5.15.196-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.15.196-rc1 review
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.196-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.196-rc1
Anup Patel <[email protected]>
RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs
Marek Vasut <[email protected]>
PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()
Zhengchao Shao <[email protected]>
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
Kuen-Han Tsai <[email protected]>
usb: gadget: f_acm: Refactor bind path to use __free()
Kuen-Han Tsai <[email protected]>
usb: gadget: f_ncm: Refactor bind path to use __free()
Kuen-Han Tsai <[email protected]>
usb: gadget: Introduce free_usb_request helper
Kuen-Han Tsai <[email protected]>
usb: gadget: Store endpoint pointer in usb_request
Kaushlendra Kumar <[email protected]>
arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
Darrick J. Wong <[email protected]>
xfs: always warn about deprecated mount options
Maarten Lankhorst <[email protected]>
devcoredump: Fix circular locking dependency with devcd->mutex.
Niklas Cassel <[email protected]>
PCI: tegra194: Reset BARs when running in PCIe endpoint mode
Marek Vasut <[email protected]>
PCI: rcar-host: Drop PMSR spinlock
Marek Vasut <[email protected]>
PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access()
Vidya Sagar <[email protected]>
PCI: tegra194: Handle errors in BPMP response
Jaegeuk Kim <[email protected]>
f2fs: fix wrong block mapping for multi-devices
Chuck Lever <[email protected]>
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
Jan Kara <[email protected]>
vfs: Don't leak disconnected dentries on umount
Gui-Dong Han <[email protected]>
drm/amdgpu: use atomic functions with memory barriers for vm fault info
Marek Vasut <[email protected]>
PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
Muhammad Usama Anjum <[email protected]>
wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
Siddharth Vadapalli <[email protected]>
PCI: j721e: Fix programming sequence of "strap" settings
Siddharth Vadapalli <[email protected]>
PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists
Darrick J. Wong <[email protected]>
fuse: fix livelock in synchronous file put from fuseblk workers
Amir Goldstein <[email protected]>
fuse: allocate ff->release_args only if release is needed
Xiao Liang <[email protected]>
padata: Reset next CPU when reorder sequence wraps around
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Simplify pm_runtime setup
Bence Csókás <[email protected]>
PM: runtime: Add new devm functions
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
David Lechner <[email protected]>
iio: imu: inv_icm42600: use = { } instead of memset()Sergey Bashirov <[email protected]>
NFSD: Fix last write offset handling in layoutcommit
Sergey Bashirov <[email protected]>
NFSD: Minor cleanup in layoutcommit processing
Sergey Bashirov <[email protected]>
NFSD: Rework encoding and decoding of nfsd4_deviceid
Christoph Hellwig <[email protected]>
xfs: fix log CRC mismatches between i386 and other architectures
Christoph Hellwig <[email protected]>
xfs: rename the old_crc variable in xlog_recover_process
Vineeth Vijayan <[email protected]>
s390/cio: Update purge function to unregister the unused subchannels
Mark Rutland <[email protected]>
arm64: errata: Apply workarounds for Neoverse-V3AE
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-V3AE definitions
Florian Eckert <[email protected]>
serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
Victoria Votokina <[email protected]>
most: usb: hdm_probe: Fix calling put_device() before device initialization
Victoria Votokina <[email protected]>
most: usb: Fix use-after-free in hdm_disconnect
Alexander Usyskin <[email protected]>
mei: me: add wildcat lake P DID
Deepanshu Kartikey <[email protected]>
comedi: fix divide-by-zero in comedi_buf_munge()
Alice Ryhl <[email protected]>
binder: remove "invalid inc weak" check
Mathias Nyman <[email protected]>
xhci: dbc: enable back DbC in resume if it was enabled before suspend
Andrey Konovalov <[email protected]>
usb: raw-gadget: do not limit transfer length
Tim Guttzeit <[email protected]>
usb/core/quirks: Add Huawei ME906S to wakeup quirk
LI Qingwu <[email protected]>
USB: serial: option: add Telit FN920C04 ECM compositions
Reinhard Speyerer <[email protected]>
USB: serial: option: add Quectel RG255C
Renjun Wang <[email protected]>
USB: serial: option: add UNISOC UIS7720
Anup Patel <[email protected]>
RISC-V: Don't print details of CPUs disabled in DT
Sunil V L <[email protected]>
riscv: cpu: Add 64bit hartid support on RV64
Tsukasa OI <[email protected]>
RISC-V: Minimal parser for "riscv, isa" strings
Tsukasa OI <[email protected]>
RISC-V: Correctly print supported extensions
Rob Herring <[email protected]>
riscv: Use of_get_cpu_hwid()
Lad Prabhakar <[email protected]>
net: ravb: Ensure memory write completes before ringing TX doorbell
Michal Pecio <[email protected]>
net: usb: rtl8150: Fix frame padding
Stefano Garzarella <[email protected]>
vsock: fix lock inversion in vsock_assign_transport()
Deepanshu Kartikey <[email protected]>
ocfs2: clear extent cache after moving/defragmenting extents
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
Rafael J. Wysocki <[email protected]>
Revert "cpuidle: menu: Avoid discarding useful information"
Tonghao Zhang <[email protected]>
net: bonding: fix possible peer notify event loss or dup issue
Alexey Simakov <[email protected]>
sctp: avoid NULL dereference when chunk data buffer is missing
Huang Ying <[email protected]>
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
Ioana Ciornei <[email protected]>
dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
Wei Fang <[email protected]>
net: enetc: correct the value of ENETC_RXB_TRUESIZE
Johannes Wiesböck <[email protected]>
rtnetlink: Allow deleting FDB entries in user namespace
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
Nikolay Aleksandrov <[email protected]>
net: add ndo_fdb_del_bulk
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add bulk delete support flag
Nikolay Aleksandrov <[email protected]>
net: netlink: add NLM_F_BULK delete request modifier
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: use BIT for flag values
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add helper to extract msg type's kind
Geert Uytterhoeven <[email protected]>
m68k: bitops: Fix find_*_bit() signatures
Yangtao Li <[email protected]>
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
Viacheslav Dubeyko <[email protected]>
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
Alexander Aring <[email protected]>
dlm: check for defined force value in dlm_lockspace_release
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
Yang Chenzhi <[email protected]>
hfs: validate record offset in hfsplus_bmap_alloc
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
Viacheslav Dubeyko <[email protected]>
hfs: make proper initalization of struct hfs_find_data
Viacheslav Dubeyko <[email protected]>
hfs: clear offset and space out of valid records in b-tree node
Simon Schuster <[email protected]>
nios2: ensure that memblock.current_limit is set when setting pfn limits
Xichao Zhao <[email protected]>
exec: Fix incorrect type for ret
Niko Mauno <[email protected]>
Revert "perf test: Don't leak workload gopipe in PERF_RECORD_*"
Brian Norris <[email protected]>
PCI/sysfs: Ensure devices are powered for config reads (part 2)
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
Jiaming Zhang <[email protected]>
ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
Randy Dunlap <[email protected]>
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
Vincent Guittot <[email protected]>
sched/fair: Fix pelt lost idle time detection
Ingo Molnar <[email protected]>
sched/balancing: Rename newidle_balance() => sched_balance_newidle()
Timur Kristóf <[email protected]>
drm/amd/powerplay: Fix CIK shutdown temperature
Fabian Vogt <[email protected]>
riscv: kprobes: Fix probe address validation
I Viswanath <[email protected]>
net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
Jakub Kicinski <[email protected]>
net: usb: use eth_hw_addr_set() instead of ether_addr_copy()
Sabrina Dubroca <[email protected]>
tls: don't rely on tx_work during send()
Sabrina Dubroca <[email protected]>
tls: always set record_type in tls_process_cmsg
Sabrina Dubroca <[email protected]>
tls: wait for async encrypt in case of error during latter iterations of sendmsg
Sascha Hauer <[email protected]>
net: tls: wait for async completion on last message
David Howells <[email protected]>
splice, net: Add a splice_eof op to file-ops and socket-ops
Alexey Simakov <[email protected]>
tg3: prevent use of uninitialized remote_adv and local_adv variables
Eric Dumazet <[email protected]>
tcp: fix tcp_tso_should_defer() vs large RTT
Raju Rangoju <[email protected]>
amd-xgbe: Avoid spurious link down messages during interface toggle
Dmitry Safonov <[email protected]>
net/ip6_tunnel: Prevent perpetual tunnel growth
Linmao Li <[email protected]>
r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
Nicolas Dichtel <[email protected]>
doc: fix seg6_flowlabel path
Yeounsu Moon <[email protected]>
net: dlink: handle dma_map_single() failure properly
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
Yuezhang Mo <[email protected]>
dax: skip read lock assertion for read-only filesystems
Benjamin Tissoires <[email protected]>
HID: multitouch: fix sticky fingers
Rafael J. Wysocki <[email protected]>
cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
Thomas Fourier <[email protected]>
crypto: rockchip - Fix dma_unmap_sg() nents value
Kaustabh Chakraborty <[email protected]>
drm/exynos: exynos7_drm_decon: remove ctx->suspended
Kaustabh Chakraborty <[email protected]>
drm/exynos: exynos7_drm_decon: properly clear channels during bind
Kaustabh Chakraborty <[email protected]>
drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions
Yu Kuai <[email protected]>
blk-crypto: fix missing blktrace bio split events
Ma Ke <[email protected]>
media: lirc: Fix error handling in lirc_register()
keliu <[email protected]>
media: rc: Directly use ida_free()
Arnd Bergmann <[email protected]>
media: s5p-mfc: remove an unused/uninitialized variable
Filipe Manana <[email protected]>
btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running
Deepanshu Kartikey <[email protected]>
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
Zhang Yi <[email protected]>
jbd2: ensure that all ongoing I/O complete before freeing blocks
Yi Cong <[email protected]>
r8152: add error handling in rtl8152_driver_init
-------------
Diffstat:
Documentation/arm64/silicon-errata.rst | 2 + Documentation/networking/seg6-sysctl.rst | 3 + Makefile | 4 +- arch/arm64/Kconfig | 1 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/pgtable.h | 3 +- arch/arm64/kernel/cpu_errata.c | 1 + arch/m68k/include/asm/bitops.h | 25 ++-- arch/mips/mti-malta/malta-setup.c | 2 +- arch/nios2/kernel/setup.c | 15 +++ arch/riscv/include/asm/processor.h | 4 +- arch/riscv/kernel/cpu.c | 28 +++-- arch/riscv/kernel/cpufeature.c | 84 ++++++++++--- arch/riscv/kernel/probes/kprobes.c | 13 +- arch/riscv/kernel/smpboot.c | 9 +- block/blk-crypto-fallback.c | 3 + drivers/android/binder.c | 11 +- drivers/base/arch_topology.c | 2 +- drivers/base/devcoredump.c | 138 +++++++++++++-------- drivers/base/power/runtime.c | 44 +++++++ drivers/clocksource/timer-riscv.c | 15 +-- drivers/comedi/comedi_buf.c | 2 +- drivers/cpufreq/cppc_cpufreq.c | 14 ++- drivers/cpuidle/governors/menu.c | 21 ++-- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 +- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 7 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 98 +++++---------- drivers/hid/hid-multitouch.c | 27 ++-- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 5 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 35 ++---- drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 5 +- drivers/irqchip/irq-riscv-intc.c | 7 +- drivers/irqchip/irq-sifive-plic.c | 7 +- drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c | 35 ++---- drivers/media/rc/lirc_dev.c | 15 +-- drivers/media/rc/rc-main.c | 6 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/most/most_usb.c | 13 +- drivers/net/bonding/bond_main.c | 40 +++--- drivers/net/can/m_can/m_can_platform.c | 2 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + drivers/net/ethernet/broadcom/tg3.c | 5 +- drivers/net/ethernet/dlink/dl2k.c | 23 ++-- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 3 +- drivers/net/ethernet/freescale/enetc/enetc.h | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 5 +- drivers/net/ethernet/renesas/ravb_main.c | 8 ++ drivers/net/usb/aqc111.c | 2 +- drivers/net/usb/lan78xx.c | 42 +++++-- drivers/net/usb/r8152.c | 9 +- drivers/net/usb/rndis_host.c | 2 +- drivers/net/usb/rtl8150.c | 13 +- drivers/net/wireless/ath/ath11k/core.c | 6 +- drivers/net/wireless/ath/ath11k/hal.c | 16 +++ drivers/net/wireless/ath/ath11k/hal.h | 1 + drivers/pci/controller/cadence/pci-j721e.c | 64 +++++++++- drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + drivers/pci/controller/dwc/pcie-tegra194.c | 28 ++++- drivers/pci/controller/pcie-rcar-host.c | 83 +++++++------ drivers/pci/pci-sysfs.c | 10 +- drivers/s390/cio/device.c | 37 ++++-- drivers/tty/serial/8250/8250_exar.c | 11 ++ drivers/usb/core/quirks.c | 2 + drivers/usb/gadget/function/f_acm.c | 42 +++---- drivers/usb/gadget/function/f_ncm.c | 78 +++++------- drivers/usb/gadget/legacy/raw_gadget.c | 2 - drivers/usb/gadget/udc/core.c | 3 + drivers/usb/host/xhci-dbgcap.c | 9 +- drivers/usb/serial/option.c | 10 ++ fs/btrfs/relocation.c | 13 +- fs/dax.c | 2 +- fs/dcache.c | 2 + fs/dlm/lockspace.c | 2 +- fs/exec.c | 2 +- fs/ext4/inode.c | 8 ++ fs/f2fs/data.c | 2 +- fs/fuse/dir.c | 2 +- fs/fuse/file.c | 75 ++++++----- fs/fuse/fuse_i.h | 2 +- fs/hfs/bfind.c | 8 +- fs/hfs/brec.c | 27 +++- fs/hfs/mdb.c | 2 +- fs/hfsplus/bfind.c | 8 +- fs/hfsplus/bnode.c | 41 ------ fs/hfsplus/btree.c | 6 + fs/hfsplus/hfsplus_fs.h | 42 +++++++ fs/hfsplus/super.c | 25 +++- fs/hfsplus/unicode.c | 24 ++++ fs/jbd2/transaction.c | 13 +- fs/nfsd/blocklayout.c | 5 +- fs/nfsd/blocklayoutxdr.c | 7 +- fs/nfsd/flexfilelayout.c | 8 ++ fs/nfsd/flexfilelayoutxdr.c | 3 +- fs/nfsd/nfs4layouts.c | 1 - fs/nfsd/nfs4proc.c | 34 +++-- fs/nfsd/nfs4xdr.c | 14 +-- fs/nfsd/xdr4.h | 36 +++++- fs/ocfs2/move_extents.c | 5 + fs/splice.c | 31 ++++- fs/xfs/libxfs/xfs_log_format.h | 30 ++++- fs/xfs/xfs_log.c | 8 +- fs/xfs/xfs_log_priv.h | 4 +- fs/xfs/xfs_log_recover.c | 34 +++-- fs/xfs/xfs_ondisk.h | 2 + fs/xfs/xfs_super.c | 33 +++-- include/linux/cpufreq.h | 3 + include/linux/fs.h | 1 + include/linux/net.h | 1 + include/linux/netdevice.h | 9 ++ include/linux/pm_runtime.h | 4 + include/linux/splice.h | 1 + include/linux/usb/gadget.h | 25 ++++ include/net/ip_tunnels.h | 15 +++ include/net/rtnetlink.h | 9 +- include/net/sock.h | 1 + include/uapi/linux/netlink.h | 1 + kernel/padata.c | 6 +- kernel/sched/fair.c | 38 +++--- net/core/rtnetlink.c | 81 ++++++++---- net/ipv4/ip_tunnel.c | 14 --- net/ipv4/tcp_output.c | 19 ++- net/ipv6/ip6_tunnel.c | 3 +- net/sctp/inqueue.c | 13 +- net/socket.c | 10 ++ net/tls/tls_main.c | 7 +- net/tls/tls_sw.c | 22 +++- net/vmw_vsock/af_vsock.c | 38 +++--- sound/firewire/amdtp-stream.h | 2 +- sound/usb/card.c | 10 +- tools/perf/tests/perf-record.c | 4 - 135 files changed, 1413 insertions(+), 774 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/123 r8152: add error handling in rtl8152_driver_init
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Cong <[email protected]>
commit 75527d61d60d493d1eb064f335071a20ca581f54 upstream.
rtl8152_driver_init() is missing the error handling. When rtl8152_driver registration fails, rtl8152_cfgselector_driver should be deregistered.
--- drivers/net/usb/r8152.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/r8152.c +6 -1
@@ -9925,7 +9925,12 @@ static int __init rtl8152_driver_init(vo ret =usb_register_device_driver (&rtl8152_cfgselector_driver,THIS_MODULE );if (ret)return ret; -return usb_register (&rtl8152_driver); + + ret =usb_register (&rtl8152_driver); +if (ret) +usb_deregister_device_driver (&rtl8152_cfgselector_driver); + +return ret; } static void __exit rtl8152_driver_exit(void)
Greg Kroah-Hartman
maintainerPATCH 2/123 jbd2: ensure that all ongoing I/O complete before freeing blocks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 3c652c3a71de1d30d72dc82c3bead8deb48eb749 upstream.
When releasing file system metadata blocks in jbd2_journal_forget(), if this buffer has not yet been checkpointed, it may have already been written back, currently be in the process of being written back, or has not yet written back. jbd2_journal_forget() calls jbd2_journal_try_remove_checkpoint() to check the buffer's status and add it to the current transaction if it has not been written back. This buffer can only be reallocated after the transaction is committed.
jbd2_journal_try_remove_checkpoint() attempts to lock the buffer and check its dirty status while holding the buffer lock. If the buffer has already been written back, everything proceeds normally. However, there are two issues. First, the function returns immediately if the buffer is locked by the write-back process. It does not wait for the write-back to complete. Consequently, until the current transaction is committed and the block is reallocated, there is no guarantee that the I/O will complete. This means that ongoing I/O could write stale metadata to the newly allocated block, potentially corrupting data. Second, the function unlocks the buffer as soon as it detects that the buffer is still dirty. If a concurrent write-back occurs immediately after this unlocking and before clear_buffer_dirty() is called in jbd2_journal_forget(), data corruption can theoretically still occur.
Although these two issues are unlikely to occur in practice since the undergoing metadata writeback I/O does not take this long to complete, it's better to explicitly ensure that all ongoing I/O operations are completed.
Message-ID: <[email protected]>
--- fs/jbd2/transaction.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/jbd2/transaction.c +9 -4
@@ -1669,6 +1669,7 @@ int jbd2_journal_forget(handle_t *handleint drop_reserve =0 ;int err =0 ;int was_modified =0 ; +int wait_for_writeback =0 ;if (is_handle_aborted (handle))return -EROFS ;
@@ -1792,18 +1793,22 @@ int jbd2_journal_forget(handle_t *handle }/* -* The buffer is still not written to disk, we should -* attach this buffer to current transaction so that the -* buffer can be checkpointed only after the current -* transaction commits. +* The buffer has not yet been written to disk. We should +* either clear the buffer or ensure that the ongoing I/O +* is completed, and attach this buffer to current +* transaction so that the buffer can be checkpointed only +* after the current transaction commits. */ clear_buffer_dirty (bh); + wait_for_writeback =1 ;__jbd2_journal_file_buffer (jh, transaction, BJ_Forget);spin_unlock (&journal->j_list_lock); } drop:__brelse (bh);spin_unlock (&jh->b_state_lock); +if (wait_for_writeback) +wait_on_buffer (bh);jbd2_journal_put_journal_head (jh);if (drop_reserve) {/* no need to reserve log space for this block -bzzz */
Greg Kroah-Hartman
maintainerPATCH 3/123 ext4: detect invalid INLINE_DATA + EXTENTS flag combination
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 1d3ad183943b38eec2acf72a0ae98e635dc8456b upstream.
syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal.
The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set:
EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:
comm syz.0.17: corrupted extent tree: lblk 0 < prev 66
Investigation revealed that the inode has both flags set:
DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1
This is an invalid combination since an inode should have either:
- INLINE_DATA: data stored directly in the inode
- EXTENTS: data stored in extent-mapped blocks
Having both flags causes ext4_has_inline_data() to return true, skipping extent tree validation in __ext4_iget(). The unvalidated out-of-order extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes.
Fix this by detecting this invalid flag combination early in ext4_iget() and rejecting the corrupted inode.
Message-ID: <[email protected]>
--- fs/ext4/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ext4/inode.c +8 -0
@@ -4785,6 +4785,14 @@ struct inode *__ext4_iget(struct super_b } ei->i_flags =le32_to_cpu (raw_inode->i_flags);ext4_set_inode_flags (inode, true); +/* Detect invalid flag combination - can't have both inline data and extents */ +if (ext4_test_inode_flag (inode,EXT4_INODE_INLINE_DATA ) && +ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS )) { +ext4_error_inode (inode, function, line,0 , +"inode has both inline data and extents flags" ); + ret = -EFSCORRUPTED ; + goto bad_inode; + } inode->i_blocks =ext4_inode_blocks (raw_inode, ei); ei->i_file_acl =le32_to_cpu (raw_inode->i_file_acl_lo);if (ext4_has_feature_64bit (sb))
Greg Kroah-Hartman
maintainerPATCH 4/123 btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 7e5a5983edda664e8e4bb20af17b80f5135c655c upstream.
When starting relocation, at reloc_chunk_start(), if we happen to find the flag BTRFS_FS_RELOC_RUNNING is already set we return an error (-EINPROGRESS) to the callers, however the callers call reloc_chunk_end() which will clear the flag BTRFS_FS_RELOC_RUNNING, which is wrong since relocation was started by another task and still running.
Finding the BTRFS_FS_RELOC_RUNNING flag already set is an unexpected scenario, but still our current behaviour is not correct.
Fix this by never calling reloc_chunk_end() if reloc_chunk_start() has returned an error, which is what logically makes sense, since the general widespread pattern is to have end functions called only if the counterpart start functions succeeded. This requires changing reloc_chunk_start() to clear BTRFS_FS_RELOC_RUNNING if there's a pending cancel request.
--- fs/btrfs/relocation.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
fs/btrfs/relocation.c +7 -6
@@ -3915,6 +3915,7 @@ out:/* * Mark start of chunk relocation that is cancellable. Check if the cancellation * has been requested meanwhile and don't start in that case. +* NOTE: if this returns an error, reloc_chunk_end() must not be called. * * Return: * 0 success
@@ -3931,10 +3932,8 @@ static int reloc_chunk_start(struct btrfif (atomic_read (&fs_info->reloc_cancel_req) >0 ) {btrfs_info (fs_info,"chunk relocation canceled on start" ); -/* -* On cancel, clear all requests but let the caller mark -* the end after cleanup operations. -*/ +/* On cancel, clear all requests. */ +clear_and_wake_up_bit (BTRFS_FS_RELOC_RUNNING , &fs_info->flags);atomic_set (&fs_info->reloc_cancel_req,0 );return -ECANCELED ; }
@@ -3943,9 +3942,11 @@ static int reloc_chunk_start(struct btrf/* * Mark end of chunk relocation that is cancellable and wake any waiters. +* NOTE: call only if a previous call to reloc_chunk_start() succeeded. */ static void reloc_chunk_end (struct btrfs_fs_info *fs_info) { +ASSERT (test_bit (BTRFS_FS_RELOC_RUNNING , &fs_info->flags));/* Requested after start, clear bit first so any waiters can continue */ if (atomic_read (&fs_info->reloc_cancel_req) >0 )btrfs_info (fs_info,"chunk relocation canceled during operation" );
@@ -4144,9 +4145,9 @@ out:if (err && rw)btrfs_dec_block_group_ro (rc->block_group);iput (rc->data_inode); +reloc_chunk_end (fs_info); out_put_bg:btrfs_put_block_group (bg); -reloc_chunk_end (fs_info);free_reloc_control (rc);return err; }
@@ -4337,8 +4338,8 @@ out_clean: err = ret; out_unset:unset_reloc_control (rc); -out_end:reloc_chunk_end (fs_info); +out_end:free_reloc_control (rc); out:free_reloc_roots (&reloc_roots);
Greg Kroah-Hartman
maintainerPATCH 5/123 media: s5p-mfc: remove an unused/uninitialized variable
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c ]
The s5p_mfc_cmd_args structure in the v6 driver is never used, not initialized to anything other than zero, but as of clang-21 this causes a warning:
drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c:45:7: error: variable 'h2r_args' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
45 | &h2r_args);
| ^~~~~~~~
Just remove this for simplicity. Since the function is also called through a callback, this does require adding a trivial wrapper with the correct prototype.
--- drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c | 35 ++++++++---------------- 1 file changed, 13 insertions(+), 22 deletions(-)
drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c +13 -22
@@ -14,8 +14,7 @@#include "s5p_mfc_opr.h" #include "s5p_mfc_cmd_v6.h" -static int s5p_mfc_cmd_host2risc_v6 (struct s5p_mfc_dev *dev,int cmd, -struct s5p_mfc_cmd_args *args) +static int s5p_mfc_cmd_host2risc_v6 (struct s5p_mfc_dev *dev,int cmd) {mfc_debug (2 ,"Issue the command: %d\n" , cmd);
@@ -31,7 +30,6 @@ static int s5p_mfc_cmd_host2risc_v6(strustatic int s5p_mfc_sys_init_cmd_v6 (struct s5p_mfc_dev *dev) { -struct s5p_mfc_cmd_args h2r_args;struct s5p_mfc_buf_size_v6 *buf_size = dev->variant->buf_size->priv;int ret;
@@ -41,33 +39,23 @@ static int s5p_mfc_sys_init_cmd_v6(strucmfc_write (dev, dev->ctx_buf.dma,S5P_FIMV_CONTEXT_MEM_ADDR_V6 );mfc_write (dev, buf_size->dev_ctx,S5P_FIMV_CONTEXT_MEM_SIZE_V6 ); -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SYS_INIT_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SYS_INIT_V6 ); }static int s5p_mfc_sleep_cmd_v6 (struct s5p_mfc_dev *dev) { -struct s5p_mfc_cmd_args h2r_args; - -memset (&h2r_args,0 ,sizeof (struct s5p_mfc_cmd_args )); -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SLEEP_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_SLEEP_V6 ); }static int s5p_mfc_wakeup_cmd_v6 (struct s5p_mfc_dev *dev) { -struct s5p_mfc_cmd_args h2r_args; - -memset (&h2r_args,0 ,sizeof (struct s5p_mfc_cmd_args )); -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_WAKEUP_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_WAKEUP_V6 ); }/* Open a new instance and get its number */ static int s5p_mfc_open_inst_cmd_v6 (struct s5p_mfc_ctx *ctx) {struct s5p_mfc_dev *dev = ctx->dev; -struct s5p_mfc_cmd_args h2r_args;int codec_type;mfc_debug (2 ,"Requested codec mode: %d\n" , ctx->codec_mode);
@@ -129,23 +117,20 @@ static int s5p_mfc_open_inst_cmd_v6(strumfc_write (dev, ctx->ctx.size,S5P_FIMV_CONTEXT_MEM_SIZE_V6 );mfc_write (dev,0 ,S5P_FIMV_D_CRC_CTRL_V6 );/* no crc */ -return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6 , - &h2r_args); +return s5p_mfc_cmd_host2risc_v6 (dev,S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6 ); }/* Close instance */ static int s5p_mfc_close_inst_cmd_v6 (struct s5p_mfc_ctx *ctx) {struct s5p_mfc_dev *dev = ctx->dev; -struct s5p_mfc_cmd_args h2r_args;int ret =0 ; dev->curr_ctx = ctx->num;if (ctx->state !=MFCINST_FREE ) {mfc_write (dev, ctx->inst_no,S5P_FIMV_INSTANCE_ID_V6 ); ret =s5p_mfc_cmd_host2risc_v6 (dev, -S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6 , - &h2r_args); +S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6 ); }else { ret = -EINVAL ; }
@@ -153,9 +138,15 @@ static int s5p_mfc_close_inst_cmd_v6(strreturn ret; } +static int s5p_mfc_cmd_host2risc_v6_args (struct s5p_mfc_dev *dev,int cmd, +struct s5p_mfc_cmd_args *ignored) +{ +return s5p_mfc_cmd_host2risc_v6 (dev, cmd); +} +/* Initialize cmd function pointers for MFC v6 */ static struct s5p_mfc_hw_cmds s5p_mfc_cmds_v6 = { - .cmd_host2risc = s5p_mfc_cmd_host2risc_v6, + .cmd_host2risc = s5p_mfc_cmd_host2risc_v6_args, .sys_init_cmd = s5p_mfc_sys_init_cmd_v6, .sleep_cmd = s5p_mfc_sleep_cmd_v6, .wakeup_cmd = s5p_mfc_wakeup_cmd_v6,
Greg Kroah-Hartman
maintainerPATCH 6/123 media: rc: Directly use ida_free()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: keliu <[email protected]>
[ Upstream commit cd54ff938091d890edf78e6555ec30c63dcd2eb5 ]
Use ida_alloc() and ida_free() instead of the deprecated ida_simple_get() and ida_simple_remove().
Stable-dep-of: 4f4098c57e13 ("media: lirc: Fix error handling in lirc_register()")
--- drivers/media/rc/lirc_dev.c | 6 +++--- drivers/media/rc/rc-main.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/media/rc/lirc_dev.c +3 -3
@@ -732,7 +732,7 @@ int lirc_register(struct rc_dev *dev)const char *rx_type, *tx_type;int err, minor; - minor =ida_simple_get (&lirc_ida,0 ,RC_DEV_MAX ,GFP_KERNEL ); + minor =ida_alloc_max (&lirc_ida,RC_DEV_MAX -1 ,GFP_KERNEL );if (minor <0 )return minor;
@@ -777,7 +777,7 @@ int lirc_register(struct rc_dev *dev)return 0 ; out_ida: -ida_simple_remove (&lirc_ida, minor); +ida_free (&lirc_ida, minor);return err; }
@@ -795,7 +795,7 @@ void lirc_unregister(struct rc_dev *dev)spin_unlock_irqrestore (&dev->lirc_fh_lock, flags);cdev_device_del (&dev->lirc_cdev, &dev->lirc_dev); -ida_simple_remove (&lirc_ida,MINOR (dev->lirc_dev.devt)); +ida_free (&lirc_ida,MINOR (dev->lirc_dev.devt)); }int __init lirc_dev_init (void )
drivers/media/rc/rc-main.c +3 -3
@@ -1897,7 +1897,7 @@ int rc_register_device(struct rc_dev *deif (!dev)return -EINVAL ; - minor =ida_simple_get (&rc_ida,0 ,RC_DEV_MAX ,GFP_KERNEL ); + minor =ida_alloc_max (&rc_ida,RC_DEV_MAX -1 ,GFP_KERNEL );if (minor <0 )return minor;
@@ -1980,7 +1980,7 @@ out_rx_free: out_raw:ir_raw_event_free (dev); out_minor: -ida_simple_remove (&rc_ida, minor); +ida_free (&rc_ida, minor);return rc; }EXPORT_SYMBOL_GPL (rc_register_device);
@@ -2040,7 +2040,7 @@ void rc_unregister_device(struct rc_devdevice_del (&dev->dev); -ida_simple_remove (&rc_ida, dev->minor); +ida_free (&rc_ida, dev->minor);if (!dev->managed_alloc)rc_free_device (dev);
Greg Kroah-Hartman
maintainerPATCH 7/123 media: lirc: Fix error handling in lirc_register()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 4f4098c57e139ad972154077fb45c3e3141555dd ]
When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count.
Found by code review.
--- drivers/media/rc/lirc_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/rc/lirc_dev.c +5 -4
@@ -748,11 +748,11 @@ int lirc_register(struct rc_dev *dev)cdev_init (&dev->lirc_cdev, &lirc_fops); +get_device (&dev->dev); + err =cdev_device_add (&dev->lirc_cdev, &dev->lirc_dev);if (err) - goto out_ida; - -get_device (&dev->dev); + goto out_put_device;switch (dev->driver_type) {case RC_DRIVER_SCANCODE :
@@ -776,7 +776,8 @@ int lirc_register(struct rc_dev *dev)return 0 ; -out_ida: +out_put_device: +put_device (&dev->lirc_dev);ida_free (&lirc_ida, minor);return err; }
Greg Kroah-Hartman
maintainerPATCH 8/123 blk-crypto: fix missing blktrace bio split events
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 06d712d297649f48ebf1381d19bd24e942813b37 ]
trace_block_split() is missing, resulting in blktrace inability to catch BIO split events and making it harder to analyze the BIO sequence.
--- block/blk-crypto-fallback.c | 3 +++ 1 file changed, 3 insertions(+)
block/blk-crypto-fallback.c +3 -0
@@ -18,6 +18,7 @@#include <linux/mempool.h> #include <linux/module.h> #include <linux/random.h> +#include <trace/events/block.h> #include "blk-crypto-internal.h"
@@ -231,7 +232,9 @@ static bool blk_crypto_split_bio_if_need bio->bi_status =BLK_STS_RESOURCE ;return false; } +bio_chain (split_bio, bio); +trace_block_split (split_bio, bio->bi_iter.bi_sector);submit_bio_noacct (bio); *bio_ptr = split_bio; }
Greg Kroah-Hartman
maintainerPATCH 9/123 drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
[ Upstream commit d31bbacf783daf1e71fbe5c68df93550c446bf44 ]
Modify the functions to accept a pointer to struct decon_context instead.
Stable-dep-of: e1361a4f1be9 ("drm/exynos: exynos7_drm_decon: remove ctx->suspended")
--- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/gpu/drm/exynos/exynos7_drm_decon.c +4 -7
@@ -81,10 +81,8 @@ static const enum drm_plane_type decon_w DRM_PLANE_TYPE_CURSOR, }; -static void decon_wait_for_vblank (struct exynos_drm_crtc *crtc) +static void decon_wait_for_vblank (struct decon_context *ctx) { -struct decon_context *ctx = crtc->ctx; -if (ctx->suspended)return ;
@@ -100,9 +98,8 @@ static void decon_wait_for_vblank(structDRM_DEV_DEBUG_KMS (ctx->dev,"vblank wait timed out.\n" ); } -static void decon_clear_channels (struct exynos_drm_crtc *crtc) +static void decon_clear_channels (struct decon_context *ctx) { -struct decon_context *ctx = crtc->ctx;unsigned int win, ch_enabled =0 ;/* Check if any channel is enabled. */
@@ -118,7 +115,7 @@ static void decon_clear_channels(struct/* Wait for vsync, as disable channel takes effect at next vsync */ if (ch_enabled) -decon_wait_for_vblank (ctx->crtc); +decon_wait_for_vblank (ctx); } static int decon_ctx_initialize(struct decon_context *ctx,
@@ -126,7 +123,7 @@ static int decon_ctx_initialize(struct d { ctx->drm_dev = drm_dev; -decon_clear_channels (ctx->crtc); +decon_clear_channels (ctx);return exynos_drm_register_dma (drm_dev, ctx->dev, &ctx->dma_priv); }
Greg Kroah-Hartman
maintainerPATCH 10/123 drm/exynos: exynos7_drm_decon: properly clear channels during bind
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
[ Upstream commit 5f1a453974204175f20b3788824a0fe23cc36f79 ]
The DECON channels are not cleared properly as the windows aren't shadow protected. When accompanied with an IOMMU, it pagefaults, and the kernel panics.
Implement shadow protect/unprotect, along with a standalone update, for channel clearing to properly take effect.
Stable-dep-of: e1361a4f1be9 ("drm/exynos: exynos7_drm_decon: remove ctx->suspended")
--- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 55 ++++++++++++++++------------- 1 file changed, 32 insertions(+), 23 deletions(-)
drivers/gpu/drm/exynos/exynos7_drm_decon.c +32 -23
@@ -81,6 +81,28 @@ static const enum drm_plane_type decon_w DRM_PLANE_TYPE_CURSOR, }; +/** +* decon_shadow_protect_win() - disable updating values from shadow registers at vsync +* +* @ctx: display and enhancement controller context +* @win: window to protect registers for +* @protect: 1 to protect (disable updates) +*/ +static void decon_shadow_protect_win (struct decon_context *ctx, +unsigned int win,bool protect) +{ +u32 bits, val; + + bits =SHADOWCON_WINx_PROTECT (win); + + val =readl (ctx->regs +SHADOWCON ); +if (protect) + val |= bits; +else + val &= ~bits; +writel (val, ctx->regs +SHADOWCON ); +} +static void decon_wait_for_vblank (struct decon_context *ctx) {if (ctx->suspended)
@@ -101,18 +123,27 @@ static void decon_wait_for_vblank(structstatic void decon_clear_channels (struct decon_context *ctx) {unsigned int win, ch_enabled =0 ; +u32 val;/* Check if any channel is enabled. */ for (win =0 ; win <WINDOWS_NR ; win++) { -u32 val =readl (ctx->regs +WINCON (win)); + val =readl (ctx->regs +WINCON (win));if (val & WINCONx_ENWIN) { +decon_shadow_protect_win (ctx, win, true); + val &= ~WINCONx_ENWIN;writel (val, ctx->regs +WINCON (win)); ch_enabled =1 ; + +decon_shadow_protect_win (ctx, win, false); } } + val =readl (ctx->regs +DECON_UPDATE ); + val |=DECON_UPDATE_STANDALONE_F ; +writel (val, ctx->regs +DECON_UPDATE ); +/* Wait for vsync, as disable channel takes effect at next vsync */ if (ch_enabled)decon_wait_for_vblank (ctx);
@@ -340,28 +371,6 @@ static void decon_win_set_colkey(structwritel (keycon1, ctx->regs +WKEYCON1_BASE (win)); } -/** -* decon_shadow_protect_win() - disable updating values from shadow registers at vsync -* -* @ctx: display and enhancement controller context -* @win: window to protect registers for -* @protect: 1 to protect (disable updates) -*/ -static void decon_shadow_protect_win (struct decon_context *ctx, -unsigned int win,bool protect) -{ -u32 bits, val; - - bits =SHADOWCON_WINx_PROTECT (win); - - val =readl (ctx->regs +SHADOWCON ); -if (protect) - val |= bits; -else - val &= ~bits; -writel (val, ctx->regs +SHADOWCON ); -} -static void decon_atomic_begin (struct exynos_drm_crtc *crtc) {struct decon_context *ctx = crtc->ctx;
Greg Kroah-Hartman
maintainerPATCH 11/123 drm/exynos: exynos7_drm_decon: remove ctx->suspended
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
[ Upstream commit e1361a4f1be9cb69a662c6d7b5ce218007d6e82b ]
Condition guards are found to be redundant, as the call flow is properly managed now, as also observed in the Exynos5433 DECON driver. Since state checking is no longer necessary, remove it.
This also fixes an issue which prevented decon_commit() from decon_atomic_enable() due to an incorrect state change setting.
--- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 ----------------------------- 1 file changed, 36 deletions(-)
drivers/gpu/drm/exynos/exynos7_drm_decon.c +0 -36
@@ -51,7 +51,6 @@ struct decon_context {void __iomem *regs;unsigned long irq_flags;bool i80_if; -bool suspended;wait_queue_head_t wait_vsync_queue;atomic_t wait_vsync_event;
@@ -105,9 +104,6 @@ static void decon_shadow_protect_win(strstatic void decon_wait_for_vblank (struct decon_context *ctx) { -if (ctx->suspended) -return ; -atomic_set (&ctx->wait_vsync_event,1 );/*
@@ -183,9 +179,6 @@ static void decon_commit(struct exynos_dstruct drm_display_mode *mode = &crtc->base.state->adjusted_mode;u32 val, clkdiv; -if (ctx->suspended) -return ; -/* nothing to do if we haven't set the mode yet */ if (mode->htotal ==0 || mode->vtotal ==0 )return ;
@@ -247,9 +240,6 @@ static int decon_enable_vblank(struct exstruct decon_context *ctx = crtc->ctx;u32 val; -if (ctx->suspended) -return -EPERM ; -if (!test_and_set_bit (0 , &ctx->irq_flags)) { val =readl (ctx->regs +VIDINTCON0 );
@@ -272,9 +262,6 @@ static void decon_disable_vblank(structstruct decon_context *ctx = crtc->ctx;u32 val; -if (ctx->suspended) -return ; -if (test_and_clear_bit (0 , &ctx->irq_flags)) { val =readl (ctx->regs +VIDINTCON0 );
@@ -376,9 +363,6 @@ static void decon_atomic_begin(struct exstruct decon_context *ctx = crtc->ctx;int i; -if (ctx->suspended) -return ; -for (i =0 ; i <WINDOWS_NR ; i++)decon_shadow_protect_win (ctx, i, true); }
@@ -398,9 +382,6 @@ static void decon_update_plane(struct exunsigned int cpp = fb->format->cpp[0 ];unsigned int pitch = fb->pitches[0 ]; -if (ctx->suspended) -return ; -/* * SHADOWCON/PRTCON register is used for enabling timing. *
@@ -488,9 +469,6 @@ static void decon_disable_plane(struct eunsigned int win = plane->index;u32 val; -if (ctx->suspended) -return ; -/* protect windows */ decon_shadow_protect_win (ctx, win, true);
@@ -509,9 +487,6 @@ static void decon_atomic_flush(struct exstruct decon_context *ctx = crtc->ctx;int i; -if (ctx->suspended) -return ; -for (i =0 ; i <WINDOWS_NR ; i++)decon_shadow_protect_win (ctx, i, false);exynos_crtc_handle_event (crtc);
@@ -539,9 +514,6 @@ static void decon_atomic_enable(struct estruct decon_context *ctx = crtc->ctx;int ret; -if (!ctx->suspended) -return ; - ret =pm_runtime_resume_and_get (ctx->dev);if (ret <0 ) {DRM_DEV_ERROR (ctx->dev,"failed to enable DECON device.\n" );
@@ -555,8 +527,6 @@ static void decon_atomic_enable(struct edecon_enable_vblank (ctx->crtc);decon_commit (ctx->crtc); - - ctx->suspended = false; }static void decon_atomic_disable (struct exynos_drm_crtc *crtc)
@@ -564,9 +534,6 @@ static void decon_atomic_disable(structstruct decon_context *ctx = crtc->ctx;int i; -if (ctx->suspended) -return ; -/* * We need to make sure that all windows are disabled before we * suspend that connector. Otherwise we might try to scan from
@@ -576,8 +543,6 @@ static void decon_atomic_disable(structdecon_disable_plane (crtc, &ctx->planes[i]);pm_runtime_put_sync (ctx->dev); - - ctx->suspended = true; }static const struct exynos_drm_crtc_ops decon_crtc_ops = {
@@ -699,7 +664,6 @@ static int decon_probe(struct platform_dreturn -ENOMEM ; ctx->dev = dev; - ctx->suspended = true; i80_if_timings =of_get_child_by_name (dev->of_node,"i80-if-timings" );if (i80_if_timings)
Greg Kroah-Hartman
maintainerPATCH 12/123 crypto: rockchip - Fix dma_unmap_sg() nents value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 21140e5caf019e4a24e1ceabcaaa16bd693b393f ]
The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned.
--- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/crypto/rockchip/rk3288_crypto_ahash.c +1 -2
@@ -236,10 +236,9 @@ static int rk_hash_unprepare(struct cryp { struct ahash_request *areq = container_of(breq, struct ahash_request, base);struct crypto_ahash *tfm =crypto_ahash_reqtfm (areq); -struct rk_ahash_rctx *rctx =ahash_request_ctx (areq);struct rk_ahash_ctx *tctx =crypto_ahash_ctx (tfm); -dma_unmap_sg (tctx->dev->dev, areq->src, rctx->nrsg,DMA_TO_DEVICE ); +dma_unmap_sg (tctx->dev->dev, areq->src,sg_nents (areq->src),DMA_TO_DEVICE );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 13/123 cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit f965d111e68f4a993cc44d487d416e3d954eea11 ]
If cppc_get_transition_latency() returns CPUFREQ_ETERNAL to indicate a failure to retrieve the transition latency value from the platform firmware, the CPPC cpufreq driver will use that value (converted to microseconds) as the policy transition delay, but it is way too large for any practical use.
Address this by making the driver use the cpufreq's default transition latency value (in microseconds) as the transition delay if CPUFREQ_ETERNAL is returned by cppc_get_transition_latency().
--- drivers/cpufreq/cppc_cpufreq.c | 14 ++++++++++++-- include/linux/cpufreq.h | 3 +++ 2 files changed, 15 insertions(+), 2 deletions(-)
drivers/cpufreq/cppc_cpufreq.c +12 -2
@@ -395,6 +395,16 @@ static int cppc_verify_policy(struct cpureturn 0 ; } +static unsigned int __cppc_cpufreq_get_transition_delay_us (unsigned int cpu) +{ +unsigned int transition_latency_ns =cppc_get_transition_latency (cpu); + +if (transition_latency_ns ==CPUFREQ_ETERNAL ) +return CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS /NSEC_PER_USEC ; + +return transition_latency_ns /NSEC_PER_USEC ; +} +/* * The PCC subspace describes the rate at which platform can accept commands * on the shared PCC channel (including READs which do not count towards freq
@@ -417,14 +427,14 @@ static unsigned int cppc_cpufreq_get_tra return 10000; } } -return cppc_get_transition_latency (cpu) /NSEC_PER_USEC ; +return __cppc_cpufreq_get_transition_delay_us (cpu); }#else static unsigned int cppc_cpufreq_get_transition_delay_us (unsigned int cpu) { -return cppc_get_transition_latency (cpu) /NSEC_PER_USEC ; +return __cppc_cpufreq_get_transition_delay_us (cpu); }#endif
include/linux/cpufreq.h +3 -0
@@ -32,6 +32,9 @@*/ #define CPUFREQ_ETERNAL (-1) + +#define CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS NSEC_PER_MSEC +#define CPUFREQ_NAME_LEN 16/* Print length for names. Extra 1 space for accommodating '\n' in prints */ #define CPUFREQ_NAME_PLEN (CPUFREQ_NAME_LEN + 1)
Greg Kroah-Hartman
maintainerPATCH 14/123 HID: multitouch: fix sticky fingers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 46f781e0d151844589dc2125c8cce3300546f92a upstream.
The sticky fingers quirk (MT_QUIRK_STICKY_FINGERS) was only considering the case when slots were not released during the last report. This can be problematic if the firmware forgets to release a finger while others are still present.
This was observed on the Synaptics DLL0945 touchpad found on the Dell XPS 9310 and the Dell Inspiron 5406.
--- drivers/hid/hid-multitouch.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
drivers/hid/hid-multitouch.c +14 -13
@@ -83,9 +83,8 @@ enum latency_mode { HID_LATENCY_HIGH = 1, }; -#define MT_IO_FLAGS_RUNNING 0 -#define MT_IO_FLAGS_ACTIVE_SLOTS 1 -#define MT_IO_FLAGS_PENDING_SLOTS 2 +#define MT_IO_SLOTS_MASK GENMASK(7, 0)/* reserve first 8 bits for slot tracking */ +#define MT_IO_FLAGS_RUNNING 32static const bool mtrue = true;/* default for true */ static const bool mfalse;/* default for false */
@@ -161,7 +160,11 @@ struct mt_device {struct mt_class mtclass;/* our mt device class */ struct timer_list release_timer;/* to release sticky fingers */ struct hid_device *hdev;/* hid_device we're attached to */ -unsigned long mt_io_flags;/* mt flags (MT_IO_FLAGS_*) */ +unsigned long mt_io_flags;/* mt flags (MT_IO_FLAGS_RUNNING) +* first 8 bits are reserved for keeping the slot +* states, this is fine because we only support up +* to 250 slots (MT_MAX_MAXCONTACT) +*/ __u8 inputmode_value;/* InputMode HID feature value */ __u8 maxcontacts;bool is_buttonpad;/* is this device a button pad? */
@@ -936,6 +939,7 @@ static void mt_release_pending_palms(strfor_each_set_bit (slotnum, app->pending_palm_slots, td->maxcontacts) {clear_bit (slotnum, app->pending_palm_slots); +clear_bit (slotnum, &td->mt_io_flags);input_mt_slot (input, slotnum);input_mt_report_slot_inactive (input);
@@ -967,12 +971,6 @@ static void mt_sync_frame(struct mt_devi app->num_received =0 ; app->left_button_state =0 ; - -if (test_bit (MT_IO_FLAGS_ACTIVE_SLOTS , &td->mt_io_flags)) -set_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags); -else -clear_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags); -clear_bit (MT_IO_FLAGS_ACTIVE_SLOTS , &td->mt_io_flags); }static int mt_compute_timestamp (struct mt_application *app,__s32 value)
@@ -1147,7 +1145,9 @@ static int mt_process_slot(struct mt_devinput_event (input,EV_ABS ,ABS_MT_TOUCH_MAJOR , major);input_event (input,EV_ABS ,ABS_MT_TOUCH_MINOR , minor); -set_bit (MT_IO_FLAGS_ACTIVE_SLOTS , &td->mt_io_flags); +set_bit (slotnum, &td->mt_io_flags); + }else { +clear_bit (slotnum, &td->mt_io_flags); }return 0 ;
@@ -1282,7 +1282,7 @@ static void mt_touch_report(struct hid_d* defect. */ if (app->quirks &MT_QUIRK_STICKY_FINGERS ) { -if (test_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags)) +if (td->mt_io_flags &MT_IO_SLOTS_MASK )mod_timer (&td->release_timer, jiffies +msecs_to_jiffies (100 ));else
@@ -1732,6 +1732,7 @@ static void mt_release_contacts(struct hfor (i =0 ; i < mt->num_slots; i++) {input_mt_slot (input_dev, i);input_mt_report_slot_inactive (input_dev); +clear_bit (i, &td->mt_io_flags); }input_mt_sync_frame (input_dev);input_sync (input_dev);
@@ -1754,7 +1755,7 @@ static void mt_expired_timeout(struct ti*/ if (test_and_set_bit_lock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags))return ; -if (test_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags)) +if (td->mt_io_flags &MT_IO_SLOTS_MASK )mt_release_contacts (hdev);clear_bit_unlock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); }
Greg Kroah-Hartman
maintainerPATCH 15/123 dax: skip read lock assertion for read-only filesystems
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
The commit 168316db3583("dax: assert that i_rwsem is held exclusive for writes") added lock assertions to ensure proper locking in DAX operations. However, these assertions trigger false-positive lockdep warnings since read lock is unnecessary on read-only filesystems(e.g., erofs).
This patch skips the read lock assertion for read-only filesystems, eliminating the spurious warnings while maintaining the integrity checks for writable filesystems.
--- fs/dax.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dax.c +1 -1
@@ -1285,7 +1285,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,if (iov_iter_rw (iter) ==WRITE ) {lockdep_assert_held_write (&iomi.inode->i_rwsem); iomi.flags |=IOMAP_WRITE ; - }else { + }else if (!sb_rdonly (iomi.inode->i_sb)) {lockdep_assert_held (&iomi.inode->i_rwsem); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/123 can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ]
Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") moved the PM runtime enable from the m_can core driver into the m_can_platform.
That patch forgot to move the pm_runtime_disable() to m_can_plat_remove(), so that unloading the m_can_platform driver causes an "Unbalanced pm_runtime_enable!" error message.
Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the problem.
--- drivers/net/can/m_can/m_can_platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can_platform.c +1 -1
@@ -170,7 +170,7 @@ static int m_can_plat_remove(struct platform_device *pdev)struct m_can_classdev *mcan_class = &priv->cdev;m_can_class_unregister (mcan_class); - +pm_runtime_disable (mcan_class->dev);m_can_class_free_dev (mcan_class->net);return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/123 net: dlink: handle dma_map_single() failure properly
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <[email protected]>
[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
There is no error handling for dma_map_single() failures.
Add error handling by checking dma_mapping_error() and freeing the skb using dev_kfree_skb() (process context) when it fails.
Tested-on: D-Link DGE-550T Rev-A3
--- drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/net/ethernet/dlink/dl2k.c +16 -7
@@ -499,25 +499,34 @@ static int alloc_list(struct net_device *dev)for (i =0 ; i <RX_RING_SIZE ; i++) {/* Allocated fixed size of skbuff */ struct sk_buff *skb; +dma_addr_t addr; skb =netdev_alloc_skb_ip_align (dev, np->rx_buf_sz); np->rx_skbuff[i] = skb; -if (!skb) { -free_list (dev); -return -ENOMEM ; - } +if (!skb) + goto err_free_list; + + addr =dma_map_single (&np->pdev->dev, skb->data, + np->rx_buf_sz,DMA_FROM_DEVICE ); +if (dma_mapping_error (&np->pdev->dev, addr)) + goto err_kfree_skb; np->rx_ring[i].next_desc =cpu_to_le64 (np->rx_ring_dma + ((i +1 ) %RX_RING_SIZE ) *sizeof (struct netdev_desc ));/* Rubicon now supports 40 bits of addressing space. */ - np->rx_ring[i].fraginfo = -cpu_to_le64 (dma_map_single (&np->pdev->dev, skb->data, - np->rx_buf_sz,DMA_FROM_DEVICE )); + np->rx_ring[i].fraginfo =cpu_to_le64 (addr); np->rx_ring[i].fraginfo |=cpu_to_le64 ((u64 )np->rx_buf_sz <<48 ); }return 0 ; + +err_kfree_skb: +dev_kfree_skb (np->rx_skbuff[i]); + np->rx_skbuff[i] =NULL ; +err_free_list: +free_list (dev); +return -ENOMEM ; }static void rio_hw_init (struct net_device *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/123 doc: fix seg6_flowlabel path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <[email protected]>
[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ]
This sysctl is not per interface; it's global per netns.
--- Documentation/networking/seg6-sysctl.rst | 3 +++ 1 file changed, 3 insertions(+)
Documentation/networking/seg6-sysctl.rst +3 -0
@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER Default is 0. +/proc/sys/net/ipv6/seg6_* variables: +==================================== + seg6_flowlabel - INTEGER Controls the behaviour of computing the flowlabel of outer IPv6 header in case of SR T.encaps
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/123 r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming packets. Packet captures show messages like "IP truncated-ip - 146 bytes missing!".
The issue is caused by RxConfig not being properly re-initialized after resume. Re-initializing the RxConfig register before the chip re-initialization sequence avoids the truncation and restores correct packet reception.
This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data corruption issue on RTL8402").
--- drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -2
@@ -4962,8 +4962,9 @@ static int rtl8169_resume(struct device *device)if (!device_may_wakeup (tp_to_dev (tp)))clk_prepare_enable (tp->clk); -/* Reportedly at least Asus X453MA truncates packets otherwise */ -if (tp->mac_version ==RTL_GIGA_MAC_VER_37 ) +/* Some chip versions may truncate packets without this initialization */ +if (tp->mac_version ==RTL_GIGA_MAC_VER_37 || + tp->mac_version ==RTL_GIGA_MAC_VER_46 )rtl_init_rxcfg (tp);return rtl8169_runtime_resume (device);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/123 net/ip6_tunnel: Prevent perpetual tunnel growth
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling.
Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer.
--- include/net/ip_tunnels.h | 15 +++++++++++++++ net/ipv4/ip_tunnel.c | 14 -------------- net/ipv6/ip6_tunnel.c | 3 +-- 3 files changed, 16 insertions(+), 16 deletions(-)
include/net/ip_tunnels.h +15 -0
@@ -467,6 +467,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,int skb_tunnel_check_pmtu (struct sk_buff *skb,struct dst_entry *encap_dst,int headroom,bool reply); +static inline void ip_tunnel_adj_headroom (struct net_device *dev, +unsigned int headroom) +{ +/* we must cap headroom to some upperlimit, else pskb_expand_head +* will overflow header offsets in skb_headers_offset_update(). +*/ +const unsigned int max_allowed =512 ; + +if (headroom > max_allowed) + headroom = max_allowed; + +if (headroom >READ_ONCE (dev->needed_headroom)) +WRITE_ONCE (dev->needed_headroom, headroom); +} +int iptunnel_handle_offloads (struct sk_buff *skb,int gso_type_mask);static inline int iptunnel_pull_offloads (struct sk_buff *skb)
net/ipv4/ip_tunnel.c +0 -14
@@ -553,20 +553,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,return 0 ; } -static void ip_tunnel_adj_headroom (struct net_device *dev,unsigned int headroom) -{ -/* we must cap headroom to some upperlimit, else pskb_expand_head -* will overflow header offsets in skb_headers_offset_update(). -*/ -static const unsigned int max_allowed =512 ; - -if (headroom > max_allowed) - headroom = max_allowed; - -if (headroom >READ_ONCE (dev->needed_headroom)) -WRITE_ONCE (dev->needed_headroom, headroom); -} -void ip_md_tunnel_xmit (struct sk_buff *skb,struct net_device *dev,u8 proto,int tunnel_hlen) {
net/ipv6/ip6_tunnel.c +1 -2
@@ -1247,8 +1247,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,*/ max_headroom =LL_RESERVED_SPACE (dst->dev) +sizeof (struct ipv6hdr ) + dst->header_len + t->hlen; -if (max_headroom >READ_ONCE (dev->needed_headroom)) -WRITE_ONCE (dev->needed_headroom, max_headroom); +ip_tunnel_adj_headroom (dev, max_headroom); err =ip6_tnl_encap (skb, t, &proto, fl6);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/123 amd-xgbe: Avoid spurious link down messages during interface toggle
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
During interface toggle operations (ifdown/ifup), the driver currently resets the local helper variable 'phy_link' to -1. This causes the link state machine to incorrectly interpret the state as a link change event, resulting in spurious "Link is down" messages being logged when the interface is brought back up.
Preserve the phy_link state across interface toggles to avoid treating the -1 sentinel value as a legitimate link state transition.
--- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/amd/xgbe/xgbe-drv.c +0 -1
@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)static int xgbe_phy_reset (struct xgbe_prv_data *pdata) { - pdata->phy_link =-1 ; pdata->phy_speed =SPEED_UNKNOWN ;return pdata->phy_if.phy_reset (pdata);
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +1 -0
@@ -1636,6 +1636,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) pdata->phy.duplex =DUPLEX_FULL ; } + pdata->phy_link =0 ; pdata->phy.link =0 ; pdata->phy.pause_autoneg = pdata->pause_autoneg;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/123 tcp: fix tcp_tso_should_defer() vs large RTT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
Neal reported that using neper tcp_stream with TCP_TX_DELAY set to 50ms would often lead to flows stuck in a small cwnd mode, regardless of the congestion control.
While tcp_stream sets TCP_TX_DELAY too late after the connect(), it highlighted two kernel bugs.
The following heuristic in tcp_tso_should_defer() seems wrong for large RTT:
delta = tp->tcp_clock_cache - head->tstamp;
/* If next ACK is likely to come too late (half srtt), do not defer */ if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
goto send_now;
If next ACK is expected to come in more than 1 ms, we should not defer because we prefer a smooth ACK clocking.
While blamed commit was a step in the good direction, it was not generic enough.
Another patch fixing TCP_TX_DELAY for established flows will be proposed when net-next reopens.
--- net/ipv4/tcp_output.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
net/ipv4/tcp_output.c +15 -4
@@ -2180,7 +2180,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, u32 max_segs) {const struct inet_connection_sock *icsk =inet_csk (sk); -u32 send_win, cong_win, limit, in_flight; +u32 send_win, cong_win, limit, in_flight, threshold; +u64 srtt_in_ns, expected_ack, how_far_is_the_ack;struct tcp_sock *tp =tcp_sk (sk);struct sk_buff *head;int win_divisor;
@@ -2242,9 +2243,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, head =tcp_rtx_queue_head (sk);if (!head) goto send_now; - delta = tp->tcp_clock_cache - head->tstamp; -/* If next ACK is likely to come too late (half srtt), do not defer */ -if ((s64)(delta - (u64 )NSEC_PER_USEC * (tp->srtt_us >>4 )) <0 ) + + srtt_in_ns = (u64)(NSEC_PER_USEC >>3 ) * tp->srtt_us; +/* When is the ACK expected ? */ + expected_ack = head->tstamp + srtt_in_ns; +/* How far from now is the ACK expected ? */ + how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; + +/* If next ACK is likely to come too late, +* ie in more than min(1ms, half srtt), do not defer. +*/ + threshold =min (srtt_in_ns >>1 ,NSEC_PER_MSEC ); + +if ((s64)(how_far_is_the_ack - threshold) >0 ) goto send_now;/* Ok, it looks like it is advisable to defer.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/123 tg3: prevent use of uninitialized remote_adv and local_adv variables
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Simakov <[email protected]>
[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
Some execution paths that jump to the fiber_setup_done label could leave the remote_adv and local_adv variables uninitialized and then use it.
Initialize this variables at the point of definition to avoid this.
--- drivers/net/ethernet/broadcom/tg3.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +1 -4
@@ -5815,7 +5815,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)u32 current_speed =SPEED_UNKNOWN ;u8 current_duplex =DUPLEX_UNKNOWN ;bool current_link_up = false; -u32 local_adv, remote_adv, sgsr; +u32 local_adv =0 , remote_adv =0 , sgsr; if ((tg3_asic_rev(tp) == ASIC_REV_5719 || tg3_asic_rev(tp) == ASIC_REV_5720) &&
@@ -5956,9 +5956,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)else current_duplex =DUPLEX_HALF ; - local_adv =0 ; - remote_adv =0 ; -if (bmcr &BMCR_ANENABLE ) {u32 common;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/123 splice, net: Add a splice_eof op to file-ops and socket-ops
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 2bfc66850952b6921b2033b09729ec59eabbc81d ]
Add an optional method, ->splice_eof(), to allow splice to indicate the premature termination of a splice to struct file_operations and struct proto_ops.
This is called if sendfile() or splice() encounters all of the following conditions inside splice_direct_to_actor():
(1) the user did not set SPLICE_F_MORE (splice only), and
(2) an EOF condition occurred (->splice_read() returned 0), and
(3) we haven't read enough to fulfill the request (ie. len > 0 still), and
(4) we have already spliced at least one byte.
A further patch will modify the behaviour of SPLICE_F_MORE to always be passed to the actor if either the user set it or we haven't yet read sufficient data to fulfill the request.
Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg")
--- fs/splice.c | 31 ++++++++++++++++++++++++++++++- include/linux/fs.h | 1 + include/linux/net.h | 1 + include/linux/splice.h | 1 + include/net/sock.h | 1 + net/socket.c | 10 ++++++++++ 6 files changed, 44 insertions(+), 1 deletion(-)
fs/splice.c +30 -1
@@ -767,6 +767,17 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,return out->f_op->splice_write (pipe, out, ppos, len, flags); } +/* +* Indicate to the caller that there was a premature EOF when reading from the +* source and the caller didn't indicate they would be sending more data after +* this. +*/ +static void do_splice_eof (struct splice_desc *sd) +{ +if (sd->splice_eof) + sd->splice_eof (sd); +} +/* * Attempt to initiate a splice from a file to a pipe. */
@@ -869,7 +880,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, ret =do_splice_to (in, &pos, pipe, len, flags);if (unlikely (ret <=0 )) - goto out_release; + goto read_failure; read_len = ret; sd->total_len = read_len;
@@ -909,6 +920,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,file_accessed (in);return bytes; +read_failure: +/* +* If the user did *not* set SPLICE_F_MORE *and* we didn't hit that +* "use all of len" case that cleared SPLICE_F_MORE, *and* we did a +* "->splice_in()" that returned EOF (ie zero) *and* we have sent at +* least 1 byte *then* we will also do the ->splice_eof() call. +*/ +if (ret ==0 && !more && len >0 && bytes) +do_splice_eof (sd); out_release:/* * If we did an incomplete transfer we must release
@@ -937,6 +957,14 @@ static int direct_splice_actor(struct pipe_inode_info *pipe, sd->flags); } +static void direct_file_splice_eof (struct splice_desc *sd) +{ +struct file *file = sd->u.file; + +if (file->f_op->splice_eof) + file->f_op->splice_eof (file); +} +/** * do_splice_direct - splices data directly between two files * @in: file to splice from
@@ -962,6 +990,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out, .flags = flags, .pos = *ppos, .u.file = out, + .splice_eof = direct_file_splice_eof, .opos = opos, };long ret;
include/linux/fs.h +1 -0
@@ -2104,6 +2104,7 @@ struct file_operations {int (*flock) (struct file *,int ,struct file_lock *);ssize_t (*splice_write)(struct pipe_inode_info *,struct file *,loff_t *,size_t ,unsigned int );ssize_t (*splice_read)(struct file *,loff_t *,struct pipe_inode_info *,size_t ,unsigned int ); +void (*splice_eof)(struct file *file);int (*setlease)(struct file *,long ,struct file_lock **,void **);long (*fallocate)(struct file *file,int mode,loff_t offset,loff_t len);
include/linux/net.h +1 -0
@@ -187,6 +187,7 @@ struct proto_ops { int offset, size_t size, int flags);ssize_t (*splice_read)(struct socket *sock,loff_t *ppos,struct pipe_inode_info *pipe,size_t len,unsigned int flags); +void (*splice_eof)(struct socket *sock);int (*set_peek_off)(struct sock *sk,int val);int (*peek_len)(struct socket *sock);
include/linux/splice.h +1 -0
@@ -38,6 +38,7 @@ struct splice_desc {struct file *file;/* file to read/write */ void *data;/* cookie */ } u; +void (*splice_eof)(struct splice_desc *sd);/* Unexpected EOF handler */ loff_t pos;/* file position */ loff_t *opos;/* sendfile: output position */ size_t num_spliced;/* number of bytes already spliced */
include/net/sock.h +1 -0
@@ -1229,6 +1229,7 @@ struct proto { int *addr_len);int (*sendpage)(struct sock *sk,struct page *page,int offset,size_t size,int flags); +void (*splice_eof)(struct socket *sock);int (*bind)(struct sock *sk,struct sockaddr *addr,int addr_len); int (*bind_add)(struct sock *sk,
net/socket.c +10 -0
@@ -129,6 +129,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,static ssize_t sock_splice_read (struct file *file,loff_t *ppos,struct pipe_inode_info *pipe,size_t len,unsigned int flags); +static void sock_splice_eof (struct file *file);#ifdef CONFIG_PROC_FS static void sock_show_fdinfo (struct seq_file *m,struct file *f)
@@ -163,6 +164,7 @@ static const struct file_operations socket_file_ops = { .sendpage = sock_sendpage, .splice_write = generic_splice_sendpage, .splice_read = sock_splice_read, + .splice_eof = sock_splice_eof, .show_fdinfo = sock_show_fdinfo, };
@@ -1037,6 +1039,14 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,return sock->ops->splice_read (sock, ppos, pipe, len, flags); } +static void sock_splice_eof (struct file *file) +{ +struct socket *sock = file->private_data; + +if (sock->ops->splice_eof) + sock->ops->splice_eof (sock); +} +static ssize_t sock_read_iter (struct kiocb *iocb,struct iov_iter *to) {struct file *file = iocb->ki_filp;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/123 net: tls: wait for async completion on last message
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <[email protected]>
[ Upstream commit 54001d0f2fdbc7852136a00f3e6fc395a9547ae5 ]
When asynchronous encryption is used KTLS sends out the final data at proto->close time. This becomes problematic when the task calling close() receives a signal. In this case it can happen that tcp_sendmsg_locked() called at close time returns -ERESTARTSYS and the final data is not sent.
The described situation happens when KTLS is used in conjunction with io_uring, as io_uring uses task_work_add() to add work to the current userspace task. A discussion of the problem along with a reproducer can be found in [1] and [2]
Fix this by waiting for the asynchronous encryption to be completed on the final message. With this there is no data left to be sent at close time.
[1] https://lore.kernel.org/all/[email protected]/
[2] https://lore.kernel.org/all/[email protected]/
Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg")
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -1164,7 +1164,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)if (!num_async) { goto send_end; - }else if (num_zc) { + }else if (num_zc || eor) {int err;/* Wait for pending encryptions to get completed */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/123 tls: wait for async encrypt in case of error during latter iterations of sendmsg
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ]
If we hit an error during the main loop of tls_sw_sendmsg_locked (eg failed allocation), we jump to send_end and immediately return. Previous iterations may have queued async encryption requests that are still pending. We should wait for those before returning, as we could otherwise be reading from memory that userspace believes we're not using anymore, which would be a sort of use-after-free.
This is similar to what tls_sw_recvmsg already does: failures during the main loop jump to the "wait for async" code, not straight to the unlock/return.
--- net/tls/tls_sw.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/tls/tls_sw.c +4 -3
@@ -1013,7 +1013,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)if (ret == -EINPROGRESS ) num_async++;else if (ret != -EAGAIN ) - goto send_end; + goto end; } }
@@ -1162,8 +1162,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) goto alloc_encrypted; } +send_end:if (!num_async) { - goto send_end; + goto end; }else if (num_zc || eor) {int err;
@@ -1181,7 +1182,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)tls_tx_records (sk, msg->msg_flags); } -send_end: +end: ret =sk_stream_error (sk, msg->msg_flags, ret);release_sock (sk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/123 tls: always set record_type in tls_process_cmsg
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
When userspace wants to send a non-DATA record (via the TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a previous MSG_MORE send() as a separate DATA record. If that DATA record is encrypted asynchronously, tls_handle_open_record will return -EINPROGRESS. This is currently treated as an error by tls_process_cmsg, and it will skip setting record_type to the correct value, but the caller (tls_sw_sendmsg_locked) handles that return value correctly and proceeds with sending the new message with an incorrect record_type (DATA instead of whatever was requested in the cmsg).
Always set record_type before handling the open record. If tls_handle_open_record returns an error, record_type will be ignored. If it succeeds, whether with synchronous crypto (returning 0) or asynchronous (returning -EINPROGRESS), the caller will proceed correctly.
--- net/tls/tls_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/tls/tls_main.c +2 -5
@@ -185,12 +185,9 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,if (msg->msg_flags &MSG_MORE )return -EINVAL ; - rc =tls_handle_open_record (sk, msg->msg_flags); -if (rc) -return rc; - *record_type = *(unsigned char *)CMSG_DATA (cmsg); - rc =0 ; + + rc =tls_handle_open_record (sk, msg->msg_flags);break ;default :return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/123 tls: dont rely on tx_work during send()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
With async crypto, we rely on tx_work to actually transmit records once encryption completes. But while send() is running, both the tx_lock and socket lock are held, so tx_work_handler cannot process the queue of encrypted records, and simply reschedules itself. During a large send(), this could last a long time, and use a lot of memory.
Transmit any pending encrypted records before restarting the main loop of tls_sw_sendmsg_locked.
--- net/tls/tls_sw.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/tls/tls_sw.c +13 -0
@@ -1089,6 +1089,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)else if (ret != -EAGAIN ) goto send_end; } + +/* Transmit if any encryptions have completed */ +if (test_and_clear_bit (BIT_TX_SCHEDULED , &ctx->tx_bitmask)) { +cancel_delayed_work (&ctx->tx_work.work); +tls_tx_records (sk, msg->msg_flags); + } +continue ; rollback_iter: copied -= try_to_copy;
@@ -1143,6 +1150,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) goto send_end; } } + +/* Transmit if any encryptions have completed */ +if (test_and_clear_bit (BIT_TX_SCHEDULED , &ctx->tx_bitmask)) { +cancel_delayed_work (&ctx->tx_work.work); +tls_tx_records (sk, msg->msg_flags); + } }continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/123 net: usb: use eth_hw_addr_set() instead of ether_addr_copy()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit af804e6db9f60b923ff5149d9bf782e0baa82a2b ]
Commit 406f42fa0d3c ("net-next: When a bond have a massive amount of VLANs...") introduced a rbtree for faster Ethernet address look up. To maintain netdev->dev_addr in this tree we need to make all the writes to it got through appropriate helpers.
Convert net/usb from ether_addr_copy() to eth_hw_addr_set():
@@
expression dev, np;
@@
- ether_addr_copy(dev->dev_addr, np)
+ eth_hw_addr_set(dev, np)
Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
--- drivers/net/usb/aqc111.c | 2 +- drivers/net/usb/lan78xx.c | 4 ++-- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/rndis_host.c | 2 +- drivers/net/usb/rtl8150.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/usb/aqc111.c +1 -1
@@ -720,7 +720,7 @@ static int aqc111_bind(struct usbnet *dev, struct usb_interface *intf)if (ret) goto out; -ether_addr_copy (dev->net->dev_addr, dev->net->perm_addr); +eth_hw_addr_set (dev->net, dev->net->perm_addr);/* Set Rx urb size */ dev->rx_urb_size =URB_SIZE ;
drivers/net/usb/lan78xx.c +2 -2
@@ -1819,7 +1819,7 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)lan78xx_write_reg (dev,MAF_LO (0 ), addr_lo);lan78xx_write_reg (dev,MAF_HI (0 ), addr_hi |MAF_HI_VALID_ ); -ether_addr_copy (dev->net->dev_addr, addr); +eth_hw_addr_set (dev->net, addr); }/* MDIO read and write wrappers for phylib */
@@ -2394,7 +2394,7 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)if (!is_valid_ether_addr (addr->sa_data))return -EADDRNOTAVAIL ; -ether_addr_copy (netdev->dev_addr, addr->sa_data); +eth_hw_addr_set (netdev, addr->sa_data); addr_lo = netdev->dev_addr[0 ] | netdev->dev_addr[1] << 8 |
drivers/net/usb/r8152.c +1 -1
@@ -1724,7 +1724,7 @@ static int set_ethernet_addr(struct r8152 *tp, bool in_resume)return ret;if (tp->version ==RTL_VER_01 ) -ether_addr_copy (dev->dev_addr, sa.sa_data); +eth_hw_addr_set (dev, sa.sa_data);else ret =__rtl8152_set_mac_address (dev, &sa, in_resume);
drivers/net/usb/rndis_host.c +1 -1
@@ -422,7 +422,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)if (bp[0 ] &0x02 )eth_hw_addr_random (net);else -ether_addr_copy (net->dev_addr, bp); +eth_hw_addr_set (net, bp);/* set a nonzero filter to enable data transfers */ memset (u.set,0 ,sizeof *u.set);
drivers/net/usb/rtl8150.c +1 -1
@@ -270,7 +270,7 @@ static void set_ethernet_addr(rtl8150_t *dev) ret =get_registers (dev,IDR ,sizeof (node_id), node_id);if (!ret) { -ether_addr_copy (dev->netdev->dev_addr, node_id); +eth_hw_addr_set (dev->netdev, node_id); }else {eth_hw_addr_random (dev->netdev); netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/123 net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ]
Convert lan78xx_init_mac_address to return error codes and handle failures in register read and write operations. Update lan78xx_reset to check for errors during MAC address initialization and propagate them appropriately.
Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
--- drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-)
drivers/net/usb/lan78xx.c +28 -8
@@ -1773,13 +1773,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = { .get_regs = lan78xx_get_regs, }; -static void lan78xx_init_mac_address (struct lan78xx_net *dev) +static int lan78xx_init_mac_address (struct lan78xx_net *dev) {u32 addr_lo, addr_hi;u8 addr[6 ]; +int ret; + + ret =lan78xx_read_reg (dev,RX_ADDRL , &addr_lo); +if (ret <0 ) +return ret; -lan78xx_read_reg (dev,RX_ADDRL , &addr_lo); -lan78xx_read_reg (dev,RX_ADDRH , &addr_hi); + ret =lan78xx_read_reg (dev,RX_ADDRH , &addr_hi); +if (ret <0 ) +return ret; addr[0 ] = addr_lo &0xFF ; addr[1 ] = (addr_lo >>8 ) &0xFF ;
@@ -1812,14 +1818,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) (addr[2 ] <<16 ) | (addr[3 ] <<24 ); addr_hi = addr[4 ] | (addr[5 ] <<8 ); -lan78xx_write_reg (dev,RX_ADDRL , addr_lo); -lan78xx_write_reg (dev,RX_ADDRH , addr_hi); + ret =lan78xx_write_reg (dev,RX_ADDRL , addr_lo); +if (ret <0 ) +return ret; + + ret =lan78xx_write_reg (dev,RX_ADDRH , addr_hi); +if (ret <0 ) +return ret; } -lan78xx_write_reg (dev,MAF_LO (0 ), addr_lo); -lan78xx_write_reg (dev,MAF_HI (0 ), addr_hi |MAF_HI_VALID_ ); + ret =lan78xx_write_reg (dev,MAF_LO (0 ), addr_lo); +if (ret <0 ) +return ret; + + ret =lan78xx_write_reg (dev,MAF_HI (0 ), addr_hi |MAF_HI_VALID_ ); +if (ret <0 ) +return ret;eth_hw_addr_set (dev->net, addr); + +return 0 ; }/* MDIO read and write wrappers for phylib */
@@ -2718,7 +2736,9 @@ static int lan78xx_reset(struct lan78xx_net *dev) } }while (buf &HW_CFG_LRST_ ); -lan78xx_init_mac_address (dev); + ret =lan78xx_init_mac_address (dev); +if (ret <0 ) +return ret;/* save DEVID for later usage */ ret =lan78xx_read_reg (dev,ID_REV , &buf);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/123 net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: I Viswanath <[email protected]>
[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
dev->chipid is used in lan78xx_init_mac_address before it's initialized:
lan78xx_reset() {
lan78xx_init_mac_address()
lan78xx_read_eeprom()
lan78xx_read_raw_eeprom() <- dev->chipid is used here
dev->chipid = ... <- dev->chipid is initialized correctly here
}Reorder initialization so that dev->chipid is set before calling lan78xx_init_mac_address().
--- drivers/net/usb/lan78xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/usb/lan78xx.c +4 -4
@@ -2736,10 +2736,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) } }while (buf &HW_CFG_LRST_ ); - ret =lan78xx_init_mac_address (dev); -if (ret <0 ) -return ret; -/* save DEVID for later usage */ ret =lan78xx_read_reg (dev,ID_REV , &buf);if (ret <0 )
@@ -2748,6 +2744,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) dev->chipid = (buf &ID_REV_CHIP_ID_MASK_ ) >>16 ; dev->chiprev = buf &ID_REV_CHIP_REV_MASK_ ; + ret =lan78xx_init_mac_address (dev); +if (ret <0 ) +return ret; +/* Respond to the IN token with a NAK */ ret =lan78xx_read_reg (dev,USB_CFG0 , &buf);if (ret <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/123 riscv: kprobes: Fix probe address validation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Vogt <[email protected]>
[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]
When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", arch_check_kprobe would start iterating all instructions starting from _text until the probed address. Not only is this very inefficient, but literal values in there (e.g. left by function patching) are misinterpreted in a way that causes a desync.
Fix this by doing it like x86: start the iteration at the closest preceding symbol instead of the given starting point.
--- arch/riscv/kernel/probes/kprobes.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
arch/riscv/kernel/probes/kprobes.c +9 -4
@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)post_kprobe_handler (p, kcb, regs); } -static bool __kprobes arch_check_kprobe (struct kprobe *p) +static bool __kprobes arch_check_kprobe (unsigned long addr) { -unsigned long tmp = (unsigned long )p->addr - p->offset; -unsigned long addr = (unsigned long )p->addr; +unsigned long tmp, offset; + +/* start iterating at the closest preceding symbol */ +if (!kallsyms_lookup_size_offset (addr,NULL , &offset)) +return false; + + tmp = addr - offset;while (tmp <= addr) {if (tmp == addr)
@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)if ((unsigned long )insn &0x1 )return -EILSEQ ; -if (!arch_check_kprobe (p)) +if (!arch_check_kprobe ((unsigned long )p->addr))return -EILSEQ ;/* copy instruction */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/123 drm/amd/powerplay: Fix CIK shutdown temperature
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
Remove extra multiplication.
CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case the shutdown temperature is hardcoded in smu7_init_dpm_defaults and is already multiplied by 1000. The value was mistakenly multiplied another time by smu7_get_thermal_temperature_range.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +1 -2
@@ -5387,8 +5387,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; else if (hwmgr->pp_table_version == PP_TABLE_V0) - thermal_data->max = data->thermal_temp_setting.temperature_shutdown * -PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; + thermal_data->max = data->thermal_temp_setting.temperature_shutdown;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/123 sched/balancing: Rename newidle_balance() => sched_balance_newidle()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <[email protected]>
[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ]
Standardize scheduler load-balancing function names on the sched_balance_() prefix.
Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
--- kernel/sched/fair.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
kernel/sched/fair.c +8 -8
@@ -3959,7 +3959,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq)return cfs_rq->avg.load_avg; } -static int newidle_balance (struct rq *this_rq,struct rq_flags *rf); +static int sched_balance_newidle (struct rq *this_rq,struct rq_flags *rf);static inline unsigned long task_util (struct task_struct *p) {
@@ -4291,7 +4291,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}static inline void detach_entity_load_avg (struct cfs_rq *cfs_rq,struct sched_entity *se) {} -static inline int newidle_balance (struct rq *rq,struct rq_flags *rf) +static inline int sched_balance_newidle (struct rq *rq,struct rq_flags *rf) {return 0 ; }
@@ -7280,7 +7280,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)if (rq->nr_running)return 1 ; - return newidle_balance(rq, rf) != 0; + return sched_balance_newidle(rq, rf) != 0; }#endif /* CONFIG_SMP */
@@ -7616,10 +7616,10 @@ done: __maybe_unused;if (!rf)return NULL ; - new_tasks =newidle_balance (rq, rf); + new_tasks =sched_balance_newidle (rq, rf);/* -* Because newidle_balance() releases (and re-acquires) rq->lock, it is +* Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is * possible for any higher priority task to appear. In that case we * must re-start the pick_next_entity() loop. */
@@ -10427,7 +10427,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, ld_moved =0 ;/* -* newidle_balance() disregards balance intervals, so we could +* sched_balance_newidle() disregards balance intervals, so we could * repeatedly reach this code, which would lead to balance_interval * skyrocketing in a short amount of time. Skip the balance_interval * increase logic to avoid that.
@@ -11155,7 +11155,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }#endif /* CONFIG_NO_HZ_COMMON */ /* -* newidle_balance is called by schedule() if this_cpu is about to become +* sched_balance_newidle is called by schedule() if this_cpu is about to become * idle. Attempts to pull tasks from other CPUs. * * Returns:
@@ -11163,7 +11163,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }* 0 - failed, no new tasks * > 0 - success, new (fair) tasks present */ -static int newidle_balance (struct rq *this_rq,struct rq_flags *rf) +static int sched_balance_newidle (struct rq *this_rq,struct rq_flags *rf) {unsigned long next_balance = jiffies +HZ ;int this_cpu = this_rq->cpu;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/123 sched/fair: Fix pelt lost idle time detection
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Guittot <[email protected]>
[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
The check for some lost idle pelt time should be always done when pick_next_task_fair() fails to pick a task and not only when we call it from the fair fast-path.
The case happens when the last running task on rq is a RT or DL task. When the latter goes to sleep and the /Sum of util_sum of the rq is at the max value, we don't account the lost of idle time whereas we should.
--- kernel/sched/fair.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
kernel/sched/fair.c +13 -13
@@ -7613,21 +7613,21 @@ done: __maybe_unused;return p; idle: -if (!rf) -return NULL ; - - new_tasks =sched_balance_newidle (rq, rf); +if (rf) { + new_tasks =sched_balance_newidle (rq, rf); -/* -* Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is -* possible for any higher priority task to appear. In that case we -* must re-start the pick_next_entity() loop. -*/ -if (new_tasks <0 ) -return RETRY_TASK ; +/* +* Because sched_balance_newidle() releases (and re-acquires) +* rq->lock, it is possible for any higher priority task to +* appear. In that case we must re-start the pick_next_entity() +* loop. +*/ +if (new_tasks <0 ) +return RETRY_TASK ; -if (new_tasks >0 ) - goto again; +if (new_tasks >0 ) + goto again; + }/* * rq is about to be idle, check if we need to update the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/123 ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
--- sound/firewire/amdtp-stream.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/firewire/amdtp-stream.h +1 -1
@@ -32,7 +32,7 @@* allows 5 times as large as IEC 61883-6 defines. * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include * valid EOH. -* @CIP_NO_HEADERS: a lack of headers in packets +* @CIP_NO_HEADER: a lack of headers in packets * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to * the value of current SYT_INTERVAL; e.g. initial value is not zero. * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/123 ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaming Zhang <[email protected]>
[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ]
In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed().
--- sound/usb/card.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
sound/usb/card.c +8 -2
@@ -753,10 +753,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id)*/ static int try_to_register_card (struct snd_usb_audio *chip,int ifnum) { +struct usb_interface *iface; +if (check_delayed_register_option (chip) == ifnum || - chip->last_iface == ifnum || -usb_interface_claimed (usb_ifnum_to_if (chip->dev, chip->last_iface))) + chip->last_iface == ifnum) +return snd_card_register (chip->card); + + iface =usb_ifnum_to_if (chip->dev, chip->last_iface); +if (iface &&usb_interface_claimed (iface))return snd_card_register (chip->card); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/123 hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
commit 42520df65bf67189541a425f7d36b0b3e7bd7844 upstream.
The hfsplus_strcasecmp() logic can trigger the issue:
[ 117.317703][ T9855] ================================================================== [ 117.318353][ T9855] BUG: KASAN: slab-out-of-bounds in hfsplus_strcasecmp+0x1bc/0x490 [ 117.318991][ T9855] Read of size 2 at addr ffff88802160f40c by task repro/9855 [ 117.319577][ T9855] [ 117.319773][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: repro Not tainted 6.17.0-rc6 #33 PREEMPT(full) [ 117.319780][ T9855] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.319783][ T9855] Call Trace: [ 117.319785][ T9855] <TASK> [ 117.319788][ T9855] dump_stack_lvl+0x1c1/0x2a0 [ 117.319795][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319803][ T9855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 117.319808][ T9855] ? rcu_is_watching+0x15/0xb0 [ 117.319816][ T9855] ? lock_release+0x4b/0x3e0 [ 117.319821][ T9855] ? __kasan_check_byte+0x12/0x40 [ 117.319828][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319835][ T9855] ? __virt_addr_valid+0x4a5/0x5c0 [ 117.319842][ T9855] print_report+0x17e/0x7e0 [ 117.319848][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319855][ T9855] ? __virt_addr_valid+0x4a5/0x5c0 [ 117.319862][ T9855] ? __phys_addr+0xd3/0x180 [ 117.319869][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490 [ 117.319876][ T9855] kasan_report+0x147/0x180 [ 117.319882][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490 [ 117.319891][ T9855] hfsplus_strcasecmp+0x1bc/0x490 [ 117.319900][ T9855] ? __pfx_hfsplus_cat_case_cmp_key+0x10/0x10 [ 117.319906][ T9855] hfs_find_rec_by_key+0xa9/0x1e0 [ 117.319913][ T9855] __hfsplus_brec_find+0x18e/0x470 [ 117.319920][ T9855] ? __pfx_hfsplus_bnode_find+0x10/0x10 [ 117.319926][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 117.319933][ T9855] ? __pfx___hfsplus_brec_find+0x10/0x10 [ 117.319942][ T9855] hfsplus_brec_find+0x28f/0x510 [ 117.319949][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 117.319956][ T9855] ? __pfx_hfsplus_brec_find+0x10/0x10 [ 117.319963][ T9855] ? __kmalloc_noprof+0x2a9/0x510 [ 117.319969][ T9855] ? hfsplus_find_init+0x8c/0x1d0 [ 117.319976][ T9855] hfsplus_brec_read+0x2b/0x120 [ 117.319983][ T9855] hfsplus_lookup+0x2aa/0x890 [ 117.319990][ T9855] ? __pfx_hfsplus_lookup+0x10/0x10 [ 117.320003][ T9855] ? d_alloc_parallel+0x2f0/0x15e0 [ 117.320008][ T9855] ? __lock_acquire+0xaec/0xd80 [ 117.320013][ T9855] ? __pfx_d_alloc_parallel+0x10/0x10 [ 117.320019][ T9855] ? __raw_spin_lock_init+0x45/0x100 [ 117.320026][ T9855] ? __init_waitqueue_head+0xa9/0x150 [ 117.320034][ T9855] __lookup_slow+0x297/0x3d0 [ 117.320039][ T9855] ? __pfx___lookup_slow+0x10/0x10 [ 117.320045][ T9855] ? down_read+0x1ad/0x2e0 [ 117.320055][ T9855] lookup_slow+0x53/0x70 [ 117.320065][ T9855] walk_component+0x2f0/0x430 [ 117.320073][ T9855] path_lookupat+0x169/0x440 [ 117.320081][ T9855] filename_lookup+0x212/0x590 [ 117.320089][ T9855] ? __pfx_filename_lookup+0x10/0x10 [ 117.320098][ T9855] ? strncpy_from_user+0x150/0x290 [ 117.320105][ T9855] ? getname_flags+0x1e5/0x540 [ 117.320112][ T9855] user_path_at+0x3a/0x60 [ 117.320117][ T9855] __x64_sys_umount+0xee/0x160 [ 117.320123][ T9855] ? __pfx___x64_sys_umount+0x10/0x10 [ 117.320129][ T9855] ? do_syscall_64+0xb7/0x3a0 [ 117.320135][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320141][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320145][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.320150][ T9855] ? exc_page_fault+0x9f/0xf0 [ 117.320154][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320158][ T9855] RIP: 0033:0x7f7dd7908b07 [ 117.320163][ T9855] Code: 23 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 08 [ 117.320167][ T9855] RSP: 002b:00007ffd5ebd9698 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 117.320172][ T9855] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7dd7908b07 [ 117.320176][ T9855] RDX: 0000000000000009 RSI: 0000000000000009 RDI: 00007ffd5ebd9740 [ 117.320179][ T9855] RBP: 00007ffd5ebda780 R08: 0000000000000005 R09: 00007ffd5ebd9530 [ 117.320181][ T9855] R10: 00007f7dd799bfc0 R11: 0000000000000202 R12: 000055e2008b32d0 [ 117.320184][ T9855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 117.320189][ T9855] </TASK> [ 117.320190][ T9855] [ 117.351311][ T9855] Allocated by task 9855: [ 117.351683][ T9855] kasan_save_track+0x3e/0x80 [ 117.352093][ T9855] __kasan_kmalloc+0x8d/0xa0 [ 117.352490][ T9855] __kmalloc_noprof+0x288/0x510 [ 117.352914][ T9855] hfsplus_find_init+0x8c/0x1d0 [ 117.353342][ T9855] hfsplus_lookup+0x19c/0x890 [ 117.353747][ T9855] __lookup_slow+0x297/0x3d0 [ 117.354148][ T9855] lookup_slow+0x53/0x70 [ 117.354514][ T9855] walk_component+0x2f0/0x430 [ 117.354921][ T9855] path_lookupat+0x169/0x440 [ 117.355325][ T9855] filename_lookup+0x212/0x590 [ 117.355740][ T9855] user_path_at+0x3a/0x60 [ 117.356115][ T9855] __x64_sys_umount+0xee/0x160 [ 117.356529][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.356920][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.357429][ T9855] [ 117.357636][ T9855] The buggy address belongs to the object at ffff88802160f000 [ 117.357636][ T9855] which belongs to the cache kmalloc-2k of size 2048 [ 117.358827][ T9855] The buggy address is located 0 bytes to the right of [ 117.358827][ T9855] allocated 1036-byte region [ffff88802160f000, ffff88802160f40c) [ 117.360061][ T9855] [ 117.360266][ T9855] The buggy address belongs to the physical page: [ 117.360813][ T9855] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21608 [ 117.361562][ T9855] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 117.362285][ T9855] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 117.362929][ T9855] page_type: f5(slab) [ 117.363282][ T9855] raw: 00fff00000000040 ffff88801a842f00 ffffea0000932000 dead000000000002 [ 117.364015][ T9855] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 117.364750][ T9855] head: 00fff00000000040 ffff88801a842f00 ffffea0000932000 dead000000000002 [ 117.365491][ T9855] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 117.366232][ T9855] head: 00fff00000000003 ffffea0000858201 00000000ffffffff 00000000ffffffff [ 117.366968][ T9855] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 117.367711][ T9855] page dumped because: kasan: bad access detected [ 117.368259][ T9855] page_owner tracks the page as allocated [ 117.368745][ T9855] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN1 [ 117.370541][ T9855] post_alloc_hook+0x240/0x2a0 [ 117.370954][ T9855] get_page_from_freelist+0x2101/0x21e0 [ 117.371435][ T9855] __alloc_frozen_pages_noprof+0x274/0x380 [ 117.371935][ T9855] alloc_pages_mpol+0x241/0x4b0 [ 117.372360][ T9855] allocate_slab+0x8d/0x380 [ 117.372752][ T9855] ___slab_alloc+0xbe3/0x1400 [ 117.373159][ T9855] __kmalloc_cache_noprof+0x296/0x3d0 [ 117.373621][ T9855] nexthop_net_init+0x75/0x100 [ 117.374038][ T9855] ops_init+0x35c/0x5c0 [ 117.374400][ T9855] setup_net+0x10c/0x320 [ 117.374768][ T9855] copy_net_ns+0x31b/0x4d0 [ 117.375156][ T9855] create_new_namespaces+0x3f3/0x720 [ 117.375613][ T9855] unshare_nsproxy_namespaces+0x11c/0x170 [ 117.376094][ T9855] ksys_unshare+0x4ca/0x8d0 [ 117.376477][ T9855] __x64_sys_unshare+0x38/0x50 [ 117.376879][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.377265][ T9855] page last free pid 9110 tgid 9110 stack trace: [ 117.377795][ T9855] __free_frozen_pages+0xbeb/0xd50 [ 117.378229][ T9855] __put_partials+0x152/0x1a0 [ 117.378625][ T9855] put_cpu_partial+0x17c/0x250 [ 117.379026][ T9855] __slab_free+0x2d4/0x3c0 [ 117.379404][ T9855] qlist_free_all+0x97/0x140 [ 117.379790][ T9855] kasan_quarantine_reduce+0x148/0x160 [ 117.380250][ T9855] __kasan_slab_alloc+0x22/0x80 [ 117.380662][ T9855] __kmalloc_noprof+0x232/0x510 [ 117.381074][ T9855] tomoyo_supervisor+0xc0a/0x1360 [ 117.381498][ T9855] tomoyo_env_perm+0x149/0x1e0 [ 117.381903][ T9855] tomoyo_find_next_domain+0x15ad/0x1b90 [ 117.382378][ T9855] tomoyo_bprm_check_security+0x11c/0x180 [ 117.382859][ T9855] security_bprm_check+0x89/0x280 [ 117.383289][ T9855] bprm_execve+0x8f1/0x14a0 [ 117.383673][ T9855] do_execveat_common+0x528/0x6b0 [ 117.384103][ T9855] __x64_sys_execve+0x94/0xb0 [ 117.384500][ T9855] [ 117.384706][ T9855] Memory state around the buggy address: [ 117.385179][ T9855] ffff88802160f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 117.385854][ T9855] ffff88802160f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 117.386534][ T9855] >ffff88802160f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.387204][ T9855] ^ [ 117.387566][ T9855] ffff88802160f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.388243][ T9855] ffff88802160f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.388918][ T9855] ==================================================================
The issue takes place if the length field of struct hfsplus_unistr is bigger than HFSPLUS_MAX_STRLEN. The patch simply checks the length of comparing strings. And if the strings' length is bigger than HFSPLUS_MAX_STRLEN, then it is corrected to this value.
v2
The string length correction has been added for hfsplus_strcmp().
--- fs/hfsplus/unicode.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
fs/hfsplus/unicode.c +24 -0
@@ -40,6 +40,18 @@ int hfsplus_strcasecmp(const struct hfsp p1 = s1->unicode; p2 = s2->unicode; +if (len1 >HFSPLUS_MAX_STRLEN ) { + len1 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s1->length), len1); + } + +if (len2 >HFSPLUS_MAX_STRLEN ) { + len2 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s2->length), len2); + } +while (1 ) { c1 = c2 =0 ;
@@ -74,6 +86,18 @@ int hfsplus_strcmp(const struct hfsplus_ p1 = s1->unicode; p2 = s2->unicode; +if (len1 >HFSPLUS_MAX_STRLEN ) { + len1 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s1->length), len1); + } + +if (len2 >HFSPLUS_MAX_STRLEN ) { + len2 =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (s2->length), len2); + } +for (len =min (len1, len2); len >0 ; len--) { c1 =be16_to_cpu (*p1); c2 =be16_to_cpu (*p2);
Greg Kroah-Hartman
maintainerPATCH 39/123 PCI/sysfs: Ensure devices are powered for config reads (part 2)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
Commit 48991e493507 ("PCI/sysfs: Ensure devices are powered for config reads") was applied to various linux-stable trees. However, prior to 6.12.y, we do not have commit d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds"). Therefore, we also need to apply the change to max_link_speed_show().
This was pointed out here:
Re: Patch "PCI/sysfs: Ensure devices are powered for config reads" has been added to the 6.6-stable tree
https://lore.kernel.org/all/[email protected]/
Original change description follows:
The "max_link_width", "current_link_speed", "current_link_width", "secondary_bus_number", and "subordinate_bus_number" sysfs files all access config registers, but they don't check the runtime PM state. If the device is in D3cold or a parent bridge is suspended, we may see -EINVAL, bogus values, or worse, depending on implementation details.
Wrap these access in pci_config_pm_runtime_{get,put}() like most of the rest of the similar sysfs attributes.
Notably, "max_link_speed" does not access config registers; it returns a cached value since d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds").
--- drivers/pci/pci-sysfs.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/pci/pci-sysfs.c +8 -2
@@ -164,9 +164,15 @@ static ssize_t max_link_speed_show(struc struct device_attribute *attr, char *buf) { struct pci_dev *pdev = to_pci_dev(dev); +ssize_t ret; -return sysfs_emit (buf,"%s\n" , -pci_speed_string (pcie_get_speed_cap (pdev))); +/* We read PCI_EXP_LNKCAP, so we need the device to be accessible. */ +pci_config_pm_runtime_get (pdev); + ret =sysfs_emit (buf,"%s\n" , +pci_speed_string (pcie_get_speed_cap (pdev))); +pci_config_pm_runtime_put (pdev); + +return ret; }static DEVICE_ATTR_RO (max_link_speed);
Greg Kroah-Hartman
maintainerPATCH 40/123 Revert "perf test: Dont leak workload gopipe in PERF_RECORD_*"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niko Mauno <[email protected]>
This reverts commit b7e5c59f3b0971f56ebbceb9d42cc45e9ac1cd94 which is commit 48918cacefd226af44373e914e63304927c0e7dc upstream.
Commit in question broke building perf followingly with v5.15.195:
| ld: perf-in.o: in function `test__PERF_RECORD':
| tools/perf/tests/perf-record.c:142: undefined reference to `evlist__cancel_workload'
The 'evlist__cancel_workload' seems to be introduced in
commit e880a70f8046 ("perf stat: Close cork_fd when create_perf_stat_counter() failed") which is currently not included in the 5.15 stable series.
--- tools/perf/tests/perf-record.c | 4 ---- 1 file changed, 4 deletions(-)
tools/perf/tests/perf-record.c +0 -4
@@ -115,7 +115,6 @@ int test__PERF_RECORD(struct test *testif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); -evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -127,7 +126,6 @@ int test__PERF_RECORD(struct test *testif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); -evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -139,7 +137,6 @@ int test__PERF_RECORD(struct test *testif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); -evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -152,7 +149,6 @@ int test__PERF_RECORD(struct test *testif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); -evlist__cancel_workload (evlist); goto out_delete_evlist; }
Greg Kroah-Hartman
maintainerPATCH 41/123 exec: Fix incorrect type for ret
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xichao Zhao <[email protected]>
[ Upstream commit 5e088248375d171b80c643051e77ade6b97bc386 ]
In the setup_arg_pages(), ret is declared as an unsigned long. The ret might take a negative value. Therefore, its type should be changed to int.
--- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/exec.c +1 -1
@@ -746,7 +746,7 @@ int setup_arg_pages(struct linux_binprm *bprm,unsigned long stack_top, int executable_stack) { -unsigned long ret; + int ret;unsigned long stack_shift;struct mm_struct *mm = current->mm;struct vm_area_struct *vma = bprm->vma;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/123 nios2: ensure that memblock.current_limit is set when setting pfn limits
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <[email protected]>
[ Upstream commit a20b83cf45be2057f3d073506779e52c7fa17f94 ]
On nios2, with CONFIG_FLATMEM set, the kernel relies on memblock_get_current_limit() to determine the limits of mem_map, in particular for max_low_pfn.
Unfortunately, memblock.current_limit is only default initialized to MEMBLOCK_ALLOC_ANYWHERE at this point of the bootup, potentially leading to situations where max_low_pfn can erroneously exceed the value of max_pfn and, thus, the valid range of available DRAM.
This can in turn cause kernel-level paging failures, e.g.:
[ 76.900000] Unable to handle kernel paging request at virtual address 20303000 [ 76.900000] ea = c0080890, ra = c000462c, cause = 14 [ 76.900000] Kernel panic - not syncing: Oops [ 76.900000] ---[ end Kernel panic - not syncing: Oops ]---
This patch fixes this by pre-calculating memblock.current_limit based on the upper limits of the available memory ranges via adjust_lowmem_bounds, a simplified version of the equivalent implementation within the arm architecture.
--- arch/nios2/kernel/setup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
arch/nios2/kernel/setup.c +15 -0
@@ -147,6 +147,20 @@ static void __init find_limits(unsigned long *min, unsigned long *max_low, *max_high =PFN_DOWN (memblock_end_of_DRAM ()); } +static void __init adjust_lowmem_bounds (void ) +{ +phys_addr_t block_start, block_end; +u64 i; +phys_addr_t memblock_limit =0 ; + +for_each_mem_range (i, &block_start, &block_end) { +if (block_end > memblock_limit) + memblock_limit = block_end; + } + +memblock_set_current_limit (memblock_limit); +} +void __init setup_arch (char **cmdline_p) {console_verbose ();
@@ -160,6 +174,7 @@ void __init setup_arch(char **cmdline_p)/* Keep a copy of command line */ *cmdline_p = boot_command_line; +adjust_lowmem_bounds ();find_limits (&min_low_pfn, &max_low_pfn, &max_pfn); max_mapnr = max_low_pfn;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/123 hfs: clear offset and space out of valid records in b-tree node
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 18b07c44f245beb03588b00b212b38fce9af7cc9 ]
Currently, hfs_brec_remove() executes moving records towards the location of deleted record and it updates offsets of moved records. However, the hfs_brec_remove() logic ignores the "mess" of b-tree node's free space and it doesn't touch the offsets out of records number. Potentially, it could confuse fsck or driver logic or to be a reason of potential corruption cases.
This patch reworks the logic of hfs_brec_remove() by means of clearing freed space of b-tree node after the records moving. And it clear the last offset that keeping old location of free space because now the offset before this one is keeping the actual offset to the free space after the record deletion.
--- fs/hfs/brec.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-)
fs/hfs/brec.c +23 -4
@@ -179,6 +179,7 @@ int hfs_brec_remove(struct hfs_find_data *fd)struct hfs_btree *tree;struct hfs_bnode *node, *parent;int end_off, rec_off, data_off, size; +int src, dst, len; tree = fd->tree; node = fd->bnode;
@@ -208,10 +209,14 @@ int hfs_brec_remove(struct hfs_find_data *fd) }hfs_bnode_write_u16 (node, offsetof(struct hfs_bnode_desc , num_recs), node->num_recs); -if (rec_off == end_off) - goto skip; size = fd->keylength + fd->entrylength; +if (rec_off == end_off) { + src = fd->keyoffset; +hfs_bnode_clear (node, src, size); + goto skip; + } + do { data_off = hfs_bnode_read_u16(node, rec_off); hfs_bnode_write_u16(node, rec_off + 2, data_off - size);
@@ -219,9 +224,23 @@ int hfs_brec_remove(struct hfs_find_data *fd) }while (rec_off >= end_off);/* fill hole */ -hfs_bnode_move (node, fd->keyoffset, fd->keyoffset + size, - data_off - fd->keyoffset - size); + dst = fd->keyoffset; + src = fd->keyoffset + size; + len = data_off - src; + +hfs_bnode_move (node, dst, src, len); + + src = dst + len; + len = data_off - src; + +hfs_bnode_clear (node, src, len); + skip: +/* +* Remove the obsolete offset to free space. +*/ +hfs_bnode_write_u16 (node, end_off,0 ); +hfs_bnode_dump (node);if (!fd->record)hfs_brec_update_parent (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/123 hfs: make proper initalization of struct hfs_find_data
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit c62663a986acee7c4485c1fa9de5fc40194b6290 ]
Potenatially, __hfs_ext_read_extent() could operate by not initialized values of fd->key after hfs_brec_find() call:
static inline int __hfs_ext_read_extent(struct hfs_find_data *fd, struct hfs_extent *extent,
u32 cnid, u32 block, u8 type)
{
int res;
hfs_ext_build_key(fd->search_key, cnid, block, type);
fd->key->ext.FNum = 0;
res = hfs_brec_find(fd);
if (res && res != -ENOENT)
return res;
if (fd->key->ext.FNum != fd->search_key->ext.FNum ||
fd->key->ext.FkType != fd->search_key->ext.FkType)
return -ENOENT;
if (fd->entrylength != sizeof(hfs_extent_rec))
return -EIO;
hfs_bnode_read(fd->bnode, extent, fd->entryoffset, sizeof(hfs_extent_rec));
return 0;
}This patch changes kmalloc() on kzalloc() in hfs_find_init() and intializes fd->record, fd->keyoffset, fd->keylength, fd->entryoffset, fd->entrylength for the case if hfs_brec_find() has been found nothing in the b-tree node.
--- fs/hfs/bfind.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/hfs/bfind.c +7 -1
@@ -18,7 +18,7 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) fd->tree = tree; fd->bnode =NULL ; - ptr =kmalloc (tree->max_key_len *2 +4 ,GFP_KERNEL ); + ptr =kzalloc (tree->max_key_len *2 +4 ,GFP_KERNEL );if (!ptr)return -ENOMEM ; fd->search_key = ptr;
@@ -112,6 +112,12 @@ int hfs_brec_find(struct hfs_find_data *fd)__be32 data;int height, res; + fd->record =-1 ; + fd->keyoffset =-1 ; + fd->keylength =-1 ; + fd->entryoffset =-1 ; + fd->entrylength =-1 ; + tree = fd->tree;if (fd->bnode)hfs_bnode_put (fd->bnode);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/123 hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 4840ceadef4290c56cc422f0fc697655f3cbf070 ]
The syzbot reported issue in __hfsplus_ext_cache_extent():
[ 70.194323][ T9350] BUG: KMSAN: uninit-value in __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195022][ T9350] __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195530][ T9350] hfsplus_file_extend+0x74f/0x1cf0 [ 70.195998][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.196458][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.196959][ T9350] cont_write_begin+0x1000/0x1950 [ 70.197416][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.197873][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.198374][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.198892][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.199393][ T9350] vfs_write+0xb0f/0x14e0 [ 70.199771][ T9350] ksys_write+0x23e/0x490 [ 70.200149][ T9350] __x64_sys_write+0x97/0xf0 [ 70.200570][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.201065][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.201506][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.202054][ T9350] [ 70.202279][ T9350] Uninit was created at: [ 70.202693][ T9350] __kmalloc_noprof+0x621/0xf80 [ 70.203149][ T9350] hfsplus_find_init+0x8d/0x1d0 [ 70.203602][ T9350] hfsplus_file_extend+0x6ca/0x1cf0 [ 70.204087][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.204561][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.205074][ T9350] cont_write_begin+0x1000/0x1950 [ 70.205547][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.206017][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.206519][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.207042][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.207552][ T9350] vfs_write+0xb0f/0x14e0 [ 70.207961][ T9350] ksys_write+0x23e/0x490 [ 70.208375][ T9350] __x64_sys_write+0x97/0xf0 [ 70.208810][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.209255][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.209680][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.210230][ T9350] [ 70.210454][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Not tainted 6.12.0-rc5 #5 [ 70.211174][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.212115][ T9350] ===================================================== [ 70.212734][ T9350] Disabling lock debugging due to kernel taint [ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic set ... [ 70.213858][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Tainted: G B 6.12.0-rc5 #5 [ 70.214679][ T9350] Tainted: [B]=BAD_PAGE [ 70.215057][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.215999][ T9350] Call Trace: [ 70.216309][ T9350] <TASK> [ 70.216585][ T9350] dump_stack_lvl+0x1fd/0x2b0 [ 70.217025][ T9350] dump_stack+0x1e/0x30 [ 70.217421][ T9350] panic+0x502/0xca0 [ 70.217803][ T9350] ? kmsan_get_metadata+0x13e/0x1c0
[ 70.218294][ Message fromT sy9350] kmsan_report+0x296/slogd@syzkaller 0x2aat Aug 18 22:11:058 ... kernel :[ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic [ 70.220179][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 set ... [ 70.221254][ T9350] ? __msan_warning+0x96/0x120 [ 70.222066][ T9350] ? __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.223023][ T9350] ? hfsplus_file_extend+0x74f/0x1cf0 [ 70.224120][ T9350] ? hfsplus_get_block+0xe16/0x17b0 [ 70.224946][ T9350] ? __block_write_begin_int+0x962/0x2ce0 [ 70.225756][ T9350] ? cont_write_begin+0x1000/0x1950 [ 70.226337][ T9350] ? hfsplus_write_begin+0x85/0x130 [ 70.226852][ T9350] ? generic_perform_write+0x3e8/0x1060 [ 70.227405][ T9350] ? __generic_file_write_iter+0x215/0x460 [ 70.227979][ T9350] ? generic_file_write_iter+0x109/0x5e0 [ 70.228540][ T9350] ? vfs_write+0xb0f/0x14e0 [ 70.228997][ T9350] ? ksys_write+0x23e/0x490 [ 70.229458][ T9350] ? __x64_sys_write+0x97/0xf0 [ 70.229939][ T9350] ? x64_sys_call+0x3015/0x3cf0 [ 70.230432][ T9350] ? do_syscall_64+0xd9/0x1d0 [ 70.230941][ T9350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.231926][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.232738][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.233711][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.234516][ T9350] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.235398][ T9350] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.236323][ T9350] ? hfsplus_brec_find+0x218/0x9f0 [ 70.237090][ T9350] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 70.237938][ T9350] ? __msan_instrument_asm_store+0xbf/0xf0 [ 70.238827][ T9350] ? __msan_metadata_ptr_for_store_4+0x27/0x40 [ 70.239772][ T9350] ? __hfsplus_ext_write_extent+0x536/0x620 [ 70.240666][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.241175][ T9350] __msan_warning+0x96/0x120 [ 70.241645][ T9350] __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.242223][ T9350] hfsplus_file_extend+0x74f/0x1cf0 [ 70.242748][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.243255][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.243878][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.244400][ T9350] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.244967][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.245531][ T9350] ? __pfx_hfsplus_get_block+0x10/0x10 [ 70.246079][ T9350] cont_write_begin+0x1000/0x1950 [ 70.246598][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.247105][ T9350] ? __pfx_hfsplus_get_block+0x10/0x10 [ 70.247650][ T9350] ? __pfx_hfsplus_write_begin+0x10/0x10 [ 70.248211][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.248752][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.249314][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.249856][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.250487][ T9350] vfs_write+0xb0f/0x14e0 [ 70.250930][ T9350] ? __pfx_generic_file_write_iter+0x10/0x10 [ 70.251530][ T9350] ksys_write+0x23e/0x490 [ 70.251974][ T9350] __x64_sys_write+0x97/0xf0 [ 70.252450][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.252924][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.253384][ T9350] ? irqentry_exit+0x16/0x60 [ 70.253844][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.254430][ T9350] RIP: 0033:0x7f7a92adffc9 [ 70.254873][ T9350] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 70.256674][ T9350] RSP: 002b:00007fff0bca3188 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 70.257485][ T9350] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7a92adffc9 [ 70.258246][ T9350] RDX: 000000000208e24b RSI: 0000000020000100 RDI: 0000000000000004 [ 70.258998][ T9350] RBP: 00007fff0bca31a0 R08: 00007fff0bca31a0 R09: 00007fff0bca31a0 [ 70.259769][ T9350] R10: 0000000000000000 R11: 0000000000000202 R12: 000055e0d75f8250 [ 70.260520][ T9350] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.261286][ T9350] </TASK> [ 70.262026][ T9350] Kernel Offset: disabled
(gdb) l *__hfsplus_ext_cache_extent+0x7d00xffffffff8318aef0 is in __hfsplus_ext_cache_extent (fs/hfsplus/extents.c:168).
163 fd->key->ext.cnid = 0;
164 res = hfs_brec_find(fd, hfs_find_rec_by_key);
165 if (res && res != -ENOENT)
166 return res;
167 if (fd->key->ext.cnid != fd->search_key->ext.cnid ||
168 fd->key->ext.fork_type != fd->search_key->ext.fork_type)
169 return -ENOENT;
170 if (fd->entrylength != sizeof(hfsplus_extent_rec))
171 return -EIO;
172 hfs_bnode_read(fd->bnode, extent, fd->entryoffset,
The __hfsplus_ext_cache_extent() calls __hfsplus_ext_read_extent():
res = __hfsplus_ext_read_extent(fd, hip->cached_extents, inode->i_ino,
block, HFSPLUS_IS_RSRC(inode) ? HFSPLUS_TYPE_RSRC : HFSPLUS_TYPE_DATA);
And if inode->i_ino could be equal to zero or any non-available CNID, then hfs_brec_find() could not find the record in the tree. As a result, fd->key could be compared with fd->search_key. But hfsplus_find_init() uses kmalloc() for fd->key and fd->search_key allocation:
int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) {
<skipped>
ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL);
if (!ptr)
return -ENOMEM;
fd->search_key = ptr;
fd->key = ptr + tree->max_key_len + 2;<skipped>
}
Finally, fd->key is still not initialized if hfs_brec_find() has found nothing.
This patch changes kmalloc() on kzalloc() in hfs_find_init() and intializes fd->record, fd->keyoffset, fd->keylength, fd->entryoffset, fd->entrylength for the case if hfs_brec_find() has been found nothing in the b-tree node.
--- fs/hfsplus/bfind.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/hfsplus/bfind.c +7 -1
@@ -18,7 +18,7 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) fd->tree = tree; fd->bnode =NULL ; - ptr =kmalloc (tree->max_key_len *2 +4 ,GFP_KERNEL ); + ptr =kzalloc (tree->max_key_len *2 +4 ,GFP_KERNEL );if (!ptr)return -ENOMEM ; fd->search_key = ptr;
@@ -158,6 +158,12 @@ int hfs_brec_find(struct hfs_find_data *fd, search_strategy_t do_key_compare)__be32 data;int height, res; + fd->record =-1 ; + fd->keyoffset =-1 ; + fd->keylength =-1 ; + fd->entryoffset =-1 ; + fd->entrylength =-1 ; + tree = fd->tree;if (fd->bnode)hfs_bnode_put (fd->bnode);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/123 hfs: validate record offset in hfsplus_bmap_alloc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Chenzhi <[email protected]>
[ Upstream commit 738d5a51864ed8d7a68600b8c0c63fe6fe5c4f20 ]
hfsplus_bmap_alloc can trigger a crash if a
record offset or length is larger than node_size
[ 15.264282] BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc+0x887/0x8b0 [ 15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183 [ 15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(voluntary) [ 15.266165] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] Call Trace: [ 15.266168] <TASK> [ 15.266169] dump_stack_lvl+0x53/0x70 [ 15.266173] print_report+0xd0/0x660 [ 15.266181] kasan_report+0xce/0x100 [ 15.266185] hfsplus_bmap_alloc+0x887/0x8b0 [ 15.266208] hfs_btree_inc_height.isra.0+0xd5/0x7c0 [ 15.266217] hfsplus_brec_insert+0x870/0xb00 [ 15.266222] __hfsplus_ext_write_extent+0x428/0x570 [ 15.266225] __hfsplus_ext_cache_extent+0x5e/0x910 [ 15.266227] hfsplus_ext_read_extent+0x1b2/0x200 [ 15.266233] hfsplus_file_extend+0x5a7/0x1000 [ 15.266237] hfsplus_get_block+0x12b/0x8c0 [ 15.266238] __block_write_begin_int+0x36b/0x12c0 [ 15.266251] block_write_begin+0x77/0x110 [ 15.266252] cont_write_begin+0x428/0x720 [ 15.266259] hfsplus_write_begin+0x51/0x100 [ 15.266262] cont_write_begin+0x272/0x720 [ 15.266270] hfsplus_write_begin+0x51/0x100 [ 15.266274] generic_perform_write+0x321/0x750 [ 15.266285] generic_file_write_iter+0xc3/0x310 [ 15.266289] __kernel_write_iter+0x2fd/0x800 [ 15.266296] dump_user_range+0x2ea/0x910 [ 15.266301] elf_core_dump+0x2a94/0x2ed0 [ 15.266320] vfs_coredump+0x1d85/0x45e0 [ 15.266349] get_signal+0x12e3/0x1990 [ 15.266357] arch_do_signal_or_restart+0x89/0x580 [ 15.266362] irqentry_exit_to_user_mode+0xab/0x110 [ 15.266364] asm_exc_page_fault+0x26/0x30 [ 15.266366] RIP: 0033:0x41bd35 [ 15.266367] Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8f [ 15.266369] RSP: 002b:00007ffc9e62d078 EFLAGS: 00010283 [ 15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX: 0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [ 15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 15.266375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000400000000000 [ 15.266376] </TASK>
When calling hfsplus_bmap_alloc to allocate a free node, this function first retrieves the bitmap from header node and map node using node->page together with the offset and length from hfs_brec_lenoff
``` len = hfs_brec_lenoff(node, 2, &off16); off = off16; off += node->page_offset; pagep = node->page + (off >> PAGE_SHIFT); data = kmap_local_page(*pagep); ```
However, if the retrieved offset or length is invalid(i.e. exceeds node_size), the code may end up accessing pages outside the allocated range for this node.
This patch adds proper validation of both offset and length before use, preventing out-of-bounds page access. Move is_bnode_offset_valid and check_and_correct_requested_length to hfsplus_fs.h, as they may be required by other functions.
--- fs/hfsplus/bnode.c | 41 ---------------------------------------- fs/hfsplus/btree.c | 6 ++++++ fs/hfsplus/hfsplus_fs.h | 42 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 48 insertions(+), 41 deletions(-)
fs/hfsplus/bnode.c +0 -41
@@ -18,47 +18,6 @@#include "hfsplus_fs.h" #include "hfsplus_raw.h" -static inline -bool is_bnode_offset_valid (struct hfs_bnode *node,int off) -{ -bool is_valid = off < node->tree->node_size; - -if (!is_valid) { -pr_err ("requested invalid offset: " -"NODE: id %u, type %#x, height %u, " -"node_size %u, offset %d\n" , - node->this, node->type, node->height, - node->tree->node_size, off); - } - -return is_valid; -} - -static inline -int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) -{ -unsigned int node_size; - -if (!is_bnode_offset_valid (node, off)) -return 0 ; - - node_size = node->tree->node_size; - -if ((off + len) > node_size) { -int new_len = (int )node_size - off; - -pr_err ("requested length has been corrected: " -"NODE: id %u, type %#x, height %u, " -"node_size %u, offset %d, " -"requested_len %d, corrected_len %d\n" , - node->this, node->type, node->height, - node->tree->node_size, off, len, new_len); - -return new_len; - } - -return len; -}/* Copy a specified range of bytes from the raw data of a node */ void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len)
fs/hfsplus/btree.c +6 -0
@@ -392,6 +392,12 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) len =hfs_brec_lenoff (node,2 , &off16); off = off16; +if (!is_bnode_offset_valid (node, off)) { +hfs_bnode_put (node); +return ERR_PTR (-EIO ); + } + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); data =kmap (*pagep);
fs/hfsplus/hfsplus_fs.h +42 -0
48 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/123 hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 9b3d15a758910bb98ba8feb4109d99cc67450ee4 ]
The syzbot reported issue in hfsplus_delete_cat():
[ 70.682285][ T9333] ===================================================== [ 70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec+0x1d7/0x220 [ 70.683640][ T9333] hfsplus_subfolders_dec+0x1d7/0x220 [ 70.684141][ T9333] hfsplus_delete_cat+0x105d/0x12b0 [ 70.684621][ T9333] hfsplus_rmdir+0x13d/0x310 [ 70.685048][ T9333] vfs_rmdir+0x5ba/0x810 [ 70.685447][ T9333] do_rmdir+0x964/0xea0 [ 70.685833][ T9333] __x64_sys_rmdir+0x71/0xb0 [ 70.686260][ T9333] x64_sys_call+0xcd8/0x3cf0 [ 70.686695][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.687119][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.687646][ T9333] [ 70.687856][ T9333] Uninit was stored to memory at: [ 70.688311][ T9333] hfsplus_subfolders_inc+0x1c2/0x1d0 [ 70.688779][ T9333] hfsplus_create_cat+0x148e/0x1800 [ 70.689231][ T9333] hfsplus_mknod+0x27f/0x600 [ 70.689730][ T9333] hfsplus_mkdir+0x5a/0x70 [ 70.690146][ T9333] vfs_mkdir+0x483/0x7a0 [ 70.690545][ T9333] do_mkdirat+0x3f2/0xd30 [ 70.690944][ T9333] __x64_sys_mkdir+0x9a/0xf0 [ 70.691380][ T9333] x64_sys_call+0x2f89/0x3cf0 [ 70.691816][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.692229][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.692773][ T9333] [ 70.692990][ T9333] Uninit was stored to memory at: [ 70.693469][ T9333] hfsplus_subfolders_inc+0x1c2/0x1d0 [ 70.693960][ T9333] hfsplus_create_cat+0x148e/0x1800 [ 70.694438][ T9333] hfsplus_fill_super+0x21c1/0x2700 [ 70.694911][ T9333] mount_bdev+0x37b/0x530 [ 70.695320][ T9333] hfsplus_mount+0x4d/0x60 [ 70.695729][ T9333] legacy_get_tree+0x113/0x2c0 [ 70.696167][ T9333] vfs_get_tree+0xb3/0x5c0 [ 70.696588][ T9333] do_new_mount+0x73e/0x1630 [ 70.697013][ T9333] path_mount+0x6e3/0x1eb0 [ 70.697425][ T9333] __se_sys_mount+0x733/0x830 [ 70.697857][ T9333] __x64_sys_mount+0xe4/0x150 [ 70.698269][ T9333] x64_sys_call+0x2691/0x3cf0 [ 70.698704][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.699117][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.699730][ T9333] [ 70.699946][ T9333] Uninit was created at: [ 70.700378][ T9333] __alloc_pages_noprof+0x714/0xe60 [ 70.700843][ T9333] alloc_pages_mpol_noprof+0x2a2/0x9b0 [ 70.701331][ T9333] alloc_pages_noprof+0xf8/0x1f0 [ 70.701774][ T9333] allocate_slab+0x30e/0x1390 [ 70.702194][ T9333] ___slab_alloc+0x1049/0x33a0 [ 70.702635][ T9333] kmem_cache_alloc_lru_noprof+0x5ce/0xb20 [ 70.703153][ T9333] hfsplus_alloc_inode+0x5a/0xd0 [ 70.703598][ T9333] alloc_inode+0x82/0x490 [ 70.703984][ T9333] iget_locked+0x22e/0x1320 [ 70.704428][ T9333] hfsplus_iget+0x5c/0xba0 [ 70.704827][ T9333] hfsplus_btree_open+0x135/0x1dd0 [ 70.705291][ T9333] hfsplus_fill_super+0x1132/0x2700 [ 70.705776][ T9333] mount_bdev+0x37b/0x530 [ 70.706171][ T9333] hfsplus_mount+0x4d/0x60 [ 70.706579][ T9333] legacy_get_tree+0x113/0x2c0 [ 70.707019][ T9333] vfs_get_tree+0xb3/0x5c0 [ 70.707444][ T9333] do_new_mount+0x73e/0x1630 [ 70.707865][ T9333] path_mount+0x6e3/0x1eb0 [ 70.708270][ T9333] __se_sys_mount+0x733/0x830 [ 70.708711][ T9333] __x64_sys_mount+0xe4/0x150 [ 70.709158][ T9333] x64_sys_call+0x2691/0x3cf0 [ 70.709630][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.710053][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.710611][ T9333] [ 70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17 [ 70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.712490][ T9333] ===================================================== [ 70.713085][ T9333] Disabling lock debugging due to kernel taint [ 70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ... [ 70.714159][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Tainted: G B 6.12.0-rc6-dirty #17 [ 70.715007][ T9333] Tainted: [B]=BAD_PAGE [ 70.715365][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.716311][ T9333] Call Trace: [ 70.716621][ T9333] <TASK> [ 70.716899][ T9333] dump_stack_lvl+0x1fd/0x2b0 [ 70.717350][ T9333] dump_stack+0x1e/0x30 [ 70.717743][ T9333] panic+0x502/0xca0 [ 70.718116][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.718611][ T9333] kmsan_report+0x296/0x2a0 [ 70.719038][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.719859][ T9333] ? __msan_warning+0x96/0x120 [ 70.720345][ T9333] ? hfsplus_subfolders_dec+0x1d7/0x220 [ 70.720881][ T9333] ? hfsplus_delete_cat+0x105d/0x12b0 [ 70.721412][ T9333] ? hfsplus_rmdir+0x13d/0x310 [ 70.721880][ T9333] ? vfs_rmdir+0x5ba/0x810 [ 70.722458][ T9333] ? do_rmdir+0x964/0xea0 [ 70.722883][ T9333] ? __x64_sys_rmdir+0x71/0xb0 [ 70.723397][ T9333] ? x64_sys_call+0xcd8/0x3cf0 [ 70.723915][ T9333] ? do_syscall_64+0xd9/0x1d0 [ 70.724454][ T9333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.725110][ T9333] ? vprintk_emit+0xd1f/0xe60 [ 70.725616][ T9333] ? vprintk_default+0x3f/0x50 [ 70.726175][ T9333] ? vprintk+0xce/0xd0 [ 70.726628][ T9333] ? _printk+0x17e/0x1b0 [ 70.727129][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.727739][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.728324][ T9333] __msan_warning+0x96/0x120 [ 70.728854][ T9333] hfsplus_subfolders_dec+0x1d7/0x220 [ 70.729479][ T9333] hfsplus_delete_cat+0x105d/0x12b0 [ 70.729984][ T9333] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.730646][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.731296][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.731863][ T9333] hfsplus_rmdir+0x13d/0x310 [ 70.732390][ T9333] ? __pfx_hfsplus_rmdir+0x10/0x10 [ 70.732919][ T9333] vfs_rmdir+0x5ba/0x810 [ 70.733416][ T9333] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.734044][ T9333] do_rmdir+0x964/0xea0 [ 70.734537][ T9333] __x64_sys_rmdir+0x71/0xb0 [ 70.735032][ T9333] x64_sys_call+0xcd8/0x3cf0 [ 70.735579][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.736092][ T9333] ? irqentry_exit+0x16/0x60 [ 70.736637][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.737269][ T9333] RIP: 0033:0x7fa9424eafc9 [ 70.737775][ T9333] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 70.739844][ T9333] RSP: 002b:00007fff099cd8d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000054 [ 70.740760][ T9333] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa9424eafc9 [ 70.741642][ T9333] RDX: 006c6f72746e6f63 RSI: 000000000000000a RDI: 0000000020000100 [ 70.742543][ T9333] RBP: 00007fff099cd8e0 R08: 00007fff099cd910 R09: 00007fff099cd910 [ 70.743376][ T9333] R10: 0000000000000000 R11: 0000000000000202 R12: 0000565430642260 [ 70.744247][ T9333] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.745082][ T9333] </TASK>
The main reason of the issue that struct hfsplus_inode_info has not been properly initialized for the case of root folder. In the case of root folder, hfsplus_fill_super() calls the hfsplus_iget() that implements only partial initialization of struct hfsplus_inode_info and subfolders field is not initialized by hfsplus_iget() logic.
This patch implements complete initialization of struct hfsplus_inode_info in the hfsplus_iget() logic with the goal to prevent likewise issues for the case of root folder.
--- fs/hfsplus/super.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
fs/hfsplus/super.c +18 -5
@@ -67,13 +67,26 @@ struct inode *hfsplus_iget(struct super_block *sb, unsigned long ino)if (!(inode->i_state &I_NEW ))return inode; -INIT_LIST_HEAD (&HFSPLUS_I (inode)->open_dir_list); -spin_lock_init (&HFSPLUS_I (inode)->open_dir_lock); -mutex_init (&HFSPLUS_I (inode)->extents_lock); -HFSPLUS_I (inode)->flags =0 ; +atomic_set (&HFSPLUS_I (inode)->opencnt,0 ); +HFSPLUS_I (inode)->first_blocks =0 ; +HFSPLUS_I (inode)->clump_blocks =0 ; +HFSPLUS_I (inode)->alloc_blocks =0 ; +HFSPLUS_I (inode)->cached_start =U32_MAX ; +HFSPLUS_I (inode)->cached_blocks =0 ; +memset (HFSPLUS_I (inode)->first_extents,0 ,sizeof (hfsplus_extent_rec)); +memset (HFSPLUS_I (inode)->cached_extents,0 ,sizeof (hfsplus_extent_rec));HFSPLUS_I (inode)->extent_state =0 ; +mutex_init (&HFSPLUS_I (inode)->extents_lock);HFSPLUS_I (inode)->rsrc_inode =NULL ; -atomic_set (&HFSPLUS_I (inode)->opencnt,0 ); +HFSPLUS_I (inode)->create_date =0 ; +HFSPLUS_I (inode)->linkid =0 ; +HFSPLUS_I (inode)->flags =0 ; +HFSPLUS_I (inode)->fs_blocks =0 ; +HFSPLUS_I (inode)->userflags =0 ; +HFSPLUS_I (inode)->subfolders =0 ; +INIT_LIST_HEAD (&HFSPLUS_I (inode)->open_dir_list); +spin_lock_init (&HFSPLUS_I (inode)->open_dir_lock); +HFSPLUS_I (inode)->phys_size =0 ;if (inode->i_ino >=HFSPLUS_FIRSTUSER_CNID || inode->i_ino ==HFSPLUS_ROOT_CNID ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/123 dlm: check for defined force value in dlm_lockspace_release
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit 6af515c9f3ccec3eb8a262ca86bef2c499d07951 ]
Force values over 3 are undefined, so don't treat them as 3.
--- fs/dlm/lockspace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dlm/lockspace.c +1 -1
@@ -785,7 +785,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)dlm_device_deregister (ls); -if (force <3 &&dlm_user_daemon_available ()) +if (force !=3 &&dlm_user_daemon_available ())do_uevent (ls,0 );dlm_recoverd_stop (ls);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/123 hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd ]
The syzbot reported issue in hfs_find_set_zero_bits():
=====================================================
BUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151 hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408 hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353 __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151 block_write_begin fs/buffer.c:2262 [inline] cont_write_begin+0x10e1/0x1bc0 fs/buffer.c:2601 hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52 cont_expand_zero fs/buffer.c:2528 [inline] cont_write_begin+0x35a/0x1bc0 fs/buffer.c:2591 hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52 hfs_file_truncate+0x1d6/0xe60 fs/hfs/extent.c:494 hfs_inode_setattr+0x964/0xaa0 fs/hfs/inode.c:654 notify_change+0x1993/0x1aa0 fs/attr.c:552 do_truncate+0x28f/0x310 fs/open.c:68 do_ftruncate+0x698/0x730 fs/open.c:195 do_sys_ftruncate fs/open.c:210 [inline] __do_sys_ftruncate fs/open.c:215 [inline] __se_sys_ftruncate fs/open.c:213 [inline] __x64_sys_ftruncate+0x11b/0x250 fs/open.c:213 x64_sys_call+0xfe3/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:78 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4154 [inline] slab_alloc_node mm/slub.c:4197 [inline] __kmalloc_cache_noprof+0x7f7/0xed0 mm/slub.c:4354 kmalloc_noprof include/linux/slab.h:905 [inline] hfs_mdb_get+0x1cc8/0x2a90 fs/hfs/mdb.c:175 hfs_fill_super+0x3d0/0xb80 fs/hfs/super.c:337 get_tree_bdev_flags+0x6e3/0x920 fs/super.c:1681 get_tree_bdev+0x38/0x50 fs/super.c:1704 hfs_get_tree+0x35/0x40 fs/hfs/super.c:388 vfs_get_tree+0xb0/0x5c0 fs/super.c:1804 do_new_mount+0x738/0x1610 fs/namespace.c:3902 path_mount+0x6db/0x1e90 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount+0x6eb/0x7d0 fs/namespace.c:4427 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4427 x64_sys_call+0xfa7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:166 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 12609 Comm: syz.1.2692 Not tainted 6.16.0-syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 =====================================================
The HFS_SB(sb)->bitmap buffer is allocated in hfs_mdb_get():
HFS_SB(sb)->bitmap = kmalloc(8192, GFP_KERNEL);
Finally, it can trigger the reported issue because kmalloc() doesn't clear the allocated memory. If allocated memory contains only zeros, then everything will work pretty fine.
But if the allocated memory contains the "garbage", then it can affect the bitmap operations and it triggers the reported issue.
This patch simply exchanges the kmalloc() on kzalloc() with the goal to guarantee the correctness of bitmap operations. Because, newly created allocation bitmap should have all available blocks free. Potentially, initialization bitmap's read operation could not fill the whole allocated memory and "garbage" in the not initialized memory will be the reason of volume coruptions and file system driver bugs.
--- fs/hfs/mdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/hfs/mdb.c +1 -1
@@ -172,7 +172,7 @@ int hfs_mdb_get(struct super_block *sb)pr_warn ("continuing without an alternate MDB\n" ); } -HFS_SB (sb)->bitmap =kmalloc (8192 ,GFP_KERNEL ); +HFS_SB (sb)->bitmap =kzalloc (8192 ,GFP_KERNEL );if (!HFS_SB (sb)->bitmap) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/123 hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 9282bc905f0949fab8cf86c0f620ca988761254c ]
If Catalog File contains corrupted record for the case of hidden directory's type, regard it as I/O error instead of Invalid argument.
--- fs/hfsplus/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/hfsplus/super.c +1 -1
@@ -538,7 +538,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)if (!hfs_brec_read (&fd, &entry,sizeof (entry))) {hfs_find_exit (&fd);if (entry.type !=cpu_to_be16 (HFSPLUS_FOLDER )) { - err = -EINVAL ; + err = -EIO ; goto out_put_root; } inode =hfsplus_iget (sb,be32_to_cpu (entry.folder.id));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/123 m68k: bitops: Fix find_*_bit() signatures
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 6d5674090543b89aac0c177d67e5fb32ddc53804 ]
The function signatures of the m68k-optimized implementations of the find_{first,next}_{,zero_}bit() helpers do not match the generic variants.
Fix this by changing all non-pointer inputs and outputs to "unsigned long", and updating a few local variables.
--- arch/m68k/include/asm/bitops.h | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
arch/m68k/include/asm/bitops.h +14 -11
@@ -314,12 +314,12 @@ static inline int bfchg_mem_test_and_change_bit(int nr,#include <asm-generic/bitops/ffz.h> #else -static inline int find_first_zero_bit (const unsigned long *vaddr, -unsigned size) +static inline unsigned long find_first_zero_bit (const unsigned long *vaddr, +unsigned long size) {const unsigned long *p = vaddr; -int res =32 ; -unsigned int words; +unsigned long res =32 ; +unsigned long words;unsigned long num;if (!size)
@@ -340,8 +340,9 @@ static inline int find_first_zero_bit(const unsigned long *vaddr, }#define find_first_zero_bit find_first_zero_bit -static inline int find_next_zero_bit (const unsigned long *vaddr,int size, -int offset) +static inline unsigned long find_next_zero_bit (const unsigned long *vaddr, +unsigned long size, +unsigned long offset) {const unsigned long *p = vaddr + (offset >>5 );int bit = offset &31UL , res;
@@ -370,11 +371,12 @@ static inline int find_next_zero_bit(const unsigned long *vaddr, int size, }#define find_next_zero_bit find_next_zero_bit -static inline int find_first_bit (const unsigned long *vaddr,unsigned size) +static inline unsigned long find_first_bit (const unsigned long *vaddr, +unsigned long size) {const unsigned long *p = vaddr; -int res =32 ; -unsigned int words; +unsigned long res =32 ; +unsigned long words;unsigned long num;if (!size)
@@ -395,8 +397,9 @@ static inline int find_first_bit(const unsigned long *vaddr, unsigned size) }#define find_first_bit find_first_bit -static inline int find_next_bit (const unsigned long *vaddr,int size, -int offset) +static inline unsigned long find_next_bit (const unsigned long *vaddr, +unsigned long size, +unsigned long offset) {const unsigned long *p = vaddr + (offset >>5 );int bit = offset &31UL , res;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/123 net: rtnetlink: add helper to extract msg types kind
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 2e9ea3e30f696fd438319c07836422bb0bbb4608 ]
Add a helper which extracts the msg type's kind using the kind mask (0x3).
Stable-dep-of: bf29555f5bdc ("rtnetlink: Allow deleting FDB entries in user namespace")
--- include/net/rtnetlink.h | 6 ++++++ net/core/rtnetlink.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)
include/net/rtnetlink.h +6 -0
@@ -19,6 +19,12 @@ enum rtnl_kinds { RTNL_KIND_GET,RTNL_KIND_SET }; +#define RTNL_KIND_MASK 0x3 + +static inline enum rtnl_kinds rtnl_msgtype_kind (int msgtype) +{ +return msgtype &RTNL_KIND_MASK ; +}struct rtnl_msg_handler {struct module *owner;
net/core/rtnetlink.c +1 -1
@@ -5572,7 +5572,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,return 0 ; family = ((struct rtgenmsg *)nlmsg_data (nlh))->rtgen_family; - kind = type&3 ; + kind =rtnl_msgtype_kind (type);if (kind !=RTNL_KIND_GET && !netlink_net_capable (skb,CAP_NET_ADMIN ))return -EPERM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/123 net: rtnetlink: use BIT for flag values
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 0569e31f1bc2f50613ba4c219f3ecc0d1174d841 ]
Use BIT to define flag values.
Stable-dep-of: bf29555f5bdc ("rtnetlink: Allow deleting FDB entries in user namespace")
--- include/net/rtnetlink.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/rtnetlink.h +1 -1
@@ -10,7 +10,7 @@ typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *,typedef int (*rtnl_dumpit_func )(struct sk_buff *,struct netlink_callback *);enum rtnl_link_flags { -RTNL_FLAG_DOIT_UNLOCKED =1 , +RTNL_FLAG_DOIT_UNLOCKED =BIT (0 ), };enum rtnl_kinds {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/123 net: netlink: add NLM_F_BULK delete request modifier
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 545528d788556c724eeb5400757f828ef27782a8 ]
Add a new delete request modifier called NLM_F_BULK which, when supported, would cause the request to delete multiple objects. The flag is a convenient way to signal that a multiple delete operation is requested which can be gradually added to different delete requests. In order to make sure older kernels will error out if the operation is not supported instead of doing something unintended we have to break a required condition when implementing support for this flag, f.e. for neighbors we will omit the mandatory mac address attribute. Initially it will be used to add flush with filtering support for bridge fdbs, but it also opens the door to add similar support to others.
Stable-dep-of: bf29555f5bdc ("rtnetlink: Allow deleting FDB entries in user namespace")
--- include/uapi/linux/netlink.h | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/netlink.h +1 -0
@@ -72,6 +72,7 @@ struct nlmsghdr {/* Modifiers to DELETE request */ #define NLM_F_NONREC 0x100/* Do not delete recursively */ +#define NLM_F_BULK 0x200/* Delete multiple objects */ /* Flags for ACK message */ #define NLM_F_CAPPED 0x100/* request was capped */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/123 net: rtnetlink: add bulk delete support flag
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit a6cec0bcd34264be8887791594be793b3f12719f ]
Add a new rtnl flag (RTNL_FLAG_BULK_DEL_SUPPORTED) which is used to verify that the delete operation allows bulk object deletion. Also emit a warning if anyone tries to set it for non-delete kind.
Stable-dep-of: bf29555f5bdc ("rtnetlink: Allow deleting FDB entries in user namespace")
--- include/net/rtnetlink.h | 3 ++- net/core/rtnetlink.c | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-)
include/net/rtnetlink.h +2 -1
@@ -10,7 +10,8 @@ typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *,typedef int (*rtnl_dumpit_func )(struct sk_buff *,struct netlink_callback *);enum rtnl_link_flags { -RTNL_FLAG_DOIT_UNLOCKED =BIT (0 ), +RTNL_FLAG_DOIT_UNLOCKED =BIT (0 ), +RTNL_FLAG_BULK_DEL_SUPPORTED =BIT (1 ), };enum rtnl_kinds {
net/core/rtnetlink.c +8 -0
@@ -214,6 +214,8 @@ static int rtnl_register_internal(struct module *owner,if (dumpit) link->dumpit = dumpit; +WARN_ON (rtnl_msgtype_kind (msgtype) !=RTNL_KIND_DEL && + (flags &RTNL_FLAG_BULK_DEL_SUPPORTED )); link->flags |= flags;/* publish protocol:msgtype */
@@ -5634,6 +5636,12 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, } flags = link->flags; +if (kind ==RTNL_KIND_DEL && (nlh->nlmsg_flags &NLM_F_BULK ) && + !(flags &RTNL_FLAG_BULK_DEL_SUPPORTED )) { +NL_SET_ERR_MSG (extack,"Bulk delete is not supported" ); + goto err_unlock; + } +if (flags &RTNL_FLAG_DOIT_UNLOCKED ) { doit = link->doit;rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/123 net: add ndo_fdb_del_bulk
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 1306d5362a591493a2d07f685ed2cc480dcda320 ]
Add a new netdev op called ndo_fdb_del_bulk, it will be later used for driver-specific bulk delete implementation dispatched from rtnetlink. The first user will be the bridge, we need it to signal to rtnetlink from the driver that we support bulk delete operation (NLM_F_BULK).
Stable-dep-of: bf29555f5bdc ("rtnetlink: Allow deleting FDB entries in user namespace")
--- include/linux/netdevice.h | 9 +++++++++ 1 file changed, 9 insertions(+)
include/linux/netdevice.h +9 -0
@@ -1273,6 +1273,10 @@ struct netdev_net_notifier {* struct net_device *dev, * const unsigned char *addr, u16 vid) * Deletes the FDB entry from dev coresponding to addr. +* int (*ndo_fdb_del_bulk)(struct ndmsg *ndm, struct nlattr *tb[], +* struct net_device *dev, +* u16 vid, +* struct netlink_ext_ack *extack); * int (*ndo_fdb_dump)(struct sk_buff *skb, struct netlink_callback *cb, * struct net_device *dev, struct net_device *filter_dev, * int *idx)
@@ -1528,6 +1532,11 @@ struct net_device_ops {struct net_device *dev, const unsigned char *addr, u16 vid); +int (*ndo_fdb_del_bulk)(struct ndmsg *ndm, +struct nlattr *tb[], +struct net_device *dev, +u16 vid, +struct netlink_ext_ack *extack); int (*ndo_fdb_dump)(struct sk_buff *skb, struct netlink_callback *cb, struct net_device *dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/123 net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 9e83425993f38bb89e0ea07849ba0039a748e85b ]
When NLM_F_BULK is specified in a fdb del message we need to handle it differently. First since this is a new call we can strictly validate the passed attributes, at first only ifindex and vlan are allowed as these will be the initially supported filter attributes, any other attribute is rejected. The mac address is no longer mandatory, but we use it to error out in older kernels because it cannot be specified with bulk request (the attribute is not allowed) and then we have to dispatch the call to ndo_fdb_del_bulk if the device supports it. The del bulk callback can do further validation of the attributes if necessary.
Stable-dep-of: bf29555f5bdc ("rtnetlink: Allow deleting FDB entries in user namespace")
--- net/core/rtnetlink.c | 67 +++++++++++++++++++++++++++++++------------- 1 file changed, 48 insertions(+), 19 deletions(-)
net/core/rtnetlink.c +48 -19
@@ -4174,22 +4174,34 @@ int ndo_dflt_fdb_del(struct ndmsg *ndm, }EXPORT_SYMBOL (ndo_dflt_fdb_del); +static const struct nla_policy fdb_del_bulk_policy[NDA_MAX +1 ] = { + [NDA_VLAN ] = { .type =NLA_U16 }, + [NDA_IFINDEX ] =NLA_POLICY_MIN (NLA_S32 ,1 ), +}; +static int rtnl_fdb_del (struct sk_buff *skb,struct nlmsghdr *nlh,struct netlink_ext_ack *extack) { +bool del_bulk = !!(nlh->nlmsg_flags &NLM_F_BULK );struct net *net =sock_net (skb->sk); +const struct net_device_ops *ops;struct ndmsg *ndm;struct nlattr *tb[NDA_MAX +1 ];struct net_device *dev; -__u8 *addr; +__u8 *addr =NULL ;int err;u16 vid;if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; - err =nlmsg_parse_deprecated (nlh,sizeof (*ndm), tb,NDA_MAX ,NULL , - extack); +if (!del_bulk) { + err =nlmsg_parse_deprecated (nlh,sizeof (*ndm), tb,NDA_MAX , +NULL , extack); + }else { + err =nlmsg_parse (nlh,sizeof (*ndm), tb,NDA_MAX , + fdb_del_bulk_policy, extack); + }if (err <0 )return err;
@@ -4205,9 +4217,12 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,return -ENODEV ; } -if (!tb[NDA_LLADDR ] ||nla_len (tb[NDA_LLADDR ]) !=ETH_ALEN ) { -NL_SET_ERR_MSG (extack,"invalid address" ); -return -EINVAL ; +if (!del_bulk) { +if (!tb[NDA_LLADDR ] ||nla_len (tb[NDA_LLADDR ]) !=ETH_ALEN ) { +NL_SET_ERR_MSG (extack,"invalid address" ); +return -EINVAL ; + } + addr =nla_data (tb[NDA_LLADDR ]); }if (dev->type !=ARPHRD_ETHER ) {
@@ -4215,8 +4230,6 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,return -EINVAL ; } - addr =nla_data (tb[NDA_LLADDR ]); - err =fdb_vid_parse (tb[NDA_VLAN ], &vid, extack);if (err)return err;
@@ -4227,10 +4240,16 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,if ((!ndm->ndm_flags || ndm->ndm_flags &NTF_MASTER ) &&netif_is_bridge_port (dev)) {struct net_device *br_dev =netdev_master_upper_dev_get (dev); -const struct net_device_ops *ops = br_dev->netdev_ops; -if (ops->ndo_fdb_del) - err = ops->ndo_fdb_del (ndm, tb, dev, addr, vid); + ops = br_dev->netdev_ops; +if (!del_bulk) { +if (ops->ndo_fdb_del) + err = ops->ndo_fdb_del (ndm, tb, dev, addr, vid); + }else { +if (ops->ndo_fdb_del_bulk) + err = ops->ndo_fdb_del_bulk (ndm, tb, dev, vid, + extack); + }if (err) goto out;
@@ -4240,15 +4259,24 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,/* Embedded bridge, macvlan, and any other device support */ if (ndm->ndm_flags &NTF_SELF ) { -if (dev->netdev_ops->ndo_fdb_del) - err = dev->netdev_ops->ndo_fdb_del (ndm, tb, dev, addr, - vid); -else - err =ndo_dflt_fdb_del (ndm, tb, dev, addr, vid); + ops = dev->netdev_ops; +if (!del_bulk) { +if (ops->ndo_fdb_del) + err = ops->ndo_fdb_del (ndm, tb, dev, addr, vid); +else + err =ndo_dflt_fdb_del (ndm, tb, dev, addr, vid); + }else { +/* in case err was cleared by NTF_MASTER call */ + err = -EOPNOTSUPP ; +if (ops->ndo_fdb_del_bulk) + err = ops->ndo_fdb_del_bulk (ndm, tb, dev, vid, + extack); + }if (!err) { -rtnl_fdb_notify (dev, addr, vid,RTM_DELNEIGH , - ndm->ndm_state); +if (!del_bulk) +rtnl_fdb_notify (dev, addr, vid,RTM_DELNEIGH , + ndm->ndm_state); ndm->ndm_flags &= ~NTF_SELF ; } }
@@ -5770,7 +5798,8 @@ void __init rtnetlink_init(void)rtnl_register (PF_UNSPEC ,RTM_DELLINKPROP , rtnl_dellinkprop,NULL ,0 );rtnl_register (PF_BRIDGE ,RTM_NEWNEIGH , rtnl_fdb_add,NULL ,0 ); -rtnl_register (PF_BRIDGE ,RTM_DELNEIGH , rtnl_fdb_del,NULL ,0 ); +rtnl_register (PF_BRIDGE ,RTM_DELNEIGH , rtnl_fdb_del,NULL , +RTNL_FLAG_BULK_DEL_SUPPORTED );rtnl_register (PF_BRIDGE ,RTM_GETNEIGH , rtnl_fdb_get, rtnl_fdb_dump,0 );rtnl_register (PF_BRIDGE ,RTM_GETLINK ,NULL , rtnl_bridge_getlink,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/123 rtnetlink: Allow deleting FDB entries in user namespace
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Wiesböck <[email protected]>
[ Upstream commit bf29555f5bdc017bac22ca66fcb6c9f46ec8788f ]
Creating FDB entries is possible from a non-initial user namespace when having CAP_NET_ADMIN, yet, when deleting FDB entries, processes receive an EPERM because the capability is always checked against the initial user namespace. This restricts the FDB management from unprivileged containers.
Drop the netlink_capable check in rtnl_fdb_del as it was originally dropped in c5c351088ae7 and reintroduced in 1690be63a27b without intention.
This patch was tested using a container on GyroidOS, where it was possible to delete FDB entries from an unprivileged user namespace and private network namespace.
--- net/core/rtnetlink.c | 3 --- 1 file changed, 3 deletions(-)
net/core/rtnetlink.c +0 -3
@@ -4192,9 +4192,6 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,int err;u16 vid; -if (!netlink_capable (skb,CAP_NET_ADMIN )) -return -EPERM ; -if (!del_bulk) { err =nlmsg_parse_deprecated (nlh,sizeof (*ndm), tb,NDA_MAX ,NULL , extack);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/123 net: enetc: correct the value of ENETC_RXB_TRUESIZE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit e59bc32df2e989f034623a580e30a2a72af33b3f ]
The ENETC RX ring uses the page halves flipping mechanism, each page is split into two halves for the RX ring to use. And ENETC_RXB_TRUESIZE is defined to 2048 to indicate the size of half a page. However, the page size is configurable, for ARM64 platform, PAGE_SIZE is default to 4K, but it could be configured to 16K or 64K.
When PAGE_SIZE is set to 16K or 64K, ENETC_RXB_TRUESIZE is not correct, and the RX ring will always use the first half of the page. This is not consistent with the description in the relevant kernel doc and commit messages.
This issue is invisible in most cases, but if users want to increase PAGE_SIZE to receive a Jumbo frame with a single buffer for some use cases, it will not work as expected, because the buffer size of each RX BD is fixed to 2048 bytes.
Based on the above two points, we expect to correct ENETC_RXB_TRUESIZE to (PAGE_SIZE >> 1), as described in the comment.
--- drivers/net/ethernet/freescale/enetc/enetc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/enetc/enetc.h +1 -1
@@ -37,7 +37,7 @@ struct enetc_tx_swbd { };#define ENETC_RX_MAXFRM_SIZE ENETC_MAC_MAXFRM_SIZE -#define ENETC_RXB_TRUESIZE 2048/* PAGE_SIZE >> 1 */ +#define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)#define ENETC_RXB_PAD NET_SKB_PAD/* add extra space if needed */ #define ENETC_RXB_DMA_SIZE \ (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/123 dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <[email protected]>
[ Upstream commit 902e81e679d86846a2404630d349709ad9372d0d ]
The blamed commit increased the needed headroom to account for alignment. This means that the size required to always align a Tx buffer was added inside the dpaa2_eth_needed_headroom() function. By doing that, a manual adjustment of the pointer passed to PTR_ALIGN() was no longer correct since the 'buffer_start' variable was already pointing to the start of the skb's memory.
The behavior of the dpaa2-eth driver without this patch was to drop frames on Tx even when the headroom was matching the 128 bytes necessary. Fix this by removing the manual adjust of 'buffer_start' from the PTR_MODE call.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +1 -2
@@ -1018,8 +1018,7 @@ static int dpaa2_eth_build_single_fd(struct dpaa2_eth_priv *priv,dma_addr_t addr; buffer_start = skb->data -dpaa2_eth_needed_headroom (skb); - aligned_start =PTR_ALIGN (buffer_start -DPAA2_ETH_TX_BUF_ALIGN , -DPAA2_ETH_TX_BUF_ALIGN ); + aligned_start =PTR_ALIGN (buffer_start,DPAA2_ETH_TX_BUF_ALIGN );if (aligned_start >= skb->head) buffer_start = aligned_start;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/123 arm64, mm: avoid always making PTE dirty in pte_mkwrite()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Ying <[email protected]>
[ Upstream commit 143937ca51cc6ae2fccc61a1cb916abb24cd34f5 ]
Current pte_mkwrite_novma() makes PTE dirty unconditionally. This may mark some pages that are never written dirty wrongly. For example, do_swap_page() may map the exclusive pages with writable and clean PTEs if the VMA is writable and the page fault is for read access. However, current pte_mkwrite_novma() implementation always dirties the PTE. This may cause unnecessary disk writing if the pages are never written before being reclaimed.
So, change pte_mkwrite_novma() to clear the PTE_RDONLY bit only if the PTE_DIRTY bit is set to make it possible to make the PTE writable and clean.
The current behavior was introduced in commit 73e86cb03cf2 ("arm64:
Move PTE_RDONLY bit handling out of set_pte_at()"). Before that, pte_mkwrite() only sets the PTE_WRITE bit, while set_pte_at() only clears the PTE_RDONLY bit if both the PTE_WRITE and the PTE_DIRTY bits are set.
To test the performance impact of the patch, on an arm64 server machine, run 16 redis-server processes on socket 1 and 16 memtier_benchmark processes on socket 0 with mostly get transactions (that is, redis-server will mostly read memory only). The memory footprint of redis-server is larger than the available memory, so swap out/in will be triggered. Test results show that the patch can avoid most swapping out because the pages are mostly clean. And the benchmark throughput improves ~23.9% in the test.
--- arch/arm64/include/asm/pgtable.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/pgtable.h +2 -1
@@ -175,7 +175,8 @@ static inline pmd_t set_pmd_bit(pmd_t pmd, pgprot_t prot)static inline pte_t pte_mkwrite (pte_t pte) { pte =set_pte_bit (pte,__pgprot (PTE_WRITE )); - pte =clear_pte_bit (pte,__pgprot (PTE_RDONLY )); +if (pte_sw_dirty (pte)) + pte =clear_pte_bit (pte,__pgprot (PTE_RDONLY ));return pte; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/123 sctp: avoid NULL dereference when chunk data buffer is missing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Simakov <[email protected]>
[ Upstream commit 441f0647f7673e0e64d4910ef61a5fb8f16bfb82 ]
chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only.
chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition.
--- net/sctp/inqueue.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/sctp/inqueue.c +7 -6
@@ -163,13 +163,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) chunk->head_skb = chunk->skb;/* skbs with "cover letter" */ -if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) +if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) { +if (WARN_ON (!skb_shinfo (chunk->skb)->frag_list)) { +__SCTP_INC_STATS (dev_net (chunk->skb->dev), +SCTP_MIB_IN_PKT_DISCARDS ); +sctp_chunk_free (chunk); + goto next_chunk; + } chunk->skb =skb_shinfo (chunk->skb)->frag_list; - -if (WARN_ON (!chunk->skb)) { -__SCTP_INC_STATS (dev_net (chunk->skb->dev),SCTP_MIB_IN_PKT_DISCARDS ); -sctp_chunk_free (chunk); - goto next_chunk; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/123 net: bonding: fix possible peer notify event loss or dup issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tonghao Zhang <[email protected]>
commit 10843e1492e474c02b91314963161731fa92af91 upstream.
If the send_peer_notif counter and the peer event notify are not synchronized. It may cause problems such as the loss or dup of peer notify event.
Before this patch:
- If should_notify_peers is true and the lock for send_peer_notif-- fails, peer event may be sent again in next mii_monitor loop, because should_notify_peers is still true.
- If should_notify_peers is true and the lock for send_peer_notif-- succeeded, but the lock for peer event fails, the peer event will be lost.
This patch locks the RTNL for send_peer_notif, events, and commit simultaneously.
--- drivers/net/bonding/bond_main.c | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-)
drivers/net/bonding/bond_main.c +18 -22
@@ -2734,7 +2734,7 @@ static void bond_mii_monitor(struct work { struct bonding *bond = container_of(work, struct bonding, mii_work.work); -bool should_notify_peers = false; +bool should_notify_peers;bool commit;unsigned long delay;struct slave *slave;
@@ -2746,30 +2746,33 @@ static void bond_mii_monitor(struct work goto re_arm;rcu_read_lock (); + should_notify_peers =bond_should_notify_peers (bond); commit = !!bond_miimon_inspect (bond); -if (bond->send_peer_notif) { -rcu_read_unlock (); -if (rtnl_trylock ()) { - bond->send_peer_notif--; -rtnl_unlock (); - } - }else { -rcu_read_unlock (); - } -if (commit) { +rcu_read_unlock (); + +if (commit || bond->send_peer_notif) {/* Race avoidance with bond_close cancel of workqueue */ if (!rtnl_trylock ()) { delay =1 ; - should_notify_peers = false; goto re_arm; } -bond_for_each_slave (bond, slave, iter) { -bond_commit_link_state (slave,BOND_SLAVE_NOTIFY_LATER ); +if (commit) { +bond_for_each_slave (bond, slave, iter) { +bond_commit_link_state (slave, +BOND_SLAVE_NOTIFY_LATER ); + } +bond_miimon_commit (bond); + } + +if (bond->send_peer_notif) { + bond->send_peer_notif--; +if (should_notify_peers) +call_netdevice_notifiers (NETDEV_NOTIFY_PEERS , + bond->dev); } -bond_miimon_commit (bond);rtnl_unlock ();/* might sleep, hold no other locks */ }
@@ -2777,13 +2780,6 @@ static void bond_mii_monitor(struct work re_arm:if (bond->params.miimon)queue_delayed_work (bond->wq, &bond->mii_work, delay); - -if (should_notify_peers) { -if (!rtnl_trylock ()) -return ; -call_netdevice_notifiers (NETDEV_NOTIFY_PEERS , bond->dev); -rtnl_unlock (); - } } static int bond_upper_dev_walk(struct net_device *upper,
Greg Kroah-Hartman
maintainerPATCH 64/123 Revert "cpuidle: menu: Avoid discarding useful information"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 10fad4012234a7dea621ae17c0c9486824f645a0 upstream.
It is reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") led to a performance regression on Intel Jasper Lake systems because it reduced the time spent by CPUs in idle state C7 which is correlated to the maximum frequency the CPUs can get to because of an average running power limit [1].
Before that commit, get_typical_interval() would have returned UINT_MAX whenever it had been unable to make a high-confidence prediction which had led to selecting the deepest available idle state too often and both power and performance had been inadequate as a result of that on some systems. However, this had not been a problem on systems with relatively aggressive average running power limits, like the Jasper Lake systems in question, because on those systems it was compensated by the ability to run CPUs faster.
It was addressed by causing get_typical_interval() to return a number based on the recent idle duration information available to it even if it could not make a high-confidence prediction, but that clearly did not take the possible correlation between idle power and available CPU capacity into account.
For this reason, revert most of the changes made by commit 85975daeaa4d, except for one cosmetic cleanup, and add a comment explaining the rationale for returning UINT_MAX from get_typical_interval() when it is unable to make a high-confidence prediction.
--- drivers/cpuidle/governors/menu.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
drivers/cpuidle/governors/menu.c +9 -12
@@ -256,20 +256,17 @@ again:* * This can deal with workloads that have long pauses interspersed * with sporadic activity with a bunch of short pauses. +* +* However, if the number of remaining samples is too small to exclude +* any more outliers, allow the deepest available idle state to be +* selected because there are systems where the time spent by CPUs in +* deep idle states is correlated to the maximum frequency the CPUs +* can get to. On those systems, shallow idle states should be avoided +* unless there is a clear indication that the given CPU is most likley +* going to be woken up shortly. */ -if (divisor *4 <=INTERVALS *3 ) { -/* -* If there are sufficiently many data points still under -* consideration after the outliers have been eliminated, -* returning without a prediction would be a mistake because it -* is likely that the next interval will not exceed the current -* maximum, so return the latter in that case. -*/ -if (divisor >=INTERVALS /2 ) -return max; - +if (divisor *4 <=INTERVALS *3 )return UINT_MAX ; - } thresh = max -1 ; goto again;
Greg Kroah-Hartman
maintainerPATCH 65/123 MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit bf5570590a981d0659d0808d2d4bcda21b27a2a5 upstream.
MIPS Malta platform code registers the PCI southbridge legacy port I/O PS/2 keyboard range as a standard resource marked as busy. It prevents the i8042 driver from registering as it fails to claim the resource in a call to i8042_platform_init(). Consequently PS/2 keyboard and mouse devices cannot be used with this platform.
Fix the issue by removing the busy marker from the standard reservation, making the driver register successfully:
serio: i8042 KBD port at 0x60,0x64 irq 1
serio: i8042 AUX port at 0x60,0x64 irq 12
and the resource show up as expected among the legacy devices:
00000000-00ffffff : MSC PCI I/O
00000000-0000001f : dma1
00000020-00000021 : pic1
00000040-0000005f : timer
00000060-0000006f : keyboard
00000060-0000006f : i8042
00000070-00000077 : rtc0
00000080-0000008f : dma page reg
000000a0-000000a1 : pic2
000000c0-000000df : dma2
[...]If the i8042 driver has not been configured, then the standard resource will remain there preventing any conflicting dynamic assignment of this PCI port I/O address range.
--- arch/mips/mti-malta/malta-setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/mti-malta/malta-setup.c +1 -1
@@ -47,7 +47,7 @@ static struct resource standard_io_resou .name = "keyboard", .start = 0x60, .end = 0x6f, - .flags =IORESOURCE_IO |IORESOURCE_BUSY + .flags =IORESOURCE_IO }, { .name = "dma page reg",
Greg Kroah-Hartman
maintainerPATCH 66/123 ocfs2: clear extent cache after moving/defragmenting extents
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 78a63493f8e352296dbc7cb7b3f4973105e8679e upstream.
The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().
The problem occurs when:
1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
2. ioctl(FITRIM) triggers ocfs2_move_extents()
3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
5. The extent map cache is not invalidated after the move
6. Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers
Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.
--- fs/ocfs2/move_extents.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ocfs2/move_extents.c +5 -0
@@ -868,6 +868,11 @@ static int __ocfs2_move_extents_range(stmlog_errno (ret); goto out; } +/* +* Invalidate extent cache after moving/defragging to prevent +* stale cached data with outdated extent flags. +*/ +ocfs2_extent_map_trunc (inode, cpos); context->clusters_moved += alloc_size; next:
Greg Kroah-Hartman
maintainerPATCH 67/123 vsock: fix lock inversion in vsock_assign_transport()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
commit f7c877e7535260cc7a21484c994e8ce7e8cb6780 upstream.
Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.
The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created.
Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().
--- net/vmw_vsock/af_vsock.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-)
net/vmw_vsock/af_vsock.c +19 -19
@@ -480,12 +480,26 @@ int vsock_assign_transport(struct vsock_ goto err; } -if (vsk->transport) { -if (vsk->transport == new_transport) { - ret =0 ; - goto err; - } +if (vsk->transport && vsk->transport == new_transport) { + ret =0 ; + goto err; + } + +/* We increase the module refcnt to prevent the transport unloading +* while there are open sockets assigned to it. +*/ +if (!new_transport || !try_module_get (new_transport->module)) { + ret = -ENODEV ; + goto err; + } + +/* It's safe to release the mutex after a successful try_module_get(). +* Whichever transport `new_transport` points at, it won't go away until +* the last module_put() below or in vsock_deassign_transport(). +*/ +mutex_unlock (&vsock_register_mutex); +if (vsk->transport) {/* transport->release() must be called with sock lock acquired. * This path can only be taken during vsock_connect(), where we * have already held the sock lock. In the other cases, this
@@ -505,20 +519,6 @@ int vsock_assign_transport(struct vsock_ vsk->peer_shutdown =0 ; } -/* We increase the module refcnt to prevent the transport unloading -* while there are open sockets assigned to it. -*/ -if (!new_transport || !try_module_get (new_transport->module)) { - ret = -ENODEV ; - goto err; - } - -/* It's safe to release the mutex after a successful try_module_get(). -* Whichever transport `new_transport` points at, it won't go away until -* the last module_put() below or in vsock_deassign_transport(). -*/ -mutex_unlock (&vsock_register_mutex); -if (sk->sk_type ==SOCK_SEQPACKET ) {if (!new_transport->seqpacket_allow || !new_transport->seqpacket_allow (remote_cid)) {
Greg Kroah-Hartman
maintainerPATCH 68/123 net: usb: rtl8150: Fix frame padding
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <[email protected]>
commit 75cea9860aa6b2350d90a8d78fed114d27c7eca2 upstream.
TX frames aren't padded and unknown memory is sent into the ether.
Theoretically, it isn't even guaranteed that the extra memory exists and can be sent out, which could cause further problems. In practice, I found that plenty of tailroom exists in the skb itself (in my test with ping at least) and skb_padto() easily succeeds, so use it here.
In the event of -ENOMEM drop the frame like other drivers do.
The use of one more padding byte instead of a USB zero-length packet is retained to avoid regression. I have a dodgy Etron xHCI controller which doesn't seem to support sending ZLPs at all.
--- drivers/net/usb/rtl8150.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/usb/rtl8150.c +9 -2
@@ -685,9 +685,16 @@ static netdev_tx_t rtl8150_start_xmit(strtl8150_t *dev =netdev_priv (netdev);int count, res; +/* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */ + count =max (skb->len,ETH_ZLEN ); +if (count %64 ==0 ) + count++; +if (skb_padto (skb, count)) { + netdev->stats.tx_dropped++; +return NETDEV_TX_OK ; + } +netif_stop_queue (netdev); - count = (skb->len <60 ) ?60 : skb->len; - count = (count &0x3f ) ? count : count +1 ; dev->tx_skb = skb;usb_fill_bulk_urb (dev->tx_urb, dev->udev,usb_sndbulkpipe (dev->udev,2 ), skb->data, count, write_bulk_callback, dev);
Greg Kroah-Hartman
maintainerPATCH 69/123 net: ravb: Ensure memory write completes before ringing TX doorbell
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
commit 706136c5723626fcde8dd8f598a4dcd251e24927 upstream.
Add a final dma_wmb() barrier before triggering the transmit request (TCCR_TSRQ) to ensure all descriptor and buffer writes are visible to the DMA engine.
According to the hardware manual, a read-back operation is required before writing to the doorbell register to guarantee completion of previous writes. Instead of performing a dummy read, a dma_wmb() is used to both enforce the same ordering semantics on the CPU side and also to ensure completion of writes.
--- drivers/net/ethernet/renesas/ravb_main.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/renesas/ravb_main.c +8 -0
@@ -1672,6 +1672,14 @@ static netdev_tx_t ravb_start_xmit(struc }else { desc->die_dt =DT_FSINGLE ; } + +/* Before ringing the doorbell we need to make sure that the latest +* writes have been committed to memory, otherwise it could delay +* things until the doorbell is rang again. +* This is in replacement of the read operation mentioned in the HW +* manuals. +*/ +dma_wmb ();ravb_modify (ndev,TCCR ,TCCR_TSRQ0 << q,TCCR_TSRQ0 << q); priv->cur_tx[q] += num_tx_desc;
Greg Kroah-Hartman
maintainerPATCH 70/123 riscv: Use of_get_cpu_hwid()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit bd2259ee458e299ec14061da7faddcfb0d54d154 ]
Replace open coded parsing of CPU nodes' 'reg' property with of_get_cpu_hwid().
Stable-dep-of: d2721bb165b3 ("RISC-V: Don't print details of CPUs disabled in DT")
--- arch/riscv/kernel/cpu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/riscv/kernel/cpu.c +2 -1
@@ -22,7 +22,8 @@ int riscv_of_processor_hartid(struct device_node *node)return -ENODEV ; } -if (of_property_read_u32 (node,"reg" , &hart)) { + hart =of_get_cpu_hwid (node,0 ); +if (hart == ~0U ) {pr_warn ("Found CPU without hart ID\n" );return -ENODEV ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/123 RISC-V: Correctly print supported extensions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tsukasa OI <[email protected]>
[ Upstream commit 58004f266918912771ee71f46bfb92bf64ab9108 ]
This commit replaces BITS_PER_LONG with number of alphabet letters.
Current ISA pretty-printing code expects extension 'a' (bit 0) through 'z' (bit 25). Although bit 26 and higher is not currently used (thus never cause an issue in practice), it will be an annoying problem if we start to use those in the future.
This commit disables printing high bits for now.
Stable-dep-of: d2721bb165b3 ("RISC-V: Don't print details of CPUs disabled in DT")
--- arch/riscv/kernel/cpufeature.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/riscv/kernel/cpufeature.c +5 -3
@@ -13,6 +13,8 @@#include <asm/smp.h> #include <asm/switch_to.h> +#define NUM_ALPHA_EXTS ('z' - 'a' + 1) +unsigned long elf_hwcap__read_mostly ;/* Host ISA bitmap */
@@ -63,7 +65,7 @@ void __init riscv_fill_hwcap(void) {struct device_node *node;const char *isa; -char print_str[BITS_PER_LONG +1 ]; +char print_str[NUM_ALPHA_EXTS +1 ];size_t i, j, isa_len;static unsigned long isa2hwcap[256 ] = {0 };
@@ -133,13 +135,13 @@ void __init riscv_fill_hwcap(void) }memset (print_str,0 ,sizeof (print_str)); -for (i =0 , j =0 ; i <BITS_PER_LONG ; i++) +for (i =0 , j =0 ; i <NUM_ALPHA_EXTS ; i++)if (riscv_isa[0 ] &BIT_MASK (i)) print_str[j++] = (char )('a' + i);pr_info ("riscv: ISA extensions %s\n" , print_str);memset (print_str,0 ,sizeof (print_str)); -for (i =0 , j =0 ; i <BITS_PER_LONG ; i++) +for (i =0 , j =0 ; i <NUM_ALPHA_EXTS ; i++)if (elf_hwcap &BIT_MASK (i)) print_str[j++] = (char )('a' + i);pr_info ("riscv: ELF capabilities %s\n" , print_str);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/123 RISC-V: Minimal parser for "riscv, isa" strings
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tsukasa OI <[email protected]>
[ Upstream commit 2a31c54be097c74344b4fab20ea6104012d2cb8b ]
Current hart ISA ("riscv,isa") parser don't correctly parse:
1. Multi-letter extensions
2. Version numbers
All ISA extensions ratified recently has multi-letter extensions (except 'H'). The current "riscv,isa" parser that is easily confused by multi-letter extensions and "p" in version numbers can be a huge problem for adding new extensions through the device tree.
Leaving it would create incompatible hacks and would make "riscv,isa" value unreliable.
This commit implements minimal parser for "riscv,isa" strings. With this, we can safely ignore multi-letter extensions and version numbers.
Stable-dep-of: d2721bb165b3 ("RISC-V: Don't print details of CPUs disabled in DT")
--- arch/riscv/kernel/cpufeature.c | 72 ++++++++++++++++++++++++++++------ 1 file changed, 61 insertions(+), 11 deletions(-)
arch/riscv/kernel/cpufeature.c +61 -11
@@ -7,6 +7,7 @@*/ #include <linux/bitmap.h> +#include <linux/ctype.h> #include <linux/of.h> #include <asm/processor.h> #include <asm/hwcap.h>
@@ -66,7 +67,7 @@ void __init riscv_fill_hwcap(void)struct device_node *node;const char *isa;char print_str[NUM_ALPHA_EXTS +1 ]; -size_t i, j, isa_len; +int i, j;static unsigned long isa2hwcap[256 ] = {0 }; isa2hwcap['i' ] = isa2hwcap['I' ] =COMPAT_HWCAP_ISA_I ;
@@ -92,23 +93,72 @@ void __init riscv_fill_hwcap(void)continue ; } - i =0 ; - isa_len =strlen (isa);#if IS_ENABLED (CONFIG_32BIT )if (!strncmp (isa,"rv32" ,4 )) - i +=4 ; + isa +=4 ;#elif IS_ENABLED (CONFIG_64BIT )if (!strncmp (isa,"rv64" ,4 )) - i +=4 ; + isa +=4 ;#endif -for (; i < isa_len; ++i) { - this_hwcap |= isa2hwcap[(unsigned char )(isa[i])]; +for (; *isa; ++isa) { +const char *ext = isa++; +const char *ext_end = isa; +bool ext_long = false, ext_err = false; + +switch (*ext) { +case 's' : +/** +* Workaround for invalid single-letter 's' & 'u'(QEMU). +* No need to set the bit in riscv_isa as 's' & 'u' are +* not valid ISA extensions. It works until multi-letter +* extension starting with "Su" appears. +*/ +if (ext[-1 ] !='_' && ext[1 ] =='u' ) { + ++isa; + ext_err = true; +break ; + } + fallthrough; +case 'x' : +case 'z' : + ext_long = true; +/* Multi-letter extension must be delimited */ +for (; *isa && *isa !='_' ; ++isa) +if (!islower (*isa) && !isdigit (*isa)) + ext_err = true; +break ; +default : +if (unlikely (!islower (*ext))) { + ext_err = true; +break ; + } +/* Find next extension */ +if (!isdigit (*isa)) +break ; +/* Skip the minor version */ +while (isdigit (*++isa)) + ; +if (*isa !='p' ) +break ; +if (!isdigit (*++isa)) { + --isa; +break ; + } +/* Skip the major version */ +while (isdigit (*++isa)) + ; +break ; + } +if (*isa !='_' ) + --isa;/* -* TODO: X, Y and Z extension parsing for Host ISA -* bitmap will be added in-future. +* TODO: Full version-aware handling including +* multi-letter extensions will be added in-future. */ -if ('a' <= isa[i] && isa[i] <'x' ) - this_isa |= (1UL << (isa[i] -'a' )); +if (ext_err || ext_long) +continue ; + this_hwcap |= isa2hwcap[(unsigned char )(*ext)]; + this_isa |= (1UL << (*ext -'a' )); }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/123 riscv: cpu: Add 64bit hartid support on RV64
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunil V L <[email protected]>
[ Upstream commit ad635e723e17379b192a5ba9c182e3eedfc24d16 ]
The hartid can be a 64bit value on RV64 platforms.
Add support for 64bit hartid in riscv_of_processor_hartid() and update its callers.
Stable-dep-of: d2721bb165b3 ("RISC-V: Don't print details of CPUs disabled in DT")
--- arch/riscv/include/asm/processor.h | 4 ++-- arch/riscv/kernel/cpu.c | 26 +++++++++++++++----------- arch/riscv/kernel/cpufeature.c | 6 ++++-- arch/riscv/kernel/smpboot.c | 9 +++++---- drivers/clocksource/timer-riscv.c | 15 ++++++++------- drivers/irqchip/irq-riscv-intc.c | 7 ++++--- drivers/irqchip/irq-sifive-plic.c | 7 ++++--- 7 files changed, 42 insertions(+), 32 deletions(-)
arch/riscv/include/asm/processor.h +2 -2
@@ -75,8 +75,8 @@ static inline void wait_for_interrupt(void) }struct device_node ; -int riscv_of_processor_hartid (struct device_node *node); -int riscv_of_parent_hartid (struct device_node *node); +int riscv_of_processor_hartid (struct device_node *node,unsigned long *hartid); +int riscv_of_parent_hartid (struct device_node *node,unsigned long *hartid);extern void riscv_fill_hwcap (void );extern int arch_dup_task_struct (struct task_struct *dst,struct task_struct *src);
arch/riscv/kernel/cpu.c +15 -11
@@ -12,37 +12,36 @@* Returns the hart ID of the given device tree node, or -ENODEV if the node * isn't an enabled and valid RISC-V hart node. */ -int riscv_of_processor_hartid (struct device_node *node) +int riscv_of_processor_hartid (struct device_node *node,unsigned long *hart) {const char *isa; -u32 hart;if (!of_device_is_compatible (node,"riscv" )) {pr_warn ("Found incompatible CPU\n" );return -ENODEV ; } - hart =of_get_cpu_hwid (node,0 ); -if (hart == ~0U ) { + *hart = (unsigned long )of_get_cpu_hwid (node,0 ); +if (*hart == ~0UL ) {pr_warn ("Found CPU without hart ID\n" );return -ENODEV ; }if (!of_device_is_available (node)) { -pr_info ("CPU with hartid=%d is not available\n" , hart); +pr_info ("CPU with hartid=%lu is not available\n" , *hart);return -ENODEV ; }if (of_property_read_string (node,"riscv,isa" , &isa)) { -pr_warn ("CPU with hartid=%d has no \"riscv,isa\" property\n" , hart); +pr_warn ("CPU with hartid=%lu has no \"riscv,isa\" property\n" , *hart);return -ENODEV ; }if (isa[0 ] !='r' || isa[1 ] !='v' ) { -pr_warn ("CPU with hartid=%d has an invalid ISA of \"%s\"\n" , hart, isa); +pr_warn ("CPU with hartid=%lu has an invalid ISA of \"%s\"\n" , *hart, isa);return -ENODEV ; } -return hart; +return 0 ; }/*
@@ -51,11 +50,16 @@ int riscv_of_processor_hartid(struct device_node *node)* To achieve this, we walk up the DT tree until we find an active * RISC-V core (HART) node and extract the cpuid from it. */ -int riscv_of_parent_hartid (struct device_node *node) +int riscv_of_parent_hartid (struct device_node *node,unsigned long *hartid) { +int rc; +for (; node; node = node->parent) { -if (of_device_is_compatible (node,"riscv" )) -return riscv_of_processor_hartid (node); +if (of_device_is_compatible (node,"riscv" )) { + rc =riscv_of_processor_hartid (node, hartid); +if (!rc) +return 0 ; + } }return -1 ;
arch/riscv/kernel/cpufeature.c +4 -2
@@ -67,8 +67,9 @@ void __init riscv_fill_hwcap(void)struct device_node *node;const char *isa;char print_str[NUM_ALPHA_EXTS +1 ]; -int i, j; +int i, j, rc;static unsigned long isa2hwcap[256 ] = {0 }; +unsigned long hartid; isa2hwcap['i' ] = isa2hwcap['I' ] =COMPAT_HWCAP_ISA_I ; isa2hwcap['m' ] = isa2hwcap['M' ] =COMPAT_HWCAP_ISA_M ;
@@ -85,7 +86,8 @@ void __init riscv_fill_hwcap(void)unsigned long this_hwcap =0 ;unsigned long this_isa =0 ; -if (riscv_of_processor_hartid (node) <0 ) + rc =riscv_of_processor_hartid (node, &hartid); +if (rc <0 )continue ;if (of_property_read_string (node,"riscv,isa" , &isa)) {
arch/riscv/kernel/smpboot.c +5 -4
@@ -77,15 +77,16 @@ void __init smp_prepare_cpus(unsigned int max_cpus)void __init setup_smp (void ) {struct device_node *dn; -int hart; +unsigned long hart;bool found_boot_cpu = false;int cpuid =1 ; +int rc;cpu_set_ops (0 );for_each_of_cpu_node (dn) { - hart =riscv_of_processor_hartid (dn); -if (hart <0 ) + rc =riscv_of_processor_hartid (dn, &hart); +if (rc <0 )continue ;if (hart ==cpuid_to_hartid_map (0 )) {
@@ -95,7 +96,7 @@ void __init setup_smp(void)continue ; }if (cpuid >=NR_CPUS ) { -pr_warn ("Invalid cpuid [%d] for hartid [%d]\n" , +pr_warn ("Invalid cpuid [%d] for hartid [%lu]\n" , cpuid, hart);break ; }
drivers/clocksource/timer-riscv.c +8 -7
@@ -92,20 +92,21 @@ static irqreturn_t riscv_timer_interrupt(int irq, void *dev_id)static int __init riscv_timer_init_dt (struct device_node *n) { -int cpuid, hartid, error; +int cpuid, error; +unsigned long hartid;struct device_node *child;struct irq_domain *domain; - hartid =riscv_of_processor_hartid (n); -if (hartid <0 ) { -pr_warn ("Not valid hartid for node [%pOF] error = [%d]\n" , + error =riscv_of_processor_hartid (n, &hartid); +if (error <0 ) { +pr_warn ("Not valid hartid for node [%pOF] error = [%lu]\n" , n, hartid); -return hartid; +return error; } cpuid =riscv_hartid_to_cpuid (hartid);if (cpuid <0 ) { -pr_warn ("Invalid cpuid for hartid [%d]\n" , hartid); +pr_warn ("Invalid cpuid for hartid [%lu]\n" , hartid);return cpuid; }
@@ -131,7 +132,7 @@ static int __init riscv_timer_init_dt(struct device_node *n)return -ENODEV ; } -pr_info ("%s: Registering clocksource cpuid [%d] hartid [%d]\n" , +pr_info ("%s: Registering clocksource cpuid [%d] hartid [%lu]\n" , __func__, cpuid, hartid); error =clocksource_register_hz (&riscv_clocksource, riscv_timebase);if (error) {
drivers/irqchip/irq-riscv-intc.c +4 -3
@@ -95,10 +95,11 @@ static const struct irq_domain_ops riscv_intc_domain_ops = {static int __init riscv_intc_init (struct device_node *node,struct device_node *parent) { -int rc, hartid; +int rc; +unsigned long hartid; - hartid =riscv_of_parent_hartid (node); -if (hartid <0 ) { + rc =riscv_of_parent_hartid (node, &hartid); +if (rc <0 ) {pr_warn ("unable to find hart id for %pOF\n" , node);return 0 ; }
drivers/irqchip/irq-sifive-plic.c +4 -3
@@ -313,7 +313,8 @@ static int __init plic_init(struct device_node *node,for (i =0 ; i < nr_contexts; i++) {struct of_phandle_args parent;irq_hw_number_t hwirq; -int cpu, hartid; +int cpu; +unsigned long hartid;if (of_irq_parse_one (node, i, &parent)) {pr_err ("failed to parse parent for context %d.\n" , i);
@@ -327,8 +328,8 @@ static int __init plic_init(struct device_node *node,if (parent.args[0 ] !=RV_IRQ_EXT )continue ; - hartid =riscv_of_parent_hartid (parent.np); -if (hartid <0 ) { + error =riscv_of_parent_hartid (parent.np, &hartid); +if (error <0 ) {pr_warn ("failed to parse hart ID for context %d.\n" , i);continue ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/123 RISC-V: Dont print details of CPUs disabled in DT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
[ Upstream commit d2721bb165b3ee00dd23525885381af07fec852a ]
Early boot stages may disable CPU DT nodes for unavailable CPUs based on SKU, pinstraps, eFuse, etc. Currently, the riscv_early_of_processor_hartid() prints details of a CPU if it is disabled in DT which has no value and gives a false impression to the users that there some issue with the CPU.
--- arch/riscv/kernel/cpu.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/riscv/kernel/cpu.c +1 -3
@@ -27,10 +27,8 @@ int riscv_of_processor_hartid(struct device_node *node, unsigned long *hart)return -ENODEV ; } -if (!of_device_is_available (node)) { -pr_info ("CPU with hartid=%lu is not available\n" , *hart); +if (!of_device_is_available (node))return -ENODEV ; - }if (of_property_read_string (node,"riscv,isa" , &isa)) {pr_warn ("CPU with hartid=%lu has no \"riscv,isa\" property\n" , *hart);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/123 USB: serial: option: add UNISOC UIS7720
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Renjun Wang <[email protected]>
commit 71c07570b918f000de5d0f7f1bf17a2887e303b5 upstream.
Add support for UNISOC (Spreadtrum) UIS7720 (A7720) module.
T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1782 ProdID=4064 Rev=04.04 S: Manufacturer=Unisoc-phone S: Product=Unisoc-phone S: SerialNumber=0123456789ABCDEF C: #Ifs= 9 Cfg#= 1 Atr=c0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0&1: RNDIS, 2: LOG, 3: DIAG, 4&5: AT Ports, 6&7: AT2 Ports, 8: ADB
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -617,6 +617,7 @@ static void option_instat_callback(struc#define UNISOC_VENDOR_ID 0x1782/* TOZED LT70-C based on UNISOC SL8563 uses UNISOC's vendor ID */ #define TOZED_PRODUCT_LT70C 0x4055 +#define UNISOC_PRODUCT_UIS7720 0x4064/* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ #define LUAT_PRODUCT_AIR720U 0x4e00
@@ -2466,6 +2467,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, UNISOC_PRODUCT_UIS7720, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ .driver_info = NCTRL(1) },
Greg Kroah-Hartman
maintainerPATCH 76/123 USB: serial: option: add Quectel RG255C
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reinhard Speyerer <[email protected]>
commit 89205c60c0fc96b73567a2e9fe27ee3f59d01193 upstream.
Add support for Quectel RG255C devices to complement commit 5c964c8a97c1 ("net: usb: qmi_wwan: add Quectel RG255C").
The composition is DM / NMEA / AT / QMI.
T: Bus=01 Lev=02 Prnt=99 Port=01 Cnt=02 Dev#=110 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0316 Rev= 5.15 S: Manufacturer=Quectel S: Product=RG255C-GL S: SerialNumber=xxxxxxxx C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -273,6 +273,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM05CN 0x0312#define QUECTEL_PRODUCT_EM05G_GR 0x0313#define QUECTEL_PRODUCT_EM05G_RS 0x0314 +#define QUECTEL_PRODUCT_RG255C 0x0316#define QUECTEL_PRODUCT_EM12 0x0512#define QUECTEL_PRODUCT_RM500Q 0x0800#define QUECTEL_PRODUCT_RM520N 0x0801
@@ -1271,6 +1272,9 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x40) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
Greg Kroah-Hartman
maintainerPATCH 77/123 USB: serial: option: add Telit FN920C04 ECM compositions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: LI Qingwu <[email protected]>
commit 622865c73ae30f254abdf182f4b66cccbe3e0f10 upstream.
Add support for the Telit Cinterion FN920C04 module when operating in ECM (Ethernet Control Model) mode. The following USB product IDs are used by the module when AT#USBCFG is set to 3 or 7.
0x10A3: ECM + tty (NMEA) + tty (DUN) [+ tty (DIAG)]
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a3 Rev= 5.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=76e7cb38 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10A8: ECM + tty (DUN) + tty (AUX) [+ tty (DIAG)]
T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a8 Rev= 5.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=76e7cb38 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Adding these IDs allows the option driver to automatically create the corresponding /dev/ttyUSB* ports under ECM mode.
Tested with FN920C04 under ECM configuration (USBCFG=3 and 7).
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -1403,10 +1403,14 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */
Greg Kroah-Hartman
maintainerPATCH 78/123 usb/core/quirks: Add Huawei ME906S to wakeup quirk
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Guttzeit <[email protected]>
commit dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab upstream.
The list of Huawei LTE modules needing the quirk fixing spurious wakeups was missing the IDs of the Huawei ME906S module, therefore suspend did not work.
--- drivers/usb/core/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/core/quirks.c +2 -0
@@ -461,6 +461,8 @@ static const struct usb_device_id usb_qu/* Huawei 4G LTE module */ { USB_DEVICE(0x12d1, 0x15bb), .driver_info = USB_QUIRK_DISCONNECT_SUSPEND }, + { USB_DEVICE(0x12d1, 0x15c1), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, { USB_DEVICE(0x12d1, 0x15c3), .driver_info = USB_QUIRK_DISCONNECT_SUSPEND },
Greg Kroah-Hartman
maintainerPATCH 79/123 usb: raw-gadget: do not limit transfer length
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream.
Drop the check on the maximum transfer length in Raw Gadget for both control and non-control transfers.
Limiting the transfer length causes a problem with emulating USB devices whose full configuration descriptor exceeds PAGE_SIZE in length.
Overall, there does not appear to be any reason to enforce any kind of transfer length limit on the Raw Gadget side for either control or non-control transfers, so let's just drop the related check.
--- drivers/usb/gadget/legacy/raw_gadget.c | 2 -- 1 file changed, 2 deletions(-)
drivers/usb/gadget/legacy/raw_gadget.c +0 -2
@@ -620,8 +620,6 @@ static void *raw_alloc_io_data(struct usreturn ERR_PTR (-EINVAL );if (!usb_raw_io_flags_valid (io->flags))return ERR_PTR (-EINVAL ); -if (io->length >PAGE_SIZE ) -return ERR_PTR (-EINVAL );if (get_from_user) data =memdup_user (ptr +sizeof (*io), io->length);else {
Greg Kroah-Hartman
maintainerPATCH 80/123 xhci: dbc: enable back DbC in resume if it was enabled before suspend
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a upstream.
DbC is currently only enabled back if it's in configured state during suspend.
If system is suspended after DbC is enabled, but before the device is properly enumerated by the host, then DbC would not be enabled back in resume.
Always enable DbC back in resume if it's suspended in enabled, connected, or configured state
--- drivers/usb/host/xhci-dbgcap.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-dbgcap.c +8 -1
@@ -1136,8 +1136,15 @@ int xhci_dbc_suspend(struct xhci_hcd *xhif (!dbc)return 0 ; -if (dbc->state ==DS_CONFIGURED ) +switch (dbc->state) { +case DS_ENABLED : +case DS_CONNECTED : +case DS_CONFIGURED : dbc->resume_required =1 ; +break ; +default : +break ; + }xhci_dbc_stop (dbc);
Greg Kroah-Hartman
maintainerPATCH 81/123 binder: remove "invalid inc weak" check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 upstream.
There are no scenarios where a weak increment is invalid on binder_node. The only possible case where it could be invalid is if the kernel delivers BR_DECREFS to the process that owns the node, and then increments the weak refcount again, effectively "reviving" a dead node.
However, that is not possible: when the BR_DECREFS command is delivered, the kernel removes and frees the binder_node. The fact that you were able to call binder_inc_node_nilocked() implies that the node is not yet destroyed, which implies that BR_DECREFS has not been delivered to userspace, so incrementing the weak refcount is valid.
Note that it's currently possible to trigger this condition if the owner calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes BC_INCREFS on binder_ref instances to fail when they should not.
--- drivers/android/binder.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/android/binder.c +1 -10
@@ -818,17 +818,8 @@ static int binder_inc_node_nilocked(stru }else {if (!internal) node->local_weak_refs++; -if (!node->has_weak_ref &&list_empty (&node->work.entry)) { -if (target_list ==NULL ) { -pr_err ("invalid inc weak node for %d\n" , - node->debug_id); -return -EINVAL ; - } -/* -* See comment above -*/ +if (!node->has_weak_ref && target_list &&list_empty (&node->work.entry))binder_enqueue_work_ilocked (&node->work, target_list); - } }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 82/123 comedi: fix divide-by-zero in comedi_buf_munge()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 upstream.
The comedi_buf_munge() function performs a modulo operation async->munge_chan %= async->cmd.chanlist_len without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path.
Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging.
This prevents potential kernel panics from malformed user commands.
--- drivers/comedi/comedi_buf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/comedi/comedi_buf.c +1 -1
@@ -369,7 +369,7 @@ static unsigned int comedi_buf_munge(strunsigned int count =0 ;const unsigned int num_sample_bytes =comedi_bytes_per_sample (s); -if (!s->munge || (async->cmd.flags &CMDF_RAWDATA )) { +if (!s->munge || (async->cmd.flags &CMDF_RAWDATA ) || async->cmd.chanlist_len ==0 ) { async->munge_count += num_bytes;return num_bytes; }
Greg Kroah-Hartman
maintainerPATCH 83/123 mei: me: add wildcat lake P DID
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 410d6c2ad4d1a88efa0acbb9966693725b564933 upstream.
Add Wildcat Lake P device id.
--- drivers/misc/mei/hw-me-regs.h | 2 ++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/misc/mei/hw-me-regs.h +2 -0
@@ -120,6 +120,8 @@#define MEI_DEV_ID_PTL_H 0xE370/* Panther Lake H */ #define MEI_DEV_ID_PTL_P 0xE470/* Panther Lake P */ +#define MEI_DEV_ID_WCL_P 0x4D70/* Wildcat Lake P */ +/* * MEI HW Section */
drivers/misc/mei/pci-me.c +2 -0
@@ -126,6 +126,8 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)}, +/* required last entry */ {0, } };
Greg Kroah-Hartman
maintainerPATCH 84/123 most: usb: Fix use-after-free in hdm_disconnect
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victoria Votokina <[email protected]>
commit 4b1270902609ef0d935ed2faa2ea6d122bd148f5 upstream.
hdm_disconnect() calls most_deregister_interface(), which eventually unregisters the MOST interface device with device_unregister(iface->dev). If that drops the last reference, the device core may call release_mdev() immediately while hdm_disconnect() is still executing.
The old code also freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls. Depending on refcount order, this could lead to use-after-free or double-free when release_mdev() ran (or when unregister paths also performed puts).
Fix by moving the frees of mdev-owned allocations into release_mdev(), so they happen exactly once when the device is truly released, and by dropping the extra put_device() calls in hdm_disconnect() that are redundant after device_unregister() and most_deregister_interface().
This addresses the KASAN slab-use-after-free reported by syzbot in hdm_disconnect(). See report and stack traces in the bug link below.
--- drivers/most/most_usb.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/most/most_usb.c +4 -7
@@ -929,6 +929,10 @@ static void release_mdev(struct device * {struct most_dev *mdev =to_mdev_from_dev (dev); +kfree (mdev->busy_urbs); +kfree (mdev->cap); +kfree (mdev->conf); +kfree (mdev->ep_address);kfree (mdev); }/**
@@ -1121,13 +1125,6 @@ static void hdm_disconnect(struct usb_inif (mdev->dci)device_unregister (&mdev->dci->dev);most_deregister_interface (&mdev->iface); - -kfree (mdev->busy_urbs); -kfree (mdev->cap); -kfree (mdev->conf); -kfree (mdev->ep_address); -put_device (&mdev->dci->dev); -put_device (&mdev->dev); }static int hdm_suspend (struct usb_interface *interface,pm_message_t message)
Greg Kroah-Hartman
maintainerPATCH 85/123 most: usb: hdm_probe: Fix calling put_device() before device initialization
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victoria Votokina <[email protected]>
commit a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 upstream.
The early error path in hdm_probe() can jump to err_free_mdev before &mdev->dev has been initialized with device_initialize(). Calling put_device(&mdev->dev) there triggers a device core WARN and ends up invoking kref_put(&kobj->kref, kobject_release) on an uninitialized kobject.
In this path the private struct was only kmalloc'ed and the intended release is effectively kfree(mdev) anyway, so free it directly instead of calling put_device() on an uninitialized device.
This removes the WARNING and fixes the pre-initialization error path.
--- drivers/most/most_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/most/most_usb.c +1 -1
@@ -1097,7 +1097,7 @@ err_free_cap: err_free_conf:kfree (mdev->conf); err_free_mdev: -put_device (&mdev->dev); +kfree (mdev);return ret; }
Greg Kroah-Hartman
maintainerPATCH 86/123 serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Eckert <[email protected]>
commit e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 upstream.
The Advantech 2-port serial card with PCI vendor=0x13fe and device=0x0018 has a 'XR17V35X' chip installed on the circuit board. Therefore, this driver can be used instead of theu outdated out-of-tree driver from the manufacturer.
--- drivers/tty/serial/8250/8250_exar.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/tty/serial/8250/8250_exar.c +11 -0
@@ -33,6 +33,8 @@#define PCI_DEVICE_ID_ACCESSIO_COM_4SM 0x10db#define PCI_DEVICE_ID_ACCESSIO_COM_8SM 0x10ea +#define PCI_DEVICE_ID_ADVANTECH_XR17V352 0x0018 +#define PCI_DEVICE_ID_COMMTECH_4224PCI335 0x0002#define PCI_DEVICE_ID_COMMTECH_4222PCI335 0x0004#define PCI_DEVICE_ID_COMMTECH_2324PCI335 0x000a
@@ -842,6 +844,12 @@ static const struct exar8250_board pbn_f .exit = pci_xr17v35x_exit, }; +static const struct exar8250_board pbn_adv_XR17V352 = { + .num_ports =2 , + .setup = pci_xr17v35x_setup, + .exit = pci_xr17v35x_exit, +}; +static const struct exar8250_board pbn_exar_XR17V4358 = { .num_ports =12 , .setup = pci_xr17v35x_setup,
@@ -911,6 +919,9 @@ static const struct pci_device_id exar_pUSR_DEVICE (XR17C152 ,2980 , pbn_exar_XR17C15x),USR_DEVICE (XR17C152 ,2981 , pbn_exar_XR17C15x), +/* ADVANTECH devices */ +EXAR_DEVICE (ADVANTECH ,XR17V352 , pbn_adv_XR17V352), +/* Exar Corp. XR17C15[248] Dual/Quad/Octal UART */ EXAR_DEVICE (EXAR ,XR17C152 , pbn_exar_XR17C15x), EXAR_DEVICE(EXAR, XR17C154, pbn_exar_XR17C15x),
Greg Kroah-Hartman
maintainerPATCH 87/123 arm64: cputype: Add Neoverse-V3AE definitions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 upstream.
Add cputype definitions for Neoverse-V3AE. These will be used for errata detection in subsequent patches.
These values can be found in the Neoverse-V3AE TRM:
https://developer.arm.com/documentation/SDEN-2615521/9-0/
... in section A.6.1 ("MIDR_EL1, Main ID Register").
--- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/include/asm/cputype.h +2 -0
@@ -93,6 +93,7 @@#define ARM_CPU_PART_NEOVERSE_V2 0xD4F#define ARM_CPU_PART_CORTEX_A720 0xD81#define ARM_CPU_PART_CORTEX_X4 0xD82 +#define ARM_CPU_PART_NEOVERSE_V3AE 0xD83#define ARM_CPU_PART_NEOVERSE_V3 0xD84#define ARM_CPU_PART_CORTEX_X925 0xD85#define ARM_CPU_PART_CORTEX_A725 0xD87
@@ -160,6 +161,7 @@#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2)#define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720)#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) +#define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE)#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)#define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)#define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
Greg Kroah-Hartman
maintainerPATCH 88/123 arm64: errata: Apply workarounds for Neoverse-V3AE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 0c33aa1804d101c11ba1992504f17a42233f0e11 upstream.
Neoverse-V3AE is also affected by erratum #3312417, as described in its Software Developer Errata Notice (SDEN) document:
Neoverse V3AE (MP172) SDEN v9.0, erratum 3312417
https://developer.arm.com/documentation/SDEN-2615521/9-0/
Enable the workaround for Neoverse-V3AE, and document this.
--- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 1 + arch/arm64/kernel/cpu_errata.c | 1 + 3 files changed, 4 insertions(+)
Documentation/arm64/silicon-errata.rst +2 -0
@@ -160,6 +160,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | MMU-500 | #841119,826419 | N/A | +----------------+-----------------+-----------------+-----------------------------+ | ARM | MMU-600 | #1076982,1209401| N/A |
arch/arm64/Kconfig +1 -0
@@ -875,6 +875,7 @@ config ARM64_ERRATUM_3194386 * ARM Neoverse-V1 erratum 3324341 * ARM Neoverse V2 erratum 3324336 * ARM Neoverse-V3 erratum 3312417 + * ARM Neoverse-V3AE erratum 3312417 On affected cores "MSR SSBS, #0" instructions may not affect subsequent speculative instructions, which may permit unexepected
arch/arm64/kernel/cpu_errata.c +1 -0
@@ -424,6 +424,7 @@ static const struct midr_range erratum_sMIDR_ALL_VERSIONS (MIDR_NEOVERSE_V1 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V2 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V3 ), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), {} };#endif
Greg Kroah-Hartman
maintainerPATCH 89/123 s390/cio: Update purge function to unregister the unused subchannels
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 upstream.
Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")', cio no longer unregisters subchannels when the attached device is invalid or unavailable.
As an unintended side-effect, the cio_ignore purge function no longer removes subchannels for devices on the cio_ignore list if no CCW device is attached. This situation occurs when a CCW device is non-operational or unavailable
To ensure the same outcome of the purge function as when the current cio_ignore list had been active during boot, update the purge function to remove I/O subchannels without working CCW devices if the associated device number is found on the cio_ignore list.
--- drivers/s390/cio/device.c | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-)
drivers/s390/cio/device.c +25 -14
@@ -1323,23 +1323,34 @@ void ccw_device_schedule_recovery(void)spin_unlock_irqrestore (&recovery_lock, flags); } -static int purge_fn (struct device *dev,void *data) +static int purge_fn (struct subchannel *sch,void *data) { -struct ccw_device *cdev =to_ccwdev (dev); -struct ccw_dev_id *id = &cdev->private->dev_id; -struct subchannel *sch =to_subchannel (cdev->dev.parent); - -spin_lock_irq (cdev->ccwlock); -if (is_blacklisted (id->ssid, id->devno) && - (cdev->private->state ==DEV_STATE_OFFLINE ) && - (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) ==0 )) { -CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x\n" , id->ssid, - id->devno); +struct ccw_device *cdev; + +spin_lock_irq (sch->lock); +if (sch->st !=SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) + goto unlock; + +if (!is_blacklisted (sch->schid.ssid, sch->schib.pmcw.dev)) + goto unlock; + + cdev =sch_get_cdev (sch); +if (cdev) { +if (cdev->private->state !=DEV_STATE_OFFLINE ) + goto unlock; + +if (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) !=0 ) + goto unlock;ccw_device_sched_todo (cdev,CDEV_TODO_UNREG ); -css_sched_sch_todo (sch,SCH_TODO_UNREG );atomic_set (&cdev->private->onoff,0 ); } -spin_unlock_irq (cdev->ccwlock); + +css_sched_sch_todo (sch,SCH_TODO_UNREG ); +CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x%s\n" , sch->schid.ssid, + sch->schib.pmcw.dev, cdev ?"" :" (no cdev)" ); + +unlock: +spin_unlock_irq (sch->lock);/* Abort loop in case of pending signal. */ if (signal_pending (current))return -EINTR ;
@@ -1355,7 +1366,7 @@ static int purge_fn(struct device *dev,int ccw_purge_blacklisted (void ) {CIO_MSG_EVENT (2 ,"ccw: purging blacklisted devices\n" ); -bus_for_each_dev (&ccw_bus_type,NULL ,NULL , purge_fn); +for_each_subchannel_staged (purge_fn,NULL ,NULL );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 90/123 xfs: rename the old_crc variable in xlog_recover_process
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 0b737f4ac1d3ec093347241df74bbf5f54a7e16c ]
old_crc is a very misleading name. Rename it to expected_crc as that described the usage much better.
Stable-dep-of: e747883c7d73 ("xfs: fix log CRC mismatches between i386 and other architectures")
--- fs/xfs/xfs_log_recover.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
fs/xfs/xfs_log_recover.c +8 -9
@@ -2864,20 +2864,19 @@ xlog_recover_process(int pass, struct list_head *buffer_list) { - __le32 old_crc = rhead->h_crc; -__le32 crc; + __le32 expected_crc = rhead->h_crc, crc; crc =xlog_cksum (log, rhead, dp,be32_to_cpu (rhead->h_len));/* * Nothing else to do if this is a CRC verification pass. Just return * if this a record with a non-zero crc. Unfortunately, mkfs always -* sets old_crc to 0 so we must consider this valid even on v5 supers. -* Otherwise, return EFSBADCRC on failure so the callers up the stack -* know precisely what failed. +* sets expected_crc to 0 so we must consider this valid even on v5 +* supers. Otherwise, return EFSBADCRC on failure so the callers up the +* stack know precisely what failed. */ if (pass ==XLOG_RECOVER_CRCPASS ) { -if (old_crc && crc != old_crc) +if (expected_crc && crc != expected_crc)return -EFSBADCRC ;return 0 ; }
@@ -2888,11 +2887,11 @@ xlog_recover_process(* zero CRC check prevents warnings from being emitted when upgrading * the kernel from one that does not add CRCs by default. */ -if (crc != old_crc) { -if (old_crc ||xfs_has_crc (log->l_mp)) { +if (crc != expected_crc) { +if (expected_crc ||xfs_has_crc (log->l_mp)) {xfs_alert (log->l_mp,"log record CRC mismatch: found 0x%x, expected 0x%x." , -le32_to_cpu (old_crc), +le32_to_cpu (expected_crc),le32_to_cpu (crc));xfs_hex_dump (dp,32 ); }
Greg Kroah-Hartman
maintainerPATCH 91/123 xfs: fix log CRC mismatches between i386 and other architectures
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit e747883c7d7306acb4d683038d881528fbfbe749 ]
When mounting file systems with a log that was dirtied on i386 on other architectures or vice versa, log recovery is unhappy:
[ 11.068052] XFS (vdb): Torn write (CRC failure) detected at log block 0x2. Truncating head block from 0xc.
This is because the CRCs generated by i386 and other architectures always diff. The reason for that is that sizeof(struct xlog_rec_header) returns different values for i386 vs the rest (324 vs 328), because the struct is not sizeof(uint64_t) aligned, and i386 has odd struct size alignment rules.
This issue goes back to commit 13cdc853c519 ("Add log versioning, and new super block field for the log stripe") in the xfs-import tree, which adds log v2 support and the h_size field that causes the unaligned size. At that time it only mattered for the crude debug only log header checksum, but with commit 0e446be44806 ("xfs: add CRC checks to the log") it became a real issue for v5 file system, because now there is a proper CRC, and regular builds actually expect it match.
Fix this by allowing checksums with and without the padding.
--- fs/xfs/libxfs/xfs_log_format.h | 30 +++++++++++++++++++++++++++++- fs/xfs/xfs_log.c | 8 ++++---- fs/xfs/xfs_log_priv.h | 4 ++-- fs/xfs/xfs_log_recover.c | 19 +++++++++++++++++-- fs/xfs/xfs_ondisk.h | 2 ++ 5 files changed, 54 insertions(+), 9 deletions(-)
fs/xfs/libxfs/xfs_log_format.h +29 -1
@@ -167,12 +167,40 @@ typedef struct xlog_rec_header {__be32 h_prev_block;/* block number to previous LR : 4 */ __be32 h_num_logops;/* number of log operations in this LR : 4 */ __be32 h_cycle_data[XLOG_HEADER_CYCLE_SIZE /BBSIZE ]; -/* new fields */ + +/* fields added by the Linux port: */ __be32 h_fmt;/* format of log record : 4 */ uuid_t h_fs_uuid;/* uuid of FS : 16 */ + +/* fields added for log v2: */ __be32 h_size;/* iclog size : 4 */ + +/* +* When h_size added for log v2 support, it caused structure to have +* a different size on i386 vs all other architectures because the +* sum of the size ofthe member is not aligned by that of the largest +* __be64-sized member, and i386 has really odd struct alignment rules. +* +* Due to the way the log headers are placed out on-disk that alone is +* not a problem becaue the xlog_rec_header always sits alone in a +* BBSIZEs area, and the rest of that area is padded with zeroes. +* But xlog_cksum used to calculate the checksum based on the structure +* size, and thus gives different checksums for i386 vs the rest. +* We now do two checksum validation passes for both sizes to allow +* moving v5 file systems with unclean logs between i386 and other +* (little-endian) architectures. +*/ +__u32 h_pad0; } xlog_rec_header_t; +#ifdef __i386__ +#define XLOG_REC_SIZE offsetofend(struct xlog_rec_header, h_size) +#define XLOG_REC_SIZE_OTHER sizeof(struct xlog_rec_header) +#else +#define XLOG_REC_SIZE sizeof(struct xlog_rec_header) +#define XLOG_REC_SIZE_OTHER offsetofend(struct xlog_rec_header, h_size) +#endif /* __i386__ */ + typedef struct xlog_rec_ext_header { __be32 xh_cycle; /* write cycle of log : 4 */ __be32 xh_cycle_data[XLOG_HEADER_CYCLE_SIZE / BBSIZE]; /* : 256 */
fs/xfs/xfs_log.c +4 -4
@@ -1761,13 +1761,13 @@ xlog_cksum(struct xlog *log, struct xlog_rec_header *rhead, char *dp, - int size) + unsigned int hdrsize, + unsigned int size) { uint32_t crc;/* first generate the crc for the record header ... */ - crc =xfs_start_cksum_update ((char *)rhead, -sizeof (struct xlog_rec_header ), + crc =xfs_start_cksum_update ((char *)rhead, hdrsize, offsetof(struct xlog_rec_header , h_crc));/* ... then for additional cycle data for v2 logs ... */
@@ -2013,7 +2013,7 @@ xlog_sync(/* calculcate the checksum */ iclog->ic_header.h_crc =xlog_cksum (log, &iclog->ic_header, - iclog->ic_datap, size); + iclog->ic_datap,XLOG_REC_SIZE , size);/* * Intentionally corrupt the log record CRC based on the error injection * frequency, if defined. This facilitates testing log recovery in the
fs/xfs/xfs_log_priv.h +2 -2
@@ -491,8 +491,8 @@ xlog_recover_finish(extern void xlog_recover_cancel (struct xlog *); -extern __le32 xlog_cksum (struct xlog *log,struct xlog_rec_header *rhead, -char *dp,int size); +__le32 xlog_cksum (struct xlog *log,struct xlog_rec_header *rhead, +char *dp,unsigned int hdrsize,unsigned int size);extern kmem_zone_t *xfs_log_ticket_zone; struct xlog_ticket *
fs/xfs/xfs_log_recover.c +17 -2
@@ -2864,9 +2864,24 @@ xlog_recover_process(int pass, struct list_head *buffer_list) { - __le32 expected_crc = rhead->h_crc, crc; + __le32 expected_crc = rhead->h_crc, crc, other_crc; - crc =xlog_cksum (log, rhead, dp,be32_to_cpu (rhead->h_len)); + crc =xlog_cksum (log, rhead, dp,XLOG_REC_SIZE , +be32_to_cpu (rhead->h_len)); + +/* +* Look at the end of the struct xlog_rec_header definition in +* xfs_log_format.h for the glory details. +*/ +if (expected_crc && crc != expected_crc) { + other_crc =xlog_cksum (log, rhead, dp,XLOG_REC_SIZE_OTHER , +be32_to_cpu (rhead->h_len)); +if (other_crc == expected_crc) { +xfs_notice_once (log->l_mp, +"Fixing up incorrect CRC due to padding." ); + crc = other_crc; + } + }/* * Nothing else to do if this is a CRC verification pass. Just return
fs/xfs/xfs_ondisk.h +2 -0
@@ -132,6 +132,8 @@ xfs_check_ondisk_structs(void) XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format, 56); XFS_CHECK_STRUCT_SIZE(struct xfs_qoff_logformat, 20); XFS_CHECK_STRUCT_SIZE(struct xfs_trans_header, 16); + XFS_CHECK_STRUCT_SIZE(struct xlog_rec_header, 328); + XFS_CHECK_STRUCT_SIZE(struct xlog_rec_ext_header, 260);/* * The v5 superblock format extended several v4 header structures with
Greg Kroah-Hartman
maintainerPATCH 92/123 NFSD: Rework encoding and decoding of nfsd4_deviceid
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <[email protected]>
[ Upstream commit 832738e4b325b742940761e10487403f9aad13e8 ]
Compilers may optimize the layout of C structures, so we should not rely on sizeof struct and memcpy to encode and decode XDR structures. The byte order of the fields should also be taken into account.
This patch adds the correct functions to handle the deviceid4 structure and removes the pad field, which is currently not used by NFSD, from the runtime state. The server's byte order is preserved because the deviceid4 blob on the wire is only used as a cookie by the client.
Stable-dep-of: d68886bae76a ("NFSD: Fix last write offset handling in layoutcommit")
--- fs/nfsd/blocklayoutxdr.c | 7 ++----- fs/nfsd/flexfilelayoutxdr.c | 3 +-- fs/nfsd/nfs4layouts.c | 1 - fs/nfsd/nfs4xdr.c | 14 +------------- fs/nfsd/xdr4.h | 36 +++++++++++++++++++++++++++++++++++- 5 files changed, 39 insertions(+), 22 deletions(-)
fs/nfsd/blocklayoutxdr.c +2 -5
@@ -29,8 +29,7 @@ nfsd4_block_encode_layoutget(struct xdr_ *p++ =cpu_to_be32 (len); *p++ =cpu_to_be32 (1 );/* we always return a single extent */ - p =xdr_encode_opaque_fixed (p, &b->vol_id, -sizeof (struct nfsd4_deviceid )); + p =svcxdr_encode_deviceid4 (p, &b->vol_id); p =xdr_encode_hyper (p, b->foff); p =xdr_encode_hyper (p, b->len); p =xdr_encode_hyper (p, b->soff);
@@ -145,9 +144,7 @@ nfsd4_block_decode_layoutupdate(__be32 *for (i =0 ; i < nr_iomaps; i++) {struct pnfs_block_extent bex; -memcpy (&bex.vol_id, p,sizeof (struct nfsd4_deviceid )); - p +=XDR_QUADLEN (sizeof (struct nfsd4_deviceid )); - + p =svcxdr_decode_deviceid4 (p, &bex.vol_id); p =xdr_decode_hyper (p, &bex.foff);if (bex.foff & (block_size -1 )) { dprintk("%s: unaligned offset 0x%llx\n",
fs/nfsd/flexfilelayoutxdr.c +1 -2
@@ -54,8 +54,7 @@ nfsd4_ff_encode_layoutget(struct xdr_str *p++ =cpu_to_be32 (1 );/* single mirror */ *p++ =cpu_to_be32 (1 );/* single data server */ - p =xdr_encode_opaque_fixed (p, &fl->deviceid, -sizeof (struct nfsd4_deviceid )); + p =svcxdr_encode_deviceid4 (p, &fl->deviceid); *p++ =cpu_to_be32 (1 );/* efficiency */
fs/nfsd/nfs4layouts.c +0 -1
@@ -120,7 +120,6 @@ nfsd4_set_deviceid(struct nfsd4_deviceid id->fsid_idx = fhp->fh_export->ex_devid_map->idx; id->generation = device_generation; - id->pad =0 ;return 0 ; }
fs/nfsd/nfs4xdr.c +1 -13
@@ -566,18 +566,6 @@ nfsd4_decode_state_owner4(struct nfsd4_c }#ifdef CONFIG_NFSD_PNFS -static __be32 -nfsd4_decode_deviceid4 (struct nfsd4_compoundargs *argp, -struct nfsd4_deviceid *devid) -{ -__be32 *p; - - p =xdr_inline_decode (argp->xdr,NFS4_DEVICEID4_SIZE ); -if (!p) -return nfserr_bad_xdr; -memcpy (devid, p,sizeof (*devid)); -return nfs_ok; -} static __be32 nfsd4_decode_layoutupdate4(struct nfsd4_compoundargs *argp,
@@ -1733,7 +1721,7 @@ nfsd4_decode_getdeviceinfo(struct nfsd4___be32 status;memset (gdev,0 ,sizeof (*gdev)); - status =nfsd4_decode_deviceid4 (argp, &gdev->gd_devid); + status =nfsd4_decode_deviceid4 (argp->xdr, &gdev->gd_devid);if (status)return status;if (xdr_stream_decode_u32 (argp->xdr, &gdev->gd_layout_type) <0 )
fs/nfsd/xdr4.h +35 -1
@@ -459,9 +459,43 @@ struct nfsd4_reclaim_complete {struct nfsd4_deviceid {u64 fsid_idx;u32 generation; -u32 pad; }; +static inline __be32 * +svcxdr_encode_deviceid4 (__be32 *p,const struct nfsd4_deviceid *devid) +{ +__be64 *q = (__be64 *)p; + + *q = (__force __be64 )devid->fsid_idx; + p +=2 ; + *p++ = (__force __be32 )devid->generation; + *p++ = xdr_zero; +return p; +} + +static inline __be32 * +svcxdr_decode_deviceid4 (__be32 *p,struct nfsd4_deviceid *devid) +{ +__be64 *q = (__be64 *)p; + + devid->fsid_idx = (__force u64)(*q); + p +=2 ; + devid->generation = (__force u32)(*p++); + p++;/* NFSD does not use the remaining octets */ +return p; +} + +static inline __be32 +nfsd4_decode_deviceid4 (struct xdr_stream *xdr,struct nfsd4_deviceid *devid) +{ +__be32 *p =xdr_inline_decode (xdr,NFS4_DEVICEID4_SIZE ); + +if (unlikely (!p)) +return nfserr_bad_xdr; +svcxdr_decode_deviceid4 (p, devid); +return nfs_ok; +} +struct nfsd4_layout_seg {u32 iomode;u64 offset;
Greg Kroah-Hartman
maintainerPATCH 93/123 NFSD: Minor cleanup in layoutcommit processing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <[email protected]>
[ Upstream commit 274365a51d88658fb51cca637ba579034e90a799 ]
Remove dprintk in nfsd4_layoutcommit. These are not needed in day to day usage, and the information is also available in Wireshark when capturing NFS traffic.
Stable-dep-of: d68886bae76a ("NFSD: Fix last write offset handling in layoutcommit")
--- fs/nfsd/nfs4proc.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
fs/nfsd/nfs4proc.c +3 -9
@@ -2278,18 +2278,12 @@ nfsd4_layoutcommit(struct svc_rqst *rqst inode =d_inode (current_fh->fh_dentry); nfserr = nfserr_inval; -if (new_size <= seg->offset) { -dprintk ("pnfsd: last write before layout segment\n" ); +if (new_size <= seg->offset) goto out; - } -if (new_size > seg->offset + seg->length) { -dprintk ("pnfsd: last write beyond layout segment\n" ); +if (new_size > seg->offset + seg->length) goto out; - } -if (!lcp->lc_newoffset && new_size >i_size_read (inode)) { -dprintk ("pnfsd: layoutcommit beyond EOF\n" ); +if (!lcp->lc_newoffset && new_size >i_size_read (inode)) goto out; - } nfserr = nfsd4_preprocess_layout_stateid(rqstp, cstate, &lcp->lc_sid, false, lcp->lc_layout_type,
Greg Kroah-Hartman
maintainerPATCH 94/123 NFSD: Fix last write offset handling in layoutcommit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <[email protected]>
[ Upstream commit d68886bae76a4b9b3484d23e5b7df086f940fa38 ]
The data type of loca_last_write_offset is newoffset4 and is switched on a boolean value, no_newoffset, that indicates if a previous write occurred or not. If no_newoffset is FALSE, an offset is not given. This means that client does not try to update the file size. Thus, server should not try to calculate new file size and check if it fits into the segment range. See RFC 8881, section 12.5.4.2.
Sometimes the current incorrect logic may cause clients to hang when trying to sync an inode. If layoutcommit fails, the client marks the inode as dirty again.
--- fs/nfsd/blocklayout.c | 5 ++--- fs/nfsd/nfs4proc.c | 30 +++++++++++++++--------------- 2 files changed, 17 insertions(+), 18 deletions(-)
fs/nfsd/blocklayout.c +2 -3
@@ -121,7 +121,6 @@ static __be32 nfsd4_block_commit_blocks(struct inode *inode, struct nfsd4_layoutcommit *lcp, struct iomap *iomaps, int nr_iomaps) { - loff_t new_size = lcp->lc_last_wr + 1; struct iattr iattr = { .ia_valid = 0 };int error;
@@ -131,9 +130,9 @@ nfsd4_block_commit_blocks(struct inode * iattr.ia_valid |=ATTR_ATIME |ATTR_CTIME |ATTR_MTIME ; iattr.ia_atime = iattr.ia_ctime = iattr.ia_mtime = lcp->lc_mtime; -if (new_size >i_size_read (inode)) { +if (lcp->lc_size_chg) { iattr.ia_valid |=ATTR_SIZE ; - iattr.ia_size = new_size; + iattr.ia_size = lcp->lc_newsize; } error = inode->i_sb->s_export_op->commit_blocks(inode, iomaps,
fs/nfsd/nfs4proc.c +15 -15
@@ -2262,7 +2262,6 @@ nfsd4_layoutcommit(struct svc_rqst *rqstconst struct nfsd4_layout_seg *seg = &lcp->lc_seg;struct svc_fh *current_fh = &cstate->current_fh;const struct nfsd4_layout_ops *ops; -loff_t new_size = lcp->lc_last_wr +1 ;struct inode *inode;struct nfs4_layout_stateid *ls;__be32 nfserr;
@@ -2277,13 +2276,21 @@ nfsd4_layoutcommit(struct svc_rqst *rqst goto out; inode =d_inode (current_fh->fh_dentry); - nfserr = nfserr_inval; -if (new_size <= seg->offset) - goto out; -if (new_size > seg->offset + seg->length) - goto out; -if (!lcp->lc_newoffset && new_size >i_size_read (inode)) - goto out; + lcp->lc_size_chg = false; +if (lcp->lc_newoffset) { +loff_t new_size = lcp->lc_last_wr +1 ; + + nfserr = nfserr_inval; +if (new_size <= seg->offset) + goto out; +if (new_size > seg->offset + seg->length) + goto out; + +if (new_size >i_size_read (inode)) { + lcp->lc_size_chg = true; + lcp->lc_newsize = new_size; + } + } nfserr = nfsd4_preprocess_layout_stateid(rqstp, cstate, &lcp->lc_sid, false, lcp->lc_layout_type,
@@ -2299,13 +2306,6 @@ nfsd4_layoutcommit(struct svc_rqst *rqst/* LAYOUTCOMMIT does not require any serialization */ mutex_unlock (&ls->ls_mutex); -if (new_size >i_size_read (inode)) { - lcp->lc_size_chg =1 ; - lcp->lc_newsize = new_size; - }else { - lcp->lc_size_chg =0 ; - } - nfserr = ops->proc_layoutcommit (inode, lcp);nfs4_put_stid (&ls->ls_stid); out:
Greg Kroah-Hartman
maintainerPATCH 95/123 iio: imu: inv_icm42600: use = { } instead of memset()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 352112e2d9aab6a156c2803ae14eb89a9fd93b7d ]
Use { } instead of memset() to zero-initialize stack memory to simplify the code.
Stable-dep-of: 466f7a2fef2a ("iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended")
--- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 5 ++--- drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +2 -3
@@ -749,7 +749,8 @@ int inv_icm42600_accel_parse_fifo(structconst int8_t *temp;unsigned int odr;int64_t ts_val; -struct inv_icm42600_accel_buffer buffer; +/* buffer is copied to userspace, zeroing it to avoid any data leak */ +struct inv_icm42600_accel_buffer buffer = { };/* parse all fifo packets */ for (i =0 , no =0 ; i < st->fifo.count; i += size, ++no) {
@@ -768,8 +769,6 @@ int inv_icm42600_accel_parse_fifo(structinv_icm42600_timestamp_apply_odr (ts, st->fifo.period, st->fifo.nb.total, no); -/* buffer is copied to userspace, zeroing it to avoid any data leak */ -memset (&buffer,0 ,sizeof (buffer));memcpy (&buffer.accel, accel,sizeof (buffer.accel));/* convert 8 bits FIFO temperature in high resolution format */ buffer.temp = temp ? (*temp *64 ) :0 ;
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +2 -3
@@ -761,7 +761,8 @@ int inv_icm42600_gyro_parse_fifo(structconst int8_t *temp;unsigned int odr;int64_t ts_val; -struct inv_icm42600_gyro_buffer buffer; +/* buffer is copied to userspace, zeroing it to avoid any data leak */ +struct inv_icm42600_gyro_buffer buffer = { };/* parse all fifo packets */ for (i =0 , no =0 ; i < st->fifo.count; i += size, ++no) {
@@ -780,8 +781,6 @@ int inv_icm42600_gyro_parse_fifo(structinv_icm42600_timestamp_apply_odr (ts, st->fifo.period, st->fifo.nb.total, no); -/* buffer is copied to userspace, zeroing it to avoid any data leak */ -memset (&buffer,0 ,sizeof (buffer));memcpy (&buffer.gyro, gyro,sizeof (buffer.gyro));/* convert 8 bits FIFO temperature in high resolution format */ buffer.temp = temp ? (*temp *64 ) :0 ;
Greg Kroah-Hartman
maintainerPATCH 96/123 iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
[ Upstream commit 466f7a2fef2a4e426f809f79845a1ec1aeb558f4 ]
Do as in suspend, skip resume configuration steps if the device is already pm_runtime suspended. This avoids reconfiguring a device that is already in the correct low-power state and ensures that pm_runtime handles the power state transitions properly.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +6 -5
@@ -680,17 +680,15 @@ EXPORT_SYMBOL_GPL(inv_icm42600_core_probstatic int __maybe_unused inv_icm42600_suspend (struct device *dev) {struct inv_icm42600_state *st =dev_get_drvdata (dev); -int ret; +int ret =0 ;mutex_lock (&st->lock); st->suspended.gyro = st->conf.gyro.mode; st->suspended.accel = st->conf.accel.mode; st->suspended.temp = st->conf.temp_en; -if (pm_runtime_suspended (dev)) { - ret =0 ; +if (pm_runtime_suspended (dev)) goto out_unlock; - }/* disable FIFO data streaming */ if (st->fifo.on) {
@@ -722,10 +720,13 @@ static int __maybe_unused inv_icm42600_rstruct inv_icm42600_state *st =dev_get_drvdata (dev);struct inv_icm42600_timestamp *gyro_ts =iio_priv (st->indio_gyro);struct inv_icm42600_timestamp *accel_ts =iio_priv (st->indio_accel); -int ret; +int ret =0 ;mutex_lock (&st->lock); +if (pm_runtime_suspended (dev)) + goto out_unlock; + ret =inv_icm42600_enable_regulator_vddio (st);if (ret) goto out_unlock;
Greg Kroah-Hartman
maintainerPATCH 97/123 PM: runtime: Add new devm functions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bence Csókás <[email protected]>
[ Upstream commit 73db799bf5efc5a04654bb3ff6c9bf63a0dfa473 ]
Add devm_pm_runtime_set_active_enabled() anddevm_pm_runtime_get_noresume() for simplifying
common cases in drivers.
Stable-dep-of: 0792c1984a45 ("iio: imu: inv_icm42600: Simplify pm_runtime setup")
--- drivers/base/power/runtime.c | 44 +++++++++++++++++++++++++++++++++++++++++++ include/linux/pm_runtime.h | 4 +++ 2 files changed, 48 insertions(+)
drivers/base/power/runtime.c +44 -0
@@ -1477,6 +1477,32 @@ void pm_runtime_enable(struct device *de }EXPORT_SYMBOL_GPL (pm_runtime_enable); +static void pm_runtime_set_suspended_action (void *data) +{ +pm_runtime_set_suspended (data); +} + +/** +* devm_pm_runtime_set_active_enabled - set_active version of devm_pm_runtime_enable. +* +* @dev: Device to handle. +*/ +int devm_pm_runtime_set_active_enabled (struct device *dev) +{ +int err; + + err =pm_runtime_set_active (dev); +if (err) +return err; + + err =devm_add_action_or_reset (dev, pm_runtime_set_suspended_action, dev); +if (err) +return err; + +return devm_pm_runtime_enable (dev); +} +EXPORT_SYMBOL_GPL (devm_pm_runtime_set_active_enabled); +static void pm_runtime_disable_action (void *data) {pm_runtime_dont_use_autosuspend (data);
@@ -1499,6 +1525,24 @@ int devm_pm_runtime_enable(struct device }EXPORT_SYMBOL_GPL (devm_pm_runtime_enable); +static void pm_runtime_put_noidle_action (void *data) +{ +pm_runtime_put_noidle (data); +} + +/** +* devm_pm_runtime_get_noresume - devres-enabled version of pm_runtime_get_noresume. +* +* @dev: Device to handle. +*/ +int devm_pm_runtime_get_noresume (struct device *dev) +{ +pm_runtime_get_noresume (dev); + +return devm_add_action_or_reset (dev, pm_runtime_put_noidle_action, dev); +} +EXPORT_SYMBOL_GPL (devm_pm_runtime_get_noresume); +/** * pm_runtime_forbid - Block runtime PM of a device. * @dev: Device to handle.
include/linux/pm_runtime.h +4 -0
@@ -75,7 +75,9 @@ extern void pm_runtime_new_link(struct dextern void pm_runtime_drop_link (struct device_link *link);extern void pm_runtime_release_supplier (struct device_link *link); +int devm_pm_runtime_set_active_enabled (struct device *dev);extern int devm_pm_runtime_enable (struct device *dev); +int devm_pm_runtime_get_noresume (struct device *dev);/** * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter.
@@ -272,7 +274,9 @@ static inline void __pm_runtime_disable(static inline void pm_runtime_allow (struct device *dev) {}static inline void pm_runtime_forbid (struct device *dev) {} +static inline int devm_pm_runtime_set_active_enabled (struct device *dev) {return 0 ; }static inline int devm_pm_runtime_enable (struct device *dev) {return 0 ; } +static inline int devm_pm_runtime_get_noresume (struct device *dev) {return 0 ; }static inline void pm_suspend_ignore_children (struct device *dev,bool enable) {}static inline void pm_runtime_get_noresume (struct device *dev) {}
Greg Kroah-Hartman
maintainerPATCH 98/123 iio: imu: inv_icm42600: Simplify pm_runtime setup
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
[ Upstream commit 0792c1984a45ccd7a296d6b8cb78088bc99a212e ]
Rework the power management in inv_icm42600_core_probe() to use devm_pm_runtime_set_active_enabled(), which simplifies the runtime PM setup by handling activation and enabling in one step. Remove the separate inv_icm42600_disable_pm callback, as it's no longer needed with the devm-managed approach.
Using devm_pm_runtime_enable() also fixes the missing disable of autosuspend.
Update inv_icm42600_disable_vddio_reg() to only disable the regulator if the device is not suspended i.e. powered-down, preventing unbalanced disables.
Also remove redundant error msg on regulator_disable(), the regulator framework already emits an error message when regulator_disable() fails.
This simplifies the PM setup and avoids manipulating the usage counter unnecessarily.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 24 ++++++----------------- 1 file changed, 7 insertions(+), 17 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +7 -17
@@ -550,20 +550,12 @@ static void inv_icm42600_disable_vdd_regstatic void inv_icm42600_disable_vddio_reg (void *_data) {struct inv_icm42600_state *st = _data; -const struct device *dev =regmap_get_device (st->map); -int ret; - - ret =regulator_disable (st->vddio_supply); -if (ret) -dev_err (dev,"failed to disable vddio error %d\n" , ret); -} +struct device *dev =regmap_get_device (st->map); -static void inv_icm42600_disable_pm (void *_data) -{ -struct device *dev = _data; +if (pm_runtime_status_suspended (dev)) +return ; -pm_runtime_put_sync (dev); -pm_runtime_disable (dev); +regulator_disable (st->vddio_supply); } int inv_icm42600_core_probe(struct regmap *regmap, int chip, int irq,
@@ -660,16 +652,14 @@ int inv_icm42600_core_probe(struct regmareturn ret;/* setup runtime power management */ - ret =pm_runtime_set_active (dev); + ret =devm_pm_runtime_set_active_enabled (dev);if (ret)return ret; -pm_runtime_get_noresume (dev); -pm_runtime_enable (dev); +pm_runtime_set_autosuspend_delay (dev,INV_ICM42600_SUSPEND_DELAY_MS );pm_runtime_use_autosuspend (dev); -pm_runtime_put (dev); -return devm_add_action_or_reset (dev, inv_icm42600_disable_pm, dev); +return ret; }EXPORT_SYMBOL_GPL (inv_icm42600_core_probe);
Greg Kroah-Hartman
maintainerPATCH 99/123 padata: Reset next CPU when reorder sequence wraps around
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Liang <[email protected]>
[ Upstream commit 501302d5cee0d8e8ec2c4a5919c37e0df9abc99b ]
When seq_nr wraps around, the next reorder job with seq 0 is hashed to the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu to the first one when pd->processed wraps around. Otherwise, if the number of used CPUs is not a power of 2, padata_find_next() will be checking a wrong list, hence deadlock.
--- kernel/padata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/padata.c +5 -1
@@ -282,7 +282,11 @@ static struct padata_priv *padata_find_nif (remove_object) {list_del_init (&padata->list); ++pd->processed; - pd->cpu =cpumask_next_wrap (cpu, pd->cpumask.pcpu,-1 , false); +/* When sequence wraps around, reset to the first CPU. */ +if (unlikely (pd->processed ==0 )) + pd->cpu =cpumask_first (pd->cpumask.pcpu); +else + pd->cpu =cpumask_next_wrap (cpu, pd->cpumask.pcpu,-1 , false); }spin_unlock (&reorder->lock);
Greg Kroah-Hartman
maintainerPATCH 100/123 fuse: allocate ff->release_args only if release is needed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit e26ee4efbc79610b20e7abe9d96c87f33dacc1ff ]
This removed the need to pass isdir argument to fuse_put_file().
Stable-dep-of: 26e5c67deb2e ("fuse: fix livelock in synchronous file put from fuseblk workers")
--- fs/fuse/dir.c | 2 - fs/fuse/file.c | 69 +++++++++++++++++++++++++++++++------------------------ fs/fuse/fuse_i.h | 2 - 3 files changed, 41 insertions(+), 32 deletions(-)
fs/fuse/dir.c +1 -1
@@ -491,7 +491,7 @@ static int fuse_create_open(struct inode goto out_err; err = -ENOMEM ; - ff =fuse_file_alloc (fm); + ff =fuse_file_alloc (fm, true);if (!ff) goto out_put_forget_req;
fs/fuse/file.c +39 -30
177 lines not on this page · raw message
fs/fuse/fuse_i.h +1 -1
@@ -996,7 +996,7 @@ void fuse_read_args_fill(struct fuse_io_*/ int fuse_open_common (struct inode *inode,struct file *file,bool isdir); -struct fuse_file *fuse_file_alloc (struct fuse_mount *fm); +struct fuse_file *fuse_file_alloc (struct fuse_mount *fm,bool release);void fuse_file_free (struct fuse_file *ff);void fuse_finish_open (struct inode *inode,struct file *file);
Greg Kroah-Hartman
maintainerPATCH 101/123 fuse: fix livelock in synchronous file put from fuseblk workers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <[email protected]>
[ Upstream commit 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 ]
I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for responses from the fuseblk server:
# cat /proc/372265/task/372313/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_do_getattr+0xfc/0x1f0 [fuse] [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse] [<0>] aio_read+0x130/0x1e0 [<0>] io_submit_one+0x542/0x860 [<0>] __x64_sys_io_submit+0x98/0x1a0 [<0>] do_syscall_64+0x37/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53
But the /weird/ part is that the fuseblk server threads are waiting for responses from itself:
# cat /proc/372210/task/372232/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_file_put+0x9a/0xd0 [fuse] [<0>] fuse_release+0x36/0x50 [fuse] [<0>] __fput+0xec/0x2b0 [<0>] task_work_run+0x55/0x90 [<0>] syscall_exit_to_user_mode+0xe9/0x100 [<0>] do_syscall_64+0x43/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53
The fuseblk server is fuse2fs so there's nothing all that exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the fstest sheds some light on that:
"By closing the file descriptor before calling io_destroy, you pretty much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion).
Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE command from userspace causes the fuse server to call the AIO completion function. The completion puts the struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to userspace, it has to run the delayed fput, which in the case of a fuseblk server, it does synchronously.
Sending the FUSE_RELEASE command sychronously from fuse server threads is a bad idea because a client program can initiate enough simultaneous AIOs such that all the fuse server threads end up in delayed_fput, and now there aren't any threads left to handle the queued fuse commands.
Fix this by only using asynchronous fputs when closing files, and leave a comment explaining why.
--- fs/fuse/file.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/fuse/file.c +7 -1
@@ -340,8 +340,14 @@ void fuse_file_release(struct inode *ino* Make the release synchronous if this is a fuseblk mount, * synchronous RELEASE is allowed (and desirable) in this case * because the server can be trusted not to screw up. +* +* Always use the asynchronous file put because the current thread +* might be the fuse server. This can happen if a process starts some +* aio and closes the fd before the aio completes. Since aio takes its +* own ref to the file, the IO completion has to drop the ref, which is +* how the fuse server can end up closing its clients' files. */ -fuse_file_put (ff, ff->fm->fc->destroy); +fuse_file_put (ff, false); }void fuse_release_common (struct file *file,bool isdir)
Greg Kroah-Hartman
maintainerPATCH 102/123 PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit 82c4be4168e26a5593aaa1002b5678128a638824 ]
The ACSPCIE module is capable of driving the reference clock required by the PCIe Endpoint device. It is an alternative to on-board and external reference clock generators. Enabling the output from the ACSPCIE module's PAD IO Buffers requires clearing the "PAD IO disable" bits of the ACSPCIE_PROXY_CTRL register in the CTRL_MMR register space.
Add support to enable the ACSPCIE reference clock output using the optional device-tree property "ti,syscon-acspcie-proxy-ctrl".
Stable-dep-of: f842d3313ba1 ("PCI: j721e: Fix programming sequence of "strap" settings")
--- drivers/pci/controller/cadence/pci-j721e.c | 39 ++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-)
drivers/pci/controller/cadence/pci-j721e.c +38 -1
@@ -46,6 +46,7 @@ enum link_status {#define LANE_COUNT_MASK BIT(8)#define LANE_COUNT (n) ((n) << 8) +#define ACSPCIE_PAD_DISABLE_MASK GENMASK(1, 0)#define GENERATION_SEL_MASK GENMASK(1, 0)#define MAX_LANES 2
@@ -218,6 +219,36 @@ static int j721e_pcie_set_lane_count(strreturn ret; } +static int j721e_enable_acspcie_refclk (struct j721e_pcie *pcie, +struct regmap *syscon) +{ +struct device *dev = pcie->cdns_pcie->dev; +struct device_node *node = dev->of_node; +u32 mask =ACSPCIE_PAD_DISABLE_MASK ; +struct of_phandle_args args; +u32 val; +int ret; + + ret =of_parse_phandle_with_fixed_args (node, +"ti,syscon-acspcie-proxy-ctrl" , +1 ,0 , &args); +if (ret) { +dev_err (dev, +"ti,syscon-acspcie-proxy-ctrl has invalid arguments\n" ); +return ret; + } + +/* Clear PAD IO disable bits to enable refclk output */ + val = ~(args.args[0 ]); + ret =regmap_update_bits (syscon,0 , mask, val); +if (ret) { +dev_err (dev,"failed to enable ACSPCIE refclk: %d\n" , ret); +return ret; + } + +return 0 ; +} +static int j721e_pcie_ctrl_init (struct j721e_pcie *pcie) {struct device *dev = pcie->dev;
@@ -257,7 +288,13 @@ static int j721e_pcie_ctrl_init(struct jreturn ret; } -return 0 ; +/* Enable ACSPCIE refclk output if the optional property exists */ + syscon =syscon_regmap_lookup_by_phandle_optional (node, +"ti,syscon-acspcie-proxy-ctrl" ); +if (!syscon) +return 0 ; + +return j721e_enable_acspcie_refclk (pcie, syscon); } static int cdns_ti_pcie_config_read(struct pci_bus *bus, unsigned int devfn,
Greg Kroah-Hartman
maintainerPATCH 103/123 PCI: j721e: Fix programming sequence of "strap" settings
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit f842d3313ba179d4005096357289c7ad09cec575 ]
The Cadence PCIe Controller integrated in the TI K3 SoCs supports both Root-Complex and Endpoint modes of operation. The Glue Layer allows "strapping" the Mode of operation of the Controller, the Link Speed and the Link Width. This is enabled by programming the "PCIEn_CTRL" register (n corresponds to the PCIe instance) within the CTRL_MMR memory-mapped register space. The "reset-values" of the registers are also different depending on the mode of operation.
Since the PCIe Controller latches onto the "reset-values" immediately after being powered on, if the Glue Layer configuration is not done while the PCIe Controller is off, it will result in the PCIe Controller latching onto the wrong "reset-values". In practice, this will show up as a wrong representation of the PCIe Controller's capability structures in the PCIe Configuration Space. Some such capabilities which are supported by the PCIe Controller in the Root-Complex mode but are incorrectly latched onto as being unsupported are:
- Link Bandwidth Notification
- Alternate Routing ID (ARI) Forwarding Support
- Next capability offset within Advanced Error Reporting (AER) capability
Fix this by powering off the PCIe Controller before programming the "strap" settings and powering it on after that. The runtime PM APIs namely pm_runtime_put_sync() and pm_runtime_get_sync() will decrement and increment the usage counter respectively, causing GENPD to power off and power on the PCIe Controller.
--- drivers/pci/controller/cadence/pci-j721e.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
drivers/pci/controller/cadence/pci-j721e.c +25 -0
@@ -270,6 +270,25 @@ static int j721e_pcie_ctrl_init(struct jif (!ret) offset = args.args[0 ]; +/* +* The PCIe Controller's registers have different "reset-values" +* depending on the "strap" settings programmed into the PCIEn_CTRL +* register within the CTRL_MMR memory-mapped register space. +* The registers latch onto a "reset-value" based on the "strap" +* settings sampled after the PCIe Controller is powered on. +* To ensure that the "reset-values" are sampled accurately, power +* off the PCIe Controller before programming the "strap" settings +* and power it on after that. The runtime PM APIs namely +* pm_runtime_put_sync() and pm_runtime_get_sync() will decrement and +* increment the usage counter respectively, causing GENPD to power off +* and power on the PCIe Controller. +*/ + ret =pm_runtime_put_sync (dev); +if (ret <0 ) { +dev_err (dev,"Failed to power off PCIe Controller\n" ); +return ret; + } + ret =j721e_pcie_set_mode (pcie, syscon, offset);if (ret <0 ) {dev_err (dev,"Failed to set pci mode\n" );
@@ -288,6 +307,12 @@ static int j721e_pcie_ctrl_init(struct jreturn ret; } + ret =pm_runtime_get_sync (dev); +if (ret <0 ) { +dev_err (dev,"Failed to power on PCIe Controller\n" ); +return ret; + } +/* Enable ACSPCIE refclk output if the optional property exists */ syscon =syscon_regmap_lookup_by_phandle_optional (node,"ti,syscon-acspcie-proxy-ctrl" );
Greg Kroah-Hartman
maintainerPATCH 104/123 wifi: ath11k: HAL SRNG: dont deinitialize and re-initialize again
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
[ Upstream commit 32be3ca4cf78b309dfe7ba52fe2d7cc3c23c5634 ]
Don't deinitialize and reinitialize the HAL helpers. The dma memory is deallocated and there is high possibility that we'll not be able to get the same memory allocated from dma when there is high memory pressure.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.6
--- drivers/net/wireless/ath/ath11k/core.c | 6 +----- drivers/net/wireless/ath/ath11k/hal.c | 16 ++++++++++++++++ drivers/net/wireless/ath/ath11k/hal.h | 1 + 3 files changed, 18 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +1 -5
@@ -942,14 +942,10 @@ static int ath11k_core_reconfigure_on_crmutex_unlock (&ab->core_lock);ath11k_dp_free (ab); -ath11k_hal_srng_deinit (ab); +ath11k_hal_srng_clear (ab); ab->free_vdev_map = (1LL << (ab->num_radios *TARGET_NUM_VDEVS )) -1 ; - ret =ath11k_hal_srng_init (ab); -if (ret) -return ret; -clear_bit (ATH11K_FLAG_CRASH_FLUSH , &ab->dev_flags); ret =ath11k_core_qmi_firmware_ready (ab);
drivers/net/wireless/ath/ath11k/hal.c +16 -0
@@ -1313,6 +1313,22 @@ void ath11k_hal_srng_deinit(struct ath11 }EXPORT_SYMBOL (ath11k_hal_srng_deinit); +void ath11k_hal_srng_clear (struct ath11k_base *ab) +{ +/* No need to memset rdp and wrp memory since each individual +* segment would get cleared in ath11k_hal_srng_src_hw_init() +* and ath11k_hal_srng_dst_hw_init(). +*/ +memset (ab->hal.srng_list,0 , +sizeof (ab->hal.srng_list)); +memset (ab->hal.shadow_reg_addr,0 , +sizeof (ab->hal.shadow_reg_addr)); + ab->hal.avail_blk_resource =0 ; + ab->hal.current_blk_index =0 ; + ab->hal.num_shadow_reg_configured =0 ; +} +EXPORT_SYMBOL (ath11k_hal_srng_clear); +void ath11k_hal_dump_srng_stats (struct ath11k_base *ab) {struct hal_srng *srng;
drivers/net/wireless/ath/ath11k/hal.h +1 -0
@@ -952,6 +952,7 @@ int ath11k_hal_srng_setup(struct ath11k_ struct hal_srng_params *params);int ath11k_hal_srng_init (struct ath11k_base *ath11k);void ath11k_hal_srng_deinit (struct ath11k_base *ath11k); +void ath11k_hal_srng_clear (struct ath11k_base *ab);void ath11k_hal_dump_srng_stats (struct ath11k_base *ab);void ath11k_hal_srng_get_shadow_config (struct ath11k_base *ab,u32 **cfg,u32 *len);
Greg Kroah-Hartman
maintainerPATCH 105/123 PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 5ed35b4d490d8735021cce9b715b62a418310864 ]
The rcar_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls rcar_msi_irq_unmask().
Since the &desc->lock descriptor lock is a raw spinlock, and the rcar_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y.
Use scoped_guard() to simplify the locking.
--- drivers/pci/controller/pcie-rcar-host.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +6 -6
@@ -38,7 +38,7 @@ struct rcar_msi {DECLARE_BITMAP (used,INT_PCI_MSI_NR );struct irq_domain *domain;struct mutex map_lock; -spinlock_t mask_lock; +raw_spinlock_t mask_lock;int irq1;int irq2; };
@@ -559,11 +559,11 @@ static void rcar_msi_irq_mask(struct irqunsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); +raw_spin_lock_irqsave (&msi->mask_lock, flags); value =rcar_pci_read_reg (pcie,PCIEMSIIER ); value &= ~BIT (d->hwirq);rcar_pci_write_reg (pcie, value,PCIEMSIIER ); -spin_unlock_irqrestore (&msi->mask_lock, flags); +raw_spin_unlock_irqrestore (&msi->mask_lock, flags); }static void rcar_msi_irq_unmask (struct irq_data *d)
@@ -573,11 +573,11 @@ static void rcar_msi_irq_unmask(struct iunsigned long flags;u32 value; -spin_lock_irqsave (&msi->mask_lock, flags); +raw_spin_lock_irqsave (&msi->mask_lock, flags); value =rcar_pci_read_reg (pcie,PCIEMSIIER ); value |=BIT (d->hwirq);rcar_pci_write_reg (pcie, value,PCIEMSIIER ); -spin_unlock_irqrestore (&msi->mask_lock, flags); +raw_spin_unlock_irqrestore (&msi->mask_lock, flags); }static int rcar_msi_set_affinity (struct irq_data *d,const struct cpumask *mask,bool force)
@@ -693,7 +693,7 @@ static int rcar_pcie_enable_msi(struct rint err;mutex_init (&msi->map_lock); -spin_lock_init (&msi->mask_lock); +raw_spin_lock_init (&msi->mask_lock); err =of_address_to_resource (dev->of_node,0 , &res);if (err)
Greg Kroah-Hartman
maintainerPATCH 106/123 drm/amdgpu: use atomic functions with memory barriers for vm fault info
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
[ Upstream commit 6df8e84aa6b5b1812cc2cacd6b3f5ccbb18cda2b ]
The atomic variable vm_fault_info_updated is used to synchronize access to adev->gmc.vm_fault_info between the interrupt handler and get_vm_fault_info().
The default atomic functions like atomic_set() and atomic_read() do not provide memory barriers. This allows for CPU instruction reordering, meaning the memory accesses to vm_fault_info and the vm_fault_info_updated flag are not guaranteed to occur in the intended order. This creates a race condition that can lead to inconsistent or stale data being used.
The previous implementation, which used an explicit mb(), was incomplete and inefficient. It failed to account for all potential CPU reorderings, such as the access of vm_fault_info being reordered before the atomic_read of the flag. This approach is also more verbose and less performant than using the proper atomic functions with acquire/release semantics.
Fix this by switching to atomic_set_release() and atomic_read_acquire(). These functions provide the necessary acquire and release semantics, which act as memory barriers to ensure the correct order of operations. It is also more efficient and idiomatic than using explicit full memory barriers.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 ++--- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 7 +++---- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 7 +++---- 3 files changed, 8 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +2 -3
@@ -1870,10 +1870,9 @@ int amdgpu_amdkfd_gpuvm_get_vm_fault_infstruct amdgpu_device *adev; adev = (struct amdgpu_device *)kgd; -if (atomic_read (&adev->gmc.vm_fault_info_updated) ==1 ) { +if (atomic_read_acquire (&adev->gmc.vm_fault_info_updated) ==1 ) { *mem = *adev->gmc.vm_fault_info; -mb (); -atomic_set (&adev->gmc.vm_fault_info_updated,0 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,0 ); }return 0 ; }
drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c +3 -4
@@ -1072,7 +1072,7 @@ static int gmc_v7_0_sw_init(void *handle GFP_KERNEL);if (!adev->gmc.vm_fault_info)return -ENOMEM ; -atomic_set (&adev->gmc.vm_fault_info_updated,0 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,0 );return 0 ; }
@@ -1301,7 +1301,7 @@ static int gmc_v7_0_process_interrupt(st vmid =REG_GET_FIELD (status,VM_CONTEXT1_PROTECTION_FAULT_STATUS ,VMID );if (amdgpu_amdkfd_is_kfd_vmid (adev, vmid) - && !atomic_read (&adev->gmc.vm_fault_info_updated)) { + && !atomic_read_acquire (&adev->gmc.vm_fault_info_updated)) {struct kfd_vm_fault_info *info = adev->gmc.vm_fault_info; u32 protections = REG_GET_FIELD(status, VM_CONTEXT1_PROTECTION_FAULT_STATUS,
@@ -1317,8 +1317,7 @@ static int gmc_v7_0_process_interrupt(st info->prot_read = protections &0x8 ? true : false; info->prot_write = protections &0x10 ? true : false; info->prot_exec = protections &0x20 ? true : false; -mb (); -atomic_set (&adev->gmc.vm_fault_info_updated,1 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,1 ); }return 0 ;
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +3 -4
@@ -1194,7 +1194,7 @@ static int gmc_v8_0_sw_init(void *handle GFP_KERNEL);if (!adev->gmc.vm_fault_info)return -ENOMEM ; -atomic_set (&adev->gmc.vm_fault_info_updated,0 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,0 );return 0 ; }
@@ -1482,7 +1482,7 @@ static int gmc_v8_0_process_interrupt(st vmid =REG_GET_FIELD (status,VM_CONTEXT1_PROTECTION_FAULT_STATUS ,VMID );if (amdgpu_amdkfd_is_kfd_vmid (adev, vmid) - && !atomic_read (&adev->gmc.vm_fault_info_updated)) { + && !atomic_read_acquire (&adev->gmc.vm_fault_info_updated)) {struct kfd_vm_fault_info *info = adev->gmc.vm_fault_info; u32 protections = REG_GET_FIELD(status, VM_CONTEXT1_PROTECTION_FAULT_STATUS,
@@ -1498,8 +1498,7 @@ static int gmc_v8_0_process_interrupt(st info->prot_read = protections &0x8 ? true : false; info->prot_write = protections &0x10 ? true : false; info->prot_exec = protections &0x20 ? true : false; -mb (); -atomic_set (&adev->gmc.vm_fault_info_updated,1 ); +atomic_set_release (&adev->gmc.vm_fault_info_updated,1 ); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 107/123 vfs: Dont leak disconnected dentries on umount
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 56094ad3eaa21e6621396cc33811d8f72847a834 ]
When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well.
--- fs/dcache.c | 2 ++ 1 file changed, 2 insertions(+)
fs/dcache.c +2 -0
@@ -1836,6 +1836,8 @@ struct dentry *d_alloc(struct dentry * p__dget_dlock (parent); dentry->d_parent = parent;list_add (&dentry->d_child, &parent->d_subdirs); +if (parent->d_flags &DCACHE_DISCONNECTED ) + dentry->d_flags |=DCACHE_DISCONNECTED ;spin_unlock (&parent->d_lock);return dentry;
Greg Kroah-Hartman
maintainerPATCH 108/123 NFSD: Define a proc_layoutcommit for the FlexFiles layout type
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 4b47a8601b71ad98833b447d465592d847b4dc77 ]
Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout.
--- fs/nfsd/flexfilelayout.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/nfsd/flexfilelayout.c +8 -0
@@ -125,6 +125,13 @@ nfsd4_ff_proc_getdeviceinfo(struct superreturn 0 ; } +static __be32 +nfsd4_ff_proc_layoutcommit (struct inode *inode, +struct nfsd4_layoutcommit *lcp) +{ +return nfs_ok; +} +const struct nfsd4_layout_ops ff_layout_ops = { .notify_types =NOTIFY_DEVICEID4_DELETE |NOTIFY_DEVICEID4_CHANGE ,
@@ -133,4 +140,5 @@ const struct nfsd4_layout_ops ff_layout_ .encode_getdeviceinfo = nfsd4_ff_encode_getdeviceinfo, .proc_layoutget = nfsd4_ff_proc_layoutget, .encode_layoutget = nfsd4_ff_encode_layoutget, + .proc_layoutcommit = nfsd4_ff_proc_layoutcommit, };
Greg Kroah-Hartman
maintainerPATCH 109/123 f2fs: fix wrong block mapping for multi-devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
[ Upstream commit 9d5c4f5c7a2c7677e1b3942772122b032c265aae ]
Assuming the disk layout as below,
disk0: 0 --- 0x00035abfff
disk1: 0x00035ac000 --- 0x00037abfff
disk2: 0x00037ac000 --- 0x00037ebfff
and we want to read data from offset=13568 having len=128 across the block devices, we can illustrate the block addresses like below.
0 .. 0x00037ac000 ------------------- 0x00037ebfff, 0x00037ec000 -------
| ^ ^ ^
| fofs 0 13568 13568+128
| ------------------------------------------------------
| LBA 0x37e8aa9 0x37ebfa9 0x37ec029
--- map 0x3caa9 0x3ffa9In this example, we should give the relative map of the target block device ranging from 0x3caa9 to 0x3ffa9 where the length should be calculated by 0x37ebfff + 1 - 0x37ebfa9.
In the below equation, however, map->m_pblk was supposed to be the original address instead of the one from the target block address.
- map->m_len = min(map->m_len, dev->end_blk + 1 - map->m_pblk);
--- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/data.c +1 -1
@@ -1505,9 +1505,9 @@ int f2fs_map_blocks(struct inode *inode, bidx =f2fs_target_device_index (sbi, map->m_pblk); map->m_bdev =FDEV (bidx).bdev; - map->m_pblk -=FDEV (bidx).start_blk; map->m_len =min (map->m_len,FDEV (bidx).end_blk +1 - map->m_pblk); + map->m_pblk -=FDEV (bidx).start_blk;if (map->m_may_create) f2fs_update_device_state(sbi, inode->i_ino,
Greg Kroah-Hartman
maintainerPATCH 110/123 PCI: tegra194: Handle errors in BPMP response
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit f8c9ad46b00453a8c075453f3745f8d263f44834 ]
The return value from tegra_bpmp_transfer() indicates the success or failure of the IPC transaction with BPMP. If the transaction succeeded, we also need to check the actual command's result code.
If we don't have error handling for tegra_bpmp_transfer(), we will set the pcie->ep_state to EP_STATE_ENABLED even when the tegra_bpmp_transfer() command fails. Thus, the pcie->ep_state will get out of sync with reality, and any further PERST# assert + deassert will be a no-op and will not trigger the hardware initialization sequence.
This is because pex_ep_event_pex_rst_deassert() checks the current pcie->ep_state, and does nothing if the current state is already EP_STATE_ENABLED.
Thus, it is important to have error handling for tegra_bpmp_transfer(), such that the pcie->ep_state can not get out of sync with reality, so that we will try to initialize the hardware not only during the first PERST# assert + deassert, but also during any succeeding PERST# assert + deassert.
One example where this fix is needed is when using a rock5b as host. During the initial PERST# assert + deassert (triggered by the bootloader on the rock5b) pex_ep_event_pex_rst_deassert() will get called, but for some unknown reason, the tegra_bpmp_transfer() call to initialize the PHY fails. Once Linux has been loaded on the rock5b, the PCIe driver will once again assert + deassert PERST#. However, without tegra_bpmp_transfer() error handling, this second PERST# assert + deassert will not trigger the hardware initialization sequence.
With tegra_bpmp_transfer() error handling, the second PERST# assert + deassert will once again trigger the hardware to be initialized and this time the tegra_bpmp_transfer() succeeds.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +16 -2
@@ -1168,6 +1168,7 @@ static int tegra_pcie_bpmp_set_ctrl_statstruct mrq_uphy_response resp;struct tegra_bpmp_message msg;struct mrq_uphy_request req; +int err;/* Controller-5 doesn't need to have its state set by BPMP-FW */ if (pcie->cid ==5 )
@@ -1187,7 +1188,13 @@ static int tegra_pcie_bpmp_set_ctrl_stat msg.rx.data = &resp; msg.rx.size =sizeof (resp); -return tegra_bpmp_transfer (pcie->bpmp, &msg); + err =tegra_bpmp_transfer (pcie->bpmp, &msg); +if (err) +return err; +if (msg.rx.ret) +return -EINVAL ; + +return 0 ; } static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie,
@@ -1196,6 +1203,7 @@ static int tegra_pcie_bpmp_set_pll_statestruct mrq_uphy_response resp;struct tegra_bpmp_message msg;struct mrq_uphy_request req; +int err;memset (&req,0 ,sizeof (req));memset (&resp,0 ,sizeof (resp));
@@ -1215,7 +1223,13 @@ static int tegra_pcie_bpmp_set_pll_state msg.rx.data = &resp; msg.rx.size =sizeof (resp); -return tegra_bpmp_transfer (pcie->bpmp, &msg); + err =tegra_bpmp_transfer (pcie->bpmp, &msg); +if (err) +return err; +if (msg.rx.ret) +return -EINVAL ; + +return 0 ; }static void tegra_pcie_downstream_dev_to_D0 (struct tegra_pcie_dw *pcie)
Greg Kroah-Hartman
maintainerPATCH 111/123 PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 84b576146294c2be702cfcd174eaa74167e276f9 ]
In case the controller is transitioning to L1 in rcar_pcie_config_access(), any read/write access to PCIECDR triggers asynchronous external abort. This is because the transition to L1 link state must be manually finished by the driver. The PCIe IP can transition back from L1 state to L0 on its own.
Avoid triggering the abort in rcar_pcie_config_access() by checking whether the controller is in the transition state, and if so, finish the transition right away. This prevents a lot of unnecessary exceptions, although not all of them.
Stable-dep-of: 0a8f173d9dad ("PCI: rcar-host: Drop PMSR spinlock")
--- drivers/pci/controller/pcie-rcar-host.c | 76 ++++++++++++++++++-------------- 1 file changed, 45 insertions(+), 31 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +45 -31
@@ -67,6 +67,42 @@ struct rcar_pcie_host {int (*phy_init_fn)(struct rcar_pcie_host *host); }; +static DEFINE_SPINLOCK (pmsr_lock); + +static int rcar_pcie_wakeup (struct device *pcie_dev,void __iomem *pcie_base) +{ +unsigned long flags; +u32 pmsr, val; +int ret =0 ; + +spin_lock_irqsave (&pmsr_lock, flags); + +if (!pcie_base ||pm_runtime_suspended (pcie_dev)) { + ret = -EINVAL ; + goto unlock_exit; + } + + pmsr =readl (pcie_base +PMSR ); + +/* +* Test if the PCIe controller received PM_ENTER_L1 DLLP and +* the PCIe controller is not in L1 link state. If true, apply +* fix, which will put the controller into L1 link state, from +* which it can return to L0s/L0 on its own. +*/ +if ((pmsr &PMEL1RX ) && ((pmsr &PMSTATE ) !=PMSTATE_L1 )) { +writel (L1IATN , pcie_base +PMCTLR ); + ret =readl_poll_timeout_atomic (pcie_base +PMSR , val, + val &L1FAEG ,10 ,1000 ); +WARN (ret,"Timeout waiting for L1 link state, ret=%d\n" , ret); +writel (L1FAEG |PMEL1RX , pcie_base +PMSR ); + } + +unlock_exit: +spin_unlock_irqrestore (&pmsr_lock, flags); +return ret; +} +static struct rcar_pcie_host *msi_to_host (struct rcar_msi *msi) { return container_of(msi, struct rcar_pcie_host, msi);
@@ -87,6 +123,14 @@ static int rcar_pcie_config_access(struc {struct rcar_pcie *pcie = &host->pcie;unsigned int dev, func, reg, index; +int ret; + +/* Wake the bus up in case it is in L1 state. */ + ret =rcar_pcie_wakeup (pcie->dev, pcie->base); +if (ret) { +PCI_SET_ERROR_RESPONSE (data); +return PCIBIOS_SET_FAILED ; + } dev =PCI_SLOT (devfn); func =PCI_FUNC (devfn);
@@ -1054,40 +1098,10 @@ static struct platform_driver rcar_pcie_ };#ifdef CONFIG_ARM -static DEFINE_SPINLOCK (pmsr_lock);static int rcar_pcie_aarch32_abort_handler (unsigned long addr,unsigned int fsr,struct pt_regs *regs) { -unsigned long flags; -u32 pmsr, val; -int ret =0 ; - -spin_lock_irqsave (&pmsr_lock, flags); - -if (!pcie_base ||pm_runtime_suspended (pcie_dev)) { - ret =1 ; - goto unlock_exit; - } - - pmsr =readl (pcie_base +PMSR ); - -/* -* Test if the PCIe controller received PM_ENTER_L1 DLLP and -* the PCIe controller is not in L1 link state. If true, apply -* fix, which will put the controller into L1 link state, from -* which it can return to L0s/L0 on its own. -*/ -if ((pmsr &PMEL1RX ) && ((pmsr &PMSTATE ) !=PMSTATE_L1 )) { -writel (L1IATN , pcie_base +PMCTLR ); - ret =readl_poll_timeout_atomic (pcie_base +PMSR , val, - val &L1FAEG ,10 ,1000 ); -WARN (ret,"Timeout waiting for L1 link state, ret=%d\n" , ret); -writel (L1FAEG |PMEL1RX , pcie_base +PMSR ); - } - -unlock_exit: -spin_unlock_irqrestore (&pmsr_lock, flags); -return ret; +return !!rcar_pcie_wakeup (pcie_dev, pcie_base); } static const struct of_device_id rcar_pcie_abort_handler_of_match[] __initconst = {
Greg Kroah-Hartman
maintainerPATCH 112/123 PCI: rcar-host: Drop PMSR spinlock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 0a8f173d9dad13930d5888505dc4c4fd6a1d4262 ]
The pmsr_lock spinlock used to be necessary to synchronize access to the PMSR register, because that access could have been triggered from either config space access in rcar_pcie_config_access() or an exception handler rcar_pcie_aarch32_abort_handler().
The rcar_pcie_aarch32_abort_handler() case is no longer applicable since commit 6e36203bc14c ("PCI: rcar: Use PCI_SET_ERROR_RESPONSE after read which triggered an exception"), which performs more accurate, controlled invocation of the exception, and a fixup.
This leaves rcar_pcie_config_access() as the only call site from which rcar_pcie_wakeup() is called. The rcar_pcie_config_access() can only be called from the controller struct pci_ops .read and .write callbacks, and those are serialized in drivers/pci/access.c using raw spinlock 'pci_lock' . It should be noted that CONFIG_PCI_LOCKLESS_CONFIG is never set on this platform.
Since the 'pci_lock' is a raw spinlock , and the 'pmsr_lock' is not a raw spinlock, this constellation triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y .
Remove the pmsr_lock to fix the locking.
--- drivers/pci/controller/pcie-rcar-host.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +2 -11
@@ -67,20 +67,13 @@ struct rcar_pcie_host {int (*phy_init_fn)(struct rcar_pcie_host *host); }; -static DEFINE_SPINLOCK (pmsr_lock); -static int rcar_pcie_wakeup (struct device *pcie_dev,void __iomem *pcie_base) { -unsigned long flags;u32 pmsr, val;int ret =0 ; -spin_lock_irqsave (&pmsr_lock, flags); - -if (!pcie_base ||pm_runtime_suspended (pcie_dev)) { - ret = -EINVAL ; - goto unlock_exit; - } +if (!pcie_base ||pm_runtime_suspended (pcie_dev)) +return -EINVAL ; pmsr =readl (pcie_base +PMSR );
@@ -98,8 +91,6 @@ static int rcar_pcie_wakeup(struct devicwritel (L1FAEG |PMEL1RX , pcie_base +PMSR ); } -unlock_exit: -spin_unlock_irqrestore (&pmsr_lock, flags);return ret; }
Greg Kroah-Hartman
maintainerPATCH 113/123 PCI: tegra194: Reset BARs when running in PCIe endpoint mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 42f9c66a6d0cc45758dab77233c5460e1cf003df ]
Tegra already defines all BARs except BAR0 as BAR_RESERVED. This is sufficient for pci-epf-test to not allocate backing memory and to not call set_bar() for those BARs. However, marking a BAR as BAR_RESERVED does not mean that the BAR gets disabled.
The host side driver, pci_endpoint_test, simply does an ioremap for all enabled BARs and will run tests against all enabled BARs, so it will run tests against the BARs marked as BAR_RESERVED.
After running the BAR tests (which will write to all enabled BARs), the inbound address translation is broken. This is because the tegra controller exposes the ATU Port Logic Structure in BAR4, so when BAR4 is written, the inbound address translation settings get overwritten.
To avoid this, implement the dw_pcie_ep_ops .init() callback and start off by disabling all BARs (pci-epf-test will later enable/configure BARs that are not defined as BAR_RESERVED).
This matches the behavior of other PCIe endpoint drivers: dra7xx, imx6, layerscape-ep, artpec6, dw-rockchip, qcom-ep, rcar-gen4, and uniphier-ep.
With this, the PCI endpoint kselftest test case CONSECUTIVE_BAR_TEST (which was specifically made to detect address translation issues) passes.
--- drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + drivers/pci/controller/dwc/pcie-tegra194.c | 10 ++++++++++ 2 files changed, 11 insertions(+)
drivers/pci/controller/dwc/pcie-designware-ep.c +1 -0
@@ -84,6 +84,7 @@ void dw_pcie_ep_reset_bar(struct dw_pciefor (func_no =0 ; func_no < funcs; func_no++)__dw_pcie_ep_reset_bar (pci, func_no, bar,0 ); } +EXPORT_SYMBOL_GPL (dw_pcie_ep_reset_bar);static u8 __dw_pcie_ep_find_next_cap (struct dw_pcie_ep *ep,u8 func_no,u8 cap_ptr,u8 cap)
drivers/pci/controller/dwc/pcie-tegra194.c +10 -0
@@ -1839,6 +1839,15 @@ static irqreturn_t tegra_pcie_ep_pex_rstreturn IRQ_HANDLED ; } +static void tegra_pcie_ep_init (struct dw_pcie_ep *ep) +{ +struct dw_pcie *pci =to_dw_pcie_from_ep (ep); +enum pci_barno bar; + +for (bar =0 ; bar <PCI_STD_NUM_BARS ; bar++) +dw_pcie_ep_reset_bar (pci, bar); +}; +static int tegra_pcie_ep_raise_legacy_irq (struct tegra_pcie_dw *pcie,u16 irq) {/* Tegra194 supports only INTA */
@@ -1912,6 +1921,7 @@ tegra_pcie_ep_get_features(struct dw_pci }static const struct dw_pcie_ep_ops pcie_ep_ops = { + .ep_init = tegra_pcie_ep_init, .raise_irq = tegra_pcie_ep_raise_irq, .get_features = tegra_pcie_ep_get_features, };
Greg Kroah-Hartman
maintainerPATCH 114/123 devcoredump: Fix circular locking dependency with devcd->mutex.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
[ Upstream commit a91c8096590bd7801a26454789f2992094fe36da ]
The original code causes a circular locking dependency found by lockdep.
======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 Tainted: G S U
------------------------------------------------------
xe_fault_inject/5091 is trying to acquire lock:ffff888156815688 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}, at: __flush_work+0x25d/0x660
but task is already holding lock:
ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&devcd->mutex){+.+.}-{3:3}:
mutex_lock_nested+0x4e/0xc0
devcd_data_write+0x27/0x90
sysfs_kf_bin_write+0x80/0xf0
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #1 (kn->active#236){++++}-{0:0}:
kernfs_drain+0x1e2/0x200
__kernfs_remove+0xae/0x400
kernfs_remove_by_name_ns+0x5d/0xc0
remove_files+0x54/0x70
sysfs_remove_group+0x3d/0xa0
sysfs_remove_groups+0x2e/0x60
device_remove_attrs+0xc7/0x100
device_del+0x15d/0x3b0
devcd_del+0x19/0x30
process_one_work+0x22b/0x6f0
worker_thread+0x1e8/0x3d0
kthread+0x11c/0x250
ret_from_fork+0x26c/0x2e0
ret_from_fork_asm+0x1a/0x30
-> #0 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}:
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
__flush_work+0x27a/0x660
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
other info that might help us debug this:
Chain exists of: (work_completion)(&(&devcd->del_wk)->work) --> kn->active#236 --> &devcd->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&devcd->mutex);
lock(kn->active#236);
lock(&devcd->mutex);
lock((work_completion)(&(&devcd->del_wk)->work));
*** DEADLOCK ***
5 locks held by xe_fault_inject/5091:
#0: ffff8881129f9488 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x72/0xf0
#1: ffff88810c755078 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x123/0x220
#2: ffff8881054811a0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x55/0x280
#3: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0
#4: ffffffff8359e020 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x72/0x660
stack backtrace:
CPU: 14 UID: 0 PID: 5091 Comm: xe_fault_inject Tainted: G S U 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 PREEMPT_{RT,(lazy)}
Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
Hardware name: Micro-Star International Co., Ltd. MS-7D25/PRO Z690-A DDR4(MS-7D25), BIOS 1.10 12/13/2021
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
dump_stack+0x10/0x20
print_circular_bug+0x285/0x360
check_noncircular+0x135/0x150
? register_lock_class+0x48/0x4a0
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
? __flush_work+0x25d/0x660
? mark_held_locks+0x46/0x90
? __flush_work+0x25d/0x660
__flush_work+0x27a/0x660
? __flush_work+0x25d/0x660
? trace_hardirqs_on+0x1e/0xd0
? __pfx_wq_barrier_func+0x10/0x10
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
? bus_find_device+0xa8/0xe0
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
? __f_unlock_pos+0x15/0x20
? __x64_sys_getdents64+0x9b/0x130
? __pfx_filldir64+0x10/0x10
? do_syscall_64+0x1a2/0xb60
? clear_bhb_loop+0x30/0x80
? clear_bhb_loop+0x30/0x80
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x76e292edd574
Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
RSP: 002b:00007fffe247a828 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000076e292edd574
RDX: 000000000000000c RSI: 00006267f6306063 RDI: 000000000000000b
RBP: 000000000000000c R08: 000076e292fc4b20 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00006267f6306063
R13: 000000000000000b R14: 00006267e6859c00 R15: 000076e29322a000
</TASK>xe 0000:03:00.0: [drm] Xe device coredump has been deleted.
--- drivers/base/devcoredump.c | 138 +++++++++++++++++++++++++++------------------ 1 file changed, 84 insertions(+), 54 deletions(-)
drivers/base/devcoredump.c +84 -54
@@ -26,50 +26,46 @@ struct devcd_entry {void *data;size_t datalen;/* -* Here, mutex is required to serialize the calls to del_wk work between -* user/kernel space which happens when devcd is added with device_add() -* and that sends uevent to user space. User space reads the uevents, -* and calls to devcd_data_write() which try to modify the work which is -* not even initialized/queued from devcoredump. +* There are 2 races for which mutex is required. * +* The first race is between device creation and userspace writing to +* schedule immediately destruction. * +* This race is handled by arming the timer before device creation, but +* when device creation fails the timer still exists. * -* cpu0(X) cpu1(Y) +* To solve this, hold the mutex during device_add(), and set +* init_completed on success before releasing the mutex. * -* dev_coredump() uevent sent to user space -* device_add() ======================> user space process Y reads the -* uevents writes to devcd fd -* which results into writes to +* That way the timer will never fire until device_add() is called, +* it will do nothing if init_completed is not set. The timer is also +* cancelled in that case. * -* devcd_data_write() -* mod_delayed_work() -* try_to_grab_pending() -* del_timer() -* debug_assert_init() -* INIT_DELAYED_WORK() -* schedule_delayed_work() -* -* -* Also, mutex alone would not be enough to avoid scheduling of -* del_wk work after it get flush from a call to devcd_free() -* mentioned as below. -* -* disabled_store() -* devcd_free() -* mutex_lock() devcd_data_write() -* flush_delayed_work() -* mutex_unlock() -* mutex_lock() -* mod_delayed_work() -* mutex_unlock() -* So, delete_work flag is required. +* The second race involves multiple parallel invocations of devcd_free(), +* add a deleted flag so only 1 can call the destructor. */ struct mutex mutex; -bool delete_work; +bool init_completed, deleted;struct module *owner;ssize_t (*read)(char *buffer,loff_t offset,size_t count,void *data,size_t datalen);void (*free)(void *data); +/* +* If nothing interferes and device_add() was returns success, +* del_wk will destroy the device after the timer fires. +* +* Multiple userspace processes can interfere in the working of the timer: +* - Writing to the coredump will reschedule the timer to run immediately, +* if still armed. +* +* This is handled by using "if (cancel_delayed_work()) { +* schedule_delayed_work() }", to prevent re-arming after having +* been previously fired. +* - Writing to /sys/class/devcoredump/disabled will destroy the +* coredump synchronously. +* This is handled by using disable_delayed_work_sync(), and then +* checking if deleted flag is set with &devcd->mutex held. +*/ struct delayed_work del_wk;struct device *failing_dev; };
@@ -98,14 +94,27 @@ static void devcd_dev_release(struct devkfree (devcd); } +static void __devcd_del (struct devcd_entry *devcd) +{ + devcd->deleted = true; +device_del (&devcd->devcd_dev); +put_device (&devcd->devcd_dev); +} +static void devcd_del (struct work_struct *wk) {struct devcd_entry *devcd; +bool init_completed; devcd = container_of(wk, struct devcd_entry, del_wk.work); -device_del (&devcd->devcd_dev); -put_device (&devcd->devcd_dev); +/* devcd->mutex serializes against dev_coredumpm_timeout */ +mutex_lock (&devcd->mutex); + init_completed = devcd->init_completed; +mutex_unlock (&devcd->mutex); + +if (init_completed) +__devcd_del (devcd); } static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj,
@@ -125,12 +134,12 @@ static ssize_t devcd_data_write(struct fstruct device *dev =kobj_to_dev (kobj);struct devcd_entry *devcd =dev_to_devcd (dev); -mutex_lock (&devcd->mutex); -if (!devcd->delete_work) { - devcd->delete_work = true; -mod_delayed_work (system_wq, &devcd->del_wk,0 ); - } -mutex_unlock (&devcd->mutex); +/* +* Although it's tempting to use mod_delayed work here, +* that will cause a reschedule if the timer already fired. +*/ +if (cancel_delayed_work (&devcd->del_wk)) +schedule_delayed_work (&devcd->del_wk,0 );return count; }
@@ -158,11 +167,21 @@ static int devcd_free(struct device *dev {struct devcd_entry *devcd =dev_to_devcd (dev); +/* +* To prevent a race with devcd_data_write(), cancel work and +* complete manually instead. +* +* We cannot rely on the return value of +* cancel_delayed_work_sync() here, because it might be in the +* middle of a cancel_delayed_work + schedule_delayed_work pair. +* +* devcd->mutex here guards against multiple parallel invocations +* of devcd_free(). +*/ +cancel_delayed_work_sync (&devcd->del_wk);mutex_lock (&devcd->mutex); -if (!devcd->delete_work) - devcd->delete_work = true; - -flush_delayed_work (&devcd->del_wk); +if (!devcd->deleted) +__devcd_del (devcd);mutex_unlock (&devcd->mutex);return 0 ; }
@@ -186,12 +205,10 @@ static ssize_t disabled_show(struct clas* put_device() <- last reference * error = fn(dev, data) devcd_dev_release() * devcd_free(dev, data) kfree(devcd) -* mutex_lock(&devcd->mutex); * * -* In the above diagram, It looks like disabled_store() would be racing with parallely -* running devcd_del() and result in memory abort while acquiring devcd->mutex which -* is called after kfree of devcd memory after dropping its last reference with +* In the above diagram, it looks like disabled_store() would be racing with parallelly +* running devcd_del() and result in memory abort after dropping its last reference with * put_device(). However, this will not happens as fn(dev, data) runs * with its own reference to device via klist_node so it is not its last reference. * so, above situation would not occur.
@@ -353,7 +370,7 @@ void dev_coredumpm(struct device *dev, s devcd->read = read; devcd->free = free; devcd->failing_dev =get_device (dev); - devcd->delete_work = false; + devcd->deleted = false;mutex_init (&devcd->mutex);device_initialize (&devcd->devcd_dev);
@@ -362,8 +379,14 @@ void dev_coredumpm(struct device *dev, s atomic_inc_return(&devcd_count)); devcd->devcd_dev.class = &devcd_class; -mutex_lock (&devcd->mutex);dev_set_uevent_suppress (&devcd->devcd_dev, true); + +/* devcd->mutex prevents devcd_del() completing until init finishes */ +mutex_lock (&devcd->mutex); + devcd->init_completed = false; +INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); +schedule_delayed_work (&devcd->del_wk,DEVCD_TIMEOUT ); +if (device_add (&devcd->devcd_dev)) goto put_device;
@@ -380,13 +403,20 @@ void dev_coredumpm(struct device *dev, sdev_set_uevent_suppress (&devcd->devcd_dev, false);kobject_uevent (&devcd->devcd_dev.kobj,KOBJ_ADD ); -INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); -schedule_delayed_work (&devcd->del_wk,DEVCD_TIMEOUT ); + +/* +* Safe to run devcd_del() now that we are done with devcd_dev. +* Alternatively we could have taken a ref on devcd_dev before +* dropping the lock. +*/ + devcd->init_completed = true;mutex_unlock (&devcd->mutex);return ; put_device: -put_device (&devcd->devcd_dev);mutex_unlock (&devcd->mutex); +cancel_delayed_work_sync (&devcd->del_wk); +put_device (&devcd->devcd_dev); + put_module:module_put (owner); free:
Greg Kroah-Hartman
maintainerPATCH 115/123 xfs: always warn about deprecated mount options
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <[email protected]>
[ Upstream commit 630785bfbe12c3ee3ebccd8b530a98d632b7e39d ]
The deprecation of the 'attr2' mount option in 6.18 wasn't entirely successful because nobody noticed that the kernel never printed a warning about attr2 being set in fstab if the only xfs filesystem is the root fs; the initramfs mounts the root fs with no mount options; and the init scripts only conveyed the fstab options by remounting the root fs.
Fix this by making it complain all the time.
--- fs/xfs/xfs_super.c | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-)
fs/xfs/xfs_super.c +21 -12
@@ -1178,16 +1178,25 @@ suffix_kstrtoint(static inline void xfs_fs_warn_deprecated (struct fs_context *fc, -struct fs_parameter *param, -uint64_t flag, -bool value) +struct fs_parameter *param) { -/* Don't print the warning if reconfiguring and current mount point -* already had the flag set +/* +* Always warn about someone passing in a deprecated mount option. +* Previously we wouldn't print the warning if we were reconfiguring +* and current mount point already had the flag set, but that was not +* the right thing to do. +* +* Many distributions mount the root filesystem with no options in the +* initramfs and rely on mount -a to remount the root fs with the +* options in fstab. However, the old behavior meant that there would +* never be a warning about deprecated mount options for the root fs in +* /etc/fstab. On a single-fs system, that means no warning at all. +* +* Compounding this problem are distribution scripts that copy +* /proc/mounts to fstab, which means that we can't remove mount +* options unless we're 100% sure they have only ever been advertised +* in /proc/mounts in response to explicitly provided mount options. */ -if ((fc->purpose &FS_CONTEXT_FOR_RECONFIGURE ) && - !!(XFS_M (fc->root->d_sb)->m_features & flag) == value) -return ;xfs_warn (fc->s_fs_info,"%s mount option is deprecated." , param->key); }
@@ -1326,19 +1335,19 @@ xfs_fs_parse_param(#endif /* Following mount options will be removed in September 2025 */ case Opt_ikeep: -xfs_fs_warn_deprecated (fc, param,XFS_FEAT_IKEEP , true); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_features |=XFS_FEAT_IKEEP ;return 0 ;case Opt_noikeep: -xfs_fs_warn_deprecated (fc, param,XFS_FEAT_IKEEP , false); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_features &= ~XFS_FEAT_IKEEP ;return 0 ;case Opt_attr2: -xfs_fs_warn_deprecated (fc, param,XFS_FEAT_ATTR2 , true); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_features |=XFS_FEAT_ATTR2 ;return 0 ;case Opt_noattr2: -xfs_fs_warn_deprecated (fc, param,XFS_FEAT_NOATTR2 , true); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_features |=XFS_FEAT_NOATTR2 ;return 0 ;default :
Greg Kroah-Hartman
maintainerPATCH 116/123 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 2eead19334516c8e9927c11b448fbe512b1f18a1 ]
Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate().
Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns:
"The error code within @ptr if it is an error pointer; 0 otherwise."
This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL.
Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
--- drivers/base/arch_topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/arch_topology.c +1 -1
@@ -290,7 +290,7 @@ bool __init topology_parse_cpu_capacity(* frequency (by keeping the initial freq_factor value). */ cpu_clk =of_clk_get (cpu_node,0 ); -if (!PTR_ERR_OR_ZERO (cpu_clk)) { +if (!IS_ERR_OR_NULL (cpu_clk)) {per_cpu (freq_factor, cpu) =clk_get_rate (cpu_clk) /1000 ;clk_put (cpu_clk);
Greg Kroah-Hartman
maintainerPATCH 117/123 usb: gadget: Store endpoint pointer in usb_request
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit bfb1d99d969fe3b892db30848aeebfa19d21f57f ]
Gadget function drivers often have goto-based error handling in their bind paths, which can be bug-prone. Refactoring these paths to use __free() scope-based cleanup is desirable, but currently blocked.
The blocker is that usb_ep_free_request(ep, req) requires two parameters, while the __free() mechanism can only pass a pointer to the request itself.
Store an endpoint pointer in the struct usb_request. The pointer is populated centrally in usb_ep_alloc_request() on every successful allocation, making the request object self-contained.
Stable-dep-of: 75a5b8d4ddd4 ("usb: gadget: f_ncm: Refactor bind path to use __free()")
--- drivers/usb/gadget/udc/core.c | 3 +++ include/linux/usb/gadget.h | 2 ++ 2 files changed, 5 insertions(+)
drivers/usb/gadget/udc/core.c +3 -0
@@ -177,6 +177,9 @@ struct usb_request *usb_ep_alloc_request req = ep->ops->alloc_request (ep, gfp_flags); +if (req) + req->ep = ep; +trace_usb_ep_alloc_request (ep, req, req ?0 : -ENOMEM );return req;
include/linux/usb/gadget.h +2 -0
@@ -33,6 +33,7 @@ struct usb_ep;/** * struct usb_request - describes one i/o request +* @ep: The associated endpoint set by usb_ep_alloc_request(). * @buf: Buffer used for data. Always provide this; some controllers * only use PIO, or don't use DMA for some endpoints. * @dma: DMA address corresponding to 'buf'. If you don't set this
@@ -98,6 +99,7 @@ struct usb_ep;*/ struct usb_request { +struct usb_ep *ep;void *buf;unsigned length;dma_addr_t dma;
Greg Kroah-Hartman
maintainerPATCH 118/123 usb: gadget: Introduce free_usb_request helper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 201c53c687f2b55a7cc6d9f4000af4797860174b ]
Introduce the free_usb_request() function that frees both the request's buffer and the request itself.
This function serves as the cleanup callback for DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request pointers.
Stable-dep-of: 75a5b8d4ddd4 ("usb: gadget: f_ncm: Refactor bind path to use __free()")
--- include/linux/usb/gadget.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
include/linux/usb/gadget.h +23 -0
@@ -17,6 +17,7 @@#ifndef __LINUX_USB_GADGET_H#define __LINUX_USB_GADGET_H +#include <linux/cleanup.h> #include <linux/device.h> #include <linux/errno.h> #include <linux/init.h>
@@ -292,6 +293,28 @@ static inline void usb_ep_fifo_flush(str/*-------------------------------------------------------------------------*/ +/** +* free_usb_request - frees a usb_request object and its buffer +* @req: the request being freed +* +* This helper function frees both the request's buffer and the request object +* itself by calling usb_ep_free_request(). Its signature is designed to be used +* with DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request +* pointers. +*/ +static inline void free_usb_request (struct usb_request *req) +{ +if (!req) +return ; + +kfree (req->buf); +usb_ep_free_request (req->ep, req); +} + +DEFINE_FREE(free_usb_request, struct usb_request *, free_usb_request(_T)) + +/*-------------------------------------------------------------------------*/ +struct usb_dcd_config_params {__u8 bU1devExitLat;/* U1 Device exit Latency */ #define USB_DEFAULT_U1_DEV_EXIT_LAT 0x01/* Less then 1 microsec */
Greg Kroah-Hartman
maintainerPATCH 119/123 usb: gadget: f_ncm: Refactor bind path to use __free()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef ]
After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec ncm_bind+0x39c/0x3dc usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20
--- drivers/usb/gadget/function/f_ncm.c | 78 +++++++++++++++--------------------- 1 file changed, 33 insertions(+), 45 deletions(-)
drivers/usb/gadget/function/f_ncm.c +33 -45
@@ -11,6 +11,7 @@* Copyright (C) 2008 Nokia Corporation */ +#include <linux/cleanup.h> #include <linux/kernel.h> #include <linux/interrupt.h> #include <linux/module.h>
@@ -19,6 +20,7 @@#include <linux/crc32.h> #include <linux/usb/cdc.h> +#include <linux/usb/gadget.h> #include "u_ether.h" #include "u_ether_configfs.h"
@@ -1441,18 +1443,18 @@ static int ncm_bind(struct usb_configurastruct usb_ep *ep;struct f_ncm_opts *ncm_opts; + struct usb_os_desc_table *os_desc_table __free(kfree) = NULL; + struct usb_request *request __free(free_usb_request) = NULL; +if (!can_support_ecm (cdev->gadget))return -EINVAL ; ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst);if (cdev->use_os_string) { - f->os_desc_table =kzalloc (sizeof (*f->os_desc_table), -GFP_KERNEL ); -if (!f->os_desc_table) + os_desc_table =kzalloc (sizeof (*os_desc_table),GFP_KERNEL ); +if (!os_desc_table)return -ENOMEM ; - f->os_desc_n =1 ; - f->os_desc_table[0 ].os_desc = &ncm_opts->ncm_os_desc; }mutex_lock (&ncm_opts->lock);
@@ -1462,16 +1464,15 @@ static int ncm_bind(struct usb_configuramutex_unlock (&ncm_opts->lock);if (status) - goto fail; +return status; ncm_opts->bound = true; us =usb_gstrings_attach (cdev, ncm_strings,ARRAY_SIZE (ncm_string_defs)); -if (IS_ERR (us)) { - status =PTR_ERR (us); - goto fail; - } +if (IS_ERR (us)) +return PTR_ERR (us); + ncm_control_intf.iInterface = us[STRING_CTRL_IDX ].id; ncm_data_nop_intf.iInterface = us[STRING_DATA_IDX ].id; ncm_data_intf.iInterface = us[STRING_DATA_IDX ].id;
@@ -1481,55 +1482,47 @@ static int ncm_bind(struct usb_configura/* allocate instance-specific interface IDs */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ncm->ctrl_id = status; ncm_iad_desc.bFirstInterface = status; ncm_control_intf.bInterfaceNumber = status; ncm_union_desc.bMasterInterface0 = status; -if (cdev->use_os_string) - f->os_desc_table[0 ].if_id = - ncm_iad_desc.bFirstInterface; - status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ncm->data_id = status; ncm_data_nop_intf.bInterfaceNumber = status; ncm_data_intf.bInterfaceNumber = status; ncm_union_desc.bSlaveInterface0 = status; - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &fs_ncm_in_desc);if (!ep) - goto fail; +return -ENODEV ; ncm->port.in_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_ncm_out_desc);if (!ep) - goto fail; +return -ENODEV ; ncm->port.out_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_ncm_notify_desc);if (!ep) - goto fail; +return -ENODEV ; ncm->notify = ep; - status = -ENOMEM ; -/* allocate notification request and buffer */ - ncm->notify_req =usb_ep_alloc_request (ep,GFP_KERNEL ); -if (!ncm->notify_req) - goto fail; - ncm->notify_req->buf =kmalloc (NCM_STATUS_BYTECOUNT ,GFP_KERNEL ); -if (!ncm->notify_req->buf) - goto fail; - ncm->notify_req->context = ncm; - ncm->notify_req->complete = ncm_notify_complete; + request =usb_ep_alloc_request (ep,GFP_KERNEL ); +if (!request) +return -ENOMEM ; + request->buf =kmalloc (NCM_STATUS_BYTECOUNT ,GFP_KERNEL ); +if (!request->buf) +return -ENOMEM ; + request->context = ncm; + request->complete = ncm_notify_complete;/* * support all relevant hardware speeds... we expect that when
@@ -1549,7 +1542,7 @@ static int ncm_bind(struct usb_configura status =usb_assign_descriptors (f, ncm_fs_function, ncm_hs_function, ncm_ss_function, ncm_ss_function);if (status) - goto fail; +return status;/* * NOTE: all that is done without knowing or caring about
@@ -1563,25 +1556,20 @@ static int ncm_bind(struct usb_configurahrtimer_init (&ncm->task_timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); ncm->task_timer.function = ncm_tx_timeout; +if (cdev->use_os_string) { + os_desc_table[0 ].os_desc = &ncm_opts->ncm_os_desc; + os_desc_table[0 ].if_id = ncm_iad_desc.bFirstInterface; + f->os_desc_table =no_free_ptr (os_desc_table); + f->os_desc_n =1 ; + } + ncm->notify_req =no_free_ptr (request); +DBG (cdev,"CDC Network: %s speed IN/%s OUT/%s NOTIFY/%s\n" ,gadget_is_superspeed (c->cdev->gadget) ?"super" :gadget_is_dualspeed (c->cdev->gadget) ?"dual" :"full" , ncm->port.in_ep->name, ncm->port.out_ep->name, ncm->notify->name);return 0 ; - -fail: -kfree (f->os_desc_table); - f->os_desc_n =0 ; - -if (ncm->notify_req) { -kfree (ncm->notify_req->buf); -usb_ep_free_request (ncm->notify, ncm->notify_req); - } - -ERROR (cdev,"%s: can't bind, err %d\n" , f->name, status); - -return status; }static inline struct f_ncm_opts *to_f_ncm_opts (struct config_item *item)
Greg Kroah-Hartman
maintainerPATCH 120/123 usb: gadget: f_acm: Refactor bind path to use __free()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 47b2116e54b4a854600341487e8b55249e926324 ]
After an bind/unbind cycle, the acm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec gs_free_req+0x30/0x44 acm_bind+0x1b8/0x1f4 usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20
--- drivers/usb/gadget/function/f_acm.c | 42 ++++++++++++++++-------------------- 1 file changed, 19 insertions(+), 23 deletions(-)
drivers/usb/gadget/function/f_acm.c +19 -23
@@ -11,12 +11,15 @@/* #define VERBOSE_DEBUG */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/device.h> #include <linux/err.h> +#include <linux/usb/gadget.h> +#include "u_serial.h"
@@ -612,6 +615,7 @@ acm_bind(struct usb_configuration *c, ststruct usb_string *us;int status;struct usb_ep *ep; + struct usb_request *request __free(free_usb_request) = NULL;/* REVISIT might want instance-specific strings to help * distinguish instances ...
@@ -629,7 +633,7 @@ acm_bind(struct usb_configuration *c, st/* allocate instance-specific interface IDs, and patch descriptors */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; acm->ctrl_id = status; acm_iad_descriptor.bFirstInterface = status;
@@ -638,40 +642,38 @@ acm_bind(struct usb_configuration *c, st status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; acm->data_id = status; acm_data_interface_desc.bInterfaceNumber = status; acm_union_desc.bSlaveInterface0 = status; acm_call_mgmt_descriptor.bDataInterface = status; - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &acm_fs_in_desc);if (!ep) - goto fail; +return -ENODEV ; acm->port.in = ep; ep =usb_ep_autoconfig (cdev->gadget, &acm_fs_out_desc);if (!ep) - goto fail; +return -ENODEV ; acm->port.out = ep; ep =usb_ep_autoconfig (cdev->gadget, &acm_fs_notify_desc);if (!ep) - goto fail; +return -ENODEV ; acm->notify = ep;/* allocate notification */ - acm->notify_req =gs_alloc_req (ep, -sizeof (struct usb_cdc_notification ) +2 , -GFP_KERNEL ); -if (!acm->notify_req) - goto fail; + request =gs_alloc_req (ep, +sizeof (struct usb_cdc_notification ) +2 , +GFP_KERNEL ); +if (!request) +return -ENODEV ; - acm->notify_req->complete = acm_cdc_notify_complete; - acm->notify_req->context = acm; + request->complete = acm_cdc_notify_complete; + request->context = acm;/* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at
@@ -688,7 +690,9 @@ acm_bind(struct usb_configuration *c, st status =usb_assign_descriptors (f, acm_fs_function, acm_hs_function, acm_ss_function, acm_ss_function);if (status) - goto fail; +return status; + + acm->notify_req =no_free_ptr (request); dev_dbg(&cdev->gadget->dev, "acm ttyGS%d: %s speed IN/%s OUT/%s NOTIFY/%s\n",
@@ -698,14 +702,6 @@ acm_bind(struct usb_configuration *c, st acm->port.in->name, acm->port.out->name, acm->notify->name);return 0 ; - -fail: -if (acm->notify_req) -gs_free_req (acm->notify, acm->notify_req); - -ERROR (cdev,"%s/%p: can't bind, err %d\n" , f->name, f, status); - -return status; }static void acm_unbind (struct usb_configuration *c,struct usb_function *f)
Greg Kroah-Hartman
maintainerPATCH 121/123 net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
commit 5b22f62724a0a09e00d301abf5b57b0c12be8a16 upstream.
When bulk delete command is received in the rtnetlink_rcv_msg function, if bulk delete is not supported, module_put is not called to release the reference counting. As a result, module reference count is leaked.
--- net/core/rtnetlink.c | 1 + 1 file changed, 1 insertion(+)
net/core/rtnetlink.c +1 -0
@@ -5664,6 +5664,7 @@ static int rtnetlink_rcv_msg(struct sk_bif (kind ==RTNL_KIND_DEL && (nlh->nlmsg_flags &NLM_F_BULK ) && !(flags &RTNL_FLAG_BULK_DEL_SUPPORTED )) {NL_SET_ERR_MSG (extack,"Bulk delete is not supported" ); +module_put (owner); goto err_unlock; }
Greg Kroah-Hartman
maintainerPATCH 122/123 PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit c93637e6a4c4e1d0e85ef7efac78d066bbb24d96 upstream.
Avoid large backtrace, it is sufficient to warn the user that there has been a link problem. Either the link has failed and the system is in need of maintenance, or the link continues to work and user has been informed. The message from the warning can be looked up in the sources.
This makes an actual link issue less verbose.
First of all, this controller has a limitation in that the controller driver has to assist the hardware with transition to L1 link state by writing L1IATN to PMCTRL register, the L1 and L0 link state switching is not fully automatic on this controller.
In case of an ASMedia ASM1062 PCIe SATA controller which does not support ASPM, on entry to suspend or during platform pm_test, the SATA controller enters D3hot state and the link enters L1 state. If the SATA controller wakes up before rcar_pcie_wakeup() was called and returns to D0, the link returns to L0 before the controller driver even started its transition to L1 link state. At this point, the SATA controller did send an PM_ENTER_L1 DLLP to the PCIe controller and the PCIe controller received it, and the PCIe controller did set PMSR PMEL1RX bit.
Once rcar_pcie_wakeup() is called, if the link is already back in L0 state and PMEL1RX bit is set, the controller driver has no way to determine if it should perform the link transition to L1 state, or treat the link as if it is in L0 state. Currently the driver attempts to perform the transition to L1 link state unconditionally, which in this specific case fails with a PMSR L1FAEG poll timeout, however the link still works as it is already back in L0 state.
Reduce this warning verbosity. In case the link is really broken, the rcar_pcie_config_access() would fail, otherwise it will succeed and any system with this controller and ASM1062 can suspend without generating a backtrace.
--- drivers/pci/controller/pcie-rcar-host.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/pci/controller/pcie-rcar-host.c +5 -1
@@ -87,7 +87,11 @@ static int rcar_pcie_wakeup(struct devicwritel (L1IATN , pcie_base +PMCTLR ); ret =readl_poll_timeout_atomic (pcie_base +PMSR , val, val &L1FAEG ,10 ,1000 ); -WARN (ret,"Timeout waiting for L1 link state, ret=%d\n" , ret); +if (ret) { +dev_warn_ratelimited (pcie_dev, +"Timeout waiting for L1 link state, ret=%d\n" , + ret); + }writel (L1FAEG |PMEL1RX , pcie_base +PMSR ); }
Greg Kroah-Hartman
maintainerPATCH 123/123 RISC-V: Dont fail in riscv_of_parent_hartid() for disabled HARTs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
commit c4676f8dc1e12e68d6511f9ed89707fdad4c962c upstream.
The riscv_of_processor_hartid() used by riscv_of_parent_hartid() fails for HARTs disabled in the DT. This results in the following warning thrown by the RISC-V INTC driver for the E-core on SiFive boards:
[ 0.000000] riscv-intc: unable to find hart id for /cpus/cpu@0/interrupt-controller
The riscv_of_parent_hartid() is only expected to read the hartid from the DT so we directly call of_get_cpu_hwid() instead of calling riscv_of_processor_hartid().
--- arch/riscv/kernel/cpu.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/riscv/kernel/cpu.c +6 -5
@@ -50,13 +50,14 @@ int riscv_of_processor_hartid(struct dev*/ int riscv_of_parent_hartid (struct device_node *node,unsigned long *hartid) { -int rc; -for (; node; node = node->parent) {if (of_device_is_compatible (node,"riscv" )) { - rc =riscv_of_processor_hartid (node, hartid); -if (!rc) -return 0 ; + *hartid = (unsigned long )of_get_cpu_hwid (node,0 ); +if (*hartid == ~0UL ) { +pr_warn ("Found CPU without hart ID\n" ); +return -ENODEV ; + } +return 0 ; } }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.196-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
5.15.196-rc1 built and run on x86_64 test system with no errors or regressions:
Slade
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.196-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
The RISC-V build fails with:
arch/riscv/kernel/cpu.c: In function 'riscv_of_processor_hartid':arch/riscv/kernel/cpu.c:24:33: error: implicit declaration of function 'of_get_cpu_hwid'; did you mean 'of_get_cpu_node'? [-Werror=implicit-function-declaration] 24 | *hart = (unsigned long) of_get_cpu_hwid(node, 0);
| ^~~~~~~~~~~~~~~
| of_get_cpu_node
cc1: some warnings being treated as errors
The function of_get_cpu_hwid() doesn't exist in Linux 5.15.x. It was introduced in 5.16-rc1. The following patches should be reverted:
87b94f8227b3b654ea6e7670cefb32dab0e570ed RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs
568d34c6aafa066bbdb5e7b6aed9c492d81964e8 RISC-V: Don't print details of CPUs disabled in DT
And the stable-dep-of patches for the above should also be reverted since they cause warnings:
989694ece94da2bbae6c6f3f044994302f923cc8 riscv: cpu: Add 64bit hartid support on RV64
8c2544fd913bb7b29ee3af79e0b302036689fe7a RISC-V: Minimal parser for "riscv, isa" strings
e0cc917db8fb7b4881ad3e8feb76cefa06f04fe6 RISC-V: Correctly print supported extensions
c616540d6b67830bb4345130e8fa3d8e217249a0 iscv: Use of_get_cpu_hwid()
Greg Kroah-Hartman
maintainerQuoted 45 lines · Ron Economos
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.196-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
The RISC-V build fails with:
arch/riscv/kernel/cpu.c: In function 'riscv_of_processor_hartid':arch/riscv/kernel/cpu.c:24:33: error: implicit declaration of function 'of_get_cpu_hwid'; did you mean 'of_get_cpu_node'? [-Werror=implicit-function-declaration]
24 | *hart = (unsigned long)of_get_cpu_hwid(node, 0); | ^~~~~~~~~~~~~~~
|of_get_cpu_node
cc1: some warnings being treated as errorsThe function
of_get_cpu_hwid()doesn't exist in Linux 5.15.x. It was introduced in 5.16-rc1. The following patches should be reverted:
87b94f8227b3b654ea6e7670cefb32dab0e570edRISC-V: Don't fail inriscv_of_parent_hartid()for disabled HARTs
568d34c6aafa066bbdb5e7b6aed9c492d81964e8RISC-V: Don't print details of CPUs disabled in DTAnd the stable-dep-of patches for the above should also be reverted since they cause warnings:
989694ece94da2bbae6c6f3f044994302f923cc8riscv: cpu: Add 64bit hartid support on RV64
Quoted 7 lines
8c2544fd913bb7b29ee3af79e0b302036689fe7aRISC-V: Minimal parser for "riscv, isa" strings
e0cc917db8fb7b4881ad3e8feb76cefa06f04fe6RISC-V: Correctly print supported extensions
c616540d6b67830bb4345130e8fa3d8e217249a0iscv: Useof_get_cpu_hwid()
Thanks, I'll go drop all of these and push out a -rc2
greg k-h
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Same problem as 5.10:
arch/riscv/kernel/cpufeature.c: In function 'riscv_fill_hwcap':
2328arch/riscv/kernel/cpufeature.c:107:16: warning: unused variable 'ext_end' [-Wunused-variable] 2329
107 | const char *ext_end = isa;
2330
| ^~~~~~~
2331arch/riscv/kernel/cpu.c: In function 'riscv_of_processor_hartid':
2332arch/riscv/kernel/cpu.c:24:26: error: implicit declaration of function 'of_get_cpu_hwid'; did you mean 'of_get_cpu_node'? [-Werror=implicit-function-declaration] 2333
24 | *hart = (unsigned long) of_get_cpu_hwid(node, 0);
2334
| ^~~~~~~~~~~~~~~
2335
| of_get_cpu_node
2336
CC arch/riscv/kernel/ptrace.o
2337
AR usr/built-in.a
2338
cc1: some warnings being treated as errors
2339
make[2]: *** [scripts/Makefile.build:289: arch/riscv/kernel/cpu.o] Error 1 2340
make[2]: *** Waiting for unfinished jobs
BR,
Pavel
Signature · 2 lines
In cooperation with DENX Software Engineering GmbH, HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.196-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
105 tests: 105 pass, 0 failLinux version: 5.15.196-rc1-g01e66f319490
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/
patch-5.15.196-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.
Quoted 3 lines
thanks,
greg k-h
perf failed to compile with following errors at compilation.
BUILDSTDERR: tests/perf-record.c: In function 'test__PERF_RECORD': BUILDSTDERR: tests/perf-record.c:118:17: error: implicit declaration of function 'evlist__cancel_workload'; did you mean 'evlist__start_workload'? [-Werror=implicit-function-declaration] BUILDSTDERR: 118 | evlist__cancel_workload(evlist); BUILDSTDERR: | ^~~~~~~~~~~~~~~~~~~~~~~ BUILDSTDERR: | evlist__start_workload
There is no definition for evlist__cancel_workload
Following are references of 'evlist__cancel_workload'tools/perf/tests/perf-record.c:118: evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:130: evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:142: evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:155: evlist__cancel_workload(evlist);
Commit which need to be reverted.b7e5c59f3b09 perf test: Don't leak workload gopipe in PERF_RECORD_*
thanks
Vijay
Greg Kroah-Hartman
maintainerQuoted 42 lines · Vijayendra Suman
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/
patch-5.15.196-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.Quoted 3 lines
thanks,
greg k-h
perf failed to compile with following errors at compilation.
BUILDSTDERR:
tests/perf-record.c: In function 'test__PERF_RECORD':
BUILDSTDERR:tests/perf-record.c:118:17: error: implicit declaration of function 'evlist__cancel_workload'; did you mean 'evlist__start_workload'? [-Werror=implicit-function-declaration]BUILDSTDERR: 118 | evlist__cancel_workload(evlist); BUILDSTDERR: | ^~~~~~~~~~~~~~~~~~~~~~~ BUILDSTDERR: | evlist__start_workloadThere is no definition for
evlist__cancel_workloadFollowing are references of '
evlist__cancel_workload'tools/perf/tests/perf-record.c:118:evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:130:evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:142:evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:155:evlist__cancel_workload(evlist);
Quoted 2 lines
Commit which need to be reverted.
b7e5c59f3b09perf test: Don't leak workload gopipe in PERF_RECORD_*
This is already being reverted in the latest -rc release, does that not work here for you?
thanks,
greg k-h
Hi Greg,
Quoted 43 lines · Greg Kroah-Hartman
Quoted 42 lines · Vijayendra Suman
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://urldefense.com/v3/__https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/__;!!ACWV5N9M2RV99hQ!IVHnCNGPANSvr6y0A-odHf0UE4PdtiY7sjGz2BlRApDAo-XoZrirsziXr5syGOL9x2-s6GjtEsk_yVSVuFc7OkW3YM4C$Quoted 8 lines
patch-5.15.196-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
perf failed to compile with following errors at compilation.
BUILDSTDERR:
tests/perf-record.c: In function 'test__PERF_RECORD':
BUILDSTDERR:tests/perf-record.c:118:17: error: implicit declaration of function 'evlist__cancel_workload'; did you mean 'evlist__start_workload'? [-Werror=implicit-function-declaration]BUILDSTDERR: 118 | evlist__cancel_workload(evlist); BUILDSTDERR: | ^~~~~~~~~~~~~~~~~~~~~~~ BUILDSTDERR: | evlist__start_workloadThere is no definition for
evlist__cancel_workloadFollowing are references of '
evlist__cancel_workload'tools/perf/tests/perf-record.c:118:evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:130:evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:142:evlist__cancel_workload(evlist);tools/perf/tests/perf-record.c:155:evlist__cancel_workload(evlist);
Quoted 5 lines
Quoted 2 lines
Commit which need to be reverted.
b7e5c59f3b09perf test: Don't leak workload gopipe in PERF_RECORD_*This is already being reverted in the latest -rc release, does that not work here for you?
I think saw, this error on v5.15.196-rc1, When I rechecked on v5.15.196-rc2, It was fixed as "perf test: Don't leak workload gopipe in PERF_RECORD_*" was reverted, had confirmed same on revert of rc2 release.
Quoted 4 lines
thanks,
greg k-h
thanks,
Vijay
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.196 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.196-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah