6.12.45-rc1 review
Greg Kroah-Hartman
maintainercover 6.12.45-rc1 review
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.45-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.45-rc1
Mason Chang <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
Mason Chang <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data
Mason Chang <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const
Imre Deak <[email protected]>
Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
Niklas Cassel <[email protected]>
PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
Niklas Cassel <[email protected]>
PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
Eric Dumazet <[email protected]>
net: rose: fix a typo in rose_clear_routes()
Yang Wang <[email protected]>
drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
Ma Ke <[email protected]>
drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
Timur Tabi <[email protected]>
drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
James Jones <[email protected]>
drm/nouveau/disp: Always accept linear modifier
Thomas Hellström <[email protected]>
drm/xe/vm: Clear the scratch_pt pointer on error
Eric Sandeen <[email protected]>
xfs: do not propagate ENODATA disk errors into xattr code
Steve French <[email protected]>
smb3 client: fix return code mapping of remap_file_range
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
Shuhao Fu <[email protected]>
fs/smb: Fix inconsistent refcnt update
Shanker Donthineni <[email protected]>
dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
Bart Van Assche <[email protected]>
blk-zoned: Fix a lockdep complaint about recursive locking
Alex Deucher <[email protected]>
Revert "drm/amdgpu: fix incorrect vm flags to map bo"
Minjong Kim <[email protected]>
HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
Ping Cheng <[email protected]>
HID: wacom: Add a new Art Pen 2
Matt Coffin <[email protected]>
HID: logitech: Add ids for G PRO 2 LIGHTSPEED
Antheas Kapenekakis <[email protected]>
HID: quirks: add support for Legion Go dual dinput modes
Qasim Ijaz <[email protected]>
HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
Qasim Ijaz <[email protected]>
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
K Prateek Nayak <[email protected]>
x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Handle the case of no BIOS microcode
Radim Krčmář <[email protected]>
RISC-V: KVM: fix stack overrun when loading vlenb
Thijs Raymakers <[email protected]>
KVM: x86: use array_index_nospec with indices that come from guest
Neil Mandir <[email protected]>
net: macb: Disable clocks once
Li Nan <[email protected]>
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
Alexander Duyck <[email protected]>
fbnic: Move phylink resume out of service_task and into open/close
Eric Dumazet <[email protected]>
l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
Eric Dumazet <[email protected]>
sctp: initialize more fields in sctp_v6_from_sk()
Takamitsu Iwai <[email protected]>
net: rose: include node references in rose_neigh refcount
Takamitsu Iwai <[email protected]>
net: rose: convert 'use' field to refcount_t
Takamitsu Iwai <[email protected]>
net: rose: split remove and free operations in rose_remove_neigh()
Dipayaan Roy <[email protected]>
net: hv_netvsc: fix loss of early receive events from host during channel open.
Joe Damato <[email protected]>
hv_netvsc: Link queues to NAPIs
Rohan G Thomas <[email protected]>
net: stmmac: Set CIC bit only for TX queues with COE
Rohan G Thomas <[email protected]>
net: stmmac: xgmac: Correct supported speed modes
Rohan G Thomas <[email protected]>
net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
Alexei Lazar <[email protected]>
net/mlx5e: Set local Xoff after FW update
Alexei Lazar <[email protected]>
net/mlx5e: Update and set Xon/Xoff upon port speed set
Alexei Lazar <[email protected]>
net/mlx5e: Update and set Xon/Xoff upon MTU set
Moshe Shemesh <[email protected]>
net/mlx5: Nack sync reset when SFs are present
Moshe Shemesh <[email protected]>
net/mlx5: Fix lockdep assertion on sync reset unload event
Moshe Shemesh <[email protected]>
net/mlx5: Reload auxiliary drivers on fw_activate
Michael Chan <[email protected]>
bnxt_en: Fix stats context reservation logic
Michael Chan <[email protected]>
bnxt_en: Adjust TX rings if reservation is less than requested
Sreekanth Reddy <[email protected]>
bnxt_en: Fix memory corruption when FW resources change during ifdown
Horatiu Vultur <[email protected]>
phy: mscc: Fix when PTP clock is register and unregister
Matthew Brost <[email protected]>
drm/xe: Don't trigger rebind on initial dma-buf validation
Zbigniew Kempczyński <[email protected]>
drm/xe/xe_sync: avoid race during ufence signaling
Jan Kiszka <[email protected]>
efi: stmm: Fix incorrect buffer allocation method
Yeounsu Moon <[email protected]>
net: dlink: fix multicast stats being counted incorrectly
Dmitry Baryshkov <[email protected]>
dt-bindings: display/msm: qcom,mdp5: drop lut clock
Michal Kubiak <[email protected]>
ice: fix incorrect counter for buffer allocation failures
Jacob Keller <[email protected]>
ice: use fixed adapter index for E825C embedded devices
Jacob Keller <[email protected]>
ice: don't leave device non-functional if Tx scheduler config fails
Timur Tabi <[email protected]>
drm/nouveau: remove unused memory target test
Timur Tabi <[email protected]>
drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
Kuniyuki Iwashima <[email protected]>
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
Pavel Shpakovskiy <[email protected]>
Bluetooth: hci_sync: fix set_local_name race condition
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
Ludovico de Nittis <[email protected]>
Bluetooth: hci_event: Mark connection as closed during suspend disconnect
Ludovico de Nittis <[email protected]>
Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
luoguangfei <[email protected]>
net: macb: fix unregister_netdev call order in macb_remove()
José Expósito <[email protected]>
HID: input: report battery status changes immediately
José Expósito <[email protected]>
HID: input: rename hidinput_set_battery_charge_status()
Madhavan Srinivasan <[email protected]>
powerpc/kvm: Fix ifdef to remove build warning
Jason-JH Lin <[email protected]>
drm/mediatek: Add error handling for old state CRTC in atomic_disable
Ayushi Makhija <[email protected]>
drm/msm: update the high bitfield of certain DSI registers
Dmitry Baryshkov <[email protected]>
drm/msm/kms: move snapshot init earlier in KMS init
Oreoluwa Babatunde <[email protected]>
of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
Rob Clark <[email protected]>
drm/msm: Defer fd_install in SUBMIT ioctl
Oscar Maes <[email protected]>
net: ipv4: fix regression in local-broadcast routes
Nikolay Kuratov <[email protected]>
vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
Werner Sembach <[email protected]>
ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
Junli Liu <[email protected]>
erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
Alexey Klimov <[email protected]>
ASoC: codecs: tx-macro: correct tx_macro_component_drv name
Paulo Alcantara <[email protected]>
smb: client: fix race with concurrent opens in rename(2)
Paulo Alcantara <[email protected]>
smb: client: fix race with concurrent opens in unlink(2)
Damien Le Moal <[email protected]>
scsi: core: sysfs: Correct sysfs attributes access rights
Namhyung Kim <[email protected]>
vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
Ian Rogers <[email protected]>
perf symbol-minimal: Fix ehdr reading in filename__read_build_id
Tengda Wu <[email protected]>
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
Dan Carpenter <[email protected]>
of: dynamic: Fix use after free in of_changeset_add_prop_helper()
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename the etop node
Aleksander Jan Bajkowski <[email protected]>
mips: dts: lantiq: danube: add missing burst length property
Randy Dunlap <[email protected]>
pinctrl: STMFX: add missing HAS_IOMEM dependency
Lizhi Hou <[email protected]>
of: dynamic: Fix memleak when of_pci_add_properties() failed
Ye Weihua <[email protected]>
trace/fgraph: Fix the warning caused by missing unregister notifier
Tao Chen <[email protected]>
rtla: Check pkg-config install
Tao Chen <[email protected]>
tools/latency-collector: Check pkg-config install
-------------
Diffstat:
.../devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 - Makefile | 4 +- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 +- arch/mips/lantiq/xway/sysctrl.c | 10 +- arch/powerpc/kernel/kvm.c | 8 +- arch/riscv/kvm/vcpu_vector.c | 2 + arch/x86/kernel/cpu/microcode/amd.c | 22 +++- arch/x86/kernel/cpu/topology_amd.c | 27 +++-- arch/x86/kvm/lapic.c | 2 + arch/x86/kvm/x86.c | 7 +- block/blk-zoned.c | 11 +- drivers/acpi/ec.c | 6 ++ drivers/atm/atmtcp.c | 17 ++- drivers/firmware/efi/stmm/tee_stmm_efi.c | 21 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 ++-- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 ++-- drivers/gpu/drm/mediatek/mtk_plane.c | 3 +- drivers/gpu/drm/msm/msm_gem_submit.c | 14 +-- drivers/gpu/drm/msm/msm_kms.c | 10 +- drivers/gpu/drm/msm/registers/display/dsi.xml | 28 ++--- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 + drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 15 +-- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 5 +- drivers/gpu/drm/xe/xe_bo.c | 3 +- drivers/gpu/drm/xe/xe_sync.c | 2 +- drivers/gpu/drm/xe/xe_vm.c | 8 +- drivers/hid/hid-asus.c | 8 +- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-input-test.c | 10 +- drivers/hid/hid-input.c | 51 +++++---- drivers/hid/hid-logitech-dj.c | 4 + drivers/hid/hid-logitech-hidpp.c | 2 + drivers/hid/hid-multitouch.c | 8 ++ drivers/hid/hid-ntrig.c | 3 + drivers/hid/hid-quirks.c | 2 + drivers/hid/wacom_wac.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 36 +++++-- drivers/net/ethernet/cadence/macb_main.c | 9 +- drivers/net/ethernet/dlink/dl2k.c | 2 +- drivers/net/ethernet/intel/ice/ice_adapter.c | 49 +++++++-- drivers/net/ethernet/intel/ice/ice_adapter.h | 4 +- drivers/net/ethernet/intel/ice/ice_ddp.c | 44 +++++--- drivers/net/ethernet/intel/ice/ice_main.c | 16 ++- drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 +++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +++- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 114 ++++++++++++--------- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h | 1 + .../net/ethernet/mellanox/mlx5/core/sf/devlink.c | 10 ++ drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 ++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 - .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 ++- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 9 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +- drivers/net/hyperv/netvsc.c | 18 +++- drivers/net/hyperv/rndis_filter.c | 20 +++- drivers/net/phy/mscc/mscc.h | 4 + drivers/net/phy/mscc/mscc_main.c | 4 +- drivers/net/phy/mscc/mscc_ptp.c | 34 +++--- drivers/net/usb/qmi_wwan.c | 3 + drivers/of/dynamic.c | 9 +- drivers/of/of_reserved_mem.c | 16 ++- drivers/pci/controller/dwc/pcie-designware.c | 8 ++ drivers/pci/controller/plda/pcie-starfive.c | 2 +- drivers/pci/pci.h | 2 +- drivers/pinctrl/Kconfig | 1 + drivers/scsi/scsi_sysfs.c | 4 +- drivers/thermal/mediatek/lvts_thermal.c | 74 ++++++++++--- drivers/vhost/net.c | 9 +- fs/efivarfs/super.c | 4 + fs/erofs/zdata.c | 13 ++- fs/smb/client/cifsfs.c | 14 +++ fs/smb/client/inode.c | 34 +++++- fs/smb/client/smb2inode.c | 7 +- fs/xfs/libxfs/xfs_attr_remote.c | 7 ++ fs/xfs/libxfs/xfs_da_btree.c | 6 ++ include/linux/atmdev.h | 1 + include/linux/dma-map-ops.h | 3 + include/net/bluetooth/hci_sync.h | 2 +- include/net/rose.h | 18 +++- include/uapi/linux/vhost.h | 4 +- kernel/dma/contiguous.c | 2 - kernel/dma/pool.c | 4 +- kernel/trace/fgraph.c | 1 + kernel/trace/trace.c | 4 +- net/atm/common.c | 15 ++- net/bluetooth/hci_event.c | 20 +++- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 5 +- net/ipv4/route.c | 10 +- net/l2tp/l2tp_ppp.c | 25 ++--- net/rose/af_rose.c | 13 +-- net/rose/rose_in.c | 12 +-- net/rose/rose_route.c | 62 ++++++----- net/rose/rose_timer.c | 2 +- net/sctp/ipv6.c | 2 + sound/soc/codecs/lpass-tx-macro.c | 2 +- tools/perf/util/symbol-minimal.c | 55 +++++----- tools/tracing/latency/Makefile.config | 8 ++ tools/tracing/rtla/Makefile.config | 8 ++ 105 files changed, 910 insertions(+), 402 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/95 tools/latency-collector: Check pkg-config install
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 26ebba25e210116053609f4c7ee701bffa7ebd7d ]
The tool pkg-config used to check libtraceevent and libtracefs, if not installed, it will report the libs not found, even though they have already been installed.
Before:
libtraceevent is missing. Please install libtraceevent-dev/libtraceevent-devel libtracefs is missing. Please install libtracefs-dev/libtracefs-devel
After:
Makefile.config:10: *** Error: pkg-config needed by libtraceevent/libtracefs is missing on this system, please install it.
--- tools/tracing/latency/Makefile.config | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/tracing/latency/Makefile.config +8 -0
@@ -1,7 +1,15 @@ # SPDX-License-Identifier: GPL-2.0-only +include $(srctree)/tools/scripts/utilities.mak + STOP_ERROR := +ifndef ($(NO_LIBTRACEEVENT),1) + ifeq ($(call get-executable,$(PKG_CONFIG)),) + $(error Error: $(PKG_CONFIG) needed by libtraceevent/libtracefs is missing on this system, please install it) + endif +endif + define lib_setup $(eval LIB_INCLUDES += $(shell sh -c "$(PKG_CONFIG) --cflags lib$(1)")) $(eval LDFLAGS += $(shell sh -c "$(PKG_CONFIG) --libs-only-L lib$(1)"))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 2/95 rtla: Check pkg-config install
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 7b128f1d53dcaa324d4aa05d821a6bf4a7b203e7 ]
The tool pkg-config used to check libtraceevent and libtracefs, if not installed, it will report the libs not found, even though they have already been installed.
Before:
libtraceevent is missing. Please install libtraceevent-dev/libtraceevent-devel libtracefs is missing. Please install libtracefs-dev/libtracefs-devel
After:
Makefile.config:10: *** Error: pkg-config needed by libtraceevent/libtracefs is missing on this system, please install it.
--- tools/tracing/rtla/Makefile.config | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/tracing/rtla/Makefile.config +8 -0
@@ -1,10 +1,18 @@ # SPDX-License-Identifier: GPL-2.0-only +include $(srctree)/tools/scripts/utilities.mak + STOP_ERROR := LIBTRACEEVENT_MIN_VERSION = 1.5 LIBTRACEFS_MIN_VERSION = 1.6 +ifndef ($(NO_LIBTRACEEVENT),1) + ifeq ($(call get-executable,$(PKG_CONFIG)),) + $(error Error: $(PKG_CONFIG) needed by libtraceevent/libtracefs is missing on this system, please install it) + endif +endif + define lib_setup $(eval LIB_INCLUDES += $(shell sh -c "$(PKG_CONFIG) --cflags lib$(1)")) $(eval LDFLAGS += $(shell sh -c "$(PKG_CONFIG) --libs-only-L lib$(1)"))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 3/95 trace/fgraph: Fix the warning caused by missing unregister notifier
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Weihua <[email protected]>
[ Upstream commit edede7a6dcd7435395cf757d053974aaab6ab1c2 ]
This warning was triggered during testing on v6.16:
notifier callback ftrace_suspend_notifier_call already registered
WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: <TASK> blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f
When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written.
Fixed by adding unregister_pm_notifier in the exception path.
--- kernel/trace/fgraph.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/fgraph.c +1 -0
@@ -1316,6 +1316,7 @@ int register_ftrace_graph(struct fgraph_ops *gops) ftrace_graph_active--; gops->saved_func =NULL ;fgraph_lru_release_index (i); +unregister_pm_notifier (&ftrace_suspend_notifier); }return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 4/95 of: dynamic: Fix memleak when of_pci_add_properties() failed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit c81f6ce16785cc07ae81f53deb07b662ed0bb3a5 ]
When of_pci_add_properties() failed, of_changeset_destroy() is called to free the changeset. And of_changeset_destroy() puts device tree node in each entry but does not free property in the entry. This leads to memory leak in the failure case.
In of_changeset_add_prop_helper(), add the property to the device tree node deadprops list. Thus, the property will also be freed along with device tree node.
--- drivers/of/dynamic.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/of/dynamic.c +3 -0
@@ -938,6 +938,9 @@ static int of_changeset_add_prop_helper(struct of_changeset *ocs,if (ret)__of_prop_free (new_pp); + new_pp->next = np->deadprops; + np->deadprops = new_pp; +return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 5/95 pinctrl: STMFX: add missing HAS_IOMEM dependency
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit a12946bef0407cf2db0899c83d42c47c00af3fbc ]
When building on ARCH=um (which does not set HAS_IOMEM), kconfig reports an unmet dependency caused by PINCTRL_STMFX. It selects MFD_STMFX, which depends on HAS_IOMEM. To stop this warning, PINCTRL_STMFX should also depend on HAS_IOMEM.
kconfig warning:
WARNING: unmet direct dependencies detected for MFD_STMFX
Depends on [n]: HAS_IOMEM [=n] && I2C [=y] && OF [=y] Selected by [y]:
- PINCTRL_STMFX [=y] && PINCTRL [=y] && I2C [=y] && OF_GPIO [=y]
--- drivers/pinctrl/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/Kconfig +1 -0
@@ -504,6 +504,7 @@ config PINCTRL_STMFX tristate "STMicroelectronics STMFX GPIO expander pinctrl driver" depends on I2C depends on OF_GPIO + depends on HAS_IOMEM select GENERIC_PINCONF select GPIOLIB_IRQCHIP select MFD_STMFX
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 6/95 mips: dts: lantiq: danube: add missing burst length property
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 7b28232921782aa38048249132899c337405eaa8 ]
The upstream dts lacks the lantiq,{rx/tx}-burst-length property. Other
issues were also fixed:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'interrupt-names' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,tx-burst-length' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,rx-burst-length' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +3 -0
@@ -87,8 +87,11 @@ etop@e180000 { reg = <0xe180000 0x40000>; interrupt-parent = <&icu0>; interrupts = <73 78>; + interrupt-names = "tx", "rx"; phy-mode = "rmii"; mac-address = [ 00 11 22 33 44 55 ]; + lantiq,rx-burst-length = <4>; + lantiq,tx-burst-length = <4>; }; stp0: stp@e100bb0 {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 7/95 mips: lantiq: xway: sysctrl: rename the etop node
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 8c431ea8f3f795c4b9cfa57a85bc4166b9cce0ac ]
Bindig requires a node name matching ‘^ethernet@[0-9a-f]+$’. This patch changes the clock name from “etop” to “ethernet”.
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): $nodename:0: 'etop@e180000' does not match '^ethernet@[0-9a-f]+$'
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +- arch/mips/lantiq/xway/sysctrl.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +1 -1
@@ -82,7 +82,7 @@ conf_out { }; }; - etop@e180000 { + ethernet@e180000 { compatible = "lantiq,etop-xway"; reg = <0xe180000 0x40000>; interrupt-parent = <&icu0>;
arch/mips/lantiq/xway/sysctrl.c +5 -5
@@ -497,7 +497,7 @@ void __init ltq_soc_init(void) ifccr =CGU_IFCCR_VR9 ; pcicr =CGU_PCICR_VR9 ; }else { -clkdev_add_pmu ("1e180000.etop" ,NULL ,1 ,0 ,PMU_PPE ); +clkdev_add_pmu ("1e180000.ethernet" ,NULL ,1 ,0 ,PMU_PPE ); }if (!of_machine_is_compatible ("lantiq,ase" ))
@@ -531,9 +531,9 @@ void __init ltq_soc_init(void) CLOCK_133M, CLOCK_133M);clkdev_add_pmu ("1e101000.usb" ,"otg" ,1 ,0 ,PMU_USB0 );clkdev_add_pmu ("1f203018.usb2-phy" ,"phy" ,1 ,0 ,PMU_USB0_P ); -clkdev_add_pmu ("1e180000.etop" ,"ppe" ,1 ,0 ,PMU_PPE ); -clkdev_add_cgu ("1e180000.etop" ,"ephycgu" ,CGU_EPHY ); -clkdev_add_pmu ("1e180000.etop" ,"ephy" ,1 ,0 ,PMU_EPHY ); +clkdev_add_pmu ("1e180000.ethernet" ,"ppe" ,1 ,0 ,PMU_PPE ); +clkdev_add_cgu ("1e180000.ethernet" ,"ephycgu" ,CGU_EPHY ); +clkdev_add_pmu ("1e180000.ethernet" ,"ephy" ,1 ,0 ,PMU_EPHY );clkdev_add_pmu ("1e103000.sdio" ,NULL ,1 ,0 ,PMU_ASE_SDIO );clkdev_add_pmu ("1e116000.mei" ,"dfe" ,1 ,0 ,PMU_DFE ); }else if (of_machine_is_compatible ("lantiq,grx390" )) {
@@ -592,7 +592,7 @@ void __init ltq_soc_init(void)clkdev_add_pmu ("1e101000.usb" ,"otg" ,1 ,0 ,PMU_USB0 |PMU_AHBM );clkdev_add_pmu ("1f203034.usb2-phy" ,"phy" ,1 ,0 ,PMU_USB1_P );clkdev_add_pmu ("1e106000.usb" ,"otg" ,1 ,0 ,PMU_USB1 |PMU_AHBM ); -clkdev_add_pmu ("1e180000.etop" ,"switch" ,1 ,0 ,PMU_SWITCH ); +clkdev_add_pmu ("1e180000.ethernet" ,"switch" ,1 ,0 ,PMU_SWITCH );clkdev_add_pmu ("1e103000.sdio" ,NULL ,1 ,0 ,PMU_SDIO );clkdev_add_pmu ("1e103100.deu" ,NULL ,1 ,0 ,PMU_DEU );clkdev_add_pmu ("1e116000.mei" ,"dfe" ,1 ,0 ,PMU_DFE );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 8/95 of: dynamic: Fix use after free in of_changeset_add_prop_helper()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 80af3745ca465c6c47e833c1902004a7fa944f37 ]
If the of_changeset_add_property() function call fails, then this code frees "new_pp" and then dereference it on the next line. Return the error code directly instead.
--- drivers/of/dynamic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/of/dynamic.c +4 -2
@@ -935,13 +935,15 @@ static int of_changeset_add_prop_helper(struct of_changeset *ocs,return -ENOMEM ; ret =of_changeset_add_property (ocs, np, new_pp); -if (ret) +if (ret) {__of_prop_free (new_pp); +return ret; + } new_pp->next = np->deadprops; np->deadprops = new_pp; -return ret; +return 0 ; }/**
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 9/95 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit 4013aef2ced9b756a410f50d12df9ebe6a883e4a ]
When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition.
The issue occurs because:
CPU0 (ftrace_dump) CPU1 (reader)
echo z > /proc/sysrq-trigger
!trace_empty(&iter)trace_iterator_reset(&iter) <- len = size = 0
cat /sys/kernel/tracing/trace_pipetrace_find_next_entry_inc(&iter)
__find_next_entry
ring_buffer_empty_cpu <- all empty
return NULL
trace_printk_seq(&iter.seq)
WARN_ON_ONCE(s->seq.len >= s->seq.size)
In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate iter.seq. At this point, due to the prior trace_iterator_reset, both iter.seq.len and iter.seq.size were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered.
Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.
--- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/trace.c +2 -2
@@ -10130,10 +10130,10 @@ static void ftrace_dump_one(struct trace_array *tr, enum ftrace_dump_mode dump_m ret =print_trace_line (&iter);if (ret !=TRACE_TYPE_NO_CONSUME )trace_consume (&iter); + +trace_printk_seq (&iter.seq); }touch_nmi_watchdog (); - -trace_printk_seq (&iter.seq); }if (!cnt)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 10/95 perf symbol-minimal: Fix ehdr reading in filename__read_build_id
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit ba0b7081f7a521d7c28b527a4f18666a148471e7 ]
The e_ident is part of the ehdr and so reading it a second time would mean the read ehdr was displaced by 16-bytes. Switch from stdio to open/read/lseek syscalls for similarity with the symbol-elf version of the function and so that later changes can alter then open flags.
--- tools/perf/util/symbol-minimal.c | 55 ++++++++++++++++---------------- 1 file changed, 27 insertions(+), 28 deletions(-)
tools/perf/util/symbol-minimal.c +27 -28
@@ -4,7 +4,6 @@#include <errno.h> #include <unistd.h> -#include <stdio.h> #include <fcntl.h> #include <string.h> #include <stdlib.h>
@@ -88,11 +87,8 @@ int filename__read_debuglink(const char *filename __maybe_unused,*/ int filename__read_build_id(const char *filename, struct build_id *bid) { - FILE *fp; - int ret = -1; + int fd, ret = -1; bool need_swap = false, elf32; - u8 e_ident[EI_NIDENT]; - int i; union { struct { Elf32_Ehdr ehdr32;
@@ -103,28 +99,27 @@ int filename__read_build_id(const char *filename, struct build_id *bid)Elf64_Phdr *phdr64; }; } hdrs; -void *phdr; -size_t phdr_size; -void *buf =NULL ; -size_t buf_size =0 ; +void *phdr, *buf =NULL ; +ssize_t phdr_size, ehdr_size, buf_size =0 ; - fp =fopen (filename,"r" ); -if (fp ==NULL ) + fd =open (filename,O_RDONLY ); +if (fd <0 )return -1 ; -if (fread (e_ident,sizeof (e_ident),1 , fp) !=1 ) +if (read (fd, hdrs.ehdr32.e_ident,EI_NIDENT ) !=EI_NIDENT ) goto out; -if (memcmp (e_ident,ELFMAG ,SELFMAG ) || - e_ident[EI_VERSION ] !=EV_CURRENT ) +if (memcmp (hdrs.ehdr32.e_ident,ELFMAG ,SELFMAG ) || + hdrs.ehdr32.e_ident[EI_VERSION ] !=EV_CURRENT ) goto out; - need_swap =check_need_swap (e_ident[EI_DATA ]); - elf32 = e_ident[EI_CLASS ] ==ELFCLASS32 ; + need_swap =check_need_swap (hdrs.ehdr32.e_ident[EI_DATA ]); + elf32 = hdrs.ehdr32.e_ident[EI_CLASS ] ==ELFCLASS32 ; + ehdr_size = (elf32 ?sizeof (hdrs.ehdr32) :sizeof (hdrs.ehdr64)) -EI_NIDENT ; -if (fread (elf32 ? (void *)&hdrs.ehdr32 : (void *)&hdrs.ehdr64, - elf32 ?sizeof (hdrs.ehdr32) :sizeof (hdrs.ehdr64), -1 , fp) !=1 ) +if (read (fd, + (elf32 ? (void *)&hdrs.ehdr32 : (void *)&hdrs.ehdr64) +EI_NIDENT , + ehdr_size) != ehdr_size) goto out;if (need_swap) {
@@ -138,14 +133,18 @@ int filename__read_build_id(const char *filename, struct build_id *bid) hdrs.ehdr64.e_phnum =bswap_16 (hdrs.ehdr64.e_phnum); } } - phdr_size = elf32 ? hdrs.ehdr32.e_phentsize * hdrs.ehdr32.e_phnum - : hdrs.ehdr64.e_phentsize * hdrs.ehdr64.e_phnum; +if ((elf32 && hdrs.ehdr32.e_phentsize !=sizeof (Elf32_Phdr)) || + (!elf32 && hdrs.ehdr64.e_phentsize !=sizeof (Elf64_Phdr))) + goto out; + + phdr_size = elf32 ?sizeof (Elf32_Phdr) * hdrs.ehdr32.e_phnum + :sizeof (Elf64_Phdr) * hdrs.ehdr64.e_phnum; phdr =malloc (phdr_size);if (phdr ==NULL ) goto out; -fseek (fp, elf32 ? hdrs.ehdr32.e_phoff : hdrs.ehdr64.e_phoff,SEEK_SET ); -if (fread (phdr, phdr_size,1 , fp) !=1 ) +lseek (fd, elf32 ? hdrs.ehdr32.e_phoff : hdrs.ehdr64.e_phoff,SEEK_SET ); +if (read (fd, phdr, phdr_size) != phdr_size) goto out_free;if (elf32)
@@ -153,8 +152,8 @@ int filename__read_build_id(const char *filename, struct build_id *bid)else hdrs.phdr64 = phdr; -for (i =0 ; i < elf32 ? hdrs.ehdr32.e_phnum : hdrs.ehdr64.e_phnum; i++) { -size_t p_filesz; +for (int i =0 ; i < (elf32 ? hdrs.ehdr32.e_phnum : hdrs.ehdr64.e_phnum); i++) { +ssize_t p_filesz;if (need_swap) {if (elf32) {
@@ -180,8 +179,8 @@ int filename__read_build_id(const char *filename, struct build_id *bid) goto out_free; buf = tmp; } -fseek (fp, elf32 ? hdrs.phdr32[i].p_offset : hdrs.phdr64[i].p_offset,SEEK_SET ); -if (fread (buf, p_filesz,1 , fp) !=1 ) +lseek (fd, elf32 ? hdrs.phdr32[i].p_offset : hdrs.phdr64[i].p_offset,SEEK_SET ); +if (read (fd, buf, p_filesz) != p_filesz) goto out_free; ret =read_build_id (buf, p_filesz, bid, need_swap);
@@ -194,7 +193,7 @@ int filename__read_build_id(const char *filename, struct build_id *bid)free (buf);free (phdr); out: -fclose (fp); +close (fd);return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 11/95 vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 24fc631539cc78225f5c61f99c7666fcff48024d ]
The VHOST_[GS]ET_FEATURES_ARRAY ioctl already took 0x83 and it would result in a build error when the vhost uapi header is used for perf tool build like below.
In file included from trace/beauty/ioctl.c:93:
tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c: In function ‘ioctl__scnprintf_vhost_virtio_cmd’:
tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: error: initialized field overwritten [-Werror=override-init]
36 | [0x83] = "SET_FORK_FROM_OWNER",
| ^~~~~~~~~~~~~~~~~~~~~ tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: note: (near initialization for ‘vhost_virtio_ioctl_cmds[131]’)
Message-Id: <[email protected]>
--- include/uapi/linux/vhost.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/uapi/linux/vhost.h +2 -2
@@ -254,7 +254,7 @@* When fork_owner is set to VHOST_FORK_OWNER_KTHREAD: * - Vhost will create vhost workers as kernel threads. */ -#define VHOST_SET_FORK_FROM_OWNER _IOW(VHOST_VIRTIO, 0x83, __u8) +#define VHOST_SET_FORK_FROM_OWNER _IOW(VHOST_VIRTIO, 0x84, __u8)/** * VHOST_GET_FORK_OWNER - Get the current fork_owner flag for the vhost device.
@@ -262,6 +262,6 @@* * @return: An 8-bit value indicating the current thread mode. */ -#define VHOST_GET_FORK_FROM_OWNER _IOR(VHOST_VIRTIO, 0x84, __u8) +#define VHOST_GET_FORK_FROM_OWNER _IOR(VHOST_VIRTIO, 0x85, __u8)#endif
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 12/95 scsi: core: sysfs: Correct sysfs attributes access rights
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit a2f54ff15c3bdc0132e20aae041607e2320dbd73 ]
The SCSI sysfs attributes "supported_mode" and "active_mode" do not define a store method and thus cannot be modified. Correct the DEVICE_ATTR() call for these two attributes to not include S_IWUSR to allow write access as they are read-only.
--- drivers/scsi/scsi_sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/scsi_sysfs.c +2 -2
@@ -265,7 +265,7 @@ show_shost_supported_mode(struct device *dev, struct device_attribute *attr,return show_shost_mode (supported_mode, buf); } -static DEVICE_ATTR(supported_mode, S_IRUGO | S_IWUSR, show_shost_supported_mode, NULL); +static DEVICE_ATTR(supported_mode, S_IRUGO, show_shost_supported_mode, NULL); static ssize_t show_shost_active_mode(struct device *dev,
@@ -279,7 +279,7 @@ show_shost_active_mode(struct device *dev,return show_shost_mode (shost->active_mode, buf); } -static DEVICE_ATTR(active_mode, S_IRUGO | S_IWUSR, show_shost_active_mode, NULL); +static DEVICE_ATTR(active_mode, S_IRUGO, show_shost_active_mode, NULL);static int check_reset_type (const char *str) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 13/95 smb: client: fix race with concurrent opens in unlink(2)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 0af1561b2d60bab2a2b00720a5c7b292ecc549ec ]
According to some logs reported by customers, CIFS client might end up reporting unlinked files as existing in stat(2) due to concurrent opens racing with unlink(2).
Besides sending the removal request to the server, the unlink process could involve closing any deferred close as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens.
Fix this by unhashing the dentry in cifs_unlink() to prevent any subsequent opens. Any open attempts, while we're still unlinking, will block on parent's i_rwsem.
--- fs/smb/client/inode.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
fs/smb/client/inode.c +14 -2
@@ -1917,15 +1917,24 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)struct cifs_sb_info *cifs_sb =CIFS_SB (sb);struct tcon_link *tlink;struct cifs_tcon *tcon; +__u32 dosattr =0 , origattr =0 ;struct TCP_Server_Info *server;struct iattr *attrs =NULL ; -__u32 dosattr =0 , origattr =0 ; +bool rehash = false;cifs_dbg (FYI ,"cifs_unlink, dir=0x%p, dentry=0x%p\n" , dir, dentry);if (unlikely (cifs_forced_shutdown (cifs_sb)))return -EIO ; +/* Unhash dentry in advance to prevent any concurrent opens */ +spin_lock (&dentry->d_lock); +if (!d_unhashed (dentry)) { +__d_drop (dentry); + rehash = true; + } +spin_unlock (&dentry->d_lock); + tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink);
@@ -1977,7 +1986,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)cifs_drop_nlink (inode); } }else if (rc == -ENOENT ) { -d_drop (dentry); +if (simple_positive (dentry)) +d_delete (dentry); }else if (rc == -EBUSY ) {if (server->ops->rename_pending_delete) { rc = server->ops->rename_pending_delete(full_path,
@@ -2030,6 +2040,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)kfree (attrs);free_xid (xid);cifs_put_tlink (tlink); +if (rehash) +d_rehash (dentry);return rc; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 14/95 smb: client: fix race with concurrent opens in rename(2)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit d84291fc7453df7881a970716f8256273aca5747 ]
Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file.
Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.
--- fs/smb/client/inode.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
fs/smb/client/inode.c +18 -0
@@ -2441,6 +2441,7 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir,struct cifs_sb_info *cifs_sb;struct tcon_link *tlink;struct cifs_tcon *tcon; +bool rehash = false;unsigned int xid;int rc, tmprc;int retry_count =0 ;
@@ -2456,6 +2457,17 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir,if (unlikely (cifs_forced_shutdown (cifs_sb)))return -EIO ; +/* +* Prevent any concurrent opens on the target by unhashing the dentry. +* VFS already unhashes the target when renaming directories. +*/ +if (d_is_positive (target_dentry) && !d_is_dir (target_dentry)) { +if (!d_unhashed (target_dentry)) { +d_drop (target_dentry); + rehash = true; + } + } + tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink);
@@ -2497,6 +2509,8 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, } } +if (!rc) + rehash = false;/* * No-replace is the natural behavior for CIFS, so skip unlink hacks. */
@@ -2555,12 +2569,16 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, goto cifs_rename_exit; rc =cifs_do_rename (xid, source_dentry, from_name, target_dentry, to_name); +if (!rc) + rehash = false; }/* force revalidate to go get info when needed */ CIFS_I (source_dir)->time =CIFS_I (target_dir)->time =0 ; cifs_rename_exit: +if (rehash) +d_rehash (target_dentry);kfree (info_buf_source);free_dentry_path (page2);free_dentry_path (page1);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 15/95 ASoC: codecs: tx-macro: correct tx_macro_component_drv name
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
[ Upstream commit 43e0da37d5cfb23eec6aeee9422f84d86621ce2b ]
We already have a component driver named "RX-MACRO", which is lpass-rx-macro.c. The tx macro component driver's name should be "TX-MACRO" accordingly. Fix it.
--- sound/soc/codecs/lpass-tx-macro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/lpass-tx-macro.c +1 -1
@@ -2230,7 +2230,7 @@ static int tx_macro_register_mclk_output(struct tx_macro *tx) }static const struct snd_soc_component_driver tx_macro_component_drv = { - .name ="RX-MACRO" , + .name ="TX-MACRO" , .probe = tx_macro_component_probe, .controls = tx_macro_snd_controls, .num_controls =ARRAY_SIZE (tx_macro_snd_controls),
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 16/95 erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junli Liu <[email protected]>
[ Upstream commit c99fab6e80b76422741d34aafc2f930a482afbdd ]
Since EROFS handles decompression in non-atomic contexts due to uncontrollable decompression latencies and vmap() usage, it tries to detect atomic contexts and only kicks off a kworker on demand in order to reduce unnecessary scheduling overhead.
However, the current approach is insufficient and can lead to sleeping function calls in invalid contexts, causing kernel warnings and potential system instability. See the stacktrace [1] and previous discussion [2].
The current implementation only checks rcu_read_lock_any_held(), which behaves inconsistently across different kernel configurations:
- When CONFIG_DEBUG_LOCK_ALLOC is enabled: correctly detects RCU critical sections by checking rcu_lock_map
- When CONFIG_DEBUG_LOCK_ALLOC is disabled: compiles to "!preemptible()", which only checks preempt_count and misses RCU critical sections
This patch introduces z_erofs_in_atomic() to provide comprehensive atomic context detection:
1. Check RCU preemption depth when CONFIG_PREEMPTION is enabled, as RCU critical sections may not affect preempt_count but still require atomic handling
2. Always use async processing when CONFIG_PREEMPT_COUNT is disabled, as preemption state cannot be reliably determined
3. Fall back to standard preemptible() check for remaining cases
The function replaces the previous complex condition check and ensures that z_erofs always uses (kthread_)work in atomic contexts to minimize scheduling overhead and prevent sleeping in invalid contexts.
[1] Problem stacktrace
[ 61.266692] BUG: sleeping function called from invalid context at kernel/locking/rtmutex_api.c:510 [ 61.266702] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 107, name: irq/54-ufshcd [ 61.266704] preempt_count: 0, expected: 0 [ 61.266705] RCU nest depth: 2, expected: 0 [ 61.266710] CPU: 0 UID: 0 PID: 107 Comm: irq/54-ufshcd Tainted: G W O 6.12.17 #1 [ 61.266714] Tainted: [W]=WARN, [O]=OOT_MODULE [ 61.266715] Hardware name: schumacher (DT) [ 61.266717] Call trace: [ 61.266718] dump_backtrace+0x9c/0x100 [ 61.266727] show_stack+0x20/0x38 [ 61.266728] dump_stack_lvl+0x78/0x90 [ 61.266734] dump_stack+0x18/0x28 [ 61.266736] __might_resched+0x11c/0x180 [ 61.266743] __might_sleep+0x64/0xc8 [ 61.266745] mutex_lock+0x2c/0xc0 [ 61.266748] z_erofs_decompress_queue+0xe8/0x978 [ 61.266753] z_erofs_decompress_kickoff+0xa8/0x190 [ 61.266756] z_erofs_endio+0x168/0x288 [ 61.266758] bio_endio+0x160/0x218 [ 61.266762] blk_update_request+0x244/0x458 [ 61.266766] scsi_end_request+0x38/0x278 [ 61.266770] scsi_io_completion+0x4c/0x600 [ 61.266772] scsi_finish_command+0xc8/0xe8 [ 61.266775] scsi_complete+0x88/0x148 [ 61.266777] blk_mq_complete_request+0x3c/0x58 [ 61.266780] scsi_done_internal+0xcc/0x158 [ 61.266782] scsi_done+0x1c/0x30 [ 61.266783] ufshcd_compl_one_cqe+0x12c/0x438 [ 61.266786] __ufshcd_transfer_req_compl+0x2c/0x78 [ 61.266788] ufshcd_poll+0xf4/0x210 [ 61.266789] ufshcd_transfer_req_compl+0x50/0x88 [ 61.266791] ufshcd_intr+0x21c/0x7c8 [ 61.266792] irq_forced_thread_fn+0x44/0xd8 [ 61.266796] irq_thread+0x1a4/0x358 [ 61.266799] kthread+0x12c/0x138 [ 61.266802] ret_from_fork+0x10/0x20
[2] https://lore.kernel.org/r/58b661d0-0ebb-4b45-a10d-c5927fb791cd@paulmck-laptop
--- fs/erofs/zdata.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/erofs/zdata.c +11 -2
@@ -1410,6 +1410,16 @@ static void z_erofs_decompressqueue_kthread_work(struct kthread_work *work) }#endif +/* Use (kthread_)work in atomic contexts to minimize scheduling overhead */ +static inline bool z_erofs_in_atomic (void ) +{ +if (IS_ENABLED (CONFIG_PREEMPTION ) &&rcu_preempt_depth ()) +return true; +if (!IS_ENABLED (CONFIG_PREEMPT_COUNT )) +return true; +return !preemptible (); +} +static void z_erofs_decompress_kickoff (struct z_erofs_decompressqueue *io,int bios) {
@@ -1424,8 +1434,7 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io,if (atomic_add_return (bios, &io->pending_bios))return ; -/* Use (kthread_)work and sync decompression for atomic contexts only */ -if (!in_task () ||irqs_disabled () ||rcu_read_lock_any_held ()) { +if (z_erofs_in_atomic ()) {#ifdef CONFIG_EROFS_FS_PCPU_KTHREAD struct kthread_worker *worker;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 17/95 ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit 9cd51eefae3c871440b93c03716c5398f41bdf78 upstream.
Add the TUXEDO InfinityBook Pro AMD Gen9 to the acpi_ec_no_wakeup[] quirk list to prevent spurious wakeups.
--- drivers/acpi/ec.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/ec.c +6 -0
@@ -2329,6 +2329,12 @@ static const struct dmi_system_id acpi_e DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), } }, + { +// TUXEDO InfinityBook Pro AMD Gen9 + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GXxHRXx"), + }, + }, { }, };
Greg Kroah-Hartman
maintainerPATCH 18/95 vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Kuratov <[email protected]>
commit dd54bcf86c91a4455b1f95cbc8e9ac91205f3193 upstream.
When operating on struct vhost_net_ubuf_ref, the following execution sequence is theoretically possible:
CPU0 is finalizing DMA operation CPU1 is doing VHOST_NET_SET_BACKEND
// ubufs->refcount == 2
vhost_net_ubuf_put() vhost_net_ubuf_put_wait_and_free(oldubufs)
vhost_net_ubuf_put_and_wait()
vhost_net_ubuf_put()
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 1
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 0
wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
// no wait occurs here because condition is already true
kfree(ubufs);if (unlikely(!r))
wake_up(&ubufs->wait); // use-after-free
This leads to use-after-free on ubufs access. This happens because CPU1 skips waiting for wake_up() when refcount is already zero.
To prevent that use a read-side RCU critical section in vhost_net_ubuf_put(), as suggested by Hillf Danton. For this lock to take effect, free ubufs with kfree_rcu().
Message-Id: <[email protected]>
--- drivers/vhost/net.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/vhost/net.c +7 -2
@@ -96,6 +96,7 @@ struct vhost_net_ubuf_ref {atomic_t refcount;wait_queue_head_t wait;struct vhost_virtqueue *vq; +struct rcu_head rcu; };#define VHOST_NET_BATCH 64
@@ -247,9 +248,13 @@ vhost_net_ubuf_alloc(struct vhost_virtqustatic int vhost_net_ubuf_put (struct vhost_net_ubuf_ref *ubufs) { -int r =atomic_sub_return (1 , &ubufs->refcount); +int r; + +rcu_read_lock (); + r =atomic_sub_return (1 , &ubufs->refcount);if (unlikely (!r))wake_up (&ubufs->wait); +rcu_read_unlock ();return r; }
@@ -262,7 +267,7 @@ static void vhost_net_ubuf_put_and_wait(static void vhost_net_ubuf_put_wait_and_free (struct vhost_net_ubuf_ref *ubufs) {vhost_net_ubuf_put_and_wait (ubufs); -kfree (ubufs); +kfree_rcu (ubufs, rcu); }static void vhost_net_clear_ubuf_info (struct vhost_net *n)
Greg Kroah-Hartman
maintainerPATCH 19/95 net: ipv4: fix regression in local-broadcast routes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Maes <[email protected]>
[ Upstream commit 5189446ba995556eaa3755a6e875bc06675b88bd ]
Commit 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes") introduced a regression where local-broadcast packets would have their gateway set in __mkroute_output, which was caused by fi = NULL being removed.
Fix this by resetting the fib_info for local-broadcast packets. This preserves the intended changes for directed-broadcast packets.
--- net/ipv4/route.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/ipv4/route.c +7 -3
@@ -2532,12 +2532,16 @@ static struct rtable *__mkroute_output(const struct fib_result *res, !netif_is_l3_master(dev_out))return ERR_PTR (-EINVAL ); -if (ipv4_is_lbcast (fl4->daddr)) +if (ipv4_is_lbcast (fl4->daddr)) { type =RTN_BROADCAST ; -else if (ipv4_is_multicast (fl4->daddr)) + +/* reset fi to prevent gateway resolution */ + fi =NULL ; + }else if (ipv4_is_multicast (fl4->daddr)) { type =RTN_MULTICAST ; -else if (ipv4_is_zeronet (fl4->daddr)) + }else if (ipv4_is_zeronet (fl4->daddr)) {return ERR_PTR (-EINVAL ); + }if (dev_out->flags &IFF_LOOPBACK ) flags |=RTCF_LOCAL ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 20/95 drm/msm: Defer fd_install in SUBMIT ioctl
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit f22853435bbd1e9836d0dce7fd99c040b94c2bf1 ]
Avoid fd_install() until there are no more potential error paths, to avoid put_unused_fd() after the fd is made visible to userspace.
Patchwork: https://patchwork.freedesktop.org/patch/665363/
--- drivers/gpu/drm/msm/msm_gem_submit.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/msm_gem_submit.c +7 -7
@@ -879,12 +879,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,if (ret ==0 && args->flags &MSM_SUBMIT_FENCE_FD_OUT ) { sync_file =sync_file_create (submit->user_fence); -if (!sync_file) { +if (!sync_file) ret = -ENOMEM ; - }else { -fd_install (out_fence_fd, sync_file->file); - args->fence_fd = out_fence_fd; - } }if (ret)
@@ -912,10 +908,14 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, out_unlock:mutex_unlock (&queue->lock); out_post_unlock: -if (ret && (out_fence_fd >=0 )) { -put_unused_fd (out_fence_fd); +if (ret) { +if (out_fence_fd >=0 ) +put_unused_fd (out_fence_fd);if (sync_file)fput (sync_file->file); + }else if (sync_file) { +fd_install (out_fence_fd, sync_file->file); + args->fence_fd = out_fence_fd; }if (!IS_ERR_OR_NULL (submit)) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 21/95 of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oreoluwa Babatunde <[email protected]>
[ Upstream commit 2c223f7239f376a90d71903ec474ba887cf21d94 ]
Restructure the call site for dma_contiguous_early_fixup() to where the reserved_mem nodes are being parsed from the DT so that dma_mmu_remap[] is populated before dma_contiguous_remap() is called.
--- drivers/of/of_reserved_mem.c | 16 ++++++++++++---- include/linux/dma-map-ops.h | 3 +++ kernel/dma/contiguous.c | 2 -- 3 files changed, 15 insertions(+), 6 deletions(-)
drivers/of/of_reserved_mem.c +12 -4
@@ -24,6 +24,7 @@#include <linux/memblock.h> #include <linux/kmemleak.h> #include <linux/cma.h> +#include <linux/dma-map-ops.h> #include "of_private.h"
@@ -128,13 +129,17 @@ static int __init __reserved_mem_reserve_reg(unsigned long node, base =dt_mem_next_cell (dt_root_addr_cells, &prop); size =dt_mem_next_cell (dt_root_size_cells, &prop); -if (size && -early_init_dt_reserve_memory (base, size, nomap) ==0 ) +if (size &&early_init_dt_reserve_memory (base, size, nomap) ==0 ) { +/* Architecture specific contiguous memory fixup. */ +if (of_flat_dt_is_compatible (node,"shared-dma-pool" ) && +of_get_flat_dt_prop (node,"reusable" ,NULL )) +dma_contiguous_early_fixup (base, size);pr_debug ("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n" , uname, &base, (unsigned long )(size /SZ_1M )); -else + }else {pr_err ("Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\n" , uname, &base, (unsigned long )(size /SZ_1M )); + } len -= t_len; }
@@ -417,7 +422,10 @@ static int __init __reserved_mem_alloc_size(unsigned long node, const char *unam uname, (unsigned long)(size / SZ_1M));return -ENOMEM ; } - +/* Architecture specific contiguous memory fixup. */ +if (of_flat_dt_is_compatible (node,"shared-dma-pool" ) && +of_get_flat_dt_prop (node,"reusable" ,NULL )) +dma_contiguous_early_fixup (base, size);/* Save region in the reserved_mem array */ fdt_reserved_mem_save_node (node, uname, base, size);return 0 ;
include/linux/dma-map-ops.h +3 -0
@@ -153,6 +153,9 @@ static inline void dma_free_contiguous(struct device *dev, struct page *page, {__free_pages (page,get_order (size)); } +static inline void dma_contiguous_early_fixup (phys_addr_t base,unsigned long size) +{ +}#endif /* CONFIG_DMA_CMA*/ #ifdef CONFIG_DMA_DECLARE_COHERENT
kernel/dma/contiguous.c +0 -2
@@ -480,8 +480,6 @@ static int __init rmem_cma_setup(struct reserved_mem *rmem)pr_err ("Reserved memory: unable to setup CMA region\n" );return err; } -/* Architecture specific contiguous memory fixup. */ -dma_contiguous_early_fixup (rmem->base, rmem->size);if (default_cma) dma_contiguous_default_area = cma;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 22/95 drm/msm/kms: move snapshot init earlier in KMS init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 553666f839b86545300773954df7426a45c169c4 ]
Various parts of the display driver can be triggering the display snapshot (including the IOMMU fault handlers). Move the call to msm_disp_snapshot_init() before KMS initialization, otherwise it is possible to ocassionally trigger the kernel fault during init:
__lock_acquire+0x44/0x2798 (P) lock_acquire+0x114/0x25c _raw_spin_lock_irqsave+0x6c/0x90 kthread_queue_work+0x2c/0xac msm_disp_snapshot_state+0x2c/0x4c msm_kms_fault_handler+0x2c/0x74 msm_disp_fault_handler+0x30/0x48 report_iommu_fault+0x54/0x128 arm_smmu_context_fault+0x74/0x184 __handle_irq_event_percpu+0xa4/0x24c handle_irq_event_percpu+0x20/0x5c handle_irq_event+0x48/0x84 handle_fasteoi_irq+0xcc/0x170 generic_handle_domain_irq+0x48/0x70 gic_handle_irq+0x54/0x11c call_on_irq_stack+0x3c/0x50 do_interrupt_handler+0x54/0x78 el1_interrupt+0x3c/0x5c el1h_64_irq_handler+0x20/0x30 el1h_64_irq+0x6c/0x70 _raw_spin_unlock_irqrestore+0x44/0x68 (P) klist_next+0xc4/0x124 bus_for_each_drv+0x9c/0xe8 __device_attach+0xfc/0x190 device_initial_probe+0x1c/0x2c bus_probe_device+0x44/0xa0 device_add+0x204/0x3e4 platform_device_add+0x170/0x244 platform_device_register_full+0x130/0x138 drm_connector_hdmi_audio_init+0xc0/0x108 drm_bridge_connector_init+0x318/0x394 msm_dsi_manager_connector_init+0xac/0xdc msm_dsi_modeset_init+0x78/0xc0 _dpu_kms_drm_obj_init+0x198/0x75c dpu_kms_hw_init+0x2f8/0x494 msm_drm_kms_init+0xb0/0x230 msm_drm_init+0x218/0x250 msm_drm_bind+0x3c/0x4c try_to_bring_up_aggregate_device+0x208/0x2a4 __component_add+0xa8/0x188 component_add+0x1c/0x2c dsi_dev_attach+0x24/0x34 dsi_host_attach+0x68/0xa0 devm_mipi_dsi_attach+0x40/0xcc lt9611_attach_dsi+0x94/0x118 lt9611_probe+0x368/0x3c8 i2c_device_probe+0x2d0/0x3d8 really_probe+0x130/0x354 __driver_probe_device+0xac/0x110 driver_probe_device+0x44/0x110 __device_attach_driver+0xb0/0x138 bus_for_each_drv+0x90/0xe8 __device_attach+0xfc/0x190 device_initial_probe+0x1c/0x2c bus_probe_device+0x44/0xa0 deferred_probe_work_func+0xac/0x110 process_one_work+0x20c/0x51c process_scheduled_works+0x58/0x88 worker_thread+0x1ec/0x304 kthread+0x194/0x1d4 ret_from_fork+0x10/0x20
Patchwork: https://patchwork.freedesktop.org/patch/664149/
--- drivers/gpu/drm/msm/msm_kms.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/msm_kms.c +6 -4
@@ -241,6 +241,12 @@ int msm_drm_kms_init(struct device *dev, const struct drm_driver *drv)if (ret)return ret; + ret =msm_disp_snapshot_init (ddev); +if (ret) { +DRM_DEV_ERROR (dev,"msm_disp_snapshot_init failed ret = %d\n" , ret); +return ret; + } + ret = priv->kms_init (ddev);if (ret) {DRM_DEV_ERROR (dev,"failed to load kms\n" );
@@ -293,10 +299,6 @@ int msm_drm_kms_init(struct device *dev, const struct drm_driver *drv) goto err_msm_uninit; } - ret =msm_disp_snapshot_init (ddev); -if (ret) -DRM_DEV_ERROR (dev,"msm_disp_snapshot_init failed ret = %d\n" , ret); -drm_mode_config_reset (ddev);return 0 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 23/95 drm/msm: update the high bitfield of certain DSI registers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ayushi Makhija <[email protected]>
[ Upstream commit 494045c561e68945b1183ff416b8db8e37a122d6 ]
Currently, the high bitfield of certain DSI registers do not align with the configuration of the SWI registers description. This can lead to wrong programming these DSI registers, for example for 4k resloution where H_TOTAL is taking 13 bits but software is programming only 12 bits because of the incorrect bitmask for H_TOTAL bitfeild, this is causing DSI FIFO errors. To resolve this issue, increase the high bitfield of the DSI registers from 12 bits to 16 bits in dsi.xml to match the SWI register configuration.
Patchwork: https://patchwork.freedesktop.org/patch/666229/
--- drivers/gpu/drm/msm/registers/display/dsi.xml | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/gpu/drm/msm/registers/display/dsi.xml +14 -14
@@ -159,28 +159,28 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd"> <bitfield name="RGB_SWAP" low="12" high="14" type="dsi_rgb_swap"/> </reg32> <reg32 offset="0x00020" name="ACTIVE_H"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00024" name="ACTIVE_V"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00028" name="TOTAL"> - <bitfield name="H_TOTAL" low="0" high="11" type="uint"/> - <bitfield name="V_TOTAL" low="16" high="27" type="uint"/> + <bitfield name="H_TOTAL" low="0" high="15" type="uint"/> + <bitfield name="V_TOTAL" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x0002c" name="ACTIVE_HSYNC"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00030" name="ACTIVE_VSYNC_HPOS"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00034" name="ACTIVE_VSYNC_VPOS"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00038" name="CMD_DMA_CTRL">
@@ -209,8 +209,8 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd"> <bitfield name="WORD_COUNT" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00058" name="CMD_MDP_STREAM0_TOTAL"> - <bitfield name="H_TOTAL" low="0" high="11" type="uint"/> - <bitfield name="V_TOTAL" low="16" high="27" type="uint"/> + <bitfield name="H_TOTAL" low="0" high="15" type="uint"/> + <bitfield name="V_TOTAL" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x0005c" name="CMD_MDP_STREAM1_CTRL"> <bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 24/95 drm/mediatek: Add error handling for old state CRTC in atomic_disable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit 0c6b24d70da21201ed009a2aca740d2dfddc7ab5 ]
Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL old_state->crtc.
E,g.
Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188
Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.
--- drivers/gpu/drm/mediatek/mtk_plane.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_plane.c +2 -1
@@ -292,7 +292,8 @@ static void mtk_plane_atomic_disable(struct drm_plane *plane,wmb ();/* Make sure the above parameter is set before update */ mtk_plane_state->pending.dirty = true; -mtk_crtc_plane_disable (old_state->crtc, plane); +if (old_state && old_state->crtc) +mtk_crtc_plane_disable (old_state->crtc, plane); } static void mtk_plane_atomic_update(struct drm_plane *plane,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 25/95 powerpc/kvm: Fix ifdef to remove build warning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhavan Srinivasan <[email protected]>
[ Upstream commit 88688a2c8ac6c8036d983ad8b34ce191c46a10aa ]
When compiling for pseries or powernv defconfig with "make C=1", these warning were reported bu sparse tool in powerpc/kernel/kvm.c
arch/powerpc/kernel/kvm.c:635:9: warning: switch with no cases arch/powerpc/kernel/kvm.c:646:9: warning: switch with no cases
Currently #ifdef were added after the switch case which are specific for BOOKE and PPC_BOOK3S_32. These are not enabled in pseries/powernv defconfig. Fix it by moving the #ifdef before switch(){}
--- arch/powerpc/kernel/kvm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/kernel/kvm.c +4 -4
@@ -632,19 +632,19 @@ static void __init kvm_check_ins(u32 *inst, u32 features)#endif } -switch (inst_no_rt & ~KVM_MASK_RB ) {#ifdef CONFIG_PPC_BOOK3S_32 +switch (inst_no_rt & ~KVM_MASK_RB ) {case KVM_INST_MTSRIN :if (features &KVM_MAGIC_FEAT_SR ) {u32 inst_rb = _inst &KVM_MASK_RB ;kvm_patch_ins_mtsrin (inst, inst_rt, inst_rb); }break ; -#endif } +#endif -switch (_inst) {#ifdef CONFIG_BOOKE +switch (_inst) {case KVM_INST_WRTEEI_0 :kvm_patch_ins_wrteei_0 (inst);break ;
@@ -652,8 +652,8 @@ static void __init kvm_check_ins(u32 *inst, u32 features)case KVM_INST_WRTEEI_1 :kvm_patch_ins_wrtee (inst,0 ,1 ); break; -#endif } +#endif }extern u32 kvm_template_start[];
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 26/95 HID: input: rename hidinput_set_battery_charge_status()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit a82231b2a8712d0218fc286a9b0da328d419a3f4 ]
In preparation for a patch fixing a bug affecting hidinput_set_battery_charge_status(), rename the function to hidinput_update_battery_charge_status() and move it up so it can be used by hidinput_update_battery().
Refactor, no functional changes.
Stable-dep-of: e94536e1d181 ("HID: input: report battery status changes immediately")
--- drivers/hid/hid-input-test.c | 10 +++++----- drivers/hid/hid-input.c | 38 ++++++++++++++++++------------------ 2 files changed, 24 insertions(+), 24 deletions(-)
drivers/hid/hid-input-test.c +5 -5
@@ -7,7 +7,7 @@#include <kunit/test.h> -static void hid_test_input_set_battery_charge_status (struct kunit *test) +static void hid_test_input_update_battery_charge_status (struct kunit *test) {struct hid_device *dev;bool handled;
@@ -15,15 +15,15 @@ static void hid_test_input_set_battery_charge_status(struct kunit *test) dev =kunit_kzalloc (test,sizeof (*dev),GFP_KERNEL );KUNIT_ASSERT_NOT_ERR_OR_NULL (test, dev); - handled =hidinput_set_battery_charge_status (dev,HID_DG_HEIGHT ,0 ); + handled =hidinput_update_battery_charge_status (dev,HID_DG_HEIGHT ,0 );KUNIT_EXPECT_FALSE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_UNKNOWN ); - handled =hidinput_set_battery_charge_status (dev,HID_BAT_CHARGING ,0 ); + handled =hidinput_update_battery_charge_status (dev,HID_BAT_CHARGING ,0 );KUNIT_EXPECT_TRUE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_DISCHARGING ); - handled =hidinput_set_battery_charge_status (dev,HID_BAT_CHARGING ,1 ); + handled =hidinput_update_battery_charge_status (dev,HID_BAT_CHARGING ,1 );KUNIT_EXPECT_TRUE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_CHARGING ); }
@@ -63,7 +63,7 @@ static void hid_test_input_get_battery_property(struct kunit *test) }static struct kunit_case hid_input_tests[] = { -KUNIT_CASE (hid_test_input_set_battery_charge_status), +KUNIT_CASE (hid_test_input_update_battery_charge_status),KUNIT_CASE (hid_test_input_get_battery_property), { } };
drivers/hid/hid-input.c +19 -19
@@ -595,6 +595,20 @@ static void hidinput_cleanup_battery(struct hid_device *dev) dev->battery =NULL ; } +static bool hidinput_update_battery_charge_status (struct hid_device *dev, +unsigned int usage,int value) +{ +switch (usage) { +case HID_BAT_CHARGING : + dev->battery_charge_status = value ? +POWER_SUPPLY_STATUS_CHARGING : +POWER_SUPPLY_STATUS_DISCHARGING ; +return true; + } + +return false; +} +static void hidinput_update_battery (struct hid_device *dev,int value) {int capacity;
@@ -617,20 +631,6 @@ static void hidinput_update_battery(struct hid_device *dev, int value) power_supply_changed(dev->battery); } } - -static bool hidinput_set_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) -{ -switch (usage) { -case HID_BAT_CHARGING : - dev->battery_charge_status = value ? -POWER_SUPPLY_STATUS_CHARGING : -POWER_SUPPLY_STATUS_DISCHARGING ; -return true; - } - -return false; -}#else /* !CONFIG_HID_BATTERY_STRENGTH */ static int hidinput_setup_battery (struct hid_device *dev,unsigned report_type,struct hid_field *field,bool is_percentage)
@@ -642,14 +642,14 @@ static void hidinput_cleanup_battery(struct hid_device *dev) { } -static void hidinput_update_battery (struct hid_device *dev,int value) +static bool hidinput_update_battery_charge_status (struct hid_device *dev, +unsigned int usage,int value) { +return false; } -static bool hidinput_set_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) +static void hidinput_update_battery (struct hid_device *dev,int value) { -return false; }#endif /* CONFIG_HID_BATTERY_STRENGTH */
@@ -1515,7 +1515,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, structreturn ;if (usage->type ==EV_PWR ) { -bool handled =hidinput_set_battery_charge_status (hid, usage->hid, value); +bool handled =hidinput_update_battery_charge_status (hid, usage->hid, value);if (!handled)hidinput_update_battery (hid, value);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 27/95 HID: input: report battery status changes immediately
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit e94536e1d1818b0989aa19b443b7089f50133c35 ]
Previously, the battery status (charging/discharging) was not reported immediately to user-space.
For most input devices, this wasn't problematic because changing their battery status requires connecting them to a different bus. For example, a gamepad would report a discharging status while connected via Bluetooth and a charging status while connected via USB.
However, certain devices are not connected or disconnected when their battery status changes. For example, a phone battery changes its status without connecting or disconnecting it.
In these cases, the battery status was not reported immediately to user space.
Report battery status changes immediately to user space to support these kinds of devices.
--- drivers/hid/hid-input.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/hid/hid-input.c +10 -13
@@ -609,13 +609,19 @@ static bool hidinput_update_battery_charge_status(struct hid_device *dev,return false; } -static void hidinput_update_battery (struct hid_device *dev,int value) +static void hidinput_update_battery (struct hid_device *dev,unsigned int usage, +int value) {int capacity;if (!dev->battery)return ; +if (hidinput_update_battery_charge_status (dev, usage, value)) { +power_supply_changed (dev->battery); +return ; + } +if (value ==0 || value < dev->battery_min || value > dev->battery_max)return ;
@@ -642,13 +648,8 @@ static void hidinput_cleanup_battery(struct hid_device *dev) { } -static bool hidinput_update_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) -{ -return false; -} - -static void hidinput_update_battery (struct hid_device *dev,int value) +static void hidinput_update_battery (struct hid_device *dev,unsigned int usage, +int value) { }#endif /* CONFIG_HID_BATTERY_STRENGTH */
@@ -1515,11 +1516,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, structreturn ;if (usage->type ==EV_PWR ) { -bool handled =hidinput_update_battery_charge_status (hid, usage->hid, value); - -if (!handled) -hidinput_update_battery (hid, value); - +hidinput_update_battery (hid, usage->hid, value);return ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 28/95 net: macb: fix unregister_netdev call order in macb_remove()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: luoguangfei <[email protected]>
[ Upstream commit 01b9128c5db1b470575d07b05b67ffa3cb02ebf1 ]
When removing a macb device, the driver calls phy_exit() before unregister_netdev(). This leads to a WARN from kernfs:
------------[ cut here ]------------
kernfs: can not remove 'attached_dev', no directory
WARNING: CPU: 1 PID: 27146 at fs/kernfs/dir.c:1683
Call trace:
kernfs_remove_by_name_ns+0xd8/0xf0
sysfs_remove_link+0x24/0x58
phy_detach+0x5c/0x168
phy_disconnect+0x4c/0x70
phylink_disconnect_phy+0x6c/0xc0 [phylink]
macb_close+0x6c/0x170 [macb]
...
macb_remove+0x60/0x168 [macb]
platform_remove+0x5c/0x80
...The warning happens because the PHY is being exited while the netdev is still registered. The correct order is to unregister the netdev before shutting down the PHY and cleaning up the MDIO bus.
Fix this by moving unregister_netdev() ahead of phy_exit() in macb_remove().
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -5225,11 +5225,11 @@ static void macb_remove(struct platform_device *pdev)if (dev) { bp =netdev_priv (dev); +unregister_netdev (dev);phy_exit (bp->sgmii_phy);mdiobus_unregister (bp->mii_bus);mdiobus_free (bp->mii_bus); -unregister_netdev (dev);cancel_work_sync (&bp->hresp_err_bh_work);pm_runtime_disable (&pdev->dev);pm_runtime_dont_use_autosuspend (&pdev->dev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 29/95 Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovico de Nittis <[email protected]>
[ Upstream commit 2f050a5392b7a0928bf836d9891df4851463512c ]
When the host sends an HCI_OP_DISCONNECT command, the controller may respond with the status HCI_ERROR_UNKNOWN_CONN_ID (0x02). E.g. this can happen on resume from suspend, if the link was terminated by the remote device before the event mask was correctly set.
This is a btmon snippet that shows the issue:
```
> ACL Data RX: Handle 3 flags 0x02 dlen 12
L2CAP: Disconnection Request (0x06) ident 5 len 4
Destination CID: 65
Source CID: 72
< ACL Data TX: Handle 3 flags 0x00 dlen 12
L2CAP: Disconnection Response (0x07) ident 5 len 4
Destination CID: 65
Source CID: 72
> ACL Data RX: Handle 3 flags 0x02 dlen 12
L2CAP: Disconnection Request (0x06) ident 6 len 4
Destination CID: 64
Source CID: 71
< ACL Data TX: Handle 3 flags 0x00 dlen 12
L2CAP: Disconnection Response (0x07) ident 6 len 4
Destination CID: 64
Source CID: 71
< HCI Command: Set Event Mask (0x03|0x0001) plen 8
Mask: 0x3dbff807fffbffff
Inquiry Complete
Inquiry Result
Connection Complete
Connection Request
Disconnection Complete
Authentication Complete
[...]
< HCI Command: Disconnect (0x01|0x0006) plen 3
Handle: 3 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) ncmd 1
Status: Unknown Connection Identifier (0x02)
```Currently, the hci_cs_disconnect function treats any non-zero status as a command failure. This can be misleading because the connection is indeed being terminated and the controller is confirming that is has no knowledge of that connection handle. Meaning that the initial request of disconnecting a device should be treated as done.
With this change we allow the function to proceed, following the success path, which correctly calls mgmt_device_disconnected and ensures a consistent state.
--- net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/hci_event.c +1 -1
@@ -2694,7 +2694,7 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)if (!conn) goto unlock; -if (status) { +if (status && status !=HCI_ERROR_UNKNOWN_CONN_ID ) {mgmt_disconnect_failed (hdev, &conn->dst, conn->type, conn->dst_type, status);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 30/95 Bluetooth: hci_event: Mark connection as closed during suspend disconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovico de Nittis <[email protected]>
[ Upstream commit b7fafbc499b5ee164018eb0eefe9027f5a6aaad2 ]
When suspending, the disconnect command for an active Bluetooth connection could be issued, but the corresponding HCI_EV_DISCONN_COMPLETE event might not be received before the system completes the suspend process. This can lead to an inconsistent state.
On resume, the controller may auto-accept reconnections from the same device (due to suspend event filters), but these new connections are rejected by the kernel which still has connection objects from before suspend. Resulting in errors like:
``` kernel: Bluetooth: hci0: ACL packet for unknown connection handle 1 kernel: Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection ```
This is a btmon snippet that shows the issue:
```
< HCI Command: Disconnect (0x01|0x0006) plen 3
Handle: 1 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) ncmd 2
Status: Success (0x00)
[...]
// Host suspends with the event filter set for the device
// On resume, the device tries to reconnect with a new handle
> HCI Event: Connect Complete (0x03) plen 11
Status: Success (0x00)
Handle: 2
Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
// Kernel ignores this event because there is an existing connection
with
// handle 1
```By explicitly setting the connection state to BT_CLOSED we can ensure a consistent state, even if we don't receive the disconnect complete event in time.
--- net/bluetooth/hci_event.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/hci_event.c +6 -0
@@ -2709,6 +2709,12 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) goto done; } +/* During suspend, mark connection as closed immediately +* since we might not receive HCI_EV_DISCONN_COMPLETE +*/ +if (hdev->suspended) + conn->state =BT_CLOSED ; + mgmt_conn =test_and_clear_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags);if (conn->type ==ACL_LINK ) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 31/95 Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 15bf2c6391bafb14a3020d06ec0761bce0803463 ]
This attempts to detect if HCI_EV_NUM_COMP_PKTS contain an unbalanced (more than currently considered outstanding) number of packets otherwise it could cause the hcon->sent to underflow and loop around breaking the tracking of the outstanding packets pending acknowledgment.
--- net/bluetooth/hci_event.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/bluetooth/hci_event.c +11 -1
@@ -4395,7 +4395,17 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,if (!conn)continue ; - conn->sent -= count; +/* Check if there is really enough packets outstanding before +* attempting to decrease the sent counter otherwise it could +* underflow.. +*/ +if (conn->sent >= count) { + conn->sent -= count; + }else { +bt_dev_warn (hdev,"hcon %p sent %u < count %u" , + conn, conn->sent, count); + conn->sent =0 ; + }switch (conn->type) {case ACL_LINK :
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 32/95 Bluetooth: hci_sync: fix set_local_name race condition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shpakovskiy <[email protected]>
[ Upstream commit 6bbd0d3f0c23fc53c17409dd7476f38ae0ff0cd9 ]
Function set_name_sync() uses hdev->dev_name field to send HCI_OP_WRITE_LOCAL_NAME command, but copying from data to hdev->dev_name is called after mgmt cmd was queued, so it is possible that function set_name_sync() will read old name value.
This change adds name as a parameter for function hci_update_name_sync() to avoid race condition.
--- include/net/bluetooth/hci_sync.h | 2 +- net/bluetooth/hci_sync.c | 6 +++--- net/bluetooth/mgmt.c | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-)
include/net/bluetooth/hci_sync.h +1 -1
@@ -93,7 +93,7 @@ int hci_update_class_sync(struct hci_dev *hdev);int hci_update_eir_sync (struct hci_dev *hdev);int hci_update_class_sync (struct hci_dev *hdev); -int hci_update_name_sync (struct hci_dev *hdev); +int hci_update_name_sync (struct hci_dev *hdev,const u8 *name);int hci_write_ssp_mode_sync (struct hci_dev *hdev,u8 mode); int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
net/bluetooth/hci_sync.c +3 -3
@@ -3491,13 +3491,13 @@ int hci_update_scan_sync(struct hci_dev *hdev)return hci_write_scan_enable_sync (hdev, scan); } -int hci_update_name_sync (struct hci_dev *hdev) +int hci_update_name_sync (struct hci_dev *hdev,const u8 *name) {struct hci_cp_write_local_name cp;memset (&cp,0 ,sizeof (cp)); -memcpy (cp.name, hdev->dev_name,sizeof (cp.name)); +memcpy (cp.name, name,sizeof (cp.name)); return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp,
@@ -3550,7 +3550,7 @@ int hci_powered_update_sync(struct hci_dev *hdev)hci_write_fast_connectable_sync (hdev, false);hci_update_scan_sync (hdev);hci_update_class_sync (hdev); -hci_update_name_sync (hdev); +hci_update_name_sync (hdev, hdev->dev_name);hci_update_eir_sync (hdev); }
net/bluetooth/mgmt.c +4 -1
@@ -3826,8 +3826,11 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err)static int set_name_sync (struct hci_dev *hdev,void *data) { +struct mgmt_pending_cmd *cmd = data; +struct mgmt_cp_set_local_name *cp = cmd->param; +if (lmp_bredr_capable (hdev)) { -hci_update_name_sync (hdev); +hci_update_name_sync (hdev, cp->name);hci_update_eir_sync (hdev); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 33/95 atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a ]
syzbot reported the splat below. [0]
When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message.
The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc.
The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer.
struct atmtcp_control {
struct atmtcp_hdr hdr; /* must be first */
...
atm_kptr_t vcc; /* both directions */
...
} __ATM_API_ALIGN;
typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;The special message is processed in atmtcp_recv_control() called from atmtcp_c_send().
atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths:
1. .ndo_start_xmit() (vcc->send() == atm_send_aal0())
2. vcc_sendmsg()
The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control.
Let's add a new ->pre_send() hook to validate messages from sendmsg().
[0]:
Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 </TASK> Modules linked in:
--- drivers/atm/atmtcp.c | 17 ++++++++++++++--- include/linux/atmdev.h | 1 + net/atm/common.c | 15 ++++++++++++--- 3 files changed, 27 insertions(+), 6 deletions(-)
drivers/atm/atmtcp.c +14 -3
@@ -279,6 +279,19 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)return NULL ; } +static int atmtcp_c_pre_send (struct atm_vcc *vcc,struct sk_buff *skb) +{ +struct atmtcp_hdr *hdr; + +if (skb->len <sizeof (struct atmtcp_hdr )) +return -EINVAL ; + + hdr = (struct atmtcp_hdr *)skb->data; +if (hdr->length ==ATMTCP_HDR_MAGIC ) +return -EINVAL ; + +return 0 ; +}static int atmtcp_c_send (struct atm_vcc *vcc,struct sk_buff *skb) {
@@ -288,9 +301,6 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)struct sk_buff *new_skb;int result =0 ; -if (skb->len <sizeof (struct atmtcp_hdr )) - goto done; - dev = vcc->dev_data; hdr = (struct atmtcp_hdr *) skb->data;if (hdr->length ==ATMTCP_HDR_MAGIC ) {
@@ -347,6 +357,7 @@ static const struct atmdev_ops atmtcp_v_dev_ops = {static const struct atmdev_ops atmtcp_c_dev_ops = { .close = atmtcp_c_close, + .pre_send = atmtcp_c_pre_send, .send = atmtcp_c_send };
include/linux/atmdev.h +1 -0
@@ -185,6 +185,7 @@ struct atmdev_ops { /* only send is required */int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd,void __user *arg);#endif +int (*pre_send)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send_bh)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send_oam)(struct atm_vcc *vcc,void *cell,int flags);
net/atm/common.c +12 -3
@@ -635,18 +635,27 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) skb->dev =NULL ;/* for paths shared with net_device interfaces */ if (!copy_from_iter_full (skb_put (skb, size), size, &m->msg_iter)) { -atm_return_tx (vcc, skb); -kfree_skb (skb); error = -EFAULT ; - goto out; + goto free_skb; }if (eff != size)memset (skb->data + size,0 , eff-size); + +if (vcc->dev->ops->pre_send) { + error = vcc->dev->ops->pre_send (vcc, skb); +if (error) + goto free_skb; + } + error = vcc->dev->ops->send (vcc, skb); error = error ? error : size; out:release_sock (sk);return error; +free_skb: +atm_return_tx (vcc, skb); +kfree_skb (skb); + goto out; }__poll_t vcc_poll (struct file *file,struct socket *sock,poll_table *wait)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 34/95 drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
[ Upstream commit f529b8915543fb9ceb732cec5571f7fe12bc9530 ]
The 'tag' parameter is passed by value and is not actually used after being incremented, so remove the increment. It's the function that calls gm200_flcn_pio_imem_wr that is supposed to (and does) increment 'tag'.
--- drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c +1 -1
@@ -103,7 +103,7 @@ gm200_flcn_pio_imem_wr_init(struct nvkm_falcon *falcon, u8 port, bool sec, u32 istatic void gm200_flcn_pio_imem_wr (struct nvkm_falcon *falcon,u8 port,const u8 *img,int len,u16 tag) { -nvkm_falcon_wr32 (falcon,0x188 + (port *0x10 ), tag++); +nvkm_falcon_wr32 (falcon,0x188 + (port *0x10 ), tag);while (len >=4 ) {nvkm_falcon_wr32 (falcon,0x184 + (port *0x10 ), *(u32 *)img); img +=4 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 35/95 drm/nouveau: remove unused memory target test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
[ Upstream commit 64c722b5e7f6b909b0e448e580f64628a0d76208 ]
The memory target check is a hold-over from a refactor. It's harmless but distracting, so just remove it.
--- drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c +3 -10
@@ -249,9 +249,11 @@ int gm200_flcn_fw_load(struct nvkm_falcon_fw *fw) {struct nvkm_falcon *falcon = fw->falcon; -int target, ret; +int ret;if (fw->inst) { +int target; +nvkm_falcon_mask (falcon,0x048 ,0x00000001 ,0x00000001 );switch (nvkm_memory_target (fw->inst)) {
@@ -285,15 +287,6 @@ gm200_flcn_fw_load(struct nvkm_falcon_fw *fw) }if (fw->boot) { -switch (nvkm_memory_target (&fw->fw.mem.memory)) { -case NVKM_MEM_TARGET_VRAM : target =4 ;break ; -case NVKM_MEM_TARGET_HOST : target =5 ;break ; -case NVKM_MEM_TARGET_NCOH : target =6 ;break ; -default : -WARN_ON (1 ); -return -EINVAL ; - } - ret =nvkm_falcon_pio_wr (falcon, fw->boot,0 ,0 ,IMEM , falcon->code.limit - fw->boot_size, fw->boot_size, fw->boot_addr >>8 , false);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 36/95 ice: dont leave device non-functional if Tx scheduler config fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 86aae43f21cf784c1d7f6a9af93e5116b0f232ab ]
The ice_cfg_tx_topo function attempts to apply Tx scheduler topology configuration based on NVM parameters, selecting either a 5 or 9 layer topology.
As part of this flow, the driver acquires the "Global Configuration Lock", which is a hardware resource associated with programming the DDP package to the device. This "lock" is implemented by firmware as a way to guarantee that only one PF can program the DDP for a device. Unlike a traditional lock, once a PF has acquired this lock, no other PF will be able to acquire it again (including that PF) until a CORER of the device. Future requests to acquire the lock report that global configuration has already completed.
The following flow is used to program the Tx topology:
* Read the DDP package for scheduler configuration data
* Acquire the global configuration lock
* Program Tx scheduler topology according to DDP package data
* Trigger a CORER which clears the global configuration lock
This is followed by the flow for programming the DDP package:
* Acquire the global configuration lock (again)
* Download the DDP package to the device
* Release the global configuration lock.
However, if configuration of the Tx topology fails, (i.e. ice_get_set_tx_topo returns an error code), the driver exits ice_cfg_tx_topo() immediately, and fails to trigger CORER.
While the global configuration lock is held, the firmware rejects most AdminQ commands, as it is waiting for the DDP package download (or Tx scheduler topology programming) to occur.
The current driver flows assume that the global configuration lock has been reset by CORER after programming the Tx topology. Thus, the same PF attempts to acquire the global lock again, and fails. This results in the driver reporting "an unknown error occurred when loading the DDP package". It then attempts to enter safe mode, but ultimately fails to finish ice_probe() since nearly all AdminQ command report error codes, and the driver stops loading the device at some point during its initialization.
The only currently known way that ice_get_set_tx_topo() can fail is with certain older DDP packages which contain invalid topology configuration, on firmware versions which strictly validate this data. The most recent releases of the DDP have resolved the invalid data. However, it is still poor practice to essentially brick the device, and prevent access to the device even through safe mode or recovery mode. It is also plausible that this command could fail for some other reason in the future.
We cannot simply release the global lock after a failed call to ice_get_set_tx_topo(). Releasing the lock indicates to firmware that global configuration (downloading of the DDP) has completed. Future attempts by this or other PFs to load the DDP will fail with a report that the DDP package has already been downloaded. Then, PFs will enter safe mode as they realize that the package on the device does not meet the minimum version requirement to load. The reported error messages are confusing, as they indicate the version of the default "safe mode" package in the NVM, rather than the version of the file loaded from /lib/firmware.
Instead, we need to trigger CORER to clear global configuration. This is the lowest level of hardware reset which clears the global configuration lock and related state. It also clears any already downloaded DDP. Crucially, it does *not* clear the Tx scheduler topology configuration.
Refactor ice_cfg_tx_topo() to always trigger a CORER after acquiring the global lock, regardless of success or failure of the topology configuration.
We need to re-initialize the HW structure when we trigger the CORER. Thus, it makes sense for this to be the responsibility of ice_cfg_tx_topo() rather than its caller, ice_init_tx_topology(). This avoids needless re-initialization in cases where we don't attempt to update the Tx scheduler topology, such as if it has already been programmed.
There is one catch: failure to re-initialize the HW struct should stop ice_probe(). If this function fails, we won't have a valid HW structure and cannot ensure the device is functioning properly. To handle this, ensure ice_cfg_tx_topo() returns a limited set of error codes. Set aside one specifically, -ENODEV, to indicate that the ice_init_tx_topology() should fail and stop probe.
Other error codes indicate failure to apply the Tx scheduler topology. This is treated as a non-fatal error, with an informational message informing the system administrator that the updated Tx topology did not apply. This allows the device to load and function with the default Tx scheduler topology, rather than failing to load entirely.
Note that this use of CORER will not result in loops with future PFs attempting to also load the invalid Tx topology configuration. The first PF will acquire the global configuration lock as part of programming the DDP. Each PF after this will attempt to acquire the global lock as part of programming the Tx topology, and will fail with the indication from firmware that global configuration is already complete. Tx scheduler topology configuration is only performed during driver init (probe or devlink reload) and not during cleanup for a CORER that happens after probe completes.
--- drivers/net/ethernet/intel/ice/ice_ddp.c | 44 ++++++++++++++++------- drivers/net/ethernet/intel/ice/ice_main.c | 16 ++++++--- 2 files changed, 43 insertions(+), 17 deletions(-)
drivers/net/ethernet/intel/ice/ice_ddp.c +32 -12
@@ -2352,7 +2352,13 @@ ice_get_set_tx_topo(struct ice_hw *hw, u8 *buf, u16 buf_size,* The function will apply the new Tx topology from the package buffer * if available. * -* Return: zero when update was successful, negative values otherwise. +* Return: +* * 0 - Successfully applied topology configuration. +* * -EBUSY - Failed to acquire global configuration lock. +* * -EEXIST - Topology configuration has already been applied. +* * -EIO - Unable to apply topology configuration. +* * -ENODEV - Failed to re-initialize device after applying configuration. +* * Other negative error codes indicate unexpected failures. */ int ice_cfg_tx_topo (struct ice_hw *hw,const void *buf,u32 len) {
@@ -2385,7 +2391,7 @@ int ice_cfg_tx_topo(struct ice_hw *hw, const void *buf, u32 len)if (status) {ice_debug (hw,ICE_DBG_INIT ,"Get current topology is failed\n" ); -return status; +return -EIO ; }/* Is default topology already applied ? */
@@ -2472,31 +2478,45 @@ int ice_cfg_tx_topo(struct ice_hw *hw, const void *buf, u32 len) ICE_GLOBAL_CFG_LOCK_TIMEOUT);if (status) {ice_debug (hw,ICE_DBG_INIT ,"Failed to acquire global lock\n" ); -return status; +return -EBUSY ; }/* Check if reset was triggered already. */ reg =rd32 (hw,GLGEN_RSTAT );if (reg &GLGEN_RSTAT_DEVSTATE_M ) { -/* Reset is in progress, re-init the HW again */ ice_debug (hw,ICE_DBG_INIT ,"Reset is in progress. Layer topology might be applied already\n" );ice_check_reset (hw); -return 0 ; +/* Reset is in progress, re-init the HW again */ + goto reinit_hw; }/* Set new topology */ status =ice_get_set_tx_topo (hw, new_topo, size,NULL ,NULL , true);if (status) { -ice_debug (hw,ICE_DBG_INIT ,"Failed setting Tx topology\n" ); -return status; +ice_debug (hw,ICE_DBG_INIT ,"Failed to set Tx topology, status %pe\n" , +ERR_PTR (status)); +/* only report -EIO here as the caller checks the error value +* and reports an informational error message informing that +* the driver failed to program Tx topology. +*/ + status = -EIO ; } -/* New topology is updated, delay 1 second before issuing the CORER */ +/* Even if Tx topology config failed, we need to CORE reset here to +* clear the global configuration lock. Delay 1 second to allow +* hardware to settle then issue a CORER +*/ msleep (1000 );ice_reset (hw,ICE_RESET_CORER ); -/* CORER will clear the global lock, so no explicit call -* required for release. -*/ +ice_check_reset (hw); + +reinit_hw: +/* Since we triggered a CORER, re-initialize hardware */ +ice_deinit_hw (hw); +if (ice_init_hw (hw)) { +ice_debug (hw,ICE_DBG_INIT ,"Failed to re-init hardware after setting Tx topology\n" ); +return -ENODEV ; + } -return 0 ; +return status; }
drivers/net/ethernet/intel/ice/ice_main.c +11 -5
@@ -4559,17 +4559,23 @@ ice_init_tx_topology(struct ice_hw *hw, const struct firmware *firmware)dev_info (dev,"Tx scheduling layers switching feature disabled\n" ); else dev_info(dev, "Tx scheduling layers switching feature enabled\n"); -/* if there was a change in topology ice_cfg_tx_topo triggered -* a CORER and we need to re-init hw +return 0 ; + }else if (err == -ENODEV ) { +/* If we failed to re-initialize the device, we can no longer +* continue loading. */ -ice_deinit_hw (hw); - err =ice_init_hw (hw); - +dev_warn (dev,"Failed to initialize hardware after applying Tx scheduling configuration.\n" );return err; }else if (err == -EIO ) {dev_info (dev,"DDP package does not support Tx scheduling layers switching feature - please update to the latest DDP package and try again\n" ); +return 0 ; + }else if (err == -EEXIST ) { +return 0 ; } +/* Do not treat this as a fatal error. */ +dev_info (dev,"Failed to apply Tx scheduling configuration, err %pe\n" , +ERR_PTR (err));return 0 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 37/95 ice: use fixed adapter index for E825C embedded devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 5c5e5b52bf05c7fe88768318c041052c5fac36b8 ]
The ice_adapter structure is used by the ice driver to connect multiple physical functions of a device in software. It was introduced by commit 0e2bddf9e5f9 ("ice: add ice_adapter for shared data across PFs on the same NIC") and is primarily used for PTP support, as well as for handling certain cross-PF synchronization.
The original design of ice_adapter used PCI address information to determine which devices should be connected. This was extended to support E825C devices by commit fdb7f54700b1 ("ice: Initial support for E825C hardware in ice_adapter"), which used the device ID for E825C devices instead of the PCI address.
Later, commit 0093cb194a75 ("ice: use DSN instead of PCI BDF for ice_adapter index") replaced the use of Bus/Device/Function addressing with use of the device serial number.
E825C devices may appear in "Dual NAC" configuration which has multiple physical devices tied to the same clock source and which need to use the same ice_adapter. Unfortunately, each "NAC" has its own NVM which has its own unique Device Serial Number. Thus, use of the DSN for connecting ice_adapter does not work properly. It "worked" in the pre-production systems because the DSN was not initialized on the test NVMs and all the NACs had the same zero'd serial number.
Since we cannot rely on the DSN, lets fall back to the logic in the original E825C support which used the device ID. This is safe for E825C only because of the embedded nature of the device. It isn't a discreet adapter that can be plugged into an arbitrary system. All E825C devices on a given system are connected to the same clock source and need to be configured through the same PTP clock.
To make this separation clear, reserve bit 63 of the 64-bit index values as a "fixed index" indicator. Always clear this bit when using the device serial number as an index.
For E825C, use a fixed value defined as the 0x579C E825C backplane device ID bitwise ORed with the fixed index indicator. This is slightly different than the original logic of just using the device ID directly. Doing so prevents a potential issue with systems where only one of the NACs is connected with an external PHY over SGMII. In that case, one NAC would have the E825C_SGMII device ID, but the other would not.
Separate the determination of the full 64-bit index from the 32-bit reduction logic. Provide both ice_adapter_index() and a wrapping ice_adapter_xa_index() which handles reducing the index to a long on 32-bit systems. As before, cache the full index value in the adapter structure to warn about collisions.
This fixes issues with E825C not initializing PTP on both NACs, due to failure to connect the appropriate devices to the same ice_adapter.
--- drivers/net/ethernet/intel/ice/ice_adapter.c | 49 +++++++++++++++----- drivers/net/ethernet/intel/ice/ice_adapter.h | 4 +- 2 files changed, 40 insertions(+), 13 deletions(-)
drivers/net/ethernet/intel/ice/ice_adapter.c +38 -11
@@ -13,16 +13,45 @@static DEFINE_XARRAY (ice_adapters);static DEFINE_MUTEX (ice_adapters_mutex); -static unsigned long ice_adapter_index (u64 dsn) +#define ICE_ADAPTER_FIXED_INDEX BIT_ULL(63) + +#define ICE_ADAPTER_INDEX_E825C \ + (ICE_DEV_ID_E825C_BACKPLANE | ICE_ADAPTER_FIXED_INDEX) + +static u64 ice_adapter_index (struct pci_dev *pdev) { +switch (pdev->device) { +case ICE_DEV_ID_E825C_BACKPLANE : +case ICE_DEV_ID_E825C_QSFP : +case ICE_DEV_ID_E825C_SFP : +case ICE_DEV_ID_E825C_SGMII : +/* E825C devices have multiple NACs which are connected to the +* same clock source, and which must share the same +* ice_adapter structure. We can't use the serial number since +* each NAC has its own NVM generated with its own unique +* Device Serial Number. Instead, rely on the embedded nature +* of the E825C devices, and use a fixed index. This relies on +* the fact that all E825C physical functions in a given +* system are part of the same overall device. +*/ +return ICE_ADAPTER_INDEX_E825C ; +default : +return pci_get_dsn (pdev) & ~ICE_ADAPTER_FIXED_INDEX ; + } +} + +static unsigned long ice_adapter_xa_index (struct pci_dev *pdev) +{ +u64 index =ice_adapter_index (pdev); +#if BITS_PER_LONG ==64 -return dsn; +return index;#else -return (u32 )dsn ^ (u32)(dsn >>32 ); +return (u32 )index ^ (u32)(index >>32 );#endif } -static struct ice_adapter *ice_adapter_new (u64 dsn) +static struct ice_adapter *ice_adapter_new (struct pci_dev *pdev) {struct ice_adapter *adapter;
@@ -30,7 +59,7 @@ static struct ice_adapter *ice_adapter_new(u64 dsn)if (!adapter)return NULL ; - adapter->device_serial_number = dsn; + adapter->index =ice_adapter_index (pdev);spin_lock_init (&adapter->ptp_gltsyn_time_lock);refcount_set (&adapter->refcount,1 );
@@ -63,24 +92,23 @@ static void ice_adapter_free(struct ice_adapter *adapter)*/ struct ice_adapter *ice_adapter_get (struct pci_dev *pdev) { -u64 dsn =pci_get_dsn (pdev);struct ice_adapter *adapter;unsigned long index;int err; - index =ice_adapter_index (dsn); + index =ice_adapter_xa_index (pdev); scoped_guard(mutex, &ice_adapters_mutex) { err =xa_insert (&ice_adapters, index,NULL ,GFP_KERNEL );if (err == -EBUSY ) { adapter =xa_load (&ice_adapters, index);refcount_inc (&adapter->refcount); -WARN_ON_ONCE (adapter->device_serial_number != dsn); +WARN_ON_ONCE (adapter->index !=ice_adapter_index (pdev));return adapter; }if (err)return ERR_PTR (err); - adapter =ice_adapter_new (dsn); + adapter =ice_adapter_new (pdev);if (!adapter)return ERR_PTR (-ENOMEM );xa_store (&ice_adapters, index, adapter,GFP_KERNEL );
@@ -99,11 +127,10 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev)*/ void ice_adapter_put (struct pci_dev *pdev) { -u64 dsn =pci_get_dsn (pdev);struct ice_adapter *adapter;unsigned long index; - index =ice_adapter_index (dsn); + index =ice_adapter_xa_index (pdev); scoped_guard(mutex, &ice_adapters_mutex) { adapter =xa_load (&ice_adapters, index);if (WARN_ON (!adapter))
drivers/net/ethernet/intel/ice/ice_adapter.h +2 -2
@@ -32,7 +32,7 @@ struct ice_port_list {* @refcount: Reference count. struct ice_pf objects hold the references. * @ctrl_pf: Control PF of the adapter * @ports: Ports list -* @device_serial_number: DSN cached for collision detection on 32bit systems +* @index: 64-bit index cached for collision detection on 32bit systems */ struct ice_adapter {refcount_t refcount;
@@ -41,7 +41,7 @@ struct ice_adapter {struct ice_pf *ctrl_pf;struct ice_port_list ports; -u64 device_serial_number; +u64 index; };struct ice_adapter *ice_adapter_get (struct pci_dev *pdev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 38/95 ice: fix incorrect counter for buffer allocation failures
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kubiak <[email protected]>
[ Upstream commit b1a0c977c6f1130f7dd125ee3db8c2435d7e3d41 ]
Currently, the driver increments alloc_page_failed when buffer allocation fails in ice_clean_rx_irq(). However, this counter is intended for page allocation failures, not buffer allocation issues.
This patch corrects the counter by incrementing alloc_buf_failed instead, ensuring accurate statistics reporting for buffer allocation failures.
--- drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_txrx.c +1 -1
@@ -1295,7 +1295,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) skb =ice_construct_skb (rx_ring, xdp);/* exit if we failed to retrieve a buffer */ if (!skb) { - rx_ring->ring_stats->rx_stats.alloc_page_failed++; + rx_ring->ring_stats->rx_stats.alloc_buf_failed++; xdp_verdict =ICE_XDP_CONSUMED ; }ice_put_rx_mbuf (rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 39/95 dt-bindings: display/msm: qcom,mdp5: drop lut clock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7ab3b7579a6d2660a3425b9ea93b9a140b07f49c ]
None of MDP5 platforms have a LUT clock on the display-controller, it was added by the mistake. Drop it, fixing DT warnings on MSM8976 / MSM8956 platforms. Technically it's an ABI break, but no other platforms are affected.
Patchwork: https://patchwork.freedesktop.org/patch/667822/
--- Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 - 1 file changed, 1 deletion(-)
Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml +0 -1
@@ -60,7 +60,6 @@ properties: - const: bus - const: core - const: vsync - - const: lut - const: tbu - const: tbu_rt # MSM8996 has additional iommu clock
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 40/95 net: dlink: fix multicast stats being counted incorrectly
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <[email protected]>
[ Upstream commit 007a5ffadc4fd51739527f1503b7cf048f31c413 ]
McstFramesRcvdOk counts the number of received multicast packets, and it reports the value correctly.
However, reading McstFramesRcvdOk clears the register to zero. As a result, the driver was reporting only the packets since the last read, instead of the accumulated total.
Fix this by updating the multicast statistics accumulatively instaed of instantaneously.
Tested-on: D-Link DGE-550T Rev-A3
--- drivers/net/ethernet/dlink/dl2k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/dlink/dl2k.c +1 -1
@@ -1091,7 +1091,7 @@ get_stats (struct net_device *dev) dev->stats.rx_bytes +=dr32 (OctetRcvOk); dev->stats.tx_bytes +=dr32 (OctetXmtOk); - dev->stats.multicast =dr32 (McstFramesRcvdOk); + dev->stats.multicast +=dr32 (McstFramesRcvdOk); dev->stats.collisions +=dr32 (SingleColFrames) +dr32 (MultiColFrames);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 41/95 efi: stmm: Fix incorrect buffer allocation method
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
[ Upstream commit c5e81e672699e0c5557b2b755cc8f7a69aa92bff ]
The communication buffer allocated by setup_mm_hdr() is later on passed to tee_shm_register_kernel_buf(). The latter expects those buffers to be contiguous pages, but setup_mm_hdr() just uses kmalloc(). That can cause various corruptions or BUGs, specifically since commit 9aec2fb0fd5e ("slab: allocate frozen pages"), though it was broken before as well.
Fix this by using alloc_pages_exact() instead of kmalloc().
--- drivers/firmware/efi/stmm/tee_stmm_efi.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/firmware/efi/stmm/tee_stmm_efi.c +12 -9
@@ -143,6 +143,10 @@ static efi_status_t mm_communicate(u8 *comm_buf, size_t payload_size)return var_hdr->ret_status; } +#define COMM_BUF_SIZE (__payload_size) (MM_COMMUNICATE_HEADER_SIZE + \ + MM_VARIABLE_COMMUNICATE_SIZE + \ + (__payload_size)) +/** * setup_mm_hdr() - Allocate a buffer for StandAloneMM and initialize the * header data.
@@ -173,9 +177,8 @@ static void *setup_mm_hdr(u8 **dptr, size_t payload_size, size_t func,return NULL ; } - comm_buf =kzalloc (MM_COMMUNICATE_HEADER_SIZE + -MM_VARIABLE_COMMUNICATE_SIZE + payload_size, -GFP_KERNEL ); + comm_buf =alloc_pages_exact (COMM_BUF_SIZE (payload_size), +GFP_KERNEL | __GFP_ZERO);if (!comm_buf) { *ret =EFI_OUT_OF_RESOURCES ;return NULL ;
@@ -239,7 +242,7 @@ static efi_status_t get_max_payload(size_t *size)*/ *size -=2 ; out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -282,7 +285,7 @@ static efi_status_t get_property_int(u16 *name, size_t name_size,memcpy (var_property, &smm_property->property,sizeof (*var_property)); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -347,7 +350,7 @@ static efi_status_t tee_get_variable(u16 *name, efi_guid_t *vendor,memcpy (data, (u8 *)var_acc->name + var_acc->name_size, var_acc->data_size); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -404,7 +407,7 @@ static efi_status_t tee_get_next_variable(unsigned long *name_size,memcpy (name, var_getnext->name, var_getnext->name_size); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -467,7 +470,7 @@ static efi_status_t tee_set_variable(efi_char16_t *name, efi_guid_t *vendor, ret =mm_communicate (comm_buf, payload_size);dev_dbg (pvt_data.dev,"Set Variable %s %d %lx\n" , __FILE__, __LINE__, ret); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -507,7 +510,7 @@ static efi_status_t tee_query_variable_info(u32 attributes, *max_variable_size = mm_query_info->max_variable_size; out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 42/95 drm/xe/xe_sync: avoid race during ufence signaling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zbigniew Kempczyński <[email protected]>
[ Upstream commit 04e1f683cd28dc9407b238543871a6e09a570dc0 ]
Marking ufence as signalled after copy_to_user() is too late. Worker thread which signals ufence by memory write might be raced with another userspace vm-bind call. In map/unmap scenario unmap may still see ufence is not signalled causing -EBUSY. Change the order of marking / write to user-fence fixes this issue.
--- drivers/gpu/drm/xe/xe_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_sync.c +1 -1
@@ -77,6 +77,7 @@ static void user_fence_worker(struct work_struct *w) { struct xe_user_fence *ufence = container_of(w, struct xe_user_fence, worker); +WRITE_ONCE (ufence->signalled,1 );if (mmget_not_zero (ufence->mm)) {kthread_use_mm (ufence->mm);if (copy_to_user (ufence->addr, &ufence->value,sizeof (ufence->value)))
@@ -89,7 +90,6 @@ static void user_fence_worker(struct work_struct *w)* Wake up waiters only after updating the ufence state, allowing the UMD * to safely reuse the same ufence without encountering -EBUSY errors. */ -WRITE_ONCE (ufence->signalled,1 );wake_up_all (&ufence->xe->ufence_wq);user_fence_put (ufence); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 43/95 drm/xe: Dont trigger rebind on initial dma-buf validation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 16ca06aa2c2218cb21907c0c45a746958c944def ]
On the first validate of an imported dma-buf (initial bind), the device has no GPU mappings, so a rebind is unnecessary. Rebinding here is harmful in multi-GPU setups and for VMs using preempt-fence mode, as it would evict in-flight GPU work.
v2:
- Drop dma_buf_validated, check for XE_PL_SYSTEM (Thomas)
--- drivers/gpu/drm/xe/xe_bo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_bo.c +2 -1
@@ -671,7 +671,8 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict, }if (ttm_bo->type == ttm_bo_type_sg) { - ret =xe_bo_move_notify (bo, ctx); +if (new_mem->mem_type ==XE_PL_SYSTEM ) + ret =xe_bo_move_notify (bo, ctx);if (!ret) ret =xe_bo_move_dmabuf (ttm_bo, new_mem);return ret;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 44/95 phy: mscc: Fix when PTP clock is register and unregister
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 882e57cbc7204662f6c5672d5b04336c1d790b03 ]
It looks like that every time when the interface was set down and up the driver was creating a new ptp clock. On top of this the function ptp_clock_unregister was never called.
Therefore fix this by calling ptp_clock_register and initialize the mii_ts struct inside the probe function and call ptp_clock_unregister when driver is removed.
--- drivers/net/phy/mscc/mscc.h | 4 ++++ drivers/net/phy/mscc/mscc_main.c | 4 +--- drivers/net/phy/mscc/mscc_ptp.c | 34 ++++++++++++++++++++------------ 3 files changed, 26 insertions(+), 16 deletions(-)
drivers/net/phy/mscc/mscc.h +4 -0
@@ -481,6 +481,7 @@ static inline void vsc8584_config_macsec_intr(struct phy_device *phydev)void vsc85xx_link_change_notify (struct phy_device *phydev);void vsc8584_config_ts_intr (struct phy_device *phydev);int vsc8584_ptp_init (struct phy_device *phydev); +void vsc8584_ptp_deinit (struct phy_device *phydev);int vsc8584_ptp_probe_once (struct phy_device *phydev);int vsc8584_ptp_probe (struct phy_device *phydev);irqreturn_t vsc8584_handle_ts_interrupt (struct phy_device *phydev);
@@ -495,6 +496,9 @@ static inline int vsc8584_ptp_init(struct phy_device *phydev) {return 0 ; } +static inline void vsc8584_ptp_deinit (struct phy_device *phydev) +{ +}static inline int vsc8584_ptp_probe_once (struct phy_device *phydev) {return 0 ;
drivers/net/phy/mscc/mscc_main.c +1 -3
@@ -2337,9 +2337,7 @@ static int vsc85xx_probe(struct phy_device *phydev)static void vsc85xx_remove (struct phy_device *phydev) { -struct vsc8531_private *priv = phydev->priv; - -skb_queue_purge (&priv->rx_skbs_list); +vsc8584_ptp_deinit (phydev); }/* Microsemi VSC85xx PHYs */
drivers/net/phy/mscc/mscc_ptp.c +21 -13
@@ -1295,7 +1295,6 @@ static void vsc8584_set_input_clk_configured(struct phy_device *phydev)static int __vsc8584_init_ptp (struct phy_device *phydev) { -struct vsc8531_private *vsc8531 = phydev->priv;static const u32 ltc_seq_e[] = {0 ,400000 ,0 ,0 ,0 };static const u8 ltc_seq_a[] = {8 ,6 ,5 ,4 ,2 };u32 val;
@@ -1512,17 +1511,7 @@ static int __vsc8584_init_ptp(struct phy_device *phydev)vsc85xx_ts_eth_cmp1_sig (phydev); - vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; - vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; - vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; - vsc8531->mii_ts.ts_info = vsc85xx_ts_info; - phydev->mii_ts = &vsc8531->mii_ts; - -memcpy (&vsc8531->ptp->caps, &vsc85xx_clk_caps,sizeof (vsc85xx_clk_caps)); - - vsc8531->ptp->ptp_clock =ptp_clock_register (&vsc8531->ptp->caps, - &phydev->mdio.dev); -return PTR_ERR_OR_ZERO (vsc8531->ptp->ptp_clock); +return 0 ; }void vsc8584_config_ts_intr (struct phy_device *phydev)
@@ -1549,6 +1538,16 @@ int vsc8584_ptp_init(struct phy_device *phydev)return 0 ; } +void vsc8584_ptp_deinit (struct phy_device *phydev) +{ +struct vsc8531_private *vsc8531 = phydev->priv; + +if (vsc8531->ptp->ptp_clock) { +ptp_clock_unregister (vsc8531->ptp->ptp_clock); +skb_queue_purge (&vsc8531->rx_skbs_list); + } +} +irqreturn_t vsc8584_handle_ts_interrupt (struct phy_device *phydev) {struct vsc8531_private *priv = phydev->priv;
@@ -1609,7 +1608,16 @@ int vsc8584_ptp_probe(struct phy_device *phydev) vsc8531->ptp->phydev = phydev; -return 0 ; + vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; + vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; + vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; + vsc8531->mii_ts.ts_info = vsc85xx_ts_info; + phydev->mii_ts = &vsc8531->mii_ts; + +memcpy (&vsc8531->ptp->caps, &vsc85xx_clk_caps,sizeof (vsc85xx_clk_caps)); + vsc8531->ptp->ptp_clock =ptp_clock_register (&vsc8531->ptp->caps, + &phydev->mdio.dev); +return PTR_ERR_OR_ZERO (vsc8531->ptp->ptp_clock); }int vsc8584_ptp_probe_once (struct phy_device *phydev)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 45/95 bnxt_en: Fix memory corruption when FW resources change during ifdown
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sreekanth Reddy <[email protected]>
[ Upstream commit 2747328ba2714f1a7454208dbbc1dc0631990b4a ]
bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.
In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings().
Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +16 -5
@@ -12241,6 +12241,17 @@ static int bnxt_set_xps_mapping(struct bnxt *bp)return rc; } +static int bnxt_tx_nr_rings (struct bnxt *bp) +{ +return bp->num_tc ? bp->tx_nr_rings_per_tc * bp->num_tc : + bp->tx_nr_rings_per_tc; +} + +static int bnxt_tx_nr_rings_per_tc (struct bnxt *bp) +{ +return bp->num_tc ? bp->tx_nr_rings / bp->num_tc : bp->tx_nr_rings; +} +static int __bnxt_open_nic (struct bnxt *bp,bool irq_re_init,bool link_re_init) {int rc =0 ;
@@ -15676,7 +15687,7 @@ static void bnxt_trim_dflt_sh_rings(struct bnxt *bp) bp->cp_nr_rings =min_t (int, bp->tx_nr_rings_per_tc, bp->rx_nr_rings); bp->rx_nr_rings = bp->cp_nr_rings; bp->tx_nr_rings_per_tc = bp->cp_nr_rings; - bp->tx_nr_rings = bp->tx_nr_rings_per_tc; + bp->tx_nr_rings =bnxt_tx_nr_rings (bp); }static int bnxt_set_dflt_rings (struct bnxt *bp,bool sh)
@@ -15708,7 +15719,7 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh)bnxt_trim_dflt_sh_rings (bp); else bp->cp_nr_rings = bp->tx_nr_rings_per_tc + bp->rx_nr_rings; - bp->tx_nr_rings = bp->tx_nr_rings_per_tc; + bp->tx_nr_rings =bnxt_tx_nr_rings (bp); avail_msix =bnxt_get_max_func_irqs (bp) - bp->cp_nr_rings;if (avail_msix >=BNXT_MIN_ROCE_CP_RINGS ) {
@@ -15721,7 +15732,7 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh) rc =__bnxt_reserve_rings (bp);if (rc && rc != -ENODEV )netdev_warn (bp->dev,"Unable to reserve tx rings\n" ); - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp);if (sh)bnxt_trim_dflt_sh_rings (bp);
@@ -15730,7 +15741,7 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh) rc =__bnxt_reserve_rings (bp);if (rc && rc != -ENODEV )netdev_warn (bp->dev,"2nd rings reservation failed.\n" ); - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp); }if (BNXT_CHIP_TYPE_NITRO_A0 (bp)) { bp->rx_nr_rings++;
@@ -15764,7 +15775,7 @@ static int bnxt_init_dflt_ring_mode(struct bnxt *bp)if (rc) goto init_dflt_ring_err; - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp);bnxt_set_dflt_rfs (bp);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 46/95 bnxt_en: Adjust TX rings if reservation is less than requested
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit 1ee581c24dfdcbc6de25aac95a48c1f08e9a542c ]
Before we accept an ethtool request to increase a resource (such as rings), we call the FW to check that the requested resource is likely available first before we commit. But it is still possible that the actual reservation or allocation can fail. The existing code is missing the logic to adjust the TX rings in case the reserved TX rings are less than requested. Add a warning message (a similar message for RX rings already exists) and add the logic to adjust the TX rings. Without this fix, the number of TX rings reported to the stack can exceed the actual TX rings and ethtool -l will report more than the actual TX rings.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +12 -0
@@ -7788,6 +7788,11 @@ static int __bnxt_reserve_rings(struct bnxt *bp) hwr.rx = rx_rings <<1 ; tx_cp =bnxt_num_tx_to_cp (bp, hwr.tx); hwr.cp = sh ?max_t (int, tx_cp, rx_rings) : tx_cp + rx_rings; +if (hwr.tx != bp->tx_nr_rings) { +netdev_warn (bp->dev, +"Able to reserve only %d out of %d requested TX rings\n" , + hwr.tx, bp->tx_nr_rings); + } bp->tx_nr_rings = hwr.tx;/* If we cannot reserve all the RX rings, reset the RSS map only
@@ -12269,6 +12274,13 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)if (rc)return rc; +/* Make adjustments if reserved TX rings are less than requested */ + bp->tx_nr_rings -= bp->tx_nr_rings_xdp; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp); +if (bp->tx_nr_rings_xdp) { + bp->tx_nr_rings_xdp = bp->tx_nr_rings_per_tc; + bp->tx_nr_rings += bp->tx_nr_rings_xdp; + } rc =bnxt_alloc_mem (bp, irq_re_init);if (rc) {netdev_err (bp->dev,"bnxt_alloc_mem err: %x\n" , rc);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 47/95 bnxt_en: Fix stats context reservation logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit b4fc8faacfea2538184a1dbd616ae9447a361f3d ]
The HW resource reservation logic allows the L2 driver to use the RoCE resources if the RoCE driver is not registered. When calculating the stats contexts available for L2, we should not blindly subtract the stats contexts reserved for RoCE unless the RoCE driver is registered. This bug may cause the L2 rings to be less than the number requested when we are close to running out of stats contexts.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -1
@@ -7780,7 +7780,8 @@ static int __bnxt_reserve_rings(struct bnxt *bp) } rx_rings =min_t (int, rx_rings, hwr.grp); hwr.cp =min_t (int, hwr.cp, bp->cp_nr_rings); -if (hwr.stat >bnxt_get_ulp_stat_ctxs (bp)) +if (bnxt_ulp_registered (bp->edev) && + hwr.stat >bnxt_get_ulp_stat_ctxs (bp)) hwr.stat -=bnxt_get_ulp_stat_ctxs (bp); hwr.cp =min_t (int, hwr.cp, hwr.stat); rc =bnxt_trim_rings (bp, &rx_rings, &hwr.tx, hwr.cp, sh);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 48/95 net/mlx5: Reload auxiliary drivers on fw_activate
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit 34cc6a54914f478c93e176450fae6313404f9f74 ]
The devlink reload fw_activate command performs firmware activation followed by driver reload, while devlink reload driver_reinit triggers only driver reload. However, the driver reload logic differs between the two modes, as on driver_reinit mode mlx5 also reloads auxiliary drivers, while in fw_activate mode the auxiliary drivers are suspended where applicable.
Additionally, following the cited commit, if the device has multiple PFs, the behavior during fw_activate may vary between PFs: one PF may suspend auxiliary drivers, while another reloads them.
Align devlink dev reload fw_activate behavior with devlink dev reload driver_reinit, to reload all auxiliary drivers.
--- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -1
@@ -107,7 +107,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netliif (err)return err; -mlx5_unload_one_devl_locked (dev, true); +mlx5_unload_one_devl_locked (dev, false); err =mlx5_health_wait_pci_up (dev);if (err)NL_SET_ERR_MSG_MOD (extack,"FW activate aborted, PCI reads fail after reset" );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 49/95 net/mlx5: Fix lockdep assertion on sync reset unload event
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit 902a8bc23a24882200f57cadc270e15a2cfaf2bb ]
Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_activate option, the PF already holds the devlink lock while handling unload event. In this case, delegate sync reset unload event handling back to the devlink callback process to avoid double-locking and resolve the lockdep warning.
Kernel log:
WARNING: CPU: 9 PID: 1578 at devl_assert_locked+0x31/0x40 [...] Call Trace: <TASK> mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core] mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core] process_one_work+0x222/0x640 worker_thread+0x199/0x350 kthread+0x10b/0x230 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x8e/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
--- .../net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- .../ethernet/mellanox/mlx5/core/fw_reset.c | 108 ++++++++++-------- .../ethernet/mellanox/mlx5/core/fw_reset.h | 1 + 3 files changed, 63 insertions(+), 48 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -1
@@ -107,7 +107,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netliif (err)return err; -mlx5_unload_one_devl_locked (dev, false); +mlx5_sync_reset_unload_flow (dev, true); err =mlx5_health_wait_pci_up (dev);if (err)NL_SET_ERR_MSG_MOD (extack,"FW activate aborted, PCI reads fail after reset" );
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +61 -47
162 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h +1 -0
@@ -12,6 +12,7 @@ int mlx5_fw_reset_set_reset_sync(struct mlx5_core_dev *dev, u8 reset_type_sel,int mlx5_fw_reset_set_live_patch (struct mlx5_core_dev *dev);int mlx5_fw_reset_wait_reset_done (struct mlx5_core_dev *dev); +void mlx5_sync_reset_unload_flow (struct mlx5_core_dev *dev,bool locked);int mlx5_fw_reset_verify_fw_complete (struct mlx5_core_dev *dev,struct netlink_ext_ack *extack);void mlx5_fw_reset_events_start (struct mlx5_core_dev *dev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 50/95 net/mlx5: Nack sync reset when SFs are present
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit 26e42ec7712d392d561964514b1f253b1a96f42d ]
If PF (Physical Function) has SFs (Sub-Functions), since the SFs are not taking part in the synchronization flow, sync reset can lead to fatal error on the SFs, as the function will be closed unexpectedly from the SF point of view.
Add a check to prevent sync reset when there are SFs on a PF device which is not ECPF, as ECPF is teardowned gracefully before reset.
--- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 6 ++++++ drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c | 10 ++++++++++ drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 ++++++ 3 files changed, 22 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +6 -0
@@ -6,6 +6,7 @@#include "fw_reset.h" #include "diag/fw_tracer.h" #include "lib/tout.h" +#include "sf/sf.h" enum {MLX5_FW_RESET_FLAGS_RESET_REQUESTED ,
@@ -423,6 +424,11 @@ static bool mlx5_is_reset_now_capable(struct mlx5_core_dev *dev,return false; } +if (!mlx5_core_is_ecpf (dev) && !mlx5_sf_table_empty (dev)) { +mlx5_core_warn (dev,"SFs should be removed before reset\n" ); +return false; + } +#if IS_ENABLED (CONFIG_HOTPLUG_PCI_PCIE )if (reset_method !=MLX5_MFRL_REG_PCI_RESET_METHOD_HOT_RESET ) { err =mlx5_check_hotplug_interrupt (dev);
drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c +10 -0
@@ -518,3 +518,13 @@ void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev)WARN_ON (!xa_empty (&table->function_ids));kfree (table); } + +bool mlx5_sf_table_empty (const struct mlx5_core_dev *dev) +{ +struct mlx5_sf_table *table = dev->priv.sf_table; + +if (!table) +return true; + +return xa_empty (&table->function_ids); +}
drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h +6 -0
@@ -17,6 +17,7 @@ void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev);int mlx5_sf_table_init (struct mlx5_core_dev *dev);void mlx5_sf_table_cleanup (struct mlx5_core_dev *dev); +bool mlx5_sf_table_empty (const struct mlx5_core_dev *dev); int mlx5_devlink_sf_port_new(struct devlink *devlink, const struct devlink_port_new_attrs *add_attr,
@@ -61,6 +62,11 @@ static inline void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) { } +static inline bool mlx5_sf_table_empty (const struct mlx5_core_dev *dev) +{ +return true; +} +#endif #endif
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 51/95 net/mlx5e: Update and set Xon/Xoff upon MTU set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb ]
Xon/Xoff sizes are derived from calculation that include the MTU size. Set Xon/Xoff when MTU is set.
If Xon/Xoff fails, set the previous MTU.
--- .../mellanox/mlx5/core/en/port_buffer.h | 12 ++++++++++++ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 ++++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +12 -0
@@ -66,11 +66,23 @@ struct mlx5e_port_buffer {struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER ]; }; +#ifdef CONFIG_MLX5_CORE_EN_DCB int mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv,u32 change,unsigned int mtu,struct ieee_pfc *pfc,u32 *buffer_size,u8 *prio2buffer); +#else +static inline int +mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv, +u32 change,unsigned int mtu, +void *pfc, +u32 *buffer_size, +u8 *prio2buffer) +{ +return 0 ; +} +#endif int mlx5e_port_query_buffer (struct mlx5e_priv *priv,struct mlx5e_port_buffer *port_buffer);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +16 -1
@@ -47,6 +47,7 @@#include "en.h" #include "en/dim.h" #include "en/txrx.h" +#include "en/port_buffer.h" #include "en_tc.h" #include "en_rep.h" #include "en_accel/ipsec.h"
@@ -2917,9 +2918,11 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)struct mlx5e_params *params = &priv->channels.params;struct net_device *netdev = priv->netdev;struct mlx5_core_dev *mdev = priv->mdev; -u16 mtu; +u16 mtu, prev_mtu;int err; +mlx5e_query_mtu (mdev, params, &prev_mtu); + err =mlx5e_set_mtu (mdev, params, params->sw_mtu);if (err)return err;
@@ -2929,6 +2932,18 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)netdev_warn (netdev,"%s: VPort MTU %d is different than netdev mtu %d\n" , __func__, mtu, params->sw_mtu); +if (mtu != prev_mtu &&MLX5_BUFFER_SUPPORTED (mdev)) { + err =mlx5e_port_manual_buffer_config (priv,0 , mtu, +NULL ,NULL ,NULL ); +if (err) { +netdev_warn (netdev,"%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n" , + __func__, mtu, err, prev_mtu); + +mlx5e_set_mtu (mdev, params, prev_mtu); +return err; + } + } + params->sw_mtu = mtu;return 0 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 52/95 net/mlx5e: Update and set Xon/Xoff upon port speed set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit d24341740fe48add8a227a753e68b6eedf4b385a ]
Xon/Xoff sizes are derived from calculations that include the port speed.
These settings need to be updated and applied whenever the port speed is changed.
The port speed is typically set after the physical link goes down and is negotiated as part of the link-up process between the two connected interfaces.
Xon/Xoff parameters being updated at the point where the new negotiated speed is established.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -0
@@ -135,6 +135,8 @@ void mlx5e_update_carrier(struct mlx5e_priv *priv)if (up) {netdev_info (priv->netdev,"Link up\n" );netif_carrier_on (priv->netdev); +mlx5e_port_manual_buffer_config (priv,0 , priv->netdev->mtu, +NULL ,NULL ,NULL ); }else {netdev_info (priv->netdev,"Link down\n" );netif_carrier_off (priv->netdev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 53/95 net/mlx5e: Set local Xoff after FW update
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit aca0c31af61e0d5cf1675a0cbd29460b95ae693c ]
The local Xoff value is being set before the firmware (FW) update. In case of a failure where the FW is not updated with the new value, there is no fallback to the previous value.
Update the local Xoff value after the FW has been successfully set.
--- drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +2 -1
@@ -575,7 +575,6 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,if (err)return err; } - priv->dcbx.xoff = xoff;/* Apply the settings */ if (update_buffer) {
@@ -584,6 +583,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,return err; } + priv->dcbx.xoff = xoff; +if (update_prio2buffer) err =mlx5e_port_set_priority2buffer (priv->mdev, prio2buffer);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 54/95 net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit 4f23382841e67174211271a454811dd17c0ef3c5 ]
Enabling RX FIFO Overflow interrupts is counterproductive and causes an interrupt storm when RX FIFO overflows. Disabling this interrupt has no side effect and eliminates interrupt storms when the RX FIFO overflows.
Commit 8a7cb245cf28 ("net: stmmac: Do not enable RX FIFO overflow interrupts") disables RX FIFO overflow interrupts for DWMAC4 IP and removes the corresponding handling of this interrupt. This patch is doing the same thing for XGMAC IP.
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +0 -4
@@ -203,10 +203,6 @@ static void dwxgmac2_dma_rx_mode(struct stmmac_priv *priv, void __iomem *ioaddr, }writel (value, ioaddr +XGMAC_MTL_RXQ_OPMODE (channel)); - -/* Enable MTL RX overflow */ - value =readl (ioaddr +XGMAC_MTL_QINTEN (channel)); -writel (value |XGMAC_RXOIE , ioaddr +XGMAC_MTL_QINTEN (channel)); } static void dwxgmac2_dma_tx_mode(struct stmmac_priv *priv, void __iomem *ioaddr,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 55/95 net: stmmac: xgmac: Correct supported speed modes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit 42ef11b2bff5b6a2910c28d2ea47cc00e0fbcaec ]
Correct supported speed modes as per the XGMAC databook. Commit 9cb54af214a7 ("net: stmmac: Fix IP-cores specific MAC capabilities") removes support for 10M, 100M and 1000HD. 1000HD is not supported by XGMAC IP, but it does support 10M and 100M FD mode for XGMAC version >= 2_20, and it also supports 10M and 100M HD mode if the HDSEL bit is set in the MAC_HW_FEATURE0 reg. This commit enables support for 10M and 100M speed modes for XGMAC IP based on XGMAC version and MAC capabilities.
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 +++++++++++-- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 5 +++++ 2 files changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +11 -2
@@ -47,6 +47,14 @@ static void dwxgmac2_core_init(struct mac_device_info *hw,writel (XGMAC_INT_DEFAULT_EN , ioaddr +XGMAC_INT_EN ); } +static void dwxgmac2_update_caps (struct stmmac_priv *priv) +{ +if (!priv->dma_cap.mbps_10_100) + priv->hw->link.caps &= ~(MAC_10 |MAC_100 ); +else if (!priv->dma_cap.half_duplex) + priv->hw->link.caps &= ~(MAC_10HD |MAC_100HD ); +} +static void dwxgmac2_set_mac (void __iomem *ioaddr,bool enable) {u32 tx =readl (ioaddr +XGMAC_TX_CONFIG );
@@ -1532,6 +1540,7 @@ static void dwxgmac3_fpe_configure(void __iomem *ioaddr,const struct stmmac_ops dwxgmac210_ops = { .core_init = dwxgmac2_core_init, + .update_caps = dwxgmac2_update_caps, .set_mac = dwxgmac2_set_mac, .rx_ipc = dwxgmac2_rx_ipc, .rx_queue_enable = dwxgmac2_rx_queue_enable,
@@ -1646,8 +1655,8 @@ int dwxgmac2_setup(struct stmmac_priv *priv) mac->mcast_bits_log2 =ilog2 (mac->multicast_filter_bins); mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | -MAC_1000FD |MAC_2500FD |MAC_5000FD | -MAC_10000FD ; +MAC_10 |MAC_100 |MAC_1000FD | +MAC_2500FD |MAC_5000FD |MAC_10000FD ; mac->link.duplex =0 ; mac->link.speed10 =XGMAC_CONFIG_SS_10_MII ; mac->link.speed100 =XGMAC_CONFIG_SS_100_MII ;
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +5 -0
@@ -382,8 +382,11 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv,static int dwxgmac2_get_hw_feature (void __iomem *ioaddr,struct dma_features *dma_cap) { +struct stmmac_priv *priv;u32 hw_cap; + priv = container_of(dma_cap, struct stmmac_priv, dma_cap); +/* MAC HW feature 0 */ hw_cap =readl (ioaddr +XGMAC_HW_FEATURE0 ); dma_cap->edma = (hw_cap &XGMAC_HWFEAT_EDMA ) >>31 ;
@@ -406,6 +409,8 @@ static int dwxgmac2_get_hw_feature(void __iomem *ioaddr, dma_cap->vlhash = (hw_cap &XGMAC_HWFEAT_VLHASH ) >>4 ; dma_cap->half_duplex = (hw_cap &XGMAC_HWFEAT_HDSEL ) >>3 ; dma_cap->mbps_1000 = (hw_cap &XGMAC_HWFEAT_GMIISEL ) >>1 ; +if (dma_cap->mbps_1000 && priv->synopsys_id >=DWXGMAC_CORE_2_20 ) + dma_cap->mbps_10_100 =1 ;/* MAC HW feature 1 */ hw_cap =readl (ioaddr +XGMAC_HW_FEATURE1 );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 56/95 net: stmmac: Set CIC bit only for TX queues with COE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit b1eded580ab28119de0b0f21efe37ee2b4419144 ]
Currently, in the AF_XDP transmit paths, the CIC bit of TX Desc3 is set for all packets. Setting this bit for packets transmitting through queues that don't support checksum offloading causes the TX DMA to get stuck after transmitting some packets. This patch ensures the CIC bit of TX Desc3 is set only if the TX queue supports checksum offloading.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +4 -2
@@ -2488,6 +2488,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget)struct netdev_queue *nq =netdev_get_tx_queue (priv->dev, queue);struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue]; +bool csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported;struct xsk_buff_pool *pool = tx_q->xsk_pool;unsigned int entry = tx_q->cur_tx;struct dma_desc *tx_desc =NULL ;
@@ -2573,7 +2574,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) }stmmac_prepare_tx_desc (priv, tx_desc,1 , xdp_desc.len, - true, priv->mode, true, true, + csum, priv->mode, true, true, xdp_desc.len);stmmac_enable_dma_transmission (priv, priv->ioaddr, queue);
@@ -4902,6 +4903,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue, {struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue];struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue]; +bool csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported;unsigned int entry = tx_q->cur_tx;struct dma_desc *tx_desc;dma_addr_t dma_addr;
@@ -4953,7 +4955,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,stmmac_set_desc_addr (priv, tx_desc, dma_addr);stmmac_prepare_tx_desc (priv, tx_desc,1 , xdpf->len, - true, priv->mode, true, true, + csum, priv->mode, true, true, xdpf->len); tx_q->tx_count_frames++;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 57/95 hv_netvsc: Link queues to NAPIs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <[email protected]>
[ Upstream commit 8b641b5e4c782464c8818a71b443eeef8984bf34 ]
Use netif_queue_set_napi to link queues to NAPI instances so that they can be queried with netlink.
Shradha Gupta tested the patch and reported that the results are as expected:
$ ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/netdev.yaml \
--dump queue-get --json='{"ifindex": 2}' [{'id': 0, 'ifindex': 2, 'napi-id': 8193, 'type': 'rx'},
{'id': 1, 'ifindex': 2, 'napi-id': 8194, 'type': 'rx'}, {'id': 2, 'ifindex': 2, 'napi-id': 8195, 'type': 'rx'}, {'id': 3, 'ifindex': 2, 'napi-id': 8196, 'type': 'rx'}, {'id': 4, 'ifindex': 2, 'napi-id': 8197, 'type': 'rx'}, {'id': 5, 'ifindex': 2, 'napi-id': 8198, 'type': 'rx'}, {'id': 6, 'ifindex': 2, 'napi-id': 8199, 'type': 'rx'}, {'id': 7, 'ifindex': 2, 'napi-id': 8200, 'type': 'rx'}, {'id': 0, 'ifindex': 2, 'napi-id': 8193, 'type': 'tx'}, {'id': 1, 'ifindex': 2, 'napi-id': 8194, 'type': 'tx'}, {'id': 2, 'ifindex': 2, 'napi-id': 8195, 'type': 'tx'}, {'id': 3, 'ifindex': 2, 'napi-id': 8196, 'type': 'tx'}, {'id': 4, 'ifindex': 2, 'napi-id': 8197, 'type': 'tx'}, {'id': 5, 'ifindex': 2, 'napi-id': 8198, 'type': 'tx'}, {'id': 6, 'ifindex': 2, 'napi-id': 8199, 'type': 'tx'}, {'id': 7, 'ifindex': 2, 'napi-id': 8200, 'type': 'tx'}]
Stable-dep-of: 9448ccd85336 ("net: hv_netvsc: fix loss of early receive events from host during channel open.")
--- drivers/net/hyperv/netvsc.c | 13 ++++++++++++- drivers/net/hyperv/rndis_filter.c | 9 +++++++-- 2 files changed, 19 insertions(+), 3 deletions(-)
drivers/net/hyperv/netvsc.c +12 -1
@@ -712,8 +712,13 @@ void netvsc_device_remove(struct hv_device *device)for (i =0 ; i < net_device->num_chn; i++) {/* See also vmbus_reset_channel_cb(). */ /* only disable enabled NAPI channel */ -if (i < ndev->real_num_rx_queues) +if (i < ndev->real_num_rx_queues) { +netif_queue_set_napi (ndev, i,NETDEV_QUEUE_TYPE_TX , +NULL ); +netif_queue_set_napi (ndev, i,NETDEV_QUEUE_TYPE_RX , +NULL );napi_disable (&net_device->chan_table[i].napi); + }netif_napi_del (&net_device->chan_table[i].napi); }
@@ -1826,6 +1831,10 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,netdev_dbg (ndev,"hv_netvsc channel opened successfully\n" );napi_enable (&net_device->chan_table[0 ].napi); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX , + &net_device->chan_table[0 ].napi); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX , + &net_device->chan_table[0 ].napi);/* Connect with the NetVsp */ ret =netvsc_connect_vsp (device, net_device, device_info);
@@ -1844,6 +1853,8 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, close:RCU_INIT_POINTER (net_device_ctx->nvdev,NULL ); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX ,NULL ); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX ,NULL );napi_disable (&net_device->chan_table[0 ].napi);/* Now, we can close the channel safely */
drivers/net/hyperv/rndis_filter.c +7 -2
@@ -1255,10 +1255,15 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc) ret =vmbus_open (new_sc, netvsc_ring_bytes, netvsc_ring_bytes,NULL ,0 , netvsc_channel_cb, nvchan); -if (ret ==0 ) +if (ret ==0 ) {napi_enable (&nvchan->napi); -else +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_RX , + &nvchan->napi); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_TX , + &nvchan->napi); + }else {netdev_notice (ndev,"sub channel open failed: %d\n" , ret); + }if (atomic_inc_return (&nvscdev->open_chn) == nvscdev->num_chn)wake_up (&nvscdev->subchan_open);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 58/95 net: hv_netvsc: fix loss of early receive events from host during channel open.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipayaan Roy <[email protected]>
[ Upstream commit 9448ccd853368582efa9db05db344f8bb9dffe0f ]
The hv_netvsc driver currently enables NAPI after opening the primary and subchannels. This ordering creates a race: if the Hyper-V host places data in the host -> guest ring buffer and signals the channel before napi_enable() has been called, the channel callback will run but napi_schedule_prep() will return false. As a result, the NAPI poller never gets scheduled, the data in the ring buffer is not consumed, and the receive queue may remain permanently stuck until another interrupt happens to arrive.
Fix this by enabling NAPI and registering it with the RX/TX queues before vmbus channel is opened. This guarantees that any early host signal after open will correctly trigger NAPI scheduling and the ring buffer will be drained.
--- drivers/net/hyperv/netvsc.c | 17 ++++++++--------- drivers/net/hyperv/rndis_filter.c | 23 ++++++++++++++++------- 2 files changed, 24 insertions(+), 16 deletions(-)
drivers/net/hyperv/netvsc.c +8 -9
@@ -1811,6 +1811,11 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,/* Enable NAPI handler before init callbacks */ netif_napi_add (ndev, &net_device->chan_table[0 ].napi, netvsc_poll); +napi_enable (&net_device->chan_table[0 ].napi); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX , + &net_device->chan_table[0 ].napi); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX , + &net_device->chan_table[0 ].napi);/* Open the channel */ device->channel->next_request_id_callback = vmbus_next_request_id;
@@ -1830,12 +1835,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,/* Channel is opened */ netdev_dbg (ndev,"hv_netvsc channel opened successfully\n" ); -napi_enable (&net_device->chan_table[0 ].napi); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX , - &net_device->chan_table[0 ].napi); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX , - &net_device->chan_table[0 ].napi); -/* Connect with the NetVsp */ ret =netvsc_connect_vsp (device, net_device, device_info);if (ret !=0 ) {
@@ -1853,14 +1852,14 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, close:RCU_INIT_POINTER (net_device_ctx->nvdev,NULL ); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX ,NULL ); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX ,NULL ); -napi_disable (&net_device->chan_table[0 ].napi);/* Now, we can close the channel safely */ vmbus_close (device->channel); cleanup: +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX ,NULL ); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX ,NULL ); +napi_disable (&net_device->chan_table[0 ].napi);netif_napi_del (&net_device->chan_table[0 ].napi); cleanup2:
drivers/net/hyperv/rndis_filter.c +16 -7
@@ -1252,17 +1252,26 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc) new_sc->rqstor_size =netvsc_rqstor_size (netvsc_ring_bytes); new_sc->max_pkt_size =NETVSC_MAX_PKT_SIZE ; +/* Enable napi before opening the vmbus channel to avoid races +* as the host placing data on the host->guest ring may be left +* out if napi was not enabled. +*/ +napi_enable (&nvchan->napi); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_RX , + &nvchan->napi); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_TX , + &nvchan->napi); + ret =vmbus_open (new_sc, netvsc_ring_bytes, netvsc_ring_bytes,NULL ,0 , netvsc_channel_cb, nvchan); -if (ret ==0 ) { -napi_enable (&nvchan->napi); -netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_RX , - &nvchan->napi); -netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_TX , - &nvchan->napi); - }else { +if (ret !=0 ) {netdev_notice (ndev,"sub channel open failed: %d\n" , ret); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_TX , +NULL ); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_RX , +NULL ); +napi_disable (&nvchan->napi); }if (atomic_inc_return (&nvscdev->open_chn) == nvscdev->num_chn)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 59/95 net: rose: split remove and free operations in rose_remove_neigh()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit dcb34659028f856c423a29ef9b4e2571d203444d ]
The current rose_remove_neigh() performs two distinct operations:
1. Removes rose_neigh from rose_neigh_list
2. Frees the rose_neigh structure
Split these operations into separate functions to improve maintainability and prepare for upcoming refcount_t conversion. The timer cleanup remains in rose_remove_neigh() because free operations can be called from timer itself.
This patch introduce rose_neigh_put() to handle the freeing of rose_neigh structures and modify rose_remove_neigh() to handle removal only.
Stable-dep-of: d860d1faa6b2 ("net: rose: convert 'use' field to refcount_t")
--- include/net/rose.h | 8 ++++++++ net/rose/rose_route.c | 15 ++++++--------- 2 files changed, 14 insertions(+), 9 deletions(-)
include/net/rose.h +8 -0
@@ -151,6 +151,14 @@ struct rose_sock {#define rose_sk (sk) ((struct rose_sock *)(sk)) +static inline void rose_neigh_put (struct rose_neigh *rose_neigh) +{ +if (rose_neigh->ax25) +ax25_cb_put (rose_neigh->ax25); +kfree (rose_neigh->digipeat); +kfree (rose_neigh); +} +/* af_rose.c */ extern ax25_address rose_callsign;extern int sysctl_rose_restart_request_timeout;
net/rose/rose_route.c +6 -9
@@ -234,20 +234,12 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)if ((s = rose_neigh_list) == rose_neigh) { rose_neigh_list = rose_neigh->next; -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh);return ; }while (s !=NULL && s->next !=NULL ) {if (s->next == rose_neigh) { s->next = rose_neigh->next; -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh);return ; }
@@ -331,8 +323,10 @@ static int rose_del_node(struct rose_route_struct *rose_route,if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; -if (rose_neigh->count ==0 && rose_neigh->use ==0 ) +if (rose_neigh->count ==0 && rose_neigh->use ==0 ) {rose_remove_neigh (rose_neigh); +rose_neigh_put (rose_neigh); + } rose_node->count--;
@@ -513,6 +507,7 @@ void rose_rt_device_down(struct net_device *dev) }rose_remove_neigh (s); +rose_neigh_put (s); }spin_unlock_bh (&rose_neigh_list_lock);spin_unlock_bh (&rose_node_list_lock);
@@ -569,6 +564,7 @@ static int rose_clear_routes(void)if (s->use ==0 && !s->loopback) { s->count =0 ;rose_remove_neigh (s); +rose_neigh_put (s); } }
@@ -1301,6 +1297,7 @@ void __exit rose_rt_free(void) rose_neigh = rose_neigh->next;rose_remove_neigh (s); +rose_neigh_put (s); }while (rose_node !=NULL ) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 60/95 net: rose: convert use field to refcount_t
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit d860d1faa6b2ce3becfdb8b0c2b048ad31800061 ]
The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths.
For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues.
This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.
--- include/net/rose.h | 18 +++++++++++++----- net/rose/af_rose.c | 13 +++++++------ net/rose/rose_in.c | 12 ++++++------ net/rose/rose_route.c | 33 ++++++++++++++++++--------------- net/rose/rose_timer.c | 2 +- 5 files changed, 45 insertions(+), 33 deletions(-)
include/net/rose.h +13 -5
@@ -8,6 +8,7 @@#ifndef _ROSE_H#define _ROSE_H +#include <linux/refcount.h>#include <linux/rose.h> #include <net/ax25.h> #include <net/sock.h>
@@ -96,7 +97,7 @@ struct rose_neigh {ax25_cb *ax25;struct net_device *dev;unsigned short count; -unsigned short use; +refcount_t use;unsigned int number;char restarted;char dce_mode;
@@ -151,12 +152,19 @@ struct rose_sock {#define rose_sk (sk) ((struct rose_sock *)(sk)) +static inline void rose_neigh_hold (struct rose_neigh *rose_neigh) +{ +refcount_inc (&rose_neigh->use); +} +static inline void rose_neigh_put (struct rose_neigh *rose_neigh) { -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh); +if (refcount_dec_and_test (&rose_neigh->use)) { +if (rose_neigh->ax25) +ax25_cb_put (rose_neigh->ax25); +kfree (rose_neigh->digipeat); +kfree (rose_neigh); + } }/* af_rose.c */
net/rose/af_rose.c +7 -6
@@ -170,7 +170,7 @@ void rose_kill_by_neigh(struct rose_neigh *neigh)if (rose->neighbour == neigh) {rose_disconnect (s,ENETUNREACH ,ROSE_OUT_OF_ORDER ,0 ); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour); rose->neighbour =NULL ; } }
@@ -212,7 +212,7 @@ static void rose_kill_by_device(struct net_device *dev)if (rose->device == dev) {rose_disconnect (sk,ENETUNREACH ,ROSE_OUT_OF_ORDER ,0 );if (rose->neighbour) - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);netdev_put (rose->device, &rose->dev_tracker); rose->device =NULL ; }
@@ -655,7 +655,7 @@ static int rose_release(struct socket *sock)break ;case ROSE_STATE_2 : - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);release_sock (sk);rose_disconnect (sk,0 ,-1 ,-1 );lock_sock (sk);
@@ -823,6 +823,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le rose->lci =rose_new_lci (rose->neighbour);if (!rose->lci) { err = -ENETUNREACH ; +rose_neigh_put (rose->neighbour); goto out_release; }
@@ -834,12 +835,14 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le dev =rose_dev_first ();if (!dev) { err = -ENETUNREACH ; +rose_neigh_put (rose->neighbour); goto out_release; } user =ax25_findbyuid (current_euid ());if (!user) { err = -EINVAL ; +rose_neigh_put (rose->neighbour);dev_put (dev); goto out_release; }
@@ -874,8 +877,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le rose->state =ROSE_STATE_1 ; - rose->neighbour->use++; -rose_write_internal (sk,ROSE_CALL_REQUEST );rose_start_heartbeat (sk);rose_start_t1timer (sk);
@@ -1077,7 +1078,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros GFP_ATOMIC); make_rose->facilities = facilities; - make_rose->neighbour->use++; +rose_neigh_hold (make_rose->neighbour);if (rose_sk (sk)->defer) { make_rose->state =ROSE_STATE_5 ;
net/rose/rose_in.c +6 -6
@@ -56,7 +56,7 @@ static int rose_state1_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,ECONNREFUSED , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -79,12 +79,12 @@ static int rose_state2_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;case ROSE_CLEAR_CONFIRMATION :rose_disconnect (sk,0 ,-1 ,-1 ); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -120,7 +120,7 @@ static int rose_state3_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;case ROSE_RR :
@@ -233,7 +233,7 @@ static int rose_state4_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -253,7 +253,7 @@ static int rose_state5_machine(struct sock *sk, struct sk_buff *skb, int frametyif (frametype ==ROSE_CLEAR_REQUEST ) {rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); -rose_sk (sk)->neighbour->use--; +rose_neigh_put (rose_sk (sk)->neighbour); }return 0 ;
net/rose/rose_route.c +18 -15
@@ -93,11 +93,11 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, rose_neigh->ax25 =NULL ; rose_neigh->dev = dev; rose_neigh->count =0 ; - rose_neigh->use =0 ; rose_neigh->dce_mode =0 ; rose_neigh->loopback =0 ; rose_neigh->number = rose_neigh_no++; rose_neigh->restarted =0 ; +refcount_set (&rose_neigh->use,1 );skb_queue_head_init (&rose_neigh->queue);
@@ -255,10 +255,10 @@ static void rose_remove_route(struct rose_route *rose_route)struct rose_route *s;if (rose_route->neigh1 !=NULL ) - rose_route->neigh1->use--; +rose_neigh_put (rose_route->neigh1);if (rose_route->neigh2 !=NULL ) - rose_route->neigh2->use--; +rose_neigh_put (rose_route->neigh2);if ((s = rose_route_list) == rose_route) { rose_route_list = rose_route->next;
@@ -323,7 +323,7 @@ static int rose_del_node(struct rose_route_struct *rose_route,if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; -if (rose_neigh->count ==0 && rose_neigh->use ==0 ) { +if (rose_neigh->count ==0 ) {rose_remove_neigh (rose_neigh);rose_neigh_put (rose_neigh); }
@@ -375,11 +375,11 @@ void rose_add_loopback_neigh(void) sn->ax25 =NULL ; sn->dev =NULL ; sn->count =0 ; - sn->use =0 ; sn->dce_mode =1 ; sn->loopback =1 ; sn->number = rose_neigh_no++; sn->restarted =1 ; +refcount_set (&sn->use,1 );skb_queue_head_init (&sn->queue);
@@ -561,8 +561,7 @@ static int rose_clear_routes(void) s = rose_neigh; rose_neigh = rose_neigh->next; -if (s->use ==0 && !s->loopback) { - s->count =0 ; +if (!s->loopback) {rose_remove_neigh (s);rose_neigh_put (s); }
@@ -680,6 +679,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,for (i =0 ; i < node->count; i++) {if (node->neighbour[i]->restarted) { res = node->neighbour[i]; +rose_neigh_hold (node->neighbour[i]); goto out; } }
@@ -691,6 +691,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,for (i =0 ; i < node->count; i++) {if (!rose_ftimer_running (node->neighbour[i])) { res = node->neighbour[i]; +rose_neigh_hold (node->neighbour[i]); goto out; } failed =1 ;
@@ -780,13 +781,13 @@ static void rose_del_route_by_neigh(struct rose_neigh *rose_neigh) }if (rose_route->neigh1 == rose_neigh) { - rose_route->neigh1->use--; +rose_neigh_put (rose_route->neigh1); rose_route->neigh1 =NULL ;rose_transmit_clear_request (rose_route->neigh2, rose_route->lci2,ROSE_OUT_OF_ORDER ,0 ); }if (rose_route->neigh2 == rose_neigh) { - rose_route->neigh2->use--; +rose_neigh_put (rose_route->neigh2); rose_route->neigh2 =NULL ;rose_transmit_clear_request (rose_route->neigh1, rose_route->lci1,ROSE_OUT_OF_ORDER ,0 ); }
@@ -915,7 +916,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)rose_clear_queues (sk); rose->cause =ROSE_NETWORK_CONGESTION ; rose->diagnostic =0 ; - rose->neighbour->use--; +rose_neigh_put (rose->neighbour); rose->neighbour =NULL ; rose->lci =0 ; rose->state =ROSE_STATE_0 ;
@@ -1040,12 +1041,12 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)if ((new_lci =rose_new_lci (new_neigh)) ==0 ) {rose_transmit_clear_request (rose_neigh, lci,ROSE_NETWORK_CONGESTION ,71 ); - goto out; + goto put_neigh; }if ((rose_route =kmalloc (sizeof (*rose_route),GFP_ATOMIC )) ==NULL ) {rose_transmit_clear_request (rose_neigh, lci,ROSE_NETWORK_CONGESTION ,120 ); - goto out; + goto put_neigh; } rose_route->lci1 = lci;
@@ -1058,8 +1059,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) rose_route->lci2 = new_lci; rose_route->neigh2 = new_neigh; - rose_route->neigh1->use++; - rose_route->neigh2->use++; +rose_neigh_hold (rose_route->neigh1); +rose_neigh_hold (rose_route->neigh2); rose_route->next = rose_route_list; rose_route_list = rose_route;
@@ -1071,6 +1072,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)rose_transmit_link (skb, rose_route->neigh2); res =1 ; +put_neigh: +rose_neigh_put (new_neigh); out:spin_unlock_bh (&rose_route_list_lock);spin_unlock_bh (&rose_neigh_list_lock);
@@ -1186,7 +1189,7 @@ static int rose_neigh_show(struct seq_file *seq, void *v) (rose_neigh->loopback) ?"RSLOOP-0" :ax2asc (buf, &rose_neigh->callsign), rose_neigh->dev ? rose_neigh->dev->name :"???" , rose_neigh->count, - rose_neigh->use, +refcount_read (&rose_neigh->use) -1 , (rose_neigh->dce_mode) ?"DCE" :"DTE" , (rose_neigh->restarted) ?"yes" :"no" , ax25_display_timer(&rose_neigh->t0timer) / HZ,
net/rose/rose_timer.c +1 -1
@@ -180,7 +180,7 @@ static void rose_timer_expiry(struct timer_list *t)break ;case ROSE_STATE_2 :/* T3 */ - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);rose_disconnect (sk,ETIMEDOUT ,-1 ,-1 );break ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 61/95 net: rose: include node references in rose_neigh refcount
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit da9c9c877597170b929a6121a68dcd3dd9a80f45 ]
Current implementation maintains two separate reference counting
mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock.
This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented.
This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node().
These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.
--- net/rose/rose_route.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
net/rose/rose_route.c +16 -2
@@ -178,6 +178,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, } } rose_neigh->count++; +rose_neigh_hold (rose_neigh); goto out; }
@@ -187,6 +188,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, rose_node->neighbour[rose_node->count] = rose_neigh; rose_node->count++; rose_neigh->count++; +rose_neigh_hold (rose_neigh); } out:
@@ -322,6 +324,7 @@ static int rose_del_node(struct rose_route_struct *rose_route,for (i =0 ; i < rose_node->count; i++) {if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; +rose_neigh_put (rose_neigh);if (rose_neigh->count ==0 ) {rose_remove_neigh (rose_neigh);
@@ -430,6 +433,7 @@ int rose_add_loopback_node(const rose_address *address) rose_node_list = rose_node; rose_loopback_neigh->count++; +rose_neigh_hold (rose_loopback_neigh); out:spin_unlock_bh (&rose_node_list_lock);
@@ -461,6 +465,7 @@ void rose_del_loopback_node(const rose_address *address)rose_remove_node (rose_node); rose_loopback_neigh->count--; +rose_neigh_put (rose_loopback_neigh); out:spin_unlock_bh (&rose_node_list_lock);
@@ -500,6 +505,7 @@ void rose_rt_device_down(struct net_device *dev)memmove (&t->neighbour[i], &t->neighbour[i +1 ],sizeof (t->neighbour[0 ]) * (t->count - i)); +rose_neigh_put (s); }if (t->count <=0 )
@@ -543,6 +549,7 @@ static int rose_clear_routes(void) {struct rose_neigh *s, *rose_neigh;struct rose_node *t, *rose_node; +int i;spin_lock_bh (&rose_node_list_lock);spin_lock_bh (&rose_neigh_list_lock);
@@ -553,8 +560,12 @@ static int rose_clear_routes(void)while (rose_node !=NULL ) { t = rose_node; rose_node = rose_node->next; -if (!t->loopback) + +if (!t->loopback) { +for (i =0 ; i < rose_node->count; i++) +rose_neigh_put (t->neighbour[i]);rose_remove_node (t); + } }while (rose_neigh !=NULL ) {
@@ -1189,7 +1200,7 @@ static int rose_neigh_show(struct seq_file *seq, void *v) (rose_neigh->loopback) ?"RSLOOP-0" :ax2asc (buf, &rose_neigh->callsign), rose_neigh->dev ? rose_neigh->dev->name :"???" , rose_neigh->count, -refcount_read (&rose_neigh->use) -1 , +refcount_read (&rose_neigh->use) - rose_neigh->count -1 , (rose_neigh->dce_mode) ?"DCE" :"DTE" , (rose_neigh->restarted) ?"yes" :"no" , ax25_display_timer(&rose_neigh->t0timer) / HZ,
@@ -1294,6 +1305,7 @@ void __exit rose_rt_free(void)struct rose_neigh *s, *rose_neigh = rose_neigh_list;struct rose_node *t, *rose_node = rose_node_list;struct rose_route *u, *rose_route = rose_route_list; +int i;while (rose_neigh !=NULL ) { s = rose_neigh;
@@ -1307,6 +1319,8 @@ void __exit rose_rt_free(void) t = rose_node; rose_node = rose_node->next; +for (i =0 ; i < t->count; i++) +rose_neigh_put (t->neighbour[i]);rose_remove_node (t); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 62/95 sctp: initialize more fields in sctp_v6_from_sk()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2e8750469242cad8f01f320131fd5a6f540dbb99 ]
syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior.
Clear sin6_scope_id and sin6_flowinfo.
BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable addr.i.i created at:
sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930
--- net/sctp/ipv6.c | 2 ++ 1 file changed, 2 insertions(+)
net/sctp/ipv6.c +2 -0
@@ -546,7 +546,9 @@ static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk) { addr->v6.sin6_family =AF_INET6 ; addr->v6.sin6_port =0 ; + addr->v6.sin6_flowinfo =0 ; addr->v6.sin6_addr = sk->sk_v6_rcv_saddr; + addr->v6.sin6_scope_id =0 ; }/* Initialize sk->sk_rcv_saddr from sctp_addr. */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 63/95 l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9b8c88f875c04d4cb9111bd5dd9291c7e9691bf5 ]
pppol2tp_session_get_sock() is using RCU, it must be ready for sk_refcnt being zero.
Commit ee40fb2e1eb5 ("l2tp: protect sock pointer of
struct pppol2tp_session with RCU") was correct because it
had a call_rcu(..., pppol2tp_put_sk) which was later removed in blamed commit.
pppol2tp_recv() can use pppol2tp_session_get_sock() as well.
--- net/l2tp/l2tp_ppp.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-)
net/l2tp/l2tp_ppp.c +8 -17
@@ -129,22 +129,12 @@ static const struct ppp_channel_ops pppol2tp_chan_ops = {static const struct proto_ops pppol2tp_ops; -/* Retrieves the pppol2tp socket associated to a session. -* A reference is held on the returned socket, so this function must be paired -* with sock_put(). -*/ +/* Retrieves the pppol2tp socket associated to a session. */ static struct sock *pppol2tp_session_get_sock (struct l2tp_session *session) {struct pppol2tp_session *ps =l2tp_session_priv (session); -struct sock *sk; - -rcu_read_lock (); - sk =rcu_dereference (ps->sk); -if (sk) -sock_hold (sk); -rcu_read_unlock (); -return sk; +return rcu_dereference (ps->sk); }/* Helpers to obtain tunnel/session contexts from sockets.
@@ -206,14 +196,13 @@ static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,static void pppol2tp_recv (struct l2tp_session *session,struct sk_buff *skb,int data_len) { -struct pppol2tp_session *ps =l2tp_session_priv (session); -struct sock *sk =NULL ; +struct sock *sk;/* If the socket is bound, send it in to PPP's input queue. Otherwise * queue it on the session socket. */ rcu_read_lock (); - sk =rcu_dereference (ps->sk); + sk =pppol2tp_session_get_sock (session);if (!sk) goto no_sock;
@@ -510,13 +499,14 @@ static void pppol2tp_show(struct seq_file *m, void *arg)struct l2tp_session *session = arg;struct sock *sk; +rcu_read_lock (); sk =pppol2tp_session_get_sock (session);if (sk) {struct pppox_sock *po =pppox_sk (sk);seq_printf (m," interface %s\n" ,ppp_dev_name (&po->chan)); -sock_put (sk); } +rcu_read_unlock (); }static void pppol2tp_session_init (struct l2tp_session *session)
@@ -1529,6 +1519,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v) port =ntohs (inet->inet_sport); } +rcu_read_lock (); sk =pppol2tp_session_get_sock (session);if (sk) { state = sk->sk_state;
@@ -1564,8 +1555,8 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)struct pppox_sock *po =pppox_sk (sk);seq_printf (m," interface %s\n" ,ppp_dev_name (&po->chan)); -sock_put (sk); } +rcu_read_unlock (); }static int pppol2tp_seq_show (struct seq_file *m,void *v)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 64/95 fbnic: Move phylink resume out of service_task and into open/close
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <[email protected]>
[ Upstream commit 6ede14a2c6365e7e5d855643c7c8390b5268c467 ]
The fbnic driver was presenting with the following locking assert coming out of a PM resume:
[ 42.208116][ T164] RTNL: assertion failed at drivers/net/phy/phylink.c (2611) [ 42.208492][ T164] WARNING: CPU: 1 PID: 164 at drivers/net/phy/phylink.c:2611 phylink_resume+0x190/0x1e0 [ 42.208872][ T164] Modules linked in: [ 42.209140][ T164] CPU: 1 UID: 0 PID: 164 Comm: bash Not tainted 6.17.0-rc2-virtme #134 PREEMPT(full) [ 42.209496][ T164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 [ 42.209861][ T164] RIP: 0010:phylink_resume+0x190/0x1e0 [ 42.210057][ T164] Code: 83 e5 01 0f 85 b0 fe ff ff c6 05 1c cd 3e 02 01 90 ba 33 0a 00 00 48 c7 c6 20 3a 1d a5 48 c7 c7 e0 3e 1d a5 e8 21 b8 90 fe 90 <0f> 0b 90 90 e9 86 fe ff ff e8 42 ea 1f ff e9 e2 fe ff ff 48 89 ef [ 42.210708][ T164] RSP: 0018:ffffc90000affbd8 EFLAGS: 00010296 [ 42.210983][ T164] RAX: 0000000000000000 RBX: ffff8880078d8400 RCX: 0000000000000000 [ 42.211235][ T164] RDX: 0000000000000000 RSI: 1ffffffff4f10938 RDI: 0000000000000001 [ 42.211466][ T164] RBP: 0000000000000000 R08: ffffffffa2ae79ea R09: fffffbfff4b3eb84 [ 42.211707][ T164] R10: 0000000000000003 R11: 0000000000000000 R12: ffff888007ad8000 [ 42.211997][ T164] R13: 0000000000000002 R14: ffff888006a18800 R15: ffffffffa34c59e0 [ 42.212234][ T164] FS: 00007f0dc8e39740(0000) GS:ffff88808f51f000(0000) knlGS:0000000000000000 [ 42.212505][ T164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.212704][ T164] CR2: 00007f0dc8e9fe10 CR3: 000000000b56d003 CR4: 0000000000772ef0 [ 42.213227][ T164] PKRU: 55555554 [ 42.213366][ T164] Call Trace: [ 42.213483][ T164] <TASK> [ 42.213565][ T164] __fbnic_pm_attach.isra.0+0x8e/0xa0 [ 42.213725][ T164] pci_reset_function+0x116/0x1d0 [ 42.213895][ T164] reset_store+0xa0/0x100 [ 42.214025][ T164] ? pci_dev_reset_attr_is_visible+0x50/0x50 [ 42.214221][ T164] ? sysfs_file_kobj+0xc1/0x1e0 [ 42.214374][ T164] ? sysfs_kf_write+0x65/0x160 [ 42.214526][ T164] kernfs_fop_write_iter+0x2f8/0x4c0 [ 42.214677][ T164] ? kernfs_vma_page_mkwrite+0x1f0/0x1f0 [ 42.214836][ T164] new_sync_write+0x308/0x6f0 [ 42.214987][ T164] ? __lock_acquire+0x34c/0x740 [ 42.215135][ T164] ? new_sync_read+0x6f0/0x6f0 [ 42.215288][ T164] ? lock_acquire.part.0+0xbc/0x260 [ 42.215440][ T164] ? ksys_write+0xff/0x200 [ 42.215590][ T164] ? perf_trace_sched_switch+0x6d0/0x6d0 [ 42.215742][ T164] vfs_write+0x65e/0xbb0 [ 42.215876][ T164] ksys_write+0xff/0x200 [ 42.215994][ T164] ? __ia32_sys_read+0xc0/0xc0 [ 42.216141][ T164] ? do_user_addr_fault+0x269/0x9f0 [ 42.216292][ T164] ? rcu_is_watching+0x15/0xd0 [ 42.216442][ T164] do_syscall_64+0xbb/0x360 [ 42.216591][ T164] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 42.216784][ T164] RIP: 0033:0x7f0dc8ea9986
A bit of digging showed that we were invoking the phylink_resume as a part of the fbnic_up path when we were enabling the service task while not holding the RTNL lock. We should be enabling this sooner as a part of the ndo_open path and then just letting the service task come online later. This will help to enforce the correct locking and brings the phylink interface online at the same time as the network interface, instead of at a later time.
I tested this on QEMU to verify this was working by putting the system to sleep using "echo mem > /sys/power/state" to put the system to sleep in the guest and then using the command "system_wakeup" in the QEMU monitor.
--- drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 ++++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 -- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c +4 -0
@@ -53,6 +53,8 @@ int __fbnic_open(struct fbnic_net *fbn)fbnic_bmc_rpc_init (fbd);fbnic_rss_reinit (fbd, fbn); +phylink_resume (fbn->phylink); +return 0 ; release_ownership:fbnic_fw_xmit_ownership_msg (fbn->fbd, false);
@@ -79,6 +81,8 @@ static int fbnic_stop(struct net_device *netdev) {struct fbnic_net *fbn =netdev_priv (netdev); +phylink_suspend (fbn->phylink,fbnic_bmc_present (fbn->fbd)); +fbnic_down (fbn);fbnic_pcs_irq_disable (fbn->fbd);
drivers/net/ethernet/meta/fbnic/fbnic_pci.c +0 -2
@@ -116,14 +116,12 @@ static void fbnic_service_task_start(struct fbnic_net *fbn)struct fbnic_dev *fbd = fbn->fbd;schedule_delayed_work (&fbd->service_task,HZ ); -phylink_resume (fbn->phylink); }static void fbnic_service_task_stop (struct fbnic_net *fbn) {struct fbnic_dev *fbd = fbn->fbd; -phylink_suspend (fbn->phylink,fbnic_bmc_present (fbd));cancel_delayed_work (&fbd->service_task); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 65/95 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit a6358f8cf64850f3f27857b8ed8c1b08cfc4685c ]
Observed on kernel 6.6 (present on master as well):
BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0
If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename:
T1 T2
lookup_open
->lookup
simple_lookup
d_add
// invalid dentry is added to hash list
lookup_open
d_alloc_parallel
__d_lookup_rcu
__d_lookup_rcu_op_compare
hlist_bl_for_each_entry_rcu
// invalid dentry can be retrieved
->d_compare
efivarfs_d_compare
// oobFix it by checking 'guid' before cmp.
--- fs/efivarfs/super.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/efivarfs/super.c +4 -0
@@ -127,6 +127,10 @@ static int efivarfs_d_compare(const struct dentry *dentry, {int guid = len -EFI_VARIABLE_GUID_LEN ; +/* Parallel lookups may produce a temporary invalid filename */ +if (guid <=0 ) +return 1 ; +if (name->len != len)return 1 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 66/95 net: macb: Disable clocks once
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Mandir <[email protected]>
[ Upstream commit dac978e51cce0c1f00a14c4a82f81d387f79b2d4 ]
When the driver is removed the clocks are disabled twice: once in macb_remove and a second time by runtime pm. Disable wakeup in remove so all the clocks are disabled and skip the second call to macb_clks_disable. Always suspend the device as we always set it active in probe.
--- drivers/net/ethernet/cadence/macb_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +2 -5
@@ -5230,14 +5230,11 @@ static void macb_remove(struct platform_device *pdev)mdiobus_unregister (bp->mii_bus);mdiobus_free (bp->mii_bus); +device_set_wakeup_enable (&bp->pdev->dev,0 );cancel_work_sync (&bp->hresp_err_bh_work);pm_runtime_disable (&pdev->dev);pm_runtime_dont_use_autosuspend (&pdev->dev); -if (!pm_runtime_suspended (&pdev->dev)) { -macb_clks_disable (bp->pclk, bp->hclk, bp->tx_clk, - bp->rx_clk, bp->tsu_clk); -pm_runtime_set_suspended (&pdev->dev); - } +pm_runtime_set_suspended (&pdev->dev);phylink_destroy (bp->phylink);free_netdev (dev); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 67/95 KVM: x86: use array_index_nospec with indices that come from guest
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thijs Raymakers <[email protected]>
commit c87bd4dd43a624109c3cc42d843138378a7f4548 upstream.
min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.
--- arch/x86/kvm/lapic.c | 2 ++ arch/x86/kvm/x86.c | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-)
arch/x86/kvm/lapic.c +2 -0
@@ -860,6 +860,8 @@ static int __pv_send_ipi(unsigned long *if (min > map->max_apic_id)return 0 ; + min =array_index_nospec (min, map->max_apic_id +1 ); +for_each_set_bit (i, ipi_bitmap,min ((u32 )BITS_PER_LONG , (map->max_apic_id - min +1 ))) {if (map->phys_map[min + i]) {
arch/x86/kvm/x86.c +5 -2
@@ -9969,8 +9969,11 @@ static void kvm_sched_yield(struct kvm_vrcu_read_lock (); map =rcu_dereference (vcpu->kvm->arch.apic_map); -if (likely (map) && dest_id <= map->max_apic_id && map->phys_map[dest_id]) - target = map->phys_map[dest_id]->vcpu; +if (likely (map) && dest_id <= map->max_apic_id) { + dest_id =array_index_nospec (dest_id, map->max_apic_id +1 ); +if (map->phys_map[dest_id]) + target = map->phys_map[dest_id]->vcpu; + }rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 68/95 RISC-V: KVM: fix stack overrun when loading vlenb
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radim Krčmář <[email protected]>
commit 799766208f09f95677a9ab111b93872d414fbad7 upstream.
The userspace load can put up to 2048 bits into an xlen bit stack buffer. We want only xlen bits, so check the size beforehand.
--- arch/riscv/kvm/vcpu_vector.c | 2 ++ 1 file changed, 2 insertions(+)
arch/riscv/kvm/vcpu_vector.c +2 -0
@@ -181,6 +181,8 @@ int kvm_riscv_vcpu_set_reg_vector(structstruct kvm_cpu_context *cntx = &vcpu->arch.guest_context;unsigned long reg_val; +if (reg_size !=sizeof (reg_val)) +return -EINVAL ;if (copy_from_user (®_val, uaddr, reg_size))return -EFAULT ;if (reg_val != cntx->vector.vlenb)
Greg Kroah-Hartman
maintainerPATCH 69/95 x86/microcode/AMD: Handle the case of no BIOS microcode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit fcf8239ad6a5de54fa7ce18e464c6b5951b982cb upstream.
Machines can be shipped without any microcode in the BIOS. Which means, the microcode patch revision is 0.
Handle that gracefully.
--- arch/x86/kernel/cpu/microcode/amd.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/microcode/amd.c +20 -2
@@ -159,8 +159,28 @@ static int cmp_id(const void *key, constreturn 1 ; } +static u32 cpuid_to_ucode_rev (unsigned int val) +{ +union zen_patch_rev p = {}; +union cpuid_1_eax c; + + c.full = val; + + p.stepping = c.stepping; + p.model = c.model; + p.ext_model = c.ext_model; + p.ext_fam = c.ext_fam; + +return p.ucode_rev; +} +static bool need_sha_check (u32 cur_rev) { +if (!cur_rev) { + cur_rev =cpuid_to_ucode_rev (bsp_cpuid_1_eax); +pr_info_once ("No current revision, generating the lowest one: 0x%x\n" , cur_rev); + } +switch (cur_rev >>8 ) {case 0x80012 :return cur_rev <=0x800126f ;break ;case 0x80082 :return cur_rev <=0x800820f ;break ;
@@ -741,8 +761,6 @@ static struct ucode_patch *cache_find_pa n.equiv_cpu = equiv_cpu; n.patch_id = uci->cpu_sig.rev; -WARN_ON_ONCE (!n.patch_id); -list_for_each_entry (p, µcode_cache, plist)if (patch_cpus_equivalent (p, &n, false))return p;
Greg Kroah-Hartman
maintainerPATCH 70/95 x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: K Prateek Nayak <[email protected]>
commit c2415c407a2cde01290d52ce2a1f81b0616379a3 upstream.
Prior to the topology parsing rewrite and the switchover to the new parsing logic for AMD processors in
c749ce393b8f ("x86/cpu: Use common topology code for AMD"),
the initial_apicid on these platforms was:
- First initialized to the LocalApicId from CPUID leaf 0x1 EBX[31:24].
- Then overwritten by the ExtendedLocalApicId in CPUID leaf 0xb EDX[31:0] on processors that supported topoext.
With the new parsing flow introduced in
f7fb3b2dd92c ("x86/cpu: Provide an AMD/HYGON specific topology parser"),
parse_8000_001e() now unconditionally overwrites the initial_apicid already parsed during cpu_parse_topology_ext().
Although this has not been a problem on baremetal platforms, on virtualized AMD guests that feature more than 255 cores, QEMU zeros out the CPUID leaf 0x8000001e on CPUs with CoreID > 255 to prevent collision of these IDs in EBX[7:0] which can only represent a maximum of 255 cores [1].
This results in the following FW_BUG being logged when booting a guest with more than 255 cores:
[Firmware Bug]: CPU 512: APIC ID mismatch. CPUID: 0x0000 APIC: 0x0200
AMD64 Architecture Programmer's Manual Volume 2: System Programming Pub. 24593 Rev. 3.42 [2] Section 16.12 "x2APIC_ID" mentions the Extended Enumeration leaf 0xb (Fn0000_000B_EDX[31:0])(which was later superseded by the extended leaf 0x80000026) provides the full x2APIC ID under all circumstances unlike the one reported by CPUID leaf 0x8000001e EAX which depends on the mode in which APIC is configured.
Rely on the APIC ID parsed during cpu_parse_topology_ext() from CPUID leaf 0x80000026 or 0xb and only use the APIC ID from leaf 0x8000001e if cpu_parse_topology_ext() failed (has_topoext is false).
On platforms that support the 0xb leaf (Zen2 or later, AMD guests on QEMU) or the extended leaf 0x80000026 (Zen4 or later), the initial_apicid is now set to the value parsed from EDX[31:0].
On older AMD/Hygon platforms that do not support the 0xb leaf but support the TOPOEXT extension (families 0x15, 0x16, 0x17[Zen1], and Hygon), retain current behavior where the initial_apicid is set using the 0x8000001e leaf.
Issue debugged by Naveen N Rao (AMD) <[email protected]> and Sairaj Kodilkar <[email protected]>.
[ bp: Massage commit message. ]
--- arch/x86/kernel/cpu/topology_amd.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/topology_amd.c +14 -9
@@ -80,20 +80,25 @@ static bool parse_8000_001e(struct topo_cpuid_leaf (0x8000001e , &leaf); - tscan->c->topo.initial_apicid = leaf.ext_apic_id; -/* -* If leaf 0xb is available, then the domain shifts are set -* already and nothing to do here. Only valid for family >= 0x17. +* If leaf 0xb/0x26 is available, then the APIC ID and the domain +* shifts are set already. */ -if (!has_topoext && tscan->c->x86 >=0x17 ) { +if (!has_topoext) { + tscan->c->topo.initial_apicid = leaf.ext_apic_id; +/* -* Leaf 0x80000008 set the CORE domain shift already. -* Update the SMT domain, but do not propagate it. +* Leaf 0x8000008 sets the CORE domain shift but not the +* SMT domain shift. On CPUs with family >= 0x17, there +* might be hyperthreads. */ -unsigned int nthreads = leaf.core_nthreads +1 ; +if (tscan->c->x86 >=0x17 ) { +/* Update the SMT domain, but do not propagate it. */ +unsigned int nthreads = leaf.core_nthreads +1 ; -topology_update_dom (tscan,TOPO_SMT_DOMAIN ,get_count_order (nthreads), nthreads); +topology_update_dom (tscan,TOPO_SMT_DOMAIN , +get_count_order (nthreads), nthreads); + } }store_node (tscan, leaf.nnodes_per_socket +1 , leaf.node_id);
Greg Kroah-Hartman
maintainerPATCH 71/95 HID: asus: fix UAF via HID_CLAIMED_INPUT validation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 upstream.
After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device.
This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees.
0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection
Below is the KASAN splat after triggering the UAF:
[ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220
[...]
--- drivers/hid/hid-asus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +7 -1
@@ -1210,7 +1210,13 @@ static int asus_probe(struct hid_devicereturn ret; } -if (!drvdata->input) { +/* +* Check that input registration succeeded. Checking that +* HID_CLAIMED_INPUT is set prevents a UAF when all input devices +* were freed during registration due to no usages being mapped, +* leaving drvdata->input pointing to freed memory. +*/ +if (!drvdata->input || !(hdev->claimed &HID_CLAIMED_INPUT )) {hid_err (hdev,"Asus input not registered\n" ); ret = -ENOMEM ; goto err_stop_hw;
Greg Kroah-Hartman
maintainerPATCH 72/95 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit 0379eb8691b9c4477da0277ae0832036ca4410b4 upstream.
A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it.
Below is the KASAN splat after the out of bounds access happens:
[ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] <TASK> [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40
[...]
--- drivers/hid/hid-multitouch.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hid/hid-multitouch.c +8 -0
@@ -1453,6 +1453,14 @@ static const __u8 *mt_report_fixup(strucif (hdev->vendor ==I2C_VENDOR_ID_GOODIX && (hdev->product ==I2C_DEVICE_ID_GOODIX_01E8 || hdev->product ==I2C_DEVICE_ID_GOODIX_01E9 )) { +if (*size <608 ) { +dev_info ( + &hdev->dev, +"GT7868Q fixup: report descriptor is only %u bytes, skipping\n" , + *size); +return rdesc; + } +if (rdesc[607 ] ==0x15 ) { rdesc[607 ] =0x25 ; dev_info(
Greg Kroah-Hartman
maintainerPATCH 73/95 HID: quirks: add support for Legion Go dual dinput modes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
commit 1f3214aae9f49faf495f3836216afbc6c5400b2e upstream.
The Legion Go features detachable controllers which support a dual dinput mode. In this mode, the controllers appear under a single HID device with two applications.
Currently, both controllers appear under the same event device, causing their controls to be mixed up. This patch separates the two so that they can be used independently.
In addition, the latest firmware update for the Legion Go swaps the IDs to the ones used by the Legion Go 2, so add those IDs as well.
--- drivers/hid/hid-ids.h | 2 ++ drivers/hid/hid-quirks.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +2 -0
@@ -825,6 +825,8 @@#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093 0x6093 +#define USB_DEVICE_ID_LENOVO_LEGION_GO_DUAL_DINPUT 0x6184 +#define USB_DEVICE_ID_LENOVO_LEGION_GO2_DUAL_DINPUT 0x61ed#define USB_VENDOR_ID_LETSKETCH 0x6161#define USB_DEVICE_ID_WP9620N 0x4d15
drivers/hid/hid-quirks.c +2 -0
@@ -124,6 +124,8 @@ static const struct hid_device_id hid_qu { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_T609A), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_ODDOR_HANDBRAKE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_LEGION_GO_DUAL_DINPUT), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_LEGION_GO2_DUAL_DINPUT), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019), HID_QUIRK_ALWAYS_POLL },
Greg Kroah-Hartman
maintainerPATCH 74/95 HID: logitech: Add ids for G PRO 2 LIGHTSPEED
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Coffin <[email protected]>
commit ab1bb82f3db20e23eace06db52031b1164a110c2 upstream.
Adds support for the G PRO 2 LIGHTSPEED Wireless via it's nano receiver or directly. This nano receiver appears to work identically to the 1_1 receiver for the case I've verified, which is the battery status through lg-hidpp.
The same appears to be the case wired, sharing much with the Pro X Superlight 2; differences seemed to lie in userland configuration rather than in interfaces used by hid_logitech_hidpp on the kernel side.
I verified the sysfs interface for battery charge/discharge status, and capacity read to be working on my 910-007290 device (white).
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-dj.c | 4 ++++ drivers/hid/hid-logitech-hidpp.c | 2 ++ 3 files changed, 7 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -900,6 +900,7 @@#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_2 0xc534#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1 0xc539#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1 0xc53f +#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_2 0xc543#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY 0xc53a#define USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER 0xc548#define USB_DEVICE_ID_SPACETRAVELLER 0xc623
drivers/hid/hid-logitech-dj.c +4 -0
@@ -1983,6 +1983,10 @@ static const struct hid_device_id logi_d HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1), .driver_data = recvr_type_gaming_hidpp}, + {/* Logitech lightspeed receiver (0xc543) */ +HID_USB_DEVICE (USB_VENDOR_ID_LOGITECH , + USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_2), + .driver_data = recvr_type_gaming_hidpp}, { /* Logitech 27 MHz HID++ 1.0 receiver (0xc513) */ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER),
drivers/hid/hid-logitech-hidpp.c +2 -0
@@ -4624,6 +4624,8 @@ static const struct hid_device_id hidpp_ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC094) }, {/* Logitech G Pro X Superlight 2 Gaming Mouse over USB */ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC09b) }, + { /* Logitech G PRO 2 LIGHTSPEED Wireless Mouse over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xc09a) }, { /* G935 Gaming Headset */ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0x0a87),
Greg Kroah-Hartman
maintainerPATCH 75/95 HID: wacom: Add a new Art Pen 2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <[email protected]>
commit 9fc51941d9e7793da969b2c66e6f8213c5b1237f upstream.
--- drivers/hid/wacom_wac.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/wacom_wac.c +1 -0
@@ -684,6 +684,7 @@ static bool wacom_is_art_pen(int tool_idcase 0x885 :/* Intuos3 Marker Pen */ case 0x804 :/* Intuos4/5 13HD/24HD Marker Pen */ case 0x10804 :/* Intuos4/5 13HD/24HD Art Pen */ +case 0x204 :/* Art Pen 2 */ is_art_pen = true;break ; }
Greg Kroah-Hartman
maintainerPATCH 76/95 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjong Kim <[email protected]>
commit 185c926283da67a72df20a63a5046b3b4631b7d9 upstream.
in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has
invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger
page fault error for address(0xffffffffffffff58)
add null check logic to ntrig_report_version()
before calling hid_to_usb_dev()
--- drivers/hid/hid-ntrig.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-ntrig.c +3 -0
@@ -144,6 +144,9 @@ static void ntrig_report_version(structstruct usb_device *usb_dev =hid_to_usb_dev (hdev);unsigned char *data =kmalloc (8 ,GFP_KERNEL ); +if (!hid_is_usb (hdev)) +return ; +if (!data) goto err_free;
Greg Kroah-Hartman
maintainerPATCH 77/95 Revert "drm/amdgpu: fix incorrect vm flags to map bo"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit ac4ed2da4c1305a1a002415058aa7deaf49ffe3e upstream.
This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f.
Revert this to align with 6.17 because the fixes tag was wrong on this commit.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +2 -2
@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_ } r =amdgpu_vm_bo_map (adev, *bo_va, csa_addr,0 , size, -AMDGPU_VM_PAGE_READABLE |AMDGPU_VM_PAGE_WRITEABLE | -AMDGPU_VM_PAGE_EXECUTABLE ); +AMDGPU_PTE_READABLE |AMDGPU_PTE_WRITEABLE | +AMDGPU_PTE_EXECUTABLE );if (r) {DRM_ERROR ("failed to do bo_map on static CSA, err=%d\n" , r);
Greg Kroah-Hartman
maintainerPATCH 78/95 blk-zoned: Fix a lockdep complaint about recursive locking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 198f36f902ec7e99b645382505f74b87a4523ed9 upstream.
If preparing a write bio fails then blk_zone_wplug_bio_work() calls bio_endio() with zwplug->lock held. If a device mapper driver is stacked on top of the zoned block device then this results in nested locking of zwplug->lock. The resulting lockdep complaint is a false positive because this is nested locking and not recursive locking. Suppress this false positive by calling blk_zone_wplug_bio_io_error() without holding zwplug->lock. This is safe because no code in blk_zone_wplug_bio_io_error() depends on zwplug->lock being held. This patch suppresses the following lockdep complaint:
WARNING: possible recursive locking detected
--------------------------------------------
kworker/3:0H/46 is trying to acquire lock:ffffff882968b830 (&zwplug->lock){-...}-{2:2}, at: blk_zone_write_plug_bio_endio+0x64/0x1f0
but task is already holding lock:ffffff88315bc230 (&zwplug->lock){-...}-{2:2}, at: blk_zone_wplug_bio_work+0x8c/0x48c
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&zwplug->lock);
lock(&zwplug->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kworker/3:0H/46:
#0: ffffff8809486758 ((wq_completion)sdd_zwplugs){+.+.}-{0:0}, at: process_one_work+0x1bc/0x65c #1: ffffffc085de3d70 ((work_completion)(&zwplug->bio_work)){+.+.}-{0:0}, at: process_one_work+0x1e4/0x65c #2: ffffff88315bc230 (&zwplug->lock){-...}-{2:2}, at: blk_zone_wplug_bio_work+0x8c/0x48c
stack backtrace: CPU: 3 UID: 0 PID: 46 Comm: kworker/3:0H Tainted: G W OE 6.12.38-android16-5-maybe-dirty-4k #1 8b362b6f76e3645a58cd27d86982bce10d150025 Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Spacecraft board based on MALIBU (DT) Workqueue: sdd_zwplugs blk_zone_wplug_bio_work Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xa0 dump_stack+0x18/0x24 print_deadlock_bug+0x38c/0x398 __lock_acquire+0x13e8/0x2e1c lock_acquire+0x134/0x2b4 _raw_spin_lock_irqsave+0x5c/0x80 blk_zone_write_plug_bio_endio+0x64/0x1f0 bio_endio+0x9c/0x240 __dm_io_complete+0x214/0x260 clone_endio+0xe8/0x214 bio_endio+0x218/0x240 blk_zone_wplug_bio_work+0x204/0x48c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20
--- block/blk-zoned.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
block/blk-zoned.c +6 -5
@@ -1281,14 +1281,14 @@ static void blk_zone_wplug_bio_work(strustruct block_device *bdev;unsigned long flags;struct bio *bio; +bool prepared;/* * Submit the next plugged BIO. If we do not have any, clear * the plugged flag. */ -spin_lock_irqsave (&zwplug->lock, flags); - again: +spin_lock_irqsave (&zwplug->lock, flags); bio =bio_list_pop (&zwplug->bio_list);if (!bio) { zwplug->flags &= ~BLK_ZONE_WPLUG_PLUGGED ;
@@ -1296,13 +1296,14 @@ again: goto put_zwplug; } -if (!blk_zone_wplug_prepare_bio (zwplug, bio)) { + prepared =blk_zone_wplug_prepare_bio (zwplug, bio); +spin_unlock_irqrestore (&zwplug->lock, flags); + +if (!prepared) {blk_zone_wplug_bio_io_error (zwplug, bio); goto again; } -spin_unlock_irqrestore (&zwplug->lock, flags); - bdev = bio->bi_bdev;/*
Greg Kroah-Hartman
maintainerPATCH 79/95 dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shanker Donthineni <[email protected]>
commit 89a2d212bdb4bc29bed8e7077abe054b801137ea upstream.
When CONFIG_DMA_DIRECT_REMAP is enabled, atomic pool pages are remapped via dma_common_contiguous_remap() using the supplied pgprot. Currently, the mapping uses pgprot_dmacoherent(PAGE_KERNEL), which leaves the memory encrypted on systems with memory encryption enabled (e.g., ARM CCA Realms).
This can cause the DMA layer to fail or crash when accessing the memory, as the underlying physical pages are not configured as expected.
Fix this by requesting a decrypted mapping in the vmap() call:
pgprot_decrypted(pgprot_dmacoherent(PAGE_KERNEL))
This ensures that atomic pool memory is consistently mapped unencrypted.
--- kernel/dma/pool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/dma/pool.c +2 -2
@@ -102,8 +102,8 @@ static int atomic_pool_expand(struct gen#ifdef CONFIG_DMA_DIRECT_REMAP addr =dma_common_contiguous_remap (page, pool_size, -pgprot_dmacoherent (PAGE_KERNEL ), -__builtin_return_address (0 )); +pgprot_decrypted (pgprot_dmacoherent (PAGE_KERNEL )), +__builtin_return_address (0 ));if (!addr) goto free_page;#else
Greg Kroah-Hartman
maintainerPATCH 80/95 fs/smb: Fix inconsistent refcnt update
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e upstream.
A possible inconsistent update of refcount was identified in smb2_compound_op. Such inconsistent update could lead to possible resource leaks.
Why it is a possible bug:
1. In the comment section of the function, it clearly states that the reference to cfile should be dropped after calling this function.
2. Every control flow path would check and drop the reference to cfile, except the patched one.
3. Existing callers would not handle refcount update of cfile if -ENOMEM is returned.
To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of vars, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function is_replayable_error, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored.
--- fs/smb/client/smb2inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +5 -2
@@ -206,8 +206,10 @@ replay_again: server =cifs_pick_channel (ses); vars =kzalloc (sizeof (*vars),GFP_ATOMIC ); -if (vars ==NULL ) -return -ENOMEM ; +if (vars ==NULL ) { + rc = -ENOMEM ; + goto out; + } rqst = &vars->rqst[0 ]; rsp_iov = &vars->rsp_iov[0 ];
@@ -832,6 +834,7 @@ finished: smb2_should_replay(tcon, &retries, &cur_sleep)) goto replay_again; +out:if (cfile)cifsFileInfo_put (cfile);
Greg Kroah-Hartman
maintainerPATCH 81/95 net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit e81a7f65288c7e2cfb7e7890f648e099fd885ab3 upstream.
Add the following Telit Cinterion LE910C4-WWX new compositions:
0x1034: tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1034 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x1037: tty (diag) + tty (Telit custom) + tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 15 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1037 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x1038: tty (Telit custom) + tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1038 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/qmi_wwan.c +3 -0
@@ -1355,6 +1355,9 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1034, 2)}, /* Telit LE910C4-WWX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1037, 4)}, /* Telit LE910C4-WWX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1038, 3)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
Greg Kroah-Hartman
maintainerPATCH 82/95 smb3 client: fix return code mapping of remap_file_range
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 0e08fa789d39aa01923e3ba144bd808291895c3c upstream.
We were returning -EOPNOTSUPP for various remap_file_range cases but for some of these the copy_file_range_syscall() requires -EINVAL to be returned (e.g. where source and target file ranges overlap when source and target are the same file). This fixes xfstest generic/157 which was expecting EINVAL for that (and also e.g. for when the src offset is beyond end of file).
--- fs/smb/client/cifsfs.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/smb/client/cifsfs.c +14 -0
@@ -1348,6 +1348,20 @@ static loff_t cifs_remap_file_range(strutruncate_setsize (target_inode, new_size);fscache_resize_cookie (cifs_inode_cookie (target_inode), new_size); + }else if (rc == -EOPNOTSUPP ) { +/* +* copy_file_range syscall man page indicates EINVAL +* is returned e.g when "fd_in and fd_out refer to the +* same file and the source and target ranges overlap." +* Test generic/157 was what showed these cases where +* we need to remap EOPNOTSUPP to EINVAL +*/ +if (off >= src_inode->i_size) { + rc = -EINVAL ; + }else if (src_inode == target_inode) { +if (off + len > destoff) + rc = -EINVAL ; + } }if (rc ==0 && new_size > target_cifsi->netfs.zero_point) target_cifsi->netfs.zero_point = new_size;
Greg Kroah-Hartman
maintainerPATCH 83/95 xfs: do not propagate ENODATA disk errors into xattr code
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit ae668cd567a6a7622bc813ee0bb61c42bed61ba7 upstream.
ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found.
However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as "attribute not found" when in fact it's an IO (disk) error.
At worst, we may oops in xfs_attr_leaf_get() when we do:
error = xfs_attr_leaf_hasname(args, &bp);
if (error == -ENOATTR) {
xfs_trans_brelse(args->trans, bp);
return error;
}because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it.
As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO.
However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later.
(Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)
--- fs/xfs/libxfs/xfs_attr_remote.c | 7 +++++++ fs/xfs/libxfs/xfs_da_btree.c | 6 ++++++ 2 files changed, 13 insertions(+)
fs/xfs/libxfs/xfs_attr_remote.c +7 -0
@@ -435,6 +435,13 @@ xfs_attr_rmtval_get( 0, &bp, &xfs_attr3_rmt_buf_ops);if (xfs_metadata_is_sick (error))xfs_dirattr_mark_sick (args->dp,XFS_ATTR_FORK ); +/* +* ENODATA from disk implies a disk medium failure; +* ENODATA for xattrs means attribute not found, so +* disambiguate that here. +*/ +if (error == -ENODATA ) + error = -EIO ;if (error)return error;
fs/xfs/libxfs/xfs_da_btree.c +6 -0
@@ -2833,6 +2833,12 @@ xfs_da_read_buf( &bp, ops);if (xfs_metadata_is_sick (error))xfs_dirattr_mark_sick (dp, whichfork); +/* +* ENODATA from disk implies a disk medium failure; ENODATA for +* xattrs means attribute not found, so disambiguate that here. +*/ +if (error == -ENODATA && whichfork ==XFS_ATTR_FORK ) + error = -EIO ;if (error) goto out_free;
Greg Kroah-Hartman
maintainerPATCH 84/95 drm/xe/vm: Clear the scratch_pt pointer on error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit 2b55ddf36229e0278c956215784ab1feeff510aa upstream.
Avoid triggering a dereference of an error pointer on cleanup in xe_vm_free_scratch() by clearing any scratch_pt error pointer.
--- drivers/gpu/drm/xe/xe_vm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_vm.c +6 -2
@@ -1402,8 +1402,12 @@ static int xe_vm_create_scratch(struct xfor (i =MAX_HUGEPTE_LEVEL ; i < vm->pt_root[id]->level; i++) { vm->scratch_pt[id][i] =xe_pt_create (vm, tile, i); -if (IS_ERR (vm->scratch_pt[id][i])) -return PTR_ERR (vm->scratch_pt[id][i]); +if (IS_ERR (vm->scratch_pt[id][i])) { +int err =PTR_ERR (vm->scratch_pt[id][i]); + + vm->scratch_pt[id][i] =NULL ; +return err; + }xe_pt_populate_empty (tile, vm, vm->scratch_pt[id][i]); }
Greg Kroah-Hartman
maintainerPATCH 85/95 drm/nouveau/disp: Always accept linear modifier
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Jones <[email protected]>
commit e2fe0c54fb7401e6ecd3c10348519ab9e23bd639 upstream.
On some chipsets, which block-linear modifiers are supported is format-specific. However, linear modifiers are always be supported. The prior modifier filtering logic was not accounting for the linear case.
--- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/nouveau/dispnv50/wndw.c +4 -0
@@ -663,6 +663,10 @@ static bool nv50_plane_format_mod_supporstruct nouveau_drm *drm =nouveau_drm (plane->dev);uint8_t i; +/* All chipsets can display all formats in linear layout */ +if (modifier ==DRM_FORMAT_MOD_LINEAR ) +return true; +if (drm->client.device.info.chipset <0xc0 ) {const struct drm_format_info *info =drm_format_info (format);const uint8_t kind = (modifier >>12 ) &0xff ;
Greg Kroah-Hartman
maintainerPATCH 86/95 drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
commit 66e82b6e0a28d4970383e1ee5d60f431001128cd upstream.
Function nvkm_gsp_fwsec_v2() sets 'ret' if the kmemdup() call fails, but it never uses or returns 'ret' after that point. We always need to release the firmware regardless, so do that and then check for error.
--- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c +3 -2
@@ -209,11 +209,12 @@ nvkm_gsp_fwsec_v2(struct nvkm_gsp *gsp, fw->boot_addr = bld->start_tag <<8 ; fw->boot_size = bld->code_size; fw->boot =kmemdup (bl->data + hdr->data_offset + bld->code_off, fw->boot_size,GFP_KERNEL ); -if (!fw->boot) - ret = -ENOMEM ;nvkm_firmware_put (bl); +if (!fw->boot) +return -ENOMEM ; +/* Patch in interface data. */ return nvkm_gsp_fwsec_patch (gsp, fw, desc->InterfaceOffset, init_cmd); }
Greg Kroah-Hartman
maintainerPATCH 87/95 drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 1f403699c40f0806a707a9a6eed3b8904224021a upstream.
Using device_find_child() and of_find_device_by_node() to locate devices could cause an imbalance in the device's reference count. device_find_child() and of_find_device_by_node() both call get_device() to increment the reference count of the found device before returning the pointer. In mtk_drm_get_all_drm_priv(), these references are never released through put_device(), resulting in permanent reference count increments. Additionally, the for_each_child_of_node() iterator fails to release node references in all code paths. This leaks device node references when loop termination occurs before reaching MAX_CRTC. These reference count leaks may prevent device/node resources from being properly released during driver unbind operations.
As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +14 -7
@@ -381,19 +381,19 @@ static bool mtk_drm_get_all_drm_priv(str of_id =of_match_node (mtk_drm_of_ids, node);if (!of_id) -continue ; + goto next_put_node; pdev =of_find_device_by_node (node);if (!pdev) -continue ; + goto next_put_node; drm_dev =device_find_child (&pdev->dev,NULL , mtk_drm_match);if (!drm_dev) -continue ; + goto next_put_device_pdev_dev; temp_drm_priv =dev_get_drvdata (drm_dev);if (!temp_drm_priv) -continue ; + goto next_put_device_drm_dev;if (temp_drm_priv->data->main_len) all_drm_priv[CRTC_MAIN ] = temp_drm_priv;
@@ -405,10 +405,17 @@ static bool mtk_drm_get_all_drm_priv(strif (temp_drm_priv->mtk_drm_bound) cnt++; -if (cnt ==MAX_CRTC ) { -of_node_put (node); +next_put_device_drm_dev: +put_device (drm_dev); + +next_put_device_pdev_dev: +put_device (&pdev->dev); + +next_put_node: +of_node_put (node); + +if (cnt ==MAX_CRTC )break ; - } }if (drm_priv->data->mmsys_dev_num == cnt) {
Greg Kroah-Hartman
maintainerPATCH 88/95 drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
commit 5dff50802b285da8284a7bf17ae2fdc6f1357023 upstream.
the PPSMC_MSG_GetPptLimit msg is not valid for gfx 11.0.3 on vf mode, so skiped to create power1_cap* hwmon sysfs node.
--- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/pm/amdgpu_pm.c +10 -8
@@ -3668,14 +3668,16 @@ static umode_t hwmon_attributes_visible( effective_mode &= ~S_IWUSR ;/* not implemented yet for APUs other than GC 10.3.1 (vangogh) and 9.4.3 */ -if (((adev->family ==AMDGPU_FAMILY_SI ) || - ((adev->flags &AMD_IS_APU ) && (gc_ver !=IP_VERSION (10 ,3 ,1 )) && - (gc_ver !=IP_VERSION (9 ,4 ,3 ) && gc_ver !=IP_VERSION (9 ,4 ,4 )))) && - (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr || - attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr || - attr == &sensor_dev_attr_power1_cap.dev_attr.attr || - attr == &sensor_dev_attr_power1_cap_default.dev_attr.attr)) -return 0 ; +if (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr || + attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr || + attr == &sensor_dev_attr_power1_cap.dev_attr.attr || + attr == &sensor_dev_attr_power1_cap_default.dev_attr.attr) { +if (adev->family ==AMDGPU_FAMILY_SI || + ((adev->flags &AMD_IS_APU ) && gc_ver !=IP_VERSION (10 ,3 ,1 ) && + (gc_ver !=IP_VERSION (9 ,4 ,3 ) && gc_ver !=IP_VERSION (9 ,4 ,4 ))) || + (amdgpu_sriov_vf (adev) && gc_ver ==IP_VERSION (11 ,0 ,3 ))) +return 0 ; + }/* not implemented yet for APUs having < GC 9.3.0 (Renoir) */ if (((adev->family == AMDGPU_FAMILY_SI) ||
Greg Kroah-Hartman
maintainerPATCH 89/95 net: rose: fix a typo in rose_clear_routes()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 1cc8a5b534e5f9b5e129e54ee2e63c9f5da4f39a upstream.
syzbot crashed in rose_clear_routes(), after a recent patch typo.
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 UID: 0 PID: 10591 Comm: syz.3.1856 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:rose_clear_routes net/rose/rose_route.c:565 [inline] RIP: 0010:rose_rt_ioctl+0x162/0x1250 net/rose/rose_route.c:760 <TASK> rose_ioctl+0x3ce/0x8b0 net/rose/af_rose.c:1381 sock_do_ioctl+0xd9/0x300 net/socket.c:1238 sock_ioctl+0x576/0x790 net/socket.c:1359 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/rose/rose_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rose/rose_route.c +1 -1
@@ -562,7 +562,7 @@ static int rose_clear_routes(void) rose_node = rose_node->next;if (!t->loopback) { -for (i =0 ; i < rose_node->count; i++) +for (i =0 ; i < t->count; i++)rose_neigh_put (t->neighbour[i]);rose_remove_node (t); }
Greg Kroah-Hartman
maintainerPATCH 90/95 PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit 817f989700fddefa56e5e443e7d138018ca6709d upstream.
Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS.
--- drivers/pci/controller/plda/pcie-starfive.c | 2 +- drivers/pci/pci.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/plda/pcie-starfive.c +1 -1
@@ -368,7 +368,7 @@ static int starfive_pcie_host_init(struc* of 100ms following exit from a conventional reset before * sending a configuration request to the device. */ -msleep (PCIE_RESET_CONFIG_DEVICE_WAIT_MS ); +msleep (PCIE_RESET_CONFIG_WAIT_MS );if (starfive_pcie_host_wait_for_link (pcie))dev_info (dev,"port link down\n" );
drivers/pci/pci.h +1 -1
@@ -57,7 +57,7 @@* completes before sending a Configuration Request to the device * immediately below that Port." */ -#define PCIE_RESET_CONFIG_DEVICE_WAIT_MS 100 +#define PCIE_RESET_CONFIG_WAIT_MS 100/* Message Routing (r[2:0]); PCIe r6.0, sec 2.2.8 */ #define PCIE_MSG_TYPE_R_RC 0
Greg Kroah-Hartman
maintainerPATCH 91/95 PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit 80dc18a0cba8dea42614f021b20a04354b213d86 upstream.
As per PCIe r6.0, sec 6.6.1, a Downstream Port that supports Link speeds greater than 5.0 GT/s, software must wait a minimum of 100 ms after Link training completes before sending a Configuration Request.
Add this delay in dw_pcie_wait_for_link(), after the link is reported as up. The delay will only be performed in the success case where the link came up.
DWC glue drivers that have a link up IRQ (drivers that set use_linkup_irq = true) do not call dw_pcie_wait_for_link(), instead they perform this delay in their threaded link up IRQ handler.
--- drivers/pci/controller/dwc/pcie-designware.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/pci/controller/dwc/pcie-designware.c +8 -0
@@ -655,6 +655,14 @@ int dw_pcie_wait_for_link(struct dw_pciereturn -ETIMEDOUT ; } +/* +* As per PCIe r6.0, sec 6.6.1, a Downstream Port that supports Link +* speeds greater than 5.0 GT/s, software must wait a minimum of 100 ms +* after Link training completes before sending a Configuration Request. +*/ +if (pci->max_link_speed >2 ) +msleep (PCIE_RESET_CONFIG_WAIT_MS ); + offset =dw_pcie_find_capability (pci,PCI_CAP_ID_EXP ); val =dw_pcie_readw_dbi (pci, offset +PCI_EXP_LNKSTA );
Greg Kroah-Hartman
maintainerPATCH 92/95 Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
This reverts commit 3c778a98bee16b4c7ba364a0101ee3c399a95b85 which is commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f upstream.
The upstream commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f ("drm/dp:
Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS") the reverted commit backported causes a regression, on one eDP panel at least resulting in display flickering, described in detail at the Link:
below. The issue fixed by the upstream commit will need a different solution, revert the backport for now.
--- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/display/drm_dp_helper.c +1 -1
@@ -664,7 +664,7 @@ ssize_t drm_dp_dpcd_read(struct drm_dp_a* monitor doesn't power down exactly after the throw away read. */ if (!aux->is_remote) { - ret =drm_dp_dpcd_probe (aux,DP_LANE0_1_STATUS ); + ret =drm_dp_dpcd_probe (aux,DP_DPCD_REV );if (ret <0 )return ret; }
Greg Kroah-Hartman
maintainerPATCH 93/95 thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mason Chang <[email protected]>
commit c5d5a72c01f7faabe7cc0fd63942c18372101daf upstream.
Change the LVTS commands array to static const in preparation for adding different commands.
--- drivers/thermal/mediatek/lvts_thermal.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
drivers/thermal/mediatek/lvts_thermal.c +15 -14
@@ -92,6 +92,17 @@#define LVTS_MINIMUM_THRESHOLD 20000 +static const u32 default_conn_cmds[] = {0xC103FFFF ,0xC502FF55 }; +/* +* Write device mask: 0xC1030000 +*/ +static const u32 default_init_cmds[] = { +0xC1030E01 ,0xC1030CFC ,0xC1030A8C ,0xC103098D ,0xC10308F1 , +0xC10307A6 ,0xC10306B8 ,0xC1030500 ,0xC1030420 ,0xC1030300 , +0xC1030030 ,0xC10300F6 ,0xC1030050 ,0xC1030060 ,0xC10300AC , +0xC10300FC ,0xC103009D ,0xC10300F1 ,0xC10300E1 +}; +static int golden_temp =LVTS_GOLDEN_TEMP_DEFAULT ;static int golden_temp_offset;
@@ -880,7 +891,7 @@ static void lvts_ctrl_monitor_enable(str* each write in the configuration register must be separated by a * delay of 2 us. */ -static void lvts_write_config (struct lvts_ctrl *lvts_ctrl,u32 *cmds,int nr_cmds) +static void lvts_write_config (struct lvts_ctrl *lvts_ctrl,const u32 *cmds,int nr_cmds) {int i;
@@ -963,9 +974,9 @@ static int lvts_ctrl_set_enable(struct lstatic int lvts_ctrl_connect (struct device *dev,struct lvts_ctrl *lvts_ctrl) { -u32 id, cmds[] = {0xC103FFFF ,0xC502FF55 }; +u32 id; -lvts_write_config (lvts_ctrl, cmds,ARRAY_SIZE (cmds)); +lvts_write_config (lvts_ctrl, default_conn_cmds,ARRAY_SIZE (default_conn_cmds));/* * LVTS_ID : Get ID and status of the thermal controller
@@ -984,17 +995,7 @@ static int lvts_ctrl_connect(struct devistatic int lvts_ctrl_initialize (struct device *dev,struct lvts_ctrl *lvts_ctrl) { -/* -* Write device mask: 0xC1030000 -*/ -u32 cmds[] = { -0xC1030E01 ,0xC1030CFC ,0xC1030A8C ,0xC103098D ,0xC10308F1 , -0xC10307A6 ,0xC10306B8 ,0xC1030500 ,0xC1030420 ,0xC1030300 , -0xC1030030 ,0xC10300F6 ,0xC1030050 ,0xC1030060 ,0xC10300AC , -0xC10300FC ,0xC103009D ,0xC10300F1 ,0xC10300E1 - }; - -lvts_write_config (lvts_ctrl, cmds,ARRAY_SIZE (cmds)); +lvts_write_config (lvts_ctrl, default_init_cmds,ARRAY_SIZE (default_init_cmds));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 94/95 thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mason Chang <[email protected]>
commit 6203a5e6fd090ed05f6d9b92e33bc7e7679a3dd6 upstream.
Add LVTS commands and their sizes to driver data in preparation for adding different commands.
--- drivers/thermal/mediatek/lvts_thermal.c | 65 +++++++++++++++++++++++++------- 1 file changed, 52 insertions(+), 13 deletions(-)
drivers/thermal/mediatek/lvts_thermal.c +52 -13
@@ -92,17 +92,6 @@#define LVTS_MINIMUM_THRESHOLD 20000 -static const u32 default_conn_cmds[] = {0xC103FFFF ,0xC502FF55 }; -/* -* Write device mask: 0xC1030000 -*/ -static const u32 default_init_cmds[] = { -0xC1030E01 ,0xC1030CFC ,0xC1030A8C ,0xC103098D ,0xC10308F1 , -0xC10307A6 ,0xC10306B8 ,0xC1030500 ,0xC1030420 ,0xC1030300 , -0xC1030030 ,0xC10300F6 ,0xC1030050 ,0xC1030060 ,0xC10300AC , -0xC10300FC ,0xC103009D ,0xC10300F1 ,0xC10300E1 -}; -static int golden_temp =LVTS_GOLDEN_TEMP_DEFAULT ;static int golden_temp_offset;
@@ -132,7 +121,11 @@ struct lvts_ctrl_data {struct lvts_data {const struct lvts_ctrl_data *lvts_ctrl; +const u32 *conn_cmd; +const u32 *init_cmd;int num_lvts_ctrl; +int num_conn_cmd; +int num_init_cmd;int temp_factor;int temp_offset;int gt_calib_bit_offset;
@@ -974,9 +967,10 @@ static int lvts_ctrl_set_enable(struct lstatic int lvts_ctrl_connect (struct device *dev,struct lvts_ctrl *lvts_ctrl) { +const struct lvts_data *lvts_data = lvts_ctrl->lvts_data;u32 id; -lvts_write_config (lvts_ctrl, default_conn_cmds,ARRAY_SIZE (default_conn_cmds)); +lvts_write_config (lvts_ctrl, lvts_data->conn_cmd, lvts_data->num_conn_cmd);/* * LVTS_ID : Get ID and status of the thermal controller
@@ -995,7 +989,9 @@ static int lvts_ctrl_connect(struct devistatic int lvts_ctrl_initialize (struct device *dev,struct lvts_ctrl *lvts_ctrl) { -lvts_write_config (lvts_ctrl, default_init_cmds,ARRAY_SIZE (default_init_cmds)); +const struct lvts_data *lvts_data = lvts_ctrl->lvts_data; + +lvts_write_config (lvts_ctrl, lvts_data->init_cmd, lvts_data->num_init_cmd);return 0 ; }
@@ -1424,6 +1420,17 @@ static int lvts_resume(struct device *dereturn 0 ; } +static const u32 default_conn_cmds[] = {0xC103FFFF ,0xC502FF55 }; +/* +* Write device mask: 0xC1030000 +*/ +static const u32 default_init_cmds[] = { +0xC1030E01 ,0xC1030CFC ,0xC1030A8C ,0xC103098D ,0xC10308F1 , +0xC10307A6 ,0xC10306B8 ,0xC1030500 ,0xC1030420 ,0xC1030300 , +0xC1030030 ,0xC10300F6 ,0xC1030050 ,0xC1030060 ,0xC10300AC , +0xC10300FC ,0xC103009D ,0xC10300F1 ,0xC10300E1 +}; +/* * The MT8186 calibration data is stored as packed 3-byte little-endian * values using a weird layout that makes sense only when viewed as a 32-bit
@@ -1718,7 +1725,11 @@ static const struct lvts_ctrl_data mt819static const struct lvts_data mt7988_lvts_ap_data = { .lvts_ctrl = mt7988_lvts_ap_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt7988_lvts_ap_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT7988 , .temp_offset =LVTS_COEFF_B_MT7988 , .gt_calib_bit_offset =24 ,
@@ -1726,7 +1737,11 @@ static const struct lvts_data mt7988_lvtstatic const struct lvts_data mt8186_lvts_data = { .lvts_ctrl = mt8186_lvts_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt8186_lvts_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT7988 , .temp_offset =LVTS_COEFF_B_MT7988 , .gt_calib_bit_offset =24 ,
@@ -1735,7 +1750,11 @@ static const struct lvts_data mt8186_lvtstatic const struct lvts_data mt8188_lvts_mcu_data = { .lvts_ctrl = mt8188_lvts_mcu_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt8188_lvts_mcu_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT8195 , .temp_offset =LVTS_COEFF_B_MT8195 , .gt_calib_bit_offset =20 ,
@@ -1744,7 +1763,11 @@ static const struct lvts_data mt8188_lvtstatic const struct lvts_data mt8188_lvts_ap_data = { .lvts_ctrl = mt8188_lvts_ap_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt8188_lvts_ap_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT8195 , .temp_offset =LVTS_COEFF_B_MT8195 , .gt_calib_bit_offset =20 ,
@@ -1753,7 +1776,11 @@ static const struct lvts_data mt8188_lvtstatic const struct lvts_data mt8192_lvts_mcu_data = { .lvts_ctrl = mt8192_lvts_mcu_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt8192_lvts_mcu_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT8195 , .temp_offset =LVTS_COEFF_B_MT8195 , .gt_calib_bit_offset =24 ,
@@ -1762,7 +1789,11 @@ static const struct lvts_data mt8192_lvtstatic const struct lvts_data mt8192_lvts_ap_data = { .lvts_ctrl = mt8192_lvts_ap_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt8192_lvts_ap_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT8195 , .temp_offset =LVTS_COEFF_B_MT8195 , .gt_calib_bit_offset =24 ,
@@ -1771,7 +1802,11 @@ static const struct lvts_data mt8192_lvtstatic const struct lvts_data mt8195_lvts_mcu_data = { .lvts_ctrl = mt8195_lvts_mcu_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt8195_lvts_mcu_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT8195 , .temp_offset =LVTS_COEFF_B_MT8195 , .gt_calib_bit_offset =24 ,
@@ -1780,7 +1815,11 @@ static const struct lvts_data mt8195_lvtstatic const struct lvts_data mt8195_lvts_ap_data = { .lvts_ctrl = mt8195_lvts_ap_data_ctrl, + .conn_cmd = default_conn_cmds, + .init_cmd = default_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt8195_lvts_ap_data_ctrl), + .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), + .num_init_cmd =ARRAY_SIZE (default_init_cmds), .temp_factor =LVTS_COEFF_A_MT8195 , .temp_offset =LVTS_COEFF_B_MT8195 , .gt_calib_bit_offset =24 ,
Greg Kroah-Hartman
maintainerPATCH 95/95 thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mason Chang <[email protected]>
commit 685a755089f95b7e205c0202567d9a647f9de096 upstream.
These commands are necessary to avoid severely abnormal and inaccurate temperature readings that are caused by using the default commands.
--- drivers/thermal/mediatek/lvts_thermal.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/thermal/mediatek/lvts_thermal.c +12 -4
@@ -1421,6 +1421,8 @@ static int lvts_resume(struct device *de }static const u32 default_conn_cmds[] = {0xC103FFFF ,0xC502FF55 }; +static const u32 mt7988_conn_cmds[] = {0xC103FFFF ,0xC502FC55 }; +/* * Write device mask: 0xC1030000 */
@@ -1431,6 +1433,12 @@ static const u32 default_init_cmds[] = { 0xC10300FC, 0xC103009D, 0xC10300F1, 0xC10300E1 }; +static const u32 mt7988_init_cmds[] = { +0xC1030300 ,0xC1030420 ,0xC1030500 ,0xC10307A6 ,0xC1030CFC , +0xC1030A8C ,0xC103098D ,0xC10308F1 ,0xC1030B04 ,0xC1030E01 , +0xC10306B8 +}; +/* * The MT8186 calibration data is stored as packed 3-byte little-endian * values using a weird layout that makes sense only when viewed as a 32-bit
@@ -1725,11 +1733,11 @@ static const struct lvts_ctrl_data mt819static const struct lvts_data mt7988_lvts_ap_data = { .lvts_ctrl = mt7988_lvts_ap_data_ctrl, - .conn_cmd = default_conn_cmds, - .init_cmd = default_init_cmds, + .conn_cmd = mt7988_conn_cmds, + .init_cmd = mt7988_init_cmds, .num_lvts_ctrl =ARRAY_SIZE (mt7988_lvts_ap_data_ctrl), - .num_conn_cmd =ARRAY_SIZE (default_conn_cmds), - .num_init_cmd =ARRAY_SIZE (default_init_cmds), + .num_conn_cmd =ARRAY_SIZE (mt7988_conn_cmds), + .num_init_cmd =ARRAY_SIZE (mt7988_init_cmds), .temp_factor =LVTS_COEFF_A_MT7988 , .temp_offset =LVTS_COEFF_B_MT7988 , .gt_calib_bit_offset =24 ,
Broadcast regression confirmed fixed:
https://lore.kernel.org/regressions/[email protected]
# Librecast Test Results
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.12.45-rc1-g4459b7afd68d #56 SMP PREEMPT_DYNAMIC Tue Sep 2 15:56:48 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.45-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.12:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
120 tests: 120 pass, 0 failLinux version: 6.12.45-rc1-g4459b7afd68d
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.45-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.12.y
Best regards,
Pavel
Signature · 2 lines
In cooperation with DENX Software Engineering GmbH, HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.45-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.12.45-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 4459b7afd68d8c7f767bfedcb8ce7b7973caee3a
* git describe: v6.12.44-96-g4459b7afd68d
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.12.y/build/v6.12.44-96-g4459b7afd68d
## Test Regressions (compared to v6.12.43-323-gc7e1bbb35205)
## Metric Regressions (compared to v6.12.43-323-gc7e1bbb35205)
## Test Fixes (compared to v6.12.43-323-gc7e1bbb35205)
## Metric Fixes (compared to v6.12.43-323-gc7e1bbb35205)
## Test result summary
total: 323915, pass: 299363, fail: 6744, skip: 17352, xfail: 456
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 139 total, 137 passed, 2 failed
* arm64: 57 total, 56 passed, 1 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 33 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 40 total, 40 passed, 0 failed
* riscv: 25 total, 22 passed, 3 failed
* s390: 22 total, 21 passed, 1 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 49 total, 48 passed, 1 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* modules
* perf
* rcutorture
* rt-tests-cyclicdeadline
* rt-tests-pi-stress
* rt-tests-pmqtest
* rt-tests-rt-migrate-test
* rt-tests-signaltest
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.45-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.45-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Builds successfully. Boots and works on qemu and Dell XPS 15 9520 w/ Intel Core i7-12600H
Thanks,
Brett
Hi Greg,
Yesterday i experienced an issue with the amdgpu driver on v6.12.44, dmesg saying:
[drm:amdgpu_job_submit [amdgpu]] *ERROR* Trying to push to a killed entity
which causes the kernel to freeze/hang, not cool.
I think this issue is fixed by this commit [1]: aa5fc4362fac ("drm/amdgpu: fix task hang from failed job submission during process kill") it has a Fixes for the commit: 71598a5a7797 ("drm/amdgpu: Avoid extra evict-restore process.")
which is in the v6.12.44 tree (but not in v6.12.43)
I am currently on v6.16.4 which include the fix above and i no longer have the issue.
It would be great to include the fix in the v6.12.45 release.
I am not subscribed to this mailing-list, please add me in CC in your reply.
Cheers,
Jules
some additional info:
CPU: AMD Ryzen 7 7735HS with Radeon Graphics
GPU: [AMD/ATI] Rembrandt [Radeon 680M] (rev 0a)
Quoted 11 lines · Jules Maselbas
Hi Greg,
Yesterday i experienced an issue with the amdgpu driver on v6.12.44, dmesg saying:
[drm:amdgpu_job_submit [amdgpu]] *ERROR* Trying to push to a killed entitywhich causes the kernel to freeze/hang, not cool.
I think this issue is fixed by this commit [1]:
aa5fc4362fac("drm/amdgpu: fix task hang from failed job submission during process kill") it has a Fixes for the commit:71598a5a7797("drm/amdgpu: Avoid extra evict-restore process.")
which is in the v6.12.44 tree (but not in v6.12.43)
Quoted 5 lines
I am currently on v6.16.4 which include the fix above and i no longer have the issue.
It would be great to include the fix in the v6.12.45 release.
I am not subscribed to this mailing-list, please add me in CC in your reply.
Odd subject line :)
I've queued this up now, thanks.
greg k-h
Greg Kroah-Hartman
maintainerQuoted 14 lines · Greg Kroah-Hartman
Quoted 13 lines · Jules Maselbas
Hi Greg,
Yesterday i experienced an issue with the amdgpu driver on v6.12.44, dmesg saying:
[drm:amdgpu_job_submit [amdgpu]] *ERROR* Trying to push to a killed entitywhich causes the kernel to freeze/hang, not cool.
I think this issue is fixed by this commit [1]:
aa5fc4362fac("drm/amdgpu: fix task hang from failed job submission during process kill") it has a Fixes for the commit:71598a5a7797("drm/amdgpu: Avoid extra evict-restore process.")
which is in the v6.12.44 tree (but not in v6.12.43)I am currently on v6.16.4 which include the fix above and i no longer have the issue.
Quoted 7 lines
Quoted 3 lines
It would be great to include the fix in the v6.12.45 release.
I am not subscribed to this mailing-list, please add me in CC in your reply.
Odd subject line :)
I've queued this up now, thanks.
OOps, nope, now dropped. This fails to build, so how did you test this?
Please send a working patch for this if you want it in 6.12.y.
thanks,
greg k-h
Hi Greg,
Yesterday i experienced an issue with the amdgpu driver on v6.12.44, dmesg saying:
[drm:amdgpu_job_submit [amdgpu]] *ERROR* Trying to push to a killed entity
which causes the kernel to freeze/hang, not cool.
I think this issue is fixed by this commit [1]: aa5fc4362fac ("drm/amdgpu: fix task hang from failed job submission during process kill") it has a Fixes for the commit: 71598a5a7797 ("drm/amdgpu: Avoid extra evict-restore process.")
which is in the v6.12.44 tree (but not in v6.12.43)
I am currently on v6.16.4 which include the fix above and i no longer have the issue.
It would be great to include the fix in the v6.12.45 release.
I am not subscribed to this mailing-list, please add me in CC in your reply.
Cheers,
Jules
some additional info:
CPU: AMD Ryzen 7 7735HS with Radeon Graphics
GPU: [AMD/ATI] Rembrandt [Radeon 680M] (rev 0a)
Am 02.09.2025 um 15:19 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit