6.12.54-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.12.54-rc1 review
This is the start of the stable review cycle for the 6.12.54 release. There are 277 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 19 Oct 2025 14:50:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.54-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.54-rc1
Kai Vehmanen <[email protected]>
ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
Olga Kornievskaia <[email protected]>
nfsd: fix access checking for NLM under XPRTSEC policies
Olga Kornievskaia <[email protected]>
nfsd: fix __fh_verify for localio
Ian Rogers <[email protected]>
perf test stat: Avoid hybrid assumption when virtualized
K Prateek Nayak <[email protected]>
sched/fair: Block delayed tasks on throttled hierarchy during dequeue
Jan Kara <[email protected]>
writeback: Avoid excessively long inode switching times
Jan Kara <[email protected]>
writeback: Avoid softlockup when switching many inodes
Tetsuo Handa <[email protected]>
cramfs: Verify inode mode when loading from disk
Lichen Liu <[email protected]>
fs: Add 'initramfs_options' to set initramfs mount options
Oleg Nesterov <[email protected]>
pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers
gaoxiang17 <[email protected]>
pid: Add a judgment for ns null in pid_nr_ns
Tetsuo Handa <[email protected]>
minixfs: Verify inode mode when loading from disk
Miklos Szeredi <[email protected]>
copy_file_range: limit size if in compat mode
Lucas Zampieri <[email protected]>
irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
Hongbo Li <[email protected]>
irqchip/sifive-plic: Make use of __assign_bit()
Ilya Leoshkevich <[email protected]>
s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
Ilya Leoshkevich <[email protected]>
s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
Ilya Leoshkevich <[email protected]>
s390/bpf: Describe the frame using a struct instead of constants
Ilya Leoshkevich <[email protected]>
s390/bpf: Centralize frame offset calculations
Lance Yang <[email protected]>
mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage
Guenter Roeck <[email protected]>
ipmi: Fix handling of messages with provided receive message pointer
Corey Minyard <[email protected]>
ipmi: Rework user message limit handling
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: usable client side with C-flag
Rafael J. Wysocki <[email protected]>
ACPI: property: Do not pass NULL handles to acpi_attach_data()
Rafael J. Wysocki <[email protected]>
ACPI: property: Add code comments explaining what is going on
Rafael J. Wysocki <[email protected]>
ACPI: property: Disregard references in data-only subnode lists
Rafael J. Wysocki <[email protected]>
ACPI: battery: Add synchronization between interface updates
Andy Shevchenko <[email protected]>
ACPI: battery: Check for error code from devm_mutex_init() call
Thomas Weißschuh <[email protected]>
ACPI: battery: initialize mutexes through devm_ APIs
Thomas Weißschuh <[email protected]>
ACPI: battery: allocate driver data through devm_ APIs
Olga Kornievskaia <[email protected]>
nfsd: unregister with rpcbind when deleting a transport
NeilBrown <[email protected]>
nfsd: don't use sv_nrthreads in connection limiting calculations.
NeilBrown <[email protected]>
nfsd: refine and rename NFSD_MAY_LOCK
Chuck Lever <[email protected]>
NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
Pali Rohár <[email protected]>
nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
Sean Christopherson <[email protected]>
x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
Kirill A. Shutemov <[email protected]>
x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
Catalin Marinas <[email protected]>
arm64: mte: Do not flag the zero page as PG_mte_tagged
Christian Brauner <[email protected]>
statmount: don't call path_put() under namespace semaphore
Borislav Petkov (AMD) <[email protected]>
KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
Rafael J. Wysocki <[email protected]>
cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
Qu Wenruo <[email protected]>
btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
Kai Vehmanen <[email protected]>
ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
Shin'ichiro Kawasaki <[email protected]>
PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
Wang Jiang <[email protected]>
PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
Donet Tom <[email protected]>
mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
Yuan Chen <[email protected]>
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
Phillip Lougher <[email protected]>
Squashfs: reject negative file sizes in squashfs_read_inode()
Phillip Lougher <[email protected]>
Squashfs: add additional inode sanity checking
Edward Adam Davis <[email protected]>
media: mc: Clear minor number before put device
Lance Yang <[email protected]>
selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
Nathan Chancellor <[email protected]>
lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
Jan Kara <[email protected]>
ext4: free orphan info with kvfree
Huacai Chen <[email protected]>
ACPICA: Allow to skip Global Lock initialization
Deepanshu Kartikey <[email protected]>
ext4: validate ea_ino and size in check_xattrs
Ahmet Eray Karadag <[email protected]>
ext4: guard against EA inode refcount underflow in xattr update
Zhang Yi <[email protected]>
ext4: fix an off-by-one issue during moving extents
Theodore Ts'o <[email protected]>
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
Ojaswin Mujoo <[email protected]>
ext4: correctly handle queries for metadata mappings
Yongjian Sun <[email protected]>
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
Jan Kara <[email protected]>
ext4: verify orphan file size is not too big
Baokun Li <[email protected]>
ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
Olga Kornievskaia <[email protected]>
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
Thorsten Blum <[email protected]>
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
SeongJae Park <[email protected]>
mm/damon/lru_sort: use param_ctx for damon_attrs staging
SeongJae Park <[email protected]>
mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
Li RongQing <[email protected]>
mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
Thadeu Lima de Souza Cascardo <[email protected]>
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
Lance Yang <[email protected]>
mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
Nick Morrow <[email protected]>
wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
Nick Morrow <[email protected]>
wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
Muhammad Usama Anjum <[email protected]>
wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
Suren Baghdasaryan <[email protected]>
slab: mark slab->obj_exts allocation failures unconditionally
Suren Baghdasaryan <[email protected]>
slab: prevent warnings when slab obj_exts vector allocation fails
Heiko Carstens <[email protected]>
s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
Jaehoon Kim <[email protected]>
s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
Jaehoon Kim <[email protected]>
s390/dasd: enforce dma_alignment to ensure proper buffer validation
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate C-flag + def limit
Sean Christopherson <[email protected]>
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
Sean Christopherson <[email protected]>
x86/umip: Check that the instruction opcode is at least two bytes
Xin Li (Intel) <[email protected]>
x86/fred: Remove ENDBR64 from FRED entry points
Santhosh Kumar K <[email protected]>
spi: cadence-quadspi: Fix cqspi_setup_flash()
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before DAC access
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before INDAC access
Niklas Cassel <[email protected]>
PCI: tegra194: Reset BARs when running in PCIe endpoint mode
Vidya Sagar <[email protected]>
PCI: tegra194: Handle errors in BPMP response
Niklas Cassel <[email protected]>
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
Marek Vasut <[email protected]>
PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
Marek Vasut <[email protected]>
PCI: rcar-host: Drop PMSR spinlock
Marek Vasut <[email protected]>
PCI: rcar-gen4: Fix PHY initialization
Siddharth Vadapalli <[email protected]>
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
Siddharth Vadapalli <[email protected]>
PCI: j721e: Fix programming sequence of "strap" settings
Lukas Wunner <[email protected]>
PCI/AER: Support errors introduced by PCIe r6.0
Niklas Schnelle <[email protected]>
PCI/AER: Fix missing uevent on recovery when a reset is requested
Lukas Wunner <[email protected]>
PCI/ERR: Fix uevent on failure to recover
Niklas Schnelle <[email protected]>
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
Brian Norris <[email protected]>
PCI/sysfs: Ensure devices are powered for config reads
Marek Vasut <[email protected]>
PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
Jani Nurminen <[email protected]>
PCI: xilinx-nwl: Fix ECAM programming
Sean Christopherson <[email protected]>
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
Esben Haabendal <[email protected]>
rtc: interface: Fix long-standing race when setting alarm
Esben Haabendal <[email protected]>
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
Zhen Ni <[email protected]>
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
Rex Chen <[email protected]>
mmc: mmc_spi: multiple block read remove read crc ack
Rex Chen <[email protected]>
mmc: core: SPI mode remove cmd7
Linus Walleij <[email protected]>
mtd: rawnand: fsmc: Default to autodetect buswidth
Alexander Lobakin <[email protected]>
xsk: Harden userspace-supplied xdp_desc validation
Miaoqian Lin <[email protected]>
xtensa: simdisk: add input size check in proc_write_simdisk
Ma Ke <[email protected]>
sparc: fix error handling in scan_one_device()
Anthony Yznaga <[email protected]>
sparc64: fix hugetlb for sun4u
Eric Biggers <[email protected]>
sctp: Fix MAC comparison to be constant-time
Abinash Singh <[email protected]>
scsi: sd: Fix build warning in sd_revalidate_disk()
Thorsten Blum <[email protected]>
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
Harshit Agarwal <[email protected]>
sched/deadline: Fix race in push_dl_task()
Corey Minyard <[email protected]>
Revert "ipmi: fix msg stack when IPMI is disconnected"
Jisheng Zhang <[email protected]>
pwm: berlin: Fix wrong register in suspend/resume
Nam Cao <[email protected]>
powerpc/pseries/msi: Fix potential underflow and leak issue
Nam Cao <[email protected]>
powerpc/powernv/pci: Fix underflow and leak issue
Dzmitry Sankouski <[email protected]>
power: supply: max77976_charger: fix constant current reporting
Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: Drop unused S3C24xx driver data
Georg Gottleuber <[email protected]>
nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
John David Anglin <[email protected]>
parisc: Remove spurious if statement from raw_copy_from_user()
Sam James <[email protected]>
parisc: don't reference obsolete termio struct for TC* constants
Askar Safin <[email protected]>
openat2: don't trigger automounts with RESOLVE_NO_XDEV
Ma Ke <[email protected]>
of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
Li Chen <[email protected]>
loop: fix backing file reference leak on validation error
Johan Hovold <[email protected]>
lib/genalloc: fix device leak in of_gen_pool_get()
Eric Biggers <[email protected]>
KEYS: trusted_tpm1: Compare HMAC values in constant time
Oleg Nesterov <[email protected]>
kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
Lu Baolu <[email protected]>
iommu/vt-d: PRS isn't usable if PDS isn't supported
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
Huacai Chen <[email protected]>
init: handle bootloader identifier in kernel parameters
Sean Anderson <[email protected]>
iio: xilinx-ams: Unmask interrupts after updating alarms
Sean Anderson <[email protected]>
iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix prescaler usage.
Qianfeng Rong <[email protected]>
iio: dac: ad5421: use int type to store negative error codes
Qianfeng Rong <[email protected]>
iio: dac: ad5360: use int type to store negative error codes
Aleksandar Gerasimovski <[email protected]>
iio/adc/pac1934: fix channel disable configuration
Darrick J. Wong <[email protected]>
fuse: fix livelock in synchronous file put from fuseblk workers
Miklos Szeredi <[email protected]>
fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
Shashank A P <[email protected]>
fs: quota: create dedicated workqueue for quota_release_work
Haoxiang Li <[email protected]>
fs/ntfs3: Fix a resource leak bug in wnd_extend()
Finn Thain <[email protected]>
fbdev: Fix logic error in "offb" name match
Nam Cao <[email protected]>
eventpoll: Replace rwlock with spinlock
Thomas Fourier <[email protected]>
crypto: rockchip - Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
crypto: atmel - Fix dma_unmap_sg() direction
Thomas Fourier <[email protected]>
crypto: aspeed - Fix dma_unmap_sg() direction
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Simon Schuster <[email protected]>
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
Abel Vesa <[email protected]>
clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk
Adam Xue <[email protected]>
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
Sumit Kumar <[email protected]>
bus: mhi: ep: Fix chained transfer handling in read path
Anderson Nascimento <[email protected]>
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
Yu Kuai <[email protected]>
blk-crypto: fix missing blktrace bio split events
Fangzhi Zuo <[email protected]>
drm/amd/display: Enable Dynamic DTBCLK Switch
Matthew Auld <[email protected]>
drm/xe/uapi: loosen used tracking restriction
Shuhao Fu <[email protected]>
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
Marek Vasut <[email protected]>
drm/rcar-du: dsi: Fix 1/2/3 lane support
Jann Horn <[email protected]>
drm/panthor: Fix memory leak in panthor_ioctl_group_create()
Ma Ke <[email protected]>
media: lirc: Fix error handling in lirc_register()
Jai Luthra <[email protected]>
media: ti: j721e-csi2rx: Fix source subdev link creation
Jai Luthra <[email protected]>
media: ti: j721e-csi2rx: Use devm_of_platform_populate
Hans Verkuil <[email protected]>
media: vivid: fix disappearing <Vendor Command With ID> messages
Stephan Gerhold <[email protected]>
media: venus: firmware: Use correct reset sequence for IRIS2
Arnd Bergmann <[email protected]>
media: s5p-mfc: remove an unused/uninitialized variable
David Lechner <[email protected]>
media: pci: mg4b: fix uninitialized iio scan data
Thomas Fourier <[email protected]>
media: pci: ivtv: Add missing check after DMA map
Laurent Pinchart <[email protected]>
media: mc: Fix MUST_CONNECT handling for pads with no links
Qianfeng Rong <[email protected]>
media: i2c: mt9v111: fix incorrect type for ret
Thomas Fourier <[email protected]>
media: cx18: Add missing check after DMA map
Randy Dunlap <[email protected]>
media: cec: extron-da-hd-4k-plus: drop external-module make commands
Johan Hovold <[email protected]>
firmware: meson_sm: fix device leak at probe
Jason Andryuk <[email protected]>
xen/events: Update virq_to_irq on migration
Jason Andryuk <[email protected]>
xen/events: Return -EEXIST for bound VIRQs
Lukas Wunner <[email protected]>
xen/manage: Fix suspend error path
Jason Andryuk <[email protected]>
xen/events: Cleanup find_virq() return codes
Michael Riesch <[email protected]>
dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
Robin Murphy <[email protected]>
perf/arm-cmn: Fix CMN S3 DTM offset
Miaoqian Lin <[email protected]>
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
Alexander Sverdlin <[email protected]>
ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset)
Yang Shi <[email protected]>
arm64: kprobes: call set_memory_rox() for kprobe page
Vibhore Vardhan <[email protected]>
arm64: dts: ti: k3-am62a-main: Fix main padcfg length
Aleksandrs Vinarskis <[email protected]>
arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default
Stephan Gerhold <[email protected]>
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8939: Add missing MDSS reset
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Add missing MDSS reset
Amir Mohammad Jahangirzad <[email protected]>
ACPI: debug: fix signedness issues in read/write helpers
Daniel Tang <[email protected]>
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
Rafael J. Wysocki <[email protected]>
ACPI: property: Fix buffer properties extraction for subnodes
Nathan Chancellor <[email protected]>
s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
Alexey Gladkov <[email protected]>
s390: vmlinux.lds.S: Reorder sections
KaFai Wan <[email protected]>
bpf: Avoid RCU context warning when unpinning htab with internal structs
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: mark the GPIO controller as sleeping
Gunnar Kudrjavets <[email protected]>
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
Pali Rohár <[email protected]>
cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
Paulo Alcantara <[email protected]>
smb: client: fix missing timestamp updates after utime(2)
Fushuai Wang <[email protected]>
cifs: Fix copy_to_iter return value check
Herbert Xu <[email protected]>
crypto: essiv - Check ssize for decryption and in-place encryption
Florian Westphal <[email protected]>
selftests: netfilter: query conntrack state to check for port clash resolution
Eric Woudstra <[email protected]>
bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_objref: validate objref and objrefmap expressions
Timur Kristóf <[email protected]>
drm/amd/display: Properly disable scaling on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
Alex Deucher <[email protected]>
drm/amdgpu: Add additional DCE6 SCL registers
Jason-JH Lin <[email protected]>
mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
Sakari Ailus <[email protected]>
mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
Sakari Ailus <[email protected]>
mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend()
Daniel Borkmann <[email protected]>
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}Harini T <[email protected]>
mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
Harini T <[email protected]>
mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
Eric Dumazet <[email protected]>
tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
Leo Yan <[email protected]>
perf python: split Clang options when invoking Popen
Leo Yan <[email protected]>
tools build: Align warning options with perf
Erick Karanja <[email protected]>
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Haotian Zhang <[email protected]>
ice: ice_adapter: release xa entry on adapter allocation failure
Duoming Zhou <[email protected]>
net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
Kuniyuki Iwashima <[email protected]>
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Alexandr Sapozhnikov <[email protected]>
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix copy-paste typo in validation
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Use-after-free in validation
Zack Rusin <[email protected]>
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Vineeth Vijayan <[email protected]>
s390/cio: Update purge function to unregister the unused subchannels
Shuicheng Lin <[email protected]>
drm/xe/hw_engine_group: Fix double write lock release in error path
Dan Carpenter <[email protected]>
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
Huacai Chen <[email protected]>
LoongArch: Init acpi_gbl_use_global_lock to false
Tiezhu Yang <[email protected]>
LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
Duoming Zhou <[email protected]>
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
Aaron Kling <[email protected]>
cpufreq: tegra186: Set target frequency for all cpus in policy
Fedor Pchelkin <[email protected]>
clk: tegra: do not overallocate memory for bpmp clocks
Alok Tiwari <[email protected]>
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
Brian Masney <[email protected]>
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
Chen-Yu Tsai <[email protected]>
clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
AngeloGioacchino Del Regno <[email protected]>
clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
Ian Rogers <[email protected]>
perf evsel: Ensure the fallback message is always written to
Namhyung Kim <[email protected]>
perf tools: Add fallback for exclude_guest
James Clark <[email protected]>
perf test: Add a test for default perf stat command
Ian Rogers <[email protected]>
perf test: Don't leak workload gopipe in PERF_RECORD_*
Leo Yan <[email protected]>
perf session: Fix handling when buffer exceeds 2 GiB
Ian Rogers <[email protected]>
perf test shell lbr: Avoid failures with perf event paranoia
Namhyung Kim <[email protected]>
perf test: Update sysfs path for core PMU caps
Ilkka Koskinen <[email protected]>
perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches
Leo Yan <[email protected]>
perf arm_spe: Correct memory level for remote access
Leo Yan <[email protected]>
perf arm-spe: Rename the common data source encoding
Leo Yan <[email protected]>
perf arm_spe: Correct setting remote access
Clément Le Goffic <[email protected]>
rtc: optee: fix memory leak on driver removal
Rob Herring (Arm) <[email protected]>
rtc: x1205: Fix Xicor X1205 vendor prefix
Yunseong Kim <[email protected]>
perf util: Fix compression checks returning -1 as bool
Yuan CHen <[email protected]>
clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init()
Brian Masney <[email protected]>
clk: at91: peripheral: fix return value
Dan Carpenter <[email protected]>
clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register()
Ian Rogers <[email protected]>
libperf event: Ensure tracing data is multiple of 8 sized
Ian Rogers <[email protected]>
perf evsel: Avoid container_of on a NULL leader
Ian Rogers <[email protected]>
perf test trace_btf_enum: Skip if permissions are insufficient
Ian Rogers <[email protected]>
perf disasm: Avoid undefined behavior in incrementing NULL
Varad Gautam <[email protected]>
asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
Tomi Valkeinen <[email protected]>
media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
Sean Christopherson <[email protected]>
KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
Petr Tesarik <[email protected]>
dma-mapping: fix direction in dma_alloc direction traces
Toke Høiland-Jørgensen <[email protected]>
page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
Zhen Ni <[email protected]>
clocksource/drivers/clps711x: Fix resource leaks in error paths
Christian Brauner <[email protected]>
listmount: don't call path_put() under namespace semaphore
Thomas Gleixner <[email protected]>
rseq: Protect event mask against membarrier IPI
Omar Sandoval <[email protected]>
arm64: map [_text, _stext) virtual address range non-executable+read-only
Aleksa Sarai <[email protected]>
fscontext: do not consume log entries when returning -EMSGSIZE
Thomas Weißschuh <[email protected]>
fs: always return zero on success from replace_fd()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + .../bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +- Makefile | 4 +- arch/arm/mach-omap2/am33xx-restart.c | 36 ++ arch/arm/mach-omap2/pm33xx-core.c | 6 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 + arch/arm64/boot/dts/qcom/msm8939.dtsi | 2 + arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 +- arch/arm64/boot/dts/qcom/x1e80100-pmics.dtsi | 2 + arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 2 +- arch/arm64/kernel/cpufeature.c | 10 +- arch/arm64/kernel/mte.c | 3 +- arch/arm64/kernel/pi/map_kernel.c | 6 + arch/arm64/kernel/probes/kprobes.c | 12 + arch/arm64/kernel/setup.c | 4 +- arch/arm64/mm/init.c | 2 +- arch/arm64/mm/mmu.c | 14 +- arch/loongarch/Makefile | 2 +- arch/loongarch/kernel/setup.c | 1 + arch/parisc/include/uapi/asm/ioctls.h | 8 +- arch/parisc/lib/memcpy.c | 1 - arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- arch/powerpc/platforms/pseries/msi.c | 2 +- arch/s390/Makefile | 1 + arch/s390/kernel/vmlinux.lds.S | 54 +-- arch/s390/net/bpf_jit.h | 55 --- arch/s390/net/bpf_jit_comp.c | 139 ++++--- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + arch/sparc/mm/hugetlbpage.c | 20 + arch/x86/entry/entry_64_fred.S | 2 +- arch/x86/hyperv/ivm.c | 2 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/mtrr.h | 10 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- arch/x86/kernel/kvm.c | 21 +- arch/x86/kernel/umip.c | 15 +- arch/x86/kvm/cpuid.c | 2 +- arch/x86/kvm/pmu.c | 5 + arch/x86/kvm/svm/pmu.c | 1 + arch/x86/kvm/x86.c | 2 + arch/x86/xen/enlighten_pv.c | 4 +- arch/xtensa/platforms/iss/simdisk.c | 6 +- block/blk-crypto-fallback.c | 3 + crypto/essiv.c | 14 +- drivers/acpi/acpi_dbg.c | 26 +- drivers/acpi/acpi_tad.c | 3 + drivers/acpi/acpica/evglock.c | 4 + drivers/acpi/battery.c | 60 +-- drivers/acpi/property.c | 139 ++++--- drivers/block/loop.c | 8 +- drivers/bus/mhi/ep/main.c | 37 +- drivers/bus/mhi/host/init.c | 5 +- drivers/char/ipmi/ipmi_kcs_sm.c | 16 +- drivers/char/ipmi/ipmi_msghandler.c | 422 ++++++++++----------- drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/clk/at91/clk-peripheral.c | 7 +- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- drivers/clk/mediatek/clk-mux.c | 4 +- drivers/clk/nxp/clk-lpc18xx-cgu.c | 20 +- drivers/clk/qcom/common.c | 4 +- drivers/clk/qcom/tcsrcc-x1e80100.c | 4 + drivers/clk/renesas/renesas-cpg-mssr.c | 7 +- drivers/clk/tegra/clk-bpmp.c | 2 +- drivers/clocksource/clps711x-timer.c | 23 +- drivers/cpufreq/cpufreq-dt.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 2 +- drivers/cpufreq/intel_pstate.c | 8 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/cpufreq/scmi-cpufreq.c | 2 +- drivers/cpufreq/scpi-cpufreq.c | 2 +- drivers/cpufreq/spear-cpufreq.c | 2 +- drivers/cpufreq/tegra186-cpufreq.c | 8 +- drivers/crypto/aspeed/aspeed-hace-crypto.c | 2 +- drivers/crypto/atmel-tdes.c | 2 +- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 2 +- drivers/firmware/meson/meson_sm.c | 7 +- drivers/gpio/gpio-wcd934x.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 21 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 4 + .../gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 + .../drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/panthor/panthor_drv.c | 11 +- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 5 +- .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 +- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +- drivers/gpu/drm/xe/xe_query.c | 15 +- drivers/iio/adc/pac1934.c | 20 +- drivers/iio/adc/xilinx-ams.c | 47 ++- drivers/iio/dac/ad5360.c | 2 +- drivers/iio/dac/ad5421.c | 2 +- drivers/iio/frequency/adf4350.c | 20 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 - drivers/iommu/intel/iommu.c | 2 +- drivers/irqchip/irq-sifive-plic.c | 13 +- drivers/mailbox/mtk-cmdq-mailbox.c | 12 +- drivers/mailbox/zynqmp-ipi-mailbox.c | 24 +- .../media/cec/usb/extron-da-hd-4k-plus/Makefile | 6 - drivers/media/i2c/mt9v111.c | 2 +- drivers/media/mc/mc-devnode.c | 6 +- drivers/media/mc/mc-entity.c | 2 +- drivers/media/pci/cx18/cx18-queue.c | 13 +- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-yuv.c | 8 +- drivers/media/pci/mgb4/mgb4_trigger.c | 2 +- drivers/media/platform/qcom/venus/firmware.c | 8 +- .../platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c | 35 +- .../media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 9 +- drivers/media/rc/lirc_dev.c | 9 +- drivers/media/test-drivers/vivid/vivid-cec.c | 12 +- drivers/memory/samsung/exynos-srom.c | 10 +- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 5 +- drivers/mmc/core/sdio.c | 6 +- drivers/mmc/host/mmc_spi.c | 2 +- drivers/mtd/nand/raw/fsmc_nand.c | 6 +- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 + drivers/net/ethernet/intel/ice/ice_adapter.c | 10 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- drivers/net/ethernet/mscc/ocelot_stats.c | 2 +- drivers/net/wireless/ath/ath11k/core.c | 6 +- drivers/net/wireless/ath/ath11k/hal.c | 16 + drivers/net/wireless/ath/ath11k/hal.h | 1 + drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 3 + drivers/nvme/host/pci.c | 2 + drivers/of/unittest.c | 1 + drivers/pci/controller/cadence/pci-j721e.c | 25 ++ drivers/pci/controller/dwc/pci-keystone.c | 4 +- drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +- drivers/pci/controller/dwc/pcie-tegra194.c | 32 +- drivers/pci/controller/pci-tegra.c | 27 +- drivers/pci/controller/pcie-rcar-host.c | 40 +- drivers/pci/controller/pcie-xilinx-nwl.c | 7 +- drivers/pci/endpoint/functions/pci-epf-test.c | 19 +- drivers/pci/iov.c | 5 + drivers/pci/pci-driver.c | 1 + drivers/pci/pci-sysfs.c | 20 +- drivers/pci/pcie/aer.c | 12 +- drivers/pci/pcie/err.c | 8 +- drivers/perf/arm-cmn.c | 9 +- drivers/pinctrl/samsung/pinctrl-samsung.h | 4 - drivers/power/supply/max77976_charger.c | 12 +- drivers/pwm/pwm-berlin.c | 4 +- drivers/rtc/interface.c | 27 ++ drivers/rtc/rtc-optee.c | 1 + drivers/rtc/rtc-x1205.c | 2 +- drivers/s390/block/dasd.c | 17 +- drivers/s390/cio/device.c | 37 +- drivers/scsi/hpsa.c | 21 +- drivers/scsi/mvsas/mv_init.c | 2 +- drivers/scsi/sd.c | 50 +-- drivers/spi/spi-cadence-quadspi.c | 18 +- drivers/video/fbdev/core/fb_cmdline.c | 2 +- drivers/xen/events/events_base.c | 37 +- drivers/xen/manage.c | 3 +- fs/btrfs/export.c | 8 +- fs/btrfs/extent_io.c | 14 +- fs/cramfs/inode.c | 11 +- fs/eventpoll.c | 139 ++----- fs/ext4/ext4.h | 2 + fs/ext4/fsmap.c | 14 +- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 10 +- fs/ext4/move_extent.c | 2 +- fs/ext4/orphan.c | 17 +- fs/ext4/super.c | 26 +- fs/ext4/xattr.c | 19 +- fs/file.c | 5 +- fs/fs-writeback.c | 32 +- fs/fsopen.c | 70 ++-- fs/fuse/dev.c | 2 +- fs/fuse/file.c | 8 +- fs/minix/inode.c | 8 +- fs/namei.c | 8 + fs/namespace.c | 106 ++++-- fs/nfs/callback.c | 4 - fs/nfs/callback_xdr.c | 1 + fs/nfsd/export.c | 24 +- fs/nfsd/export.h | 3 +- fs/nfsd/lockd.c | 28 +- fs/nfsd/netns.h | 4 +- fs/nfsd/nfs4proc.c | 4 +- fs/nfsd/nfs4state.c | 6 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfsfh.c | 22 +- fs/nfsd/trace.h | 2 +- fs/nfsd/vfs.c | 14 +- fs/nfsd/vfs.h | 2 +- fs/ntfs3/bitmap.c | 1 + fs/quota/dquot.c | 10 +- fs/read_write.c | 14 +- fs/smb/client/smb1ops.c | 62 ++- fs/smb/client/smb2inode.c | 22 +- fs/smb/client/smb2ops.c | 10 +- fs/squashfs/inode.c | 24 +- include/acpi/acpixf.h | 6 + include/asm-generic/io.h | 98 +++-- include/linux/cpufreq.h | 3 + include/linux/iio/frequency/adf4350.h | 2 +- include/linux/ksm.h | 8 +- include/linux/mm.h | 22 +- include/linux/rseq.h | 11 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_xprt.h | 19 + include/media/v4l2-subdev.h | 30 +- include/trace/events/dma.h | 1 + init/main.c | 12 + kernel/bpf/inode.c | 4 +- kernel/fork.c | 2 +- kernel/pid.c | 5 +- kernel/rseq.c | 10 +- kernel/sched/deadline.c | 73 ++-- kernel/sched/fair.c | 9 +- kernel/sys.c | 22 +- kernel/trace/trace_fprobe.c | 11 +- kernel/trace/trace_kprobe.c | 11 +- kernel/trace/trace_probe.h | 9 +- kernel/trace/trace_uprobe.c | 12 +- lib/crypto/Makefile | 4 + lib/genalloc.c | 5 +- mm/damon/lru_sort.c | 2 +- mm/damon/vaddr.c | 8 +- mm/huge_memory.c | 15 +- mm/hugetlb.c | 3 + mm/migrate.c | 23 +- mm/page_alloc.c | 2 +- mm/slab.h | 8 +- mm/slub.c | 3 +- net/bridge/br_vlan.c | 2 +- net/core/filter.c | 2 + net/core/page_pool.c | 76 ++-- net/ipv4/tcp.c | 5 +- net/ipv4/tcp_input.c | 1 - net/mptcp/pm.c | 7 +- net/mptcp/pm_netlink.c | 50 ++- net/mptcp/protocol.h | 8 + net/netfilter/nft_objref.c | 39 ++ net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/sunrpc/svc_xprt.c | 45 ++- net/sunrpc/svcsock.c | 2 + net/xdp/xsk_queue.h | 45 ++- security/keys/trusted-keys/trusted_tpm1.c | 7 +- sound/soc/sof/intel/hda-pcm.c | 29 +- sound/soc/sof/intel/hda-stream.c | 29 +- sound/soc/sof/ipc4-pcm.c | 138 +++++-- sound/soc/sof/ipc4-topology.c | 16 +- sound/soc/sof/ipc4-topology.h | 10 +- tools/build/feature/Makefile | 4 +- tools/lib/perf/include/perf/event.h | 1 + tools/perf/builtin-stat.c | 18 +- .../arch/arm64/ampere/ampereonex/metrics.json | 10 +- tools/perf/tests/perf-record.c | 4 + tools/perf/tests/shell/record_lbr.sh | 29 +- tools/perf/tests/shell/stat.sh | 29 ++ tools/perf/tests/shell/trace_btf_enum.sh | 11 + tools/perf/util/arm-spe-decoder/arm-spe-decoder.h | 18 +- tools/perf/util/arm-spe.c | 34 +- tools/perf/util/disasm.c | 7 +- tools/perf/util/evsel.c | 31 +- tools/perf/util/lzma.c | 2 +- tools/perf/util/session.c | 2 +- tools/perf/util/setup.py | 5 +- tools/perf/util/zlib.c | 2 +- tools/testing/selftests/mm/madv_populate.c | 21 +- tools/testing/selftests/mm/soft-dirty.c | 5 +- tools/testing/selftests/mm/vm_util.c | 77 ++++ tools/testing/selftests/mm/vm_util.h | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 + .../selftests/net/netfilter/nf_nat_edemux.sh | 58 ++- tools/testing/selftests/rseq/rseq.c | 8 +- 276 files changed, 2812 insertions(+), 1556 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/277 fs: always return zero on success from replace_fd()
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 upstream.
replace_fd() returns the number of the new file descriptor through the return value of do_dup2(). However its callers never care about the specific returned number. In fact the caller in receive_fd_replace() treats any non-zero return value as an error and therefore never calls __receive_sock() for most file descriptors, which is a bug.
To fix the bug in receive_fd_replace() and to avoid the same issue happening in future callers, signal success through a plain zero.
--- fs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/file.c +4 -1
@@ -1262,7 +1262,10 @@ int replace_fd(unsigned fd, struct file err =expand_files (files, fd);if (unlikely (err <0 )) goto out_unlock; -return do_dup2 (files, file, fd, flags); + err =do_dup2 (files, file, fd, flags); +if (err <0 ) +return err; +return 0 ; out_unlock:spin_unlock (&files->file_lock);
Greg Kroah-Hartman
maintainerPATCH 2/277 fscontext: do not consume log entries when returning -EMSGSIZE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit 72d271a7baa7062cb27e774ac37c5459c6d20e22 upstream.
Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case.
Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. While we're at it, refactor some fscontext_read() into a separate helper to make the ring buffer logic a bit easier to read.
--- fs/fsopen.c | 70 ++++++++++++++++++++++++++++++++---------------------------- 1 file changed, 38 insertions(+), 32 deletions(-)
fs/fsopen.c +38 -32
@@ -18,50 +18,56 @@#include "internal.h" #include "mount.h" +static inline const char *fetch_message_locked (struct fc_log *log,size_t len, +bool *need_free) +{ +const char *p; +int index; + +if (unlikely (log->head == log->tail)) +return ERR_PTR (-ENODATA ); + + index = log->tail & (ARRAY_SIZE (log->buffer) -1 ); + p = log->buffer[index]; +if (unlikely (strlen (p) > len)) +return ERR_PTR (-EMSGSIZE ); + + log->buffer[index] =NULL ; + *need_free = log->need_free & (1 << index); + log->need_free &= ~(1 << index); + log->tail++; + +return p; +} +/* * Allow the user to read back any error, warning or informational messages. +* Only one message is returned for each read(2) call. */ static ssize_t fscontext_read (struct file *file,char __user *_buf,size_t len,loff_t *pos) {struct fs_context *fc = file->private_data; -struct fc_log *log = fc->log.log; -unsigned int logsize =ARRAY_SIZE (log->buffer); -ssize_t ret; -char *p; +ssize_t err; + const char *p __free(kfree) = NULL, *message;bool need_free; -int index, n; - - ret =mutex_lock_interruptible (&fc->uapi_mutex); -if (ret <0 ) -return ret; - -if (log->head == log->tail) { -mutex_unlock (&fc->uapi_mutex); -return -ENODATA ; - } +int n; - index = log->tail & (logsize -1 ); - p = log->buffer[index]; - need_free = log->need_free & (1 << index); - log->buffer[index] =NULL ; - log->need_free &= ~(1 << index); - log->tail++; + err =mutex_lock_interruptible (&fc->uapi_mutex); +if (err <0 ) +return err; + message =fetch_message_locked (fc->log.log, len, &need_free);mutex_unlock (&fc->uapi_mutex); +if (IS_ERR (message)) +return PTR_ERR (message); - ret = -EMSGSIZE ; - n =strlen (p); -if (n > len) - goto err_free; - ret = -EFAULT ; -if (copy_to_user (_buf, p, n) !=0 ) - goto err_free; - ret = n; - -err_free:if (need_free) -kfree (p); -return ret; + p = message; + + n =strlen (message); +if (copy_to_user (_buf, message, n)) +return -EFAULT ; +return n; }static int fscontext_release (struct inode *inode,struct file *file)
Greg Kroah-Hartman
maintainerPATCH 3/277 arm64: map [_text, _stext) virtual address range non-executable+read-only
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <[email protected]>
commit 5973a62efa34c80c9a4e5eac1fca6f6209b902af upstream.
Since the referenced fixes commit, the kernel's .text section is only mapped starting from _stext; the region [_text, _stext) is omitted. As a result, other vmalloc/vmap allocations may use the virtual addresses nominally in the range [_text, _stext). This address reuse confuses multiple things:
1. crash_prepare_elf64_headers() sets up a segment in /proc/vmcore mapping the entire range [_text, _end) to [__pa_symbol(_text), __pa_symbol(_end)). Reading an address in [_text, _stext) from /proc/vmcore therefore gives the incorrect result.
2. Tools doing symbolization (either by reading /proc/kallsyms or based on the vmlinux ELF file) will incorrectly identify vmalloc/vmap allocations in [_text, _stext) as kernel symbols.
In practice, both of these issues affect the drgn debugger. Specifically, there were cases where the vmap IRQ stacks for some CPUs were allocated in [_text, _stext). As a result, drgn could not get the stack trace for a crash in an IRQ handler because the core dump contained invalid data for the IRQ stack address. The stack addresses were also symbolized as being in the _text symbol.
Fix this by bringing back the mapping of [_text, _stext), but now make it non-executable and read-only. This prevents other allocations from using it while still achieving the original goal of not mapping unpredictable data as executable. Other than the changed protection, this is effectively a revert of the fixes commit.
--- arch/arm64/kernel/pi/map_kernel.c | 6 ++++++ arch/arm64/kernel/setup.c | 4 ++-- arch/arm64/mm/init.c | 2 +- arch/arm64/mm/mmu.c | 14 +++++++++----- 4 files changed, 18 insertions(+), 8 deletions(-)
arch/arm64/kernel/pi/map_kernel.c +6 -0
@@ -78,6 +78,12 @@ static void __init map_kernel(u64 kaslr_ twopass |= enable_scs; prot = twopass ? data_prot : text_prot; +/* +* [_stext, _text) isn't executed after boot and contains some +* non-executable, unpredictable data, so map it non-executable. +*/ +map_segment (init_pg_dir, &pgdp, va_offset, _text, _stext, data_prot, + false, root_level);map_segment (init_pg_dir, &pgdp, va_offset, _stext, _etext, prot, !twopass, root_level); map_segment(init_pg_dir, &pgdp, va_offset, __start_rodata,
arch/arm64/kernel/setup.c +2 -2
@@ -213,7 +213,7 @@ static void __init request_standard_resounsigned long i =0 ;size_t res_size; - kernel_code.start =__pa_symbol (_stext); + kernel_code.start =__pa_symbol (_text); kernel_code.end =__pa_symbol (__init_begin -1 ); kernel_data.start =__pa_symbol (_sdata); kernel_data.end =__pa_symbol (_end -1 );
@@ -281,7 +281,7 @@ u64 cpu_logical_map(unsigned int cpu) void __init __no_sanitize_address setup_arch(char **cmdline_p) { -setup_initial_init_mm (_stext, _etext, _edata, _end); +setup_initial_init_mm (_text, _etext, _edata, _end); *cmdline_p = boot_command_line;
arch/arm64/mm/init.c +1 -1
@@ -300,7 +300,7 @@ void __init arm64_memblock_init(void)* Register the kernel text, kernel data, initrd, and initial * pagetables with memblock. */ -memblock_reserve (__pa_symbol (_stext), _end - _stext); +memblock_reserve (__pa_symbol (_text), _end - _text);if (IS_ENABLED (CONFIG_BLK_DEV_INITRD ) && phys_initrd_size) {/* the generic initrd code expects virtual addresses */ initrd_start =__phys_to_virt (phys_initrd_start);
arch/arm64/mm/mmu.c +9 -5
@@ -561,8 +561,8 @@ void __init mark_linear_text_alias_ro(vo/* * Remove the write permissions from the linear alias of .text/.rodata */ -update_mapping_prot (__pa_symbol (_stext), (unsigned long )lm_alias (_stext), - (unsigned long )__init_begin - (unsigned long )_stext, +update_mapping_prot (__pa_symbol (_text), (unsigned long )lm_alias (_text), + (unsigned long )__init_begin - (unsigned long )_text,PAGE_KERNEL_RO ); }
@@ -623,7 +623,7 @@ static inline void arm64_kfence_map_poolstatic void __init map_mem (pgd_t *pgdp) {static const u64 direct_map_end =_PAGE_END (VA_BITS_MIN ); -phys_addr_t kernel_start =__pa_symbol (_stext); +phys_addr_t kernel_start =__pa_symbol (_text);phys_addr_t kernel_end =__pa_symbol (__init_begin);phys_addr_t start, end;phys_addr_t early_kfence_pool;
@@ -670,7 +670,7 @@ static void __init map_mem(pgd_t *pgdp) }/* -* Map the linear alias of the [_stext, __init_begin) interval +* Map the linear alias of the [_text, __init_begin) interval * as non-executable now, and remove the write permission in * mark_linear_text_alias_ro() below (which will be called after * alternative patching has completed). This makes the contents
@@ -697,6 +697,10 @@ void mark_rodata_ro(void)WRITE_ONCE (rodata_is_rw, false);update_mapping_prot (__pa_symbol (__start_rodata), (unsigned long )__start_rodata, section_size,PAGE_KERNEL_RO ); +/* mark the range between _text and _stext as read only. */ +update_mapping_prot (__pa_symbol (_text), (unsigned long )_text, + (unsigned long )_stext - (unsigned long )_text, +PAGE_KERNEL_RO ); } static void __init declare_vma(struct vm_struct *vma,
@@ -767,7 +771,7 @@ static void __init declare_kernel_vmas(v {static struct vm_struct vmlinux_seg[KERNEL_SEGMENT_COUNT ]; -declare_vma (&vmlinux_seg[0 ], _stext, _etext,VM_NO_GUARD ); +declare_vma (&vmlinux_seg[0 ], _text, _etext,VM_NO_GUARD );declare_vma (&vmlinux_seg[1 ], __start_rodata, __inittext_begin,VM_NO_GUARD );declare_vma (&vmlinux_seg[2 ], __inittext_begin, __inittext_end,VM_NO_GUARD );declare_vma (&vmlinux_seg[3 ], __initdata_begin, __initdata_end,VM_NO_GUARD );
Greg Kroah-Hartman
maintainerPATCH 4/277 rseq: Protect event mask against membarrier IPI
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 6eb350a2233100a283f882c023e5ad426d0ed63b upstream.
rseq_need_restart() reads and clears task::rseq_event_mask with preemption disabled to guard against the scheduler.
But membarrier() uses an IPI and sets the PREEMPT bit in the event mask from the IPI, which leaves that RMW operation unprotected.
Use guard(irq) if CONFIG_MEMBARRIER is enabled to fix that.
--- include/linux/rseq.h | 11 ++++++++--- kernel/rseq.c | 10 +++++----- 2 files changed, 13 insertions(+), 8 deletions(-)
include/linux/rseq.h +8 -3
@@ -7,6 +7,12 @@#include <linux/preempt.h> #include <linux/sched.h> +#ifdef CONFIG_MEMBARRIER +# define RSEQ_EVENT_GUARD irq +#else +# define RSEQ_EVENT_GUARD preempt +#endif +/* * Map the event mask on the user-space ABI enum rseq_cs_flags * for direct mask checks.
@@ -41,9 +47,8 @@ static inline void rseq_handle_notify_restatic inline void rseq_signal_deliver (struct ksignal *ksig,struct pt_regs *regs) { -preempt_disable (); -__set_bit (RSEQ_EVENT_SIGNAL_BIT , ¤t->rseq_event_mask); -preempt_enable (); +scoped_guard (RSEQ_EVENT_GUARD) + __set_bit(RSEQ_EVENT_SIGNAL_BIT, ¤t->rseq_event_mask);rseq_handle_notify_resume (ksig, regs); }
kernel/rseq.c +5 -5
@@ -255,12 +255,12 @@ static int rseq_need_restart(struct task/* * Load and clear event mask atomically with respect to -* scheduler preemption. +* scheduler preemption and membarrier IPIs. */ -preempt_disable (); - event_mask = t->rseq_event_mask; - t->rseq_event_mask =0 ; -preempt_enable (); +scoped_guard (RSEQ_EVENT_GUARD ) { + event_mask = t->rseq_event_mask; + t->rseq_event_mask =0 ; + }return !!event_mask; }
Greg Kroah-Hartman
maintainerPATCH 5/277 listmount: dont call path_put() under namespace semaphore
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
commit c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 upstream.
Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.
--- fs/namespace.c | 87 ++++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 59 insertions(+), 28 deletions(-)
fs/namespace.c +59 -28
@@ -5411,23 +5411,34 @@ retry:return ret; } -static ssize_t do_listmount (struct mnt_namespace *ns,u64 mnt_parent_id, -u64 last_mnt_id,u64 *mnt_ids,size_t nr_mnt_ids, -bool reverse) +struct klistmount { +u64 last_mnt_id; +u64 mnt_parent_id; +u64 *kmnt_ids; +u32 nr_mnt_ids; +struct mnt_namespace *ns; +struct path root; +}; + +static ssize_t do_listmount (struct klistmount *kls,bool reverse) { - struct path root __free(path_put) = {}; +struct mnt_namespace *ns = kls->ns; +u64 mnt_parent_id = kls->mnt_parent_id; +u64 last_mnt_id = kls->last_mnt_id; +u64 *mnt_ids = kls->kmnt_ids; +size_t nr_mnt_ids = kls->nr_mnt_ids;struct path orig;struct mount *r, *first;ssize_t ret;rwsem_assert_held (&namespace_sem); - ret =grab_requested_root (ns, &root); + ret =grab_requested_root (ns, &kls->root);if (ret)return ret;if (mnt_parent_id ==LSMT_ROOT ) { - orig = root; + orig = kls->root; }else { orig.mnt =lookup_mnt_in_ns (mnt_parent_id, ns);if (!orig.mnt)
@@ -5439,7 +5450,7 @@ static ssize_t do_listmount(struct mnt_n* Don't trigger audit denials. We just want to determine what * mounts to show users. */ -if (!is_path_reachable (real_mount (orig.mnt), orig.dentry, &root) && +if (!is_path_reachable (real_mount (orig.mnt), orig.dentry, &kls->root) && !ns_capable_noaudit (ns->user_ns,CAP_SYS_ADMIN ))return -EPERM ;
@@ -5472,14 +5483,45 @@ static ssize_t do_listmount(struct mnt_nreturn ret; } +static void __free_klistmount_free (const struct klistmount *kls) +{ +path_put (&kls->root); +kvfree (kls->kmnt_ids); +mnt_ns_release (kls->ns); +} + +static inline int prepare_klistmount (struct klistmount *kls,struct mnt_id_req *kreq, +size_t nr_mnt_ids) +{ + +u64 last_mnt_id = kreq->param; + +/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ +if (last_mnt_id !=0 && last_mnt_id <=MNT_UNIQUE_ID_OFFSET ) +return -EINVAL ; + + kls->last_mnt_id = last_mnt_id; + + kls->nr_mnt_ids = nr_mnt_ids; + kls->kmnt_ids =kvmalloc_array (nr_mnt_ids,sizeof (*kls->kmnt_ids), +GFP_KERNEL_ACCOUNT ); +if (!kls->kmnt_ids) +return -ENOMEM ; + + kls->ns =grab_requested_mnt_ns (kreq); +if (!kls->ns) +return -ENOENT ; + + kls->mnt_parent_id = kreq->mnt_id; +return 0 ; +} + SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req, u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags) { - u64 *kmnt_ids __free(kvfree) = NULL; + struct klistmount kls __free(klistmount_free) = {};const size_t maxcount =1000000 ; - struct mnt_namespace *ns __free(mnt_ns_release) = NULL;struct mnt_id_req kreq; -u64 last_mnt_id;ssize_t ret;if (flags & ~LISTMOUNT_REVERSE )
@@ -5500,31 +5542,20 @@ SYSCALL_DEFINE4(listmount, const structif (ret)return ret; - last_mnt_id = kreq.param; -/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ -if (last_mnt_id !=0 && last_mnt_id <=MNT_UNIQUE_ID_OFFSET ) -return -EINVAL ; - - kmnt_ids =kvmalloc_array (nr_mnt_ids,sizeof (*kmnt_ids), -GFP_KERNEL_ACCOUNT ); -if (!kmnt_ids) -return -ENOMEM ; - - ns =grab_requested_mnt_ns (&kreq); -if (!ns) -return -ENOENT ; + ret =prepare_klistmount (&kls, &kreq, nr_mnt_ids); +if (ret) +return ret; -if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && - !ns_capable_noaudit (ns->user_ns,CAP_SYS_ADMIN )) +if (kreq.mnt_ns_id && (kls.ns != current->nsproxy->mnt_ns) && + !ns_capable_noaudit (kls.ns->user_ns,CAP_SYS_ADMIN ))return -ENOENT ;scoped_guard (rwsem_read, &namespace_sem) - ret = do_listmount(ns, kreq.mnt_id, last_mnt_id, kmnt_ids, - nr_mnt_ids, (flags &LISTMOUNT_REVERSE )); + ret = do_listmount(&kls, (flags & LISTMOUNT_REVERSE));if (ret <=0 )return ret; -if (copy_to_user (mnt_ids, kmnt_ids, ret *sizeof (*mnt_ids))) +if (copy_to_user (mnt_ids, kls.kmnt_ids, ret *sizeof (*mnt_ids)))return -EFAULT ;return ret;
Greg Kroah-Hartman
maintainerPATCH 6/277 clocksource/drivers/clps711x: Fix resource leaks in error paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit cd32e596f02fc981674573402c1138f616df1728 upstream.
The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths.
--- drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/clps711x-timer.c +16 -7
@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(stunsigned int irq =irq_of_parse_and_map (np,0 );struct clk *clock =of_clk_get (np,0 );void __iomem *base =of_iomap (np,0 ); +int ret =0 ;if (!base)return -ENOMEM ; -if (!irq) -return -EINVAL ; -if (IS_ERR (clock)) -return PTR_ERR (clock); +if (!irq) { + ret = -EINVAL ; + goto unmap_io; + } +if (IS_ERR (clock)) { + ret =PTR_ERR (clock); + goto unmap_io; + }switch (of_alias_get_id (np,"timer" )) {case CLPS711X_CLKSRC_CLOCKSOURCE :clps711x_clksrc_init (clock, base);break ;case CLPS711X_CLKSRC_CLOCKEVENT : -return _clps711x_clkevt_init (clock, base, irq); + ret =_clps711x_clkevt_init (clock, base, irq); +break ;default : -return -EINVAL ; + ret = -EINVAL ; +break ; } -return 0 ; +unmap_io: +iounmap (base); +return ret; }TIMER_OF_DECLARE (clps711x,"cirrus,ep7209-timer" , clps711x_timer_init);
Greg Kroah-Hartman
maintainerPATCH 7/277 page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
commit 95920c2ed02bde551ab654e9749c2ca7bc3100e0 upstream.
Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the page_pool_page_is_pp() incurs false positives which crashes the machine.
Just disabling the check in page_pool_is_pp() will lead to the page_pool code itself malfunctioning; so instead of doing this, this patch changes the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel pointers for page_pool-tagged pages.
The fix relies on the kernel pointers that alias with the pp_magic field always being above PAGE_OFFSET. With this assumption, we can use the lowest bit of the value of PAGE_OFFSET as the upper bound of the PP_DMA_INDEX_MASK, which should avoid the false positives.
Because we cannot rely on PAGE_OFFSET always being a compile-time constant, nor on it always being >0, we fall back to disabling the dma_index storage when there are not enough bits available. This leaves us in the situation we were in before the patch in the Fixes tag, but only on a subset of architecture configurations. This seems to be the best we can do until the transition to page types in complete for page_pool pages.
v2:
- Make sure there's at least 8 bits available and that the PAGE_OFFSET bit calculation doesn't wrap
--- include/linux/mm.h | 22 ++++++++------ net/core/page_pool.c | 76 +++++++++++++++++++++++++++++++++++---------------- 2 files changed, 66 insertions(+), 32 deletions(-)
include/linux/mm.h +13 -9
@@ -4318,14 +4318,13 @@ static inline void pgalloc_tag_copy(stru* since this value becomes part of PP_SIGNATURE; meaning we can just use the * space between the PP_SIGNATURE value (without POISON_POINTER_DELTA), and the * lowest bits of POISON_POINTER_DELTA. On arches where POISON_POINTER_DELTA is -* 0, we make sure that we leave the two topmost bits empty, as that guarantees -* we won't mistake a valid kernel pointer for a value we set, regardless of the -* VMSPLIT setting. +* 0, we use the lowest bit of PAGE_OFFSET as the boundary if that value is +* known at compile-time. * -* Altogether, this means that the number of bits available is constrained by -* the size of an unsigned long (at the upper end, subtracting two bits per the -* above), and the definition of PP_SIGNATURE (with or without -* POISON_POINTER_DELTA). +* If the value of PAGE_OFFSET is not known at compile time, or if it is too +* small to leave at least 8 bits available above PP_SIGNATURE, we define the +* number of bits to be 0, which turns off the DMA index tracking altogether +* (see page_pool_register_dma_index()). */ #define PP_DMA_INDEX_SHIFT (1 + __fls(PP_SIGNATURE - POISON_POINTER_DELTA))#if POISON_POINTER_DELTA >0
@@ -4334,8 +4333,13 @@ static inline void pgalloc_tag_copy(stru*/ #define PP_DMA_INDEX_BITS MIN(32, __ffs(POISON_POINTER_DELTA) - PP_DMA_INDEX_SHIFT)#else -/* Always leave out the topmost two; see above. */ -#define PP_DMA_INDEX_BITS MIN(32, BITS_PER_LONG - PP_DMA_INDEX_SHIFT - 2) +/* Use the lowest bit of PAGE_OFFSET if there's at least 8 bits available; see above */ +#define PP_DMA_INDEX_MIN_OFFSET (1 << (PP_DMA_INDEX_SHIFT + 8)) +#define PP_DMA_INDEX_BITS ((__builtin_constant_p(PAGE_OFFSET) && \ + PAGE_OFFSET >= PP_DMA_INDEX_MIN_OFFSET && \ + !(PAGE_OFFSET & (PP_DMA_INDEX_MIN_OFFSET - 1))) ? \ + MIN(32, __ffs(PAGE_OFFSET) - PP_DMA_INDEX_SHIFT) : 0) +#endif #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
net/core/page_pool.c +53 -23
112 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 8/277 dma-mapping: fix direction in dma_alloc direction traces
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Tesarik <[email protected]>
commit 16abbabc004bedeeaa702e11913da9d4fa70e63a upstream.
Set __entry->dir to the actual "dir" parameter of all trace events in dma_alloc_class. This struct member was left uninitialized by mistake.
--- include/trace/events/dma.h | 1 + 1 file changed, 1 insertion(+)
include/trace/events/dma.h +1 -0
@@ -136,6 +136,7 @@ DECLARE_EVENT_CLASS(dma_alloc_class, __entry->dma_addr = dma_addr; __entry->size = size; __entry->flags = flags; + __entry->dir = dir; __entry->attrs = attrs; ),
Greg Kroah-Hartman
maintainerPATCH 9/277 KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 68e61f6fd65610e73b17882f86fedfd784d99229 upstream.
Emulate PERF_CNTR_GLOBAL_STATUS_SET when PerfMonV2 is enumerated to the guest, as the MSR is supposed to exist in all AMD v2 PMUs.
--- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kvm/pmu.c | 5 +++++ arch/x86/kvm/svm/pmu.c | 1 + arch/x86/kvm/x86.c | 2 ++ 4 files changed, 9 insertions(+)
arch/x86/include/asm/msr-index.h +1 -0
@@ -722,6 +722,7 @@#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS 0xc0000300#define MSR_AMD64_PERF_CNTR_GLOBAL_CTL 0xc0000301#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR 0xc0000302 +#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET 0xc0000303/* AMD Last Branch Record MSRs */ #define MSR_AMD64_LBR_SELECT 0xc000010e
arch/x86/kvm/pmu.c +5 -0
@@ -650,6 +650,7 @@ int kvm_pmu_get_msr(struct kvm_vcpu *vcp msr_info->data = pmu->global_ctrl;break ;case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR : +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET :case MSR_CORE_PERF_GLOBAL_OVF_CTRL : msr_info->data =0 ;break ;
@@ -711,6 +712,10 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpif (!msr_info->host_initiated) pmu->global_status &= ~data;break ; +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET : +if (!msr_info->host_initiated) + pmu->global_status |= data & ~pmu->global_status_rsvd; +break ;default :kvm_pmu_mark_pmc_in_use (vcpu, msr_info->index);return kvm_pmu_call (set_msr)(vcpu, msr_info);
arch/x86/kvm/svm/pmu.c +1 -0
@@ -113,6 +113,7 @@ static bool amd_is_valid_msr(struct kvm_case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS :case MSR_AMD64_PERF_CNTR_GLOBAL_CTL :case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR : +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET :return pmu->version >1 ;default : if (msr > MSR_F15H_PERF_CTR5 &&
arch/x86/kvm/x86.c +2 -0
@@ -364,6 +364,7 @@ static const u32 msrs_to_save_pmu[] = {MSR_AMD64_PERF_CNTR_GLOBAL_CTL ,MSR_AMD64_PERF_CNTR_GLOBAL_STATUS ,MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR , + MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET, }; static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_base) +
@@ -7449,6 +7450,7 @@ static void kvm_probe_msr_to_save(u32 mscase MSR_AMD64_PERF_CNTR_GLOBAL_CTL :case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS :case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR : +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET :if (!kvm_cpu_cap_has (X86_FEATURE_PERFMON_V2 ))return ;break ;
Greg Kroah-Hartman
maintainerPATCH 10/277 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly.
--- include/linux/iio/frequency/adf4350.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/frequency/adf4350.h +1 -1
@@ -51,7 +51,7 @@/* REG3 Bit Definitions */ #define ADF4350_REG3_12BIT_CLKDIV (x) ((x) << 3) -#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 16) +#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 15)#define ADF4350_REG3_12BIT_CSR_EN (1 << 18)#define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)#define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
Greg Kroah-Hartman
maintainerPATCH 11/277 media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream.
v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash.
Add proper error handling to v4l2_subdev_call_state_try().
--- include/media/v4l2-subdev.h | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
include/media/v4l2-subdev.h +17 -13
@@ -1952,19 +1952,23 @@ extern const struct v4l2_subdev_ops v4l2* * Note: only legacy non-MC drivers may need this macro. */ -#define v4l2_subdev_call_state_try(sd, o, f, args...) \ - ({ \ - int __result; \ - static struct lock_class_key __key; \ - const char *name = KBUILD_BASENAME \ - ":" __stringify(__LINE__) ":state->lock"; \ - struct v4l2_subdev_state *state = \ - __v4l2_subdev_state_alloc(sd, name, &__key); \ - v4l2_subdev_lock_state(state); \ - __result = v4l2_subdev_call(sd, o, f, state, ##args); \ - v4l2_subdev_unlock_state(state); \ - __v4l2_subdev_state_free(state); \ - __result; \ +#define v4l2_subdev_call_state_try(sd, o, f, args...) \ + ({ \ + int __result; \ + static struct lock_class_key __key; \ + const char *name = KBUILD_BASENAME \ + ":" __stringify(__LINE__) ":state->lock"; \ + struct v4l2_subdev_state *state = \ + __v4l2_subdev_state_alloc(sd, name, &__key); \ + if (IS_ERR(state)) { \ + __result = PTR_ERR(state); \ + } else { \ + v4l2_subdev_lock_state(state); \ + __result = v4l2_subdev_call(sd, o, f, state, ##args); \ + v4l2_subdev_unlock_state(state); \ + __v4l2_subdev_state_free(state); \ + } \ + __result; \ })/**
Greg Kroah-Hartman
maintainerPATCH 12/277 asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varad Gautam <[email protected]>
commit 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 upstream.
With CONFIG_TRACE_MMIO_ACCESS=y, the {read,write}{b,w,l,q}{_relaxed}() mmio accessors unconditionally call log_{post_}{read,write}_mmio() helpers, which in turn call the ftrace ops for rwmmio trace events
This adds a performance penalty per mmio accessor call, even when rwmmio events are disabled at runtime (~80% overhead on local measurement).
Guard these with tracepoint_enabled().
--- include/asm-generic/io.h | 98 +++++++++++++++++++++++++++++++---------------- 1 file changed, 66 insertions(+), 32 deletions(-)
include/asm-generic/io.h +66 -32
@@ -75,6 +75,7 @@#if IS_ENABLED (CONFIG_TRACE_MMIO_ACCESS ) && !(defined(__DISABLE_TRACE_MMIO__))#include <linux/tracepoint-defs.h> +#define rwmmio_tracepoint_enabled (tracepoint) tracepoint_enabled(tracepoint)DECLARE_TRACEPOINT (rwmmio_write);DECLARE_TRACEPOINT (rwmmio_post_write);DECLARE_TRACEPOINT (rwmmio_read);
@@ -91,6 +92,7 @@ void log_post_read_mmio(u64 val, u8 widt#else +#define rwmmio_tracepoint_enabled (tracepoint) falsestatic inline void log_write_mmio (u64 val,u8 width,volatile void __iomem *addr,unsigned long caller_addr,unsigned long caller_addr0) {} static inline void log_post_write_mmio(u64 val, u8 width, volatile void __iomem *addr,
@@ -189,11 +191,13 @@ static inline u8 readb(const volatile vo {u8 val; -log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__raw_readb (addr);__io_ar (val); -log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -204,11 +208,13 @@ static inline u16 readw(const volatile v {u16 val; -log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le16_to_cpu ((__le16 __force )__raw_readw (addr));__io_ar (val); -log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -219,11 +225,13 @@ static inline u32 readl(const volatile v {u32 val; -log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le32_to_cpu ((__le32 __force )__raw_readl (addr));__io_ar (val); -log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -235,11 +243,13 @@ static inline u64 readq(const volatile v {u64 val; -log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le64_to_cpu ((__le64 __force )__raw_readq (addr));__io_ar (val); -log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -249,11 +259,13 @@ static inline u64 readq(const volatile v#define writeb writebstatic inline void writeb (u8 value,volatile void __iomem *addr) { -log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writeb (value, addr);__io_aw (); -log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -261,11 +273,13 @@ static inline void writeb(u8 value, vola#define writew writewstatic inline void writew (u16 value,volatile void __iomem *addr) { -log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writew ((u16 __force )cpu_to_le16 (value), addr);__io_aw (); -log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -273,11 +287,13 @@ static inline void writew(u16 value, vol#define writel writelstatic inline void writel (u32 value,volatile void __iomem *addr) { -log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writel ((u32 __force )__cpu_to_le32 (value), addr);__io_aw (); -log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -286,11 +302,13 @@ static inline void writel(u32 value, vol#define writeq writeqstatic inline void writeq (u64 value,volatile void __iomem *addr) { -log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writeq ((u64 __force )__cpu_to_le64 (value), addr);__io_aw (); -log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); }#endif #endif /* CONFIG_64BIT */
@@ -306,9 +324,11 @@ static inline u8 readb_relaxed(const vol {u8 val; -log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); val =__raw_readb (addr); -log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -319,9 +339,11 @@ static inline u16 readw_relaxed(const vo {u16 val; -log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); val =__le16_to_cpu ((__le16 __force )__raw_readw (addr)); -log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -332,9 +354,11 @@ static inline u32 readl_relaxed(const vo {u32 val; -log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); val =__le32_to_cpu ((__le32 __force )__raw_readl (addr)); -log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -345,9 +369,11 @@ static inline u64 readq_relaxed(const vo {u64 val; -log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); val =__le64_to_cpu ((__le64 __force )__raw_readq (addr)); -log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -356,9 +382,11 @@ static inline u64 readq_relaxed(const vo#define writeb_relaxed writeb_relaxedstatic inline void writeb_relaxed (u8 value,volatile void __iomem *addr) { -log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_);__raw_writeb (value, addr); -log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -366,9 +394,11 @@ static inline void writeb_relaxed(u8 val#define writew_relaxed writew_relaxedstatic inline void writew_relaxed (u16 value,volatile void __iomem *addr) { -log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_);__raw_writew ((u16 __force )cpu_to_le16 (value), addr); -log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -376,9 +406,11 @@ static inline void writew_relaxed(u16 va#define writel_relaxed writel_relaxedstatic inline void writel_relaxed (u32 value,volatile void __iomem *addr) { -log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_);__raw_writel ((u32 __force )__cpu_to_le32 (value), addr); -log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -386,9 +418,11 @@ static inline void writel_relaxed(u32 va#define writeq_relaxed writeq_relaxedstatic inline void writeq_relaxed (u64 value,volatile void __iomem *addr) { -log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_);__raw_writeq ((u64 __force )__cpu_to_le64 (value), addr); -log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); }#endif
Greg Kroah-Hartman
maintainerPATCH 13/277 perf disasm: Avoid undefined behavior in incrementing NULL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 78d853512d6f979cf0cc41566e4f6cd82995ff34 ]
Incrementing NULL is undefined behavior and triggers ubsan during the perf annotate test.
Split a compound statement over two lines to avoid this.
--- tools/perf/util/disasm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/perf/util/disasm.c +5 -2
@@ -389,13 +389,16 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s* skip over possible up to 2 operands to get to address, e.g.: * tbnz w0, #26, ffff0000083cd190 <security_file_permission+0xd0> */ -if (c++ !=NULL ) { +if (c !=NULL ) { + c++; ops->target.addr =strtoull (c,NULL ,16 );if (!ops->target.addr) { c =strchr (c,',' ); c =validate_comma (c, ops); -if (c++ !=NULL ) +if (c !=NULL ) { + c++; ops->target.addr =strtoull (c,NULL ,16 ); + } } }else { ops->target.addr =strtoull (ops->raw,NULL ,16 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/277 perf test trace_btf_enum: Skip if permissions are insufficient
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 4bd5bd8dbd41a208fb73afb65bda6f38e2b5a637 ]
Modify test behavior to skip if BPF calls fail with "Operation not permitted".
--- tools/perf/tests/shell/trace_btf_enum.sh | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/perf/tests/shell/trace_btf_enum.sh +11 -0
@@ -23,6 +23,14 @@ check_vmlinux() { fi } +check_permissions() { + if perf trace -e $syscall $TESTPROG 2>&1 | grep -q "Operation not permitted" + then + echo "trace+enum test [Skipped permissions]" + err=2 + fi +} + trace_landlock() { echo "Tracing syscall ${syscall}"
@@ -54,6 +62,9 @@ trace_non_syscall() { } check_vmlinux +if [ $err = 0 ]; then + check_permissions +fi if [ $err = 0 ]; then trace_landlock
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/277 perf evsel: Avoid container_of on a NULL leader
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
An evsel should typically have a leader of itself, however, in tests like 'Sample parsing' a NULL leader may occur and the container_of will return a corrupt pointer.
Avoid this with an explicit NULL test.
--- tools/perf/util/evsel.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/util/evsel.c +2 -0
@@ -3497,6 +3497,8 @@ bool evsel__is_hybrid(const struct evsel *evsel)struct evsel *evsel__leader (const struct evsel *evsel) { +if (evsel->core.leader ==NULL ) +return NULL ; return container_of(evsel->core.leader, struct evsel, core); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/277 libperf event: Ensure tracing data is multiple of 8 sized
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
Perf's synthetic-events.c will ensure 8-byte alignment of tracing data, writing it after a perf_record_header_tracing_data event.
Add padding to struct perf_record_header_tracing_data to make it 16-byte rather than 12-byte sized.
--- tools/lib/perf/include/perf/event.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/perf/include/perf/event.h +1 -0
@@ -291,6 +291,7 @@ struct perf_record_header_event_type {struct perf_record_header_tracing_data {struct perf_event_header header;__u32 size; +__u32 pad; };#define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/277 clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 1e50f5c9965252ed6657b8692cd7366784d60616 ]
The devm_clk_hw_get_clk() function doesn't return NULL, it returns error pointers. Update the checking to match.
--- drivers/clk/qcom/common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/common.c +2 -2
@@ -273,8 +273,8 @@ static int qcom_cc_icc_register(struct device *dev, icd[i].slave_id = desc->icc_hws[i].slave_id; hws = &desc->clks[desc->icc_hws[i].clk_id]->hw; icd[i].clk =devm_clk_hw_get_clk (dev, hws,"icc" ); -if (!icd[i].clk) -return dev_err_probe (dev, -ENOENT , +if (IS_ERR (icd[i].clk)) +return dev_err_probe (dev,PTR_ERR (icd[i].clk),"(%d) clock entry is null\n" , i); icd[i].name =clk_hw_get_name (hws); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/277 clk: at91: peripheral: fix return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
determine_rate() is expected to return an error code, or 0 on success. clk_sam9x5_peripheral_determine_rate() has a branch that returns the parent rate on a certain case. This is the behavior of round_rate(), so let's go ahead and fix this by setting req->rate.
--- drivers/clk/at91/clk-peripheral.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/at91/clk-peripheral.c +5 -2
@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,long best_diff =LONG_MIN ;u32 shift; -if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) -return parent_rate; +if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) { + req->rate = parent_rate; + +return 0 ; + }/* Fist step: check the available dividers. */ for (shift =0 ; shift <=PERIPHERAL_MAX_SHIFT ; shift++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/277 clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan CHen <[email protected]>
[ Upstream commit cc55fc58fc1b7f405003fd2ecf79e74653461f0b ]
In case of krealloc_array() failure, the current error handling just returns from the function without freeing the original array. Fix this memory leak by freeing the original array.
--- drivers/clk/renesas/renesas-cpg-mssr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/renesas/renesas-cpg-mssr.c +5 -2
@@ -1012,6 +1012,7 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,of_for_each_phandle (&it, rc, node,"clocks" ,"#clock-cells" ,-1 ) {int idx; +unsigned int *new_ids;if (it.node != priv->np)continue ;
@@ -1022,11 +1023,13 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,if (args[0 ] !=CPG_MOD )continue ; - ids =krealloc_array (ids, (num +1 ),sizeof (*ids),GFP_KERNEL ); -if (!ids) { + new_ids =krealloc_array (ids, (num +1 ),sizeof (*ids),GFP_KERNEL ); +if (!new_ids) {of_node_put (it.node); +kfree (ids);return -ENOMEM ; } + ids = new_ids;if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ) idx =MOD_CLK_PACK_10 (args[1 ]);/* for DEF_MOD_STB() */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/277 perf util: Fix compression checks returning -1 as bool
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1.
A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers.
Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch.
--- tools/perf/util/lzma.c | 2 +- tools/perf/util/zlib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/lzma.c +1 -1
@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
tools/perf/util/zlib.c +1 -1
@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/277 rtc: x1205: Fix Xicor X1205 vendor prefix
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered.
--- drivers/rtc/rtc-x1205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-x1205.c +1 -1
@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {MODULE_DEVICE_TABLE (i2c, x1205_id);static const struct of_device_id x1205_dt_ids[] = { - { .compatible ="xircom,x1205" , }, + { .compatible ="xicor,x1205" , }, {}, };MODULE_DEVICE_TABLE (of, x1205_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/277 rtc: optee: fix memory leak on driver removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
Fix a memory leak in case of driver removal.
Free the shared memory used for arguments exchanges between kernel and OP-TEE RTC PTA.
--- drivers/rtc/rtc-optee.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-optee.c +1 -0
@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) {struct optee_rtc *priv =dev_get_drvdata (dev); +tee_shm_free (priv->shm);tee_client_close_session (priv->ctx, priv->session_id);tee_client_close_context (priv->ctx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/277 perf arm_spe: Correct setting remote access
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
Set the mem_remote field for a remote access to appropriately represent the event.
--- tools/perf/util/arm-spe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/arm-spe.c +1 -1
@@ -514,7 +514,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco }if (record->type &ARM_SPE_REMOTE_ACCESS ) - data_src->mem_lvl |=PERF_MEM_LVL_REM_CCE1 ; + data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; }static u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/277 perf arm-spe: Rename the common data source encoding
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
The Neoverse CPUs follow the common data source encoding, and other CPU variants can share the same format.
Rename the CPU list and data source definitions as common data source names. This change prepares for appending more CPU variants.
Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
--- .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ tools/perf/util/arm-spe.c | 28 +++++++++---------- 2 files changed, 23 insertions(+), 23 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +9 -9
@@ -56,15 +56,15 @@ enum arm_spe_op_type { ARM_SPE_OP_BR_INDIRECT = 1 << 17, }; -enum arm_spe_neoverse_data_source { -ARM_SPE_NV_L1D =0x0 , -ARM_SPE_NV_L2 =0x8 , -ARM_SPE_NV_PEER_CORE =0x9 , -ARM_SPE_NV_LOCAL_CLUSTER =0xa , -ARM_SPE_NV_SYS_CACHE =0xb , -ARM_SPE_NV_PEER_CLUSTER =0xc , -ARM_SPE_NV_REMOTE =0xd , -ARM_SPE_NV_DRAM =0xe , +enum arm_spe_common_data_source { +ARM_SPE_COMMON_DS_L1D =0x0 , +ARM_SPE_COMMON_DS_L2 =0x8 , +ARM_SPE_COMMON_DS_PEER_CORE =0x9 , +ARM_SPE_COMMON_DS_LOCAL_CLUSTER =0xa , +ARM_SPE_COMMON_DS_SYS_CACHE =0xb , +ARM_SPE_COMMON_DS_PEER_CLUSTER =0xc , +ARM_SPE_COMMON_DS_REMOTE =0xd , +ARM_SPE_COMMON_DS_DRAM =0xe , };struct arm_spe_record {
tools/perf/util/arm-spe.c +14 -14
@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq,return arm_spe_deliver_synth_event (spe, speq, event, &sample); } -static const struct midr_range neoverse_spe[] = { +static const struct midr_range common_ds_encoding_cpus[] = {MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N1 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N2 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V1 ), {}, }; -static void arm_spe__synth_data_source_neoverse (const struct arm_spe_record *record, -union perf_mem_data_src *data_src) +static void arm_spe__synth_data_source_common (const struct arm_spe_record *record, +union perf_mem_data_src *data_src) {/* * Even though four levels of cache hierarchy are possible, no known
@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec }switch (record->source) { -case ARM_SPE_NV_L1D : +case ARM_SPE_COMMON_DS_L1D : data_src->mem_lvl =PERF_MEM_LVL_L1 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L1 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_L2 : +case ARM_SPE_COMMON_DS_L2 : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_PEER_CORE : +case ARM_SPE_COMMON_DS_PEER_CORE : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know if this is L1, L2 but we do know it was a cache-2-cache * transfer, so set SNOOPX_PEER */ -case ARM_SPE_NV_LOCAL_CLUSTER : -case ARM_SPE_NV_PEER_CLUSTER : +case ARM_SPE_COMMON_DS_LOCAL_CLUSTER : +case ARM_SPE_COMMON_DS_PEER_CLUSTER : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec/* * System cache is assumed to be L3 */ -case ARM_SPE_NV_SYS_CACHE : +case ARM_SPE_COMMON_DS_SYS_CACHE : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoop =PERF_MEM_SNOOP_HIT ;
@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know what level it hit in, except it came from the other * socket */ -case ARM_SPE_NV_REMOTE : +case ARM_SPE_COMMON_DS_REMOTE : data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ; -case ARM_SPE_NV_DRAM : +case ARM_SPE_COMMON_DS_DRAM : data_src->mem_lvl =PERF_MEM_LVL_LOC_RAM |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_RAM ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;
@@ -520,7 +520,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *recostatic u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr) {union perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA }; -bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe); +bool is_common =is_midr_in_range_list (midr, common_ds_encoding_cpus);/* Only synthesize data source for LDST operations */ if (!is_ldst_op (record->op))
@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 melse return 0 ; -if (is_neoverse) -arm_spe__synth_data_source_neoverse (record, &data_src); +if (is_common) +arm_spe__synth_data_source_common (record, &data_src);else arm_spe__synth_data_source_generic (record, &data_src);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/277 perf arm_spe: Correct memory level for remote access
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
For remote accesses, the data source packet does not contain information about the memory level. To avoid misinformation, set the memory level to NA (Not Available).
--- tools/perf/util/arm-spe.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/arm-spe.c +2 -2
@@ -479,8 +479,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor* socket */ case ARM_SPE_COMMON_DS_REMOTE : - data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; - data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; + data_src->mem_lvl =PERF_MEM_LVL_NA ; + data_src->mem_lvl_num =PERF_MEM_LVLNUM_NA ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/277 perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilkka Koskinen <[email protected]>
[ Upstream commit 97996580da08f06f8b09a86f3384ed9fa7a52e32 ]
Add missing 'h' to l1d_cache_access_prefetces
Also fix a couple of typos and use consistent term in brief descriptions
--- .../arch/arm64/ampere/ampereonex/metrics.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json +5 -5
@@ -113,7 +113,7 @@ { "MetricName": "load_store_spec_rate", "MetricExpr": "LDST_SPEC / INST_SPEC", - "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speclatively executed", + "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speculatively executed", "MetricGroup": "Operation_Mix", "ScaleUnit": "100percent of operations" },
@@ -132,7 +132,7 @@ { "MetricName": "pc_write_spec_rate", "MetricExpr": "PC_WRITE_SPEC / INST_SPEC", - "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speclatively executed", + "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speculatively executed", "MetricGroup": "Operation_Mix", "ScaleUnit": "100percent of operations" },
@@ -195,14 +195,14 @@ { "MetricName": "stall_frontend_cache_rate", "MetricExpr": "STALL_FRONTEND_CACHE / CPU_CYCLES", - "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and cache miss", + "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and cache miss", "MetricGroup": "Stall", "ScaleUnit": "100percent of cycles" }, { "MetricName": "stall_frontend_tlb_rate", "MetricExpr": "STALL_FRONTEND_TLB / CPU_CYCLES", - "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and TLB miss", + "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and TLB miss", "MetricGroup": "Stall", "ScaleUnit": "100percent of cycles" },
@@ -391,7 +391,7 @@ "ScaleUnit": "100percent of cache acceses" }, { - "MetricName": "l1d_cache_access_prefetces", + "MetricName": "l1d_cache_access_prefetches", "MetricExpr": "L1D_CACHE_PRFM / L1D_CACHE", "BriefDescription": "L1D cache access - prefetch", "MetricGroup": "Cache",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/277 perf test: Update sysfs path for core PMU caps
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit b9228817127430356c929847f111197776201225 ]
While CPU is a system device, it'd be better to use a path for event_source devices when it checks PMU capability.
Stable-dep-of: 48314d20fe46 ("perf test shell lbr: Avoid failures with perf event paranoia")
--- tools/perf/tests/shell/record_lbr.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/perf/tests/shell/record_lbr.sh +2 -1
@@ -4,7 +4,8 @@ set -e -if [ ! -f /sys/devices/cpu/caps/branches ] && [ ! -f /sys/devices/cpu_core/caps/branches ] +if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] && + [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ] then echo "Skip: only x86 CPUs support LBR" exit 2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/277 perf test shell lbr: Avoid failures with perf event paranoia
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 48314d20fe467d6653783cbf5536cb2fcc9bdd7c ]
When not running as root and with higher perf event paranoia values the perf record LBR tests could fail rather than skipping the problematic tests.
Add the sensitivity to the test and confirm it passes with paranoia values from -1 to 2.
Committer testing:
Testing with '$ perf test -vv lbr', i.e. as non root, and then comparing the output shows the mentioned errors before this patch:
acme@x1:~$ grep -m1 "model name" /proc/cpuinfo model name : 13th Gen Intel(R) Core(TM) i7-1365U acme@x1:~$
Before:
132: perf record LBR tests : Skip
After:
132: perf record LBR tests : Ok
--- tools/perf/tests/shell/record_lbr.sh | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-)
tools/perf/tests/shell/record_lbr.sh +20 -6
@@ -4,6 +4,10 @@ set -e +ParanoidAndNotRoot() { + [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ] +} + if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] && [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ] then
@@ -23,6 +27,7 @@ cleanup() { } trap_cleanup() { + echo "Unexpected signal in ${FUNCNAME[1]}" cleanup exit 1 }
@@ -123,8 +128,11 @@ lbr_test "-j ind_call" "any indirect call" 2 lbr_test "-j ind_jmp" "any indirect jump" 100 lbr_test "-j call" "direct calls" 2 lbr_test "-j ind_call,u" "any indirect user call" 100 -lbr_test "-a -b" "system wide any branch" 2 -lbr_test "-a -j any_call" "system wide any call" 2 +if ! ParanoidAndNotRoot 1 +then + lbr_test "-a -b" "system wide any branch" 2 + lbr_test "-a -j any_call" "system wide any call" 2 +fi # Parallel parallel_lbr_test "-b" "parallel any branch" 100 &
@@ -141,10 +149,16 @@ parallel_lbr_test "-j call" "parallel direct calls" 100 & pid6=$! parallel_lbr_test "-j ind_call,u" "parallel any indirect user call" 100 & pid7=$! -parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & -pid8=$! -parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & -pid9=$! +if ParanoidAndNotRoot 1 +then + pid8= + pid9= +else + parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & + pid8=$! + parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & + pid9=$! +fi for pid in $pid1 $pid2 $pid3 $pid4 $pid5 $pid6 $pid7 $pid8 $pid9 do
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/277 perf session: Fix handling when buffer exceeds 2 GiB
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative.
As a result, the perf record command reports an error:
0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly.
--- tools/perf/util/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/session.c +1 -1
@@ -1371,7 +1371,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,const struct perf_tool *tool = session->tool;struct perf_sample sample = { .time =0 , };int fd =perf_data__fd (session->data); -int err; +s64 err;if (event->header.type !=PERF_RECORD_COMPRESSED ||perf_tool__compressed_is_stub (tool))dump_event (session->evlist, event, file_offset, &sample, file_path);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/277 perf test: Dont leak workload gopipe in PERF_RECORD_*
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
The test starts a workload and then opens events. If the events fail to open, for example because of perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.
Before:
```
$ perf test -vv 7
7: PERF_RECORD_* events & perf_sample fields:
--- start ---
test child forked, pid 1189568
Using CPUID GenuineIntel-6-B7-1
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
Attempt to add: software/cpu-clock/
..after resolving event: software/config=0/
cpu-clock -> software/cpu-clock/
------------------------------------------------------------
perf_event_attr:
type 1 (PERF_TYPE_SOFTWARE)
size 136
config 0x9 (PERF_COUNT_SW_DUMMY)
sample_type IP|TID|TIME|CPU
read_format ID|LOST
disabled 1
inherit 1
mmap 1
comm 1
enable_on_exec 1
task 1
sample_id_all 1
mmap2 1
comm_exec 1
ksymbol 1
bpf_event 1
{ wakeup_events, wakeup_watermark } 1
------------------------------------------------------------
sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
perf_evlist__open: Permission denied
---- end(-2) ----
Leak of file descriptor 6 that opened: 'pipe:[14200347]'
---- unexpected signal (6) ----
iFailed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
#0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
#1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
#2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
#3 0x7f29ce849cc2 in raise raise.c:27
#4 0x7f29ce8324ac in abort abort.c:81
#5 0x565358f662d4 in check_leaks builtin-test.c:226
#6 0x565358f6682e in run_test_child builtin-test.c:344
#7 0x565358ef7121 in start_command run-command.c:128
#8 0x565358f67273 in start_test builtin-test.c:545
#9 0x565358f6771d in __cmd_test builtin-test.c:647
#10 0x565358f682bd in cmd_test builtin-test.c:849
#11 0x565358ee5ded in run_builtin perf.c:349
#12 0x565358ee6085 in handle_internal_command perf.c:401
#13 0x565358ee61de in run_argv perf.c:448
#14 0x565358ee6527 in main perf.c:555
#15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
#16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
#17 0x565358e391c1 in _start perf[851c1]
7: PERF_RECORD_* events & perf_sample fields : FAILED!
```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```
--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/perf/tests/perf-record.c +4 -0
@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/277 perf test: Add a test for default perf stat command
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 65d11821910bd910a2b4b5b005360d036c76ecef ]
Test that one cycles event is opened for each core PMU when "perf stat" is run without arguments.
The event line can either be output as "pmu/cycles/" or just "cycles" if there is only one PMU. Include 2 spaces for padding in the one PMU case to avoid matching when the word cycles is included in metric descriptions.
Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
--- tools/perf/tests/shell/stat.sh | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
tools/perf/tests/shell/stat.sh +25 -0
@@ -146,6 +146,30 @@ test_cputype() { echo "cputype test [Success]" } +test_hybrid() { + # Test the default stat command on hybrid devices opens one cycles event for + # each CPU type. + echo "hybrid test" + + # Count the number of core PMUs, assume minimum of 1 + pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l) + if [ "$pmus" -lt 1 ] + then + pmus=1 + fi + + # Run default Perf stat + cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) + + if [ "$pmus" -ne "$cycles_events" ] + then + echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]" + err=1 + return + fi + echo "hybrid test [Success]" +} + test_default_stat test_stat_record_report test_stat_record_script
@@ -153,4 +177,5 @@ test_stat_repeat_weak_groups test_topdown_groups test_topdown_weak_groups test_cputype +test_hybrid exit $err
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/277 perf tools: Add fallback for exclude_guest
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit bb6e7cb11d97ce1957894d30d13bfad3e8bfefe9 ]
Commit 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default") changed to parse "cycles:P" event instead of creating a new cycles event for perf record. But it also changed the way how modifiers are handled so it doesn't set the exclude_guest bit by default.
It seems Apple M1 PMU requires exclude_guest set and returns EOPNOTSUPP if not. Let's add a fallback so that it can work with default events.
Also update perf stat hybrid tests to handle possible u or H modifiers.
Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
--- tools/perf/builtin-stat.c | 18 +++++++++++++++--- tools/perf/tests/shell/stat.sh | 2 +- tools/perf/util/evsel.c | 21 +++++++++++++++++++++ 3 files changed, 37 insertions(+), 4 deletions(-)
tools/perf/builtin-stat.c +15 -3
@@ -639,8 +639,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)* (behavior changed with commit b0a873e). */ if (errno ==EINVAL || errno ==ENOSYS || - errno ==ENOENT || errno ==EOPNOTSUPP || - errno ==ENXIO ) { + errno ==ENOENT || errno ==ENXIO ) {if (verbose >0 )ui__warning ("%s event is not supported by the kernel.\n" ,evsel__name (counter));
@@ -658,7 +657,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)if (verbose >0 )ui__warning ("%s\n" , msg);return COUNTER_RETRY ; - }else if (target__has_per_thread (&target) && + }else if (target__has_per_thread (&target) && errno !=EOPNOTSUPP && evsel_list->core.threads && evsel_list->core.threads->err_thread !=-1 ) {/*
@@ -679,6 +678,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)return COUNTER_SKIP ; } +if (errno ==EOPNOTSUPP ) { +if (verbose >0 ) { +ui__warning ("%s event is not supported by the kernel.\n" , +evsel__name (counter)); + } + counter->supported = false; + counter->errored = true; + +if ((evsel__leader (counter) != counter) || + !(counter->core.leader->nr_members >1 )) +return COUNTER_SKIP ; + } +evsel__open_strerror (counter, &target, errno, msg,sizeof (msg));ui__error ("%s\n" , msg);
tools/perf/tests/shell/stat.sh +1 -1
@@ -159,7 +159,7 @@ test_hybrid() { fi # Run default Perf stat - cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l) + cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) if [ "$pmus" -ne "$cycles_events" ] then
tools/perf/util/evsel.c +21 -0
@@ -3255,6 +3255,27 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, evsel->core.attr.exclude_kernel =1 ; evsel->core.attr.exclude_hv =1 ; +return true; + }else if (err ==EOPNOTSUPP && !evsel->core.attr.exclude_guest && + !evsel->exclude_GH) { +const char *name =evsel__name (evsel); +char *new_name; +const char *sep =":" ; + +/* Is there already the separator in the name. */ +if (strchr (name,'/' ) || + (strchr (name,':' ) && !evsel->is_libpfm_event)) + sep ="" ; + +if (asprintf (&new_name,"%s%sH" , name, sep) <0 ) +return false; + +free (evsel->name); + evsel->name = new_name; +/* Apple M1 requires exclude_guest */ +scnprintf (msg, msgsize,"trying to fall back to excluding guest samples" ); + evsel->core.attr.exclude_guest =1 ; +return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/277 perf evsel: Ensure the fallback message is always written to
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ]
The fallback message is unconditionally printed in places like record__open().
If no fallback is attempted this can lead to printing uninitialized data, crashes, etc.
--- tools/perf/util/evsel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/perf/util/evsel.c +7 -5
@@ -3237,7 +3237,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,/* If event has exclude user then don't exclude kernel. */ if (evsel->core.attr.exclude_user) -return false; + goto no_fallback;/* Is there already the separator in the name. */ if (strchr(name, '/') ||
@@ -3245,7 +3245,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, sep ="" ;if (asprintf (&new_name,"%s%su" , name, sep) <0 ) -return false; + goto no_fallback;free (evsel->name); evsel->name = new_name;
@@ -3268,17 +3268,19 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, sep ="" ;if (asprintf (&new_name,"%s%sH" , name, sep) <0 ) -return false; + goto no_fallback;free (evsel->name); evsel->name = new_name;/* Apple M1 requires exclude_guest */ -scnprintf (msg, msgsize,"trying to fall back to excluding guest samples" ); +scnprintf (msg, msgsize,"Trying to fall back to excluding guest samples" ); evsel->core.attr.exclude_guest =1 ;return true; } - +no_fallback: +scnprintf (msg, msgsize,"No fallback found for '%s' for error %d" , +evsel__name (evsel), err);return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/277 clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
The infrastructure gate for the HDMI specific crystal needs the top_hdmi_xtal clock to be configured in order to ungate the 26m clock to the HDMI IP, and it wouldn't work without.
Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
--- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/mediatek/clk-mt8195-infra_ao.c +1 -1
@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {GATE_INFRA_AO0 (CLK_INFRA_AO_CQ_DMA_FPC ,"infra_ao_cq_dma_fpc" ,"fpc" ,28 ),GATE_INFRA_AO0 (CLK_INFRA_AO_UART5 ,"infra_ao_uart5" ,"top_uart" ,29 ),/* INFRA_AO1 */ -GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"clk26m" ,0 ), +GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"top_hdmi_xtal" ,0 ),GATE_INFRA_AO1 (CLK_INFRA_AO_SPI0 ,"infra_ao_spi0" ,"top_spi" ,1 ),GATE_INFRA_AO1 (CLK_INFRA_AO_MSDC0 ,"infra_ao_msdc0" ,"top_msdc50_0_hclk" ,2 ), GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/277 clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
The flags in |struct mtk_mux| are core clk flags, not mux clk flags. Passing one to the other is wrong.
Since there aren't any actual users adding CLK_MUX_* flags, just drop it for now.
--- drivers/clk/mediatek/clk-mux.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/clk/mediatek/clk-mux.c +1 -3
@@ -146,9 +146,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)static int mtk_clk_mux_determine_rate (struct clk_hw *hw,struct clk_rate_request *req) { -struct mtk_clk_mux *mux =to_mtk_clk_mux (hw); - -return clk_mux_determine_rate_flags (hw, req, mux->data->flags); +return clk_mux_determine_rate_flags (hw, req,0 ); }const struct clk_ops mtk_mux_clr_set_upd_ops = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/277 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series.
Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +9 -7
@@ -370,23 +370,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,return 0 ; } -static long lpc18xx_pll0_round_rate (struct clk_hw *hw,unsigned long rate, -unsigned long *prate) +static int lpc18xx_pll0_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) {unsigned long m; -if (*prate < rate) { +if (req->best_parent_rate < req->rate) {pr_warn ("%s: pll dividers not supported\n" , __func__);return -EINVAL ; } - m =DIV_ROUND_UP_ULL (*prate, rate *2 ); + m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 );if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { -pr_warn ("%s: unable to support rate %lu\n" , __func__, rate); +pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; } -return 2 * *prate * m; + req->rate =2 * req->best_parent_rate * m; + +return 0 ; } static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
@@ -443,7 +445,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,static const struct clk_ops lpc18xx_pll0_ops = { .recalc_rate = lpc18xx_pll0_recalc_rate, - .round_rate = lpc18xx_pll0_round_rate, + .determine_rate = lpc18xx_pll0_determine_rate, .set_rate = lpc18xx_pll0_set_rate, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/277 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
This ensures proper bounds checking during clk rate setting and rounding.
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +2 -2
@@ -381,7 +381,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, } m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; }
@@ -404,7 +404,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, } m =DIV_ROUND_UP_ULL (parent_rate, rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, rate);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/277 clk: tegra: do not overallocate memory for bpmp clocks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
struct tegra_bpmp::clocks is a pointer to a dynamically allocated array of pointers to 'struct tegra_bpmp_clk'.
But the size of the allocated area is calculated like it is an array containing actual 'struct tegra_bpmp_clk' objects - it's not true, there are just pointers.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
--- drivers/clk/tegra/clk-bpmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/tegra/clk-bpmp.c +1 -1
@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, bpmp->num_clocks = count; - bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (struct tegra_bpmp_clk ),GFP_KERNEL ); + bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (*bpmp->clocks),GFP_KERNEL );if (!bpmp->clocks)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/277 cpufreq: tegra186: Set target frequency for all cpus in policy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
The original commit set all cores in a cluster to a shared policy, but did not update set_target to apply a frequency change to all cores for the policy. This caused most cores to remain stuck at their boot frequency.
--- drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/cpufreq/tegra186-cpufreq.c +6 -2
@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, {struct tegra186_cpufreq_data *data =cpufreq_get_driver_data ();struct cpufreq_frequency_table *tbl = policy->freq_table + index; -unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; +unsigned int edvd_offset;u32 edvd_val = tbl->driver_data; +u32 cpu; -writel (edvd_val, data->regs + edvd_offset); +for_each_cpu (cpu, policy->cpus) { + edvd_offset = data->cpus[cpu].edvd_offset; +writel (edvd_val, data->regs + edvd_offset); + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/277 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
mvs_pci_remove() |
mvs_free() | mvs_work_queue()
cancel_delayed_work() |
kfree(mvi) |
| mvi-> // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.
This bug was found by static analysis.
--- drivers/scsi/mvsas/mv_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mvsas/mv_init.c +1 -1
@@ -124,7 +124,7 @@ static void mvs_free(struct mvs_info *mvi)if (mvi->shost)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry) -cancel_delayed_work (&mwq->work_q); +cancel_delayed_work_sync (&mwq->work_q);kfree (mvi->rsvd_tags);kfree (mvi); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/277 ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ]
The firmware has changed the minimum host buffer size from 2 periods to 4 periods (1 period is 1ms) which was missed by the kernel side.
Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware.
--- sound/soc/sof/ipc4-topology.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/sof/ipc4-topology.h +2 -2
@@ -60,8 +60,8 @@#define SOF_IPC4_INVALID_NODE_ID 0xffffffff -/* FW requires minimum 2ms DMA buffer size */ -#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 +/* FW requires minimum 4ms DMA buffer size */ +#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4/* * The base of multi-gateways. Multi-gateways addressing starts from
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/277 ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a ]
For ChainDMA the firmware allocates 5ms host buffer instead of the standard 4ms which should be taken into account when setting the constraint on the buffer size.
--- sound/soc/sof/ipc4-topology.c | 9 +++++++-- sound/soc/sof/ipc4-topology.h | 3 +++ 2 files changed, 10 insertions(+), 2 deletions(-)
sound/soc/sof/ipc4-topology.c +7 -2
@@ -519,8 +519,13 @@ static int sof_ipc4_widget_setup_pcm(struct snd_sof_widget *swidget) swidget->tuples, swidget->num_tuples, sizeof(u32), 1);/* Set default DMA buffer size if it is not specified in topology */ -if (!sps->dsp_max_burst_size_in_ms) - sps->dsp_max_burst_size_in_ms =SOF_IPC4_MIN_DMA_BUFFER_SIZE ; +if (!sps->dsp_max_burst_size_in_ms) { +struct snd_sof_widget *pipe_widget = swidget->spipe->pipe_widget; +struct sof_ipc4_pipeline *pipeline = pipe_widget->private; + + sps->dsp_max_burst_size_in_ms = pipeline->use_chain_dma ? +SOF_IPC4_CHAIN_DMA_BUFFER_SIZE :SOF_IPC4_MIN_DMA_BUFFER_SIZE ; + } }else {/* Capture data is copied from DSP to host in 1ms bursts */ spcm->stream[dir].dsp_max_burst_size_in_ms =1 ;
sound/soc/sof/ipc4-topology.h +3 -0
@@ -63,6 +63,9 @@/* FW requires minimum 4ms DMA buffer size */ #define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 +/* ChainDMA in fw uses 5ms DMA buffer */ +#define SOF_IPC4_CHAIN_DMA_BUFFER_SIZE 5 +/* * The base of multi-gateways. Multi-gateways addressing starts from * ALH_MULTI_GTW_BASE and there are ALH_MULTI_GTW_COUNT multi-sources
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/277 ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a ]
Instead of constraining the ALSA buffer time to be double of the firmware host buffer size, it is better to set it for the period time. This will implicitly constrain the buffer time to a safe value (num_periods is at least 2) and prohibits applications to set smaller period size than what will be covered by the initial DMA burst.
--- sound/soc/sof/intel/hda-pcm.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
sound/soc/sof/intel/hda-pcm.c +21 -8
@@ -29,6 +29,8 @@#define SDnFMT_BITS (x) ((x) << 4)#define SDnFMT_CHAN (x) ((x) << 0) +#define HDA_MAX_PERIOD_TIME_HEADROOM 10 +static bool hda_always_enable_dmi_l1;module_param_named (always_enable_dmi_l1, hda_always_enable_dmi_l1, bool,0444 );MODULE_PARM_DESC (always_enable_dmi_l1,"SOF HDA always enable DMI l1" );
@@ -276,19 +278,30 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev,* On playback start the DMA will transfer dsp_max_burst_size_in_ms * amount of data in one initial burst to fill up the host DMA buffer. * Consequent DMA burst sizes are shorter and their length can vary. -* To make sure that userspace allocate large enough ALSA buffer we need -* to place a constraint on the buffer time. +* To avoid immediate xrun by the initial burst we need to place +* constraint on the period size (via PERIOD_TIME) to cover the size of +* the host buffer. +* We need to add headroom of max 10ms as the firmware needs time to +* settle to the 1ms pacing and initially it can run faster for few +* internal periods. * * On capture the DMA will transfer 1ms chunks. -* -* Exact dsp_max_burst_size_in_ms constraint is racy, so set the -* constraint to a minimum of 2x dsp_max_burst_size_in_ms. */ -if (spcm->stream[direction].dsp_max_burst_size_in_ms) +if (spcm->stream[direction].dsp_max_burst_size_in_ms) { +unsigned int period_time = spcm->stream[direction].dsp_max_burst_size_in_ms; + +/* +* add headroom over the maximum burst size to cover the time +* needed for the DMA pace to settle. +* Limit the headroom time to HDA_MAX_PERIOD_TIME_HEADROOM +*/ + period_time +=min (period_time,HDA_MAX_PERIOD_TIME_HEADROOM ); +snd_pcm_hw_constraint_minmax (substream->runtime, -SNDRV_PCM_HW_PARAM_BUFFER_TIME , - spcm->stream[direction].dsp_max_burst_size_in_ms *USEC_PER_MSEC *2 , +SNDRV_PCM_HW_PARAM_PERIOD_TIME , + period_time *USEC_PER_MSEC ,UINT_MAX ); + }/* binding pcm substream to hda stream */ substream->runtime->private_data = &dsp_stream->hstream;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/277 LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit abb2a5572264b425e6dd9c213b735a82ab0ca68a ]
Currently, when compiling with GCC, there is no "break 7" instruction for zero division due to using the option -mno-check-zero-division, but the compiler still generates "break 0" instruction for zero division.
Here is a simple example:
$ cat test.c
int div(int a)
{
return a / 0;
}
$ gcc -O2 -S test.c -o test.sGCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes "ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the objtool warnings for LoongArch, but this is not the intention.
When decoding "break 0" as INSN_TRAP in the previous commit, the aim is to handle "break 0" as a trap. The generated "break 0" for zero division by GCC is not proper, it should generate a break instruction with proper bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference to avoid generating the unexpected "break 0" instruction for now.
--- arch/loongarch/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/Makefile +1 -1
@@ -114,7 +114,7 @@ KBUILD_RUSTFLAGS_KERNEL += -Crelocation-model=pie LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext $(call ld-option, --apply-dynamic-relocs) endif -cflags-y += $(call cc-option, -mno-check-zero-division) +cflags-y += $(call cc-option, -mno-check-zero-division -fno-isolate-erroneous-paths-dereference) ifndef CONFIG_KASAN cflags-y += -fno-builtin-memcpy -fno-builtin-memmove -fno-builtin-memset
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/277 LoongArch: Init acpi_gbl_use_global_lock to false
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
Init acpi_gbl_use_global_lock to false, in order to void error messages during boot phase:
ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
--- arch/loongarch/kernel/setup.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/kernel/setup.c +1 -0
@@ -354,6 +354,7 @@ void __init platform_init(void)#ifdef CONFIG_ACPI acpi_table_upgrade (); + acpi_gbl_use_global_lock = false; acpi_gbl_use_default_register_widths = false;acpi_boot_table_init ();#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/277 ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 ]
It is allowed to mix Link and Host DMA channels in a way that their index is different. In this case we would read the LLP from a channel which is not used or used for other operation.
Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire configuration:
playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA used
Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and Link channel 0 (stream_tag 1).
In this case reading the LLP from channel 2 is incorrect as that is not the Link channel used for the HDMI playback.
To correct this, we should look up the BE and get the channel used on the Link side.
--- sound/soc/sof/intel/hda-stream.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-)
sound/soc/sof/intel/hda-stream.c +27 -2
@@ -1103,10 +1103,35 @@ u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev,struct snd_soc_component *component, struct snd_pcm_substream *substream) { - struct hdac_stream *hstream = substream->runtime->private_data; -struct hdac_ext_stream *hext_stream =stream_to_hdac_ext_stream (hstream); + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); +struct snd_soc_pcm_runtime *be_rtd =NULL ; +struct hdac_ext_stream *hext_stream; +struct snd_soc_dai *cpu_dai; +struct snd_soc_dpcm *dpcm;u32 llp_l, llp_u; +/* +* The LLP needs to be read from the Link DMA used for this FE as it is +* allowed to use any combination of Link and Host channels +*/ +for_each_dpcm_be (rtd, substream->stream, dpcm) { +if (dpcm->fe != rtd) +continue ; + + be_rtd = dpcm->be; + } + +if (!be_rtd) +return 0 ; + + cpu_dai =snd_soc_rtd_to_cpu (be_rtd,0 ); +if (!cpu_dai) +return 0 ; + + hext_stream =snd_soc_dai_get_dma_data (cpu_dai, substream); +if (!hext_stream) +return 0 ; +/* * The pplc_addr have been calculated during probe in * hda_dsp_stream_init():
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/277 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,mlx4_unregister_mac (mdev->dev, priv->port, mac);hlist_del_rcu (&entry->hlist); -kfree_rcu (entry, rcu);en_dbg (DRV , priv,"Removed MAC %pM on port:%d\n" , entry->mac, priv->port); +kfree_rcu (entry, rcu); ++removed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/277 drm/xe/hw_engine_group: Fix double write lock release in error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d ]
In xe_hw_engine_group_get_mode(), a write lock is acquired before calling switch_mode(), which in turn invokes xe_hw_engine_group_suspend_faulting_lr_jobs().
On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(), the write lock is released there, and then again in xe_hw_engine_group_get_mode(), leading to a double release.
Fix this by keeping both acquire and release operation in xe_hw_engine_group_get_mode().
--- drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/gpu/drm/xe/xe_hw_engine_group.c +1 -5
@@ -237,17 +237,13 @@ static int xe_hw_engine_group_suspend_faulting_lr_jobs(struct xe_hw_engine_group err = q->ops->suspend_wait (q);if (err) - goto err_suspend; +return err; }if (need_resume)xe_hw_engine_group_resume_faulting_lr_jobs (group);return 0 ; - -err_suspend: -up_write (&group->mode_sem); -return err; }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/277 s390/cio: Update purge function to unregister the unused subchannels
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")', cio no longer unregisters subchannels when the attached device is invalid or unavailable.
As an unintended side-effect, the cio_ignore purge function no longer removes subchannels for devices on the cio_ignore list if no CCW device is attached. This situation occurs when a CCW device is non-operational or unavailable
To ensure the same outcome of the purge function as when the current cio_ignore list had been active during boot, update the purge function to remove I/O subchannels without working CCW devices if the associated device number is found on the cio_ignore list.
--- drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
drivers/s390/cio/device.c +24 -13
@@ -1318,23 +1318,34 @@ void ccw_device_schedule_recovery(void)spin_unlock_irqrestore (&recovery_lock, flags); } -static int purge_fn (struct device *dev,void *data) +static int purge_fn (struct subchannel *sch,void *data) { -struct ccw_device *cdev =to_ccwdev (dev); -struct ccw_dev_id *id = &cdev->private->dev_id; -struct subchannel *sch =to_subchannel (cdev->dev.parent); +struct ccw_device *cdev; -spin_lock_irq (cdev->ccwlock); -if (is_blacklisted (id->ssid, id->devno) && - (cdev->private->state ==DEV_STATE_OFFLINE ) && - (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) ==0 )) { -CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x\n" , id->ssid, - id->devno); +spin_lock_irq (&sch->lock); +if (sch->st !=SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) + goto unlock; + +if (!is_blacklisted (sch->schid.ssid, sch->schib.pmcw.dev)) + goto unlock; + + cdev =sch_get_cdev (sch); +if (cdev) { +if (cdev->private->state !=DEV_STATE_OFFLINE ) + goto unlock; + +if (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) !=0 ) + goto unlock;ccw_device_sched_todo (cdev,CDEV_TODO_UNREG ); -css_sched_sch_todo (sch,SCH_TODO_UNREG );atomic_set (&cdev->private->onoff,0 ); } -spin_unlock_irq (cdev->ccwlock); + +css_sched_sch_todo (sch,SCH_TODO_UNREG ); +CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x%s\n" , sch->schid.ssid, + sch->schib.pmcw.dev, cdev ?"" :" (no cdev)" ); + +unlock: +spin_unlock_irq (&sch->lock);/* Abort loop in case of pending signal. */ if (signal_pending (current))return -EINTR ;
@@ -1350,7 +1361,7 @@ static int purge_fn(struct device *dev, void *data)int ccw_purge_blacklisted (void ) {CIO_MSG_EVENT (2 ,"ccw: purging blacklisted devices\n" ); -bus_for_each_dev (&ccw_bus_type,NULL ,NULL , purge_fn); +for_each_subchannel_staged (purge_fn,NULL ,NULL );return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/277 drm/vmwgfx: Fix a null-ptr access in the cursor snooper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ]
Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it.
vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it.
Fixes unchecked null-ptr reference in the snooping code.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +12 -5
@@ -1515,6 +1515,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, SVGA3dCmdHeader *header) {struct vmw_bo *vmw_bo =NULL ; +struct vmw_resource *res;struct vmw_surface *srf =NULL ;VMW_DECLARE_CMD_VAR (*cmd, SVGA3dCmdSurfaceDMA);int ret;
@@ -1550,18 +1551,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, dirty = (cmd->body.transfer ==SVGA3D_WRITE_HOST_VRAM ) ?VMW_RES_DIRTY_SET :0 ; - ret =vmw_cmd_res_check (dev_priv, sw_context, vmw_res_surface, - dirty, user_surface_converter, - &cmd->body.host.sid,NULL ); + ret =vmw_cmd_res_check (dev_priv, sw_context, vmw_res_surface, dirty, + user_surface_converter, &cmd->body.host.sid, +NULL );if (unlikely (ret !=0 )) {if (unlikely (ret != -ERESTARTSYS ))VMW_DEBUG_USER ("could not find surface for DMA.\n" );return ret; } - srf =vmw_res_to_srf (sw_context->res_cache[vmw_res_surface].res); + res = sw_context->res_cache[vmw_res_surface].res; +if (!res) { +VMW_DEBUG_USER ("Invalid DMA surface.\n" ); +return -EINVAL ; + } -vmw_kms_cursor_snoop (srf, sw_context->fp->tfile, &vmw_bo->tbo, header); + srf =vmw_res_to_srf (res); +vmw_kms_cursor_snoop (srf, sw_context->fp->tfile, &vmw_bo->tbo, + header);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/277 drm/vmwgfx: Fix Use-after-free in validation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +3 -1
@@ -309,8 +309,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,hash_add_rcu (ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res =vmw_resource_reference_unless_doomed (res); -if (!node->res) +if (!node->res) { +hash_del_rcu (&node->hash.head);return -ESRCH ; + } node->first_usage =1 ;if (!res->dev_priv->has_mob) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/277 drm/vmwgfx: Fix copy-paste typo in validation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
'entry' should be 'val' which is the loop iterator.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +1 -1
@@ -639,7 +639,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)hash_del_rcu (&val->hash.head);list_for_each_entry (val, &ctx->resource_ctx_list, head) -hash_del_rcu (&entry->hash.head); +hash_del_rcu (&val->hash.head); ctx->sw_context =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/277 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandr Sapozhnikov <[email protected]>
[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
--- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sm_statefuns.c +2 -1
@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,return SCTP_DISPOSITION_CONSUME ; nomem_authev: -sctp_ulpevent_free (ai_ev); +if (ai_ev) +sctp_ulpevent_free (ai_ev); nomem_aiev:sctp_ulpevent_free (ev); nomem_ev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/277 tcp: Dont call reqsk_fastopen_remove() in tcp_conn_request().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]:refcount_t: underflow; use-after-free.
WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
--- net/ipv4/tcp_input.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/tcp_input.c +0 -1
@@ -7338,7 +7338,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, &foc, TCP_SYNACK_FASTOPEN, skb);/* Add the child socket directly into the accept queue */ if (!inet_csk_reqsk_queue_add (sk, req, fastopen_sk)) { -reqsk_fastopen_remove (fastopen_sk, req, false);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk); goto drop_and_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/277 net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 ]
The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cancel_delayed_work() may fail to cancel the work item if it is already executing. While destroy_workqueue() does wait for all pending work items in the work queue to complete before destroying the work queue, it cannot prevent the delayed work item from being rescheduled within the ocelot_check_stats_work() function. This limitation exists because the delayed work item is only enqueued into the work queue after its timer expires. Before the timer expiration, destroy_workqueue() has no visibility of this pending work item. Once the work queue appears empty, destroy_workqueue() proceeds with destruction. When the timer eventually expires, the delayed work item gets queued again, leading to the following warning:
workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats
WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0 ... RIP: 0010:__queue_work+0x875/0xaf0 ... RSP: 0018:ffff88806d108b10 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88 RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2 R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000 R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0 FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0 Call Trace: <IRQ> ? kasan_report+0xc6/0xf0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? __pfx_delayed_work_timer_fn+0x10/0x10 call_timer_fn+0x25/0x1c0 __run_timer_base.part.0+0x3be/0x8c0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x1c0/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
The following diagram reveals the cause of the above warning:
CPU 0 (remove) | CPU 1 (delayed work callback)
mscc_ocelot_remove() |
ocelot_deinit() | ocelot_check_stats_work()
ocelot_stats_deinit() |
cancel_delayed_work()| ...
| queue_delayed_work()
destroy_workqueue() | (wait a time)
| __queue_work() //UAFThe above scenario actually constitutes a UAF vulnerability.
The ocelot_stats_deinit() is only invoked when initialization failure or resource destruction, so we must ensure that any delayed work items cannot be rescheduled.
Replace cancel_delayed_work() with disable_delayed_work_sync() to guarantee proper cancellation of the delayed work item and ensure completion of any currently executing work before the workqueue is deallocated.
A deadlock concern was considered: ocelot_stats_deinit() is called in a process context and is not holding any locks that the delayed work item might also need. Therefore, the use of the _sync() variant is safe here.
This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated ocelot-switch device by writing a kernel module and prepared the necessary resources for the virtual ocelot-switch device's probe process. Then, removing the virtual device will trigger the mscc_ocelot_remove() function, which in turn destroys the workqueue.
--- drivers/net/ethernet/mscc/ocelot_stats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mscc/ocelot_stats.c +1 -1
@@ -984,6 +984,6 @@ int ocelot_stats_init(struct ocelot *ocelot)void ocelot_stats_deinit (struct ocelot *ocelot) { -cancel_delayed_work (&ocelot->stats_work); +disable_delayed_work_sync (&ocelot->stats_work);destroy_workqueue (ocelot->stats_queue); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/277 ice: ice_adapter: release xa entry on adapter allocation failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 2db687f3469dbc5c59bc53d55acafd75d530b497 ]
When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent insertions at the same index to return -EBUSY, potentially leading to NULL pointer dereferences.
Reorder the operations as suggested by Przemek Kitszel:
1. Check if adapter already exists (xa_load)
2. Reserve the XArray slot (xa_reserve)
3. Allocate the adapter (ice_adapter_new)
4. Store the adapter (xa_store)
--- drivers/net/ethernet/intel/ice/ice_adapter.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_adapter.c +6 -4
@@ -98,19 +98,21 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev) index =ice_adapter_xa_index (pdev); scoped_guard(mutex, &ice_adapters_mutex) { - err =xa_insert (&ice_adapters, index,NULL ,GFP_KERNEL ); -if (err == -EBUSY ) { - adapter =xa_load (&ice_adapters, index); + adapter =xa_load (&ice_adapters, index); +if (adapter) {refcount_inc (&adapter->refcount);WARN_ON_ONCE (adapter->index !=ice_adapter_index (pdev));return adapter; } + err =xa_reserve (&ice_adapters, index,GFP_KERNEL );if (err)return ERR_PTR (err); adapter =ice_adapter_new (pdev); -if (!adapter) +if (!adapter) { +xa_release (&ice_adapters, index);return ERR_PTR (-ENOMEM ); + }xa_store (&ice_adapters, index, adapter,GFP_KERNEL ); }return adapter;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/277 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <[email protected]>
[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node.
--- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fsl_pq_mdio.c +2 -0
@@ -479,10 +479,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)"missing 'reg' property in node %pOF\n" , tbi); err = -EBUSY ; +of_node_put (tbi); goto error; }set_tbipa (*prop, pdev, data->get_tbipa, priv->map, &res); +of_node_put (tbi); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/277 tools build: Align warning options with perf
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks.
Make the feature test program use the same warning options as perf.
--- tools/build/feature/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +2 -2
@@ -327,10 +327,10 @@ $(OUTPUT)test-libcapstone.bin: $(BUILD) # -lcapstone provided by $(FEATURE_CHECK_LDFLAGS-libcapstone) $(OUTPUT)test-compile-32.bin: - $(CC) -m32 -o $@ test-compile.c + $(CC) -m32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-compile-x32.bin: - $(CC) -mx32 -o $@ test-compile.c + $(CC) -mx32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-zlib.bin: $(BUILD) -lz
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/277 perf python: split Clang options when invoking Popen
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ]
When passing a list to subprocess.Popen, each element maps to one argv token. Current code bundles multiple Clang flags into a single element, something like:
cmd = ['clang',
'--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', 'test-hello.c']
So Clang only sees one long, invalid option instead of separate flags, as a result, the script cannot capture any log via PIPE.
Fix this by using shlex.split() to separate the string so each option becomes its own argv element. The fixed list will be:
cmd = ['clang',
'--target=x86_64-linux-gnu', '-fintegrated-as', '-Wno-cast-function-type-mismatch', 'test-hello.c']
--- tools/perf/util/setup.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/setup.py +4 -1
@@ -1,6 +1,7 @@ from os import getenv, path from subprocess import Popen, PIPE from re import sub +import shlex cc = getenv("CC")
@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline src_feature_tests = getenv('srctree') + '/tools/build/feature' def clang_has_option(option): - cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() + cmd = shlex.split(f"{cc} {cc_options} {option}") + cmd.append(path.join(src_feature_tests, "test-hello.c")) + cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] if cc_is_clang:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/277 tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ]
Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT on their listener, before accept().
This has an unfortunate effect on wscale selection in tcp_select_initial_window() during 3WHS.
For instance, tcp_mmap was negotiating wscale 4, regardless of tcp_rmem[2] and sysctl_rmem_max.
Do not change tp->window_clamp if it is zero
or bigger than our computed value.
Zero value is special, it allows tcp_select_initial_window() to enable autotuning.
Note that SO_RCVLOWAT use on listener is probably not wise, because tp->scaling_ratio has a default value, possibly wrong.
--- net/ipv4/tcp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +4 -1
@@ -1735,6 +1735,7 @@ EXPORT_SYMBOL(tcp_peek_len);/* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ int tcp_set_rcvlowat (struct sock *sk,int val) { +struct tcp_sock *tp =tcp_sk (sk);int space, cap;if (sk->sk_userlocks &SOCK_RCVBUF_LOCK )
@@ -1753,7 +1754,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) space =tcp_space_from_win (sk, val);if (space > sk->sk_rcvbuf) {WRITE_ONCE (sk->sk_rcvbuf, space); -WRITE_ONCE (tcp_sk (sk)->window_clamp, val); + +if (tp->window_clamp && tp->window_clamp < val) +WRITE_ONCE (tp->window_clamp, val); }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/277 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary.
Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - 1 file changed, 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +0 -1
@@ -894,7 +894,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (ipi_mbox->dev.parent) { -mbox_controller_unregister (&ipi_mbox->mbox);if (device_is_registered (&ipi_mbox->dev))device_unregister (&ipi_mbox->dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/277 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes.
device_is_registered() is the canonical and robust method to verify the registration status.
Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +2 -4
@@ -893,10 +893,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) i = pdata->num_mboxes;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i]; -if (ipi_mbox->dev.parent) { -if (device_is_registered (&ipi_mbox->dev)) -device_unregister (&ipi_mbox->dev); - } +if (device_is_registered (&ipi_mbox->dev)) +device_unregister (&ipi_mbox->dev); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/277 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 0aead8197fc1a85b0a89646e418feb49a564b029 ]
The cleanup loop was starting at the wrong array index, causing out-of-bounds access.
Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond the allocated array bounds.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +1 -1
@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)if (pdata->irq <MAX_SGI )xlnx_mbox_cleanup_sgi (pdata); - i = pdata->num_mboxes; + i = pdata->num_mboxes -1 ;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (device_is_registered (&ipi_mbox->dev))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/277 mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit bb160e791ab15b89188a7a19589b8e11f681bef3 ]
The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16, which fails with dynamic IRQ allocation. During unbind, this causes improper SGI cleanup leading to kernel crash.
Add explicit irq_type field to pdata for reliable identification of SGI interrupts (type-2) and only clean up SGI resources when appropriate.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +10 -5
@@ -62,7 +62,8 @@#define DST_BIT_POS 9U#define SRC_BITMASK GENMASK(11, 8) -#define MAX_SGI 16 +/* Macro to represent SGI type for IPI IRQs */ +#define IPI_IRQ_TYPE_SGI 2/* * Module parameters
@@ -121,6 +122,7 @@ struct zynqmp_ipi_mbox {* @dev: device pointer corresponding to the Xilinx ZynqMP * IPI agent * @irq: IPI agent interrupt ID +* @irq_type: IPI SGI or SPI IRQ type * @method: IPI SMC or HVC is going to be used * @local_id: local IPI agent ID * @virq_sgi: IRQ number mapped to SGI
@@ -130,6 +132,7 @@ struct zynqmp_ipi_mbox {struct zynqmp_ipi_pdata {struct device *dev;int irq; +unsigned int irq_type;unsigned int method;u32 local_id;int virq_sgi;
@@ -887,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)struct zynqmp_ipi_mbox *ipi_mbox;int i; -if (pdata->irq <MAX_SGI ) +if (pdata->irq_type ==IPI_IRQ_TYPE_SGI )xlnx_mbox_cleanup_sgi (pdata); i = pdata->num_mboxes -1 ;
@@ -956,14 +959,16 @@ static int zynqmp_ipi_probe(struct platform_device *pdev)dev_err (dev,"failed to parse interrupts\n" ); goto free_mbox_dev; } - ret = out_irq.args[1 ]; + +/* Use interrupt type to distinguish SGI and SPI interrupts */ + pdata->irq_type = out_irq.args[0 ];/* * If Interrupt number is in SGI range, then request SGI else request * IPI system IRQ. */ -if (ret <MAX_SGI ) { - pdata->irq = ret; +if (pdata->irq_type ==IPI_IRQ_TYPE_SGI ) { + pdata->irq = out_irq.args[1 ]; ret =xlnx_mbox_init_sgi (pdev, pdata->irq, pdata);if (ret) goto free_mbox_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/277 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster.
The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing.
The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first.
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -2289,6 +2289,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,if (IS_ERR (dst)) goto out_drop; +skb_dst_drop (skb);skb_dst_set (skb, dst); }else if (nh->nh_family !=AF_INET6 ) { goto out_drop;
@@ -2397,6 +2398,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } +skb_dst_drop (skb);skb_dst_set (skb, &rt->dst); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/277 mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 08fb6d8ff900a1d06ef2f4a6ded45cdaa7140c01 ]
pm_runtime_put_autosuspend() will soon be changed to include a call to pm_runtime_mark_last_busy(). This patch switches the current users to __pm_runtime_put_autosuspend() which will continue to have the functionality of old pm_runtime_put_autosuspend().
Stable-dep-of: 3f39f5652037 ("mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()")
--- drivers/mailbox/mtk-cmdq-mailbox.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/mailbox/mtk-cmdq-mailbox.c +5 -5
@@ -390,7 +390,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) task =kzalloc (sizeof (*task),GFP_ATOMIC );if (!task) { -pm_runtime_put_autosuspend (cmdq->mbox.dev); +__pm_runtime_put_autosuspend (cmdq->mbox.dev);return -ENOMEM ; }
@@ -440,7 +440,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)list_move_tail (&task->list_entry, &thread->task_busy_list);pm_runtime_mark_last_busy (cmdq->mbox.dev); -pm_runtime_put_autosuspend (cmdq->mbox.dev); +__pm_runtime_put_autosuspend (cmdq->mbox.dev);return 0 ; }
@@ -488,7 +488,7 @@ static void cmdq_mbox_shutdown(struct mbox_chan *chan)spin_unlock_irqrestore (&thread->chan->lock, flags);pm_runtime_mark_last_busy (cmdq->mbox.dev); -pm_runtime_put_autosuspend (cmdq->mbox.dev); +__pm_runtime_put_autosuspend (cmdq->mbox.dev); }static int cmdq_mbox_flush (struct mbox_chan *chan,unsigned long timeout)
@@ -528,7 +528,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) out:spin_unlock_irqrestore (&thread->chan->lock, flags);pm_runtime_mark_last_busy (cmdq->mbox.dev); -pm_runtime_put_autosuspend (cmdq->mbox.dev); +__pm_runtime_put_autosuspend (cmdq->mbox.dev);return 0 ;
@@ -543,7 +543,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)return -EFAULT ; }pm_runtime_mark_last_busy (cmdq->mbox.dev); -pm_runtime_put_autosuspend (cmdq->mbox.dev); +__pm_runtime_put_autosuspend (cmdq->mbox.dev);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/277 mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 472f8a3fccbb579cb98c1821da4cb9cbd51ee3e4 ]
__pm_runtime_put_autosuspend() was meant to be used by callers that needed to put the Runtime PM usage_count without marking the device's last busy timestamp. It was however seen that the Runtime PM autosuspend related functions should include that call. Thus switch the driver to use pm_runtime_put_autosuspend().
Stable-dep-of: 3f39f5652037 ("mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()")
--- drivers/mailbox/mtk-cmdq-mailbox.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/mailbox/mtk-cmdq-mailbox.c +5 -5
@@ -390,7 +390,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) task =kzalloc (sizeof (*task),GFP_ATOMIC );if (!task) { -__pm_runtime_put_autosuspend (cmdq->mbox.dev); +pm_runtime_put_autosuspend (cmdq->mbox.dev);return -ENOMEM ; }
@@ -440,7 +440,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)list_move_tail (&task->list_entry, &thread->task_busy_list);pm_runtime_mark_last_busy (cmdq->mbox.dev); -__pm_runtime_put_autosuspend (cmdq->mbox.dev); +pm_runtime_put_autosuspend (cmdq->mbox.dev);return 0 ; }
@@ -488,7 +488,7 @@ static void cmdq_mbox_shutdown(struct mbox_chan *chan)spin_unlock_irqrestore (&thread->chan->lock, flags);pm_runtime_mark_last_busy (cmdq->mbox.dev); -__pm_runtime_put_autosuspend (cmdq->mbox.dev); +pm_runtime_put_autosuspend (cmdq->mbox.dev); }static int cmdq_mbox_flush (struct mbox_chan *chan,unsigned long timeout)
@@ -528,7 +528,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) out:spin_unlock_irqrestore (&thread->chan->lock, flags);pm_runtime_mark_last_busy (cmdq->mbox.dev); -__pm_runtime_put_autosuspend (cmdq->mbox.dev); +pm_runtime_put_autosuspend (cmdq->mbox.dev);return 0 ;
@@ -543,7 +543,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)return -EFAULT ; }pm_runtime_mark_last_busy (cmdq->mbox.dev); -__pm_runtime_put_autosuspend (cmdq->mbox.dev); +pm_runtime_put_autosuspend (cmdq->mbox.dev);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/277 mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit 3f39f56520374cf56872644acf9afcc618a4b674 ]
pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit() (mailbox.c). This caused lockdep warnings such as "sleeping function called from invalid context" when running with lockdebug enabled.
The BUG report:
BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164
in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
irq event stamp: 0
CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1
Hardware name: Google Ciri sku0/unprovisioned board (DT)
Workqueue: imgsys_runner imgsys_runner_func
Call trace:
dump_backtrace+0x100/0x120
show_stack+0x20/0x2c
dump_stack_lvl+0x84/0xb4
dump_stack+0x18/0x48
__might_resched+0x354/0x4c0
__might_sleep+0x98/0xe4
__pm_runtime_resume+0x70/0x124
cmdq_mbox_send_data+0xe4/0xb1c
msg_submit+0x194/0x2dc
mbox_send_message+0x190/0x330
imgsys_cmdq_sendtask+0x1618/0x2224
imgsys_runner_func+0xac/0x11c
process_one_work+0x638/0xf84
worker_thread+0x808/0xcd0
kthread+0x24c/0x324
ret_from_fork+0x10/0x20Additionally, pm_runtime_put_autosuspend() should be invoked from the GCE IRQ handler to ensure the hardware has actually completed its work.
To resolve these issues, remove the pm_runtime calls from cmdq_mbox_send_data() and delegate power management responsibilities to the client driver.
--- drivers/mailbox/mtk-cmdq-mailbox.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
drivers/mailbox/mtk-cmdq-mailbox.c +1 -11
@@ -379,20 +379,13 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)struct cmdq *cmdq =dev_get_drvdata (chan->mbox->dev);struct cmdq_task *task;unsigned long curr_pa, end_pa; -int ret;/* Client should not flush new tasks if suspended. */ WARN_ON (cmdq->suspended); - ret =pm_runtime_get_sync (cmdq->mbox.dev); -if (ret <0 ) -return ret; - task =kzalloc (sizeof (*task),GFP_ATOMIC ); -if (!task) { -pm_runtime_put_autosuspend (cmdq->mbox.dev); +if (!task)return -ENOMEM ; - } task->cmdq = cmdq;INIT_LIST_HEAD (&task->list_entry);
@@ -439,9 +432,6 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) }list_move_tail (&task->list_entry, &thread->task_busy_list); -pm_runtime_mark_last_busy (cmdq->mbox.dev); -pm_runtime_put_autosuspend (cmdq->mbox.dev); -return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/277 drm/amdgpu: Add additional DCE6 SCL registers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
--- drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ 2 files changed, 9 insertions(+)
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +7 -0
@@ -4115,6 +4115,7 @@#define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40#define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL0_SCL_SCALER_ENABLE 0x1B42#define mmSCL0_SCL_CONTROL 0x1B44#define mmSCL0_SCL_DEBUG 0x1B6A#define mmSCL0_SCL_DEBUG2 0x1B69
@@ -4144,6 +4145,7 @@#define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55#define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40#define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 +#define mmSCL1_SCL_SCALER_ENABLE 0x1E42#define mmSCL1_SCL_CONTROL 0x1E44#define mmSCL1_SCL_DEBUG 0x1E6A#define mmSCL1_SCL_DEBUG2 0x1E69
@@ -4173,6 +4175,7 @@#define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155#define mmSCL2_SCL_COEF_RAM_SELECT 0x4140#define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 +#define mmSCL2_SCL_SCALER_ENABLE 0x4142#define mmSCL2_SCL_CONTROL 0x4144#define mmSCL2_SCL_DEBUG 0x416A#define mmSCL2_SCL_DEBUG2 0x4169
@@ -4202,6 +4205,7 @@#define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455#define mmSCL3_SCL_COEF_RAM_SELECT 0x4440#define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 +#define mmSCL3_SCL_SCALER_ENABLE 0x4442#define mmSCL3_SCL_CONTROL 0x4444#define mmSCL3_SCL_DEBUG 0x446A#define mmSCL3_SCL_DEBUG2 0x4469
@@ -4231,6 +4235,7 @@#define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755#define mmSCL4_SCL_COEF_RAM_SELECT 0x4740#define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 +#define mmSCL4_SCL_SCALER_ENABLE 0x4742#define mmSCL4_SCL_CONTROL 0x4744#define mmSCL4_SCL_DEBUG 0x476A#define mmSCL4_SCL_DEBUG2 0x4769
@@ -4260,6 +4265,7 @@#define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55#define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40#define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 +#define mmSCL5_SCL_SCALER_ENABLE 0x4A42#define mmSCL5_SCL_CONTROL 0x4A44#define mmSCL5_SCL_DEBUG 0x4A6A#define mmSCL5_SCL_DEBUG2 0x4A69
@@ -4287,6 +4293,7 @@#define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL_COEF_RAM_SELECT 0x1B40#define mmSCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL_SCALER_ENABLE 0x1B42#define mmSCL_CONTROL 0x1B44#define mmSCL_DEBUG 0x1B6A#define mmSCL_DEBUG2 0x1B69
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +2 -0
@@ -8648,6 +8648,8 @@#define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 +#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L +#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000#define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L#define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000#define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/277 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
Without these, it's impossible to program these registers.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,8 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \SRI (SCL_HORZ_FILTER_SCALE_RATIO ,SCL , id), \SRI (SCL_VERT_FILTER_SCALE_RATIO ,SCL , id), \ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/277 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
Previously, the code would set a bit field which didn't exist on DCE6 so it would be effectively a no-op.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +2 -4
@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {/* 4. Program vertical filters */ if (xfm_dce->filter_v ==NULL ) -REG_SET (SCL_VERT_FILTER_CONTROL ,0 , -SCL_V_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_VERT_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.v_taps,
@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(/* 5. Program horizontal filters */ if (xfm_dce->filter_h ==NULL ) -REG_SET (SCL_HORZ_FILTER_CONTROL ,0 , -SCL_H_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_HORZ_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.h_taps,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/277 drm/amd/display: Properly disable scaling on DCE6
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
SCL_SCALER_ENABLE can be used to enable/disable the scaler on DCE6. Program it to 0 when scaling isn't used, 1 when used. Additionally, clear some other registers when scaling is disabled and program the SCL_UPDATE register as recommended.
This fixes visible glitches for users whose BIOS sets up a mode with scaling at boot, which DC was unable to clean up.
--- .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +11 -4
@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(REG_SET (SCL_BYPASS_CONTROL ,0 ,SCL_BYPASS_MODE ,0 );if (data->taps.h_taps + data->taps.v_taps <=2 ) { -/* Set bypass */ - -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +/* Disable scaler functionality */ +REG_WRITE (SCL_SCALER_ENABLE ,0 ); +/* Clear registers that can cause glitches even when the scaler is off */ +REG_WRITE (SCL_TAP_CONTROL ,0 ); +REG_WRITE (SCL_AUTOMATIC_MODE_CONTROL ,0 ); +REG_WRITE (SCL_F_SHARP_CONTROL ,0 );return false; }
@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(SCL_H_NUM_OF_TAPS , data->taps.h_taps -1 , SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +REG_WRITE (SCL_SCALER_ENABLE ,1 );/* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(REG_SET (DC_LB_MEM_SIZE ,0 ,DC_LB_MEM_SIZE , xfm_dce->lb_memory_size); +REG_WRITE (SCL_UPDATE ,0x00010000 ); +/* Clear SCL_F_SHARP_CONTROL value to 0 */ REG_WRITE (SCL_F_SHARP_CONTROL ,0 );
@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(/* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ + + REG_WRITE(SCL_UPDATE, 0); }#endif
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,7 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_SCALER_ENABLE ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
@@ -592,6 +593,7 @@ struct dce_transform_registers {uint32_t SCL_VERT_FILTER_SCALE_RATIO ;uint32_t SCL_HORZ_FILTER_INIT ;#if defined(CONFIG_DRM_AMD_DC_SI ) +uint32_t SCL_SCALER_ENABLE ;uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA ;uint32_t SCL_HORZ_FILTER_INIT_CHROMA ;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/277 netfilter: nft_objref: validate objref and objrefmap expressions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ]
Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls:
BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0
[...]
Implement objref and objrefmap expression validate functions.
Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook.
Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error:
synproxy_crash.nft: Error: Could not process rule: Operation not supported
synproxy name mysynproxy
^^^^^^^^^^^^^^^^^^^^^^^^
--- net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
net/netfilter/nft_objref.c +39 -0
@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, obj->ops->eval (obj, regs, pkt); } +static int nft_objref_validate_obj_type (const struct nft_ctx *ctx,u32 type) +{ +unsigned int hooks; + +switch (type) { +case NFT_OBJECT_SYNPROXY : +if (ctx->family !=NFPROTO_IPV4 && + ctx->family !=NFPROTO_IPV6 && + ctx->family !=NFPROTO_INET ) +return -EOPNOTSUPP ; + + hooks = (1 <<NF_INET_LOCAL_IN ) | (1 <<NF_INET_FORWARD ); + +return nft_chain_validate_hooks (ctx->chain, hooks); +default : +break ; + } + +return 0 ; +} + +static int nft_objref_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +struct nft_object *obj =nft_objref_priv (expr); + +return nft_objref_validate_obj_type (ctx, obj->ops->type->type); +} +static int nft_objref_init (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nlattr *const tb[])
@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { .activate = nft_objref_activate, .deactivate = nft_objref_deactivate, .dump = nft_objref_dump, + .validate = nft_objref_validate, .reduce = NFT_REDUCE_READONLY, };
@@ -197,6 +227,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx,nf_tables_destroy_set (ctx, priv->set); } +static int nft_objref_map_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +const struct nft_objref_map *priv =nft_expr_priv (expr); + +return nft_objref_validate_obj_type (ctx, priv->set->objtype); +} +static const struct nft_expr_ops nft_objref_map_ops = { .type = &nft_objref_type, .size =NFT_EXPR_SIZE (sizeof (struct nft_objref_map )),
@@ -206,6 +244,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { .deactivate = nft_objref_map_deactivate, .destroy = nft_objref_map_destroy, .dump = nft_objref_map_dump, + .validate = nft_objref_map_validate, .reduce = NFT_REDUCE_READONLY, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/277 bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Woudstra <[email protected]>
[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
7 locks held by socat/410:
#0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 [..]
#6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
Call Trace: lockdep_rcu_suspicious.cold+0x4f/0xb1 br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] br_fill_forward_path+0x7a/0x4d0 [bridge]
Use to correct helper, non _rcu variant requires RTNL mutex.
--- net/bridge/br_vlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_vlan.c +1 -1
@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,if (!br_opt_get (br,BROPT_VLAN_ENABLED ))return ; - vg =br_vlan_group (br); + vg =br_vlan_group_rcu (br);if (idx >=0 && ctx->vlan[idx].proto == br->vlan_proto) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/277 selftests: netfilter: query conntrack state to check for port clash resolution
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit e84945bdc619ed4243ba4298dbb8ca2062026474 ]
Jakub reported this self test flaking occasionally (fails, but passes on re-run) on debug kernels.
This is because the test checks for elapsed time to determine if both connections were established in parallel.
Rework this to no longer depend on timing.
Use busywait helper to check that both sockets have moved to established state and then query the conntrack engine for the two entries.
--- .../selftests/net/netfilter/nf_nat_edemux.sh | 58 +++++++++++++------ 1 file changed, 41 insertions(+), 17 deletions(-)
tools/testing/selftests/net/netfilter/nf_nat_edemux.sh +41 -17
@@ -17,9 +17,31 @@ cleanup() checktool "socat -h" "run test without socat" checktool "iptables --version" "run test without iptables" +checktool "conntrack --version" "run test without conntrack" trap cleanup EXIT +connect_done() +{ + local ns="$1" + local port="$2" + + ip netns exec "$ns" ss -nt -o state established "dport = :$port" | grep -q "$port" +} + +check_ctstate() +{ + local ns="$1" + local dp="$2" + + if ! ip netns exec "$ns" conntrack --get -s 192.168.1.2 -d 192.168.1.1 -p tcp \ + --sport 10000 --dport "$dp" --state ESTABLISHED > /dev/null 2>&1;then + echo "FAIL: Did not find expected state for dport $2" + ip netns exec "$ns" bash -c 'conntrack -L; conntrack -S; ss -nt' + ret=1 + fi +} + setup_ns ns1 ns2 # Connect the namespaces using a veth pair
@@ -44,15 +66,18 @@ socatpid=$! ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000" # add a virtual IP using DNAT -ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 +ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 || exit 1 # ... and route it to the other namespace ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1 -# add a persistent connection from the other namespace -ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & +# listener should be up by now, wait if it isn't yet. +wait_local_port_listen "$ns1" 5201 tcp -sleep 1 +# add a persistent connection from the other namespace +sleep 10 | ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & +cpid0=$! +busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" "5201" # ip daddr:dport will be rewritten to 192.168.1.1 5201 # NAT must reallocate source port 10000 because
@@ -71,26 +96,25 @@ fi ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201 ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201 -sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & +sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & +cpid1=$! -# if connect succeeds, client closes instantly due to EOF on stdin. -# if connect hangs, it will time out after 5s. -echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & +sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & cpid2=$! -time_then=$(date +%s) -wait $cpid2 -rv=$? -time_now=$(date +%s) +busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5202 +busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5203 -# Check how much time has elapsed, expectation is for -# 'cpid2' to connect and then exit (and no connect delay). -delta=$((time_now - time_then)) +check_ctstate "$ns1" 5202 +check_ctstate "$ns1" 5203 -if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then +kill $socatpid $cpid0 $cpid1 $cpid2 +socatpid=0 + +if [ $ret -eq 0 ]; then echo "PASS: could connect to service via redirected ports" else - echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)" + echo "FAIL: socat cannot connect to service via redirect" ret=1 fi
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/277 crypto: essiv - Check ssize for decryption and in-place encryption
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
--- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
crypto/essiv.c +6 -8
@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)const struct essiv_tfm_ctx *tctx =crypto_aead_ctx (tfm);struct essiv_aead_request_ctx *rctx =aead_request_ctx (req);struct aead_request *subreq = &rctx->aead_req; +int ivsize =crypto_aead_ivsize (tfm); +int ssize = req->assoclen - ivsize;struct scatterlist *src = req->src;int err; +if (ssize <0 ) +return -EINVAL ; +crypto_cipher_encrypt_one (tctx->essiv_cipher, req->iv, req->iv);/*
@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)*/ rctx->assoc =NULL ;if (req->src == req->dst || !enc) { -scatterwalk_map_and_copy (req->iv, req->dst, - req->assoclen -crypto_aead_ivsize (tfm), -crypto_aead_ivsize (tfm),1 ); +scatterwalk_map_and_copy (req->iv, req->dst, ssize, ivsize,1 ); }else {u8 *iv = (u8 *)aead_request_ctx (req) + tctx->ivoffset; -int ivsize =crypto_aead_ivsize (tfm); -int ssize = req->assoclen - ivsize;struct scatterlist *sg;int nents; -if (ssize <0 ) -return -EINVAL ; - nents =sg_nents_for_len (req->src, ssize);if (nents <0 )return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/277 cifs: Fix copy_to_iter return value check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fushuai Wang <[email protected]>
[ Upstream commit 0cc380d0e1d36b8f2703379890e90f896f68e9e8 ]
The return value of copy_to_iter() function will never be negative, it is the number of bytes copied, or zero if nothing was copied. Update the check to treat 0 as an error, and return -1 in that case.
--- fs/smb/client/smb2ops.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/smb/client/smb2ops.c +5 -5
@@ -4657,7 +4657,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,unsigned int pad_len;struct cifs_io_subrequest *rdata = mid->callback_data;struct smb2_hdr *shdr = (struct smb2_hdr *)buf; -int length; +size_t copied;bool use_rdma_mr = false;if (shdr->Command !=SMB2_READ ) {
@@ -4770,10 +4770,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, }else if (buf_len >= data_offset + data_len) {/* read response payload is in buf */ WARN_ONCE (buffer,"read data can be either in buf or in buffer" ); - length =copy_to_iter (buf + data_offset, data_len, &rdata->subreq.io_iter); -if (length <0 ) -return length; - rdata->got_bytes = data_len; + copied =copy_to_iter (buf + data_offset, data_len, &rdata->subreq.io_iter); +if (copied ==0 ) +return -EIO ; + rdata->got_bytes = copied; }else {/* read response payload cannot be in both buf and pages */ WARN_ONCE (1 ,"buf can not contain only a part of read data" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/277 smb: client: fix missing timestamp updates after utime(2)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ]
Don't reuse open handle when changing timestamps to prevent the server from disabling automatic timestamp updates as per MS-FSA 2.1.4.17.
---8<---
import os
import time
filename = '/mnt/foo'
def print_stat(prefix):
st = os.stat(filename)
print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime))
fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) print_stat('old')os.utime(fd, None)time.sleep(2)os.write(fd, b'foo')os.close(fd)time.sleep(2)print_stat('new')
---8<---
Before patch:
$ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
After patch:
$ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025 new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025
--- fs/smb/client/smb2inode.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
fs/smb/client/smb2inode.c +12 -10
@@ -1220,31 +1220,33 @@ int smb2_set_file_info(struct inode *inode, const char *full_path, FILE_BASIC_INFO *buf, const unsigned int xid) { - struct cifs_open_parms oparms; + struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb); +struct cifsFileInfo *cfile =NULL ; +struct cifs_open_parms oparms;struct tcon_link *tlink;struct cifs_tcon *tcon; -struct cifsFileInfo *cfile; -struct kvec in_iov = { .iov_base = buf, .iov_len =sizeof (*buf), }; -int rc; - -if ((buf->CreationTime ==0 ) && (buf->LastAccessTime ==0 ) && - (buf->LastWriteTime ==0 ) && (buf->ChangeTime ==0 ) && - (buf->Attributes ==0 )) -return 0 ;/* would be a no op, no sense sending this */ +int rc =0 ; tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink); tcon =tlink_tcon (tlink); -cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); +if ((buf->CreationTime ==0 ) && (buf->LastAccessTime ==0 ) && + (buf->LastWriteTime ==0 ) && (buf->ChangeTime ==0 )) { +if (buf->Attributes ==0 ) + goto out;/* would be a no op, no sense sending this */ +cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); + } + oparms =CIFS_OPARMS (cifs_sb, tcon, full_path,FILE_WRITE_ATTRIBUTES ,FILE_OPEN ,0 ,ACL_NO_MODE ); rc =smb2_compound_op (xid, tcon, cifs_sb, full_path, &oparms, &in_iov, &(int ){SMB2_OP_SET_INFO },1 , cfile,NULL ,NULL ,NULL ); +out:cifs_put_tlink (tlink);return rc; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/277 cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ]
EA $LXMOD is required for WSL non-symlink reparse points.
--- fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 60 insertions(+), 2 deletions(-)
fs/smb/client/smb1ops.c +60 -2
@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid, }#ifdef CONFIG_CIFS_XATTR +/* +* For non-symlink WSL reparse points it is required to fetch +* EA $LXMOD which contains in its S_DT part the mandatory file type. +*/ +if (!rc && data->reparse_point) { +struct smb2_file_full_ea_info *ea; +u32 next =0 ; + + ea = (struct smb2_file_full_ea_info *)data->wsl.eas; +do { + ea = (void *)((u8 *)ea + next); + next =le32_to_cpu (ea->next_entry_offset); + }while (next); +if (le16_to_cpu (ea->ea_value_length)) { + ea->next_entry_offset =cpu_to_le32 (ALIGN (sizeof (*ea) + + ea->ea_name_length +1 + +le16_to_cpu (ea->ea_value_length),4 )); + ea = (void *)((u8 *)ea +le32_to_cpu (ea->next_entry_offset)); + } + + rc =CIFSSMBQAllEAs (xid, tcon, full_path,SMB2_WSL_XATTR_MODE , + &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN +1 ], +SMB2_WSL_XATTR_MODE_SIZE , cifs_sb); +if (rc ==SMB2_WSL_XATTR_MODE_SIZE ) { + ea->next_entry_offset =cpu_to_le32 (0 ); + ea->flags =0 ; + ea->ea_name_length =SMB2_WSL_XATTR_NAME_LEN ; + ea->ea_value_length =cpu_to_le16 (SMB2_WSL_XATTR_MODE_SIZE ); +memcpy (&ea->ea_data[0 ],SMB2_WSL_XATTR_MODE ,SMB2_WSL_XATTR_NAME_LEN +1 ); + data->wsl.eas_len +=ALIGN (sizeof (*ea) +SMB2_WSL_XATTR_NAME_LEN +1 + +SMB2_WSL_XATTR_MODE_SIZE ,4 ); + rc =0 ; + }else if (rc >=0 ) { +/* It is an error if EA $LXMOD has wrong size. */ + rc = -EINVAL ; + }else { +/* +* In all other cases ignore error if fetching +* of EA $LXMOD failed. It is needed only for +* non-symlink WSL reparse points and wsl_to_fattr() +* handle the case when EA is missing. +*/ + rc =0 ; + } + } +/* * For WSL CHR and BLK reparse points it is required to fetch * EA $LXDEV which contains major and minor device numbers. */ if (!rc && data->reparse_point) {struct smb2_file_full_ea_info *ea; +u32 next =0 ; ea = (struct smb2_file_full_ea_info *)data->wsl.eas; +do { + ea = (void *)((u8 *)ea + next); + next =le32_to_cpu (ea->next_entry_offset); + }while (next); +if (le16_to_cpu (ea->ea_value_length)) { + ea->next_entry_offset =cpu_to_le32 (ALIGN (sizeof (*ea) + + ea->ea_name_length +1 + +le16_to_cpu (ea->ea_value_length),4 )); + ea = (void *)((u8 *)ea +le32_to_cpu (ea->next_entry_offset)); + } + rc =CIFSSMBQAllEAs (xid, tcon, full_path,SMB2_WSL_XATTR_DEV , &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN +1 ],SMB2_WSL_XATTR_DEV_SIZE , cifs_sb);
@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid, ea->ea_name_length =SMB2_WSL_XATTR_NAME_LEN ; ea->ea_value_length =cpu_to_le16 (SMB2_WSL_XATTR_DEV_SIZE );memcpy (&ea->ea_data[0 ],SMB2_WSL_XATTR_DEV ,SMB2_WSL_XATTR_NAME_LEN +1 ); - data->wsl.eas_len =sizeof (*ea) +SMB2_WSL_XATTR_NAME_LEN +1 + -SMB2_WSL_XATTR_DEV_SIZE ; + data->wsl.eas_len +=ALIGN (sizeof (*ea) +SMB2_WSL_XATTR_NAME_LEN +1 + +SMB2_WSL_XATTR_MODE_SIZE ,4 ); rc =0 ; }else if (rc >=0 ) {/* It is an error if EA $LXDEV has wrong size. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/277 tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gunnar Kudrjavets <[email protected]>
[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
The tpm_tis_write8() call specifies arguments in wrong order. Should be (data, addr, value) not (data, value, addr). The initial correct order was changed during the major refactoring when the code was split.
--- drivers/char/tpm/tpm_tis_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +2 -2
@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,* will call disable_irq which undoes all of the above. */ if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) { -tpm_tis_write8 (priv, original_int_vec, -TPM_INT_VECTOR (priv->locality)); +tpm_tis_write8 (priv,TPM_INT_VECTOR (priv->locality), + original_int_vec); rc =-1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/277 gpio: wcd934x: mark the GPIO controller as sleeping
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
The slimbus regmap passed to the GPIO driver down from MFD does not use fast_io. This means a mutex is used for locking and thus this GPIO chip must not be used in atomic context. Change the can_sleep switch in struct gpio_chip to true.
--- drivers/gpio/gpio-wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-wcd934x.c +1 -1
@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) chip->base =-1 ; chip->ngpio =WCD934X_NPINS ; chip->label =dev_name (dev); - chip->can_sleep = false; + chip->can_sleep = true;return devm_gpiochip_add_data (dev, chip, data); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/277 bpf: Avoid RCU context warning when unpinning htab with internal structs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: KaFai Wan <[email protected]>
[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered:
BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ...
The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms:
1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context.
2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations.
However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule.
Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning.
--- kernel/bpf/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/bpf/inode.c +2 -2
@@ -775,7 +775,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)return 0 ; } -static void bpf_free_inode (struct inode *inode) +static void bpf_destroy_inode (struct inode *inode) {enum bpf_type type;
@@ -790,7 +790,7 @@ const struct super_operations bpf_super_ops = { .statfs = simple_statfs, .drop_inode = generic_delete_inode, .show_options = bpf_show_options, - .free_inode = bpf_free_inode, + .destroy_inode = bpf_destroy_inode, };enum {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/277 s390: vmlinux.lds.S: Reorder sections
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Gladkov <[email protected]>
[ Upstream commit 8d18ef04f940a8d336fe7915b5ea419c3eb0c0a6 ]
In the upcoming changes, the ELF_DETAILS macro will be extended with the ".modinfo" section, which will cause an error:
Quoted 3 lines
Quoted 3 lines
s390x-linux-ld: .tmp_vmlinux1: warning: allocated section `.modinfo' not in segment
s390x-linux-ld: .tmp_vmlinux2: warning: allocated section `.modinfo' not in segment
s390x-linux-ld: vmlinux.unstripped: warning: allocated section `.modinfo' not in segment
This happens because the .vmlinux.info use :NONE to override the default segment and tell the linker to not put the section in any segment at all.
To avoid this, we need to change the sections order that will be placed in the default segment.
Stable-dep-of: 9338d660b79a ("s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections")
--- arch/s390/kernel/vmlinux.lds.S | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/s390/kernel/vmlinux.lds.S +5 -5
@@ -202,6 +202,11 @@ SECTIONS . = ALIGN(PAGE_SIZE); _end = . ; + /* Debugging sections. */ + STABS_DEBUG + DWARF_DEBUG + ELF_DETAILS + /* * uncompressed image info used by the decompressor * it should match struct vmlinux_info
@@ -232,11 +237,6 @@ SECTIONS #endif } :NONE - /* Debugging sections. */ - STABS_DEBUG - DWARF_DEBUG - ELF_DETAILS - /* * Make sure that the .got.plt is either completely empty or it * contains only the three reserved double words.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/277 s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit 9338d660b79a0dfe4eb3fe9bd748054cded87d4f ]
When building s390 defconfig with binutils older than 2.32, there are several warnings during the final linking stage:
s390-linux-ld: .tmp_vmlinux1: warning: allocated section `.got.plt' not in segment
s390-linux-ld: .tmp_vmlinux2: warning: allocated section `.got.plt' not in segment
s390-linux-ld: vmlinux.unstripped: warning: allocated section `.got.plt' not in segment
s390-linux-objcopy: vmlinux: warning: allocated section `.got.plt' not in segment
s390-linux-objcopy: st7afZyb: warning: allocated section `.got.plt' not in segment
binutils commit afca762f598 ("S/390: Improve partial relro support for 64 bit") [1] in 2.32 changed where .got.plt is emitted, avoiding the warning.
The :NONE in the .vmlinux.info output section description changes the segment for subsequent allocated sections. Move .vmlinux.info right above the discards section to place all other sections in the previously defined segment, .data.
--- arch/s390/kernel/vmlinux.lds.S | 44 +++++++++++++++++----------------- 1 file changed, 22 insertions(+), 22 deletions(-)
arch/s390/kernel/vmlinux.lds.S +22 -22
@@ -207,6 +207,28 @@ SECTIONS DWARF_DEBUG ELF_DETAILS + /* + * Make sure that the .got.plt is either completely empty or it + * contains only the three reserved double words. + */ + .got.plt : { + *(.got.plt) + } + ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!") + + /* + * Sections that should stay zero sized, which is safer to + * explicitly check instead of blindly discarding. + */ + .plt : { + *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) + } + ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") + .rela.dyn : { + *(.rela.*) *(.rela_*) + } + ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") + /* * uncompressed image info used by the decompressor * it should match struct vmlinux_info
@@ -237,28 +259,6 @@ SECTIONS #endif } :NONE - /* - * Make sure that the .got.plt is either completely empty or it - * contains only the three reserved double words. - */ - .got.plt : { - *(.got.plt) - } - ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!") - - /* - * Sections that should stay zero sized, which is safer to - * explicitly check instead of blindly discarding. - */ - .plt : { - *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) - } - ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") - .rela.dyn : { - *(.rela.*) *(.rela_*) - } - ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") - /* Sections to be discarded */ DISCARDS /DISCARD/ : {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/277 ACPI: property: Fix buffer properties extraction for subnodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit d0759b10989c5c5aae3d455458c9fc4e8cc694f7 upstream.
The ACPI handle passed to acpi_extract_properties() as the first argument represents the ACPI namespace scope in which to look for objects returning buffers associated with buffer properties.
For _DSD objects located immediately under ACPI devices, this handle is the same as the handle of the device object holding the _DSD, but for data-only subnodes it is not so.
First of all, data-only subnodes are represented by objects that cannot hold other objects in their scopes (like control methods). Therefore a data-only subnode handle cannot be used for completing relative pathname segments, so the current code in
in acpi_nondev_subnode_extract() passing a data-only subnode handle to acpi_extract_properties() is invalid.
Moreover, a data-only subnode of device A may be represented by an object located in the scope of device B (which kind of makes sense, for instance, if A is a B's child). In that case, the scope in question would be the one of device B. In other words, the scope mentioned above is the same as the scope used for subnode object lookup in acpi_nondev_subnode_extract().
Accordingly, rearrange that function to use the same scope for the extraction of properties and subnode object lookup.
--- drivers/acpi/property.c | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-)
drivers/acpi/property.c +11 -19
@@ -83,6 +83,7 @@ static bool acpi_nondev_subnode_extract( struct fwnode_handle *parent) {struct acpi_data_node *dn; +acpi_handle scope =NULL ;bool result;if (acpi_graph_ignore_port (handle))
@@ -98,27 +99,18 @@ static bool acpi_nondev_subnode_extract(INIT_LIST_HEAD (&dn->data.properties);INIT_LIST_HEAD (&dn->data.subnodes); - result =acpi_extract_properties (handle, desc, &dn->data); +/* +* The scope for the completion of relative pathname segments and +* subnode object lookup is the one of the namespace node (device) +* containing the object that has returned the package. That is, it's +* the scope of that object's parent device. +*/ +if (handle) +acpi_get_parent (handle, &scope); -if (handle) { -acpi_handle scope; -acpi_status status; - -/* -* The scope for the subnode object lookup is the one of the -* namespace node (device) containing the object that has -* returned the package. That is, it's the scope of that -* object's parent. -*/ - status =acpi_get_parent (handle, &scope); -if (ACPI_SUCCESS (status) - &&acpi_enumerate_nondev_subnodes (scope, desc, &dn->data, - &dn->fwnode)) - result = true; - }else if (acpi_enumerate_nondev_subnodes (NULL , desc, &dn->data, - &dn->fwnode)) { + result =acpi_extract_properties (scope, desc, &dn->data); +if (acpi_enumerate_nondev_subnodes (scope, desc, &dn->data, &dn->fwnode)) result = true; - }if (result) { dn->handle = handle;
Greg Kroah-Hartman
maintainerPATCH 86/277 ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Tang <[email protected]>
commit 4aac453deca0d9c61df18d968f8864c3ae7d3d8d upstream.
Previously, after rmmod acpi_tad, modprobe acpi_tad would fail with this dmesg:
sysfs: cannot create duplicate filename '/devices/platform/ACPI000E:00/time'
Call Trace: <TASK> dump_stack_lvl+0x6c/0x90 dump_stack+0x10/0x20 sysfs_warn_dup+0x8b/0xa0 sysfs_add_file_mode_ns+0x122/0x130 internal_create_group+0x1dd/0x4c0 sysfs_create_group+0x13/0x20 acpi_tad_probe+0x147/0x1f0 [acpi_tad] platform_probe+0x42/0xb0 </TASK>
acpi-tad ACPI000E:00: probe with driver acpi-tad failed with error -17
--- drivers/acpi/acpi_tad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_tad.c +3 -0
@@ -565,6 +565,9 @@ static void acpi_tad_remove(struct platfpm_runtime_get_sync (dev); +if (dd->capabilities &ACPI_TAD_RT ) +sysfs_remove_group (&dev->kobj, &acpi_tad_time_attr_group); +if (dd->capabilities &ACPI_TAD_DC_WAKE )sysfs_remove_group (&dev->kobj, &acpi_tad_dc_attr_group);
Greg Kroah-Hartman
maintainerPATCH 87/277 ACPI: debug: fix signedness issues in read/write helpers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Mohammad Jahangirzad <[email protected]>
commit 496f9372eae14775e0524e83e952814691fe850a upstream.
In the ACPI debugger interface, the helper functions for read and write operations use "int" as the length parameter data type. When a large "size_t count" is passed from the file operations, this cast to "int" results in truncation and a negative value due to signed integer representation.
Logically, this negative number propagates to the min() calculation, where it is selected over the positive buffer space value, leading to unexpected behavior. Subsequently, when this negative value is used in copy_to_user() or copy_from_user(), it is interpreted as a large positive value due to the unsigned nature of the size parameter in these functions, causing the copy operations to attempt handling sizes far beyond the intended buffer limits.
Address the issue by:
- Changing the length parameters in acpi_aml_read_user() and acpi_aml_write_user() from "int" to "size_t", aligning with the expected unsigned size semantics.
- Updating return types and local variables in acpi_aml_read() and acpi_aml_write() to "ssize_t" for consistency with kernel file operation conventions.
- Using "size_t" for the "n" variable to ensure calculations remain unsigned.
- Using min_t() for circ_count_to_end() and circ_space_to_end() to ensure type-safe comparisons and prevent integer overflow.
--- drivers/acpi/acpi_dbg.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/acpi/acpi_dbg.c +13 -13
@@ -569,11 +569,11 @@ static int acpi_aml_release(struct inodereturn 0 ; } -static int acpi_aml_read_user (char __user *buf,int len) +static ssize_t acpi_aml_read_user (char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.out_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_read (crc,ACPI_AML_OUT_USER );
@@ -582,7 +582,7 @@ static int acpi_aml_read_user(char __use/* sync head before removing logs */ smp_rmb (); p = &crc->buf[crc->tail]; - n =min (len,circ_count_to_end (crc)); + n =min_t (size_t, len,circ_count_to_end (crc));if (copy_to_user (buf, p, n)) { ret = -EFAULT ; goto out;
@@ -599,8 +599,8 @@ out:static ssize_t acpi_aml_read (struct file *file,char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
@@ -639,11 +639,11 @@ again:return size >0 ? size : ret; } -static int acpi_aml_write_user (const char __user *buf,int len) +static ssize_t acpi_aml_write_user (const char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.in_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_write (crc,ACPI_AML_IN_USER );
@@ -652,7 +652,7 @@ static int acpi_aml_write_user(const cha/* sync tail before inserting cmds */ smp_mb (); p = &crc->buf[crc->head]; - n =min (len,circ_space_to_end (crc)); + n =min_t (size_t, len,circ_space_to_end (crc));if (copy_from_user (p, buf, n)) { ret = -EFAULT ; goto out;
@@ -663,14 +663,14 @@ static int acpi_aml_write_user(const cha ret = n; out:acpi_aml_unlock_fifo (ACPI_AML_IN_USER , ret >=0 ); -return n; +return ret; }static ssize_t acpi_aml_write (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 88/277 arm64: dts: qcom: msm8916: Add missing MDSS reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 99b78773c2ae55dcc01025f94eae8ce9700ae985 upstream.
On most MSM8916 devices (aside from the DragonBoard 410c), the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state.
The reset for MDSS is currently missing in msm8916.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers:
dsi_err_worker: status=6
dsi_err_worker: status=6
dsi_err_worker: status=6
...
It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -0
@@ -1540,6 +1540,8 @@ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; + resets = <&gcc GCC_MDSS_BCR>; + interrupt-controller; #interrupt-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 89/277 arm64: dts: qcom: msm8939: Add missing MDSS reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit f73c82c855e186e9b67125e3eee743960320e43c upstream.
On most MSM8939 devices, the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state.
The reset for MDSS is currently missing in msm8939.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers:
dsi_err_worker: status=6
dsi_err_worker: status=6
dsi_err_worker: status=6
...
It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module.
--- arch/arm64/boot/dts/qcom/msm8939.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8939.dtsi +2 -0
@@ -1218,6 +1218,8 @@ power-domains = <&gcc MDSS_GDSC>; + resets = <&gcc GCC_MDSS_BCR>; + #address-cells = <1>; #size-cells = <1>; #interrupt-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 90/277 arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 316294bb6695a43a9181973ecd4e6fb3e576a9f7 upstream.
Reading the hardware registers of the &slimbam on RB3 reveals that the BAM supports only 23 pipes (channels) and supports 4 EEs instead of 2. This hasn't caused problems so far since nothing is using the extra channels, but attempting to use them would lead to crashes.
The bam_dma driver might warn in the future if the num-channels in the DT are wrong, so correct the properties in the DT to avoid future regressions.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sdm845.dtsi +2 -2
@@ -5365,11 +5365,11 @@ compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0"; qcom,controlled-remotely; reg = <0 0x17184000 0 0x2a000>; - num-channels = <31>; + num-channels = <23>; interrupts = <GIC_SPI 164 IRQ_TYPE_LEVEL_HIGH>; #dma-cells = <1>; qcom,ee = <1>; - qcom,num-ees = <2>; + qcom,num-ees = <4>; iommus = <&apps_smmu 0x1806 0x0>; };
Greg Kroah-Hartman
maintainerPATCH 91/277 arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrs Vinarskis <[email protected]>
commit b9a185198f96259311543b30d884d8c01da913f7 upstream.
pm8010 is a camera specific PMIC, and may not be present on some devices. These may instead use a dedicated vreg for this purpose (Dell XPS 9345, Dell Inspiron..) or use USB webcam instead of a MIPI one alltogether (Lenovo Thinbook 16, Lenovo Yoga..).
Disable pm8010 by default, let platforms that actually have one onboard enable it instead.
--- arch/arm64/boot/dts/qcom/x1e80100-pmics.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/x1e80100-pmics.dtsi +2 -0
@@ -475,6 +475,8 @@ #address-cells = <1>; #size-cells = <0>; + status = "disabled"; + pm8010_temp_alarm: temp-alarm@2400 { compatible = "qcom,spmi-temp-alarm"; reg = <0x2400>;
Greg Kroah-Hartman
maintainerPATCH 92/277 arm64: dts: ti: k3-am62a-main: Fix main padcfg length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vibhore Vardhan <[email protected]>
commit 4c4e48afb6d85c1a8f9fdbae1fdf17ceef4a6f5b upstream.
The main pad configuration register region starts with the register MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG0 with address 0x000f4000 and ends with the MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG150 register with address 0x000f4258, as a result of which, total size of the region is 0x25c instead of 0x2ac.
Reference Docs
TRM (AM62A) - https://www.ti.com/lit/ug/spruj16b/spruj16b.pdf
TRM (AM62D) - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf
--- arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +1 -1
@@ -258,7 +258,7 @@ main_pmx0: pinctrl@f4000 { compatible = "pinctrl-single"; - reg = <0x00 0xf4000 0x00 0x2ac>; + reg = <0x00 0xf4000 0x00 0x25c>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Greg Kroah-Hartman
maintainerPATCH 93/277 arm64: kprobes: call set_memory_rox() for kprobe page
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
commit 195a1b7d8388c0ec2969a39324feb8bebf9bb907 upstream.
The kprobe page is allocated by execmem allocator with ROX permission. It needs to call set_memory_rox() to set proper permission for the direct map too. It was missed.
--- arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/arm64/kernel/probes/kprobes.c +12 -0
@@ -10,6 +10,7 @@#define pr_fmt (fmt) "kprobes: " fmt +#include <linux/execmem.h> #include <linux/extable.h> #include <linux/kasan.h> #include <linux/kernel.h>
@@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprstatic void __kprobes post_kprobe_handler (struct kprobe *,struct kprobe_ctlblk *,struct pt_regs *); +void *alloc_insn_page (void ) +{ +void *addr; + + addr =execmem_alloc (EXECMEM_KPROBES ,PAGE_SIZE ); +if (!addr) +return NULL ; +set_memory_rox ((unsigned long )addr,1 ); +return addr; +} +static void __kprobes arch_prepare_ss_slot (struct kprobe *p) {kprobe_opcode_t *addr = p->ainsn.api.insn;
Greg Kroah-Hartman
maintainerPATCH 94/277 ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit 8a6506e1ba0d2b831729808d958aae77604f12f9 upstream.
There is an issue possible where TI AM33xx SoCs do not boot properly after a reset if EMU0/EMU1 pins were used as GPIO and have been driving low level actively prior to reset [1].
"Advisory 1.0.36 EMU0 and EMU1: Terminals Must be Pulled High Before ICEPick Samples
The state of the EMU[1:0] terminals are latched during reset to determine ICEPick boot mode. For normal device operation, these terminals must be pulled up to a valid high logic level ( > VIH min) before ICEPick samples the state of these terminals, which occurs
[five CLK_M_OSC clock cycles - 10 ns] after the falling edge of WARMRSTn.
Many applications may not require the secondary GPIO function of the EMU[1:0] terminals. In this case, they would only be connected to pull-up resistors, which ensures they are always high when ICEPick samples. However, some applications may need to use these terminals as GPIO where they could be driven low before reset is asserted. This usage of the EMU[1:0] terminals may require special attention to ensure the terminals are allowed to return to a valid high-logic level before ICEPick samples the state of these terminals.
When any device reset is asserted, the pin mux mode of EMU[1:0] terminals configured to operate as GPIO (mode 7) will change back to EMU input (mode 0) on the falling edge of WARMRSTn. This only provides a short period of time for the terminals to return high if driven low before reset is asserted...
If the EMU[1:0] terminals are configured to operate as GPIO, the product should be designed such these terminals can be pulled to a valid high-logic level within 190 ns after the falling edge of WARMRSTn."
We've noticed this problem with custom am335x hardware in combination with recently implemented cold reset method
(commit 6521f6a195c70 ("ARM: AM33xx: PRM: Implement REBOOT_COLD")). It looks like the problem can affect other HW, for instance AM335x Chiliboard, because the latter has LEDs on GPIO3_7/GPIO3_8 as well.
One option would be to check if the pins are in GPIO mode and either switch to output active high, or switch to input and poll until the external pull-ups have brought the pins to the desired high state. But fighting with GPIO driver for these pins is probably not the most straight forward approch in a reboot handler.
Fortunately we can easily control pinmuxing here and rely on the external pull-ups. TI recommends 4k7 external pull up resistors [2] and even with quite conservative estimation for pin capacity (1 uF should never happen) the required delay shall not exceed 5ms.
[1] Link: https://www.ti.com/lit/pdf/sprz360
[2] Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/866346/am3352-emu-1-0-questions
--- arch/arm/mach-omap2/am33xx-restart.c | 36 +++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
arch/arm/mach-omap2/am33xx-restart.c +36 -0
@@ -2,12 +2,46 @@/* * am33xx-restart.c - Code common to all AM33xx machines. */ +#include <dt-bindings/pinctrl/am33xx.h> +#include <linux/delay.h> #include <linux/kernel.h> #include <linux/reboot.h> #include "common.h" +#include "control.h" #include "prm.h" +/* +* Advisory 1.0.36 EMU0 and EMU1: Terminals Must be Pulled High Before +* ICEPick Samples +* +* If EMU0/EMU1 pins have been used as GPIO outputs and actively driving low +* level, the device might not reboot in normal mode. We are in a bad position +* to override GPIO state here, so just switch the pins into EMU input mode +* (that's what reset will do anyway) and wait a bit, because the state will be +* latched 190 ns after reset. +*/ +static void am33xx_advisory_1_0_36 (void ) +{ +u32 emu0 =omap_ctrl_readl (AM335X_PIN_EMU0 ); +u32 emu1 =omap_ctrl_readl (AM335X_PIN_EMU1 ); + +/* If both pins are in EMU mode, nothing to do */ +if (!(emu0 &7 ) && !(emu1 &7 )) +return ; + +/* Switch GPIO3_7/GPIO3_8 into EMU0/EMU1 modes respectively */ +omap_ctrl_writel (emu0 & ~7 ,AM335X_PIN_EMU0 ); +omap_ctrl_writel (emu1 & ~7 ,AM335X_PIN_EMU1 ); + +/* +* Give pull-ups time to load the pin/PCB trace capacity. +* 5 ms shall be enough to load 1 uF (would be huge capacity for these +* pins) with TI-recommended 4k7 external pull-ups. +*/ +mdelay (5 ); +} +/** * am33xx_restart - trigger a software restart of the SoC * @mode: the "reboot mode", see arch/arm/kernel/{setup,process}.c
@@ -18,6 +52,8 @@*/ void am33xx_restart (enum reboot_mode mode,const char *cmd) { +am33xx_advisory_1_0_36 (); +/* TODO: Handle cmd if necessary */ prm_reboot_mode = mode;
Greg Kroah-Hartman
maintainerPATCH 95/277 ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 74139a64e8cedb6d971c78d5d17384efeced1725 upstream.
Add missing of_node_put() calls to release device node references obtained via of_parse_phandle().
--- arch/arm/mach-omap2/pm33xx-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/pm33xx-core.c +5 -1
@@ -388,12 +388,15 @@ static int __init amx3_idle_init(structif (!state_node)break ; -if (!of_device_is_available (state_node)) +if (!of_device_is_available (state_node)) { +of_node_put (state_node);continue ; + }if (i ==CPUIDLE_STATE_MAX ) {pr_warn ("%s: cpuidle states reached max possible\n" , __func__); +of_node_put (state_node);break ; }
@@ -403,6 +406,7 @@ static int __init amx3_idle_init(struct states[state_count].wfi_flags |=WFI_FLAG_WAKE_M3 |WFI_FLAG_FLUSH_CACHE ; +of_node_put (state_node); state_count++; }
Greg Kroah-Hartman
maintainerPATCH 96/277 perf/arm-cmn: Fix CMN S3 DTM offset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit b3fe1c83a56f3cb7c475747ee1c6ec5a9dd5f60e upstream.
CMN S3's DTM offset is different between r0px and r1p0, and it turns out this was not a error in the earlier documentation, but does actually exist in the design. Lovely.
--- drivers/perf/arm-cmn.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/perf/arm-cmn.c +6 -3
@@ -65,7 +65,7 @@/* PMU registers occupy the 3rd 4KB page of each node's region */ #define CMN_PMU_OFFSET 0x2000/* ...except when they don't :( */ -#define CMN_S3_DTM_OFFSET 0xa000 +#define CMN_S3_R1_DTM_OFFSET 0xa000#define CMN_S3_PMU_OFFSET 0xd900/* For most nodes, this is all there is */
@@ -233,6 +233,9 @@ enum cmn_revision {REV_CMN700_R1P0 ,REV_CMN700_R2P0 ,REV_CMN700_R3P0 , +REV_CMNS3_R0P0 =0 , +REV_CMNS3_R0P1 , +REV_CMNS3_R1P0 ,REV_CI700_R0P0 =0 ,REV_CI700_R1P0 , REV_CI700_R2P0,
@@ -425,8 +428,8 @@ static enum cmn_model arm_cmn_model(consstatic int arm_cmn_pmu_offset (const struct arm_cmn *cmn,const struct arm_cmn_node *dn) {if (cmn->part ==PART_CMN_S3 ) { -if (dn->type ==CMN_TYPE_XP ) -return CMN_S3_DTM_OFFSET ; +if (cmn->rev >=REV_CMNS3_R1P0 && dn->type ==CMN_TYPE_XP ) +return CMN_S3_R1_DTM_OFFSET ;return CMN_S3_PMU_OFFSET ; }return CMN_PMU_OFFSET ;
Greg Kroah-Hartman
maintainerPATCH 97/277 dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Riesch <[email protected]>
commit c254815b02673cc77a84103c4c0d6197bd90c0ef upstream.
There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568 variant) that are powered on by default as they are part of the ALIVE power domain.
Remove 'power-domains' from the required properties in order to avoid false positives.
--- Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml +14 -1
@@ -57,11 +57,24 @@ required: - clocks - clock-names - '#phy-cells' - - power-domains - resets - reset-names - rockchip,grf +allOf: + - if: + properties: + compatible: + contains: + enum: + - rockchip,px30-csi-dphy + - rockchip,rk1808-csi-dphy + - rockchip,rk3326-csi-dphy + - rockchip,rk3368-csi-dphy + then: + required: + - power-domains + additionalProperties: false examples:
Greg Kroah-Hartman
maintainerPATCH 98/277 xen/events: Cleanup find_virq() return codes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream.
rc is overwritten by the evtchn_status hypercall in each iteration, so the return value will be whatever the last iteration is. This could incorrectly return success even if the event channel was not found. Change to an explicit -ENOENT for an un-found virq and return 0 on a successful match.
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/xen/events/events_base.c +4 -3
@@ -1324,10 +1324,11 @@ static int find_virq(unsigned int virq, {struct evtchn_status status;evtchn_port_t port; -int rc = -ENOENT ;memset (&status,0 ,sizeof (status));for (port =0 ; port <xen_evtchn_max_channels (); port++) { +int rc; + status.dom =DOMID_SELF ; status.port = port; rc =HYPERVISOR_event_channel_op (EVTCHNOP_status, &status);
@@ -1337,10 +1338,10 @@ static int find_virq(unsigned int virq,continue ;if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) { *evtchn = port; -break ; +return 0 ; } } -return rc; +return -ENOENT ; }/**
Greg Kroah-Hartman
maintainerPATCH 99/277 xen/manage: Fix suspend error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit f770c3d858687252f1270265ba152d5c622e793f upstream.
The device power management API has the following asymmetry:
* dpm_suspend_start() does not clean up on failure (it requires a call to dpm_resume_end())
* dpm_suspend_end() does clean up on failure
(it does not require a call to dpm_resume_start())
The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related patches for 2.6.27") in June 2008: It removed a call to device_resume() from device_suspend() (which was later renamed to dpm_suspend_start()).
When Xen began using the device power management API in May 2008 with commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did not yet exist. But since it was introduced, a call to dpm_resume_end() is missing in the error path of dpm_suspend_start(). Fix it.
Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de>
--- drivers/xen/manage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/manage.c +2 -1
@@ -116,7 +116,7 @@ static void do_suspend(void) err =dpm_suspend_start (PMSG_FREEZE );if (err) {pr_err ("%s: dpm_suspend_start %d\n" , __func__, err); - goto out_thaw; + goto out_resume_end; }printk (KERN_DEBUG "suspending xenstore...\n" );
@@ -156,6 +156,7 @@ out_resume:else xs_suspend_cancel (); +out_resume_end:dpm_resume_end (si.cancelled ?PMSG_THAW :PMSG_RESTORE ); out_thaw:
Greg Kroah-Hartman
maintainerPATCH 100/277 xen/events: Return -EEXIST for bound VIRQs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 07ce121d93a5e5fb2440a24da3dbf408fcee978e upstream.
Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards.
Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON().
A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/xen/events/events_base.c +14 -5
@@ -1320,10 +1320,12 @@ int bind_interdomain_evtchn_to_irq_latee }EXPORT_SYMBOL_GPL (bind_interdomain_evtchn_to_irq_lateeoi); -static int find_virq (unsigned int virq,unsigned int cpu,evtchn_port_t *evtchn) +static int find_virq (unsigned int virq,unsigned int cpu,evtchn_port_t *evtchn, +bool percpu) {struct evtchn_status status;evtchn_port_t port; +bool exists = false;memset (&status,0 ,sizeof (status));for (port =0 ; port <xen_evtchn_max_channels (); port++) {
@@ -1336,12 +1338,16 @@ static int find_virq(unsigned int virq,continue ;if (status.status != EVTCHNSTAT_virq)continue ; -if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) { +if (status.u.virq != virq) +continue ; +if (status.vcpu ==xen_vcpu_nr (cpu)) { *evtchn = port;return 0 ; + }else if (!percpu) { + exists = true; } } -return -ENOENT ; +return exists ? -EEXIST : -ENOENT ; }/**
@@ -1388,8 +1394,11 @@ int bind_virq_to_irq(unsigned int virq, evtchn = bind_virq.port; else {if (ret == -EEXIST ) - ret =find_virq (virq, cpu, &evtchn); -BUG_ON (ret <0 ); + ret =find_virq (virq, cpu, &evtchn, percpu); +if (ret) { +__unbind_from_irq (info, info->irq); + goto out; + } } ret =xen_irq_info_virq_setup (info, cpu, evtchn, virq);
Greg Kroah-Hartman
maintainerPATCH 101/277 xen/events: Update virq_to_irq on migration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 3fcc8e146935415d69ffabb5df40ecf50e106131 upstream.
VIRQs come in 3 flavors, per-VPU, per-domain, and global, and the VIRQs are tracked in per-cpu virq_to_irq arrays.
Per-domain and global VIRQs must be bound on CPU 0, and bind_virq_to_irq() sets the per_cpu virq_to_irq at registration time Later, the interrupt can migrate, and info->cpu is updated. When calling __unbind_from_irq(), the per-cpu virq_to_irq is cleared for a different cpu. If bind_virq_to_irq() is called again with CPU 0, the stale irq is returned. There won't be any irq_info for the irq, so things break.
Make xen_rebind_evtchn_to_cpu() update the per_cpu virq_to_irq mappings to keep them update to date with the current cpu. This ensures the correct virq_to_irq is cleared in __unbind_from_irq().
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/xen/events/events_base.c +12 -1
@@ -1803,9 +1803,20 @@ static int xen_rebind_evtchn_to_cpu(stru* virq or IPI channel, which don't actually need to be rebound. Ignore * it, but don't do the xenlinux-level rebind in that case. */ -if (HYPERVISOR_event_channel_op (EVTCHNOP_bind_vcpu, &bind_vcpu) >=0 ) +if (HYPERVISOR_event_channel_op (EVTCHNOP_bind_vcpu, &bind_vcpu) >=0 ) { +int old_cpu = info->cpu; +bind_evtchn_to_cpu (info, tcpu, false); +if (info->type ==IRQT_VIRQ ) { +int virq = info->u.virq; +int irq =per_cpu (virq_to_irq, old_cpu)[virq]; + +per_cpu (virq_to_irq, old_cpu)[virq] =-1 ; +per_cpu (virq_to_irq, tcpu)[virq] = irq; + } + } +do_unmask (info,EVT_MASK_REASON_TEMPORARY );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 102/277 firmware: meson_sm: fix device leak at probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream.
Make sure to drop the reference to the secure monitor device taken by of_find_device_by_node() when looking up its driver data on behalf of other drivers (e.g. during probe).
Note that holding a reference to the platform device does not prevent its driver data from going away so there is no point in keeping the reference after the helper returns.
--- drivers/firmware/meson/meson_sm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/firmware/meson/meson_sm.c +6 -1
@@ -232,11 +232,16 @@ EXPORT_SYMBOL(meson_sm_call_write);struct meson_sm_firmware *meson_sm_get (struct device_node *sm_node) {struct platform_device *pdev =of_find_device_by_node (sm_node); +struct meson_sm_firmware *fw;if (!pdev)return NULL ; -return platform_get_drvdata (pdev); + fw =platform_get_drvdata (pdev); + +put_device (&pdev->dev); + +return fw; }EXPORT_SYMBOL_GPL (meson_sm_get);
Greg Kroah-Hartman
maintainerPATCH 103/277 media: cec: extron-da-hd-4k-plus: drop external-module make commands
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
commit d5d12cc03e501c38925e544abe44d5bfe23dc930 upstream.
Delete the external-module style Makefile commands. They are not needed for in-tree modules.
This is the only Makefile in the kernel tree (aside from tools/ and samples/) that uses this Makefile style.
The same files are built with or without this patch.
--- drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile | 6 ------ 1 file changed, 6 deletions(-)
drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile +0 -6
@@ -1,8 +1,2 @@ extron-da-hd-4k-plus-cec-objs := extron-da-hd-4k-plus.o cec-splitter.o obj-$(CONFIG_USB_EXTRON_DA_HD_4K_PLUS_CEC) := extron-da-hd-4k-plus-cec.o - -all: - $(MAKE) -C $(KDIR) M=$(shell pwd) modules - -install: - $(MAKE) -C $(KDIR) M=$(shell pwd) modules_install
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/277 media: cx18: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 23b53639a793477326fd57ed103823a8ab63084f upstream.
The DMA map functions can fail and should be tested for errors. If the mapping fails, dealloc buffers, and return.
--- drivers/media/pci/cx18/cx18-queue.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/media/pci/cx18/cx18-queue.c +10 -3
@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_streambreak ; } + buf->dma_handle =dma_map_single (&s->cx->pci_dev->dev, + buf->buf, s->buf_size, + s->dma); +if (dma_mapping_error (&s->cx->pci_dev->dev, buf->dma_handle)) { +kfree (buf->buf); +kfree (mdl); +kfree (buf); +break ; + } +INIT_LIST_HEAD (&mdl->list);INIT_LIST_HEAD (&mdl->buf_list); mdl->id = s->mdl_base_idx;/* a somewhat safe value */ cx18_enqueue (s, mdl, &s->q_idle);INIT_LIST_HEAD (&buf->list); - buf->dma_handle =dma_map_single (&s->cx->pci_dev->dev, - buf->buf, s->buf_size, - s->dma);cx18_buf_sync_for_cpu (s, buf);list_add_tail (&buf->list, &s->buf_pool); }
Greg Kroah-Hartman
maintainerPATCH 105/277 media: i2c: mt9v111: fix incorrect type for ret
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream.
Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() to store negative error codes or zero returned by __mt9v111_hw_reset() and other functions.
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants.
No effect on runtime.
--- drivers/media/i2c/mt9v111.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/mt9v111.c +1 -1
@@ -532,8 +532,8 @@ static int mt9v111_calc_frame_rate(strucstatic int mt9v111_hw_config (struct mt9v111_dev *mt9v111) {struct i2c_client *c = mt9v111->client; -unsigned int ret;u16 outfmtctrl2; +int ret;/* Force device reset. */ ret =__mt9v111_hw_reset (mt9v111);
Greg Kroah-Hartman
maintainerPATCH 106/277 media: mc: Fix MUST_CONNECT handling for pads with no links
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
commit eec81250219a209b863f11d02128ec1dd8e20877 upstream.
Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link") expanded the meaning of the MUST_CONNECT flag to require an enabled link in all cases. To do so, the link exploration code was expanded to cover unconnected pads, in order to reject those that have the MUST_CONNECT flag set. The implementation was however incorrect, ignoring unconnected pads instead of ignoring connected pads. Fix it.
--- drivers/media/mc/mc-entity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/mc/mc-entity.c +1 -1
@@ -691,7 +691,7 @@ done:* (already discovered through iterating over links) and pads * not internally connected. */ -if (origin == local || !local->num_links || +if (origin == local || local->num_links || !media_entity_has_pad_interdep (origin->entity, origin->index, local->index))continue ;
Greg Kroah-Hartman
maintainerPATCH 107/277 media: pci: ivtv: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 upstream.
The DMA map functions can fail and should be tested for errors. If the mapping fails, free blanking_ptr and set it to 0. As 0 is a valid DMA address, use blanking_ptr to test if the DMA address is set.
--- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-yuv.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/media/pci/ivtv/ivtv-irq.c +1 -1
@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct/* Insert buffer block for YUV if needed */ if (s->type ==IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) { -if (yi->blanking_dmaptr) { +if (yi->blanking_ptr) { s->sg_pending[idx].src = yi->blanking_dmaptr; s->sg_pending[idx].dst = offset; s->sg_pending[idx].size =720 *16 ;
drivers/media/pci/ivtv/ivtv-yuv.c +7 -1
@@ -125,7 +125,7 @@ static int ivtv_yuv_prep_user_dma(structivtv_udma_fill_sg_array (dma, y_buffer_offset, uv_buffer_offset, y_size);/* If we've offset the y plane, ensure top area is blanked */ -if (f->offset_y && yi->blanking_dmaptr) { +if (f->offset_y && yi->blanking_ptr) { dma->SGarray[dma->SG_length].size =cpu_to_le32 (720 *16 ); dma->SGarray[dma->SG_length].src =cpu_to_le32 (yi->blanking_dmaptr); dma->SGarray[dma->SG_length].dst =cpu_to_le32 (IVTV_DECODER_OFFSET + yuv_offset[frame]);
@@ -929,6 +929,12 @@ static void ivtv_yuv_init(struct ivtv *i yi->blanking_dmaptr =dma_map_single (&itv->pdev->dev, yi->blanking_ptr,720 *16 ,DMA_TO_DEVICE ); +if (dma_mapping_error (&itv->pdev->dev, yi->blanking_dmaptr)) { +kfree (yi->blanking_ptr); + yi->blanking_ptr =NULL ; + yi->blanking_dmaptr =0 ; +IVTV_DEBUG_WARN ("Failed to dma_map yuv blanking buffer\n" ); + } }else { yi->blanking_dmaptr =0 ;IVTV_DEBUG_WARN ("Failed to allocate yuv blanking buffer\n" );
Greg Kroah-Hartman
maintainerPATCH 108/277 media: pci: mg4b: fix uninitialized iio scan data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit c0d3f6969bb4d72476cfe7ea9263831f1c283704 upstream.
Fix potential leak of uninitialized stack data to userspace by ensuring that the scan structure is zeroed before use.
--- drivers/media/pci/mgb4/mgb4_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/mgb4/mgb4_trigger.c +1 -1
@@ -91,7 +91,7 @@ static irqreturn_t trigger_handler(int istruct {u32 data;s64 ts__aligned(8) ; - } scan; + } scan = { }; scan.data =mgb4_read_reg (&st->mgbdev->video,0xA0 );mgb4_write_reg (&st->mgbdev->video,0xA0 , scan.data);
Greg Kroah-Hartman
maintainerPATCH 109/277 media: s5p-mfc: remove an unused/uninitialized variable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c upstream.
The s5p_mfc_cmd_args structure in the v6 driver is never used, not initialized to anything other than zero, but as of clang-21 this causes a warning:
drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c:45:7: error: variable 'h2r_args' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
45 | &h2r_args);
| ^~~~~~~~
Just remove this for simplicity. Since the function is also called through a callback, this does require adding a trivial wrapper with the correct prototype.
--- drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c | 35 +++++----------- 1 file changed, 13 insertions(+), 22 deletions(-)
drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c +13 -22
@@ -14,8 +14,7 @@#include "s5p_mfc_opr.h" #include "s5p_mfc_cmd_v6.h" -static int s5p_mfc_cmd_host2risc_v6 (struct s5p_mfc_dev *dev,int cmd, -const struct s5p_mfc_cmd_args *args) +static int s5p_mfc_cmd_host2risc_v6 (struct s5p_mfc_dev *dev,int cmd) {mfc_debug (2 ,"Issue the command: %d\n" , cmd);
@@ -31,7 +30,6 @@ static int s5p_mfc_cmd_host2risc_v6(strustatic int s5p_mfc_sys_init_cmd_v6 (struct s5p_mfc_dev *dev) { -struct s5p_mfc_cmd_args h2r_args;const struct s5p_mfc_buf_size_v6 *buf_size = dev->variant->buf_size->priv;int ret;
@@ -41,33 +39,23 @@ static int s5p_mfc_sys_init_cmd_v6(strucmfc_write (dev, dev->ctx_buf.dma,S5P_FIMV_CONTEXT_MEM_ADDR_V6 );mfc_write (dev, buf_size->dev_ctx,S5P_FIMV_CONTEXT_MEM_SIZE_V6 ); -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SYS_INIT_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SYS_INIT_V6 ); }static int s5p_mfc_sleep_cmd_v6 (struct s5p_mfc_dev *dev) { -struct s5p_mfc_cmd_args h2r_args; - -memset (&h2r_args,0 ,sizeof (struct s5p_mfc_cmd_args )); -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SLEEP_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SLEEP_V6 ); }static int s5p_mfc_wakeup_cmd_v6 (struct s5p_mfc_dev *dev) { -struct s5p_mfc_cmd_args h2r_args; - -memset (&h2r_args,0 ,sizeof (struct s5p_mfc_cmd_args )); -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_WAKEUP_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_WAKEUP_V6 ); }/* Open a new instance and get its number */ static int s5p_mfc_open_inst_cmd_v6 (struct s5p_mfc_ctx *ctx) {struct s5p_mfc_dev *dev = ctx->dev; -struct s5p_mfc_cmd_args h2r_args;int codec_type;mfc_debug (2 ,"Requested codec mode: %d\n" , ctx->codec_mode);
@@ -129,23 +117,20 @@ static int s5p_mfc_open_inst_cmd_v6(strumfc_write (dev, ctx->ctx.size,S5P_FIMV_CONTEXT_MEM_SIZE_V6 );mfc_write (dev,0 ,S5P_FIMV_D_CRC_CTRL_V6 );/* no crc */ -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6 ); }/* Close instance */ static int s5p_mfc_close_inst_cmd_v6 (struct s5p_mfc_ctx *ctx) {struct s5p_mfc_dev *dev = ctx->dev; -struct s5p_mfc_cmd_args h2r_args;int ret =0 ; dev->curr_ctx = ctx->num;if (ctx->state !=MFCINST_FREE ) {mfc_write (dev, ctx->inst_no,S5P_FIMV_INSTANCE_ID_V6 ); ret =s5p_mfc_cmd_host2risc_v6 (dev, -S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6 , - &h2r_args); +S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6 ); }else { ret = -EINVAL ; }
@@ -153,9 +138,15 @@ static int s5p_mfc_close_inst_cmd_v6(strreturn ret; } +static int s5p_mfc_cmd_host2risc_v6_args (struct s5p_mfc_dev *dev,int cmd, +const struct s5p_mfc_cmd_args *ignored) +{ +return s5p_mfc_cmd_host2risc_v6 (dev, cmd); +} +/* Initialize cmd function pointers for MFC v6 */ static const struct s5p_mfc_hw_cmds s5p_mfc_cmds_v6 = { - .cmd_host2risc = s5p_mfc_cmd_host2risc_v6, + .cmd_host2risc = s5p_mfc_cmd_host2risc_v6_args, .sys_init_cmd = s5p_mfc_sys_init_cmd_v6, .sleep_cmd = s5p_mfc_sleep_cmd_v6, .wakeup_cmd = s5p_mfc_wakeup_cmd_v6,
Greg Kroah-Hartman
maintainerPATCH 110/277 media: venus: firmware: Use correct reset sequence for IRIS2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 93f213b444a40f1e7a4383b499b65e782dcb14b9 upstream.
When starting venus with the "no_tz" code path, IRIS2 needs the same boot/reset sequence as IRIS2_1. This is because most of the registers were moved to the "wrapper_tz_base", which is already defined for both IRIS2 and IRIS2_1 inside core.c. Add IRIS2 to the checks inside firmware.c as well to make sure that it uses the correct reset sequence.
Both IRIS2 and IRIS2_1 are HFI v6 variants, so the correct sequence was used before commit c38610f8981e ("media: venus: firmware: Sanitize per-VPU-version").
--- drivers/media/platform/qcom/venus/firmware.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/platform/qcom/venus/firmware.c +4 -4
@@ -30,7 +30,7 @@ static void venus_reset_cpu(struct venusu32 fw_size = core->fw.mapped_mem_size;void __iomem *wrapper_base; -if (IS_IRIS2_1 (core)) +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core)) wrapper_base = core->wrapper_tz_base;else wrapper_base = core->wrapper_base;
@@ -42,7 +42,7 @@ static void venus_reset_cpu(struct venuswritel (fw_size, wrapper_base +WRAPPER_NONPIX_START_ADDR );writel (fw_size, wrapper_base +WRAPPER_NONPIX_END_ADDR ); -if (IS_IRIS2_1 (core)) { +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core)) {/* Bring XTSS out of reset */ writel (0 , wrapper_base +WRAPPER_TZ_XTSS_SW_RESET ); }else {
@@ -68,7 +68,7 @@ int venus_set_hw_state(struct venus_coreif (resume) {venus_reset_cpu (core); }else { -if (IS_IRIS2_1 (core)) +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core))writel (WRAPPER_XTSS_SW_RESET_BIT , core->wrapper_tz_base +WRAPPER_TZ_XTSS_SW_RESET );else
@@ -181,7 +181,7 @@ static int venus_shutdown_no_tz(struct vvoid __iomem *wrapper_base = core->wrapper_base;void __iomem *wrapper_tz_base = core->wrapper_tz_base; -if (IS_IRIS2_1 (core)) { +if (IS_IRIS2 (core) ||IS_IRIS2_1 (core)) {/* Assert the reset to XTSS */ reg =readl (wrapper_tz_base +WRAPPER_TZ_XTSS_SW_RESET ); reg |=WRAPPER_XTSS_SW_RESET_BIT ;
Greg Kroah-Hartman
maintainerPATCH 111/277 media: vivid: fix disappearing <Vendor Command With ID> messages
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit 4bd8a6147645480d550242ff816b4c7ba160e5b7 upstream.
The vivid driver supports the <Vendor Command With ID> message, but if the Vendor ID of the received message didn't match the Vendor ID of the CEC Adapter, then it ignores it (good) and returns 0 (bad).
It should return -ENOMSG to indicate that other followers should be asked to handle it. Return code 0 means that the driver handled it, which is wrong in this case.
As a result, userspace followers never get the chance to process such a message.
Refactor the code a bit to have the function return -ENOMSG at the end, drop the default case, and ensure that the message handlers return 0.
That way 0 is only returned if the message is actually handled in the vivid_received() function.
--- drivers/media/test-drivers/vivid/vivid-cec.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/media/test-drivers/vivid/vivid-cec.c +5 -7
@@ -327,7 +327,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg)char osd[14 ];if (!cec_is_sink (adap)) -return -ENOMSG ; +break ;cec_ops_set_osd_string (msg, &disp_ctl, osd);switch (disp_ctl) {case CEC_OP_DISP_CTL_DEFAULT :
@@ -348,7 +348,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg)cec_transmit_msg (adap, &reply, false);break ; } -break ; +return 0 ; }case CEC_MSG_VENDOR_COMMAND_WITH_ID : {u32 vendor_id;
@@ -379,7 +379,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg)if (size ==1 ) {// Ignore even op values if (!(vendor_cmd[0 ] &1 )) -break ; +return 0 ; reply.len = msg->len;memcpy (reply.msg +1 , msg->msg +1 , msg->len -1 ); reply.msg[msg->len -1 ]++;
@@ -388,12 +388,10 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg) CEC_OP_ABORT_INVALID_OP); }cec_transmit_msg (adap, &reply, false); -break ; +return 0 ; } -default : -return -ENOMSG ; } -return 0 ; +return -ENOMSG ; }static const struct cec_adap_ops vivid_cec_adap_ops = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/277 media: ti: j721e-csi2rx: Use devm_of_platform_populate
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jai Luthra <[email protected]>
commit 072799db233f9de90a62be54c1e59275c2db3969 upstream.
Ensure that we clean up the platform bus when we remove this driver.
This fixes a crash seen when reloading the module for the child device with the parent not yet reloaded.
--- drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c +1 -1
@@ -1121,7 +1121,7 @@ static int ti_csi2rx_probe(struct platfoif (ret) goto err_vb2q; - ret =of_platform_populate (csi->dev->of_node,NULL ,NULL , csi->dev); + ret =devm_of_platform_populate (csi->dev);if (ret) {dev_err (csi->dev,"Failed to create children: %d\n" , ret); goto err_subdev;
Greg Kroah-Hartman
maintainerPATCH 113/277 media: ti: j721e-csi2rx: Fix source subdev link creation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jai Luthra <[email protected]>
commit 3e743cd0a73246219da117ee99061aad51c4748c upstream.
We don't use OF ports and remote-endpoints to connect the CSI2RX bridge and this device in the device tree, thus it is wrong to use v4l2_create_fwnode_links_to_pad() to create the media graph link between the two.
It works out on accident, as neither the source nor the sink implement the .get_fwnode_pad() callback, and the framework helper falls back on using the first source and sink pads to create the link between them.
Instead, manually create the media link from the first source pad of the bridge to the first sink pad of the J721E CSI2RX.
--- drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c +5 -2
@@ -52,6 +52,8 @@#define DRAIN_TIMEOUT_MS 50#define DRAIN_BUFFER_SIZE SZ_32K +#define CSI2RX_BRIDGE_SOURCE_PAD 1 +struct ti_csi2rx_fmt {u32 fourcc;/* Four character code. */ u32 code;/* Mbus code. */
@@ -426,8 +428,9 @@ static int csi_async_notifier_complete(sif (ret)return ret; - ret =v4l2_create_fwnode_links_to_pad (csi->source, &csi->pad, -MEDIA_LNK_FL_IMMUTABLE |MEDIA_LNK_FL_ENABLED ); + ret =media_create_pad_link (&csi->source->entity,CSI2RX_BRIDGE_SOURCE_PAD , + &vdev->entity, csi->pad.index, +MEDIA_LNK_FL_IMMUTABLE |MEDIA_LNK_FL_ENABLED );if (ret) {video_unregister_device (vdev);
Greg Kroah-Hartman
maintainerPATCH 114/277 media: lirc: Fix error handling in lirc_register()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream.
When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count.
Found by code review.
--- drivers/media/rc/lirc_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/rc/lirc_dev.c +5 -4
@@ -736,11 +736,11 @@ int lirc_register(struct rc_dev *dev)cdev_init (&dev->lirc_cdev, &lirc_fops); +get_device (&dev->dev); + err =cdev_device_add (&dev->lirc_cdev, &dev->lirc_dev);if (err) - goto out_ida; - -get_device (&dev->dev); + goto out_put_device;switch (dev->driver_type) {case RC_DRIVER_SCANCODE :
@@ -764,7 +764,8 @@ int lirc_register(struct rc_dev *dev)return 0 ; -out_ida: +out_put_device: +put_device (&dev->lirc_dev);ida_free (&lirc_ida, minor);return err; }
Greg Kroah-Hartman
maintainerPATCH 115/277 drm/panthor: Fix memory leak in panthor_ioctl_group_create()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit ca2a6abdaee43808034cdb218428d2ed85fd3db8 upstream.
When bailing out due to group_priority_permit() failure, the queue_args need to be freed. Fix it by rearranging the function to use the goto-on-error pattern, such that the success case flows straight without indentation while error cases jump forward to cleanup.
--- drivers/gpu/drm/panthor/panthor_drv.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/gpu/drm/panthor/panthor_drv.c +6 -5
@@ -1032,14 +1032,15 @@ static int panthor_ioctl_group_create(st ret =group_priority_permit (file, args->priority);if (ret) -return ret; + goto out; ret =panthor_group_create (pfile, args, queue_args); -if (ret >=0 ) { - args->group_handle = ret; - ret =0 ; - } +if (ret <0 ) + goto out; + args->group_handle = ret; + ret =0 ; +out:kvfree (queue_args);return ret; }
Greg Kroah-Hartman
maintainerPATCH 116/277 drm/rcar-du: dsi: Fix 1/2/3 lane support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit d83f1d19c898ac1b54ae64d1c950f5beff801982 upstream.
Remove fixed PPI lane count setup. The R-Car DSI host is capable of operating in 1..4 DSI lane mode. Remove the hard-coded 4-lane configuration from PPI register settings and instead configure the PPI lane count according to lane count information already obtained by this driver instance.
Configure TXSETR register to match PPI lane count. The R-Car V4H Reference Manual R19UH0186EJ0121 Rev.1.21 section 67.2.2.3 Tx Set Register (TXSETR), field LANECNT description indicates that the TXSETR register LANECNT bitfield lane count must be configured such, that it matches lane count configuration in PPISETR register DLEN bitfield. Make sure the LANECNT and DLEN bitfields are configured to match.
--- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 5 ++++- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 8 ++++---- 2 files changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c +4 -1
@@ -576,7 +576,10 @@ static int rcar_mipi_dsi_startup(structudelay (10 );rcar_mipi_dsi_clr (dsi,CLOCKSET1 ,CLOCKSET1_UPDATEPLL ); - ppisetr =PPISETR_DLEN_3 |PPISETR_CLEN ; +rcar_mipi_dsi_clr (dsi,TXSETR ,TXSETR_LANECNT_MASK ); +rcar_mipi_dsi_set (dsi,TXSETR , dsi->lanes -1 ); + + ppisetr = ((BIT (dsi->lanes) -1 ) &PPISETR_DLEN_MASK ) |PPISETR_CLEN ;rcar_mipi_dsi_write (dsi,PPISETR , ppisetr);rcar_mipi_dsi_set (dsi,PHYSETUP ,PHYSETUP_SHUTDOWNZ );
drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h +4 -4
@@ -12,6 +12,9 @@#define LINKSR_LPBUSY (1 << 1)#define LINKSR_HSBUSY (1 << 0) +#define TXSETR 0x100 +#define TXSETR_LANECNT_MASK (0x3 << 0) +/* * Video Mode Register */
@@ -80,10 +83,7 @@* PHY-Protocol Interface (PPI) Registers */ #define PPISETR 0x700 -#define PPISETR_DLEN_0 (0x1 << 0) -#define PPISETR_DLEN_1 (0x3 << 0) -#define PPISETR_DLEN_2 (0x7 << 0) -#define PPISETR_DLEN_3 (0xf << 0) +#define PPISETR_DLEN_MASK (0xf << 0)#define PPISETR_CLEN (1 << 8)#define PPICLCR 0x710
Greg Kroah-Hartman
maintainerPATCH 117/277 drm/nouveau: fix bad ret code in nouveau_bo_move_prep
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 upstream.
In nouveau_bo_move_prep, if nouveau_mem_map fails, an error code should be returned. Currently, it returns zero even if vmm addr is not correctly mapped.
--- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -1
@@ -852,7 +852,7 @@ done:nvif_vmm_put (vmm, &old_mem->vma[1 ]);nvif_vmm_put (vmm, &old_mem->vma[0 ]); } -return 0 ; +return ret; } static int
Greg Kroah-Hartman
maintainerPATCH 118/277 drm/xe/uapi: loosen used tracking restriction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
commit 2d1684a077d62fddfac074052c162ec6573a34e1 upstream.
Currently this is hidden behind perfmon_capable() since this is technically an info leak, given that this is a system wide metric. However the granularity reported here is always PAGE_SIZE aligned, which matches what the core kernel is already willing to expose to userspace if querying how many free RAM pages there are on the system, and that doesn't need any special privileges. In addition other drm drivers seem happy to expose this.
The motivation here if with oneAPI where they want to use the system wide 'used' reporting here, so not the per-client fdinfo stats. This has also come up with some perf overlay applications wanting this information.
--- drivers/gpu/drm/xe/xe_query.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/gpu/drm/xe/xe_query.c +6 -9
@@ -277,8 +277,7 @@ static int query_mem_regions(struct xe_d mem_regions->mem_regions[0 ].instance =0 ; mem_regions->mem_regions[0 ].min_page_size =PAGE_SIZE ; mem_regions->mem_regions[0 ].total_size = man->size <<PAGE_SHIFT ; -if (perfmon_capable ()) - mem_regions->mem_regions[0 ].used =ttm_resource_manager_usage (man); + mem_regions->mem_regions[0 ].used =ttm_resource_manager_usage (man); mem_regions->num_mem_regions =1 ;for (i =XE_PL_VRAM0 ; i <=XE_PL_VRAM1 ; ++i) {
@@ -294,13 +293,11 @@ static int query_mem_regions(struct xe_d mem_regions->mem_regions[mem_regions->num_mem_regions].total_size = man->size; -if (perfmon_capable ()) { -xe_ttm_vram_get_used (man, - &mem_regions->mem_regions - [mem_regions->num_mem_regions].used, - &mem_regions->mem_regions - [mem_regions->num_mem_regions].cpu_visible_used); - } +xe_ttm_vram_get_used (man, + &mem_regions->mem_regions + [mem_regions->num_mem_regions].used, + &mem_regions->mem_regions + [mem_regions->num_mem_regions].cpu_visible_used); mem_regions->mem_regions[mem_regions->num_mem_regions].cpu_visible_size =xe_ttm_vram_get_cpu_visible_size (man);
Greg Kroah-Hartman
maintainerPATCH 119/277 drm/amd/display: Enable Dynamic DTBCLK Switch
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <[email protected]>
commit 5949e7c4890c3cf65e783c83c355b95e21f10dba upstream.
[WHAT]
Since dcn35, DTBCLK can be disabled when no DP2 sink connected for power saving purpose.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -0
@@ -2027,6 +2027,10 @@ static int amdgpu_dm_init(struct amdgpu_ init_data.flags.disable_ips_in_vpb =0 ; +/* DCN35 and above supports dynamic DTBCLK switch */ +if (amdgpu_ip_version (adev,DCE_HWIP ,0 ) >=IP_VERSION (3 ,5 ,0 )) + init_data.flags.allow_0_dtb_clk = true; +/* Enable DWB for tested platforms only */ if (amdgpu_ip_version (adev,DCE_HWIP ,0 ) >=IP_VERSION (3 ,0 ,0 )) init_data.num_virtual_links =1 ;
Greg Kroah-Hartman
maintainerPATCH 120/277 blk-crypto: fix missing blktrace bio split events
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
commit 06d712d297649f48ebf1381d19bd24e942813b37 upstream.
trace_block_split() is missing, resulting in blktrace inability to catch BIO split events and making it harder to analyze the BIO sequence.
--- block/blk-crypto-fallback.c | 3 +++ 1 file changed, 3 insertions(+)
block/blk-crypto-fallback.c +3 -0
@@ -18,6 +18,7 @@#include <linux/module.h> #include <linux/random.h> #include <linux/scatterlist.h> +#include <trace/events/block.h> #include "blk-cgroup.h" #include "blk-crypto-internal.h"
@@ -230,7 +231,9 @@ static bool blk_crypto_fallback_split_bi bio->bi_status =BLK_STS_RESOURCE ;return false; } +bio_chain (split_bio, bio); +trace_block_split (split_bio, bio->bi_iter.bi_sector);submit_bio_noacct (bio); *bio_ptr = split_bio; }
Greg Kroah-Hartman
maintainerPATCH 121/277 btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Nascimento <[email protected]>
commit dff4f9ff5d7f289e4545cc936362e01ed3252742 upstream.
The function btrfs_encode_fh() does not properly account for the three cases it handles.
Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes).
However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes).
If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned.
This results in an 8-byte out-of-bounds write atfid->parent_root_objectid = parent_root_id.
A previous attempt to fix this issue was made but was lost.
https://lore.kernel.org/all/[email protected]/
Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data.
--- fs/btrfs/export.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/btrfs/export.c +7 -1
@@ -23,7 +23,11 @@ static int btrfs_encode_fh(struct inodeint type;if (parent && (len <BTRFS_FID_SIZE_CONNECTABLE )) { - *max_len =BTRFS_FID_SIZE_CONNECTABLE ; +if (btrfs_root_id (BTRFS_I (inode)->root) != +btrfs_root_id (BTRFS_I (parent)->root)) + *max_len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; +else + *max_len =BTRFS_FID_SIZE_CONNECTABLE ;return FILEID_INVALID ; }else if (len <BTRFS_FID_SIZE_NON_CONNECTABLE ) { *max_len =BTRFS_FID_SIZE_NON_CONNECTABLE ;
@@ -45,6 +49,8 @@ static int btrfs_encode_fh(struct inode parent_root_id =btrfs_root_id (BTRFS_I (parent)->root);if (parent_root_id != fid->root_objectid) { +if (*max_len <BTRFS_FID_SIZE_CONNECTABLE_ROOT ) +return FILEID_INVALID ; fid->parent_root_objectid = parent_root_id; len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; type =FILEID_BTRFS_WITH_PARENT_ROOT ;
Greg Kroah-Hartman
maintainerPATCH 122/277 bus: mhi: ep: Fix chained transfer handling in read path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Kumar <[email protected]>
commit f5225a34bd8f9f64eec37f6ae1461289aaa3eb86 upstream.
The mhi_ep_read_channel function incorrectly assumes the End of Transfer (EOT) bit is present for each packet in a chained transactions, causing it to advance mhi_chan->rd_offset beyond wr_offset during host-to-device transfers when EOT has not yet arrived. This leads to access of unmapped host memory, causing IOMMU faults and processing of stale TREs.
Modify the loop condition to ensure mhi_queue is not empty, allowing the function to process only valid TREs up to the current write pointer to prevent premature reads and ensure safe traversal of chained TREs.
Due to this change, buf_left needs to be removed from the while loop condition to avoid exiting prematurely before reading the ring completely, and also remove write_offset since it will always be zero because the new cache buffer is allocated every time.
--- drivers/bus/mhi/ep/main.c | 37 ++++++++++++------------------------- 1 file changed, 12 insertions(+), 25 deletions(-)
drivers/bus/mhi/ep/main.c +12 -25
@@ -403,17 +403,13 @@ static int mhi_ep_read_channel(struct mh {struct mhi_ep_chan *mhi_chan = &mhi_cntrl->mhi_chan[ring->ch_id];struct device *dev = &mhi_cntrl->mhi_dev->dev; -size_t tr_len, read_offset, write_offset; +size_t tr_len, read_offset;struct mhi_ep_buf_info buf_info = {};u32 len =MHI_EP_DEFAULT_MTU ;struct mhi_ring_element *el; -bool tr_done = false;void *buf_addr; -u32 buf_left;int ret; - buf_left = len; - do { /* Don't process the transfer ring if the channel is not in RUNNING state */ if (mhi_chan->state != MHI_CH_STATE_RUNNING) {
@@ -426,24 +422,23 @@ static int mhi_ep_read_channel(struct mh/* Check if there is data pending to be read from previous read operation */ if (mhi_chan->tre_bytes_left) {dev_dbg (dev,"TRE bytes remaining: %u\n" , mhi_chan->tre_bytes_left); - tr_len =min (buf_left, mhi_chan->tre_bytes_left); + tr_len =min (len, mhi_chan->tre_bytes_left); }else { mhi_chan->tre_loc =MHI_TRE_DATA_GET_PTR (el); mhi_chan->tre_size =MHI_TRE_DATA_GET_LEN (el); mhi_chan->tre_bytes_left = mhi_chan->tre_size; - tr_len =min (buf_left, mhi_chan->tre_size); + tr_len =min (len, mhi_chan->tre_size); } read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left; - write_offset = len - buf_left; buf_addr =kmem_cache_zalloc (mhi_cntrl->tre_buf_cache,GFP_KERNEL );if (!buf_addr)return -ENOMEM ; buf_info.host_addr = mhi_chan->tre_loc + read_offset; - buf_info.dev_addr = buf_addr + write_offset; + buf_info.dev_addr = buf_addr; buf_info.size = tr_len; buf_info.cb = mhi_ep_read_completion; buf_info.cb_buf = buf_addr;
@@ -459,16 +454,12 @@ static int mhi_ep_read_channel(struct mh goto err_free_buf_addr; } - buf_left -= tr_len; mhi_chan->tre_bytes_left -= tr_len; -if (!mhi_chan->tre_bytes_left) { -if (MHI_TRE_DATA_GET_IEOT (el)) - tr_done = true; - +if (!mhi_chan->tre_bytes_left) mhi_chan->rd_offset = (mhi_chan->rd_offset +1 ) % ring->ring_size; - } - }while (buf_left && !tr_done); +/* Read until the some buffer is left or the ring becomes not empty */ + }while (!mhi_ep_queue_is_empty (mhi_chan->mhi_dev,DMA_TO_DEVICE ));return 0 ;
@@ -502,15 +493,11 @@ static int mhi_ep_process_ch_ring(struct mhi_chan->xfer_cb (mhi_chan->mhi_dev, &result); }else {/* UL channel */ -do { - ret =mhi_ep_read_channel (mhi_cntrl, ring); -if (ret <0 ) { -dev_err (&mhi_chan->mhi_dev->dev,"Failed to read channel\n" ); -return ret; - } - -/* Read until the ring becomes empty */ - }while (!mhi_ep_queue_is_empty (mhi_chan->mhi_dev,DMA_TO_DEVICE )); + ret =mhi_ep_read_channel (mhi_cntrl, ring); +if (ret <0 ) { +dev_err (&mhi_chan->mhi_dev->dev,"Failed to read channel\n" ); +return ret; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 123/277 bus: mhi: host: Do not use uninitialized dev pointer in mhi_init_irq_setup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Xue <[email protected]>
commit d0856a6dff57f95cc5d2d74e50880f01697d0cc4 upstream.
In mhi_init_irq_setup, the device pointer used for dev_err() was not initialized. Use the pointer from mhi_cntrl instead.
--- drivers/bus/mhi/host/init.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/bus/mhi/host/init.c +2 -3
@@ -194,7 +194,6 @@ void mhi_deinit_free_irq(struct mhi_contint mhi_init_irq_setup (struct mhi_controller *mhi_cntrl) {struct mhi_event *mhi_event = mhi_cntrl->mhi_event; -struct device *dev = &mhi_cntrl->mhi_dev->dev;unsigned long irq_flags =IRQF_SHARED |IRQF_NO_SUSPEND ;int i, ret;
@@ -221,7 +220,7 @@ int mhi_init_irq_setup(struct mhi_controcontinue ;if (mhi_event->irq >= mhi_cntrl->nr_irqs) { -dev_err (dev,"irq %d not available for event ring\n" , +dev_err (mhi_cntrl->cntrl_dev,"irq %d not available for event ring\n" , mhi_event->irq); ret = -EINVAL ; goto error_request;
@@ -232,7 +231,7 @@ int mhi_init_irq_setup(struct mhi_contro irq_flags, "mhi", mhi_event);if (ret) { -dev_err (dev,"Error requesting irq:%d for ev:%d\n" , +dev_err (mhi_cntrl->cntrl_dev,"Error requesting irq:%d for ev:%d\n" , mhi_cntrl->irq[mhi_event->irq], i); goto error_request; }
Greg Kroah-Hartman
maintainerPATCH 124/277 clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
commit 57c8e9da3dfe606b918d8f193837ebf2213a9545 upstream.
All the other ref clocks provided by this driver have the bi_tcxo as parent. The eDP refclk is the only one without a parent, leading to reporting its rate as 0. So set its parent to bi_tcxo, just like the rest of the refclks.
--- drivers/clk/qcom/tcsrcc-x1e80100.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/clk/qcom/tcsrcc-x1e80100.c +4 -0
@@ -29,6 +29,10 @@ static struct clk_branch tcsr_edp_clkref .enable_mask = BIT(0), .hw.init = &(const struct clk_init_data ) { .name ="tcsr_edp_clkref_en" , + .parent_data = &(const struct clk_parent_data ){ + .index =DT_BI_TCXO_PAD , + }, + .num_parents =1 , .ops = &clk_branch2_ops, }, },
Greg Kroah-Hartman
maintainerPATCH 125/277 copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <[email protected]>
commit 04ff48239f46e8b493571e260bd0e6c3a6400371 upstream.
With the introduction of clone3 in commit 7f192e3cd316 ("fork: add clone3") the effective bit width of clone_flags on all architectures was increased from 32-bit to 64-bit. However, the signature of the copy_* helper functions (e.g., copy_sighand) used by copy_process was not adapted.
As such, they truncate the flags on any 32-bit architectures that supports clone3 (arc, arm, csky, m68k, microblaze, mips32, openrisc, parisc32, powerpc32, riscv32, x86-32 and xtensa).
For copy_sighand with CLONE_CLEAR_SIGHAND being an actual u64 constant, this triggers an observable bug in kernel selftest clone3_clear_sighand:
if (clone_flags & CLONE_CLEAR_SIGHAND)
in function copy_sighand within fork.c will always fail given:
unsigned long /* == uint32_t */ clone_flags
#define CLONE_CLEAR_SIGHAND 0x100000000ULLThis commit fixes the bug by always passing clone_flags to copy_sighand via their declared u64 type, invariant of architecture-dependent integer sizes.
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -1807,7 +1807,7 @@ static int copy_files(unsigned long clonreturn 0 ; } -static int copy_sighand (unsigned long clone_flags,struct task_struct *tsk) +static int copy_sighand (u64 clone_flags,struct task_struct *tsk) {struct sighand_struct *sig;
Greg Kroah-Hartman
maintainerPATCH 126/277 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream.
The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
--- drivers/cpufreq/intel_pstate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/intel_pstate.c +5 -3
@@ -1582,10 +1582,10 @@ static void update_qos_request(enum freqcontinue ; req = policy->driver_data; -cpufreq_cpu_put (policy); - -if (!req) +if (!req) { +cpufreq_cpu_put (policy);continue ; + }if (hwp_active)intel_pstate_get_hwp_cap (cpu);
@@ -1601,6 +1601,8 @@ static void update_qos_request(enum freqif (freq_qos_update_request (req, freq) <0 )pr_warn ("Failed to update freq constraint: CPU%d\n" , i); + +cpufreq_cpu_put (policy); } }
Greg Kroah-Hartman
maintainerPATCH 127/277 crypto: aspeed - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 838d2d51513e6d2504a678e906823cfd2ecaaa22 upstream.
It seems like everywhere in this file, when the request is not bidirectionala, req->src is mapped with DMA_TO_DEVICE and req->dst is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/aspeed/aspeed-hace-crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/aspeed/aspeed-hace-crypto.c +1 -1
@@ -346,7 +346,7 @@ free_req: }else {dma_unmap_sg (hace_dev->dev, req->dst, rctx->dst_nents, -DMA_TO_DEVICE ); +DMA_FROM_DEVICE );dma_unmap_sg (hace_dev->dev, req->src, rctx->src_nents,DMA_TO_DEVICE ); }
Greg Kroah-Hartman
maintainerPATCH 128/277 crypto: atmel - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit f5d643156ef62216955c119216d2f3815bd51cb1 upstream.
It seems like everywhere in this file, dd->in_sg is mapped with DMA_TO_DEVICE and dd->out_sg is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/atmel-tdes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/atmel-tdes.c +1 -1
@@ -512,7 +512,7 @@ static int atmel_tdes_crypt_start(structif (err && (dd->flags &TDES_FLAGS_FAST )) {dma_unmap_sg (dd->dev, dd->in_sg,1 ,DMA_TO_DEVICE ); -dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_TO_DEVICE ); +dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_FROM_DEVICE ); }return err;
Greg Kroah-Hartman
maintainerPATCH 129/277 crypto: rockchip - Fix dma_unmap_sg() nents value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 21140e5caf019e4a24e1ceabcaaa16bd693b393f upstream.
The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned.
--- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/rockchip/rk3288_crypto_ahash.c +1 -1
@@ -252,7 +252,7 @@ static void rk_hash_unprepare(struct crystruct rk_ahash_rctx *rctx =ahash_request_ctx (areq);struct rk_crypto_info *rkc = rctx->dev; -dma_unmap_sg (rkc->dev, areq->src, rctx->nrsg,DMA_TO_DEVICE ); +dma_unmap_sg (rkc->dev, areq->src,sg_nents (areq->src),DMA_TO_DEVICE ); }static int rk_hash_run (struct crypto_engine *engine,void *breq)
Greg Kroah-Hartman
maintainerPATCH 130/277 eventpoll: Replace rwlock with spinlock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 0c43094f8cc9d3d99d835c0ac9c4fe1ccc62babd upstream.
The ready event list of an epoll object is protected by read-write semaphore:
- The consumer (waiter) acquires the write lock and takes items.
- the producer (waker) takes the read lock and adds items.
The point of this design is enabling epoll to scale well with large number of producers, as multiple producers can hold the read lock at the same time.
Unfortunately, this implementation may cause scheduling priority inversion problem. Suppose the consumer has higher scheduling priority than the producer. The consumer needs to acquire the write lock, but may be blocked by the producer holding the read lock. Since read-write semaphore does not support priority-boosting for the readers (even with CONFIG_PREEMPT_RT=y), we have a case of priority inversion: a higher priority consumer is blocked by a lower priority producer. This problem was reported in [1].
Furthermore, this could also cause stall problem, as described in [2].
Fix this problem by replacing rwlock with spinlock.
This reduces the event bandwidth, as the producers now have to contend with each other for the spinlock. According to the benchmark from
https://github.com/rouming/test-tools/blob/master/stress-epoll.c:
On 12 x86 CPUs:
Before After Diff
threads events/ms events/ms
8 7162 4956 -31%
16 8733 5383 -38%
32 7968 5572 -30%
64 10652 5739 -46%
128 11236 5931 -47%
On 4 riscv CPUs:
Before After Diff
threads events/ms events/ms
8 2958 2833 -4%
16 3323 3097 -7%
32 3451 3240 -6%
64 3554 3178 -11%
128 3601 3235 -10%Although the numbers look bad, it should be noted that this benchmark creates multiple threads who do nothing except constantly generating new epoll events, thus contention on the spinlock is high. For real workload, the event rate is likely much lower, and the performance drop is not as bad.
Using another benchmark (perf bench epoll wait) where spinlock contention is lower, improvement is even observed on x86:
On 12 x86 CPUs:
Before: Averaged 110279 operations/sec (+- 1.09%), total secs = 8
After: Averaged 114577 operations/sec (+- 2.25%), total secs = 8
On 4 riscv CPUs:
Before: Averaged 175767 operations/sec (+- 0.62%), total secs = 8
After: Averaged 167396 operations/sec (+- 0.23%), total secs = 8In conclusion, no one is likely to be upset over this change. After all, spinlock was used originally for years, and the commit which converted to rwlock didn't mention a real workload, just that the benchmark numbers are nice.
This patch is not exactly the revert of commit a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention"), because git revert conflicts in some places which are not obvious on the resolution. This patch is intended to be backported, therefore go with the obvious approach:
- Replace rwlock_t with spinlock_t one to one
- Delete list_add_tail_lockless() and chain_epi_lockless(). These were introduced to allow producers to concurrently add items to the list. But now that spinlock no longer allows producers to touch the event list concurrently, these two functions are not necessary anymore.
--- fs/eventpoll.c | 139 ++++++++++----------------------------------------------- 1 file changed, 26 insertions(+), 113 deletions(-)
fs/eventpoll.c +26 -113
@@ -46,10 +46,10 @@* * 1) epnested_mutex (mutex) * 2) ep->mtx (mutex) -* 3) ep->lock (rwlock) +* 3) ep->lock (spinlock) * * The acquire order is the one listed above, from 1 to 3. -* We need a rwlock (ep->lock) because we manipulate objects +* We need a spinlock (ep->lock) because we manipulate objects * from inside the poll callback, that might be triggered from * a wake_up() that in turn might be called from IRQ context. * So we can't sleep inside the poll callback and hence we need
@@ -195,7 +195,7 @@ struct eventpoll {struct list_head rdllist;/* Lock which protects rdllist and ovflist */ -rwlock_t lock; +spinlock_t lock;/* RB tree root used to store monitored fd structs */ struct rb_root_cached rbr;
@@ -713,10 +713,10 @@ static void ep_start_scan(struct eventpo* in a lockless way. */ lockdep_assert_irqs_enabled (); -write_lock_irq (&ep->lock); +spin_lock_irq (&ep->lock);list_splice_init (&ep->rdllist, txlist);WRITE_ONCE (ep->ovflist,NULL ); -write_unlock_irq (&ep->lock); +spin_unlock_irq (&ep->lock); } static void ep_done_scan(struct eventpoll *ep,
@@ -724,7 +724,7 @@ static void ep_done_scan(struct eventpol {struct epitem *epi, *nepi; -write_lock_irq (&ep->lock); +spin_lock_irq (&ep->lock);/* * During the time we spent inside the "sproc" callback, some * other events might have been queued by the poll callback.
@@ -765,7 +765,7 @@ static void ep_done_scan(struct eventpolwake_up (&ep->wq); } -write_unlock_irq (&ep->lock); +spin_unlock_irq (&ep->lock); }static void ep_get (struct eventpoll *ep)
@@ -839,10 +839,10 @@ static bool __ep_remove(struct eventpollrb_erase_cached (&epi->rbn, &ep->rbr); -write_lock_irq (&ep->lock); +spin_lock_irq (&ep->lock);if (ep_is_linked (epi))list_del_init (&epi->rdllink); -write_unlock_irq (&ep->lock); +spin_unlock_irq (&ep->lock);wakeup_source_unregister (ep_wakeup_source (epi));/*
@@ -1123,7 +1123,7 @@ static int ep_alloc(struct eventpoll **preturn -ENOMEM ;mutex_init (&ep->mtx); -rwlock_init (&ep->lock); +spin_lock_init (&ep->lock);init_waitqueue_head (&ep->wq);init_waitqueue_head (&ep->poll_wait);INIT_LIST_HEAD (&ep->rdllist);
@@ -1211,99 +1211,9 @@ struct file *get_epoll_tfile_raw_ptr(str#endif /* CONFIG_KCMP */ /* -* Adds a new entry to the tail of the list in a lockless way, i.e. -* multiple CPUs are allowed to call this function concurrently. -* -* Beware: it is necessary to prevent any other modifications of the -* existing list until all changes are completed, in other words -* concurrent list_add_tail_lockless() calls should be protected -* with a read lock, where write lock acts as a barrier which -* makes sure all list_add_tail_lockless() calls are fully -* completed. -* -* Also an element can be locklessly added to the list only in one -* direction i.e. either to the tail or to the head, otherwise -* concurrent access will corrupt the list. -* -* Return: %false if element has been already added to the list, %true -* otherwise. -*/ -static inline bool list_add_tail_lockless (struct list_head *new, -struct list_head *head) -{ -struct list_head *prev; - -/* -* This is simple 'new->next = head' operation, but cmpxchg() -* is used in order to detect that same element has been just -* added to the list from another CPU: the winner observes -* new->next == new. -*/ -if (!try_cmpxchg (&new->next, &new, head)) -return false; - -/* -* Initially ->next of a new element must be updated with the head -* (we are inserting to the tail) and only then pointers are atomically -* exchanged. XCHG guarantees memory ordering, thus ->next should be -* updated before pointers are actually swapped and pointers are -* swapped before prev->next is updated. -*/ - - prev =xchg (&head->prev, new); - -/* -* It is safe to modify prev->next and new->prev, because a new element -* is added only to the tail and new->next is updated before XCHG. -*/ - - prev->next = new; - new->prev = prev; - -return true; -} - -/* -* Chains a new epi entry to the tail of the ep->ovflist in a lockless way, -* i.e. multiple CPUs are allowed to call this function concurrently. -* -* Return: %false if epi element has been already chained, %true otherwise. -*/ -static inline bool chain_epi_lockless (struct epitem *epi) -{ -struct eventpoll *ep = epi->ep; - -/* Fast preliminary check */ -if (epi->next !=EP_UNACTIVE_PTR ) -return false; - -/* Check that the same epi has not been just chained from another CPU */ -if (cmpxchg (&epi->next,EP_UNACTIVE_PTR ,NULL ) !=EP_UNACTIVE_PTR ) -return false; - -/* Atomically exchange tail */ - epi->next =xchg (&ep->ovflist, epi); - -return true; -} - -/* * This is the callback that is passed to the wait queue wakeup * mechanism. It is called by the stored file descriptors when they * have events to report. -* -* This callback takes a read lock in order not to contend with concurrent -* events from another file descriptor, thus all modifications to ->rdllist -* or ->ovflist are lockless. Read lock is paired with the write lock from -* ep_start/done_scan(), which stops all list modifications and guarantees -* that lists state is seen correctly. -* -* Another thing worth to mention is that ep_poll_callback() can be called -* concurrently for the same @epi from different CPUs if poll table was inited -* with several wait queues entries. Plural wakeup from different CPUs of a -* single wait queue is serialized by wq.lock, but the case when multiple wait -* queues are used should be detected accordingly. This is detected using -* cmpxchg() operation. */ static int ep_poll_callback (wait_queue_entry_t *wait,unsigned mode,int sync,void *key) {
@@ -1314,7 +1224,7 @@ static int ep_poll_callback(wait_queue_eunsigned long flags;int ewake =0 ; -read_lock_irqsave (&ep->lock, flags); +spin_lock_irqsave (&ep->lock, flags);ep_set_busy_poll_napi_id (epi);
@@ -1343,12 +1253,15 @@ static int ep_poll_callback(wait_queue_e* chained in ep->ovflist and requeued later on. */ if (READ_ONCE (ep->ovflist) !=EP_UNACTIVE_PTR ) { -if (chain_epi_lockless (epi)) +if (epi->next ==EP_UNACTIVE_PTR ) { + epi->next =READ_ONCE (ep->ovflist); +WRITE_ONCE (ep->ovflist, epi);ep_pm_stay_awake_rcu (epi); + } }else if (!ep_is_linked (epi)) {/* In the usual case, add event to ready list. */ -if (list_add_tail_lockless (&epi->rdllink, &ep->rdllist)) -ep_pm_stay_awake_rcu (epi); +list_add_tail (&epi->rdllink, &ep->rdllist); +ep_pm_stay_awake_rcu (epi); }/*
@@ -1381,7 +1294,7 @@ static int ep_poll_callback(wait_queue_e pwake++; out_unlock: -read_unlock_irqrestore (&ep->lock, flags); +spin_unlock_irqrestore (&ep->lock, flags);/* We have to call this outside the lock */ if (pwake)
@@ -1716,7 +1629,7 @@ static int ep_insert(struct eventpoll *e }/* We have to drop the new item inside our item list to keep track of it */ -write_lock_irq (&ep->lock); +spin_lock_irq (&ep->lock);/* record NAPI ID of new item if present */ ep_set_busy_poll_napi_id (epi);
@@ -1733,7 +1646,7 @@ static int ep_insert(struct eventpoll *e pwake++; } -write_unlock_irq (&ep->lock); +spin_unlock_irq (&ep->lock);/* We have to call this outside the lock */ if (pwake)
@@ -1797,7 +1710,7 @@ static int ep_modify(struct eventpoll *e* list, push it inside. */ if (ep_item_poll (epi, &pt,1 )) { -write_lock_irq (&ep->lock); +spin_lock_irq (&ep->lock);if (!ep_is_linked (epi)) {list_add_tail (&epi->rdllink, &ep->rdllist);ep_pm_stay_awake (epi);
@@ -1808,7 +1721,7 @@ static int ep_modify(struct eventpoll *eif (waitqueue_active (&ep->poll_wait)) pwake++; } -write_unlock_irq (&ep->lock); +spin_unlock_irq (&ep->lock); }/* We have to call this outside the lock */
@@ -2041,7 +1954,7 @@ static int ep_poll(struct eventpoll *ep,init_wait (&wait); wait.func = ep_autoremove_wake_function; -write_lock_irq (&ep->lock); +spin_lock_irq (&ep->lock);/* * Barrierless variant, waitqueue_active() is called under * the same lock on wakeup ep_poll_callback() side, so it
@@ -2060,7 +1973,7 @@ static int ep_poll(struct eventpoll *ep,if (!eavail)__add_wait_queue_exclusive (&ep->wq, &wait); -write_unlock_irq (&ep->lock); +spin_unlock_irq (&ep->lock);if (!eavail) timed_out = !schedule_hrtimeout_range(to, slack,
@@ -2075,7 +1988,7 @@ static int ep_poll(struct eventpoll *ep, eavail =1 ;if (!list_empty_careful (&wait.entry)) { -write_lock_irq (&ep->lock); +spin_lock_irq (&ep->lock);/* * If the thread timed out and is not on the wait queue, * it means that the thread was woken up after its
@@ -2086,7 +1999,7 @@ static int ep_poll(struct eventpoll *ep,if (timed_out) eavail =list_empty (&wait.entry);__remove_wait_queue (&ep->wq, &wait); -write_unlock_irq (&ep->lock); +spin_unlock_irq (&ep->lock); } } }
Greg Kroah-Hartman
maintainerPATCH 131/277 fbdev: Fix logic error in "offb" name match
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 15df28699b28d6b49dc305040c4e26a9553df07a upstream.
A regression was reported to me recently whereby /dev/fb0 had disappeared from a PowerBook G3 Series "Wallstreet". The problem shows up when the "video=ofonly" parameter is passed to the kernel, which is what the bootloader does when "no video driver" is selected. The cause of the problem is the "offb" string comparison, which got mangled when it got refactored. Fix it.
--- drivers/video/fbdev/core/fb_cmdline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/core/fb_cmdline.c +1 -1
@@ -40,7 +40,7 @@ int fb_get_options(const char *name, chabool enabled;if (name) - is_of =strncmp (name,"offb" ,4 ); + is_of = !strncmp (name,"offb" ,4 ); enabled =__video_get_options (name, &options, is_of);
Greg Kroah-Hartman
maintainerPATCH 132/277 fs/ntfs3: Fix a resource leak bug in wnd_extend()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d68318471aa2e16222ebf492883e05a2d72b9b17 upstream.
Add put_bh() to decrease the refcount of 'bh' after the job is finished, preventing a resource leak.
--- fs/ntfs3/bitmap.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/bitmap.c +1 -0
@@ -1399,6 +1399,7 @@ int wnd_extend(struct wnd_bitmap *wnd, smark_buffer_dirty (bh);unlock_buffer (bh);/* err = sync_dirty_buffer(bh); */ +put_bh (bh); b0 =0 ; bits -= op;
Greg Kroah-Hartman
maintainerPATCH 133/277 fs: quota: create dedicated workqueue for quota_release_work
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shashank A P <[email protected]>
commit 72b7ceca857f38a8ca7c5629feffc63769638974 upstream.
There is a kernel panic due to WARN_ONCE when panic_on_warn is set.
This issue occurs when writeback is triggered due to sync call for an opened file(ie, writeback reason is WB_REASON_SYNC). When f2fs balance is needed at sync path, flush for quota_release_work is triggered. By default quota_release_work is queued to "events_unbound" queue which does not have WQ_MEM_RECLAIM flag. During f2fs balance "writeback" workqueue tries to flush quota_release_work causing kernel panic due to MEM_RECLAIM flag mismatch errors.
This patch creates dedicated workqueue with WQ_MEM_RECLAIM flag for work quota_release_work.
------------[ cut here ]------------ WARNING: CPU: 4 PID: 14867 at kernel/workqueue.c:3721 check_flush_dependency+0x13c/0x148 Call trace: check_flush_dependency+0x13c/0x148 __flush_work+0xd0/0x398 flush_delayed_work+0x44/0x5c dquot_writeback_dquots+0x54/0x318 f2fs_do_quota_sync+0xb8/0x1a8 f2fs_write_checkpoint+0x3cc/0x99c f2fs_gc+0x190/0x750 f2fs_balance_fs+0x110/0x168 f2fs_write_single_data_page+0x474/0x7dc f2fs_write_data_pages+0x7d0/0xd0c do_writepages+0xe0/0x2f4 __writeback_single_inode+0x44/0x4ac writeback_sb_inodes+0x30c/0x538 wb_writeback+0xf4/0x440 wb_workfn+0x128/0x5d4 process_scheduled_works+0x1c4/0x45c worker_thread+0x32c/0x3e8 kthread+0x11c/0x1b0 ret_from_fork+0x10/0x20 Kernel panic - not syncing: kernel: panic_on_warn set ...
--- fs/quota/dquot.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/quota/dquot.c +9 -1
@@ -163,6 +163,9 @@ static struct quota_module_name module_n/* SLAB cache for dquot structures */ static struct kmem_cache *dquot_cachep; +/* workqueue for work quota_release_work*/ +static struct workqueue_struct *quota_unbound_wq; +void register_quota_format (struct quota_format_type *fmt) {spin_lock (&dq_list_lock);
@@ -882,7 +885,7 @@ void dqput(struct dquot *dquot)put_releasing_dquots (dquot);atomic_dec (&dquot->dq_count);spin_unlock (&dq_list_lock); -queue_delayed_work (system_unbound_wq, "a_release_work,1 ); +queue_delayed_work (quota_unbound_wq, "a_release_work,1 ); }EXPORT_SYMBOL (dqput);
@@ -3042,6 +3045,11 @@ static int __init dquot_init(void)shrinker_register (dqcache_shrinker); + quota_unbound_wq =alloc_workqueue ("quota_events_unbound" , +WQ_UNBOUND |WQ_MEM_RECLAIM ,WQ_MAX_ACTIVE ); +if (!quota_unbound_wq) +panic ("Cannot create quota_unbound_wq\n" ); +return 0 ; }fs_initcall (dquot_init);
Greg Kroah-Hartman
maintainerPATCH 134/277 fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 0b563aad1c0a05dc7d123f68a9f82f79de206dad upstream.
In case of FUSE_NOTIFY_RESEND and FUSE_NOTIFY_INC_EPOCH fuse_copy_finish() isn't called.
Fix by always calling fuse_copy_finish() after fuse_notify(). It's a no-op if called a second time.
--- fs/fuse/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/dev.c +1 -1
@@ -1989,7 +1989,7 @@ static ssize_t fuse_dev_do_write(struct*/ if (!oh.unique) { err =fuse_notify (fc, oh.error, nbytes -sizeof (oh), cs); - goto out; + goto copy_finish; } err = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 135/277 fuse: fix livelock in synchronous file put from fuseblk workers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
commit 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 upstream.
I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for responses from the fuseblk server:
# cat /proc/372265/task/372313/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_do_getattr+0xfc/0x1f0 [fuse] [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse] [<0>] aio_read+0x130/0x1e0 [<0>] io_submit_one+0x542/0x860 [<0>] __x64_sys_io_submit+0x98/0x1a0 [<0>] do_syscall_64+0x37/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53
But the /weird/ part is that the fuseblk server threads are waiting for responses from itself:
# cat /proc/372210/task/372232/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_file_put+0x9a/0xd0 [fuse] [<0>] fuse_release+0x36/0x50 [fuse] [<0>] __fput+0xec/0x2b0 [<0>] task_work_run+0x55/0x90 [<0>] syscall_exit_to_user_mode+0xe9/0x100 [<0>] do_syscall_64+0x43/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53
The fuseblk server is fuse2fs so there's nothing all that exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the fstest sheds some light on that:
"By closing the file descriptor before calling io_destroy, you pretty much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion).
Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE command from userspace causes the fuse server to call the AIO completion function. The completion puts the struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to userspace, it has to run the delayed fput, which in the case of a fuseblk server, it does synchronously.
Sending the FUSE_RELEASE command sychronously from fuse server threads is a bad idea because a client program can initiate enough simultaneous AIOs such that all the fuse server threads end up in delayed_fput, and now there aren't any threads left to handle the queued fuse commands.
Fix this by only using asynchronous fputs when closing files, and leave a comment explaining why.
--- fs/fuse/file.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/fuse/file.c +7 -1
@@ -355,8 +355,14 @@ void fuse_file_release(struct inode *ino* Make the release synchronous if this is a fuseblk mount, * synchronous RELEASE is allowed (and desirable) in this case * because the server can be trusted not to screw up. +* +* Always use the asynchronous file put because the current thread +* might be the fuse server. This can happen if a process starts some +* aio and closes the fd before the aio completes. Since aio takes its +* own ref to the file, the IO completion has to drop the ref, which is +* how the fuse server can end up closing its clients' files. */ -fuse_file_put (ff, ff->fm->fc->destroy); +fuse_file_put (ff, false); }void fuse_release_common (struct file *file,bool isdir)
Greg Kroah-Hartman
maintainerPATCH 136/277 iio/adc/pac1934: fix channel disable configuration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandar Gerasimovski <[email protected]>
commit 3c63ba1c430af1c0dcd68dd36f2246980621dcba upstream.
There are two problems with the chip configuration in this driver:
- First, is that writing 12 bytes (ARRAY_SIZE(regs)) would anyhow lead to a config overflow due to HW auto increment implementation in the chip.
- Second, the i2c_smbus_write_block_data write ends up in writing unexpected value to the channel_dis register, this is because the smbus size that is 0x03 in this case gets written to the register. The PAC1931/2/3/4 data sheet does not really specify that block write is indeed supported.
This problem is probably not visible on PAC1934 version where all channels are used as the chip is properly configured by luck, but in our case whenusing PAC1931 this leads to nonfunctional device.
--- drivers/iio/adc/pac1934.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/iio/adc/pac1934.c +18 -2
@@ -88,6 +88,7 @@#define PAC1934_VPOWER_3_ADDR 0x19#define PAC1934_VPOWER_4_ADDR 0x1A#define PAC1934_REFRESH_V_REG_ADDR 0x1F +#define PAC1934_SLOW_REG_ADDR 0x20#define PAC1934_CTRL_STAT_REGS_ADDR 0x1C#define PAC1934_PID_REG_ADDR 0xFD#define PAC1934_MID_REG_ADDR 0xFE
@@ -1265,8 +1266,23 @@ static int pac1934_chip_configure(struct/* no SLOW triggered REFRESH, clear POR */ regs[PAC1934_SLOW_REG_OFF ] =0 ; - ret =i2c_smbus_write_block_data (client,PAC1934_CTRL_STAT_REGS_ADDR , -ARRAY_SIZE (regs), (u8 *)regs); +/* +* Write the three bytes sequentially, as the device does not support +* block write. +*/ + ret =i2c_smbus_write_byte_data (client,PAC1934_CTRL_STAT_REGS_ADDR , + regs[PAC1934_CHANNEL_DIS_REG_OFF ]); +if (ret) +return ret; + + ret =i2c_smbus_write_byte_data (client, +PAC1934_CTRL_STAT_REGS_ADDR +PAC1934_NEG_PWR_REG_OFF , + regs[PAC1934_NEG_PWR_REG_OFF ]); +if (ret) +return ret; + + ret =i2c_smbus_write_byte_data (client,PAC1934_SLOW_REG_ADDR , + regs[PAC1934_SLOW_REG_OFF ]);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 137/277 iio: dac: ad5360: use int type to store negative error codes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit f9381ece76de999a2065d5b4fdd87fa17883978c upstream.
Change the 'ret' variable in ad5360_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5360_write_unlocked().
--- drivers/iio/dac/ad5360.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5360.c +1 -1
@@ -262,7 +262,7 @@ static int ad5360_update_ctrl(struct iio unsigned int clr) {struct ad5360_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 138/277 iio: dac: ad5421: use int type to store negative error codes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit 3379c900320954d768ed9903691fb2520926bbe3 upstream.
Change the 'ret' variable in ad5421_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5421_write_unlocked().
--- drivers/iio/dac/ad5421.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5421.c +1 -1
@@ -186,7 +186,7 @@ static int ad5421_update_ctrl(struct iio unsigned int clr) {struct ad5421_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 139/277 iio: frequency: adf4350: Fix prescaler usage.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d upstream.
The ADF4350/1 features a programmable dual-modulus prescaler of 4/5 or 8/9. When set to 4/5, the maximum RF frequency allowed is 3 GHz. Therefore, when operating the ADF4351 above 3 GHz, this must be set to 8/9. In this context not the RF output frequency is meant
- it's the VCO frequency.
Therefore move the prescaler selection after we derived the VCO frequency from the desired RF output frequency.
This BUG may have caused PLL lock instabilities when operating the VCO at the very high range close to 4.4 GHz.
--- drivers/iio/frequency/adf4350.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/iio/frequency/adf4350.c +13 -7
@@ -149,6 +149,19 @@ static int adf4350_set_freq(struct adf43if (freq >ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq)return -EINVAL ; + st->r4_rf_div_sel =0 ; + +/* +* !\TODO: The below computation is making sure we get a power of 2 +* shift (st->r4_rf_div_sel) so that freq becomes higher or equal to +* ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() +* and friends. +*/ +while (freq <ADF4350_MIN_VCO_FREQ ) { + freq <<=1 ; + st->r4_rf_div_sel++; + } +if (freq >ADF4350_MAX_FREQ_45_PRESC ) { prescaler =ADF4350_REG1_PRESCALER ; mdiv =75 ;
@@ -157,13 +170,6 @@ static int adf4350_set_freq(struct adf43 mdiv =23 ; } - st->r4_rf_div_sel =0 ; - -while (freq <ADF4350_MIN_VCO_FREQ ) { - freq <<=1 ; - st->r4_rf_div_sel++; - } -/* * Allow a predefined reference division factor * if not set, compute our own
Greg Kroah-Hartman
maintainerPATCH 140/277 iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
commit 1315cc2dbd5034f566e20ddce4d675cb9e6d4ddd upstream.
AMS_ALARM_THR_DIRECT_MASK should be bit 0, not bit 1. This would cause hysteresis to be enabled with a lower threshold of -28C. The temperature alarm would never deassert even if the temperature dropped below the upper threshold.
--- drivers/iio/adc/xilinx-ams.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/xilinx-ams.c +1 -1
@@ -118,7 +118,7 @@#define AMS_ALARM_THRESHOLD_OFF_10 0x10#define AMS_ALARM_THRESHOLD_OFF_20 0x20 -#define AMS_ALARM_THR_DIRECT_MASK BIT(1) +#define AMS_ALARM_THR_DIRECT_MASK BIT(0)#define AMS_ALARM_THR_MIN 0x0000#define AMS_ALARM_THR_MAX (BIT(16) - 1)
Greg Kroah-Hartman
maintainerPATCH 141/277 iio: xilinx-ams: Unmask interrupts after updating alarms
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
commit feb500c7ae7a198db4d2757901bce562feeefa5e upstream.
To convert level-triggered alarms into edge-triggered IIO events, alarms are masked when they are triggered. To ensure we catch subsequent alarms, we then periodically poll to see if the alarm is still active. If it isn't, we unmask it. Active but masked alarms are stored in current_masked_alarm.
If an active alarm is disabled, it will remain set in current_masked_alarm until ams_unmask_worker clears it. If the alarm is re-enabled before ams_unmask_worker runs, then it will never be cleared from current_masked_alarm. This will prevent the alarm event from being pushed even if the alarm is still active.
Fix this by recalculating current_masked_alarm immediately when enabling or disabling alarms.
--- drivers/iio/adc/xilinx-ams.c | 45 +++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 20 deletions(-)
drivers/iio/adc/xilinx-ams.c +25 -20
@@ -389,6 +389,29 @@ static void ams_update_pl_alarm(struct aams_pl_update_reg (ams,AMS_REG_CONFIG3 ,AMS_REGCFG3_ALARM_MASK , cfg); } +static void ams_unmask (struct ams *ams) +{ +unsigned int status, unmask; + + status =readl (ams->base +AMS_ISR_0 ); + +/* Clear those bits which are not active anymore */ + unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; + +/* Clear status of disabled alarm */ + unmask |= ams->intr_mask; + + ams->current_masked_alarm &= status; + +/* Also clear those which are masked out anyway */ + ams->current_masked_alarm &= ~ams->intr_mask; + +/* Clear the interrupts before we unmask them */ +writel (unmask, ams->base +AMS_ISR_0 ); + +ams_update_intrmask (ams, ~AMS_ALARM_MASK , ~AMS_ALARM_MASK ); +} +static void ams_update_alarm (struct ams *ams,unsigned long alarm_mask) {unsigned long flags;
@@ -401,6 +424,7 @@ static void ams_update_alarm(struct amsspin_lock_irqsave (&ams->intr_lock, flags);ams_update_intrmask (ams,AMS_ISR0_ALARM_MASK , ~alarm_mask); +ams_unmask (ams);spin_unlock_irqrestore (&ams->intr_lock, flags); }
@@ -1035,28 +1059,9 @@ static void ams_handle_events(struct iiostatic void ams_unmask_worker (struct work_struct *work) { struct ams *ams = container_of(work, struct ams, ams_unmask_work.work); -unsigned int status, unmask;spin_lock_irq (&ams->intr_lock); - - status =readl (ams->base +AMS_ISR_0 ); - -/* Clear those bits which are not active anymore */ - unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; - -/* Clear status of disabled alarm */ - unmask |= ams->intr_mask; - - ams->current_masked_alarm &= status; - -/* Also clear those which are masked out anyway */ - ams->current_masked_alarm &= ~ams->intr_mask; - -/* Clear the interrupts before we unmask them */ -writel (unmask, ams->base +AMS_ISR_0 ); - -ams_update_intrmask (ams, ~AMS_ALARM_MASK , ~AMS_ALARM_MASK ); - +ams_unmask (ams);spin_unlock_irq (&ams->intr_lock);/* If still pending some alarm re-trigger the timer */
Greg Kroah-Hartman
maintainerPATCH 142/277 init: handle bootloader identifier in kernel parameters
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit e416f0ed3c500c05c55fb62ee62662717b1c7f71 upstream.
BootLoaders (Grub, LILO, etc) may pass an identifier such as "BOOT_IMAGE= /boot/vmlinuz-x.y.z" to kernel parameters. But these identifiers are not recognized by the kernel itself so will be passed to userspace. However user space init program also don't recognize it.
KEXEC/KDUMP (kexec-tools) may also pass an identifier such as "kexec" on some architectures.
We cannot change BootLoader's behavior, because this behavior exists for many years, and there are already user space programs search BOOT_IMAGE= in /proc/cmdline to obtain the kernel image locations:
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/util.go
(search getBootOptions)
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/main.go
(search getKernelReleaseWithBootOption) So the the best way is handle (ignore) it by the kernel itself, which can avoid such boot warnings (if we use something like init=/bin/bash, bootloader identifier can even cause a crash):
Kernel command line: BOOT_IMAGE=(hd0,1)/vmlinuz-6.x root=/dev/sda3 ro console=tty Unknown kernel command line parameters "BOOT_IMAGE=(hd0,1)/vmlinuz-6.x", will be passed to user space.
--- init/main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
init/main.c +12 -0
@@ -543,6 +543,12 @@ static int __init unknown_bootoption(cha const char *unused, void *arg) { size_t len = strlen(param); +/* +* Well-known bootloader identifiers: +* 1. LILO/Grub pass "BOOT_IMAGE=..."; +* 2. kexec/kdump (kexec-tools) pass "kexec". +*/ +const char *bootloader[] = {"BOOT_IMAGE=" ,"kexec" ,NULL };/* Handle params aliased to sysctls */ if (sysctl_is_alias (param))
@@ -550,6 +556,12 @@ static int __init unknown_bootoption(charepair_env_string (param, val); +/* Handle bootloader identifier */ +for (int i =0 ; bootloader[i]; i++) { +if (strstarts (param, bootloader[i])) +return 0 ; + } +/* Handle obsolete-style parameters */ if (obsolete_checksetup (param))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 143/277 iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
commit a95a0b4e471a6d8860f40c6ac8f1cad9dde3189a upstream.
Remove unnecessary calls to pm_runtime_disable(), pm_runtime_set_active(), and pm_runtime_enable() from the resume path. These operations are not required here and can interfere with proper pm_runtime state handling, especially when resuming from a pm_runtime suspended state.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +0 -4
@@ -847,10 +847,6 @@ static int inv_icm42600_resume(struct deif (ret) goto out_unlock; -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -/* restore sensors state */ ret = inv_icm42600_set_pwr_mgmt0(st, st->suspended.gyro, st->suspended.accel,
Greg Kroah-Hartman
maintainerPATCH 144/277 iommu/vt-d: PRS isnt usable if PDS isnt supported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 5ef7e24c742038a5d8c626fdc0e3a21834358341 upstream.
The specification, Section 7.10, "Software Steps to Drain Page Requests & Responses," requires software to submit an Invalidation Wait Descriptor (inv_wait_dsc) with the Page-request Drain (PD=1) flag set, along with the Invalidation Wait Completion Status Write flag (SW=1). It then waits for the Invalidation Wait Descriptor's completion.
However, the PD field in the Invalidation Wait Descriptor is optional, as stated in Section 6.5.2.9, "Invalidation Wait Descriptor":
"Page-request Drain (PD): Remapping hardware implementations reporting
Page-request draining as not supported (PDS = 0 in ECAP_REG) treat this field as reserved."
This implies that if the IOMMU doesn't support the PDS capability, software can't drain page requests and group responses as expected.
Do not enable PCI/PRI if the IOMMU doesn't support PDS.
--- drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/iommu.c +1 -1
@@ -3952,7 +3952,7 @@ static struct iommu_device *intel_iommu_ }if (info->ats_supported &&ecap_prs (iommu->ecap) && -pci_pri_supported (pdev)) +ecap_pds (iommu->ecap) &&pci_pri_supported (pdev)) info->pri_supported =1 ; } }
Greg Kroah-Hartman
maintainerPATCH 145/277 kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit a15f37a40145c986cdf289a4b88390f35efdecc4 upstream.
The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken.
sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct.
Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock().
Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable.
--- kernel/sys.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
kernel/sys.c +20 -2
@@ -1698,6 +1698,7 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, ustruct rlimit old, new;struct task_struct *tsk;unsigned int checkflags =0 ; +bool need_tasklist;int ret;if (old_rlim)
@@ -1724,8 +1725,25 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, uget_task_struct (tsk);rcu_read_unlock (); - ret =do_prlimit (tsk, resource, new_rlim ? &new :NULL , - old_rlim ? &old :NULL ); + need_tasklist = !same_thread_group (tsk, current); +if (need_tasklist) { +/* +* Ensure we can't race with group exit or de_thread(), +* so tsk->group_leader can't be freed or changed until +* read_unlock(tasklist_lock) below. +*/ +read_lock (&tasklist_lock); +if (!pid_alive (tsk)) + ret = -ESRCH ; + } + +if (!ret) { + ret =do_prlimit (tsk, resource, new_rlim ? &new :NULL , + old_rlim ? &old :NULL ); + } + +if (need_tasklist) +read_unlock (&tasklist_lock);if (!ret && old_rlim) {rlim_to_rlim64 (&old, &old64);
Greg Kroah-Hartman
maintainerPATCH 146/277 KEYS: trusted_tpm1: Compare HMAC values in constant time
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit eed0e3d305530066b4fc5370107cff8ef1a0d229 upstream.
To prevent timing attacks, HMAC value comparison needs to be constant time. Replace the memcmp() with the correct function, crypto_memneq().
[For the Fixes commit I used the commit that introduced the memcmp(). It predates the introduction of crypto_memneq(), but it was still a bug at the time even though a helper function didn't exist yet.]
--- security/keys/trusted-keys/trusted_tpm1.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
security/keys/trusted-keys/trusted_tpm1.c +4 -3
@@ -7,6 +7,7 @@*/ #include <crypto/hash_info.h> +#include <crypto/utils.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/parser.h>
@@ -241,7 +242,7 @@ int TSS_checkhmac1(unsigned char *bufferif (ret <0 ) goto out; -if (memcmp (testhmac, authdata,SHA1_DIGEST_SIZE )) +if (crypto_memneq (testhmac, authdata,SHA1_DIGEST_SIZE )) ret = -EINVAL ; out:kfree_sensitive (sdesc);
@@ -334,7 +335,7 @@ static int TSS_checkhmac2(unsigned char TPM_NONCE_SIZE, ononce, 1, continueflag1, 0, 0);if (ret <0 ) goto out; -if (memcmp (testhmac1, authdata1,SHA1_DIGEST_SIZE )) { +if (crypto_memneq (testhmac1, authdata1,SHA1_DIGEST_SIZE )) { ret = -EINVAL ; goto out; }
@@ -343,7 +344,7 @@ static int TSS_checkhmac2(unsigned char TPM_NONCE_SIZE, ononce, 1, continueflag2, 0, 0);if (ret <0 ) goto out; -if (memcmp (testhmac2, authdata2,SHA1_DIGEST_SIZE )) +if (crypto_memneq (testhmac2, authdata2,SHA1_DIGEST_SIZE )) ret = -EINVAL ; out:kfree_sensitive (sdesc);
Greg Kroah-Hartman
maintainerPATCH 147/277 lib/genalloc: fix device leak in of_gen_pool_get()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1260cbcffa608219fc9188a6cbe9c45a300ef8b5 upstream.
Make sure to drop the reference taken when looking up the genpool platform device in of_gen_pool_get() before returning the pool.
Note that holding a reference to a device does typically not prevent its devres managed resources from being released so there is no point in keeping the reference.
--- lib/genalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
lib/genalloc.c +4 -1
@@ -899,8 +899,11 @@ struct gen_pool *of_gen_pool_get(structif (!name) name =of_node_full_name (np_pool); } -if (pdev) +if (pdev) { pool =gen_pool_get (&pdev->dev, name); +put_device (&pdev->dev); + } +of_node_put (np_pool);return pool;
Greg Kroah-Hartman
maintainerPATCH 148/277 loop: fix backing file reference leak on validation error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Chen <[email protected]>
commit 98b7bf54338b797e3a11e8178ce0e806060d8fa3 upstream.
loop_change_fd() and loop_configure() call loop_check_backing_file() to validate the new backing file. If validation fails, the reference acquired by fget() was not dropped, leaking a file reference.
Fix this by calling fput(file) before returning the error.
--- drivers/block/loop.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/block/loop.c +6 -2
@@ -536,8 +536,10 @@ static int loop_change_fd(struct loop_dereturn -EBADF ; error =loop_check_backing_file (file); -if (error) +if (error) { +fput (file);return error; + }/* suppress uevents while reconfiguring the device */ dev_set_uevent_suppress (disk_to_dev (lo->lo_disk),1 );
@@ -973,8 +975,10 @@ static int loop_configure(struct loop_dereturn -EBADF ; error =loop_check_backing_file (file); -if (error) +if (error) { +fput (file);return error; + } is_loop =is_loop_device (file);
Greg Kroah-Hartman
maintainerPATCH 149/277 of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit a8de554774ae48efbe48ace79f8badae2daa2bf1 upstream.
In of_unittest_pci_node_verify(), when the add parameter is false, device_find_any_child() obtains a reference to a child device. This function implicitly calls get_device() to increment the device's reference count before returning the pointer. However, the caller fails to properly release this reference by calling put_device(), leading to a device reference count leak. Add put_device() in the else branch immediately after child_dev is no longer needed.
As the comment of device_find_any_child states: "NOTE: you will need to drop the reference with put_device() after use".
Found by code review.
--- drivers/of/unittest.c | 1 + 1 file changed, 1 insertion(+)
drivers/of/unittest.c +1 -0
@@ -4191,6 +4191,7 @@ static int of_unittest_pci_node_verify(sunittest (!np,"Child device tree node is not removed\n" ); child_dev =device_find_any_child (&pdev->dev);unittest (!child_dev,"Child device is not removed\n" ); +put_device (child_dev); } failed:
Greg Kroah-Hartman
maintainerPATCH 150/277 openat2: dont trigger automounts with RESOLVE_NO_XDEV
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Askar Safin <[email protected]>
commit 042a60680de43175eb4df0977ff04a4eba9da082 upstream.
openat2 had a bug: if we pass RESOLVE_NO_XDEV, then openat2 doesn't traverse through automounts, but may still trigger them. (See the link for full bug report with reproducer.)
This commit fixes this bug.
--- fs/namei.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/namei.c +8 -0
@@ -1388,6 +1388,10 @@ static int follow_automount(struct path dentry->d_inode)return -EISDIR ; +/* No need to trigger automounts if mountpoint crossing is disabled. */ +if (lookup_flags &LOOKUP_NO_XDEV ) +return -EXDEV ; +if (count && (*count)++ >=MAXSYMLINKS )return -ELOOP ;
@@ -1411,6 +1415,10 @@ static int __traverse_mounts(struct path/* Allow the filesystem to manage the transit without i_mutex * being held. */ if (flags &DCACHE_MANAGE_TRANSIT ) { +if (lookup_flags &LOOKUP_NO_XDEV ) { + ret = -EXDEV ; +break ; + } ret = path->dentry->d_op->d_manage (path, false); flags =smp_load_acquire (&path->dentry->d_flags);if (ret <0 )