6.17.5-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.17.5-rc1 review
This is the start of the stable review cycle for the 6.17.5 release. There are 159 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 23 Oct 2025 19:49:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.17.5-rc1
Matthew Brost <[email protected]>
drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
Lucas De Marchi <[email protected]>
drm/xe: Move rebar to be done earlier
Piotr Piórkowski <[email protected]>
drm/xe: Unify the initialization of VRAM regions
Piotr Piórkowski <[email protected]>
drm/xe: Move struct xe_vram_region to a dedicated header
Piotr Piórkowski <[email protected]>
drm/xe: Use dynamic allocation for tile and device VRAM region structures
Piotr Piórkowski <[email protected]>
drm/xe: Use devm_ioremap_wc for VRAM mapping and drop manual unmap
Devarsh Thakkar <[email protected]>
phy: cadence: cdns-dphy: Update calibration wait time for startup state machine
Dave Jiang <[email protected]>
cxl: Fix match_region_by_range() to use region_res_match_cxl_range()
Babu Moger <[email protected]>
x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
Babu Moger <[email protected]>
x86/resctrl: Refactor resctrl_arch_rmid_read()
Chuck Lever <[email protected]>
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
Devarsh Thakkar <[email protected]>
phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling
Tomi Valkeinen <[email protected]>
phy: cdns-dphy: Store hs_clk_rate and return it
Sergey Bashirov <[email protected]>
NFSD: Fix last write offset handling in layoutcommit
Sergey Bashirov <[email protected]>
NFSD: Implement large extent array support in pNFS
Sergey Bashirov <[email protected]>
NFSD: Minor cleanup in layoutcommit processing
Sergey Bashirov <[email protected]>
NFSD: Rework encoding and decoding of nfsd4_deviceid
Christoph Hellwig <[email protected]>
xfs: fix log CRC mismatches between i386 and other architectures
Christoph Hellwig <[email protected]>
xfs: rename the old_crc variable in xlog_recover_process
Mark Rutland <[email protected]>
arm64: errata: Apply workarounds for Neoverse-V3AE
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-V3AE definitions
Ada Couprie Diaz <[email protected]>
arm64: debug: always unmask interrupts in el0_softstp()
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
Miguel Ojeda <[email protected]>
rust: cpufreq: fix formatting
Wilfred Mallawa <[email protected]>
nvme/tcp: handle tls partially sent records in write_space()
Xing Guo <[email protected]>
selftests: arg_parsing: Ensure data is flushed to disk before reading.
Matthew Auld <[email protected]>
drm/xe/evict: drop bogus assert
Li Qiang <[email protected]>
ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails
Thadeu Lima de Souza Cascardo <[email protected]>
HID: multitouch: fix name of Stylus input devices
Dmitry Torokhov <[email protected]>
HID: hid-input: only ignore 0 battery events for digitizers
Ming Lei <[email protected]>
block: Remove elevator_lock usage from blkg_conf frozen operations
Yu Kuai <[email protected]>
blk-mq: fix stale tag depth for shared sched tags in blk_mq_update_nr_requests()
Jiaming Zhang <[email protected]>
ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
Andrii Nakryiko <[email protected]>
selftests/bpf: make arg_parsing.c more robust to crashes
Alison Schofield <[email protected]>
cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events
Martin George <[email protected]>
nvme-auth: update sc_c in host response
Pranjal Ramajor Asha Kanojiya <[email protected]>
accel/qaic: Synchronize access to DBC request queue head & tail pointer
Youssef Samir <[email protected]>
accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
Jeff Hugo <[email protected]>
accel/qaic: Fix bootlog initialization ordering
Randy Dunlap <[email protected]>
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
Vincent Guittot <[email protected]>
sched/fair: Fix pelt lost idle time detection
Peter Zijlstra (Intel) <[email protected]>
sched/deadline: Stop dl_server before CPU goes offline
Even Xu <[email protected]>
HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level to edge detection
Alok Tiwari <[email protected]>
drm/rockchip: vop2: use correct destination rectangle height check
Francesco Valla <[email protected]>
drm/draw: fix color truncation in drm_draw_fill24
Ingo Molnar <[email protected]>
x86/mm: Fix SMP ordering in switch_mm_irqs_off()
Dave Jiang <[email protected]>
cxl/features: Add check for no entries in cxl_feature_info
Vinay Belgaumkar <[email protected]>
drm/xe: Enable media sampler power gating
Timur Kristóf <[email protected]>
drm/amd/powerplay: Fix CIK shutdown temperature
Alex Deucher <[email protected]>
drm/amdgpu: drop unused structures in amdgpu_drm.h
Alex Deucher <[email protected]>
drm/amdgpu: set an error on all fences from a bad context
Alex Deucher <[email protected]>
drm/amdgpu: handle wrap around in reemit handling
Alex Deucher <[email protected]>
drm/amdgpu: fix handling of harvesting for ip_discovery firmware
Alex Deucher <[email protected]>
drm/amdgpu: add support for cyan skillfish without IP discovery
Alex Deucher <[email protected]>
drm/amdgpu: add ip offset support for cyan skillfish
Ville Syrjälä <[email protected]>
drm/i915/fb: Fix the set_tiling vs. addfb race, again
Ville Syrjälä <[email protected]>
drm/i915/frontbuffer: Move bo refcounting intel_frontbuffer_{get,release}()
Zhanjun Dong <[email protected]>
drm/i915/guc: Skip communication warning on reset in progress
Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Consistently clear interrupts before unmasking
Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Generalize helper to clear IRQ status
Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Cancel jdet_work before handling jack ejection
Christophe Leroy <[email protected]>
ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
Sourabh Jain <[email protected]>
powerpc/fadump: skip parameter area allocation when fadump is disabled
Marek Vasut <[email protected]>
drm/bridge: lt9211: Drop check for last nibble of version register
Fabian Vogt <[email protected]>
riscv: kprobes: Fix probe address validation
Amit Chaudhary <[email protected]>
nvme-multipath: Skip nr_active increments in RETRY disposition
Ketil Johnsen <[email protected]>
drm/panthor: Ensure MCU is disabled on suspend
I Viswanath <[email protected]>
net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
Breno Leitao <[email protected]>
netdevsim: set the carrier when the device goes up
Sabrina Dubroca <[email protected]>
tls: don't rely on tx_work during send()
Sabrina Dubroca <[email protected]>
tls: wait for pending async decryptions if tls_strp_msg_hold fails
Sabrina Dubroca <[email protected]>
tls: always set record_type in tls_process_cmsg
Sabrina Dubroca <[email protected]>
tls: wait for async encrypt in case of error during latter iterations of sendmsg
Sabrina Dubroca <[email protected]>
tls: trim encrypted message to match the plaintext on short splice
Alexey Simakov <[email protected]>
tg3: prevent use of uninitialized remote_adv and local_adv variables
Marios Makassikis <[email protected]>
ksmbd: fix recursive locking in RPC handle list access
Florian Westphal <[email protected]>
net: core: fix lockdep splat on device unregister
Wang Liang <[email protected]>
selftests: net: check jq command is supported
Lorenzo Bianconi <[email protected]>
net: airoha: Take into account out-of-order tx completions in airoha_dev_xmit()
Eric Dumazet <[email protected]>
tcp: fix tcp_tso_should_defer() vs large RTT
Zqiang <[email protected]>
usbnet: Fix using smp_processor_id() in preemptible code warnings
Harshit Mogalapalli <[email protected]>
Octeontx2-af: Fix missing error code in cgx_probe()
Raju Rangoju <[email protected]>
amd-xgbe: Avoid spurious link down messages during interface toggle
Marek Vasut <[email protected]>
net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present
Koichiro Den <[email protected]>
ixgbe: fix too early devlink_free() in ixgbe_remove()
Milena Olech <[email protected]>
idpf: cleanup remaining SKBs in PTP flows
Dmitry Safonov <[email protected]>
net/ip6_tunnel: Prevent perpetual tunnel growth
Kamil Horák - 2N <[email protected]>
net: phy: bcm54811: Fix GMII/MII/MII-Lite selection
Linmao Li <[email protected]>
r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
Ivan Vecera <[email protected]>
dpll: zl3073x: Handle missing or corrupted flash configuration
Ivan Vecera <[email protected]>
dpll: zl3073x: Refactor DPLL initialization
Tetsuo Handa <[email protected]>
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
Nicolas Dichtel <[email protected]>
doc: fix seg6_flowlabel path
Yeounsu Moon <[email protected]>
net: dlink: handle dma_map_single() failure properly
Rex Lu <[email protected]>
net: mtk: wed: add dma mask limitation and GFP_DMA32 for device with more than 4GB DRAM
Marc Kleine-Budde <[email protected]>
can: m_can: fix CAN state in system PM
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_chip_config(): bring up interface in correct state
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
Christian Brauner <[email protected]>
coredump: fix core_pattern input validation
Yuezhang Mo <[email protected]>
dax: skip read lock assertion for read-only filesystems
Benjamin Tissoires <[email protected]>
HID: multitouch: fix sticky fingers
Kuen-Han Tsai <[email protected]>
usb: gadget: f_ncm: Refactor bind path to use __free()
Kuen-Han Tsai <[email protected]>
usb: gadget: f_ecm: Refactor bind path to use __free()
Kuen-Han Tsai <[email protected]>
usb: gadget: f_acm: Refactor bind path to use __free()
Kuen-Han Tsai <[email protected]>
usb: gadget: f_rndis: Refactor bind path to use __free()
Kuen-Han Tsai <[email protected]>
usb: gadget: Introduce free_usb_request helper
Kuen-Han Tsai <[email protected]>
usb: gadget: Store endpoint pointer in usb_request
Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: m2m: Fix streaming cleanup on release
Mario Limonciello (AMD) <[email protected]>
drm/amd: Fix hybrid sleep
Mario Limonciello (AMD) <[email protected]>
PM: hibernate: Add pm_hibernation_mode_is_suspend()
Mario Limonciello <[email protected]>
drm/amd: Check whether secure display TA loaded successfully
Adrian Hunter <[email protected]>
perf/core: Fix MMAP2 event device with backing files
Adrian Hunter <[email protected]>
perf/core: Fix MMAP event path names with backing files
Adrian Hunter <[email protected]>
perf/core: Fix address filter match with backing files
Kenneth Graunke <[email protected]>
drm/xe: Increase global invalidation timeout to 1000us
Jonathan Kim <[email protected]>
drm/amdgpu: fix gfx12 mes packet status return check
Gui-Dong Han <[email protected]>
drm/amdgpu: use atomic functions with memory barriers for vm fault info
Thomas Zimmermann <[email protected]>
drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off
Tvrtko Ursulin <[email protected]>
drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
Denis Arefev <[email protected]>
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
Denis Arefev <[email protected]>
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk entry for HP ZBook 17 G6
Stuart Hayhurst <[email protected]>
ALSA: hda/intel: Add MSI X870E Tomahawk to denylist
Dave Jiang <[email protected]>
cxl/acpi: Fix setup of memory resource in cxl_acpi_set_cache_size()
Eugene Korenevsky <[email protected]>
cifs: parse_dfs_referrals: prevent oob on malformed input
Celeste Liu <[email protected]>
can: gs_usb: increase max interface to U8_MAX
Celeste Liu <[email protected]>
can: gs_usb: gs_make_candev(): populate net_device->dev_port
Filipe Manana <[email protected]>
btrfs: do not assert we found block group item when creating free space tree
Miquel Sabaté Solà <[email protected]>
btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST
Boris Burkov <[email protected]>
btrfs: fix incorrect readahead expansion length
Qu Wenruo <[email protected]>
btrfs: only set the device specific options after devices are opened
Miquel Sabaté Solà <[email protected]>
btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
Filipe Manana <[email protected]>
btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running
Deepanshu Kartikey <[email protected]>
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
Zhang Yi <[email protected]>
ext4: wait for ongoing I/O to complete before freeing blocks
Zhang Yi <[email protected]>
jbd2: ensure that all ongoing I/O complete before freeing blocks
Tim Hostetler <[email protected]>
gve: Check valid ts bit on RX descriptor before hw timestamping
Jaegeuk Kim <[email protected]>
f2fs: fix wrong block mapping for multi-devices
Oliver Upton <[email protected]>
KVM: arm64: Prevent access to vCPU events before init
Bhanu Seshu Kumar Valluri <[email protected]>
net: usb: lan78xx: Fix lost EEPROM write timeout error(-ETIMEDOUT) in lan78xx_write_raw_eeprom
Yi Cong <[email protected]>
r8152: add error handling in rtl8152_driver_init
Matthew Schwartz <[email protected]>
Revert "drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume"
Pavel Begunkov <[email protected]>
io_uring: protect mem region deregistration
Jens Axboe <[email protected]>
Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
Hao Ge <[email protected]>
slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
Rong Zhang <[email protected]>
x86/CPU/AMD: Prevent reset reasons from being retained across reboot
Shuhao Fu <[email protected]>
smb: client: Fix refcount leak for cifs_sb_tlink
Conor Dooley <[email protected]>
rust: cfi: only 64-bit arm and x86 support CFI_CLANG
Jedrzej Jagielski <[email protected]>
ixgbevf: fix mailbox API compatibility by negotiating supported features
Jedrzej Jagielski <[email protected]>
ixgbevf: fix getting link speed data for E610 devices
Shuicheng Lin <[email protected]>
drm/xe/guc: Check GuC running state before deregistering exec queue
Lorenzo Pieralisi <[email protected]>
arm64/sysreg: Fix GIC CDEOI instruction encoding
Damien Le Moal <[email protected]>
ata: libata-core: relax checks in ata_read_log_directory()
Jan Kara <[email protected]>
vfs: Don't leak disconnected dentries on umount
Inochi Amaoto <[email protected]>
PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info()
Andrey Albershteyn <[email protected]>
Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP"
Jonathan Corbet <[email protected]>
docs: kdoc: handle the obsolescensce of docutils.ErrorString()
-------------
Diffstat:
Documentation/arch/arm64/silicon-errata.rst | 2 + Documentation/networking/seg6-sysctl.rst | 3 + Documentation/sphinx/kernel_feat.py | 4 +- Documentation/sphinx/kernel_include.py | 6 +- Documentation/sphinx/maintainers_include.py | 4 +- Makefile | 4 +- arch/Kconfig | 1 + arch/arm64/Kconfig | 1 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/sysreg.h | 11 +- arch/arm64/kernel/cpu_errata.c | 1 + arch/arm64/kernel/entry-common.c | 8 +- arch/arm64/kvm/arm.c | 6 + arch/powerpc/kernel/fadump.c | 3 + arch/riscv/kernel/probes/kprobes.c | 13 +- arch/x86/kernel/cpu/amd.c | 16 +- arch/x86/kernel/cpu/resctrl/monitor.c | 46 ++-- arch/x86/mm/tlb.c | 24 +- block/blk-cgroup.c | 13 +- block/blk-mq-sched.c | 2 +- block/blk-mq-tag.c | 5 +- block/blk-mq.c | 2 +- block/blk-mq.h | 3 +- drivers/accel/qaic/qaic.h | 2 + drivers/accel/qaic/qaic_control.c | 2 +- drivers/accel/qaic/qaic_data.c | 12 +- drivers/accel/qaic/qaic_debugfs.c | 5 +- drivers/accel/qaic/qaic_drv.c | 3 + drivers/ata/libata-core.c | 11 +- drivers/cxl/acpi.c | 2 +- drivers/cxl/core/features.c | 3 + drivers/cxl/core/region.c | 7 +- drivers/cxl/core/trace.h | 2 +- drivers/dpll/zl3073x/core.c | 280 +++++++++++++-------- drivers/dpll/zl3073x/core.h | 3 + drivers/dpll/zl3073x/devlink.c | 18 +- drivers/dpll/zl3073x/regs.h | 3 + drivers/gpu/drm/amd/amdgpu/Makefile | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 48 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 54 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 2 +- .../gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c | 56 +++++ drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/nv.h | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 7 - .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +- drivers/gpu/drm/ast/ast_mode.c | 18 +- drivers/gpu/drm/ast/ast_reg.h | 1 + drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +- drivers/gpu/drm/drm_draw.c | 2 +- drivers/gpu/drm/drm_draw_internal.h | 2 +- drivers/gpu/drm/i915/display/intel_fb.c | 38 +-- drivers/gpu/drm/i915/display/intel_frontbuffer.c | 10 +- .../gpu/drm/i915/gem/i915_gem_object_frontbuffer.h | 2 - drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 +- drivers/gpu/drm/panthor/panthor_fw.c | 1 + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- drivers/gpu/drm/scheduler/sched_main.c | 13 +- drivers/gpu/drm/xe/display/xe_fb_pin.c | 5 +- drivers/gpu/drm/xe/display/xe_plane_initial.c | 3 +- drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_assert.h | 4 +- drivers/gpu/drm/xe/xe_bo.c | 1 + drivers/gpu/drm/xe/xe_bo.h | 4 +- drivers/gpu/drm/xe/xe_bo_evict.c | 8 - drivers/gpu/drm/xe/xe_bo_types.h | 1 + drivers/gpu/drm/xe/xe_device.c | 22 +- drivers/gpu/drm/xe/xe_device_types.h | 62 +---- drivers/gpu/drm/xe/xe_gt_idle.c | 8 + drivers/gpu/drm/xe/xe_gt_pagefault.c | 13 +- drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 3 +- drivers/gpu/drm/xe/xe_guc_submit.c | 13 +- drivers/gpu/drm/xe/xe_migrate.c | 25 +- drivers/gpu/drm/xe/xe_pci.c | 8 + drivers/gpu/drm/xe/xe_query.c | 5 +- drivers/gpu/drm/xe/xe_svm.c | 63 ++--- drivers/gpu/drm/xe/xe_tile.c | 58 +++-- drivers/gpu/drm/xe/xe_tile.h | 14 +- drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c | 10 +- drivers/gpu/drm/xe/xe_ttm_vram_mgr.c | 22 +- drivers/gpu/drm/xe/xe_ttm_vram_mgr.h | 3 +- drivers/gpu/drm/xe/xe_vm.c | 32 ++- drivers/gpu/drm/xe/xe_vm_types.h | 2 + drivers/gpu/drm/xe/xe_vram.c | 245 +++++++++++++----- drivers/gpu/drm/xe/xe_vram.h | 14 +- drivers/gpu/drm/xe/xe_vram_types.h | 85 +++++++ drivers/hid/hid-input.c | 5 +- drivers/hid/hid-multitouch.c | 28 ++- .../intel-quickspi/quickspi-protocol.c | 3 +- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 226 +++++++---------- drivers/net/can/m_can/m_can.c | 64 +++-- drivers/net/can/m_can/m_can_platform.c | 2 +- drivers/net/can/usb/gs_usb.c | 23 +- drivers/net/ethernet/airoha/airoha_eth.c | 16 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + drivers/net/ethernet/broadcom/tg3.c | 5 +- drivers/net/ethernet/dlink/dl2k.c | 23 +- drivers/net/ethernet/google/gve/gve.h | 2 + drivers/net/ethernet/google/gve/gve_desc_dqo.h | 3 +- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 16 +- drivers/net/ethernet/intel/idpf/idpf_ptp.c | 3 + .../net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +- drivers/net/ethernet/intel/ixgbevf/defines.h | 1 + drivers/net/ethernet/intel/ixgbevf/ipsec.c | 10 + drivers/net/ethernet/intel/ixgbevf/ixgbevf.h | 7 + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 34 ++- drivers/net/ethernet/intel/ixgbevf/mbx.h | 8 + drivers/net/ethernet/intel/ixgbevf/vf.c | 182 +++++++++++--- drivers/net/ethernet/intel/ixgbevf/vf.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 1 + drivers/net/ethernet/mediatek/mtk_wed.c | 8 +- drivers/net/ethernet/realtek/r8169_main.c | 5 +- drivers/net/netdevsim/netdev.c | 7 + drivers/net/phy/broadcom.c | 20 +- drivers/net/phy/realtek/realtek_main.c | 23 +- drivers/net/usb/lan78xx.c | 19 +- drivers/net/usb/r8152.c | 7 +- drivers/net/usb/usbnet.c | 2 + drivers/nvme/host/auth.c | 6 +- drivers/nvme/host/multipath.c | 6 +- drivers/nvme/host/tcp.c | 3 + drivers/pci/controller/vmd.c | 13 + drivers/phy/cadence/cdns-dphy.c | 133 +++++++--- drivers/usb/gadget/function/f_acm.c | 42 ++-- drivers/usb/gadget/function/f_ecm.c | 48 ++-- drivers/usb/gadget/function/f_ncm.c | 78 +++--- drivers/usb/gadget/function/f_rndis.c | 85 +++---- drivers/usb/gadget/udc/core.c | 3 + fs/btrfs/extent_io.c | 2 +- fs/btrfs/free-space-tree.c | 15 +- fs/btrfs/ioctl.c | 2 +- fs/btrfs/relocation.c | 13 +- fs/btrfs/super.c | 3 +- fs/btrfs/zoned.c | 2 +- fs/coredump.c | 2 +- fs/dax.c | 2 +- fs/dcache.c | 2 + fs/exec.c | 2 +- fs/ext4/ext4_jbd2.c | 11 +- fs/ext4/inode.c | 8 + fs/f2fs/data.c | 2 +- fs/file_attr.c | 12 +- fs/fuse/ioctl.c | 4 - fs/hfsplus/unicode.c | 24 ++ fs/jbd2/transaction.c | 13 +- fs/nfsd/blocklayout.c | 25 +- fs/nfsd/blocklayoutxdr.c | 86 ++++--- fs/nfsd/blocklayoutxdr.h | 4 +- fs/nfsd/flexfilelayout.c | 8 + fs/nfsd/flexfilelayoutxdr.c | 3 +- fs/nfsd/nfs4layouts.c | 1 - fs/nfsd/nfs4proc.c | 36 ++- fs/nfsd/nfs4xdr.c | 25 +- fs/nfsd/pnfs.h | 1 + fs/nfsd/xdr4.h | 39 ++- fs/overlayfs/copy_up.c | 2 +- fs/overlayfs/inode.c | 5 +- fs/smb/client/inode.c | 6 +- fs/smb/client/misc.c | 17 ++ fs/smb/client/smb2ops.c | 8 +- fs/smb/server/mgmt/user_session.c | 7 +- fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/transport_ipc.c | 12 + fs/xfs/libxfs/xfs_log_format.h | 30 ++- fs/xfs/libxfs/xfs_ondisk.h | 2 + fs/xfs/xfs_log.c | 8 +- fs/xfs/xfs_log_priv.h | 4 +- fs/xfs/xfs_log_recover.c | 34 ++- include/linux/brcmphy.h | 1 + include/linux/libata.h | 6 + include/linux/suspend.h | 2 + include/linux/usb/gadget.h | 25 ++ include/net/ip_tunnels.h | 15 ++ include/uapi/drm/amdgpu_drm.h | 21 -- io_uring/register.c | 1 + io_uring/rw.c | 2 +- kernel/events/core.c | 8 +- kernel/power/hibernate.c | 11 + kernel/sched/core.c | 2 + kernel/sched/deadline.c | 3 + kernel/sched/fair.c | 26 +- mm/slub.c | 9 +- net/can/j1939/main.c | 2 + net/core/dev.c | 40 ++- net/ipv4/ip_tunnel.c | 14 -- net/ipv4/tcp_output.c | 19 +- net/ipv6/ip6_tunnel.c | 3 +- net/tls/tls_main.c | 7 +- net/tls/tls_sw.c | 31 ++- rust/kernel/cpufreq.rs | 3 +- sound/firewire/amdtp-stream.h | 2 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 + sound/hda/codecs/side-codecs/hda_component.c | 4 + sound/hda/controllers/intel.c | 1 + sound/soc/amd/acp/acp-sdw-sof-mach.c | 2 +- sound/soc/codecs/idt821034.c | 12 +- sound/soc/codecs/nau8821.c | 115 +++++---- sound/usb/card.c | 10 +- .../testing/selftests/bpf/prog_tests/arg_parsing.c | 12 +- tools/testing/selftests/net/rtnetlink.sh | 2 + tools/testing/selftests/net/vlan_bridge_binding.sh | 2 + 211 files changed, 2408 insertions(+), 1262 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/159 docs: kdoc: handle the obsolescensce of docutils.ErrorString()
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Corbet <[email protected]>
commit 00d95fcc4dee66dfb6980de6f2973b32f973a1eb upstream.
The ErrorString() and SafeString() docutils functions were helpers meant to ease the handling of encodings during the Python 3 transition. There is no real need for them after Python 3.6, and docutils 0.22 removes them, breaking the docs build
Handle this by just injecting our own one-liner version of ErrorString(), and removing the sole SafeString() call entirely.
Message-ID: <[email protected]>
[ Salvatore Bonaccorso: Backport to v6.17.y for context changes in
Documentation/sphinx/kernel_include.py with major refactorings for the v6.18 development cycle ]
--- Documentation/sphinx/kernel_feat.py | 4 +++- Documentation/sphinx/kernel_include.py | 6 ++++-- Documentation/sphinx/maintainers_include.py | 4 +++- 3 files changed, 10 insertions(+), 4 deletions(-)
Documentation/sphinx/kernel_feat.py +3 -1
@@ -40,9 +40,11 @@ import sys from docutils import nodes, statemachine from docutils.statemachine import ViewList from docutils.parsers.rst import directives, Directive -from docutils.utils.error_reporting import ErrorString from sphinx.util.docutils import switch_source_input +def ErrorString(exc): # Shamelessly stolen from docutils + return f'{exc.__class__.__name}: {exc}' + __version__ = '1.0' def setup(app):
Documentation/sphinx/kernel_include.py +4 -2
@@ -35,13 +35,15 @@ import os.path from docutils import io, nodes, statemachine -from docutils.utils.error_reporting import SafeString, ErrorString from docutils.parsers.rst import directives from docutils.parsers.rst.directives.body import CodeBlock, NumberLines from docutils.parsers.rst.directives.misc import Include __version__ = '1.0' +def ErrorString(exc): # Shamelessly stolen from docutils + return f'{exc.__class__.__name}: {exc}' + # ============================================================================== def setup(app): # ==============================================================================
@@ -112,7 +114,7 @@ class KernelInclude(Include): raise self.severe('Problems with "%s" directive path:\n' 'Cannot encode input file path "%s" ' '(wrong locale?).' % - (self.name, SafeString(path))) + (self.name, path)) except IOError as error: raise self.severe('Problems with "%s" directive path:\n%s.' % (self.name, ErrorString(error)))
Documentation/sphinx/maintainers_include.py +3 -1
@@ -22,10 +22,12 @@ import re import os.path from docutils import statemachine -from docutils.utils.error_reporting import ErrorString from docutils.parsers.rst import Directive from docutils.parsers.rst.directives.misc import Include +def ErrorString(exc): # Shamelessly stolen from docutils + return f'{exc.__class__.__name}: {exc}' + __version__ = '1.0' def setup(app):
Greg Kroah-Hartman
maintainerPATCH 2/159 Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP"
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Albershteyn <[email protected]>
commit 4dd5b5ac089bb6ea719b7ffb748707ac9cbce4e4 upstream.
This reverts commit 474b155adf3927d2c944423045757b54aa1ca4de.
This patch caused regression in ioctl_setflags(). Underlying filesystems use EOPNOTSUPP to indicate that flag is not supported. This error is also gets converted in ioctl_setflags(). Therefore, for unsupported flags error changed from EOPNOSUPP to ENOIOCTLCMD.
--- fs/file_attr.c | 12 ++---------- fs/fuse/ioctl.c | 4 ---- fs/overlayfs/copy_up.c | 2 +- fs/overlayfs/inode.c | 5 ++++- 4 files changed, 7 insertions(+), 16 deletions(-)
fs/file_attr.c +2 -10
@@ -84,7 +84,7 @@ int vfs_fileattr_get(struct dentry *dentry, struct file_kattr *fa)int error;if (!inode->i_op->fileattr_get) -return -EOPNOTSUPP ; +return -ENOIOCTLCMD ; error =security_inode_file_getattr (dentry, fa);if (error)
@@ -270,7 +270,7 @@ int vfs_fileattr_set(struct mnt_idmap *idmap, struct dentry *dentry,int err;if (!inode->i_op->fileattr_set) -return -EOPNOTSUPP ; +return -ENOIOCTLCMD ;if (!inode_owner_or_capable (idmap, inode))return -EPERM ;
@@ -312,8 +312,6 @@ int ioctl_getflags(struct file *file, unsigned int __user *argp)int err; err =vfs_fileattr_get (file->f_path.dentry, &fa); -if (err == -EOPNOTSUPP ) - err = -ENOIOCTLCMD ;if (!err) err =put_user (fa.flags, argp);return err;
@@ -335,8 +333,6 @@ int ioctl_setflags(struct file *file, unsigned int __user *argp)fileattr_fill_flags (&fa, flags); err =vfs_fileattr_set (idmap, dentry, &fa);mnt_drop_write_file (file); -if (err == -EOPNOTSUPP ) - err = -ENOIOCTLCMD ; } }return err;
@@ -349,8 +345,6 @@ int ioctl_fsgetxattr(struct file *file, void __user *argp)int err; err =vfs_fileattr_get (file->f_path.dentry, &fa); -if (err == -EOPNOTSUPP ) - err = -ENOIOCTLCMD ;if (!err) err =copy_fsxattr_to_user (&fa, argp);
@@ -371,8 +365,6 @@ int ioctl_fssetxattr(struct file *file, void __user *argp)if (!err) { err =vfs_fileattr_set (idmap, dentry, &fa);mnt_drop_write_file (file); -if (err == -EOPNOTSUPP ) - err = -ENOIOCTLCMD ; } }return err;
fs/fuse/ioctl.c +0 -4
@@ -536,8 +536,6 @@ int fuse_fileattr_get(struct dentry *dentry, struct file_kattr *fa) cleanup:fuse_priv_ioctl_cleanup (inode, ff); -if (err == -ENOTTY ) - err = -EOPNOTSUPP ;return err; }
@@ -574,7 +572,5 @@ int fuse_fileattr_set(struct mnt_idmap *idmap, cleanup:fuse_priv_ioctl_cleanup (inode, ff); -if (err == -ENOTTY ) - err = -EOPNOTSUPP ;return err; }
fs/overlayfs/copy_up.c +1 -1
@@ -178,7 +178,7 @@ static int ovl_copy_fileattr(struct inode *inode, const struct path *old, err =ovl_real_fileattr_get (old, &oldfa);if (err) {/* Ntfs-3g returns -EINVAL for "no fileattr support" */ -if (err == -EOPNOTSUPP || err == -EINVAL ) +if (err == -ENOTTY || err == -EINVAL )return 0 ;pr_warn ("failed to retrieve lower fileattr (%pd2, err=%i)\n" , old->dentry, err);
fs/overlayfs/inode.c +4 -1
@@ -720,7 +720,10 @@ int ovl_real_fileattr_get(const struct path *realpath, struct file_kattr *fa)if (err)return err; -return vfs_fileattr_get (realpath->dentry, fa); + err =vfs_fileattr_get (realpath->dentry, fa); +if (err == -ENOIOCTLCMD ) + err = -ENOTTY ; +return err; }int ovl_fileattr_get (struct dentry *dentry,struct file_kattr *fa)
Signature · 1 line
2.51.1.dirty
Greg Kroah-Hartman
maintainerPATCH 3/159 PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <[email protected]>
commit e433110eb5bf067f74d3d15c5fb252206c66ae0b upstream.
Since commit 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains") set callback irq_startup() and irq_shutdown() of the struct pci_msi[x]_template, __irq_startup() will always invokes irq_startup() callback instead of irq_enable() callback overridden in vmd_init_dev_msi_info(). This will not start the IRQ correctly.
Also override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info(), so the irq_startup() can invoke the real logic.
--- drivers/pci/controller/vmd.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/pci/controller/vmd.c +13 -0
@@ -192,6 +192,12 @@ static void vmd_pci_msi_enable(struct irq_data *data) data->chip->irq_unmask (data); } +static unsigned int vmd_pci_msi_startup (struct irq_data *data) +{ +vmd_pci_msi_enable (data); +return 0 ; +} +static void vmd_irq_disable (struct irq_data *data) {struct vmd_irq *vmdirq = data->chip_data;
@@ -210,6 +216,11 @@ static void vmd_pci_msi_disable(struct irq_data *data)vmd_irq_disable (data->parent_data); } +static void vmd_pci_msi_shutdown (struct irq_data *data) +{ +vmd_pci_msi_disable (data); +} +static struct irq_chip vmd_msi_controller = { .name ="VMD-MSI" , .irq_compose_msi_msg = vmd_compose_msi_msg,
@@ -309,6 +320,8 @@ static bool vmd_init_dev_msi_info(struct device *dev, struct irq_domain *domain,if (!msi_lib_init_dev_msi_info (dev, domain, real_parent, info))return false; + info->chip->irq_startup = vmd_pci_msi_startup; + info->chip->irq_shutdown = vmd_pci_msi_shutdown; info->chip->irq_enable = vmd_pci_msi_enable; info->chip->irq_disable = vmd_pci_msi_disable;return true;
Signature · 1 line
2.51.1.dirty
Greg Kroah-Hartman
maintainerPATCH 4/159 vfs: Dont leak disconnected dentries on umount
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 56094ad3eaa21e6621396cc33811d8f72847a834 upstream.
When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well.
--- fs/dcache.c | 2 ++ 1 file changed, 2 insertions(+)
fs/dcache.c +2 -0
@@ -2557,6 +2557,8 @@ struct dentry *d_alloc_parallel(struct dspin_lock (&parent->d_lock); new->d_parent =dget_dlock (parent);hlist_add_head (&new->d_sib, &parent->d_children); +if (parent->d_flags &DCACHE_DISCONNECTED ) + new->d_flags |=DCACHE_DISCONNECTED ;spin_unlock (&parent->d_lock); retry:
Greg Kroah-Hartman
maintainerPATCH 5/159 ata: libata-core: relax checks in ata_read_log_directory()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 12d724f2852d094d68dccaf5101e0ef89a971cde upstream.
Commit 6d4405b16d37 ("ata: libata-core: Cache the general purpose log directory") introduced caching of a device general purpose log directory to avoid repeated access to this log page during device scan. This change also added a check on this log page to verify that the log page version is 0x0001 as mandated by the ACS specifications.
And it turns out that some devices do not bother reporting this version, instead reporting a version 0, resulting in error messages such as:
ata6.00: Invalid log directory version 0x0000
and to the device being marked as not supporting the general purpose log directory log page.
Since before commit 6d4405b16d37 the log page version check did not exist and things were still working correctly for these devices, relax ata_read_log_directory() version check and only warn about the invalid log page version number without disabling access to the log directory page.
--- drivers/ata/libata-core.c | 11 ++++------- include/linux/libata.h | 6 ++++++ 2 files changed, 10 insertions(+), 7 deletions(-)
drivers/ata/libata-core.c +4 -7
@@ -2174,13 +2174,10 @@ static int ata_read_log_directory(struct ata_device *dev) } version =get_unaligned_le16 (&dev->gp_log_dir[0 ]); -if (version !=0x0001 ) { -ata_dev_err (dev,"Invalid log directory version 0x%04x\n" , - version); -ata_clear_log_directory (dev); - dev->quirks |=ATA_QUIRK_NO_LOG_DIR ; -return -EINVAL ; - } +if (version !=0x0001 ) +ata_dev_warn_once (dev, +"Invalid log directory version 0x%04x\n" , + version);return 0 ; }
include/linux/libata.h +6 -0
@@ -1594,6 +1594,12 @@ do { \#define ata_dev_dbg (dev, fmt, ...) \ ata_dev_printk(debug, dev, fmt, ##__VA_ARGS__) +#define ata_dev_warn_once (dev, fmt, ...) \ + pr_warn_once("ata%u.%02u: " fmt, \ + (dev)->link->ap->print_id, \ + (dev)->link->pmp + (dev)->devno, \ + ##__VA_ARGS__) +static inline void ata_print_version_once (const struct device *dev,const char *version) {
Signature · 1 line
2.51.1.dirty
Greg Kroah-Hartman
maintainerPATCH 6/159 arm64/sysreg: Fix GIC CDEOI instruction encoding
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <[email protected]>
commit e9ad390a4812fd60c1da46823f7a6f84f2411f0c upstream.
The GIC CDEOI system instruction requires the Rt field to be set to 0b11111 otherwise the instruction behaviour becomes CONSTRAINED UNPREDICTABLE.
Currenly, its usage is encoded as a system register write, with a constant 0 value:
write_sysreg_s(0, GICV5_OP_GIC_CDEOI)
While compiling with GCC, the 0 constant value, through these asm constraints and modifiers ('x' modifier and 'Z' constraint combo):
asm volatile(__msr_s(r, "%x0") : : "rZ" (__val));
forces the compiler to issue the XZR register for the MSR operation (ie that corresponds to Rt == 0b11111) issuing the right instruction encoding.
Unfortunately LLVM does not yet understand that modifier/constraint combo so it ends up issuing a different register from XZR for the MSR source, which in turns means that it encodes the GIC CDEOI instruction wrongly and the instruction behaviour becomes CONSTRAINED UNPREDICTABLE that we must prevent.
Add a conditional to write_sysreg_s() macro that detects whether it is passed a constant 0 value and issues an MSR write with XZR as source register - explicitly doing what the asm modifier/constraint is meant to achieve through constraints/modifiers, fixing the LLVM compilation issue.
--- arch/arm64/include/asm/sysreg.h | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
arch/arm64/include/asm/sysreg.h +10 -1
@@ -1231,10 +1231,19 @@ __val; \ }) +/* +* The "Z" constraint combined with the "%x0" template should be enough +* to force XZR generation if (v) is a constant 0 value but LLVM does not +* yet understand that modifier/constraint combo so a conditional is required +* to nudge the compiler into using XZR as a source for a 0 constant value. +*/ #define write_sysreg_s (v, r) do { \ u64 __val = (u64)(v); \ u32 __maybe_unused __check_r = (u32)(r); \ - asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); \ + if (__builtin_constant_p(__val) && __val == 0) \ + asm volatile(__msr_s(r, "xzr")); \ + else \ + asm volatile(__msr_s(r, "%x0") : : "r" (__val)); \ } while (0)/*
Greg Kroah-Hartman
maintainerPATCH 7/159 drm/xe/guc: Check GuC running state before deregistering exec queue
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
commit 9f64b3cd051b825de0a2a9f145c8e003200cedd5 upstream.
In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driver is forced to unbind while the exec queue is still running, the user may call exec_destroy() after the GuC has already been stopped and CT communication disabled.
In this case, the driver cannot receive a response from the GuC, preventing proper cleanup of exec queue resources. Fix this by directly releasing the resources when GuC is not running.
Here is the failure dmesg log:
"
[ 468.089581] ---[ end trace 0000000000000000 ]--- [ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535) [ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535 [ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1 [ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1) [ 468.092716] ------------[ cut here ]------------ [ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe]
"
v2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled().
As CT may go down and come back during VF migration.
--- drivers/gpu/drm/xe/xe_guc_submit.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_guc_submit.c +12 -1
@@ -44,6 +44,7 @@#include "xe_ring_ops_types.h" #include "xe_sched_job.h" #include "xe_trace.h" +#include "xe_uc_fw.h" #include "xe_vm.h" static struct xe_guc *
@@ -1413,7 +1414,17 @@ static void __guc_exec_queue_process_msgxe_gt_assert (guc_to_gt (guc), !(q->flags &EXEC_QUEUE_FLAG_PERMANENT ));trace_xe_exec_queue_cleanup_entity (q); -if (exec_queue_registered (q)) +/* +* Expected state transitions for cleanup: +* - If the exec queue is registered and GuC firmware is running, we must first +* disable scheduling and deregister the queue to ensure proper teardown and +* resource release in the GuC, then destroy the exec queue on driver side. +* - If the GuC is already stopped (e.g., during driver unload or GPU reset), +* we cannot expect a response for the deregister request. In this case, +* it is safe to directly destroy the exec queue on driver side, as the GuC +* will not process further requests and all resources must be cleaned up locally. +*/ +if (exec_queue_registered (q) &&xe_uc_fw_is_running (&guc->fw))disable_scheduling_deregister (guc, q);else __guc_exec_queue_destroy (guc, q);
Greg Kroah-Hartman
maintainerPATCH 8/159 ixgbevf: fix getting link speed data for E610 devices
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jedrzej Jagielski <[email protected]>
commit 53f0eb62b4d23d40686f2dd51776b8220f2887bb upstream.
E610 adapters no longer use the VFLINKS register to read PF's link speed and linkup state. As a result VF driver cannot get actual link state and it incorrectly reports 10G which is the default option. It leads to a situation where even 1G adapters print 10G as actual link speed. The same happens when PF driver set speed different than 10G.
Add new mailbox operation to let the VF driver request a PF driver to provide actual link data. Update the mailbox api to v1.6.
Incorporate both ways of getting link status within the legacy ixgbe_check_mac_link_vf() function.
--- drivers/net/ethernet/intel/ixgbevf/defines.h | 1 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 6 drivers/net/ethernet/intel/ixgbevf/mbx.h | 4 drivers/net/ethernet/intel/ixgbevf/vf.c | 137 +++++++++++++++++----- 4 files changed, 116 insertions(+), 32 deletions(-)
drivers/net/ethernet/intel/ixgbevf/defines.h +1 -0
@@ -28,6 +28,7 @@/* Link speed */ typedef u32 ixgbe_link_speed ; +#define IXGBE_LINK_SPEED_UNKNOWN 0#define IXGBE_LINK_SPEED_1GB_FULL 0x0020#define IXGBE_LINK_SPEED_10GB_FULL 0x0080#define IXGBE_LINK_SPEED_100_FULL 0x0008
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +5 -1
@@ -2275,6 +2275,7 @@ static void ixgbevf_negotiate_api(struct {struct ixgbe_hw *hw = &adapter->hw;static const int api[] = { + ixgbe_mbox_api_16, ixgbe_mbox_api_15, ixgbe_mbox_api_14, ixgbe_mbox_api_13,
@@ -2294,7 +2295,8 @@ static void ixgbevf_negotiate_api(struct idx++; } -if (hw->api_version >= ixgbe_mbox_api_15) { +/* Following is not supported by API 1.6, it is specific for 1.5 */ +if (hw->api_version == ixgbe_mbox_api_15) { hw->mbx.ops.init_params (hw);memcpy (&hw->mbx.ops, &ixgbevf_mbx_ops,sizeof (struct ixgbe_mbx_operations ));
@@ -2651,6 +2653,7 @@ static void ixgbevf_set_num_queues(struccase ixgbe_mbox_api_13:case ixgbe_mbox_api_14:case ixgbe_mbox_api_15: +case ixgbe_mbox_api_16:if (adapter->xdp_prog && hw->mac.max_tx_queues == rss) rss = rss >3 ?2 :1 ;
@@ -4645,6 +4648,7 @@ static int ixgbevf_probe(struct pci_devcase ixgbe_mbox_api_13:case ixgbe_mbox_api_14:case ixgbe_mbox_api_15: +case ixgbe_mbox_api_16: netdev->max_mtu =IXGBE_MAX_JUMBO_FRAME_SIZE - (ETH_HLEN +ETH_FCS_LEN );break ;
drivers/net/ethernet/intel/ixgbevf/mbx.h +4 -0
@@ -66,6 +66,7 @@ enum ixgbe_pfvf_api_rev { ixgbe_mbox_api_13,/* API version 1.3, linux/freebsd VF driver */ ixgbe_mbox_api_14,/* API version 1.4, linux/freebsd VF driver */ ixgbe_mbox_api_15,/* API version 1.5, linux/freebsd VF driver */ + ixgbe_mbox_api_16,/* API version 1.6, linux/freebsd VF driver */ /* This value should always be last */ ixgbe_mbox_api_unknown, /* indicates that API version is not known */ };
@@ -102,6 +103,9 @@ enum ixgbe_pfvf_api_rev {#define IXGBE_VF_GET_LINK_STATE 0x10/* get vf link state */ +/* mailbox API, version 1.6 VF requests */ +#define IXGBE_VF_GET_PF_LINK_STATE 0x11/* request PF to send link info */ +/* length of permanent address message returned from PF */ #define IXGBE_VF_PERMADDR_MSG_LEN 4/* word in permanent address message with the current multicast type */
drivers/net/ethernet/intel/ixgbevf/vf.c +106 -31
185 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 9/159 ixgbevf: fix mailbox API compatibility by negotiating supported features
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jedrzej Jagielski <[email protected]>
commit a7075f501bd33c93570af759b6f4302ef0175168 upstream.
There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapters from Intel portfolio could easily negotiate mailbox API.
This convention has been broken since introducing API 1.4. Commit 0062e7cc955e ("ixgbevf: add VF IPsec offload code") added support for IPSec which is specific only for the kernel ixgbe driver. None of the rest of the Intel 10G PF/VF drivers supports it. And actually lack of support was not included in the IPSec implementation - there were no such code paths. No possibility to negotiate support for the feature was introduced along with introduction of the feature itself.
Commit 339f28964147 ("ixgbevf: Add support for new mailbox communication between PF and VF") increasing API version to 1.5 did the same - it introduced code supported specifically by the PF ESX driver. It altered API version for the VF driver in the same time not touching the version defined for the PF ixgbe driver. It led to additional discrepancies, as the code provided within API 1.6 cannot be supported for Linux ixgbe driver as it causes crashes.
The issue was noticed some time ago and mitigated by Jake within the commit d0725312adf5 ("ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5"). As a result we have regression for IPsec support and after increasing API to version 1.6 ixgbevf driver stopped to support ESX MBX.
To fix this mess add new mailbox op asking PF driver about supported features. Basing on a response determine whether to set support for IPSec and ESX-specific enhanced mailbox.
New mailbox op, for compatibility purposes, must be added within new API revision, as API version of OOT PF & VF drivers is already increased to 1.6 and doesn't incorporate features negotiate op.
Features negotiation mechanism gives possibility to be extended with new features when needed in the future.
--- drivers/net/ethernet/intel/ixgbevf/ipsec.c | 10 ++++ drivers/net/ethernet/intel/ixgbevf/ixgbevf.h | 7 +++ drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 32 ++++++++++++++- drivers/net/ethernet/intel/ixgbevf/mbx.h | 4 + drivers/net/ethernet/intel/ixgbevf/vf.c | 45 +++++++++++++++++++++- drivers/net/ethernet/intel/ixgbevf/vf.h | 1 6 files changed, 96 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/ixgbevf/ipsec.c +10 -0
@@ -273,6 +273,9 @@ static int ixgbevf_ipsec_add_sa(struct n adapter =netdev_priv (dev); ipsec = adapter->ipsec; +if (!(adapter->pf_features &IXGBEVF_PF_SUP_IPSEC )) +return -EOPNOTSUPP ; +if (xs->id.proto !=IPPROTO_ESP && xs->id.proto !=IPPROTO_AH ) {NL_SET_ERR_MSG_MOD (extack,"Unsupported protocol for IPsec offload" );return -EINVAL ;
@@ -405,6 +408,9 @@ static void ixgbevf_ipsec_del_sa(struct adapter =netdev_priv (dev); ipsec = adapter->ipsec; +if (!(adapter->pf_features &IXGBEVF_PF_SUP_IPSEC )) +return ; +if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) { sa_idx = xs->xso.offload_handle -IXGBE_IPSEC_BASE_RX_INDEX ;
@@ -612,6 +618,10 @@ void ixgbevf_init_ipsec_offload(struct isize_t size;switch (adapter->hw.api_version) { +case ixgbe_mbox_api_17: +if (!(adapter->pf_features &IXGBEVF_PF_SUP_IPSEC )) +return ; +break ;case ixgbe_mbox_api_14:break ;default :
drivers/net/ethernet/intel/ixgbevf/ixgbevf.h +7 -0
@@ -363,6 +363,13 @@ struct ixgbevf_adapter {struct ixgbe_hw hw;u16 msg_enable; +u32 pf_features; +#define IXGBEVF_PF_SUP_IPSEC BIT(0) +#define IXGBEVF_PF_SUP_ESX_MBX BIT(1) + +#define IXGBEVF_SUPPORTED_FEATURES (IXGBEVF_PF_SUP_IPSEC | \ + IXGBEVF_PF_SUP_ESX_MBX) +struct ixgbevf_hw_stats stats;unsigned long state;
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +30 -2
@@ -2271,10 +2271,35 @@ static void ixgbevf_init_last_counter_st adapter->stats.base_vfmprc = adapter->stats.last_vfmprc; } +/** +* ixgbevf_set_features - Set features supported by PF +* @adapter: pointer to the adapter struct +* +* Negotiate with PF supported features and then set pf_features accordingly. +*/ +static void ixgbevf_set_features (struct ixgbevf_adapter *adapter) +{ +u32 *pf_features = &adapter->pf_features; +struct ixgbe_hw *hw = &adapter->hw; +int err; + + err = hw->mac.ops.negotiate_features (hw, pf_features); +if (err && err != -EOPNOTSUPP ) +netdev_dbg (adapter->netdev, +"PF feature negotiation failed.\n" ); + +/* Address also pre API 1.7 cases */ +if (hw->api_version == ixgbe_mbox_api_14) + *pf_features |=IXGBEVF_PF_SUP_IPSEC ; +else if (hw->api_version == ixgbe_mbox_api_15) + *pf_features |=IXGBEVF_PF_SUP_ESX_MBX ; +} +static void ixgbevf_negotiate_api (struct ixgbevf_adapter *adapter) {struct ixgbe_hw *hw = &adapter->hw;static const int api[] = { + ixgbe_mbox_api_17, ixgbe_mbox_api_16, ixgbe_mbox_api_15, ixgbe_mbox_api_14,
@@ -2295,8 +2320,9 @@ static void ixgbevf_negotiate_api(struct idx++; } -/* Following is not supported by API 1.6, it is specific for 1.5 */ -if (hw->api_version == ixgbe_mbox_api_15) { +ixgbevf_set_features (adapter); + +if (adapter->pf_features &IXGBEVF_PF_SUP_ESX_MBX ) { hw->mbx.ops.init_params (hw);memcpy (&hw->mbx.ops, &ixgbevf_mbx_ops,sizeof (struct ixgbe_mbx_operations ));
@@ -2654,6 +2680,7 @@ static void ixgbevf_set_num_queues(struccase ixgbe_mbox_api_14:case ixgbe_mbox_api_15:case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17:if (adapter->xdp_prog && hw->mac.max_tx_queues == rss) rss = rss >3 ?2 :1 ;
@@ -4649,6 +4676,7 @@ static int ixgbevf_probe(struct pci_devcase ixgbe_mbox_api_14:case ixgbe_mbox_api_15:case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17: netdev->max_mtu =IXGBE_MAX_JUMBO_FRAME_SIZE - (ETH_HLEN +ETH_FCS_LEN );break ;
drivers/net/ethernet/intel/ixgbevf/mbx.h +4 -0
@@ -67,6 +67,7 @@ enum ixgbe_pfvf_api_rev { ixgbe_mbox_api_14,/* API version 1.4, linux/freebsd VF driver */ ixgbe_mbox_api_15,/* API version 1.5, linux/freebsd VF driver */ ixgbe_mbox_api_16,/* API version 1.6, linux/freebsd VF driver */ + ixgbe_mbox_api_17,/* API version 1.7, linux/freebsd VF driver */ /* This value should always be last */ ixgbe_mbox_api_unknown, /* indicates that API version is not known */ };
@@ -106,6 +107,9 @@ enum ixgbe_pfvf_api_rev {/* mailbox API, version 1.6 VF requests */ #define IXGBE_VF_GET_PF_LINK_STATE 0x11/* request PF to send link info */ +/* mailbox API, version 1.7 VF requests */ +#define IXGBE_VF_FEATURES_NEGOTIATE 0x12/* get features supported by PF*/ +/* length of permanent address message returned from PF */ #define IXGBE_VF_PERMADDR_MSG_LEN 4/* word in permanent address message with the current multicast type */
drivers/net/ethernet/intel/ixgbevf/vf.c +44 -1
99 lines not on this page · raw message
drivers/net/ethernet/intel/ixgbevf/vf.h +1 -0
@@ -26,6 +26,7 @@ struct ixgbe_mac_operations {s32 (*stop_adapter)(struct ixgbe_hw *);s32 (*get_bus_info)(struct ixgbe_hw *);s32 (*negotiate_api_version)(struct ixgbe_hw *hw,int api); +int (*negotiate_features)(struct ixgbe_hw *hw,u32 *pf_features);/* Link */ s32 (*setup_link)(struct ixgbe_hw *,ixgbe_link_speed ,bool ,bool );
Greg Kroah-Hartman
maintainerPATCH 10/159 rust: cfi: only 64-bit arm and x86 support CFI_CLANG
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conor Dooley <[email protected]>
commit 812258ff4166bcd41c7d44707e0591f9ae32ac8c upstream.
The kernel uses the standard rustc targets for non-x86 targets, and out of those only 64-bit arm's target has kcfi support enabled. For x86, the custom 64-bit target enables kcfi.
The HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC config option that allows CFI_CLANG to be used in combination with RUST does not check whether the rustc target supports kcfi. This breaks the build on riscv (and presumably 32-bit arm) when CFI_CLANG and RUST are enabled at the same time.
Ordinarily, a rustc-option check would be used to detect target support but unfortunately rustc-option filters out the target for reasons given in commit 46e24a545cdb4 ("rust: kasan/kbuild: fix missing flags on first build"). As a result, if the host supports kcfi but the target does not, e.g. when building for riscv on x86_64, the build would remain broken.
Instead, make HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC depend on the only two architectures where the target used supports it to fix the build.
--- arch/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/Kconfig +1 -0
@@ -917,6 +917,7 @@ config HAVE_CFI_ICALL_NORMALIZE_INTEGERS def_bool y depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG depends on RUSTC_VERSION >= 107900 + depends on ARM64 || X86_64 # With GCOV/KASAN we need this fix: https://github.com/rust-lang/rust/pull/129373 depends on (RUSTC_LLVM_VERSION >= 190103 && RUSTC_VERSION >= 108200) || \ (!GCOV_KERNEL && !KASAN_GENERIC && !KASAN_SW_TAGS)
Greg Kroah-Hartman
maintainerPATCH 11/159 smb: client: Fix refcount leak for cifs_sb_tlink
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit c2b77f42205ef485a647f62082c442c1cd69d3fc upstream.
Fix three refcount inconsistency issues related to cifs_sb_tlink.
Comments for cifs_sb_tlink state that cifs_put_tlink() needs to be called after successful calls to cifs_sb_tlink(). Three calls fail to update refcount accordingly, leading to possible resource leaks.
--- fs/smb/client/inode.c | 6 ++++-- fs/smb/client/smb2ops.c | 8 ++++---- 2 files changed, 8 insertions(+), 6 deletions(-)
fs/smb/client/inode.c +4 -2
@@ -2431,8 +2431,10 @@ cifs_do_rename(const unsigned int xid, s tcon =tlink_tcon (tlink); server = tcon->ses->server; -if (!server->ops->rename) -return -ENOSYS ; +if (!server->ops->rename) { + rc = -ENOSYS ; + goto do_rename_exit; + }/* try path-based rename first */ rc = server->ops->rename(xid, tcon, from_dentry,
fs/smb/client/smb2ops.c +4 -4
@@ -3129,8 +3129,7 @@ get_smb2_acl_by_path(struct cifs_sb_info utf16_path =cifs_convert_path_to_utf16 (path, cifs_sb);if (!utf16_path) { rc = -ENOMEM ; -free_xid (xid); -return ERR_PTR (rc); + goto put_tlink; } oparms = (struct cifs_open_parms ) {
@@ -3162,6 +3161,7 @@ get_smb2_acl_by_path(struct cifs_sb_infoSMB2_close (xid, tcon, fid.persistent_fid, fid.volatile_fid); } +put_tlink:cifs_put_tlink (tlink);free_xid (xid);
@@ -3202,8 +3202,7 @@ set_smb2_acl(struct smb_ntsd *pnntsd, __ utf16_path =cifs_convert_path_to_utf16 (path, cifs_sb);if (!utf16_path) { rc = -ENOMEM ; -free_xid (xid); -return rc; + goto put_tlink; } oparms = (struct cifs_open_parms ) {
@@ -3224,6 +3223,7 @@ set_smb2_acl(struct smb_ntsd *pnntsd, __SMB2_close (xid, tcon, fid.persistent_fid, fid.volatile_fid); } +put_tlink:cifs_put_tlink (tlink);free_xid (xid);return rc;
Greg Kroah-Hartman
maintainerPATCH 12/159 x86/CPU/AMD: Prevent reset reasons from being retained across reboot
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <[email protected]>
commit e6416c2dfe23c9a6fec881fda22ebb9ae486cfc5 upstream.
The S5_RESET_STATUS register is parsed on boot and printed to kmsg. However, this could sometimes be misleading and lead to users wasting a lot of time on meaningless debugging for two reasons:
* Some bits are never cleared by hardware. It's the software's responsibility to clear them as per the Processor Programming Reference (see [1]).
* Some rare hardware-initiated platform resets do not update the register at all.
In both cases, a previous reboot could leave its trace in the register, resulting in users seeing unrelated reboot reasons while debugging random reboots afterward.
Write the read value back to the register in order to clear all reason bits since they are write-1-to-clear while the others must be preserved.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=206537#attach_303991
[ bp: Massage commit message. ]
--- arch/x86/kernel/cpu/amd.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/amd.c +14 -2
@@ -1338,11 +1338,23 @@ static __init int print_s5_reset_status_return 0 ; value =ioread32 (addr); -iounmap (addr);/* Value with "all bits set" is an error response and should be ignored. */ -if (value ==U32_MAX ) +if (value ==U32_MAX ) { +iounmap (addr);return 0 ; + } + +/* +* Clear all reason bits so they won't be retained if the next reset +* does not update the register. Besides, some bits are never cleared by +* hardware so it's software's responsibility to clear them. +* +* Writing the value back effectively clears all reason bits as they are +* write-1-to-clear. +*/ +iowrite32 (value, addr); +iounmap (addr);for (i =0 ; i <ARRAY_SIZE (s5_reset_reason_txt); i++) {if (!(value &BIT (i)))
Greg Kroah-Hartman
maintainerPATCH 13/159 slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
commit 86f54f9b6c17d6567c69e3a6fed52fdf5d7dbe93 upstream.
If obj_exts allocation failed, slab->obj_exts is set to OBJEXTS_ALLOC_FAIL, But we do not clear it when freeing the slab. Since OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS currently share the same bit position, during the release of the associated folio, a VM_BUG_ON_FOLIO() check in folio_memcg_kmem() is triggered because the OBJEXTS_ALLOC_FAIL flag was not cleared, causing it to be interpreted as a kmem folio (non-slab) with MEMCG_OBJEXTS_DATA flag set, which is invalid because MEMCG_OBJEXTS_DATA is supposed to be set only on slabs.
Another problem that predates sharing the OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS bits is that on configurations with is_check_pages_enabled(), the non-cleared bit in page->memcg_data will trigger a free_page_is_bad() failure "page still charged to cgroup"
When freeing a slab, we clear slab->obj_exts if the obj_ext array has been successfully allocated. So let's clear it also when the allocation has failed.
--- mm/slub.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
mm/slub.c +8 -1
@@ -2073,8 +2073,15 @@ static inline void free_slab_obj_exts(ststruct slabobj_ext *obj_exts; obj_exts =slab_obj_exts (slab); -if (!obj_exts) +if (!obj_exts) { +/* +* If obj_exts allocation failed, slab->obj_exts is set to +* OBJEXTS_ALLOC_FAIL. In this case, we end up here and should +* clear the flag. +*/ + slab->obj_exts =0 ;return ; + }/* * obj_exts was created with __GFP_NO_OBJ_EXT flag, therefore its
Greg Kroah-Hartman
maintainerPATCH 14/159 Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 927069c4ac2cd1a37efa468596fb5b8f86db9df0 upstream.
This reverts commit 90bfb28d5fa8127a113a140c9791ea0b40ab156a.
Kevin reports that this commit causes an issue for him with LVM snapshots, most likely because of turning off NOWAIT support while a snapshot is being created. This makes -EOPNOTSUPP bubble back through the completion handler, where io_uring read/write handling should just retry it.
Reinstate the previous check removed by the referenced commit.
--- io_uring/rw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/rw.c +1 -1
@@ -540,7 +540,7 @@ static void __io_complete_rw_common(stru {if (res == req->cqe.res)return ; -if (res == -EAGAIN &&io_rw_should_reissue (req)) { +if ((res == -EOPNOTSUPP || res == -EAGAIN ) &&io_rw_should_reissue (req)) { req->flags |=REQ_F_REISSUE |REQ_F_BL_NO_RECYCLE ; }else {req_set_fail (req);
Greg Kroah-Hartman
maintainerPATCH 15/159 io_uring: protect mem region deregistration
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit be7cab44ed099566c605a8dac686c3254db01b35 upstream.
io_create_region_mmap_safe() protects publishing of a region against concurrent mmap calls, however we should also protect against it when removing a region. There is a gap io_register_mem_region() where it safely publishes a region, but then copy_to_user goes wrong and it unsafely frees the region.
--- io_uring/register.c | 1 + 1 file changed, 1 insertion(+)
io_uring/register.c +1 -0
@@ -618,6 +618,7 @@ static int io_register_mem_region(structif (ret)return ret;if (copy_to_user (rd_uptr, &rd,sizeof (rd))) { +guard (mutex)(&ctx->mmap_lock);io_free_region (ctx, &ctx->param_region);return -EFAULT ; }
Greg Kroah-Hartman
maintainerPATCH 16/159 Revert "drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume"
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <[email protected]>
commit 9858ea4c29c283f0a8a3cdbb42108d464ece90a8 upstream.
This fix regressed the original issue that commit 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot") solved, so revert it until a different approach to solve the regression that it caused with AMD_PRIVATE_COLOR is found.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++-------- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 7 ------- 2 files changed, 4 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -8
@@ -2041,8 +2041,6 @@ static int amdgpu_dm_init(struct amdgpu_dc_hardware_init (adev->dm.dc); - adev->dm.restore_backlight = true; - adev->dm.hpd_rx_offload_wq =hpd_rx_irq_create_workqueue (adev);if (!adev->dm.hpd_rx_offload_wq) {drm_err (adev_to_drm (adev),"failed to create hpd rx offload workqueue.\n" );
@@ -3405,7 +3403,6 @@ static int dm_resume(struct amdgpu_ip_bldc_set_power_state (dm->dc,DC_ACPI_CM_POWER_STATE_D0 );dc_resume (dm->dc); - adev->dm.restore_backlight = true;amdgpu_dm_irq_resume_early (adev);
@@ -9836,6 +9833,7 @@ static void amdgpu_dm_commit_streams(strbool mode_set_reset_required = false;u32 i;struct dc_commit_streams_params params = {dc_state->streams, dc_state->stream_count}; +bool set_backlight_level = false;/* Disable writeback */ for_each_old_connector_in_state (state, connector, old_con_state, i) {
@@ -9955,6 +9953,7 @@ static void amdgpu_dm_commit_streams(str acrtc->hw_mode = new_crtc_state->mode; crtc->hwmode = new_crtc_state->mode; mode_set_reset_required = true; + set_backlight_level = true; }else if (modereset_required (new_crtc_state)) { drm_dbg_atomic(dev, "Atomic commit: RESET. crtc id %d:[%p]\n",
@@ -10011,16 +10010,13 @@ static void amdgpu_dm_commit_streams(str* to fix a flicker issue. * It will cause the dm->actual_brightness is not the current panel brightness * level. (the dm->brightness is the correct panel level) -* So we set the backlight level with dm->brightness value after initial -* set mode. Use restore_backlight flag to avoid setting backlight level -* for every subsequent mode set. +* So we set the backlight level with dm->brightness value after set mode */ -if (dm->restore_backlight) { +if (set_backlight_level) {for (i =0 ; i < dm->num_of_edps; i++) {if (dm->backlight_dev[i])amdgpu_dm_backlight_set_level (dm, i, dm->brightness[i]); } - dm->restore_backlight = false; } }
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +0 -7
@@ -611,13 +611,6 @@ struct amdgpu_display_manager {u32 actual_brightness[AMDGPU_DM_MAX_NUM_EDP ];/** -* @restore_backlight: -* -* Flag to indicate whether to restore backlight after modeset. -*/ -bool restore_backlight; - -/** * @aux_hpd_discon_quirk: * * quirk for hpd discon while aux is on-going.
Greg Kroah-Hartman
maintainerPATCH 17/159 r8152: add error handling in rtl8152_driver_init
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Cong <[email protected]>
commit 75527d61d60d493d1eb064f335071a20ca581f54 upstream.
rtl8152_driver_init() is missing the error handling. When rtl8152_driver registration fails, rtl8152_cfgselector_driver should be deregistered.
--- drivers/net/usb/r8152.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/r8152.c +6 -1
@@ -10122,7 +10122,12 @@ static int __init rtl8152_driver_init(vo ret =usb_register_device_driver (&rtl8152_cfgselector_driver,THIS_MODULE );if (ret)return ret; -return usb_register (&rtl8152_driver); + + ret =usb_register (&rtl8152_driver); +if (ret) +usb_deregister_device_driver (&rtl8152_cfgselector_driver); + +return ret; } static void __exit rtl8152_driver_exit(void)
Greg Kroah-Hartman
maintainerPATCH 18/159 net: usb: lan78xx: Fix lost EEPROM write timeout error(-ETIMEDOUT) in lan78xx_write_raw_eeprom
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhanu Seshu Kumar Valluri <[email protected]>
commit d5d790ba1558dbb8d179054f514476e2ee970b8e upstream.
The function lan78xx_write_raw_eeprom failed to properly propagate EEPROM write timeout errors (-ETIMEDOUT). In the timeout fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error saved in ret.
As a result, callers could mistakenly treat EEPROM write operation as successful even though the EEPROM write had actually timed out with no or partial data write.
To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM write timeout error saved in ret to the caller.
--- drivers/net/usb/lan78xx.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/net/usb/lan78xx.c +7 -4
@@ -1174,10 +1174,13 @@ static int lan78xx_write_raw_eeprom(stru } write_raw_eeprom_done: -if (dev->chipid ==ID_REV_CHIP_ID_7800_ ) -return lan78xx_write_reg (dev,HW_CFG , saved); - -return 0 ; +if (dev->chipid ==ID_REV_CHIP_ID_7800_ ) { +int rc =lan78xx_write_reg (dev,HW_CFG , saved); +/* If USB fails, there is nothing to do */ +if (rc <0 ) +return rc; + } +return ret; } static int lan78xx_read_raw_otp(struct lan78xx_net *dev, u32 offset,
Greg Kroah-Hartman
maintainerPATCH 19/159 KVM: arm64: Prevent access to vCPU events before init
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
commit 0aa1b76fe1429629215a7c79820e4b96233ac4a3 upstream.
Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception.
In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection:
kernel BUG at arch/arm64/kvm/inject_fault.c:40!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000)
Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state.
--- arch/arm64/kvm/arm.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/kvm/arm.c +6 -0
@@ -1789,6 +1789,9 @@ long kvm_arch_vcpu_ioctl(struct file *ficase KVM_GET_VCPU_EVENTS : {struct kvm_vcpu_events events; +if (!kvm_vcpu_initialized (vcpu)) +return -ENOEXEC ; +if (kvm_arm_vcpu_get_events (vcpu, &events))return -EINVAL ;
@@ -1800,6 +1803,9 @@ long kvm_arch_vcpu_ioctl(struct file *ficase KVM_SET_VCPU_EVENTS : {struct kvm_vcpu_events events; +if (!kvm_vcpu_initialized (vcpu)) +return -ENOEXEC ; +if (copy_from_user (&events, argp,sizeof (events)))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 20/159 f2fs: fix wrong block mapping for multi-devices
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 9d5c4f5c7a2c7677e1b3942772122b032c265aae upstream.
Assuming the disk layout as below,
disk0: 0 --- 0x00035abfff
disk1: 0x00035ac000 --- 0x00037abfff
disk2: 0x00037ac000 --- 0x00037ebfff
and we want to read data from offset=13568 having len=128 across the block devices, we can illustrate the block addresses like below.
0 .. 0x00037ac000 ------------------- 0x00037ebfff, 0x00037ec000 -------
| ^ ^ ^
| fofs 0 13568 13568+128
| ------------------------------------------------------
| LBA 0x37e8aa9 0x37ebfa9 0x37ec029
--- map 0x3caa9 0x3ffa9In this example, we should give the relative map of the target block device ranging from 0x3caa9 to 0x3ffa9 where the length should be calculated by 0x37ebfff + 1 - 0x37ebfa9.
In the below equation, however, map->m_pblk was supposed to be the original address instead of the one from the target block address.
- map->m_len = min(map->m_len, dev->end_blk + 1 - map->m_pblk);
--- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/data.c +1 -1
@@ -1504,8 +1504,8 @@ static bool f2fs_map_blocks_cached(strucstruct f2fs_dev_info *dev = &sbi->devs[bidx]; map->m_bdev = dev->bdev; - map->m_pblk -= dev->start_blk; map->m_len =min (map->m_len, dev->end_blk +1 - map->m_pblk); + map->m_pblk -= dev->start_blk; }else { map->m_bdev = inode->i_sb->s_bdev; }
Greg Kroah-Hartman
maintainerPATCH 21/159 gve: Check valid ts bit on RX descriptor before hw timestamping
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Hostetler <[email protected]>
commit bfdd74166a639930baaba27a8d729edaacd46907 upstream.
The device returns a valid bit in the LSB of the low timestamp byte in the completion descriptor that the driver should check before setting the SKB's hardware timestamp. If the timestamp is not valid, do not hardware timestamp the SKB.
--- drivers/net/ethernet/google/gve/gve.h | 2 ++ drivers/net/ethernet/google/gve/gve_desc_dqo.h | 3 ++- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 16 +++++++++++----- 3 files changed, 15 insertions(+), 6 deletions(-)
drivers/net/ethernet/google/gve/gve.h +2 -0
@@ -100,6 +100,8 @@*/ #define GVE_DQO_QPL_ONDEMAND_ALLOC_THRESHOLD 96 +#define GVE_DQO_RX_HWTSTAMP_VALID 0x1 +/* Each slot in the desc ring has a 1:1 mapping to a slot in the data ring */ struct gve_rx_desc_queue {struct gve_rx_desc *desc_ring;/* the descriptor ring */
drivers/net/ethernet/google/gve/gve_desc_dqo.h +2 -1
@@ -236,7 +236,8 @@ struct gve_rx_compl_desc_dqo {u8 status_error1; -__le16 reserved5; +u8 reserved5; +u8 ts_sub_nsecs_low;__le16 buf_id;/* Buffer ID which was sent on the buffer queue. */ union {
drivers/net/ethernet/google/gve/gve_rx_dqo.c +11 -5
@@ -456,14 +456,20 @@ static void gve_rx_skb_hash(struct sk_bu* Note that this means if the time delta between packet reception and the last * clock read is greater than ~2 seconds, this will provide invalid results. */ -static void gve_rx_skb_hwtstamp (struct gve_rx_ring *rx,u32 hwts) +static void gve_rx_skb_hwtstamp (struct gve_rx_ring *rx, +const struct gve_rx_compl_desc_dqo *desc) {u64 last_read =READ_ONCE (rx->gve->last_sync_nic_counter);struct sk_buff *skb = rx->ctx.skb_head; -u32 low = (u32 )last_read; -s32 diff = hwts - low; +u32 ts, low; +s32 diff; -skb_hwtstamps (skb)->hwtstamp =ns_to_ktime (last_read + diff); +if (desc->ts_sub_nsecs_low &GVE_DQO_RX_HWTSTAMP_VALID ) { + ts =le32_to_cpu (desc->ts); + low = (u32 )last_read; + diff = ts - low; +skb_hwtstamps (skb)->hwtstamp =ns_to_ktime (last_read + diff); + } }static void gve_rx_free_skb (struct napi_struct *napi,struct gve_rx_ring *rx)
@@ -919,7 +925,7 @@ static int gve_rx_complete_skb(struct gvgve_rx_skb_csum (rx->ctx.skb_head, desc, ptype);if (rx->gve->ts_config.rx_filter ==HWTSTAMP_FILTER_ALL ) -gve_rx_skb_hwtstamp (rx,le32_to_cpu (desc->ts)); +gve_rx_skb_hwtstamp (rx, desc);/* RSC packets must set gso_size otherwise the TCP stack will complain * that packets are larger than MTU.
Greg Kroah-Hartman
maintainerPATCH 22/159 jbd2: ensure that all ongoing I/O complete before freeing blocks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 3c652c3a71de1d30d72dc82c3bead8deb48eb749 upstream.
When releasing file system metadata blocks in jbd2_journal_forget(), if this buffer has not yet been checkpointed, it may have already been written back, currently be in the process of being written back, or has not yet written back. jbd2_journal_forget() calls jbd2_journal_try_remove_checkpoint() to check the buffer's status and add it to the current transaction if it has not been written back. This buffer can only be reallocated after the transaction is committed.
jbd2_journal_try_remove_checkpoint() attempts to lock the buffer and check its dirty status while holding the buffer lock. If the buffer has already been written back, everything proceeds normally. However, there are two issues. First, the function returns immediately if the buffer is locked by the write-back process. It does not wait for the write-back to complete. Consequently, until the current transaction is committed and the block is reallocated, there is no guarantee that the I/O will complete. This means that ongoing I/O could write stale metadata to the newly allocated block, potentially corrupting data. Second, the function unlocks the buffer as soon as it detects that the buffer is still dirty. If a concurrent write-back occurs immediately after this unlocking and before clear_buffer_dirty() is called in jbd2_journal_forget(), data corruption can theoretically still occur.
Although these two issues are unlikely to occur in practice since the undergoing metadata writeback I/O does not take this long to complete, it's better to explicitly ensure that all ongoing I/O operations are completed.
Message-ID: <[email protected]>
--- fs/jbd2/transaction.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/jbd2/transaction.c +9 -4
@@ -1659,6 +1659,7 @@ int jbd2_journal_forget(handle_t *handleint drop_reserve =0 ;int err =0 ;int was_modified =0 ; +int wait_for_writeback =0 ;if (is_handle_aborted (handle))return -EROFS ;
@@ -1782,18 +1783,22 @@ int jbd2_journal_forget(handle_t *handle }/* -* The buffer is still not written to disk, we should -* attach this buffer to current transaction so that the -* buffer can be checkpointed only after the current -* transaction commits. +* The buffer has not yet been written to disk. We should +* either clear the buffer or ensure that the ongoing I/O +* is completed, and attach this buffer to current +* transaction so that the buffer can be checkpointed only +* after the current transaction commits. */ clear_buffer_dirty (bh); + wait_for_writeback =1 ;__jbd2_journal_file_buffer (jh, transaction, BJ_Forget);spin_unlock (&journal->j_list_lock); } drop:__brelse (bh);spin_unlock (&jh->b_state_lock); +if (wait_for_writeback) +wait_on_buffer (bh);jbd2_journal_put_journal_head (jh);if (drop_reserve) {/* no need to reserve log space for this block -bzzz */
Greg Kroah-Hartman
maintainerPATCH 23/159 ext4: wait for ongoing I/O to complete before freeing blocks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 328a782cb138029182e521c08f50eb1587db955d upstream.
When freeing metadata blocks in nojournal mode, ext4_forget() calls bforget() to clear the dirty flag on the buffer_head and remvoe associated mappings. This is acceptable if the metadata has not yet begun to be written back. However, if the write-back has already started but is not yet completed, ext4_forget() will have no effect. Subsequently, ext4_mb_clear_bb() will immediately return the block to the mb allocator. This block can then be reallocated immediately, potentially causing an data corruption issue.
Fix this by clearing the buffer's dirty flag and waiting for the ongoing I/O to complete, ensuring that no further writes to stale data will occur.
Message-ID: <[email protected]>
--- fs/ext4/ext4_jbd2.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/ext4/ext4_jbd2.c +9 -2
@@ -280,9 +280,16 @@ int __ext4_forget(const char *where, uns bh, is_metadata, inode->i_mode, test_opt(inode->i_sb, DATA_FLAGS)); -/* In the no journal case, we can just do a bforget and return */ +/* +* In the no journal case, we should wait for the ongoing buffer +* to complete and do a forget. +*/ if (!ext4_handle_valid (handle)) { -bforget (bh); +if (bh) { +clear_buffer_dirty (bh); +wait_on_buffer (bh); +__bforget (bh); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 24/159 ext4: detect invalid INLINE_DATA + EXTENTS flag combination
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 1d3ad183943b38eec2acf72a0ae98e635dc8456b upstream.
syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal.
The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set:
EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:
comm syz.0.17: corrupted extent tree: lblk 0 < prev 66
Investigation revealed that the inode has both flags set:
DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1
This is an invalid combination since an inode should have either:
- INLINE_DATA: data stored directly in the inode
- EXTENTS: data stored in extent-mapped blocks
Having both flags causes ext4_has_inline_data() to return true, skipping extent tree validation in __ext4_iget(). The unvalidated out-of-order extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes.
Fix this by detecting this invalid flag combination early in ext4_iget() and rejecting the corrupted inode.
Message-ID: <[email protected]>
--- fs/ext4/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ext4/inode.c +8 -0
@@ -5319,6 +5319,14 @@ struct inode *__ext4_iget(struct super_b } ei->i_flags =le32_to_cpu (raw_inode->i_flags);ext4_set_inode_flags (inode, true); +/* Detect invalid flag combination - can't have both inline data and extents */ +if (ext4_test_inode_flag (inode,EXT4_INODE_INLINE_DATA ) && +ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS )) { +ext4_error_inode (inode, function, line,0 , +"inode has both inline data and extents flags" ); + ret = -EFSCORRUPTED ; + goto bad_inode; + } inode->i_blocks =ext4_inode_blocks (raw_inode, ei); ei->i_file_acl =le32_to_cpu (raw_inode->i_file_acl_lo);if (ext4_has_feature_64bit (sb))
Greg Kroah-Hartman
maintainerPATCH 25/159 btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 7e5a5983edda664e8e4bb20af17b80f5135c655c upstream.
When starting relocation, at reloc_chunk_start(), if we happen to find the flag BTRFS_FS_RELOC_RUNNING is already set we return an error (-EINPROGRESS) to the callers, however the callers call reloc_chunk_end() which will clear the flag BTRFS_FS_RELOC_RUNNING, which is wrong since relocation was started by another task and still running.
Finding the BTRFS_FS_RELOC_RUNNING flag already set is an unexpected scenario, but still our current behaviour is not correct.
Fix this by never calling reloc_chunk_end() if reloc_chunk_start() has returned an error, which is what logically makes sense, since the general widespread pattern is to have end functions called only if the counterpart start functions succeeded. This requires changing reloc_chunk_start() to clear BTRFS_FS_RELOC_RUNNING if there's a pending cancel request.
--- fs/btrfs/relocation.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
fs/btrfs/relocation.c +7 -6
@@ -3795,6 +3795,7 @@ out:/* * Mark start of chunk relocation that is cancellable. Check if the cancellation * has been requested meanwhile and don't start in that case. +* NOTE: if this returns an error, reloc_chunk_end() must not be called. * * Return: * 0 success
@@ -3811,10 +3812,8 @@ static int reloc_chunk_start(struct btrfif (atomic_read (&fs_info->reloc_cancel_req) >0 ) {btrfs_info (fs_info,"chunk relocation canceled on start" ); -/* -* On cancel, clear all requests but let the caller mark -* the end after cleanup operations. -*/ +/* On cancel, clear all requests. */ +clear_and_wake_up_bit (BTRFS_FS_RELOC_RUNNING , &fs_info->flags);atomic_set (&fs_info->reloc_cancel_req,0 );return -ECANCELED ; }
@@ -3823,9 +3822,11 @@ static int reloc_chunk_start(struct btrf/* * Mark end of chunk relocation that is cancellable and wake any waiters. +* NOTE: call only if a previous call to reloc_chunk_start() succeeded. */ static void reloc_chunk_end (struct btrfs_fs_info *fs_info) { +ASSERT (test_bit (BTRFS_FS_RELOC_RUNNING , &fs_info->flags));/* Requested after start, clear bit first so any waiters can continue */ if (atomic_read (&fs_info->reloc_cancel_req) >0 )btrfs_info (fs_info,"chunk relocation canceled during operation" );
@@ -4038,9 +4039,9 @@ out:if (err && rw)btrfs_dec_block_group_ro (rc->block_group);iput (rc->data_inode); +reloc_chunk_end (fs_info); out_put_bg:btrfs_put_block_group (bg); -reloc_chunk_end (fs_info);free_reloc_control (rc);return err; }
@@ -4223,8 +4224,8 @@ out_clean: ret = ret2; out_unset:unset_reloc_control (rc); -out_end:reloc_chunk_end (fs_info); +out_end:free_reloc_control (rc); out:free_reloc_roots (&reloc_roots);
Greg Kroah-Hartman
maintainerPATCH 26/159 btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Sabaté Solà <[email protected]>
commit 53a4acbfc1de85fa637521ffab4f4e2ee03cbeeb upstream.
On 'btrfs_ioctl_qgroup_assign' we first duplicate the argument as provided by the user, which is kfree'd in the end. But this was not the case when allocating memory for 'prealloc'. In this case, if it somehow failed, then the previous code would go directly into calling 'mnt_drop_write_file', without freeing the string duplicated from the user space.
--- fs/btrfs/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/ioctl.c +1 -1
@@ -3740,7 +3740,7 @@ static long btrfs_ioctl_qgroup_assign(st prealloc =kzalloc (sizeof (*prealloc),GFP_KERNEL );if (!prealloc) { ret = -ENOMEM ; - goto drop_write; + goto out; } }
Greg Kroah-Hartman
maintainerPATCH 27/159 btrfs: only set the device specific options after devices are opened
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
commit b7fdfd29a136a17c5c8ad9e9bbf89c48919c3d19 upstream.
[BUG]
With v6.17-rc kernels, btrfs will always set 'ssd' mount option even if the block device is not a rotating one:
# cat /sys/block/sdd/queue/rotational 1 # cat /etc/fstab: LABEL=DATA2 /data2 btrfs rw,relatime,space_cache=v2,subvolid=5,subvol=/,nofail,nosuid,nodev 0 0
# mount [...] /dev/sdd on /data2 type btrfs (rw,nosuid,nodev,relatime,ssd,space_cache=v2,subvolid=5,subvol=/)
[CAUSE]
The 'ssd' mount option is set by set_device_specific_options(), and it expects that if there is any rotating device in the btrfs, it will set fs_devices::rotating.
However after commit bddf57a70781 ("btrfs: delay btrfs_open_devices() until super block is created"), the device opening is delayed until the super block is created.
But the timing of set_device_specific_options() is still left as is, this makes the function be called without any device opened.
Since no device is opened, thus fs_devices::rotating will never be set, making btrfs incorrectly set 'ssd' mount option.
[FIX]
Only call set_device_specific_options() after btrfs_open_devices().
Also only call set_device_specific_options() after a new mount, if we're mounting a mounted btrfs, there is no need to set the device specific mount options again.
--- fs/btrfs/super.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/super.c +1 -2
@@ -1902,8 +1902,6 @@ static int btrfs_get_tree_super(struct freturn PTR_ERR (sb); } -set_device_specific_options (fs_info); -if (sb->s_root) {/* * Not the first mount of the fs thus got an existing super block.
@@ -1948,6 +1946,7 @@ static int btrfs_get_tree_super(struct fdeactivate_locked_super (sb);return -EACCES ; } +set_device_specific_options (fs_info); bdev = fs_devices->latest_dev->bdev;snprintf (sb->s_id,sizeof (sb->s_id),"%pg" , bdev);shrinker_debugfs_rename (sb->s_shrink,"sb-btrfs:%s" , sb->s_id);
Greg Kroah-Hartman
maintainerPATCH 28/159 btrfs: fix incorrect readahead expansion length
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
commit 8ab2fa69691b2913a67f3c54fbb991247b3755be upstream.
The intent of btrfs_readahead_expand() was to expand to the length of the current compressed extent being read. However, "ram_bytes" is *not* that, in the case where a single physical compressed extent is used for multiple file extents.
Consider this case with a large compressed extent C and then later two non-compressed extents N1 and N2 written over C, leaving C1 and C2 pointing to offset/len pairs of C:
[ C ]
[ N1 ][ C1 ][ N2 ][ C2 ]
In such a case, ram_bytes for both C1 and C2 is the full uncompressed length of C. So starting readahead in C1 will expand the readahead past the end of C1, past N2, and into C2. This will then expand readahead again, to C2_start + ram_bytes, way past EOF. First of all, this is totally undesirable, we don't want to read the whole file in arbitrary chunks of the large underlying extent if it happens to exist. Secondly, it results in zeroing the range past the end of C2 up to ram_bytes. This is particularly unpleasant with fs-verity as it can zero and set uptodate pages in the verity virtual space past EOF. This incorrect readahead behavior can lead to verity verification errors, if we iterate in a way that happens to do the wrong readahead.
Fix this by using em->len for readahead expansion, not em->ram_bytes, resulting in the expected behavior of stopping readahead at the extent boundary.
--- fs/btrfs/extent_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent_io.c +1 -1
@@ -914,7 +914,7 @@ static void btrfs_readahead_expand(struc {const u64 ra_pos =readahead_pos (ractl);const u64 ra_end = ra_pos +readahead_length (ractl); -const u64 em_end = em->start + em->ram_bytes; +const u64 em_end = em->start + em->len;/* No expansion for holes and inline extents. */ if (em->disk_bytenr >EXTENT_MAP_LAST_BYTE )
Greg Kroah-Hartman
maintainerPATCH 29/159 btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Sabaté Solà <[email protected]>
commit fec9b9d3ced39f16be8d7afdf81f4dd2653da319 upstream.
At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is not a SINGLE one and there is no RAID stripe tree, then we return early with an error.
Doing that, though, prevents the code from running the last calls from this function which are about freeing memory allocated during its run. Hence, in this case, instead of returning early, we set the ret value and fall through the rest of the cleanup code.
--- fs/btrfs/zoned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/zoned.c +1 -1
@@ -1753,7 +1753,7 @@ out: !fs_info->stripe_root) {btrfs_err (fs_info,"zoned: data %s needs raid-stripe-tree" ,btrfs_bg_type_to_raid_name (map->type)); -return -EINVAL ; + ret = -EINVAL ; }if (cache->alloc_offset > cache->zone_capacity) {
Greg Kroah-Hartman
maintainerPATCH 30/159 btrfs: do not assert we found block group item when creating free space tree
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit a5a51bf4e9b7354ce7cd697e610d72c1b33fd949 upstream.
Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree feature, we always expect to find block group items (either extent items or a block group item with key type BTRFS_BLOCK_GROUP_ITEM_KEY) when we search the extent tree with btrfs_search_slot_for_read(), so we assert that we found an item. However this expectation is wrong since we can have a new block group created in the current transaction which is still empty and for which we still have not added the block group's item to the extent tree, in which case we do not have any items in the extent tree associated to the block group.
The insertion of a new block group's block group item in the extent tree happens at btrfs_create_pending_block_groups() when it calls the helper insert_block_group_item(). This typically is done when a transaction handle is released, committed or when running delayed refs (either as part of a transaction commit or when serving tickets for space reservation if we are low on free space).
So remove the assertion at populate_free_space_tree() even when the block group tree feature is not enabled and update the comment to mention this case.
Syzbot reported this with the following stack trace:
BTRFS info (device loop3 state M): rebuilding free space tree assertion failed: ret == 0 :: 0, in fs/btrfs/free-space-tree.c:1115
------------[ cut here ]------------ kernel BUG at fs/btrfs/free-space-tree.c:1115! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6352 Comm: syz.3.25 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:populate_free_space_tree+0x700/0x710 fs/btrfs/free-space-tree.c:1115 Code: ff ff e8 d3 (...) RSP: 0018:ffffc9000430f780 EFLAGS: 00010246 RAX: 0000000000000043 RBX: ffff88805b709630 RCX: fea61d0e2e79d000 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc9000430f8b0 R08: ffffc9000430f4a7 R09: 1ffff92000861e94 R10: dffffc0000000000 R11: fffff52000861e95 R12: 0000000000000001 R13: 1ffff92000861f00 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007f424d9fe6c0(0000) GS:ffff888125afc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd78ad212c0 CR3: 0000000076d68000 CR4: 00000000003526f0 Call Trace: <TASK> btrfs_rebuild_free_space_tree+0x1ba/0x6d0 fs/btrfs/free-space-tree.c:1364 btrfs_start_pre_rw_mount+0x128f/0x1bf0 fs/btrfs/disk-io.c:3062 btrfs_remount_rw fs/btrfs/super.c:1334 [inline] btrfs_reconfigure+0xaed/0x2160 fs/btrfs/super.c:1559 reconfigure_super+0x227/0x890 fs/super.c:1076 do_remount fs/namespace.c:3279 [inline] path_mount+0xd1a/0xfe0 fs/namespace.c:4027 do_mount fs/namespace.c:4048 [inline] __do_sys_mount fs/namespace.c:4236 [inline] __se_sys_mount+0x313/0x410 fs/namespace.c:4213 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f424e39066a Code: d8 64 89 02 (...) RSP: 002b:00007f424d9fde68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f424d9fdef0 RCX: 00007f424e39066a RDX: 0000200000000180 RSI: 0000200000000380 RDI: 0000000000000000 RBP: 0000200000000180 R08: 00007f424d9fdef0 R09: 0000000000000020 R10: 0000000000000020 R11: 0000000000000246 R12: 0000200000000380 R13: 00007f424d9fdeb0 R14: 0000000000000000 R15: 00002000000002c0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---
--- fs/btrfs/free-space-tree.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
fs/btrfs/free-space-tree.c +8 -7
@@ -1106,14 +1106,15 @@ static int populate_free_space_tree(stru* If ret is 1 (no key found), it means this is an empty block group, * without any extents allocated from it and there's no block group * item (key BTRFS_BLOCK_GROUP_ITEM_KEY) located in the extent tree -* because we are using the block group tree feature, so block group -* items are stored in the block group tree. It also means there are no -* extents allocated for block groups with a start offset beyond this -* block group's end offset (this is the last, highest, block group). +* because we are using the block group tree feature (so block group +* items are stored in the block group tree) or this is a new block +* group created in the current transaction and its block group item +* was not yet inserted in the extent tree (that happens in +* btrfs_create_pending_block_groups() -> insert_block_group_item()). +* It also means there are no extents allocated for block groups with a +* start offset beyond this block group's end offset (this is the last, +* highest, block group). */ -if (!btrfs_fs_compat_ro (trans->fs_info,BLOCK_GROUP_TREE )) -ASSERT (ret ==0 ); - start = block_group->start; end = block_group->start + block_group->length;while (ret ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 31/159 can: gs_usb: gs_make_candev(): populate net_device->dev_port
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Celeste Liu <[email protected]>
commit a12f0bc764da3781da2019c60826f47a6d7ed64f upstream.
The gs_usb driver supports USB devices with more than 1 CAN channel. In old kernel before 3.15, it uses net_device->dev_id to distinguish different channel in userspace, which was done in commit acff76fa45b4 ("can: gs_usb: gs_make_candev(): set netdev->dev_id"). But since 3.15, the correct way is populating net_device->dev_port. And according to documentation, if network device support multiple interface, lack of net_device->dev_port SHALL be treated as a bug.
--- drivers/net/can/usb/gs_usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/can/usb/gs_usb.c +1 -0
@@ -1249,6 +1249,7 @@ static struct gs_can *gs_make_candev(uns netdev->flags |=IFF_ECHO ;/* we support full roundtrip echo */ netdev->dev_id = channel; + netdev->dev_port = channel;/* dev setup */ strcpy (dev->bt_const.name,KBUILD_MODNAME );
Greg Kroah-Hartman
maintainerPATCH 32/159 can: gs_usb: increase max interface to U8_MAX
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Celeste Liu <[email protected]>
commit 2a27f6a8fb5722223d526843040f747e9b0e8060 upstream.
This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD converter[1]. The original developers may have only 3 interfaces device to test so they write 3 here and wait for future change.
During the HSCanT development, we actually used 4 interfaces, so the limitation of 3 is not enough now. But just increase one is not future-proofed. Since the channel index type in gs_host_frame is u8, just make canch[] become a flexible array with a u8 index, so it naturally constraint by U8_MAX and avoid statically allocate 256 pointer for every gs_usb device.
[1]: https://github.com/cherry-embedded/HSCanT-hardware
--- drivers/net/can/usb/gs_usb.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
drivers/net/can/usb/gs_usb.c +10 -12
@@ -289,11 +289,6 @@ struct gs_host_frame {#define GS_MAX_RX_URBS 30#define GS_NAPI_WEIGHT 32 -/* Maximum number of interfaces the driver supports per device. -* Current hardware only supports 3 interfaces. The future may vary. -*/ -#define GS_MAX_INTF 3 -struct gs_tx_context {struct gs_can *dev;unsigned int echo_id;
@@ -324,7 +319,6 @@ struct gs_can {/* usb interface struct */ struct gs_usb { -struct gs_can *canch[GS_MAX_INTF ];struct usb_anchor rx_submitted;struct usb_device *udev;
@@ -336,9 +330,11 @@ struct gs_usb {unsigned int hf_size_rx;u8 active_channels; +u8 channel_cnt;unsigned int pipe_in;unsigned int pipe_out; + struct gs_can *canch[] __counted_by(channel_cnt); };/* 'allocate' a tx context.
@@ -599,7 +595,7 @@ static void gs_usb_receive_bulk_callback }/* device reports out of range channel id */ -if (hf->channel >=GS_MAX_INTF ) +if (hf->channel >= parent->channel_cnt) goto device_detach; dev = parent->canch[hf->channel];
@@ -699,7 +695,7 @@ resubmit_urb:/* USB failure take down all interfaces */ if (rc == -ENODEV ) { device_detach: -for (rc =0 ; rc <GS_MAX_INTF ; rc++) { +for (rc =0 ; rc < parent->channel_cnt; rc++) {if (parent->canch[rc])netif_device_detach (parent->canch[rc]->netdev); }
@@ -1461,17 +1457,19 @@ static int gs_usb_probe(struct usb_inter icount = dconf.icount +1 ;dev_info (&intf->dev,"Configuring for %u interfaces\n" , icount); -if (icount >GS_MAX_INTF ) { +if (icount >type_max (parent->channel_cnt)) {dev_err (&intf->dev,"Driver cannot handle more that %u CAN interfaces\n" , -GS_MAX_INTF ); +type_max (parent->channel_cnt));return -EINVAL ; } - parent =kzalloc (sizeof (*parent),GFP_KERNEL ); + parent =kzalloc (struct_size (parent, canch, icount),GFP_KERNEL );if (!parent)return -ENOMEM ; + parent->channel_cnt = icount; +init_usb_anchor (&parent->rx_submitted);usb_set_intfdata (intf, parent);
@@ -1532,7 +1530,7 @@ static void gs_usb_disconnect(struct usbreturn ; } -for (i =0 ; i <GS_MAX_INTF ; i++) +for (i =0 ; i < parent->channel_cnt; i++)if (parent->canch[i])gs_destroy_candev (parent->canch[i]);
Greg Kroah-Hartman
maintainerPATCH 33/159 cifs: parse_dfs_referrals: prevent oob on malformed input
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugene Korenevsky <[email protected]>
commit 6447b0e355562a1ff748c4a2ffb89aae7e84d2c9 upstream.
Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS
- reply smaller than sizeof(struct get_dfs_referral_rsp)
- reply with number of referrals smaller than NumberOfReferrals in the header
Processing of such replies will cause oob.
Return -EINVAL error on such replies to prevent oob-s.
--- fs/smb/client/misc.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
fs/smb/client/misc.c +17 -0
@@ -916,6 +916,14 @@ parse_dfs_referrals(struct get_dfs_referchar *data_end;struct dfs_referral_level_3 *ref; +if (rsp_size <sizeof (*rsp)) { +cifs_dbg (VFS |ONCE , +"%s: header is malformed (size is %u, must be %zu)\n" , + __func__, rsp_size,sizeof (*rsp)); + rc = -EINVAL ; + goto parse_DFS_referrals_exit; + } + *num_of_nodes =le16_to_cpu (rsp->NumberOfReferrals);if (*num_of_nodes <1 ) {
@@ -925,6 +933,15 @@ parse_dfs_referrals(struct get_dfs_refer goto parse_DFS_referrals_exit; } +if (sizeof (*rsp) + *num_of_nodes *sizeof (REFERRAL3 ) > rsp_size) { +cifs_dbg (VFS |ONCE , +"%s: malformed buffer (size is %u, must be at least %zu)\n" , + __func__, rsp_size, +sizeof (*rsp) + *num_of_nodes *sizeof (REFERRAL3 )); + rc = -EINVAL ; + goto parse_DFS_referrals_exit; + } + ref = (struct dfs_referral_level_3 *) &(rsp->referrals);if (ref->VersionNumber !=cpu_to_le16 (3 )) { cifs_dbg(VFS, "Referrals of V%d version are not supported, should be V3\n",
Greg Kroah-Hartman
maintainerPATCH 34/159 cxl/acpi: Fix setup of memory resource in cxl_acpi_set_cache_size()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
commit 2e41e5a91a37202ff6743c3ae5329e106aeb1c6c upstream.
In order to compare the resource against the HMAT memory target, the resource needs to be memory type. Change the DEFINE_RES() macro to DEFINE_RES_MEM() in order to set the correct resource type. hmat_get_extended_linear_cache_size() uses resource_contains() internally. This causes a regression for platforms with the extended linear cache enabled as the comparison always fails and the cache size is not set. User visible impact is that when 'cxl list' is issued, a CXL region with extended linear cache support will only report half the size of the actual size. And this also breaks MCE reporting of the memory region due to incorrect offset calculation for the memory.
[dj: Fixup commit log suggested by djbw]
[dj: Fixup stable address for cc]
--- drivers/cxl/acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cxl/acpi.c +1 -1
@@ -345,7 +345,7 @@ static int cxl_acpi_set_cache_size(strucstruct resource res;int nid, rc; - res =DEFINE_RES (start, size,0 ); + res =DEFINE_RES_MEM (start, size); nid =phys_to_target_node (start); rc =hmat_get_extended_linear_cache_size (&res, nid, &cache_size);
Greg Kroah-Hartman
maintainerPATCH 35/159 ALSA: hda/intel: Add MSI X870E Tomahawk to denylist
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayhurst <[email protected]>
commit 30b3211aa24161856134b2c2ea2ab1c6eb534b36 upstream.
This motherboard uses USB audio instead, causing this driver to complain about "no codecs found!".
Add it to the denylist to silence the warning.
--- sound/hda/controllers/intel.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/controllers/intel.c +1 -0
@@ -2077,6 +2077,7 @@ static const struct pci_device_id driver { PCI_DEVICE_SUB(0x1022, 0x1487, 0x1043, 0x874f) }, /* ASUS ROG Zenith II / Strix */ { PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb59) }, /* MSI TRX40 Creator */ { PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb60) }, /* MSI TRX40 */ + { PCI_DEVICE_SUB(0x1022, 0x15e3, 0x1462, 0xee59) }, /* MSI X870E Tomahawk WiFi */ {} };
Greg Kroah-Hartman
maintainerPATCH 36/159 ALSA: hda/realtek: Add quirk entry for HP ZBook 17 G6
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 5ec6f9434225e18496a393f920b03eb46d67d71d upstream.
HP ZBook 17 G6 with SSID 103c:860c requires a similar workaround as its 15-inch model in order to make the speaker and mute LED working. Add the corresponding quirk entry to address it.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6390,6 +6390,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x103c ,0x854a ,"HP EliteBook 830 G6" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x85c6 ,"HP Pavilion x360 Convertible 14-dy1xxx" ,ALC295_FIXUP_HP_MUTE_LED_COEFBIT11 ),SND_PCI_QUIRK (0x103c ,0x85de ,"HP Envy x360 13-ar0xxx" ,ALC285_FIXUP_HP_ENVY_X360 ), +SND_PCI_QUIRK (0x103c ,0x860c ,"HP ZBook 17 G6" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x860f ,"HP ZBook 15 G6" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x861f ,"HP Elite Dragonfly G1" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
Greg Kroah-Hartman
maintainerPATCH 37/159 ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <[email protected]>
commit 8527bbb33936340525a3504a00932b2f8fd75754 upstream.
Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function.
acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/codecs/side-codecs/cs35l41_hda.c +2 -0
@@ -1426,6 +1426,8 @@ static int cs35l41_get_acpi_mute_state(sif (cs35l41_dsm_supported (handle,CS35L41_DSM_GET_MUTE )) { ret =acpi_evaluate_dsm (handle, &guid,0 ,CS35L41_DSM_GET_MUTE ,NULL ); +if (!ret) +return -EINVAL ; mute = *ret->buffer.pointer;dev_dbg (cs35l41->dev,"CS35L41_DSM_GET_MUTE: %d\n" , mute); }
Greg Kroah-Hartman
maintainerPATCH 38/159 ALSA: hda: Fix missing pointer check in hda_component_manager_init function
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <[email protected]>
commit 1cf11d80db5df805b538c942269e05a65bcaf5bc upstream.
The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.
The call stack leading to the error looks like this:
hda_component_manager_init
|-> component_match_add
|-> component_match_add_release
|-> __component_match_add ( ... ,**matchptr, ... )
|-> *matchptr = ERR_PTR(-ENOMEM); // assign
|-> component_master_add_with_match( ... match)
|-> component_match_realloc(match, match->num); // dereferenceAdd IS_ERR() check to prevent the crash.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/hda/codecs/side-codecs/hda_component.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/hda/codecs/side-codecs/hda_component.c +4 -0
@@ -181,6 +181,10 @@ int hda_component_manager_init(struct hd sm->match_str = match_str; sm->index = i;component_match_add (dev, &match, hda_comp_match_dev_name, sm); +if (IS_ERR (match)) { +codec_err (cdc,"Fail to add component %ld\n" ,PTR_ERR (match)); +return PTR_ERR (match); + } } ret =component_master_add_with_match (dev, ops, match);
Greg Kroah-Hartman
maintainerPATCH 39/159 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
commit 5801e65206b065b0b2af032f7f1eef222aa2fd83 upstream.
When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free.
Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this:
drm_sched_job_add_implicit_dependencies():
...
for (i = 0; i < fence_count; i++) {
ret = drm_sched_job_add_dependency(job, fences[i]);
if (ret)
break;
}
for (; i < fence_count; i++)
dma_fence_put(fences[i]);Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it.
The bug was then only noticed and fixed after
commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of
commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").
At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix.
But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case.
As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain.
While fixing we also improve the comment and explain the reason for taking the reference and not dropping it.
--- drivers/gpu/drm/scheduler/sched_main.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/scheduler/sched_main.c +7 -6
@@ -986,13 +986,14 @@ int drm_sched_job_add_resv_dependencies(dma_resv_assert_held (resv);dma_resv_for_each_fence (&cursor, resv, usage, fence) { -/* Make sure to grab an additional ref on the added fence */ -dma_fence_get (fence); - ret =drm_sched_job_add_dependency (job, fence); -if (ret) { -dma_fence_put (fence); +/* +* As drm_sched_job_add_dependency always consumes the fence +* reference (even when it fails), and dma_resv_for_each_fence +* is not obtaining one, we need to grab one before calling. +*/ + ret =drm_sched_job_add_dependency (job,dma_fence_get (fence)); +if (ret)return ret; - } }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 40/159 drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 6f719373b943a955fee6fc2012aed207b65e2854 upstream.
Blank the display by disabling sync pulses with VGACR17<7>. Unblank by reenabling them. This VGA setting should be supported by all Aspeed hardware.
Ast currently blanks via sync-off bits in VGACRB6. Not all BMCs handle VGACRB6 correctly. After disabling sync during a reboot, some BMCs do not reenable it after the soft reset. The display output remains dark. When the display is off during boot, some BMCs set the sync-off bits in VGACRB6, so the display remains dark. Observed with Blackbird AST2500 BMCs. Clearing the sync-off bits unconditionally fixes these issues.
Also do not modify VGASR1's SD bit for blanking, as it only disables GPU access to video memory.
v2:
- init vgacrb6 correctly (Jocelyn)
--- drivers/gpu/drm/ast/ast_mode.c | 18 ++++++++++-------- drivers/gpu/drm/ast/ast_reg.h | 1 + 2 files changed, 11 insertions(+), 8 deletions(-)
drivers/gpu/drm/ast/ast_mode.c +10 -8
@@ -836,22 +836,24 @@ ast_crtc_helper_atomic_flush(struct drm_static void ast_crtc_helper_atomic_enable (struct drm_crtc *crtc,struct drm_atomic_state *state) {struct ast_device *ast =to_ast_device (crtc->dev); +u8 vgacr17 =0x00 ; +u8 vgacrb6 =0xff ; -ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0xb6 ,0xfc ,0x00 ); -ast_set_index_reg_mask (ast,AST_IO_VGASRI ,0x01 ,0xdf ,0x00 ); + vgacr17 |=AST_IO_VGACR17_SYNC_ENABLE ; + vgacrb6 &= ~(AST_IO_VGACRB6_VSYNC_OFF |AST_IO_VGACRB6_HSYNC_OFF ); + +ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0x17 ,0x7f , vgacr17); +ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0xb6 ,0xfc , vgacrb6); }static void ast_crtc_helper_atomic_disable (struct drm_crtc *crtc,struct drm_atomic_state *state) {struct drm_crtc_state *old_crtc_state =drm_atomic_get_old_crtc_state (state, crtc);struct ast_device *ast =to_ast_device (crtc->dev); -u8 vgacrb6; +u8 vgacr17 =0xff ; -ast_set_index_reg_mask (ast,AST_IO_VGASRI ,0x01 ,0xdf ,AST_IO_VGASR1_SD ); - - vgacrb6 =AST_IO_VGACRB6_VSYNC_OFF | -AST_IO_VGACRB6_HSYNC_OFF ; -ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0xb6 ,0xfc , vgacrb6); + vgacr17 &= ~AST_IO_VGACR17_SYNC_ENABLE ; +ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0x17 ,0x7f , vgacr17);/* * HW cursors require the underlying primary plane and CRTC to
drivers/gpu/drm/ast/ast_reg.h +1 -0
@@ -29,6 +29,7 @@#define AST_IO_VGAGRI (0x4E)#define AST_IO_VGACRI (0x54) +#define AST_IO_VGACR17_SYNC_ENABLE BIT(7)/* called "Hardware reset" in docs */ #define AST_IO_VGACR80_PASSWORD (0xa8)#define AST_IO_VGACR99_VGAMEM_RSRV_MASK GENMASK(1, 0)#define AST_IO_VGACRA1_VGAIO_DISABLED BIT(1)
Re: [PATCH 6.17 040/159] drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off
Quoted 11 lines · Greg Kroah-Hartman
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit
6f719373b943a955fee6fc2012aed207b65e2854upstream.Blank the display by disabling sync pulses with VGACR17<7>. Unblank by reenabling them. This VGA setting should be supported by all Aspeed hardware.
TWIMC, a regression report about 6.18-rc2 that was bisected to this commit just came in:
https://lore.kernel.org/all/[email protected]/
To quote:
"""
I have encountered a serious (for me) regression with 6.18-rc2 on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. After booting, my console screen goes blank and stays blank. 6.18-rc1 was still fine.
[...]
When I revert this from 6.18-rc2, the issue goes away and my console screen works again.
"""
Ciao, Thorsten
Quoted 80 lines
Ast currently blanks via sync-off bits in VGACRB6. Not all BMCs handle VGACRB6 correctly. After disabling sync during a reboot, some BMCs do not reenable it after the soft reset. The display output remains dark. When the display is off during boot, some BMCs set the sync-off bits in VGACRB6, so the display remains dark. Observed with Blackbird AST2500 BMCs. Clearing the sync-off bits unconditionally fixes these issues.
Also do not modify VGASR1's SD bit for blanking, as it only disables GPU access to video memory.
v2:
- init vgacrb6 correctly (Jocelyn)Signed-off-by Thomas Zimmermann <[email protected]>Fixes ce3d99c83495 ("drm: Call drm_atomic_helper_shutdown() at shutdown time for misc drivers")Tested-by Nick Bowler <[email protected]>Reported-by Nick Bowler <[email protected]>Closes https://lore.kernel.org/dri-devel/wpwd7rit6t4mnu6kdqbtsnk5bhftgslio6e2jgkz6kgw6cuvvr@xbfswsczfqsi/ open hereCc Douglas Anderson <[email protected]>Cc Dave Airlie <[email protected]>Cc Thomas Zimmermann <[email protected]>Cc Jocelyn Falempe <[email protected]>Cc <[email protected]> # v6.7+Reviewed-by Jocelyn Falempe <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/gpu/drm/ast/ast_mode.c | 18 ++++++++++-------- drivers/gpu/drm/ast/ast_reg.h | 1 + 2 files changed, 11 insertions(+), 8 deletions(-)drivers/gpu/drm/ast/ast_mode.c +10
-8@@ -836,22 +836,24 @@ ast_crtc_helper_atomic_flush(struct drm_static void ast_crtc_helper_atomic_enable (struct drm_crtc *crtc,struct drm_atomic_state *state) {struct ast_device *ast =to_ast_device (crtc->dev); +u8 vgacr17 =0x00 ; +u8 vgacrb6 =0xff ; -ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0xb6 ,0xfc ,0x00 ); -ast_set_index_reg_mask (ast,AST_IO_VGASRI ,0x01 ,0xdf ,0x00 ); + vgacr17 |=AST_IO_VGACR17_SYNC_ENABLE ; + vgacrb6 &= ~(AST_IO_VGACRB6_VSYNC_OFF |AST_IO_VGACRB6_HSYNC_OFF ); + +ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0x17 ,0x7f , vgacr17); +ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0xb6 ,0xfc , vgacrb6); }static void ast_crtc_helper_atomic_disable (struct drm_crtc *crtc,struct drm_atomic_state *state) {struct drm_crtc_state *old_crtc_state =drm_atomic_get_old_crtc_state (state, crtc);struct ast_device *ast =to_ast_device (crtc->dev); -u8 vgacrb6; +u8 vgacr17 =0xff ; -ast_set_index_reg_mask (ast,AST_IO_VGASRI ,0x01 ,0xdf ,AST_IO_VGASR1_SD ); - - vgacrb6 =AST_IO_VGACRB6_VSYNC_OFF | -AST_IO_VGACRB6_HSYNC_OFF ; -ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0xb6 ,0xfc , vgacrb6); + vgacr17 &= ~AST_IO_VGACR17_SYNC_ENABLE ; +ast_set_index_reg_mask (ast,AST_IO_VGACRI ,0x17 ,0x7f , vgacr17);/* * HW cursors require the underlying primary plane and CRTC to drivers/gpu/drm/ast/ast_reg.h +1
-0@@ -29,6 +29,7 @@#define AST_IO_VGAGRI (0x4E)#define AST_IO_VGACRI (0x54) +#define AST_IO_VGACR17_SYNC_ENABLE BIT(7)/* called "Hardware reset" in docs */ #define AST_IO_VGACR80_PASSWORD (0xa8)#define AST_IO_VGACR99_VGAMEM_RSRV_MASK GENMASK(1, 0)#define AST_IO_VGACRA1_VGAIO_DISABLED BIT(1)
Greg Kroah-Hartman
maintainerRe: [PATCH 6.17 040/159] drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off
Quoted 26 lines · Thorsten Leemhuis
Quoted 11 lines · Greg Kroah-Hartman
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit
6f719373b943a955fee6fc2012aed207b65e2854upstream.Blank the display by disabling sync pulses with VGACR17<7>. Unblank by reenabling them. This VGA setting should be supported by all Aspeed hardware.
TWIMC, a regression report about 6.18-rc2 that was bisected to this commit just came in:
https://lore.kernel.org/all/[email protected]/
To quote:
"""
I have encountered a serious (for me) regression with 6.18-rc2 on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. After booting, my console screen goes blank and stays blank. 6.18-rc1 was still fine.
Quoted 5 lines
[...]
When I revert this from 6.18-rc2, the issue goes away and my console screen works again.
"""
Thanks, I'll go drop this patch from the stable queues for now.
greg k-h
Re: [PATCH 6.17 040/159] drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off
Hi Greg,
Am 22.10.2025 um 07:28 schrieb Greg Kroah-Hartman:
Quoted 29 lines · Thorsten Leemhuis
Quoted 28 lines · Greg Kroah-Hartman
Quoted 11 lines
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit
6f719373b943a955fee6fc2012aed207b65e2854upstream.Blank the display by disabling sync pulses with VGACR17<7>. Unblank by reenabling them. This VGA setting should be supported by all Aspeed hardware.
TWIMC, a regression report about 6.18-rc2 that was bisected to this commit just came in:
https://lore.kernel.org/all/[email protected]/
To quote:
"""
I have encountered a serious (for me) regression with 6.18-rc2 on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. After booting, my console screen goes blank and stays blank. 6.18-rc1 was still fine.[...]
Quoted 7 lines
Quoted 3 lines
When I revert this from 6.18-rc2, the issue goes away and my console screen works again.
"""Thanks, I'll go drop this patch from the stable queues for now.
greg k-h
So Thorsten (thanks!) was 20 minutes quicker ;-) But I just tested this with 6.12.55-rc1 and 6.17.5-rc1, too, and can confirm that this offending patch breaks VGA on my machine, and that reverting just this patch against either RC makes the issue go away.
I'll retest -rc2 too when it's out.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Greg Kroah-Hartman
maintainerRe: [PATCH 6.17 040/159] drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off
Quoted 42 lines · Peter Schneider
Hi Greg,
Am 22.10.2025 um 07:28 schrieb Greg Kroah-Hartman:
Quoted 29 lines · Thorsten Leemhuis
Quoted 28 lines · Greg Kroah-Hartman
Quoted 11 lines
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit
6f719373b943a955fee6fc2012aed207b65e2854upstream.Blank the display by disabling sync pulses with VGACR17<7>. Unblank by reenabling them. This VGA setting should be supported by all Aspeed hardware.
TWIMC, a regression report about 6.18-rc2 that was bisected to this commit just came in:
https://lore.kernel.org/all/[email protected]/
To quote:
"""
I have encountered a serious (for me) regression with 6.18-rc2 on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. After booting, my console screen goes blank and stays blank. 6.18-rc1 was still fine.[...]
Quoted 7 lines
Quoted 3 lines
When I revert this from 6.18-rc2, the issue goes away and my console screen works again.
"""Thanks, I'll go drop this patch from the stable queues for now.
greg k-h
Quoted 6 lines
So Thorsten (thanks!) was 20 minutes quicker ;-) But I just tested this with 6.12.55-rc1 and 6.17.5-rc1, too, and can confirm that this offending patch breaks VGA on my machine, and that reverting just this patch against either RC makes the issue go away.
I'll retest -rc2 too when it's out.
Should be out now, thanks!
Greg Kroah-Hartman
maintainerPATCH 41/159 drm/amdgpu: use atomic functions with memory barriers for vm fault info
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
commit 6df8e84aa6b5b1812cc2cacd6b3f5ccbb18cda2b upstream.
The atomic variable vm_fault_info_updated is used to synchronize access to adev->gmc.vm_fault_info between the interrupt handler and get_vm_fault_info().
The default atomic functions like atomic_set() and atomic_read() do not provide memory barriers. This allows for CPU instruction reordering, meaning the memory accesses to vm_fault_info and the vm_fault_info_updated flag are not guaranteed to occur in the intended order. This creates a race condition that can lead to inconsistent or stale data being used.
The previous implementation, which used an explicit mb(), was incomplete and inefficient. It failed to account for all potential CPU reorderings, such as the access of vm_fault_info being reordered before the atomic_read of the flag. This approach is also more verbose and less performant than using the proper atomic functions with acquire/release semantics.
Fix this by switching to atomic_set_release() and atomic_read_acquire(). These functions provide the necessary acquire and release semantics, which act as memory barriers to ensure the correct order of operations. It is also more efficient and idiomatic than using explicit full memory barriers.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 ++--- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 7 +++---- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 7 +++---- 3 files changed, 8 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +2 -3
@@ -2325,10 +2325,9 @@ void amdgpu_amdkfd_gpuvm_unmap_gtt_bo_frint amdgpu_amdkfd_gpuvm_get_vm_fault_info (struct amdgpu_device *adev,struct kfd_vm_fault_info *mem) { -if (atomic_read (&adev->gmc.vm_fault_info_updated) ==1 ) { +if (atomic_read_acquire (&adev->gmc.vm_fault_info_updated) ==1 ) { *mem = *adev->gmc.vm_fault_info; -mb ();/* make sure read happened */ -atomic_set (&adev->gmc.vm_fault_info_updated,0 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,0 ); }return 0 ; }
drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c +3 -4
@@ -1066,7 +1066,7 @@ static int gmc_v7_0_sw_init(struct amdgp GFP_KERNEL);if (!adev->gmc.vm_fault_info)return -ENOMEM ; -atomic_set (&adev->gmc.vm_fault_info_updated,0 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,0 );return 0 ; }
@@ -1288,7 +1288,7 @@ static int gmc_v7_0_process_interrupt(st vmid =REG_GET_FIELD (status,VM_CONTEXT1_PROTECTION_FAULT_STATUS ,VMID );if (amdgpu_amdkfd_is_kfd_vmid (adev, vmid) - && !atomic_read (&adev->gmc.vm_fault_info_updated)) { + && !atomic_read_acquire (&adev->gmc.vm_fault_info_updated)) {struct kfd_vm_fault_info *info = adev->gmc.vm_fault_info; u32 protections = REG_GET_FIELD(status, VM_CONTEXT1_PROTECTION_FAULT_STATUS,
@@ -1304,8 +1304,7 @@ static int gmc_v7_0_process_interrupt(st info->prot_read = protections &0x8 ? true : false; info->prot_write = protections &0x10 ? true : false; info->prot_exec = protections &0x20 ? true : false; -mb (); -atomic_set (&adev->gmc.vm_fault_info_updated,1 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,1 ); }return 0 ;
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +3 -4
@@ -1179,7 +1179,7 @@ static int gmc_v8_0_sw_init(struct amdgp GFP_KERNEL);if (!adev->gmc.vm_fault_info)return -ENOMEM ; -atomic_set (&adev->gmc.vm_fault_info_updated,0 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,0 );return 0 ; }
@@ -1474,7 +1474,7 @@ static int gmc_v8_0_process_interrupt(st vmid =REG_GET_FIELD (status,VM_CONTEXT1_PROTECTION_FAULT_STATUS ,VMID );if (amdgpu_amdkfd_is_kfd_vmid (adev, vmid) - && !atomic_read (&adev->gmc.vm_fault_info_updated)) { + && !atomic_read_acquire (&adev->gmc.vm_fault_info_updated)) {struct kfd_vm_fault_info *info = adev->gmc.vm_fault_info; u32 protections = REG_GET_FIELD(status, VM_CONTEXT1_PROTECTION_FAULT_STATUS,
@@ -1490,8 +1490,7 @@ static int gmc_v8_0_process_interrupt(st info->prot_read = protections &0x8 ? true : false; info->prot_write = protections &0x10 ? true : false; info->prot_exec = protections &0x20 ? true : false; -mb (); -atomic_set (&adev->gmc.vm_fault_info_updated,1 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,1 ); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 42/159 drm/amdgpu: fix gfx12 mes packet status return check
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Kim <[email protected]>
commit d0de79f66a80eeb849033fae34bd07a69ce72235 upstream.
GFX12 MES uses low 32 bits of status return for success (1 or 0) and high bits for debug information if low bits are 0.
GFX11 MES doesn't do this so checking full 64-bit status return for 1 or 0 is still valid.
--- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +6 -1
@@ -225,7 +225,12 @@ static int mes_v12_0_submit_pkt_and_poll pipe, x_pkt->header.opcode); r =amdgpu_fence_wait_polling (ring, seq, timeout); -if (r <1 || !*status_ptr) { + +/* +* status_ptr[31:0] == 0 (fail) or status_ptr[63:0] == 1 (success). +* If status_ptr[31:0] == 0 then status_ptr[63:32] will have debug error information. +*/ +if (r <1 || !(lower_32_bits (*status_ptr))) {if (misc_op_str) dev_err(adev->dev, "MES(%d) failed to respond to msg=%s (%s)\n",
Greg Kroah-Hartman
maintainerPATCH 43/159 drm/xe: Increase global invalidation timeout to 1000us
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Graunke <[email protected]>
commit e5ae8d1eb08a3e27fff4ae264af4c8056d908639 upstream.
The previous timeout of 500us seems to be too small; panning the map in the Roll20 VTT in Firefox on a KDE/Wayland desktop reliably triggered timeouts within a few seconds of usage, causing the monitor to freeze and the following to be printed to dmesg:
[Jul30 13:44] xe 0000:03:00.0: [drm] *ERROR* GT0: Global invalidation timeout [Jul30 13:48] xe 0000:03:00.0: [drm] *ERROR* [CRTC:82:pipe A] flip_done timed out
I haven't hit a single timeout since increasing it to 1000us even after several multi-hour testing sessions.
--- drivers/gpu/drm/xe/xe_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_device.c +1 -1
@@ -1029,7 +1029,7 @@ void xe_device_l2_flush(struct xe_devicespin_lock (>->global_invl_lock);xe_mmio_write32 (>->mmio,XE2_GLOBAL_INVAL ,0x1 ); -if (xe_mmio_wait32 (>->mmio,XE2_GLOBAL_INVAL ,0x1 ,0x0 ,500 ,NULL , true)) +if (xe_mmio_wait32 (>->mmio,XE2_GLOBAL_INVAL ,0x1 ,0x0 ,1000 ,NULL , true))xe_gt_err_once (gt,"Global invalidation timeout\n" );spin_unlock (>->global_invl_lock);
Greg Kroah-Hartman
maintainerPATCH 44/159 perf/core: Fix address filter match with backing files
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit ebfc8542ad62d066771e46c8aa30f5624b89cad8 upstream.
It was reported that Intel PT address filters do not work in Docker containers. That relates to the use of overlayfs.
overlayfs records the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped. In order for an address filter to match, it must compare to the user file inode. There is an existing helper file_user_inode() for that situation.
Use file_user_inode() instead of file_inode() to get the inode for address filter matching.
Example:
Setup:
# cd /root
# mkdir test ; cd test ; mkdir lower upper work merged
# cp `which cat` lower
# mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged
# perf record --buildid-mmap -e intel_pt//u --filter 'filter * @ /root/test/merged/cat' -- /root/test/merged/cat /proc/self/maps
...
55d61d246000-55d61d2e1000 r-xp 00018000 00:1a 3418 /root/test/merged/cat
...
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.015 MB perf.data ]
# perf buildid-cache --add /root/test/merged/catBefore:
Address filter does not match so there are no control flow packets
# perf script --itrace=e
# perf script --itrace=b | wc -l
0
# perf script -D | grep 'TIP.PGE' | wc -l
0
#After:
Address filter does match so there are control flow packets
# perf script --itrace=e
# perf script --itrace=b | wc -l
235
# perf script -D | grep 'TIP.PGE' | wc -l
57
#With respect to stable kernels, overlayfs mmap function ovl_mmap() was added in v4.19 but file_user_inode() was not added until v6.8 and never back-ported to stable kernels. FMODE_BACKING that it depends on was added in v6.5. This issue has gone largely unnoticed, so back-porting before v6.8 is probably not worth it, so put 6.8 as the stable kernel prerequisite version, although in practice the next long term kernel is 6.12.
--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -9479,7 +9479,7 @@ static bool perf_addr_filter_match(strucif (!filter->path.dentry)return false; -if (d_inode (filter->path.dentry) !=file_inode (file)) +if (d_inode (filter->path.dentry) !=file_user_inode (file))return false;if (filter->offset > offset + size)
Greg Kroah-Hartman
maintainerPATCH 45/159 perf/core: Fix MMAP event path names with backing files
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 8818f507a9391019a3ec7c57b1a32e4b386e48a5 upstream.
Some file systems like FUSE-based ones or overlayfs may record the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped.
Since commit def3ae83da02f ("fs: store real path instead of fake path in backing file f_path"), file_path() no longer returns the user file path when applied to a backing file. There is an existing helper file_user_path() for that situation.
Use file_user_path() instead of file_path() to get the path for MMAP and MMAP2 events.
Example:
Setup:
# cd /root
# mkdir test ; cd test ; mkdir lower upper work merged
# cp `which cat` lower
# mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged
# perf record -e intel_pt//u -- /root/test/merged/cat /proc/self/maps
...
55b0ba399000-55b0ba434000 r-xp 00018000 00:1a 3419 /root/test/merged/cat
...
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.060 MB perf.data ]
#Before:
File name is wrong (/cat), so decoding fails:
# perf script --no-itrace --show-mmap-events
cat 367 [016] 100.491492: PERF_RECORD_MMAP2 367/367: [0x55b0ba399000(0x9b000) @ 0x18000 00:02 3419 489959280]: r-xp /cat
...
# perf script --itrace=e | wc -l
Warning:
19 instruction trace errors
19
#After:
File name is correct (/root/test/merged/cat), so decoding is ok:
# perf script --no-itrace --show-mmap-events
cat 364 [016] 72.153006: PERF_RECORD_MMAP2 364/364: [0x55ce4003d000(0x9b000) @ 0x18000 00:02 3419 3132534314]: r-xp /root/test/merged/cat
# perf script --itrace=e
# perf script --itrace=e | wc -l
0
#--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -9403,7 +9403,7 @@ static void perf_event_mmap_event(struct* need to add enough zero bytes after the string to handle * the 64bit alignment we do later. */ - name =file_path (file, buf,PATH_MAX -sizeof (u64)); + name =d_path (file_user_path (file), buf,PATH_MAX -sizeof (u64));if (IS_ERR (name)) { name ="//toolong" ; goto cpy_name;
Greg Kroah-Hartman
maintainerPATCH 46/159 perf/core: Fix MMAP2 event device with backing files
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit fa4f4bae893fbce8a3edfff1ab7ece0c01dc1328 upstream.
Some file systems like FUSE-based ones or overlayfs may record the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped.
That causes perf to misreport the device major/minor numbers of the file system of the file, and the generation of the file, and potentially other inode details. There is an existing helper file_user_inode() for that situation.
Use file_user_inode() instead of file_inode() to get the inode for MMAP2 events.
Example:
Setup:
# cd /root
# mkdir test ; cd test ; mkdir lower upper work merged
# cp `which cat` lower
# mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged
# perf record -e cycles:u -- /root/test/merged/cat /proc/self/maps
...
55b2c91d0000-55b2c926b000 r-xp 00018000 00:1a 3419 /root/test/merged/cat
...
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.004 MB perf.data (5 samples) ]
#
# stat /root/test/merged/cat
File: /root/test/merged/cat
Size: 1127792 Blocks: 2208 IO Block: 4096 regular file
Device: 0,26 Inode: 3419 Links: 1
Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2025-09-08 12:23:59.453309624 +0000
Modify: 2025-09-08 12:23:59.454309624 +0000
Change: 2025-09-08 12:23:59.454309624 +0000
Birth: 2025-09-08 12:23:59.453309624 +0000Before:
Device reported 00:02 differs from stat output and /proc/self/maps
# perf script --show-mmap-events | grep /root/test/merged/cat
cat 377 [-01] 243.078558: PERF_RECORD_MMAP2 377/377: [0x55b2c91d0000(0x9b000) @ 0x18000 00:02 3419 2068525940]: r-xp /root/test/merged/catAfter:
Device reported 00:1a is the same as stat output and /proc/self/maps
# perf script --show-mmap-events | grep /root/test/merged/cat
cat 362 [-01] 127.755167: PERF_RECORD_MMAP2 362/362: [0x55ba6e781000(0x9b000) @ 0x18000 00:1a 3419 0]: r-xp /root/test/merged/catWith respect to stable kernels, overlayfs mmap function ovl_mmap() was added in v4.19 but file_user_inode() was not added until v6.8 and never back-ported to stable kernels. FMODE_BACKING that it depends on was added in v6.5. This issue has gone largely unnoticed, so back-porting before v6.8 is probably not worth it, so put 6.8 as the stable kernel prerequisite version, although in practice the next long term kernel is 6.12.
--- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/events/core.c +2 -2
@@ -9390,7 +9390,7 @@ static void perf_event_mmap_event(struct flags |=MAP_HUGETLB ;if (file) { -struct inode *inode; +const struct inode *inode;dev_t dev; buf =kmalloc (PATH_MAX ,GFP_KERNEL );
@@ -9408,7 +9408,7 @@ static void perf_event_mmap_event(struct name ="//toolong" ; goto cpy_name; } - inode =file_inode (vma->vm_file); + inode =file_user_inode (vma->vm_file); dev = inode->i_sb->s_dev; ino = inode->i_ino; gen = inode->i_generation;
Greg Kroah-Hartman
maintainerPATCH 47/159 drm/amd: Check whether secure display TA loaded successfully
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit c760bcda83571e07b72c10d9da175db5051ed971 upstream.
[Why]
Not all renoir hardware supports secure display. If the TA is present but the feature isn't supported it will fail to load or send commands. This shows ERR messages to the user that make it seems like there is a problem.
[How]
Check the resp_status of the context to see if there was an error before trying to send any secure display commands.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +1 -1
@@ -2350,7 +2350,7 @@ static int psp_securedisplay_initialize( } ret =psp_ta_load (psp, &psp->securedisplay_context.context); -if (!ret) { +if (!ret && !psp->securedisplay_context.context.resp_status) { psp->securedisplay_context.context.initialized = true;mutex_init (&psp->securedisplay_context.mutex); }else
Greg Kroah-Hartman
maintainerPATCH 48/159 PM: hibernate: Add pm_hibernation_mode_is_suspend()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Mario Limonciello (AMD)" <[email protected]>
[ Upstream commit 495c8d35035edb66e3284113bef01f3b1b843832 ]
Some drivers have different flows for hibernation and suspend. If the driver opportunistically will skip thaw() then it needs a hint to know what is happening after the hibernate.
Introduce a new symbol pm_hibernation_mode_is_suspend() that drivers can call to determine if suspending the system for this purpose.
Stable-dep-of: 0a6e9e098fcc ("drm/amd: Fix hybrid sleep")
--- include/linux/suspend.h | 2 ++ kernel/power/hibernate.c | 11 +++++++++++ 2 files changed, 13 insertions(+)
include/linux/suspend.h +2 -0
@@ -276,6 +276,7 @@ extern void arch_suspend_enable_irqs(voiextern int pm_suspend (suspend_state_t state);extern bool sync_on_suspend_enabled; +bool pm_hibernation_mode_is_suspend (void );#else /* !CONFIG_SUSPEND */ #define suspend_valid_only_mem NULL
@@ -288,6 +289,7 @@ static inline bool pm_suspend_via_firmwastatic inline bool pm_resume_via_firmware (void ) {return false; }static inline bool pm_suspend_no_platform (void ) {return false; }static inline bool pm_suspend_default_s2idle (void ) {return false; } +static inline bool pm_hibernation_mode_is_suspend (void ) {return false; }static inline void suspend_set_ops (const struct platform_suspend_ops *ops) {}static inline int pm_suspend (suspend_state_t state) {return -ENOSYS ; }
kernel/power/hibernate.c +11 -0
@@ -80,6 +80,17 @@ static const struct platform_hibernationstatic atomic_t hibernate_atomic =ATOMIC_INIT (1 ); +#ifdef CONFIG_SUSPEND +/** +* pm_hibernation_mode_is_suspend - Check if hibernation has been set to suspend +*/ +bool pm_hibernation_mode_is_suspend (void ) +{ +return hibernation_mode ==HIBERNATION_SUSPEND ; +} +EXPORT_SYMBOL_GPL (pm_hibernation_mode_is_suspend); +#endif +bool hibernate_acquire (void ) {return atomic_add_unless (&hibernate_atomic,-1 ,0 );
Greg Kroah-Hartman
maintainerPATCH 49/159 drm/amd: Fix hybrid sleep
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Mario Limonciello (AMD)" <[email protected]>
[ Upstream commit 0a6e9e098fcc318fec0f45a05a5c4743a81a60d9 ]
[Why]
commit 530694f54dd5e ("drm/amdgpu: do not resume device in thaw for normal hibernation") optimized the flow for systems that are going into S4 where the power would be turned off. Basically the thaw() callback wouldn't resume the device if the hibernation image was successfully created since the system would be powered off.
This however isn't the correct flow for a system entering into s0i3 after the hibernation image is created. Some of the amdgpu callbacks have different behavior depending upon the intended state of the suspend.
[How]
Use pm_hibernation_mode_is_suspend() as an input to decide whether to run resume during thaw() callback.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +1 -1
@@ -2665,7 +2665,7 @@ static int amdgpu_pmops_thaw(struct devistruct drm_device *drm_dev =dev_get_drvdata (dev);/* do not resume device if it's normal hibernation */ -if (!pm_hibernate_is_recovering ()) +if (!pm_hibernate_is_recovering () && !pm_hibernation_mode_is_suspend ())return 0 ;return amdgpu_device_resume (drm_dev, true);
Greg Kroah-Hartman
maintainerPATCH 50/159 media: nxp: imx8-isi: m2m: Fix streaming cleanup on release
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu Zhou <[email protected]>
[ Upstream commit 178aa3360220231dd91e7dbc2eb984525886c9c1 ]
If streamon/streamoff calls are imbalanced, such as when exiting an application with Ctrl+C when streaming, the m2m usage_count will never reach zero and the ISI channel won't be freed. Besides from that, if the input line width is more than 2K, it will trigger a WARN_ON():
[ 59.222120] ------------[ cut here ]------------ [ 59.226758] WARNING: drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c:631 at mxc_isi_channel_chain+0xa4/0x120, CPU#4: v4l2-ctl/654 [ 59.238569] Modules linked in: ap1302 [ 59.242231] CPU: 4 UID: 0 PID: 654 Comm: v4l2-ctl Not tainted 6.16.0-rc4-next-20250704-06511-gff0e002d480a-dirty #258 PREEMPT [ 59.253597] Hardware name: NXP i.MX95 15X15 board (DT) [ 59.258720] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 59.265669] pc : mxc_isi_channel_chain+0xa4/0x120 [ 59.270358] lr : mxc_isi_channel_chain+0x44/0x120 [ 59.275047] sp : ffff8000848c3b40 [ 59.278348] x29: ffff8000848c3b40 x28: ffff0000859b4c98 x27: ffff800081939f00 [ 59.285472] x26: 000000000000000a x25: ffff0000859b4cb8 x24: 0000000000000001 [ 59.292597] x23: ffff0000816f4760 x22: ffff0000816f4258 x21: ffff000084ceb780 [ 59.299720] x20: ffff000084342ff8 x19: ffff000084340000 x18: 0000000000000000 [ 59.306845] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffdb369e1c [ 59.313969] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 59.321093] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 59.328217] x8 : ffff8000848c3d48 x7 : ffff800081930b30 x6 : ffff800081930b30 [ 59.335340] x5 : ffff0000859b6000 x4 : ffff80008193ae80 x3 : ffff800081022420 [ 59.342464] x2 : ffff0000852f6900 x1 : 0000000000000001 x0 : ffff000084341000 [ 59.349590] Call trace: [ 59.352025] mxc_isi_channel_chain+0xa4/0x120 (P) [ 59.356722] mxc_isi_m2m_streamon+0x160/0x20c [ 59.361072] v4l_streamon+0x24/0x30 [ 59.364556] __video_do_ioctl+0x40c/0x4a0 [ 59.368560] video_usercopy+0x2bc/0x690 [ 59.372382] video_ioctl2+0x18/0x24 [ 59.375857] v4l2_ioctl+0x40/0x60 [ 59.379168] __arm64_sys_ioctl+0xac/0x104 [ 59.383172] invoke_syscall+0x48/0x104 [ 59.386916] el0_svc_common.constprop.0+0xc0/0xe0 [ 59.391613] do_el0_svc+0x1c/0x28 [ 59.394915] el0_svc+0x34/0xf4 [ 59.397966] el0t_64_sync_handler+0xa0/0xe4 [ 59.402143] el0t_64_sync+0x198/0x19c [ 59.405801] ---[ end trace 0000000000000000 ]---
Address this issue by moving the streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() operations. This also simplifies the driver by allowing direct usage of the v4l2_m2m_ioctl_streamon() and v4l2_m2m_ioctl_streamoff() helpers.
--- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 226 ++++++++------------- 1 file changed, 93 insertions(+), 133 deletions(-)
drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c +93 -133
@@ -43,7 +43,6 @@ struct mxc_isi_m2m_ctx_queue_data {struct v4l2_pix_format_mplane format;const struct mxc_isi_format_info *info;u32 sequence; -bool streaming; };struct mxc_isi_m2m_ctx {
@@ -236,6 +235,66 @@ static void mxc_isi_m2m_vb2_buffer_queuev4l2_m2m_buf_queue (ctx->fh.m2m_ctx, vbuf); } +static int mxc_isi_m2m_vb2_prepare_streaming (struct vb2_queue *q) +{ +struct mxc_isi_m2m_ctx *ctx =vb2_get_drv_priv (q); +const struct v4l2_pix_format_mplane *out_pix = &ctx->queues.out.format; +const struct v4l2_pix_format_mplane *cap_pix = &ctx->queues.cap.format; +const struct mxc_isi_format_info *cap_info = ctx->queues.cap.info; +const struct mxc_isi_format_info *out_info = ctx->queues.out.info; +struct mxc_isi_m2m *m2m = ctx->m2m; +bool bypass; +int ret; + +guard (mutex)(&m2m->lock); + +if (m2m->usage_count ==INT_MAX ) +return -EOVERFLOW ; + + bypass = cap_pix->width == out_pix->width && + cap_pix->height == out_pix->height && + cap_info->encoding == out_info->encoding; + +/* +* Acquire the pipe and initialize the channel with the first user of +* the M2M device. +*/ +if (m2m->usage_count ==0 ) { + ret =mxc_isi_channel_acquire (m2m->pipe, + &mxc_isi_m2m_frame_write_done, + bypass); +if (ret) +return ret; + +mxc_isi_channel_get (m2m->pipe); + } + + m2m->usage_count++; + +/* +* Allocate resources for the channel, counting how many users require +* buffer chaining. +*/ +if (!ctx->chained && out_pix->width >MXC_ISI_MAX_WIDTH_UNCHAINED ) { + ret =mxc_isi_channel_chain (m2m->pipe, bypass); +if (ret) + goto err_deinit; + + m2m->chained_count++; + ctx->chained = true; + } + +return 0 ; + +err_deinit: +if (--m2m->usage_count ==0 ) { +mxc_isi_channel_put (m2m->pipe); +mxc_isi_channel_release (m2m->pipe); + } + +return ret; +} +static int mxc_isi_m2m_vb2_start_streaming (struct vb2_queue *q,unsigned int count) {
@@ -265,13 +324,44 @@ static void mxc_isi_m2m_vb2_stop_streami } } +static void mxc_isi_m2m_vb2_unprepare_streaming (struct vb2_queue *q) +{ +struct mxc_isi_m2m_ctx *ctx =vb2_get_drv_priv (q); +struct mxc_isi_m2m *m2m = ctx->m2m; + +guard (mutex)(&m2m->lock); + +/* +* If the last context is this one, reset it to make sure the device +* will be reconfigured when streaming is restarted. +*/ +if (m2m->last_ctx == ctx) + m2m->last_ctx =NULL ; + +/* Free the channel resources if this is the last chained context. */ +if (ctx->chained && --m2m->chained_count ==0 ) +mxc_isi_channel_unchain (m2m->pipe); + ctx->chained = false; + +/* Turn off the light with the last user. */ +if (--m2m->usage_count ==0 ) { +mxc_isi_channel_disable (m2m->pipe); +mxc_isi_channel_put (m2m->pipe); +mxc_isi_channel_release (m2m->pipe); + } + +WARN_ON (m2m->usage_count <0 ); +} +static const struct vb2_ops mxc_isi_m2m_vb2_qops = { .queue_setup = mxc_isi_m2m_vb2_queue_setup, .buf_init = mxc_isi_m2m_vb2_buffer_init, .buf_prepare = mxc_isi_m2m_vb2_buffer_prepare, .buf_queue = mxc_isi_m2m_vb2_buffer_queue, + .prepare_streaming = mxc_isi_m2m_vb2_prepare_streaming, .start_streaming = mxc_isi_m2m_vb2_start_streaming, .stop_streaming = mxc_isi_m2m_vb2_stop_streaming, + .unprepare_streaming = mxc_isi_m2m_vb2_unprepare_streaming, }; static int mxc_isi_m2m_queue_init(void *priv, struct vb2_queue *src_vq,
@@ -481,136 +571,6 @@ static int mxc_isi_m2m_s_fmt_vid(structreturn 0 ; } -static int mxc_isi_m2m_streamon (struct file *file,void *fh, -enum v4l2_buf_type type) -{ -struct mxc_isi_m2m_ctx *ctx =to_isi_m2m_ctx (fh); -struct mxc_isi_m2m_ctx_queue_data *q =mxc_isi_m2m_ctx_qdata (ctx, type); -const struct v4l2_pix_format_mplane *out_pix = &ctx->queues.out.format; -const struct v4l2_pix_format_mplane *cap_pix = &ctx->queues.cap.format; -const struct mxc_isi_format_info *cap_info = ctx->queues.cap.info; -const struct mxc_isi_format_info *out_info = ctx->queues.out.info; -struct mxc_isi_m2m *m2m = ctx->m2m; -bool bypass; -int ret; - -if (q->streaming) -return 0 ; - -mutex_lock (&m2m->lock); - -if (m2m->usage_count ==INT_MAX ) { - ret = -EOVERFLOW ; - goto unlock; - } - - bypass = cap_pix->width == out_pix->width && - cap_pix->height == out_pix->height && - cap_info->encoding == out_info->encoding; - -/* -* Acquire the pipe and initialize the channel with the first user of -* the M2M device. -*/ -if (m2m->usage_count ==0 ) { - ret =mxc_isi_channel_acquire (m2m->pipe, - &mxc_isi_m2m_frame_write_done, - bypass); -if (ret) - goto unlock; - -mxc_isi_channel_get (m2m->pipe); - } - - m2m->usage_count++; - -/* -* Allocate resources for the channel, counting how many users require -* buffer chaining. -*/ -if (!ctx->chained && out_pix->width >MXC_ISI_MAX_WIDTH_UNCHAINED ) { - ret =mxc_isi_channel_chain (m2m->pipe, bypass); -if (ret) - goto deinit; - - m2m->chained_count++; - ctx->chained = true; - } - -/* -* Drop the lock to start the stream, as the .device_run() operation -* needs to acquire it. -*/ -mutex_unlock (&m2m->lock); - ret =v4l2_m2m_ioctl_streamon (file, fh, type); -if (ret) { -/* Reacquire the lock for the cleanup path. */ -mutex_lock (&m2m->lock); - goto unchain; - } - - q->streaming = true; - -return 0 ; - -unchain: -if (ctx->chained && --m2m->chained_count ==0 ) -mxc_isi_channel_unchain (m2m->pipe); - ctx->chained = false; - -deinit: -if (--m2m->usage_count ==0 ) { -mxc_isi_channel_put (m2m->pipe); -mxc_isi_channel_release (m2m->pipe); - } - -unlock: -mutex_unlock (&m2m->lock); -return ret; -} - -static int mxc_isi_m2m_streamoff (struct file *file,void *fh, -enum v4l2_buf_type type) -{ -struct mxc_isi_m2m_ctx *ctx =to_isi_m2m_ctx (fh); -struct mxc_isi_m2m_ctx_queue_data *q =mxc_isi_m2m_ctx_qdata (ctx, type); -struct mxc_isi_m2m *m2m = ctx->m2m; - -v4l2_m2m_ioctl_streamoff (file, fh, type); - -if (!q->streaming) -return 0 ; - -mutex_lock (&m2m->lock); - -/* -* If the last context is this one, reset it to make sure the device -* will be reconfigured when streaming is restarted. -*/ -if (m2m->last_ctx == ctx) - m2m->last_ctx =NULL ; - -/* Free the channel resources if this is the last chained context. */ -if (ctx->chained && --m2m->chained_count ==0 ) -mxc_isi_channel_unchain (m2m->pipe); - ctx->chained = false; - -/* Turn off the light with the last user. */ -if (--m2m->usage_count ==0 ) { -mxc_isi_channel_disable (m2m->pipe); -mxc_isi_channel_put (m2m->pipe); -mxc_isi_channel_release (m2m->pipe); - } - -WARN_ON (m2m->usage_count <0 ); - -mutex_unlock (&m2m->lock); - - q->streaming = false; - -return 0 ; -} -static const struct v4l2_ioctl_ops mxc_isi_m2m_ioctl_ops = { .vidioc_querycap = mxc_isi_m2m_querycap,
@@ -631,8 +591,8 @@ static const struct v4l2_ioctl_ops mxc_i .vidioc_prepare_buf = v4l2_m2m_ioctl_prepare_buf, .vidioc_create_bufs = v4l2_m2m_ioctl_create_bufs, - .vidioc_streamon = mxc_isi_m2m_streamon, - .vidioc_streamoff = mxc_isi_m2m_streamoff, + .vidioc_streamon = v4l2_m2m_ioctl_streamon, + .vidioc_streamoff = v4l2_m2m_ioctl_streamoff, .vidioc_subscribe_event = v4l2_ctrl_subscribe_event, .vidioc_unsubscribe_event = v4l2_event_unsubscribe,
Greg Kroah-Hartman
maintainerPATCH 51/159 usb: gadget: Store endpoint pointer in usb_request
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit bfb1d99d969fe3b892db30848aeebfa19d21f57f ]
Gadget function drivers often have goto-based error handling in their bind paths, which can be bug-prone. Refactoring these paths to use __free() scope-based cleanup is desirable, but currently blocked.
The blocker is that usb_ep_free_request(ep, req) requires two parameters, while the __free() mechanism can only pass a pointer to the request itself.
Store an endpoint pointer in the struct usb_request. The pointer is populated centrally in usb_ep_alloc_request() on every successful allocation, making the request object self-contained.
Stable-dep-of: 082289414360 ("usb: gadget: f_rndis: Refactor bind path to use __free()")
--- drivers/usb/gadget/udc/core.c | 3 +++ include/linux/usb/gadget.h | 2 ++ 2 files changed, 5 insertions(+)
drivers/usb/gadget/udc/core.c +3 -0
@@ -194,6 +194,9 @@ struct usb_request *usb_ep_alloc_request req = ep->ops->alloc_request (ep, gfp_flags); +if (req) + req->ep = ep; +trace_usb_ep_alloc_request (ep, req, req ?0 : -ENOMEM );return req;
include/linux/usb/gadget.h +2 -0
@@ -32,6 +32,7 @@ struct usb_ep;/** * struct usb_request - describes one i/o request +* @ep: The associated endpoint set by usb_ep_alloc_request(). * @buf: Buffer used for data. Always provide this; some controllers * only use PIO, or don't use DMA for some endpoints. * @dma: DMA address corresponding to 'buf'. If you don't set this
@@ -98,6 +99,7 @@ struct usb_ep;*/ struct usb_request { +struct usb_ep *ep;void *buf;unsigned length;dma_addr_t dma;
Greg Kroah-Hartman
maintainerPATCH 52/159 usb: gadget: Introduce free_usb_request helper
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 201c53c687f2b55a7cc6d9f4000af4797860174b ]
Introduce the free_usb_request() function that frees both the request's buffer and the request itself.
This function serves as the cleanup callback for DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request pointers.
Stable-dep-of: 082289414360 ("usb: gadget: f_rndis: Refactor bind path to use __free()")
--- include/linux/usb/gadget.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
include/linux/usb/gadget.h +23 -0
@@ -15,6 +15,7 @@#ifndef __LINUX_USB_GADGET_H#define __LINUX_USB_GADGET_H +#include <linux/cleanup.h> #include <linux/configfs.h> #include <linux/device.h> #include <linux/errno.h>
@@ -293,6 +294,28 @@ static inline void usb_ep_fifo_flush(str/*-------------------------------------------------------------------------*/ +/** +* free_usb_request - frees a usb_request object and its buffer +* @req: the request being freed +* +* This helper function frees both the request's buffer and the request object +* itself by calling usb_ep_free_request(). Its signature is designed to be used +* with DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request +* pointers. +*/ +static inline void free_usb_request (struct usb_request *req) +{ +if (!req) +return ; + +kfree (req->buf); +usb_ep_free_request (req->ep, req); +} + +DEFINE_FREE(free_usb_request, struct usb_request *, free_usb_request(_T)) + +/*-------------------------------------------------------------------------*/ +struct usb_dcd_config_params {__u8 bU1devExitLat;/* U1 Device exit Latency */ #define USB_DEFAULT_U1_DEV_EXIT_LAT 0x01/* Less then 1 microsec */
Greg Kroah-Hartman
maintainerPATCH 53/159 usb: gadget: f_rndis: Refactor bind path to use __free()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 08228941436047bdcd35a612c1aec0912a29d8cd ]
After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
--- drivers/usb/gadget/function/f_rndis.c | 85 ++++++++++++++-------------------- 1 file changed, 35 insertions(+), 50 deletions(-)
drivers/usb/gadget/function/f_rndis.c +35 -50
@@ -19,6 +19,8 @@#include <linux/atomic.h> +#include <linux/usb/gadget.h> +#include "u_ether.h" #include "u_ether_configfs.h" #include "u_rndis.h"
@@ -662,6 +664,8 @@ rndis_bind(struct usb_configuration *c,struct usb_ep *ep;struct f_rndis_opts *rndis_opts; + struct usb_os_desc_table *os_desc_table __free(kfree) = NULL; + struct usb_request *request __free(free_usb_request) = NULL;if (!can_support_rndis (c))return -EINVAL ;
@@ -669,12 +673,9 @@ rndis_bind(struct usb_configuration *c, rndis_opts = container_of(f->fi, struct f_rndis_opts, func_inst);if (cdev->use_os_string) { - f->os_desc_table =kzalloc (sizeof (*f->os_desc_table), -GFP_KERNEL ); -if (!f->os_desc_table) + os_desc_table =kzalloc (sizeof (*os_desc_table),GFP_KERNEL ); +if (!os_desc_table)return -ENOMEM ; - f->os_desc_n =1 ; - f->os_desc_table[0 ].os_desc = &rndis_opts->rndis_os_desc; } rndis_iad_descriptor.bFunctionClass = rndis_opts->class;
@@ -692,16 +693,14 @@ rndis_bind(struct usb_configuration *c,gether_set_gadget (rndis_opts->net, cdev->gadget); status =gether_register_netdev (rndis_opts->net);if (status) - goto fail; +return status; rndis_opts->bound = true; } us =usb_gstrings_attach (cdev, rndis_strings,ARRAY_SIZE (rndis_string_defs)); -if (IS_ERR (us)) { - status =PTR_ERR (us); - goto fail; - } +if (IS_ERR (us)) +return PTR_ERR (us); rndis_control_intf.iInterface = us[0 ].id; rndis_data_intf.iInterface = us[1 ].id; rndis_iad_descriptor.iFunction = us[2 ].id;
@@ -709,36 +708,30 @@ rndis_bind(struct usb_configuration *c,/* allocate instance-specific interface IDs */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; rndis->ctrl_id = status; rndis_iad_descriptor.bFirstInterface = status; rndis_control_intf.bInterfaceNumber = status; rndis_union_desc.bMasterInterface0 = status; -if (cdev->use_os_string) - f->os_desc_table[0 ].if_id = - rndis_iad_descriptor.bFirstInterface; - status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; rndis->data_id = status; rndis_data_intf.bInterfaceNumber = status; rndis_union_desc.bSlaveInterface0 = status; - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &fs_in_desc);if (!ep) - goto fail; +return -ENODEV ; rndis->port.in_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_out_desc);if (!ep) - goto fail; +return -ENODEV ; rndis->port.out_ep = ep;/* NOTE: a status/notification endpoint is, strictly speaking,
@@ -747,21 +740,19 @@ rndis_bind(struct usb_configuration *c,*/ ep =usb_ep_autoconfig (cdev->gadget, &fs_notify_desc);if (!ep) - goto fail; +return -ENODEV ; rndis->notify = ep; - status = -ENOMEM ; -/* allocate notification request and buffer */ - rndis->notify_req =usb_ep_alloc_request (ep,GFP_KERNEL ); -if (!rndis->notify_req) - goto fail; - rndis->notify_req->buf =kmalloc (STATUS_BYTECOUNT ,GFP_KERNEL ); -if (!rndis->notify_req->buf) - goto fail; - rndis->notify_req->length =STATUS_BYTECOUNT ; - rndis->notify_req->context = rndis; - rndis->notify_req->complete = rndis_response_complete; + request =usb_ep_alloc_request (ep,GFP_KERNEL ); +if (!request) +return -ENOMEM ; + request->buf =kmalloc (STATUS_BYTECOUNT ,GFP_KERNEL ); +if (!request->buf) +return -ENOMEM ; + request->length =STATUS_BYTECOUNT ; + request->context = rndis; + request->complete = rndis_response_complete;/* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at
@@ -778,7 +769,7 @@ rndis_bind(struct usb_configuration *c, status =usb_assign_descriptors (f, eth_fs_function, eth_hs_function, eth_ss_function, eth_ss_function);if (status) - goto fail; +return status; rndis->port.open = rndis_open; rndis->port.close = rndis_close;
@@ -789,9 +780,18 @@ rndis_bind(struct usb_configuration *c,if (rndis->manufacturer && rndis->vendorID &&rndis_set_param_vendor (rndis->params, rndis->vendorID, rndis->manufacturer)) { - status = -EINVAL ; - goto fail_free_descs; +usb_free_all_descriptors (f); +return -EINVAL ; + } + +if (cdev->use_os_string) { + os_desc_table[0 ].os_desc = &rndis_opts->rndis_os_desc; + os_desc_table[0 ].if_id = rndis_iad_descriptor.bFirstInterface; + f->os_desc_table =no_free_ptr (os_desc_table); + f->os_desc_n =1 ; + } + rndis->notify_req =no_free_ptr (request);/* NOTE: all that is done without knowing or caring about * the network link ... which is unavailable to this code
@@ -802,21 +802,6 @@ rndis_bind(struct usb_configuration *c, rndis->port.in_ep->name, rndis->port.out_ep->name, rndis->notify->name);return 0 ; - -fail_free_descs: -usb_free_all_descriptors (f); -fail: -kfree (f->os_desc_table); - f->os_desc_n =0 ; - -if (rndis->notify_req) { -kfree (rndis->notify_req->buf); -usb_ep_free_request (rndis->notify, rndis->notify_req); - } - -ERROR (cdev,"%s: can't bind, err %d\n" , f->name, status); - -return status; }void rndis_borrow_net (struct usb_function_instance *f,struct net_device *net)
Greg Kroah-Hartman
maintainerPATCH 54/159 usb: gadget: f_acm: Refactor bind path to use __free()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 47b2116e54b4a854600341487e8b55249e926324 ]
After an bind/unbind cycle, the acm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec gs_free_req+0x30/0x44 acm_bind+0x1b8/0x1f4 usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20
--- drivers/usb/gadget/function/f_acm.c | 42 ++++++++++++++++-------------------- 1 file changed, 19 insertions(+), 23 deletions(-)
drivers/usb/gadget/function/f_acm.c +19 -23
@@ -11,12 +11,15 @@/* #define VERBOSE_DEBUG */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/device.h> #include <linux/err.h> +#include <linux/usb/gadget.h> +#include "u_serial.h"
@@ -613,6 +616,7 @@ acm_bind(struct usb_configuration *c, ststruct usb_string *us;int status;struct usb_ep *ep; + struct usb_request *request __free(free_usb_request) = NULL;/* REVISIT might want instance-specific strings to help * distinguish instances ...
@@ -630,7 +634,7 @@ acm_bind(struct usb_configuration *c, st/* allocate instance-specific interface IDs, and patch descriptors */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; acm->ctrl_id = status; acm_iad_descriptor.bFirstInterface = status;
@@ -639,43 +643,41 @@ acm_bind(struct usb_configuration *c, st status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; acm->data_id = status; acm_data_interface_desc.bInterfaceNumber = status; acm_union_desc.bSlaveInterface0 = status; acm_call_mgmt_descriptor.bDataInterface = status; - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &acm_fs_in_desc);if (!ep) - goto fail; +return -ENODEV ; acm->port.in = ep; ep =usb_ep_autoconfig (cdev->gadget, &acm_fs_out_desc);if (!ep) - goto fail; +return -ENODEV ; acm->port.out = ep; ep =usb_ep_autoconfig (cdev->gadget, &acm_fs_notify_desc);if (!ep) - goto fail; +return -ENODEV ; acm->notify = ep; acm_iad_descriptor.bFunctionProtocol = acm->bInterfaceProtocol; acm_control_interface_desc.bInterfaceProtocol = acm->bInterfaceProtocol;/* allocate notification */ - acm->notify_req =gs_alloc_req (ep, -sizeof (struct usb_cdc_notification ) +2 , -GFP_KERNEL ); -if (!acm->notify_req) - goto fail; + request =gs_alloc_req (ep, +sizeof (struct usb_cdc_notification ) +2 , +GFP_KERNEL ); +if (!request) +return -ENODEV ; - acm->notify_req->complete = acm_cdc_notify_complete; - acm->notify_req->context = acm; + request->complete = acm_cdc_notify_complete; + request->context = acm;/* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at
@@ -692,7 +694,9 @@ acm_bind(struct usb_configuration *c, st status =usb_assign_descriptors (f, acm_fs_function, acm_hs_function, acm_ss_function, acm_ss_function);if (status) - goto fail; +return status; + + acm->notify_req =no_free_ptr (request); dev_dbg(&cdev->gadget->dev, "acm ttyGS%d: IN/%s OUT/%s NOTIFY/%s\n",
@@ -700,14 +704,6 @@ acm_bind(struct usb_configuration *c, st acm->port.in->name, acm->port.out->name, acm->notify->name);return 0 ; - -fail: -if (acm->notify_req) -gs_free_req (acm->notify, acm->notify_req); - -ERROR (cdev,"%s/%p: can't bind, err %d\n" , f->name, f, status); - -return status; }static void acm_unbind (struct usb_configuration *c,struct usb_function *f)
Greg Kroah-Hartman
maintainerPATCH 55/159 usb: gadget: f_ecm: Refactor bind path to use __free()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 42988380ac67c76bb9dff8f77d7ef3eefd50b7b5 ]
After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
--- drivers/usb/gadget/function/f_ecm.c | 48 +++++++++++++++--------------------- 1 file changed, 20 insertions(+), 28 deletions(-)
drivers/usb/gadget/function/f_ecm.c +20 -28
@@ -8,6 +8,7 @@/* #define VERBOSE_DEBUG */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h>
@@ -15,6 +16,8 @@#include <linux/etherdevice.h> #include <linux/string_choices.h> +#include <linux/usb/gadget.h> +#include "u_ether.h" #include "u_ether_configfs.h" #include "u_ecm.h"
@@ -678,6 +681,7 @@ ecm_bind(struct usb_configuration *c, ststruct usb_ep *ep;struct f_ecm_opts *ecm_opts; + struct usb_request *request __free(free_usb_request) = NULL;if (!can_support_ecm (cdev->gadget))return -EINVAL ;
@@ -711,7 +715,7 @@ ecm_bind(struct usb_configuration *c, st/* allocate instance-specific interface IDs */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ecm->ctrl_id = status; ecm_iad_descriptor.bFirstInterface = status;
@@ -720,24 +724,22 @@ ecm_bind(struct usb_configuration *c, st status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ecm->data_id = status; ecm_data_nop_intf.bInterfaceNumber = status; ecm_data_intf.bInterfaceNumber = status; ecm_union_desc.bSlaveInterface0 = status; - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_in_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->port.in_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_out_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->port.out_ep = ep;/* NOTE: a status/notification endpoint is *OPTIONAL* but we
@@ -746,20 +748,18 @@ ecm_bind(struct usb_configuration *c, st*/ ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_notify_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->notify = ep; - status = -ENOMEM ; -/* allocate notification request and buffer */ - ecm->notify_req =usb_ep_alloc_request (ep,GFP_KERNEL ); -if (!ecm->notify_req) - goto fail; - ecm->notify_req->buf =kmalloc (ECM_STATUS_BYTECOUNT ,GFP_KERNEL ); -if (!ecm->notify_req->buf) - goto fail; - ecm->notify_req->context = ecm; - ecm->notify_req->complete = ecm_notify_complete; + request =usb_ep_alloc_request (ep,GFP_KERNEL ); +if (!request) +return -ENOMEM ; + request->buf =kmalloc (ECM_STATUS_BYTECOUNT ,GFP_KERNEL ); +if (!request->buf) +return -ENOMEM ; + request->context = ecm; + request->complete = ecm_notify_complete;/* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at
@@ -778,7 +778,7 @@ ecm_bind(struct usb_configuration *c, st status =usb_assign_descriptors (f, ecm_fs_function, ecm_hs_function, ecm_ss_function, ecm_ss_function);if (status) - goto fail; +return status;/* NOTE: all that is done without knowing or caring about * the network link ... which is unavailable to this code
@@ -788,20 +788,12 @@ ecm_bind(struct usb_configuration *c, st ecm->port.open = ecm_open; ecm->port.close = ecm_close; + ecm->notify_req =no_free_ptr (request); +DBG (cdev,"CDC Ethernet: IN/%s OUT/%s NOTIFY/%s\n" , ecm->port.in_ep->name, ecm->port.out_ep->name, ecm->notify->name);return 0 ; - -fail: -if (ecm->notify_req) { -kfree (ecm->notify_req->buf); -usb_ep_free_request (ecm->notify, ecm->notify_req); - } - -ERROR (cdev,"%s: can't bind, err %d\n" , f->name, status); - -return status; }static inline struct f_ecm_opts *to_f_ecm_opts (struct config_item *item)
Greg Kroah-Hartman
maintainerPATCH 56/159 usb: gadget: f_ncm: Refactor bind path to use __free()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef ]
After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec ncm_bind+0x39c/0x3dc usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20
--- drivers/usb/gadget/function/f_ncm.c | 78 +++++++++++++++--------------------- 1 file changed, 33 insertions(+), 45 deletions(-)
drivers/usb/gadget/function/f_ncm.c +33 -45
@@ -11,6 +11,7 @@* Copyright (C) 2008 Nokia Corporation */ +#include <linux/cleanup.h> #include <linux/kernel.h> #include <linux/interrupt.h> #include <linux/module.h>
@@ -20,6 +21,7 @@#include <linux/string_choices.h> #include <linux/usb/cdc.h> +#include <linux/usb/gadget.h> #include "u_ether.h" #include "u_ether_configfs.h"
@@ -1436,18 +1438,18 @@ static int ncm_bind(struct usb_configurastruct usb_ep *ep;struct f_ncm_opts *ncm_opts; + struct usb_os_desc_table *os_desc_table __free(kfree) = NULL; + struct usb_request *request __free(free_usb_request) = NULL; +if (!can_support_ecm (cdev->gadget))return -EINVAL ; ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst);if (cdev->use_os_string) { - f->os_desc_table =kzalloc (sizeof (*f->os_desc_table), -GFP_KERNEL ); -if (!f->os_desc_table) + os_desc_table =kzalloc (sizeof (*os_desc_table),GFP_KERNEL ); +if (!os_desc_table)return -ENOMEM ; - f->os_desc_n =1 ; - f->os_desc_table[0 ].os_desc = &ncm_opts->ncm_os_desc; }mutex_lock (&ncm_opts->lock);
@@ -1459,16 +1461,15 @@ static int ncm_bind(struct usb_configuramutex_unlock (&ncm_opts->lock);if (status) - goto fail; +return status; ncm_opts->bound = true; us =usb_gstrings_attach (cdev, ncm_strings,ARRAY_SIZE (ncm_string_defs)); -if (IS_ERR (us)) { - status =PTR_ERR (us); - goto fail; - } +if (IS_ERR (us)) +return PTR_ERR (us); + ncm_control_intf.iInterface = us[STRING_CTRL_IDX ].id; ncm_data_nop_intf.iInterface = us[STRING_DATA_IDX ].id; ncm_data_intf.iInterface = us[STRING_DATA_IDX ].id;
@@ -1478,20 +1479,16 @@ static int ncm_bind(struct usb_configura/* allocate instance-specific interface IDs */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ncm->ctrl_id = status; ncm_iad_desc.bFirstInterface = status; ncm_control_intf.bInterfaceNumber = status; ncm_union_desc.bMasterInterface0 = status; -if (cdev->use_os_string) - f->os_desc_table[0 ].if_id = - ncm_iad_desc.bFirstInterface; - status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ncm->data_id = status; ncm_data_nop_intf.bInterfaceNumber = status;
@@ -1500,35 +1497,31 @@ static int ncm_bind(struct usb_configura ecm_desc.wMaxSegmentSize =cpu_to_le16 (ncm_opts->max_segment_size); - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &fs_ncm_in_desc);if (!ep) - goto fail; +return -ENODEV ; ncm->port.in_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_ncm_out_desc);if (!ep) - goto fail; +return -ENODEV ; ncm->port.out_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_ncm_notify_desc);if (!ep) - goto fail; +return -ENODEV ; ncm->notify = ep; - status = -ENOMEM ; -/* allocate notification request and buffer */ - ncm->notify_req =usb_ep_alloc_request (ep,GFP_KERNEL ); -if (!ncm->notify_req) - goto fail; - ncm->notify_req->buf =kmalloc (NCM_STATUS_BYTECOUNT ,GFP_KERNEL ); -if (!ncm->notify_req->buf) - goto fail; - ncm->notify_req->context = ncm; - ncm->notify_req->complete = ncm_notify_complete; + request =usb_ep_alloc_request (ep,GFP_KERNEL ); +if (!request) +return -ENOMEM ; + request->buf =kmalloc (NCM_STATUS_BYTECOUNT ,GFP_KERNEL ); +if (!request->buf) +return -ENOMEM ; + request->context = ncm; + request->complete = ncm_notify_complete;/* * support all relevant hardware speeds... we expect that when
@@ -1548,7 +1541,7 @@ static int ncm_bind(struct usb_configura status =usb_assign_descriptors (f, ncm_fs_function, ncm_hs_function, ncm_ss_function, ncm_ss_function);if (status) - goto fail; +return status;/* * NOTE: all that is done without knowing or caring about
@@ -1561,23 +1554,18 @@ static int ncm_bind(struct usb_configurahrtimer_setup (&ncm->task_timer, ncm_tx_timeout,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); +if (cdev->use_os_string) { + os_desc_table[0 ].os_desc = &ncm_opts->ncm_os_desc; + os_desc_table[0 ].if_id = ncm_iad_desc.bFirstInterface; + f->os_desc_table =no_free_ptr (os_desc_table); + f->os_desc_n =1 ; + } + ncm->notify_req =no_free_ptr (request); +DBG (cdev,"CDC Network: IN/%s OUT/%s NOTIFY/%s\n" , ncm->port.in_ep->name, ncm->port.out_ep->name, ncm->notify->name);return 0 ; - -fail: -kfree (f->os_desc_table); - f->os_desc_n =0 ; - -if (ncm->notify_req) { -kfree (ncm->notify_req->buf); -usb_ep_free_request (ncm->notify, ncm->notify_req); - } - -ERROR (cdev,"%s: can't bind, err %d\n" , f->name, status); - -return status; }static inline struct f_ncm_opts *to_f_ncm_opts (struct config_item *item)
Greg Kroah-Hartman
maintainerPATCH 57/159 HID: multitouch: fix sticky fingers
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 46f781e0d151844589dc2125c8cce3300546f92a upstream.
The sticky fingers quirk (MT_QUIRK_STICKY_FINGERS) was only considering the case when slots were not released during the last report. This can be problematic if the firmware forgets to release a finger while others are still present.
This was observed on the Synaptics DLL0945 touchpad found on the Dell XPS 9310 and the Dell Inspiron 5406.
--- drivers/hid/hid-multitouch.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
drivers/hid/hid-multitouch.c +14 -13
@@ -92,9 +92,8 @@ enum report_mode { TOUCHPAD_REPORT_ALL = TOUCHPAD_REPORT_BUTTONS | TOUCHPAD_REPORT_CONTACTS, }; -#define MT_IO_FLAGS_RUNNING 0 -#define MT_IO_FLAGS_ACTIVE_SLOTS 1 -#define MT_IO_FLAGS_PENDING_SLOTS 2 +#define MT_IO_SLOTS_MASK GENMASK(7, 0)/* reserve first 8 bits for slot tracking */ +#define MT_IO_FLAGS_RUNNING 32static const bool mtrue = true;/* default for true */ static const bool mfalse;/* default for false */
@@ -169,7 +168,11 @@ struct mt_device {struct mt_class mtclass;/* our mt device class */ struct timer_list release_timer;/* to release sticky fingers */ struct hid_device *hdev;/* hid_device we're attached to */ -unsigned long mt_io_flags;/* mt flags (MT_IO_FLAGS_*) */ +unsigned long mt_io_flags;/* mt flags (MT_IO_FLAGS_RUNNING) +* first 8 bits are reserved for keeping the slot +* states, this is fine because we only support up +* to 250 slots (MT_MAX_MAXCONTACT) +*/ __u8 inputmode_value;/* InputMode HID feature value */ __u8 maxcontacts;bool is_buttonpad;/* is this device a button pad? */
@@ -977,6 +980,7 @@ static void mt_release_pending_palms(strfor_each_set_bit (slotnum, app->pending_palm_slots, td->maxcontacts) {clear_bit (slotnum, app->pending_palm_slots); +clear_bit (slotnum, &td->mt_io_flags);input_mt_slot (input, slotnum);input_mt_report_slot_inactive (input);
@@ -1008,12 +1012,6 @@ static void mt_sync_frame(struct mt_devi app->num_received =0 ; app->left_button_state =0 ; - -if (test_bit (MT_IO_FLAGS_ACTIVE_SLOTS , &td->mt_io_flags)) -set_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags); -else -clear_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags); -clear_bit (MT_IO_FLAGS_ACTIVE_SLOTS , &td->mt_io_flags); }static int mt_compute_timestamp (struct mt_application *app,__s32 value)
@@ -1188,7 +1186,9 @@ static int mt_process_slot(struct mt_devinput_event (input,EV_ABS ,ABS_MT_TOUCH_MAJOR , major);input_event (input,EV_ABS ,ABS_MT_TOUCH_MINOR , minor); -set_bit (MT_IO_FLAGS_ACTIVE_SLOTS , &td->mt_io_flags); +set_bit (slotnum, &td->mt_io_flags); + }else { +clear_bit (slotnum, &td->mt_io_flags); }return 0 ;
@@ -1323,7 +1323,7 @@ static void mt_touch_report(struct hid_d* defect. */ if (app->quirks &MT_QUIRK_STICKY_FINGERS ) { -if (test_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags)) +if (td->mt_io_flags &MT_IO_SLOTS_MASK )mod_timer (&td->release_timer, jiffies +msecs_to_jiffies (100 ));else
@@ -1782,6 +1782,7 @@ static void mt_release_contacts(struct hfor (i =0 ; i < mt->num_slots; i++) {input_mt_slot (input_dev, i);input_mt_report_slot_inactive (input_dev); +clear_bit (i, &td->mt_io_flags); }input_mt_sync_frame (input_dev);input_sync (input_dev);
@@ -1804,7 +1805,7 @@ static void mt_expired_timeout(struct ti*/ if (test_and_set_bit_lock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags))return ; -if (test_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags)) +if (td->mt_io_flags &MT_IO_SLOTS_MASK )mt_release_contacts (hdev);clear_bit_unlock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); }
Greg Kroah-Hartman
maintainerPATCH 58/159 dax: skip read lock assertion for read-only filesystems
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
The commit 168316db3583("dax: assert that i_rwsem is held exclusive for writes") added lock assertions to ensure proper locking in DAX operations. However, these assertions trigger false-positive lockdep warnings since read lock is unnecessary on read-only filesystems(e.g., erofs).
This patch skips the read lock assertion for read-only filesystems, eliminating the spurious warnings while maintaining the integrity checks for writable filesystems.
--- fs/dax.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dax.c +1 -1
@@ -1752,7 +1752,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,if (iov_iter_rw (iter) ==WRITE ) {lockdep_assert_held_write (&iomi.inode->i_rwsem); iomi.flags |=IOMAP_WRITE ; - }else { + }else if (!sb_rdonly (iomi.inode->i_sb)) {lockdep_assert_held (&iomi.inode->i_rwsem); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/159 coredump: fix core_pattern input validation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit a779e27f24aeb679969ddd1fdd7f636e22ddbc1e ]
In be1e0283021e ("coredump: don't pointlessly check and spew warnings") we tried to fix input validation so it only happens during a write to core_pattern. This would avoid needlessly logging a lot of warnings during a read operation. However the logic accidently got inverted in this commit. Fix it so the input validation only happens on write and is skipped on read.
--- fs/coredump.c | 2 +- fs/exec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/coredump.c +1 -1
@@ -1466,7 +1466,7 @@ static int proc_dostring_coredump(const struct ctl_table *table, int write,ssize_t retval;char old_core_pattern[CORENAME_MAX_SIZE ]; -if (write) +if (!write)return proc_dostring (table, write, buffer, lenp, ppos); retval =strscpy (old_core_pattern, core_pattern,CORENAME_MAX_SIZE );
fs/exec.c +1 -1
@@ -2048,7 +2048,7 @@ static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int writ {int error =proc_dointvec_minmax (table, write, buffer, lenp, ppos); -if (!error && !write) +if (!error && write)validate_coredump_safety ();return error; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/159 can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ]
Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") moved the PM runtime enable from the m_can core driver into the m_can_platform.
That patch forgot to move the pm_runtime_disable() to m_can_plat_remove(), so that unloading the m_can_platform driver causes an "Unbalanced pm_runtime_enable!" error message.
Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the problem.
--- drivers/net/can/m_can/m_can_platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can_platform.c +1 -1
@@ -180,7 +180,7 @@ static void m_can_plat_remove(struct platform_device *pdev)struct m_can_classdev *mcan_class = &priv->cdev;m_can_class_unregister (mcan_class); - +pm_runtime_disable (mcan_class->dev);m_can_class_free_dev (mcan_class->net); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/159 can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 3d9db29b45f970d81acf61cf91a65442efbeb997 ]
The CAN Error State is determined by the receive and transmit error counters. The CAN error counters decrease when reception/transmission is successful, so that a status transition back to the Error Active status is possible. This transition is not handled by m_can_handle_state_errors().
Add the missing detection of the Error Active state to m_can_handle_state_errors() and extend the handling of this state in m_can_handle_state_change().
--- drivers/net/can/m_can/m_can.c | 53 +++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 21 deletions(-)
drivers/net/can/m_can/m_can.c +32 -21
@@ -812,6 +812,9 @@ static int m_can_handle_state_change(struct net_device *dev,u32 timestamp =0 ;switch (new_state) { +case CAN_STATE_ERROR_ACTIVE : + cdev->can.state =CAN_STATE_ERROR_ACTIVE ; +break ;case CAN_STATE_ERROR_WARNING :/* error warning state */ cdev->can.can_stats.error_warning++;
@@ -841,6 +844,12 @@ static int m_can_handle_state_change(struct net_device *dev,__m_can_get_berr_counter (dev, &bec);switch (new_state) { +case CAN_STATE_ERROR_ACTIVE : + cf->can_id |=CAN_ERR_CRTL |CAN_ERR_CNT ; + cf->data[1 ] =CAN_ERR_CRTL_ACTIVE ; + cf->data[6 ] = bec.txerr; + cf->data[7 ] = bec.rxerr; +break ;case CAN_STATE_ERROR_WARNING :/* error warning state */ cf->can_id |=CAN_ERR_CRTL |CAN_ERR_CNT ;
@@ -877,30 +886,33 @@ static int m_can_handle_state_change(struct net_device *dev,return 1 ; } -static int m_can_handle_state_errors (struct net_device *dev,u32 psr) +static enum can_state +m_can_state_get_by_psr (struct m_can_classdev *cdev) { -struct m_can_classdev *cdev =netdev_priv (dev); -int work_done =0 ; +u32 reg_psr; -if (psr &PSR_EW && cdev->can.state !=CAN_STATE_ERROR_WARNING ) { -netdev_dbg (dev,"entered error warning state\n" ); - work_done +=m_can_handle_state_change (dev, -CAN_STATE_ERROR_WARNING ); - } + reg_psr =m_can_read (cdev,M_CAN_PSR ); -if (psr &PSR_EP && cdev->can.state !=CAN_STATE_ERROR_PASSIVE ) { -netdev_dbg (dev,"entered error passive state\n" ); - work_done +=m_can_handle_state_change (dev, -CAN_STATE_ERROR_PASSIVE ); - } +if (reg_psr &PSR_BO ) +return CAN_STATE_BUS_OFF ; +if (reg_psr &PSR_EP ) +return CAN_STATE_ERROR_PASSIVE ; +if (reg_psr &PSR_EW ) +return CAN_STATE_ERROR_WARNING ; -if (psr &PSR_BO && cdev->can.state !=CAN_STATE_BUS_OFF ) { -netdev_dbg (dev,"entered error bus off state\n" ); - work_done +=m_can_handle_state_change (dev, -CAN_STATE_BUS_OFF ); - } +return CAN_STATE_ERROR_ACTIVE ; +} -return work_done; +static int m_can_handle_state_errors (struct net_device *dev) +{ +struct m_can_classdev *cdev =netdev_priv (dev); +enum can_state new_state; + + new_state =m_can_state_get_by_psr (cdev); +if (new_state == cdev->can.state) +return 0 ; + +return m_can_handle_state_change (dev, new_state); }static void m_can_handle_other_err (struct net_device *dev,u32 irqstatus)
@@ -1031,8 +1043,7 @@ static int m_can_rx_handler(struct net_device *dev, int quota, u32 irqstatus) }if (irqstatus &IR_ERR_STATE ) - work_done +=m_can_handle_state_errors (dev, -m_can_read (cdev,M_CAN_PSR )); + work_done +=m_can_handle_state_errors (dev);if (irqstatus &IR_ERR_BUS_30X ) work_done += m_can_handle_bus_errors(dev, irqstatus,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/159 can: m_can: m_can_chip_config(): bring up interface in correct state
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 4942c42fe1849e6d68dfb5b36ccba344a9fac016 ]
In some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the CAN state and CAN error counters over an internal reset cycle. An external reset is not always possible, due to the shared reset with the other CAN core. This caused the core not always be in Error Active state when bringing up the controller.
Instead of always setting the CAN state to Error Active in m_can_chip_config(), fix this by reading and decoding the Protocol Status Regitser (PSR) and set the CAN state accordingly.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -1617,7 +1617,7 @@ static int m_can_start(struct net_device *dev)netdev_queue_set_dql_min_limit (netdev_get_tx_queue (cdev->net,0 ), cdev->tx_max_coalesced_frames); - cdev->can.state =CAN_STATE_ERROR_ACTIVE ; + cdev->can.state =m_can_state_get_by_psr (cdev);m_can_enable_all_interrupts (cdev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/159 can: m_can: fix CAN state in system PM
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit a9e30a22d6f23a2684c248871cad4c3061181639 ]
A suspend/resume cycle on a down interface results in the interface coming up in Error Active state. A suspend/resume cycle on an Up interface will always result in Error Active state, regardless of the actual CAN state.
During suspend, only set running interfaces to CAN_STATE_SLEEPING. During resume only touch the CAN state of running interfaces. For wakeup sources, set the CAN state depending on the Protocol Status Regitser (PSR), for non wakeup source interfaces m_can_start() will do the same.
--- drivers/net/can/m_can/m_can.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/can/m_can/m_can.c +3 -4
@@ -2505,12 +2505,11 @@ int m_can_class_suspend(struct device *dev) }m_can_clk_stop (cdev); + cdev->can.state =CAN_STATE_SLEEPING ; }pinctrl_pm_select_sleep_state (dev); - cdev->can.state =CAN_STATE_SLEEPING ; -return ret; }EXPORT_SYMBOL_GPL (m_can_class_suspend);
@@ -2523,8 +2522,6 @@ int m_can_class_resume(struct device *dev)pinctrl_pm_select_default_state (dev); - cdev->can.state =CAN_STATE_ERROR_ACTIVE ; -if (netif_running (ndev)) { ret =m_can_clk_start (cdev);if (ret)
@@ -2542,6 +2539,8 @@ int m_can_class_resume(struct device *dev)if (cdev->ops->init) ret = cdev->ops->init (cdev); + cdev->can.state =m_can_state_get_by_psr (cdev); +m_can_write (cdev,M_CAN_IE , cdev->active_interrupts); }else { ret =m_can_start (ndev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/159 net: mtk: wed: add dma mask limitation and GFP_DMA32 for device with more than 4GB DRAM
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Lu <[email protected]>
[ Upstream commit 3abc0e55ea1fa2250e52bc860e8f24b2b9a2093a ]
Limit tx/rx buffer address to 32-bit address space for board with more than 4GB DRAM.
--- drivers/net/ethernet/mediatek/mtk_wed.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/mediatek/mtk_wed.c +6 -2
@@ -670,7 +670,7 @@ mtk_wed_tx_buffer_alloc(struct mtk_wed_device *dev)void *buf;int s; - page =__dev_alloc_page (GFP_KERNEL ); + page =__dev_alloc_page (GFP_KERNEL |GFP_DMA32 );if (!page)return -ENOMEM ;
@@ -793,7 +793,7 @@ mtk_wed_hwrro_buffer_alloc(struct mtk_wed_device *dev)struct page *page;int s; - page =__dev_alloc_page (GFP_KERNEL ); + page =__dev_alloc_page (GFP_KERNEL |GFP_DMA32 );if (!page)return -ENOMEM ;
@@ -2405,6 +2405,10 @@ mtk_wed_attach(struct mtk_wed_device *dev) dev->version = hw->version; dev->hw->pcie_base =mtk_wed_get_pcie_base (dev); + ret =dma_set_mask_and_coherent (hw->dev,DMA_BIT_MASK (32 )); +if (ret) + goto out; +if (hw->eth->dma_dev == hw->eth->dev &&of_dma_is_coherent (hw->eth->dev->of_node))mtk_eth_set_dma_device (hw->eth, hw->dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/159 net: dlink: handle dma_map_single() failure properly
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <[email protected]>
[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
There is no error handling for dma_map_single() failures.
Add error handling by checking dma_mapping_error() and freeing the skb using dev_kfree_skb() (process context) when it fails.
Tested-on: D-Link DGE-550T Rev-A3
--- drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/net/ethernet/dlink/dl2k.c +16 -7
@@ -508,25 +508,34 @@ static int alloc_list(struct net_device *dev)for (i =0 ; i <RX_RING_SIZE ; i++) {/* Allocated fixed size of skbuff */ struct sk_buff *skb; +dma_addr_t addr; skb =netdev_alloc_skb_ip_align (dev, np->rx_buf_sz); np->rx_skbuff[i] = skb; -if (!skb) { -free_list (dev); -return -ENOMEM ; - } +if (!skb) + goto err_free_list; + + addr =dma_map_single (&np->pdev->dev, skb->data, + np->rx_buf_sz,DMA_FROM_DEVICE ); +if (dma_mapping_error (&np->pdev->dev, addr)) + goto err_kfree_skb; np->rx_ring[i].next_desc =cpu_to_le64 (np->rx_ring_dma + ((i +1 ) %RX_RING_SIZE ) *sizeof (struct netdev_desc ));/* Rubicon now supports 40 bits of addressing space. */ - np->rx_ring[i].fraginfo = -cpu_to_le64 (dma_map_single (&np->pdev->dev, skb->data, - np->rx_buf_sz,DMA_FROM_DEVICE )); + np->rx_ring[i].fraginfo =cpu_to_le64 (addr); np->rx_ring[i].fraginfo |=cpu_to_le64 ((u64 )np->rx_buf_sz <<48 ); }return 0 ; + +err_kfree_skb: +dev_kfree_skb (np->rx_skbuff[i]); + np->rx_skbuff[i] =NULL ; +err_free_list: +free_list (dev); +return -ENOMEM ; }static void rio_hw_init (struct net_device *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/159 doc: fix seg6_flowlabel path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <[email protected]>
[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ]
This sysctl is not per interface; it's global per netns.
--- Documentation/networking/seg6-sysctl.rst | 3 +++ 1 file changed, 3 insertions(+)
Documentation/networking/seg6-sysctl.rst +3 -0
@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER Default is 0. +/proc/sys/net/ipv6/seg6_* variables: +==================================== + seg6_flowlabel - INTEGER Controls the behaviour of computing the flowlabel of outer IPv6 header in case of SR T.encaps
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/159 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 93a27b5891b8194a8c083c9a80d2141d4bf47ba8 ]
Currently NETDEV_UNREGISTER event handler is not calling j1939_cancel_active_session() and j1939_sk_queue_drop_all(). This will result in these calls being skipped when j1939_sk_release() is called. And I guess that the reason syzbot is still reporting
unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
is caused by lack of these calls.
Calling j1939_cancel_active_session(priv, sk) from j1939_sk_release() can be covered by calling j1939_cancel_active_session(priv, NULL) from j1939_netdev_notify().
Calling j1939_sk_queue_drop_all() from j1939_sk_release() can be covered by calling j1939_sk_netdev_event_netdown() from j1939_netdev_notify().
Therefore, we can reuse j1939_cancel_active_session(priv, NULL) and j1939_sk_netdev_event_netdown(priv) for NETDEV_UNREGISTER event handler.
--- net/can/j1939/main.c | 2 ++ 1 file changed, 2 insertions(+)
net/can/j1939/main.c +2 -0
@@ -378,6 +378,8 @@ static int j1939_netdev_notify(struct notifier_block *nb,j1939_ecu_unmap_all (priv);break ;case NETDEV_UNREGISTER : +j1939_cancel_active_session (priv,NULL ); +j1939_sk_netdev_event_netdown (priv);j1939_sk_netdev_event_unregister (priv);break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/159 dpll: zl3073x: Refactor DPLL initialization
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit ebb1031c51377829b21e1c58e8eccc479e4921b7 ]
Refactor DPLL initialization and move DPLL (de)registration, monitoring control, fetching device invariant parameters and phase offset measurement block setup to separate functions.
Use these new functions during device probe and teardown functions and during changes to the clock_id devlink parameter.
These functions will also be used in the next patch implementing devlink flash, where this functionality is likewise required.
Stable-dep-of: fcb8b32a68fd ("dpll: zl3073x: Handle missing or corrupted flash configuration")
--- drivers/dpll/zl3073x/core.c | 207 +++++++++++++++++++++------------ drivers/dpll/zl3073x/core.h | 3 + drivers/dpll/zl3073x/devlink.c | 18 +-- 3 files changed, 142 insertions(+), 86 deletions(-)
drivers/dpll/zl3073x/core.c +133 -74
@@ -809,21 +809,142 @@ zl3073x_dev_periodic_work(struct kthread_work *work) msecs_to_jiffies(500)); } +/** +* zl3073x_dev_phase_meas_setup - setup phase offset measurement +* @zldev: pointer to zl3073x_dev structure +* +* Enable phase offset measurement block, set measurement averaging factor +* and enable DPLL-to-its-ref phase measurement for all DPLLs. +* +* Returns: 0 on success, <0 on error +*/ +static int +zl3073x_dev_phase_meas_setup (struct zl3073x_dev *zldev) +{ +struct zl3073x_dpll *zldpll; +u8 dpll_meas_ctrl, mask =0 ; +int rc; + +/* Read DPLL phase measurement control register */ + rc =zl3073x_read_u8 (zldev,ZL_REG_DPLL_MEAS_CTRL , &dpll_meas_ctrl); +if (rc) +return rc; + +/* Setup phase measurement averaging factor */ + dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR ; + dpll_meas_ctrl |=FIELD_PREP (ZL_DPLL_MEAS_CTRL_AVG_FACTOR ,3 ); + +/* Enable DPLL measurement block */ + dpll_meas_ctrl |=ZL_DPLL_MEAS_CTRL_EN ; + +/* Update phase measurement control register */ + rc =zl3073x_write_u8 (zldev,ZL_REG_DPLL_MEAS_CTRL , dpll_meas_ctrl); +if (rc) +return rc; + +/* Enable DPLL-to-connected-ref measurement for each channel */ +list_for_each_entry (zldpll, &zldev->dplls, list) + mask |=BIT (zldpll->id); + +return zl3073x_write_u8 (zldev,ZL_REG_DPLL_PHASE_ERR_READ_MASK , mask); +} + +/** +* zl3073x_dev_start - Start normal operation +* @zldev: zl3073x device pointer +* @full: perform full initialization +* +* The function starts normal operation, which means registering all DPLLs and +* their pins, and starting monitoring. If full initialization is requested, +* the function additionally initializes the phase offset measurement block and +* fetches hardware-invariant parameters. +* +* Return: 0 on success, <0 on error +*/ +int zl3073x_dev_start (struct zl3073x_dev *zldev,bool full) +{ +struct zl3073x_dpll *zldpll; +int rc; + +if (full) { +/* Fetch device state */ + rc =zl3073x_dev_state_fetch (zldev); +if (rc) +return rc; + +/* Setup phase offset measurement block */ + rc =zl3073x_dev_phase_meas_setup (zldev); +if (rc) { +dev_err (zldev->dev, +"Failed to setup phase measurement\n" ); +return rc; + } + } + +/* Register all DPLLs */ +list_for_each_entry (zldpll, &zldev->dplls, list) { + rc =zl3073x_dpll_register (zldpll); +if (rc) { +dev_err_probe (zldev->dev, rc, +"Failed to register DPLL%u\n" , + zldpll->id); +return rc; + } + } + +/* Perform initial firmware fine phase correction */ + rc =zl3073x_dpll_init_fine_phase_adjust (zldev); +if (rc) { +dev_err_probe (zldev->dev, rc, +"Failed to init fine phase correction\n" ); +return rc; + } + +/* Start monitoring */ +kthread_queue_delayed_work (zldev->kworker, &zldev->work,0 ); + +return 0 ; +} + +/** +* zl3073x_dev_stop - Stop normal operation +* @zldev: zl3073x device pointer +* +* The function stops the normal operation that mean deregistration of all +* DPLLs and their pins and stop monitoring. +* +* Return: 0 on success, <0 on error +*/ +void zl3073x_dev_stop (struct zl3073x_dev *zldev) +{ +struct zl3073x_dpll *zldpll; + +/* Stop monitoring */ +kthread_cancel_delayed_work_sync (&zldev->work); + +/* Unregister all DPLLs */ +list_for_each_entry (zldpll, &zldev->dplls, list) { +if (zldpll->dpll_dev) +zl3073x_dpll_unregister (zldpll); + } +} +static void zl3073x_dev_dpll_fini (void *ptr) {struct zl3073x_dpll *zldpll, *next;struct zl3073x_dev *zldev = ptr; -/* Stop monitoring thread */ +/* Stop monitoring and unregister DPLLs */ +zl3073x_dev_stop (zldev); + +/* Destroy monitoring thread */ if (zldev->kworker) { -kthread_cancel_delayed_work_sync (&zldev->work);kthread_destroy_worker (zldev->kworker); zldev->kworker =NULL ; } -/* Release DPLLs */ +/* Free all DPLLs */ list_for_each_entry_safe (zldpll, next, &zldev->dplls, list) { -zl3073x_dpll_unregister (zldpll);list_del (&zldpll->list);zl3073x_dpll_free (zldpll); }
@@ -839,7 +960,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls)INIT_LIST_HEAD (&zldev->dplls); -/* Initialize all DPLLs */ +/* Allocate all DPLLs */ for (i =0 ; i < num_dplls; i++) { zldpll =zl3073x_dpll_alloc (zldev, i);if (IS_ERR (zldpll)) {
@@ -849,25 +970,9 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) goto error; } - rc =zl3073x_dpll_register (zldpll); -if (rc) { -dev_err_probe (zldev->dev, rc, -"Failed to register DPLL%u\n" , i); -zl3073x_dpll_free (zldpll); - goto error; - } -list_add_tail (&zldpll->list, &zldev->dplls); } -/* Perform initial firmware fine phase correction */ - rc =zl3073x_dpll_init_fine_phase_adjust (zldev); -if (rc) { -dev_err_probe (zldev->dev, rc, -"Failed to init fine phase correction\n" ); - goto error; - } -/* Initialize monitoring thread */ kthread_init_delayed_work (&zldev->work, zl3073x_dev_periodic_work); kworker =kthread_run_worker (0 ,"zl3073x-%s" ,dev_name (zldev->dev));
@@ -875,9 +980,14 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) rc =PTR_ERR (kworker); goto error; } - zldev->kworker = kworker; -kthread_queue_delayed_work (zldev->kworker, &zldev->work,0 ); + +/* Start normal operation */ + rc =zl3073x_dev_start (zldev, true); +if (rc) { +dev_err_probe (zldev->dev, rc,"Failed to start device\n" ); + goto error; + }/* Add devres action to release DPLL related resources */ rc =devm_add_action_or_reset (zldev->dev, zl3073x_dev_dpll_fini, zldev);
@@ -892,46 +1002,6 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls)return rc; } -/** -* zl3073x_dev_phase_meas_setup - setup phase offset measurement -* @zldev: pointer to zl3073x_dev structure -* @num_channels: number of DPLL channels -* -* Enable phase offset measurement block, set measurement averaging factor -* and enable DPLL-to-its-ref phase measurement for all DPLLs. -* -* Returns: 0 on success, <0 on error -*/ -static int -zl3073x_dev_phase_meas_setup (struct zl3073x_dev *zldev,int num_channels) -{ -u8 dpll_meas_ctrl, mask; -int i, rc; - -/* Read DPLL phase measurement control register */ - rc =zl3073x_read_u8 (zldev,ZL_REG_DPLL_MEAS_CTRL , &dpll_meas_ctrl); -if (rc) -return rc; - -/* Setup phase measurement averaging factor */ - dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR ; - dpll_meas_ctrl |=FIELD_PREP (ZL_DPLL_MEAS_CTRL_AVG_FACTOR ,3 ); - -/* Enable DPLL measurement block */ - dpll_meas_ctrl |=ZL_DPLL_MEAS_CTRL_EN ; - -/* Update phase measurement control register */ - rc =zl3073x_write_u8 (zldev,ZL_REG_DPLL_MEAS_CTRL , dpll_meas_ctrl); -if (rc) -return rc; - -/* Enable DPLL-to-connected-ref measurement for each channel */ -for (i =0 , mask =0 ; i < num_channels; i++) - mask |=BIT (i); - -return zl3073x_write_u8 (zldev,ZL_REG_DPLL_PHASE_ERR_READ_MASK , mask); -} -/** * zl3073x_dev_probe - initialize zl3073x device * @zldev: pointer to zl3073x device
@@ -999,17 +1069,6 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev,return dev_err_probe (zldev->dev, rc,"Failed to initialize mutex\n" ); -/* Fetch device state */ - rc =zl3073x_dev_state_fetch (zldev); -if (rc) -return rc; - -/* Setup phase offset measurement block */ - rc =zl3073x_dev_phase_meas_setup (zldev, chip_info->num_channels); -if (rc) -return dev_err_probe (zldev->dev, rc, -"Failed to setup phase measurement\n" ); -/* Register DPLL channels */ rc =zl3073x_devm_dpll_init (zldev, chip_info->num_channels);if (rc)
drivers/dpll/zl3073x/core.h +3 -0
@@ -111,6 +111,9 @@ struct zl3073x_dev *zl3073x_devm_alloc(struct device *dev);int zl3073x_dev_probe (struct zl3073x_dev *zldev,const struct zl3073x_chip_info *chip_info); +int zl3073x_dev_start (struct zl3073x_dev *zldev,bool full); +void zl3073x_dev_stop (struct zl3073x_dev *zldev); +/********************** * Registers operations **********************/
drivers/dpll/zl3073x/devlink.c +6 -12
@@ -86,14 +86,12 @@ zl3073x_devlink_reload_down(struct devlink *devlink, bool netns_change, struct netlink_ext_ack *extack) {struct zl3073x_dev *zldev =devlink_priv (devlink); -struct zl3073x_dpll *zldpll;if (action !=DEVLINK_RELOAD_ACTION_DRIVER_REINIT )return -EOPNOTSUPP ; -/* Unregister all DPLLs */ -list_for_each_entry (zldpll, &zldev->dplls, list) -zl3073x_dpll_unregister (zldpll); +/* Stop normal operation */ +zl3073x_dev_stop (zldev);return 0 ; }
@@ -107,7 +105,6 @@ zl3073x_devlink_reload_up(struct devlink *devlink, {struct zl3073x_dev *zldev =devlink_priv (devlink);union devlink_param_value val; -struct zl3073x_dpll *zldpll;int rc;if (action !=DEVLINK_RELOAD_ACTION_DRIVER_REINIT )
@@ -125,13 +122,10 @@ zl3073x_devlink_reload_up(struct devlink *devlink, zldev->clock_id = val.vu64; } -/* Re-register all DPLLs */ -list_for_each_entry (zldpll, &zldev->dplls, list) { - rc =zl3073x_dpll_register (zldpll); -if (rc) -dev_warn (zldev->dev, -"Failed to re-register DPLL%u\n" , zldpll->id); - } +/* Restart normal operation */ + rc =zl3073x_dev_start (zldev, false); +if (rc) +dev_warn (zldev->dev,"Failed to re-start normal operation\n" ); *actions_performed =BIT (DEVLINK_RELOAD_ACTION_DRIVER_REINIT );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/159 dpll: zl3073x: Handle missing or corrupted flash configuration
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit fcb8b32a68fd40b0440cb9468cf6f6ab9de9f3c5 ]
If the internal flash contains missing or corrupted configuration, basic communication over the bus still functions, but the device is not capable of normal operation (for example, using mailboxes).
This condition is indicated in the info register by the ready bit. If this bit is cleared, the probe procedure times out while fetching the device state.
Handle this case by checking the ready bit value in zl3073x_dev_start() and skipping DPLL device and pin registration if it is cleared. Do not report this condition as an error, allowing the devlink device to be registered and enabling the user to flash the correct configuration.
Prior this patch:
[ 31.112299] zl3073x-i2c 1-0070: Failed to fetch input state: -ETIMEDOUT [ 31.116332] zl3073x-i2c 1-0070: error -ETIMEDOUT: Failed to start device [ 31.136881] zl3073x-i2c 1-0070: probe with driver zl3073x-i2c failed with error -110
After this patch:
[ 41.011438] zl3073x-i2c 1-0070: FW not fully ready - missing or corrupted config
--- drivers/dpll/zl3073x/core.c | 21 +++++++++++++++++++++ drivers/dpll/zl3073x/regs.h | 3 +++ 2 files changed, 24 insertions(+)
drivers/dpll/zl3073x/core.c +21 -0
@@ -864,8 +864,29 @@ zl3073x_dev_phase_meas_setup(struct zl3073x_dev *zldev)int zl3073x_dev_start (struct zl3073x_dev *zldev,bool full) {struct zl3073x_dpll *zldpll; +u8 info;int rc; + rc =zl3073x_read_u8 (zldev,ZL_REG_INFO , &info); +if (rc) { +dev_err (zldev->dev,"Failed to read device status info\n" ); +return rc; + } + +if (!FIELD_GET (ZL_INFO_READY , info)) { +/* The ready bit indicates that the firmware was successfully +* configured and is ready for normal operation. If it is +* cleared then the configuration stored in flash is wrong +* or missing. In this situation the driver will expose +* only devlink interface to give an opportunity to flash +* the correct config. +*/ +dev_info (zldev->dev, +"FW not fully ready - missing or corrupted config\n" ); + +return 0 ; + } +if (full) {/* Fetch device state */ rc =zl3073x_dev_state_fetch (zldev);
drivers/dpll/zl3073x/regs.h +3 -0
@@ -67,6 +67,9 @@* Register Page 0, General **************************/ +#define ZL_REG_INFO ZL_REG(0, 0x00, 1) +#define ZL_INFO_READY BIT(7) +#define ZL_REG_ID ZL_REG(0, 0x01, 2)#define ZL_REG_REVISION ZL_REG(0, 0x03, 2)#define ZL_REG_FW_VER ZL_REG(0, 0x05, 2)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/159 r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming packets. Packet captures show messages like "IP truncated-ip - 146 bytes missing!".
The issue is caused by RxConfig not being properly re-initialized after resume. Re-initializing the RxConfig register before the chip re-initialization sequence avoids the truncation and restores correct packet reception.
This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data corruption issue on RTL8402").
--- drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -2
@@ -4994,8 +4994,9 @@ static int rtl8169_resume(struct device *device)if (!device_may_wakeup (tp_to_dev (tp)))clk_prepare_enable (tp->clk); -/* Reportedly at least Asus X453MA truncates packets otherwise */ -if (tp->mac_version ==RTL_GIGA_MAC_VER_37 ) +/* Some chip versions may truncate packets without this initialization */ +if (tp->mac_version ==RTL_GIGA_MAC_VER_37 || + tp->mac_version ==RTL_GIGA_MAC_VER_46 )rtl_init_rxcfg (tp);return rtl8169_runtime_resume (device);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/159 net: phy: bcm54811: Fix GMII/MII/MII-Lite selection
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Horák - 2N <[email protected]>
[ Upstream commit e4d0c909bf8328d986bf3aadba0c33a72b5ae30d ]
The Broadcom bcm54811 is hardware-strapped to select among RGMII and GMII/MII/MII-Lite modes. However, the corresponding bit, RGMII Enable in Miscellaneous Control Register must be also set to select desired RGMII or MII(-lite)/GMII mode.
--- drivers/net/phy/broadcom.c | 20 +++++++++++++++++++- include/linux/brcmphy.h | 1 + 2 files changed, 20 insertions(+), 1 deletion(-)
drivers/net/phy/broadcom.c +19 -1
@@ -407,7 +407,7 @@ static int bcm5481x_set_brrmode(struct phy_device *phydev, bool on)static int bcm54811_config_init (struct phy_device *phydev) {struct bcm54xx_phy_priv *priv = phydev->priv; -int err, reg, exp_sync_ethernet; +int err, reg, exp_sync_ethernet, aux_rgmii_en;/* Enable CLK125 MUX on LED4 if ref clock is enabled. */ if (!(phydev->dev_flags &PHY_BRCM_RX_REFCLK_UNUSED )) {
@@ -436,6 +436,24 @@ static int bcm54811_config_init(struct phy_device *phydev)if (err <0 )return err; +/* Enable RGMII if configured */ +if (phy_interface_is_rgmii (phydev)) + aux_rgmii_en =MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN | +MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN ; +else + aux_rgmii_en =0 ; + +/* Also writing Reserved bits 6:5 because the documentation requires +* them to be written to 0b11 +*/ + err =bcm54xx_auxctl_write (phydev, +MII_BCM54XX_AUXCTL_SHDWSEL_MISC , +MII_BCM54XX_AUXCTL_MISC_WREN | + aux_rgmii_en | +MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RSVD ); +if (err <0 ) +return err; +return bcm5481x_set_brrmode (phydev, priv->brr_mode); }
include/linux/brcmphy.h +1 -0
@@ -137,6 +137,7 @@#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC 0x07#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN 0x0010 +#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RSVD 0x0060#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN 0x0080#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN 0x0100#define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX 0x0200
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/159 net/ip6_tunnel: Prevent perpetual tunnel growth
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling.
Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer.
--- include/net/ip_tunnels.h | 15 +++++++++++++++ net/ipv4/ip_tunnel.c | 14 -------------- net/ipv6/ip6_tunnel.c | 3 +-- 3 files changed, 16 insertions(+), 16 deletions(-)
include/net/ip_tunnels.h +15 -0
@@ -609,6 +609,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,int skb_tunnel_check_pmtu (struct sk_buff *skb,struct dst_entry *encap_dst,int headroom,bool reply); +static inline void ip_tunnel_adj_headroom (struct net_device *dev, +unsigned int headroom) +{ +/* we must cap headroom to some upperlimit, else pskb_expand_head +* will overflow header offsets in skb_headers_offset_update(). +*/ +const unsigned int max_allowed =512 ; + +if (headroom > max_allowed) + headroom = max_allowed; + +if (headroom >READ_ONCE (dev->needed_headroom)) +WRITE_ONCE (dev->needed_headroom, headroom); +} +int iptunnel_handle_offloads (struct sk_buff *skb,int gso_type_mask);static inline int iptunnel_pull_offloads (struct sk_buff *skb)
net/ipv4/ip_tunnel.c +0 -14
@@ -568,20 +568,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,return 0 ; } -static void ip_tunnel_adj_headroom (struct net_device *dev,unsigned int headroom) -{ -/* we must cap headroom to some upperlimit, else pskb_expand_head -* will overflow header offsets in skb_headers_offset_update(). -*/ -static const unsigned int max_allowed =512 ; - -if (headroom > max_allowed) - headroom = max_allowed; - -if (headroom >READ_ONCE (dev->needed_headroom)) -WRITE_ONCE (dev->needed_headroom, headroom); -} -void ip_md_tunnel_xmit (struct sk_buff *skb,struct net_device *dev,u8 proto,int tunnel_hlen) {
net/ipv6/ip6_tunnel.c +1 -2
@@ -1257,8 +1257,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,*/ max_headroom =LL_RESERVED_SPACE (tdev) +sizeof (struct ipv6hdr ) + dst->header_len + t->hlen; -if (max_headroom >READ_ONCE (dev->needed_headroom)) -WRITE_ONCE (dev->needed_headroom, max_headroom); +ip_tunnel_adj_headroom (dev, max_headroom); err =ip6_tnl_encap (skb, t, &proto, fl6);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/159 idpf: cleanup remaining SKBs in PTP flows
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milena Olech <[email protected]>
[ Upstream commit a3f8c0a273120fd2638f03403e786c3de2382e72 ]
When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skb_get. It increases the reference counter for that SKB to prevent unexpected freeing by another component. However, there may be a case where the index is requested, SKB is assigned and never consumed by PTP flows - for example due to reset during running PTP apps.
Add a check in release timestamping function to verify if the SKB assigned to Tx timestamp latch was freed, and release remaining SKBs.
--- drivers/net/ethernet/intel/idpf/idpf_ptp.c | 3 +++ drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | 1 + 2 files changed, 4 insertions(+)
drivers/net/ethernet/intel/idpf/idpf_ptp.c +3 -0
@@ -855,6 +855,9 @@ static void idpf_ptp_release_vport_tstamp(struct idpf_vport *vport) head = &vport->tx_tstamp_caps->latches_in_use;list_for_each_entry_safe (ptp_tx_tstamp, tmp, head, list_member) {list_del (&ptp_tx_tstamp->list_member); +if (ptp_tx_tstamp->skb) +consume_skb (ptp_tx_tstamp->skb); +kfree (ptp_tx_tstamp); }
drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c +1 -0
@@ -517,6 +517,7 @@ idpf_ptp_get_tstamp_value(struct idpf_vport *vport, shhwtstamps.hwtstamp =ns_to_ktime (tstamp);skb_tstamp_tx (ptp_tx_tstamp->skb, &shhwtstamps);consume_skb (ptp_tx_tstamp->skb); + ptp_tx_tstamp->skb =NULL ;list_add (&ptp_tx_tstamp->list_member, &tx_tstamp_caps->latches_free);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/159 ixgbe: fix too early devlink_free() in ixgbe_remove()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit 5feef67b646d8f5064bac288e22204ffba2b9a4a ]
Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end.
KASAN report:
BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace: show_stack+0x30/0x90 (C) dump_stack_lvl+0x9c/0xd0 print_address_description.constprop.0+0x90/0x310 print_report+0x104/0x1f0 kasan_report+0x88/0x180 __asan_report_load8_noabort+0x20/0x30 ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe] ixgbe_remove+0x2d0/0x8c0 [ixgbe] pci_device_remove+0xa0/0x220 device_remove+0xb8/0x170 device_release_driver_internal+0x318/0x490 device_driver_detach+0x40/0x68 unbind_store+0xec/0x118 drv_attr_store+0x64/0xb8 sysfs_kf_write+0xcc/0x138 kernfs_fop_write_iter+0x294/0x440 new_sync_write+0x1fc/0x588 vfs_write+0x480/0x6a0 ksys_write+0xf0/0x1e0 __arm64_sys_write+0x70/0xc0 invoke_syscall.constprop.0+0xcc/0x280 el0_svc_common.constprop.0+0xa8/0x248 do_el0_svc+0x44/0x68 el0_svc+0x54/0x160 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +2 -1
@@ -12091,7 +12091,6 @@ static void ixgbe_remove(struct pci_dev *pdev)devl_port_unregister (&adapter->devlink_port);devl_unlock (adapter->devlink); -devlink_free (adapter->devlink);ixgbe_stop_ipsec_offload (adapter);ixgbe_clear_interrupt_scheme (adapter);
@@ -12127,6 +12126,8 @@ static void ixgbe_remove(struct pci_dev *pdev)if (disable_dev)pci_disable_device (pdev); + +devlink_free (adapter->devlink); }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/159 net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 2c67301584f2671e320236df6bbe75ae09feb4d0 ]
The driver is currently checking for PHYCR2 register presence in rtl8211f_config_init(), but it does so after accessing PHYCR2 to disable EEE. This was introduced in commit bfc17c165835 ("net:
phy: realtek: disable PHY-mode EEE"). Move the PHYCR2 presence test before the EEE disablement and simplify the code.
--- drivers/net/phy/realtek/realtek_main.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
drivers/net/phy/realtek/realtek_main.c +11 -12
@@ -589,26 +589,25 @@ static int rtl8211f_config_init(struct phy_device *phydev) str_enabled_disabled(val_rxdly)); } +if (!priv->has_phycr2) +return 0 ; +/* Disable PHY-mode EEE so LPI is passed to the MAC */ ret =phy_modify_paged (phydev,RTL8211F_PHYCR_PAGE ,RTL8211F_PHYCR2 ,RTL8211F_PHYCR2_PHY_EEE_ENABLE ,0 );if (ret)return ret; -if (priv->has_phycr2) { - ret =phy_modify_paged (phydev,RTL8211F_PHYCR_PAGE , -RTL8211F_PHYCR2 ,RTL8211F_CLKOUT_EN , - priv->phycr2); -if (ret <0 ) { -dev_err (dev,"clkout configuration failed: %pe\n" , -ERR_PTR (ret)); -return ret; - } - -return genphy_soft_reset (phydev); + ret =phy_modify_paged (phydev,RTL8211F_PHYCR_PAGE , +RTL8211F_PHYCR2 ,RTL8211F_CLKOUT_EN , + priv->phycr2); +if (ret <0 ) { +dev_err (dev,"clkout configuration failed: %pe\n" , +ERR_PTR (ret)); +return ret; } -return 0 ; +return genphy_soft_reset (phydev); }static int rtl821x_suspend (struct phy_device *phydev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/159 amd-xgbe: Avoid spurious link down messages during interface toggle
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
During interface toggle operations (ifdown/ifup), the driver currently resets the local helper variable 'phy_link' to -1. This causes the link state machine to incorrectly interpret the state as a link change event, resulting in spurious "Link is down" messages being logged when the interface is brought back up.
Preserve the phy_link state across interface toggles to avoid treating the -1 sentinel value as a legitimate link state transition.
--- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/amd/xgbe/xgbe-drv.c +0 -1
@@ -1065,7 +1065,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)static int xgbe_phy_reset (struct xgbe_prv_data *pdata) { - pdata->phy_link =-1 ; pdata->phy_speed =SPEED_UNKNOWN ;return pdata->phy_if.phy_reset (pdata);
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +1 -0
@@ -1555,6 +1555,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) pdata->phy.duplex =DUPLEX_FULL ; } + pdata->phy_link =0 ; pdata->phy.link =0 ; pdata->phy.pause_autoneg = pdata->pause_autoneg;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/159 Octeontx2-af: Fix missing error code in cgx_probe()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit c5705a2a4aa35350e504b72a94b5c71c3754833c ]
When CGX fails mapping to NIX, set the error code to -ENODEV, currently err is zero and that is treated as success path.
--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +1 -0
@@ -1981,6 +1981,7 @@ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id) !is_cgx_mapped_to_nix(pdev->subsystem_device, cgx->cgx_id)) {dev_notice (dev,"CGX %d not mapped to NIX, skipping probe\n" , cgx->cgx_id); + err = -ENODEV ; goto err_release_regions; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/159 usbnet: Fix using smp_processor_id() in preemptible code warnings
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 ]
Syzbot reported the following warning:
BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 __dev_set_mtu net/core/dev.c:9443 [inline] netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 sock_do_ioctl+0x19d/0x280 net/socket.c:1204 sock_ioctl+0x42f/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
For historical and portability reasons, the netif_rx() is usually run in the softirq or interrupt context, this commit therefore add local_bh_disable/enable() protection in the usbnet_resume_rx().
--- drivers/net/usb/usbnet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/usbnet.c +2 -0
@@ -702,6 +702,7 @@ void usbnet_resume_rx(struct usbnet *dev)struct sk_buff *skb;int num =0 ; +local_bh_disable ();clear_bit (EVENT_RX_PAUSED , &dev->flags);while ((skb =skb_dequeue (&dev->rxq_pause)) !=NULL ) {
@@ -710,6 +711,7 @@ void usbnet_resume_rx(struct usbnet *dev) }queue_work (system_bh_wq, &dev->bh_work); +local_bh_enable ();netif_dbg (dev, rx_status, dev->net,"paused rx queue disabled, %d skbs requeued\n" , num);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/159 tcp: fix tcp_tso_should_defer() vs large RTT
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
Neal reported that using neper tcp_stream with TCP_TX_DELAY set to 50ms would often lead to flows stuck in a small cwnd mode, regardless of the congestion control.
While tcp_stream sets TCP_TX_DELAY too late after the connect(), it highlighted two kernel bugs.
The following heuristic in tcp_tso_should_defer() seems wrong for large RTT:
delta = tp->tcp_clock_cache - head->tstamp;
/* If next ACK is likely to come too late (half srtt), do not defer */ if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
goto send_now;
If next ACK is expected to come in more than 1 ms, we should not defer because we prefer a smooth ACK clocking.
While blamed commit was a step in the good direction, it was not generic enough.
Another patch fixing TCP_TX_DELAY for established flows will be proposed when net-next reopens.
--- net/ipv4/tcp_output.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
net/ipv4/tcp_output.c +15 -4
@@ -2219,7 +2219,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, u32 max_segs) {const struct inet_connection_sock *icsk =inet_csk (sk); -u32 send_win, cong_win, limit, in_flight; +u32 send_win, cong_win, limit, in_flight, threshold; +u64 srtt_in_ns, expected_ack, how_far_is_the_ack;struct tcp_sock *tp =tcp_sk (sk);struct sk_buff *head;int win_divisor;
@@ -2281,9 +2282,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, head =tcp_rtx_queue_head (sk);if (!head) goto send_now; - delta = tp->tcp_clock_cache - head->tstamp; -/* If next ACK is likely to come too late (half srtt), do not defer */ -if ((s64)(delta - (u64 )NSEC_PER_USEC * (tp->srtt_us >>4 )) <0 ) + + srtt_in_ns = (u64)(NSEC_PER_USEC >>3 ) * tp->srtt_us; +/* When is the ACK expected ? */ + expected_ack = head->tstamp + srtt_in_ns; +/* How far from now is the ACK expected ? */ + how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; + +/* If next ACK is likely to come too late, +* ie in more than min(1ms, half srtt), do not defer. +*/ + threshold =min (srtt_in_ns >>1 ,NSEC_PER_MSEC ); + +if ((s64)(how_far_is_the_ack - threshold) >0 ) goto send_now;/* Ok, it looks like it is advisable to defer.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/159 net: airoha: Take into account out-of-order tx completions in airoha_dev_xmit()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit bd5afca115f181c85f992d42a57cd497bc823ccb ]
Completion napi can free out-of-order tx descriptors if hw QoS is enabled and packets with different priority are queued to same DMA ring. Take into account possible out-of-order reports checking if the tx queue is full using circular buffer head/tail pointer instead of the number of queued packets.
--- drivers/net/ethernet/airoha/airoha_eth.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/net/ethernet/airoha/airoha_eth.c +15 -1
@@ -1872,6 +1872,20 @@ static u32 airoha_get_dsa_tag(struct sk_buff *skb, struct net_device *dev)#endif } +static bool airoha_dev_tx_queue_busy (struct airoha_queue *q,u32 nr_frags) +{ +u32 tail = q->tail <= q->head ? q->tail + q->ndesc : q->tail; +u32 index = q->head + nr_frags; + +/* completion napi can free out-of-order tx descriptors if hw QoS is +* enabled and packets with different priorities are queued to the same +* DMA ring. Take into account possible out-of-order reports checking +* if the tx queue is full using circular buffer head/tail pointers +* instead of the number of queued packets. +*/ +return index >= tail; +} +static netdev_tx_t airoha_dev_xmit (struct sk_buff *skb,struct net_device *dev) {
@@ -1925,7 +1939,7 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, txq =netdev_get_tx_queue (dev, qid); nr_frags =1 +skb_shinfo (skb)->nr_frags; -if (q->queued + nr_frags > q->ndesc) { +if (airoha_dev_tx_queue_busy (q, nr_frags)) {/* not enough space in the queue */ netif_tx_stop_queue (txq);spin_unlock_bh (&q->lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/159 selftests: net: check jq command is supported
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit 4f86eb0a38bc719ba966f155071a6f0594327f34 ]
The jq command is used in vlan_bridge_binding.sh, if it is not supported, the test will spam the following log.
# ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found
# TEST: Test bridge_binding on->off when lower down [FAIL]
# Got operstate of , expected 0
The rtnetlink.sh has the same problem. It makes sense to check if jq is installed before running these tests. After this patch, the vlan_bridge_binding.sh skipped if jq is not supported:
# timeout set to 3600 # selftests: net: vlan_bridge_binding.sh # TEST: jq not installed [SKIP]
--- tools/testing/selftests/net/rtnetlink.sh | 2 ++ tools/testing/selftests/net/vlan_bridge_binding.sh | 2 ++ 2 files changed, 4 insertions(+)
tools/testing/selftests/net/rtnetlink.sh +2 -0
@@ -1453,6 +1453,8 @@ usage: ${0##*/} OPTS EOF } +require_command jq + #check for needed privileges if [ "$(id -u)" -ne 0 ];then end_test "SKIP: Need root privileges"
tools/testing/selftests/net/vlan_bridge_binding.sh +2 -0
@@ -249,6 +249,8 @@ test_binding_toggle_off_when_upper_down() do_test_binding_off : "on->off when upper down" } +require_command jq + trap defer_scopes_cleanup EXIT setup_prepare tests_run
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/159 net: core: fix lockdep splat on device unregister
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 7f0fddd817ba6daebea1445ae9fab4b6d2294fa8 ]
Since blamed commit, unregister_netdevice_many_notify() takes the netdev mutex if the device needs it.
If the device list is too long, this will lock more device mutexes than lockdep can handle:
unshare -n \
bash -c 'for i in $(seq 1 100);do ip link add foo$i type dummy;done'
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48 max: 48!
48 locks held by kworker/u16:1/69:
#0: ..148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work
#1: ..d40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work
#2: ..bd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net
#3: ..aa8 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch
#4: ..cb0 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify
[..]
Add a helper to close and then unlock a list of net_devices. Devices that are not up have to be skipped - netif_close_many always removes them from the list without any other actions taken, so they'd remain in locked state.
Close devices whenever we've used up half of the tracking slots or we processed entire list without hitting the limit.
--- net/core/dev.c | 40 +++++++++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 5 deletions(-)
net/core/dev.c +35 -5
@@ -12088,6 +12088,35 @@ static void dev_memory_provider_uninstall(struct net_device *dev) } } +/* devices must be UP and netdev_lock()'d */ +static void netif_close_many_and_unlock (struct list_head *close_head) +{ +struct net_device *dev, *tmp; + +netif_close_many (close_head, false); + +/* ... now unlock them */ +list_for_each_entry_safe (dev, tmp, close_head, close_list) { +netdev_unlock (dev); +list_del_init (&dev->close_list); + } +} + +static void netif_close_many_and_unlock_cond (struct list_head *close_head) +{ +#ifdef CONFIG_LOCKDEP +/* We can only track up to MAX_LOCK_DEPTH locks per task. +* +* Reserve half the available slots for additional locks possibly +* taken by notifiers and (soft)irqs. +*/ +unsigned int limit =MAX_LOCK_DEPTH /2 ; + +if (lockdep_depth (current) > limit) +netif_close_many_and_unlock (close_head); +#endif +} +void unregister_netdevice_many_notify (struct list_head *head,u32 portid,const struct nlmsghdr *nlh) {
@@ -12120,17 +12149,18 @@ void unregister_netdevice_many_notify(struct list_head *head,/* If device is running, close it first. Start with ops locked... */ list_for_each_entry (dev, head, unreg_list) { +if (!(dev->flags &IFF_UP )) +continue ;if (netdev_need_ops_lock (dev)) {list_add_tail (&dev->close_list, &close_head);netdev_lock (dev); } +netif_close_many_and_unlock_cond (&close_head); } -netif_close_many (&close_head, true); -/* ... now unlock them and go over the rest. */ +netif_close_many_and_unlock (&close_head); +/* ... now go over the rest. */ list_for_each_entry (dev, head, unreg_list) { -if (netdev_need_ops_lock (dev)) -netdev_unlock (dev); -else +if (!netdev_need_ops_lock (dev))list_add_tail (&dev->close_list, &close_head); }netif_close_many (&close_head, true);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/159 ksmbd: fix recursive locking in RPC handle list access
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marios Makassikis <[email protected]>
[ Upstream commit 88f170814fea74911ceab798a43cbd7c5599bed4 ]
Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.
This causes hung connections / tasks when a client attempts to open a named pipe. Using Samba's rpcclient tool:
$ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo <connection hung here>
Kernel side:
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000
Workqueue: ksmbd-io handle_ksmbd_work Call trace: __schedule from schedule+0x3c/0x58 schedule from schedule_preempt_disabled+0xc/0x10 schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 rwsem_down_read_slowpath from down_read+0x28/0x30 down_read from ksmbd_session_rpc_method+0x18/0x3c ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 create_smb2_pipe from smb2_open+0x10c/0x27ac smb2_open from handle_ksmbd_work+0x238/0x3dc handle_ksmbd_work from process_scheduled_works+0x160/0x25c process_scheduled_works from worker_thread+0x16c/0x1e8 worker_thread from kthread+0xa8/0xb8 kthread from ret_from_fork+0x14/0x38 Exception stack(0x8529ffb0 to 0x8529fff8)
The task deadlocks because the lock is already held:
ksmbd_session_rpc_open
down_write(&sess->rpc_lock)
ksmbd_rpc_open
ksmbd_session_rpc_method
down_read(&sess->rpc_lock) <-- deadlockAdjust ksmbd_session_rpc_method() callers to take the lock when necessary.
--- fs/smb/server/mgmt/user_session.c | 7 ++----- fs/smb/server/smb2pdu.c | 9 ++++++++- fs/smb/server/transport_ipc.c | 12 ++++++++++++ 3 files changed, 22 insertions(+), 6 deletions(-)
fs/smb/server/mgmt/user_session.c +2 -5
@@ -147,14 +147,11 @@ void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id)int ksmbd_session_rpc_method (struct ksmbd_session *sess,int id) {struct ksmbd_session_rpc *entry; -int method; -down_read (&sess->rpc_lock); +lockdep_assert_held (&sess->rpc_lock); entry =xa_load (&sess->rpc_handle_list, id); - method = entry ? entry->method :0 ; -up_read (&sess->rpc_lock); -return method; +return entry ? entry->method :0 ; }void ksmbd_session_destroy (struct ksmbd_session *sess)
fs/smb/server/smb2pdu.c +8 -1
@@ -4624,8 +4624,15 @@ static int smb2_get_info_file_pipe(struct ksmbd_session *sess,* pipe without opening it, checking error condition here */ id = req->VolatileFileId; -if (!ksmbd_session_rpc_method (sess, id)) + +lockdep_assert_not_held (&sess->rpc_lock); + +down_read (&sess->rpc_lock); +if (!ksmbd_session_rpc_method (sess, id)) { +up_read (&sess->rpc_lock);return -ENOENT ; + } +up_read (&sess->rpc_lock);ksmbd_debug (SMB ,"FileInfoClass %u, FileId 0x%llx\n" , req->FileInfoClass, req->VolatileFileId);
fs/smb/server/transport_ipc.c +12 -0
@@ -825,6 +825,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handleif (!msg)return NULL ; +lockdep_assert_not_held (&sess->rpc_lock); + +down_read (&sess->rpc_lock); msg->type =KSMBD_EVENT_RPC_REQUEST ; req = (struct ksmbd_rpc_command *)msg->payload; req->handle = handle;
@@ -833,6 +836,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle req->flags |=KSMBD_RPC_WRITE_METHOD ; req->payload_sz = payload_sz;memcpy (req->payload, payload, payload_sz); +up_read (&sess->rpc_lock); resp =ipc_msg_send_request (msg, req->handle);ipc_msg_free (msg);
@@ -849,6 +853,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle)if (!msg)return NULL ; +lockdep_assert_not_held (&sess->rpc_lock); + +down_read (&sess->rpc_lock); msg->type =KSMBD_EVENT_RPC_REQUEST ; req = (struct ksmbd_rpc_command *)msg->payload; req->handle = handle;
@@ -856,6 +863,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle) req->flags |=rpc_context_flags (sess); req->flags |=KSMBD_RPC_READ_METHOD ; req->payload_sz =0 ; +up_read (&sess->rpc_lock); resp =ipc_msg_send_request (msg, req->handle);ipc_msg_free (msg);
@@ -876,6 +884,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handleif (!msg)return NULL ; +lockdep_assert_not_held (&sess->rpc_lock); + +down_read (&sess->rpc_lock); msg->type =KSMBD_EVENT_RPC_REQUEST ; req = (struct ksmbd_rpc_command *)msg->payload; req->handle = handle;
@@ -884,6 +895,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle req->flags |=KSMBD_RPC_IOCTL_METHOD ; req->payload_sz = payload_sz;memcpy (req->payload, payload, payload_sz); +up_read (&sess->rpc_lock); resp =ipc_msg_send_request (msg, req->handle);ipc_msg_free (msg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/159 tg3: prevent use of uninitialized remote_adv and local_adv variables
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Simakov <[email protected]>
[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
Some execution paths that jump to the fiber_setup_done label could leave the remote_adv and local_adv variables uninitialized and then use it.
Initialize this variables at the point of definition to avoid this.
--- drivers/net/ethernet/broadcom/tg3.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +1 -4
@@ -5803,7 +5803,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)u32 current_speed =SPEED_UNKNOWN ;u8 current_duplex =DUPLEX_UNKNOWN ;bool current_link_up = false; -u32 local_adv, remote_adv, sgsr; +u32 local_adv =0 , remote_adv =0 , sgsr; if ((tg3_asic_rev(tp) == ASIC_REV_5719 || tg3_asic_rev(tp) == ASIC_REV_5720) &&
@@ -5944,9 +5944,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)else current_duplex =DUPLEX_HALF ; - local_adv =0 ; - remote_adv =0 ; -if (bmcr &BMCR_ANENABLE ) {u32 common;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/159 tls: trim encrypted message to match the plaintext on short splice
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit ce5af41e3234425a40974696682163edfd21128c ]
During tls_sw_sendmsg_locked, we pre-allocate the encrypted message for the size we're expecting to send during the current iteration, but we may end up sending less, for example when splicing: if we're getting the data from small fragments of memory, we may fill up all the slots in the skmsg with less data than expected.
In this case, we need to trim the encrypted message to only the length we actually need, to avoid pushing uninitialized bytes down the underlying TCP socket.
--- net/tls/tls_sw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/tls/tls_sw.c +4 -1
@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, goto send_end; tls_ctx->pending_open_record_frags = true; -if (sk_msg_full (msg_pl)) +if (sk_msg_full (msg_pl)) { full_record = true; +sk_msg_trim (sk, msg_en, + msg_pl->sg.size + prot->overhead_size); + }if (full_record || eor) goto copied;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/159 tls: wait for async encrypt in case of error during latter iterations of sendmsg
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ]
If we hit an error during the main loop of tls_sw_sendmsg_locked (eg failed allocation), we jump to send_end and immediately return. Previous iterations may have queued async encryption requests that are still pending. We should wait for those before returning, as we could otherwise be reading from memory that userspace believes we're not using anymore, which would be a sort of use-after-free.
This is similar to what tls_sw_recvmsg already does: failures during the main loop jump to the "wait for async" code, not straight to the unlock/return.
--- net/tls/tls_sw.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/tls/tls_sw.c +4 -3
@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,if (ret == -EINPROGRESS ) num_async++;else if (ret != -EAGAIN ) - goto send_end; + goto end; } }
@@ -1226,8 +1226,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, goto alloc_encrypted; } +send_end:if (!num_async) { - goto send_end; + goto end; }else if (num_zc || eor) {int err;
@@ -1245,7 +1246,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,tls_tx_records (sk, msg->msg_flags); } -send_end: +end: ret =sk_stream_error (sk, msg->msg_flags, ret);return copied >0 ? copied : ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/159 tls: always set record_type in tls_process_cmsg
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
When userspace wants to send a non-DATA record (via the TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a previous MSG_MORE send() as a separate DATA record. If that DATA record is encrypted asynchronously, tls_handle_open_record will return -EINPROGRESS. This is currently treated as an error by tls_process_cmsg, and it will skip setting record_type to the correct value, but the caller (tls_sw_sendmsg_locked) handles that return value correctly and proceeds with sending the new message with an incorrect record_type (DATA instead of whatever was requested in the cmsg).
Always set record_type before handling the open record. If tls_handle_open_record returns an error, record_type will be ignored. If it succeeds, whether with synchronous crypto (returning 0) or asynchronous (returning -EINPROGRESS), the caller will proceed correctly.
--- net/tls/tls_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/tls/tls_main.c +2 -5
@@ -255,12 +255,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg,if (msg->msg_flags &MSG_MORE )return -EINVAL ; - rc =tls_handle_open_record (sk, msg->msg_flags); -if (rc) -return rc; - *record_type = *(unsigned char *)CMSG_DATA (cmsg); - rc =0 ; + + rc =tls_handle_open_record (sk, msg->msg_flags);break ;default :return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/159 tls: wait for pending async decryptions if tls_strp_msg_hold fails
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ]
Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decryption can lead to various issues (UAF on the skb, writing into userspace memory after the recv() call has returned).
In this case, wait for all pending decryption requests.
--- net/tls/tls_sw.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/tls/tls_sw.c +4 -2
@@ -1641,8 +1641,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,if (unlikely (darg->async)) { err =tls_strp_msg_hold (&ctx->strp, &ctx->async_hold); -if (err) -__skb_queue_tail (&ctx->async_hold, darg->skb); +if (err) { + err =tls_decrypt_async_wait (ctx); + darg->async = false; + }return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/159 tls: dont rely on tx_work during send()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
With async crypto, we rely on tx_work to actually transmit records once encryption completes. But while send() is running, both the tx_lock and socket lock are held, so tx_work_handler cannot process the queue of encrypted records, and simply reschedules itself. During a large send(), this could last a long time, and use a lot of memory.
Transmit any pending encrypted records before restarting the main loop of tls_sw_sendmsg_locked.
--- net/tls/tls_sw.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/tls/tls_sw.c +13 -0
@@ -1152,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, }else if (ret != -EAGAIN ) goto send_end; } + +/* Transmit if any encryptions have completed */ +if (test_and_clear_bit (BIT_TX_SCHEDULED , &ctx->tx_bitmask)) { +cancel_delayed_work (&ctx->tx_work.work); +tls_tx_records (sk, msg->msg_flags); + } +continue ; rollback_iter: copied -= try_to_copy;
@@ -1207,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, goto send_end; } } + +/* Transmit if any encryptions have completed */ +if (test_and_clear_bit (BIT_TX_SCHEDULED , &ctx->tx_bitmask)) { +cancel_delayed_work (&ctx->tx_work.work); +tls_tx_records (sk, msg->msg_flags); + } }continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/159 netdevsim: set the carrier when the device goes up
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8 ]
Bringing a linked netdevsim device down and then up causes communication failure because both interfaces lack carrier. Basically a ifdown/ifup on the interface make the link broken.
Commit 3762ec05a9fbda ("netdevsim: add NAPI support") added supported for NAPI, calling netif_carrier_off() in nsim_stop(). This patch re-enables the carrier symmetrically on nsim_open(), in case the device is linked and the peer is up.
--- drivers/net/netdevsim/netdev.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/netdevsim/netdev.c +7 -0
@@ -528,6 +528,7 @@ static void nsim_enable_napi(struct netdevsim *ns)static int nsim_open (struct net_device *dev) {struct netdevsim *ns =netdev_priv (dev); +struct netdevsim *peer;int err;netdev_assert_locked (dev);
@@ -538,6 +539,12 @@ static int nsim_open(struct net_device *dev)nsim_enable_napi (ns); + peer =rtnl_dereference (ns->peer); +if (peer &&netif_running (peer->netdev)) { +netif_carrier_on (dev); +netif_carrier_on (peer->netdev); + } +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/159 net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: I Viswanath <[email protected]>
[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
dev->chipid is used in lan78xx_init_mac_address before it's initialized:
lan78xx_reset() {
lan78xx_init_mac_address()
lan78xx_read_eeprom()
lan78xx_read_raw_eeprom() <- dev->chipid is used here
dev->chipid = ... <- dev->chipid is initialized correctly here
}Reorder initialization so that dev->chipid is set before calling lan78xx_init_mac_address().
--- drivers/net/usb/lan78xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/usb/lan78xx.c +4 -4
@@ -3244,10 +3244,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) } }while (buf &HW_CFG_LRST_ ); - ret =lan78xx_init_mac_address (dev); -if (ret <0 ) -return ret; -/* save DEVID for later usage */ ret =lan78xx_read_reg (dev,ID_REV , &buf);if (ret <0 )
@@ -3256,6 +3252,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) dev->chipid = (buf &ID_REV_CHIP_ID_MASK_ ) >>16 ; dev->chiprev = buf &ID_REV_CHIP_REV_MASK_ ; + ret =lan78xx_init_mac_address (dev); +if (ret <0 ) +return ret; +/* Respond to the IN token with a NAK */ ret =lan78xx_read_reg (dev,USB_CFG0 , &buf);if (ret <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/159 drm/panthor: Ensure MCU is disabled on suspend
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ketil Johnsen <[email protected]>
[ Upstream commit e07e10ae83bdf429f59c8c149173a8c4f29c481e ]
Currently the Panthor driver needs the GPU to be powered down between suspend and resume. If this is not done, then the MCU_CONTROL register will be preserved as AUTO, which again will cause a premature FW boot on resume. The FW will go directly into fatal state in this case.
This case needs to be handled as there is no guarantee that the GPU will be powered down after the suspend callback on all platforms.
The fix is to call panthor_fw_stop() in "pre-reset" path to ensure the MCU_CONTROL register is cleared (set DISABLE). This matches well with the already existing call to panthor_fw_start() from the "post-reset" path.
--- drivers/gpu/drm/panthor/panthor_fw.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panthor/panthor_fw.c +1 -0
@@ -1099,6 +1099,7 @@ void panthor_fw_pre_reset(struct panthor_device *ptdev, bool on_hang) }panthor_job_irq_suspend (&ptdev->fw->irq); +panthor_fw_stop (ptdev); }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/159 nvme-multipath: Skip nr_active increments in RETRY disposition
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Chaudhary <[email protected]>
[ Upstream commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 ]
For queue-depth I/O policy, this patch fixes unbalanced I/Os across nvme multipaths.
Issue Description:
The RETRY disposition incorrectly increments ns->ctrl->nr_active counter and reinitializes iostat start-time. In such cases nr_active counter never goes back to zero until that path disconnects and reconnects.
Such a path is not chosen for new I/Os if multiple RETRY cases on a given a path cause its queue-depth counter to be artificially higher compared to other paths. This leads to unbalanced I/Os across paths.
The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set.
base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a
--- drivers/nvme/host/multipath.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/nvme/host/multipath.c +4 -2
@@ -182,12 +182,14 @@ void nvme_mpath_start_request(struct request *rq)struct nvme_ns *ns = rq->q->queuedata;struct gendisk *disk = ns->head->disk; -if (READ_ONCE (ns->head->subsys->iopolicy) ==NVME_IOPOLICY_QD ) { +if ((READ_ONCE (ns->head->subsys->iopolicy) ==NVME_IOPOLICY_QD ) && + !(nvme_req (rq)->flags &NVME_MPATH_CNT_ACTIVE )) {atomic_inc (&ns->ctrl->nr_active);nvme_req (rq)->flags |=NVME_MPATH_CNT_ACTIVE ; } -if (!blk_queue_io_stat (disk->queue) ||blk_rq_is_passthrough (rq)) +if (!blk_queue_io_stat (disk->queue) ||blk_rq_is_passthrough (rq) || + (nvme_req (rq)->flags &NVME_MPATH_IO_STATS ))return ;nvme_req (rq)->flags |=NVME_MPATH_IO_STATS ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/159 riscv: kprobes: Fix probe address validation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Vogt <[email protected]>
[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]
When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", arch_check_kprobe would start iterating all instructions starting from _text until the probed address. Not only is this very inefficient, but literal values in there (e.g. left by function patching) are misinterpreted in a way that causes a desync.
Fix this by doing it like x86: start the iteration at the closest preceding symbol instead of the given starting point.
--- arch/riscv/kernel/probes/kprobes.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
arch/riscv/kernel/probes/kprobes.c +9 -4
@@ -49,10 +49,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)post_kprobe_handler (p, kcb, regs); } -static bool __kprobes arch_check_kprobe (struct kprobe *p) +static bool __kprobes arch_check_kprobe (unsigned long addr) { -unsigned long tmp = (unsigned long )p->addr - p->offset; -unsigned long addr = (unsigned long )p->addr; +unsigned long tmp, offset; + +/* start iterating at the closest preceding symbol */ +if (!kallsyms_lookup_size_offset (addr,NULL , &offset)) +return false; + + tmp = addr - offset;while (tmp <= addr) {if (tmp == addr)
@@ -71,7 +76,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)if ((unsigned long )insn &0x1 )return -EILSEQ ; -if (!arch_check_kprobe (p)) +if (!arch_check_kprobe ((unsigned long )p->addr))return -EILSEQ ;/* copy instruction */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/159 drm/bridge: lt9211: Drop check for last nibble of version register
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ]
There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 . The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the driver checks for right now. Since there is a possibility there will be yet another revision of the LT9211 in the future, drop the last version nibble check to allow all future revisions of the chip to work with this driver.
This fix makes LT9211 rev. U5 work with this driver.
--- drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/bridge/lontium-lt9211.c +1 -2
@@ -121,8 +121,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx) }/* Test for known Chip ID. */ -if (chipid[0 ] !=REG_CHIPID0_VALUE || chipid[1 ] !=REG_CHIPID1_VALUE || - chipid[2 ] !=REG_CHIPID2_VALUE ) { +if (chipid[0 ] !=REG_CHIPID0_VALUE || chipid[1 ] !=REG_CHIPID1_VALUE ) {dev_err (ctx->dev,"Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n" , chipid[0 ], chipid[1 ], chipid[2 ]);return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/159 powerpc/fadump: skip parameter area allocation when fadump is disabled
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
[ Upstream commit 0843ba458439f38efdc14aa359c14ad0127edb01 ]
Fadump allocates memory to pass additional kernel command-line argument to the fadump kernel. However, this allocation is not needed when fadump is disabled. So avoid allocating memory for the additional parameter area in such cases.
--- arch/powerpc/kernel/fadump.c | 3 +++ 1 file changed, 3 insertions(+)
arch/powerpc/kernel/fadump.c +3 -0
@@ -1747,6 +1747,9 @@ void __init fadump_setup_param_area(void) {phys_addr_t range_start, range_end; +if (!fw_dump.fadump_enabled) +return ; +if (!fw_dump.param_area_supported || fw_dump.dump_active)return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/159 ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 6370a996f308ea3276030769b7482b346e7cc7c1 ]
The gain ranges specified in Renesas IDT821034 codec documentation are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the receive path (DAC). Allthough the registers allow programming values outside those ranges, the signal S/N and distorsion are only guaranteed in the specified ranges.
Set ranges to the specified ones.
--- sound/soc/codecs/idt821034.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
sound/soc/codecs/idt821034.c +6 -6
@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol,return ret; } -static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306); -#define IDT821034_GAIN_IN_MIN_RAW 1/* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */ -#define IDT821034_GAIN_IN_MAX_RAW 8191/* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */ +static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300); +#define IDT821034_GAIN_IN_MIN_RAW 1288/* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */ +#define IDT821034_GAIN_IN_MAX_RAW 8130/* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */ #define IDT821034_GAIN_IN_INIT_RAW 1820/* 0dB -> 10^(0/20) * 1820 = 1820 */ -static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029); -#define IDT821034_GAIN_OUT_MIN_RAW 1/* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/ -#define IDT821034_GAIN_OUT_MAX_RAW 8191/* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */ +static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300); +#define IDT821034_GAIN_OUT_MIN_RAW 561/* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */ +#define IDT821034_GAIN_OUT_MAX_RAW 3540/* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */ #define IDT821034_GAIN_OUT_INIT_RAW 2506/* 0dB -> 10^(0/20) * 2506 = 2506 */ static const struct snd_kcontrol_new idt821034_controls[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/159 ASoC: nau8821: Cancel jdet_work before handling jack ejection
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ]
The microphone detection work scheduled by a prior jack insertion interrupt may still be in a pending state or under execution when a jack ejection interrupt has been fired.
This might lead to a racing condition or nau8821_jdet_work() completing after nau8821_eject_jack(), which will override the currently disconnected state of the jack and incorrectly report the headphone or the headset as being connected.
Cancel any pending jdet_work or wait for its execution to finish before attempting to handle the ejection interrupt.
Proceed similarly before launching the eject handler as a consequence of detecting an invalid insert interrupt.
--- sound/soc/codecs/nau8821.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/codecs/nau8821.c +2 -1
@@ -1185,6 +1185,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)if ((active_irq &NAU8821_JACK_EJECT_IRQ_MASK ) ==NAU8821_JACK_EJECT_DETECTED ) { +cancel_work_sync (&nau8821->jdet_work);regmap_update_bits (regmap,NAU8821_R71_ANALOG_ADC_1 ,NAU8821_MICDET_MASK ,NAU8821_MICDET_DIS );nau8821_eject_jack (nau8821);
@@ -1199,11 +1200,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) clear_irq =NAU8821_KEY_RELEASE_IRQ ; }else if ((active_irq &NAU8821_JACK_INSERT_IRQ_MASK ) ==NAU8821_JACK_INSERT_DETECTED ) { +cancel_work_sync (&nau8821->jdet_work);regmap_update_bits (regmap,NAU8821_R71_ANALOG_ADC_1 ,NAU8821_MICDET_MASK ,NAU8821_MICDET_EN );if (nau8821_is_jack_inserted (regmap)) {/* detect microphone and jack type */ -cancel_work_sync (&nau8821->jdet_work);schedule_work (&nau8821->jdet_work);/* Turn off insertion interruption at manual mode */ regmap_update_bits(regmap,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/159 ASoC: nau8821: Generalize helper to clear IRQ status
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ]
Instead of adding yet another utility function for dealing with the interrupt clearing register, generalize nau8821_int_status_clear_all() by renaming it to nau8821_irq_status_clear(), whilst introducing a second parameter to allow restricting the operation scope to a single interrupt instead of the whole range of active IRQs.
While at it, also fix a spelling typo in the comment block.
Note this is mainly a prerequisite for subsequent patches aiming to address some deficiencies in the implementation of the interrupt handler. Thus the presence of the Fixes tag below is intentional, to facilitate backporting.
--- sound/soc/codecs/nau8821.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
sound/soc/codecs/nau8821.c +11 -6
@@ -1021,12 +1021,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap)return active_high == is_high; } -static void nau8821_int_status_clear_all (struct regmap *regmap) +static void nau8821_irq_status_clear (struct regmap *regmap,int active_irq) { -int active_irq, clear_irq, i; +int clear_irq, i; -/* Reset the intrruption status from rightmost bit if the corres- -* ponding irq event occurs. +if (active_irq) { +regmap_write (regmap,NAU8821_R11_INT_CLR_KEY_STATUS , active_irq); +return ; + } + +/* Reset the interruption status from rightmost bit if the +* corresponding irq event occurs. */ regmap_read (regmap,NAU8821_R10_IRQ_STATUS , &active_irq);for (i =0 ; i <NAU8821_REG_DATA_LEN ; i++) {
@@ -1053,7 +1058,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)snd_soc_dapm_sync (dapm);/* Clear all interruption status */ -nau8821_int_status_clear_all (regmap); +nau8821_irq_status_clear (regmap,0 );/* Enable the insertion interruption, disable the ejection inter- * ruption, and then bypass de-bounce circuit.
@@ -1522,7 +1527,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821)nau8821_configure_sysclk (nau8821,NAU8821_CLK_DIS ,0 );if (nau8821->irq) {/* Clear all interruption status */ -nau8821_int_status_clear_all (regmap); +nau8821_irq_status_clear (regmap,0 );/* Enable both insertion and ejection interruptions, and then * bypass de-bounce circuit.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/159 ASoC: nau8821: Consistently clear interrupts before unmasking
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit a698679fe8b0fec41d1fb9547a53127a85c1be92 ]
The interrupt handler attempts to perform some IRQ status clear operations *after* rather than *before* unmasking and enabling interrupts. This is a rather fragile approach since it may generally lead to missing IRQ requests or causing spurious interrupts.
Make use of the nau8821_irq_status_clear() helper instead of manipulating the related register directly and ensure any interrupt clearing is performed *after* the target interrupts are disabled/masked and *before* proceeding with additional interrupt unmasking/enablement operations.
This also implicitly drops the redundant clear operation of the ejection IRQ in the interrupt handler, since nau8821_eject_jack() has been already responsible for clearing all active interrupts.
--- sound/soc/codecs/nau8821.c | 58 ++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 28 deletions(-)
sound/soc/codecs/nau8821.c +30 -28
@@ -1057,20 +1057,24 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)snd_soc_component_disable_pin (component,"MICBIAS" );snd_soc_dapm_sync (dapm); +/* Disable & mask both insertion & ejection IRQs */ +regmap_update_bits (regmap,NAU8821_R12_INTERRUPT_DIS_CTRL , +NAU8821_IRQ_INSERT_DIS |NAU8821_IRQ_EJECT_DIS , +NAU8821_IRQ_INSERT_DIS |NAU8821_IRQ_EJECT_DIS ); +regmap_update_bits (regmap,NAU8821_R0F_INTERRUPT_MASK , +NAU8821_IRQ_INSERT_EN |NAU8821_IRQ_EJECT_EN , +NAU8821_IRQ_INSERT_EN |NAU8821_IRQ_EJECT_EN ); +/* Clear all interruption status */ nau8821_irq_status_clear (regmap,0 ); -/* Enable the insertion interruption, disable the ejection inter- -* ruption, and then bypass de-bounce circuit. -*/ +/* Enable & unmask the insertion IRQ */ regmap_update_bits (regmap,NAU8821_R12_INTERRUPT_DIS_CTRL , -NAU8821_IRQ_EJECT_DIS |NAU8821_IRQ_INSERT_DIS , -NAU8821_IRQ_EJECT_DIS ); -/* Mask unneeded IRQs: 1 - disable, 0 - enable */ +NAU8821_IRQ_INSERT_DIS ,0 );regmap_update_bits (regmap,NAU8821_R0F_INTERRUPT_MASK , -NAU8821_IRQ_EJECT_EN |NAU8821_IRQ_INSERT_EN , -NAU8821_IRQ_EJECT_EN ); +NAU8821_IRQ_INSERT_EN ,0 ); +/* Bypass de-bounce circuit */ regmap_update_bits (regmap,NAU8821_R0D_JACK_DET_CTRL ,NAU8821_JACK_DET_DB_BYPASS ,NAU8821_JACK_DET_DB_BYPASS );
@@ -1094,7 +1098,6 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)NAU8821_IRQ_KEY_RELEASE_DIS | NAU8821_IRQ_KEY_PRESS_DIS); } - }static void nau8821_jdet_work (struct work_struct *work)
@@ -1151,6 +1154,15 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) {struct regmap *regmap = nau8821->regmap; +/* Disable & mask insertion IRQ */ +regmap_update_bits (regmap,NAU8821_R12_INTERRUPT_DIS_CTRL , +NAU8821_IRQ_INSERT_DIS ,NAU8821_IRQ_INSERT_DIS ); +regmap_update_bits (regmap,NAU8821_R0F_INTERRUPT_MASK , +NAU8821_IRQ_INSERT_EN ,NAU8821_IRQ_INSERT_EN ); + +/* Clear insert IRQ status */ +nau8821_irq_status_clear (regmap,NAU8821_JACK_INSERT_DETECTED ); +/* Enable internal VCO needed for interruptions */ if (nau8821->dapm->bias_level <SND_SOC_BIAS_PREPARE )nau8821_configure_sysclk (nau8821,NAU8821_CLK_INTERNAL ,0 );
@@ -1169,17 +1181,18 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)regmap_update_bits (regmap,NAU8821_R0D_JACK_DET_CTRL ,NAU8821_JACK_DET_DB_BYPASS ,0 ); +/* Unmask & enable the ejection IRQs */ regmap_update_bits (regmap,NAU8821_R0F_INTERRUPT_MASK , -NAU8821_IRQ_EJECT_EN ,0 ); +NAU8821_IRQ_EJECT_EN ,0 );regmap_update_bits (regmap,NAU8821_R12_INTERRUPT_DIS_CTRL , -NAU8821_IRQ_EJECT_DIS ,0 ); +NAU8821_IRQ_EJECT_DIS ,0 ); }static irqreturn_t nau8821_interrupt (int irq,void *data) {struct nau8821 *nau8821 = (struct nau8821 *)data;struct regmap *regmap = nau8821->regmap; -int active_irq, clear_irq =0 , event =0 , event_mask =0 ; +int active_irq, event =0 , event_mask =0 ;if (regmap_read (regmap,NAU8821_R10_IRQ_STATUS , &active_irq)) {dev_err (nau8821->dev,"failed to read irq status\n" );
@@ -1195,14 +1208,13 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) NAU8821_MICDET_MASK, NAU8821_MICDET_DIS);nau8821_eject_jack (nau8821); event_mask |=SND_JACK_HEADSET ; - clear_irq =NAU8821_JACK_EJECT_IRQ_MASK ; }else if (active_irq &NAU8821_KEY_SHORT_PRESS_IRQ ) { event |=NAU8821_BUTTON ; event_mask |=NAU8821_BUTTON ; - clear_irq =NAU8821_KEY_SHORT_PRESS_IRQ ; +nau8821_irq_status_clear (regmap,NAU8821_KEY_SHORT_PRESS_IRQ ); }else if (active_irq &NAU8821_KEY_RELEASE_IRQ ) { event_mask =NAU8821_BUTTON ; - clear_irq =NAU8821_KEY_RELEASE_IRQ ; +nau8821_irq_status_clear (regmap,NAU8821_KEY_RELEASE_IRQ ); }else if ((active_irq &NAU8821_JACK_INSERT_IRQ_MASK ) ==NAU8821_JACK_INSERT_DETECTED ) {cancel_work_sync (&nau8821->jdet_work);
@@ -1212,27 +1224,17 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)/* detect microphone and jack type */ schedule_work (&nau8821->jdet_work);/* Turn off insertion interruption at manual mode */ -regmap_update_bits (regmap, -NAU8821_R12_INTERRUPT_DIS_CTRL , -NAU8821_IRQ_INSERT_DIS , -NAU8821_IRQ_INSERT_DIS ); -regmap_update_bits (regmap, -NAU8821_R0F_INTERRUPT_MASK , -NAU8821_IRQ_INSERT_EN , -NAU8821_IRQ_INSERT_EN );nau8821_setup_inserted_irq (nau8821); }else {dev_warn (nau8821->dev,"Inserted IRQ fired but not connected\n" );nau8821_eject_jack (nau8821); } + }else { +/* Clear the rightmost interrupt */ +nau8821_irq_status_clear (regmap, active_irq); } -if (!clear_irq) - clear_irq = active_irq; -/* clears the rightmost interruption */ -regmap_write (regmap,NAU8821_R11_INT_CLR_KEY_STATUS , clear_irq); -if (event_mask)snd_soc_jack_report (nau8821->jack, event, event_mask);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/159 ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ]
Stress testing the audio jack hotplug handling on a few Steam Deck units revealed that the debounce circuit is responsible for having a negative impact on the detection reliability, e.g. in some cases the ejection interrupt is not fired, while in other instances it goes into a kind of invalid state and generates a flood of misleading interrupts.
Add new entries to the DMI table introduced via commit 1bc40efdaf4a ("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect") and extend the quirk logic to allow bypassing the debounce circuit used for jack detection on Valve Steam Deck LCD and OLED models.
While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability by differentiating from similarly named register bits.
--- sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-)
sound/soc/codecs/nau8821.c +27 -6
@@ -26,7 +26,8 @@#include <sound/tlv.h> #include "nau8821.h" -#define NAU8821_JD_ACTIVE_HIGH BIT(0) +#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0) +#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1)static int nau8821_quirk;static int quirk_override =-1 ;
@@ -1177,9 +1178,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)regmap_update_bits (regmap,NAU8821_R1D_I2S_PCM_CTRL2 ,NAU8821_I2S_MS_MASK ,NAU8821_I2S_MS_SLAVE ); -/* Not bypass de-bounce circuit */ -regmap_update_bits (regmap,NAU8821_R0D_JACK_DET_CTRL , -NAU8821_JACK_DET_DB_BYPASS ,0 ); +/* Do not bypass de-bounce circuit */ +if (!(nau8821_quirk &NAU8821_QUIRK_JD_DB_BYPASS )) +regmap_update_bits (regmap,NAU8821_R0D_JACK_DET_CTRL , +NAU8821_JACK_DET_DB_BYPASS ,0 );/* Unmask & enable the ejection IRQs */ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
@@ -1864,7 +1866,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = { DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), }, - .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), + .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH), + }, + { + /* Valve Steam Deck LCD */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Valve"), + DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), + }, + .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), + }, + { + /* Valve Steam Deck OLED */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Valve"), + DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"), + }, + .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), }, {} };
@@ -1906,9 +1924,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c)nau8821_check_quirks (); -if (nau8821_quirk &NAU8821_JD_ACTIVE_HIGH ) +if (nau8821_quirk &NAU8821_QUIRK_JD_ACTIVE_HIGH ) nau8821->jkdet_polarity =0 ; +if (nau8821_quirk &NAU8821_QUIRK_JD_DB_BYPASS ) +dev_dbg (dev,"Force bypassing jack detection debounce circuit\n" ); +nau8821_print_device_properties (nau8821);nau8821_reset_chip (nau8821->regmap);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/159 drm/i915/guc: Skip communication warning on reset in progress
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhanjun Dong <[email protected]>
[ Upstream commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 ]
GuC IRQ and tasklet handler receive just single G2H message, and let other messages to be received from next tasklet. During this chained tasklet process, if reset process started, communication will be disabled. Skip warning for this condition.
--- drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c +8 -1
@@ -1324,9 +1324,16 @@ static int ct_receive(struct intel_guc_ct *ct)static void ct_try_receive_message (struct intel_guc_ct *ct) { +struct intel_guc *guc =ct_to_guc (ct);int ret; -if (GEM_WARN_ON (!ct->enabled)) +if (!ct->enabled) { +GEM_WARN_ON (!guc_to_gt (guc)->uc.reset_in_progress); +return ; + } + +/* When interrupt disabled, message handling is not expected */ +if (!guc->interrupts.enabled)return ; ret =ct_receive (ct);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/159 drm/i915/frontbuffer: Move bo refcounting intel_frontbuffer_{get,release}()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
[ Upstream commit 760039c95c78490c5c66ef584fcd536797ed6a2f ]
Currently xe's intel_frontbuffer implementation forgets to hold a reference on the bo. This makes the entire thing extremely fragile as the cleanup order now depends on bo references held by other things
(namely intel_fb_bo_framebuffer_fini()).
Move the bo refcounting to intel_frontbuffer_{get,release}() so that both i915 and xe do this the same way.
I first tried to fix this by having xe do the refcounting from its intel_bo_set_frontbuffer() implementation (which is what i915 does currently), but turns out xe's drm_gem_object_free() can sleep and thus drm_gem_object_put() isn't safe to call while we hold fb_tracking.lock.
--- drivers/gpu/drm/i915/display/intel_frontbuffer.c | 10 +++++++++- drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h | 2 -- 2 files changed, 9 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/display/intel_frontbuffer.c +9 -1
@@ -270,6 +270,8 @@ static void frontbuffer_release(struct kref *ref)spin_unlock (&display->fb_tracking.lock);i915_active_fini (&front->write); + +drm_gem_object_put (obj);kfree_rcu (front, rcu); }
@@ -287,6 +289,8 @@ intel_frontbuffer_get(struct drm_gem_object *obj)if (!front)return NULL ; +drm_gem_object_get (obj); + front->obj = obj;kref_init (&front->ref);atomic_set (&front->bits,0 );
@@ -299,8 +303,12 @@ intel_frontbuffer_get(struct drm_gem_object *obj)spin_lock (&display->fb_tracking.lock); cur =intel_bo_set_frontbuffer (obj, front);spin_unlock (&display->fb_tracking.lock); -if (cur != front) + +if (cur != front) { +drm_gem_object_put (obj);kfree (front); + } +return cur; }
drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h +0 -2
@@ -89,12 +89,10 @@ i915_gem_object_set_frontbuffer(struct drm_i915_gem_object *obj,if (!front) {RCU_INIT_POINTER (obj->frontbuffer,NULL ); -drm_gem_object_put (intel_bo_to_drm_bo (obj)); }else if (rcu_access_pointer (obj->frontbuffer)) { cur =rcu_dereference_protected (obj->frontbuffer, true);kref_get (&cur->ref); }else { -drm_gem_object_get (intel_bo_to_drm_bo (obj));rcu_assign_pointer (obj->frontbuffer, front); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/159 drm/i915/fb: Fix the set_tiling vs. addfb race, again
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
[ Upstream commit 86af6b90e0556fcefbc6e98eb78bdce90327ee76 ]
intel_frontbuffer_get() is what locks out subsequent set_tiling changes to the bo. Thus the fence vs. modifier check must be done after intel_frontbuffer_get(), or else a concurrent set_tiling ioctl might sneak in and change the fence after the check has been done.
Close the race again. See commit dd689287b977 ("drm/i915: Prevent concurrent tiling/framebuffer modifications") for the previous instance.
v2: Reorder intel_user_framebuffer_destroy() to match the unwind (Jani)
--- drivers/gpu/drm/i915/display/intel_fb.c | 38 +++++++++++++------------ 1 file changed, 20 insertions(+), 18 deletions(-)
drivers/gpu/drm/i915/display/intel_fb.c +20 -18
@@ -2111,10 +2111,10 @@ static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb)if (intel_fb_uses_dpt (fb))intel_dpt_destroy (intel_fb->dpt_vm); -intel_frontbuffer_put (intel_fb->frontbuffer); -intel_fb_bo_framebuffer_fini (intel_fb_bo (fb)); +intel_frontbuffer_put (intel_fb->frontbuffer); +kfree (intel_fb); }
@@ -2216,15 +2216,17 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,int ret = -EINVAL ;int i; +/* +* intel_frontbuffer_get() must be done before +* intel_fb_bo_framebuffer_init() to avoid set_tiling vs. addfb race. +*/ + intel_fb->frontbuffer =intel_frontbuffer_get (obj); +if (!intel_fb->frontbuffer) +return -ENOMEM ; + ret =intel_fb_bo_framebuffer_init (fb, obj, mode_cmd);if (ret) -return ret; - - intel_fb->frontbuffer =intel_frontbuffer_get (obj); -if (!intel_fb->frontbuffer) { - ret = -ENOMEM ; - goto err; - } + goto err_frontbuffer_put; ret = -EINVAL ; if (!drm_any_plane_has_format(display->drm,
@@ -2233,7 +2235,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,drm_dbg_kms (display->drm,"unsupported pixel format %p4cc / modifier 0x%llx\n" , &mode_cmd->pixel_format, mode_cmd->modifier[0 ]); - goto err_frontbuffer_put; + goto err_bo_framebuffer_fini; } max_stride = intel_fb_max_stride(display, mode_cmd->pixel_format,
@@ -2244,7 +2246,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, mode_cmd->modifier[0 ] !=DRM_FORMAT_MOD_LINEAR ?"tiled" :"linear" , mode_cmd->pitches[0], max_stride); - goto err_frontbuffer_put; + goto err_bo_framebuffer_fini; }/* FIXME need to adjust LINOFF/TILEOFF accordingly. */
@@ -2252,7 +2254,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,drm_dbg_kms (display->drm,"plane 0 offset (0x%08x) must be 0\n" , mode_cmd->offsets[0 ]); - goto err_frontbuffer_put; + goto err_bo_framebuffer_fini; }drm_helper_mode_fill_fb_struct (display->drm, fb, info, mode_cmd);
@@ -2262,7 +2264,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,if (mode_cmd->handles[i] != mode_cmd->handles[0 ]) {drm_dbg_kms (display->drm,"bad plane %d handle\n" , i); - goto err_frontbuffer_put; + goto err_bo_framebuffer_fini; } stride_alignment =intel_fb_stride_alignment (fb, i);
@@ -2270,7 +2272,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,drm_dbg_kms (display->drm,"plane %d pitch (%d) must be at least %u byte aligned\n" , i, fb->pitches[i], stride_alignment); - goto err_frontbuffer_put; + goto err_bo_framebuffer_fini; }if (intel_fb_is_gen12_ccs_aux_plane (fb, i)) {
@@ -2280,7 +2282,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,drm_dbg_kms (display->drm,"ccs aux plane %d pitch (%d) must be %d\n" , i, fb->pitches[i], ccs_aux_stride); - goto err_frontbuffer_put; + goto err_bo_framebuffer_fini; } }
@@ -2289,7 +2291,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, ret =intel_fill_fb_info (display, intel_fb);if (ret) - goto err_frontbuffer_put; + goto err_bo_framebuffer_fini;if (intel_fb_uses_dpt (fb)) {struct i915_address_space *vm;
@@ -2315,10 +2317,10 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, err_free_dpt:if (intel_fb_uses_dpt (fb))intel_dpt_destroy (intel_fb->dpt_vm); +err_bo_framebuffer_fini: +intel_fb_bo_framebuffer_fini (obj); err_frontbuffer_put:intel_frontbuffer_put (intel_fb->frontbuffer); -err: -intel_fb_bo_framebuffer_fini (obj);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/159 drm/amdgpu: add ip offset support for cyan skillfish
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit e8529dbc75cab56fc3c57830d0fd48cbd8911e6c ]
For chips that don't have IP discovery tables.
Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware")
--- drivers/gpu/drm/amd/amdgpu/Makefile | 3 +- .../drm/amd/amdgpu/cyan_skillfish_reg_init.c | 56 +++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/nv.h | 1 + 3 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c
drivers/gpu/drm/amd/amdgpu/Makefile +2 -1
@@ -84,7 +84,8 @@ amdgpu-y += \ vega20_reg_init.o nbio_v7_4.o nbio_v2_3.o nv.o arct_reg_init.o mxgpu_nv.o \ nbio_v7_2.o hdp_v4_0.o hdp_v5_0.o aldebaran_reg_init.o aldebaran.o soc21.o soc24.o \ sienna_cichlid.o smu_v13_0_10.o nbio_v4_3.o hdp_v6_0.o nbio_v7_7.o hdp_v5_2.o lsdma_v6_0.o \ - nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o + nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o \ + cyan_skillfish_reg_init.o # add DF block amdgpu-y += \
drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c new file +56 -0
56 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/nv.h +1 -0
@@ -31,5 +31,6 @@ extern const struct amdgpu_ip_block_version nv_common_ip_block;void nv_grbm_select (struct amdgpu_device *adev,u32 me,u32 pipe,u32 queue,u32 vmid);void nv_set_virt_ops (struct amdgpu_device *adev); +int cyan_skillfish_reg_base_init (struct amdgpu_device *adev);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/159 drm/amdgpu: add support for cyan skillfish without IP discovery
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 9e6a5cf1a23bf575e93544ae05585659063b1c18 ]
For platforms without an IP discovery table.
Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +30 -0
@@ -2746,6 +2746,36 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) adev->ip_versions[UVD_HWIP ][1 ] =IP_VERSION (2 ,6 ,0 ); adev->ip_versions[XGMI_HWIP ][0 ] =IP_VERSION (6 ,1 ,0 );break ; +case CHIP_CYAN_SKILLFISH : +if (adev->apu_flags &AMD_APU_IS_CYAN_SKILLFISH2 ) { + r =amdgpu_discovery_reg_base_init (adev); +if (r) +return -EINVAL ; + +amdgpu_discovery_harvest_ip (adev); +amdgpu_discovery_get_gfx_info (adev); +amdgpu_discovery_get_mall_info (adev); +amdgpu_discovery_get_vcn_info (adev); + }else { +cyan_skillfish_reg_base_init (adev); + adev->sdma.num_instances =2 ; + adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (2 ,0 ,3 ); + adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (2 ,0 ,3 ); + adev->ip_versions[OSSSYS_HWIP ][0 ] =IP_VERSION (5 ,0 ,1 ); + adev->ip_versions[HDP_HWIP ][0 ] =IP_VERSION (5 ,0 ,1 ); + adev->ip_versions[SDMA0_HWIP ][0 ] =IP_VERSION (5 ,0 ,1 ); + adev->ip_versions[SDMA1_HWIP ][1 ] =IP_VERSION (5 ,0 ,1 ); + adev->ip_versions[DF_HWIP ][0 ] =IP_VERSION (3 ,5 ,0 ); + adev->ip_versions[NBIO_HWIP ][0 ] =IP_VERSION (2 ,1 ,1 ); + adev->ip_versions[UMC_HWIP ][0 ] =IP_VERSION (8 ,1 ,1 ); + adev->ip_versions[MP0_HWIP ][0 ] =IP_VERSION (11 ,0 ,8 ); + adev->ip_versions[MP1_HWIP ][0 ] =IP_VERSION (11 ,0 ,8 ); + adev->ip_versions[THM_HWIP ][0 ] =IP_VERSION (11 ,0 ,1 ); + adev->ip_versions[SMUIO_HWIP ][0 ] =IP_VERSION (11 ,0 ,8 ); + adev->ip_versions[GC_HWIP ][0 ] =IP_VERSION (10 ,1 ,3 ); + adev->ip_versions[UVD_HWIP ][0 ] =IP_VERSION (2 ,0 ,3 ); + } +break ;default : r =amdgpu_discovery_reg_base_init (adev);if (r) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/159 drm/amdgpu: fix handling of harvesting for ip_discovery firmware
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 357d90be2c7aaa526a840cddffd2b8d676fe75a6 ]
Chips which use the IP discovery firmware loaded by the driver reported incorrect harvesting information in the ip discovery table in sysfs because the driver only uses the ip discovery firmware for populating sysfs and not for direct parsing for the driver itself as such, the fields that are used to print the harvesting info in sysfs report incorrect data for some IPs. Populate the relevant fields for this case as well.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +17 -1
@@ -1033,7 +1033,9 @@ static uint8_t amdgpu_discovery_get_harvest_info(struct amdgpu_device *adev,/* Until a uniform way is figured, get mask based on hwid */ switch (hw_id) {case VCN_HWID : - harvest = ((1 << inst) & adev->vcn.inst_mask) ==0 ; +/* VCN vs UVD+VCE */ +if (!amdgpu_ip_version (adev,VCE_HWIP ,0 )) + harvest = ((1 << inst) & adev->vcn.inst_mask) ==0 ;break ;case DMU_HWID :if (adev->harvest_ip_mask &AMD_HARVEST_IP_DMU_MASK )
@@ -2562,7 +2564,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)amdgpu_discovery_init (adev);vega10_reg_base_init (adev); adev->sdma.num_instances =2 ; + adev->sdma.sdma_mask =3 ; adev->gmc.num_umc =4 ; + adev->gfx.xcc_mask =1 ; adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (9 ,0 ,0 ); adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (9 ,0 ,0 ); adev->ip_versions[OSSSYS_HWIP ][0 ] =IP_VERSION (4 ,0 ,0 );
@@ -2589,7 +2593,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)amdgpu_discovery_init (adev);vega10_reg_base_init (adev); adev->sdma.num_instances =2 ; + adev->sdma.sdma_mask =3 ; adev->gmc.num_umc =4 ; + adev->gfx.xcc_mask =1 ; adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (9 ,3 ,0 ); adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (9 ,3 ,0 ); adev->ip_versions[OSSSYS_HWIP ][0 ] =IP_VERSION (4 ,0 ,1 );
@@ -2616,8 +2622,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)amdgpu_discovery_init (adev);vega10_reg_base_init (adev); adev->sdma.num_instances =1 ; + adev->sdma.sdma_mask =1 ; adev->vcn.num_vcn_inst =1 ; adev->gmc.num_umc =2 ; + adev->gfx.xcc_mask =1 ;if (adev->apu_flags &AMD_APU_IS_RAVEN2 ) { adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (9 ,2 ,0 ); adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (9 ,2 ,0 );
@@ -2662,7 +2670,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)amdgpu_discovery_init (adev);vega20_reg_base_init (adev); adev->sdma.num_instances =2 ; + adev->sdma.sdma_mask =3 ; adev->gmc.num_umc =8 ; + adev->gfx.xcc_mask =1 ; adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (9 ,4 ,0 ); adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (9 ,4 ,0 ); adev->ip_versions[OSSSYS_HWIP ][0 ] =IP_VERSION (4 ,2 ,0 );
@@ -2690,8 +2700,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)amdgpu_discovery_init (adev);arct_reg_base_init (adev); adev->sdma.num_instances =8 ; + adev->sdma.sdma_mask =0xff ; adev->vcn.num_vcn_inst =2 ; adev->gmc.num_umc =8 ; + adev->gfx.xcc_mask =1 ; adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (9 ,4 ,1 ); adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (9 ,4 ,1 ); adev->ip_versions[OSSSYS_HWIP ][0 ] =IP_VERSION (4 ,2 ,1 );
@@ -2723,8 +2735,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)amdgpu_discovery_init (adev);aldebaran_reg_base_init (adev); adev->sdma.num_instances =5 ; + adev->sdma.sdma_mask =0x1f ; adev->vcn.num_vcn_inst =2 ; adev->gmc.num_umc =4 ; + adev->gfx.xcc_mask =1 ; adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (9 ,4 ,2 ); adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (9 ,4 ,2 ); adev->ip_versions[OSSSYS_HWIP ][0 ] =IP_VERSION (4 ,4 ,0 );
@@ -2759,6 +2773,8 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) }else {cyan_skillfish_reg_base_init (adev); adev->sdma.num_instances =2 ; + adev->sdma.sdma_mask =3 ; + adev->gfx.xcc_mask =1 ; adev->ip_versions[MMHUB_HWIP ][0 ] =IP_VERSION (2 ,0 ,3 ); adev->ip_versions[ATHUB_HWIP ][0 ] =IP_VERSION (2 ,0 ,3 ); adev->ip_versions[OSSSYS_HWIP ][0 ] =IP_VERSION (5 ,0 ,1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/159 drm/amdgpu: handle wrap around in reemit handling
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 1f22fcb88bfef26a966e9eb242c692c6bf253d47 ]
Compare the sequence numbers directly.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +10 -5
@@ -791,14 +791,19 @@ void amdgpu_ring_backup_unprocessed_commands(struct amdgpu_ring *ring,struct dma_fence *unprocessed;struct dma_fence __rcu **ptr;struct amdgpu_fence *fence; -u64 wptr, i, seqno; +u64 wptr; +u32 seq, last_seq; - seqno =amdgpu_fence_read (ring); + last_seq =amdgpu_fence_read (ring) & ring->fence_drv.num_fences_mask; + seq = ring->fence_drv.sync_seq & ring->fence_drv.num_fences_mask; wptr = ring->fence_drv.signalled_wptr; ring->ring_backup_entries_to_copy =0 ; -for (i = seqno +1 ; i <= ring->fence_drv.sync_seq; ++i) { - ptr = &ring->fence_drv.fences[i & ring->fence_drv.num_fences_mask]; + do { + last_seq++; + last_seq &= ring->fence_drv.num_fences_mask; + + ptr = &ring->fence_drv.fences[last_seq]; rcu_read_lock(); unprocessed = rcu_dereference(*ptr);
@@ -814,7 +819,7 @@ void amdgpu_ring_backup_unprocessed_commands(struct amdgpu_ring *ring, wptr = fence->wptr; }rcu_read_unlock (); - } + }while (last_seq != seq); }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/159 drm/amdgpu: set an error on all fences from a bad context
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit ff780f4f80323148d43198f2052c14160c8428d3 ]
When we backup ring contents to reemit after a queue reset, we don't backup ring contents from the bad context. When we signal the fences, we should set an error on those fences as well.
v2: misc cleanups
v3: add locking for fence error, fix comment (Christian)
v4: fix wrap around, locking (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 39 ++++++++++++++++++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 2 +- 3 files changed, 37 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +35 -4
@@ -759,11 +759,42 @@ void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring)* @fence: fence of the ring to signal * */ -void amdgpu_fence_driver_guilty_force_completion (struct amdgpu_fence *fence) +void amdgpu_fence_driver_guilty_force_completion (struct amdgpu_fence *af) { -dma_fence_set_error (&fence->base, -ETIME ); -amdgpu_fence_write (fence->ring, fence->seq); -amdgpu_fence_process (fence->ring); +struct dma_fence *unprocessed; +struct dma_fence __rcu **ptr; +struct amdgpu_fence *fence; +struct amdgpu_ring *ring = af->ring; +unsigned long flags; +u32 seq, last_seq; + + last_seq =amdgpu_fence_read (ring) & ring->fence_drv.num_fences_mask; + seq = ring->fence_drv.sync_seq & ring->fence_drv.num_fences_mask; + +/* mark all fences from the guilty context with an error */ +spin_lock_irqsave (&ring->fence_drv.lock, flags); +do { + last_seq++; + last_seq &= ring->fence_drv.num_fences_mask; + + ptr = &ring->fence_drv.fences[last_seq]; +rcu_read_lock (); + unprocessed =rcu_dereference (*ptr); + +if (unprocessed && !dma_fence_is_signaled_locked (unprocessed)) { + fence = container_of(unprocessed, struct amdgpu_fence, base); + +if (fence == af) +dma_fence_set_error (&fence->base, -ETIME ); +else if (fence->context == af->context) +dma_fence_set_error (&fence->base, -ECANCELED ); + } +rcu_read_unlock (); + }while (last_seq != seq); +spin_unlock_irqrestore (&ring->fence_drv.lock, flags); +/* signal the guilty fence */ +amdgpu_fence_write (ring, af->seq); +amdgpu_fence_process (ring); }void amdgpu_fence_save_wptr (struct dma_fence *fence)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +1 -1
@@ -811,7 +811,7 @@ int amdgpu_ring_reset_helper_end(struct amdgpu_ring *ring,if (r)return r; -/* signal the fence of the bad job */ +/* signal the guilty fence and set an error on all fences from the context */ if (guilty_fence)amdgpu_fence_driver_guilty_force_completion (guilty_fence);/* Re-emit the non-guilty commands */
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +1 -1
@@ -155,7 +155,7 @@ extern const struct drm_sched_backend_ops amdgpu_sched_ops;void amdgpu_fence_driver_clear_job_fences (struct amdgpu_ring *ring);void amdgpu_fence_driver_set_error (struct amdgpu_ring *ring,int error);void amdgpu_fence_driver_force_completion (struct amdgpu_ring *ring); -void amdgpu_fence_driver_guilty_force_completion (struct amdgpu_fence *fence); +void amdgpu_fence_driver_guilty_force_completion (struct amdgpu_fence *af);void amdgpu_fence_save_wptr (struct dma_fence *fence);int amdgpu_fence_driver_init_ring (struct amdgpu_ring *ring);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/159 drm/amdgpu: drop unused structures in amdgpu_drm.h
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit ef38b4eab146715bc68d45029257f5e69ea3f2cd ]
These were never used and are duplicated with the interface that is used. Maybe leftovers from a previous revision of the patch that added them.
--- include/uapi/drm/amdgpu_drm.h | 21 --------------------- 1 file changed, 21 deletions(-)
include/uapi/drm/amdgpu_drm.h +0 -21
@@ -1497,27 +1497,6 @@ struct drm_amdgpu_info_hw_ip {__u32 userq_num_slots; }; -/* GFX metadata BO sizes and alignment info (in bytes) */ -struct drm_amdgpu_info_uq_fw_areas_gfx { -/* shadow area size */ -__u32 shadow_size; -/* shadow area base virtual mem alignment */ -__u32 shadow_alignment; -/* context save area size */ -__u32 csa_size; -/* context save area base virtual mem alignment */ -__u32 csa_alignment; -}; - -/* IP specific fw related information used in the -* subquery AMDGPU_INFO_UQ_FW_AREAS -*/ -struct drm_amdgpu_info_uq_fw_areas { -union { -struct drm_amdgpu_info_uq_fw_areas_gfx gfx; - }; -}; -struct drm_amdgpu_info_num_handles {/** Max handles as supported by firmware for UVD */ __u32 uvd_max_handles;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/159 drm/amd/powerplay: Fix CIK shutdown temperature
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
Remove extra multiplication.
CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case the shutdown temperature is hardcoded in smu7_init_dpm_defaults and is already multiplied by 1000. The value was mistakenly multiplied another time by smu7_get_thermal_temperature_range.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +1 -2
@@ -5444,8 +5444,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; else if (hwmgr->pp_table_version == PP_TABLE_V0) - thermal_data->max = data->thermal_temp_setting.temperature_shutdown * -PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; + thermal_data->max = data->thermal_temp_setting.temperature_shutdown; thermal_data->sw_ctf_threshold = thermal_data->max;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/159 drm/xe: Enable media sampler power gating
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinay Belgaumkar <[email protected]>
[ Upstream commit 1852d27aa998272696680607b65a2ceac966104e ]
Where applicable, enable media sampler power gating. Also, add it to the powergate_info debugfs.
v2: Remove the sampler powergate status since it is cleared quickly anyway.
v3: Use vcs mask (Rodrigo) and fix the version check for media
v4: Remove extra spaces
v5: Media samplers are independent of vcs mask,
use Media version 1255 (Matt Roper)
--- drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_gt_idle.c | 8 ++++++++ 2 files changed, 9 insertions(+)
drivers/gpu/drm/xe/regs/xe_gt_regs.h +1 -0
@@ -342,6 +342,7 @@#define POWERGATE_ENABLE XE_REG(0xa210)#define RENDER_POWERGATE_ENABLE REG_BIT(0)#define MEDIA_POWERGATE_ENABLE REG_BIT(1) +#define MEDIA_SAMPLERS_POWERGATE_ENABLE REG_BIT(2)#define VDN_HCP_POWERGATE_ENABLE (n) REG_BIT(3 + 2 * (n))#define VDN_MFXVDENC_POWERGATE_ENABLE (n) REG_BIT(4 + 2 * (n))
drivers/gpu/drm/xe/xe_gt_idle.c +8 -0
@@ -124,6 +124,9 @@ void xe_gt_idle_enable_pg(struct xe_gt *gt)if (xe_gt_is_main_type (gt)) gtidle->powergate_enable |=RENDER_POWERGATE_ENABLE ; +if (MEDIA_VERx100 (xe) >=1100 &&MEDIA_VERx100 (xe) <1255 ) + gtidle->powergate_enable |=MEDIA_SAMPLERS_POWERGATE_ENABLE ; +if (xe->info.platform !=XE_DG1 ) {for (i =XE_HW_ENGINE_VCS0 , j =0 ; i <=XE_HW_ENGINE_VCS7 ; ++i, ++j) {if ((gt->info.engine_mask &BIT (i)))
@@ -246,6 +249,11 @@ int xe_gt_idle_pg_print(struct xe_gt *gt, struct drm_printer *p)drm_printf (p,"Media Slice%d Power Gate Status: %s\n" , n,str_up_down (pg_status & media_slices[n].status_bit)); } + +if (MEDIA_VERx100 (xe) >=1100 &&MEDIA_VERx100 (xe) <1255 ) +drm_printf (p,"Media Samplers Power Gating Enabled: %s\n" , +str_yes_no (pg_enabled &MEDIA_SAMPLERS_POWERGATE_ENABLE )); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/159 cxl/features: Add check for no entries in cxl_feature_info
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit a375246fcf2bbdaeb1df7fa7ee5a8b884a89085e ]
cxl EDAC calls cxl_feature_info() to get the feature information and if the hardware has no Features support, cxlfs may be passed in as NULL.
[ 51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 51.965571] #PF: supervisor read access in kernel mode [ 51.971559] #PF: error_code(0x0000) - not-present page [ 51.977542] PGD 17e4f6067 P4D 0 [ 51.981384] Oops: Oops: 0000 [#1] SMP NOPTI [ 51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj test+ #64 PREEMPT(voluntary) [ 51.997355] Hardware name: <removed> [ 52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core]
Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if there is no cxlfs created due to no hardware support.
--- drivers/cxl/core/features.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cxl/core/features.c +3 -0
@@ -371,6 +371,9 @@ cxl_feature_info(struct cxl_features_state *cxlfs, {struct cxl_feat_entry *feat; +if (!cxlfs || !cxlfs->entries) +return ERR_PTR (-EOPNOTSUPP ); +for (int i =0 ; i < cxlfs->entries->num_features; i++) { feat = &cxlfs->entries->ent[i];if (uuid_equal (uuid, &feat->uuid))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/159 x86/mm: Fix SMP ordering in switch_mm_irqs_off()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <[email protected]>
[ Upstream commit 83b0177a6c4889b3a6e865da5e21b2c9d97d0551 ]
Stephen noted that it is possible to not have an smp_mb() between the loaded_mm store and the tlb_gen load in switch_mm(), meaning the ordering against flush_tlb_mm_range() goes out the window, and it becomes possible for switch_mm() to not observe a recent tlb_gen update and fail to flush the TLBs.
[ dhansen: merge conflict fixed by Ingo ]
--- arch/x86/mm/tlb.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
arch/x86/mm/tlb.c +22 -2
@@ -911,11 +911,31 @@ void switch_mm_irqs_off(struct mm_struct *unused, struct mm_struct *next,* CR3 and cpu_tlbstate.loaded_mm are not all in sync. */ this_cpu_write (cpu_tlbstate.loaded_mm,LOADED_MM_SWITCHING ); -barrier (); -/* Start receiving IPIs and then read tlb_gen (and LAM below) */ +/* +* Make sure this CPU is set in mm_cpumask() such that we'll +* receive invalidation IPIs. +* +* Rely on the smp_mb() implied by cpumask_set_cpu()'s atomic +* operation, or explicitly provide one. Such that: +* +* switch_mm_irqs_off() flush_tlb_mm_range() +* smp_store_release(loaded_mm, SWITCHING); atomic64_inc_return(tlb_gen) +* smp_mb(); // here // smp_mb() implied +* atomic64_read(tlb_gen); this_cpu_read(loaded_mm); +* +* we properly order against flush_tlb_mm_range(), where the +* loaded_mm load can happen in mative_flush_tlb_multi() -> +* should_flush_tlb(). +* +* This way switch_mm() must see the new tlb_gen or +* flush_tlb_mm_range() must see the new loaded_mm, or both. +*/ if (next != &init_mm && !cpumask_test_cpu (cpu,mm_cpumask (next)))cpumask_set_cpu (cpu,mm_cpumask (next)); +else +smp_mb (); + next_tlb_gen =atomic64_read (&next->context.tlb_gen); ns =choose_new_asid (next, next_tlb_gen);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/159 drm/draw: fix color truncation in drm_draw_fill24
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Valla <[email protected]>
[ Upstream commit 095232711f23179053ca26bcf046ca121a91a465 ]
The color parameter passed to drm_draw_fill24() was truncated to 16 bits, leading to an incorrect color drawn to the target iosys_map. Fix this behavior, widening the parameter to 32 bits.
--- drivers/gpu/drm/drm_draw.c | 2 +- drivers/gpu/drm/drm_draw_internal.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_draw.c +1 -1
@@ -127,7 +127,7 @@ EXPORT_SYMBOL(drm_draw_fill16);void drm_draw_fill24 (struct iosys_map *dmap,unsigned int dpitch,unsigned int height,unsigned int width, -u16 color) +u32 color) {unsigned int y, x;
drivers/gpu/drm/drm_draw_internal.h +1 -1
@@ -47,7 +47,7 @@ void drm_draw_fill16(struct iosys_map *dmap, unsigned int dpitch,void drm_draw_fill24 (struct iosys_map *dmap,unsigned int dpitch,unsigned int height,unsigned int width, -u16 color); +u32 color); void drm_draw_fill32(struct iosys_map *dmap, unsigned int dpitch, unsigned int height, unsigned int width,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/159 drm/rockchip: vop2: use correct destination rectangle height check
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ]
The vop2_plane_atomic_check() function incorrectly checks drm_rect_width(dest) twice instead of verifying both width and height. Fix the second condition to use drm_rect_height(dest) so that invalid destination rectangles with height < 4 are correctly rejected.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +1 -1
@@ -1031,7 +1031,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane,return format;if (drm_rect_width (src) >>16 <4 ||drm_rect_height (src) >>16 <4 || -drm_rect_width (dest) <4 ||drm_rect_width (dest) <4 ) { +drm_rect_width (dest) <4 ||drm_rect_height (dest) <4 ) {drm_err (vop2->drm,"Invalid size: %dx%d->%dx%d, min size is 4x4\n" ,drm_rect_width (src) >>16 ,drm_rect_height (src) >>16 ,drm_rect_width (dest),drm_rect_height (dest));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/159 HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level to edge detection
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Even Xu <[email protected]>
[ Upstream commit 8fe2cd8ec84b3592b57f40b080f9d5aeebd553af ]
The original implementation used level detection for the first interrupt after device reset to avoid potential interrupt line noise and missed interrupts during the initialization phase. However, this approach introduced unintended side effects when tested with certain touch panels, including:
- Delayed hardware interrupt response
- Multiple spurious interrupt triggers
Switching back to edge detection for the first interrupt resolves these issues while maintaining reliable interrupt handling.
Extensive testing across multiple platforms with touch panels from various vendors confirms this change introduces no regressions.
--- drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c +1 -2
@@ -280,8 +280,7 @@ int reset_tic(struct quickspi_device *qsdev) qsdev->reset_ack = false; -/* First interrupt uses level trigger to avoid missing interrupt */ -thc_int_trigger_type_select (qsdev->thc_hw, false); +thc_int_trigger_type_select (qsdev->thc_hw, true); ret =acpi_tic_reset (qsdev);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/159 sched/deadline: Stop dl_server before CPU goes offline
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra (Intel) <[email protected]>
[ Upstream commit ee6e44dfe6e50b4a5df853d933a96bdff5309e6e ]
IBM CI tool reported kernel warning[1] when running a CPU removal operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1"
WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0x170 NIP [c0000000002b6ed8] cpudl_set+0x58/0x170 LR [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 Call Trace: [c000000002c2f8c0] init_stack+0x78c0/0x8000 (unreliable) [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 [c00000000034df84] __hrtimer_run_queues+0x1a4/0x390 [c00000000034f624] hrtimer_interrupt+0x124/0x300 [c00000000002a230] timer_interrupt+0x140/0x320
Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck")
This happens since:
- dl_server hrtimer gets enqueued close to cpu offline, when kthread_park enqueues a fair task.
- CPU goes offline and drmgr removes it from cpu_present_mask.
- hrtimer fires and warning is hit.
Fix it by stopping the dl_server before CPU is marked dead.
[1]: https://lore.kernel.org/all/[email protected]/
[2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr
--- kernel/sched/core.c | 2 ++ kernel/sched/deadline.c | 3 +++ 2 files changed, 5 insertions(+)
kernel/sched/core.c +2 -0
@@ -8603,10 +8603,12 @@ int sched_cpu_dying(unsigned int cpu)sched_tick_stop (cpu);rq_lock_irqsave (rq, &rf); +update_rq_clock (rq);if (rq->nr_running !=1 ||rq_has_pinned_tasks (rq)) {WARN (true,"Dying CPU not properly vacated!" );dump_rq_tasks (rq,KERN_WARNING ); } +dl_server_stop (&rq->fair_server);rq_unlock_irqrestore (rq, &rf);calc_load_migrate (rq);
kernel/sched/deadline.c +3 -0
@@ -1582,6 +1582,9 @@ void dl_server_start(struct sched_dl_entity *dl_se)if (!dl_server (dl_se) || dl_se->dl_server_active)return ; +if (WARN_ON_ONCE (!cpu_online (cpu_of (rq)))) +return ; + dl_se->dl_server_active =1 ;enqueue_dl_entity (dl_se,ENQUEUE_WAKEUP );if (!dl_task (dl_se->rq->curr) ||dl_entity_preempt (dl_se, &rq->curr->dl))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/159 sched/fair: Fix pelt lost idle time detection
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Guittot <[email protected]>
[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
The check for some lost idle pelt time should be always done when pick_next_task_fair() fails to pick a task and not only when we call it from the fair fast-path.
The case happens when the last running task on rq is a RT or DL task. When the latter goes to sleep and the /Sum of util_sum of the rq is at the max value, we don't account the lost of idle time whereas we should.
--- kernel/sched/fair.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
kernel/sched/fair.c +13 -13
@@ -8829,21 +8829,21 @@ pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rfreturn p; idle: -if (!rf) -return NULL ; - - new_tasks =sched_balance_newidle (rq, rf); +if (rf) { + new_tasks =sched_balance_newidle (rq, rf); -/* -* Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is -* possible for any higher priority task to appear. In that case we -* must re-start the pick_next_entity() loop. -*/ -if (new_tasks <0 ) -return RETRY_TASK ; +/* +* Because sched_balance_newidle() releases (and re-acquires) +* rq->lock, it is possible for any higher priority task to +* appear. In that case we must re-start the pick_next_entity() +* loop. +*/ +if (new_tasks <0 ) +return RETRY_TASK ; -if (new_tasks >0 ) - goto again; +if (new_tasks >0 ) + goto again; + }/* * rq is about to be idle, check if we need to update the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/159 ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
--- sound/firewire/amdtp-stream.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/firewire/amdtp-stream.h +1 -1
@@ -32,7 +32,7 @@* allows 5 times as large as IEC 61883-6 defines. * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include * valid EOH. -* @CIP_NO_HEADERS: a lack of headers in packets +* @CIP_NO_HEADER: a lack of headers in packets * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to * the value of current SYT_INTERVAL; e.g. initial value is not zero. * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/159 accel/qaic: Fix bootlog initialization ordering
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrey Hugo <[email protected]>
[ Upstream commit fd6e385528d8f85993b7bfc6430576136bb14c65 ]
As soon as we queue MHI buffers to receive the bootlog from the device, we could be receiving data. Therefore all the resources needed to process that data need to be setup prior to queuing the buffers.
We currently initialize some of the resources after queuing the buffers which creates a race between the probe() and any data that comes back from the device. If the uninitialized resources are accessed, we could see page faults.
Fix the init ordering to close the race.
--- drivers/accel/qaic/qaic_debugfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/accel/qaic/qaic_debugfs.c +3 -2
@@ -218,6 +218,9 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_dif (ret) goto destroy_workqueue; +dev_set_drvdata (&mhi_dev->dev, qdev); + qdev->bootlog_ch = mhi_dev; +for (i =0 ; i <BOOTLOG_POOL_SIZE ; i++) { msg =devm_kzalloc (&qdev->pdev->dev,sizeof (*msg),GFP_KERNEL );if (!msg) {
@@ -233,8 +236,6 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d goto mhi_unprepare; } -dev_set_drvdata (&mhi_dev->dev, qdev); - qdev->bootlog_ch = mhi_dev;return 0 ; mhi_unprepare:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/159 accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youssef Samir <[email protected]>
[ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ]
Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size is equal to the requested transaction size, the function will return 0 before allocating an sgt or setting the fields of the dma_xfer struct. In that case, encode_addr_size_pairs() will try to access the sgt which will lead to a general protection fault.
Return an EINVAL in case the user provides a zero-sized ALP, or the device requests continuation after all of the bytes have been transferred.
--- drivers/accel/qaic/qaic_control.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accel/qaic/qaic_control.c +1 -1
@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev,return -EINVAL ; remaining = in_trans->size - resources->xferred_dma_size;if (remaining ==0 ) -return 0 ; +return -EINVAL ;if (check_add_overflow (xfer_start_addr, remaining, &end))return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/159 accel/qaic: Synchronize access to DBC request queue head & tail pointer
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranjal Ramajor Asha Kanojiya <[email protected]>
[ Upstream commit 52e59f7740ba23bbb664914967df9a00208ca10c ]
Two threads of the same process can potential read and write parallelly to head and tail pointers of the same DBC request queue. This could lead to a race condition and corrupt the DBC request queue.
--- drivers/accel/qaic/qaic.h | 2 ++ drivers/accel/qaic/qaic_data.c | 12 ++++++++++-- drivers/accel/qaic/qaic_drv.c | 3 +++ 3 files changed, 15 insertions(+), 2 deletions(-)
drivers/accel/qaic/qaic.h +2 -0
@@ -97,6 +97,8 @@ struct dma_bridge_chan {* response queue's head and tail pointer of this DBC. */ void __iomem *dbc_base; +/* Synchronizes access to Request queue's head and tail pointer */ +struct mutex req_lock;/* Head of list where each node is a memory handle queued in request queue */ struct list_head xfer_list;/* Synchronizes DBC readers during cleanup */
drivers/accel/qaic/qaic_data.c +10 -2
@@ -1356,13 +1356,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr goto release_ch_rcu; } + ret =mutex_lock_interruptible (&dbc->req_lock); +if (ret) + goto release_ch_rcu; + head =readl (dbc->dbc_base +REQHP_OFF ); tail =readl (dbc->dbc_base +REQTP_OFF );if (head ==U32_MAX || tail ==U32_MAX ) {/* PCI link error */ ret = -ENODEV ; - goto release_ch_rcu; + goto unlock_req_lock; } queue_level = head <= tail ? tail - head : dbc->nelem - (head - tail);
@@ -1370,11 +1374,12 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr ret =send_bo_list_to_device (qdev, file_priv, exec, args->hdr.count, is_partial, dbc, head, &tail);if (ret) - goto release_ch_rcu; + goto unlock_req_lock;/* Finalize commit to hardware */ submit_ts =ktime_get_ns ();writel (tail, dbc->dbc_base +REQTP_OFF ); +mutex_unlock (&dbc->req_lock);update_profiling_data (file_priv, exec, args->hdr.count, is_partial, received_ts, submit_ts, queue_level);
@@ -1382,6 +1387,9 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct drif (datapath_polling)schedule_work (&dbc->poll_work); +unlock_req_lock: +if (ret) +mutex_unlock (&dbc->req_lock); release_ch_rcu:srcu_read_unlock (&dbc->ch_lock, rcu_id); unlock_dev_srcu:
drivers/accel/qaic/qaic_drv.c +3 -0
@@ -454,6 +454,9 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev,return NULL ;init_waitqueue_head (&qdev->dbc[i].dbc_release);INIT_LIST_HEAD (&qdev->dbc[i].bo_lists); + ret =drmm_mutex_init (drm, &qdev->dbc[i].req_lock); +if (ret) +return NULL ; }return qdev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/159 nvme-auth: update sc_c in host response
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin George <[email protected]>
[ Upstream commit 7e091add9c433bab6912228799bf508e2414acc3 ]
The sc_c field is currently not updated in the host response to the controller challenge leading to failures while attempting secure channel concatenation. Fix this by adding a new sc_c variable to the dhchap queue context structure which is appropriately set during negotiate and then used in the host response.
--- drivers/nvme/host/auth.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/nvme/host/auth.c +5 -1
@@ -36,6 +36,7 @@ struct nvme_dhchap_queue_context {u8 status;u8 dhgroup_id;u8 hash_id; +u8 sc_c;size_t hash_len;u8 c1[64 ];u8 c2[64 ];
@@ -154,6 +155,8 @@ static int nvme_auth_set_dhchap_negotiate_data(struct nvme_ctrl *ctrl, data->auth_protocol[0 ].dhchap.idlist[34 ] =NVME_AUTH_DHGROUP_6144 ; data->auth_protocol[0 ].dhchap.idlist[35 ] =NVME_AUTH_DHGROUP_8192 ; + chap->sc_c = data->sc_c; +return size; }
@@ -489,7 +492,7 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl, ret =crypto_shash_update (shash, buf,2 );if (ret) goto out; -memset (buf,0 ,sizeof (buf)); + *buf = chap->sc_c; ret =crypto_shash_update (shash, buf,1 );if (ret) goto out;
@@ -500,6 +503,7 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl, strlen(ctrl->opts->host->nqn));if (ret) goto out; +memset (buf,0 ,sizeof (buf)); ret =crypto_shash_update (shash, buf,1 );if (ret) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/159 cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <[email protected]>
[ Upstream commit a4bbb493a3247ef32f6191fd8b2a0657139f8e08 ]
Traces of cxl_poison events include an hpa_alias0 field if the poison address is in a region configured with an ELC, Extended Linear Cache.
Since the ELC always comes first in the region, the calculation needs to subtract the ELC size from the calculated HPA address.
--- drivers/cxl/core/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cxl/core/trace.h +1 -1
@@ -1068,7 +1068,7 @@ TRACE_EVENT(cxl_poison, __entry->hpa =cxl_dpa_to_hpa (cxlr, cxlmd, __entry->dpa);if (__entry->hpa !=ULLONG_MAX && cxlr->params.cache_size) - __entry->hpa_alias0 = __entry->hpa + + __entry->hpa_alias0 = __entry->hpa - cxlr->params.cache_size;else __entry->hpa_alias0 =ULLONG_MAX ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/159 selftests/bpf: make arg_parsing.c more robust to crashes
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 ]
We started getting a crash in BPF CI, which seems to originate from test_parse_test_list_file() test and is happening at this line:
ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");One way we can crash there is if set.cnt zero, which is checked for with ASSERT_EQ() above, but we proceed after this regardless of the outcome. Instead of crashing, we should bail out with test failure early.
Similarly, if parse_test_list_file() fails, we shouldn't be even looking at set, so bail even earlier if ASSERT_OK() fails.
--- tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/testing/selftests/bpf/prog_tests/arg_parsing.c +6 -3
@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void)init_test_filter_set (&set); -ASSERT_OK (parse_test_list_file (tmpfile, &set, true),"parse file" ); +if (!ASSERT_OK (parse_test_list_file (tmpfile, &set, true),"parse file" )) + goto out_fclose; + +if (!ASSERT_EQ (set.cnt,4 ,"test count" )) + goto out_free_set; -ASSERT_EQ (set.cnt,4 ,"test count" );ASSERT_OK (strcmp ("test_with_spaces" , set.tests[0 ].name),"test 0 name" );ASSERT_EQ (set.tests[0 ].subtest_cnt,0 ,"test 0 subtest count" );ASSERT_OK (strcmp ("testA" , set.tests[1 ].name),"test 1 name" );
@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void)ASSERT_OK (strcmp ("testB" , set.tests[2 ].name),"test 2 name" );ASSERT_OK (strcmp ("testC_no_eof_newline" , set.tests[3 ].name),"test 3 name" ); +out_free_set:free_test_filter_set (&set); - out_fclose:fclose (fp); out_remove:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/159 ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaming Zhang <[email protected]>
[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ]
In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed().
--- sound/usb/card.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
sound/usb/card.c +8 -2
@@ -850,10 +850,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id)*/ static int try_to_register_card (struct snd_usb_audio *chip,int ifnum) { +struct usb_interface *iface; +if (check_delayed_register_option (chip) == ifnum || - chip->last_iface == ifnum || -usb_interface_claimed (usb_ifnum_to_if (chip->dev, chip->last_iface))) + chip->last_iface == ifnum) +return snd_card_register (chip->card); + + iface =usb_ifnum_to_if (chip->dev, chip->last_iface); +if (iface &&usb_interface_claimed (iface))return snd_card_register (chip->card); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/159 blk-mq: fix stale tag depth for shared sched tags in blk_mq_update_nr_requests()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit dc96cefef0d3032c69e46a21b345c60e56b18934 ]
Commit 7f2799c546db ("blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()") moves blk_mq_tag_update_sched_shared_tags() before q->nr_requests is updated, however, it's still using the old q->nr_requests to resize tag depth.
Fix this problem by passing in expected new tag depth.
--- block/blk-mq-sched.c | 2 +- block/blk-mq-tag.c | 5 +++-- block/blk-mq.c | 2 +- block/blk-mq.h | 3 ++- 4 files changed, 7 insertions(+), 5 deletions(-)
block/blk-mq-sched.c +1 -1
@@ -557,7 +557,7 @@ int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e,if (blk_mq_is_shared_tags (flags)) {/* Shared tags are stored at index 0 in @et->tags. */ q->sched_shared_tags = et->tags[0 ]; -blk_mq_tag_update_sched_shared_tags (q); +blk_mq_tag_update_sched_shared_tags (q, et->nr_requests); }queue_for_each_hw_ctx (q, hctx, i) {
block/blk-mq-tag.c +3 -2
@@ -622,10 +622,11 @@ void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set, unsigned int sizesbitmap_queue_resize (&tags->bitmap_tags, size - set->reserved_tags); } -void blk_mq_tag_update_sched_shared_tags (struct request_queue *q) +void blk_mq_tag_update_sched_shared_tags (struct request_queue *q, +unsigned int nr) {sbitmap_queue_resize (&q->sched_shared_tags->bitmap_tags, - q->nr_requests - q->tag_set->reserved_tags); + nr - q->tag_set->reserved_tags); }/**
block/blk-mq.c +1 -1
@@ -4942,7 +4942,7 @@ struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q,* tags can't grow, see blk_mq_alloc_sched_tags(). */ if (q->elevator) -blk_mq_tag_update_sched_shared_tags (q); +blk_mq_tag_update_sched_shared_tags (q, nr);else blk_mq_tag_resize_shared_tags (set, nr); }else if (!q->elevator) {
block/blk-mq.h +2 -1
@@ -188,7 +188,8 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, struct blk_mq_tags **tags, unsigned int depth);void blk_mq_tag_resize_shared_tags (struct blk_mq_tag_set *set,unsigned int size); -void blk_mq_tag_update_sched_shared_tags (struct request_queue *q); +void blk_mq_tag_update_sched_shared_tags (struct request_queue *q, +unsigned int nr);void blk_mq_tag_wakeup_all (struct blk_mq_tags *tags,bool ); void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_tag_iter_fn *fn,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/159 block: Remove elevator_lock usage from blkg_conf frozen operations
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 08823e89e3e269bf4c4a20b4c24a8119920cc7a4 ]
Remove the acquisition and release of q->elevator_lock in the blkg_conf_open_bdev_frozen() and blkg_conf_exit_frozen() functions. The elevator lock is no longer needed in these code paths since commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()") which introduces disk->rqos_state_mutex for protecting wbt state change, and not necessary to abuse elevator_lock for this purpose.
This change helps to solve the lockdep warning reported from Yu Kuai[1].
Pass blktests/throtl with lockdep enabled.
Links: https://lore.kernel.org/linux-block/[email protected]/ [1]
--- block/blk-cgroup.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
block/blk-cgroup.c +4 -9
@@ -812,8 +812,7 @@ int blkg_conf_open_bdev(struct blkg_conf_ctx *ctx) }/* * Similar to blkg_conf_open_bdev, but additionally freezes the queue, -* acquires q->elevator_lock, and ensures the correct locking order -* between q->elevator_lock and q->rq_qos_mutex. +* ensures the correct locking order between freeze queue and q->rq_qos_mutex. * * This function returns negative error on failure. On success it returns * memflags which must be saved and later passed to blkg_conf_exit_frozen
@@ -834,13 +833,11 @@ unsigned long __must_check blkg_conf_open_bdev_frozen(struct blkg_conf_ctx *ctx)* At this point, we haven’t started protecting anything related to QoS, * so we release q->rq_qos_mutex here, which was first acquired in blkg_ * conf_open_bdev. Later, we re-acquire q->rq_qos_mutex after freezing -* the queue and acquiring q->elevator_lock to maintain the correct -* locking order. +* the queue to maintain the correct locking order. */ mutex_unlock (&ctx->bdev->bd_queue->rq_qos_mutex); memflags =blk_mq_freeze_queue (ctx->bdev->bd_queue); -mutex_lock (&ctx->bdev->bd_queue->elevator_lock);mutex_lock (&ctx->bdev->bd_queue->rq_qos_mutex);return memflags;
@@ -1002,9 +999,8 @@ void blkg_conf_exit(struct blkg_conf_ctx *ctx)EXPORT_SYMBOL_GPL (blkg_conf_exit);/* -* Similar to blkg_conf_exit, but also unfreezes the queue and releases -* q->elevator_lock. Should be used when blkg_conf_open_bdev_frozen -* is used to open the bdev. +* Similar to blkg_conf_exit, but also unfreezes the queue. Should be used +* when blkg_conf_open_bdev_frozen is used to open the bdev. */ void blkg_conf_exit_frozen (struct blkg_conf_ctx *ctx,unsigned long memflags) {
@@ -1012,7 +1008,6 @@ void blkg_conf_exit_frozen(struct blkg_conf_ctx *ctx, unsigned long memflags)struct request_queue *q = ctx->bdev->bd_queue;blkg_conf_exit (ctx); -mutex_unlock (&q->elevator_lock);blk_mq_unfreeze_queue (q, memflags); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/159 HID: hid-input: only ignore 0 battery events for digitizers
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ]
Commit 581c4484769e ("HID: input: map digitizer battery usage") added handling of battery events for digitizers (typically for batteries presented in stylii). Digitizers typically report correct battery levels only when stylus is actively touching the surface, and in other cases they may report battery level of 0. To avoid confusing consumers of the battery information the code was added to filer out reports with 0 battery levels.
However there exist other kinds of devices that may legitimately report 0 battery levels. Fix this by filtering out 0-level reports only for digitizer usages, and continue reporting them for other kinds of devices (Smart Batteries, etc).
--- drivers/hid/hid-input.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hid/hid-input.c +4 -1
@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage,return ; } -if (value ==0 || value < dev->battery_min || value > dev->battery_max) +if ((usage &HID_USAGE_PAGE ) ==HID_UP_DIGITIZER && value ==0 ) +return ; + +if (value < dev->battery_min || value > dev->battery_max)return ; capacity =hidinput_scale_battery_capacity (dev, value);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/159 HID: multitouch: fix name of Stylus input devices
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ]
HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN"). However, on multitouch devices, these suffixes may be overridden. Before that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after that, multitouch would override them to have an "UNKNOWN" suffix. Just add HID_DG_PEN to the list of non-overriden suffixes in multitouch.
Before this fix:
[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
ELAN9008:00 04F3:2E14 UNKNOWN
After this fix:
[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
ELAN9008:00 04F3:2E14 Stylus
--- drivers/hid/hid-multitouch.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/hid-multitouch.c +1 -0
@@ -1711,6 +1711,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)case HID_CP_CONSUMER_CONTROL :case HID_GD_WIRELESS_RADIO_CTLS :case HID_GD_SYSTEM_MULTIAXIS : +case HID_DG_PEN :/* already handled by hid core */ break ;case HID_DG_TOUCHSCREEN :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/159 ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <[email protected]>
[ Upstream commit 5726b68473f7153a7f6294185e5998b7e2a230a2 ]
devm_kasprintf() may return NULL on memory allocation failure, but the debug message prints cpus->dai_name before checking it. Move the dev_dbg() call after the NULL check to prevent potential NULL pointer dereference.
--- sound/soc/amd/acp/acp-sdw-sof-mach.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/amd/acp/acp-sdw-sof-mach.c +1 -1
@@ -176,9 +176,9 @@ static int create_sdw_dailink(struct snd_soc_card *card, cpus->dai_name =devm_kasprintf (dev,GFP_KERNEL ,"SDW%d Pin%d" , link_num, cpu_pin_id); -dev_dbg (dev,"cpu->dai_name:%s\n" , cpus->dai_name);if (!cpus->dai_name)return -ENOMEM ; +dev_dbg (dev,"cpu->dai_name:%s\n" , cpus->dai_name); codec_maps[j].cpu =0 ; codec_maps[j].codec = j;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/159 drm/xe/evict: drop bogus assert
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
[ Upstream commit 225bc03d85427e7e3821d6f99f4f2d4a09350dda ]
This assert can trigger here with non pin_map users that select LATE_RESTORE, since the vmap is allowed to be NULL given that save/restore can now use the blitter instead. The check here doesn't seem to have much value anymore given that we no longer move pinned memory, so any existing vmap is left well alone, and doesn't need to be recreated upon restore, so just drop the assert here.
--- drivers/gpu/drm/xe/xe_bo_evict.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/gpu/drm/xe/xe_bo_evict.c +0 -8
@@ -182,7 +182,6 @@ int xe_bo_evict_all(struct xe_device *xe)static int xe_bo_restore_and_map_ggtt (struct xe_bo *bo) { -struct xe_device *xe =xe_bo_device (bo);int ret; ret =xe_bo_restore_pinned (bo);
@@ -201,13 +200,6 @@ static int xe_bo_restore_and_map_ggtt(struct xe_bo *bo) } } -/* -* We expect validate to trigger a move VRAM and our move code -* should setup the iosys map. -*/ -xe_assert (xe, !(bo->flags &XE_BO_FLAG_PINNED_LATE_RESTORE ) || - !iosys_map_is_null (&bo->vmap)); -return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/159 selftests: arg_parsing: Ensure data is flushed to disk before reading.
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xing Guo <[email protected]>
[ Upstream commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a ]
test_parse_test_list_file writes some data to /tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read the data back. However, after writing data to that file, we forget to call fsync() and it's causing testing failure in my laptop. This patch helps fix it by adding the missing fsync() call.
--- tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 3 +++ 1 file changed, 3 insertions(+)
tools/testing/selftests/bpf/prog_tests/arg_parsing.c +3 -0
@@ -144,6 +144,9 @@ static void test_parse_test_list_file(void)if (!ASSERT_OK (ferror (fp),"prepare tmp" )) goto out_fclose; +if (!ASSERT_OK (fsync (fileno (fp)),"fsync tmp" )) + goto out_fclose; +init_test_filter_set (&set);if (!ASSERT_OK (parse_test_list_file (tmpfile, &set, true),"parse file" ))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/159 nvme/tcp: handle tls partially sent records in write_space()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wilfred Mallawa <[email protected]>
[ Upstream commit 5a869d017793399fd1d2609ff27e900534173eb3 ]
With TLS enabled, records that are encrypted and appended to TLS TX list can fail to see a retry if the underlying TCP socket is busy, for example, hitting an EAGAIN from tcp_sendmsg_locked(). This is not known to the NVMe TCP driver, as the TLS layer successfully generated a record.
Typically, the TLS write_space() callback would ensure such records are retried, but in the NVMe TCP Host driver, write_space() invokes nvme_tcp_write_space(). This causes a partially sent record in the TLS TX list to timeout after not being retried.
This patch fixes the above by calling queue->write_space(), which calls into the TLS layer to retry any pending records.
--- drivers/nvme/host/tcp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/nvme/host/tcp.c +3 -0
@@ -1081,6 +1081,9 @@ static void nvme_tcp_write_space(struct sock *sk) queue = sk->sk_user_data;if (likely (queue &&sk_stream_is_writeable (sk))) {clear_bit (SOCK_NOSPACE , &sk->sk_socket->flags); +/* Ensure pending TLS partial records are retried */ +if (nvme_tcp_queue_tls (queue)) + queue->write_space (sk);queue_work_on (queue->io_cpu, nvme_tcp_wq, &queue->io_work); }read_unlock_bh (&sk->sk_callback_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/159 rust: cpufreq: fix formatting
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 32f072d9eaf9c31c2b0527a4a3370570a731e3cc ]
We do our best to keep the repository rustfmt-clean, thus run the tool to fix the formatting issue.
--- rust/kernel/cpufreq.rs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
rust/kernel/cpufreq.rs +1 -2
@@ -39,8 +39,7 @@ use macros::vtable;const CPUFREQ_NAME_LEN :usize = bindings::CPUFREQ_NAME_LEN as usize ;/// Default transition latency value in nanoseconds. -pub const DEFAULT_TRANSITION_LATENCY_NS :u32 = - bindings::CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ; +pub const DEFAULT_TRANSITION_LATENCY_NS :u32 = bindings::CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ;/// CPU frequency driver flags. pub mod flags {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/159 hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
commit 42520df65bf67189541a425f7d36b0b3e7bd7844 upstream.
The hfsplus_strcasecmp() logic can trigger the issue:
[ 117.317703][ T9855] ================================================================== [ 117.318353][ T9855] BUG: KASAN: slab-out-of-bounds in hfsplus_strcasecmp+0x1bc/0x490 [ 117.318991][ T9855] Read of size 2 at addr ffff88802160f40c by task repro/9855 [ 117.319577][ T9855] [ 117.319773][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: repro Not tainted 6.17.0-rc6 #33 PREEMPT(full) [ 117.319780][ T9855] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.319783][ T9855] Call Trace: [ 117.319785][ T9855] <TASK> [ 117.319788][ T9855] dump_stack_lvl+0x1c1/0x2a0 [ 117.319795][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319803][ T9855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 117.319808][ T9855] ? rcu_is_watching+0x15/0xb0 [ 117.319816][ T9855] ? lock_release+0x4b/0x3e0 [ 117.319821][ T9855] ? __kasan_check_byte+0x12/0x40 [ 117.319828][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319835][ T9855] ? __virt_addr_valid+0x4a5/0x5c0 [ 117.319842][ T9855] print_report+0x17e/0x7e0 [ 117.319848][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319855][ T9855] ? __virt_addr_valid+0x4a5/0x5c0 [ 117.319862][ T9855] ? __phys_addr+0xd3/0x180 [ 117.319869][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490 [ 117.319876][ T9855] kasan_report+0x147/0x180 [ 117.319882][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490 [ 117.319891][ T9855] hfsplus_strcasecmp+0x1bc/0x490 [ 117.319900][ T9855] ? __pfx_hfsplus_cat_case_cmp_key+0x10/0x10 [ 117.319906][ T9855] hfs_find_rec_by_key+0xa9/0x1e0 [ 117.319913][ T9855] __hfsplus_brec_find+0x18e/0x470 [ 117.319920][ T9855] ? __pfx_hfsplus_bnode_find+0x10/0x10 [ 117.319926][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 117.319933][ T9855] ? __pfx___hfsplus_brec_find+0x10/0x10 [ 117.319942][ T9855] hfsplus_brec_find+0x28f/0x510 [ 117.319949][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 117.319956][ T9855] ? __pfx_hfsplus_brec_find+0x10/0x10 [ 117.319963][ T9855] ? __kmalloc_noprof+0x2a9/0x510 [ 117.319969][ T9855] ? hfsplus_find_init+0x8c/0x1d0 [ 117.319976][ T9855] hfsplus_brec_read+0x2b/0x120 [ 117.319983][ T9855] hfsplus_lookup+0x2aa/0x890 [ 117.319990][ T9855] ? __pfx_hfsplus_lookup+0x10/0x10 [ 117.320003][ T9855] ? d_alloc_parallel+0x2f0/0x15e0 [ 117.320008][ T9855] ? __lock_acquire+0xaec/0xd80 [ 117.320013][ T9855] ? __pfx_d_alloc_parallel+0x10/0x10 [ 117.320019][ T9855] ? __raw_spin_lock_init+0x45/0x100 [ 117.320026][ T9855] ? __init_waitqueue_head+0xa9/0x150 [ 117.320034][ T9855] __lookup_slow+0x297/0x3d0 [ 117.320039][ T9855] ? __pfx___lookup_slow+0x10/0x10 [ 117.320045][ T9855] ? down_read+0x1ad/0x2e0 [ 117.320055][ T9855] lookup_slow+0x53/0x70 [ 117.320065][ T9855] walk_component+0x2f0/0x430 [ 117.320073][ T9855] path_lookupat+0x169/0x440 [ 117.320081][ T9855] filename_lookup+0x212/0x590 [ 117.320089][ T9855] ? __pfx_filename_lookup+0x10/0x10 [ 117.320098][ T9855] ? strncpy_from_user+0x150/0x290 [ 117.320105][ T9855] ? getname_flags+0x1e5/0x540 [ 117.320112][ T9855] user_path_at+0x3a/0x60 [ 117.320117][ T9855] __x64_sys_umount+0xee/0x160 [ 117.320123][ T9855] ? __pfx___x64_sys_umount+0x10/0x10 [ 117.320129][ T9855] ? do_syscall_64+0xb7/0x3a0 [ 117.320135][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320141][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320145][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.320150][ T9855] ? exc_page_fault+0x9f/0xf0 [ 117.320154][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320158][ T9855] RIP: 0033:0x7f7dd7908b07 [ 117.320163][ T9855] Code: 23 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 08 [ 117.320167][ T9855] RSP: 002b:00007ffd5ebd9698 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 117.320172][ T9855] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7dd7908b07 [ 117.320176][ T9855] RDX: 0000000000000009 RSI: 0000000000000009 RDI: 00007ffd5ebd9740 [ 117.320179][ T9855] RBP: 00007ffd5ebda780 R08: 0000000000000005 R09: 00007ffd5ebd9530 [ 117.320181][ T9855] R10: 00007f7dd799bfc0 R11: 0000000000000202 R12: 000055e2008b32d0 [ 117.320184][ T9855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 117.320189][ T9855] </TASK> [ 117.320190][ T9855] [ 117.351311][ T9855] Allocated by task 9855: [ 117.351683][ T9855] kasan_save_track+0x3e/0x80 [ 117.352093][ T9855] __kasan_kmalloc+0x8d/0xa0 [ 117.352490][ T9855] __kmalloc_noprof+0x288/0x510 [ 117.352914][ T9855] hfsplus_find_init+0x8c/0x1d0 [ 117.353342][ T9855] hfsplus_lookup+0x19c/0x890 [ 117.353747][ T9855] __lookup_slow+0x297/0x3d0 [ 117.354148][ T9855] lookup_slow+0x53/0x70 [ 117.354514][ T9855] walk_component+0x2f0/0x430 [ 117.354921][ T9855] path_lookupat+0x169/0x440 [ 117.355325][ T9855] filename_lookup+0x212/0x590 [ 117.355740][ T9855] user_path_at+0x3a/0x60 [ 117.356115][ T9855] __x64_sys_umount+0xee/0x160 [ 117.356529][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.356920][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.357429][ T9855] [ 117.357636][ T9855] The buggy address belongs to the object at ffff88802160f000 [ 117.357636][ T9855] which belongs to the cache kmalloc-2k of size 2048 [ 117.358827][ T9855] The buggy address is located 0 bytes to the right of [ 117.358827][ T9855] allocated 1036-byte region [ffff88802160f000, ffff88802160f40c) [ 117.360061][ T9855] [ 117.360266][ T9855] The buggy address belongs to the physical page: [ 117.360813][ T9855] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21608 [ 117.361562][ T9855] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 117.362285][ T9855] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 117.362929][ T9855] page_type: f5(slab) [ 117.363282][ T9855] raw: 00fff00000000040 ffff88801a842f00 ffffea0000932000 dead000000000002 [ 117.364015][ T9855] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 117.364750][ T9855] head: 00fff00000000040 ffff88801a842f00 ffffea0000932000 dead000000000002 [ 117.365491][ T9855] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 117.366232][ T9855] head: 00fff00000000003 ffffea0000858201 00000000ffffffff 00000000ffffffff [ 117.366968][ T9855] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 117.367711][ T9855] page dumped because: kasan: bad access detected [ 117.368259][ T9855] page_owner tracks the page as allocated [ 117.368745][ T9855] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN1 [ 117.370541][ T9855] post_alloc_hook+0x240/0x2a0 [ 117.370954][ T9855] get_page_from_freelist+0x2101/0x21e0 [ 117.371435][ T9855] __alloc_frozen_pages_noprof+0x274/0x380 [ 117.371935][ T9855] alloc_pages_mpol+0x241/0x4b0 [ 117.372360][ T9855] allocate_slab+0x8d/0x380 [ 117.372752][ T9855] ___slab_alloc+0xbe3/0x1400 [ 117.373159][ T9855] __kmalloc_cache_noprof+0x296/0x3d0 [ 117.373621][ T9855] nexthop_net_init+0x75/0x100 [ 117.374038][ T9855] ops_init+0x35c/0x5c0 [ 117.374400][ T9855] setup_net+0x10c/0x320 [ 117.374768][ T9855] copy_net_ns+0x31b/0x4d0 [ 117.375156][ T9855] create_new_namespaces+0x3f3/0x720 [ 117.375613][ T9855] unshare_nsproxy_namespaces+0x11c/0x170 [ 117.376094][ T9855] ksys_unshare+0x4ca/0x8d0 [ 117.376477][ T9855] __x64_sys_unshare+0x38/0x50 [ 117.376879][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.377265][ T9855] page last free pid 9110 tgid 9110 stack trace: [ 117.377795][ T9855] __free_frozen_pages+0xbeb/0xd50 [ 117.378229][ T9855] __put_partials+0x152/0x1a0 [ 117.378625][ T9855] put_cpu_partial+0x17c/0x250 [ 117.379026][ T9855] __slab_free+0x2d4/0x3c0 [ 117.379404][ T9855] qlist_free_all+0x97/0x140 [ 117.379790][ T9855] kasan_quarantine_reduce+0x148/0x160 [ 117.380250][ T9855] __kasan_slab_alloc+0x22/0x80 [ 117.380662][ T9855] __kmalloc_noprof+0x232/0x510 [ 117.381074][ T9855] tomoyo_supervisor+0xc0a/0x1360 [ 117.381498][ T9855] tomoyo_env_perm+0x149/0x1e0 [ 117.381903][ T9855] tomoyo_find_next_domain+0x15ad/0x1b90 [ 117.382378][ T9855] tomoyo_bprm_check_security+0x11c/0x180 [ 117.382859][ T9855] security_bprm_check+0x89/0x280 [ 117.383289][ T9855] bprm_execve+0x8f1/0x14a0 [ 117.383673][ T9855] do_execveat_common+0x528/0x6b0 [ 117.384103][ T9855] __x64_sys_execve+0x94/0xb0 [ 117.384500][ T9855] [ 117.384706][ T9855] Memory state around the buggy address: [ 117.385179][ T9855] ffff88802160f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 117.385854][ T9855] ffff88802160f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 117.386534][ T9855] >ffff88802160f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.387204][ T9855] ^ [ 117.387566][ T9855] ffff88802160f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.388243][ T9855] ffff88802160f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.388918][ T9855] ==================================================================
The issue takes place if the length field of struct hfsplus_unistr is bigger than HFSPLUS_MAX_STRLEN. The patch simply checks the length of comparing strings. And if the strings' length is bigger than HFSPLUS_MAX_STRLEN, then it is corrected to this value.
v2
The string length correction has been added for hfsplus_strcmp().
--- fs/hfsplus/unicode.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
fs/hfsplus/unicode.c +24 -0
@@ -40,6 +40,18 @@ int hfsplus_strcasecmp(const struct hfsp p1 = s1->unicode; p2 = s2->unicode; +if (len1 >HFSPLUS_MAX_STRLEN ) { + len1 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s1->length), len1); + } + +if (len2 >HFSPLUS_MAX_STRLEN ) { + len2 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s2->length), len2); + } +while (1 ) { c1 = c2 =0 ;
@@ -74,6 +86,18 @@ int hfsplus_strcmp(const struct hfsplus_ p1 = s1->unicode; p2 = s2->unicode; +if (len1 >HFSPLUS_MAX_STRLEN ) { + len1 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s1->length), len1); + } + +if (len2 >HFSPLUS_MAX_STRLEN ) { + len2 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s2->length), len2); + } +for (len =min (len1, len2); len >0 ; len--) { c1 =be16_to_cpu (*p1); c2 =be16_to_cpu (*p2);
Greg Kroah-Hartman
maintainerPATCH 138/159 arm64: debug: always unmask interrupts in el0_softstp()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ada Couprie Diaz <[email protected]>
commit ea0d55ae4b3207c33691a73da3443b1fd379f1d2 upstream.
We intend that EL0 exception handlers unmask all DAIF exceptions before calling exit_to_user_mode().
When completing single-step of a suspended breakpoint, we do not call local_daif_restore(DAIF_PROCCTX) before calling exit_to_user_mode(), leaving all DAIF exceptions masked.
When pseudo-NMIs are not in use this is benign.
When pseudo-NMIs are in use, this is unsound. At this point interrupts are masked by both DAIF.IF and PMR_EL1, and subsequent irq flag manipulation may not work correctly. For example, a subsequent local_irq_enable() within exit_to_user_mode_loop() will only unmask interrupts via PMR_EL1 (leaving those masked via DAIF.IF), and anything depending on interrupts being unmasked (e.g. delivery of signals) will not work correctly.
This was detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING.
Move the call to try_step_suspended_breakpoints() outside of the check so that interrupts can be unmasked even if we don't call the step handler.
--- arch/arm64/kernel/entry-common.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/arm64/kernel/entry-common.c +5 -3
@@ -832,6 +832,8 @@ static void noinstr el0_breakpt(struct p static void noinstr el0_softstp(struct pt_regs *regs, unsigned long esr) { +bool step_done; +if (!is_ttbr0_addr (regs->pc))arm64_apply_bp_hardening ();
@@ -842,10 +844,10 @@ static void noinstr el0_softstp(struct p* If we are stepping a suspended breakpoint there's nothing more to do: * the single-step is complete. */ -if (!try_step_suspended_breakpoints (regs)) { -local_daif_restore (DAIF_PROCCTX ); + step_done =try_step_suspended_breakpoints (regs); +local_daif_restore (DAIF_PROCCTX ); +if (!step_done)do_el0_softstep (esr, regs); - }exit_to_user_mode (regs); }
Greg Kroah-Hartman
maintainerPATCH 139/159 arm64: cputype: Add Neoverse-V3AE definitions
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 upstream.
Add cputype definitions for Neoverse-V3AE. These will be used for errata detection in subsequent patches.
These values can be found in the Neoverse-V3AE TRM:
https://developer.arm.com/documentation/SDEN-2615521/9-0/
... in section A.6.1 ("MIDR_EL1, Main ID Register").
--- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/include/asm/cputype.h +2 -0
@@ -93,6 +93,7 @@#define ARM_CPU_PART_NEOVERSE_V2 0xD4F#define ARM_CPU_PART_CORTEX_A720 0xD81#define ARM_CPU_PART_CORTEX_X4 0xD82 +#define ARM_CPU_PART_NEOVERSE_V3AE 0xD83#define ARM_CPU_PART_NEOVERSE_V3 0xD84#define ARM_CPU_PART_CORTEX_X925 0xD85#define ARM_CPU_PART_CORTEX_A725 0xD87
@@ -182,6 +183,7 @@#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2)#define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720)#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) +#define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE)#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)#define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)#define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
Greg Kroah-Hartman
maintainerPATCH 140/159 arm64: errata: Apply workarounds for Neoverse-V3AE
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 0c33aa1804d101c11ba1992504f17a42233f0e11 upstream.
Neoverse-V3AE is also affected by erratum #3312417, as described in its Software Developer Errata Notice (SDEN) document:
Neoverse V3AE (MP172) SDEN v9.0, erratum 3312417
https://developer.arm.com/documentation/SDEN-2615521/9-0/
Enable the workaround for Neoverse-V3AE, and document this.
--- Documentation/arch/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 1 + arch/arm64/kernel/cpu_errata.c | 1 + 3 files changed, 4 insertions(+)
Documentation/arch/arm64/silicon-errata.rst +2 -0
@@ -200,6 +200,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | MMU-500 | #841119,826419 | ARM_SMMU_MMU_500_CPRE_ERRATA| | | | #562869,1047329 | | +----------------+-----------------+-----------------+-----------------------------+
arch/arm64/Kconfig +1 -0
@@ -1138,6 +1138,7 @@ config ARM64_ERRATUM_3194386 * ARM Neoverse-V1 erratum 3324341 * ARM Neoverse V2 erratum 3324336 * ARM Neoverse-V3 erratum 3312417 + * ARM Neoverse-V3AE erratum 3312417 On affected cores "MSR SSBS, #0" instructions may not affect subsequent speculative instructions, which may permit unexepected
arch/arm64/kernel/cpu_errata.c +1 -0
@@ -545,6 +545,7 @@ static const struct midr_range erratum_sMIDR_ALL_VERSIONS (MIDR_NEOVERSE_V1 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V2 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V3 ), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), {} };#endif
Greg Kroah-Hartman
maintainerPATCH 141/159 xfs: rename the old_crc variable in xlog_recover_process
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 0b737f4ac1d3ec093347241df74bbf5f54a7e16c ]
old_crc is a very misleading name. Rename it to expected_crc as that described the usage much better.
Stable-dep-of: e747883c7d73 ("xfs: fix log CRC mismatches between i386 and other architectures")
--- fs/xfs/xfs_log_recover.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
fs/xfs/xfs_log_recover.c +8 -9
@@ -2894,20 +2894,19 @@ xlog_recover_process(int pass, struct list_head *buffer_list) { - __le32 old_crc = rhead->h_crc; -__le32 crc; + __le32 expected_crc = rhead->h_crc, crc; crc =xlog_cksum (log, rhead, dp,be32_to_cpu (rhead->h_len));/* * Nothing else to do if this is a CRC verification pass. Just return * if this a record with a non-zero crc. Unfortunately, mkfs always -* sets old_crc to 0 so we must consider this valid even on v5 supers. -* Otherwise, return EFSBADCRC on failure so the callers up the stack -* know precisely what failed. +* sets expected_crc to 0 so we must consider this valid even on v5 +* supers. Otherwise, return EFSBADCRC on failure so the callers up the +* stack know precisely what failed. */ if (pass ==XLOG_RECOVER_CRCPASS ) { -if (old_crc && crc != old_crc) +if (expected_crc && crc != expected_crc)return -EFSBADCRC ;return 0 ; }
@@ -2918,11 +2917,11 @@ xlog_recover_process(* zero CRC check prevents warnings from being emitted when upgrading * the kernel from one that does not add CRCs by default. */ -if (crc != old_crc) { -if (old_crc ||xfs_has_crc (log->l_mp)) { +if (crc != expected_crc) { +if (expected_crc ||xfs_has_crc (log->l_mp)) {xfs_alert (log->l_mp,"log record CRC mismatch: found 0x%x, expected 0x%x." , -le32_to_cpu (old_crc), +le32_to_cpu (expected_crc),le32_to_cpu (crc));xfs_hex_dump (dp,32 ); }