6.1.157-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.1.157-rc1 review
This is the start of the stable review cycle for the 6.1.157 release. There are 168 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 19 Oct 2025 14:50:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.157-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.157-rc1
Jason Andryuk <[email protected]>
xen/events: Update virq_to_irq on migration
Jan Kara <[email protected]>
writeback: Avoid excessively long inode switching times
Jan Kara <[email protected]>
writeback: Avoid softlockup when switching many inodes
Tetsuo Handa <[email protected]>
cramfs: Verify inode mode when loading from disk
Lichen Liu <[email protected]>
fs: Add 'initramfs_options' to set initramfs mount options
Oleg Nesterov <[email protected]>
pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers
gaoxiang17 <[email protected]>
pid: Add a judgment for ns null in pid_nr_ns
Tetsuo Handa <[email protected]>
minixfs: Verify inode mode when loading from disk
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: usable client side with C-flag
Varad Gautam <[email protected]>
asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
Vladimir Oltean <[email protected]>
asm-generic/io.h: suppress endianness warnings for relaxed accessors
Sai Prakash Ranjan <[email protected]>
asm-generic/io: Add _RET_IP_ to MMIO trace for more accurate debug info
Lance Yang <[email protected]>
selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
Rafael J. Wysocki <[email protected]>
ACPI: property: Do not pass NULL handles to acpi_attach_data()
Rafael J. Wysocki <[email protected]>
ACPI: property: Add code comments explaining what is going on
Rafael J. Wysocki <[email protected]>
ACPI: property: Disregard references in data-only subnode lists
Guenter Roeck <[email protected]>
ipmi: Fix handling of messages with provided receive message pointer
Corey Minyard <[email protected]>
ipmi: Rework user message limit handling
Thomas Gleixner <[email protected]>
rseq: Protect event mask against membarrier IPI
Qu Wenruo <[email protected]>
btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
Shin'ichiro Kawasaki <[email protected]>
PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
Wang Jiang <[email protected]>
PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
Namjae Jeon <[email protected]>
ksmbd: add max ip connections parameter
Yuan Chen <[email protected]>
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
Phillip Lougher <[email protected]>
Squashfs: reject negative file sizes in squashfs_read_inode()
Phillip Lougher <[email protected]>
Squashfs: add additional inode sanity checking
Edward Adam Davis <[email protected]>
media: mc: Clear minor number before put device
Sean Christopherson <[email protected]>
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
Ma Ke <[email protected]>
ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wcd934x: Simplify with dev_err_probe
Nathan Chancellor <[email protected]>
lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
Jan Kara <[email protected]>
ext4: free orphan info with kvfree
Huacai Chen <[email protected]>
ACPICA: Allow to skip Global Lock initialization
Ahmet Eray Karadag <[email protected]>
ext4: guard against EA inode refcount underflow in xattr update
Ojaswin Mujoo <[email protected]>
ext4: correctly handle queries for metadata mappings
Yongjian Sun <[email protected]>
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
Jan Kara <[email protected]>
ext4: verify orphan file size is not too big
Olga Kornievskaia <[email protected]>
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
Thorsten Blum <[email protected]>
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
Li RongQing <[email protected]>
mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
Thadeu Lima de Souza Cascardo <[email protected]>
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
Muhammad Usama Anjum <[email protected]>
wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate C-flag + def limit
Sean Christopherson <[email protected]>
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
Sean Christopherson <[email protected]>
x86/umip: Check that the instruction opcode is at least two bytes
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before DAC access
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before INDAC access
Vidya Sagar <[email protected]>
PCI: tegra194: Handle errors in BPMP response
Niklas Cassel <[email protected]>
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
Marek Vasut <[email protected]>
PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
Marek Vasut <[email protected]>
PCI: rcar-host: Drop PMSR spinlock
Siddharth Vadapalli <[email protected]>
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
Lukas Wunner <[email protected]>
PCI/AER: Support errors introduced by PCIe r6.0
Niklas Schnelle <[email protected]>
PCI/AER: Fix missing uevent on recovery when a reset is requested
Lukas Wunner <[email protected]>
PCI/ERR: Fix uevent on failure to recover
Niklas Schnelle <[email protected]>
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
Brian Norris <[email protected]>
PCI/sysfs: Ensure devices are powered for config reads
Marek Vasut <[email protected]>
PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
Sean Christopherson <[email protected]>
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
Esben Haabendal <[email protected]>
rtc: interface: Fix long-standing race when setting alarm
Esben Haabendal <[email protected]>
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
Zhen Ni <[email protected]>
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
Rex Chen <[email protected]>
mmc: core: SPI mode remove cmd7
Linus Walleij <[email protected]>
mtd: rawnand: fsmc: Default to autodetect buswidth
Miaoqian Lin <[email protected]>
xtensa: simdisk: add input size check in proc_write_simdisk
Ma Ke <[email protected]>
sparc: fix error handling in scan_one_device()
Anthony Yznaga <[email protected]>
sparc64: fix hugetlb for sun4u
Eric Biggers <[email protected]>
sctp: Fix MAC comparison to be constant-time
Thorsten Blum <[email protected]>
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
Harshit Agarwal <[email protected]>
sched/deadline: Fix race in push_dl_task()
Jisheng Zhang <[email protected]>
pwm: berlin: Fix wrong register in suspend/resume
Nam Cao <[email protected]>
powerpc/pseries/msi: Fix potential underflow and leak issue
Nam Cao <[email protected]>
powerpc/powernv/pci: Fix underflow and leak issue
Dzmitry Sankouski <[email protected]>
power: supply: max77976_charger: fix constant current reporting
Georg Gottleuber <[email protected]>
nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
John David Anglin <[email protected]>
parisc: Remove spurious if statement from raw_copy_from_user()
Sam James <[email protected]>
parisc: don't reference obsolete termio struct for TC* constants
Askar Safin <[email protected]>
openat2: don't trigger automounts with RESOLVE_NO_XDEV
Johan Hovold <[email protected]>
lib/genalloc: fix device leak in of_gen_pool_get()
Eric Biggers <[email protected]>
KEYS: trusted_tpm1: Compare HMAC values in constant time
Oleg Nesterov <[email protected]>
kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
Lu Baolu <[email protected]>
iommu/vt-d: PRS isn't usable if PDS isn't supported
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
Huacai Chen <[email protected]>
init: handle bootloader identifier in kernel parameters
Sean Anderson <[email protected]>
iio: xilinx-ams: Unmask interrupts after updating alarms
Sean Anderson <[email protected]>
iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix prescaler usage.
Qianfeng Rong <[email protected]>
iio: dac: ad5421: use int type to store negative error codes
Qianfeng Rong <[email protected]>
iio: dac: ad5360: use int type to store negative error codes
Haoxiang Li <[email protected]>
fs/ntfs3: Fix a resource leak bug in wnd_extend()
Thomas Fourier <[email protected]>
crypto: atmel - Fix dma_unmap_sg() direction
Thomas Fourier <[email protected]>
crypto: aspeed - Fix dma_unmap_sg() direction
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Simon Schuster <[email protected]>
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
Adam Xue <[email protected]>
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
Anderson Nascimento <[email protected]>
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
Yu Kuai <[email protected]>
blk-crypto: fix missing blktrace bio split events
Shuhao Fu <[email protected]>
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
Ma Ke <[email protected]>
media: lirc: Fix error handling in lirc_register()
Thomas Fourier <[email protected]>
media: pci: ivtv: Add missing check after DMA map
Laurent Pinchart <[email protected]>
media: mc: Fix MUST_CONNECT handling for pads with no links
Qianfeng Rong <[email protected]>
media: i2c: mt9v111: fix incorrect type for ret
Thomas Fourier <[email protected]>
media: cx18: Add missing check after DMA map
Johan Hovold <[email protected]>
firmware: meson_sm: fix device leak at probe
Lukas Wunner <[email protected]>
xen/manage: Fix suspend error path
Jason Andryuk <[email protected]>
xen/events: Cleanup find_virq() return codes
Michael Riesch <[email protected]>
dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Avoid using invalid recent intervals data
Miaoqian Lin <[email protected]>
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
Vibhore Vardhan <[email protected]>
arm64: dts: ti: k3-am62a-main: Fix main padcfg length
Stephan Gerhold <[email protected]>
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Add missing MDSS reset
Amir Mohammad Jahangirzad <[email protected]>
ACPI: debug: fix signedness issues in read/write helpers
Daniel Tang <[email protected]>
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
Rafael J. Wysocki <[email protected]>
ACPI: property: Fix buffer properties extraction for subnodes
KaFai Wan <[email protected]>
bpf: Avoid RCU context warning when unpinning htab with internal structs
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: mark the GPIO controller as sleeping
Andy Shevchenko <[email protected]>
gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
Gunnar Kudrjavets <[email protected]>
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
Herbert Xu <[email protected]>
crypto: essiv - Check ssize for decryption and in-place encryption
Eric Woudstra <[email protected]>
bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
Timur Kristóf <[email protected]>
drm/amd/display: Properly disable scaling on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
Alex Deucher <[email protected]>
drm/amdgpu: Add additional DCE6 SCL registers
Daniel Borkmann <[email protected]>
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
Leo Yan <[email protected]>
tools build: Align warning options with perf
Erick Karanja <[email protected]>
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Kuniyuki Iwashima <[email protected]>
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Alexandr Sapozhnikov <[email protected]>
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix copy-paste typo in validation
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Use-after-free in validation
Vineeth Vijayan <[email protected]>
s390/cio: Update purge function to unregister the unused subchannels
Dan Carpenter <[email protected]>
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
Huacai Chen <[email protected]>
LoongArch: Init acpi_gbl_use_global_lock to false
Tiezhu Yang <[email protected]>
LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
Duoming Zhou <[email protected]>
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
John Garry <[email protected]>
scsi: mvsas: Use sas_task_find_rq() for tagging
John Garry <[email protected]>
scsi: mvsas: Delete mvs_tag_init()
John Garry <[email protected]>
scsi: libsas: Add sas_task_find_rq()
Aaron Kling <[email protected]>
cpufreq: tegra186: Set target frequency for all cpus in policy
Fedor Pchelkin <[email protected]>
clk: tegra: do not overallocate memory for bpmp clocks
Alok Tiwari <[email protected]>
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
Brian Masney <[email protected]>
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
Chen-Yu Tsai <[email protected]>
clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
AngeloGioacchino Del Regno <[email protected]>
clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
Ian Rogers <[email protected]>
perf test: Don't leak workload gopipe in PERF_RECORD_*
Leo Yan <[email protected]>
perf session: Fix handling when buffer exceeds 2 GiB
Leo Yan <[email protected]>
perf arm_spe: Correct memory level for remote access
Leo Yan <[email protected]>
perf arm-spe: Rename the common data source encoding
German Gomez <[email protected]>
perf arm-spe: Refactor arm-spe to support operation packet type
Leo Yan <[email protected]>
perf arm_spe: Correct setting remote access
Clément Le Goffic <[email protected]>
rtc: optee: fix memory leak on driver removal
Rob Herring (Arm) <[email protected]>
rtc: x1205: Fix Xicor X1205 vendor prefix
Yunseong Kim <[email protected]>
perf util: Fix compression checks returning -1 as bool
Brian Masney <[email protected]>
clk: at91: peripheral: fix return value
Ian Rogers <[email protected]>
libperf event: Ensure tracing data is multiple of 8 sized
Ian Rogers <[email protected]>
perf evsel: Avoid container_of on a NULL leader
Tomi Valkeinen <[email protected]>
media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
Zhen Ni <[email protected]>
clocksource/drivers/clps711x: Fix resource leaks in error paths
Aleksa Sarai <[email protected]>
fscontext: do not consume log entries when returning -EMSGSIZE
Thomas Weißschuh <[email protected]>
fs: always return zero on success from replace_fd()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + .../bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +- Makefile | 4 +- arch/arm/mach-omap2/pm33xx-core.c | 6 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 + arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 +- arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 2 +- arch/loongarch/kernel/setup.c | 5 +- arch/parisc/include/uapi/asm/ioctls.h | 8 +- arch/parisc/lib/memcpy.c | 1 - arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- arch/powerpc/platforms/pseries/msi.c | 2 +- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + arch/sparc/mm/hugetlbpage.c | 20 + arch/x86/kernel/umip.c | 15 +- arch/x86/kvm/emulate.c | 11 +- arch/x86/kvm/kvm_emulate.h | 2 +- arch/x86/kvm/x86.c | 9 +- arch/xtensa/platforms/iss/simdisk.c | 6 +- block/blk-crypto-fallback.c | 3 + crypto/essiv.c | 14 +- drivers/acpi/acpi_dbg.c | 26 +- drivers/acpi/acpi_tad.c | 3 + drivers/acpi/acpica/evglock.c | 4 + drivers/acpi/property.c | 139 ++++--- drivers/bus/mhi/host/init.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 422 ++++++++++----------- drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/clk/at91/clk-peripheral.c | 7 +- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- drivers/clk/mediatek/clk-mux.c | 4 +- drivers/clk/nxp/clk-lpc18xx-cgu.c | 20 +- drivers/clk/tegra/clk-bpmp.c | 2 +- drivers/clocksource/clps711x-timer.c | 23 +- drivers/cpufreq/intel_pstate.c | 8 +- drivers/cpufreq/tegra186-cpufreq.c | 8 +- drivers/cpuidle/governors/menu.c | 21 +- drivers/crypto/aspeed/aspeed-hace-crypto.c | 2 +- drivers/crypto/atmel-tdes.c | 2 +- drivers/firmware/meson/meson_sm.c | 7 +- drivers/gpio/gpio-wcd934x.c | 3 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 21 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 4 + .../gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 + .../drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- drivers/iio/adc/xilinx-ams.c | 47 ++- drivers/iio/dac/ad5360.c | 2 +- drivers/iio/dac/ad5421.c | 2 +- drivers/iio/frequency/adf4350.c | 20 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 - drivers/iommu/intel/iommu.c | 2 +- drivers/mailbox/zynqmp-ipi-mailbox.c | 7 +- drivers/media/i2c/mt9v111.c | 2 +- drivers/media/mc/mc-devnode.c | 6 +- drivers/media/mc/mc-entity.c | 2 +- drivers/media/pci/cx18/cx18-queue.c | 13 +- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-yuv.c | 8 +- drivers/media/rc/lirc_dev.c | 9 +- drivers/memory/samsung/exynos-srom.c | 10 +- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 5 +- drivers/mmc/core/sdio.c | 6 +- drivers/mtd/nand/raw/fsmc_nand.c | 6 +- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- drivers/net/wireless/ath/ath11k/core.c | 6 +- drivers/net/wireless/ath/ath11k/hal.c | 16 + drivers/net/wireless/ath/ath11k/hal.h | 1 + drivers/nvme/host/pci.c | 2 + drivers/pci/controller/dwc/pci-keystone.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 22 +- drivers/pci/controller/pci-tegra.c | 27 +- drivers/pci/controller/pcie-rcar-host.c | 40 +- drivers/pci/endpoint/functions/pci-epf-test.c | 19 +- drivers/pci/iov.c | 5 + drivers/pci/pci-driver.c | 1 + drivers/pci/pci-sysfs.c | 20 +- drivers/pci/pcie/aer.c | 12 +- drivers/pci/pcie/err.c | 8 +- drivers/power/supply/max77976_charger.c | 12 +- drivers/pwm/pwm-berlin.c | 4 +- drivers/rtc/interface.c | 27 ++ drivers/rtc/rtc-optee.c | 1 + drivers/rtc/rtc-x1205.c | 2 +- drivers/s390/cio/device.c | 37 +- drivers/scsi/hpsa.c | 21 +- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 13 +- drivers/scsi/mvsas/mv_sas.c | 42 +- drivers/scsi/mvsas/mv_sas.h | 8 +- drivers/spi/spi-cadence-quadspi.c | 5 + drivers/xen/events/events_base.c | 20 +- drivers/xen/manage.c | 3 +- fs/btrfs/export.c | 8 +- fs/btrfs/extent_io.c | 14 +- fs/cramfs/inode.c | 11 +- fs/ext4/fsmap.c | 14 +- fs/ext4/inode.c | 10 +- fs/ext4/orphan.c | 17 +- fs/ext4/xattr.c | 15 +- fs/file.c | 5 +- fs/fs-writeback.c | 32 +- fs/fsopen.c | 70 ++-- fs/minix/inode.c | 8 +- fs/namei.c | 8 + fs/namespace.c | 11 +- fs/nfsd/lockd.c | 15 + fs/nfsd/nfs4proc.c | 2 +- fs/ntfs3/bitmap.c | 1 + fs/smb/server/ksmbd_netlink.h | 5 +- fs/smb/server/server.h | 1 + fs/smb/server/transport_ipc.c | 3 + fs/smb/server/transport_tcp.c | 27 +- fs/squashfs/inode.c | 24 +- include/acpi/acpixf.h | 6 + include/asm-generic/io.h | 126 +++--- include/linux/iio/frequency/adf4350.h | 2 +- include/linux/sched.h | 11 +- include/media/v4l2-subdev.h | 30 +- include/scsi/libsas.h | 18 + include/trace/events/rwmmio.h | 43 ++- init/main.c | 12 + kernel/bpf/inode.c | 4 +- kernel/fork.c | 2 +- kernel/pid.c | 5 +- kernel/rseq.c | 10 +- kernel/sched/deadline.c | 73 ++-- kernel/sys.c | 22 +- kernel/trace/trace_kprobe.c | 11 +- kernel/trace/trace_probe.h | 9 +- kernel/trace/trace_uprobe.c | 13 +- lib/crypto/Makefile | 4 + lib/genalloc.c | 5 +- lib/trace_readwrite.c | 16 +- mm/hugetlb.c | 3 + mm/page_alloc.c | 2 +- net/bridge/br_vlan.c | 2 +- net/core/filter.c | 2 + net/ipv4/tcp_input.c | 1 - net/mptcp/pm.c | 7 +- net/mptcp/pm_netlink.c | 55 ++- net/mptcp/protocol.h | 8 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- security/keys/trusted-keys/trusted_tpm1.c | 7 +- sound/soc/codecs/wcd934x.c | 30 +- tools/build/feature/Makefile | 4 +- tools/lib/perf/include/perf/event.h | 1 + tools/perf/tests/perf-record.c | 4 + tools/perf/util/arm-spe-decoder/arm-spe-decoder.c | 30 +- tools/perf/util/arm-spe-decoder/arm-spe-decoder.h | 65 +++- tools/perf/util/arm-spe.c | 42 +- tools/perf/util/evsel.c | 2 + tools/perf/util/lzma.c | 2 +- tools/perf/util/session.c | 2 +- tools/perf/util/zlib.c | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 + tools/testing/selftests/rseq/rseq.c | 8 +- tools/testing/selftests/vm/madv_populate.c | 9 +- tools/testing/selftests/vm/soft-dirty.c | 5 +- tools/testing/selftests/vm/vm_util.c | 77 ++++ tools/testing/selftests/vm/vm_util.h | 2 + 165 files changed, 1668 insertions(+), 873 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/168 fs: always return zero on success from replace_fd()
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 upstream.
replace_fd() returns the number of the new file descriptor through the return value of do_dup2(). However its callers never care about the specific returned number. In fact the caller in receive_fd_replace() treats any non-zero return value as an error and therefore never calls __receive_sock() for most file descriptors, which is a bug.
To fix the bug in receive_fd_replace() and to avoid the same issue happening in future callers, signal success through a plain zero.
--- fs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/file.c +4 -1
@@ -1136,7 +1136,10 @@ int replace_fd(unsigned fd, struct file err =expand_files (files, fd);if (unlikely (err <0 )) goto out_unlock; -return do_dup2 (files, file, fd, flags); + err =do_dup2 (files, file, fd, flags); +if (err <0 ) +return err; +return 0 ; out_unlock:spin_unlock (&files->file_lock);
Greg Kroah-Hartman
maintainerPATCH 2/168 fscontext: do not consume log entries when returning -EMSGSIZE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit 72d271a7baa7062cb27e774ac37c5459c6d20e22 upstream.
Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case.
Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. While we're at it, refactor some fscontext_read() into a separate helper to make the ring buffer logic a bit easier to read.
--- fs/fsopen.c | 70 ++++++++++++++++++++++++++++++++---------------------------- 1 file changed, 38 insertions(+), 32 deletions(-)
fs/fsopen.c +38 -32
@@ -18,50 +18,56 @@#include "internal.h" #include "mount.h" +static inline const char *fetch_message_locked (struct fc_log *log,size_t len, +bool *need_free) +{ +const char *p; +int index; + +if (unlikely (log->head == log->tail)) +return ERR_PTR (-ENODATA ); + + index = log->tail & (ARRAY_SIZE (log->buffer) -1 ); + p = log->buffer[index]; +if (unlikely (strlen (p) > len)) +return ERR_PTR (-EMSGSIZE ); + + log->buffer[index] =NULL ; + *need_free = log->need_free & (1 << index); + log->need_free &= ~(1 << index); + log->tail++; + +return p; +} +/* * Allow the user to read back any error, warning or informational messages. +* Only one message is returned for each read(2) call. */ static ssize_t fscontext_read (struct file *file,char __user *_buf,size_t len,loff_t *pos) {struct fs_context *fc = file->private_data; -struct fc_log *log = fc->log.log; -unsigned int logsize =ARRAY_SIZE (log->buffer); -ssize_t ret; -char *p; +ssize_t err; + const char *p __free(kfree) = NULL, *message;bool need_free; -int index, n; - - ret =mutex_lock_interruptible (&fc->uapi_mutex); -if (ret <0 ) -return ret; - -if (log->head == log->tail) { -mutex_unlock (&fc->uapi_mutex); -return -ENODATA ; - } +int n; - index = log->tail & (logsize -1 ); - p = log->buffer[index]; - need_free = log->need_free & (1 << index); - log->buffer[index] =NULL ; - log->need_free &= ~(1 << index); - log->tail++; + err =mutex_lock_interruptible (&fc->uapi_mutex); +if (err <0 ) +return err; + message =fetch_message_locked (fc->log.log, len, &need_free);mutex_unlock (&fc->uapi_mutex); +if (IS_ERR (message)) +return PTR_ERR (message); - ret = -EMSGSIZE ; - n =strlen (p); -if (n > len) - goto err_free; - ret = -EFAULT ; -if (copy_to_user (_buf, p, n) !=0 ) - goto err_free; - ret = n; - -err_free:if (need_free) -kfree (p); -return ret; + p = message; + + n =strlen (message); +if (copy_to_user (_buf, message, n)) +return -EFAULT ; +return n; }static int fscontext_release (struct inode *inode,struct file *file)
Greg Kroah-Hartman
maintainerPATCH 3/168 clocksource/drivers/clps711x: Fix resource leaks in error paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit cd32e596f02fc981674573402c1138f616df1728 upstream.
The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths.
--- drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/clps711x-timer.c +16 -7
@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(stunsigned int irq =irq_of_parse_and_map (np,0 );struct clk *clock =of_clk_get (np,0 );void __iomem *base =of_iomap (np,0 ); +int ret =0 ;if (!base)return -ENOMEM ; -if (!irq) -return -EINVAL ; -if (IS_ERR (clock)) -return PTR_ERR (clock); +if (!irq) { + ret = -EINVAL ; + goto unmap_io; + } +if (IS_ERR (clock)) { + ret =PTR_ERR (clock); + goto unmap_io; + }switch (of_alias_get_id (np,"timer" )) {case CLPS711X_CLKSRC_CLOCKSOURCE :clps711x_clksrc_init (clock, base);break ;case CLPS711X_CLKSRC_CLOCKEVENT : -return _clps711x_clkevt_init (clock, base, irq); + ret =_clps711x_clkevt_init (clock, base, irq); +break ;default : -return -EINVAL ; + ret = -EINVAL ; +break ; } -return 0 ; +unmap_io: +iounmap (base); +return ret; }TIMER_OF_DECLARE (clps711x,"cirrus,ep7209-timer" , clps711x_timer_init);
Greg Kroah-Hartman
maintainerPATCH 4/168 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly.
--- include/linux/iio/frequency/adf4350.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/frequency/adf4350.h +1 -1
@@ -51,7 +51,7 @@/* REG3 Bit Definitions */ #define ADF4350_REG3_12BIT_CLKDIV (x) ((x) << 3) -#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 16) +#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 15)#define ADF4350_REG3_12BIT_CSR_EN (1 << 18)#define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)#define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
Greg Kroah-Hartman
maintainerPATCH 5/168 media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream.
v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash.
Add proper error handling to v4l2_subdev_call_state_try().
--- include/media/v4l2-subdev.h | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
include/media/v4l2-subdev.h +17 -13
@@ -1462,19 +1462,23 @@ extern const struct v4l2_subdev_ops v4l2* * Note: only legacy non-MC drivers may need this macro. */ -#define v4l2_subdev_call_state_try(sd, o, f, args...) \ - ({ \ - int __result; \ - static struct lock_class_key __key; \ - const char *name = KBUILD_BASENAME \ - ":" __stringify(__LINE__) ":state->lock"; \ - struct v4l2_subdev_state *state = \ - __v4l2_subdev_state_alloc(sd, name, &__key); \ - v4l2_subdev_lock_state(state); \ - __result = v4l2_subdev_call(sd, o, f, state, ##args); \ - v4l2_subdev_unlock_state(state); \ - __v4l2_subdev_state_free(state); \ - __result; \ +#define v4l2_subdev_call_state_try(sd, o, f, args...) \ + ({ \ + int __result; \ + static struct lock_class_key __key; \ + const char *name = KBUILD_BASENAME \ + ":" __stringify(__LINE__) ":state->lock"; \ + struct v4l2_subdev_state *state = \ + __v4l2_subdev_state_alloc(sd, name, &__key); \ + if (IS_ERR(state)) { \ + __result = PTR_ERR(state); \ + } else { \ + v4l2_subdev_lock_state(state); \ + __result = v4l2_subdev_call(sd, o, f, state, ##args); \ + v4l2_subdev_unlock_state(state); \ + __v4l2_subdev_state_free(state); \ + } \ + __result; \ })/**
Greg Kroah-Hartman
maintainerPATCH 6/168 perf evsel: Avoid container_of on a NULL leader
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
An evsel should typically have a leader of itself, however, in tests like 'Sample parsing' a NULL leader may occur and the container_of will return a corrupt pointer.
Avoid this with an explicit NULL test.
--- tools/perf/util/evsel.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/util/evsel.c +2 -0
@@ -3146,6 +3146,8 @@ bool evsel__is_hybrid(struct evsel *evsel)struct evsel *evsel__leader (struct evsel *evsel) { +if (evsel->core.leader ==NULL ) +return NULL ; return container_of(evsel->core.leader, struct evsel, core); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/168 libperf event: Ensure tracing data is multiple of 8 sized
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
Perf's synthetic-events.c will ensure 8-byte alignment of tracing data, writing it after a perf_record_header_tracing_data event.
Add padding to struct perf_record_header_tracing_data to make it 16-byte rather than 12-byte sized.
--- tools/lib/perf/include/perf/event.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/perf/include/perf/event.h +1 -0
@@ -273,6 +273,7 @@ struct perf_record_header_event_type {struct perf_record_header_tracing_data {struct perf_event_header header;__u32 size; +__u32 pad; };#define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/168 clk: at91: peripheral: fix return value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
determine_rate() is expected to return an error code, or 0 on success. clk_sam9x5_peripheral_determine_rate() has a branch that returns the parent rate on a certain case. This is the behavior of round_rate(), so let's go ahead and fix this by setting req->rate.
--- drivers/clk/at91/clk-peripheral.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/at91/clk-peripheral.c +5 -2
@@ -275,8 +275,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,long best_diff =LONG_MIN ;u32 shift; -if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) -return parent_rate; +if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) { + req->rate = parent_rate; + +return 0 ; + }/* Fist step: check the available dividers. */ for (shift =0 ; shift <=PERIPHERAL_MAX_SHIFT ; shift++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/168 perf util: Fix compression checks returning -1 as bool
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1.
A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers.
Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch.
--- tools/perf/util/lzma.c | 2 +- tools/perf/util/zlib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/lzma.c +1 -1
@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
tools/perf/util/zlib.c +1 -1
@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/168 rtc: x1205: Fix Xicor X1205 vendor prefix
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered.
--- drivers/rtc/rtc-x1205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-x1205.c +1 -1
@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {MODULE_DEVICE_TABLE (i2c, x1205_id);static const struct of_device_id x1205_dt_ids[] = { - { .compatible ="xircom,x1205" , }, + { .compatible ="xicor,x1205" , }, {}, };MODULE_DEVICE_TABLE (of, x1205_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/168 rtc: optee: fix memory leak on driver removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
Fix a memory leak in case of driver removal.
Free the shared memory used for arguments exchanges between kernel and OP-TEE RTC PTA.
--- drivers/rtc/rtc-optee.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-optee.c +1 -0
@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) {struct optee_rtc *priv =dev_get_drvdata (dev); +tee_shm_free (priv->shm);tee_client_close_session (priv->ctx, priv->session_id);tee_client_close_context (priv->ctx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/168 perf arm_spe: Correct setting remote access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
Set the mem_remote field for a remote access to appropriately represent the event.
--- tools/perf/util/arm-spe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/arm-spe.c +1 -1
@@ -492,7 +492,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco }if (record->type &ARM_SPE_REMOTE_ACCESS ) - data_src->mem_lvl |=PERF_MEM_LVL_REM_CCE1 ; + data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; }static u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/168 perf arm-spe: Refactor arm-spe to support operation packet type
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: German Gomez <[email protected]>
[ Upstream commit 0066015a3d8f9c01a17eb04579edba7dac9510af ]
Extend the decoder of Arm SPE records to support more fields from the operation packet type.
Not all fields are being decoded by this commit. Only those needed to support the use-case SVE load/store/other operations.
Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
--- .../util/arm-spe-decoder/arm-spe-decoder.c | 30 ++++++++++-- .../util/arm-spe-decoder/arm-spe-decoder.h | 47 +++++++++++++++---- tools/perf/util/arm-spe.c | 8 ++-- 3 files changed, 67 insertions(+), 18 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +26 -4
@@ -186,11 +186,27 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) decoder->record.context_id = payload;break ;case ARM_SPE_OP_TYPE : -if (idx ==SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC ) { -if (payload &0x1 ) - decoder->record.op =ARM_SPE_ST ; +switch (idx) { +case SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC : + decoder->record.op |=ARM_SPE_OP_LDST ; +if (payload &SPE_OP_PKT_ST ) + decoder->record.op |=ARM_SPE_OP_ST ;else - decoder->record.op =ARM_SPE_LD ; + decoder->record.op |=ARM_SPE_OP_LD ; +if (SPE_OP_PKT_IS_LDST_SVE (payload)) + decoder->record.op |=ARM_SPE_OP_SVE_LDST ; +break ; +case SPE_OP_PKT_HDR_CLASS_OTHER : + decoder->record.op |=ARM_SPE_OP_OTHER ; +if (SPE_OP_PKT_IS_OTHER_SVE_OP (payload)) + decoder->record.op |=ARM_SPE_OP_SVE_OTHER ; +break ; +case SPE_OP_PKT_HDR_CLASS_BR_ERET : + decoder->record.op |=ARM_SPE_OP_BRANCH_ERET ; +break ; +default : +pr_err ("Get packet error!\n" ); +return -1 ; }break ;case ARM_SPE_EVENTS :
@@ -218,6 +234,12 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)if (payload &BIT (EV_MISPRED )) decoder->record.type |=ARM_SPE_BRANCH_MISS ; +if (payload &BIT (EV_PARTIAL_PREDICATE )) + decoder->record.type |=ARM_SPE_SVE_PARTIAL_PRED ; + +if (payload &BIT (EV_EMPTY_PREDICATE )) + decoder->record.type |=ARM_SPE_SVE_EMPTY_PRED ; +break ;case ARM_SPE_DATA_SOURCE : decoder->record.source = payload;
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +37 -10
56 lines not on this page · raw message
tools/perf/util/arm-spe.c +4 -4
@@ -411,7 +411,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We have no data on the hit level or data source for stores in the * Neoverse SPE records. */ -if (record->op &ARM_SPE_ST ) { +if (record->op &ARM_SPE_OP_ST ) { data_src->mem_lvl =PERF_MEM_LVL_NA ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_NA ; data_src->mem_snoop =PERF_MEM_SNOOP_NA ;
@@ -497,12 +497,12 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *recostatic u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr) { -union perf_mem_data_src data_src = {0 }; +union perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA };bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe); -if (record->op ==ARM_SPE_LD ) +if (record->op &ARM_SPE_OP_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ; -else if (record->op ==ARM_SPE_ST ) +else if (record->op &ARM_SPE_OP_ST ) data_src.mem_op =PERF_MEM_OP_STORE ;else return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/168 perf arm-spe: Rename the common data source encoding
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
The Neoverse CPUs follow the common data source encoding, and other CPU variants can share the same format.
Rename the CPU list and data source definitions as common data source names. This change prepares for appending more CPU variants.
Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
--- .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ tools/perf/util/arm-spe.c | 28 +++++++++---------- 2 files changed, 23 insertions(+), 23 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +9 -9
@@ -56,15 +56,15 @@ enum arm_spe_op_type { ARM_SPE_OP_BR_INDIRECT = 1 << 17, }; -enum arm_spe_neoverse_data_source { -ARM_SPE_NV_L1D =0x0 , -ARM_SPE_NV_L2 =0x8 , -ARM_SPE_NV_PEER_CORE =0x9 , -ARM_SPE_NV_LOCAL_CLUSTER =0xa , -ARM_SPE_NV_SYS_CACHE =0xb , -ARM_SPE_NV_PEER_CLUSTER =0xc , -ARM_SPE_NV_REMOTE =0xd , -ARM_SPE_NV_DRAM =0xe , +enum arm_spe_common_data_source { +ARM_SPE_COMMON_DS_L1D =0x0 , +ARM_SPE_COMMON_DS_L2 =0x8 , +ARM_SPE_COMMON_DS_PEER_CORE =0x9 , +ARM_SPE_COMMON_DS_LOCAL_CLUSTER =0xa , +ARM_SPE_COMMON_DS_SYS_CACHE =0xb , +ARM_SPE_COMMON_DS_PEER_CLUSTER =0xc , +ARM_SPE_COMMON_DS_REMOTE =0xd , +ARM_SPE_COMMON_DS_DRAM =0xe , };struct arm_spe_record {
tools/perf/util/arm-spe.c +14 -14
@@ -389,15 +389,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq,return arm_spe_deliver_synth_event (spe, speq, event, &sample); } -static const struct midr_range neoverse_spe[] = { +static const struct midr_range common_ds_encoding_cpus[] = {MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N1 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N2 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V1 ), {}, }; -static void arm_spe__synth_data_source_neoverse (const struct arm_spe_record *record, -union perf_mem_data_src *data_src) +static void arm_spe__synth_data_source_common (const struct arm_spe_record *record, +union perf_mem_data_src *data_src) {/* * Even though four levels of cache hierarchy are possible, no known
@@ -419,17 +419,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec }switch (record->source) { -case ARM_SPE_NV_L1D : +case ARM_SPE_COMMON_DS_L1D : data_src->mem_lvl =PERF_MEM_LVL_L1 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L1 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_L2 : +case ARM_SPE_COMMON_DS_L2 : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_PEER_CORE : +case ARM_SPE_COMMON_DS_PEER_CORE : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -438,8 +438,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know if this is L1, L2 but we do know it was a cache-2-cache * transfer, so set SNOOPX_PEER */ -case ARM_SPE_NV_LOCAL_CLUSTER : -case ARM_SPE_NV_PEER_CLUSTER : +case ARM_SPE_COMMON_DS_LOCAL_CLUSTER : +case ARM_SPE_COMMON_DS_PEER_CLUSTER : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -447,7 +447,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec/* * System cache is assumed to be L3 */ -case ARM_SPE_NV_SYS_CACHE : +case ARM_SPE_COMMON_DS_SYS_CACHE : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoop =PERF_MEM_SNOOP_HIT ;
@@ -456,13 +456,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know what level it hit in, except it came from the other * socket */ -case ARM_SPE_NV_REMOTE : +case ARM_SPE_COMMON_DS_REMOTE : data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ; -case ARM_SPE_NV_DRAM : +case ARM_SPE_COMMON_DS_DRAM : data_src->mem_lvl =PERF_MEM_LVL_LOC_RAM |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_RAM ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;
@@ -498,7 +498,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *recostatic u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr) {union perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA }; -bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe); +bool is_common =is_midr_in_range_list (midr, common_ds_encoding_cpus);if (record->op &ARM_SPE_OP_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ;
@@ -507,8 +507,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 melse return 0 ; -if (is_neoverse) -arm_spe__synth_data_source_neoverse (record, &data_src); +if (is_common) +arm_spe__synth_data_source_common (record, &data_src);else arm_spe__synth_data_source_generic (record, &data_src);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/168 perf arm_spe: Correct memory level for remote access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
For remote accesses, the data source packet does not contain information about the memory level. To avoid misinformation, set the memory level to NA (Not Available).
--- tools/perf/util/arm-spe.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/arm-spe.c +2 -2
@@ -457,8 +457,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor* socket */ case ARM_SPE_COMMON_DS_REMOTE : - data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; - data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; + data_src->mem_lvl =PERF_MEM_LVL_NA ; + data_src->mem_lvl_num =PERF_MEM_LVLNUM_NA ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/168 perf session: Fix handling when buffer exceeds 2 GiB
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative.
As a result, the perf record command reports an error:
0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly.
--- tools/perf/util/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/session.c +1 -1
@@ -1658,7 +1658,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,struct perf_tool *tool = session->tool;struct perf_sample sample = { .time =0 , };int fd =perf_data__fd (session->data); -int err; +s64 err;if (event->header.type !=PERF_RECORD_COMPRESSED || tool->compressed == perf_session__process_compressed_event_stub)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/168 perf test: Dont leak workload gopipe in PERF_RECORD_*
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
The test starts a workload and then opens events. If the events fail to open, for example because of perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.
Before:
```
$ perf test -vv 7
7: PERF_RECORD_* events & perf_sample fields:
--- start ---
test child forked, pid 1189568
Using CPUID GenuineIntel-6-B7-1
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
Attempt to add: software/cpu-clock/
..after resolving event: software/config=0/
cpu-clock -> software/cpu-clock/
------------------------------------------------------------
perf_event_attr:
type 1 (PERF_TYPE_SOFTWARE)
size 136
config 0x9 (PERF_COUNT_SW_DUMMY)
sample_type IP|TID|TIME|CPU
read_format ID|LOST
disabled 1
inherit 1
mmap 1
comm 1
enable_on_exec 1
task 1
sample_id_all 1
mmap2 1
comm_exec 1
ksymbol 1
bpf_event 1
{ wakeup_events, wakeup_watermark } 1
------------------------------------------------------------
sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
perf_evlist__open: Permission denied
---- end(-2) ----
Leak of file descriptor 6 that opened: 'pipe:[14200347]'
---- unexpected signal (6) ----
iFailed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
#0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
#1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
#2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
#3 0x7f29ce849cc2 in raise raise.c:27
#4 0x7f29ce8324ac in abort abort.c:81
#5 0x565358f662d4 in check_leaks builtin-test.c:226
#6 0x565358f6682e in run_test_child builtin-test.c:344
#7 0x565358ef7121 in start_command run-command.c:128
#8 0x565358f67273 in start_test builtin-test.c:545
#9 0x565358f6771d in __cmd_test builtin-test.c:647
#10 0x565358f682bd in cmd_test builtin-test.c:849
#11 0x565358ee5ded in run_builtin perf.c:349
#12 0x565358ee6085 in handle_internal_command perf.c:401
#13 0x565358ee61de in run_argv perf.c:448
#14 0x565358ee6527 in main perf.c:555
#15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
#16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
#17 0x565358e391c1 in _start perf[851c1]
7: PERF_RECORD_* events & perf_sample fields : FAILED!
```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```
--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/perf/tests/perf-record.c +4 -0
@@ -113,6 +113,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -124,6 +125,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -135,6 +137,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -147,6 +150,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/168 clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
The infrastructure gate for the HDMI specific crystal needs the top_hdmi_xtal clock to be configured in order to ungate the 26m clock to the HDMI IP, and it wouldn't work without.
Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
--- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/mediatek/clk-mt8195-infra_ao.c +1 -1
@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {GATE_INFRA_AO0 (CLK_INFRA_AO_CQ_DMA_FPC ,"infra_ao_cq_dma_fpc" ,"fpc" ,28 ),GATE_INFRA_AO0 (CLK_INFRA_AO_UART5 ,"infra_ao_uart5" ,"top_uart" ,29 ),/* INFRA_AO1 */ -GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"clk26m" ,0 ), +GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"top_hdmi_xtal" ,0 ),GATE_INFRA_AO1 (CLK_INFRA_AO_SPI0 ,"infra_ao_spi0" ,"top_spi" ,1 ),GATE_INFRA_AO1 (CLK_INFRA_AO_MSDC0 ,"infra_ao_msdc0" ,"top_msdc50_0_hclk" ,2 ), GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/168 clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
The flags in |struct mtk_mux| are core clk flags, not mux clk flags. Passing one to the other is wrong.
Since there aren't any actual users adding CLK_MUX_* flags, just drop it for now.
--- drivers/clk/mediatek/clk-mux.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/clk/mediatek/clk-mux.c +1 -3
@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)static int mtk_clk_mux_determine_rate (struct clk_hw *hw,struct clk_rate_request *req) { -struct mtk_clk_mux *mux =to_mtk_clk_mux (hw); - -return clk_mux_determine_rate_flags (hw, req, mux->data->flags); +return clk_mux_determine_rate_flags (hw, req,0 ); }const struct clk_ops mtk_mux_clr_set_upd_ops = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/168 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series.
Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +9 -7
@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,return 0 ; } -static long lpc18xx_pll0_round_rate (struct clk_hw *hw,unsigned long rate, -unsigned long *prate) +static int lpc18xx_pll0_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) {unsigned long m; -if (*prate < rate) { +if (req->best_parent_rate < req->rate) {pr_warn ("%s: pll dividers not supported\n" , __func__);return -EINVAL ; } - m =DIV_ROUND_UP_ULL (*prate, rate *2 ); + m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 );if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { -pr_warn ("%s: unable to support rate %lu\n" , __func__, rate); +pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; } -return 2 * *prate * m; + req->rate =2 * req->best_parent_rate * m; + +return 0 ; } static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,static const struct clk_ops lpc18xx_pll0_ops = { .recalc_rate = lpc18xx_pll0_recalc_rate, - .round_rate = lpc18xx_pll0_round_rate, + .determine_rate = lpc18xx_pll0_determine_rate, .set_rate = lpc18xx_pll0_set_rate, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/168 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
This ensures proper bounds checking during clk rate setting and rounding.
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +2 -2
@@ -382,7 +382,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, } m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; }
@@ -405,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, } m =DIV_ROUND_UP_ULL (parent_rate, rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, rate);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/168 clk: tegra: do not overallocate memory for bpmp clocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
struct tegra_bpmp::clocks is a pointer to a dynamically allocated array of pointers to 'struct tegra_bpmp_clk'.
But the size of the allocated area is calculated like it is an array containing actual 'struct tegra_bpmp_clk' objects - it's not true, there are just pointers.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
--- drivers/clk/tegra/clk-bpmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/tegra/clk-bpmp.c +1 -1
@@ -603,7 +603,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, bpmp->num_clocks = count; - bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (struct tegra_bpmp_clk ),GFP_KERNEL ); + bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (*bpmp->clocks),GFP_KERNEL );if (!bpmp->clocks)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/168 cpufreq: tegra186: Set target frequency for all cpus in policy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
The original commit set all cores in a cluster to a shared policy, but did not update set_target to apply a frequency change to all cores for the policy. This caused most cores to remain stuck at their boot frequency.
--- drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/cpufreq/tegra186-cpufreq.c +6 -2
@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, {struct tegra186_cpufreq_data *data =cpufreq_get_driver_data ();struct cpufreq_frequency_table *tbl = policy->freq_table + index; -unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; +unsigned int edvd_offset;u32 edvd_val = tbl->driver_data; +u32 cpu; -writel (edvd_val, data->regs + edvd_offset); +for_each_cpu (cpu, policy->cpus) { + edvd_offset = data->cpus[cpu].edvd_offset; +writel (edvd_val, data->regs + edvd_offset); + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/168 scsi: libsas: Add sas_task_find_rq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
blk-mq already provides a unique tag per request. Some libsas LLDDs - like hisi_sas - already use this tag as the unique per-I/O HW tag.
Add a common function to provide the request associated with a sas_task for all libsas LLDDs.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- include/scsi/libsas.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/scsi/libsas.h +18 -0
@@ -648,6 +648,24 @@ static inline bool sas_is_internal_abort(struct sas_task *task)return task->task_proto ==SAS_PROTOCOL_INTERNAL_ABORT ; } +static inline struct request *sas_task_find_rq (struct sas_task *task) +{ +struct scsi_cmnd *scmd; + +if (task->task_proto &SAS_PROTOCOL_STP_ALL ) { +struct ata_queued_cmd *qc = task->uldd_task; + + scmd = qc ? qc->scsicmd :NULL ; + }else { + scmd = task->uldd_task; + } + +if (!scmd) +return NULL ; + +return scsi_cmd_to_rq (scmd); +} +struct sas_domain_function_template {/* The class calls these to notify the LLDD of an event. */ void (*lldd_port_formed)(struct asd_sas_phy *);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/168 scsi: mvsas: Delete mvs_tag_init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
All mvs_tag_init() does is zero the tag bitmap, but this is already done with the kzalloc() call to alloc the tags, so delete this unneeded function.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_init.c | 2 -- drivers/scsi/mvsas/mv_sas.c | 7 ------- drivers/scsi/mvsas/mv_sas.h | 1 - 3 files changed, 10 deletions(-)
drivers/scsi/mvsas/mv_init.c +0 -2
@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) } mvi->tags_num = slot_nr; -/* Initialize tags */ -mvs_tag_init (mvi);return 0 ; err_out:return 1 ;
drivers/scsi/mvsas/mv_sas.c +0 -7
@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)return 0 ; } -void mvs_tag_init (struct mvs_info *mvi) -{ -int i; -for (i =0 ; i < mvi->tags_num; ++i) -mvs_tag_clear (mvi, i); -} -static struct mvs_info *mvs_find_dev_mvi (struct domain_device *dev) {unsigned long i =0 , j =0 , hi =0 ;
drivers/scsi/mvsas/mv_sas.h +0 -1
@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);void mvs_tag_free (struct mvs_info *mvi,u32 tag);void mvs_tag_set (struct mvs_info *mvi,unsigned int tag);int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out); -void mvs_tag_init (struct mvs_info *mvi);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/168 scsi: mvsas: Use sas_task_find_rq() for tagging
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
The request associated with a SCSI command coming from the block layer has a unique tag, so use that when possible for getting a slot.
Unfortunately we don't support reserved commands in the SCSI midlayer yet. As such, SMP tasks - as an example - will not have a request associated, so in the interim continue to manage those tags for that type of sas_task internally.
We reserve an arbitrary 4 tags for these internal tags. Indeed, we already decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 slots are used for is not obvious.
Also make the tag management functions static, where possible.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 9 +++++---- drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- drivers/scsi/mvsas/mv_sas.h | 7 +------ 4 files changed, 29 insertions(+), 23 deletions(-)
drivers/scsi/mvsas/mv_defs.h +1 -0
@@ -40,6 +40,7 @@ enum driver_configuration {MVS_ATA_CMD_SZ =96 ,/* SATA command table buffer size */ MVS_OAF_SZ =64 ,/* Open address frame buffer size */ MVS_QUEUE_SIZE =64 ,/* Support Queue depth */ +MVS_RSVD_SLOTS =4 , MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, };
drivers/scsi/mvsas/mv_init.c +5 -4
@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry)cancel_delayed_work (&mwq->work_q); -kfree (mvi->tags); +kfree (mvi->rsvd_tags);kfree (mvi); }
@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)printk (KERN_DEBUG "failed to create dma pool %s.\n" , pool_name); goto err_out; } - mvi->tags_num = slot_nr;return 0 ; err_out:
@@ -367,8 +366,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, mvi->sas = sha; mvi->shost = shost; - mvi->tags =kzalloc (MVS_CHIP_SLOT_SZ >>3 ,GFP_KERNEL ); -if (!mvi->tags) + mvi->rsvd_tags =bitmap_zalloc (MVS_RSVD_SLOTS ,GFP_KERNEL ); +if (!mvi->rsvd_tags) goto err_out;if (MVS_CHIP_DISP ->chip_ioremap (mvi))
@@ -469,6 +468,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,else can_queue =MVS_CHIP_SLOT_SZ ; + can_queue -=MVS_RSVD_SLOTS ; + shost->sg_tablesize =min_t (u16,SG_ALL ,MVS_MAX_SG ); shost->can_queue = can_queue; mvi->shost->cmd_per_lun =MVS_QUEUE_SIZE ;
drivers/scsi/mvsas/mv_sas.c +22 -13
@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)return 0 ; } -void mvs_tag_clear (struct mvs_info *mvi,u32 tag) +static void mvs_tag_clear (struct mvs_info *mvi,u32 tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;clear_bit (tag, bitmap); } -void mvs_tag_free (struct mvs_info *mvi,u32 tag) +static void mvs_tag_free (struct mvs_info *mvi,u32 tag) { +if (tag >=MVS_RSVD_SLOTS ) +return ; +mvs_tag_clear (mvi, tag); } -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) +static void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;set_bit (tag, bitmap); } -inline int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) +static int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) {unsigned int index, tag; -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags; - index =find_first_zero_bit (bitmap, mvi->tags_num); + index =find_first_zero_bit (bitmap,MVS_RSVD_SLOTS ); tag = index; -if (tag >= mvi->tags_num) +if (tag >=MVS_RSVD_SLOTS )return -SAS_QUEUE_FULL ;mvs_tag_set (mvi, tag); *tag_out = tag;
@@ -696,6 +699,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmfstruct mvs_task_exec_info tei;struct mvs_slot_info *slot;u32 tag =0xdeadbeef , n_elem =0 ; +struct request *rq;int rc =0 ;if (!dev->port) {
@@ -760,9 +764,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf n_elem = task->num_scatter; } - rc =mvs_tag_alloc (mvi, &tag); -if (rc) - goto err_out; + rq =sas_task_find_rq (task); +if (rq) { + tag = rq->tag +MVS_RSVD_SLOTS ; + }else { + rc =mvs_tag_alloc (mvi, &tag); +if (rc) + goto err_out; + } slot = &mvi->slot_info[tag];
@@ -857,7 +866,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)static void mvs_slot_free (struct mvs_info *mvi,u32 rx_desc) {u32 slot_idx = rx_desc &RXQ_SLOT_MASK ; -mvs_tag_clear (mvi, slot_idx); +mvs_tag_free (mvi, slot_idx); } static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
drivers/scsi/mvsas/mv_sas.h +1 -6
@@ -370,8 +370,7 @@ struct mvs_info {u32 chip_id;const struct mvs_chip_info *chip; -int tags_num; -unsigned long *tags; +unsigned long *rsvd_tags;/* further per-slot information */ struct mvs_phy phy[MVS_MAX_PHYS ];struct mvs_port port[MVS_MAX_PHYS ];
@@ -424,10 +423,6 @@ struct mvs_task_exec_info {/******************** function prototype *********************/ void mvs_get_sas_addr (void *buf,u32 buflen); -void mvs_tag_clear (struct mvs_info *mvi,u32 tag); -void mvs_tag_free (struct mvs_info *mvi,u32 tag); -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag); -int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/168 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
mvs_pci_remove() |
mvs_free() | mvs_work_queue()
cancel_delayed_work() |
kfree(mvi) |
| mvi-> // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.
This bug was found by static analysis.
--- drivers/scsi/mvsas/mv_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mvsas/mv_init.c +1 -1
@@ -141,7 +141,7 @@ static void mvs_free(struct mvs_info *mvi)if (mvi->shost)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry) -cancel_delayed_work (&mwq->work_q); +cancel_delayed_work_sync (&mwq->work_q);kfree (mvi->rsvd_tags);kfree (mvi); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/168 LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 6c3ca6654a74dd396bc477839ba8d9792eced441 ]
Both acpi_table_upgrade() and acpi_boot_table_init() are defined as empty functions under !CONFIG_ACPI_TABLE_UPGRADE and !CONFIG_ACPI in include/linux/acpi.h, there are no implicit declaration errors with various configs.
#ifdef CONFIG_ACPI_TABLE_UPGRADE
void acpi_table_upgrade(void);
#else
static inline void acpi_table_upgrade(void) { }
#endif
#ifdef CONFIG_ACPI
...
void acpi_boot_table_init (void);
...
#else /* !CONFIG_ACPI */
...
static inline void acpi_boot_table_init(void)
{
}
...
#endif /* !CONFIG_ACPI */As Huacai suggested, CONFIG_ACPI_TABLE_UPGRADE is ugly and not necessary here, just remove it. At the same time, just keep CONFIG_ACPI to prevent potential build errors in future, and give a signal to indicate the code is ACPI-specific. For the same reason, we also put acpi_table_upgrade() under CONFIG_ACPI.
Stable-dep-of: 98662be7ef20 ("LoongArch: Init acpi_gbl_use_global_lock to false")
--- arch/loongarch/kernel/setup.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/loongarch/kernel/setup.c +1 -3
@@ -252,10 +252,8 @@ void __init platform_init(void)arch_reserve_vmcore ();arch_parse_crashkernel (); -#ifdef CONFIG_ACPI_TABLE_UPGRADE -acpi_table_upgrade (); -#endif #ifdef CONFIG_ACPI +acpi_table_upgrade (); acpi_gbl_use_default_register_widths = false;acpi_boot_table_init ();#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/168 LoongArch: Init acpi_gbl_use_global_lock to false
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
Init acpi_gbl_use_global_lock to false, in order to void error messages during boot phase:
ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
--- arch/loongarch/kernel/setup.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/kernel/setup.c +1 -0
@@ -254,6 +254,7 @@ void __init platform_init(void)#ifdef CONFIG_ACPI acpi_table_upgrade (); + acpi_gbl_use_global_lock = false; acpi_gbl_use_default_register_widths = false;acpi_boot_table_init ();#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/168 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,mlx4_unregister_mac (mdev->dev, priv->port, mac);hlist_del_rcu (&entry->hlist); -kfree_rcu (entry, rcu);en_dbg (DRV , priv,"Removed MAC %pM on port:%d\n" , entry->mac, priv->port); +kfree_rcu (entry, rcu); ++removed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/168 s390/cio: Update purge function to unregister the unused subchannels
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")', cio no longer unregisters subchannels when the attached device is invalid or unavailable.
As an unintended side-effect, the cio_ignore purge function no longer removes subchannels for devices on the cio_ignore list if no CCW device is attached. This situation occurs when a CCW device is non-operational or unavailable
To ensure the same outcome of the purge function as when the current cio_ignore list had been active during boot, update the purge function to remove I/O subchannels without working CCW devices if the associated device number is found on the cio_ignore list.
--- drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
drivers/s390/cio/device.c +24 -13
@@ -1309,23 +1309,34 @@ void ccw_device_schedule_recovery(void)spin_unlock_irqrestore (&recovery_lock, flags); } -static int purge_fn (struct device *dev,void *data) +static int purge_fn (struct subchannel *sch,void *data) { -struct ccw_device *cdev =to_ccwdev (dev); -struct ccw_dev_id *id = &cdev->private->dev_id; -struct subchannel *sch =to_subchannel (cdev->dev.parent); +struct ccw_device *cdev; -spin_lock_irq (cdev->ccwlock); -if (is_blacklisted (id->ssid, id->devno) && - (cdev->private->state ==DEV_STATE_OFFLINE ) && - (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) ==0 )) { -CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x\n" , id->ssid, - id->devno); +spin_lock_irq (&sch->lock); +if (sch->st !=SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) + goto unlock; + +if (!is_blacklisted (sch->schid.ssid, sch->schib.pmcw.dev)) + goto unlock; + + cdev =sch_get_cdev (sch); +if (cdev) { +if (cdev->private->state !=DEV_STATE_OFFLINE ) + goto unlock; + +if (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) !=0 ) + goto unlock;ccw_device_sched_todo (cdev,CDEV_TODO_UNREG ); -css_sched_sch_todo (sch,SCH_TODO_UNREG );atomic_set (&cdev->private->onoff,0 ); } -spin_unlock_irq (cdev->ccwlock); + +css_sched_sch_todo (sch,SCH_TODO_UNREG ); +CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x%s\n" , sch->schid.ssid, + sch->schib.pmcw.dev, cdev ?"" :" (no cdev)" ); + +unlock: +spin_unlock_irq (&sch->lock);/* Abort loop in case of pending signal. */ if (signal_pending (current))return -EINTR ;
@@ -1341,7 +1352,7 @@ static int purge_fn(struct device *dev, void *data)int ccw_purge_blacklisted (void ) {CIO_MSG_EVENT (2 ,"ccw: purging blacklisted devices\n" ); -bus_for_each_dev (&ccw_bus_type,NULL ,NULL , purge_fn); +for_each_subchannel_staged (purge_fn,NULL ,NULL );return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/168 drm/vmwgfx: Fix Use-after-free in validation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +3 -1
@@ -339,8 +339,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,hash_add_rcu (ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res =vmw_resource_reference_unless_doomed (res); -if (!node->res) +if (!node->res) { +hash_del_rcu (&node->hash.head);return -ESRCH ; + } node->first_usage =1 ;if (!res->dev_priv->has_mob) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/168 drm/vmwgfx: Fix copy-paste typo in validation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
'entry' should be 'val' which is the loop iterator.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +1 -1
@@ -692,7 +692,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)hash_del_rcu (&val->hash.head);list_for_each_entry (val, &ctx->resource_ctx_list, head) -hash_del_rcu (&entry->hash.head); +hash_del_rcu (&val->hash.head); ctx->sw_context =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/168 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandr Sapozhnikov <[email protected]>
[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
--- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sm_statefuns.c +2 -1
@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,return SCTP_DISPOSITION_CONSUME ; nomem_authev: -sctp_ulpevent_free (ai_ev); +if (ai_ev) +sctp_ulpevent_free (ai_ev); nomem_aiev:sctp_ulpevent_free (ev); nomem_ev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/168 tcp: Dont call reqsk_fastopen_remove() in tcp_conn_request().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]:refcount_t: underflow; use-after-free.
WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
--- net/ipv4/tcp_input.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/tcp_input.c +0 -1
@@ -7125,7 +7125,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, &foc, TCP_SYNACK_FASTOPEN, skb);/* Add the child socket directly into the accept queue */ if (!inet_csk_reqsk_queue_add (sk, req, fastopen_sk)) { -reqsk_fastopen_remove (fastopen_sk, req, false);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk); goto drop_and_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/168 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <[email protected]>
[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node.
--- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fsl_pq_mdio.c +2 -0
@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)"missing 'reg' property in node %pOF\n" , tbi); err = -EBUSY ; +of_node_put (tbi); goto error; }set_tbipa (*prop, pdev, data->get_tbipa, priv->map, &res); +of_node_put (tbi); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/168 tools build: Align warning options with perf
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks.
Make the feature test program use the same warning options as perf.
--- tools/build/feature/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +2 -2
@@ -282,10 +282,10 @@ $(OUTPUT)test-libbabeltrace.bin: $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace) $(OUTPUT)test-compile-32.bin: - $(CC) -m32 -o $@ test-compile.c + $(CC) -m32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-compile-x32.bin: - $(CC) -mx32 -o $@ test-compile.c + $(CC) -mx32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-zlib.bin: $(BUILD) -lz
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/168 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary.
Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - 1 file changed, 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +0 -1
@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (ipi_mbox->dev.parent) { -mbox_controller_unregister (&ipi_mbox->mbox);if (device_is_registered (&ipi_mbox->dev))device_unregister (&ipi_mbox->dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/168 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes.
device_is_registered() is the canonical and robust method to verify the registration status.
Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +2 -4
@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) i = pdata->num_mboxes;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i]; -if (ipi_mbox->dev.parent) { -if (device_is_registered (&ipi_mbox->dev)) -device_unregister (&ipi_mbox->dev); - } +if (device_is_registered (&ipi_mbox->dev)) +device_unregister (&ipi_mbox->dev); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/168 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster.
The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing.
The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first.
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -2266,6 +2266,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,if (IS_ERR (dst)) goto out_drop; +skb_dst_drop (skb);skb_dst_set (skb, dst); }else if (nh->nh_family !=AF_INET6 ) { goto out_drop;
@@ -2375,6 +2376,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } +skb_dst_drop (skb);skb_dst_set (skb, &rt->dst); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/168 drm/amdgpu: Add additional DCE6 SCL registers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
--- drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ 2 files changed, 9 insertions(+)
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +7 -0
@@ -4115,6 +4115,7 @@#define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40#define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL0_SCL_SCALER_ENABLE 0x1B42#define mmSCL0_SCL_CONTROL 0x1B44#define mmSCL0_SCL_DEBUG 0x1B6A#define mmSCL0_SCL_DEBUG2 0x1B69
@@ -4144,6 +4145,7 @@#define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55#define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40#define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 +#define mmSCL1_SCL_SCALER_ENABLE 0x1E42#define mmSCL1_SCL_CONTROL 0x1E44#define mmSCL1_SCL_DEBUG 0x1E6A#define mmSCL1_SCL_DEBUG2 0x1E69
@@ -4173,6 +4175,7 @@#define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155#define mmSCL2_SCL_COEF_RAM_SELECT 0x4140#define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 +#define mmSCL2_SCL_SCALER_ENABLE 0x4142#define mmSCL2_SCL_CONTROL 0x4144#define mmSCL2_SCL_DEBUG 0x416A#define mmSCL2_SCL_DEBUG2 0x4169
@@ -4202,6 +4205,7 @@#define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455#define mmSCL3_SCL_COEF_RAM_SELECT 0x4440#define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 +#define mmSCL3_SCL_SCALER_ENABLE 0x4442#define mmSCL3_SCL_CONTROL 0x4444#define mmSCL3_SCL_DEBUG 0x446A#define mmSCL3_SCL_DEBUG2 0x4469
@@ -4231,6 +4235,7 @@#define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755#define mmSCL4_SCL_COEF_RAM_SELECT 0x4740#define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 +#define mmSCL4_SCL_SCALER_ENABLE 0x4742#define mmSCL4_SCL_CONTROL 0x4744#define mmSCL4_SCL_DEBUG 0x476A#define mmSCL4_SCL_DEBUG2 0x4769
@@ -4260,6 +4265,7 @@#define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55#define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40#define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 +#define mmSCL5_SCL_SCALER_ENABLE 0x4A42#define mmSCL5_SCL_CONTROL 0x4A44#define mmSCL5_SCL_DEBUG 0x4A6A#define mmSCL5_SCL_DEBUG2 0x4A69
@@ -4287,6 +4293,7 @@#define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL_COEF_RAM_SELECT 0x1B40#define mmSCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL_SCALER_ENABLE 0x1B42#define mmSCL_CONTROL 0x1B44#define mmSCL_DEBUG 0x1B6A#define mmSCL_DEBUG2 0x1B69
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +2 -0
@@ -8648,6 +8648,8 @@#define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 +#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L +#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000#define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L#define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000#define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/168 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
Without these, it's impossible to program these registers.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,8 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \SRI (SCL_HORZ_FILTER_SCALE_RATIO ,SCL , id), \SRI (SCL_VERT_FILTER_SCALE_RATIO ,SCL , id), \ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/168 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
Previously, the code would set a bit field which didn't exist on DCE6 so it would be effectively a no-op.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +2 -4
@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {/* 4. Program vertical filters */ if (xfm_dce->filter_v ==NULL ) -REG_SET (SCL_VERT_FILTER_CONTROL ,0 , -SCL_V_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_VERT_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.v_taps,
@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(/* 5. Program horizontal filters */ if (xfm_dce->filter_h ==NULL ) -REG_SET (SCL_HORZ_FILTER_CONTROL ,0 , -SCL_H_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_HORZ_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.h_taps,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/168 drm/amd/display: Properly disable scaling on DCE6
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
SCL_SCALER_ENABLE can be used to enable/disable the scaler on DCE6. Program it to 0 when scaling isn't used, 1 when used. Additionally, clear some other registers when scaling is disabled and program the SCL_UPDATE register as recommended.
This fixes visible glitches for users whose BIOS sets up a mode with scaling at boot, which DC was unable to clean up.
--- .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +11 -4
@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(REG_SET (SCL_BYPASS_CONTROL ,0 ,SCL_BYPASS_MODE ,0 );if (data->taps.h_taps + data->taps.v_taps <=2 ) { -/* Set bypass */ - -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +/* Disable scaler functionality */ +REG_WRITE (SCL_SCALER_ENABLE ,0 ); +/* Clear registers that can cause glitches even when the scaler is off */ +REG_WRITE (SCL_TAP_CONTROL ,0 ); +REG_WRITE (SCL_AUTOMATIC_MODE_CONTROL ,0 ); +REG_WRITE (SCL_F_SHARP_CONTROL ,0 );return false; }
@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(SCL_H_NUM_OF_TAPS , data->taps.h_taps -1 , SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +REG_WRITE (SCL_SCALER_ENABLE ,1 );/* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(REG_SET (DC_LB_MEM_SIZE ,0 ,DC_LB_MEM_SIZE , xfm_dce->lb_memory_size); +REG_WRITE (SCL_UPDATE ,0x00010000 ); +/* Clear SCL_F_SHARP_CONTROL value to 0 */ REG_WRITE (SCL_F_SHARP_CONTROL ,0 );
@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(/* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ + + REG_WRITE(SCL_UPDATE, 0); }#endif
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,7 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_SCALER_ENABLE ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
@@ -592,6 +593,7 @@ struct dce_transform_registers {uint32_t SCL_VERT_FILTER_SCALE_RATIO ;uint32_t SCL_HORZ_FILTER_INIT ;#if defined(CONFIG_DRM_AMD_DC_SI ) +uint32_t SCL_SCALER_ENABLE ;uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA ;uint32_t SCL_HORZ_FILTER_INIT_CHROMA ;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/168 bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Woudstra <[email protected]>
[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
7 locks held by socat/410:
#0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 [..]
#6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
Call Trace: lockdep_rcu_suspicious.cold+0x4f/0xb1 br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] br_fill_forward_path+0x7a/0x4d0 [bridge]
Use to correct helper, non _rcu variant requires RTNL mutex.
--- net/bridge/br_vlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_vlan.c +1 -1
@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,if (!br_opt_get (br,BROPT_VLAN_ENABLED ))return ; - vg =br_vlan_group (br); + vg =br_vlan_group_rcu (br);if (idx >=0 && ctx->vlan[idx].proto == br->vlan_proto) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/168 crypto: essiv - Check ssize for decryption and in-place encryption
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
--- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
crypto/essiv.c +6 -8
@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)const struct essiv_tfm_ctx *tctx =crypto_aead_ctx (tfm);struct essiv_aead_request_ctx *rctx =aead_request_ctx (req);struct aead_request *subreq = &rctx->aead_req; +int ivsize =crypto_aead_ivsize (tfm); +int ssize = req->assoclen - ivsize;struct scatterlist *src = req->src;int err; +if (ssize <0 ) +return -EINVAL ; +crypto_cipher_encrypt_one (tctx->essiv_cipher, req->iv, req->iv);/*
@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)*/ rctx->assoc =NULL ;if (req->src == req->dst || !enc) { -scatterwalk_map_and_copy (req->iv, req->dst, - req->assoclen -crypto_aead_ivsize (tfm), -crypto_aead_ivsize (tfm),1 ); +scatterwalk_map_and_copy (req->iv, req->dst, ssize, ivsize,1 ); }else {u8 *iv = (u8 *)aead_request_ctx (req) + tctx->ivoffset; -int ivsize =crypto_aead_ivsize (tfm); -int ssize = req->assoclen - ivsize;struct scatterlist *sg;int nents; -if (ssize <0 ) -return -EINVAL ; - nents =sg_nents_for_len (req->src, ssize);if (nents <0 )return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/168 tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gunnar Kudrjavets <[email protected]>
[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
The tpm_tis_write8() call specifies arguments in wrong order. Should be (data, addr, value) not (data, value, addr). The initial correct order was changed during the major refactoring when the code was split.
--- drivers/char/tpm/tpm_tis_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +2 -2
@@ -878,8 +878,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,* will call disable_irq which undoes all of the above. */ if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) { -tpm_tis_write8 (priv, original_int_vec, -TPM_INT_VECTOR (priv->locality)); +tpm_tis_write8 (priv,TPM_INT_VECTOR (priv->locality), + original_int_vec); rc =-1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/168 gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ]
The of_gpio_n_cells default is 2 when ->of_xlate() callback is not defined. No need to assign it explicitly in the driver.
Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping")
--- drivers/gpio/gpio-wcd934x.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpio/gpio-wcd934x.c +0 -1
@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev) chip->base =-1 ; chip->ngpio =WCD934X_NPINS ; chip->label =dev_name (dev); - chip->of_gpio_n_cells =2 ; chip->can_sleep = false;return devm_gpiochip_add_data (dev, chip, data);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/168 gpio: wcd934x: mark the GPIO controller as sleeping
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
The slimbus regmap passed to the GPIO driver down from MFD does not use fast_io. This means a mutex is used for locking and thus this GPIO chip must not be used in atomic context. Change the can_sleep switch in struct gpio_chip to true.
--- drivers/gpio/gpio-wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-wcd934x.c +1 -1
@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) chip->base =-1 ; chip->ngpio =WCD934X_NPINS ; chip->label =dev_name (dev); - chip->can_sleep = false; + chip->can_sleep = true;return devm_gpiochip_add_data (dev, chip, data); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/168 bpf: Avoid RCU context warning when unpinning htab with internal structs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: KaFai Wan <[email protected]>
[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered:
BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ...
The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms:
1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context.
2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations.
However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule.
Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning.
--- kernel/bpf/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/bpf/inode.c +2 -2
@@ -610,7 +610,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)return 0 ; } -static void bpf_free_inode (struct inode *inode) +static void bpf_destroy_inode (struct inode *inode) {enum bpf_type type;
@@ -625,7 +625,7 @@ static const struct super_operations bpf_super_ops = { .statfs = simple_statfs, .drop_inode = generic_delete_inode, .show_options = bpf_show_options, - .free_inode = bpf_free_inode, + .destroy_inode = bpf_destroy_inode, };enum {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/168 ACPI: property: Fix buffer properties extraction for subnodes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit d0759b10989c5c5aae3d455458c9fc4e8cc694f7 upstream.
The ACPI handle passed to acpi_extract_properties() as the first argument represents the ACPI namespace scope in which to look for objects returning buffers associated with buffer properties.
For _DSD objects located immediately under ACPI devices, this handle is the same as the handle of the device object holding the _DSD, but for data-only subnodes it is not so.
First of all, data-only subnodes are represented by objects that cannot hold other objects in their scopes (like control methods). Therefore a data-only subnode handle cannot be used for completing relative pathname segments, so the current code in
in acpi_nondev_subnode_extract() passing a data-only subnode handle to acpi_extract_properties() is invalid.
Moreover, a data-only subnode of device A may be represented by an object located in the scope of device B (which kind of makes sense, for instance, if A is a B's child). In that case, the scope in question would be the one of device B. In other words, the scope mentioned above is the same as the scope used for subnode object lookup in acpi_nondev_subnode_extract().
Accordingly, rearrange that function to use the same scope for the extraction of properties and subnode object lookup.
--- drivers/acpi/property.c | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-)
drivers/acpi/property.c +11 -19
@@ -74,6 +74,7 @@ static bool acpi_nondev_subnode_extract( struct fwnode_handle *parent) {struct acpi_data_node *dn; +acpi_handle scope =NULL ;bool result; dn =kzalloc (sizeof (*dn),GFP_KERNEL );
@@ -86,27 +87,18 @@ static bool acpi_nondev_subnode_extract(INIT_LIST_HEAD (&dn->data.properties);INIT_LIST_HEAD (&dn->data.subnodes); - result =acpi_extract_properties (handle, desc, &dn->data); +/* +* The scope for the completion of relative pathname segments and +* subnode object lookup is the one of the namespace node (device) +* containing the object that has returned the package. That is, it's +* the scope of that object's parent device. +*/ +if (handle) +acpi_get_parent (handle, &scope); -if (handle) { -acpi_handle scope; -acpi_status status; - -/* -* The scope for the subnode object lookup is the one of the -* namespace node (device) containing the object that has -* returned the package. That is, it's the scope of that -* object's parent. -*/ - status =acpi_get_parent (handle, &scope); -if (ACPI_SUCCESS (status) - &&acpi_enumerate_nondev_subnodes (scope, desc, &dn->data, - &dn->fwnode)) - result = true; - }else if (acpi_enumerate_nondev_subnodes (NULL , desc, &dn->data, - &dn->fwnode)) { + result =acpi_extract_properties (scope, desc, &dn->data); +if (acpi_enumerate_nondev_subnodes (scope, desc, &dn->data, &dn->fwnode)) result = true; - }if (result) { dn->handle = handle;
Greg Kroah-Hartman
maintainerPATCH 52/168 ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Tang <[email protected]>
commit 4aac453deca0d9c61df18d968f8864c3ae7d3d8d upstream.
Previously, after rmmod acpi_tad, modprobe acpi_tad would fail with this dmesg:
sysfs: cannot create duplicate filename '/devices/platform/ACPI000E:00/time'
Call Trace: <TASK> dump_stack_lvl+0x6c/0x90 dump_stack+0x10/0x20 sysfs_warn_dup+0x8b/0xa0 sysfs_add_file_mode_ns+0x122/0x130 internal_create_group+0x1dd/0x4c0 sysfs_create_group+0x13/0x20 acpi_tad_probe+0x147/0x1f0 [acpi_tad] platform_probe+0x42/0xb0 </TASK>
acpi-tad ACPI000E:00: probe with driver acpi-tad failed with error -17
--- drivers/acpi/acpi_tad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_tad.c +3 -0
@@ -563,6 +563,9 @@ static int acpi_tad_remove(struct platfopm_runtime_get_sync (dev); +if (dd->capabilities &ACPI_TAD_RT ) +sysfs_remove_group (&dev->kobj, &acpi_tad_time_attr_group); +if (dd->capabilities &ACPI_TAD_DC_WAKE )sysfs_remove_group (&dev->kobj, &acpi_tad_dc_attr_group);
Greg Kroah-Hartman
maintainerPATCH 53/168 ACPI: debug: fix signedness issues in read/write helpers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Mohammad Jahangirzad <[email protected]>
commit 496f9372eae14775e0524e83e952814691fe850a upstream.
In the ACPI debugger interface, the helper functions for read and write operations use "int" as the length parameter data type. When a large "size_t count" is passed from the file operations, this cast to "int" results in truncation and a negative value due to signed integer representation.
Logically, this negative number propagates to the min() calculation, where it is selected over the positive buffer space value, leading to unexpected behavior. Subsequently, when this negative value is used in copy_to_user() or copy_from_user(), it is interpreted as a large positive value due to the unsigned nature of the size parameter in these functions, causing the copy operations to attempt handling sizes far beyond the intended buffer limits.
Address the issue by:
- Changing the length parameters in acpi_aml_read_user() and acpi_aml_write_user() from "int" to "size_t", aligning with the expected unsigned size semantics.
- Updating return types and local variables in acpi_aml_read() and acpi_aml_write() to "ssize_t" for consistency with kernel file operation conventions.
- Using "size_t" for the "n" variable to ensure calculations remain unsigned.
- Using min_t() for circ_count_to_end() and circ_space_to_end() to ensure type-safe comparisons and prevent integer overflow.
--- drivers/acpi/acpi_dbg.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/acpi/acpi_dbg.c +13 -13
@@ -569,11 +569,11 @@ static int acpi_aml_release(struct inodereturn 0 ; } -static int acpi_aml_read_user (char __user *buf,int len) +static ssize_t acpi_aml_read_user (char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.out_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_read (crc,ACPI_AML_OUT_USER );
@@ -582,7 +582,7 @@ static int acpi_aml_read_user(char __use/* sync head before removing logs */ smp_rmb (); p = &crc->buf[crc->tail]; - n =min (len,circ_count_to_end (crc)); + n =min_t (size_t, len,circ_count_to_end (crc));if (copy_to_user (buf, p, n)) { ret = -EFAULT ; goto out;
@@ -599,8 +599,8 @@ out:static ssize_t acpi_aml_read (struct file *file,char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
@@ -639,11 +639,11 @@ again:return size >0 ? size : ret; } -static int acpi_aml_write_user (const char __user *buf,int len) +static ssize_t acpi_aml_write_user (const char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.in_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_write (crc,ACPI_AML_IN_USER );
@@ -652,7 +652,7 @@ static int acpi_aml_write_user(const cha/* sync tail before inserting cmds */ smp_mb (); p = &crc->buf[crc->head]; - n =min (len,circ_space_to_end (crc)); + n =min_t (size_t, len,circ_space_to_end (crc));if (copy_from_user (p, buf, n)) { ret = -EFAULT ; goto out;
@@ -663,14 +663,14 @@ static int acpi_aml_write_user(const cha ret = n; out:acpi_aml_unlock_fifo (ACPI_AML_IN_USER , ret >=0 ); -return n; +return ret; }static ssize_t acpi_aml_write (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 54/168 arm64: dts: qcom: msm8916: Add missing MDSS reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 99b78773c2ae55dcc01025f94eae8ce9700ae985 upstream.
On most MSM8916 devices (aside from the DragonBoard 410c), the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state.
The reset for MDSS is currently missing in msm8916.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers:
dsi_err_worker: status=6
dsi_err_worker: status=6
dsi_err_worker: status=6
...
It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -0
@@ -981,6 +981,8 @@ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; + resets = <&gcc GCC_MDSS_BCR>; + interrupt-controller; #interrupt-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 55/168 arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 316294bb6695a43a9181973ecd4e6fb3e576a9f7 upstream.
Reading the hardware registers of the &slimbam on RB3 reveals that the BAM supports only 23 pipes (channels) and supports 4 EEs instead of 2. This hasn't caused problems so far since nothing is using the extra channels, but attempting to use them would lead to crashes.
The bam_dma driver might warn in the future if the num-channels in the DT are wrong, so correct the properties in the DT to avoid future regressions.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sdm845.dtsi +2 -2
@@ -5134,11 +5134,11 @@ compatible = "qcom,bam-v1.7.0"; qcom,controlled-remotely; reg = <0 0x17184000 0 0x2a000>; - num-channels = <31>; + num-channels = <23>; interrupts = <GIC_SPI 164 IRQ_TYPE_LEVEL_HIGH>; #dma-cells = <1>; qcom,ee = <1>; - qcom,num-ees = <2>; + qcom,num-ees = <4>; iommus = <&apps_smmu 0x1806 0x0>; };
Greg Kroah-Hartman
maintainerPATCH 56/168 arm64: dts: ti: k3-am62a-main: Fix main padcfg length
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vibhore Vardhan <[email protected]>
commit 4c4e48afb6d85c1a8f9fdbae1fdf17ceef4a6f5b upstream.
The main pad configuration register region starts with the register MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG0 with address 0x000f4000 and ends with the MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG150 register with address 0x000f4258, as a result of which, total size of the region is 0x25c instead of 0x2ac.
Reference Docs
TRM (AM62A) - https://www.ti.com/lit/ug/spruj16b/spruj16b.pdf
TRM (AM62D) - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf
--- arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +1 -1
@@ -97,7 +97,7 @@ main_pmx0: pinctrl@f4000 { compatible = "pinctrl-single"; - reg = <0x00 0xf4000 0x00 0x2ac>; + reg = <0x00 0xf4000 0x00 0x25c>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Greg Kroah-Hartman
maintainerPATCH 57/168 ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 74139a64e8cedb6d971c78d5d17384efeced1725 upstream.
Add missing of_node_put() calls to release device node references obtained via of_parse_phandle().
--- arch/arm/mach-omap2/pm33xx-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/pm33xx-core.c +5 -1
@@ -393,12 +393,15 @@ static int __init amx3_idle_init(structif (!state_node)break ; -if (!of_device_is_available (state_node)) +if (!of_device_is_available (state_node)) { +of_node_put (state_node);continue ; + }if (i ==CPUIDLE_STATE_MAX ) {pr_warn ("%s: cpuidle states reached max possible\n" , __func__); +of_node_put (state_node);break ; }
@@ -408,6 +411,7 @@ static int __init amx3_idle_init(struct states[state_count].wfi_flags |=WFI_FLAG_WAKE_M3 |WFI_FLAG_FLUSH_CACHE ; +of_node_put (state_node); state_count++; }
Greg Kroah-Hartman
maintainerPATCH 58/168 cpuidle: governors: menu: Avoid using invalid recent intervals data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit fa3fa55de0d6177fdcaf6fc254f13cc8f33c3eed upstream.
Marc has reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") caused the number of wakeup interrupts to increase on an idle system [1], which was not expected to happen after merely allowing shallower idle states to be selected by the governor in some cases.
However, on the system in question, all of the idle states deeper than WFI are rejected by the driver due to a firmware issue [2]. This causes the governor to only consider the recent interval duriation data corresponding to attempts to enter WFI that are successful and the recent invervals table is filled with values lower than the scheduler tick period. Consequently, the governor predicts an idle duration below the scheduler tick period length and avoids stopping the tick more often which leads to the observed symptom.
Address it by modifying the governor to update the recent intervals table also when entering the previously selected idle state fails, so it knows that the short idle intervals might have been the minority had the selected idle states been actually entered every time.
--- drivers/cpuidle/governors/menu.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/cpuidle/governors/menu.c +17 -4
@@ -158,6 +158,14 @@ static inline int performance_multiplier static DEFINE_PER_CPU(struct menu_device, menu_devices); +static void menu_update_intervals (struct menu_device *data,unsigned int interval_us) +{ +/* Update the repeating-pattern data. */ + data->intervals[data->interval_ptr++] = interval_us; +if (data->interval_ptr >=INTERVALS ) + data->interval_ptr =0 ; +} +static void menu_update (struct cpuidle_driver *drv,struct cpuidle_device *dev);/*
@@ -288,6 +296,14 @@ static int menu_select(struct cpuidle_drif (data->needs_update) {menu_update (drv, dev); data->needs_update =0 ; + }else if (!dev->last_residency_ns) { +/* +* This happens when the driver rejects the previously selected +* idle state and returns an error, so update the recent +* intervals table to prevent invalid information from being +* used going forward. +*/ +menu_update_intervals (data,UINT_MAX ); }/* determine the expected residency time, round up */
@@ -542,10 +558,7 @@ static void menu_update(struct cpuidle_d data->correction_factor[data->bucket] = new_factor; -/* update the repeating-pattern data */ - data->intervals[data->interval_ptr++] =ktime_to_us (measured_ns); -if (data->interval_ptr >=INTERVALS ) - data->interval_ptr =0 ; +menu_update_intervals (data,ktime_to_us (measured_ns)); }/**
Greg Kroah-Hartman
maintainerPATCH 59/168 dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Riesch <[email protected]>
commit c254815b02673cc77a84103c4c0d6197bd90c0ef upstream.
There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568 variant) that are powered on by default as they are part of the ALIVE power domain.
Remove 'power-domains' from the required properties in order to avoid false positives.
--- Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml +14 -1
@@ -57,11 +57,24 @@ required: - clocks - clock-names - '#phy-cells' - - power-domains - resets - reset-names - rockchip,grf +allOf: + - if: + properties: + compatible: + contains: + enum: + - rockchip,px30-csi-dphy + - rockchip,rk1808-csi-dphy + - rockchip,rk3326-csi-dphy + - rockchip,rk3368-csi-dphy + then: + required: + - power-domains + additionalProperties: false examples:
Greg Kroah-Hartman
maintainerPATCH 60/168 xen/events: Cleanup find_virq() return codes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream.
rc is overwritten by the evtchn_status hypercall in each iteration, so the return value will be whatever the last iteration is. This could incorrectly return success even if the event channel was not found. Change to an explicit -ENOENT for an un-found virq and return 0 on a successful match.
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/xen/events/events_base.c +4 -3
@@ -1332,10 +1332,11 @@ static int find_virq(unsigned int virq, {struct evtchn_status status;evtchn_port_t port; -int rc = -ENOENT ;memset (&status,0 ,sizeof (status));for (port =0 ; port <xen_evtchn_max_channels (); port++) { +int rc; + status.dom =DOMID_SELF ; status.port = port; rc =HYPERVISOR_event_channel_op (EVTCHNOP_status, &status);
@@ -1345,10 +1346,10 @@ static int find_virq(unsigned int virq,continue ;if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) { *evtchn = port; -break ; +return 0 ; } } -return rc; +return -ENOENT ; }/**
Greg Kroah-Hartman
maintainerPATCH 61/168 xen/manage: Fix suspend error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit f770c3d858687252f1270265ba152d5c622e793f upstream.
The device power management API has the following asymmetry:
* dpm_suspend_start() does not clean up on failure (it requires a call to dpm_resume_end())
* dpm_suspend_end() does clean up on failure
(it does not require a call to dpm_resume_start())
The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related patches for 2.6.27") in June 2008: It removed a call to device_resume() from device_suspend() (which was later renamed to dpm_suspend_start()).
When Xen began using the device power management API in May 2008 with commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did not yet exist. But since it was introduced, a call to dpm_resume_end() is missing in the error path of dpm_suspend_start(). Fix it.
Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de>
--- drivers/xen/manage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/manage.c +2 -1
@@ -116,7 +116,7 @@ static void do_suspend(void) err =dpm_suspend_start (PMSG_FREEZE );if (err) {pr_err ("%s: dpm_suspend_start %d\n" , __func__, err); - goto out_thaw; + goto out_resume_end; }printk (KERN_DEBUG "suspending xenstore...\n" );
@@ -156,6 +156,7 @@ out_resume:else xs_suspend_cancel (); +out_resume_end:dpm_resume_end (si.cancelled ?PMSG_THAW :PMSG_RESTORE ); out_thaw:
Greg Kroah-Hartman
maintainerPATCH 62/168 firmware: meson_sm: fix device leak at probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream.
Make sure to drop the reference to the secure monitor device taken by of_find_device_by_node() when looking up its driver data on behalf of other drivers (e.g. during probe).
Note that holding a reference to the platform device does not prevent its driver data from going away so there is no point in keeping the reference after the helper returns.
--- drivers/firmware/meson/meson_sm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/firmware/meson/meson_sm.c +6 -1
@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write);struct meson_sm_firmware *meson_sm_get (struct device_node *sm_node) {struct platform_device *pdev =of_find_device_by_node (sm_node); +struct meson_sm_firmware *fw;if (!pdev)return NULL ; -return platform_get_drvdata (pdev); + fw =platform_get_drvdata (pdev); + +put_device (&pdev->dev); + +return fw; }EXPORT_SYMBOL_GPL (meson_sm_get);
Greg Kroah-Hartman
maintainerPATCH 63/168 media: cx18: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 23b53639a793477326fd57ed103823a8ab63084f upstream.
The DMA map functions can fail and should be tested for errors. If the mapping fails, dealloc buffers, and return.
--- drivers/media/pci/cx18/cx18-queue.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/media/pci/cx18/cx18-queue.c +10 -3
@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_streambreak ; } + buf->dma_handle =dma_map_single (&s->cx->pci_dev->dev, + buf->buf, s->buf_size, + s->dma); +if (dma_mapping_error (&s->cx->pci_dev->dev, buf->dma_handle)) { +kfree (buf->buf); +kfree (mdl); +kfree (buf); +break ; + } +INIT_LIST_HEAD (&mdl->list);INIT_LIST_HEAD (&mdl->buf_list); mdl->id = s->mdl_base_idx;/* a somewhat safe value */ cx18_enqueue (s, mdl, &s->q_idle);INIT_LIST_HEAD (&buf->list); - buf->dma_handle =dma_map_single (&s->cx->pci_dev->dev, - buf->buf, s->buf_size, - s->dma);cx18_buf_sync_for_cpu (s, buf);list_add_tail (&buf->list, &s->buf_pool); }
Greg Kroah-Hartman
maintainerPATCH 64/168 media: i2c: mt9v111: fix incorrect type for ret
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream.
Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() to store negative error codes or zero returned by __mt9v111_hw_reset() and other functions.
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants.
No effect on runtime.
--- drivers/media/i2c/mt9v111.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/mt9v111.c +1 -1
@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(strucstatic int mt9v111_hw_config (struct mt9v111_dev *mt9v111) {struct i2c_client *c = mt9v111->client; -unsigned int ret;u16 outfmtctrl2; +int ret;/* Force device reset. */ ret =__mt9v111_hw_reset (mt9v111);
Greg Kroah-Hartman
maintainerPATCH 65/168 media: mc: Fix MUST_CONNECT handling for pads with no links
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
commit eec81250219a209b863f11d02128ec1dd8e20877 upstream.
Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link") expanded the meaning of the MUST_CONNECT flag to require an enabled link in all cases. To do so, the link exploration code was expanded to cover unconnected pads, in order to reject those that have the MUST_CONNECT flag set. The implementation was however incorrect, ignoring unconnected pads instead of ignoring connected pads. Fix it.
--- drivers/media/mc/mc-entity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/mc/mc-entity.c +1 -1
@@ -665,7 +665,7 @@ done:* (already discovered through iterating over links) and pads * not internally connected. */ -if (origin == local || !local->num_links || +if (origin == local || local->num_links || !media_entity_has_pad_interdep (origin->entity, origin->index, local->index))continue ;
Greg Kroah-Hartman
maintainerPATCH 66/168 media: pci: ivtv: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 upstream.
The DMA map functions can fail and should be tested for errors. If the mapping fails, free blanking_ptr and set it to 0. As 0 is a valid DMA address, use blanking_ptr to test if the DMA address is set.
--- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-yuv.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/media/pci/ivtv/ivtv-irq.c +1 -1
@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct/* Insert buffer block for YUV if needed */ if (s->type ==IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) { -if (yi->blanking_dmaptr) { +if (yi->blanking_ptr) { s->sg_pending[idx].src = yi->blanking_dmaptr; s->sg_pending[idx].dst = offset; s->sg_pending[idx].size =720 *16 ;
drivers/media/pci/ivtv/ivtv-yuv.c +7 -1
@@ -126,7 +126,7 @@ static int ivtv_yuv_prep_user_dma(structivtv_udma_fill_sg_array (dma, y_buffer_offset, uv_buffer_offset, y_size);/* If we've offset the y plane, ensure top area is blanked */ -if (f->offset_y && yi->blanking_dmaptr) { +if (f->offset_y && yi->blanking_ptr) { dma->SGarray[dma->SG_length].size =cpu_to_le32 (720 *16 ); dma->SGarray[dma->SG_length].src =cpu_to_le32 (yi->blanking_dmaptr); dma->SGarray[dma->SG_length].dst =cpu_to_le32 (IVTV_DECODER_OFFSET + yuv_offset[frame]);
@@ -930,6 +930,12 @@ static void ivtv_yuv_init(struct ivtv *i yi->blanking_dmaptr =dma_map_single (&itv->pdev->dev, yi->blanking_ptr,720 *16 ,DMA_TO_DEVICE ); +if (dma_mapping_error (&itv->pdev->dev, yi->blanking_dmaptr)) { +kfree (yi->blanking_ptr); + yi->blanking_ptr =NULL ; + yi->blanking_dmaptr =0 ; +IVTV_DEBUG_WARN ("Failed to dma_map yuv blanking buffer\n" ); + } }else { yi->blanking_dmaptr =0 ;IVTV_DEBUG_WARN ("Failed to allocate yuv blanking buffer\n" );
Greg Kroah-Hartman
maintainerPATCH 67/168 media: lirc: Fix error handling in lirc_register()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream.
When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count.
Found by code review.
--- drivers/media/rc/lirc_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/rc/lirc_dev.c +5 -4
@@ -735,11 +735,11 @@ int lirc_register(struct rc_dev *dev)cdev_init (&dev->lirc_cdev, &lirc_fops); +get_device (&dev->dev); + err =cdev_device_add (&dev->lirc_cdev, &dev->lirc_dev);if (err) - goto out_ida; - -get_device (&dev->dev); + goto out_put_device;switch (dev->driver_type) {case RC_DRIVER_SCANCODE :
@@ -763,7 +763,8 @@ int lirc_register(struct rc_dev *dev)return 0 ; -out_ida: +out_put_device: +put_device (&dev->lirc_dev);ida_free (&lirc_ida, minor);return err; }
Greg Kroah-Hartman
maintainerPATCH 68/168 drm/nouveau: fix bad ret code in nouveau_bo_move_prep
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 upstream.
In nouveau_bo_move_prep, if nouveau_mem_map fails, an error code should be returned. Currently, it returns zero even if vmm addr is not correctly mapped.
--- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -1
@@ -791,7 +791,7 @@ done:nvif_vmm_put (vmm, &old_mem->vma[1 ]);nvif_vmm_put (vmm, &old_mem->vma[0 ]); } -return 0 ; +return ret; } static int
Greg Kroah-Hartman
maintainerPATCH 69/168 blk-crypto: fix missing blktrace bio split events
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
commit 06d712d297649f48ebf1381d19bd24e942813b37 upstream.
trace_block_split() is missing, resulting in blktrace inability to catch BIO split events and making it harder to analyze the BIO sequence.
--- block/blk-crypto-fallback.c | 3 +++ 1 file changed, 3 insertions(+)
block/blk-crypto-fallback.c +3 -0
@@ -18,6 +18,7 @@#include <linux/module.h> #include <linux/random.h> #include <linux/scatterlist.h> +#include <trace/events/block.h> #include "blk-cgroup.h" #include "blk-crypto-internal.h"
@@ -229,7 +230,9 @@ static bool blk_crypto_fallback_split_bi bio->bi_status =BLK_STS_RESOURCE ;return false; } +bio_chain (split_bio, bio); +trace_block_split (split_bio, bio->bi_iter.bi_sector);submit_bio_noacct (bio); *bio_ptr = split_bio; }
Greg Kroah-Hartman
maintainerPATCH 70/168 btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Nascimento <[email protected]>
commit dff4f9ff5d7f289e4545cc936362e01ed3252742 upstream.
The function btrfs_encode_fh() does not properly account for the three cases it handles.
Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes).
However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes).
If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned.
This results in an 8-byte out-of-bounds write atfid->parent_root_objectid = parent_root_id.
A previous attempt to fix this issue was made but was lost.
https://lore.kernel.org/all/[email protected]/
Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data.
--- fs/btrfs/export.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/btrfs/export.c +7 -1
@@ -22,7 +22,11 @@ static int btrfs_encode_fh(struct inodeint type;if (parent && (len <BTRFS_FID_SIZE_CONNECTABLE )) { - *max_len =BTRFS_FID_SIZE_CONNECTABLE ; +if (btrfs_root_id (BTRFS_I (inode)->root) != +btrfs_root_id (BTRFS_I (parent)->root)) + *max_len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; +else + *max_len =BTRFS_FID_SIZE_CONNECTABLE ;return FILEID_INVALID ; }else if (len <BTRFS_FID_SIZE_NON_CONNECTABLE ) { *max_len =BTRFS_FID_SIZE_NON_CONNECTABLE ;
@@ -44,6 +48,8 @@ static int btrfs_encode_fh(struct inode parent_root_id =BTRFS_I (parent)->root->root_key.objectid;if (parent_root_id != fid->root_objectid) { +if (*max_len <BTRFS_FID_SIZE_CONNECTABLE_ROOT ) +return FILEID_INVALID ; fid->parent_root_objectid = parent_root_id; len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; type =FILEID_BTRFS_WITH_PARENT_ROOT ;
Greg Kroah-Hartman
maintainerPATCH 71/168 bus: mhi: host: Do not use uninitialized dev pointer in mhi_init_irq_setup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Xue <[email protected]>
commit d0856a6dff57f95cc5d2d74e50880f01697d0cc4 upstream.
In mhi_init_irq_setup, the device pointer used for dev_err() was not initialized. Use the pointer from mhi_cntrl instead.
--- drivers/bus/mhi/host/init.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/bus/mhi/host/init.c +2 -3
@@ -164,7 +164,6 @@ void mhi_deinit_free_irq(struct mhi_contint mhi_init_irq_setup (struct mhi_controller *mhi_cntrl) {struct mhi_event *mhi_event = mhi_cntrl->mhi_event; -struct device *dev = &mhi_cntrl->mhi_dev->dev;unsigned long irq_flags =IRQF_SHARED |IRQF_NO_SUSPEND ;int i, ret;
@@ -191,7 +190,7 @@ int mhi_init_irq_setup(struct mhi_controcontinue ;if (mhi_event->irq >= mhi_cntrl->nr_irqs) { -dev_err (dev,"irq %d not available for event ring\n" , +dev_err (mhi_cntrl->cntrl_dev,"irq %d not available for event ring\n" , mhi_event->irq); ret = -EINVAL ; goto error_request;
@@ -202,7 +201,7 @@ int mhi_init_irq_setup(struct mhi_contro irq_flags, "mhi", mhi_event);if (ret) { -dev_err (dev,"Error requesting irq:%d for ev:%d\n" , +dev_err (mhi_cntrl->cntrl_dev,"Error requesting irq:%d for ev:%d\n" , mhi_cntrl->irq[mhi_event->irq], i); goto error_request; }
Greg Kroah-Hartman
maintainerPATCH 72/168 copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <[email protected]>
commit 04ff48239f46e8b493571e260bd0e6c3a6400371 upstream.
With the introduction of clone3 in commit 7f192e3cd316 ("fork: add clone3") the effective bit width of clone_flags on all architectures was increased from 32-bit to 64-bit. However, the signature of the copy_* helper functions (e.g., copy_sighand) used by copy_process was not adapted.
As such, they truncate the flags on any 32-bit architectures that supports clone3 (arc, arm, csky, m68k, microblaze, mips32, openrisc, parisc32, powerpc32, riscv32, x86-32 and xtensa).
For copy_sighand with CLONE_CLEAR_SIGHAND being an actual u64 constant, this triggers an observable bug in kernel selftest clone3_clear_sighand:
if (clone_flags & CLONE_CLEAR_SIGHAND)
in function copy_sighand within fork.c will always fail given:
unsigned long /* == uint32_t */ clone_flags
#define CLONE_CLEAR_SIGHAND 0x100000000ULLThis commit fixes the bug by always passing clone_flags to copy_sighand via their declared u64 type, invariant of architecture-dependent integer sizes.
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -1641,7 +1641,7 @@ static int copy_files(unsigned long clonreturn 0 ; } -static int copy_sighand (unsigned long clone_flags,struct task_struct *tsk) +static int copy_sighand (u64 clone_flags,struct task_struct *tsk) {struct sighand_struct *sig;
Greg Kroah-Hartman
maintainerPATCH 73/168 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream.
The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
--- drivers/cpufreq/intel_pstate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/intel_pstate.c +5 -3
@@ -1308,10 +1308,10 @@ static void update_qos_request(enum freqcontinue ; req = policy->driver_data; -cpufreq_cpu_put (policy); - -if (!req) +if (!req) { +cpufreq_cpu_put (policy);continue ; + }if (hwp_active)intel_pstate_get_hwp_cap (cpu);
@@ -1327,6 +1327,8 @@ static void update_qos_request(enum freqif (freq_qos_update_request (req, freq) <0 )pr_warn ("Failed to update freq constraint: CPU%d\n" , i); + +cpufreq_cpu_put (policy); } }
Greg Kroah-Hartman
maintainerPATCH 74/168 crypto: aspeed - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 838d2d51513e6d2504a678e906823cfd2ecaaa22 upstream.
It seems like everywhere in this file, when the request is not bidirectionala, req->src is mapped with DMA_TO_DEVICE and req->dst is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/aspeed/aspeed-hace-crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/aspeed/aspeed-hace-crypto.c +1 -1
@@ -335,7 +335,7 @@ free_req: }else {dma_unmap_sg (hace_dev->dev, req->dst, rctx->dst_nents, -DMA_TO_DEVICE ); +DMA_FROM_DEVICE );dma_unmap_sg (hace_dev->dev, req->src, rctx->src_nents,DMA_TO_DEVICE ); }
Greg Kroah-Hartman
maintainerPATCH 75/168 crypto: atmel - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit f5d643156ef62216955c119216d2f3815bd51cb1 upstream.
It seems like everywhere in this file, dd->in_sg is mapped with DMA_TO_DEVICE and dd->out_sg is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/atmel-tdes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/atmel-tdes.c +1 -1
@@ -548,7 +548,7 @@ static int atmel_tdes_crypt_start(structif (err && (dd->flags &TDES_FLAGS_FAST )) {dma_unmap_sg (dd->dev, dd->in_sg,1 ,DMA_TO_DEVICE ); -dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_TO_DEVICE ); +dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_FROM_DEVICE ); }return err;
Greg Kroah-Hartman
maintainerPATCH 76/168 fs/ntfs3: Fix a resource leak bug in wnd_extend()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d68318471aa2e16222ebf492883e05a2d72b9b17 upstream.
Add put_bh() to decrease the refcount of 'bh' after the job is finished, preventing a resource leak.
--- fs/ntfs3/bitmap.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/bitmap.c +1 -0
@@ -1374,6 +1374,7 @@ int wnd_extend(struct wnd_bitmap *wnd, smark_buffer_dirty (bh);unlock_buffer (bh);/* err = sync_dirty_buffer(bh); */ +put_bh (bh); b0 =0 ; bits -= op;
Greg Kroah-Hartman
maintainerPATCH 77/168 iio: dac: ad5360: use int type to store negative error codes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit f9381ece76de999a2065d5b4fdd87fa17883978c upstream.
Change the 'ret' variable in ad5360_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5360_write_unlocked().
--- drivers/iio/dac/ad5360.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5360.c +1 -1
@@ -262,7 +262,7 @@ static int ad5360_update_ctrl(struct iio unsigned int clr) {struct ad5360_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 78/168 iio: dac: ad5421: use int type to store negative error codes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit 3379c900320954d768ed9903691fb2520926bbe3 upstream.
Change the 'ret' variable in ad5421_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5421_write_unlocked().
--- drivers/iio/dac/ad5421.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5421.c +1 -1
@@ -186,7 +186,7 @@ static int ad5421_update_ctrl(struct iio unsigned int clr) {struct ad5421_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 79/168 iio: frequency: adf4350: Fix prescaler usage.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d upstream.
The ADF4350/1 features a programmable dual-modulus prescaler of 4/5 or 8/9. When set to 4/5, the maximum RF frequency allowed is 3 GHz. Therefore, when operating the ADF4351 above 3 GHz, this must be set to 8/9. In this context not the RF output frequency is meant
- it's the VCO frequency.
Therefore move the prescaler selection after we derived the VCO frequency from the desired RF output frequency.
This BUG may have caused PLL lock instabilities when operating the VCO at the very high range close to 4.4 GHz.
--- drivers/iio/frequency/adf4350.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/iio/frequency/adf4350.c +13 -7
@@ -143,6 +143,19 @@ static int adf4350_set_freq(struct adf43if (freq >ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq)return -EINVAL ; + st->r4_rf_div_sel =0 ; + +/* +* !\TODO: The below computation is making sure we get a power of 2 +* shift (st->r4_rf_div_sel) so that freq becomes higher or equal to +* ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() +* and friends. +*/ +while (freq <ADF4350_MIN_VCO_FREQ ) { + freq <<=1 ; + st->r4_rf_div_sel++; + } +if (freq >ADF4350_MAX_FREQ_45_PRESC ) { prescaler =ADF4350_REG1_PRESCALER ; mdiv =75 ;
@@ -151,13 +164,6 @@ static int adf4350_set_freq(struct adf43 mdiv =23 ; } - st->r4_rf_div_sel =0 ; - -while (freq <ADF4350_MIN_VCO_FREQ ) { - freq <<=1 ; - st->r4_rf_div_sel++; - } -/* * Allow a predefined reference division factor * if not set, compute our own
Greg Kroah-Hartman
maintainerPATCH 80/168 iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
commit 1315cc2dbd5034f566e20ddce4d675cb9e6d4ddd upstream.
AMS_ALARM_THR_DIRECT_MASK should be bit 0, not bit 1. This would cause hysteresis to be enabled with a lower threshold of -28C. The temperature alarm would never deassert even if the temperature dropped below the upper threshold.
--- drivers/iio/adc/xilinx-ams.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/xilinx-ams.c +1 -1
@@ -118,7 +118,7 @@#define AMS_ALARM_THRESHOLD_OFF_10 0x10#define AMS_ALARM_THRESHOLD_OFF_20 0x20 -#define AMS_ALARM_THR_DIRECT_MASK BIT(1) +#define AMS_ALARM_THR_DIRECT_MASK BIT(0)#define AMS_ALARM_THR_MIN 0x0000#define AMS_ALARM_THR_MAX (BIT(16) - 1)
Greg Kroah-Hartman
maintainerPATCH 81/168 iio: xilinx-ams: Unmask interrupts after updating alarms
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
commit feb500c7ae7a198db4d2757901bce562feeefa5e upstream.
To convert level-triggered alarms into edge-triggered IIO events, alarms are masked when they are triggered. To ensure we catch subsequent alarms, we then periodically poll to see if the alarm is still active. If it isn't, we unmask it. Active but masked alarms are stored in current_masked_alarm.
If an active alarm is disabled, it will remain set in current_masked_alarm until ams_unmask_worker clears it. If the alarm is re-enabled before ams_unmask_worker runs, then it will never be cleared from current_masked_alarm. This will prevent the alarm event from being pushed even if the alarm is still active.
Fix this by recalculating current_masked_alarm immediately when enabling or disabling alarms.
--- drivers/iio/adc/xilinx-ams.c | 45 +++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 20 deletions(-)
drivers/iio/adc/xilinx-ams.c +25 -20
@@ -385,6 +385,29 @@ static void ams_update_pl_alarm(struct aams_pl_update_reg (ams,AMS_REG_CONFIG3 ,AMS_REGCFG3_ALARM_MASK , cfg); } +static void ams_unmask (struct ams *ams) +{ +unsigned int status, unmask; + + status =readl (ams->base +AMS_ISR_0 ); + +/* Clear those bits which are not active anymore */ + unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; + +/* Clear status of disabled alarm */ + unmask |= ams->intr_mask; + + ams->current_masked_alarm &= status; + +/* Also clear those which are masked out anyway */ + ams->current_masked_alarm &= ~ams->intr_mask; + +/* Clear the interrupts before we unmask them */ +writel (unmask, ams->base +AMS_ISR_0 ); + +ams_update_intrmask (ams, ~AMS_ALARM_MASK , ~AMS_ALARM_MASK ); +} +static void ams_update_alarm (struct ams *ams,unsigned long alarm_mask) {unsigned long flags;
@@ -397,6 +420,7 @@ static void ams_update_alarm(struct amsspin_lock_irqsave (&ams->intr_lock, flags);ams_update_intrmask (ams,AMS_ISR0_ALARM_MASK , ~alarm_mask); +ams_unmask (ams);spin_unlock_irqrestore (&ams->intr_lock, flags); }
@@ -1025,28 +1049,9 @@ static void ams_handle_events(struct iiostatic void ams_unmask_worker (struct work_struct *work) { struct ams *ams = container_of(work, struct ams, ams_unmask_work.work); -unsigned int status, unmask;spin_lock_irq (&ams->intr_lock); - - status =readl (ams->base +AMS_ISR_0 ); - -/* Clear those bits which are not active anymore */ - unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; - -/* Clear status of disabled alarm */ - unmask |= ams->intr_mask; - - ams->current_masked_alarm &= status; - -/* Also clear those which are masked out anyway */ - ams->current_masked_alarm &= ~ams->intr_mask; - -/* Clear the interrupts before we unmask them */ -writel (unmask, ams->base +AMS_ISR_0 ); - -ams_update_intrmask (ams, ~AMS_ALARM_MASK , ~AMS_ALARM_MASK ); - +ams_unmask (ams);spin_unlock_irq (&ams->intr_lock);/* If still pending some alarm re-trigger the timer */
Greg Kroah-Hartman
maintainerPATCH 82/168 init: handle bootloader identifier in kernel parameters
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit e416f0ed3c500c05c55fb62ee62662717b1c7f71 upstream.
BootLoaders (Grub, LILO, etc) may pass an identifier such as "BOOT_IMAGE= /boot/vmlinuz-x.y.z" to kernel parameters. But these identifiers are not recognized by the kernel itself so will be passed to userspace. However user space init program also don't recognize it.
KEXEC/KDUMP (kexec-tools) may also pass an identifier such as "kexec" on some architectures.
We cannot change BootLoader's behavior, because this behavior exists for many years, and there are already user space programs search BOOT_IMAGE= in /proc/cmdline to obtain the kernel image locations:
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/util.go
(search getBootOptions)
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/main.go
(search getKernelReleaseWithBootOption) So the the best way is handle (ignore) it by the kernel itself, which can avoid such boot warnings (if we use something like init=/bin/bash, bootloader identifier can even cause a crash):
Kernel command line: BOOT_IMAGE=(hd0,1)/vmlinuz-6.x root=/dev/sda3 ro console=tty Unknown kernel command line parameters "BOOT_IMAGE=(hd0,1)/vmlinuz-6.x", will be passed to user space.
--- init/main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
init/main.c +12 -0
@@ -533,6 +533,12 @@ static int __init unknown_bootoption(cha const char *unused, void *arg) { size_t len = strlen(param); +/* +* Well-known bootloader identifiers: +* 1. LILO/Grub pass "BOOT_IMAGE=..."; +* 2. kexec/kdump (kexec-tools) pass "kexec". +*/ +const char *bootloader[] = {"BOOT_IMAGE=" ,"kexec" ,NULL };/* Handle params aliased to sysctls */ if (sysctl_is_alias (param))
@@ -540,6 +546,12 @@ static int __init unknown_bootoption(charepair_env_string (param, val); +/* Handle bootloader identifier */ +for (int i =0 ; bootloader[i]; i++) { +if (strstarts (param, bootloader[i])) +return 0 ; + } +/* Handle obsolete-style parameters */ if (obsolete_checksetup (param))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 83/168 iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
commit a95a0b4e471a6d8860f40c6ac8f1cad9dde3189a upstream.
Remove unnecessary calls to pm_runtime_disable(), pm_runtime_set_active(), and pm_runtime_enable() from the resume path. These operations are not required here and can interfere with proper pm_runtime state handling, especially when resuming from a pm_runtime suspended state.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +0 -4
@@ -730,10 +730,6 @@ static int __maybe_unused inv_icm42600_rif (ret) goto out_unlock; -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -/* restore sensors state */ ret = inv_icm42600_set_pwr_mgmt0(st, st->suspended.gyro, st->suspended.accel,
Greg Kroah-Hartman
maintainerPATCH 84/168 iommu/vt-d: PRS isnt usable if PDS isnt supported
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 5ef7e24c742038a5d8c626fdc0e3a21834358341 upstream.
The specification, Section 7.10, "Software Steps to Drain Page Requests & Responses," requires software to submit an Invalidation Wait Descriptor (inv_wait_dsc) with the Page-request Drain (PD=1) flag set, along with the Invalidation Wait Completion Status Write flag (SW=1). It then waits for the Invalidation Wait Descriptor's completion.
However, the PD field in the Invalidation Wait Descriptor is optional, as stated in Section 6.5.2.9, "Invalidation Wait Descriptor":
"Page-request Drain (PD): Remapping hardware implementations reporting
Page-request draining as not supported (PDS = 0 in ECAP_REG) treat this field as reserved."
This implies that if the IOMMU doesn't support the PDS capability, software can't drain page requests and group responses as expected.
Do not enable PCI/PRI if the IOMMU doesn't support PDS.
--- drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/iommu.c +1 -1
@@ -4563,7 +4563,7 @@ static struct iommu_device *intel_iommu_ }if (info->ats_supported &&ecap_prs (iommu->ecap) && -pci_pri_supported (pdev)) +ecap_pds (iommu->ecap) &&pci_pri_supported (pdev)) info->pri_supported =1 ; } }
Greg Kroah-Hartman
maintainerPATCH 85/168 kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit a15f37a40145c986cdf289a4b88390f35efdecc4 upstream.
The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken.
sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct.
Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock().
Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable.
--- kernel/sys.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
kernel/sys.c +20 -2
@@ -1682,6 +1682,7 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, ustruct rlimit old, new;struct task_struct *tsk;unsigned int checkflags =0 ; +bool need_tasklist;int ret;if (old_rlim)
@@ -1708,8 +1709,25 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, uget_task_struct (tsk);rcu_read_unlock (); - ret =do_prlimit (tsk, resource, new_rlim ? &new :NULL , - old_rlim ? &old :NULL ); + need_tasklist = !same_thread_group (tsk, current); +if (need_tasklist) { +/* +* Ensure we can't race with group exit or de_thread(), +* so tsk->group_leader can't be freed or changed until +* read_unlock(tasklist_lock) below. +*/ +read_lock (&tasklist_lock); +if (!pid_alive (tsk)) + ret = -ESRCH ; + } + +if (!ret) { + ret =do_prlimit (tsk, resource, new_rlim ? &new :NULL , + old_rlim ? &old :NULL ); + } + +if (need_tasklist) +read_unlock (&tasklist_lock);if (!ret && old_rlim) {rlim_to_rlim64 (&old, &old64);
Greg Kroah-Hartman
maintainerPATCH 86/168 KEYS: trusted_tpm1: Compare HMAC values in constant time
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit eed0e3d305530066b4fc5370107cff8ef1a0d229 upstream.
To prevent timing attacks, HMAC value comparison needs to be constant time. Replace the memcmp() with the correct function, crypto_memneq().
[For the Fixes commit I used the commit that introduced the memcmp(). It predates the introduction of crypto_memneq(), but it was still a bug at the time even though a helper function didn't exist yet.]
--- security/keys/trusted-keys/trusted_tpm1.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
security/keys/trusted-keys/trusted_tpm1.c +4 -3
@@ -7,6 +7,7 @@*/ #include <crypto/hash_info.h> +#include <crypto/algapi.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/parser.h>
@@ -241,7 +242,7 @@ int TSS_checkhmac1(unsigned char *bufferif (ret <0 ) goto out; -if (memcmp (testhmac, authdata,SHA1_DIGEST_SIZE )) +if (crypto_memneq (testhmac, authdata,SHA1_DIGEST_SIZE )) ret = -EINVAL ; out:kfree_sensitive (sdesc);
@@ -334,7 +335,7 @@ static int TSS_checkhmac2(unsigned char TPM_NONCE_SIZE, ononce, 1, continueflag1, 0, 0);if (ret <0 ) goto out; -if (memcmp (testhmac1, authdata1,SHA1_DIGEST_SIZE )) { +if (crypto_memneq (testhmac1, authdata1,SHA1_DIGEST_SIZE )) { ret = -EINVAL ; goto out; }
@@ -343,7 +344,7 @@ static int TSS_checkhmac2(unsigned char TPM_NONCE_SIZE, ononce, 1, continueflag2, 0, 0);if (ret <0 ) goto out; -if (memcmp (testhmac2, authdata2,SHA1_DIGEST_SIZE )) +if (crypto_memneq (testhmac2, authdata2,SHA1_DIGEST_SIZE )) ret = -EINVAL ; out:kfree_sensitive (sdesc);
Greg Kroah-Hartman
maintainerPATCH 87/168 lib/genalloc: fix device leak in of_gen_pool_get()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1260cbcffa608219fc9188a6cbe9c45a300ef8b5 upstream.
Make sure to drop the reference taken when looking up the genpool platform device in of_gen_pool_get() before returning the pool.
Note that holding a reference to a device does typically not prevent its devres managed resources from being released so there is no point in keeping the reference.
--- lib/genalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
lib/genalloc.c +4 -1
@@ -899,8 +899,11 @@ struct gen_pool *of_gen_pool_get(structif (!name) name = np_pool->name; } -if (pdev) +if (pdev) { pool =gen_pool_get (&pdev->dev, name); +put_device (&pdev->dev); + } +of_node_put (np_pool);return pool;
Greg Kroah-Hartman
maintainerPATCH 88/168 openat2: dont trigger automounts with RESOLVE_NO_XDEV
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Askar Safin <[email protected]>
commit 042a60680de43175eb4df0977ff04a4eba9da082 upstream.
openat2 had a bug: if we pass RESOLVE_NO_XDEV, then openat2 doesn't traverse through automounts, but may still trigger them. (See the link for full bug report with reproducer.)
This commit fixes this bug.
--- fs/namei.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/namei.c +8 -0
@@ -1360,6 +1360,10 @@ static int follow_automount(struct path dentry->d_inode)return -EISDIR ; +/* No need to trigger automounts if mountpoint crossing is disabled. */ +if (lookup_flags &LOOKUP_NO_XDEV ) +return -EXDEV ; +if (count && (*count)++ >=MAXSYMLINKS )return -ELOOP ;
@@ -1383,6 +1387,10 @@ static int __traverse_mounts(struct path/* Allow the filesystem to manage the transit without i_mutex * being held. */ if (flags &DCACHE_MANAGE_TRANSIT ) { +if (lookup_flags &LOOKUP_NO_XDEV ) { + ret = -EXDEV ; +break ; + } ret = path->dentry->d_op->d_manage (path, false); flags =smp_load_acquire (&path->dentry->d_flags);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 89/168 parisc: dont reference obsolete termio struct for TC* constants
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam James <[email protected]>
commit 8ec5a066f88f89bd52094ba18792b34c49dcd55a upstream.
Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead.
This fixes building Python for example, which falls over like:
./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
--- arch/parisc/include/uapi/asm/ioctls.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/parisc/include/uapi/asm/ioctls.h +4 -4
@@ -10,10 +10,10 @@#define TCSETS _IOW('T', 17, struct termios)/* TCSETATTR */ #define TCSETSW _IOW('T', 18, struct termios)/* TCSETATTRD */ #define TCSETSF _IOW('T', 19, struct termios)/* TCSETATTRF */ -#define TCGETA _IOR('T', 1, struct termio) -#define TCSETA _IOW('T', 2, struct termio) -#define TCSETAW _IOW('T', 3, struct termio) -#define TCSETAF _IOW('T', 4, struct termio) +#define TCGETA 0x40125401 +#define TCSETA 0x80125402 +#define TCSETAW 0x80125403 +#define TCSETAF 0x80125404#define TCSBRK _IO('T', 5)#define TCXONC _IO('T', 6)#define TCFLSH _IO('T', 7)
Greg Kroah-Hartman
maintainerPATCH 90/168 parisc: Remove spurious if statement from raw_copy_from_user()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 16794e524d310780163fdd49d0bf7fac30f8dbc8 upstream.
Accidently introduced in commit 91428ca9320e.
--- arch/parisc/lib/memcpy.c | 1 - 1 file changed, 1 deletion(-)
arch/parisc/lib/memcpy.c +0 -1
@@ -41,7 +41,6 @@ unsigned long raw_copy_from_user(void *dmtsp (get_kernel_space (),SR_TEMP2 );/* Check region is user accessible */ -if (start)while (start < end) {if (!prober_user (SR_TEMP1 , start)) { newlen = (start - (unsigned long ) src);
Greg Kroah-Hartman
maintainerPATCH 91/168 nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Gottleuber <[email protected]>
commit eeaed48980a7aeb0d3d8b438185d4b5a66154ff9 upstream.
On the TUXEDO InfinityBook S Gen8, a Samsung 990 Evo NVMe leads to a high power consumption in s2idle sleep (3.5 watts).
This patch applies 'Force No Simple Suspend' quirk to achieve a sleep with a lower power consumption, typically around 1 watts.
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -3109,10 +3109,12 @@ static unsigned long check_vendor_combin* Exclude Samsung 990 Evo from NVME_QUIRK_SIMPLE_SUSPEND * because of high power consumption (> 2 Watt) in s2idle * sleep. Only some boards with Intel CPU are affected. +* (Note for testing: Samsung 990 Evo Plus has same PCI ID) */ if (dmi_match (DMI_BOARD_NAME ,"DN50Z-140HC-YD" ) ||dmi_match (DMI_BOARD_NAME ,"GMxPXxx" ) ||dmi_match (DMI_BOARD_NAME ,"GXxMRXx" ) || +dmi_match (DMI_BOARD_NAME ,"NS5X_NS7XAU" ) ||dmi_match (DMI_BOARD_NAME ,"PH4PG31" ) ||dmi_match (DMI_BOARD_NAME ,"PH4PRX1_PH6PRX1" ) ||dmi_match (DMI_BOARD_NAME ,"PH6PG01_PH6PG71" ))
Greg Kroah-Hartman
maintainerPATCH 92/168 power: supply: max77976_charger: fix constant current reporting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <[email protected]>
commit ee6cd8f3e28ee5a929c3b67c01a350f550f9b73a upstream.
CHARGE_CONTROL_LIMIT is a wrong property to report charge current limit, because CHARGE_* attributes represents capacity, not current. The correct attribute to report and set charge current limit is CONSTANT_CHARGE_CURRENT.
Rename CHARGE_CONTROL_LIMIT to CONSTANT_CHARGE_CURRENT.
--- drivers/power/supply/max77976_charger.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/power/supply/max77976_charger.c +6 -6
@@ -292,10 +292,10 @@ static int max77976_get_property(structcase POWER_SUPPLY_PROP_ONLINE : err =max77976_get_online (chg, &val->intval);break ; -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX : val->intval =MAX77976_CHG_CC_MAX ;break ; -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT : err = max77976_get_integer(chg, CHG_CC, MAX77976_CHG_CC_MIN, MAX77976_CHG_CC_MAX,
@@ -330,7 +330,7 @@ static int max77976_set_property(structint err =0 ;switch (psp) { -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT : err = max77976_set_integer(chg, CHG_CC, MAX77976_CHG_CC_MIN, MAX77976_CHG_CC_MAX,
@@ -355,7 +355,7 @@ static int max77976_property_is_writeabl enum power_supply_property psp) {switch (psp) { -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT :case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT :return true;default :
@@ -368,8 +368,8 @@ static enum power_supply_property max779POWER_SUPPLY_PROP_CHARGE_TYPE ,POWER_SUPPLY_PROP_HEALTH ,POWER_SUPPLY_PROP_ONLINE , -POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT , -POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX , +POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT , +POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ,POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT ,POWER_SUPPLY_PROP_MODEL_NAME , POWER_SUPPLY_PROP_MANUFACTURER,
Greg Kroah-Hartman
maintainerPATCH 93/168 powerpc/powernv/pci: Fix underflow and leak issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit a39087905af9ffecaa237a918a2c03a04e479934 upstream.
pnv_irq_domain_alloc() allocates interrupts at parent's interrupt domain. If it fails in the progress, all allocated interrupts are freed.
The number of successfully allocated interrupts so far is stored "i". However, "i - 1" interrupts are freed. This is broken:
- One interrupt is not be freed
- If "i" is zero, "i - 1" wraps around
Correct the number of freed interrupts to "i".
--- arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/powernv/pci-ioda.c +1 -1
@@ -2234,7 +2234,7 @@ static int pnv_irq_domain_alloc(struct ireturn 0 ; out: -irq_domain_free_irqs_parent (domain, virq, i -1 ); +irq_domain_free_irqs_parent (domain, virq, i);msi_bitmap_free_hwirqs (&phb->msi_bmp, hwirq, nr_irqs);return ret; }
Greg Kroah-Hartman
maintainerPATCH 94/168 powerpc/pseries/msi: Fix potential underflow and leak issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 3443ff3be6e59b80d74036bb39f5b6409eb23cc9 upstream.
pseries_irq_domain_alloc() allocates interrupts at parent's interrupt domain. If it fails in the progress, all allocated interrupts are freed.
The number of successfully allocated interrupts so far is stored "i". However, "i - 1" interrupts are freed. This is broken:
- One interrupt is not be freed
- If "i" is zero, "i - 1" wraps around
Correct the number of freed interrupts to 'i'.
--- arch/powerpc/platforms/pseries/msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/msi.c +1 -1
@@ -590,7 +590,7 @@ static int pseries_irq_domain_alloc(stru out:/* TODO: handle RTAS cleanup in ->msi_finish() ? */ -irq_domain_free_irqs_parent (domain, virq, i -1 ); +irq_domain_free_irqs_parent (domain, virq, i);return ret; }
Greg Kroah-Hartman
maintainerPATCH 95/168 pwm: berlin: Fix wrong register in suspend/resume
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
commit 3a4b9d027e4061766f618292df91760ea64a1fcc upstream.
The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu exception then kernel panic during suspend/resume.
--- drivers/pwm/pwm-berlin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-berlin.c +2 -2
@@ -274,7 +274,7 @@ static int berlin_pwm_suspend(struct devif (!channel)continue ; - channel->enable =berlin_pwm_readl (bpc, i,BERLIN_PWM_ENABLE ); + channel->enable =berlin_pwm_readl (bpc, i,BERLIN_PWM_EN ); channel->ctrl =berlin_pwm_readl (bpc, i,BERLIN_PWM_CONTROL ); channel->duty =berlin_pwm_readl (bpc, i,BERLIN_PWM_DUTY ); channel->tcnt =berlin_pwm_readl (bpc, i,BERLIN_PWM_TCNT );
@@ -305,7 +305,7 @@ static int berlin_pwm_resume(struct deviberlin_pwm_writel (bpc, i, channel->ctrl,BERLIN_PWM_CONTROL );berlin_pwm_writel (bpc, i, channel->duty,BERLIN_PWM_DUTY );berlin_pwm_writel (bpc, i, channel->tcnt,BERLIN_PWM_TCNT ); -berlin_pwm_writel (bpc, i, channel->enable,BERLIN_PWM_ENABLE ); +berlin_pwm_writel (bpc, i, channel->enable,BERLIN_PWM_EN ); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 96/168 sched/deadline: Fix race in push_dl_task()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Agarwal <[email protected]>
commit 8fd5485fb4f3d9da3977fd783fcb8e5452463420 upstream.
When a CPU chooses to call push_dl_task and picks a task to push to another CPU's runqueue then it will call find_lock_later_rq method which would take a double lock on both CPUs' runqueues. If one of the locks aren't readily available, it may lead to dropping the current runqueue lock and reacquiring both the locks at once. During this window it is possible that the task is already migrated and is running on some other CPU. These cases are already handled. However, if the task is migrated and has already been executed and another CPU is now trying to wake it up (ttwu) such that it is queued again on the runqeue (on_rq is 1) and also if the task was run by the same CPU, then the current checks will pass even though the task was migrated out and is no longer in the pushable tasks list.
Please go through the original rt change for more details on the issue.
To fix this, after the lock is obtained inside the find_lock_later_rq, it ensures that the task is still at the head of pushable tasks list. Also removed some checks that are no longer needed with the addition of this new check.
However, the new check of pushable tasks list only applies when find_lock_later_rq is called by push_dl_task. For the other caller i.e. dl_task_offline_migration, existing checks are used.
--- kernel/sched/deadline.c | 73 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 49 insertions(+), 24 deletions(-)
kernel/sched/deadline.c +49 -24
@@ -2217,6 +2217,25 @@ static int find_later_rq(struct task_strreturn -1 ; } +static struct task_struct *pick_next_pushable_dl_task (struct rq *rq) +{ +struct task_struct *p; + +if (!has_pushable_dl_tasks (rq)) +return NULL ; + + p =__node_2_pdl (rb_first_cached (&rq->dl.pushable_dl_tasks_root)); + +WARN_ON_ONCE (rq->cpu !=task_cpu (p)); +WARN_ON_ONCE (task_current (rq, p)); +WARN_ON_ONCE (p->nr_cpus_allowed <=1 ); + +WARN_ON_ONCE (!task_on_rq_queued (p)); +WARN_ON_ONCE (!dl_task (p)); + +return p; +} +/* Locks the rq it finds */ static struct rq *find_lock_later_rq (struct task_struct *task,struct rq *rq) {
@@ -2244,12 +2263,37 @@ static struct rq *find_lock_later_rq(str/* Retry if something changed. */ if (double_lock_balance (rq, later_rq)) { -if (unlikely (task_rq (task) != rq || +/* +* double_lock_balance had to release rq->lock, in the +* meantime, task may no longer be fit to be migrated. +* Check the following to ensure that the task is +* still suitable for migration: +* 1. It is possible the task was scheduled, +* migrate_disabled was set and then got preempted, +* so we must check the task migration disable +* flag. +* 2. The CPU picked is in the task's affinity. +* 3. For throttled task (dl_task_offline_migration), +* check the following: +* - the task is not on the rq anymore (it was +* migrated) +* - the task is not on CPU anymore +* - the task is still a dl task +* - the task is not queued on the rq anymore +* 4. For the non-throttled task (push_dl_task), the +* check to ensure that this task is still at the +* head of the pushable tasks list is enough. +*/ +if (unlikely (is_migration_disabled (task) || !cpumask_test_cpu (later_rq->cpu, &task->cpus_mask) || -task_on_cpu (rq, task) || - !dl_task (task) || -is_migration_disabled (task) || - !task_on_rq_queued (task))) { + (task->dl.dl_throttled && + (task_rq (task) != rq || +task_on_cpu (rq, task) || + !dl_task (task) || + !task_on_rq_queued (task))) || + (!task->dl.dl_throttled && + task !=pick_next_pushable_dl_task (rq)))) { +double_unlock_balance (rq, later_rq); later_rq =NULL ;break ;
@@ -2272,25 +2316,6 @@ static struct rq *find_lock_later_rq(strreturn later_rq; } -static struct task_struct *pick_next_pushable_dl_task (struct rq *rq) -{ -struct task_struct *p; - -if (!has_pushable_dl_tasks (rq)) -return NULL ; - - p =__node_2_pdl (rb_first_cached (&rq->dl.pushable_dl_tasks_root)); - -WARN_ON_ONCE (rq->cpu !=task_cpu (p)); -WARN_ON_ONCE (task_current (rq, p)); -WARN_ON_ONCE (p->nr_cpus_allowed <=1 ); - -WARN_ON_ONCE (!task_on_rq_queued (p)); -WARN_ON_ONCE (!dl_task (p)); - -return p; -} -/* * See if the non running -deadline tasks on this rq * can be sent to some other CPU where they can preempt
Greg Kroah-Hartman
maintainerPATCH 97/168 scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit b81296591c567b12d3873b05a37b975707959b94 upstream.
Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally.
Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0).
--- drivers/scsi/hpsa.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/scsi/hpsa.c +12 -9
@@ -6528,18 +6528,21 @@ static int hpsa_big_passthru_ioctl(strucwhile (left) { sz = (left > ioc->malloc_size) ? ioc->malloc_size : left; buff_size[sg_used] = sz; - buff[sg_used] =kmalloc (sz,GFP_KERNEL ); -if (buff[sg_used] ==NULL ) { - status = -ENOMEM ; - goto cleanup1; - } +if (ioc->Request.Type.Direction &XFER_WRITE ) { -if (copy_from_user (buff[sg_used], data_ptr, sz)) { - status = -EFAULT ; + buff[sg_used] =memdup_user (data_ptr, sz); +if (IS_ERR (buff[sg_used])) { + status =PTR_ERR (buff[sg_used]); + goto cleanup1; + } + }else { + buff[sg_used] =kzalloc (sz,GFP_KERNEL ); +if (!buff[sg_used]) { + status = -ENOMEM ; goto cleanup1; } - }else -memset (buff[sg_used],0 , sz); + } + left -= sz; data_ptr += sz; sg_used++;
Greg Kroah-Hartman
maintainerPATCH 98/168 sctp: Fix MAC comparison to be constant-time
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit dd91c79e4f58fbe2898dac84858033700e0e99fb upstream.
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
--- net/sctp/sm_make_chunk.c | 3 ++- net/sctp/sm_statefuns.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/sctp/sm_make_chunk.c +2 -1
@@ -31,6 +31,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt#include <crypto/hash.h> +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -1796,7 +1797,7 @@ struct sctp_association *sctp_unpack_coo } } -if (memcmp (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { +if (crypto_memneq (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { *error = -SCTP_IERROR_BAD_SIG ; goto fail; }
net/sctp/sm_statefuns.c +2 -1
@@ -30,6 +30,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -4418,7 +4419,7 @@ static enum sctp_ierror sctp_sf_authenti sh_key, GFP_ATOMIC);/* Discard the packet if the digests do not match */ -if (memcmp (save_digest, digest, sig_len)) { +if (crypto_memneq (save_digest, digest, sig_len)) {kfree (save_digest);return SCTP_IERROR_BAD_SIG ; }
Greg Kroah-Hartman
maintainerPATCH 99/168 sparc64: fix hugetlb for sun4u
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Yznaga <[email protected]>
commit 6fd44a481b3c6111e4801cec964627791d0f3ec5 upstream.
An attempt to exercise sparc hugetlb code in a sun4u-based guest running under qemu results in the guest hanging due to being stuck in a trap loop. This is due to invalid hugetlb TTEs being installed that do not have the expected _PAGE_PMD_HUGE and page size bits set. Although the breakage has gone apparently unnoticed for several years, fix it now so there is the option to exercise sparc hugetlb code under qemu. This can be useful because sun4v support in qemu does not support linux guests currently and sun4v-based hardware resources may not be readily available.
Fix tested with a 6.15.2 and 6.16-rc6 kernels by running libhugetlbfs tests on a qemu guest running Debian 13.
--- arch/sparc/mm/hugetlbpage.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
arch/sparc/mm/hugetlbpage.c +20 -0
@@ -133,6 +133,26 @@ hugetlb_get_unmapped_area(struct file *fstatic pte_t sun4u_hugepage_shift_to_tte (pte_t entry,unsigned int shift) { +unsigned long hugepage_size = _PAGE_SZ4MB_4U; + +pte_val (entry) =pte_val (entry) & ~_PAGE_SZALL_4U; + +switch (shift) { +case HPAGE_256MB_SHIFT : + hugepage_size = _PAGE_SZ256MB_4U; +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_SHIFT : +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_64K_SHIFT : + hugepage_size = _PAGE_SZ64K_4U; +break ; +default : +WARN_ONCE (1 ,"unsupported hugepage shift=%u\n" , shift); + } + +pte_val (entry) =pte_val (entry) | hugepage_size;return entry; }
Greg Kroah-Hartman
maintainerPATCH 100/168 sparc: fix error handling in scan_one_device()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 302c04110f0ce70d25add2496b521132548cd408 upstream.
Once of_device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it could cause memory leak. So fix this by calling put_device(), then the name can be freed in kobject_cleanup().
Calling path: of_device_register() -> of_device_add() -> device_add(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.
Found by code review.
--- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + 2 files changed, 2 insertions(+)
arch/sparc/kernel/of_device_32.c +1 -0
@@ -387,6 +387,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
arch/sparc/kernel/of_device_64.c +1 -0
@@ -680,6 +680,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 101/168 xtensa: simdisk: add input size check in proc_write_simdisk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 5d5f08fd0cd970184376bee07d59f635c8403f63 upstream.
A malicious user could pass an arbitrarily bad value to memdup_user_nul(), potentially causing kernel crash.
This follows the same pattern as commit ee76746387f6 ("netdevsim: prevent bad user input in nsim_dev_health_break_write()")
Message-Id: <[email protected]>
--- arch/xtensa/platforms/iss/simdisk.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/xtensa/platforms/iss/simdisk.c +5 -1
@@ -230,10 +230,14 @@ static ssize_t proc_read_simdisk(structstatic ssize_t proc_write_simdisk (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -char *tmp =memdup_user_nul (buf, count); +char *tmp;struct simdisk *dev =pde_data (file_inode (file));int err; +if (count ==0 || count >PAGE_SIZE ) +return -EINVAL ; + + tmp =memdup_user_nul (buf, count);if (IS_ERR (tmp))return PTR_ERR (tmp);
Greg Kroah-Hartman
maintainerPATCH 102/168 mtd: rawnand: fsmc: Default to autodetect buswidth
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit b8df622cf7f6808c85764e681847150ed6d85f3d upstream.
If you don't specify buswidth 2 (16 bits) in the device tree, FSMC doesn't even probe anymore:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro 10100000.flash
nand: bus width 8 instead of 16 bits
nand: No NAND device found
fsmc-nand 10100000.flash: probe with driver fsmc-nand failed
with error -22
With this patch to use autodetection unless buswidth is specified, the device is properly detected again:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro NAND 128MiB 1,8V 16-bit
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 fsmc-nand 10100000.flash: Using 1-bit HW ECC scheme Scanning device for bad blocks
I don't know where or how this happened, I think some change in the nand core.
--- drivers/mtd/nand/raw/fsmc_nand.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/fsmc_nand.c +5 -1
@@ -876,10 +876,14 @@ static int fsmc_nand_probe_config_dt(strif (!of_property_read_u32 (np,"bank-width" , &val)) {if (val ==2 ) { nand->options |=NAND_BUSWIDTH_16 ; - }else if (val !=1 ) { + }else if (val ==1 ) { + nand->options |=NAND_BUSWIDTH_AUTO ; + }else {dev_err (&pdev->dev,"invalid bank-width %u\n" , val);return -EINVAL ; } + }else { + nand->options |=NAND_BUSWIDTH_AUTO ; }if (of_get_property (np,"nand-skip-bbtscan" ,NULL ))
Greg Kroah-Hartman
maintainerPATCH 103/168 mmc: core: SPI mode remove cmd7
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Chen <[email protected]>
commit fec40f44afdabcbc4a7748e4278f30737b54bb1a upstream.
SPI mode doesn't support cmd7, so remove it in mmc_sdio_alive() and confirm if sdio is active by checking CCCR register value is available or not.
--- drivers/mmc/core/sdio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/core/sdio.c +5 -1
@@ -945,7 +945,11 @@ static void mmc_sdio_remove(struct mmc_h*/ static int mmc_sdio_alive (struct mmc_host *host) { -return mmc_select_card (host->card); +if (!mmc_host_is_spi (host)) +return mmc_select_card (host->card); +else +return mmc_io_rw_direct (host->card,0 ,0 ,SDIO_CCCR_CCCR ,0 , +NULL ); }/*
Greg Kroah-Hartman
maintainerPATCH 104/168 memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit 6744085079e785dae5f7a2239456135407c58b25 upstream.
The of_platform_populate() call at the end of the function has a possible failure path, causing a resource leak.
Replace of_iomap() with devm_platform_ioremap_resource() to ensure automatic cleanup of srom->reg_base.
This issue was detected by smatch static analysis:drivers/memory/samsung/exynos-srom.c:155 exynos_srom_probe()warn:
'srom->reg_base' from of_iomap() not released on lines: 155.
--- drivers/memory/samsung/exynos-srom.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/memory/samsung/exynos-srom.c +4 -6
@@ -121,20 +121,18 @@ static int exynos_srom_probe(struct platreturn -ENOMEM ; srom->dev = dev; - srom->reg_base =of_iomap (np,0 ); -if (!srom->reg_base) { + srom->reg_base =devm_platform_ioremap_resource (pdev,0 ); +if (IS_ERR (srom->reg_base)) {dev_err (&pdev->dev,"iomap of exynos srom controller failed\n" ); -return -ENOMEM ; +return PTR_ERR (srom->reg_base); }platform_set_drvdata (pdev, srom); srom->reg_offset =exynos_srom_alloc_reg_dump (exynos_srom_offsets,ARRAY_SIZE (exynos_srom_offsets)); -if (!srom->reg_offset) { -iounmap (srom->reg_base); +if (!srom->reg_offset)return -ENOMEM ; - }for_each_child_of_node (np, child) {if (exynos_srom_configure_bank (srom, child)) {
Greg Kroah-Hartman
maintainerPATCH 105/168 rtc: interface: Ensure alarm irq is enabled when UIE is enabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 9db26d5855d0374d4652487bfb5aacf40821c469 upstream.
When setting a normal alarm, user-space is responsible for using RTC_AIE_ON/RTC_AIE_OFF to control if alarm irq should be enabled.
But when RTC_UIE_ON is used, interrupts must be enabled so that the requested irq events are generated.
When RTC_UIE_OFF is used, alarm irq is disabled if there are no other alarms queued, so this commit brings symmetry to that.
--- drivers/rtc/interface.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/rtc/interface.c +4 -0
@@ -594,6 +594,10 @@ int rtc_update_irq_enable(struct rtc_dev rtc->uie_rtctimer.node.expires =ktime_add (now, onesec); rtc->uie_rtctimer.period =ktime_set (1 ,0 ); err =rtc_timer_enqueue (rtc, &rtc->uie_rtctimer); +if (!err && rtc->ops && rtc->ops->alarm_irq_enable) + err = rtc->ops->alarm_irq_enable (rtc->dev.parent,1 ); +if (err) + goto out; }else {rtc_timer_remove (rtc, &rtc->uie_rtctimer); }
Greg Kroah-Hartman
maintainerPATCH 106/168 rtc: interface: Fix long-standing race when setting alarm
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 795cda8338eab036013314dbc0b04aae728880ab upstream.
As described in the old comment dating back to
commit 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") from 2010, we have been living with a race window when setting alarm with an expiry in the near future (i.e. next second).
With 1 second resolution, it can happen that the second ticks after the check for the timer having expired, but before the alarm is actually set. When this happen, no alarm IRQ is generated, at least not with some RTC chips (isl12022 is an example of this).
With UIE RTC timer being implemented on top of alarm irq, being re-armed every second, UIE will occasionally fail to work, as an alarm irq lost due to this race will stop the re-arming loop.
For now, I have limited the additional expiry check to only be done for alarms set to next seconds. I expect it should be good enough, although I don't know if we can now for sure that systems with loads could end up causing the same problems for alarms set 2 seconds or even longer in the future.
I haven't been able to reproduce the problem with this check in place.
--- drivers/rtc/interface.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/rtc/interface.c +23 -0
@@ -443,6 +443,29 @@ static int __rtc_set_alarm(struct rtc_deelse err = rtc->ops->set_alarm (rtc->dev.parent, alarm); +/* +* Check for potential race described above. If the waiting for next +* second, and the second just ticked since the check above, either +* +* 1) It ticked after the alarm was set, and an alarm irq should be +* generated. +* +* 2) It ticked before the alarm was set, and alarm irq most likely will +* not be generated. +* +* While we cannot easily check for which of these two scenarios we +* are in, we can return -ETIME to signal that the timer has already +* expired, which is true in both cases. +*/ +if ((scheduled - now) <=1 ) { + err =__rtc_read_time (rtc, &tm); +if (err) +return err; + now =rtc_tm_to_time64 (&tm); +if (scheduled <= now) +return -ETIME ; + } +trace_rtc_set_alarm (rtc_tm_to_time64 (&alarm->time), err);return err; }
Greg Kroah-Hartman
maintainerPATCH 107/168 rseq/selftests: Use weak symbol reference, not definition, to link with glibc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit a001cd248ab244633c5fabe4f7c707e13fc1d1cc upstream.
Add "extern" to the glibc-defined weak rseq symbols to convert the rseq selftest's usage from weak symbol definitions to weak symbol _references_. Effectively re-defining the glibc symbols wreaks havoc when building with -fno-common, e.g. generates segfaults when running multi-threaded programs, as dynamically linked applications end up with multiple versions of the symbols.
Building with -fcommon, which until recently has the been the default for GCC and clang, papers over the bug by allowing the linker to resolve the weak/tentative definition to glibc's "real" definition.
Note, the symbol itself (or rather its address), not the value of the symbol, is set to 0/NULL for unresolved weak symbol references, as the symbol doesn't exist and thus can't have a value. Check for a NULL rseq size pointer to handle the scenario where the test is statically linked against a libc that doesn't support rseq in any capacity.
--- tools/testing/selftests/rseq/rseq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/rseq/rseq.c +4 -4
@@ -38,9 +38,9 @@* Define weak versions to play nice with binaries that are statically linked * against a libc that doesn't support registering its own rseq. */ -__weak ptrdiff_t __rseq_offset; -__weak unsigned int __rseq_size; -__weak unsigned int __rseq_flags; +extern __weak ptrdiff_t __rseq_offset; +extern __weak unsigned int __rseq_size; +extern __weak unsigned int __rseq_flags;static const ptrdiff_t *libc_rseq_offset_p = &__rseq_offset;static const unsigned int *libc_rseq_size_p = &__rseq_size;
@@ -124,7 +124,7 @@ void rseq_init(void)* libc not having registered a restartable sequence. Try to find the * symbols if that's the case. */ -if (!*libc_rseq_size_p) { +if (!libc_rseq_size_p || !*libc_rseq_size_p) { libc_rseq_offset_p =dlsym (RTLD_NEXT ,"__rseq_offset" ); libc_rseq_size_p =dlsym (RTLD_NEXT ,"__rseq_size" ); libc_rseq_flags_p =dlsym (RTLD_NEXT ,"__rseq_flags" );
Greg Kroah-Hartman
maintainerPATCH 108/168 PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 26fda92d3b56bf44a02bcb4001c5a5548e0ae8ee upstream.
The tegra_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls tegra_msi_irq_unmask().
Since the &desc->lock descriptor lock is a raw spinlock, and the tegra_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y.
Use scoped_guard() to simplify the locking.
--- drivers/pci/controller/pci-tegra.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
drivers/pci/controller/pci-tegra.c +13 -14
@@ -14,6 +14,7 @@*/ #include <linux/clk.h> +#include <linux/cleanup.h> #include <linux/debugfs.h> #include <linux/delay.h> #include <linux/export.h>
@@ -269,7 +270,7 @@ struct tegra_msi {DECLARE_BITMAP (used,INT_PCI_MSI_NR );struct irq_domain *domain;struct mutex map_lock; -spinlock_t mask_lock; +raw_spinlock_t mask_lock;void *virt;dma_addr_t phys;int irq;
@@ -1607,14 +1608,13 @@ static void tegra_msi_irq_mask(struct irstruct tegra_msi *msi =irq_data_get_irq_chip_data (d);struct tegra_pcie *pcie =msi_to_pcie (msi);unsigned int index = d->hwirq /32 ; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); - value &= ~BIT (d->hwirq %32 ); -afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); + value &= ~BIT (d->hwirq %32 ); +afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); + } }static void tegra_msi_irq_unmask (struct irq_data *d)
@@ -1622,14 +1622,13 @@ static void tegra_msi_irq_unmask(structstruct tegra_msi *msi =irq_data_get_irq_chip_data (d);struct tegra_pcie *pcie =msi_to_pcie (msi);unsigned int index = d->hwirq /32 ; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); - value |=BIT (d->hwirq %32 ); -afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); + value |=BIT (d->hwirq %32 ); +afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); + } }static int tegra_msi_set_affinity (struct irq_data *d,const struct cpumask *mask,bool force)
@@ -1745,7 +1744,7 @@ static int tegra_pcie_msi_setup(struct tint err;mutex_init (&msi->map_lock); -spin_lock_init (&msi->mask_lock); +raw_spin_lock_init (&msi->mask_lock);if (IS_ENABLED (CONFIG_PCI_MSI )) { err =tegra_allocate_domains (msi);
Greg Kroah-Hartman
maintainerPATCH 109/168 PCI/sysfs: Ensure devices are powered for config reads
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 48991e4935078b05f80616c75d1ee2ea3ae18e58 upstream.
The "max_link_width", "current_link_speed", "current_link_width", "secondary_bus_number", and "subordinate_bus_number" sysfs files all access config registers, but they don't check the runtime PM state. If the device is in D3cold or a parent bridge is suspended, we may see -EINVAL, bogus values, or worse, depending on implementation details.
Wrap these access in pci_config_pm_runtime_{get,put}() like most of the rest of the similar sysfs attributes.
Notably, "max_link_speed" does not access config registers; it returns a cached value since d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds").
--- drivers/pci/pci-sysfs.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/pci/pci-sysfs.c +19 -1
@@ -196,8 +196,14 @@ static ssize_t max_link_width_show(struc struct device_attribute *attr, char *buf) { struct pci_dev *pdev = to_pci_dev(dev); +ssize_t ret; -return sysfs_emit (buf,"%u\n" ,pcie_get_width_cap (pdev)); +/* We read PCI_EXP_LNKCAP, so we need the device to be accessible. */ +pci_config_pm_runtime_get (pdev); + ret =sysfs_emit (buf,"%u\n" ,pcie_get_width_cap (pdev)); +pci_config_pm_runtime_put (pdev); + +return ret; }static DEVICE_ATTR_RO (max_link_width);
@@ -209,7 +215,10 @@ static ssize_t current_link_speed_show(sint err;enum pci_bus_speed speed; +pci_config_pm_runtime_get (pci_dev); err =pcie_capability_read_word (pci_dev,PCI_EXP_LNKSTA , &linkstat); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
@@ -226,7 +235,10 @@ static ssize_t current_link_width_show(su16 linkstat;int err; +pci_config_pm_runtime_get (pci_dev); err =pcie_capability_read_word (pci_dev,PCI_EXP_LNKSTA , &linkstat); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
@@ -242,7 +254,10 @@ static ssize_t secondary_bus_number_showu8 sec_bus;int err; +pci_config_pm_runtime_get (pci_dev); err =pci_read_config_byte (pci_dev,PCI_SECONDARY_BUS , &sec_bus); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
@@ -258,7 +273,10 @@ static ssize_t subordinate_bus_number_shu8 sub_bus;int err; +pci_config_pm_runtime_get (pci_dev); err =pci_read_config_byte (pci_dev,PCI_SUBORDINATE_BUS , &sub_bus); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 110/168 PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 upstream.
Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs.
Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()") such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls.
On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed:
PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56)
GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001
00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8
#0 [3800313fb20] device_del at c9158ad5c
#1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390
#9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2.
This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy.
Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper.
Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking.
--- drivers/pci/iov.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/iov.c +5 -0
@@ -582,15 +582,18 @@ static int sriov_add_vfs(struct pci_devif (dev->no_vf_scan)return 0 ; +pci_lock_rescan_remove ();for (i =0 ; i < num_vfs; i++) { rc =pci_iov_add_virtfn (dev, i);if (rc) goto failed; } +pci_unlock_rescan_remove ();return 0 ; failed:while (i--)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove ();return rc; }
@@ -710,8 +713,10 @@ static void sriov_del_vfs(struct pci_devstruct pci_sriov *iov = dev->sriov;int i; +pci_lock_rescan_remove ();for (i =0 ; i < iov->num_VFs; i++)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove (); }static void sriov_disable (struct pci_dev *dev)
Greg Kroah-Hartman
maintainerPATCH 111/168 PCI/ERR: Fix uevent on failure to recover
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 1cbc5e25fb70e942a7a735a1f3d6dd391afc9b29 upstream.
Upon failure to recover from a PCIe error through AER, DPC or EDR, a uevent is sent to inform user space about disconnection of the bridge whose subordinate devices failed to recover.
However the bridge itself is not disconnected. Instead, a uevent should be sent for each of the subordinate devices.
Only if the "bridge" happens to be a Root Complex Event Collector or Integrated Endpoint does it make sense to send a uevent for it (because there are no subordinate devices).
Right now if there is a mix of subordinate devices with and without pci_error_handlers, a BEGIN_RECOVERY event is sent for those with pci_error_handlers but no FAILED_RECOVERY event is ever sent for them afterwards. Fix it.
--- drivers/pci/pcie/err.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pci/pcie/err.c +7 -1
@@ -108,6 +108,12 @@ static int report_normal_detected(structreturn report_error_detected (dev, pci_channel_io_normal, data); } +static int report_perm_failure_detected (struct pci_dev *dev,void *data) +{ +pci_uevent_ers (dev,PCI_ERS_RESULT_DISCONNECT ); +return 0 ; +} +static int report_mmio_enabled (struct pci_dev *dev,void *data) {struct pci_driver *pdrv;
@@ -275,7 +281,7 @@ pci_ers_result_t pcie_do_recovery(struct failed:pci_walk_bridge (bridge, pci_pm_runtime_put,NULL ); -pci_uevent_ers (bridge,PCI_ERS_RESULT_DISCONNECT ); +pci_walk_bridge (bridge, report_perm_failure_detected,NULL );/* TODO: Should kernel panic here? */ pci_info (bridge,"device recovery failed\n" );
Greg Kroah-Hartman
maintainerPATCH 112/168 PCI/AER: Fix missing uevent on recovery when a reset is requested
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit bbf7d0468d0da71d76cc6ec9bc8a224325d07b6b upstream.
Since commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") AER uses the result of error_detected() as parameter to pci_uevent_ers(). As pci_uevent_ers() however does not handle PCI_ERS_RESULT_NEED_RESET this results in a missing uevent for the beginning of recovery if drivers request a reset. Fix this by treating PCI_ERS_RESULT_NEED_RESET as beginning recovery.
--- drivers/pci/pci-driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/pci-driver.c +1 -0
@@ -1611,6 +1611,7 @@ void pci_uevent_ers(struct pci_dev *pdevswitch (err_type) {case PCI_ERS_RESULT_NONE :case PCI_ERS_RESULT_CAN_RECOVER : +case PCI_ERS_RESULT_NEED_RESET : envp[idx++] ="ERROR_EVENT=BEGIN_RECOVERY" ; envp[idx++] ="DEVICE_ONLINE=0" ;break ;
Greg Kroah-Hartman
maintainerPATCH 113/168 PCI/AER: Support errors introduced by PCIe r6.0
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 6633875250b38b18b8638cf01e695de031c71f02 upstream.
PCIe r6.0 defined five additional errors in the Uncorrectable Error Status, Mask and Severity Registers (PCIe r7.0 sec 7.8.4.2ff).
lspci has been supporting them since commit 144b0911cc0b ("ls-ecaps:
extend decode support for more fields for AER CE and UE status"):
https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/commit/?id=144b0911cc0b
Amend the AER driver to recognize them as well, instead of logging them as "Unknown Error Bit".
--- drivers/pci/pcie/aer.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/pcie/aer.c +6 -6
@@ -37,7 +37,7 @@#define AER_ERROR_SOURCES_MAX 128#define AER_MAX_TYPEOF_COR_ERRS 16/* as per PCI_ERR_COR_STATUS */ -#define AER_MAX_TYPEOF_UNCOR_ERRS 27/* as per PCI_ERR_UNCOR_STATUS*/ +#define AER_MAX_TYPEOF_UNCOR_ERRS 32/* as per PCI_ERR_UNCOR_STATUS*/ struct aer_err_source {unsigned int status;
@@ -518,11 +518,11 @@ static const char *aer_uncorrectable_err"AtomicOpBlocked" ,/* Bit Position 24 */ "TLPBlockedErr" ,/* Bit Position 25 */ "PoisonTLPBlocked" ,/* Bit Position 26 */ -NULL ,/* Bit Position 27 */ -NULL ,/* Bit Position 28 */ -NULL ,/* Bit Position 29 */ -NULL ,/* Bit Position 30 */ - NULL, /* Bit Position 31 */ +"DMWrReqBlocked" ,/* Bit Position 27 */ +"IDECheck" ,/* Bit Position 28 */ +"MisIDETLP" ,/* Bit Position 29 */ +"PCRC_CHECK" ,/* Bit Position 30 */ + "TLPXlatBlocked", /* Bit Position 31 */ }; static const char *aer_agent_string[] = {
Greg Kroah-Hartman
maintainerPATCH 114/168 PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit e51d05f523e43ce5d2bad957943a2b14f68078cd upstream.
Commit under Fixes introduced the IRQ handler for "ks-pcie-error-irq". The interrupt is acquired using "request_irq()" but is never freed if the driver exits due to an error. Although the section in the driver that invokes "request_irq()" has moved around over time, the issue hasn't been addressed until now.
Fix this by using "devm_request_irq()" which automatically frees the interrupt if the driver exits.
--- drivers/pci/controller/dwc/pci-keystone.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pci-keystone.c +2 -2
@@ -1214,8 +1214,8 @@ static int ks_pcie_probe(struct platformif (irq <0 )return irq; - ret =request_irq (irq, ks_pcie_err_irq_handler,IRQF_SHARED , -"ks-pcie-error-irq" , ks_pcie); + ret =devm_request_irq (dev, irq, ks_pcie_err_irq_handler,IRQF_SHARED , +"ks-pcie-error-irq" , ks_pcie);if (ret <0 ) {dev_err (dev,"failed to request error IRQ %d\n" , irq);
Greg Kroah-Hartman
maintainerPATCH 115/168 PCI: rcar-host: Drop PMSR spinlock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 0a8f173d9dad13930d5888505dc4c4fd6a1d4262 upstream.
The pmsr_lock spinlock used to be necessary to synchronize access to the PMSR register, because that access could have been triggered from either config space access in rcar_pcie_config_access() or an exception handler rcar_pcie_aarch32_abort_handler().
The rcar_pcie_aarch32_abort_handler() case is no longer applicable since commit 6e36203bc14c ("PCI: rcar: Use PCI_SET_ERROR_RESPONSE after read which triggered an exception"), which performs more accurate, controlled invocation of the exception, and a fixup.
This leaves rcar_pcie_config_access() as the only call site from which rcar_pcie_wakeup() is called. The rcar_pcie_config_access() can only be called from the controller struct pci_ops .read and .write callbacks, and those are serialized in drivers/pci/access.c using raw spinlock 'pci_lock' . It should be noted that CONFIG_PCI_LOCKLESS_CONFIG is never set on this platform.
Since the 'pci_lock' is a raw spinlock , and the 'pmsr_lock' is not a raw spinlock, this constellation triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y .
Remove the pmsr_lock to fix the locking.
--- drivers/pci/controller/pcie-rcar-host.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +2 -11
@@ -65,20 +65,13 @@ struct rcar_pcie_host {int (*phy_init_fn)(struct rcar_pcie_host *host); }; -static DEFINE_SPINLOCK (pmsr_lock); -static int rcar_pcie_wakeup (struct device *pcie_dev,void __iomem *pcie_base) { -unsigned long flags;u32 pmsr, val;int ret =0 ; -spin_lock_irqsave (&pmsr_lock, flags); - -if (!pcie_base ||pm_runtime_suspended (pcie_dev)) { - ret = -EINVAL ; - goto unlock_exit; - } +if (!pcie_base ||pm_runtime_suspended (pcie_dev)) +return -EINVAL ; pmsr =readl (pcie_base +PMSR );
@@ -100,8 +93,6 @@ static int rcar_pcie_wakeup(struct devicwritel (L1FAEG |PMEL1RX , pcie_base +PMSR ); } -unlock_exit: -spin_unlock_irqrestore (&pmsr_lock, flags);return ret; }
Greg Kroah-Hartman
maintainerPATCH 116/168 PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 5ed35b4d490d8735021cce9b715b62a418310864 upstream.
The rcar_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls rcar_msi_irq_unmask().
Since the &desc->lock descriptor lock is a raw spinlock, and the rcar_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y.
Use scoped_guard() to simplify the locking.
--- drivers/pci/controller/pcie-rcar-host.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +13 -14
@@ -12,6 +12,7 @@*/ #include <linux/bitops.h> +#include <linux/cleanup.h> #include <linux/clk.h> #include <linux/clk-provider.h> #include <linux/delay.h>
@@ -36,7 +37,7 @@ struct rcar_msi {DECLARE_BITMAP (used,INT_PCI_MSI_NR );struct irq_domain *domain;struct mutex map_lock; -spinlock_t mask_lock; +raw_spinlock_t mask_lock;int irq1;int irq2; };
@@ -639,28 +640,26 @@ static void rcar_msi_irq_mask(struct irq {struct rcar_msi *msi =irq_data_get_irq_chip_data (d);struct rcar_pcie *pcie = &msi_to_host (msi)->pcie; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =rcar_pci_read_reg (pcie,PCIEMSIIER ); - value &= ~BIT (d->hwirq); -rcar_pci_write_reg (pcie, value,PCIEMSIIER ); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =rcar_pci_read_reg (pcie,PCIEMSIIER ); + value &= ~BIT (d->hwirq); +rcar_pci_write_reg (pcie, value,PCIEMSIIER ); + } }static void rcar_msi_irq_unmask (struct irq_data *d) {struct rcar_msi *msi =irq_data_get_irq_chip_data (d);struct rcar_pcie *pcie = &msi_to_host (msi)->pcie; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =rcar_pci_read_reg (pcie,PCIEMSIIER ); - value |=BIT (d->hwirq); -rcar_pci_write_reg (pcie, value,PCIEMSIIER ); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =rcar_pci_read_reg (pcie,PCIEMSIIER ); + value |=BIT (d->hwirq); +rcar_pci_write_reg (pcie, value,PCIEMSIIER ); + } }static int rcar_msi_set_affinity (struct irq_data *d,const struct cpumask *mask,bool force)
@@ -776,7 +775,7 @@ static int rcar_pcie_enable_msi(struct rint err;mutex_init (&msi->map_lock); -spin_lock_init (&msi->mask_lock); +raw_spin_lock_init (&msi->mask_lock); err =of_address_to_resource (dev->of_node,0 , &res);if (err)
Greg Kroah-Hartman
maintainerPATCH 117/168 PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit b640d42a6ac9ba01abe65ec34f7c73aaf6758ab8 upstream.
The pci_epc_raise_irq() supplies a MSI or MSI-X interrupt number in range (1-N), as per the pci_epc_raise_irq() kdoc, where N is 32 for MSI.
But tegra_pcie_ep_raise_msi_irq() incorrectly uses the interrupt number as the MSI vector. This causes wrong MSI vector to be triggered, leading to the failure of PCI endpoint Kselftest MSI_TEST test case.
To fix this issue, convert the interrupt number to MSI vector.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -2
@@ -1949,10 +1949,10 @@ static int tegra_pcie_ep_raise_legacy_irstatic int tegra_pcie_ep_raise_msi_irq (struct tegra_pcie_dw *pcie,u16 irq) { -if (unlikely (irq >31 )) +if (unlikely (irq >32 ))return -EINVAL ; -appl_writel (pcie,BIT (irq),APPL_MSI_CTRL_1 ); +appl_writel (pcie,BIT (irq -1 ),APPL_MSI_CTRL_1 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 118/168 PCI: tegra194: Handle errors in BPMP response
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
commit f8c9ad46b00453a8c075453f3745f8d263f44834 upstream.
The return value from tegra_bpmp_transfer() indicates the success or failure of the IPC transaction with BPMP. If the transaction succeeded, we also need to check the actual command's result code.
If we don't have error handling for tegra_bpmp_transfer(), we will set the pcie->ep_state to EP_STATE_ENABLED even when the tegra_bpmp_transfer() command fails. Thus, the pcie->ep_state will get out of sync with reality, and any further PERST# assert + deassert will be a no-op and will not trigger the hardware initialization sequence.
This is because pex_ep_event_pex_rst_deassert() checks the current pcie->ep_state, and does nothing if the current state is already EP_STATE_ENABLED.
Thus, it is important to have error handling for tegra_bpmp_transfer(), such that the pcie->ep_state can not get out of sync with reality, so that we will try to initialize the hardware not only during the first PERST# assert + deassert, but also during any succeeding PERST# assert + deassert.
One example where this fix is needed is when using a rock5b as host. During the initial PERST# assert + deassert (triggered by the bootloader on the rock5b) pex_ep_event_pex_rst_deassert() will get called, but for some unknown reason, the tegra_bpmp_transfer() call to initialize the PHY fails. Once Linux has been loaded on the rock5b, the PCIe driver will once again assert + deassert PERST#. However, without tegra_bpmp_transfer() error handling, this second PERST# assert + deassert will not trigger the hardware initialization sequence.
With tegra_bpmp_transfer() error handling, the second PERST# assert + deassert will once again trigger the hardware to be initialized and this time the tegra_bpmp_transfer() succeeds.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +16 -2
@@ -1204,6 +1204,7 @@ static int tegra_pcie_bpmp_set_ctrl_statstruct mrq_uphy_response resp;struct tegra_bpmp_message msg;struct mrq_uphy_request req; +int err;/* * Controller-5 doesn't need to have its state set by BPMP-FW in
@@ -1226,7 +1227,13 @@ static int tegra_pcie_bpmp_set_ctrl_stat msg.rx.data = &resp; msg.rx.size =sizeof (resp); -return tegra_bpmp_transfer (pcie->bpmp, &msg); + err =tegra_bpmp_transfer (pcie->bpmp, &msg); +if (err) +return err; +if (msg.rx.ret) +return -EINVAL ; + +return 0 ; } static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie,
@@ -1235,6 +1242,7 @@ static int tegra_pcie_bpmp_set_pll_statestruct mrq_uphy_response resp;struct tegra_bpmp_message msg;struct mrq_uphy_request req; +int err;memset (&req,0 ,sizeof (req));memset (&resp,0 ,sizeof (resp));
@@ -1254,7 +1262,13 @@ static int tegra_pcie_bpmp_set_pll_state msg.rx.data = &resp; msg.rx.size =sizeof (resp); -return tegra_bpmp_transfer (pcie->bpmp, &msg); + err =tegra_bpmp_transfer (pcie->bpmp, &msg); +if (err) +return err; +if (msg.rx.ret) +return -EINVAL ; + +return 0 ; }static void tegra_pcie_downstream_dev_to_D0 (struct tegra_pcie_dw *pcie)
Greg Kroah-Hartman
maintainerPATCH 119/168 spi: cadence-quadspi: Flush posted register writes before INDAC access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
commit 29e0b471ccbd674d20d4bbddea1a51e7105212c5 upstream.
cqspi_indirect_read_execute() and cqspi_indirect_write_execute() first set the enable bit on APB region and then start reading/writing to the AHB region. On TI K3 SoCs these regions lie on different endpoints. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level.
It is possible for the AHB write to be executed before the APB write to enable the indirect controller, causing the transaction to be invalid and the write erroring out. Read back the APB region write before accessing the AHB region to make sure the write got flushed and the race condition is eliminated.
Message-ID: <[email protected]>
--- drivers/spi/spi-cadence-quadspi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-cadence-quadspi.c +3 -0
@@ -694,6 +694,7 @@ static int cqspi_indirect_read_execute(sreinit_completion (&cqspi->transfer_complete);writel (CQSPI_REG_INDIRECTRD_START_MASK , reg_base +CQSPI_REG_INDIRECTRD ); +readl (reg_base +CQSPI_REG_INDIRECTRD );/* Flush posted write. */ while (remaining > 0) { if (!wait_for_completion_timeout(&cqspi->transfer_complete,
@@ -968,6 +969,8 @@ static int cqspi_indirect_write_execute(reinit_completion (&cqspi->transfer_complete);writel (CQSPI_REG_INDIRECTWR_START_MASK , reg_base +CQSPI_REG_INDIRECTWR ); +readl (reg_base +CQSPI_REG_INDIRECTWR );/* Flush posted write. */ +/* * As per 66AK2G02 TRM SPRUHY8F section 11.15.5.3 Indirect Access * Controller programming sequence, couple of cycles of
Greg Kroah-Hartman
maintainerPATCH 120/168 spi: cadence-quadspi: Flush posted register writes before DAC access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
commit 1ad55767e77a853c98752ed1e33b68049a243bd7 upstream.
cqspi_read_setup() and cqspi_write_setup() program the address width as the last step in the setup. This is likely to be immediately followed by a DAC region read/write. On TI K3 SoCs the DAC region is on a different endpoint from the register region. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level. It is possible that the DAC read/write goes through before the address width update goes through. In this situation if the previous command used a different address width the OSPI command is sent with the wrong number of address bytes, resulting in an invalid command and undefined behavior.
Read back the size register to make sure the write gets flushed before accessing the DAC region.
Message-ID: <[email protected]>
--- drivers/spi/spi-cadence-quadspi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-cadence-quadspi.c +2 -0
@@ -655,6 +655,7 @@ static int cqspi_read_setup(struct cqspi reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK ; reg |= (op->addr.nbytes -1 );writel (reg, reg_base +CQSPI_REG_SIZE ); +readl (reg_base +CQSPI_REG_SIZE );/* Flush posted write. */ return 0 ; }
@@ -944,6 +945,7 @@ static int cqspi_write_setup(struct cqsp reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK ; reg |= (op->addr.nbytes -1 );writel (reg, reg_base +CQSPI_REG_SIZE ); +readl (reg_base +CQSPI_REG_SIZE );/* Flush posted write. */ return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 121/168 x86/umip: Check that the instruction opcode is at least two bytes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 32278c677947ae2f042c9535674a7fff9a245dd3 upstream.
When checking for a potential UMIP violation on #GP, verify the decoder found at least two opcode bytes to avoid false positives when the kernel encounters an unknown instruction that starts with 0f. Because the array of opcode.bytes is zero-initialized by insn_init(), peeking at bytes[1] will misinterpret garbage as a potential SLDT or STR instruction, and can incorrectly trigger emulation.
E.g. if a VPALIGNR instruction
62 83 c5 05 0f 08 ff vpalignr xmm17{k5},xmm23,XMMWORD PTR [r8],0xff
hits a #GP, the kernel emulates it as STR and squashes the #GP (and corrupts the userspace code stream).
Arguably the check should look for exactly two bytes, but no three byte opcodes use '0f 00 xx' or '0f 01 xx' as an escape, i.e. it should be impossible to get a false positive if the first two opcode bytes match '0f 00' or '0f 01'. Go with a more conservative check with respect to the existing code to minimize the chances of breaking userspace, e.g. due to decoder weirdness.
Analyzed by Nick Bray <[email protected]>.
--- arch/x86/kernel/umip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/umip.c +2 -2
@@ -156,8 +156,8 @@ static int identify_insn(struct insn *inif (!insn->modrm.nbytes)return -EINVAL ; -/* All the instructions of interest start with 0x0f. */ -if (insn->opcode.bytes[0 ] !=0xf ) +/* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */ +if (insn->opcode.nbytes <2 || insn->opcode.bytes[0 ] !=0xf )return -EINVAL ;if (insn->opcode.bytes[1 ] ==0x1 ) {
Greg Kroah-Hartman
maintainerPATCH 122/168 x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 27b1fd62012dfe9d3eb8ecde344d7aa673695ecf upstream.
Filter out the register forms of 0F 01 when determining whether or not to emulate in response to a potential UMIP violation #GP, as SGDT and SIDT only accept memory operands. The register variants of 0F 01 are used to encode instructions for things like VMX and SGX, i.e. not checking the Mod field would cause the kernel to incorrectly emulate on #GP, e.g. due to a CPL violation on VMLAUNCH.
--- arch/x86/kernel/umip.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kernel/umip.c +11 -0
@@ -163,8 +163,19 @@ static int identify_insn(struct insn *inif (insn->opcode.bytes[1 ] ==0x1 ) {switch (X86_MODRM_REG (insn->modrm.value)) {case 0 : +/* The reg form of 0F 01 /0 encodes VMX instructions. */ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SGDT ;case 1 : +/* +* The reg form of 0F 01 /1 encodes MONITOR/MWAIT, +* STAC/CLAC, and ENCLS. +*/ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SIDT ;case 4 :return UMIP_INST_SMSW ;
Greg Kroah-Hartman
maintainerPATCH 123/168 selftests: mptcp: join: validate C-flag + def limit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 008385efd05e04d8dff299382df2e8be0f91d8a0 upstream.
The previous commit adds an exception for the C-flag case. The 'mptcp_join.sh' selftest is extended to validate this case.
In this subtest, there is a typical CDN deployment with a client where MPTCP endpoints have been 'automatically' configured:
- the server set net.mptcp.allow_join_initial_addr_port=0
- the client has multiple 'subflow' endpoints, and the default limits:
not accepting ADD_ADDRs.
Without the parent patch, the client is not able to establish new subflows using its 'subflow' endpoints. The parent commit fixes that.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +11 -0
@@ -3024,6 +3024,17 @@ deny_join_id0_tests() run_tests $ns1 $ns2 10.0.1.1 chk_join_nr 1 1 1 fi + + # default limits, server deny join id 0 + signal + if reset_with_allow_join_id0 "default limits, server deny join id 0" 0 1; then + pm_nl_set_limits $ns1 0 2 + pm_nl_set_limits $ns2 0 2 + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal + pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow + pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 2 2 2 + fi } fullmesh_tests()
Greg Kroah-Hartman
maintainerPATCH 124/168 wifi: ath11k: HAL SRNG: dont deinitialize and re-initialize again
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
commit 32be3ca4cf78b309dfe7ba52fe2d7cc3c23c5634 upstream.
Don't deinitialize and reinitialize the HAL helpers. The dma memory is deallocated and there is high possibility that we'll not be able to get the same memory allocated from dma when there is high memory pressure.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.6
--- drivers/net/wireless/ath/ath11k/core.c | 6 +----- drivers/net/wireless/ath/ath11k/hal.c | 16 ++++++++++++++++ drivers/net/wireless/ath/ath11k/hal.h | 1 + 3 files changed, 18 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +1 -5
@@ -1596,14 +1596,10 @@ static int ath11k_core_reconfigure_on_crmutex_unlock (&ab->core_lock);ath11k_dp_free (ab); -ath11k_hal_srng_deinit (ab); +ath11k_hal_srng_clear (ab); ab->free_vdev_map = (1LL << (ab->num_radios *TARGET_NUM_VDEVS (ab))) -1 ; - ret =ath11k_hal_srng_init (ab); -if (ret) -return ret; -clear_bit (ATH11K_FLAG_CRASH_FLUSH , &ab->dev_flags); ret =ath11k_core_qmi_firmware_ready (ab);
drivers/net/wireless/ath/ath11k/hal.c +16 -0
@@ -1351,6 +1351,22 @@ void ath11k_hal_srng_deinit(struct ath11 }EXPORT_SYMBOL (ath11k_hal_srng_deinit); +void ath11k_hal_srng_clear (struct ath11k_base *ab) +{ +/* No need to memset rdp and wrp memory since each individual +* segment would get cleared in ath11k_hal_srng_src_hw_init() +* and ath11k_hal_srng_dst_hw_init(). +*/ +memset (ab->hal.srng_list,0 , +sizeof (ab->hal.srng_list)); +memset (ab->hal.shadow_reg_addr,0 , +sizeof (ab->hal.shadow_reg_addr)); + ab->hal.avail_blk_resource =0 ; + ab->hal.current_blk_index =0 ; + ab->hal.num_shadow_reg_configured =0 ; +} +EXPORT_SYMBOL (ath11k_hal_srng_clear); +void ath11k_hal_dump_srng_stats (struct ath11k_base *ab) {struct hal_srng *srng;
drivers/net/wireless/ath/ath11k/hal.h +1 -0
@@ -957,6 +957,7 @@ int ath11k_hal_srng_setup(struct ath11k_ struct hal_srng_params *params);int ath11k_hal_srng_init (struct ath11k_base *ath11k);void ath11k_hal_srng_deinit (struct ath11k_base *ath11k); +void ath11k_hal_srng_clear (struct ath11k_base *ab);void ath11k_hal_dump_srng_stats (struct ath11k_base *ab);void ath11k_hal_srng_get_shadow_config (struct ath11k_base *ab,u32 **cfg,u32 *len);
Greg Kroah-Hartman
maintainerPATCH 125/168 mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 6a204d4b14c99232e05d35305c27ebce1c009840 upstream.
Commit 524c48072e56 ("mm/page_alloc: rename ALLOC_HIGH to ALLOC_MIN_RESERVE") is the start of a series that explains how __GFP_HIGH, which implies ALLOC_MIN_RESERVE, is going to be used instead of __GFP_ATOMIC for high atomic reserves.
Commit eb2e2b425c69 ("mm/page_alloc: explicitly record high-order atomic allocations in alloc_flags") introduced ALLOC_HIGHATOMIC for such allocations of order higher than 0. It still used __GFP_ATOMIC, though.
Then, commit 1ebbb21811b7 ("mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations accesses reserves") just turned that check for !__GFP_DIRECT_RECLAIM, ignoring that high atomic reserves were expected to test for __GFP_HIGH.
This leads to high atomic reserves being added for high-order GFP_NOWAIT allocations and others that clear __GFP_DIRECT_RECLAIM, which is unexpected. Later, those reserves lead to 0-order allocations going to the slow path and starting reclaim.
Quoted 1 line
From
/proc/pagetypeinfo, without the patch:
Node 0, zone DMA, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone DMA32, type HighAtomic 1 8 10 9 7 3 0 0 0 0 0 Node 0, zone Normal, type HighAtomic 64 20 12 5 0 0 0 0 0 0 0
With the patch:
Node 0, zone DMA, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone DMA32, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone Normal, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0
--- mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/page_alloc.c +1 -1
@@ -4887,7 +4887,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask, unsigif (!(gfp_mask & __GFP_NOMEMALLOC)) { alloc_flags |=ALLOC_NON_BLOCK ; -if (order >0 ) +if (order >0 && (alloc_flags &ALLOC_MIN_RESERVE )) alloc_flags |=ALLOC_HIGHATOMIC ; }
Greg Kroah-Hartman
maintainerPATCH 126/168 mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
commit b322e88b3d553e85b4e15779491c70022783faa4 upstream.
Optimize hugetlb_pages_alloc_boot() to return immediately when max_huge_pages is 0, avoiding unnecessary CPU cycles and the below log message when hugepages aren't configured in the kernel command line.
[ 3.702280] HugeTLB: allocation took 0ms with hugepage_allocation_threads=32
--- mm/hugetlb.c | 3 +++ 1 file changed, 3 insertions(+)
mm/hugetlb.c +3 -0
@@ -3324,6 +3324,9 @@ static void __init hugetlb_hstate_alloc_return ; } +if (!h->max_huge_pages) +return ; +/* do node specific alloc */ for_each_online_node (i) {if (h->max_huge_pages_node[i] >0 ) {
Greg Kroah-Hartman
maintainerPATCH 127/168 NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit ab1c282c010c4f327bd7addc3c0035fd8e3c1721 upstream.
Commit 5304877936c0 ("NFSD: Fix strncpy() fortify warning") replaced strncpy(,, sizeof(..)) with strlcpy(,, sizeof(..) - 1), but strlcpy() already guaranteed NUL-termination of the destination buffer and subtracting one byte potentially truncated the source string.
The incorrect size was then carried over in commit 72f78ae00a8e ("NFSD:
move from strlcpy with unused retval to strscpy") when switching from strlcpy() to strscpy().
Fix this off-by-one error by using the full size of the destination buffer again.
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -1334,7 +1334,7 @@ try_again:return 0 ; }if (work) { -strscpy (work->nsui_ipaddr, ipaddr,sizeof (work->nsui_ipaddr) -1 ); +strscpy (work->nsui_ipaddr, ipaddr,sizeof (work->nsui_ipaddr));refcount_set (&work->nsui_refcnt,2 ); work->nsui_busy = true;list_add_tail (&work->nsui_list, &nn->nfsd_ssc_mount_list);
Greg Kroah-Hartman
maintainerPATCH 128/168 nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit a082e4b4d08a4a0e656d90c2c05da85f23e6d0c9 upstream.
When v3 NLM request finds a conflicting delegation, it triggers a delegation recall and nfsd_open fails with EAGAIN. nfsd_open then translates EAGAIN into nfserr_jukebox. In nlm_fopen, instead of returning nlm_failed for when there is a conflicting delegation, drop this NLM request so that the client retries. Once delegation is recalled and if a local lock is claimed, a retry would lead to nfsd returning a nlm_lck_blocked error or a successful nlm lock.
--- fs/nfsd/lockd.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/nfsd/lockd.c +15 -0
@@ -48,6 +48,21 @@ nlm_fopen(struct svc_rqst *rqstp, structswitch (nfserr) {case nfs_ok:return 0 ; +case nfserr_jukebox: +/* this error can indicate a presence of a conflicting +* delegation to an NLM lock request. Options are: +* (1) For now, drop this request and make the client +* retry. When delegation is returned, client's lock retry +* will complete. +* (2) NLM4_DENIED as per "spec" signals to the client +* that the lock is unavailable now but client can retry. +* Linux client implementation does not. It treats +* NLM4_DENIED same as NLM4_FAILED and errors the request. +* (3) For the future, treat this as blocked lock and try +* to callback when the delegation is returned but might +* not have a proper lock request to block on. +*/ + fallthrough;case nfserr_dropit:return nlm_drop_reply;case nfserr_stale:
Greg Kroah-Hartman
maintainerPATCH 129/168 ext4: verify orphan file size is not too big
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 0a6ce20c156442a4ce2a404747bb0fb05d54eeb3 upstream.
In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan files can lead to big amounts of memory consumed. Limit orphan file size to a sane value and also use kvmalloc() for allocating array of block descriptor structures to avoid large order allocations for sane but large orphan files.
Message-ID: <[email protected]>
--- fs/ext4/orphan.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
fs/ext4/orphan.c +12 -1
@@ -584,9 +584,20 @@ int ext4_init_orphan_info(struct super_bext4_msg (sb,KERN_ERR ,"get orphan inode failed" );return PTR_ERR (inode); } +/* +* This is just an artificial limit to prevent corrupted fs from +* consuming absurd amounts of memory when pinning blocks of orphan +* file in memory. +*/ +if (inode->i_size >8 <<20 ) { +ext4_msg (sb,KERN_ERR ,"orphan file too big: %llu" , + (unsigned long long )inode->i_size); + ret = -EFSCORRUPTED ; + goto out_put; + } oi->of_blocks = inode->i_size >> sb->s_blocksize_bits; oi->of_csum_seed =EXT4_I (inode)->i_csum_seed; - oi->of_binfo =kmalloc_array (oi->of_blocks, + oi->of_binfo =kvmalloc_array (oi->of_blocks,sizeof (struct ext4_orphan_block ),GFP_KERNEL );if (!oi->of_binfo) {
Greg Kroah-Hartman
maintainerPATCH 130/168 ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Sun <[email protected]>
commit 9d80eaa1a1d37539224982b76c9ceeee736510b9 upstream.
After running a stress test combined with fault injection, we performed fsck -a followed by fsck -fn on the filesystem image. During the second pass, fsck -fn reported:
Inode 131512, end of extent exceeds allowed value
(logical block 405, physical block 1180540, len 2)
This inode was not in the orphan list. Analysis revealed the following call chain that leads to the inconsistency:
ext4_da_write_end()
//does not update i_disksize
ext4_punch_hole()
//truncate folio, keep size
ext4_page_mkwrite()
ext4_block_page_mkwrite()
ext4_block_write_begin()
ext4_get_block()
//insert written extent without update i_disksizejournal commit
echo 1 > /sys/block/xxx/device/delete
da-write path updates i_size but does not update i_disksize. Then ext4_punch_hole truncates the da-folio yet still leaves i_disksize unchanged(in the ext4_update_disksize_before_punch function, the condition offset + len < size is met). Then ext4_page_mkwrite sees ext4_nonda_switch return 1 and takes the nodioread_nolock path, the folio about to be written has just been punched out, and it’s offset sits beyond the current i_disksize. This may result in a written extent being inserted, but again does not update i_disksize. If the journal gets committed and then the block device is yanked, we might run into this. It should be noted that replacing ext4_punch_hole with ext4_zero_range in the call sequence may also trigger this issue, as neither will update i_disksize under these circumstances.
To fix this, we can modify ext4_update_disksize_before_punch to increase i_disksize to min(i_size, offset + len) when both i_size and (offset + len) are greater than i_disksize.
Message-ID: <[email protected]>
--- fs/ext4/inode.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/ext4/inode.c +8 -2
@@ -3945,7 +3945,11 @@ int ext4_can_truncate(struct inode *inod* We have to make sure i_disksize gets properly updated before we truncate * page cache due to hole punching or zero range. Otherwise i_disksize update * can get lost as it may have been postponed to submission of writeback but -* that will never happen after we truncate page cache. +* that will never happen if we remove the folio containing i_size from the +* page cache. Also if we punch hole within i_size but above i_disksize, +* following ext4_page_mkwrite() may mistakenly allocate written blocks over +* the hole and thus introduce allocated blocks beyond i_disksize which is +* not allowed (e2fsck would complain in case of crash). */ int ext4_update_disksize_before_punch (struct inode *inode,loff_t offset,loff_t len)
@@ -3956,9 +3960,11 @@ int ext4_update_disksize_before_punch(stloff_t size =i_size_read (inode);WARN_ON (!inode_is_locked (inode)); -if (offset > size || offset + len < size) +if (offset > size)return 0 ; +if (offset + len < size) + size = offset + len;if (EXT4_I (inode)->i_disksize >= size)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 131/168 ext4: correctly handle queries for metadata mappings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
commit 46c22a8bb4cb03211da1100d7ee4a2005bf77c70 upstream.
Currently, our handling of metadata is _ambiguous_ in some scenarios, that is, we end up returning unknown if the range only covers the mapping partially.
For example, in the following case:
$ xfs_io -c fsmap -d
0: 254:16 [0..7]: static fs metadata 8
1: 254:16 [8..15]: special 102:1 8
2: 254:16 [16..5127]: special 102:2 5112
3: 254:16 [5128..5255]: special 102:3 128
4: 254:16 [5256..5383]: special 102:4 128
5: 254:16 [5384..70919]: inodes 65536
6: 254:16 [70920..70967]: unknown 48
...
$ xfs_io -c fsmap -d 24 33
0: 254:16 [24..39]: unknown 16 <--- incomplete reporting
$ xfs_io -c fsmap -d 24 33 (With patch)
0: 254:16 [16..5127]: special 102:2 5112
This is because earlier in ext4_getfsmap_meta_helper, we end up ignoring any extent that starts before our queried range, but overlaps it. While the man page [1] is a bit ambiguous on this, this fix makes the output make more sense since we are anyways returning an "unknown" extent. This is also consistent to how XFS does it:
$ xfs_io -c fsmap -d
...
6: 254:16 [104..127]: free space 24
7: 254:16 [128..191]: inodes 64
...
$ xfs_io -c fsmap -d 137 150
0: 254:16 [128..191]: inodes 64 <-- full extent returned
[1] https://man7.org/linux/man-pages/man2/ioctl_getfsmap.2.html
Message-ID: <023f37e35ee280cd9baac0296cbadcbe10995cab.1757058211.git.ojaswin@linux.ibm.com>
--- fs/ext4/fsmap.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/ext4/fsmap.c +9 -5
@@ -74,7 +74,8 @@ static int ext4_getfsmap_dev_compare(constatic bool ext4_getfsmap_rec_before_low_key (struct ext4_getfsmap_info *info,struct ext4_fsmap *rec) { -return rec->fmr_physical < info->gfi_low.fmr_physical; +return rec->fmr_physical + rec->fmr_length <= + info->gfi_low.fmr_physical; }/*
@@ -200,15 +201,18 @@ static int ext4_getfsmap_meta_helper(str ext4_group_first_block_no(sb, agno)); fs_end = fs_start +EXT4_C2B (sbi, len); -/* Return relevant extents from the meta_list */ +/* +* Return relevant extents from the meta_list. We emit all extents that +* partially/fully overlap with the query range +*/ list_for_each_entry_safe (p, tmp, &info->gfi_meta_list, fmr_list) { -if (p->fmr_physical < info->gfi_next_fsblk) { +if (p->fmr_physical + p->fmr_length <= info->gfi_next_fsblk) {list_del (&p->fmr_list);kfree (p);continue ; } -if (p->fmr_physical <= fs_start || - p->fmr_physical + p->fmr_length <= fs_end) { +if (p->fmr_physical <= fs_end && + p->fmr_physical + p->fmr_length > fs_start) {/* Emit the retained free extent record if present */ if (info->gfi_lastfree.fmr_owner) { error = ext4_getfsmap_helper(sb, info,
Greg Kroah-Hartman
maintainerPATCH 132/168 ext4: guard against EA inode refcount underflow in xattr update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmet Eray Karadag <[email protected]>
commit 57295e835408d8d425bef58da5253465db3d6888 upstream.
syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:
EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117
Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode().
This prevents the underflow and the follow-on orphan/cleanup churn.
Message-ID: <[email protected]>
--- fs/ext4/xattr.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
fs/ext4/xattr.c +8 -7
@@ -987,7 +987,7 @@ static int ext4_xattr_inode_update_ref(h int ref_change) {struct ext4_iloc iloc; -s64 ref_count; +u64 ref_count;int ret;inode_lock_nested (ea_inode,I_MUTEX_XATTR );
@@ -997,13 +997,17 @@ static int ext4_xattr_inode_update_ref(h goto out; ref_count =ext4_xattr_inode_get_ref (ea_inode); +if ((ref_count ==0 && ref_change <0 ) || (ref_count ==U64_MAX && ref_change >0 )) { +ext4_error_inode (ea_inode, __func__, __LINE__,0 , +"EA inode %lu ref wraparound: ref_count=%lld ref_change=%d" , + ea_inode->i_ino, ref_count, ref_change); + ret = -EFSCORRUPTED ; + goto out; + } ref_count += ref_change;ext4_xattr_inode_set_ref (ea_inode, ref_count);if (ref_change >0 ) { -WARN_ONCE (ref_count <=0 ,"EA inode %lu ref_count=%lld" , - ea_inode->i_ino, ref_count); -if (ref_count ==1 ) {WARN_ONCE (ea_inode->i_nlink,"EA inode %lu i_nlink=%u" , ea_inode->i_ino, ea_inode->i_nlink);
@@ -1012,9 +1016,6 @@ static int ext4_xattr_inode_update_ref(hext4_orphan_del (handle, ea_inode); } }else { -WARN_ONCE (ref_count <0 ,"EA inode %lu ref_count=%lld" , - ea_inode->i_ino, ref_count); -if (ref_count ==0 ) { WARN_ONCE(ea_inode->i_nlink != 1, "EA inode %lu i_nlink=%u",
Greg Kroah-Hartman
maintainerPATCH 133/168 ACPICA: Allow to skip Global Lock initialization
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit feb8ae81b2378b75a99c81d315602ac8918ed382 upstream.
Introduce acpi_gbl_use_global_lock, which allows to skip the Global Lock initialization. This is useful for systems without Global Lock (such as loong_arch), so as to avoid error messages during boot phase:
ACPI Error: Could not enable global_lock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
--- drivers/acpi/acpica/evglock.c | 4 ++++ include/acpi/acpixf.h | 6 ++++++ 2 files changed, 10 insertions(+)
drivers/acpi/acpica/evglock.c +4 -0
@@ -42,6 +42,10 @@ acpi_status acpi_ev_init_global_lock_hanreturn_ACPI_STATUS (AE_OK ); } +if (!acpi_gbl_use_global_lock) { +return_ACPI_STATUS (AE_OK ); + } +/* Attempt installation of the global lock handler */ status = acpi_install_fixed_event_handler(ACPI_EVENT_GLOBAL,
include/acpi/acpixf.h +6 -0
@@ -214,6 +214,12 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_osi_data,ACPI_INIT_GLOBAL (u8, acpi_gbl_reduced_hardware, FALSE);/* +* ACPI Global Lock is mainly used for systems with SMM, so no-SMM systems +* (such as loong_arch) may not have and not use Global Lock. +*/ +ACPI_INIT_GLOBAL (u8, acpi_gbl_use_global_lock, TRUE); + +/* * Maximum timeout for While() loop iterations before forced method abort. * This mechanism is intended to prevent infinite loops during interpreter * execution within a host kernel.
Greg Kroah-Hartman
maintainerPATCH 134/168 ext4: free orphan info with kvfree
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 971843c511c3c2f6eda96c6b03442913bfee6148 upstream.
Orphan info is now getting allocated with kvmalloc_array(). Free it with kvfree() instead of kfree() to avoid complaints from mm.
Message-ID: <[email protected]>
--- fs/ext4/orphan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/orphan.c +2 -2
@@ -513,7 +513,7 @@ void ext4_release_orphan_info(struct supreturn ;for (i =0 ; i < oi->of_blocks; i++)brelse (oi->of_binfo[i].ob_bh); -kfree (oi->of_binfo); +kvfree (oi->of_binfo); } static struct ext4_orphan_block_tail *ext4_orphan_block_tail(
@@ -638,7 +638,7 @@ int ext4_init_orphan_info(struct super_b out_free:for (i--; i >=0 ; i--)brelse (oi->of_binfo[i].ob_bh); -kfree (oi->of_binfo); +kvfree (oi->of_binfo); out_put:iput (inode);return ret;
Greg Kroah-Hartman
maintainerPATCH 135/168 lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 2f13daee2a72bb962f5fd356c3a263a6f16da965 upstream.
After commit 6f110a5e4f99 ("Disable SLUB_TINY for build testing"), which causes CONFIG_KASAN to be enabled in allmodconfig again, arm64 allmodconfig builds with clang-17 and older show an instance of -Wframe-larger-than (which breaks the build with CONFIG_WERROR=y):
lib/crypto/curve25519-hacl64.c:757:6: error: stack frame size (2336) exceeds limit (2048) in 'curve25519_generic' [-Werror,-Wframe-larger-than]
757 | void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE],
| ^When KASAN is disabled, the stack usage is roughly quartered:
lib/crypto/curve25519-hacl64.c:757:6: error: stack frame size (608) exceeds limit (128) in 'curve25519_generic' [-Werror,-Wframe-larger-than]
757 | void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE],
| ^Using '-Rpass-analysis=stack-frame-layout' shows the following variables and many, many 8-byte spills when KASAN is enabled:
Offset: [SP-144], Type: Variable, Align: 8, Size: 40
Offset: [SP-464], Type: Variable, Align: 8, Size: 320
Offset: [SP-784], Type: Variable, Align: 8, Size: 320
Offset: [SP-864], Type: Variable, Align: 32, Size: 80
Offset: [SP-896], Type: Variable, Align: 32, Size: 32
Offset: [SP-1016], Type: Variable, Align: 8, Size: 120
When KASAN is disabled, there are still spills but not at many and the variables list is smaller:
Offset: [SP-192], Type: Variable, Align: 32, Size: 80
Offset: [SP-224], Type: Variable, Align: 32, Size: 32
Offset: [SP-344], Type: Variable, Align: 8, Size: 120
Disable KASAN for this file when using clang-17 or older to avoid blowing out the stack, clearing up the warning.
--- lib/crypto/Makefile | 4 ++++ 1 file changed, 4 insertions(+)
lib/crypto/Makefile +4 -0
@@ -25,6 +25,10 @@ obj-$(CONFIG_CRYPTO_LIB_CURVE25519_GENER libcurve25519-generic-y := curve25519-fiat32.o libcurve25519-generic-$(CONFIG_ARCH_SUPPORTS_INT128) := curve25519-hacl64.o libcurve25519-generic-y += curve25519-generic.o +# clang versions prior to 18 may blow out the stack with KASAN +ifeq ($(call clang-min-version, 180000),) +KASAN_SANITIZE_curve25519-hacl64.o := n +endif obj-$(CONFIG_CRYPTO_LIB_CURVE25519) += libcurve25519.o libcurve25519-y += curve25519.o
Greg Kroah-Hartman
maintainerPATCH 136/168 ASoC: codecs: wcd934x: Simplify with dev_err_probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fa92f4294283cc7d1f29151420be9e9336182518 ]
Replace dev_err() in probe() path with dev_err_probe() to:
1. Make code a bit simpler and easier to read,
2. Do not print messages on deferred probe.
Stable-dep-of: 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
--- sound/soc/codecs/wcd934x.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-)
sound/soc/codecs/wcd934x.c +7 -12
@@ -5884,10 +5884,9 @@ static int wcd934x_codec_parse_data(struslim_get_logical_addr (wcd->sidev); wcd->if_regmap =regmap_init_slimbus (wcd->sidev, &wcd934x_ifc_regmap_config); -if (IS_ERR (wcd->if_regmap)) { -dev_err (dev,"Failed to allocate ifc register map\n" ); -return PTR_ERR (wcd->if_regmap); - } +if (IS_ERR (wcd->if_regmap)) +return dev_err_probe (dev,PTR_ERR (wcd->if_regmap), +"Failed to allocate ifc register map\n" );of_property_read_u32 (dev->parent->of_node,"qcom,dmic-sample-rate" , &wcd->dmic_sample_rate);
@@ -5939,19 +5938,15 @@ static int wcd934x_codec_probe(struct plmemcpy (wcd->tx_chs, wcd934x_tx_chs,sizeof (wcd934x_tx_chs)); irq =regmap_irq_get_virq (data->irq_data,WCD934X_IRQ_SLIMBUS ); -if (irq <0 ) { -dev_err (wcd->dev,"Failed to get SLIM IRQ\n" ); -return irq; - } +if (irq <0 ) +return dev_err_probe (wcd->dev, irq,"Failed to get SLIM IRQ\n" ); ret =devm_request_threaded_irq (dev, irq,NULL , wcd934x_slim_irq_handler,IRQF_TRIGGER_RISING |IRQF_ONESHOT ,"slim" , wcd); -if (ret) { -dev_err (dev,"Failed to request slimbus irq\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to request slimbus irq\n" );wcd934x_register_mclk_output (wcd);platform_set_drvdata (pdev, wcd);
Greg Kroah-Hartman
maintainerPATCH 137/168 ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 4e65bda8273c938039403144730923e77916a3d7 ]
wcd934x_codec_parse_data() contains a device reference count leak in of_slim_get_device() where device_find_child() increases the reference count of the device but this reference is not properly decreased in the success path. Add put_device() in wcd934x_codec_parse_data() and add devm_add_action_or_reset() in the probe function, which ensures that the reference count of the device is correctly managed.
Memory leak in regmap_init_slimbus() as the allocated regmap is not released when the device is removed. Using devm_regmap_init_slimbus() instead of regmap_init_slimbus() to ensure automatic regmap cleanup on device removal.
Calling path: of_slim_get_device() -> of_find_slim_device() -> device_find_child(). As comment of device_find_child() says, 'NOTE:
you will need to drop the reference with put_device() after use.'.
Found by code review.
--- sound/soc/codecs/wcd934x.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
sound/soc/codecs/wcd934x.c +15 -2
@@ -5862,6 +5862,13 @@ static const struct snd_soc_component_dr .endianness = 1, }; +static void wcd934x_put_device_action (void *data) +{ +struct device *dev = data; + +put_device (dev); +} +static int wcd934x_codec_parse_data (struct wcd934x_codec *wcd) {struct device *dev = &wcd->sdev->dev;
@@ -5882,11 +5889,13 @@ static int wcd934x_codec_parse_data(stru }slim_get_logical_addr (wcd->sidev); - wcd->if_regmap =regmap_init_slimbus (wcd->sidev, + wcd->if_regmap =devm_regmap_init_slimbus (wcd->sidev, &wcd934x_ifc_regmap_config); -if (IS_ERR (wcd->if_regmap)) +if (IS_ERR (wcd->if_regmap)) { +put_device (&wcd->sidev->dev);return dev_err_probe (dev,PTR_ERR (wcd->if_regmap),"Failed to allocate ifc register map\n" ); + }of_property_read_u32 (dev->parent->of_node,"qcom,dmic-sample-rate" , &wcd->dmic_sample_rate);
@@ -5930,6 +5939,10 @@ static int wcd934x_codec_probe(struct plreturn ret; } + ret =devm_add_action_or_reset (dev, wcd934x_put_device_action, &wcd->sidev->dev); +if (ret) +return ret; +/* set default rate 9P6MHz */ regmap_update_bits(wcd->regmap, WCD934X_CODEC_RPM_CLK_MCLK_CFG, WCD934X_CODEC_RPM_CLK_MCLK_CFG_MCLK_MASK,
Greg Kroah-Hartman
maintainerPATCH 138/168 KVM: x86: Dont (re)check L1 intercepts when completing userspace I/O
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit e750f85391286a4c8100275516973324b621a269 ]
When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access.
Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP.
The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction.
WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>
--- arch/x86/kvm/emulate.c | 11 ++++------- arch/x86/kvm/kvm_emulate.h | 2 +- arch/x86/kvm/x86.c | 9 ++++++++- 3 files changed, 13 insertions(+), 9 deletions(-)
arch/x86/kvm/emulate.c +4 -7
@@ -5478,12 +5478,11 @@ void init_decode_cache(struct x86_emulat ctxt->mem_read.end =0 ; } -int x86_emulate_insn (struct x86_emulate_ctxt *ctxt) +int x86_emulate_insn (struct x86_emulate_ctxt *ctxt,bool check_intercepts) {const struct x86_emulate_ops *ops = ctxt->ops;int rc =X86EMUL_CONTINUE ;int saved_dst_type = ctxt->dst.type; -unsigned emul_flags; ctxt->mem_read.pos =0 ;
@@ -5497,8 +5496,6 @@ int x86_emulate_insn(struct x86_emulate_ rc =emulate_ud (ctxt); goto done; } - - emul_flags = ctxt->ops->get_hflags (ctxt);if (unlikely (ctxt->d & (No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) { if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) ||
@@ -5532,7 +5529,7 @@ int x86_emulate_insn(struct x86_emulate_fetch_possible_mmx_operand (&ctxt->dst); } -if (unlikely (emul_flags &X86EMUL_GUEST_MASK ) && ctxt->intercept) { +if (unlikely (check_intercepts) && ctxt->intercept) { rc =emulator_check_intercept (ctxt, ctxt->intercept,X86_ICPT_PRE_EXCEPT );if (rc !=X86EMUL_CONTINUE )
@@ -5561,7 +5558,7 @@ int x86_emulate_insn(struct x86_emulate_ goto done; } -if (unlikely (emul_flags &X86EMUL_GUEST_MASK ) && (ctxt->d & Intercept)) { +if (unlikely (check_intercepts) && (ctxt->d & Intercept)) { rc =emulator_check_intercept (ctxt, ctxt->intercept,X86_ICPT_POST_EXCEPT );if (rc !=X86EMUL_CONTINUE )
@@ -5615,7 +5612,7 @@ int x86_emulate_insn(struct x86_emulate_ special_insn: -if (unlikely (emul_flags &X86EMUL_GUEST_MASK ) && (ctxt->d & Intercept)) { +if (unlikely (check_intercepts) && (ctxt->d & Intercept)) { rc =emulator_check_intercept (ctxt, ctxt->intercept,X86_ICPT_POST_MEMACCESS );if (rc !=X86EMUL_CONTINUE )
arch/x86/kvm/kvm_emulate.h +1 -1
@@ -517,7 +517,7 @@ bool x86_page_table_writing_insn(struct#define EMULATION_RESTART 1#define EMULATION_INTERCEPTED 2void init_decode_cache (struct x86_emulate_ctxt *ctxt); -int x86_emulate_insn (struct x86_emulate_ctxt *ctxt); +int x86_emulate_insn (struct x86_emulate_ctxt *ctxt,bool check_intercepts);int emulator_task_switch (struct x86_emulate_ctxt *ctxt,u16 tss_selector,int idt_index,int reason,bool has_error_code,u32 error_code);
arch/x86/kvm/x86.c +8 -1
@@ -8976,7 +8976,14 @@ restart: ctxt->exception.address =0 ; } - r =x86_emulate_insn (ctxt); +/* +* Check L1's instruction intercepts when emulating instructions for +* L2, unless KVM is re-emulating a previously decoded instruction, +* e.g. to complete userspace I/O, in which case KVM has already +* checked the intercepts. +*/ + r =x86_emulate_insn (ctxt,is_guest_mode (vcpu) && + !(emulation_type &EMULTYPE_NO_DECODE ));if (r ==EMULATION_INTERCEPTED )return 1 ;
Greg Kroah-Hartman
maintainerPATCH 139/168 media: mc: Clear minor number before put device
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 8cfc8cec1b4da88a47c243a11f384baefd092a50 ]
The device minor should not be cleared after the device is released.
--- drivers/media/mc/mc-devnode.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/media/mc/mc-devnode.c +1 -5
@@ -50,11 +50,6 @@ static void media_devnode_release(struct {struct media_devnode *devnode =to_media_devnode (cd); -mutex_lock (&media_devnode_lock); -/* Mark device node number as free */ -clear_bit (devnode->minor, media_devnode_nums); -mutex_unlock (&media_devnode_lock); -/* Release media_devnode and perform other cleanups as needed. */ if (devnode->release) devnode->release (devnode);
@@ -283,6 +278,7 @@ void media_devnode_unregister(struct med/* Delete the cdev on this minor as well */ cdev_device_del (&devnode->cdev, &devnode->dev); devnode->media_dev =NULL ; +clear_bit (devnode->minor, media_devnode_nums);mutex_unlock (&media_devnode_lock);put_device (&devnode->dev);
Greg Kroah-Hartman
maintainerPATCH 140/168 Squashfs: add additional inode sanity checking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 9ee94bfbe930a1b39df53fa2d7b31141b780eb5a ]
Patch series "Squashfs: performance improvement and a sanity check".
This patchset adds an additional sanity check when reading regular file inodes, and adds support for SEEK_DATA/SEEK_HOLE lseek() whence values.
This patch (of 2):
Add an additional sanity check when reading regular file inodes.
A regular file if the file size is an exact multiple of the filesystem block size cannot have a fragment. This is because by definition a fragment block stores tailends which are not a whole block in size.
Stable-dep-of: 9f1c14c1de1b ("Squashfs: reject negative file sizes in squashfs_read_inode()")
--- fs/squashfs/inode.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
fs/squashfs/inode.c +18 -2
@@ -140,8 +140,17 @@ int squashfs_read_inode(struct inode *inif (err <0 ) goto failed_read; + inode->i_size =le32_to_cpu (sqsh_ino->file_size); frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) { +/* +* the file cannot have a fragment (tailend) and have a +* file size a multiple of the block size +*/ +if ((inode->i_size & (msblk->block_size -1 )) ==0 ) { + err = -EINVAL ; + goto failed_read; + } frag_offset =le32_to_cpu (sqsh_ino->offset); frag_size =squashfs_frag_lookup (sb, frag, &frag_blk);if (frag_size <0 ) {
@@ -155,7 +164,6 @@ int squashfs_read_inode(struct inode *in }set_nlink (inode,1 ); - inode->i_size =le32_to_cpu (sqsh_ino->file_size); inode->i_fop = &generic_ro_fops; inode->i_mode |=S_IFREG ; inode->i_blocks = ((inode->i_size -1 ) >>9 ) +1 ;
@@ -184,8 +192,17 @@ int squashfs_read_inode(struct inode *inif (err <0 ) goto failed_read; + inode->i_size =le64_to_cpu (sqsh_ino->file_size); frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) { +/* +* the file cannot have a fragment (tailend) and have a +* file size a multiple of the block size +*/ +if ((inode->i_size & (msblk->block_size -1 )) ==0 ) { + err = -EINVAL ; + goto failed_read; + } frag_offset =le32_to_cpu (sqsh_ino->offset); frag_size =squashfs_frag_lookup (sb, frag, &frag_blk);if (frag_size <0 ) {
@@ -200,7 +217,6 @@ int squashfs_read_inode(struct inode *in xattr_id =le32_to_cpu (sqsh_ino->xattr);set_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); - inode->i_size =le64_to_cpu (sqsh_ino->file_size); inode->i_op = &squashfs_inode_ops; inode->i_fop = &generic_ro_fops; inode->i_mode |=S_IFREG ;
Greg Kroah-Hartman
maintainerPATCH 141/168 Squashfs: reject negative file sizes in squashfs_read_inode()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b ]
Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.
This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.
This commit checks for a negative file size and returns EINVAL.
--- fs/squashfs/inode.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/squashfs/inode.c +4 -0
@@ -193,6 +193,10 @@ int squashfs_read_inode(struct inode *in goto failed_read; inode->i_size =le64_to_cpu (sqsh_ino->file_size); +if (inode->i_size <0 ) { + err = -EINVAL ; + goto failed_read; + } frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) {/*
Greg Kroah-Hartman
maintainerPATCH 142/168 tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <[email protected]>
[ Upstream commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f ]
There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash.
[1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000 ... [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12: 0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace: [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception+0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0
kernel/trace/trace_kprobe.c: 13080xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21, [x24,#120]include/linux/compiler.h: 2940xffff3df8995039f0 <kprobe_perf_func+0x30>: ldr x1, [x21,x0]
kernel/trace/trace_kprobe.c
1308: head = this_cpu_ptr(call->perf_events);
1309: if (hlist_empty(head))
1310: return 0;
crash> struct trace_event_call -o
struct trace_event_call {
...
[120] struct hlist_head *perf_events; //(call->perf_event)
...
}
crash> struct trace_event_call ffffaf015340e528
struct trace_event_call {
...
perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0
...
}
Race Condition Analysis:
The race occurs between kprobe activation and perf_events initialization:
CPU0 CPU1
==== ====
perf_kprobe_init
perf_trace_event_init
tp_event->perf_events = list;(1)
tp_event->class->reg (2)← KPROBE ACTIVE
Debug exception triggers
...
kprobe_dispatcher
kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE)
head = this_cpu_ptr(call->perf_events)(3)
(perf_events is still NULL)Problem:
1. CPU0 executes (1) assigning tp_event->perf_events = list
2. CPU0 executes (2) enabling kprobe functionality via class->reg()
3. CPU1 triggers and reaches kprobe_dispatcher
4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
5. CPU1 calls kprobe_perf_func() and crashes at (3) because call->perf_events is still NULL
CPU1 sees that kprobe functionality is enabled but does not see that perf_events has been assigned.
Add pairing read and write memory barriers to guarantee that if CPU1 sees that kprobe functionality is enabled, it must also see that perf_events has been assigned.
--- kernel/trace/trace_kprobe.c | 11 +++++++---- kernel/trace/trace_probe.h | 9 +++++++-- kernel/trace/trace_uprobe.c | 13 +++++++++---- 3 files changed, 23 insertions(+), 10 deletions(-)
kernel/trace/trace_kprobe.c +7 -4
@@ -1715,14 +1715,15 @@ static int kprobe_register(struct trace_static int kprobe_dispatcher (struct kprobe *kp,struct pt_regs *regs) { struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp); +unsigned int flags =trace_probe_load_flag (&tk->tp);int ret =0 ;raw_cpu_inc (*tk->nhit); -if (trace_probe_test_flag (&tk->tp,TP_FLAG_TRACE )) +if (flags &TP_FLAG_TRACE )kprobe_trace_func (tk, regs);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tk->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE ) ret =kprobe_perf_func (tk, regs);#endif return ret;
@@ -1734,6 +1735,7 @@ kretprobe_dispatcher(struct kretprobe_in {struct kretprobe *rp =get_kretprobe (ri);struct trace_kprobe *tk; +unsigned int flags;/* * There is a small chance that get_kretprobe(ri) returns NULL when
@@ -1746,10 +1748,11 @@ kretprobe_dispatcher(struct kretprobe_in tk = container_of(rp, struct trace_kprobe, rp);raw_cpu_inc (*tk->nhit); -if (trace_probe_test_flag (&tk->tp,TP_FLAG_TRACE )) + flags =trace_probe_load_flag (&tk->tp); +if (flags &TP_FLAG_TRACE )kretprobe_trace_func (tk, ri, regs);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tk->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE )kretprobe_perf_func (tk, ri, regs);#endif return 0 ;/* We don't tweak kernel, so just return 0 */
kernel/trace/trace_probe.h +7 -2
@@ -257,16 +257,21 @@ struct event_file_link {struct list_head list; }; +static inline unsigned int trace_probe_load_flag (struct trace_probe *tp) +{ +return smp_load_acquire (&tp->event->flags); +} +static inline bool trace_probe_test_flag (struct trace_probe *tp,unsigned int flag) { -return !!(tp->event->flags & flag); +return !!(trace_probe_load_flag (tp) & flag); }static inline void trace_probe_set_flag (struct trace_probe *tp,unsigned int flag) { - tp->event->flags |= flag; +smp_store_release (&tp->event->flags, tp->event->flags | flag); } static inline void trace_probe_clear_flag(struct trace_probe *tp,
kernel/trace/trace_uprobe.c +9 -4
@@ -1497,6 +1497,7 @@ static int uprobe_dispatcher(struct uprostruct trace_uprobe *tu;struct uprobe_dispatch_data udd;struct uprobe_cpu_buffer *ucb; +unsigned int flags;int ret =0 ; tu = container_of(con, struct trace_uprobe, consumer);
@@ -1512,11 +1513,12 @@ static int uprobe_dispatcher(struct upro ucb =prepare_uprobe_buffer (tu, regs); -if (trace_probe_test_flag (&tu->tp,TP_FLAG_TRACE )) + flags =trace_probe_load_flag (&tu->tp); +if (flags &TP_FLAG_TRACE ) ret |=uprobe_trace_func (tu, regs, ucb);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tu->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE ) ret |=uprobe_perf_func (tu, regs, ucb);#endif uprobe_buffer_put (ucb);
@@ -1529,6 +1531,7 @@ static int uretprobe_dispatcher(struct ustruct trace_uprobe *tu;struct uprobe_dispatch_data udd;struct uprobe_cpu_buffer *ucb; +unsigned int flags; tu = container_of(con, struct trace_uprobe, consumer);
@@ -1541,11 +1544,13 @@ static int uretprobe_dispatcher(struct ureturn 0 ; ucb =prepare_uprobe_buffer (tu, regs); -if (trace_probe_test_flag (&tu->tp,TP_FLAG_TRACE )) + + flags =trace_probe_load_flag (&tu->tp); +if (flags &TP_FLAG_TRACE )uretprobe_trace_func (tu, func, regs, ucb);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tu->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE )uretprobe_perf_func (tu, func, regs, ucb);#endif uprobe_buffer_put (ucb);
Greg Kroah-Hartman
maintainerPATCH 143/168 ksmbd: add max ip connections parameter
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit d8b6dc9256762293048bf122fc11c4e612d0ef5d ]
This parameter set the maximum number of connections per ip address. The default is 8.
--- fs/smb/server/ksmbd_netlink.h | 5 +++-- fs/smb/server/server.h | 1 + fs/smb/server/transport_ipc.c | 3 +++ fs/smb/server/transport_tcp.c | 27 ++++++++++++++++----------- 4 files changed, 23 insertions(+), 13 deletions(-)
fs/smb/server/ksmbd_netlink.h +3 -2
@@ -107,10 +107,11 @@ struct ksmbd_startup_request {__u32 smb2_max_credits;/* MAX credits */ __u32 smbd_max_io_size;/* smbd read write size */ __u32 max_connections;/* Number of maximum simultaneous connections */ -__u32 reserved[126 ];/* Reserved room */ +__u32 max_ip_connections;/* Number of maximum connection per ip address */ +__u32 reserved[125 ];/* Reserved room */ __u32 ifc_list_sz;/* interfaces list size */ __s8 ____payload[]; -}; +} __packed;#define KSMBD_STARTUP_CONFIG_INTERFACES (s) ((s)->____payload)
fs/smb/server/server.h +1 -0
@@ -42,6 +42,7 @@ struct ksmbd_server_config {struct smb_sid domain_sid;unsigned int auth_mechs;unsigned int max_connections; +unsigned int max_ip_connections;char *conf[SERVER_CONF_WORK_GROUP +1 ]; };
fs/smb/server/transport_ipc.c +3 -0
@@ -318,6 +318,9 @@ static int ipc_server_config_on_startup(if (req->max_connections) server_conf.max_connections = req->max_connections; +if (req->max_ip_connections) + server_conf.max_ip_connections = req->max_ip_connections; + ret =ksmbd_set_netbios_name (req->netbios_name); ret |=ksmbd_set_server_string (req->server_string); ret |=ksmbd_set_work_group (req->work_group);
fs/smb/server/transport_tcp.c +16 -11
@@ -236,6 +236,7 @@ static int ksmbd_kthread_fn(void *p)struct interface *iface = (struct interface *)p;struct ksmbd_conn *conn;int ret; +unsigned int max_ip_conns;while (!kthread_should_stop ()) {mutex_lock (&iface->sock_release_lock);
@@ -253,34 +254,38 @@ static int ksmbd_kthread_fn(void *p)continue ; } +if (!server_conf.max_ip_connections) + goto skip_max_ip_conns_limit; +/* * Limits repeated connections from clients with the same IP. */ + max_ip_conns =0 ;down_read (&conn_list_lock); - list_for_each_entry(conn, &conn_list, conns_list) +list_for_each_entry (conn, &conn_list, conns_list) {#if IS_ENABLED (CONFIG_IPV6 )if (client_sk->sk->sk_family ==AF_INET6 ) {if (memcmp (&client_sk->sk->sk_v6_daddr, - &conn->inet6_addr,16 ) ==0 ) { - ret = -EAGAIN ; -break ; - } + &conn->inet6_addr,16 ) ==0 ) + max_ip_conns++; }else if (inet_sk (client_sk->sk)->inet_daddr == - conn->inet_addr) { - ret = -EAGAIN ; -break ; - } + conn->inet_addr) + max_ip_conns++;#else if (inet_sk (client_sk->sk)->inet_daddr == - conn->inet_addr) { + conn->inet_addr) + max_ip_conns++; +#endif +if (server_conf.max_ip_connections <= max_ip_conns) { ret = -EAGAIN ;break ; } -#endif + }up_read (&conn_list_lock);if (ret == -EAGAIN )continue ; +skip_max_ip_conns_limit:if (server_conf.max_connections &&atomic_inc_return (&active_num_conn) >= server_conf.max_connections) { pr_info_ratelimited("Limit the maximum number of connections(%u)\n",
Greg Kroah-Hartman
maintainerPATCH 144/168 PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jiang <[email protected]>
[ Upstream commit 9b80bdb10aee04ce7289896e6bdad13e33972636 ]
Remove a surplus return statement from the void function that has been added in the commit commit 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities").
Especially, as an empty return statements at the end of a void functions serve little purpose.
This fixes the following checkpatch.pl script warning:
WARNING: void function return statements are not generally useful #296: FILE: drivers/pci/endpoint/functions/pci-epf-test.c:296:
+ return;
+}
Stable-dep-of: 85afa9ea122d ("PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release")
--- drivers/pci/endpoint/functions/pci-epf-test.c | 2 -- 1 file changed, 2 deletions(-)
drivers/pci/endpoint/functions/pci-epf-test.c +0 -2
@@ -291,8 +291,6 @@ static void pci_epf_test_clean_dma_chan(dma_release_channel (epf_test->dma_chan_rx); epf_test->dma_chan_rx =NULL ; - -return ; } static void pci_epf_test_print_rate(const char *ops, u64 size,
Greg Kroah-Hartman
maintainerPATCH 145/168 PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 85afa9ea122dd9d4a2ead104a951d318975dcd25 ]
The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be NULL even after EPF initialization. Then it is prudent to check that they have non-NULL values before releasing the channels. Add the checks in pci_epf_test_clean_dma_chan().
Without the checks, NULL pointer dereferences happen and they can lead to a kernel panic in some cases:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Call trace: dma_release_channel+0x2c/0x120 (P) pci_epf_test_epc_deinit+0x94/0xc0 [pci_epf_test] pci_epc_deinit_notify+0x74/0xc0 tegra_pcie_ep_pex_rst_irq+0x250/0x5d8 irq_thread_fn+0x34/0xb8 irq_thread+0x18c/0x2e8 kthread+0x14c/0x210 ret_from_fork+0x10/0x20
--- drivers/pci/endpoint/functions/pci-epf-test.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/pci/endpoint/functions/pci-epf-test.c +11 -6
@@ -282,15 +282,20 @@ static void pci_epf_test_clean_dma_chan(if (!epf_test->dma_supported)return ; -dma_release_channel (epf_test->dma_chan_tx); -if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) { +if (epf_test->dma_chan_tx) { +dma_release_channel (epf_test->dma_chan_tx); +if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) { + epf_test->dma_chan_tx =NULL ; + epf_test->dma_chan_rx =NULL ; +return ; + } epf_test->dma_chan_tx =NULL ; - epf_test->dma_chan_rx =NULL ; -return ; } -dma_release_channel (epf_test->dma_chan_rx); - epf_test->dma_chan_rx =NULL ; +if (epf_test->dma_chan_rx) { +dma_release_channel (epf_test->dma_chan_rx); + epf_test->dma_chan_rx =NULL ; + } } static void pci_epf_test_print_rate(const char *ops, u64 size,
Greg Kroah-Hartman
maintainerPATCH 146/168 mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 70e997e0107e5ed85c1a3ef2adfccbe351c29d71 ]
The max_register = 128 setting in the regmap config is not valid.
The Intel Dollar Cove TI PMIC has an eeprom unlock register at address 0x88 and a number of EEPROM registers at 0xF?. Increase max_register to 0xff so that these registers can be accessed.
Stable-dep-of: 64e0d839c589 ("mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag")
--- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/intel_soc_pmic_chtdc_ti.c +1 -1
@@ -81,7 +81,7 @@ static struct mfd_cell chtdc_ti_dev[] =static const struct regmap_config chtdc_ti_regmap_config = { .reg_bits =8 , .val_bits =8 , - .max_register =128 , + .max_register =0xff , .cache_type =REGCACHE_NONE , };
Greg Kroah-Hartman
maintainerPATCH 147/168 mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 9eb99c08508714906db078b5efbe075329a3fb06 ]
REGCACHE_NONE is the default type of the cache when not provided. Drop unneeded explicit assignment to it.
Note, it's defined to 0, and if ever be redefined, it will break literally a lot of the drivers, so it very unlikely to happen.
Stable-dep-of: 64e0d839c589 ("mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag")
--- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 1 - 1 file changed, 1 deletion(-)
drivers/mfd/intel_soc_pmic_chtdc_ti.c +0 -1
@@ -82,7 +82,6 @@ static const struct regmap_config chtdc_ .reg_bits = 8, .val_bits = 8, .max_register = 0xff, - .cache_type = REGCACHE_NONE, };static const struct regmap_irq chtdc_ti_irqs[] = {
Greg Kroah-Hartman
maintainerPATCH 148/168 mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 64e0d839c589f4f2ecd2e3e5bdb5cee6ba6bade9 ]
Testing has shown that reading multiple registers at once (for 10-bit ADC values) does not work. Set the use_single_read regmap_config flag to make regmap split these for us.
This should fix temperature opregion accesses done by drivers/acpi/pmic/intel_pmic_chtdc_ti.c and is also necessary for the upcoming drivers for the ADC and battery MFD cells.
--- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mfd/intel_soc_pmic_chtdc_ti.c +2 -0
@@ -82,6 +82,8 @@ static const struct regmap_config chtdc_ .reg_bits = 8, .val_bits = 8, .max_register = 0xff, + /* The hardware does not support reading multiple registers at once */ + .use_single_read = true, };static const struct regmap_irq chtdc_ti_irqs[] = {
Greg Kroah-Hartman
maintainerPATCH 149/168 btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 7b26da407420e5054e3f06c5d13271697add9423 ]
[BUG]
With my local branch to enable bs > ps support for btrfs, sometimes I hit the following ASSERT() inside submit_one_sector():
ASSERT(block_start != EXTENT_MAP_HOLE);
Please note that it's not yet possible to hit this ASSERT() in the wild yet, as it requires btrfs bs > ps support, which is not even in the development branch.
But on the other hand, there is also a very low chance to hit above ASSERT() with bs < ps cases, so this is an existing bug affect not only the incoming bs > ps support but also the existing bs < ps support.
[CAUSE]
Firstly that ASSERT() means we're trying to submit a dirty block but without a real extent map nor ordered extent map backing it.
Furthermore with extra debugging, the folio triggering such ASSERT() is always larger than the fs block size in my bs > ps case.
(8K block size, 4K page size)
After some more debugging, the ASSERT() is trigger by the following sequence:
extent_writepage()
| We got a 32K folio (4 fs blocks) at file offset 0, and the fs block
| size is 8K, page size is 4K.
| And there is another 8K folio at file offset 32K, which is also
| dirty.
| So the filemap layout looks like the following:
|
| "||" is the filio boundary in the filemap.
| "//| is the dirty range.
|
| 0 8K 16K 24K 32K 40K
| |////////| |//////////////////////||////////|
|
|- writepage_delalloc()
| |- find_lock_delalloc_range() for [0, 8K)
| | Now range [0, 8K) is properly locked.
| |
| |- find_lock_delalloc_range() for [16K, 40K)
| | |- btrfs_find_delalloc_range() returned range [16K, 40K)
| | |- lock_delalloc_folios() locked folio 0 successfully
| | |
| | | The filemap range [32K, 40K) got dropped from filemap.
| | |
| | |- lock_delalloc_folios() failed with -EAGAIN on folio 32K
| | | As the folio at 32K is dropped.
| | |
| | |- loops = 1;
| | |- max_bytes = PAGE_SIZE;
| | |- goto again;
| | | This will re-do the lookup for dirty delalloc ranges.
| | |
| | |- btrfs_find_delalloc_range() called with @max_bytes == 4K
| | | This is smaller than block size, so
| | | btrfs_find_delalloc_range() is unable to return any range.
| | \- return false;
| |
| \- Now only range [0, 8K) has an OE for it, but for dirty range
| [16K, 32K) it's dirty without an OE.
| This breaks the assumption that writepage_delalloc() will find
| and lock all dirty ranges inside the folio.
|
|- extent_writepage_io()
|- submit_one_sector() for [0, 8K)
| Succeeded
|
|- submit_one_sector() for [16K, 24K) Triggering the ASSERT(), as there is no OE, and the original extent map is a hole.
Please note that, this also exposed the same problem for bs < ps support. E.g. with 64K page size and 4K block size.
If we failed to lock a folio, and falls back into the "loops = 1;" branch, we will re-do the search using 64K as max_bytes. Which may fail again to lock the next folio, and exit early without handling all dirty blocks inside the folio.
[FIX]
Instead of using the fixed size PAGE_SIZE as @max_bytes, use @sectorsize, so that we are ensured to find and lock any remaining blocks inside the folio.
And since we're here, add an extra ASSERT() to
before calling btrfs_find_delalloc_range() to make sure the @max_bytes is at least no smaller than a block to avoid false negative.
--- fs/btrfs/extent_io.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/btrfs/extent_io.c +11 -3
@@ -415,6 +415,13 @@ again:/* step one, find a bunch of delalloc bytes starting at start */ delalloc_start = *start; delalloc_end =0 ; + +/* +* If @max_bytes is smaller than a block, btrfs_find_delalloc_range() can +* return early without handling any dirty ranges. +*/ +ASSERT (max_bytes >= fs_info->sectorsize); + found =btrfs_find_delalloc_range (tree, &delalloc_start, &delalloc_end, max_bytes, &cached_state);if (!found || delalloc_end <= *start || delalloc_start > orig_end) {
@@ -445,13 +452,14 @@ again: delalloc_start, delalloc_end);ASSERT (!ret || ret == -EAGAIN );if (ret == -EAGAIN ) { -/* some of the pages are gone, lets avoid looping by -* shortening the size of the delalloc range we're searching +/* +* Some of the pages are gone, lets avoid looping by +* shortening the size of the delalloc range we're searching. */ free_extent_state (cached_state); cached_state =NULL ;if (!loops) { - max_bytes =PAGE_SIZE ; + max_bytes = fs_info->sectorsize; loops =1 ; goto again; }else {
Greg Kroah-Hartman
maintainerPATCH 150/168 rseq: Protect event mask against membarrier IPI
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 6eb350a2233100a283f882c023e5ad426d0ed63b ]
rseq_need_restart() reads and clears task::rseq_event_mask with preemption disabled to guard against the scheduler.
But membarrier() uses an IPI and sets the PREEMPT bit in the event mask from the IPI, which leaves that RMW operation unprotected.
Use guard(irq) if CONFIG_MEMBARRIER is enabled to fix that.
--- include/linux/sched.h | 11 ++++++++--- kernel/rseq.c | 10 +++++----- 2 files changed, 13 insertions(+), 8 deletions(-)
include/linux/sched.h +8 -3
@@ -2313,6 +2313,12 @@ enum rseq_event_mask { RSEQ_EVENT_MIGRATE = (1U << RSEQ_EVENT_MIGRATE_BIT), }; +#ifdef CONFIG_MEMBARRIER +# define RSEQ_EVENT_GUARD irq +#else +# define RSEQ_EVENT_GUARD preempt +#endif +static inline void rseq_set_notify_resume (struct task_struct *t) {if (t->rseq)
@@ -2331,9 +2337,8 @@ static inline void rseq_handle_notify_restatic inline void rseq_signal_deliver (struct ksignal *ksig,struct pt_regs *regs) { -preempt_disable (); -__set_bit (RSEQ_EVENT_SIGNAL_BIT , ¤t->rseq_event_mask); -preempt_enable (); +scoped_guard (RSEQ_EVENT_GUARD) + __set_bit(RSEQ_EVENT_SIGNAL_BIT, ¤t->rseq_event_mask);rseq_handle_notify_resume (ksig, regs); }
kernel/rseq.c +5 -5
@@ -226,12 +226,12 @@ static int rseq_need_restart(struct task/* * Load and clear event mask atomically with respect to -* scheduler preemption. +* scheduler preemption and membarrier IPIs. */ -preempt_disable (); - event_mask = t->rseq_event_mask; - t->rseq_event_mask =0 ; -preempt_enable (); +scoped_guard (RSEQ_EVENT_GUARD ) { + event_mask = t->rseq_event_mask; + t->rseq_event_mask =0 ; + }return !!event_mask; }
Greg Kroah-Hartman
maintainerPATCH 151/168 ipmi: Rework user message limit handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
commit b52da4054ee0bf9ecb44996f2c83236ff50b3812 upstream
This patch required quite a bit of work to backport due to a number of unrelated changes that do not make sense to backport. This has been run against my test suite and passes all tests.
The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free.
Restructure how this is all done to handle more in the receive message allocation routine, so all refcouting and user message limit counts are done in that routine. It's a lot cleaner and safer.
--- drivers/char/ipmi/ipmi_msghandler.c | 415 +++++++++++++++++------------------- 1 file changed, 198 insertions(+), 217 deletions(-)
drivers/char/ipmi/ipmi_msghandler.c +198 -217
@@ -39,7 +39,9 @@#define IPMI_DRIVER_VERSION "39.2" -static struct ipmi_recv_msg *ipmi_alloc_recv_msg (void ); +static struct ipmi_recv_msg *ipmi_alloc_recv_msg (struct ipmi_user *user); +static void ipmi_set_recv_msg_user (struct ipmi_recv_msg *msg, +struct ipmi_user *user);static int ipmi_init_msghandler (void );static void smi_recv_tasklet (struct tasklet_struct *t);static void handle_new_recv_msgs (struct ipmi_smi *intf);
@@ -939,13 +941,11 @@ static int deliver_response(struct ipmi_* risk. At this moment, simply skip it in that case. */ ipmi_free_recv_msg (msg); -atomic_dec (&msg->user->nr_msgs); }else {int index;struct ipmi_user *user =acquire_ipmi_user (msg->user, &index);if (user) { -atomic_dec (&user->nr_msgs); user->handler->ipmi_recv_hndl (msg, user->handler_data);release_ipmi_user (user, index); }else {
@@ -1634,8 +1634,7 @@ int ipmi_set_gets_events(struct ipmi_usespin_unlock_irqrestore (&intf->events_lock, flags);list_for_each_entry_safe (msg, msg2, &msgs, link) { - msg->user = user; -kref_get (&user->refcount); +ipmi_set_recv_msg_user (msg, user);deliver_local_response (intf, msg); }
@@ -2309,22 +2308,15 @@ static int i_ipmi_request(struct ipmi_usstruct ipmi_recv_msg *recv_msg;int rv =0 ; -if (user) { -if (atomic_add_return (1 , &user->nr_msgs) > max_msgs_per_user) { -/* Decrement will happen at the end of the routine. */ - rv = -EBUSY ; - goto out; - } - } - -if (supplied_recv) +if (supplied_recv) { recv_msg = supplied_recv; -else { - recv_msg =ipmi_alloc_recv_msg (); -if (recv_msg ==NULL ) { - rv = -ENOMEM ; - goto out; - } + recv_msg->user = user; +if (user) +atomic_inc (&user->nr_msgs); + }else { + recv_msg =ipmi_alloc_recv_msg (user); +if (IS_ERR (recv_msg)) +return PTR_ERR (recv_msg); } recv_msg->user_msg_data = user_msg_data;
@@ -2335,8 +2327,7 @@ static int i_ipmi_request(struct ipmi_usif (smi_msg ==NULL ) {if (!supplied_recv)ipmi_free_recv_msg (recv_msg); - rv = -ENOMEM ; - goto out; +return -ENOMEM ; } }
@@ -2346,10 +2337,6 @@ static int i_ipmi_request(struct ipmi_us goto out_err; } - recv_msg->user = user; -if (user) -/* The put happens when the message is freed. */ -kref_get (&user->refcount); recv_msg->msgid = msgid;/* * Store the message to send in the receive message so timeout
@@ -2378,8 +2365,10 @@ static int i_ipmi_request(struct ipmi_usif (rv) { out_err: -ipmi_free_smi_msg (smi_msg); -ipmi_free_recv_msg (recv_msg); +if (!supplied_smi) +ipmi_free_smi_msg (smi_msg); +if (!supplied_recv) +ipmi_free_recv_msg (recv_msg); }else {dev_dbg (intf->si_dev,"Send: %*ph\n" , smi_msg->data_size, smi_msg->data);
@@ -2388,9 +2377,6 @@ out_err: }rcu_read_unlock (); -out: -if (rv && user) -atomic_dec (&user->nr_msgs);return rv; }
@@ -3883,7 +3869,7 @@ static int handle_ipmb_get_msg_cmd(strucunsigned char chan;struct ipmi_user *user =NULL ;struct ipmi_ipmb_addr *ipmb_addr; -struct ipmi_recv_msg *recv_msg; +struct ipmi_recv_msg *recv_msg =NULL ;if (msg->rsp_size <10 ) {/* Message not big enough, just ignore it. */
@@ -3904,9 +3890,8 @@ static int handle_ipmb_get_msg_cmd(struc rcvr =find_cmd_rcvr (intf, netfn, cmd, chan);if (rcvr) { user = rcvr->user; -kref_get (&user->refcount); - }else - user =NULL ; + recv_msg =ipmi_alloc_recv_msg (user); + }rcu_read_unlock ();if (user ==NULL ) {
@@ -3941,47 +3926,41 @@ static int handle_ipmb_get_msg_cmd(struc rv =-1 ; }rcu_read_unlock (); - }else { - recv_msg =ipmi_alloc_recv_msg (); -if (!recv_msg) { -/* -* We couldn't allocate memory for the -* message, so requeue it for handling -* later. -*/ - rv =1 ; -kref_put (&user->refcount, free_user); - }else { -/* Extract the source address from the data. */ - ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; - ipmb_addr->addr_type =IPMI_IPMB_ADDR_TYPE ; - ipmb_addr->slave_addr = msg->rsp[6 ]; - ipmb_addr->lun = msg->rsp[7 ] &3 ; - ipmb_addr->channel = msg->rsp[3 ] &0xf ; + }else if (!IS_ERR (recv_msg)) { +/* Extract the source address from the data. */ + ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; + ipmb_addr->addr_type =IPMI_IPMB_ADDR_TYPE ; + ipmb_addr->slave_addr = msg->rsp[6 ]; + ipmb_addr->lun = msg->rsp[7 ] &3 ; + ipmb_addr->channel = msg->rsp[3 ] &0xf ; -/* -* Extract the rest of the message information -* from the IPMB header. -*/ - recv_msg->user = user; - recv_msg->recv_type =IPMI_CMD_RECV_TYPE ; - recv_msg->msgid = msg->rsp[7 ] >>2 ; - recv_msg->msg.netfn = msg->rsp[4 ] >>2 ; - recv_msg->msg.cmd = msg->rsp[8 ]; - recv_msg->msg.data = recv_msg->msg_data; +/* +* Extract the rest of the message information +* from the IPMB header. +*/ + recv_msg->recv_type =IPMI_CMD_RECV_TYPE ; + recv_msg->msgid = msg->rsp[7 ] >>2 ; + recv_msg->msg.netfn = msg->rsp[4 ] >>2 ; + recv_msg->msg.cmd = msg->rsp[8 ]; + recv_msg->msg.data = recv_msg->msg_data; -/* -* We chop off 10, not 9 bytes because the checksum -* at the end also needs to be removed. -*/ - recv_msg->msg.data_len = msg->rsp_size -10 ; -memcpy (recv_msg->msg_data, &msg->rsp[9 ], - msg->rsp_size -10 ); -if (deliver_response (intf, recv_msg)) -ipmi_inc_stat (intf, unhandled_commands); -else -ipmi_inc_stat (intf, handled_commands); - } +/* +* We chop off 10, not 9 bytes because the checksum +* at the end also needs to be removed. +*/ + recv_msg->msg.data_len = msg->rsp_size -10 ; +memcpy (recv_msg->msg_data, &msg->rsp[9 ], + msg->rsp_size -10 ); +if (deliver_response (intf, recv_msg)) +ipmi_inc_stat (intf, unhandled_commands); +else +ipmi_inc_stat (intf, handled_commands); + }else { +/* +* We couldn't allocate memory for the message, so +* requeue it for handling later. +*/ + rv =1 ; }return rv;
@@ -3994,7 +3973,7 @@ static int handle_ipmb_direct_rcv_cmd(stint rv =0 ;struct ipmi_user *user =NULL ;struct ipmi_ipmb_direct_addr *daddr; -struct ipmi_recv_msg *recv_msg; +struct ipmi_recv_msg *recv_msg =NULL ;unsigned char netfn = msg->rsp[0 ] >>2 ;unsigned char cmd = msg->rsp[3 ];
@@ -4003,9 +3982,8 @@ static int handle_ipmb_direct_rcv_cmd(st rcvr =find_cmd_rcvr (intf, netfn, cmd,0 );if (rcvr) { user = rcvr->user; -kref_get (&user->refcount); - }else - user =NULL ; + recv_msg =ipmi_alloc_recv_msg (user); + }rcu_read_unlock ();if (user ==NULL ) {
@@ -4032,44 +4010,38 @@ static int handle_ipmb_direct_rcv_cmd(st rv =-1 ; }rcu_read_unlock (); - }else { - recv_msg =ipmi_alloc_recv_msg (); -if (!recv_msg) { -/* -* We couldn't allocate memory for the -* message, so requeue it for handling -* later. -*/ - rv =1 ; -kref_put (&user->refcount, free_user); - }else { -/* Extract the source address from the data. */ - daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; - daddr->addr_type =IPMI_IPMB_DIRECT_ADDR_TYPE ; - daddr->channel =0 ; - daddr->slave_addr = msg->rsp[1 ]; - daddr->rs_lun = msg->rsp[0 ] &3 ; - daddr->rq_lun = msg->rsp[2 ] &3 ; + }else if (!IS_ERR (recv_msg)) { +/* Extract the source address from the data. */ + daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; + daddr->addr_type =IPMI_IPMB_DIRECT_ADDR_TYPE ; + daddr->channel =0 ; + daddr->slave_addr = msg->rsp[1 ]; + daddr->rs_lun = msg->rsp[0 ] &3 ; + daddr->rq_lun = msg->rsp[2 ] &3 ; -/* -* Extract the rest of the message information -* from the IPMB header. -*/ - recv_msg->user = user; - recv_msg->recv_type =IPMI_CMD_RECV_TYPE ; - recv_msg->msgid = (msg->rsp[2 ] >>2 ); - recv_msg->msg.netfn = msg->rsp[0 ] >>2 ; - recv_msg->msg.cmd = msg->rsp[3 ]; - recv_msg->msg.data = recv_msg->msg_data; - - recv_msg->msg.data_len = msg->rsp_size -4 ; -memcpy (recv_msg->msg_data, msg->rsp +4 , - msg->rsp_size -4 ); -if (deliver_response (intf, recv_msg)) -ipmi_inc_stat (intf, unhandled_commands); -else -ipmi_inc_stat (intf, handled_commands); - } +/* +* Extract the rest of the message information +* from the IPMB header. +*/ + recv_msg->recv_type =IPMI_CMD_RECV_TYPE ; + recv_msg->msgid = (msg->rsp[2 ] >>2 ); + recv_msg->msg.netfn = msg->rsp[0 ] >>2 ; + recv_msg->msg.cmd = msg->rsp[3 ]; + recv_msg->msg.data = recv_msg->msg_data; + + recv_msg->msg.data_len = msg->rsp_size -4 ; +memcpy (recv_msg->msg_data, msg->rsp +4 , + msg->rsp_size -4 ); +if (deliver_response (intf, recv_msg)) +ipmi_inc_stat (intf, unhandled_commands); +else +ipmi_inc_stat (intf, handled_commands); + }else { +/* +* We couldn't allocate memory for the message, so +* requeue it for handling later. +*/ + rv =1 ; }return rv;
@@ -4183,7 +4155,7 @@ static int handle_lan_get_msg_cmd(structunsigned char chan;struct ipmi_user *user =NULL ;struct ipmi_lan_addr *lan_addr; -struct ipmi_recv_msg *recv_msg; +struct ipmi_recv_msg *recv_msg =NULL ;if (msg->rsp_size <12 ) {/* Message not big enough, just ignore it. */
@@ -4204,9 +4176,8 @@ static int handle_lan_get_msg_cmd(struct rcvr =find_cmd_rcvr (intf, netfn, cmd, chan);if (rcvr) { user = rcvr->user; -kref_get (&user->refcount); - }else - user =NULL ; + recv_msg =ipmi_alloc_recv_msg (user); + }rcu_read_unlock ();if (user ==NULL ) {
@@ -4218,49 +4189,44 @@ static int handle_lan_get_msg_cmd(struct* them to be freed. */ rv =0 ; - }else { - recv_msg =ipmi_alloc_recv_msg (); -if (!recv_msg) { -/* -* We couldn't allocate memory for the -* message, so requeue it for handling later. -*/ - rv =1 ; -kref_put (&user->refcount, free_user); - }else { -/* Extract the source address from the data. */ - lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; - lan_addr->addr_type =IPMI_LAN_ADDR_TYPE ; - lan_addr->session_handle = msg->rsp[4 ]; - lan_addr->remote_SWID = msg->rsp[8 ]; - lan_addr->local_SWID = msg->rsp[5 ]; - lan_addr->lun = msg->rsp[9 ] &3 ; - lan_addr->channel = msg->rsp[3 ] &0xf ; - lan_addr->privilege = msg->rsp[3 ] >>4 ; + }else if (!IS_ERR (recv_msg)) { +/* Extract the source address from the data. */ + lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; + lan_addr->addr_type =IPMI_LAN_ADDR_TYPE ; + lan_addr->session_handle = msg->rsp[4 ]; + lan_addr->remote_SWID = msg->rsp[8 ]; + lan_addr->local_SWID = msg->rsp[5 ]; + lan_addr->lun = msg->rsp[9 ] &3 ; + lan_addr->channel = msg->rsp[3 ] &0xf ; + lan_addr->privilege = msg->rsp[3 ] >>4 ; -/* -* Extract the rest of the message information -* from the IPMB header. -*/ - recv_msg->user = user; - recv_msg->recv_type =IPMI_CMD_RECV_TYPE ; - recv_msg->msgid = msg->rsp[9 ] >>2 ; - recv_msg->msg.netfn = msg->rsp[6 ] >>2 ; - recv_msg->msg.cmd = msg->rsp[10 ]; - recv_msg->msg.data = recv_msg->msg_data; +/* +* Extract the rest of the message information +* from the IPMB header. +*/ + recv_msg->recv_type =IPMI_CMD_RECV_TYPE ; + recv_msg->msgid = msg->rsp[9 ] >>2 ; + recv_msg->msg.netfn = msg->rsp[6 ] >>2 ; + recv_msg->msg.cmd = msg->rsp[10 ]; + recv_msg->msg.data = recv_msg->msg_data; -/* -* We chop off 12, not 11 bytes because the checksum -* at the end also needs to be removed. -*/ - recv_msg->msg.data_len = msg->rsp_size -12 ; -memcpy (recv_msg->msg_data, &msg->rsp[11 ], - msg->rsp_size -12 ); -if (deliver_response (intf, recv_msg)) -ipmi_inc_stat (intf, unhandled_commands); -else -ipmi_inc_stat (intf, handled_commands); - } +/* +* We chop off 12, not 11 bytes because the checksum +* at the end also needs to be removed. +*/ + recv_msg->msg.data_len = msg->rsp_size -12 ; +memcpy (recv_msg->msg_data, &msg->rsp[11 ], + msg->rsp_size -12 ); +if (deliver_response (intf, recv_msg)) +ipmi_inc_stat (intf, unhandled_commands); +else +ipmi_inc_stat (intf, handled_commands); + }else { +/* +* We couldn't allocate memory for the message, so +* requeue it for handling later. +*/ + rv =1 ; }return rv;
@@ -4282,7 +4248,7 @@ static int handle_oem_get_msg_cmd(structunsigned char chan;struct ipmi_user *user =NULL ;struct ipmi_system_interface_addr *smi_addr; -struct ipmi_recv_msg *recv_msg; +struct ipmi_recv_msg *recv_msg =NULL ;/* * We expect the OEM SW to perform error checking
@@ -4311,9 +4277,8 @@ static int handle_oem_get_msg_cmd(struct rcvr =find_cmd_rcvr (intf, netfn, cmd, chan);if (rcvr) { user = rcvr->user; -kref_get (&user->refcount); - }else - user =NULL ; + recv_msg =ipmi_alloc_recv_msg (user); + }rcu_read_unlock ();if (user ==NULL ) {
@@ -4326,48 +4291,42 @@ static int handle_oem_get_msg_cmd(struct*/ rv =0 ; - }else { - recv_msg =ipmi_alloc_recv_msg (); -if (!recv_msg) { -/* -* We couldn't allocate memory for the -* message, so requeue it for handling -* later. -*/ - rv =1 ; -kref_put (&user->refcount, free_user); - }else { -/* -* OEM Messages are expected to be delivered via -* the system interface to SMS software. We might -* need to visit this again depending on OEM -* requirements -*/ - smi_addr = ((struct ipmi_system_interface_addr *) - &recv_msg->addr); - smi_addr->addr_type =IPMI_SYSTEM_INTERFACE_ADDR_TYPE ; - smi_addr->channel =IPMI_BMC_CHANNEL ; - smi_addr->lun = msg->rsp[0 ] &3 ; - - recv_msg->user = user; - recv_msg->user_msg_data =NULL ; - recv_msg->recv_type =IPMI_OEM_RECV_TYPE ; - recv_msg->msg.netfn = msg->rsp[0 ] >>2 ; - recv_msg->msg.cmd = msg->rsp[1 ]; - recv_msg->msg.data = recv_msg->msg_data; + }else if (!IS_ERR (recv_msg)) { +/* +* OEM Messages are expected to be delivered via +* the system interface to SMS software. We might +* need to visit this again depending on OEM +* requirements +*/ + smi_addr = ((struct ipmi_system_interface_addr *) + &recv_msg->addr); + smi_addr->addr_type =IPMI_SYSTEM_INTERFACE_ADDR_TYPE ; + smi_addr->channel =IPMI_BMC_CHANNEL ; + smi_addr->lun = msg->rsp[0 ] &3 ; + + recv_msg->user_msg_data =NULL ; + recv_msg->recv_type =IPMI_OEM_RECV_TYPE ; + recv_msg->msg.netfn = msg->rsp[0 ] >>2 ; + recv_msg->msg.cmd = msg->rsp[1 ]; + recv_msg->msg.data = recv_msg->msg_data; -/* -* The message starts at byte 4 which follows the -* Channel Byte in the "GET MESSAGE" command -*/ - recv_msg->msg.data_len = msg->rsp_size -4 ; -memcpy (recv_msg->msg_data, &msg->rsp[4 ], - msg->rsp_size -4 ); -if (deliver_response (intf, recv_msg)) -ipmi_inc_stat (intf, unhandled_commands); -else -ipmi_inc_stat (intf, handled_commands); - } +/* +* The message starts at byte 4 which follows the +* Channel Byte in the "GET MESSAGE" command +*/ + recv_msg->msg.data_len = msg->rsp_size -4 ; +memcpy (recv_msg->msg_data, &msg->rsp[4 ], + msg->rsp_size -4 ); +if (deliver_response (intf, recv_msg)) +ipmi_inc_stat (intf, unhandled_commands); +else +ipmi_inc_stat (intf, handled_commands); + }else { +/* +* We couldn't allocate memory for the message, so +* requeue it for handling later. +*/ + rv =1 ; }return rv;
@@ -4426,8 +4385,8 @@ static int handle_read_event_rsp(structif (!user->gets_events)continue ; - recv_msg =ipmi_alloc_recv_msg (); -if (!recv_msg) { + recv_msg =ipmi_alloc_recv_msg (user); +if (IS_ERR (recv_msg)) {rcu_read_unlock ();list_for_each_entry_safe (recv_msg, recv_msg2, &msgs, link) {
@@ -4446,8 +4405,6 @@ static int handle_read_event_rsp(struct deliver_count++;copy_event_into_recv_msg (recv_msg, msg); - recv_msg->user = user; -kref_get (&user->refcount);list_add_tail (&recv_msg->link, &msgs); }srcu_read_unlock (&intf->users_srcu, index);
@@ -4463,8 +4420,8 @@ static int handle_read_event_rsp(struct* No one to receive the message, put it in queue if there's * not already too many things in the queue. */ - recv_msg =ipmi_alloc_recv_msg (); -if (!recv_msg) { + recv_msg =ipmi_alloc_recv_msg (NULL ); +if (IS_ERR (recv_msg)) {/* * We couldn't allocate memory for the * message, so requeue it for handling
@@ -5156,27 +5113,51 @@ static void free_recv_msg(struct ipmi_rekfree (msg); } -static struct ipmi_recv_msg *ipmi_alloc_recv_msg (void ) +static struct ipmi_recv_msg *ipmi_alloc_recv_msg (struct ipmi_user *user) {struct ipmi_recv_msg *rv; +if (user) { +if (atomic_add_return (1 , &user->nr_msgs) > max_msgs_per_user) { +atomic_dec (&user->nr_msgs); +return ERR_PTR (-EBUSY ); + } + } + rv =kmalloc (sizeof (struct ipmi_recv_msg ),GFP_ATOMIC ); -if (rv) { - rv->user =NULL ; - rv->done = free_recv_msg; -atomic_inc (&recv_msg_inuse_count); +if (!rv) { +if (user) +atomic_dec (&user->nr_msgs); +return ERR_PTR (-ENOMEM ); } + + rv->user = user; + rv->done = free_recv_msg; +if (user) +kref_get (&user->refcount); +atomic_inc (&recv_msg_inuse_count);return rv; }void ipmi_free_recv_msg (struct ipmi_recv_msg *msg) { -if (msg->user && !oops_in_progress) +if (msg->user && !oops_in_progress) { +atomic_dec (&msg->user->nr_msgs);kref_put (&msg->user->refcount, free_user); + } msg->done (msg); }EXPORT_SYMBOL (ipmi_free_recv_msg); +static void ipmi_set_recv_msg_user (struct ipmi_recv_msg *msg, +struct ipmi_user *user) +{ +WARN_ON_ONCE (msg->user);/* User should not be set. */ + msg->user = user; +atomic_inc (&user->nr_msgs); +kref_get (&user->refcount); +} +static atomic_t panic_done_count =ATOMIC_INIT (0 );static void dummy_smi_done_handler (struct ipmi_smi_msg *msg)
Greg Kroah-Hartman
maintainerPATCH 152/168 ipmi: Fix handling of messages with provided receive message pointer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit e2c69490dda5d4c9f1bfbb2898989c8f3530e354 upstream
Prior to commit b52da4054ee0 ("ipmi: Rework user message limit handling"), i_ipmi_request() used to increase the user reference counter if the receive message is provided by the caller of IPMI API functions. This is no longer the case. However, ipmi_free_recv_msg() is still called and decreases the reference counter. This results in the reference counter reaching zero, the user data pointer is released, and all kinds of interesting crashes are seen.
Fix the problem by increasing user reference counter if the receive message has been provided by the caller.
Message-ID: <[email protected]>
--- drivers/char/ipmi/ipmi_msghandler.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_msghandler.c +4 -1
@@ -2311,8 +2311,11 @@ static int i_ipmi_request(struct ipmi_usif (supplied_recv) { recv_msg = supplied_recv; recv_msg->user = user; -if (user) +if (user) {atomic_inc (&user->nr_msgs); +/* The put happens when the message is freed. */ +kref_get (&user->refcount); + } }else { recv_msg =ipmi_alloc_recv_msg (user);if (IS_ERR (recv_msg))
Greg Kroah-Hartman
maintainerPATCH 153/168 ACPI: property: Disregard references in data-only subnode lists
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit d06118fe9b03426484980ed4c189a8c7b99fa631 ]
Data-only subnode links following the ACPI data subnode GUID in a _DSD package are expected to point to named objects returning _DSD-equivalent packages. If a reference to such an object is used in the target field of any of those links, that object will be evaluated in place (as a named object) and its return data will be embedded in the outer _DSD package.
For this reason, it is not expected to see a subnode link with the target field containing a local reference (that would mean pointing to a device or another object that cannot be evaluated in place and therefore cannot return a _DSD-equivalent package).
Accordingly, simplify the code parsing data-only subnode links to simply print a message when it encounters a local reference in the target field of one of those links.
Moreover, since acpi_nondev_subnode_data_ok() would only have one caller after the change above, fold it into that caller.
Stable-dep-of: baf60d5cb8bc ("ACPI: property: Do not pass NULL handles to acpi_attach_data()")
--- drivers/acpi/property.c | 51 ++++++++++++++++++++---------------------------- 1 file changed, 22 insertions(+), 29 deletions(-)
drivers/acpi/property.c +22 -29
@@ -112,32 +112,12 @@ static bool acpi_nondev_subnode_extract(return false; } -static bool acpi_nondev_subnode_data_ok (acpi_handle handle, -const union acpi_object *link, -struct list_head *list, -struct fwnode_handle *parent) -{ -struct acpi_buffer buf = {ACPI_ALLOCATE_BUFFER }; -acpi_status status; - - status =acpi_evaluate_object_typed (handle,NULL ,NULL , &buf, -ACPI_TYPE_PACKAGE ); -if (ACPI_FAILURE (status)) -return false; - -if (acpi_nondev_subnode_extract (buf.pointer, handle, link, list, - parent)) -return true; - -ACPI_FREE (buf.pointer); -return false; -} -static bool acpi_nondev_subnode_ok (acpi_handle scope,const union acpi_object *link,struct list_head *list,struct fwnode_handle *parent) { +struct acpi_buffer buf = {ACPI_ALLOCATE_BUFFER };acpi_handle handle;acpi_status status;
@@ -149,7 +129,17 @@ static bool acpi_nondev_subnode_ok(acpi_if (ACPI_FAILURE (status))return false; -return acpi_nondev_subnode_data_ok (handle, link, list, parent); + status =acpi_evaluate_object_typed (handle,NULL ,NULL , &buf, +ACPI_TYPE_PACKAGE ); +if (ACPI_FAILURE (status)) +return false; + +if (acpi_nondev_subnode_extract (buf.pointer, handle, link, list, + parent)) +return true; + +ACPI_FREE (buf.pointer); +return false; } static bool acpi_add_nondev_subnodes(acpi_handle scope,
@@ -162,7 +152,6 @@ static bool acpi_add_nondev_subnodes(acpfor (i =0 ; i < links->package.count; i++) {union acpi_object *link, *desc; -acpi_handle handle;bool result; link = &links->package.elements[i];
@@ -174,22 +163,26 @@ static bool acpi_add_nondev_subnodes(acpif (link->package.elements[0 ].type !=ACPI_TYPE_STRING )continue ; -/* The second one may be a string, a reference or a package. */ +/* The second one may be a string or a package. */ switch (link->package.elements[1 ].type) {case ACPI_TYPE_STRING : result =acpi_nondev_subnode_ok (scope, link, list, parent);break ; -case ACPI_TYPE_LOCAL_REFERENCE : - handle = link->package.elements[1 ].reference.handle; - result =acpi_nondev_subnode_data_ok (handle, link, list, - parent); -break ;case ACPI_TYPE_PACKAGE : desc = &link->package.elements[1 ]; result =acpi_nondev_subnode_extract (desc,NULL , link, list, parent);break ; +case ACPI_TYPE_LOCAL_REFERENCE : +/* +* It is not expected to see any local references in +* the links package because referencing a named object +* should cause it to be evaluated in place. +*/ +acpi_handle_info (scope,"subnode %s: Unexpected reference\n" , + link->package.elements[0 ].string.pointer); + fallthrough;default : result = false;break ;
Greg Kroah-Hartman
maintainerPATCH 154/168 ACPI: property: Add code comments explaining what is going on
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit 737c3a09dcf69ba2814f3674947ccaec1861c985 ]
In some places in the ACPI device properties handling code, it is unclear why the code is what it is. Some assumptions are not documented and some pieces of code are based on knowledge that is not mentioned anywhere.
Add code comments explaining these things.
Stable-dep-of: baf60d5cb8bc ("ACPI: property: Do not pass NULL handles to acpi_attach_data()")
--- drivers/acpi/property.c | 46 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 2 deletions(-)
drivers/acpi/property.c +44 -2
@@ -96,7 +96,18 @@ static bool acpi_nondev_subnode_extract(if (handle)acpi_get_parent (handle, &scope); +/* +* Extract properties from the _DSD-equivalent package pointed to by +* desc and use scope (if not NULL) for the completion of relative +* pathname segments. +* +* The extracted properties will be held in the new data node dn. +*/ result =acpi_extract_properties (scope, desc, &dn->data); +/* +* Look for subnodes in the _DSD-equivalent package pointed to by desc +* and create child nodes of dn if there are any. +*/ if (acpi_enumerate_nondev_subnodes (scope, desc, &dn->data, &dn->fwnode)) result = true;
@@ -121,6 +132,12 @@ static bool acpi_nondev_subnode_ok(acpi_acpi_handle handle;acpi_status status; +/* +* If the scope is unknown, the _DSD-equivalent package being parsed +* was embedded in an outer _DSD-equivalent package as a result of +* direct evaluation of an object pointed to by a reference. In that +* case, using a pathname as the target object pointer is invalid. +*/ if (!scope)return false;
@@ -150,6 +167,10 @@ static bool acpi_add_nondev_subnodes(acpbool ret = false;int i; +/* +* Every element in the links package is expected to represent a link +* to a non-device node in a tree containing device-specific data. +*/ for (i =0 ; i < links->package.count; i++) {union acpi_object *link, *desc;bool result;
@@ -159,17 +180,38 @@ static bool acpi_add_nondev_subnodes(acpif (link->package.count !=2 )continue ; -/* The first one must be a string. */ +/* The first one (the key) must be a string. */ if (link->package.elements[0 ].type !=ACPI_TYPE_STRING )continue ; -/* The second one may be a string or a package. */ +/* The second one (the target) may be a string or a package. */ switch (link->package.elements[1 ].type) {case ACPI_TYPE_STRING : +/* +* The string is expected to be a full pathname or a +* pathname segment relative to the given scope. That +* pathname is expected to point to an object returning +* a package that contains _DSD-equivalent information. +*/ result =acpi_nondev_subnode_ok (scope, link, list, parent);break ;case ACPI_TYPE_PACKAGE : +/* +* This happens when a reference is used in AML to +* point to the target. Since the target is expected +* to be a named object, a reference to it will cause it +* to be avaluated in place and its return package will +* be embedded in the links package at the location of +* the reference. +* +* The target package is expected to contain _DSD- +* equivalent information, but the scope in which it +* is located in the original AML is unknown. Thus +* it cannot contain pathname segments represented as +* strings because there is no way to build full +* pathnames out of them. +*/ desc = &link->package.elements[1 ]; result =acpi_nondev_subnode_extract (desc,NULL , link, list, parent);
Greg Kroah-Hartman
maintainerPATCH 155/168 ACPI: property: Do not pass NULL handles to acpi_attach_data()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit baf60d5cb8bc6b85511c5df5f0ad7620bb66d23c ]
In certain circumstances, the ACPI handle of a data-only node may be NULL, in which case it does not make sense to attempt to attach that node to an ACPI namespace object, so update the code to avoid attempts to do so.
This prevents confusing and unuseful error messages from being printed.
Also document the fact that the ACPI handle of a data-only node may be NULL and when that happens in a code comment. In addition, make acpi_add_nondev_subnodes() print a diagnostic message for each data-only node with an unknown ACPI namespace scope.
--- drivers/acpi/property.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/acpi/property.c +12 -0
@@ -112,6 +112,10 @@ static bool acpi_nondev_subnode_extract( result = true;if (result) { +/* +* This will be NULL if the desc package is embedded in an outer +* _DSD-equivalent package and its scope cannot be determined. +*/ dn->handle = handle; dn->data.pointer = desc;list_add_tail (&dn->sibling, list);
@@ -212,6 +216,8 @@ static bool acpi_add_nondev_subnodes(acp* strings because there is no way to build full * pathnames out of them. */ +acpi_handle_debug (scope,"subnode %s: Unknown scope\n" , + link->package.elements[0 ].string.pointer); desc = &link->package.elements[1 ]; result =acpi_nondev_subnode_extract (desc,NULL , link, list, parent);
@@ -384,6 +390,9 @@ static void acpi_untie_nondev_subnodes(sstruct acpi_data_node *dn;list_for_each_entry (dn, &data->subnodes, sibling) { +if (!dn->handle) +continue ; +acpi_detach_data (dn->handle, acpi_nondev_subnode_tag);acpi_untie_nondev_subnodes (&dn->data);
@@ -398,6 +407,9 @@ static bool acpi_tie_nondev_subnodes(stracpi_status status;bool ret; +if (!dn->handle) +continue ; + status =acpi_attach_data (dn->handle, acpi_nondev_subnode_tag, dn);if (ACPI_FAILURE (status) && status !=AE_ALREADY_EXISTS ) {acpi_handle_err (dn->handle,"Can't tag data node\n" );
Greg Kroah-Hartman
maintainerPATCH 156/168 selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lance Yang <[email protected]>
commit 0389c305ef56cbadca4cbef44affc0ec3213ed30 upstream.
The madv_populate and soft-dirty kselftests currently fail on systems where CONFIG_MEM_SOFT_DIRTY is disabled.
Introduce a new helper softdirty_supported() into vm_util.c/h to ensure tests are properly skipped when the feature is not enabled.
--- tools/testing/selftests/vm/madv_populate.c | 9 ++- tools/testing/selftests/vm/soft-dirty.c | 5 + tools/testing/selftests/vm/vm_util.c | 77 +++++++++++++++++++++++++++++ tools/testing/selftests/vm/vm_util.h | 2 4 files changed, 90 insertions(+), 3 deletions(-)
tools/testing/selftests/vm/madv_populate.c +7 -2
@@ -274,12 +274,16 @@ static void test_softdirty(void)int main (int argc,char **argv) { +int nr_tests =16 ;int err; pagesize =getpagesize (); +if (softdirty_supported ()) + nr_tests +=5 ; +ksft_print_header (); -ksft_set_plan (21 ); +ksft_set_plan (nr_tests);sense_support ();test_prot_read ();
@@ -287,7 +291,8 @@ int main(int argc, char **argv)test_holes ();test_populate_read ();test_populate_write (); -test_softdirty (); +if (softdirty_supported ()) +test_softdirty (); err =ksft_get_fail_cnt ();if (err)
tools/testing/selftests/vm/soft-dirty.c +4 -1
@@ -190,8 +190,11 @@ int main(int argc, char **argv)int pagesize;ksft_print_header (); -ksft_set_plan (15 ); +if (!softdirty_supported ()) +ksft_exit_skip ("soft-dirty is not support\n" ); + +ksft_set_plan (15 ); pagemap_fd =open (PAGEMAP_FILE_PATH ,O_RDONLY );if (pagemap_fd <0 )ksft_exit_fail_msg ("Failed to open %s\n" ,PAGEMAP_FILE_PATH );
tools/testing/selftests/vm/vm_util.c +77 -0
86 lines not on this page · raw message
tools/testing/selftests/vm/vm_util.h +2 -0
@@ -1,6 +1,7 @@/* SPDX-License-Identifier: GPL-2.0 */ #include <stdint.h> #include <stdbool.h> +#include <sys/mman.h> uint64_t pagemap_get_entry (int fd,char *start);bool pagemap_is_softdirty (int fd,char *start);
@@ -10,3 +11,4 @@ uint64_t read_pmd_pagesize(void);bool check_huge_anon (void *addr,int nr_hpages,uint64_t hpage_size);bool check_huge_file (void *addr,int nr_hpages,uint64_t hpage_size);bool check_huge_shmem (void *addr,int nr_hpages,uint64_t hpage_size); +bool softdirty_supported (void );