6.6.113-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 6.6.113-rc1 review
This is the start of the stable review cycle for the 6.6.113 release. There are 201 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 19 Oct 2025 14:50:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.113-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.113-rc1
Ian Rogers <[email protected]>
perf test stat: Avoid hybrid assumption when virtualized
Jan Kara <[email protected]>
writeback: Avoid excessively long inode switching times
Jan Kara <[email protected]>
writeback: Avoid softlockup when switching many inodes
Tetsuo Handa <[email protected]>
cramfs: Verify inode mode when loading from disk
Lichen Liu <[email protected]>
fs: Add 'initramfs_options' to set initramfs mount options
Oleg Nesterov <[email protected]>
pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers
gaoxiang17 <[email protected]>
pid: Add a judgment for ns null in pid_nr_ns
Tetsuo Handa <[email protected]>
minixfs: Verify inode mode when loading from disk
Lucas Zampieri <[email protected]>
irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
Hongbo Li <[email protected]>
irqchip/sifive-plic: Make use of __assign_bit()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: usable client side with C-flag
Lance Yang <[email protected]>
selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
Ilya Leoshkevich <[email protected]>
s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
Ilya Leoshkevich <[email protected]>
s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
Ilya Leoshkevich <[email protected]>
s390/bpf: Describe the frame using a struct instead of constants
Ilya Leoshkevich <[email protected]>
s390/bpf: Centralize frame offset calculations
Ilya Leoshkevich <[email protected]>
s390/bpf: Change seen_reg to a mask
Rafael J. Wysocki <[email protected]>
ACPI: property: Do not pass NULL handles to acpi_attach_data()
Rafael J. Wysocki <[email protected]>
ACPI: property: Add code comments explaining what is going on
Rafael J. Wysocki <[email protected]>
ACPI: property: Disregard references in data-only subnode lists
Rafael J. Wysocki <[email protected]>
ACPI: battery: Add synchronization between interface updates
Andy Shevchenko <[email protected]>
ACPI: battery: Check for error code from devm_mutex_init() call
Thomas Weißschuh <[email protected]>
ACPI: battery: initialize mutexes through devm_ APIs
Thomas Weißschuh <[email protected]>
ACPI: battery: allocate driver data through devm_ APIs
Catalin Marinas <[email protected]>
arm64: mte: Do not flag the zero page as PG_mte_tagged
Yang Shi <[email protected]>
arm64: kprobes: call set_memory_rox() for kprobe page
Guenter Roeck <[email protected]>
ipmi: Fix handling of messages with provided receive message pointer
Corey Minyard <[email protected]>
ipmi: Rework user message limit handling
Sean Christopherson <[email protected]>
KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
Thomas Gleixner <[email protected]>
rseq: Protect event mask against membarrier IPI
Qu Wenruo <[email protected]>
btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
Shin'ichiro Kawasaki <[email protected]>
PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
Wang Jiang <[email protected]>
PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
Ling Xu <[email protected]>
misc: fastrpc: Save actual DMA size in fastrpc_map structure
Ekansh Gupta <[email protected]>
misc: fastrpc: Add missing dev_err newlines
Namjae Jeon <[email protected]>
ksmbd: add max ip connections parameter
Sean Christopherson <[email protected]>
KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
Donet Tom <[email protected]>
mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
Yuan Chen <[email protected]>
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
Edward Adam Davis <[email protected]>
media: mc: Clear minor number before put device
Phillip Lougher <[email protected]>
Squashfs: reject negative file sizes in squashfs_read_inode()
Phillip Lougher <[email protected]>
Squashfs: add additional inode sanity checking
Nathan Chancellor <[email protected]>
lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
Jan Kara <[email protected]>
ext4: free orphan info with kvfree
Huacai Chen <[email protected]>
ACPICA: Allow to skip Global Lock initialization
Deepanshu Kartikey <[email protected]>
ext4: validate ea_ino and size in check_xattrs
Ahmet Eray Karadag <[email protected]>
ext4: guard against EA inode refcount underflow in xattr update
Zhang Yi <[email protected]>
ext4: fix an off-by-one issue during moving extents
Ojaswin Mujoo <[email protected]>
ext4: correctly handle queries for metadata mappings
Yongjian Sun <[email protected]>
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
Jan Kara <[email protected]>
ext4: verify orphan file size is not too big
Olga Kornievskaia <[email protected]>
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
Thorsten Blum <[email protected]>
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
SeongJae Park <[email protected]>
mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
Li RongQing <[email protected]>
mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
Thadeu Lima de Souza Cascardo <[email protected]>
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
Nick Morrow <[email protected]>
wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
Muhammad Usama Anjum <[email protected]>
wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate C-flag + def limit
Sean Christopherson <[email protected]>
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
Sean Christopherson <[email protected]>
x86/umip: Check that the instruction opcode is at least two bytes
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before DAC access
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before INDAC access
Vidya Sagar <[email protected]>
PCI: tegra194: Handle errors in BPMP response
Niklas Cassel <[email protected]>
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
Marek Vasut <[email protected]>
PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
Marek Vasut <[email protected]>
PCI: rcar-host: Drop PMSR spinlock
Siddharth Vadapalli <[email protected]>
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
Lukas Wunner <[email protected]>
PCI/AER: Support errors introduced by PCIe r6.0
Niklas Schnelle <[email protected]>
PCI/AER: Fix missing uevent on recovery when a reset is requested
Lukas Wunner <[email protected]>
PCI/ERR: Fix uevent on failure to recover
Niklas Schnelle <[email protected]>
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
Brian Norris <[email protected]>
PCI/sysfs: Ensure devices are powered for config reads
Marek Vasut <[email protected]>
PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
Sean Christopherson <[email protected]>
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
Esben Haabendal <[email protected]>
rtc: interface: Fix long-standing race when setting alarm
Esben Haabendal <[email protected]>
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
Zhen Ni <[email protected]>
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
Rex Chen <[email protected]>
mmc: core: SPI mode remove cmd7
Linus Walleij <[email protected]>
mtd: rawnand: fsmc: Default to autodetect buswidth
Miaoqian Lin <[email protected]>
xtensa: simdisk: add input size check in proc_write_simdisk
Ma Ke <[email protected]>
sparc: fix error handling in scan_one_device()
Anthony Yznaga <[email protected]>
sparc64: fix hugetlb for sun4u
Eric Biggers <[email protected]>
sctp: Fix MAC comparison to be constant-time
Thorsten Blum <[email protected]>
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
Harshit Agarwal <[email protected]>
sched/deadline: Fix race in push_dl_task()
Corey Minyard <[email protected]>
Revert "ipmi: fix msg stack when IPMI is disconnected"
Jisheng Zhang <[email protected]>
pwm: berlin: Fix wrong register in suspend/resume
Nam Cao <[email protected]>
powerpc/pseries/msi: Fix potential underflow and leak issue
Nam Cao <[email protected]>
powerpc/powernv/pci: Fix underflow and leak issue
Dzmitry Sankouski <[email protected]>
power: supply: max77976_charger: fix constant current reporting
Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: Drop unused S3C24xx driver data
Georg Gottleuber <[email protected]>
nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
John David Anglin <[email protected]>
parisc: Remove spurious if statement from raw_copy_from_user()
Sam James <[email protected]>
parisc: don't reference obsolete termio struct for TC* constants
Askar Safin <[email protected]>
openat2: don't trigger automounts with RESOLVE_NO_XDEV
Ma Ke <[email protected]>
of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
Johan Hovold <[email protected]>
lib/genalloc: fix device leak in of_gen_pool_get()
Eric Biggers <[email protected]>
KEYS: trusted_tpm1: Compare HMAC values in constant time
Oleg Nesterov <[email protected]>
kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
Lu Baolu <[email protected]>
iommu/vt-d: PRS isn't usable if PDS isn't supported
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
Huacai Chen <[email protected]>
init: handle bootloader identifier in kernel parameters
Sean Anderson <[email protected]>
iio: xilinx-ams: Unmask interrupts after updating alarms
Sean Anderson <[email protected]>
iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix prescaler usage.
Qianfeng Rong <[email protected]>
iio: dac: ad5421: use int type to store negative error codes
Qianfeng Rong <[email protected]>
iio: dac: ad5360: use int type to store negative error codes
Haoxiang Li <[email protected]>
fs/ntfs3: Fix a resource leak bug in wnd_extend()
Finn Thain <[email protected]>
fbdev: Fix logic error in "offb" name match
Thomas Fourier <[email protected]>
crypto: rockchip - Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
crypto: atmel - Fix dma_unmap_sg() direction
Thomas Fourier <[email protected]>
crypto: aspeed - Fix dma_unmap_sg() direction
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Simon Schuster <[email protected]>
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
Adam Xue <[email protected]>
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
Sumit Kumar <[email protected]>
bus: mhi: ep: Fix chained transfer handling in read path
Anderson Nascimento <[email protected]>
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
Yu Kuai <[email protected]>
blk-crypto: fix missing blktrace bio split events
Shuhao Fu <[email protected]>
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
Marek Vasut <[email protected]>
drm/rcar-du: dsi: Fix 1/2/3 lane support
Ma Ke <[email protected]>
media: lirc: Fix error handling in lirc_register()
Stephan Gerhold <[email protected]>
media: venus: firmware: Use correct reset sequence for IRIS2
Thomas Fourier <[email protected]>
media: pci: ivtv: Add missing check after DMA map
Laurent Pinchart <[email protected]>
media: mc: Fix MUST_CONNECT handling for pads with no links
Qianfeng Rong <[email protected]>
media: i2c: mt9v111: fix incorrect type for ret
Thomas Fourier <[email protected]>
media: cx18: Add missing check after DMA map
Johan Hovold <[email protected]>
firmware: meson_sm: fix device leak at probe
Jason Andryuk <[email protected]>
xen/events: Update virq_to_irq on migration
Jason Andryuk <[email protected]>
xen/events: Return -EEXIST for bound VIRQs
Lukas Wunner <[email protected]>
xen/manage: Fix suspend error path
Jason Andryuk <[email protected]>
xen/events: Cleanup find_virq() return codes
Michael Riesch <[email protected]>
dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
Miaoqian Lin <[email protected]>
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
Vibhore Vardhan <[email protected]>
arm64: dts: ti: k3-am62a-main: Fix main padcfg length
Stephan Gerhold <[email protected]>
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8939: Add missing MDSS reset
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Add missing MDSS reset
Amir Mohammad Jahangirzad <[email protected]>
ACPI: debug: fix signedness issues in read/write helpers
Daniel Tang <[email protected]>
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
Rafael J. Wysocki <[email protected]>
ACPI: property: Fix buffer properties extraction for subnodes
KaFai Wan <[email protected]>
bpf: Avoid RCU context warning when unpinning htab with internal structs
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: mark the GPIO controller as sleeping
Gunnar Kudrjavets <[email protected]>
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
Pali Rohár <[email protected]>
cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
Paulo Alcantara <[email protected]>
smb: client: fix missing timestamp updates after utime(2)
Herbert Xu <[email protected]>
crypto: essiv - Check ssize for decryption and in-place encryption
Eric Woudstra <[email protected]>
bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_objref: validate objref and objrefmap expressions
Florian Westphal <[email protected]>
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
Timur Kristóf <[email protected]>
drm/amd/display: Properly disable scaling on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
Alex Deucher <[email protected]>
drm/amdgpu: Add additional DCE6 SCL registers
Daniel Borkmann <[email protected]>
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
Eric Dumazet <[email protected]>
tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
Leo Yan <[email protected]>
perf python: split Clang options when invoking Popen
Leo Yan <[email protected]>
tools build: Align warning options with perf
Erick Karanja <[email protected]>
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Kuniyuki Iwashima <[email protected]>
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Alexandr Sapozhnikov <[email protected]>
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix copy-paste typo in validation
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Use-after-free in validation
Zack Rusin <[email protected]>
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Vineeth Vijayan <[email protected]>
s390/cio: Update purge function to unregister the unused subchannels
Dan Carpenter <[email protected]>
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
Huacai Chen <[email protected]>
LoongArch: Init acpi_gbl_use_global_lock to false
Tiezhu Yang <[email protected]>
LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
Duoming Zhou <[email protected]>
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
Aaron Kling <[email protected]>
cpufreq: tegra186: Set target frequency for all cpus in policy
Fedor Pchelkin <[email protected]>
clk: tegra: do not overallocate memory for bpmp clocks
Alok Tiwari <[email protected]>
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
Brian Masney <[email protected]>
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
Chen-Yu Tsai <[email protected]>
clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
AngeloGioacchino Del Regno <[email protected]>
clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
Ian Rogers <[email protected]>
perf evsel: Ensure the fallback message is always written to
Namhyung Kim <[email protected]>
perf tools: Add fallback for exclude_guest
James Clark <[email protected]>
perf test: Add a test for default perf stat command
Ian Rogers <[email protected]>
perf test: Don't leak workload gopipe in PERF_RECORD_*
Leo Yan <[email protected]>
perf session: Fix handling when buffer exceeds 2 GiB
Leo Yan <[email protected]>
perf arm_spe: Correct memory level for remote access
Leo Yan <[email protected]>
perf arm-spe: Rename the common data source encoding
Leo Yan <[email protected]>
perf arm_spe: Correct setting remote access
Clément Le Goffic <[email protected]>
rtc: optee: fix memory leak on driver removal
Rob Herring (Arm) <[email protected]>
rtc: x1205: Fix Xicor X1205 vendor prefix
Yunseong Kim <[email protected]>
perf util: Fix compression checks returning -1 as bool
Brian Masney <[email protected]>
clk: at91: peripheral: fix return value
Ian Rogers <[email protected]>
libperf event: Ensure tracing data is multiple of 8 sized
Ian Rogers <[email protected]>
perf evsel: Avoid container_of on a NULL leader
Varad Gautam <[email protected]>
asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
Tomi Valkeinen <[email protected]>
media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
Zhen Ni <[email protected]>
clocksource/drivers/clps711x: Fix resource leaks in error paths
Aleksa Sarai <[email protected]>
fscontext: do not consume log entries when returning -EMSGSIZE
Thomas Weißschuh <[email protected]>
fs: always return zero on success from replace_fd()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + .../bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +- Makefile | 4 +- arch/arm/mach-omap2/pm33xx-core.c | 6 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 + arch/arm64/boot/dts/qcom/msm8939.dtsi | 2 + arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 +- arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 2 +- arch/arm64/kernel/cpufeature.c | 10 +- arch/arm64/kernel/mte.c | 3 +- arch/arm64/kernel/probes/kprobes.c | 8 +- arch/loongarch/kernel/setup.c | 5 +- arch/parisc/include/uapi/asm/ioctls.h | 8 +- arch/parisc/lib/memcpy.c | 1 - arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- arch/powerpc/platforms/pseries/msi.c | 2 +- arch/s390/net/bpf_jit.h | 55 --- arch/s390/net/bpf_jit_comp.c | 161 ++++---- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + arch/sparc/mm/hugetlbpage.c | 20 + arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/umip.c | 15 +- arch/x86/kvm/pmu.c | 5 + arch/x86/kvm/svm/pmu.c | 1 + arch/x86/kvm/svm/svm.c | 13 +- arch/x86/kvm/x86.c | 2 + arch/xtensa/platforms/iss/simdisk.c | 6 +- block/blk-crypto-fallback.c | 3 + crypto/essiv.c | 14 +- drivers/acpi/acpi_dbg.c | 26 +- drivers/acpi/acpi_tad.c | 3 + drivers/acpi/acpica/evglock.c | 4 + drivers/acpi/battery.c | 60 +-- drivers/acpi/property.c | 139 ++++--- drivers/bus/mhi/ep/main.c | 37 +- drivers/bus/mhi/host/init.c | 5 +- drivers/char/ipmi/ipmi_kcs_sm.c | 16 +- drivers/char/ipmi/ipmi_msghandler.c | 422 ++++++++++----------- drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/clk/at91/clk-peripheral.c | 7 +- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- drivers/clk/mediatek/clk-mux.c | 4 +- drivers/clk/nxp/clk-lpc18xx-cgu.c | 20 +- drivers/clk/tegra/clk-bpmp.c | 2 +- drivers/clocksource/clps711x-timer.c | 23 +- drivers/cpufreq/intel_pstate.c | 8 +- drivers/cpufreq/tegra186-cpufreq.c | 8 +- drivers/crypto/aspeed/aspeed-hace-crypto.c | 2 +- drivers/crypto/atmel-tdes.c | 2 +- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 2 +- drivers/firmware/meson/meson_sm.c | 7 +- drivers/gpio/gpio-wcd934x.c | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 21 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 4 + .../gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 + .../drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 5 +- .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 +- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- drivers/iio/adc/xilinx-ams.c | 47 ++- drivers/iio/dac/ad5360.c | 2 +- drivers/iio/dac/ad5421.c | 2 +- drivers/iio/frequency/adf4350.c | 20 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 - drivers/iommu/intel/iommu.c | 2 +- drivers/irqchip/irq-sifive-plic.c | 13 +- drivers/mailbox/zynqmp-ipi-mailbox.c | 7 +- drivers/media/i2c/mt9v111.c | 2 +- drivers/media/mc/mc-devnode.c | 6 +- drivers/media/mc/mc-entity.c | 2 +- drivers/media/pci/cx18/cx18-queue.c | 13 +- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-yuv.c | 8 +- drivers/media/platform/qcom/venus/firmware.c | 8 +- drivers/media/rc/lirc_dev.c | 9 +- drivers/memory/samsung/exynos-srom.c | 10 +- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 5 +- drivers/misc/fastrpc.c | 37 +- drivers/mmc/core/sdio.c | 6 +- drivers/mtd/nand/raw/fsmc_nand.c | 6 +- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- drivers/net/wireless/ath/ath11k/core.c | 6 +- drivers/net/wireless/ath/ath11k/hal.c | 16 + drivers/net/wireless/ath/ath11k/hal.h | 1 + drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 3 + drivers/nvme/host/pci.c | 2 + drivers/of/unittest.c | 1 + drivers/pci/controller/dwc/pci-keystone.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 22 +- drivers/pci/controller/pci-tegra.c | 27 +- drivers/pci/controller/pcie-rcar-host.c | 40 +- drivers/pci/endpoint/functions/pci-epf-test.c | 19 +- drivers/pci/iov.c | 5 + drivers/pci/pci-driver.c | 1 + drivers/pci/pci-sysfs.c | 20 +- drivers/pci/pcie/aer.c | 12 +- drivers/pci/pcie/err.c | 8 +- drivers/pinctrl/samsung/pinctrl-samsung.h | 4 - drivers/power/supply/max77976_charger.c | 12 +- drivers/pwm/pwm-berlin.c | 4 +- drivers/rtc/interface.c | 27 ++ drivers/rtc/rtc-optee.c | 1 + drivers/rtc/rtc-x1205.c | 2 +- drivers/s390/cio/device.c | 37 +- drivers/scsi/hpsa.c | 21 +- drivers/scsi/mvsas/mv_init.c | 2 +- drivers/spi/spi-cadence-quadspi.c | 5 + drivers/video/fbdev/core/fb_cmdline.c | 2 +- drivers/xen/events/events_base.c | 37 +- drivers/xen/manage.c | 3 +- fs/btrfs/export.c | 8 +- fs/btrfs/extent_io.c | 14 +- fs/cramfs/inode.c | 11 +- fs/ext4/fsmap.c | 14 +- fs/ext4/inode.c | 10 +- fs/ext4/move_extent.c | 2 +- fs/ext4/orphan.c | 17 +- fs/ext4/xattr.c | 19 +- fs/file.c | 5 +- fs/fs-writeback.c | 32 +- fs/fsopen.c | 70 ++-- fs/minix/inode.c | 8 +- fs/namei.c | 8 + fs/namespace.c | 11 +- fs/nfsd/lockd.c | 15 + fs/nfsd/nfs4proc.c | 2 +- fs/ntfs3/bitmap.c | 1 + fs/smb/client/smb1ops.c | 62 ++- fs/smb/client/smb2inode.c | 22 +- fs/smb/server/ksmbd_netlink.h | 5 +- fs/smb/server/server.h | 1 + fs/smb/server/transport_ipc.c | 3 + fs/smb/server/transport_tcp.c | 28 +- fs/squashfs/inode.c | 24 +- include/acpi/acpixf.h | 6 + include/asm-generic/io.h | 98 +++-- include/linux/iio/frequency/adf4350.h | 2 +- include/linux/ksm.h | 6 + include/linux/sched.h | 11 +- include/media/v4l2-subdev.h | 30 +- include/net/netfilter/nf_tables.h | 3 +- include/net/netfilter/nft_fib.h | 4 +- include/net/netfilter/nft_meta.h | 3 +- include/net/netfilter/nft_reject.h | 3 +- init/main.c | 12 + kernel/bpf/inode.c | 4 +- kernel/fork.c | 2 +- kernel/pid.c | 5 +- kernel/rseq.c | 10 +- kernel/sched/deadline.c | 73 ++-- kernel/sys.c | 22 +- kernel/trace/trace_fprobe.c | 11 +- kernel/trace/trace_kprobe.c | 11 +- kernel/trace/trace_probe.h | 9 +- kernel/trace/trace_uprobe.c | 12 +- lib/crypto/Makefile | 4 + lib/genalloc.c | 5 +- mm/damon/vaddr.c | 8 +- mm/hugetlb.c | 3 + mm/page_alloc.c | 2 +- net/bridge/br_vlan.c | 2 +- net/bridge/netfilter/nft_meta_bridge.c | 5 +- net/bridge/netfilter/nft_reject_bridge.c | 3 +- net/core/filter.c | 2 + net/ipv4/tcp.c | 5 +- net/ipv4/tcp_input.c | 1 - net/mptcp/pm.c | 7 +- net/mptcp/pm_netlink.c | 52 ++- net/mptcp/protocol.h | 8 + net/netfilter/nf_tables_api.c | 3 +- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_fib.c | 3 +- net/netfilter/nft_flow_offload.c | 3 +- net/netfilter/nft_fwd_netdev.c | 3 +- net/netfilter/nft_immediate.c | 3 +- net/netfilter/nft_lookup.c | 3 +- net/netfilter/nft_masq.c | 3 +- net/netfilter/nft_meta.c | 6 +- net/netfilter/nft_nat.c | 3 +- net/netfilter/nft_objref.c | 39 ++ net/netfilter/nft_osf.c | 3 +- net/netfilter/nft_queue.c | 3 +- net/netfilter/nft_redir.c | 3 +- net/netfilter/nft_reject.c | 3 +- net/netfilter/nft_reject_inet.c | 3 +- net/netfilter/nft_reject_netdev.c | 3 +- net/netfilter/nft_rt.c | 3 +- net/netfilter/nft_socket.c | 3 +- net/netfilter/nft_synproxy.c | 3 +- net/netfilter/nft_tproxy.c | 3 +- net/netfilter/nft_xfrm.c | 3 +- net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- security/keys/trusted-keys/trusted_tpm1.c | 7 +- sound/soc/sof/ipc4-topology.h | 4 +- tools/build/feature/Makefile | 4 +- tools/lib/perf/include/perf/event.h | 1 + tools/perf/builtin-stat.c | 18 +- tools/perf/tests/perf-record.c | 4 + tools/perf/tests/shell/stat.sh | 29 ++ tools/perf/util/arm-spe-decoder/arm-spe-decoder.h | 18 +- tools/perf/util/arm-spe.c | 34 +- tools/perf/util/evsel.c | 31 +- tools/perf/util/lzma.c | 2 +- tools/perf/util/session.c | 2 +- tools/perf/util/setup.py | 5 +- tools/perf/util/zlib.c | 2 +- tools/testing/selftests/mm/madv_populate.c | 21 +- tools/testing/selftests/mm/soft-dirty.c | 5 +- tools/testing/selftests/mm/vm_util.c | 77 ++++ tools/testing/selftests/mm/vm_util.h | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 + tools/testing/selftests/rseq/rseq.c | 8 +- 217 files changed, 1951 insertions(+), 1097 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/201 fs: always return zero on success from replace_fd()
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 upstream.
replace_fd() returns the number of the new file descriptor through the return value of do_dup2(). However its callers never care about the specific returned number. In fact the caller in receive_fd_replace() treats any non-zero return value as an error and therefore never calls __receive_sock() for most file descriptors, which is a bug.
To fix the bug in receive_fd_replace() and to avoid the same issue happening in future callers, signal success through a plain zero.
--- fs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/file.c +4 -1
@@ -1138,7 +1138,10 @@ int replace_fd(unsigned fd, struct file err =expand_files (files, fd);if (unlikely (err <0 )) goto out_unlock; -return do_dup2 (files, file, fd, flags); + err =do_dup2 (files, file, fd, flags); +if (err <0 ) +return err; +return 0 ; out_unlock:spin_unlock (&files->file_lock);
Greg Kroah-Hartman
maintainerPATCH 2/201 fscontext: do not consume log entries when returning -EMSGSIZE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit 72d271a7baa7062cb27e774ac37c5459c6d20e22 upstream.
Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case.
Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. While we're at it, refactor some fscontext_read() into a separate helper to make the ring buffer logic a bit easier to read.
--- fs/fsopen.c | 70 ++++++++++++++++++++++++++++++++---------------------------- 1 file changed, 38 insertions(+), 32 deletions(-)
fs/fsopen.c +38 -32
@@ -18,50 +18,56 @@#include "internal.h" #include "mount.h" +static inline const char *fetch_message_locked (struct fc_log *log,size_t len, +bool *need_free) +{ +const char *p; +int index; + +if (unlikely (log->head == log->tail)) +return ERR_PTR (-ENODATA ); + + index = log->tail & (ARRAY_SIZE (log->buffer) -1 ); + p = log->buffer[index]; +if (unlikely (strlen (p) > len)) +return ERR_PTR (-EMSGSIZE ); + + log->buffer[index] =NULL ; + *need_free = log->need_free & (1 << index); + log->need_free &= ~(1 << index); + log->tail++; + +return p; +} +/* * Allow the user to read back any error, warning or informational messages. +* Only one message is returned for each read(2) call. */ static ssize_t fscontext_read (struct file *file,char __user *_buf,size_t len,loff_t *pos) {struct fs_context *fc = file->private_data; -struct fc_log *log = fc->log.log; -unsigned int logsize =ARRAY_SIZE (log->buffer); -ssize_t ret; -char *p; +ssize_t err; + const char *p __free(kfree) = NULL, *message;bool need_free; -int index, n; - - ret =mutex_lock_interruptible (&fc->uapi_mutex); -if (ret <0 ) -return ret; - -if (log->head == log->tail) { -mutex_unlock (&fc->uapi_mutex); -return -ENODATA ; - } +int n; - index = log->tail & (logsize -1 ); - p = log->buffer[index]; - need_free = log->need_free & (1 << index); - log->buffer[index] =NULL ; - log->need_free &= ~(1 << index); - log->tail++; + err =mutex_lock_interruptible (&fc->uapi_mutex); +if (err <0 ) +return err; + message =fetch_message_locked (fc->log.log, len, &need_free);mutex_unlock (&fc->uapi_mutex); +if (IS_ERR (message)) +return PTR_ERR (message); - ret = -EMSGSIZE ; - n =strlen (p); -if (n > len) - goto err_free; - ret = -EFAULT ; -if (copy_to_user (_buf, p, n) !=0 ) - goto err_free; - ret = n; - -err_free:if (need_free) -kfree (p); -return ret; + p = message; + + n =strlen (message); +if (copy_to_user (_buf, message, n)) +return -EFAULT ; +return n; }static int fscontext_release (struct inode *inode,struct file *file)
Greg Kroah-Hartman
maintainerPATCH 3/201 clocksource/drivers/clps711x: Fix resource leaks in error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit cd32e596f02fc981674573402c1138f616df1728 upstream.
The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths.
--- drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/clps711x-timer.c +16 -7
@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(stunsigned int irq =irq_of_parse_and_map (np,0 );struct clk *clock =of_clk_get (np,0 );void __iomem *base =of_iomap (np,0 ); +int ret =0 ;if (!base)return -ENOMEM ; -if (!irq) -return -EINVAL ; -if (IS_ERR (clock)) -return PTR_ERR (clock); +if (!irq) { + ret = -EINVAL ; + goto unmap_io; + } +if (IS_ERR (clock)) { + ret =PTR_ERR (clock); + goto unmap_io; + }switch (of_alias_get_id (np,"timer" )) {case CLPS711X_CLKSRC_CLOCKSOURCE :clps711x_clksrc_init (clock, base);break ;case CLPS711X_CLKSRC_CLOCKEVENT : -return _clps711x_clkevt_init (clock, base, irq); + ret =_clps711x_clkevt_init (clock, base, irq); +break ;default : -return -EINVAL ; + ret = -EINVAL ; +break ; } -return 0 ; +unmap_io: +iounmap (base); +return ret; }TIMER_OF_DECLARE (clps711x,"cirrus,ep7209-timer" , clps711x_timer_init);
Greg Kroah-Hartman
maintainerPATCH 4/201 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly.
--- include/linux/iio/frequency/adf4350.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/frequency/adf4350.h +1 -1
@@ -51,7 +51,7 @@/* REG3 Bit Definitions */ #define ADF4350_REG3_12BIT_CLKDIV (x) ((x) << 3) -#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 16) +#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 15)#define ADF4350_REG3_12BIT_CSR_EN (1 << 18)#define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)#define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
Greg Kroah-Hartman
maintainerPATCH 5/201 media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream.
v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash.
Add proper error handling to v4l2_subdev_call_state_try().
--- include/media/v4l2-subdev.h | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
include/media/v4l2-subdev.h +17 -13
@@ -1881,19 +1881,23 @@ extern const struct v4l2_subdev_ops v4l2* * Note: only legacy non-MC drivers may need this macro. */ -#define v4l2_subdev_call_state_try(sd, o, f, args...) \ - ({ \ - int __result; \ - static struct lock_class_key __key; \ - const char *name = KBUILD_BASENAME \ - ":" __stringify(__LINE__) ":state->lock"; \ - struct v4l2_subdev_state *state = \ - __v4l2_subdev_state_alloc(sd, name, &__key); \ - v4l2_subdev_lock_state(state); \ - __result = v4l2_subdev_call(sd, o, f, state, ##args); \ - v4l2_subdev_unlock_state(state); \ - __v4l2_subdev_state_free(state); \ - __result; \ +#define v4l2_subdev_call_state_try(sd, o, f, args...) \ + ({ \ + int __result; \ + static struct lock_class_key __key; \ + const char *name = KBUILD_BASENAME \ + ":" __stringify(__LINE__) ":state->lock"; \ + struct v4l2_subdev_state *state = \ + __v4l2_subdev_state_alloc(sd, name, &__key); \ + if (IS_ERR(state)) { \ + __result = PTR_ERR(state); \ + } else { \ + v4l2_subdev_lock_state(state); \ + __result = v4l2_subdev_call(sd, o, f, state, ##args); \ + v4l2_subdev_unlock_state(state); \ + __v4l2_subdev_state_free(state); \ + } \ + __result; \ })/**
Greg Kroah-Hartman
maintainerPATCH 6/201 asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varad Gautam <[email protected]>
commit 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 upstream.
With CONFIG_TRACE_MMIO_ACCESS=y, the {read,write}{b,w,l,q}{_relaxed}() mmio accessors unconditionally call log_{post_}{read,write}_mmio() helpers, which in turn call the ftrace ops for rwmmio trace events
This adds a performance penalty per mmio accessor call, even when rwmmio events are disabled at runtime (~80% overhead on local measurement).
Guard these with tracepoint_enabled().
--- include/asm-generic/io.h | 98 +++++++++++++++++++++++++++++++---------------- 1 file changed, 66 insertions(+), 32 deletions(-)
include/asm-generic/io.h +66 -32
@@ -74,6 +74,7 @@#if IS_ENABLED (CONFIG_TRACE_MMIO_ACCESS ) && !(defined(__DISABLE_TRACE_MMIO__))#include <linux/tracepoint-defs.h> +#define rwmmio_tracepoint_enabled (tracepoint) tracepoint_enabled(tracepoint)DECLARE_TRACEPOINT (rwmmio_write);DECLARE_TRACEPOINT (rwmmio_post_write);DECLARE_TRACEPOINT (rwmmio_read);
@@ -90,6 +91,7 @@ void log_post_read_mmio(u64 val, u8 widt#else +#define rwmmio_tracepoint_enabled (tracepoint) falsestatic inline void log_write_mmio (u64 val,u8 width,volatile void __iomem *addr,unsigned long caller_addr,unsigned long caller_addr0) {} static inline void log_post_write_mmio(u64 val, u8 width, volatile void __iomem *addr,
@@ -188,11 +190,13 @@ static inline u8 readb(const volatile vo {u8 val; -log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__raw_readb (addr);__io_ar (val); -log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -203,11 +207,13 @@ static inline u16 readw(const volatile v {u16 val; -log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le16_to_cpu ((__le16 __force )__raw_readw (addr));__io_ar (val); -log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -218,11 +224,13 @@ static inline u32 readl(const volatile v {u32 val; -log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le32_to_cpu ((__le32 __force )__raw_readl (addr));__io_ar (val); -log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -234,11 +242,13 @@ static inline u64 readq(const volatile v {u64 val; -log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le64_to_cpu ((__le64 __force )__raw_readq (addr));__io_ar (val); -log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -248,11 +258,13 @@ static inline u64 readq(const volatile v#define writeb writebstatic inline void writeb (u8 value,volatile void __iomem *addr) { -log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writeb (value, addr);__io_aw (); -log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -260,11 +272,13 @@ static inline void writeb(u8 value, vola#define writew writewstatic inline void writew (u16 value,volatile void __iomem *addr) { -log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writew ((u16 __force )cpu_to_le16 (value), addr);__io_aw (); -log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -272,11 +286,13 @@ static inline void writew(u16 value, vol#define writel writelstatic inline void writel (u32 value,volatile void __iomem *addr) { -log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writel ((u32 __force )__cpu_to_le32 (value), addr);__io_aw (); -log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -285,11 +301,13 @@ static inline void writel(u32 value, vol#define writeq writeqstatic inline void writeq (u64 value,volatile void __iomem *addr) { -log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writeq ((u64 __force )__cpu_to_le64 (value), addr);__io_aw (); -log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); }#endif #endif /* CONFIG_64BIT */
@@ -305,9 +323,11 @@ static inline u8 readb_relaxed(const vol {u8 val; -log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); val =__raw_readb (addr); -log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -318,9 +338,11 @@ static inline u16 readw_relaxed(const vo {u16 val; -log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); val =__le16_to_cpu ((__le16 __force )__raw_readw (addr)); -log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -331,9 +353,11 @@ static inline u32 readl_relaxed(const vo {u32 val; -log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); val =__le32_to_cpu ((__le32 __force )__raw_readl (addr)); -log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -344,9 +368,11 @@ static inline u64 readq_relaxed(const vo {u64 val; -log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); val =__le64_to_cpu ((__le64 __force )__raw_readq (addr)); -log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -355,9 +381,11 @@ static inline u64 readq_relaxed(const vo#define writeb_relaxed writeb_relaxedstatic inline void writeb_relaxed (u8 value,volatile void __iomem *addr) { -log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_);__raw_writeb (value, addr); -log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -365,9 +393,11 @@ static inline void writeb_relaxed(u8 val#define writew_relaxed writew_relaxedstatic inline void writew_relaxed (u16 value,volatile void __iomem *addr) { -log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_);__raw_writew ((u16 __force )cpu_to_le16 (value), addr); -log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -375,9 +405,11 @@ static inline void writew_relaxed(u16 va#define writel_relaxed writel_relaxedstatic inline void writel_relaxed (u32 value,volatile void __iomem *addr) { -log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_);__raw_writel ((u32 __force )__cpu_to_le32 (value), addr); -log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -385,9 +417,11 @@ static inline void writel_relaxed(u32 va#define writeq_relaxed writeq_relaxedstatic inline void writeq_relaxed (u64 value,volatile void __iomem *addr) { -log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_);__raw_writeq ((u64 __force )__cpu_to_le64 (value), addr); -log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); }#endif
Greg Kroah-Hartman
maintainerPATCH 7/201 perf evsel: Avoid container_of on a NULL leader
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
An evsel should typically have a leader of itself, however, in tests like 'Sample parsing' a NULL leader may occur and the container_of will return a corrupt pointer.
Avoid this with an explicit NULL test.
--- tools/perf/util/evsel.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/util/evsel.c +2 -0
@@ -3131,6 +3131,8 @@ bool evsel__is_hybrid(const struct evsel *evsel)struct evsel *evsel__leader (const struct evsel *evsel) { +if (evsel->core.leader ==NULL ) +return NULL ; return container_of(evsel->core.leader, struct evsel, core); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/201 libperf event: Ensure tracing data is multiple of 8 sized
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
Perf's synthetic-events.c will ensure 8-byte alignment of tracing data, writing it after a perf_record_header_tracing_data event.
Add padding to struct perf_record_header_tracing_data to make it 16-byte rather than 12-byte sized.
--- tools/lib/perf/include/perf/event.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/perf/include/perf/event.h +1 -0
@@ -285,6 +285,7 @@ struct perf_record_header_event_type {struct perf_record_header_tracing_data {struct perf_event_header header;__u32 size; +__u32 pad; };#define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/201 clk: at91: peripheral: fix return value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
determine_rate() is expected to return an error code, or 0 on success. clk_sam9x5_peripheral_determine_rate() has a branch that returns the parent rate on a certain case. This is the behavior of round_rate(), so let's go ahead and fix this by setting req->rate.
--- drivers/clk/at91/clk-peripheral.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/at91/clk-peripheral.c +5 -2
@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,long best_diff =LONG_MIN ;u32 shift; -if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) -return parent_rate; +if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) { + req->rate = parent_rate; + +return 0 ; + }/* Fist step: check the available dividers. */ for (shift =0 ; shift <=PERIPHERAL_MAX_SHIFT ; shift++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/201 perf util: Fix compression checks returning -1 as bool
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1.
A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers.
Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch.
--- tools/perf/util/lzma.c | 2 +- tools/perf/util/zlib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/lzma.c +1 -1
@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
tools/perf/util/zlib.c +1 -1
@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/201 rtc: x1205: Fix Xicor X1205 vendor prefix
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered.
--- drivers/rtc/rtc-x1205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-x1205.c +1 -1
@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {MODULE_DEVICE_TABLE (i2c, x1205_id);static const struct of_device_id x1205_dt_ids[] = { - { .compatible ="xircom,x1205" , }, + { .compatible ="xicor,x1205" , }, {}, };MODULE_DEVICE_TABLE (of, x1205_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/201 rtc: optee: fix memory leak on driver removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
Fix a memory leak in case of driver removal.
Free the shared memory used for arguments exchanges between kernel and OP-TEE RTC PTA.
--- drivers/rtc/rtc-optee.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-optee.c +1 -0
@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) {struct optee_rtc *priv =dev_get_drvdata (dev); +tee_shm_free (priv->shm);tee_client_close_session (priv->ctx, priv->session_id);tee_client_close_context (priv->ctx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/201 perf arm_spe: Correct setting remote access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
Set the mem_remote field for a remote access to appropriately represent the event.
--- tools/perf/util/arm-spe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/arm-spe.c +1 -1
@@ -514,7 +514,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco }if (record->type &ARM_SPE_REMOTE_ACCESS ) - data_src->mem_lvl |=PERF_MEM_LVL_REM_CCE1 ; + data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; }static u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/201 perf arm-spe: Rename the common data source encoding
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
The Neoverse CPUs follow the common data source encoding, and other CPU variants can share the same format.
Rename the CPU list and data source definitions as common data source names. This change prepares for appending more CPU variants.
Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
--- .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ tools/perf/util/arm-spe.c | 28 +++++++++---------- 2 files changed, 23 insertions(+), 23 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +9 -9
@@ -56,15 +56,15 @@ enum arm_spe_op_type { ARM_SPE_OP_BR_INDIRECT = 1 << 17, }; -enum arm_spe_neoverse_data_source { -ARM_SPE_NV_L1D =0x0 , -ARM_SPE_NV_L2 =0x8 , -ARM_SPE_NV_PEER_CORE =0x9 , -ARM_SPE_NV_LOCAL_CLUSTER =0xa , -ARM_SPE_NV_SYS_CACHE =0xb , -ARM_SPE_NV_PEER_CLUSTER =0xc , -ARM_SPE_NV_REMOTE =0xd , -ARM_SPE_NV_DRAM =0xe , +enum arm_spe_common_data_source { +ARM_SPE_COMMON_DS_L1D =0x0 , +ARM_SPE_COMMON_DS_L2 =0x8 , +ARM_SPE_COMMON_DS_PEER_CORE =0x9 , +ARM_SPE_COMMON_DS_LOCAL_CLUSTER =0xa , +ARM_SPE_COMMON_DS_SYS_CACHE =0xb , +ARM_SPE_COMMON_DS_PEER_CLUSTER =0xc , +ARM_SPE_COMMON_DS_REMOTE =0xd , +ARM_SPE_COMMON_DS_DRAM =0xe , };struct arm_spe_record {
tools/perf/util/arm-spe.c +14 -14
@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq,return arm_spe_deliver_synth_event (spe, speq, event, &sample); } -static const struct midr_range neoverse_spe[] = { +static const struct midr_range common_ds_encoding_cpus[] = {MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N1 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N2 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V1 ), {}, }; -static void arm_spe__synth_data_source_neoverse (const struct arm_spe_record *record, -union perf_mem_data_src *data_src) +static void arm_spe__synth_data_source_common (const struct arm_spe_record *record, +union perf_mem_data_src *data_src) {/* * Even though four levels of cache hierarchy are possible, no known
@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec }switch (record->source) { -case ARM_SPE_NV_L1D : +case ARM_SPE_COMMON_DS_L1D : data_src->mem_lvl =PERF_MEM_LVL_L1 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L1 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_L2 : +case ARM_SPE_COMMON_DS_L2 : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_PEER_CORE : +case ARM_SPE_COMMON_DS_PEER_CORE : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know if this is L1, L2 but we do know it was a cache-2-cache * transfer, so set SNOOPX_PEER */ -case ARM_SPE_NV_LOCAL_CLUSTER : -case ARM_SPE_NV_PEER_CLUSTER : +case ARM_SPE_COMMON_DS_LOCAL_CLUSTER : +case ARM_SPE_COMMON_DS_PEER_CLUSTER : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec/* * System cache is assumed to be L3 */ -case ARM_SPE_NV_SYS_CACHE : +case ARM_SPE_COMMON_DS_SYS_CACHE : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoop =PERF_MEM_SNOOP_HIT ;
@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know what level it hit in, except it came from the other * socket */ -case ARM_SPE_NV_REMOTE : +case ARM_SPE_COMMON_DS_REMOTE : data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ; -case ARM_SPE_NV_DRAM : +case ARM_SPE_COMMON_DS_DRAM : data_src->mem_lvl =PERF_MEM_LVL_LOC_RAM |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_RAM ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;
@@ -520,7 +520,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *recostatic u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr) {union perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA }; -bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe); +bool is_common =is_midr_in_range_list (midr, common_ds_encoding_cpus);/* Only synthesize data source for LDST operations */ if (!is_ldst_op (record->op))
@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 melse return 0 ; -if (is_neoverse) -arm_spe__synth_data_source_neoverse (record, &data_src); +if (is_common) +arm_spe__synth_data_source_common (record, &data_src);else arm_spe__synth_data_source_generic (record, &data_src);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/201 perf arm_spe: Correct memory level for remote access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
For remote accesses, the data source packet does not contain information about the memory level. To avoid misinformation, set the memory level to NA (Not Available).
--- tools/perf/util/arm-spe.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/arm-spe.c +2 -2
@@ -479,8 +479,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor* socket */ case ARM_SPE_COMMON_DS_REMOTE : - data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; - data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; + data_src->mem_lvl =PERF_MEM_LVL_NA ; + data_src->mem_lvl_num =PERF_MEM_LVLNUM_NA ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/201 perf session: Fix handling when buffer exceeds 2 GiB
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative.
As a result, the perf record command reports an error:
0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly.
--- tools/perf/util/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/session.c +1 -1
@@ -1662,7 +1662,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,struct perf_tool *tool = session->tool;struct perf_sample sample = { .time =0 , };int fd =perf_data__fd (session->data); -int err; +s64 err;if (event->header.type !=PERF_RECORD_COMPRESSED || tool->compressed == perf_session__process_compressed_event_stub)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/201 perf test: Dont leak workload gopipe in PERF_RECORD_*
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
The test starts a workload and then opens events. If the events fail to open, for example because of perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.
Before:
```
$ perf test -vv 7
7: PERF_RECORD_* events & perf_sample fields:
--- start ---
test child forked, pid 1189568
Using CPUID GenuineIntel-6-B7-1
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
Attempt to add: software/cpu-clock/
..after resolving event: software/config=0/
cpu-clock -> software/cpu-clock/
------------------------------------------------------------
perf_event_attr:
type 1 (PERF_TYPE_SOFTWARE)
size 136
config 0x9 (PERF_COUNT_SW_DUMMY)
sample_type IP|TID|TIME|CPU
read_format ID|LOST
disabled 1
inherit 1
mmap 1
comm 1
enable_on_exec 1
task 1
sample_id_all 1
mmap2 1
comm_exec 1
ksymbol 1
bpf_event 1
{ wakeup_events, wakeup_watermark } 1
------------------------------------------------------------
sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
perf_evlist__open: Permission denied
---- end(-2) ----
Leak of file descriptor 6 that opened: 'pipe:[14200347]'
---- unexpected signal (6) ----
iFailed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
#0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
#1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
#2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
#3 0x7f29ce849cc2 in raise raise.c:27
#4 0x7f29ce8324ac in abort abort.c:81
#5 0x565358f662d4 in check_leaks builtin-test.c:226
#6 0x565358f6682e in run_test_child builtin-test.c:344
#7 0x565358ef7121 in start_command run-command.c:128
#8 0x565358f67273 in start_test builtin-test.c:545
#9 0x565358f6771d in __cmd_test builtin-test.c:647
#10 0x565358f682bd in cmd_test builtin-test.c:849
#11 0x565358ee5ded in run_builtin perf.c:349
#12 0x565358ee6085 in handle_internal_command perf.c:401
#13 0x565358ee61de in run_argv perf.c:448
#14 0x565358ee6527 in main perf.c:555
#15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
#16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
#17 0x565358e391c1 in _start perf[851c1]
7: PERF_RECORD_* events & perf_sample fields : FAILED!
```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```
--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/perf/tests/perf-record.c +4 -0
@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/201 perf test: Add a test for default perf stat command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 65d11821910bd910a2b4b5b005360d036c76ecef ]
Test that one cycles event is opened for each core PMU when "perf stat" is run without arguments.
The event line can either be output as "pmu/cycles/" or just "cycles" if there is only one PMU. Include 2 spaces for padding in the one PMU case to avoid matching when the word cycles is included in metric descriptions.
Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
--- tools/perf/tests/shell/stat.sh | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
tools/perf/tests/shell/stat.sh +25 -0
@@ -146,6 +146,30 @@ test_cputype() { echo "cputype test [Success]" } +test_hybrid() { + # Test the default stat command on hybrid devices opens one cycles event for + # each CPU type. + echo "hybrid test" + + # Count the number of core PMUs, assume minimum of 1 + pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l) + if [ "$pmus" -lt 1 ] + then + pmus=1 + fi + + # Run default Perf stat + cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) + + if [ "$pmus" -ne "$cycles_events" ] + then + echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]" + err=1 + return + fi + echo "hybrid test [Success]" +} + test_default_stat test_stat_record_report test_stat_record_script
@@ -153,4 +177,5 @@ test_stat_repeat_weak_groups test_topdown_groups test_topdown_weak_groups test_cputype +test_hybrid exit $err
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/201 perf tools: Add fallback for exclude_guest
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit bb6e7cb11d97ce1957894d30d13bfad3e8bfefe9 ]
Commit 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default") changed to parse "cycles:P" event instead of creating a new cycles event for perf record. But it also changed the way how modifiers are handled so it doesn't set the exclude_guest bit by default.
It seems Apple M1 PMU requires exclude_guest set and returns EOPNOTSUPP if not. Let's add a fallback so that it can work with default events.
Also update perf stat hybrid tests to handle possible u or H modifiers.
Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
--- tools/perf/builtin-stat.c | 18 +++++++++++++++--- tools/perf/tests/shell/stat.sh | 2 +- tools/perf/util/evsel.c | 21 +++++++++++++++++++++ 3 files changed, 37 insertions(+), 4 deletions(-)
tools/perf/builtin-stat.c +15 -3
@@ -638,8 +638,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)* (behavior changed with commit b0a873e). */ if (errno ==EINVAL || errno ==ENOSYS || - errno ==ENOENT || errno ==EOPNOTSUPP || - errno ==ENXIO ) { + errno ==ENOENT || errno ==ENXIO ) {if (verbose >0 )ui__warning ("%s event is not supported by the kernel.\n" ,evsel__name (counter));
@@ -657,7 +656,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)if (verbose >0 )ui__warning ("%s\n" , msg);return COUNTER_RETRY ; - }else if (target__has_per_thread (&target) && + }else if (target__has_per_thread (&target) && errno !=EOPNOTSUPP && evsel_list->core.threads && evsel_list->core.threads->err_thread !=-1 ) {/*
@@ -678,6 +677,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)return COUNTER_SKIP ; } +if (errno ==EOPNOTSUPP ) { +if (verbose >0 ) { +ui__warning ("%s event is not supported by the kernel.\n" , +evsel__name (counter)); + } + counter->supported = false; + counter->errored = true; + +if ((evsel__leader (counter) != counter) || + !(counter->core.leader->nr_members >1 )) +return COUNTER_SKIP ; + } +evsel__open_strerror (counter, &target, errno, msg,sizeof (msg));ui__error ("%s\n" , msg);
tools/perf/tests/shell/stat.sh +1 -1
@@ -159,7 +159,7 @@ test_hybrid() { fi # Run default Perf stat - cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) + cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) if [ "$pmus" -ne "$cycles_events" ] then
tools/perf/util/evsel.c +21 -0
@@ -2892,6 +2892,27 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) evsel->core.attr.exclude_kernel =1 ; evsel->core.attr.exclude_hv =1 ; +return true; + }else if (err ==EOPNOTSUPP && !evsel->core.attr.exclude_guest && + !evsel->exclude_GH) { +const char *name =evsel__name (evsel); +char *new_name; +const char *sep =":" ; + +/* Is there already the separator in the name. */ +if (strchr (name,'/' ) || + (strchr (name,':' ) && !evsel->is_libpfm_event)) + sep ="" ; + +if (asprintf (&new_name,"%s%sH" , name, sep) <0 ) +return false; + +free (evsel->name); + evsel->name = new_name; +/* Apple M1 requires exclude_guest */ +scnprintf (msg, msgsize,"trying to fall back to excluding guest samples" ); + evsel->core.attr.exclude_guest =1 ; +return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/201 perf evsel: Ensure the fallback message is always written to
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ]
The fallback message is unconditionally printed in places like record__open().
If no fallback is attempted this can lead to printing uninitialized data, crashes, etc.
--- tools/perf/util/evsel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/perf/util/evsel.c +7 -5
@@ -2874,7 +2874,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize)/* If event has exclude user then don't exclude kernel. */ if (evsel->core.attr.exclude_user) -return false; + goto no_fallback;/* Is there already the separator in the name. */ if (strchr(name, '/') ||
@@ -2882,7 +2882,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) sep ="" ;if (asprintf (&new_name,"%s%su" , name, sep) <0 ) -return false; + goto no_fallback;free (evsel->name); evsel->name = new_name;
@@ -2905,17 +2905,19 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) sep ="" ;if (asprintf (&new_name,"%s%sH" , name, sep) <0 ) -return false; + goto no_fallback;free (evsel->name); evsel->name = new_name;/* Apple M1 requires exclude_guest */ -scnprintf (msg, msgsize,"trying to fall back to excluding guest samples" ); +scnprintf (msg, msgsize,"Trying to fall back to excluding guest samples" ); evsel->core.attr.exclude_guest =1 ;return true; } - +no_fallback: +scnprintf (msg, msgsize,"No fallback found for '%s' for error %d" , +evsel__name (evsel), err);return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/201 clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
The infrastructure gate for the HDMI specific crystal needs the top_hdmi_xtal clock to be configured in order to ungate the 26m clock to the HDMI IP, and it wouldn't work without.
Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
--- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/mediatek/clk-mt8195-infra_ao.c +1 -1
@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {GATE_INFRA_AO0 (CLK_INFRA_AO_CQ_DMA_FPC ,"infra_ao_cq_dma_fpc" ,"fpc" ,28 ),GATE_INFRA_AO0 (CLK_INFRA_AO_UART5 ,"infra_ao_uart5" ,"top_uart" ,29 ),/* INFRA_AO1 */ -GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"clk26m" ,0 ), +GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"top_hdmi_xtal" ,0 ),GATE_INFRA_AO1 (CLK_INFRA_AO_SPI0 ,"infra_ao_spi0" ,"top_spi" ,1 ),GATE_INFRA_AO1 (CLK_INFRA_AO_MSDC0 ,"infra_ao_msdc0" ,"top_msdc50_0_hclk" ,2 ), GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/201 clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
The flags in |struct mtk_mux| are core clk flags, not mux clk flags. Passing one to the other is wrong.
Since there aren't any actual users adding CLK_MUX_* flags, just drop it for now.
--- drivers/clk/mediatek/clk-mux.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/clk/mediatek/clk-mux.c +1 -3
@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)static int mtk_clk_mux_determine_rate (struct clk_hw *hw,struct clk_rate_request *req) { -struct mtk_clk_mux *mux =to_mtk_clk_mux (hw); - -return clk_mux_determine_rate_flags (hw, req, mux->data->flags); +return clk_mux_determine_rate_flags (hw, req,0 ); }const struct clk_ops mtk_mux_clr_set_upd_ops = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/201 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series.
Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +9 -7
@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,return 0 ; } -static long lpc18xx_pll0_round_rate (struct clk_hw *hw,unsigned long rate, -unsigned long *prate) +static int lpc18xx_pll0_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) {unsigned long m; -if (*prate < rate) { +if (req->best_parent_rate < req->rate) {pr_warn ("%s: pll dividers not supported\n" , __func__);return -EINVAL ; } - m =DIV_ROUND_UP_ULL (*prate, rate *2 ); + m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 );if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { -pr_warn ("%s: unable to support rate %lu\n" , __func__, rate); +pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; } -return 2 * *prate * m; + req->rate =2 * req->best_parent_rate * m; + +return 0 ; } static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,static const struct clk_ops lpc18xx_pll0_ops = { .recalc_rate = lpc18xx_pll0_recalc_rate, - .round_rate = lpc18xx_pll0_round_rate, + .determine_rate = lpc18xx_pll0_determine_rate, .set_rate = lpc18xx_pll0_set_rate, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/201 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
This ensures proper bounds checking during clk rate setting and rounding.
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +2 -2
@@ -382,7 +382,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, } m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; }
@@ -405,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, } m =DIV_ROUND_UP_ULL (parent_rate, rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, rate);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/201 clk: tegra: do not overallocate memory for bpmp clocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
struct tegra_bpmp::clocks is a pointer to a dynamically allocated array of pointers to 'struct tegra_bpmp_clk'.
But the size of the allocated area is calculated like it is an array containing actual 'struct tegra_bpmp_clk' objects - it's not true, there are just pointers.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
--- drivers/clk/tegra/clk-bpmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/tegra/clk-bpmp.c +1 -1
@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, bpmp->num_clocks = count; - bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (struct tegra_bpmp_clk ),GFP_KERNEL ); + bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (*bpmp->clocks),GFP_KERNEL );if (!bpmp->clocks)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/201 cpufreq: tegra186: Set target frequency for all cpus in policy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
The original commit set all cores in a cluster to a shared policy, but did not update set_target to apply a frequency change to all cores for the policy. This caused most cores to remain stuck at their boot frequency.
--- drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/cpufreq/tegra186-cpufreq.c +6 -2
@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, {struct tegra186_cpufreq_data *data =cpufreq_get_driver_data ();struct cpufreq_frequency_table *tbl = policy->freq_table + index; -unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; +unsigned int edvd_offset;u32 edvd_val = tbl->driver_data; +u32 cpu; -writel (edvd_val, data->regs + edvd_offset); +for_each_cpu (cpu, policy->cpus) { + edvd_offset = data->cpus[cpu].edvd_offset; +writel (edvd_val, data->regs + edvd_offset); + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/201 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
mvs_pci_remove() |
mvs_free() | mvs_work_queue()
cancel_delayed_work() |
kfree(mvi) |
| mvi-> // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.
This bug was found by static analysis.
--- drivers/scsi/mvsas/mv_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mvsas/mv_init.c +1 -1
@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi)if (mvi->shost)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry) -cancel_delayed_work (&mwq->work_q); +cancel_delayed_work_sync (&mwq->work_q);kfree (mvi->rsvd_tags);kfree (mvi); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/201 ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ]
The firmware has changed the minimum host buffer size from 2 periods to 4 periods (1 period is 1ms) which was missed by the kernel side.
Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware.
--- sound/soc/sof/ipc4-topology.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/sof/ipc4-topology.h +2 -2
@@ -59,8 +59,8 @@#define SOF_IPC4_INVALID_NODE_ID 0xffffffff -/* FW requires minimum 2ms DMA buffer size */ -#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 +/* FW requires minimum 4ms DMA buffer size */ +#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4/* * The base of multi-gateways. Multi-gateways addressing starts from
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/201 LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 6c3ca6654a74dd396bc477839ba8d9792eced441 ]
Both acpi_table_upgrade() and acpi_boot_table_init() are defined as empty functions under !CONFIG_ACPI_TABLE_UPGRADE and !CONFIG_ACPI in include/linux/acpi.h, there are no implicit declaration errors with various configs.
#ifdef CONFIG_ACPI_TABLE_UPGRADE
void acpi_table_upgrade(void);
#else
static inline void acpi_table_upgrade(void) { }
#endif
#ifdef CONFIG_ACPI
...
void acpi_boot_table_init (void);
...
#else /* !CONFIG_ACPI */
...
static inline void acpi_boot_table_init(void)
{
}
...
#endif /* !CONFIG_ACPI */As Huacai suggested, CONFIG_ACPI_TABLE_UPGRADE is ugly and not necessary here, just remove it. At the same time, just keep CONFIG_ACPI to prevent potential build errors in future, and give a signal to indicate the code is ACPI-specific. For the same reason, we also put acpi_table_upgrade() under CONFIG_ACPI.
Stable-dep-of: 98662be7ef20 ("LoongArch: Init acpi_gbl_use_global_lock to false")
--- arch/loongarch/kernel/setup.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/loongarch/kernel/setup.c +1 -3
@@ -363,10 +363,8 @@ void __init platform_init(void)arch_reserve_vmcore ();arch_parse_crashkernel (); -#ifdef CONFIG_ACPI_TABLE_UPGRADE -acpi_table_upgrade (); -#endif #ifdef CONFIG_ACPI +acpi_table_upgrade (); acpi_gbl_use_default_register_widths = false;acpi_boot_table_init ();#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/201 LoongArch: Init acpi_gbl_use_global_lock to false
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
Init acpi_gbl_use_global_lock to false, in order to void error messages during boot phase:
ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
--- arch/loongarch/kernel/setup.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/kernel/setup.c +1 -0
@@ -365,6 +365,7 @@ void __init platform_init(void)#ifdef CONFIG_ACPI acpi_table_upgrade (); + acpi_gbl_use_global_lock = false; acpi_gbl_use_default_register_widths = false;acpi_boot_table_init ();#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/201 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,mlx4_unregister_mac (mdev->dev, priv->port, mac);hlist_del_rcu (&entry->hlist); -kfree_rcu (entry, rcu);en_dbg (DRV , priv,"Removed MAC %pM on port:%d\n" , entry->mac, priv->port); +kfree_rcu (entry, rcu); ++removed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/201 s390/cio: Update purge function to unregister the unused subchannels
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")', cio no longer unregisters subchannels when the attached device is invalid or unavailable.
As an unintended side-effect, the cio_ignore purge function no longer removes subchannels for devices on the cio_ignore list if no CCW device is attached. This situation occurs when a CCW device is non-operational or unavailable
To ensure the same outcome of the purge function as when the current cio_ignore list had been active during boot, update the purge function to remove I/O subchannels without working CCW devices if the associated device number is found on the cio_ignore list.
--- drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
drivers/s390/cio/device.c +24 -13
@@ -1318,23 +1318,34 @@ void ccw_device_schedule_recovery(void)spin_unlock_irqrestore (&recovery_lock, flags); } -static int purge_fn (struct device *dev,void *data) +static int purge_fn (struct subchannel *sch,void *data) { -struct ccw_device *cdev =to_ccwdev (dev); -struct ccw_dev_id *id = &cdev->private->dev_id; -struct subchannel *sch =to_subchannel (cdev->dev.parent); +struct ccw_device *cdev; -spin_lock_irq (cdev->ccwlock); -if (is_blacklisted (id->ssid, id->devno) && - (cdev->private->state ==DEV_STATE_OFFLINE ) && - (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) ==0 )) { -CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x\n" , id->ssid, - id->devno); +spin_lock_irq (&sch->lock); +if (sch->st !=SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) + goto unlock; + +if (!is_blacklisted (sch->schid.ssid, sch->schib.pmcw.dev)) + goto unlock; + + cdev =sch_get_cdev (sch); +if (cdev) { +if (cdev->private->state !=DEV_STATE_OFFLINE ) + goto unlock; + +if (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) !=0 ) + goto unlock;ccw_device_sched_todo (cdev,CDEV_TODO_UNREG ); -css_sched_sch_todo (sch,SCH_TODO_UNREG );atomic_set (&cdev->private->onoff,0 ); } -spin_unlock_irq (cdev->ccwlock); + +css_sched_sch_todo (sch,SCH_TODO_UNREG ); +CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x%s\n" , sch->schid.ssid, + sch->schib.pmcw.dev, cdev ?"" :" (no cdev)" ); + +unlock: +spin_unlock_irq (&sch->lock);/* Abort loop in case of pending signal. */ if (signal_pending (current))return -EINTR ;
@@ -1350,7 +1361,7 @@ static int purge_fn(struct device *dev, void *data)int ccw_purge_blacklisted (void ) {CIO_MSG_EVENT (2 ,"ccw: purging blacklisted devices\n" ); -bus_for_each_dev (&ccw_bus_type,NULL ,NULL , purge_fn); +for_each_subchannel_staged (purge_fn,NULL ,NULL );return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/201 drm/vmwgfx: Fix a null-ptr access in the cursor snooper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ]
Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it.
vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it.
Fixes unchecked null-ptr reference in the snooping code.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +12 -5
@@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, SVGA3dCmdHeader *header) {struct vmw_bo *vmw_bo =NULL ; +struct vmw_resource *res;struct vmw_surface *srf =NULL ;VMW_DECLARE_CMD_VAR (*cmd, SVGA3dCmdSurfaceDMA);int ret;
@@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, dirty = (cmd->body.transfer ==SVGA3D_WRITE_HOST_VRAM ) ?VMW_RES_DIRTY_SET :0 ; - ret =vmw_cmd_res_check (dev_priv, sw_context, vmw_res_surface, - dirty, user_surface_converter, - &cmd->body.host.sid,NULL ); + ret =vmw_cmd_res_check (dev_priv, sw_context, vmw_res_surface, dirty, + user_surface_converter, &cmd->body.host.sid, +NULL );if (unlikely (ret !=0 )) {if (unlikely (ret != -ERESTARTSYS ))VMW_DEBUG_USER ("could not find surface for DMA.\n" );return ret; } - srf =vmw_res_to_srf (sw_context->res_cache[vmw_res_surface].res); + res = sw_context->res_cache[vmw_res_surface].res; +if (!res) { +VMW_DEBUG_USER ("Invalid DMA surface.\n" ); +return -EINVAL ; + } -vmw_kms_cursor_snoop (srf, sw_context->fp->tfile, &vmw_bo->tbo, header); + srf =vmw_res_to_srf (res); +vmw_kms_cursor_snoop (srf, sw_context->fp->tfile, &vmw_bo->tbo, + header);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/201 drm/vmwgfx: Fix Use-after-free in validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +3 -1
@@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,hash_add_rcu (ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res =vmw_resource_reference_unless_doomed (res); -if (!node->res) +if (!node->res) { +hash_del_rcu (&node->hash.head);return -ESRCH ; + } node->first_usage =1 ;if (!res->dev_priv->has_mob) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/201 drm/vmwgfx: Fix copy-paste typo in validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
'entry' should be 'val' which is the loop iterator.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +1 -1
@@ -656,7 +656,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)hash_del_rcu (&val->hash.head);list_for_each_entry (val, &ctx->resource_ctx_list, head) -hash_del_rcu (&entry->hash.head); +hash_del_rcu (&val->hash.head); ctx->sw_context =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/201 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandr Sapozhnikov <[email protected]>
[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
--- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sm_statefuns.c +2 -1
@@ -884,7 +884,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,return SCTP_DISPOSITION_CONSUME ; nomem_authev: -sctp_ulpevent_free (ai_ev); +if (ai_ev) +sctp_ulpevent_free (ai_ev); nomem_aiev:sctp_ulpevent_free (ev); nomem_ev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/201 tcp: Dont call reqsk_fastopen_remove() in tcp_conn_request().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]:refcount_t: underflow; use-after-free.
WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
--- net/ipv4/tcp_input.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/tcp_input.c +0 -1
@@ -7200,7 +7200,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, &foc, TCP_SYNACK_FASTOPEN, skb);/* Add the child socket directly into the accept queue */ if (!inet_csk_reqsk_queue_add (sk, req, fastopen_sk)) { -reqsk_fastopen_remove (fastopen_sk, req, false);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk); goto drop_and_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/201 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <[email protected]>
[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node.
--- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fsl_pq_mdio.c +2 -0
@@ -483,10 +483,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)"missing 'reg' property in node %pOF\n" , tbi); err = -EBUSY ; +of_node_put (tbi); goto error; }set_tbipa (*prop, pdev, data->get_tbipa, priv->map, &res); +of_node_put (tbi); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/201 tools build: Align warning options with perf
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks.
Make the feature test program use the same warning options as perf.
--- tools/build/feature/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +2 -2
@@ -306,10 +306,10 @@ $(OUTPUT)test-libbabeltrace.bin: $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace) $(OUTPUT)test-compile-32.bin: - $(CC) -m32 -o $@ test-compile.c + $(CC) -m32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-compile-x32.bin: - $(CC) -mx32 -o $@ test-compile.c + $(CC) -mx32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-zlib.bin: $(BUILD) -lz
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/201 perf python: split Clang options when invoking Popen
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ]
When passing a list to subprocess.Popen, each element maps to one argv token. Current code bundles multiple Clang flags into a single element, something like:
cmd = ['clang',
'--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', 'test-hello.c']
So Clang only sees one long, invalid option instead of separate flags, as a result, the script cannot capture any log via PIPE.
Fix this by using shlex.split() to separate the string so each option becomes its own argv element. The fixed list will be:
cmd = ['clang',
'--target=x86_64-linux-gnu', '-fintegrated-as', '-Wno-cast-function-type-mismatch', 'test-hello.c']
--- tools/perf/util/setup.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/setup.py +4 -1
@@ -1,6 +1,7 @@ from os import getenv, path from subprocess import Popen, PIPE from re import sub +import shlex cc = getenv("CC")
@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline src_feature_tests = getenv('srctree') + '/tools/build/feature' def clang_has_option(option): - cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() + cmd = shlex.split(f"{cc} {cc_options} {option}") + cmd.append(path.join(src_feature_tests, "test-hello.c")) + cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] if cc_is_clang:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/201 tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ]
Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT on their listener, before accept().
This has an unfortunate effect on wscale selection in tcp_select_initial_window() during 3WHS.
For instance, tcp_mmap was negotiating wscale 4, regardless of tcp_rmem[2] and sysctl_rmem_max.
Do not change tp->window_clamp if it is zero
or bigger than our computed value.
Zero value is special, it allows tcp_select_initial_window() to enable autotuning.
Note that SO_RCVLOWAT use on listener is probably not wise, because tp->scaling_ratio has a default value, possibly wrong.
--- net/ipv4/tcp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +4 -1
@@ -1724,6 +1724,7 @@ EXPORT_SYMBOL(tcp_peek_len);/* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ int tcp_set_rcvlowat (struct sock *sk,int val) { +struct tcp_sock *tp =tcp_sk (sk);int space, cap;if (sk->sk_userlocks &SOCK_RCVBUF_LOCK )
@@ -1742,7 +1743,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) space =tcp_space_from_win (sk, val);if (space > sk->sk_rcvbuf) {WRITE_ONCE (sk->sk_rcvbuf, space); -WRITE_ONCE (tcp_sk (sk)->window_clamp, val); + +if (tp->window_clamp && tp->window_clamp < val) +WRITE_ONCE (tp->window_clamp, val); }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/201 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary.
Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - 1 file changed, 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +0 -1
@@ -617,7 +617,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (ipi_mbox->dev.parent) { -mbox_controller_unregister (&ipi_mbox->mbox);if (device_is_registered (&ipi_mbox->dev))device_unregister (&ipi_mbox->dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/201 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes.
device_is_registered() is the canonical and robust method to verify the registration status.
Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +2 -4
@@ -616,10 +616,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) i = pdata->num_mboxes;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i]; -if (ipi_mbox->dev.parent) { -if (device_is_registered (&ipi_mbox->dev)) -device_unregister (&ipi_mbox->dev); - } +if (device_is_registered (&ipi_mbox->dev)) +device_unregister (&ipi_mbox->dev); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/201 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster.
The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing.
The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first.
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -2273,6 +2273,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,if (IS_ERR (dst)) goto out_drop; +skb_dst_drop (skb);skb_dst_set (skb, dst); }else if (nh->nh_family !=AF_INET6 ) { goto out_drop;
@@ -2382,6 +2383,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } +skb_dst_drop (skb);skb_dst_set (skb, &rt->dst); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/201 drm/amdgpu: Add additional DCE6 SCL registers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
--- drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ 2 files changed, 9 insertions(+)
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +7 -0
@@ -4115,6 +4115,7 @@#define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40#define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL0_SCL_SCALER_ENABLE 0x1B42#define mmSCL0_SCL_CONTROL 0x1B44#define mmSCL0_SCL_DEBUG 0x1B6A#define mmSCL0_SCL_DEBUG2 0x1B69
@@ -4144,6 +4145,7 @@#define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55#define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40#define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 +#define mmSCL1_SCL_SCALER_ENABLE 0x1E42#define mmSCL1_SCL_CONTROL 0x1E44#define mmSCL1_SCL_DEBUG 0x1E6A#define mmSCL1_SCL_DEBUG2 0x1E69
@@ -4173,6 +4175,7 @@#define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155#define mmSCL2_SCL_COEF_RAM_SELECT 0x4140#define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 +#define mmSCL2_SCL_SCALER_ENABLE 0x4142#define mmSCL2_SCL_CONTROL 0x4144#define mmSCL2_SCL_DEBUG 0x416A#define mmSCL2_SCL_DEBUG2 0x4169
@@ -4202,6 +4205,7 @@#define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455#define mmSCL3_SCL_COEF_RAM_SELECT 0x4440#define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 +#define mmSCL3_SCL_SCALER_ENABLE 0x4442#define mmSCL3_SCL_CONTROL 0x4444#define mmSCL3_SCL_DEBUG 0x446A#define mmSCL3_SCL_DEBUG2 0x4469
@@ -4231,6 +4235,7 @@#define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755#define mmSCL4_SCL_COEF_RAM_SELECT 0x4740#define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 +#define mmSCL4_SCL_SCALER_ENABLE 0x4742#define mmSCL4_SCL_CONTROL 0x4744#define mmSCL4_SCL_DEBUG 0x476A#define mmSCL4_SCL_DEBUG2 0x4769
@@ -4260,6 +4265,7 @@#define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55#define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40#define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 +#define mmSCL5_SCL_SCALER_ENABLE 0x4A42#define mmSCL5_SCL_CONTROL 0x4A44#define mmSCL5_SCL_DEBUG 0x4A6A#define mmSCL5_SCL_DEBUG2 0x4A69
@@ -4287,6 +4293,7 @@#define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL_COEF_RAM_SELECT 0x1B40#define mmSCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL_SCALER_ENABLE 0x1B42#define mmSCL_CONTROL 0x1B44#define mmSCL_DEBUG 0x1B6A#define mmSCL_DEBUG2 0x1B69
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +2 -0
@@ -8648,6 +8648,8 @@#define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 +#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L +#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000#define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L#define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000#define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/201 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
Without these, it's impossible to program these registers.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,8 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \SRI (SCL_HORZ_FILTER_SCALE_RATIO ,SCL , id), \SRI (SCL_VERT_FILTER_SCALE_RATIO ,SCL , id), \ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/201 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
Previously, the code would set a bit field which didn't exist on DCE6 so it would be effectively a no-op.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +2 -4
@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {/* 4. Program vertical filters */ if (xfm_dce->filter_v ==NULL ) -REG_SET (SCL_VERT_FILTER_CONTROL ,0 , -SCL_V_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_VERT_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.v_taps,
@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(/* 5. Program horizontal filters */ if (xfm_dce->filter_h ==NULL ) -REG_SET (SCL_HORZ_FILTER_CONTROL ,0 , -SCL_H_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_HORZ_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.h_taps,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/201 drm/amd/display: Properly disable scaling on DCE6
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
SCL_SCALER_ENABLE can be used to enable/disable the scaler on DCE6. Program it to 0 when scaling isn't used, 1 when used. Additionally, clear some other registers when scaling is disabled and program the SCL_UPDATE register as recommended.
This fixes visible glitches for users whose BIOS sets up a mode with scaling at boot, which DC was unable to clean up.
--- .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +11 -4
@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(REG_SET (SCL_BYPASS_CONTROL ,0 ,SCL_BYPASS_MODE ,0 );if (data->taps.h_taps + data->taps.v_taps <=2 ) { -/* Set bypass */ - -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +/* Disable scaler functionality */ +REG_WRITE (SCL_SCALER_ENABLE ,0 ); +/* Clear registers that can cause glitches even when the scaler is off */ +REG_WRITE (SCL_TAP_CONTROL ,0 ); +REG_WRITE (SCL_AUTOMATIC_MODE_CONTROL ,0 ); +REG_WRITE (SCL_F_SHARP_CONTROL ,0 );return false; }
@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(SCL_H_NUM_OF_TAPS , data->taps.h_taps -1 , SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +REG_WRITE (SCL_SCALER_ENABLE ,1 );/* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(REG_SET (DC_LB_MEM_SIZE ,0 ,DC_LB_MEM_SIZE , xfm_dce->lb_memory_size); +REG_WRITE (SCL_UPDATE ,0x00010000 ); +/* Clear SCL_F_SHARP_CONTROL value to 0 */ REG_WRITE (SCL_F_SHARP_CONTROL ,0 );
@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(/* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ + + REG_WRITE(SCL_UPDATE, 0); }#endif
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,7 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_SCALER_ENABLE ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
@@ -592,6 +593,7 @@ struct dce_transform_registers {uint32_t SCL_VERT_FILTER_SCALE_RATIO ;uint32_t SCL_HORZ_FILTER_INIT ;#if defined(CONFIG_DRM_AMD_DC_SI ) +uint32_t SCL_SCALER_ENABLE ;uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA ;uint32_t SCL_HORZ_FILTER_INIT_CHROMA ;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/201 netfilter: nf_tables: drop unused 3rd argument from validate callback ops
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit eaf9b2c875ece22768b78aa38da8b232e5de021b ]
Since commit a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation") the validate() callback no longer needs the return pointer argument.
Stable-dep-of: f359b809d54c ("netfilter: nft_objref: validate objref and objrefmap expressions")
--- include/net/netfilter/nf_tables.h | 3 +-- include/net/netfilter/nft_fib.h | 4 +--- include/net/netfilter/nft_meta.h | 3 +-- include/net/netfilter/nft_reject.h | 3 +-- net/bridge/netfilter/nft_meta_bridge.c | 5 ++--- net/bridge/netfilter/nft_reject_bridge.c | 3 +-- net/netfilter/nf_tables_api.c | 3 +-- net/netfilter/nft_compat.c | 6 ++---- net/netfilter/nft_fib.c | 3 +-- net/netfilter/nft_flow_offload.c | 3 +-- net/netfilter/nft_fwd_netdev.c | 3 +-- net/netfilter/nft_immediate.c | 3 +-- net/netfilter/nft_lookup.c | 3 +-- net/netfilter/nft_masq.c | 3 +-- net/netfilter/nft_meta.c | 6 ++---- net/netfilter/nft_nat.c | 3 +-- net/netfilter/nft_osf.c | 3 +-- net/netfilter/nft_queue.c | 3 +-- net/netfilter/nft_redir.c | 3 +-- net/netfilter/nft_reject.c | 3 +-- net/netfilter/nft_reject_inet.c | 3 +-- net/netfilter/nft_reject_netdev.c | 3 +-- net/netfilter/nft_rt.c | 3 +-- net/netfilter/nft_socket.c | 3 +-- net/netfilter/nft_synproxy.c | 3 +-- net/netfilter/nft_tproxy.c | 3 +-- net/netfilter/nft_xfrm.c | 3 +-- 27 files changed, 30 insertions(+), 60 deletions(-)
include/net/netfilter/nf_tables.h +1 -2
@@ -955,8 +955,7 @@ struct nft_expr_ops {const struct nft_expr *expr, bool reset);int (*validate)(const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data); +const struct nft_expr *expr);bool (*reduce)(struct nft_regs_track *track,const struct nft_expr *expr); bool (*gc)(struct net *net,
include/net/netfilter/nft_fib.h +1 -3
@@ -21,9 +21,7 @@ nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in)int nft_fib_dump (struct sk_buff *skb,const struct nft_expr *expr,bool reset);int nft_fib_init (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nlattr *const tb[]); -int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data); - +int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr);void nft_fib4_eval_type (const struct nft_expr *expr,struct nft_regs *regs,const struct nft_pktinfo *pkt);
include/net/netfilter/nft_meta.h +1 -2
@@ -41,8 +41,7 @@ void nft_meta_set_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr);int nft_meta_set_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data); +const struct nft_expr *expr);bool nft_meta_get_reduce (struct nft_regs_track *track,const struct nft_expr *expr);
include/net/netfilter/nft_reject.h +1 -2
@@ -15,8 +15,7 @@ struct nft_reject {extern const struct nla_policy nft_reject_policy[];int nft_reject_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data); +const struct nft_expr *expr); int nft_reject_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
net/bridge/netfilter/nft_meta_bridge.c +2 -3
@@ -168,8 +168,7 @@ static bool nft_meta_bridge_set_reduce(struct nft_regs_track *track, }static int nft_meta_bridge_set_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct nft_meta *priv =nft_expr_priv (expr);unsigned int hooks;
@@ -179,7 +178,7 @@ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx, hooks =1 <<NF_BR_PRE_ROUTING ;break ;default : -return nft_meta_set_validate (ctx, expr, data); +return nft_meta_set_validate (ctx, expr); }return nft_chain_validate_hooks (ctx->chain, hooks);
net/bridge/netfilter/nft_reject_bridge.c +1 -2
@@ -170,8 +170,7 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, }static int nft_reject_bridge_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {return nft_chain_validate_hooks (ctx->chain, (1 <<NF_BR_PRE_ROUTING ) | (1 <<NF_BR_LOCAL_IN ));
net/netfilter/nf_tables_api.c +1 -2
@@ -3793,7 +3793,6 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rint nft_chain_validate (const struct nft_ctx *ctx,const struct nft_chain *chain) {struct nft_expr *expr, *last; -const struct nft_data *data;struct nft_rule *rule;int err;
@@ -3814,7 +3813,7 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)/* This may call nft_chain_validate() recursively, * callers that do so must increment ctx->level. */ - err = expr->ops->validate (ctx, expr, &data); + err = expr->ops->validate (ctx, expr);if (err <0 )return err; }
net/netfilter/nft_compat.c +2 -4
@@ -350,8 +350,7 @@ static int nft_target_dump(struct sk_buff *skb, }static int nft_target_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct xt_target *target = expr->ops->data;unsigned int hook_mask =0 ;
@@ -611,8 +610,7 @@ static int nft_match_large_dump(struct sk_buff *skb, }static int nft_match_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct xt_match *match = expr->ops->data;unsigned int hook_mask =0 ;
net/netfilter/nft_fib.c +1 -2
@@ -26,8 +26,7 @@ const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = { };EXPORT_SYMBOL (nft_fib_policy); -int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data) +int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr) {const struct nft_fib *priv =nft_expr_priv (expr);unsigned int hooks;
net/netfilter/nft_flow_offload.c +1 -2
@@ -385,8 +385,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, }static int nft_flow_offload_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {unsigned int hook_mask = (1 <<NF_INET_FORWARD );
net/netfilter/nft_fwd_netdev.c +1 -2
@@ -204,8 +204,7 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, }static int nft_fwd_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {return nft_chain_validate_hooks (ctx->chain, (1 <<NF_NETDEV_INGRESS ) | (1 <<NF_NETDEV_EGRESS ));
net/netfilter/nft_immediate.c +1 -2
@@ -244,8 +244,7 @@ static int nft_immediate_dump(struct sk_buff *skb, }static int nft_immediate_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **d) +const struct nft_expr *expr) {const struct nft_immediate_expr *priv =nft_expr_priv (expr);struct nft_ctx *pctx = (struct nft_ctx *)ctx;
net/netfilter/nft_lookup.c +1 -2
@@ -206,8 +206,7 @@ static int nft_lookup_dump(struct sk_buff *skb, }static int nft_lookup_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **d) +const struct nft_expr *expr) {const struct nft_lookup *priv =nft_expr_priv (expr);struct nft_set_iter iter;
net/netfilter/nft_masq.c +1 -2
@@ -27,8 +27,7 @@ static const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = { };static int nft_masq_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {int err;
net/netfilter/nft_meta.c +2 -4
@@ -581,8 +581,7 @@ static int nft_meta_get_validate_xfrm(const struct nft_ctx *ctx) }static int nft_meta_get_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {const struct nft_meta *priv =nft_expr_priv (expr);
@@ -600,8 +599,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx, }int nft_meta_set_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct nft_meta *priv =nft_expr_priv (expr);unsigned int hooks;
net/netfilter/nft_nat.c +1 -2
@@ -137,8 +137,7 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = { };static int nft_nat_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct nft_nat *priv =nft_expr_priv (expr);int err;
net/netfilter/nft_osf.c +1 -2
@@ -113,8 +113,7 @@ static int nft_osf_dump(struct sk_buff *skb, }static int nft_osf_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {unsigned int hooks;
net/netfilter/nft_queue.c +1 -2
@@ -69,8 +69,7 @@ static void nft_queue_sreg_eval(const struct nft_expr *expr, }static int nft_queue_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
net/netfilter/nft_redir.c +1 -2
@@ -27,8 +27,7 @@ static const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = { };static int nft_redir_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {int err;
net/netfilter/nft_reject.c +1 -2
@@ -24,8 +24,7 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {EXPORT_SYMBOL_GPL (nft_reject_policy);int nft_reject_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
net/netfilter/nft_reject_inet.c +1 -2
@@ -61,8 +61,7 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, }static int nft_reject_inet_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
net/netfilter/nft_reject_netdev.c +1 -2
@@ -145,8 +145,7 @@ static void nft_reject_netdev_eval(const struct nft_expr *expr, }static int nft_reject_netdev_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {return nft_chain_validate_hooks (ctx->chain, (1 <<NF_NETDEV_INGRESS )); }
net/netfilter/nft_rt.c +1 -2
@@ -160,8 +160,7 @@ static int nft_rt_get_dump(struct sk_buff *skb,return -1 ; } -static int nft_rt_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data) +static int nft_rt_validate (const struct nft_ctx *ctx,const struct nft_expr *expr) {const struct nft_rt *priv =nft_expr_priv (expr);unsigned int hooks;
net/netfilter/nft_socket.c +1 -2
@@ -275,8 +275,7 @@ static bool nft_socket_reduce(struct nft_regs_track *track, }static int nft_socket_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { if (ctx->family != NFPROTO_IPV4 && ctx->family != NFPROTO_IPV6 &&
net/netfilter/nft_synproxy.c +1 -2
@@ -248,8 +248,7 @@ static void nft_synproxy_eval(const struct nft_expr *expr, }static int nft_synproxy_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { if (ctx->family != NFPROTO_IPV4 && ctx->family != NFPROTO_IPV6 &&
net/netfilter/nft_tproxy.c +1 -2
@@ -313,8 +313,7 @@ static int nft_tproxy_dump(struct sk_buff *skb, }static int nft_tproxy_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { if (ctx->family != NFPROTO_IPV4 && ctx->family != NFPROTO_IPV6 &&
net/netfilter/nft_xfrm.c +1 -2
@@ -229,8 +229,7 @@ static int nft_xfrm_get_dump(struct sk_buff *skb,return 0 ; } -static int nft_xfrm_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data) +static int nft_xfrm_validate (const struct nft_ctx *ctx,const struct nft_expr *expr) {const struct nft_xfrm *priv =nft_expr_priv (expr);unsigned int hooks;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/201 netfilter: nft_objref: validate objref and objrefmap expressions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ]
Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls:
BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0
[...]
Implement objref and objrefmap expression validate functions.
Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook.
Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error:
synproxy_crash.nft: Error: Could not process rule: Operation not supported
synproxy name mysynproxy
^^^^^^^^^^^^^^^^^^^^^^^^
--- net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
net/netfilter/nft_objref.c +39 -0
@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, obj->ops->eval (obj, regs, pkt); } +static int nft_objref_validate_obj_type (const struct nft_ctx *ctx,u32 type) +{ +unsigned int hooks; + +switch (type) { +case NFT_OBJECT_SYNPROXY : +if (ctx->family !=NFPROTO_IPV4 && + ctx->family !=NFPROTO_IPV6 && + ctx->family !=NFPROTO_INET ) +return -EOPNOTSUPP ; + + hooks = (1 <<NF_INET_LOCAL_IN ) | (1 <<NF_INET_FORWARD ); + +return nft_chain_validate_hooks (ctx->chain, hooks); +default : +break ; + } + +return 0 ; +} + +static int nft_objref_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +struct nft_object *obj =nft_objref_priv (expr); + +return nft_objref_validate_obj_type (ctx, obj->ops->type->type); +} +static int nft_objref_init (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nlattr *const tb[])
@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { .activate = nft_objref_activate, .deactivate = nft_objref_deactivate, .dump = nft_objref_dump, + .validate = nft_objref_validate, .reduce = NFT_REDUCE_READONLY, };
@@ -198,6 +228,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx,nf_tables_destroy_set (ctx, priv->set); } +static int nft_objref_map_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +const struct nft_objref_map *priv =nft_expr_priv (expr); + +return nft_objref_validate_obj_type (ctx, priv->set->objtype); +} +static const struct nft_expr_ops nft_objref_map_ops = { .type = &nft_objref_type, .size =NFT_EXPR_SIZE (sizeof (struct nft_objref_map )),
@@ -207,6 +245,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { .deactivate = nft_objref_map_deactivate, .destroy = nft_objref_map_destroy, .dump = nft_objref_map_dump, + .validate = nft_objref_map_validate, .reduce = NFT_REDUCE_READONLY, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/201 bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Woudstra <[email protected]>
[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
7 locks held by socat/410:
#0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 [..]
#6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
Call Trace: lockdep_rcu_suspicious.cold+0x4f/0xb1 br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] br_fill_forward_path+0x7a/0x4d0 [bridge]
Use to correct helper, non _rcu variant requires RTNL mutex.
--- net/bridge/br_vlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_vlan.c +1 -1
@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,if (!br_opt_get (br,BROPT_VLAN_ENABLED ))return ; - vg =br_vlan_group (br); + vg =br_vlan_group_rcu (br);if (idx >=0 && ctx->vlan[idx].proto == br->vlan_proto) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/201 crypto: essiv - Check ssize for decryption and in-place encryption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
--- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
crypto/essiv.c +6 -8
@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)const struct essiv_tfm_ctx *tctx =crypto_aead_ctx (tfm);struct essiv_aead_request_ctx *rctx =aead_request_ctx (req);struct aead_request *subreq = &rctx->aead_req; +int ivsize =crypto_aead_ivsize (tfm); +int ssize = req->assoclen - ivsize;struct scatterlist *src = req->src;int err; +if (ssize <0 ) +return -EINVAL ; +crypto_cipher_encrypt_one (tctx->essiv_cipher, req->iv, req->iv);/*
@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)*/ rctx->assoc =NULL ;if (req->src == req->dst || !enc) { -scatterwalk_map_and_copy (req->iv, req->dst, - req->assoclen -crypto_aead_ivsize (tfm), -crypto_aead_ivsize (tfm),1 ); +scatterwalk_map_and_copy (req->iv, req->dst, ssize, ivsize,1 ); }else {u8 *iv = (u8 *)aead_request_ctx (req) + tctx->ivoffset; -int ivsize =crypto_aead_ivsize (tfm); -int ssize = req->assoclen - ivsize;struct scatterlist *sg;int nents; -if (ssize <0 ) -return -EINVAL ; - nents =sg_nents_for_len (req->src, ssize);if (nents <0 )return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/201 smb: client: fix missing timestamp updates after utime(2)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ]
Don't reuse open handle when changing timestamps to prevent the server from disabling automatic timestamp updates as per MS-FSA 2.1.4.17.
---8<---
import os
import time
filename = '/mnt/foo'
def print_stat(prefix):
st = os.stat(filename)
print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime))
fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) print_stat('old')os.utime(fd, None)time.sleep(2)os.write(fd, b'foo')os.close(fd)time.sleep(2)print_stat('new')
---8<---
Before patch:
$ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
After patch:
$ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025 new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025
--- fs/smb/client/smb2inode.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
fs/smb/client/smb2inode.c +12 -10
@@ -1216,31 +1216,33 @@ int smb2_set_file_info(struct inode *inode, const char *full_path, FILE_BASIC_INFO *buf, const unsigned int xid) { - struct cifs_open_parms oparms; + struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb); +struct cifsFileInfo *cfile =NULL ; +struct cifs_open_parms oparms;struct tcon_link *tlink;struct cifs_tcon *tcon; -struct cifsFileInfo *cfile; -struct kvec in_iov = { .iov_base = buf, .iov_len =sizeof (*buf), }; -int rc; - -if ((buf->CreationTime ==0 ) && (buf->LastAccessTime ==0 ) && - (buf->LastWriteTime ==0 ) && (buf->ChangeTime ==0 ) && - (buf->Attributes ==0 )) -return 0 ;/* would be a no op, no sense sending this */ +int rc =0 ; tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink); tcon =tlink_tcon (tlink); -cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); +if ((buf->CreationTime ==0 ) && (buf->LastAccessTime ==0 ) && + (buf->LastWriteTime ==0 ) && (buf->ChangeTime ==0 )) { +if (buf->Attributes ==0 ) + goto out;/* would be a no op, no sense sending this */ +cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); + } + oparms =CIFS_OPARMS (cifs_sb, tcon, full_path,FILE_WRITE_ATTRIBUTES ,FILE_OPEN ,0 ,ACL_NO_MODE ); rc =smb2_compound_op (xid, tcon, cifs_sb, full_path, &oparms, &in_iov, &(int ){SMB2_OP_SET_INFO },1 , cfile,NULL ,NULL ,NULL ); +out:cifs_put_tlink (tlink);return rc; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/201 cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ]
EA $LXMOD is required for WSL non-symlink reparse points.
--- fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 60 insertions(+), 2 deletions(-)
fs/smb/client/smb1ops.c +60 -2
@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid, }#ifdef CONFIG_CIFS_XATTR +/* +* For non-symlink WSL reparse points it is required to fetch +* EA $LXMOD which contains in its S_DT part the mandatory file type. +*/ +if (!rc && data->reparse_point) { +struct smb2_file_full_ea_info *ea; +u32 next =0 ; + + ea = (struct smb2_file_full_ea_info *)data->wsl.eas; +do { + ea = (void *)((u8 *)ea + next); + next =le32_to_cpu (ea->next_entry_offset); + }while (next); +if (le16_to_cpu (ea->ea_value_length)) { + ea->next_entry_offset =cpu_to_le32 (ALIGN (sizeof (*ea) + + ea->ea_name_length +1 + +le16_to_cpu (ea->ea_value_length),4 )); + ea = (void *)((u8 *)ea +le32_to_cpu (ea->next_entry_offset)); + } + + rc =CIFSSMBQAllEAs (xid, tcon, full_path,SMB2_WSL_XATTR_MODE , + &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN +1 ], +SMB2_WSL_XATTR_MODE_SIZE , cifs_sb); +if (rc ==SMB2_WSL_XATTR_MODE_SIZE ) { + ea->next_entry_offset =cpu_to_le32 (0 ); + ea->flags =0 ; + ea->ea_name_length =SMB2_WSL_XATTR_NAME_LEN ; + ea->ea_value_length =cpu_to_le16 (SMB2_WSL_XATTR_MODE_SIZE ); +memcpy (&ea->ea_data[0 ],SMB2_WSL_XATTR_MODE ,SMB2_WSL_XATTR_NAME_LEN +1 ); + data->wsl.eas_len +=ALIGN (sizeof (*ea) +SMB2_WSL_XATTR_NAME_LEN +1 + +SMB2_WSL_XATTR_MODE_SIZE ,4 ); + rc =0 ; + }else if (rc >=0 ) { +/* It is an error if EA $LXMOD has wrong size. */ + rc = -EINVAL ; + }else { +/* +* In all other cases ignore error if fetching +* of EA $LXMOD failed. It is needed only for +* non-symlink WSL reparse points and wsl_to_fattr() +* handle the case when EA is missing. +*/ + rc =0 ; + } + } +/* * For WSL CHR and BLK reparse points it is required to fetch * EA $LXDEV which contains major and minor device numbers. */ if (!rc && data->reparse_point) {struct smb2_file_full_ea_info *ea; +u32 next =0 ; ea = (struct smb2_file_full_ea_info *)data->wsl.eas; +do { + ea = (void *)((u8 *)ea + next); + next =le32_to_cpu (ea->next_entry_offset); + }while (next); +if (le16_to_cpu (ea->ea_value_length)) { + ea->next_entry_offset =cpu_to_le32 (ALIGN (sizeof (*ea) + + ea->ea_name_length +1 + +le16_to_cpu (ea->ea_value_length),4 )); + ea = (void *)((u8 *)ea +le32_to_cpu (ea->next_entry_offset)); + } + rc =CIFSSMBQAllEAs (xid, tcon, full_path,SMB2_WSL_XATTR_DEV , &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN +1 ],SMB2_WSL_XATTR_DEV_SIZE , cifs_sb);
@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid, ea->ea_name_length =SMB2_WSL_XATTR_NAME_LEN ; ea->ea_value_length =cpu_to_le16 (SMB2_WSL_XATTR_DEV_SIZE );memcpy (&ea->ea_data[0 ],SMB2_WSL_XATTR_DEV ,SMB2_WSL_XATTR_NAME_LEN +1 ); - data->wsl.eas_len =sizeof (*ea) +SMB2_WSL_XATTR_NAME_LEN +1 + -SMB2_WSL_XATTR_DEV_SIZE ; + data->wsl.eas_len +=ALIGN (sizeof (*ea) +SMB2_WSL_XATTR_NAME_LEN +1 + +SMB2_WSL_XATTR_MODE_SIZE ,4 ); rc =0 ; }else if (rc >=0 ) {/* It is an error if EA $LXDEV has wrong size. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/201 tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gunnar Kudrjavets <[email protected]>
[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
The tpm_tis_write8() call specifies arguments in wrong order. Should be (data, addr, value) not (data, value, addr). The initial correct order was changed during the major refactoring when the code was split.
--- drivers/char/tpm/tpm_tis_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +2 -2
@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,* will call disable_irq which undoes all of the above. */ if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) { -tpm_tis_write8 (priv, original_int_vec, -TPM_INT_VECTOR (priv->locality)); +tpm_tis_write8 (priv,TPM_INT_VECTOR (priv->locality), + original_int_vec); rc =-1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/201 gpio: wcd934x: mark the GPIO controller as sleeping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
The slimbus regmap passed to the GPIO driver down from MFD does not use fast_io. This means a mutex is used for locking and thus this GPIO chip must not be used in atomic context. Change the can_sleep switch in struct gpio_chip to true.
--- drivers/gpio/gpio-wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-wcd934x.c +1 -1
@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) chip->base =-1 ; chip->ngpio =WCD934X_NPINS ; chip->label =dev_name (dev); - chip->can_sleep = false; + chip->can_sleep = true;return devm_gpiochip_add_data (dev, chip, data); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/201 bpf: Avoid RCU context warning when unpinning htab with internal structs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: KaFai Wan <[email protected]>
[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered:
BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ...
The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms:
1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context.
2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations.
However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule.
Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning.
--- kernel/bpf/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/bpf/inode.c +2 -2
@@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)return 0 ; } -static void bpf_free_inode (struct inode *inode) +static void bpf_destroy_inode (struct inode *inode) {enum bpf_type type;
@@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = { .statfs = simple_statfs, .drop_inode = generic_delete_inode, .show_options = bpf_show_options, - .free_inode = bpf_free_inode, + .destroy_inode = bpf_destroy_inode, };enum {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/201 ACPI: property: Fix buffer properties extraction for subnodes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit d0759b10989c5c5aae3d455458c9fc4e8cc694f7 upstream.
The ACPI handle passed to acpi_extract_properties() as the first argument represents the ACPI namespace scope in which to look for objects returning buffers associated with buffer properties.
For _DSD objects located immediately under ACPI devices, this handle is the same as the handle of the device object holding the _DSD, but for data-only subnodes it is not so.
First of all, data-only subnodes are represented by objects that cannot hold other objects in their scopes (like control methods). Therefore a data-only subnode handle cannot be used for completing relative pathname segments, so the current code in
in acpi_nondev_subnode_extract() passing a data-only subnode handle to acpi_extract_properties() is invalid.
Moreover, a data-only subnode of device A may be represented by an object located in the scope of device B (which kind of makes sense, for instance, if A is a B's child). In that case, the scope in question would be the one of device B. In other words, the scope mentioned above is the same as the scope used for subnode object lookup in acpi_nondev_subnode_extract().
Accordingly, rearrange that function to use the same scope for the extraction of properties and subnode object lookup.
--- drivers/acpi/property.c | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-)
drivers/acpi/property.c +11 -19
@@ -74,6 +74,7 @@ static bool acpi_nondev_subnode_extract( struct fwnode_handle *parent) {struct acpi_data_node *dn; +acpi_handle scope =NULL ;bool result; dn =kzalloc (sizeof (*dn),GFP_KERNEL );
@@ -86,27 +87,18 @@ static bool acpi_nondev_subnode_extract(INIT_LIST_HEAD (&dn->data.properties);INIT_LIST_HEAD (&dn->data.subnodes); - result =acpi_extract_properties (handle, desc, &dn->data); +/* +* The scope for the completion of relative pathname segments and +* subnode object lookup is the one of the namespace node (device) +* containing the object that has returned the package. That is, it's +* the scope of that object's parent device. +*/ +if (handle) +acpi_get_parent (handle, &scope); -if (handle) { -acpi_handle scope; -acpi_status status; - -/* -* The scope for the subnode object lookup is the one of the -* namespace node (device) containing the object that has -* returned the package. That is, it's the scope of that -* object's parent. -*/ - status =acpi_get_parent (handle, &scope); -if (ACPI_SUCCESS (status) - &&acpi_enumerate_nondev_subnodes (scope, desc, &dn->data, - &dn->fwnode)) - result = true; - }else if (acpi_enumerate_nondev_subnodes (NULL , desc, &dn->data, - &dn->fwnode)) { + result =acpi_extract_properties (scope, desc, &dn->data); +if (acpi_enumerate_nondev_subnodes (scope, desc, &dn->data, &dn->fwnode)) result = true; - }if (result) { dn->handle = handle;
Greg Kroah-Hartman
maintainerPATCH 59/201 ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Tang <[email protected]>
commit 4aac453deca0d9c61df18d968f8864c3ae7d3d8d upstream.
Previously, after rmmod acpi_tad, modprobe acpi_tad would fail with this dmesg:
sysfs: cannot create duplicate filename '/devices/platform/ACPI000E:00/time'
Call Trace: <TASK> dump_stack_lvl+0x6c/0x90 dump_stack+0x10/0x20 sysfs_warn_dup+0x8b/0xa0 sysfs_add_file_mode_ns+0x122/0x130 internal_create_group+0x1dd/0x4c0 sysfs_create_group+0x13/0x20 acpi_tad_probe+0x147/0x1f0 [acpi_tad] platform_probe+0x42/0xb0 </TASK>
acpi-tad ACPI000E:00: probe with driver acpi-tad failed with error -17
--- drivers/acpi/acpi_tad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_tad.c +3 -0
@@ -564,6 +564,9 @@ static int acpi_tad_remove(struct platfopm_runtime_get_sync (dev); +if (dd->capabilities &ACPI_TAD_RT ) +sysfs_remove_group (&dev->kobj, &acpi_tad_time_attr_group); +if (dd->capabilities &ACPI_TAD_DC_WAKE )sysfs_remove_group (&dev->kobj, &acpi_tad_dc_attr_group);
Greg Kroah-Hartman
maintainerPATCH 60/201 ACPI: debug: fix signedness issues in read/write helpers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Mohammad Jahangirzad <[email protected]>
commit 496f9372eae14775e0524e83e952814691fe850a upstream.
In the ACPI debugger interface, the helper functions for read and write operations use "int" as the length parameter data type. When a large "size_t count" is passed from the file operations, this cast to "int" results in truncation and a negative value due to signed integer representation.
Logically, this negative number propagates to the min() calculation, where it is selected over the positive buffer space value, leading to unexpected behavior. Subsequently, when this negative value is used in copy_to_user() or copy_from_user(), it is interpreted as a large positive value due to the unsigned nature of the size parameter in these functions, causing the copy operations to attempt handling sizes far beyond the intended buffer limits.
Address the issue by:
- Changing the length parameters in acpi_aml_read_user() and acpi_aml_write_user() from "int" to "size_t", aligning with the expected unsigned size semantics.
- Updating return types and local variables in acpi_aml_read() and acpi_aml_write() to "ssize_t" for consistency with kernel file operation conventions.
- Using "size_t" for the "n" variable to ensure calculations remain unsigned.
- Using min_t() for circ_count_to_end() and circ_space_to_end() to ensure type-safe comparisons and prevent integer overflow.
--- drivers/acpi/acpi_dbg.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/acpi/acpi_dbg.c +13 -13
@@ -569,11 +569,11 @@ static int acpi_aml_release(struct inodereturn 0 ; } -static int acpi_aml_read_user (char __user *buf,int len) +static ssize_t acpi_aml_read_user (char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.out_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_read (crc,ACPI_AML_OUT_USER );
@@ -582,7 +582,7 @@ static int acpi_aml_read_user(char __use/* sync head before removing logs */ smp_rmb (); p = &crc->buf[crc->tail]; - n =min (len,circ_count_to_end (crc)); + n =min_t (size_t, len,circ_count_to_end (crc));if (copy_to_user (buf, p, n)) { ret = -EFAULT ; goto out;
@@ -599,8 +599,8 @@ out:static ssize_t acpi_aml_read (struct file *file,char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
@@ -639,11 +639,11 @@ again:return size >0 ? size : ret; } -static int acpi_aml_write_user (const char __user *buf,int len) +static ssize_t acpi_aml_write_user (const char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.in_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_write (crc,ACPI_AML_IN_USER );
@@ -652,7 +652,7 @@ static int acpi_aml_write_user(const cha/* sync tail before inserting cmds */ smp_mb (); p = &crc->buf[crc->head]; - n =min (len,circ_space_to_end (crc)); + n =min_t (size_t, len,circ_space_to_end (crc));if (copy_from_user (p, buf, n)) { ret = -EFAULT ; goto out;
@@ -663,14 +663,14 @@ static int acpi_aml_write_user(const cha ret = n; out:acpi_aml_unlock_fifo (ACPI_AML_IN_USER , ret >=0 ); -return n; +return ret; }static ssize_t acpi_aml_write (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 61/201 arm64: dts: qcom: msm8916: Add missing MDSS reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 99b78773c2ae55dcc01025f94eae8ce9700ae985 upstream.
On most MSM8916 devices (aside from the DragonBoard 410c), the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state.
The reset for MDSS is currently missing in msm8916.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers:
dsi_err_worker: status=6
dsi_err_worker: status=6
dsi_err_worker: status=6
...
It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -0
@@ -1529,6 +1529,8 @@ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; + resets = <&gcc GCC_MDSS_BCR>; + interrupt-controller; #interrupt-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 62/201 arm64: dts: qcom: msm8939: Add missing MDSS reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit f73c82c855e186e9b67125e3eee743960320e43c upstream.
On most MSM8939 devices, the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state.
The reset for MDSS is currently missing in msm8939.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers:
dsi_err_worker: status=6
dsi_err_worker: status=6
dsi_err_worker: status=6
...
It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module.
--- arch/arm64/boot/dts/qcom/msm8939.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8939.dtsi +2 -0
@@ -1210,6 +1210,8 @@ power-domains = <&gcc MDSS_GDSC>; + resets = <&gcc GCC_MDSS_BCR>; + #address-cells = <1>; #size-cells = <1>; #interrupt-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 63/201 arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 316294bb6695a43a9181973ecd4e6fb3e576a9f7 upstream.
Reading the hardware registers of the &slimbam on RB3 reveals that the BAM supports only 23 pipes (channels) and supports 4 EEs instead of 2. This hasn't caused problems so far since nothing is using the extra channels, but attempting to use them would lead to crashes.
The bam_dma driver might warn in the future if the num-channels in the DT are wrong, so correct the properties in the DT to avoid future regressions.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sdm845.dtsi +2 -2
@@ -5208,11 +5208,11 @@ compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0"; qcom,controlled-remotely; reg = <0 0x17184000 0 0x2a000>; - num-channels = <31>; + num-channels = <23>; interrupts = <GIC_SPI 164 IRQ_TYPE_LEVEL_HIGH>; #dma-cells = <1>; qcom,ee = <1>; - qcom,num-ees = <2>; + qcom,num-ees = <4>; iommus = <&apps_smmu 0x1806 0x0>; };
Greg Kroah-Hartman
maintainerPATCH 64/201 arm64: dts: ti: k3-am62a-main: Fix main padcfg length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vibhore Vardhan <[email protected]>
commit 4c4e48afb6d85c1a8f9fdbae1fdf17ceef4a6f5b upstream.
The main pad configuration register region starts with the register MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG0 with address 0x000f4000 and ends with the MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG150 register with address 0x000f4258, as a result of which, total size of the region is 0x25c instead of 0x2ac.
Reference Docs
TRM (AM62A) - https://www.ti.com/lit/ug/spruj16b/spruj16b.pdf
TRM (AM62D) - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf
--- arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +1 -1
@@ -185,7 +185,7 @@ main_pmx0: pinctrl@f4000 { compatible = "pinctrl-single"; - reg = <0x00 0xf4000 0x00 0x2ac>; + reg = <0x00 0xf4000 0x00 0x25c>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Greg Kroah-Hartman
maintainerPATCH 65/201 ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 74139a64e8cedb6d971c78d5d17384efeced1725 upstream.
Add missing of_node_put() calls to release device node references obtained via of_parse_phandle().
--- arch/arm/mach-omap2/pm33xx-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/pm33xx-core.c +5 -1
@@ -388,12 +388,15 @@ static int __init amx3_idle_init(structif (!state_node)break ; -if (!of_device_is_available (state_node)) +if (!of_device_is_available (state_node)) { +of_node_put (state_node);continue ; + }if (i ==CPUIDLE_STATE_MAX ) {pr_warn ("%s: cpuidle states reached max possible\n" , __func__); +of_node_put (state_node);break ; }
@@ -403,6 +406,7 @@ static int __init amx3_idle_init(struct states[state_count].wfi_flags |=WFI_FLAG_WAKE_M3 |WFI_FLAG_FLUSH_CACHE ; +of_node_put (state_node); state_count++; }
Greg Kroah-Hartman
maintainerPATCH 66/201 dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Riesch <[email protected]>
commit c254815b02673cc77a84103c4c0d6197bd90c0ef upstream.
There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568 variant) that are powered on by default as they are part of the ALIVE power domain.
Remove 'power-domains' from the required properties in order to avoid false positives.
--- Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml +14 -1
@@ -57,11 +57,24 @@ required: - clocks - clock-names - '#phy-cells' - - power-domains - resets - reset-names - rockchip,grf +allOf: + - if: + properties: + compatible: + contains: + enum: + - rockchip,px30-csi-dphy + - rockchip,rk1808-csi-dphy + - rockchip,rk3326-csi-dphy + - rockchip,rk3368-csi-dphy + then: + required: + - power-domains + additionalProperties: false examples:
Greg Kroah-Hartman
maintainerPATCH 67/201 xen/events: Cleanup find_virq() return codes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream.
rc is overwritten by the evtchn_status hypercall in each iteration, so the return value will be whatever the last iteration is. This could incorrectly return success even if the event channel was not found. Change to an explicit -ENOENT for an un-found virq and return 0 on a successful match.
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/xen/events/events_base.c +4 -3
@@ -1330,10 +1330,11 @@ static int find_virq(unsigned int virq, {struct evtchn_status status;evtchn_port_t port; -int rc = -ENOENT ;memset (&status,0 ,sizeof (status));for (port =0 ; port <xen_evtchn_max_channels (); port++) { +int rc; + status.dom =DOMID_SELF ; status.port = port; rc =HYPERVISOR_event_channel_op (EVTCHNOP_status, &status);
@@ -1343,10 +1344,10 @@ static int find_virq(unsigned int virq,continue ;if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) { *evtchn = port; -break ; +return 0 ; } } -return rc; +return -ENOENT ; }/**
Greg Kroah-Hartman
maintainerPATCH 68/201 xen/manage: Fix suspend error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit f770c3d858687252f1270265ba152d5c622e793f upstream.
The device power management API has the following asymmetry:
* dpm_suspend_start() does not clean up on failure (it requires a call to dpm_resume_end())
* dpm_suspend_end() does clean up on failure
(it does not require a call to dpm_resume_start())
The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related patches for 2.6.27") in June 2008: It removed a call to device_resume() from device_suspend() (which was later renamed to dpm_suspend_start()).
When Xen began using the device power management API in May 2008 with commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did not yet exist. But since it was introduced, a call to dpm_resume_end() is missing in the error path of dpm_suspend_start(). Fix it.
Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de>
--- drivers/xen/manage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/manage.c +2 -1
@@ -116,7 +116,7 @@ static void do_suspend(void) err =dpm_suspend_start (PMSG_FREEZE );if (err) {pr_err ("%s: dpm_suspend_start %d\n" , __func__, err); - goto out_thaw; + goto out_resume_end; }printk (KERN_DEBUG "suspending xenstore...\n" );
@@ -156,6 +156,7 @@ out_resume:else xs_suspend_cancel (); +out_resume_end:dpm_resume_end (si.cancelled ?PMSG_THAW :PMSG_RESTORE ); out_thaw:
Greg Kroah-Hartman
maintainerPATCH 69/201 xen/events: Return -EEXIST for bound VIRQs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 07ce121d93a5e5fb2440a24da3dbf408fcee978e upstream.
Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards.
Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON().
A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/xen/events/events_base.c +14 -5
@@ -1326,10 +1326,12 @@ int bind_interdomain_evtchn_to_irq_latee }EXPORT_SYMBOL_GPL (bind_interdomain_evtchn_to_irq_lateeoi); -static int find_virq (unsigned int virq,unsigned int cpu,evtchn_port_t *evtchn) +static int find_virq (unsigned int virq,unsigned int cpu,evtchn_port_t *evtchn, +bool percpu) {struct evtchn_status status;evtchn_port_t port; +bool exists = false;memset (&status,0 ,sizeof (status));for (port =0 ; port <xen_evtchn_max_channels (); port++) {
@@ -1342,12 +1344,16 @@ static int find_virq(unsigned int virq,continue ;if (status.status != EVTCHNSTAT_virq)continue ; -if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) { +if (status.u.virq != virq) +continue ; +if (status.vcpu ==xen_vcpu_nr (cpu)) { *evtchn = port;return 0 ; + }else if (!percpu) { + exists = true; } } -return -ENOENT ; +return exists ? -EEXIST : -ENOENT ; }/**
@@ -1394,8 +1400,11 @@ int bind_virq_to_irq(unsigned int virq, evtchn = bind_virq.port; else {if (ret == -EEXIST ) - ret =find_virq (virq, cpu, &evtchn); -BUG_ON (ret <0 ); + ret =find_virq (virq, cpu, &evtchn, percpu); +if (ret) { +__unbind_from_irq (info, info->irq); + goto out; + } } ret =xen_irq_info_virq_setup (info, cpu, evtchn, virq);
Greg Kroah-Hartman
maintainerPATCH 70/201 xen/events: Update virq_to_irq on migration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 3fcc8e146935415d69ffabb5df40ecf50e106131 upstream.
VIRQs come in 3 flavors, per-VPU, per-domain, and global, and the VIRQs are tracked in per-cpu virq_to_irq arrays.
Per-domain and global VIRQs must be bound on CPU 0, and bind_virq_to_irq() sets the per_cpu virq_to_irq at registration time Later, the interrupt can migrate, and info->cpu is updated. When calling __unbind_from_irq(), the per-cpu virq_to_irq is cleared for a different cpu. If bind_virq_to_irq() is called again with CPU 0, the stale irq is returned. There won't be any irq_info for the irq, so things break.
Make xen_rebind_evtchn_to_cpu() update the per_cpu virq_to_irq mappings to keep them update to date with the current cpu. This ensures the correct virq_to_irq is cleared in __unbind_from_irq().
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/xen/events/events_base.c +12 -1
@@ -1809,9 +1809,20 @@ static int xen_rebind_evtchn_to_cpu(stru* virq or IPI channel, which don't actually need to be rebound. Ignore * it, but don't do the xenlinux-level rebind in that case. */ -if (HYPERVISOR_event_channel_op (EVTCHNOP_bind_vcpu, &bind_vcpu) >=0 ) +if (HYPERVISOR_event_channel_op (EVTCHNOP_bind_vcpu, &bind_vcpu) >=0 ) { +int old_cpu = info->cpu; +bind_evtchn_to_cpu (info, tcpu, false); +if (info->type ==IRQT_VIRQ ) { +int virq = info->u.virq; +int irq =per_cpu (virq_to_irq, old_cpu)[virq]; + +per_cpu (virq_to_irq, old_cpu)[virq] =-1 ; +per_cpu (virq_to_irq, tcpu)[virq] = irq; + } + } +do_unmask (info,EVT_MASK_REASON_TEMPORARY );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 71/201 firmware: meson_sm: fix device leak at probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream.
Make sure to drop the reference to the secure monitor device taken by of_find_device_by_node() when looking up its driver data on behalf of other drivers (e.g. during probe).
Note that holding a reference to the platform device does not prevent its driver data from going away so there is no point in keeping the reference after the helper returns.
--- drivers/firmware/meson/meson_sm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/firmware/meson/meson_sm.c +6 -1
@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write);struct meson_sm_firmware *meson_sm_get (struct device_node *sm_node) {struct platform_device *pdev =of_find_device_by_node (sm_node); +struct meson_sm_firmware *fw;if (!pdev)return NULL ; -return platform_get_drvdata (pdev); + fw =platform_get_drvdata (pdev); + +put_device (&pdev->dev); + +return fw; }EXPORT_SYMBOL_GPL (meson_sm_get);
Greg Kroah-Hartman
maintainerPATCH 72/201 media: cx18: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 23b53639a793477326fd57ed103823a8ab63084f upstream.
The DMA map functions can fail and should be tested for errors. If the mapping fails, dealloc buffers, and return.
--- drivers/media/pci/cx18/cx18-queue.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/media/pci/cx18/cx18-queue.c +10 -3
@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_streambreak ; } + buf->dma_handle =dma_map_single (&s->cx->pci_dev->dev, + buf->buf, s->buf_size, + s->dma); +if (dma_mapping_error (&s->cx->pci_dev->dev, buf->dma_handle)) { +kfree (buf->buf); +kfree (mdl); +kfree (buf); +break ; + } +INIT_LIST_HEAD (&mdl->list);INIT_LIST_HEAD (&mdl->buf_list); mdl->id = s->mdl_base_idx;/* a somewhat safe value */ cx18_enqueue (s, mdl, &s->q_idle);INIT_LIST_HEAD (&buf->list); - buf->dma_handle =dma_map_single (&s->cx->pci_dev->dev, - buf->buf, s->buf_size, - s->dma);cx18_buf_sync_for_cpu (s, buf);list_add_tail (&buf->list, &s->buf_pool); }
Greg Kroah-Hartman
maintainerPATCH 73/201 media: i2c: mt9v111: fix incorrect type for ret
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream.
Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() to store negative error codes or zero returned by __mt9v111_hw_reset() and other functions.
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants.
No effect on runtime.
--- drivers/media/i2c/mt9v111.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/mt9v111.c +1 -1
@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(strucstatic int mt9v111_hw_config (struct mt9v111_dev *mt9v111) {struct i2c_client *c = mt9v111->client; -unsigned int ret;u16 outfmtctrl2; +int ret;/* Force device reset. */ ret =__mt9v111_hw_reset (mt9v111);
Greg Kroah-Hartman
maintainerPATCH 74/201 media: mc: Fix MUST_CONNECT handling for pads with no links
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
commit eec81250219a209b863f11d02128ec1dd8e20877 upstream.
Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link") expanded the meaning of the MUST_CONNECT flag to require an enabled link in all cases. To do so, the link exploration code was expanded to cover unconnected pads, in order to reject those that have the MUST_CONNECT flag set. The implementation was however incorrect, ignoring unconnected pads instead of ignoring connected pads. Fix it.
--- drivers/media/mc/mc-entity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/mc/mc-entity.c +1 -1
@@ -678,7 +678,7 @@ done:* (already discovered through iterating over links) and pads * not internally connected. */ -if (origin == local || !local->num_links || +if (origin == local || local->num_links || !media_entity_has_pad_interdep (origin->entity, origin->index, local->index))continue ;
Greg Kroah-Hartman
maintainerPATCH 75/201 media: pci: ivtv: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 upstream.
The DMA map functions can fail and should be tested for errors. If the mapping fails, free blanking_ptr and set it to 0. As 0 is a valid DMA address, use blanking_ptr to test if the DMA address is set.
--- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-yuv.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/media/pci/ivtv/ivtv-irq.c +1 -1
@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct/* Insert buffer block for YUV if needed */ if (s->type ==IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) { -if (yi->blanking_dmaptr) { +if (yi->blanking_ptr) { s->sg_pending[idx].src = yi->blanking_dmaptr; s->sg_pending[idx].dst = offset; s->sg_pending[idx].size =720 *16 ;
drivers/media/pci/ivtv/ivtv-yuv.c +7 -1
@@ -125,7 +125,7 @@ static int ivtv_yuv_prep_user_dma(structivtv_udma_fill_sg_array (dma, y_buffer_offset, uv_buffer_offset, y_size);/* If we've offset the y plane, ensure top area is blanked */ -if (f->offset_y && yi->blanking_dmaptr) { +if (f->offset_y && yi->blanking_ptr) { dma->SGarray[dma->SG_length].size =cpu_to_le32 (720 *16 ); dma->SGarray[dma->SG_length].src =cpu_to_le32 (yi->blanking_dmaptr); dma->SGarray[dma->SG_length].dst =cpu_to_le32 (IVTV_DECODER_OFFSET + yuv_offset[frame]);
@@ -929,6 +929,12 @@ static void ivtv_yuv_init(struct ivtv *i yi->blanking_dmaptr =dma_map_single (&itv->pdev->dev, yi->blanking_ptr,720 *16 ,DMA_TO_DEVICE ); +if (dma_mapping_error (&itv->pdev->dev, yi->blanking_dmaptr)) { +kfree (yi->blanking_ptr); + yi->blanking_ptr =NULL ; + yi->blanking_dmaptr =0 ; +IVTV_DEBUG_WARN ("Failed to dma_map yuv blanking buffer\n" ); + } }else { yi->blanking_dmaptr =0 ;IVTV_DEBUG_WARN ("Failed to allocate yuv blanking buffer\n" );
Greg Kroah-Hartman
maintainerPATCH 76/201 media: venus: firmware: Use correct reset sequence for IRIS2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 93f213b444a40f1e7a4383b499b65e782dcb14b9 upstream.
When starting venus with the "no_tz" code path, IRIS2 needs the same boot/reset sequence as IRIS2_1. This is because most of the registers were moved to the "wrapper_tz_base", which is already defined for both IRIS2 and IRIS2_1 inside core.c. Add IRIS2 to the checks inside firmware.c as well to make sure that it uses the correct reset sequence.
Both IRIS2 and IRIS2_1 are HFI v6 variants, so the correct sequence was used before commit c38610f8981e ("media: venus: firmware: Sanitize per-VPU-version").
--- drivers/media/platform/qcom/venus/firmware.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/platform/qcom/venus/firmware.c +4 -4
@@ -30,7 +30,7 @@ static void venus_reset_cpu(struct venusu32 fw_size = core->fw.mapped_mem_size;void __iomem *wrapper_base; -if (IS_IRIS2_1 (core)) +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core)) wrapper_base = core->wrapper_tz_base;else wrapper_base = core->wrapper_base;
@@ -42,7 +42,7 @@ static void venus_reset_cpu(struct venuswritel (fw_size, wrapper_base +WRAPPER_NONPIX_START_ADDR );writel (fw_size, wrapper_base +WRAPPER_NONPIX_END_ADDR ); -if (IS_IRIS2_1 (core)) { +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core)) {/* Bring XTSS out of reset */ writel (0 , wrapper_base +WRAPPER_TZ_XTSS_SW_RESET ); }else {
@@ -68,7 +68,7 @@ int venus_set_hw_state(struct venus_coreif (resume) {venus_reset_cpu (core); }else { -if (IS_IRIS2_1 (core)) +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core))writel (WRAPPER_XTSS_SW_RESET_BIT , core->wrapper_tz_base +WRAPPER_TZ_XTSS_SW_RESET );else
@@ -181,7 +181,7 @@ static int venus_shutdown_no_tz(struct vvoid __iomem *wrapper_base = core->wrapper_base;void __iomem *wrapper_tz_base = core->wrapper_tz_base; -if (IS_IRIS2_1 (core)) { +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core)) {/* Assert the reset to XTSS */ reg =readl (wrapper_tz_base +WRAPPER_TZ_XTSS_SW_RESET ); reg |=WRAPPER_XTSS_SW_RESET_BIT ;
Greg Kroah-Hartman
maintainerPATCH 77/201 media: lirc: Fix error handling in lirc_register()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream.
When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count.
Found by code review.
--- drivers/media/rc/lirc_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/rc/lirc_dev.c +5 -4
@@ -735,11 +735,11 @@ int lirc_register(struct rc_dev *dev)cdev_init (&dev->lirc_cdev, &lirc_fops); +get_device (&dev->dev); + err =cdev_device_add (&dev->lirc_cdev, &dev->lirc_dev);if (err) - goto out_ida; - -get_device (&dev->dev); + goto out_put_device;switch (dev->driver_type) {case RC_DRIVER_SCANCODE :
@@ -763,7 +763,8 @@ int lirc_register(struct rc_dev *dev)return 0 ; -out_ida: +out_put_device: +put_device (&dev->lirc_dev);ida_free (&lirc_ida, minor);return err; }
Greg Kroah-Hartman
maintainerPATCH 78/201 drm/rcar-du: dsi: Fix 1/2/3 lane support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit d83f1d19c898ac1b54ae64d1c950f5beff801982 upstream.
Remove fixed PPI lane count setup. The R-Car DSI host is capable of operating in 1..4 DSI lane mode. Remove the hard-coded 4-lane configuration from PPI register settings and instead configure the PPI lane count according to lane count information already obtained by this driver instance.
Configure TXSETR register to match PPI lane count. The R-Car V4H Reference Manual R19UH0186EJ0121 Rev.1.21 section 67.2.2.3 Tx Set Register (TXSETR), field LANECNT description indicates that the TXSETR register LANECNT bitfield lane count must be configured such, that it matches lane count configuration in PPISETR register DLEN bitfield. Make sure the LANECNT and DLEN bitfields are configured to match.
--- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 5 ++++- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 8 ++++---- 2 files changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c +4 -1
@@ -576,7 +576,10 @@ static int rcar_mipi_dsi_startup(structudelay (10 );rcar_mipi_dsi_clr (dsi,CLOCKSET1 ,CLOCKSET1_UPDATEPLL ); - ppisetr =PPISETR_DLEN_3 |PPISETR_CLEN ; +rcar_mipi_dsi_clr (dsi,TXSETR ,TXSETR_LANECNT_MASK ); +rcar_mipi_dsi_set (dsi,TXSETR , dsi->lanes -1 ); + + ppisetr = ((BIT (dsi->lanes) -1 ) &PPISETR_DLEN_MASK ) |PPISETR_CLEN ;rcar_mipi_dsi_write (dsi,PPISETR , ppisetr);rcar_mipi_dsi_set (dsi,PHYSETUP ,PHYSETUP_SHUTDOWNZ );
drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h +4 -4
@@ -12,6 +12,9 @@#define LINKSR_LPBUSY (1 << 1)#define LINKSR_HSBUSY (1 << 0) +#define TXSETR 0x100 +#define TXSETR_LANECNT_MASK (0x3 << 0) +/* * Video Mode Register */
@@ -80,10 +83,7 @@* PHY-Protocol Interface (PPI) Registers */ #define PPISETR 0x700 -#define PPISETR_DLEN_0 (0x1 << 0) -#define PPISETR_DLEN_1 (0x3 << 0) -#define PPISETR_DLEN_2 (0x7 << 0) -#define PPISETR_DLEN_3 (0xf << 0) +#define PPISETR_DLEN_MASK (0xf << 0)#define PPISETR_CLEN (1 << 8)#define PPICLCR 0x710
Greg Kroah-Hartman
maintainerPATCH 79/201 drm/nouveau: fix bad ret code in nouveau_bo_move_prep
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 upstream.
In nouveau_bo_move_prep, if nouveau_mem_map fails, an error code should be returned. Currently, it returns zero even if vmm addr is not correctly mapped.
--- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -1
@@ -836,7 +836,7 @@ done:nvif_vmm_put (vmm, &old_mem->vma[1 ]);nvif_vmm_put (vmm, &old_mem->vma[0 ]); } -return 0 ; +return ret; } static int
Greg Kroah-Hartman
maintainerPATCH 80/201 blk-crypto: fix missing blktrace bio split events
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
commit 06d712d297649f48ebf1381d19bd24e942813b37 upstream.
trace_block_split() is missing, resulting in blktrace inability to catch BIO split events and making it harder to analyze the BIO sequence.
--- block/blk-crypto-fallback.c | 3 +++ 1 file changed, 3 insertions(+)
block/blk-crypto-fallback.c +3 -0
@@ -18,6 +18,7 @@#include <linux/module.h> #include <linux/random.h> #include <linux/scatterlist.h> +#include <trace/events/block.h> #include "blk-cgroup.h" #include "blk-crypto-internal.h"
@@ -229,7 +230,9 @@ static bool blk_crypto_fallback_split_bi bio->bi_status =BLK_STS_RESOURCE ;return false; } +bio_chain (split_bio, bio); +trace_block_split (split_bio, bio->bi_iter.bi_sector);submit_bio_noacct (bio); *bio_ptr = split_bio; }
Greg Kroah-Hartman
maintainerPATCH 81/201 btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Nascimento <[email protected]>
commit dff4f9ff5d7f289e4545cc936362e01ed3252742 upstream.
The function btrfs_encode_fh() does not properly account for the three cases it handles.
Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes).
However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes).
If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned.
This results in an 8-byte out-of-bounds write atfid->parent_root_objectid = parent_root_id.
A previous attempt to fix this issue was made but was lost.
https://lore.kernel.org/all/[email protected]/
Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data.
--- fs/btrfs/export.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/btrfs/export.c +7 -1
@@ -24,7 +24,11 @@ static int btrfs_encode_fh(struct inodeint type;if (parent && (len <BTRFS_FID_SIZE_CONNECTABLE )) { - *max_len =BTRFS_FID_SIZE_CONNECTABLE ; +if (btrfs_root_id (BTRFS_I (inode)->root) != +btrfs_root_id (BTRFS_I (parent)->root)) + *max_len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; +else + *max_len =BTRFS_FID_SIZE_CONNECTABLE ;return FILEID_INVALID ; }else if (len <BTRFS_FID_SIZE_NON_CONNECTABLE ) { *max_len =BTRFS_FID_SIZE_NON_CONNECTABLE ;
@@ -46,6 +50,8 @@ static int btrfs_encode_fh(struct inode parent_root_id =BTRFS_I (parent)->root->root_key.objectid;if (parent_root_id != fid->root_objectid) { +if (*max_len <BTRFS_FID_SIZE_CONNECTABLE_ROOT ) +return FILEID_INVALID ; fid->parent_root_objectid = parent_root_id; len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; type =FILEID_BTRFS_WITH_PARENT_ROOT ;
Greg Kroah-Hartman
maintainerPATCH 82/201 bus: mhi: ep: Fix chained transfer handling in read path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Kumar <[email protected]>
commit f5225a34bd8f9f64eec37f6ae1461289aaa3eb86 upstream.
The mhi_ep_read_channel function incorrectly assumes the End of Transfer (EOT) bit is present for each packet in a chained transactions, causing it to advance mhi_chan->rd_offset beyond wr_offset during host-to-device transfers when EOT has not yet arrived. This leads to access of unmapped host memory, causing IOMMU faults and processing of stale TREs.
Modify the loop condition to ensure mhi_queue is not empty, allowing the function to process only valid TREs up to the current write pointer to prevent premature reads and ensure safe traversal of chained TREs.
Due to this change, buf_left needs to be removed from the while loop condition to avoid exiting prematurely before reading the ring completely, and also remove write_offset since it will always be zero because the new cache buffer is allocated every time.
--- drivers/bus/mhi/ep/main.c | 37 ++++++++++++------------------------- 1 file changed, 12 insertions(+), 25 deletions(-)
drivers/bus/mhi/ep/main.c +12 -25
@@ -387,17 +387,13 @@ static int mhi_ep_read_channel(struct mh {struct mhi_ep_chan *mhi_chan = &mhi_cntrl->mhi_chan[ring->ch_id];struct device *dev = &mhi_cntrl->mhi_dev->dev; -size_t tr_len, read_offset, write_offset; +size_t tr_len, read_offset;struct mhi_ep_buf_info buf_info = {};u32 len =MHI_EP_DEFAULT_MTU ;struct mhi_ring_element *el; -bool tr_done = false;void *buf_addr; -u32 buf_left;int ret; - buf_left = len; - do { /* Don't process the transfer ring if the channel is not in RUNNING state */ if (mhi_chan->state != MHI_CH_STATE_RUNNING) {
@@ -410,24 +406,23 @@ static int mhi_ep_read_channel(struct mh/* Check if there is data pending to be read from previous read operation */ if (mhi_chan->tre_bytes_left) {dev_dbg (dev,"TRE bytes remaining: %u\n" , mhi_chan->tre_bytes_left); - tr_len =min (buf_left, mhi_chan->tre_bytes_left); + tr_len =min (len, mhi_chan->tre_bytes_left); }else { mhi_chan->tre_loc =MHI_TRE_DATA_GET_PTR (el); mhi_chan->tre_size =MHI_TRE_DATA_GET_LEN (el); mhi_chan->tre_bytes_left = mhi_chan->tre_size; - tr_len =min (buf_left, mhi_chan->tre_size); + tr_len =min (len, mhi_chan->tre_size); } read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left; - write_offset = len - buf_left; buf_addr =kmem_cache_zalloc (mhi_cntrl->tre_buf_cache,GFP_KERNEL );if (!buf_addr)return -ENOMEM ; buf_info.host_addr = mhi_chan->tre_loc + read_offset; - buf_info.dev_addr = buf_addr + write_offset; + buf_info.dev_addr = buf_addr; buf_info.size = tr_len; buf_info.cb = mhi_ep_read_completion; buf_info.cb_buf = buf_addr;
@@ -443,16 +438,12 @@ static int mhi_ep_read_channel(struct mh goto err_free_buf_addr; } - buf_left -= tr_len; mhi_chan->tre_bytes_left -= tr_len; -if (!mhi_chan->tre_bytes_left) { -if (MHI_TRE_DATA_GET_IEOT (el)) - tr_done = true; - +if (!mhi_chan->tre_bytes_left) mhi_chan->rd_offset = (mhi_chan->rd_offset +1 ) % ring->ring_size; - } - }while (buf_left && !tr_done); +/* Read until the some buffer is left or the ring becomes not empty */ + }while (!mhi_ep_queue_is_empty (mhi_chan->mhi_dev,DMA_TO_DEVICE ));return 0 ;
@@ -486,15 +477,11 @@ static int mhi_ep_process_ch_ring(struct mhi_chan->xfer_cb (mhi_chan->mhi_dev, &result); }else {/* UL channel */ -do { - ret =mhi_ep_read_channel (mhi_cntrl, ring); -if (ret <0 ) { -dev_err (&mhi_chan->mhi_dev->dev,"Failed to read channel\n" ); -return ret; - } - -/* Read until the ring becomes empty */ - }while (!mhi_ep_queue_is_empty (mhi_chan->mhi_dev,DMA_TO_DEVICE )); + ret =mhi_ep_read_channel (mhi_cntrl, ring); +if (ret <0 ) { +dev_err (&mhi_chan->mhi_dev->dev,"Failed to read channel\n" ); +return ret; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 83/201 bus: mhi: host: Do not use uninitialized dev pointer in mhi_init_irq_setup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Xue <[email protected]>
commit d0856a6dff57f95cc5d2d74e50880f01697d0cc4 upstream.
In mhi_init_irq_setup, the device pointer used for dev_err() was not initialized. Use the pointer from mhi_cntrl instead.
--- drivers/bus/mhi/host/init.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/bus/mhi/host/init.c +2 -3
@@ -164,7 +164,6 @@ void mhi_deinit_free_irq(struct mhi_contint mhi_init_irq_setup (struct mhi_controller *mhi_cntrl) {struct mhi_event *mhi_event = mhi_cntrl->mhi_event; -struct device *dev = &mhi_cntrl->mhi_dev->dev;unsigned long irq_flags =IRQF_SHARED |IRQF_NO_SUSPEND ;int i, ret;
@@ -191,7 +190,7 @@ int mhi_init_irq_setup(struct mhi_controcontinue ;if (mhi_event->irq >= mhi_cntrl->nr_irqs) { -dev_err (dev,"irq %d not available for event ring\n" , +dev_err (mhi_cntrl->cntrl_dev,"irq %d not available for event ring\n" , mhi_event->irq); ret = -EINVAL ; goto error_request;
@@ -202,7 +201,7 @@ int mhi_init_irq_setup(struct mhi_contro irq_flags, "mhi", mhi_event);if (ret) { -dev_err (dev,"Error requesting irq:%d for ev:%d\n" , +dev_err (mhi_cntrl->cntrl_dev,"Error requesting irq:%d for ev:%d\n" , mhi_cntrl->irq[mhi_event->irq], i); goto error_request; }
Greg Kroah-Hartman
maintainerPATCH 84/201 copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <[email protected]>
commit 04ff48239f46e8b493571e260bd0e6c3a6400371 upstream.
With the introduction of clone3 in commit 7f192e3cd316 ("fork: add clone3") the effective bit width of clone_flags on all architectures was increased from 32-bit to 64-bit. However, the signature of the copy_* helper functions (e.g., copy_sighand) used by copy_process was not adapted.
As such, they truncate the flags on any 32-bit architectures that supports clone3 (arc, arm, csky, m68k, microblaze, mips32, openrisc, parisc32, powerpc32, riscv32, x86-32 and xtensa).
For copy_sighand with CLONE_CLEAR_SIGHAND being an actual u64 constant, this triggers an observable bug in kernel selftest clone3_clear_sighand:
if (clone_flags & CLONE_CLEAR_SIGHAND)
in function copy_sighand within fork.c will always fail given:
unsigned long /* == uint32_t */ clone_flags
#define CLONE_CLEAR_SIGHAND 0x100000000ULLThis commit fixes the bug by always passing clone_flags to copy_sighand via their declared u64 type, invariant of architecture-dependent integer sizes.
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -1799,7 +1799,7 @@ static int copy_files(unsigned long clonreturn 0 ; } -static int copy_sighand (unsigned long clone_flags,struct task_struct *tsk) +static int copy_sighand (u64 clone_flags,struct task_struct *tsk) {struct sighand_struct *sig;
Greg Kroah-Hartman
maintainerPATCH 85/201 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream.
The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
--- drivers/cpufreq/intel_pstate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/intel_pstate.c +5 -3
@@ -1341,10 +1341,10 @@ static void update_qos_request(enum freqcontinue ; req = policy->driver_data; -cpufreq_cpu_put (policy); - -if (!req) +if (!req) { +cpufreq_cpu_put (policy);continue ; + }if (hwp_active)intel_pstate_get_hwp_cap (cpu);
@@ -1360,6 +1360,8 @@ static void update_qos_request(enum freqif (freq_qos_update_request (req, freq) <0 )pr_warn ("Failed to update freq constraint: CPU%d\n" , i); + +cpufreq_cpu_put (policy); } }
Greg Kroah-Hartman
maintainerPATCH 86/201 crypto: aspeed - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 838d2d51513e6d2504a678e906823cfd2ecaaa22 upstream.
It seems like everywhere in this file, when the request is not bidirectionala, req->src is mapped with DMA_TO_DEVICE and req->dst is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/aspeed/aspeed-hace-crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/aspeed/aspeed-hace-crypto.c +1 -1
@@ -346,7 +346,7 @@ free_req: }else {dma_unmap_sg (hace_dev->dev, req->dst, rctx->dst_nents, -DMA_TO_DEVICE ); +DMA_FROM_DEVICE );dma_unmap_sg (hace_dev->dev, req->src, rctx->src_nents,DMA_TO_DEVICE ); }
Greg Kroah-Hartman
maintainerPATCH 87/201 crypto: atmel - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit f5d643156ef62216955c119216d2f3815bd51cb1 upstream.
It seems like everywhere in this file, dd->in_sg is mapped with DMA_TO_DEVICE and dd->out_sg is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/atmel-tdes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/atmel-tdes.c +1 -1
@@ -548,7 +548,7 @@ static int atmel_tdes_crypt_start(structif (err && (dd->flags &TDES_FLAGS_FAST )) {dma_unmap_sg (dd->dev, dd->in_sg,1 ,DMA_TO_DEVICE ); -dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_TO_DEVICE ); +dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_FROM_DEVICE ); }return err;
Greg Kroah-Hartman
maintainerPATCH 88/201 crypto: rockchip - Fix dma_unmap_sg() nents value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 21140e5caf019e4a24e1ceabcaaa16bd693b393f upstream.
The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned.
--- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/rockchip/rk3288_crypto_ahash.c +1 -1
@@ -252,7 +252,7 @@ static void rk_hash_unprepare(struct crystruct rk_ahash_rctx *rctx =ahash_request_ctx (areq);struct rk_crypto_info *rkc = rctx->dev; -dma_unmap_sg (rkc->dev, areq->src, rctx->nrsg,DMA_TO_DEVICE ); +dma_unmap_sg (rkc->dev, areq->src,sg_nents (areq->src),DMA_TO_DEVICE ); }static int rk_hash_run (struct crypto_engine *engine,void *breq)
Greg Kroah-Hartman
maintainerPATCH 89/201 fbdev: Fix logic error in "offb" name match
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 15df28699b28d6b49dc305040c4e26a9553df07a upstream.
A regression was reported to me recently whereby /dev/fb0 had disappeared from a PowerBook G3 Series "Wallstreet". The problem shows up when the "video=ofonly" parameter is passed to the kernel, which is what the bootloader does when "no video driver" is selected. The cause of the problem is the "offb" string comparison, which got mangled when it got refactored. Fix it.
--- drivers/video/fbdev/core/fb_cmdline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/core/fb_cmdline.c +1 -1
@@ -40,7 +40,7 @@ int fb_get_options(const char *name, char **option)bool enabled;if (name) - is_of =strncmp (name,"offb" ,4 ); + is_of = !strncmp (name,"offb" ,4 ); enabled =__video_get_options (name, &options, is_of);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/201 fs/ntfs3: Fix a resource leak bug in wnd_extend()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d68318471aa2e16222ebf492883e05a2d72b9b17 upstream.
Add put_bh() to decrease the refcount of 'bh' after the job is finished, preventing a resource leak.
--- fs/ntfs3/bitmap.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/bitmap.c +1 -0
@@ -1399,6 +1399,7 @@ int wnd_extend(struct wnd_bitmap *wnd, smark_buffer_dirty (bh);unlock_buffer (bh);/* err = sync_dirty_buffer(bh); */ +put_bh (bh); b0 =0 ; bits -= op;
Greg Kroah-Hartman
maintainerPATCH 91/201 iio: dac: ad5360: use int type to store negative error codes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit f9381ece76de999a2065d5b4fdd87fa17883978c upstream.
Change the 'ret' variable in ad5360_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5360_write_unlocked().
--- drivers/iio/dac/ad5360.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5360.c +1 -1
@@ -262,7 +262,7 @@ static int ad5360_update_ctrl(struct iio unsigned int clr) {struct ad5360_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 92/201 iio: dac: ad5421: use int type to store negative error codes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit 3379c900320954d768ed9903691fb2520926bbe3 upstream.
Change the 'ret' variable in ad5421_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5421_write_unlocked().
--- drivers/iio/dac/ad5421.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5421.c +1 -1
@@ -186,7 +186,7 @@ static int ad5421_update_ctrl(struct iio unsigned int clr) {struct ad5421_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 93/201 iio: frequency: adf4350: Fix prescaler usage.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d upstream.
The ADF4350/1 features a programmable dual-modulus prescaler of 4/5 or 8/9. When set to 4/5, the maximum RF frequency allowed is 3 GHz. Therefore, when operating the ADF4351 above 3 GHz, this must be set to 8/9. In this context not the RF output frequency is meant
- it's the VCO frequency.
Therefore move the prescaler selection after we derived the VCO frequency from the desired RF output frequency.
This BUG may have caused PLL lock instabilities when operating the VCO at the very high range close to 4.4 GHz.
--- drivers/iio/frequency/adf4350.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/iio/frequency/adf4350.c +13 -7
@@ -143,6 +143,19 @@ static int adf4350_set_freq(struct adf43if (freq >ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq)return -EINVAL ; + st->r4_rf_div_sel =0 ; + +/* +* !\TODO: The below computation is making sure we get a power of 2 +* shift (st->r4_rf_div_sel) so that freq becomes higher or equal to +* ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() +* and friends. +*/ +while (freq <ADF4350_MIN_VCO_FREQ ) { + freq <<=1 ; + st->r4_rf_div_sel++; + } +if (freq >ADF4350_MAX_FREQ_45_PRESC ) { prescaler =ADF4350_REG1_PRESCALER ; mdiv =75 ;
@@ -151,13 +164,6 @@ static int adf4350_set_freq(struct adf43 mdiv =23 ; } - st->r4_rf_div_sel =0 ; - -while (freq <ADF4350_MIN_VCO_FREQ ) { - freq <<=1 ; - st->r4_rf_div_sel++; - } -/* * Allow a predefined reference division factor * if not set, compute our own
Greg Kroah-Hartman
maintainerPATCH 94/201 iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
commit 1315cc2dbd5034f566e20ddce4d675cb9e6d4ddd upstream.
AMS_ALARM_THR_DIRECT_MASK should be bit 0, not bit 1. This would cause hysteresis to be enabled with a lower threshold of -28C. The temperature alarm would never deassert even if the temperature dropped below the upper threshold.
--- drivers/iio/adc/xilinx-ams.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/xilinx-ams.c +1 -1
@@ -118,7 +118,7 @@#define AMS_ALARM_THRESHOLD_OFF_10 0x10#define AMS_ALARM_THRESHOLD_OFF_20 0x20 -#define AMS_ALARM_THR_DIRECT_MASK BIT(1) +#define AMS_ALARM_THR_DIRECT_MASK BIT(0)#define AMS_ALARM_THR_MIN 0x0000#define AMS_ALARM_THR_MAX (BIT(16) - 1)
Greg Kroah-Hartman
maintainerPATCH 95/201 iio: xilinx-ams: Unmask interrupts after updating alarms
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
commit feb500c7ae7a198db4d2757901bce562feeefa5e upstream.
To convert level-triggered alarms into edge-triggered IIO events, alarms are masked when they are triggered. To ensure we catch subsequent alarms, we then periodically poll to see if the alarm is still active. If it isn't, we unmask it. Active but masked alarms are stored in current_masked_alarm.
If an active alarm is disabled, it will remain set in current_masked_alarm until ams_unmask_worker clears it. If the alarm is re-enabled before ams_unmask_worker runs, then it will never be cleared from current_masked_alarm. This will prevent the alarm event from being pushed even if the alarm is still active.
Fix this by recalculating current_masked_alarm immediately when enabling or disabling alarms.
--- drivers/iio/adc/xilinx-ams.c | 45 +++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 20 deletions(-)
drivers/iio/adc/xilinx-ams.c +25 -20
@@ -385,6 +385,29 @@ static void ams_update_pl_alarm(struct aams_pl_update_reg (ams,AMS_REG_CONFIG3 ,AMS_REGCFG3_ALARM_MASK , cfg); } +static void ams_unmask (struct ams *ams) +{ +unsigned int status, unmask; + + status =readl (ams->base +AMS_ISR_0 ); + +/* Clear those bits which are not active anymore */ + unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; + +/* Clear status of disabled alarm */ + unmask |= ams->intr_mask; + + ams->current_masked_alarm &= status; + +/* Also clear those which are masked out anyway */ + ams->current_masked_alarm &= ~ams->intr_mask; + +/* Clear the interrupts before we unmask them */ +writel (unmask, ams->base +AMS_ISR_0 ); + +ams_update_intrmask (ams, ~AMS_ALARM_MASK , ~AMS_ALARM_MASK ); +} +static void ams_update_alarm (struct ams *ams,unsigned long alarm_mask) {unsigned long flags;
@@ -397,6 +420,7 @@ static void ams_update_alarm(struct amsspin_lock_irqsave (&ams->intr_lock, flags);ams_update_intrmask (ams,AMS_ISR0_ALARM_MASK , ~alarm_mask); +ams_unmask (ams);spin_unlock_irqrestore (&ams->intr_lock, flags); }
@@ -1025,28 +1049,9 @@ static void ams_handle_events(struct iiostatic void ams_unmask_worker (struct work_struct *work) { struct ams *ams = container_of(work, struct ams, ams_unmask_work.work); -unsigned int status, unmask;spin_lock_irq (&ams->intr_lock); - - status =readl (ams->base +AMS_ISR_0 ); - -/* Clear those bits which are not active anymore */ - unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; - -/* Clear status of disabled alarm */ - unmask |= ams->intr_mask; - - ams->current_masked_alarm &= status; - -/* Also clear those which are masked out anyway */ - ams->current_masked_alarm &= ~ams->intr_mask; - -/* Clear the interrupts before we unmask them */ -writel (unmask, ams->base +AMS_ISR_0 ); - -ams_update_intrmask (ams, ~AMS_ALARM_MASK , ~AMS_ALARM_MASK ); - +ams_unmask (ams);spin_unlock_irq (&ams->intr_lock);/* If still pending some alarm re-trigger the timer */
Greg Kroah-Hartman
maintainerPATCH 96/201 init: handle bootloader identifier in kernel parameters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit e416f0ed3c500c05c55fb62ee62662717b1c7f71 upstream.
BootLoaders (Grub, LILO, etc) may pass an identifier such as "BOOT_IMAGE= /boot/vmlinuz-x.y.z" to kernel parameters. But these identifiers are not recognized by the kernel itself so will be passed to userspace. However user space init program also don't recognize it.
KEXEC/KDUMP (kexec-tools) may also pass an identifier such as "kexec" on some architectures.
We cannot change BootLoader's behavior, because this behavior exists for many years, and there are already user space programs search BOOT_IMAGE= in /proc/cmdline to obtain the kernel image locations:
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/util.go
(search getBootOptions)
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/main.go
(search getKernelReleaseWithBootOption) So the the best way is handle (ignore) it by the kernel itself, which can avoid such boot warnings (if we use something like init=/bin/bash, bootloader identifier can even cause a crash):
Kernel command line: BOOT_IMAGE=(hd0,1)/vmlinuz-6.x root=/dev/sda3 ro console=tty Unknown kernel command line parameters "BOOT_IMAGE=(hd0,1)/vmlinuz-6.x", will be passed to user space.
--- init/main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
init/main.c +12 -0
@@ -530,6 +530,12 @@ static int __init unknown_bootoption(cha const char *unused, void *arg) { size_t len = strlen(param); +/* +* Well-known bootloader identifiers: +* 1. LILO/Grub pass "BOOT_IMAGE=..."; +* 2. kexec/kdump (kexec-tools) pass "kexec". +*/ +const char *bootloader[] = {"BOOT_IMAGE=" ,"kexec" ,NULL };/* Handle params aliased to sysctls */ if (sysctl_is_alias (param))
@@ -537,6 +543,12 @@ static int __init unknown_bootoption(charepair_env_string (param, val); +/* Handle bootloader identifier */ +for (int i =0 ; bootloader[i]; i++) { +if (strstarts (param, bootloader[i])) +return 0 ; + } +/* Handle obsolete-style parameters */ if (obsolete_checksetup (param))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 97/201 iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
commit a95a0b4e471a6d8860f40c6ac8f1cad9dde3189a upstream.
Remove unnecessary calls to pm_runtime_disable(), pm_runtime_set_active(), and pm_runtime_enable() from the resume path. These operations are not required here and can interfere with proper pm_runtime state handling, especially when resuming from a pm_runtime suspended state.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +0 -4
@@ -747,10 +747,6 @@ static int inv_icm42600_resume(struct deif (ret) goto out_unlock; -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -/* restore sensors state */ ret = inv_icm42600_set_pwr_mgmt0(st, st->suspended.gyro, st->suspended.accel,
Greg Kroah-Hartman
maintainerPATCH 98/201 iommu/vt-d: PRS isnt usable if PDS isnt supported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 5ef7e24c742038a5d8c626fdc0e3a21834358341 upstream.
The specification, Section 7.10, "Software Steps to Drain Page Requests & Responses," requires software to submit an Invalidation Wait Descriptor (inv_wait_dsc) with the Page-request Drain (PD=1) flag set, along with the Invalidation Wait Completion Status Write flag (SW=1). It then waits for the Invalidation Wait Descriptor's completion.
However, the PD field in the Invalidation Wait Descriptor is optional, as stated in Section 6.5.2.9, "Invalidation Wait Descriptor":
"Page-request Drain (PD): Remapping hardware implementations reporting
Page-request draining as not supported (PDS = 0 in ECAP_REG) treat this field as reserved."
This implies that if the IOMMU doesn't support the PDS capability, software can't drain page requests and group responses as expected.
Do not enable PCI/PRI if the IOMMU doesn't support PDS.
--- drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/iommu.c +1 -1
@@ -4415,7 +4415,7 @@ static struct iommu_device *intel_iommu_ }if (info->ats_supported &&ecap_prs (iommu->ecap) && -pci_pri_supported (pdev)) +ecap_pds (iommu->ecap) &&pci_pri_supported (pdev)) info->pri_supported =1 ; } }
Greg Kroah-Hartman
maintainerPATCH 99/201 kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit a15f37a40145c986cdf289a4b88390f35efdecc4 upstream.
The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken.
sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct.
Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock().
Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable.
--- kernel/sys.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
kernel/sys.c +20 -2
@@ -1689,6 +1689,7 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, ustruct rlimit old, new;struct task_struct *tsk;unsigned int checkflags =0 ; +bool need_tasklist;int ret;if (old_rlim)
@@ -1715,8 +1716,25 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, uget_task_struct (tsk);rcu_read_unlock (); - ret =do_prlimit (tsk, resource, new_rlim ? &new :NULL , - old_rlim ? &old :NULL ); + need_tasklist = !same_thread_group (tsk, current); +if (need_tasklist) { +/* +* Ensure we can't race with group exit or de_thread(), +* so tsk->group_leader can't be freed or changed until +* read_unlock(tasklist_lock) below. +*/ +read_lock (&tasklist_lock); +if (!pid_alive (tsk)) + ret = -ESRCH ; + } + +if (!ret) { + ret =do_prlimit (tsk, resource, new_rlim ? &new :NULL , + old_rlim ? &old :NULL ); + } + +if (need_tasklist) +read_unlock (&tasklist_lock);if (!ret && old_rlim) {rlim_to_rlim64 (&old, &old64);
Greg Kroah-Hartman
maintainerPATCH 100/201 KEYS: trusted_tpm1: Compare HMAC values in constant time
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit eed0e3d305530066b4fc5370107cff8ef1a0d229 upstream.
To prevent timing attacks, HMAC value comparison needs to be constant time. Replace the memcmp() with the correct function, crypto_memneq().
[For the Fixes commit I used the commit that introduced the memcmp(). It predates the introduction of crypto_memneq(), but it was still a bug at the time even though a helper function didn't exist yet.]
--- security/keys/trusted-keys/trusted_tpm1.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
security/keys/trusted-keys/trusted_tpm1.c +4 -3
@@ -7,6 +7,7 @@*/ #include <crypto/hash_info.h> +#include <crypto/utils.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/parser.h>
@@ -241,7 +242,7 @@ int TSS_checkhmac1(unsigned char *bufferif (ret <0 ) goto out; -if (memcmp (testhmac, authdata,SHA1_DIGEST_SIZE )) +if (crypto_memneq (testhmac, authdata,SHA1_DIGEST_SIZE )) ret = -EINVAL ; out:kfree_sensitive (sdesc);
@@ -334,7 +335,7 @@ static int TSS_checkhmac2(unsigned char TPM_NONCE_SIZE, ononce, 1, continueflag1, 0, 0);if (ret <0 ) goto out; -if (memcmp (testhmac1, authdata1,SHA1_DIGEST_SIZE )) { +if (crypto_memneq (testhmac1, authdata1,SHA1_DIGEST_SIZE )) { ret = -EINVAL ; goto out; }
@@ -343,7 +344,7 @@ static int TSS_checkhmac2(unsigned char TPM_NONCE_SIZE, ononce, 1, continueflag2, 0, 0);if (ret <0 ) goto out; -if (memcmp (testhmac2, authdata2,SHA1_DIGEST_SIZE )) +if (crypto_memneq (testhmac2, authdata2,SHA1_DIGEST_SIZE )) ret = -EINVAL ; out:kfree_sensitive (sdesc);
Greg Kroah-Hartman
maintainerPATCH 101/201 lib/genalloc: fix device leak in of_gen_pool_get()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1260cbcffa608219fc9188a6cbe9c45a300ef8b5 upstream.
Make sure to drop the reference taken when looking up the genpool platform device in of_gen_pool_get() before returning the pool.
Note that holding a reference to a device does typically not prevent its devres managed resources from being released so there is no point in keeping the reference.
--- lib/genalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
lib/genalloc.c +4 -1
@@ -899,8 +899,11 @@ struct gen_pool *of_gen_pool_get(structif (!name) name =of_node_full_name (np_pool); } -if (pdev) +if (pdev) { pool =gen_pool_get (&pdev->dev, name); +put_device (&pdev->dev); + } +of_node_put (np_pool);return pool;
Greg Kroah-Hartman
maintainerPATCH 102/201 of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit a8de554774ae48efbe48ace79f8badae2daa2bf1 upstream.
In of_unittest_pci_node_verify(), when the add parameter is false, device_find_any_child() obtains a reference to a child device. This function implicitly calls get_device() to increment the device's reference count before returning the pointer. However, the caller fails to properly release this reference by calling put_device(), leading to a device reference count leak. Add put_device() in the else branch immediately after child_dev is no longer needed.
As the comment of device_find_any_child states: "NOTE: you will need to drop the reference with put_device() after use".
Found by code review.
--- drivers/of/unittest.c | 1 + 1 file changed, 1 insertion(+)
drivers/of/unittest.c +1 -0
@@ -3957,6 +3957,7 @@ static int of_unittest_pci_node_verify(sunittest (!np,"Child device tree node is not removed\n" ); child_dev =device_find_any_child (&pdev->dev);unittest (!child_dev,"Child device is not removed\n" ); +put_device (child_dev); } failed:
Greg Kroah-Hartman
maintainerPATCH 103/201 openat2: dont trigger automounts with RESOLVE_NO_XDEV
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Askar Safin <[email protected]>
commit 042a60680de43175eb4df0977ff04a4eba9da082 upstream.
openat2 had a bug: if we pass RESOLVE_NO_XDEV, then openat2 doesn't traverse through automounts, but may still trigger them. (See the link for full bug report with reproducer.)
This commit fixes this bug.
--- fs/namei.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/namei.c +8 -0
@@ -1364,6 +1364,10 @@ static int follow_automount(struct path dentry->d_inode)return -EISDIR ; +/* No need to trigger automounts if mountpoint crossing is disabled. */ +if (lookup_flags &LOOKUP_NO_XDEV ) +return -EXDEV ; +if (count && (*count)++ >=MAXSYMLINKS )return -ELOOP ;
@@ -1387,6 +1391,10 @@ static int __traverse_mounts(struct path/* Allow the filesystem to manage the transit without i_mutex * being held. */ if (flags &DCACHE_MANAGE_TRANSIT ) { +if (lookup_flags &LOOKUP_NO_XDEV ) { + ret = -EXDEV ; +break ; + } ret = path->dentry->d_op->d_manage (path, false); flags =smp_load_acquire (&path->dentry->d_flags);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 104/201 parisc: dont reference obsolete termio struct for TC* constants
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam James <[email protected]>
commit 8ec5a066f88f89bd52094ba18792b34c49dcd55a upstream.
Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead.
This fixes building Python for example, which falls over like:
./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
--- arch/parisc/include/uapi/asm/ioctls.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/parisc/include/uapi/asm/ioctls.h +4 -4
@@ -10,10 +10,10 @@#define TCSETS _IOW('T', 17, struct termios)/* TCSETATTR */ #define TCSETSW _IOW('T', 18, struct termios)/* TCSETATTRD */ #define TCSETSF _IOW('T', 19, struct termios)/* TCSETATTRF */ -#define TCGETA _IOR('T', 1, struct termio) -#define TCSETA _IOW('T', 2, struct termio) -#define TCSETAW _IOW('T', 3, struct termio) -#define TCSETAF _IOW('T', 4, struct termio) +#define TCGETA 0x40125401 +#define TCSETA 0x80125402 +#define TCSETAW 0x80125403 +#define TCSETAF 0x80125404#define TCSBRK _IO('T', 5)#define TCXONC _IO('T', 6)#define TCFLSH _IO('T', 7)
Greg Kroah-Hartman
maintainerPATCH 105/201 parisc: Remove spurious if statement from raw_copy_from_user()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 16794e524d310780163fdd49d0bf7fac30f8dbc8 upstream.
Accidently introduced in commit 91428ca9320e.
--- arch/parisc/lib/memcpy.c | 1 - 1 file changed, 1 deletion(-)
arch/parisc/lib/memcpy.c +0 -1
@@ -41,7 +41,6 @@ unsigned long raw_copy_from_user(void *dmtsp (get_kernel_space (),SR_TEMP2 );/* Check region is user accessible */ -if (start)while (start < end) {if (!prober_user (SR_TEMP1 , start)) { newlen = (start - (unsigned long ) src);
Greg Kroah-Hartman
maintainerPATCH 106/201 nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Gottleuber <[email protected]>
commit eeaed48980a7aeb0d3d8b438185d4b5a66154ff9 upstream.
On the TUXEDO InfinityBook S Gen8, a Samsung 990 Evo NVMe leads to a high power consumption in s2idle sleep (3.5 watts).
This patch applies 'Force No Simple Suspend' quirk to achieve a sleep with a lower power consumption, typically around 1 watts.
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -2986,10 +2986,12 @@ static unsigned long check_vendor_combin* Exclude Samsung 990 Evo from NVME_QUIRK_SIMPLE_SUSPEND * because of high power consumption (> 2 Watt) in s2idle * sleep. Only some boards with Intel CPU are affected. +* (Note for testing: Samsung 990 Evo Plus has same PCI ID) */ if (dmi_match (DMI_BOARD_NAME ,"DN50Z-140HC-YD" ) ||dmi_match (DMI_BOARD_NAME ,"GMxPXxx" ) ||dmi_match (DMI_BOARD_NAME ,"GXxMRXx" ) || +dmi_match (DMI_BOARD_NAME ,"NS5X_NS7XAU" ) ||dmi_match (DMI_BOARD_NAME ,"PH4PG31" ) ||dmi_match (DMI_BOARD_NAME ,"PH4PRX1_PH6PRX1" ) ||dmi_match (DMI_BOARD_NAME ,"PH6PG01_PH6PG71" ))
Greg Kroah-Hartman
maintainerPATCH 107/201 pinctrl: samsung: Drop unused S3C24xx driver data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 358253fa8179ab4217ac283b56adde0174186f87 upstream.
Drop unused declarations after S3C24xx SoC family removal in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support").
--- drivers/pinctrl/samsung/pinctrl-samsung.h | 4 ---- 1 file changed, 4 deletions(-)
drivers/pinctrl/samsung/pinctrl-samsung.h +0 -4
@@ -352,10 +352,6 @@ extern const struct samsung_pinctrl_of_mextern const struct samsung_pinctrl_of_match_data exynosautov9_of_data;extern const struct samsung_pinctrl_of_match_data fsd_of_data;extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data; -extern const struct samsung_pinctrl_of_match_data s3c2412_of_data; -extern const struct samsung_pinctrl_of_match_data s3c2416_of_data; -extern const struct samsung_pinctrl_of_match_data s3c2440_of_data; -extern const struct samsung_pinctrl_of_match_data s3c2450_of_data;extern const struct samsung_pinctrl_of_match_data s5pv210_of_data;#endif /* __PINCTRL_SAMSUNG_H */
Greg Kroah-Hartman
maintainerPATCH 108/201 power: supply: max77976_charger: fix constant current reporting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <[email protected]>
commit ee6cd8f3e28ee5a929c3b67c01a350f550f9b73a upstream.
CHARGE_CONTROL_LIMIT is a wrong property to report charge current limit, because CHARGE_* attributes represents capacity, not current. The correct attribute to report and set charge current limit is CONSTANT_CHARGE_CURRENT.
Rename CHARGE_CONTROL_LIMIT to CONSTANT_CHARGE_CURRENT.
--- drivers/power/supply/max77976_charger.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/power/supply/max77976_charger.c +6 -6
@@ -292,10 +292,10 @@ static int max77976_get_property(structcase POWER_SUPPLY_PROP_ONLINE : err =max77976_get_online (chg, &val->intval);break ; -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX : val->intval =MAX77976_CHG_CC_MAX ;break ; -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT : err = max77976_get_integer(chg, CHG_CC, MAX77976_CHG_CC_MIN, MAX77976_CHG_CC_MAX,
@@ -330,7 +330,7 @@ static int max77976_set_property(structint err =0 ;switch (psp) { -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT : err = max77976_set_integer(chg, CHG_CC, MAX77976_CHG_CC_MIN, MAX77976_CHG_CC_MAX,
@@ -355,7 +355,7 @@ static int max77976_property_is_writeabl enum power_supply_property psp) {switch (psp) { -case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT : +case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT :case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT :return true;default :
@@ -368,8 +368,8 @@ static enum power_supply_property max779POWER_SUPPLY_PROP_CHARGE_TYPE ,POWER_SUPPLY_PROP_HEALTH ,POWER_SUPPLY_PROP_ONLINE , -POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT , -POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX , +POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT , +POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ,POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT ,POWER_SUPPLY_PROP_MODEL_NAME , POWER_SUPPLY_PROP_MANUFACTURER,
Greg Kroah-Hartman
maintainerPATCH 109/201 powerpc/powernv/pci: Fix underflow and leak issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit a39087905af9ffecaa237a918a2c03a04e479934 upstream.
pnv_irq_domain_alloc() allocates interrupts at parent's interrupt domain. If it fails in the progress, all allocated interrupts are freed.
The number of successfully allocated interrupts so far is stored "i". However, "i - 1" interrupts are freed. This is broken:
- One interrupt is not be freed
- If "i" is zero, "i - 1" wraps around
Correct the number of freed interrupts to "i".
--- arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/powernv/pci-ioda.c +1 -1
@@ -1895,7 +1895,7 @@ static int pnv_irq_domain_alloc(struct ireturn 0 ; out: -irq_domain_free_irqs_parent (domain, virq, i -1 ); +irq_domain_free_irqs_parent (domain, virq, i);msi_bitmap_free_hwirqs (&phb->msi_bmp, hwirq, nr_irqs);return ret; }
Greg Kroah-Hartman
maintainerPATCH 110/201 powerpc/pseries/msi: Fix potential underflow and leak issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 3443ff3be6e59b80d74036bb39f5b6409eb23cc9 upstream.
pseries_irq_domain_alloc() allocates interrupts at parent's interrupt domain. If it fails in the progress, all allocated interrupts are freed.
The number of successfully allocated interrupts so far is stored "i". However, "i - 1" interrupts are freed. This is broken:
- One interrupt is not be freed
- If "i" is zero, "i - 1" wraps around
Correct the number of freed interrupts to 'i'.
--- arch/powerpc/platforms/pseries/msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/msi.c +1 -1
@@ -587,7 +587,7 @@ static int pseries_irq_domain_alloc(stru out:/* TODO: handle RTAS cleanup in ->msi_finish() ? */ -irq_domain_free_irqs_parent (domain, virq, i -1 ); +irq_domain_free_irqs_parent (domain, virq, i);return ret; }
Greg Kroah-Hartman
maintainerPATCH 111/201 pwm: berlin: Fix wrong register in suspend/resume
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
commit 3a4b9d027e4061766f618292df91760ea64a1fcc upstream.
The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu exception then kernel panic during suspend/resume.
--- drivers/pwm/pwm-berlin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-berlin.c +2 -2
@@ -273,7 +273,7 @@ static int berlin_pwm_suspend(struct devif (!channel)continue ; - channel->enable =berlin_pwm_readl (bpc, i,BERLIN_PWM_ENABLE ); + channel->enable =berlin_pwm_readl (bpc, i,BERLIN_PWM_EN ); channel->ctrl =berlin_pwm_readl (bpc, i,BERLIN_PWM_CONTROL ); channel->duty =berlin_pwm_readl (bpc, i,BERLIN_PWM_DUTY ); channel->tcnt =berlin_pwm_readl (bpc, i,BERLIN_PWM_TCNT );
@@ -304,7 +304,7 @@ static int berlin_pwm_resume(struct deviberlin_pwm_writel (bpc, i, channel->ctrl,BERLIN_PWM_CONTROL );berlin_pwm_writel (bpc, i, channel->duty,BERLIN_PWM_DUTY );berlin_pwm_writel (bpc, i, channel->tcnt,BERLIN_PWM_TCNT ); -berlin_pwm_writel (bpc, i, channel->enable,BERLIN_PWM_ENABLE ); +berlin_pwm_writel (bpc, i, channel->enable,BERLIN_PWM_EN ); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 112/201 Revert "ipmi: fix msg stack when IPMI is disconnected"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
commit 5d09ee1bec870263f4ace439402ea840503b503b upstream.
This reverts commit c608966f3f9c2dca596967501d00753282b395fc.
This patch has a subtle bug that can cause the IPMI driver to go into an infinite loop if the BMC misbehaves in a certain way. Apparently certain BMCs do misbehave this way because several reports have come in recently about this.
--- drivers/char/ipmi/ipmi_kcs_sm.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
drivers/char/ipmi/ipmi_kcs_sm.c +5 -11
@@ -122,10 +122,10 @@ struct si_sm_data {unsigned long error0_timeout; }; -static unsigned int init_kcs_data_with_state (struct si_sm_data *kcs, -struct si_sm_io *io,enum kcs_states state) +static unsigned int init_kcs_data (struct si_sm_data *kcs, +struct si_sm_io *io) { - kcs->state = state; + kcs->state =KCS_IDLE ; kcs->io = io; kcs->write_pos =0 ; kcs->write_count =0 ;
@@ -140,12 +140,6 @@ static unsigned int init_kcs_data_with_state(struct si_sm_data *kcs,return 2 ; } -static unsigned int init_kcs_data (struct si_sm_data *kcs, -struct si_sm_io *io) -{ -return init_kcs_data_with_state (kcs, io,KCS_IDLE ); -} -static inline unsigned char read_status (struct si_sm_data *kcs) {return kcs->io->inputb (kcs->io,1 );
@@ -276,7 +270,7 @@ static int start_kcs_transaction(struct si_sm_data *kcs, unsigned char *data,if (size >MAX_KCS_WRITE_SIZE )return IPMI_REQ_LEN_EXCEEDED_ERR ; -if (kcs->state !=KCS_IDLE ) { +if ((kcs->state !=KCS_IDLE ) && (kcs->state !=KCS_HOSED )) {dev_warn (kcs->io->dev,"KCS in invalid state %d\n" , kcs->state);return IPMI_NOT_IN_MY_STATE_ERR ; }
@@ -501,7 +495,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time) }if (kcs->state ==KCS_HOSED ) { -init_kcs_data_with_state (kcs, kcs->io,KCS_ERROR0 ); +init_kcs_data (kcs, kcs->io);return SI_SM_HOSED ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/201 sched/deadline: Fix race in push_dl_task()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Agarwal <[email protected]>
commit 8fd5485fb4f3d9da3977fd783fcb8e5452463420 upstream.
When a CPU chooses to call push_dl_task and picks a task to push to another CPU's runqueue then it will call find_lock_later_rq method which would take a double lock on both CPUs' runqueues. If one of the locks aren't readily available, it may lead to dropping the current runqueue lock and reacquiring both the locks at once. During this window it is possible that the task is already migrated and is running on some other CPU. These cases are already handled. However, if the task is migrated and has already been executed and another CPU is now trying to wake it up (ttwu) such that it is queued again on the runqeue (on_rq is 1) and also if the task was run by the same CPU, then the current checks will pass even though the task was migrated out and is no longer in the pushable tasks list.
Please go through the original rt change for more details on the issue.
To fix this, after the lock is obtained inside the find_lock_later_rq, it ensures that the task is still at the head of pushable tasks list. Also removed some checks that are no longer needed with the addition of this new check.
However, the new check of pushable tasks list only applies when find_lock_later_rq is called by push_dl_task. For the other caller i.e. dl_task_offline_migration, existing checks are used.
--- kernel/sched/deadline.c | 73 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 49 insertions(+), 24 deletions(-)
kernel/sched/deadline.c +49 -24
@@ -2214,6 +2214,25 @@ static int find_later_rq(struct task_strreturn -1 ; } +static struct task_struct *pick_next_pushable_dl_task (struct rq *rq) +{ +struct task_struct *p; + +if (!has_pushable_dl_tasks (rq)) +return NULL ; + + p =__node_2_pdl (rb_first_cached (&rq->dl.pushable_dl_tasks_root)); + +WARN_ON_ONCE (rq->cpu !=task_cpu (p)); +WARN_ON_ONCE (task_current (rq, p)); +WARN_ON_ONCE (p->nr_cpus_allowed <=1 ); + +WARN_ON_ONCE (!task_on_rq_queued (p)); +WARN_ON_ONCE (!dl_task (p)); + +return p; +} +/* Locks the rq it finds */ static struct rq *find_lock_later_rq (struct task_struct *task,struct rq *rq) {
@@ -2241,12 +2260,37 @@ static struct rq *find_lock_later_rq(str/* Retry if something changed. */ if (double_lock_balance (rq, later_rq)) { -if (unlikely (task_rq (task) != rq || +/* +* double_lock_balance had to release rq->lock, in the +* meantime, task may no longer be fit to be migrated. +* Check the following to ensure that the task is +* still suitable for migration: +* 1. It is possible the task was scheduled, +* migrate_disabled was set and then got preempted, +* so we must check the task migration disable +* flag. +* 2. The CPU picked is in the task's affinity. +* 3. For throttled task (dl_task_offline_migration), +* check the following: +* - the task is not on the rq anymore (it was +* migrated) +* - the task is not on CPU anymore +* - the task is still a dl task +* - the task is not queued on the rq anymore +* 4. For the non-throttled task (push_dl_task), the +* check to ensure that this task is still at the +* head of the pushable tasks list is enough. +*/ +if (unlikely (is_migration_disabled (task) || !cpumask_test_cpu (later_rq->cpu, &task->cpus_mask) || -task_on_cpu (rq, task) || - !dl_task (task) || -is_migration_disabled (task) || - !task_on_rq_queued (task))) { + (task->dl.dl_throttled && + (task_rq (task) != rq || +task_on_cpu (rq, task) || + !dl_task (task) || + !task_on_rq_queued (task))) || + (!task->dl.dl_throttled && + task !=pick_next_pushable_dl_task (rq)))) { +double_unlock_balance (rq, later_rq); later_rq =NULL ;break ;
@@ -2269,25 +2313,6 @@ static struct rq *find_lock_later_rq(strreturn later_rq; } -static struct task_struct *pick_next_pushable_dl_task (struct rq *rq) -{ -struct task_struct *p; - -if (!has_pushable_dl_tasks (rq)) -return NULL ; - - p =__node_2_pdl (rb_first_cached (&rq->dl.pushable_dl_tasks_root)); - -WARN_ON_ONCE (rq->cpu !=task_cpu (p)); -WARN_ON_ONCE (task_current (rq, p)); -WARN_ON_ONCE (p->nr_cpus_allowed <=1 ); - -WARN_ON_ONCE (!task_on_rq_queued (p)); -WARN_ON_ONCE (!dl_task (p)); - -return p; -} -/* * See if the non running -deadline tasks on this rq * can be sent to some other CPU where they can preempt
Greg Kroah-Hartman
maintainerPATCH 114/201 scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit b81296591c567b12d3873b05a37b975707959b94 upstream.
Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally.
Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0).
--- drivers/scsi/hpsa.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/scsi/hpsa.c +12 -9
@@ -6528,18 +6528,21 @@ static int hpsa_big_passthru_ioctl(strucwhile (left) { sz = (left > ioc->malloc_size) ? ioc->malloc_size : left; buff_size[sg_used] = sz; - buff[sg_used] =kmalloc (sz,GFP_KERNEL ); -if (buff[sg_used] ==NULL ) { - status = -ENOMEM ; - goto cleanup1; - } +if (ioc->Request.Type.Direction &XFER_WRITE ) { -if (copy_from_user (buff[sg_used], data_ptr, sz)) { - status = -EFAULT ; + buff[sg_used] =memdup_user (data_ptr, sz); +if (IS_ERR (buff[sg_used])) { + status =PTR_ERR (buff[sg_used]); + goto cleanup1; + } + }else { + buff[sg_used] =kzalloc (sz,GFP_KERNEL ); +if (!buff[sg_used]) { + status = -ENOMEM ; goto cleanup1; } - }else -memset (buff[sg_used],0 , sz); + } + left -= sz; data_ptr += sz; sg_used++;
Greg Kroah-Hartman
maintainerPATCH 115/201 sctp: Fix MAC comparison to be constant-time
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit dd91c79e4f58fbe2898dac84858033700e0e99fb upstream.
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
--- net/sctp/sm_make_chunk.c | 3 ++- net/sctp/sm_statefuns.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/sctp/sm_make_chunk.c +2 -1
@@ -31,6 +31,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt#include <crypto/hash.h> +#include <crypto/utils.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -1796,7 +1797,7 @@ struct sctp_association *sctp_unpack_coo } } -if (memcmp (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { +if (crypto_memneq (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { *error = -SCTP_IERROR_BAD_SIG ; goto fail; }
net/sctp/sm_statefuns.c +2 -1
@@ -30,6 +30,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <crypto/utils.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -4416,7 +4417,7 @@ static enum sctp_ierror sctp_sf_authenti sh_key, GFP_ATOMIC);/* Discard the packet if the digests do not match */ -if (memcmp (save_digest, digest, sig_len)) { +if (crypto_memneq (save_digest, digest, sig_len)) {kfree (save_digest);return SCTP_IERROR_BAD_SIG ; }
Greg Kroah-Hartman
maintainerPATCH 116/201 sparc64: fix hugetlb for sun4u
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Yznaga <[email protected]>
commit 6fd44a481b3c6111e4801cec964627791d0f3ec5 upstream.
An attempt to exercise sparc hugetlb code in a sun4u-based guest running under qemu results in the guest hanging due to being stuck in a trap loop. This is due to invalid hugetlb TTEs being installed that do not have the expected _PAGE_PMD_HUGE and page size bits set. Although the breakage has gone apparently unnoticed for several years, fix it now so there is the option to exercise sparc hugetlb code under qemu. This can be useful because sun4v support in qemu does not support linux guests currently and sun4v-based hardware resources may not be readily available.
Fix tested with a 6.15.2 and 6.16-rc6 kernels by running libhugetlbfs tests on a qemu guest running Debian 13.
--- arch/sparc/mm/hugetlbpage.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
arch/sparc/mm/hugetlbpage.c +20 -0
@@ -133,6 +133,26 @@ hugetlb_get_unmapped_area(struct file *fstatic pte_t sun4u_hugepage_shift_to_tte (pte_t entry,unsigned int shift) { +unsigned long hugepage_size = _PAGE_SZ4MB_4U; + +pte_val (entry) =pte_val (entry) & ~_PAGE_SZALL_4U; + +switch (shift) { +case HPAGE_256MB_SHIFT : + hugepage_size = _PAGE_SZ256MB_4U; +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_SHIFT : +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_64K_SHIFT : + hugepage_size = _PAGE_SZ64K_4U; +break ; +default : +WARN_ONCE (1 ,"unsupported hugepage shift=%u\n" , shift); + } + +pte_val (entry) =pte_val (entry) | hugepage_size;return entry; }
Greg Kroah-Hartman
maintainerPATCH 117/201 sparc: fix error handling in scan_one_device()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 302c04110f0ce70d25add2496b521132548cd408 upstream.
Once of_device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it could cause memory leak. So fix this by calling put_device(), then the name can be freed in kobject_cleanup().
Calling path: of_device_register() -> of_device_add() -> device_add(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.
Found by code review.
--- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + 2 files changed, 2 insertions(+)
arch/sparc/kernel/of_device_32.c +1 -0
@@ -387,6 +387,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
arch/sparc/kernel/of_device_64.c +1 -0
@@ -680,6 +680,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 118/201 xtensa: simdisk: add input size check in proc_write_simdisk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 5d5f08fd0cd970184376bee07d59f635c8403f63 upstream.
A malicious user could pass an arbitrarily bad value to memdup_user_nul(), potentially causing kernel crash.
This follows the same pattern as commit ee76746387f6 ("netdevsim: prevent bad user input in nsim_dev_health_break_write()")
Message-Id: <[email protected]>
--- arch/xtensa/platforms/iss/simdisk.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/xtensa/platforms/iss/simdisk.c +5 -1
@@ -230,10 +230,14 @@ static ssize_t proc_read_simdisk(structstatic ssize_t proc_write_simdisk (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -char *tmp =memdup_user_nul (buf, count); +char *tmp;struct simdisk *dev =pde_data (file_inode (file));int err; +if (count ==0 || count >PAGE_SIZE ) +return -EINVAL ; + + tmp =memdup_user_nul (buf, count);if (IS_ERR (tmp))return PTR_ERR (tmp);
Greg Kroah-Hartman
maintainerPATCH 119/201 mtd: rawnand: fsmc: Default to autodetect buswidth
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit b8df622cf7f6808c85764e681847150ed6d85f3d upstream.
If you don't specify buswidth 2 (16 bits) in the device tree, FSMC doesn't even probe anymore:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro 10100000.flash
nand: bus width 8 instead of 16 bits
nand: No NAND device found
fsmc-nand 10100000.flash: probe with driver fsmc-nand failed
with error -22
With this patch to use autodetection unless buswidth is specified, the device is properly detected again:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro NAND 128MiB 1,8V 16-bit
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 fsmc-nand 10100000.flash: Using 1-bit HW ECC scheme Scanning device for bad blocks
I don't know where or how this happened, I think some change in the nand core.
--- drivers/mtd/nand/raw/fsmc_nand.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/fsmc_nand.c +5 -1
@@ -876,10 +876,14 @@ static int fsmc_nand_probe_config_dt(strif (!of_property_read_u32 (np,"bank-width" , &val)) {if (val ==2 ) { nand->options |=NAND_BUSWIDTH_16 ; - }else if (val !=1 ) { + }else if (val ==1 ) { + nand->options |=NAND_BUSWIDTH_AUTO ; + }else {dev_err (&pdev->dev,"invalid bank-width %u\n" , val);return -EINVAL ; } + }else { + nand->options |=NAND_BUSWIDTH_AUTO ; }if (of_property_read_bool (np,"nand-skip-bbtscan" ))
Greg Kroah-Hartman
maintainerPATCH 120/201 mmc: core: SPI mode remove cmd7
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Chen <[email protected]>
commit fec40f44afdabcbc4a7748e4278f30737b54bb1a upstream.
SPI mode doesn't support cmd7, so remove it in mmc_sdio_alive() and confirm if sdio is active by checking CCCR register value is available or not.
--- drivers/mmc/core/sdio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/core/sdio.c +5 -1
@@ -945,7 +945,11 @@ static void mmc_sdio_remove(struct mmc_h*/ static int mmc_sdio_alive (struct mmc_host *host) { -return mmc_select_card (host->card); +if (!mmc_host_is_spi (host)) +return mmc_select_card (host->card); +else +return mmc_io_rw_direct (host->card,0 ,0 ,SDIO_CCCR_CCCR ,0 , +NULL ); }/*
Greg Kroah-Hartman
maintainerPATCH 121/201 memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit 6744085079e785dae5f7a2239456135407c58b25 upstream.
The of_platform_populate() call at the end of the function has a possible failure path, causing a resource leak.
Replace of_iomap() with devm_platform_ioremap_resource() to ensure automatic cleanup of srom->reg_base.
This issue was detected by smatch static analysis:drivers/memory/samsung/exynos-srom.c:155 exynos_srom_probe()warn:
'srom->reg_base' from of_iomap() not released on lines: 155.
--- drivers/memory/samsung/exynos-srom.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/memory/samsung/exynos-srom.c +4 -6
@@ -121,20 +121,18 @@ static int exynos_srom_probe(struct platreturn -ENOMEM ; srom->dev = dev; - srom->reg_base =of_iomap (np,0 ); -if (!srom->reg_base) { + srom->reg_base =devm_platform_ioremap_resource (pdev,0 ); +if (IS_ERR (srom->reg_base)) {dev_err (&pdev->dev,"iomap of exynos srom controller failed\n" ); -return -ENOMEM ; +return PTR_ERR (srom->reg_base); }platform_set_drvdata (pdev, srom); srom->reg_offset =exynos_srom_alloc_reg_dump (exynos_srom_offsets,ARRAY_SIZE (exynos_srom_offsets)); -if (!srom->reg_offset) { -iounmap (srom->reg_base); +if (!srom->reg_offset)return -ENOMEM ; - }for_each_child_of_node (np, child) {if (exynos_srom_configure_bank (srom, child)) {
Greg Kroah-Hartman
maintainerPATCH 122/201 rtc: interface: Ensure alarm irq is enabled when UIE is enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 9db26d5855d0374d4652487bfb5aacf40821c469 upstream.
When setting a normal alarm, user-space is responsible for using RTC_AIE_ON/RTC_AIE_OFF to control if alarm irq should be enabled.
But when RTC_UIE_ON is used, interrupts must be enabled so that the requested irq events are generated.
When RTC_UIE_OFF is used, alarm irq is disabled if there are no other alarms queued, so this commit brings symmetry to that.
--- drivers/rtc/interface.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/rtc/interface.c +4 -0
@@ -594,6 +594,10 @@ int rtc_update_irq_enable(struct rtc_dev rtc->uie_rtctimer.node.expires =ktime_add (now, onesec); rtc->uie_rtctimer.period =ktime_set (1 ,0 ); err =rtc_timer_enqueue (rtc, &rtc->uie_rtctimer); +if (!err && rtc->ops && rtc->ops->alarm_irq_enable) + err = rtc->ops->alarm_irq_enable (rtc->dev.parent,1 ); +if (err) + goto out; }else {rtc_timer_remove (rtc, &rtc->uie_rtctimer); }
Greg Kroah-Hartman
maintainerPATCH 123/201 rtc: interface: Fix long-standing race when setting alarm
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 795cda8338eab036013314dbc0b04aae728880ab upstream.
As described in the old comment dating back to
commit 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") from 2010, we have been living with a race window when setting alarm with an expiry in the near future (i.e. next second).
With 1 second resolution, it can happen that the second ticks after the check for the timer having expired, but before the alarm is actually set. When this happen, no alarm IRQ is generated, at least not with some RTC chips (isl12022 is an example of this).
With UIE RTC timer being implemented on top of alarm irq, being re-armed every second, UIE will occasionally fail to work, as an alarm irq lost due to this race will stop the re-arming loop.
For now, I have limited the additional expiry check to only be done for alarms set to next seconds. I expect it should be good enough, although I don't know if we can now for sure that systems with loads could end up causing the same problems for alarms set 2 seconds or even longer in the future.
I haven't been able to reproduce the problem with this check in place.
--- drivers/rtc/interface.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/rtc/interface.c +23 -0
@@ -443,6 +443,29 @@ static int __rtc_set_alarm(struct rtc_deelse err = rtc->ops->set_alarm (rtc->dev.parent, alarm); +/* +* Check for potential race described above. If the waiting for next +* second, and the second just ticked since the check above, either +* +* 1) It ticked after the alarm was set, and an alarm irq should be +* generated. +* +* 2) It ticked before the alarm was set, and alarm irq most likely will +* not be generated. +* +* While we cannot easily check for which of these two scenarios we +* are in, we can return -ETIME to signal that the timer has already +* expired, which is true in both cases. +*/ +if ((scheduled - now) <=1 ) { + err =__rtc_read_time (rtc, &tm); +if (err) +return err; + now =rtc_tm_to_time64 (&tm); +if (scheduled <= now) +return -ETIME ; + } +trace_rtc_set_alarm (rtc_tm_to_time64 (&alarm->time), err);return err; }
Greg Kroah-Hartman
maintainerPATCH 124/201 rseq/selftests: Use weak symbol reference, not definition, to link with glibc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit a001cd248ab244633c5fabe4f7c707e13fc1d1cc upstream.
Add "extern" to the glibc-defined weak rseq symbols to convert the rseq selftest's usage from weak symbol definitions to weak symbol _references_. Effectively re-defining the glibc symbols wreaks havoc when building with -fno-common, e.g. generates segfaults when running multi-threaded programs, as dynamically linked applications end up with multiple versions of the symbols.
Building with -fcommon, which until recently has the been the default for GCC and clang, papers over the bug by allowing the linker to resolve the weak/tentative definition to glibc's "real" definition.
Note, the symbol itself (or rather its address), not the value of the symbol, is set to 0/NULL for unresolved weak symbol references, as the symbol doesn't exist and thus can't have a value. Check for a NULL rseq size pointer to handle the scenario where the test is statically linked against a libc that doesn't support rseq in any capacity.
--- tools/testing/selftests/rseq/rseq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/rseq/rseq.c +4 -4
@@ -40,9 +40,9 @@* Define weak versions to play nice with binaries that are statically linked * against a libc that doesn't support registering its own rseq. */ -__weak ptrdiff_t __rseq_offset; -__weak unsigned int __rseq_size; -__weak unsigned int __rseq_flags; +extern __weak ptrdiff_t __rseq_offset; +extern __weak unsigned int __rseq_size; +extern __weak unsigned int __rseq_flags;static const ptrdiff_t *libc_rseq_offset_p = &__rseq_offset;static const unsigned int *libc_rseq_size_p = &__rseq_size;
@@ -198,7 +198,7 @@ void rseq_init(void)* libc not having registered a restartable sequence. Try to find the * symbols if that's the case. */ -if (!*libc_rseq_size_p) { +if (!libc_rseq_size_p || !*libc_rseq_size_p) { libc_rseq_offset_p =dlsym (RTLD_NEXT ,"__rseq_offset" ); libc_rseq_size_p =dlsym (RTLD_NEXT ,"__rseq_size" ); libc_rseq_flags_p =dlsym (RTLD_NEXT ,"__rseq_flags" );
Greg Kroah-Hartman
maintainerPATCH 125/201 PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 26fda92d3b56bf44a02bcb4001c5a5548e0ae8ee upstream.
The tegra_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls tegra_msi_irq_unmask().
Since the &desc->lock descriptor lock is a raw spinlock, and the tegra_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y.
Use scoped_guard() to simplify the locking.
--- drivers/pci/controller/pci-tegra.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
drivers/pci/controller/pci-tegra.c +13 -14
@@ -14,6 +14,7 @@*/ #include <linux/clk.h> +#include <linux/cleanup.h> #include <linux/debugfs.h> #include <linux/delay.h> #include <linux/export.h>
@@ -269,7 +270,7 @@ struct tegra_msi {DECLARE_BITMAP (used,INT_PCI_MSI_NR );struct irq_domain *domain;struct mutex map_lock; -spinlock_t mask_lock; +raw_spinlock_t mask_lock;void *virt;dma_addr_t phys;int irq;
@@ -1604,14 +1605,13 @@ static void tegra_msi_irq_mask(struct irstruct tegra_msi *msi =irq_data_get_irq_chip_data (d);struct tegra_pcie *pcie =msi_to_pcie (msi);unsigned int index = d->hwirq /32 ; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); - value &= ~BIT (d->hwirq %32 ); -afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); + value &= ~BIT (d->hwirq %32 ); +afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); + } }static void tegra_msi_irq_unmask (struct irq_data *d)
@@ -1619,14 +1619,13 @@ static void tegra_msi_irq_unmask(structstruct tegra_msi *msi =irq_data_get_irq_chip_data (d);struct tegra_pcie *pcie =msi_to_pcie (msi);unsigned int index = d->hwirq /32 ; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); - value |=BIT (d->hwirq %32 ); -afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =afi_readl (pcie,AFI_MSI_EN_VEC (index)); + value |=BIT (d->hwirq %32 ); +afi_writel (pcie, value,AFI_MSI_EN_VEC (index)); + } }static int tegra_msi_set_affinity (struct irq_data *d,const struct cpumask *mask,bool force)
@@ -1742,7 +1741,7 @@ static int tegra_pcie_msi_setup(struct tint err;mutex_init (&msi->map_lock); -spin_lock_init (&msi->mask_lock); +raw_spin_lock_init (&msi->mask_lock);if (IS_ENABLED (CONFIG_PCI_MSI )) { err =tegra_allocate_domains (msi);
Greg Kroah-Hartman
maintainerPATCH 126/201 PCI/sysfs: Ensure devices are powered for config reads
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 48991e4935078b05f80616c75d1ee2ea3ae18e58 upstream.
The "max_link_width", "current_link_speed", "current_link_width", "secondary_bus_number", and "subordinate_bus_number" sysfs files all access config registers, but they don't check the runtime PM state. If the device is in D3cold or a parent bridge is suspended, we may see -EINVAL, bogus values, or worse, depending on implementation details.
Wrap these access in pci_config_pm_runtime_{get,put}() like most of the rest of the similar sysfs attributes.
Notably, "max_link_speed" does not access config registers; it returns a cached value since d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds").
--- drivers/pci/pci-sysfs.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/pci/pci-sysfs.c +19 -1
@@ -196,8 +196,14 @@ static ssize_t max_link_width_show(struc struct device_attribute *attr, char *buf) { struct pci_dev *pdev = to_pci_dev(dev); +ssize_t ret; -return sysfs_emit (buf,"%u\n" ,pcie_get_width_cap (pdev)); +/* We read PCI_EXP_LNKCAP, so we need the device to be accessible. */ +pci_config_pm_runtime_get (pdev); + ret =sysfs_emit (buf,"%u\n" ,pcie_get_width_cap (pdev)); +pci_config_pm_runtime_put (pdev); + +return ret; }static DEVICE_ATTR_RO (max_link_width);
@@ -209,7 +215,10 @@ static ssize_t current_link_speed_show(sint err;enum pci_bus_speed speed; +pci_config_pm_runtime_get (pci_dev); err =pcie_capability_read_word (pci_dev,PCI_EXP_LNKSTA , &linkstat); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
@@ -226,7 +235,10 @@ static ssize_t current_link_width_show(su16 linkstat;int err; +pci_config_pm_runtime_get (pci_dev); err =pcie_capability_read_word (pci_dev,PCI_EXP_LNKSTA , &linkstat); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
@@ -242,7 +254,10 @@ static ssize_t secondary_bus_number_showu8 sec_bus;int err; +pci_config_pm_runtime_get (pci_dev); err =pci_read_config_byte (pci_dev,PCI_SECONDARY_BUS , &sec_bus); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
@@ -258,7 +273,10 @@ static ssize_t subordinate_bus_number_shu8 sub_bus;int err; +pci_config_pm_runtime_get (pci_dev); err =pci_read_config_byte (pci_dev,PCI_SUBORDINATE_BUS , &sub_bus); +pci_config_pm_runtime_put (pci_dev); +if (err)return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 127/201 PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 upstream.
Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs.
Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()") such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls.
On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed:
PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56)
GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001
00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8
#0 [3800313fb20] device_del at c9158ad5c
#1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390
#9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2.
This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy.
Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper.
Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking.
--- drivers/pci/iov.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/iov.c +5 -0
@@ -581,15 +581,18 @@ static int sriov_add_vfs(struct pci_devif (dev->no_vf_scan)return 0 ; +pci_lock_rescan_remove ();for (i =0 ; i < num_vfs; i++) { rc =pci_iov_add_virtfn (dev, i);if (rc) goto failed; } +pci_unlock_rescan_remove ();return 0 ; failed:while (i--)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove ();return rc; }
@@ -709,8 +712,10 @@ static void sriov_del_vfs(struct pci_devstruct pci_sriov *iov = dev->sriov;int i; +pci_lock_rescan_remove ();for (i =0 ; i < iov->num_VFs; i++)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove (); }static void sriov_disable (struct pci_dev *dev)
Greg Kroah-Hartman
maintainerPATCH 128/201 PCI/ERR: Fix uevent on failure to recover
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 1cbc5e25fb70e942a7a735a1f3d6dd391afc9b29 upstream.
Upon failure to recover from a PCIe error through AER, DPC or EDR, a uevent is sent to inform user space about disconnection of the bridge whose subordinate devices failed to recover.
However the bridge itself is not disconnected. Instead, a uevent should be sent for each of the subordinate devices.
Only if the "bridge" happens to be a Root Complex Event Collector or Integrated Endpoint does it make sense to send a uevent for it (because there are no subordinate devices).
Right now if there is a mix of subordinate devices with and without pci_error_handlers, a BEGIN_RECOVERY event is sent for those with pci_error_handlers but no FAILED_RECOVERY event is ever sent for them afterwards. Fix it.
--- drivers/pci/pcie/err.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pci/pcie/err.c +7 -1
@@ -108,6 +108,12 @@ static int report_normal_detected(structreturn report_error_detected (dev, pci_channel_io_normal, data); } +static int report_perm_failure_detected (struct pci_dev *dev,void *data) +{ +pci_uevent_ers (dev,PCI_ERS_RESULT_DISCONNECT ); +return 0 ; +} +static int report_mmio_enabled (struct pci_dev *dev,void *data) {struct pci_driver *pdrv;
@@ -275,7 +281,7 @@ pci_ers_result_t pcie_do_recovery(struct failed:pci_walk_bridge (bridge, pci_pm_runtime_put,NULL ); -pci_uevent_ers (bridge,PCI_ERS_RESULT_DISCONNECT ); +pci_walk_bridge (bridge, report_perm_failure_detected,NULL );/* TODO: Should kernel panic here? */ pci_info (bridge,"device recovery failed\n" );
Greg Kroah-Hartman
maintainerPATCH 129/201 PCI/AER: Fix missing uevent on recovery when a reset is requested
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit bbf7d0468d0da71d76cc6ec9bc8a224325d07b6b upstream.
Since commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") AER uses the result of error_detected() as parameter to pci_uevent_ers(). As pci_uevent_ers() however does not handle PCI_ERS_RESULT_NEED_RESET this results in a missing uevent for the beginning of recovery if drivers request a reset. Fix this by treating PCI_ERS_RESULT_NEED_RESET as beginning recovery.
--- drivers/pci/pci-driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/pci-driver.c +1 -0
@@ -1612,6 +1612,7 @@ void pci_uevent_ers(struct pci_dev *pdevswitch (err_type) {case PCI_ERS_RESULT_NONE :case PCI_ERS_RESULT_CAN_RECOVER : +case PCI_ERS_RESULT_NEED_RESET : envp[idx++] ="ERROR_EVENT=BEGIN_RECOVERY" ; envp[idx++] ="DEVICE_ONLINE=0" ;break ;
Greg Kroah-Hartman
maintainerPATCH 130/201 PCI/AER: Support errors introduced by PCIe r6.0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 6633875250b38b18b8638cf01e695de031c71f02 upstream.
PCIe r6.0 defined five additional errors in the Uncorrectable Error Status, Mask and Severity Registers (PCIe r7.0 sec 7.8.4.2ff).
lspci has been supporting them since commit 144b0911cc0b ("ls-ecaps:
extend decode support for more fields for AER CE and UE status"):
https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/commit/?id=144b0911cc0b
Amend the AER driver to recognize them as well, instead of logging them as "Unknown Error Bit".
--- drivers/pci/pcie/aer.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/pcie/aer.c +6 -6
@@ -38,7 +38,7 @@#define AER_ERROR_SOURCES_MAX 128#define AER_MAX_TYPEOF_COR_ERRS 16/* as per PCI_ERR_COR_STATUS */ -#define AER_MAX_TYPEOF_UNCOR_ERRS 27/* as per PCI_ERR_UNCOR_STATUS*/ +#define AER_MAX_TYPEOF_UNCOR_ERRS 32/* as per PCI_ERR_UNCOR_STATUS*/ struct aer_err_source {unsigned int status;
@@ -510,11 +510,11 @@ static const char *aer_uncorrectable_err"AtomicOpBlocked" ,/* Bit Position 24 */ "TLPBlockedErr" ,/* Bit Position 25 */ "PoisonTLPBlocked" ,/* Bit Position 26 */ -NULL ,/* Bit Position 27 */ -NULL ,/* Bit Position 28 */ -NULL ,/* Bit Position 29 */ -NULL ,/* Bit Position 30 */ - NULL, /* Bit Position 31 */ +"DMWrReqBlocked" ,/* Bit Position 27 */ +"IDECheck" ,/* Bit Position 28 */ +"MisIDETLP" ,/* Bit Position 29 */ +"PCRC_CHECK" ,/* Bit Position 30 */ + "TLPXlatBlocked", /* Bit Position 31 */ }; static const char *aer_agent_string[] = {
Greg Kroah-Hartman
maintainerPATCH 131/201 PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit e51d05f523e43ce5d2bad957943a2b14f68078cd upstream.
Commit under Fixes introduced the IRQ handler for "ks-pcie-error-irq". The interrupt is acquired using "request_irq()" but is never freed if the driver exits due to an error. Although the section in the driver that invokes "request_irq()" has moved around over time, the issue hasn't been addressed until now.
Fix this by using "devm_request_irq()" which automatically frees the interrupt if the driver exits.
--- drivers/pci/controller/dwc/pci-keystone.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pci-keystone.c +2 -2
@@ -1213,8 +1213,8 @@ static int ks_pcie_probe(struct platformif (irq <0 )return irq; - ret =request_irq (irq, ks_pcie_err_irq_handler,IRQF_SHARED , -"ks-pcie-error-irq" , ks_pcie); + ret =devm_request_irq (dev, irq, ks_pcie_err_irq_handler,IRQF_SHARED , +"ks-pcie-error-irq" , ks_pcie);if (ret <0 ) {dev_err (dev,"failed to request error IRQ %d\n" , irq);
Greg Kroah-Hartman
maintainerPATCH 132/201 PCI: rcar-host: Drop PMSR spinlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 0a8f173d9dad13930d5888505dc4c4fd6a1d4262 upstream.
The pmsr_lock spinlock used to be necessary to synchronize access to the PMSR register, because that access could have been triggered from either config space access in rcar_pcie_config_access() or an exception handler rcar_pcie_aarch32_abort_handler().
The rcar_pcie_aarch32_abort_handler() case is no longer applicable since commit 6e36203bc14c ("PCI: rcar: Use PCI_SET_ERROR_RESPONSE after read which triggered an exception"), which performs more accurate, controlled invocation of the exception, and a fixup.
This leaves rcar_pcie_config_access() as the only call site from which rcar_pcie_wakeup() is called. The rcar_pcie_config_access() can only be called from the controller struct pci_ops .read and .write callbacks, and those are serialized in drivers/pci/access.c using raw spinlock 'pci_lock' . It should be noted that CONFIG_PCI_LOCKLESS_CONFIG is never set on this platform.
Since the 'pci_lock' is a raw spinlock , and the 'pmsr_lock' is not a raw spinlock, this constellation triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y .
Remove the pmsr_lock to fix the locking.
--- drivers/pci/controller/pcie-rcar-host.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +2 -11
@@ -50,20 +50,13 @@ struct rcar_pcie_host {int (*phy_init_fn)(struct rcar_pcie_host *host); }; -static DEFINE_SPINLOCK (pmsr_lock); -static int rcar_pcie_wakeup (struct device *pcie_dev,void __iomem *pcie_base) { -unsigned long flags;u32 pmsr, val;int ret =0 ; -spin_lock_irqsave (&pmsr_lock, flags); - -if (!pcie_base ||pm_runtime_suspended (pcie_dev)) { - ret = -EINVAL ; - goto unlock_exit; - } +if (!pcie_base ||pm_runtime_suspended (pcie_dev)) +return -EINVAL ; pmsr =readl (pcie_base +PMSR );
@@ -85,8 +78,6 @@ static int rcar_pcie_wakeup(struct devicwritel (L1FAEG |PMEL1RX , pcie_base +PMSR ); } -unlock_exit: -spin_unlock_irqrestore (&pmsr_lock, flags);return ret; }
Greg Kroah-Hartman
maintainerPATCH 133/201 PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 5ed35b4d490d8735021cce9b715b62a418310864 upstream.
The rcar_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls rcar_msi_irq_unmask().
Since the &desc->lock descriptor lock is a raw spinlock, and the rcar_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y.
Use scoped_guard() to simplify the locking.
--- drivers/pci/controller/pcie-rcar-host.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +13 -14
@@ -12,6 +12,7 @@*/ #include <linux/bitops.h> +#include <linux/cleanup.h> #include <linux/clk.h> #include <linux/clk-provider.h> #include <linux/delay.h>
@@ -36,7 +37,7 @@ struct rcar_msi {DECLARE_BITMAP (used,INT_PCI_MSI_NR );struct irq_domain *domain;struct mutex map_lock; -spinlock_t mask_lock; +raw_spinlock_t mask_lock;int irq1;int irq2; };
@@ -624,28 +625,26 @@ static void rcar_msi_irq_mask(struct irq {struct rcar_msi *msi =irq_data_get_irq_chip_data (d);struct rcar_pcie *pcie = &msi_to_host (msi)->pcie; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =rcar_pci_read_reg (pcie,PCIEMSIIER ); - value &= ~BIT (d->hwirq); -rcar_pci_write_reg (pcie, value,PCIEMSIIER ); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =rcar_pci_read_reg (pcie,PCIEMSIIER ); + value &= ~BIT (d->hwirq); +rcar_pci_write_reg (pcie, value,PCIEMSIIER ); + } }static void rcar_msi_irq_unmask (struct irq_data *d) {struct rcar_msi *msi =irq_data_get_irq_chip_data (d);struct rcar_pcie *pcie = &msi_to_host (msi)->pcie; -unsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); - value =rcar_pci_read_reg (pcie,PCIEMSIIER ); - value |=BIT (d->hwirq); -rcar_pci_write_reg (pcie, value,PCIEMSIIER ); -spin_unlock_irqrestore (&msi->mask_lock, flags); + scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { + value =rcar_pci_read_reg (pcie,PCIEMSIIER ); + value |=BIT (d->hwirq); +rcar_pci_write_reg (pcie, value,PCIEMSIIER ); + } }static int rcar_msi_set_affinity (struct irq_data *d,const struct cpumask *mask,bool force)
@@ -761,7 +760,7 @@ static int rcar_pcie_enable_msi(struct rint err;mutex_init (&msi->map_lock); -spin_lock_init (&msi->mask_lock); +raw_spin_lock_init (&msi->mask_lock); err =of_address_to_resource (dev->of_node,0 , &res);if (err)
Greg Kroah-Hartman
maintainerPATCH 134/201 PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit b640d42a6ac9ba01abe65ec34f7c73aaf6758ab8 upstream.
The pci_epc_raise_irq() supplies a MSI or MSI-X interrupt number in range (1-N), as per the pci_epc_raise_irq() kdoc, where N is 32 for MSI.
But tegra_pcie_ep_raise_msi_irq() incorrectly uses the interrupt number as the MSI vector. This causes wrong MSI vector to be triggered, leading to the failure of PCI endpoint Kselftest MSI_TEST test case.
To fix this issue, convert the interrupt number to MSI vector.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -2
@@ -1963,10 +1963,10 @@ static int tegra_pcie_ep_raise_legacy_irstatic int tegra_pcie_ep_raise_msi_irq (struct tegra_pcie_dw *pcie,u16 irq) { -if (unlikely (irq >31 )) +if (unlikely (irq >32 ))return -EINVAL ; -appl_writel (pcie,BIT (irq),APPL_MSI_CTRL_1 ); +appl_writel (pcie,BIT (irq -1 ),APPL_MSI_CTRL_1 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 135/201 PCI: tegra194: Handle errors in BPMP response
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
commit f8c9ad46b00453a8c075453f3745f8d263f44834 upstream.
The return value from tegra_bpmp_transfer() indicates the success or failure of the IPC transaction with BPMP. If the transaction succeeded, we also need to check the actual command's result code.
If we don't have error handling for tegra_bpmp_transfer(), we will set the pcie->ep_state to EP_STATE_ENABLED even when the tegra_bpmp_transfer() command fails. Thus, the pcie->ep_state will get out of sync with reality, and any further PERST# assert + deassert will be a no-op and will not trigger the hardware initialization sequence.
This is because pex_ep_event_pex_rst_deassert() checks the current pcie->ep_state, and does nothing if the current state is already EP_STATE_ENABLED.
Thus, it is important to have error handling for tegra_bpmp_transfer(), such that the pcie->ep_state can not get out of sync with reality, so that we will try to initialize the hardware not only during the first PERST# assert + deassert, but also during any succeeding PERST# assert + deassert.
One example where this fix is needed is when using a rock5b as host. During the initial PERST# assert + deassert (triggered by the bootloader on the rock5b) pex_ep_event_pex_rst_deassert() will get called, but for some unknown reason, the tegra_bpmp_transfer() call to initialize the PHY fails. Once Linux has been loaded on the rock5b, the PCIe driver will once again assert + deassert PERST#. However, without tegra_bpmp_transfer() error handling, this second PERST# assert + deassert will not trigger the hardware initialization sequence.
With tegra_bpmp_transfer() error handling, the second PERST# assert + deassert will once again trigger the hardware to be initialized and this time the tegra_bpmp_transfer() succeeds.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +16 -2
@@ -1218,6 +1218,7 @@ static int tegra_pcie_bpmp_set_ctrl_statstruct mrq_uphy_response resp;struct tegra_bpmp_message msg;struct mrq_uphy_request req; +int err;/* * Controller-5 doesn't need to have its state set by BPMP-FW in
@@ -1240,7 +1241,13 @@ static int tegra_pcie_bpmp_set_ctrl_stat msg.rx.data = &resp; msg.rx.size =sizeof (resp); -return tegra_bpmp_transfer (pcie->bpmp, &msg); + err =tegra_bpmp_transfer (pcie->bpmp, &msg); +if (err) +return err; +if (msg.rx.ret) +return -EINVAL ; + +return 0 ; } static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie,
@@ -1249,6 +1256,7 @@ static int tegra_pcie_bpmp_set_pll_statestruct mrq_uphy_response resp;struct tegra_bpmp_message msg;struct mrq_uphy_request req; +int err;memset (&req,0 ,sizeof (req));memset (&resp,0 ,sizeof (resp));
@@ -1268,7 +1276,13 @@ static int tegra_pcie_bpmp_set_pll_state msg.rx.data = &resp; msg.rx.size =sizeof (resp); -return tegra_bpmp_transfer (pcie->bpmp, &msg); + err =tegra_bpmp_transfer (pcie->bpmp, &msg); +if (err) +return err; +if (msg.rx.ret) +return -EINVAL ; + +return 0 ; }static void tegra_pcie_downstream_dev_to_D0 (struct tegra_pcie_dw *pcie)
Greg Kroah-Hartman
maintainerPATCH 136/201 spi: cadence-quadspi: Flush posted register writes before INDAC access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
commit 29e0b471ccbd674d20d4bbddea1a51e7105212c5 upstream.
cqspi_indirect_read_execute() and cqspi_indirect_write_execute() first set the enable bit on APB region and then start reading/writing to the AHB region. On TI K3 SoCs these regions lie on different endpoints. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level.
It is possible for the AHB write to be executed before the APB write to enable the indirect controller, causing the transaction to be invalid and the write erroring out. Read back the APB region write before accessing the AHB region to make sure the write got flushed and the race condition is eliminated.
Message-ID: <[email protected]>
--- drivers/spi/spi-cadence-quadspi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-cadence-quadspi.c +3 -0
@@ -726,6 +726,7 @@ static int cqspi_indirect_read_execute(sreinit_completion (&cqspi->transfer_complete);writel (CQSPI_REG_INDIRECTRD_START_MASK , reg_base +CQSPI_REG_INDIRECTRD ); +readl (reg_base +CQSPI_REG_INDIRECTRD );/* Flush posted write. */ while (remaining > 0) { if (!wait_for_completion_timeout(&cqspi->transfer_complete,
@@ -1029,6 +1030,8 @@ static int cqspi_indirect_write_execute(reinit_completion (&cqspi->transfer_complete);writel (CQSPI_REG_INDIRECTWR_START_MASK , reg_base +CQSPI_REG_INDIRECTWR ); +readl (reg_base +CQSPI_REG_INDIRECTWR );/* Flush posted write. */ +/* * As per 66AK2G02 TRM SPRUHY8F section 11.15.5.3 Indirect Access * Controller programming sequence, couple of cycles of
Greg Kroah-Hartman
maintainerPATCH 137/201 spi: cadence-quadspi: Flush posted register writes before DAC access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
commit 1ad55767e77a853c98752ed1e33b68049a243bd7 upstream.
cqspi_read_setup() and cqspi_write_setup() program the address width as the last step in the setup. This is likely to be immediately followed by a DAC region read/write. On TI K3 SoCs the DAC region is on a different endpoint from the register region. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level. It is possible that the DAC read/write goes through before the address width update goes through. In this situation if the previous command used a different address width the OSPI command is sent with the wrong number of address bytes, resulting in an invalid command and undefined behavior.
Read back the size register to make sure the write gets flushed before accessing the DAC region.
Message-ID: <[email protected]>
--- drivers/spi/spi-cadence-quadspi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-cadence-quadspi.c +2 -0
@@ -687,6 +687,7 @@ static int cqspi_read_setup(struct cqspi reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK ; reg |= (op->addr.nbytes -1 );writel (reg, reg_base +CQSPI_REG_SIZE ); +readl (reg_base +CQSPI_REG_SIZE );/* Flush posted write. */ return 0 ; }
@@ -1005,6 +1006,7 @@ static int cqspi_write_setup(struct cqsp reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK ; reg |= (op->addr.nbytes -1 );writel (reg, reg_base +CQSPI_REG_SIZE ); +readl (reg_base +CQSPI_REG_SIZE );/* Flush posted write. */ return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 138/201 x86/umip: Check that the instruction opcode is at least two bytes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 32278c677947ae2f042c9535674a7fff9a245dd3 upstream.
When checking for a potential UMIP violation on #GP, verify the decoder found at least two opcode bytes to avoid false positives when the kernel encounters an unknown instruction that starts with 0f. Because the array of opcode.bytes is zero-initialized by insn_init(), peeking at bytes[1] will misinterpret garbage as a potential SLDT or STR instruction, and can incorrectly trigger emulation.
E.g. if a VPALIGNR instruction
62 83 c5 05 0f 08 ff vpalignr xmm17{k5},xmm23,XMMWORD PTR [r8],0xff
hits a #GP, the kernel emulates it as STR and squashes the #GP (and corrupts the userspace code stream).
Arguably the check should look for exactly two bytes, but no three byte opcodes use '0f 00 xx' or '0f 01 xx' as an escape, i.e. it should be impossible to get a false positive if the first two opcode bytes match '0f 00' or '0f 01'. Go with a more conservative check with respect to the existing code to minimize the chances of breaking userspace, e.g. due to decoder weirdness.
Analyzed by Nick Bray <[email protected]>.
--- arch/x86/kernel/umip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/umip.c +2 -2
@@ -156,8 +156,8 @@ static int identify_insn(struct insn *inif (!insn->modrm.nbytes)return -EINVAL ; -/* All the instructions of interest start with 0x0f. */ -if (insn->opcode.bytes[0 ] !=0xf ) +/* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */ +if (insn->opcode.nbytes <2 || insn->opcode.bytes[0 ] !=0xf )return -EINVAL ;if (insn->opcode.bytes[1 ] ==0x1 ) {
Greg Kroah-Hartman
maintainerPATCH 139/201 x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 27b1fd62012dfe9d3eb8ecde344d7aa673695ecf upstream.
Filter out the register forms of 0F 01 when determining whether or not to emulate in response to a potential UMIP violation #GP, as SGDT and SIDT only accept memory operands. The register variants of 0F 01 are used to encode instructions for things like VMX and SGX, i.e. not checking the Mod field would cause the kernel to incorrectly emulate on #GP, e.g. due to a CPL violation on VMLAUNCH.
--- arch/x86/kernel/umip.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kernel/umip.c +11 -0
@@ -163,8 +163,19 @@ static int identify_insn(struct insn *inif (insn->opcode.bytes[1 ] ==0x1 ) {switch (X86_MODRM_REG (insn->modrm.value)) {case 0 : +/* The reg form of 0F 01 /0 encodes VMX instructions. */ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SGDT ;case 1 : +/* +* The reg form of 0F 01 /1 encodes MONITOR/MWAIT, +* STAC/CLAC, and ENCLS. +*/ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SIDT ;case 4 :return UMIP_INST_SMSW ;
Greg Kroah-Hartman
maintainerPATCH 140/201 selftests: mptcp: join: validate C-flag + def limit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 008385efd05e04d8dff299382df2e8be0f91d8a0 upstream.
The previous commit adds an exception for the C-flag case. The 'mptcp_join.sh' selftest is extended to validate this case.
In this subtest, there is a typical CDN deployment with a client where MPTCP endpoints have been 'automatically' configured:
- the server set net.mptcp.allow_join_initial_addr_port=0
- the client has multiple 'subflow' endpoints, and the default limits:
not accepting ADD_ADDRs.
Without the parent patch, the client is not able to establish new subflows using its 'subflow' endpoints. The parent commit fixes that.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +11 -0
@@ -3234,6 +3234,17 @@ deny_join_id0_tests() run_tests $ns1 $ns2 10.0.1.1 chk_join_nr 1 1 1 fi + + # default limits, server deny join id 0 + signal + if reset_with_allow_join_id0 "default limits, server deny join id 0" 0 1; then + pm_nl_set_limits $ns1 0 2 + pm_nl_set_limits $ns2 0 2 + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal + pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow + pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 2 2 2 + fi } fullmesh_tests()
Greg Kroah-Hartman
maintainerPATCH 141/201 wifi: ath11k: HAL SRNG: dont deinitialize and re-initialize again
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
commit 32be3ca4cf78b309dfe7ba52fe2d7cc3c23c5634 upstream.
Don't deinitialize and reinitialize the HAL helpers. The dma memory is deallocated and there is high possibility that we'll not be able to get the same memory allocated from dma when there is high memory pressure.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.6
--- drivers/net/wireless/ath/ath11k/core.c | 6 +----- drivers/net/wireless/ath/ath11k/hal.c | 16 ++++++++++++++++ drivers/net/wireless/ath/ath11k/hal.h | 1 + 3 files changed, 18 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +1 -5
@@ -1763,14 +1763,10 @@ static int ath11k_core_reconfigure_on_crmutex_unlock (&ab->core_lock);ath11k_dp_free (ab); -ath11k_hal_srng_deinit (ab); +ath11k_hal_srng_clear (ab); ab->free_vdev_map = (1LL << (ab->num_radios *TARGET_NUM_VDEVS (ab))) -1 ; - ret =ath11k_hal_srng_init (ab); -if (ret) -return ret; -clear_bit (ATH11K_FLAG_CRASH_FLUSH , &ab->dev_flags); ret =ath11k_core_qmi_firmware_ready (ab);
drivers/net/wireless/ath/ath11k/hal.c +16 -0
@@ -1356,6 +1356,22 @@ void ath11k_hal_srng_deinit(struct ath11 }EXPORT_SYMBOL (ath11k_hal_srng_deinit); +void ath11k_hal_srng_clear (struct ath11k_base *ab) +{ +/* No need to memset rdp and wrp memory since each individual +* segment would get cleared in ath11k_hal_srng_src_hw_init() +* and ath11k_hal_srng_dst_hw_init(). +*/ +memset (ab->hal.srng_list,0 , +sizeof (ab->hal.srng_list)); +memset (ab->hal.shadow_reg_addr,0 , +sizeof (ab->hal.shadow_reg_addr)); + ab->hal.avail_blk_resource =0 ; + ab->hal.current_blk_index =0 ; + ab->hal.num_shadow_reg_configured =0 ; +} +EXPORT_SYMBOL (ath11k_hal_srng_clear); +void ath11k_hal_dump_srng_stats (struct ath11k_base *ab) {struct hal_srng *srng;
drivers/net/wireless/ath/ath11k/hal.h +1 -0
@@ -962,6 +962,7 @@ int ath11k_hal_srng_setup(struct ath11k_ struct hal_srng_params *params);int ath11k_hal_srng_init (struct ath11k_base *ath11k);void ath11k_hal_srng_deinit (struct ath11k_base *ath11k); +void ath11k_hal_srng_clear (struct ath11k_base *ab);void ath11k_hal_dump_srng_stats (struct ath11k_base *ab);void ath11k_hal_srng_get_shadow_config (struct ath11k_base *ab,u32 **cfg,u32 *len);
Greg Kroah-Hartman
maintainerPATCH 142/201 wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Morrow <[email protected]>
commit fc6627ca8a5f811b601aea74e934cf8a048c88ac upstream.
Add VID/PID 0846/9065 for Netgear A7500.
--- drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7921/usb.c +3 -0
@@ -21,6 +21,9 @@ static const struct usb_device_id mt7921/* Netgear, Inc. [A8000,AXE3000] */ { USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9060, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, + /* Netgear, Inc. A7500 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9065, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, /* TP-Link TXE50UH */ { USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0107, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM },
Greg Kroah-Hartman
maintainerPATCH 143/201 mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 6a204d4b14c99232e05d35305c27ebce1c009840 upstream.
Commit 524c48072e56 ("mm/page_alloc: rename ALLOC_HIGH to ALLOC_MIN_RESERVE") is the start of a series that explains how __GFP_HIGH, which implies ALLOC_MIN_RESERVE, is going to be used instead of __GFP_ATOMIC for high atomic reserves.
Commit eb2e2b425c69 ("mm/page_alloc: explicitly record high-order atomic allocations in alloc_flags") introduced ALLOC_HIGHATOMIC for such allocations of order higher than 0. It still used __GFP_ATOMIC, though.
Then, commit 1ebbb21811b7 ("mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations accesses reserves") just turned that check for !__GFP_DIRECT_RECLAIM, ignoring that high atomic reserves were expected to test for __GFP_HIGH.
This leads to high atomic reserves being added for high-order GFP_NOWAIT allocations and others that clear __GFP_DIRECT_RECLAIM, which is unexpected. Later, those reserves lead to 0-order allocations going to the slow path and starting reclaim.
Quoted 1 line
From
/proc/pagetypeinfo, without the patch:
Node 0, zone DMA, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone DMA32, type HighAtomic 1 8 10 9 7 3 0 0 0 0 0 Node 0, zone Normal, type HighAtomic 64 20 12 5 0 0 0 0 0 0 0
With the patch:
Node 0, zone DMA, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone DMA32, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone Normal, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0
--- mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/page_alloc.c +1 -1
@@ -3738,7 +3738,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask, unsigif (!(gfp_mask & __GFP_NOMEMALLOC)) { alloc_flags |=ALLOC_NON_BLOCK ; -if (order >0 ) +if (order >0 && (alloc_flags &ALLOC_MIN_RESERVE )) alloc_flags |=ALLOC_HIGHATOMIC ; }
Greg Kroah-Hartman
maintainerPATCH 144/201 mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
commit b322e88b3d553e85b4e15779491c70022783faa4 upstream.
Optimize hugetlb_pages_alloc_boot() to return immediately when max_huge_pages is 0, avoiding unnecessary CPU cycles and the below log message when hugepages aren't configured in the kernel command line.
[ 3.702280] HugeTLB: allocation took 0ms with hugepage_allocation_threads=32
--- mm/hugetlb.c | 3 +++ 1 file changed, 3 insertions(+)
mm/hugetlb.c +3 -0
@@ -3298,6 +3298,9 @@ static void __init hugetlb_hstate_alloc_return ; } +if (!h->max_huge_pages) +return ; +/* do node specific alloc */ for_each_online_node (i) {if (h->max_huge_pages_node[i] >0 ) {
Greg Kroah-Hartman
maintainerPATCH 145/201 mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit b93af2cc8e036754c0d9970d9ddc47f43cc94b9f upstream.
DAMON's virtual address space operation set implementation (vaddr) calls pte_offset_map_lock() inside the page table walk callback function. This is for reading and writing page table accessed bits. If pte_offset_map_lock() fails, it retries by returning the page table walk callback function with ACTION_AGAIN.
pte_offset_map_lock() can continuously fail if the target is a pmd migration entry, though. Hence it could cause an infinite page table walk if the migration cannot be done until the page table walk is finished. This indeed caused a soft lockup when CPU hotplugging and DAMON were running in parallel.
Avoid the infinite loop by simply not retrying the page table walk. DAMON is promising only a best-effort accuracy, so missing access to such pages is no problem.
--- mm/damon/vaddr.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
mm/damon/vaddr.c +2 -6
@@ -324,10 +324,8 @@ static int damon_mkold_pmd_entry(pmd_t * } pte =pte_offset_map_lock (walk->mm, pmd, addr, &ptl); -if (!pte) { - walk->action =ACTION_AGAIN ; +if (!pte)return 0 ; - }if (!pte_present (ptep_get (pte))) goto out;damon_ptep_mkold (pte, walk->vma, addr);
@@ -479,10 +477,8 @@ regular_page:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */ pte =pte_offset_map_lock (walk->mm, pmd, addr, &ptl); -if (!pte) { - walk->action =ACTION_AGAIN ; +if (!pte)return 0 ; - } ptent =ptep_get (pte);if (!pte_present (ptent)) goto out;
Greg Kroah-Hartman
maintainerPATCH 146/201 NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit ab1c282c010c4f327bd7addc3c0035fd8e3c1721 upstream.
Commit 5304877936c0 ("NFSD: Fix strncpy() fortify warning") replaced strncpy(,, sizeof(..)) with strlcpy(,, sizeof(..) - 1), but strlcpy() already guaranteed NUL-termination of the destination buffer and subtracting one byte potentially truncated the source string.
The incorrect size was then carried over in commit 72f78ae00a8e ("NFSD:
move from strlcpy with unused retval to strscpy") when switching from strlcpy() to strscpy().
Fix this off-by-one error by using the full size of the destination buffer again.
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -1368,7 +1368,7 @@ try_again:return 0 ; }if (work) { -strscpy (work->nsui_ipaddr, ipaddr,sizeof (work->nsui_ipaddr) -1 ); +strscpy (work->nsui_ipaddr, ipaddr,sizeof (work->nsui_ipaddr));refcount_set (&work->nsui_refcnt,2 ); work->nsui_busy = true;list_add_tail (&work->nsui_list, &nn->nfsd_ssc_mount_list);
Greg Kroah-Hartman
maintainerPATCH 147/201 nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit a082e4b4d08a4a0e656d90c2c05da85f23e6d0c9 upstream.
When v3 NLM request finds a conflicting delegation, it triggers a delegation recall and nfsd_open fails with EAGAIN. nfsd_open then translates EAGAIN into nfserr_jukebox. In nlm_fopen, instead of returning nlm_failed for when there is a conflicting delegation, drop this NLM request so that the client retries. Once delegation is recalled and if a local lock is claimed, a retry would lead to nfsd returning a nlm_lck_blocked error or a successful nlm lock.
--- fs/nfsd/lockd.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/nfsd/lockd.c +15 -0
@@ -48,6 +48,21 @@ nlm_fopen(struct svc_rqst *rqstp, structswitch (nfserr) {case nfs_ok:return 0 ; +case nfserr_jukebox: +/* this error can indicate a presence of a conflicting +* delegation to an NLM lock request. Options are: +* (1) For now, drop this request and make the client +* retry. When delegation is returned, client's lock retry +* will complete. +* (2) NLM4_DENIED as per "spec" signals to the client +* that the lock is unavailable now but client can retry. +* Linux client implementation does not. It treats +* NLM4_DENIED same as NLM4_FAILED and errors the request. +* (3) For the future, treat this as blocked lock and try +* to callback when the delegation is returned but might +* not have a proper lock request to block on. +*/ + fallthrough;case nfserr_dropit:return nlm_drop_reply;case nfserr_stale:
Greg Kroah-Hartman
maintainerPATCH 148/201 ext4: verify orphan file size is not too big
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 0a6ce20c156442a4ce2a404747bb0fb05d54eeb3 upstream.
In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan files can lead to big amounts of memory consumed. Limit orphan file size to a sane value and also use kvmalloc() for allocating array of block descriptor structures to avoid large order allocations for sane but large orphan files.
Message-ID: <[email protected]>
--- fs/ext4/orphan.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
fs/ext4/orphan.c +12 -1
@@ -584,9 +584,20 @@ int ext4_init_orphan_info(struct super_bext4_msg (sb,KERN_ERR ,"get orphan inode failed" );return PTR_ERR (inode); } +/* +* This is just an artificial limit to prevent corrupted fs from +* consuming absurd amounts of memory when pinning blocks of orphan +* file in memory. +*/ +if (inode->i_size >8 <<20 ) { +ext4_msg (sb,KERN_ERR ,"orphan file too big: %llu" , + (unsigned long long )inode->i_size); + ret = -EFSCORRUPTED ; + goto out_put; + } oi->of_blocks = inode->i_size >> sb->s_blocksize_bits; oi->of_csum_seed =EXT4_I (inode)->i_csum_seed; - oi->of_binfo =kmalloc_array (oi->of_blocks, + oi->of_binfo =kvmalloc_array (oi->of_blocks,sizeof (struct ext4_orphan_block ),GFP_KERNEL );if (!oi->of_binfo) {
Greg Kroah-Hartman
maintainerPATCH 149/201 ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Sun <[email protected]>
commit 9d80eaa1a1d37539224982b76c9ceeee736510b9 upstream.
After running a stress test combined with fault injection, we performed fsck -a followed by fsck -fn on the filesystem image. During the second pass, fsck -fn reported:
Inode 131512, end of extent exceeds allowed value
(logical block 405, physical block 1180540, len 2)
This inode was not in the orphan list. Analysis revealed the following call chain that leads to the inconsistency:
ext4_da_write_end()
//does not update i_disksize
ext4_punch_hole()
//truncate folio, keep size
ext4_page_mkwrite()
ext4_block_page_mkwrite()
ext4_block_write_begin()
ext4_get_block()
//insert written extent without update i_disksizejournal commit
echo 1 > /sys/block/xxx/device/delete
da-write path updates i_size but does not update i_disksize. Then ext4_punch_hole truncates the da-folio yet still leaves i_disksize unchanged(in the ext4_update_disksize_before_punch function, the condition offset + len < size is met). Then ext4_page_mkwrite sees ext4_nonda_switch return 1 and takes the nodioread_nolock path, the folio about to be written has just been punched out, and it’s offset sits beyond the current i_disksize. This may result in a written extent being inserted, but again does not update i_disksize. If the journal gets committed and then the block device is yanked, we might run into this. It should be noted that replacing ext4_punch_hole with ext4_zero_range in the call sequence may also trigger this issue, as neither will update i_disksize under these circumstances.
To fix this, we can modify ext4_update_disksize_before_punch to increase i_disksize to min(i_size, offset + len) when both i_size and (offset + len) are greater than i_disksize.
Message-ID: <[email protected]>
--- fs/ext4/inode.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/ext4/inode.c +8 -2
@@ -3871,7 +3871,11 @@ int ext4_can_truncate(struct inode *inod* We have to make sure i_disksize gets properly updated before we truncate * page cache due to hole punching or zero range. Otherwise i_disksize update * can get lost as it may have been postponed to submission of writeback but -* that will never happen after we truncate page cache. +* that will never happen if we remove the folio containing i_size from the +* page cache. Also if we punch hole within i_size but above i_disksize, +* following ext4_page_mkwrite() may mistakenly allocate written blocks over +* the hole and thus introduce allocated blocks beyond i_disksize which is +* not allowed (e2fsck would complain in case of crash). */ int ext4_update_disksize_before_punch (struct inode *inode,loff_t offset,loff_t len)
@@ -3882,9 +3886,11 @@ int ext4_update_disksize_before_punch(stloff_t size =i_size_read (inode);WARN_ON (!inode_is_locked (inode)); -if (offset > size || offset + len < size) +if (offset > size)return 0 ; +if (offset + len < size) + size = offset + len;if (EXT4_I (inode)->i_disksize >= size)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 150/201 ext4: correctly handle queries for metadata mappings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
commit 46c22a8bb4cb03211da1100d7ee4a2005bf77c70 upstream.
Currently, our handling of metadata is _ambiguous_ in some scenarios, that is, we end up returning unknown if the range only covers the mapping partially.
For example, in the following case:
$ xfs_io -c fsmap -d
0: 254:16 [0..7]: static fs metadata 8
1: 254:16 [8..15]: special 102:1 8
2: 254:16 [16..5127]: special 102:2 5112
3: 254:16 [5128..5255]: special 102:3 128
4: 254:16 [5256..5383]: special 102:4 128
5: 254:16 [5384..70919]: inodes 65536
6: 254:16 [70920..70967]: unknown 48
...
$ xfs_io -c fsmap -d 24 33
0: 254:16 [24..39]: unknown 16 <--- incomplete reporting
$ xfs_io -c fsmap -d 24 33 (With patch)
0: 254:16 [16..5127]: special 102:2 5112
This is because earlier in ext4_getfsmap_meta_helper, we end up ignoring any extent that starts before our queried range, but overlaps it. While the man page [1] is a bit ambiguous on this, this fix makes the output make more sense since we are anyways returning an "unknown" extent. This is also consistent to how XFS does it:
$ xfs_io -c fsmap -d
...
6: 254:16 [104..127]: free space 24
7: 254:16 [128..191]: inodes 64
...
$ xfs_io -c fsmap -d 137 150
0: 254:16 [128..191]: inodes 64 <-- full extent returned
[1] https://man7.org/linux/man-pages/man2/ioctl_getfsmap.2.html
Message-ID: <023f37e35ee280cd9baac0296cbadcbe10995cab.1757058211.git.ojaswin@linux.ibm.com>
--- fs/ext4/fsmap.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/ext4/fsmap.c +9 -5
@@ -74,7 +74,8 @@ static int ext4_getfsmap_dev_compare(constatic bool ext4_getfsmap_rec_before_low_key (struct ext4_getfsmap_info *info,struct ext4_fsmap *rec) { -return rec->fmr_physical < info->gfi_low.fmr_physical; +return rec->fmr_physical + rec->fmr_length <= + info->gfi_low.fmr_physical; }/*
@@ -200,15 +201,18 @@ static int ext4_getfsmap_meta_helper(str ext4_group_first_block_no(sb, agno)); fs_end = fs_start +EXT4_C2B (sbi, len); -/* Return relevant extents from the meta_list */ +/* +* Return relevant extents from the meta_list. We emit all extents that +* partially/fully overlap with the query range +*/ list_for_each_entry_safe (p, tmp, &info->gfi_meta_list, fmr_list) { -if (p->fmr_physical < info->gfi_next_fsblk) { +if (p->fmr_physical + p->fmr_length <= info->gfi_next_fsblk) {list_del (&p->fmr_list);kfree (p);continue ; } -if (p->fmr_physical <= fs_start || - p->fmr_physical + p->fmr_length <= fs_end) { +if (p->fmr_physical <= fs_end && + p->fmr_physical + p->fmr_length > fs_start) {/* Emit the retained free extent record if present */ if (info->gfi_lastfree.fmr_owner) { error = ext4_getfsmap_helper(sb, info,
Greg Kroah-Hartman
maintainerPATCH 151/201 ext4: fix an off-by-one issue during moving extents
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 12e803c8827d049ae8f2c743ef66ab87ae898375 upstream.
During the movement of a written extent, mext_page_mkuptodate() is called to read data in the range [from, to) into the page cache and to update the corresponding buffers. Therefore, we should not wait on any buffer whose start offset is >= 'to'. Otherwise, it will return -EIO and fail the extents movement.
$ for i in `seq 3 -1 0`; \ do xfs_io -fs -c "pwrite -b 1024 $((i * 1024)) 1024" /mnt/foo; \ done $ umount /mnt && mount /dev/pmem1s /mnt # drop cache $ e4defrag /mnt/foo e4defrag 1.47.0 (5-Feb-2023) ext4 defragmentation for /mnt/foo [1/1]/mnt/foo: 0% [ NG ] Success: [0/1]
Message-ID: <[email protected]>
--- fs/ext4/move_extent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/move_extent.c +1 -1
@@ -225,7 +225,7 @@ static int mext_page_mkuptodate(struct folio *folio, size_t from, size_t to) do { if (bh_offset(bh) + blocksize <= from) continue; - if (bh_offset(bh) > to) + if (bh_offset(bh) >= to) break; wait_on_buffer(bh); if (buffer_uptodate(bh))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 152/201 ext4: guard against EA inode refcount underflow in xattr update
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmet Eray Karadag <[email protected]>
commit 57295e835408d8d425bef58da5253465db3d6888 upstream.
syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:
EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117
Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode().
This prevents the underflow and the follow-on orphan/cleanup churn.
Message-ID: <[email protected]>
--- fs/ext4/xattr.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
fs/ext4/xattr.c +8 -7
@@ -1036,7 +1036,7 @@ static int ext4_xattr_inode_update_ref(h int ref_change) {struct ext4_iloc iloc; -s64 ref_count; +u64 ref_count;int ret;inode_lock_nested (ea_inode,I_MUTEX_XATTR );
@@ -1046,13 +1046,17 @@ static int ext4_xattr_inode_update_ref(h goto out; ref_count =ext4_xattr_inode_get_ref (ea_inode); +if ((ref_count ==0 && ref_change <0 ) || (ref_count ==U64_MAX && ref_change >0 )) { +ext4_error_inode (ea_inode, __func__, __LINE__,0 , +"EA inode %lu ref wraparound: ref_count=%lld ref_change=%d" , + ea_inode->i_ino, ref_count, ref_change); + ret = -EFSCORRUPTED ; + goto out; + } ref_count += ref_change;ext4_xattr_inode_set_ref (ea_inode, ref_count);if (ref_change >0 ) { -WARN_ONCE (ref_count <=0 ,"EA inode %lu ref_count=%lld" , - ea_inode->i_ino, ref_count); -if (ref_count ==1 ) {WARN_ONCE (ea_inode->i_nlink,"EA inode %lu i_nlink=%u" , ea_inode->i_ino, ea_inode->i_nlink);
@@ -1061,9 +1065,6 @@ static int ext4_xattr_inode_update_ref(hext4_orphan_del (handle, ea_inode); } }else { -WARN_ONCE (ref_count <0 ,"EA inode %lu ref_count=%lld" , - ea_inode->i_ino, ref_count); -if (ref_count ==0 ) { WARN_ONCE(ea_inode->i_nlink != 1, "EA inode %lu i_nlink=%u",
Greg Kroah-Hartman
maintainerPATCH 153/201 ext4: validate ea_ino and size in check_xattrs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 44d2a72f4d64655f906ba47a5e108733f59e6f28 upstream.
During xattr block validation, check_xattrs() processes xattr entries without validating that entries claiming to use EA inodes have non-zero sizes. Corrupted filesystems may contain xattr entries where e_value_size is zero but e_value_inum is non-zero, indicating invalid xattr data.
Add validation in check_xattrs() to detect this corruption pattern early and return -EFSCORRUPTED, preventing invalid xattr entries from causing issues throughout the ext4 codebase.
Message-ID: <[email protected]>
--- fs/ext4/xattr.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/xattr.c +4 -0
@@ -251,6 +251,10 @@ check_xattrs(struct inode *inode, struct err_str ="invalid ea_ino" ; goto errout; } +if (ea_ino && !size) { + err_str ="invalid size in ea xattr" ; + goto errout; + }if (size >EXT4_XATTR_SIZE_MAX ) { err_str ="e_value size too large" ; goto errout;
Greg Kroah-Hartman
maintainerPATCH 154/201 ACPICA: Allow to skip Global Lock initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit feb8ae81b2378b75a99c81d315602ac8918ed382 upstream.
Introduce acpi_gbl_use_global_lock, which allows to skip the Global Lock initialization. This is useful for systems without Global Lock (such as loong_arch), so as to avoid error messages during boot phase:
ACPI Error: Could not enable global_lock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
--- drivers/acpi/acpica/evglock.c | 4 ++++ include/acpi/acpixf.h | 6 ++++++ 2 files changed, 10 insertions(+)
drivers/acpi/acpica/evglock.c +4 -0
@@ -42,6 +42,10 @@ acpi_status acpi_ev_init_global_lock_hanreturn_ACPI_STATUS (AE_OK ); } +if (!acpi_gbl_use_global_lock) { +return_ACPI_STATUS (AE_OK ); + } +/* Attempt installation of the global lock handler */ status = acpi_install_fixed_event_handler(ACPI_EVENT_GLOBAL,
include/acpi/acpixf.h +6 -0
@@ -214,6 +214,12 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_osi_data,ACPI_INIT_GLOBAL (u8, acpi_gbl_reduced_hardware, FALSE);/* +* ACPI Global Lock is mainly used for systems with SMM, so no-SMM systems +* (such as loong_arch) may not have and not use Global Lock. +*/ +ACPI_INIT_GLOBAL (u8, acpi_gbl_use_global_lock, TRUE); + +/* * Maximum timeout for While() loop iterations before forced method abort. * This mechanism is intended to prevent infinite loops during interpreter * execution within a host kernel.
Greg Kroah-Hartman
maintainerPATCH 155/201 ext4: free orphan info with kvfree
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 971843c511c3c2f6eda96c6b03442913bfee6148 upstream.
Orphan info is now getting allocated with kvmalloc_array(). Free it with kvfree() instead of kfree() to avoid complaints from mm.
Message-ID: <[email protected]>
--- fs/ext4/orphan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/orphan.c +2 -2
@@ -513,7 +513,7 @@ void ext4_release_orphan_info(struct supreturn ;for (i =0 ; i < oi->of_blocks; i++)brelse (oi->of_binfo[i].ob_bh); -kfree (oi->of_binfo); +kvfree (oi->of_binfo); } static struct ext4_orphan_block_tail *ext4_orphan_block_tail(
@@ -638,7 +638,7 @@ int ext4_init_orphan_info(struct super_b out_free:for (i--; i >=0 ; i--)brelse (oi->of_binfo[i].ob_bh); -kfree (oi->of_binfo); +kvfree (oi->of_binfo); out_put:iput (inode);return ret;
Greg Kroah-Hartman
maintainerPATCH 156/201 lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 2f13daee2a72bb962f5fd356c3a263a6f16da965 upstream.
After commit 6f110a5e4f99 ("Disable SLUB_TINY for build testing"), which causes CONFIG_KASAN to be enabled in allmodconfig again, arm64 allmodconfig builds with clang-17 and older show an instance of -Wframe-larger-than (which breaks the build with CONFIG_WERROR=y):
lib/crypto/curve25519-hacl64.c:757:6: error: stack frame size (2336) exceeds limit (2048) in 'curve25519_generic' [-Werror,-Wframe-larger-than]
757 | void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE],
| ^When KASAN is disabled, the stack usage is roughly quartered:
lib/crypto/curve25519-hacl64.c:757:6: error: stack frame size (608) exceeds limit (128) in 'curve25519_generic' [-Werror,-Wframe-larger-than]
757 | void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE],
| ^Using '-Rpass-analysis=stack-frame-layout' shows the following variables and many, many 8-byte spills when KASAN is enabled:
Offset: [SP-144], Type: Variable, Align: 8, Size: 40
Offset: [SP-464], Type: Variable, Align: 8, Size: 320
Offset: [SP-784], Type: Variable, Align: 8, Size: 320
Offset: [SP-864], Type: Variable, Align: 32, Size: 80
Offset: [SP-896], Type: Variable, Align: 32, Size: 32
Offset: [SP-1016], Type: Variable, Align: 8, Size: 120
When KASAN is disabled, there are still spills but not at many and the variables list is smaller:
Offset: [SP-192], Type: Variable, Align: 32, Size: 80
Offset: [SP-224], Type: Variable, Align: 32, Size: 32
Offset: [SP-344], Type: Variable, Align: 8, Size: 120
Disable KASAN for this file when using clang-17 or older to avoid blowing out the stack, clearing up the warning.
--- lib/crypto/Makefile | 4 ++++ 1 file changed, 4 insertions(+)
lib/crypto/Makefile +4 -0
@@ -30,6 +30,10 @@ obj-$(CONFIG_CRYPTO_LIB_CURVE25519_GENER libcurve25519-generic-y := curve25519-fiat32.o libcurve25519-generic-$(CONFIG_ARCH_SUPPORTS_INT128) := curve25519-hacl64.o libcurve25519-generic-y += curve25519-generic.o +# clang versions prior to 18 may blow out the stack with KASAN +ifeq ($(call clang-min-version, 180000),) +KASAN_SANITIZE_curve25519-hacl64.o := n +endif obj-$(CONFIG_CRYPTO_LIB_CURVE25519) += libcurve25519.o libcurve25519-y += curve25519.o
Greg Kroah-Hartman
maintainerPATCH 157/201 Squashfs: add additional inode sanity checking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 9ee94bfbe930a1b39df53fa2d7b31141b780eb5a ]
Patch series "Squashfs: performance improvement and a sanity check".
This patchset adds an additional sanity check when reading regular file inodes, and adds support for SEEK_DATA/SEEK_HOLE lseek() whence values.
This patch (of 2):
Add an additional sanity check when reading regular file inodes.
A regular file if the file size is an exact multiple of the filesystem block size cannot have a fragment. This is because by definition a fragment block stores tailends which are not a whole block in size.
Stable-dep-of: 9f1c14c1de1b ("Squashfs: reject negative file sizes in squashfs_read_inode()")
--- fs/squashfs/inode.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
fs/squashfs/inode.c +18 -2
@@ -140,8 +140,17 @@ int squashfs_read_inode(struct inode *inif (err <0 ) goto failed_read; + inode->i_size =le32_to_cpu (sqsh_ino->file_size); frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) { +/* +* the file cannot have a fragment (tailend) and have a +* file size a multiple of the block size +*/ +if ((inode->i_size & (msblk->block_size -1 )) ==0 ) { + err = -EINVAL ; + goto failed_read; + } frag_offset =le32_to_cpu (sqsh_ino->offset); frag_size =squashfs_frag_lookup (sb, frag, &frag_blk);if (frag_size <0 ) {
@@ -155,7 +164,6 @@ int squashfs_read_inode(struct inode *in }set_nlink (inode,1 ); - inode->i_size =le32_to_cpu (sqsh_ino->file_size); inode->i_fop = &generic_ro_fops; inode->i_mode |=S_IFREG ; inode->i_blocks = ((inode->i_size -1 ) >>9 ) +1 ;
@@ -184,8 +192,17 @@ int squashfs_read_inode(struct inode *inif (err <0 ) goto failed_read; + inode->i_size =le64_to_cpu (sqsh_ino->file_size); frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) { +/* +* the file cannot have a fragment (tailend) and have a +* file size a multiple of the block size +*/ +if ((inode->i_size & (msblk->block_size -1 )) ==0 ) { + err = -EINVAL ; + goto failed_read; + } frag_offset =le32_to_cpu (sqsh_ino->offset); frag_size =squashfs_frag_lookup (sb, frag, &frag_blk);if (frag_size <0 ) {
@@ -200,7 +217,6 @@ int squashfs_read_inode(struct inode *in xattr_id =le32_to_cpu (sqsh_ino->xattr);set_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); - inode->i_size =le64_to_cpu (sqsh_ino->file_size); inode->i_op = &squashfs_inode_ops; inode->i_fop = &generic_ro_fops; inode->i_mode |=S_IFREG ;
Greg Kroah-Hartman
maintainerPATCH 158/201 Squashfs: reject negative file sizes in squashfs_read_inode()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b ]
Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.
This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.
This commit checks for a negative file size and returns EINVAL.
--- fs/squashfs/inode.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/squashfs/inode.c +4 -0
@@ -193,6 +193,10 @@ int squashfs_read_inode(struct inode *in goto failed_read; inode->i_size =le64_to_cpu (sqsh_ino->file_size); +if (inode->i_size <0 ) { + err = -EINVAL ; + goto failed_read; + } frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) {/*
Greg Kroah-Hartman
maintainerPATCH 159/201 media: mc: Clear minor number before put device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 8cfc8cec1b4da88a47c243a11f384baefd092a50 ]
The device minor should not be cleared after the device is released.
--- drivers/media/mc/mc-devnode.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/media/mc/mc-devnode.c +1 -5
@@ -50,11 +50,6 @@ static void media_devnode_release(struct {struct media_devnode *devnode =to_media_devnode (cd); -mutex_lock (&media_devnode_lock); -/* Mark device node number as free */ -clear_bit (devnode->minor, media_devnode_nums); -mutex_unlock (&media_devnode_lock); -/* Release media_devnode and perform other cleanups as needed. */ if (devnode->release) devnode->release (devnode);
@@ -283,6 +278,7 @@ void media_devnode_unregister(struct med/* Delete the cdev on this minor as well */ cdev_device_del (&devnode->cdev, &devnode->dev); devnode->media_dev =NULL ; +clear_bit (devnode->minor, media_devnode_nums);mutex_unlock (&media_devnode_lock);put_device (&devnode->dev);