5.4.301-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.4.301-rc1 review
This is the start of the stable review cycle for the 5.4.301 release. There are 224 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.301-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.301-rc1
Zhengchao Shao <[email protected]>
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
Arnd Bergmann <[email protected]>
media: s5p-mfc: remove an unused/uninitialized variable
Sergey Bashirov <[email protected]>
NFSD: Fix last write offset handling in layoutcommit
Sergey Bashirov <[email protected]>
NFSD: Minor cleanup in layoutcommit processing
Xiao Liang <[email protected]>
padata: Reset next CPU when reorder sequence wraps around
Eric Biggers <[email protected]>
KEYS: trusted_tpm1: Compare HMAC values in constant time
Chuck Lever <[email protected]>
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
Jan Kara <[email protected]>
vfs: Don't leak disconnected dentries on umount
Zhang Yi <[email protected]>
jbd2: ensure that all ongoing I/O complete before freeing blocks
Deepanshu Kartikey <[email protected]>
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
Gui-Dong Han <[email protected]>
drm/amdgpu: use atomic functions with memory barriers for vm fault info
Theodore Ts'o <[email protected]>
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before DAC access
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before INDAC access
Zhen Ni <[email protected]>
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
Krzysztof Kozlowski <[email protected]>
memory: samsung: exynos-srom: Correct alignment
Mark Rutland <[email protected]>
arm64: errata: Apply workarounds for Neoverse-V3AE
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-V3AE definitions
Deepanshu Kartikey <[email protected]>
comedi: fix divide-by-zero in comedi_buf_munge()
Alice Ryhl <[email protected]>
binder: remove "invalid inc weak" check
Mathias Nyman <[email protected]>
xhci: dbc: enable back DbC in resume if it was enabled before suspend
Tim Guttzeit <[email protected]>
usb/core/quirks: Add Huawei ME906S to wakeup quirk
LI Qingwu <[email protected]>
USB: serial: option: add Telit FN920C04 ECM compositions
Reinhard Speyerer <[email protected]>
USB: serial: option: add Quectel RG255C
Renjun Wang <[email protected]>
USB: serial: option: add UNISOC UIS7720
Lad Prabhakar <[email protected]>
net: ravb: Ensure memory write completes before ringing TX doorbell
Michal Pecio <[email protected]>
net: usb: rtl8150: Fix frame padding
Deepanshu Kartikey <[email protected]>
ocfs2: clear extent cache after moving/defragmenting extents
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
Rafael J. Wysocki <[email protected]>
Revert "cpuidle: menu: Avoid discarding useful information"
Tonghao Zhang <[email protected]>
net: bonding: fix possible peer notify event loss or dup issue
Alexey Simakov <[email protected]>
sctp: avoid NULL dereference when chunk data buffer is missing
Huang Ying <[email protected]>
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
Wei Fang <[email protected]>
net: enetc: correct the value of ENETC_RXB_TRUESIZE
Johannes Wiesböck <[email protected]>
rtnetlink: Allow deleting FDB entries in user namespace
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
Nikolay Aleksandrov <[email protected]>
net: add ndo_fdb_del_bulk
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add bulk delete support flag
Nikolay Aleksandrov <[email protected]>
net: netlink: add NLM_F_BULK delete request modifier
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: use BIT for flag values
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add helper to extract msg type's kind
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add msg kind names
Colin Ian King <[email protected]>
net: rtnetlink: remove redundant assignment to variable err
Geert Uytterhoeven <[email protected]>
m68k: bitops: Fix find_*_bit() signatures
Yangtao Li <[email protected]>
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
Viacheslav Dubeyko <[email protected]>
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
Alexander Aring <[email protected]>
dlm: check for defined force value in dlm_lockspace_release
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
Yang Chenzhi <[email protected]>
hfs: validate record offset in hfsplus_bmap_alloc
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
Viacheslav Dubeyko <[email protected]>
hfs: make proper initalization of struct hfs_find_data
Viacheslav Dubeyko <[email protected]>
hfs: clear offset and space out of valid records in b-tree node
Xichao Zhao <[email protected]>
exec: Fix incorrect type for ret
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
Randy Dunlap <[email protected]>
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
Vincent Guittot <[email protected]>
sched/fair: Fix pelt lost idle time detection
Ingo Molnar <[email protected]>
sched/balancing: Rename newidle_balance() => sched_balance_newidle()
Barry Song <[email protected]>
sched/fair: Trivial correction of the newidle_balance() comment
Chen Yu <[email protected]>
sched: Make newidle_balance() static again
Sabrina Dubroca <[email protected]>
tls: don't rely on tx_work during send()
Sabrina Dubroca <[email protected]>
tls: always set record_type in tls_process_cmsg
Alexey Simakov <[email protected]>
tg3: prevent use of uninitialized remote_adv and local_adv variables
Eric Dumazet <[email protected]>
tcp: fix tcp_tso_should_defer() vs large RTT
Raju Rangoju <[email protected]>
amd-xgbe: Avoid spurious link down messages during interface toggle
Dmitry Safonov <[email protected]>
net/ip6_tunnel: Prevent perpetual tunnel growth
Yeounsu Moon <[email protected]>
net: dlink: handle dma_map_single() failure properly
Christophe JAILLET <[email protected]>
net: dl2k: switch from 'pci_' to 'dma_' API
Thomas Fourier <[email protected]>
media: pci: ivtv: Add missing check after DMA map
Christophe JAILLET <[email protected]>
media: pci/ivtv: switch from 'pci_' to 'dma_' API
Jason Andryuk <[email protected]>
xen/events: Update virq_to_irq on migration
Ma Ke <[email protected]>
media: lirc: Fix error handling in lirc_register()
keliu <[email protected]>
media: rc: Directly use ida_free()
Kaustabh Chakraborty <[email protected]>
drm/exynos: exynos7_drm_decon: remove ctx->suspended
Anderson Nascimento <[email protected]>
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
Jisheng Zhang <[email protected]>
pwm: berlin: Fix wrong register in suspend/resume
Thomas Fourier <[email protected]>
media: cx18: Add missing check after DMA map
Jason Andryuk <[email protected]>
xen/events: Cleanup find_virq() return codes
Tetsuo Handa <[email protected]>
cramfs: Verify inode mode when loading from disk
Lichen Liu <[email protected]>
fs: Add 'initramfs_options' to set initramfs mount options
gaoxiang17 <[email protected]>
pid: Add a judgment for ns null in pid_nr_ns
Tetsuo Handa <[email protected]>
minixfs: Verify inode mode when loading from disk
Yuan Chen <[email protected]>
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
Zheng Qixing <[email protected]>
dm: fix NULL pointer dereference in __dm_suspend()
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
Phillip Lougher <[email protected]>
Squashfs: reject negative file sizes in squashfs_read_inode()
Phillip Lougher <[email protected]>
Squashfs: add additional inode sanity checking
Edward Adam Davis <[email protected]>
media: mc: Clear minor number before put device
Bartosz Golaszewski <[email protected]>
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
Larshin Sergey <[email protected]>
fs: udf: fix OOB read in lengthAllocDescs handling
Sean Christopherson <[email protected]>
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
Nalivayko Sergey <[email protected]>
net/9p: fix double req put in p9_fd_cancelled
Ahmet Eray Karadag <[email protected]>
ext4: guard against EA inode refcount underflow in xattr update
Ojaswin Mujoo <[email protected]>
ext4: correctly handle queries for metadata mappings
Yongjian Sun <[email protected]>
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
Olga Kornievskaia <[email protected]>
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
Sean Christopherson <[email protected]>
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
Sean Christopherson <[email protected]>
x86/umip: Check that the instruction opcode is at least two bytes
Siddharth Vadapalli <[email protected]>
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
Niklas Schnelle <[email protected]>
PCI/AER: Fix missing uevent on recovery when a reset is requested
Niklas Schnelle <[email protected]>
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
Sean Christopherson <[email protected]>
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
Esben Haabendal <[email protected]>
rtc: interface: Fix long-standing race when setting alarm
Esben Haabendal <[email protected]>
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
Rex Chen <[email protected]>
mmc: core: SPI mode remove cmd7
Linus Walleij <[email protected]>
mtd: rawnand: fsmc: Default to autodetect buswidth
Ma Ke <[email protected]>
sparc: fix error handling in scan_one_device()
Anthony Yznaga <[email protected]>
sparc64: fix hugetlb for sun4u
Eric Biggers <[email protected]>
sctp: Fix MAC comparison to be constant-time
Thorsten Blum <[email protected]>
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
Sam James <[email protected]>
parisc: don't reference obsolete termio struct for TC* constants
Johan Hovold <[email protected]>
lib/genalloc: fix device leak in of_gen_pool_get()
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix prescaler usage.
Qianfeng Rong <[email protected]>
iio: dac: ad5421: use int type to store negative error codes
Qianfeng Rong <[email protected]>
iio: dac: ad5360: use int type to store negative error codes
Thomas Fourier <[email protected]>
crypto: atmel - Fix dma_unmap_sg() direction
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Shuhao Fu <[email protected]>
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
Qianfeng Rong <[email protected]>
media: i2c: mt9v111: fix incorrect type for ret
Johan Hovold <[email protected]>
firmware: meson_sm: fix device leak at probe
Lukas Wunner <[email protected]>
xen/manage: Fix suspend error path
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Add missing MDSS reset
Amir Mohammad Jahangirzad <[email protected]>
ACPI: debug: fix signedness issues in read/write helpers
Daniel Tang <[email protected]>
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
Gunnar Kudrjavets <[email protected]>
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
Lino Sanfilippo <[email protected]>
tpm, tpm_tis: Claim locality before writing interrupt registers
Herbert Xu <[email protected]>
crypto: essiv - Check ssize for decryption and in-place encryption
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
Leo Yan <[email protected]>
tools build: Align warning options with perf
Erick Karanja <[email protected]>
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Kuniyuki Iwashima <[email protected]>
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Alexandr Sapozhnikov <[email protected]>
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Use-after-free in validation
Dan Carpenter <[email protected]>
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
Duoming Zhou <[email protected]>
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
John Garry <[email protected]>
scsi: mvsas: Use sas_task_find_rq() for tagging
John Garry <[email protected]>
scsi: mvsas: Delete mvs_tag_init()
John Garry <[email protected]>
scsi: libsas: Add sas_task_find_rq()
Alok Tiwari <[email protected]>
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
Brian Masney <[email protected]>
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
Leo Yan <[email protected]>
perf session: Fix handling when buffer exceeds 2 GiB
Rob Herring (Arm) <[email protected]>
rtc: x1205: Fix Xicor X1205 vendor prefix
Yunseong Kim <[email protected]>
perf util: Fix compression checks returning -1 as bool
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
Zhen Ni <[email protected]>
clocksource/drivers/clps711x: Fix resource leaks in error paths
Bartosz Golaszewski <[email protected]>
pinctrl: check the return value of pinmux_ops::get_function_name()
Zhen Ni <[email protected]>
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
Yang Shi <[email protected]>
mm: hugetlb: avoid soft lockup when mprotect to large memory area
Naman Jain <[email protected]>
uio_hv_generic: Let userspace take care of interrupt mask
Phillip Lougher <[email protected]>
Squashfs: fix uninit-value in squashfs_get_parent
Jakub Kicinski <[email protected]>
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Kohei Enju <[email protected]>
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Kohei Enju <[email protected]>
nfp: fix RSS hash key size when RSS is not supported
Donet Tom <[email protected]>
drivers/base/node: fix double free in register_one_node()
Dan Carpenter <[email protected]>
ocfs2: fix double free in user_cluster_connect()
I Viswanath <[email protected]>
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
Bernard Metzler <[email protected]>
RDMA/siw: Always report immediate post SQ errors
Cristian Ciocaltea <[email protected]>
usb: vhci-hcd: Prevent suspending virtually attached devices
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
Slavin Liu <[email protected]>
ipvs: Defer ip_vs_ftp unregister during netns cleanup
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix backchannel max_resp_sz verification check
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
Baochen Qiang <[email protected]>
wifi: ath10k: avoid unnecessary wait for service ready message
Vlad Dumitrescu <[email protected]>
IB/sa: Fix sa_local_svc_timeout_ms read race
Parav Pandit <[email protected]>
RDMA/core: Resolve MAC of next-hop device without ARP support
Abdun Nihaal <[email protected]>
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
Donet Tom <[email protected]>
drivers/base/node: handle error properly in register_one_node()
Christophe Leroy <[email protected]>
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
Zhen Ni <[email protected]>
netfilter: ipset: Remove unused htable_bits in macro ahash_region
Hans de Goede <[email protected]>
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
Takashi Iwai <[email protected]>
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
Takashi Iwai <[email protected]>
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
Takashi Iwai <[email protected]>
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
Wang Liang <[email protected]>
pps: fix warning in pps_register_cdev when register device fail
Colin Ian King <[email protected]>
misc: genwqe: Fix incorrect cmd field being reported in error
William Wu <[email protected]>
usb: gadget: configfs: Correctly set use_os_string at bind
Xichao Zhao <[email protected]>
usb: phy: twl6030: Fix incorrect type for ret
Eric Dumazet <[email protected]>
tcp: fix __tcp_close() to only send RST when required
Alok Tiwari <[email protected]>
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
Stefan Kerkmann <[email protected]>
wifi: mwifiex: send world regulatory domain to driver
Qianfeng Rong <[email protected]>
ALSA: lx_core: use int type to store negative error codes
Zhang Shurong <[email protected]>
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
Thomas Fourier <[email protected]>
scsi: myrs: Fix dma_alloc_coherent() error check
Niklas Cassel <[email protected]>
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
Dan Carpenter <[email protected]>
serial: max310x: Add error checking in probe()
Dan Carpenter <[email protected]>
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
Brahmajit Das <[email protected]>
drm/radeon/r600_cs: clean up of dead code in r600_cs
Kunihiko Hayashi <[email protected]>
i2c: designware: Add disabling clocks when probe fails
Leilk.Liu <[email protected]>
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
Paul Chaignon <[email protected]>
bpf: Explicitly check accesses to bpf_sock_addr
Akhilesh Patil <[email protected]>
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
Uwe Kleine-König <[email protected]>
pwm: tiehrpwm: Fix corner case in clock divisor calculation
Qianfeng Rong <[email protected]>
block: use int to store blk_stack_limits() return value
Li Nan <[email protected]>
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
Da Xue <[email protected]>
pinctrl: meson-gxl: add missing i2c_d pinmux
Sneh Mankad <[email protected]>
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
Huisong Li <[email protected]>
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
Geert Uytterhoeven <[email protected]>
regmap: Remove superfluous check for !config in __regmap_init()
Uros Bizjak <[email protected]>
x86/vdso: Fix output operand size of RDPID
Leo Yan <[email protected]>
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
Rafael J. Wysocki <[email protected]>
driver core/PM: Set power.no_callbacks along with power.no_pm
Ovidiu Panait <[email protected]>
staging: axis-fifo: flush RX FIFO on read errors
Ovidiu Panait <[email protected]>
staging: axis-fifo: fix maximum TX packet length check
hupu <[email protected]>
perf subcmd: avoid crash in exclude_cmds when excludes is empty
Mikulas Patocka <[email protected]>
dm-integrity: limit MAX_TAG_SIZE to 255
Bitterblue Smith <[email protected]>
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
Xiaowei Li <[email protected]>
USB: serial: option: add SIMCom 8230C compositions
Larshin Sergey <[email protected]>
media: rc: fix races with imon_disconnect()
Tetsuo Handa <[email protected]>
media: imon: grab lock earlier in imon_ir_change_protocol()
Tetsuo Handa <[email protected]>
media: imon: reorganize serialization
Flavius Georgescu <[email protected]>
media: rc: Add support for another iMON 0xffdc device
Duoming Zhou <[email protected]>
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
Duoming Zhou <[email protected]>
media: tuner: xc5000: Fix use-after-free in xc5000_release
Ricardo Ribalda <[email protected]>
media: tunner: xc5000: Refactor firmware load
Kuniyuki Iwashima <[email protected]>
udp: Fix memory accounting leak.
Duoming Zhou <[email protected]>
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Wang Haoran <[email protected]>
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + Documentation/arm64/silicon-errata.rst | 2 + Makefile | 4 +- arch/arm64/Kconfig | 1 + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/pgtable.h | 3 +- arch/arm64/kernel/cpu_errata.c | 1 + arch/m68k/include/asm/bitops.h | 25 +-- arch/mips/mti-malta/malta-setup.c | 2 +- arch/parisc/include/uapi/asm/ioctls.h | 8 +- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + arch/sparc/lib/M7memcpy.S | 20 +-- arch/sparc/lib/Memcpy_utils.S | 9 + arch/sparc/lib/NG4memcpy.S | 2 +- arch/sparc/lib/NGmemcpy.S | 29 ++-- arch/sparc/lib/U1memcpy.S | 19 ++- arch/sparc/lib/U3memcpy.S | 2 +- arch/sparc/mm/hugetlbpage.c | 20 +++ arch/x86/include/asm/kvm_emulate.h | 2 +- arch/x86/include/asm/segment.h | 8 +- arch/x86/kernel/umip.c | 15 +- arch/x86/kvm/emulate.c | 10 +- arch/x86/kvm/x86.c | 9 +- block/blk-mq-sysfs.c | 6 +- block/blk-settings.c | 3 +- crypto/essiv.c | 14 +- drivers/acpi/acpi_dbg.c | 26 +-- drivers/acpi/acpi_tad.c | 3 + drivers/acpi/processor_idle.c | 3 + drivers/android/binder.c | 11 +- drivers/base/node.c | 4 + drivers/base/regmap/regmap.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 26 +-- drivers/clk/nxp/clk-lpc18xx-cgu.c | 20 ++- drivers/clocksource/clps711x-timer.c | 23 ++- drivers/cpufreq/intel_pstate.c | 8 +- drivers/cpuidle/governors/menu.c | 21 +-- drivers/crypto/atmel-tdes.c | 2 +- drivers/firmware/meson/meson_sm.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 +- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 7 +- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 ---- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/radeon/r600_cs.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +- drivers/i2c/busses/i2c-designware-platdrv.c | 1 + drivers/i2c/busses/i2c-mt65xx.c | 17 +- drivers/iio/dac/ad5360.c | 2 +- drivers/iio/dac/ad5421.c | 2 +- drivers/iio/frequency/adf4350.c | 20 ++- drivers/iio/inkern.c | 2 +- drivers/infiniband/core/addr.c | 10 +- drivers/infiniband/core/sa_query.c | 6 +- drivers/infiniband/sw/siw/siw_verbs.c | 25 +-- drivers/input/misc/uinput.c | 1 + drivers/mailbox/zynqmp-ipi-mailbox.c | 7 +- drivers/md/dm-integrity.c | 2 +- drivers/md/dm.c | 7 +- drivers/media/i2c/mt9v111.c | 2 +- drivers/media/i2c/rj54n1cb0c.c | 9 +- drivers/media/i2c/tc358743.c | 4 +- drivers/media/mc/mc-devnode.c | 6 +- drivers/media/pci/b2c2/flexcop-pci.c | 2 +- drivers/media/pci/cx18/cx18-queue.c | 12 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-queue.c | 18 +- drivers/media/pci/ivtv/ivtv-streams.c | 22 +-- drivers/media/pci/ivtv/ivtv-udma.c | 19 ++- drivers/media/pci/ivtv/ivtv-yuv.c | 18 +- drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c | 35 ++-- drivers/media/rc/imon.c | 189 +++++++++++++-------- drivers/media/rc/lirc_dev.c | 15 +- drivers/media/rc/rc-main.c | 6 +- drivers/media/tuners/xc5000.c | 41 ++--- drivers/memory/samsung/exynos-srom.c | 32 ++-- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 5 +- drivers/mfd/vexpress-sysreg.c | 6 +- drivers/misc/genwqe/card_ddcb.c | 2 +- drivers/mmc/core/sdio.c | 6 +- drivers/mtd/nand/raw/fsmc_nand.c | 6 +- drivers/mtd/spi-nor/cadence-quadspi.c | 5 + drivers/net/bonding/bond_main.c | 40 ++--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + drivers/net/ethernet/broadcom/tg3.c | 5 +- drivers/net/ethernet/dlink/dl2k.c | 99 ++++++----- drivers/net/ethernet/freescale/enetc/enetc.h | 2 +- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 -- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 17 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 8 + drivers/net/usb/rtl8150.c | 13 +- drivers/net/wireless/ath/ath10k/wmi.c | 39 +++-- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- .../net/wireless/realtek/rtlwifi/rtl8192cu/sw.c | 1 - drivers/pci/controller/dwc/pci-keystone.c | 4 +- drivers/pci/controller/pci-tegra.c | 2 +- drivers/pci/iov.c | 5 + drivers/pci/pci-driver.c | 1 + drivers/perf/arm_spe_pmu.c | 3 +- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++ drivers/pinctrl/pinmux.c | 2 +- drivers/pps/kapi.c | 5 +- drivers/pps/pps.c | 5 +- drivers/pwm/pwm-berlin.c | 4 +- drivers/pwm/pwm-tiehrpwm.c | 4 +- drivers/remoteproc/qcom_q6v5.c | 3 - drivers/rtc/interface.c | 27 +++ drivers/rtc/rtc-x1205.c | 2 +- drivers/scsi/hpsa.c | 21 ++- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 13 +- drivers/scsi/mvsas/mv_sas.c | 42 ++--- drivers/scsi/mvsas/mv_sas.h | 8 +- drivers/scsi/myrs.c | 8 +- drivers/scsi/pm8001/pm8001_sas.c | 9 +- drivers/soc/qcom/rpmh-rsc.c | 7 +- drivers/staging/axis-fifo/axis-fifo.c | 32 ++-- drivers/staging/comedi/comedi_buf.c | 2 +- drivers/target/target_core_configfs.c | 2 +- drivers/tty/serial/max310x.c | 2 + drivers/uio/uio_hv_generic.c | 7 +- drivers/usb/core/quirks.c | 2 + drivers/usb/gadget/configfs.c | 2 + drivers/usb/host/max3421-hcd.c | 2 +- drivers/usb/host/xhci-dbgcap.c | 9 +- drivers/usb/phy/phy-twl6030-usb.c | 3 +- drivers/usb/serial/option.c | 16 ++ drivers/usb/usbip/vhci_hcd.c | 22 +++ drivers/watchdog/mpc8xxx_wdt.c | 2 + drivers/xen/events/events_base.c | 25 ++- drivers/xen/manage.c | 3 +- fs/btrfs/export.c | 8 +- fs/cramfs/inode.c | 11 +- fs/dcache.c | 2 + fs/dlm/lockspace.c | 2 +- fs/exec.c | 2 +- fs/ext4/fsmap.c | 14 +- fs/ext4/inode.c | 18 +- fs/ext4/super.c | 10 +- fs/ext4/xattr.c | 15 +- fs/hfs/bfind.c | 8 +- fs/hfs/brec.c | 27 ++- fs/hfs/mdb.c | 2 +- fs/hfsplus/bfind.c | 8 +- fs/hfsplus/bnode.c | 41 ----- fs/hfsplus/btree.c | 6 + fs/hfsplus/hfsplus_fs.h | 42 +++++ fs/hfsplus/super.c | 25 ++- fs/hfsplus/unicode.c | 24 +++ fs/jbd2/transaction.c | 13 +- fs/minix/inode.c | 8 +- fs/namespace.c | 11 +- fs/nfs/nfs4proc.c | 2 +- fs/nfsd/blocklayout.c | 5 +- fs/nfsd/flexfilelayout.c | 8 + fs/nfsd/lockd.c | 15 ++ fs/nfsd/nfs4proc.c | 34 ++-- fs/ocfs2/move_extents.c | 5 + fs/ocfs2/stack_user.c | 1 + fs/squashfs/inode.c | 31 +++- fs/squashfs/squashfs_fs_i.h | 2 +- fs/udf/inode.c | 3 + include/linux/device.h | 3 + include/linux/iio/frequency/adf4350.h | 2 +- include/linux/netdevice.h | 9 + include/net/ip_tunnels.h | 15 ++ include/net/rtnetlink.h | 16 +- include/scsi/libsas.h | 18 ++ include/uapi/linux/netlink.h | 1 + kernel/padata.c | 6 +- kernel/pid.c | 2 +- kernel/sched/fair.c | 38 +++-- kernel/sched/sched.h | 4 - kernel/trace/trace_kprobe.c | 11 +- kernel/trace/trace_probe.h | 9 +- kernel/trace/trace_uprobe.c | 12 +- lib/genalloc.c | 5 +- mm/hugetlb.c | 2 + net/9p/trans_fd.c | 8 +- net/core/filter.c | 16 +- net/core/rtnetlink.c | 89 +++++++--- net/ipv4/ip_tunnel.c | 14 -- net/ipv4/tcp.c | 9 +- net/ipv4/tcp_input.c | 1 - net/ipv4/tcp_output.c | 19 ++- net/ipv4/udp.c | 16 +- net/ipv6/ip6_tunnel.c | 3 +- net/netfilter/ipset/ip_set_hash_gen.h | 8 +- net/netfilter/ipvs/ip_vs_ftp.c | 4 +- net/sctp/inqueue.c | 13 +- net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/tls/tls_main.c | 7 +- net/tls/tls_sw.c | 13 ++ security/keys/trusted.c | 7 +- sound/firewire/amdtp-stream.h | 2 +- sound/pci/lx6464es/lx_core.c | 4 +- sound/soc/intel/boards/bytcht_es8316.c | 20 ++- sound/soc/intel/boards/bytcr_rt5640.c | 7 +- sound/soc/intel/boards/bytcr_rt5651.c | 26 ++- tools/build/feature/Makefile | 4 +- tools/lib/subcmd/help.c | 3 + tools/perf/util/lzma.c | 2 +- tools/perf/util/session.c | 2 +- tools/perf/util/zlib.c | 2 +- tools/testing/selftests/rseq/rseq.c | 8 +- tools/testing/selftests/watchdog/watchdog-test.c | 6 + 217 files changed, 1530 insertions(+), 941 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/224 scsi: target: target_core_configfs: Add length check to avoid buffer overflow
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Haoran <[email protected]>
commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream.
A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes).
snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes.
Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error.
An additional check of the return value of snprintf() can avoid this buffer overflow.
--- drivers/target/target_core_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/target_core_configfs.c +1 -1
@@ -2563,7 +2563,7 @@ static ssize_t target_lu_gp_members_show config_item_name(&dev->dev_group.cg_item)); cur_len++;/* Extra byte for NULL terminator */ -if ((cur_len + len) >PAGE_SIZE ) { +if ((cur_len + len) >PAGE_SIZE || cur_len >LU_GROUP_NAME_BUF ) {pr_warn ("Ran out of lu_gp_show_attr" "_members buffer\n" );break ;
Greg Kroah-Hartman
maintainerPATCH 2/224 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
commit 01e03fb7db419d39e18d6090d4873c1bff103914 upstream.
The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
flexcop_pci_remove() | flexcop_pci_irq_check_work()
cancel_delayed_work() |
flexcop_device_kfree(fc_pci->fc_dev) |
| fc = fc_pci->fc_dev; // UAFThis is confirmed by a KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 135: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work has finished before the device memory is deallocated.
This bug was initially identified through static analysis. To reproduce and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced artificial delays within the flexcop_pci_irq_check_work() function to increase the likelihood of triggering the bug.
--- drivers/media/pci/b2c2/flexcop-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/b2c2/flexcop-pci.c +1 -1
@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pcstruct flexcop_pci *fc_pci =pci_get_drvdata (pdev);if (irq_chk_intv >0 ) -cancel_delayed_work (&fc_pci->irq_check_work); +cancel_delayed_work_sync (&fc_pci->irq_check_work);flexcop_pci_dma_exit (fc_pci);flexcop_device_exit (fc_pci->fc_dev);
Greg Kroah-Hartman
maintainerPATCH 3/224 udp: Fix memory accounting leak.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit df207de9d9e7a4d92f8567e2c539d9c8c12fd99d upstream.
Matt Dowling reported a weird UDP memory usage issue.
Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288 pages and never dropped. Moreover, the value doubled when the application was terminated. Finally, it caused intermittent packet drops.
We can reproduce the issue with the script below [0]:
1. /proc/net/sockstat reports 0 pages
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 02. Run the script till the report reaches 524,288
# python3 test.py & sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 3 mem 524288 <-- (INT_MAX + 1) >> PAGE_SHIFT3. Kill the socket and confirm the number never drops
# pkill python3 && sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 524288 4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()
# python3 test.py & sleep 1 && pkill python3
5. The number doubles
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 1048577The application set INT_MAX to SO_RCVBUF, which triggered an integer overflow in udp_rmem_release().
When a socket is close()d, udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable.
The total size is then passed to udp_rmem_release() to adjust memory accounting. However, because the function takes a signed integer argument, the total size can wrap around, causing an overflow.
Then, the released amount is calculated as follows:
1) Add size to sk->sk_forward_alloc.
2) Round down sk->sk_forward_alloc to the nearest lower multiple of PAGE_SIZE and assign it to amount.
3) Subtract amount from sk->sk_forward_alloc.
4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().
When the issue occurred, the total in udp_destruct_common() was 2147484480 (INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().
At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and
2) sets -2147479552 to amount. 3) reverts the wraparound, so we don't see a warning in inet_sock_destruct(). However, udp_memory_allocated ends up doubling at 4).
Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for memory_allocated"), memory usage no longer doubles immediately after a socket is close()d because __sk_mem_reduce_allocated() caches the amount in udp_memory_per_cpu_fw_alloc. However, the next time a UDP socket receives a packet, the subtraction takes effect, causing UDP memory usage to double.
This issue makes further memory allocation fail once the socket's sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet drops.
To prevent this issue, let's use unsigned int for the calculation and call sk_forward_alloc_add() only once for the small delta.
Note that first_packet_length() also potentially has the same problem.
[0]:
from socket import *
SO_RCVBUFFORCE = 33INT_MAX = (2 ** 31) - 1
s = socket(AF_INET, SOCK_DGRAM)s.bind(('', 0))s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)
c = socket(AF_INET, SOCK_DGRAM)
c.connect(s.getsockname())
data = b'a' * 100
while True:
c.send(data)
--- net/ipv4/udp.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
net/ipv4/udp.c +7 -9
@@ -1371,12 +1371,12 @@ static bool udp_skb_has_head_state(struc }/* fully reclaim rmem/fwd memory allocated for skb */ -static void udp_rmem_release (struct sock *sk,int size,int partial, -bool rx_queue_lock_held) +static void udp_rmem_release (struct sock *sk,unsigned int size, +int partial,bool rx_queue_lock_held) {struct udp_sock *up =udp_sk (sk);struct sk_buff_head *sk_queue; -int amt; +unsigned int amt;if (likely (partial)) { up->forward_deficit += size;
@@ -1396,10 +1396,8 @@ static void udp_rmem_release(struct sockif (!rx_queue_lock_held)spin_lock (&sk_queue->lock); - - sk->sk_forward_alloc += size; - amt = (sk->sk_forward_alloc - partial) & ~(SK_MEM_QUANTUM -1 ); - sk->sk_forward_alloc -= amt; + amt = (size + sk->sk_forward_alloc - partial) & ~(PAGE_SIZE -1 ); + sk->sk_forward_alloc += size - amt;if (amt)__sk_mem_reduce_allocated (sk, amt >>SK_MEM_QUANTUM_SHIFT );
@@ -1583,7 +1581,7 @@ EXPORT_SYMBOL_GPL(skb_consume_udp);static struct sk_buff *__first_packet_length (struct sock *sk,struct sk_buff_head *rcvq, -int *total) +unsigned int *total) {struct sk_buff *skb;
@@ -1616,8 +1614,8 @@ static int first_packet_length(struct so {struct sk_buff_head *rcvq = &udp_sk (sk)->reader_queue;struct sk_buff_head *sk_queue = &sk->sk_receive_queue; +unsigned int total =0 ;struct sk_buff *skb; -int total =0 ;int res;spin_lock_bh (&rcvq->lock);
Greg Kroah-Hartman
maintainerPATCH 4/224 media: tunner: xc5000: Refactor firmware load
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 8e1f5da59dd4a1966f859639860b803a7e8b8bfb ]
Make sure the firmware is released when we leavexc_load_fw_and_init_tuner()
This change makes smatch happy:drivers/media/tuners/xc5000.c:1213 xc_load_fw_and_init_tuner() warn: 'fw' from request_firmware() not released on lines: 1213.
Stable-dep-of: 40b7a19f321e ("media: tuner: xc5000: Fix use-after-free in xc5000_release")
--- drivers/media/tuners/xc5000.c | 41 ++++++++++++++++++----------------------- 1 file changed, 18 insertions(+), 23 deletions(-)
drivers/media/tuners/xc5000.c +18 -23
@@ -58,7 +58,7 @@ struct xc5000_priv {struct dvb_frontend *fe;struct delayed_work timer_sleep; -const struct firmware *firmware; +bool inited; };/* Misc Defines */
@@ -1110,23 +1110,19 @@ static int xc_load_fw_and_init_tuner(strif (!force &&xc5000_is_firmware_loaded (fe) ==0 )return 0 ; -if (!priv->firmware) { - ret =request_firmware (&fw, desired_fw->name, - priv->i2c_props.adap->dev.parent); -if (ret) { -pr_err ("xc5000: Upload failed. rc %d\n" , ret); -return ret; - } -dprintk (1 ,"firmware read %zu bytes.\n" , fw->size); - -if (fw->size != desired_fw->size) { -pr_err ("xc5000: Firmware file with incorrect size\n" ); -release_firmware (fw); -return -EINVAL ; - } - priv->firmware = fw; - }else - fw = priv->firmware; + ret =request_firmware (&fw, desired_fw->name, + priv->i2c_props.adap->dev.parent); +if (ret) { +pr_err ("xc5000: Upload failed. rc %d\n" , ret); +return ret; + } +dprintk (1 ,"firmware read %zu bytes.\n" , fw->size); + +if (fw->size != desired_fw->size) { +pr_err ("xc5000: Firmware file with incorrect size\n" ); +release_firmware (fw); +return -EINVAL ; + }/* Try up to 5 times to load firmware */ for (i =0 ; i <5 ; i++) {
@@ -1204,6 +1200,7 @@ static int xc_load_fw_and_init_tuner(str } err: +release_firmware (fw);if (!ret)printk (KERN_INFO "xc5000: Firmware %s loaded and running.\n" , desired_fw->name);
@@ -1274,7 +1271,7 @@ static int xc5000_resume(struct dvb_fron/* suspended before firmware is loaded. Avoid firmware load in resume path. */ -if (!priv->firmware) +if (!priv->inited)return 0 ;return xc5000_set_params (fe);
@@ -1293,6 +1290,8 @@ static int xc5000_init(struct dvb_fronteif (debug)xc_debug_dump (priv); + priv->inited = true; +return 0 ; }
@@ -1306,10 +1305,6 @@ static void xc5000_release(struct dvb_frif (priv) {cancel_delayed_work (&priv->timer_sleep); -if (priv->firmware) { -release_firmware (priv->firmware); - priv->firmware =NULL ; - }hybrid_tuner_release_state (priv); }
Greg Kroah-Hartman
maintainerPATCH 5/224 media: tuner: xc5000: Fix use-after-free in xc5000_release
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 40b7a19f321e65789612ebaca966472055dab48c ]
The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv.
A typical race condition is illustrated below:
CPU 0 (release thread) | CPU 1 (delayed work callback)
xc5000_release() | xc5000_do_timer_sleep()
cancel_delayed_work() |
hybrid_tuner_release_state(priv) |
kfree(priv) |
| priv = container_of() // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated.
A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here.
This bug was initially identified through static analysis.
--- drivers/media/tuners/xc5000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/tuners/xc5000.c +1 -1
@@ -1304,7 +1304,7 @@ static void xc5000_release(struct dvb_frmutex_lock (&xc5000_list_mutex);if (priv) { -cancel_delayed_work (&priv->timer_sleep); +cancel_delayed_work_sync (&priv->timer_sleep);hybrid_tuner_release_state (priv); }
Greg Kroah-Hartman
maintainerPATCH 6/224 media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 79d10f4f21a92e459b2276a77be62c59c1502c9d ]
The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming itself. Using timer_delete() fails to guarantee the timer isn't still running when destroyed, similarly cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has terminated if already executing. During probe failure after timer initialization, these may continue running as orphans and reference the already-freed tc358743_state object through tc358743_irq_poll_timer.
The following is the trace captured by KASAN.
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800ded83c8 by task swapper/1/0 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
Allocated by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Replace timer_delete() with timer_delete_sync() and cancel_delayed_work() with cancel_delayed_work_sync() to ensure proper termination of timer and work items before resource cleanup.
This bug was initially identified through static analysis. For reproduction and testing, I created a functional emulation of the tc358743 device via a kernel module and introduced faults through the debugfs interface.
--- drivers/media/i2c/tc358743.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/tc358743.c +2 -2
@@ -2200,10 +2200,10 @@ static int tc358743_probe(struct i2c_cli err_work_queues:cec_unregister_adapter (state->cec_adap);if (!state->i2c_client->irq) { -del_timer (&state->timer); +timer_delete_sync (&state->timer);flush_work (&state->work_i2c_poll); } -cancel_delayed_work (&state->delayed_work_enable_hotplug); +cancel_delayed_work_sync (&state->delayed_work_enable_hotplug);mutex_destroy (&state->confctl_mutex); err_hdl:media_entity_cleanup (&sd->entity);
Greg Kroah-Hartman
maintainerPATCH 7/224 media: rc: Add support for another iMON 0xffdc device
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Flavius Georgescu <[email protected]>
[ Upstream commit cf330691668a3bee37b8ac8212709b3ccdd87997 ]
The device it's an iMON UltraBay (0x98 in config byte) with LCD, IR and dual-knobs front panel.
To work properly the device also require its own key table, and repeat suppression for all buttons.
Stable-dep-of: fa0f61cc1d82 ("media: rc: fix races with imon_disconnect()")
--- drivers/media/rc/imon.c | 61 ++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 51 insertions(+), 10 deletions(-)
drivers/media/rc/imon.c +51 -10
@@ -83,6 +83,7 @@ struct imon_usb_dev_descr {__u16 flags;#define IMON_NO_FLAGS 0#define IMON_NEED_20MS_PKT_DELAY 1 +#define IMON_SUPPRESS_REPEATED_KEYS 2struct imon_panel_key_table key_table[]; };
@@ -149,8 +150,9 @@ struct imon_context {struct timer_list ttimer;/* touch screen timer */ int touch_x;/* x coordinate on touchscreen */ int touch_y;/* y coordinate on touchscreen */ -struct imon_usb_dev_descr *dev_descr;/* device description with key -table for front panels */ +const struct imon_usb_dev_descr *dev_descr; +/* device description with key */ +/* table for front panels */ };#define TOUCH_TIMEOUT (HZ/30)
@@ -315,6 +317,32 @@ static const struct imon_usb_dev_descr i } }; +/* imon ultrabay front panel key table */ +static const struct imon_usb_dev_descr ultrabay_table = { + .flags =IMON_SUPPRESS_REPEATED_KEYS , + .key_table = { + {0x0000000f0000ffeell ,KEY_MEDIA },/* Go */ + {0x000000000100ffeell ,KEY_UP }, + {0x000000000001ffeell ,KEY_DOWN }, + {0x000000160000ffeell ,KEY_ENTER }, + {0x0000001f0000ffeell ,KEY_AUDIO },/* Music */ + {0x000000200000ffeell ,KEY_VIDEO },/* Movie */ + {0x000000210000ffeell ,KEY_CAMERA },/* Photo */ + {0x000000270000ffeell ,KEY_DVD },/* DVD */ + {0x000000230000ffeell ,KEY_TV },/* TV */ + {0x000000050000ffeell ,KEY_PREVIOUS },/* Previous */ + {0x000000070000ffeell ,KEY_REWIND }, + {0x000000040000ffeell ,KEY_STOP }, + {0x000000020000ffeell ,KEY_PLAYPAUSE }, + {0x000000080000ffeell ,KEY_FASTFORWARD }, + {0x000000060000ffeell ,KEY_NEXT },/* Next */ + {0x000100000000ffeell ,KEY_VOLUMEUP }, + {0x010000000000ffeell ,KEY_VOLUMEDOWN }, + {0x000000010000ffeell ,KEY_MUTE }, + {0 ,KEY_RESERVED }, + } +}; +/* * USB Device ID for iMON USB Control Boards *
@@ -1261,9 +1289,11 @@ static u32 imon_mce_key_lookup(struct imstatic u32 imon_panel_key_lookup (struct imon_context *ictx,u64 code) { -int i; +const struct imon_panel_key_table *key_table;u32 keycode =KEY_RESERVED ; -struct imon_panel_key_table *key_table = ictx->dev_descr->key_table; +int i; + + key_table = ictx->dev_descr->key_table;for (i =0 ; key_table[i].hw_code !=0 ; i++) {if (key_table[i].hw_code == (code |0xffee )) {
@@ -1547,7 +1577,6 @@ static void imon_incoming_packet(structu32 kc;u64 scancode;int press_type =0 ; -long msec;ktime_t t;static ktime_t prev_time;u8 ktype;
@@ -1649,14 +1678,16 @@ static void imon_incoming_packet(structspin_lock_irqsave (&ictx->kc_lock, flags); t =ktime_get (); -/* KEY_MUTE repeats from knob need to be suppressed */ -if (ictx->kc ==KEY_MUTE && ictx->kc == ictx->last_keycode) { - msec =ktime_ms_delta (t, prev_time); -if (msec < ictx->idev->rep[REP_DELAY ]) { +/* KEY repeats from knob and panel that need to be suppressed */ +if (ictx->kc ==KEY_MUTE || + ictx->dev_descr->flags &IMON_SUPPRESS_REPEATED_KEYS ) { +if (ictx->kc == ictx->last_keycode && +ktime_ms_delta (t, prev_time) < ictx->idev->rep[REP_DELAY ]) {spin_unlock_irqrestore (&ictx->kc_lock, flags);return ; } } + prev_time = t; kc = ictx->kc;
@@ -1844,6 +1875,14 @@ static void imon_get_ffdc_type(struct imdev_info (ictx->dev,"0xffdc iMON Inside, iMON IR" ); ictx->display_supported = false;break ; +/* Soundgraph iMON UltraBay */ +case 0x98 : +dev_info (ictx->dev,"0xffdc iMON UltraBay, LCD + IR" ); + detected_display_type =IMON_DISPLAY_TYPE_LCD ; + allowed_protos =RC_PROTO_BIT_IMON |RC_PROTO_BIT_RC6_MCE ; + ictx->dev_descr = &ultrabay_table; +break ; +default :dev_info (ictx->dev,"Unknown 0xffdc device, defaulting to VFD and iMON IR" ); detected_display_type =IMON_DISPLAY_TYPE_VFD ;
@@ -1975,10 +2014,12 @@ out:static struct input_dev *imon_init_idev (struct imon_context *ictx) { -struct imon_panel_key_table *key_table = ictx->dev_descr->key_table; +const struct imon_panel_key_table *key_table;struct input_dev *idev;int ret, i; + key_table = ictx->dev_descr->key_table; + idev =input_allocate_device ();if (!idev) goto out;
Greg Kroah-Hartman
maintainerPATCH 8/224 media: imon: reorganize serialization
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit db264d4c66c0fe007b5d19fd007707cd0697603d ]
Since usb_register_dev() from imon_init_display() from imon_probe() holds minor_rwsem while display_open() which holds driver_lock and ictx->lock is called with minor_rwsem held from usb_open(), holding driver_lock or ictx->lock when calling usb_register_dev() causes circular locking dependency problem.
Since usb_deregister_dev() from imon_disconnect() holds minor_rwsem while display_open() which holds driver_lock is called with minor_rwsem held, holding driver_lock when calling usb_deregister_dev() also causes circular locking dependency problem.
Sean Young explained that the problem is there are imon devices which have two usb interfaces, even though it is one device. The probe and disconnect function of both usb interfaces can run concurrently.
Alan Stern responded that the driver and USB cores guarantee that when an interface is probed, both the interface and its USB device are locked. Ditto for when the disconnect callback gets run. So concurrent probing/ disconnection of multiple interfaces on the same device is not possible.
Therefore, we don't need locks for handling race between imon_probe() and imon_disconnect(). But we still need to handle race between display_open() /vfd_write()/lcd_write()/display_close() and imon_disconnect(), for disconnect event can happen while file descriptors are in use.
Since "struct file"->private_data is set by display_open(), vfd_write()/ lcd_write()/display_close() can assume that "struct file"->private_data is not NULL even after usb_set_intfdata(interface, NULL) was called.
Replace insufficiently held driver_lock with refcount_t based management. Add a boolean flag for recording whether imon_disconnect() was already called. Use RCU for accessing this boolean flag and refcount_t.
Since the boolean flag for imon_disconnect() is shared, disconnect event on either intf0 or intf1 affects both interfaces. But I assume that this change does not matter, for usually disconnect event would not happen while interfaces are in use.
Stable-dep-of: fa0f61cc1d82 ("media: rc: fix races with imon_disconnect()")
--- drivers/media/rc/imon.c | 99 ++++++++++++++++++++++-------------------------- 1 file changed, 47 insertions(+), 52 deletions(-)
drivers/media/rc/imon.c +47 -52
@@ -153,6 +153,24 @@ struct imon_context {const struct imon_usb_dev_descr *dev_descr;/* device description with key */ /* table for front panels */ +/* +* Fields for deferring free_imon_context(). +* +* Since reference to "struct imon_context" is stored into +* "struct file"->private_data, we need to remember +* how many file descriptors might access this "struct imon_context". +*/ +refcount_t users; +/* +* Use a flag for telling display_open()/vfd_write()/lcd_write() that +* imon_disconnect() was already called. +*/ +bool disconnected; +/* +* We need to wait for RCU grace period in order to allow +* display_open() to safely check ->disconnected and increment ->users. +*/ +struct rcu_head rcu; };#define TOUCH_TIMEOUT (HZ/30)
@@ -160,18 +178,18 @@ struct imon_context {/* vfd character device file operations */ static const struct file_operations vfd_fops = { .owner =THIS_MODULE , - .open = &display_open, - .write = &vfd_write, - .release = &display_close, + .open = display_open, + .write = vfd_write, + .release = display_close, .llseek = noop_llseek, };/* lcd character device file operations */ static const struct file_operations lcd_fops = { .owner =THIS_MODULE , - .open = &display_open, - .write = &lcd_write, - .release = &display_close, + .open = display_open, + .write = lcd_write, + .release = display_close, .llseek = noop_llseek, };
@@ -439,9 +457,6 @@ static struct usb_driver imon_driver = { .id_table = imon_usb_id_table, }; -/* to prevent races between open() and disconnect(), probing, etc */ -static DEFINE_MUTEX (driver_lock); -/* Module bookkeeping bits */ MODULE_AUTHOR (MOD_AUTHOR );MODULE_DESCRIPTION (MOD_DESC );
@@ -481,9 +496,11 @@ static void free_imon_context(struct imostruct device *dev = ictx->dev;usb_free_urb (ictx->tx_urb); +WARN_ON (ictx->dev_present_intf0);usb_free_urb (ictx->rx_urb_intf0); +WARN_ON (ictx->dev_present_intf1);usb_free_urb (ictx->rx_urb_intf1); -kfree (ictx); +kfree_rcu (ictx, rcu);dev_dbg (dev,"%s: iMON context freed\n" , __func__); }
@@ -499,9 +516,6 @@ static int display_open(struct inode *inint subminor;int retval =0 ; -/* prevent races with disconnect */ -mutex_lock (&driver_lock); - subminor =iminor (inode); interface =usb_find_interface (&imon_driver, subminor);if (!interface) {
@@ -509,13 +523,16 @@ static int display_open(struct inode *in retval = -ENODEV ; goto exit; } - ictx =usb_get_intfdata (interface); -if (!ictx) { +rcu_read_lock (); + ictx =usb_get_intfdata (interface); +if (!ictx || ictx->disconnected || !refcount_inc_not_zero (&ictx->users)) { +rcu_read_unlock ();pr_err ("no context found for minor %d\n" , subminor); retval = -ENODEV ; goto exit; } +rcu_read_unlock ();mutex_lock (&ictx->lock);
@@ -533,8 +550,10 @@ static int display_open(struct inode *inmutex_unlock (&ictx->lock); +if (retval &&refcount_dec_and_test (&ictx->users)) +free_imon_context (ictx); + exit: -mutex_unlock (&driver_lock);return retval; }
@@ -544,16 +563,9 @@ exit:*/ static int display_close (struct inode *inode,struct file *file) { -struct imon_context *ictx =NULL ; +struct imon_context *ictx = file->private_data;int retval =0 ; - ictx = file->private_data; - -if (!ictx) { -pr_err ("no context for device\n" ); -return -ENODEV ; - } -mutex_lock (&ictx->lock);if (!ictx->display_supported) {
@@ -568,6 +580,8 @@ static int display_close(struct inode *i }mutex_unlock (&ictx->lock); +if (refcount_dec_and_test (&ictx->users)) +free_imon_context (ictx);return retval; }
@@ -936,15 +950,12 @@ static ssize_t vfd_write(struct file *fiint offset;int seq;int retval =0 ; -struct imon_context *ictx; +struct imon_context *ictx = file->private_data;static const unsigned char vfd_packet6[] = {0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0xFF ,0xFF }; - ictx = file->private_data; -if (!ictx) { -pr_err_ratelimited ("no context for device\n" ); +if (ictx->disconnected)return -ENODEV ; - }if (mutex_lock_interruptible (&ictx->lock))return -ERESTARTSYS ;
@@ -1021,13 +1032,10 @@ static ssize_t lcd_write(struct file *fi size_t n_bytes, loff_t *pos) { int retval = 0; -struct imon_context *ictx; +struct imon_context *ictx = file->private_data; - ictx = file->private_data; -if (!ictx) { -pr_err_ratelimited ("no context for device\n" ); +if (ictx->disconnected)return -ENODEV ; - }mutex_lock (&ictx->lock);
@@ -2402,7 +2410,6 @@ static int imon_probe(struct usb_interfaint ifnum, sysfs_err;int ret =0 ;struct imon_context *ictx =NULL ; -struct imon_context *first_if_ctx =NULL ;u16 vendor, product; usbdev =usb_get_dev (interface_to_usbdev (interface));
@@ -2414,17 +2421,12 @@ static int imon_probe(struct usb_interfadev_dbg (dev,"%s: found iMON device (%04x:%04x, intf%d)\n" , __func__, vendor, product, ifnum); -/* prevent races probing devices w/multiple interfaces */ -mutex_lock (&driver_lock); - first_if =usb_ifnum_to_if (usbdev,0 );if (!first_if) { ret = -ENODEV ; goto fail; } - first_if_ctx =usb_get_intfdata (first_if); -if (ifnum ==0 ) { ictx =imon_init_intf0 (interface, id);if (!ictx) {
@@ -2432,9 +2434,11 @@ static int imon_probe(struct usb_interfa ret = -ENODEV ; goto fail; } +refcount_set (&ictx->users,1 ); }else {/* this is the secondary interface on the device */ +struct imon_context *first_if_ctx =usb_get_intfdata (first_if);/* fail early if first intf failed to register */ if (!first_if_ctx) {
@@ -2448,14 +2452,13 @@ static int imon_probe(struct usb_interfa ret = -ENODEV ; goto fail; } +refcount_inc (&ictx->users); }usb_set_intfdata (interface, ictx);if (ifnum ==0 ) { -mutex_lock (&ictx->lock); -if (product ==0xffdc && ictx->rf_device) { sysfs_err =sysfs_create_group (&interface->dev.kobj, &imon_rf_attr_group);
@@ -2466,21 +2469,17 @@ static int imon_probe(struct usb_interfaif (ictx->display_supported)imon_init_display (ictx, interface); - -mutex_unlock (&ictx->lock); }dev_info (dev,"iMON device (%04x:%04x, intf%d) on usb<%d:%d> initialized\n" , vendor, product, ifnum, usbdev->bus->busnum, usbdev->devnum); -mutex_unlock (&driver_lock);usb_put_dev (usbdev);return 0 ; fail: -mutex_unlock (&driver_lock);usb_put_dev (usbdev);dev_err (dev,"unable to register, err %d\n" , ret);
@@ -2496,10 +2495,8 @@ static void imon_disconnect(struct usb_istruct device *dev;int ifnum; -/* prevent races with multi-interface device probing and display_open */ -mutex_lock (&driver_lock); - ictx =usb_get_intfdata (interface); + ictx->disconnected = true; dev = ictx->dev; ifnum = interface->cur_altsetting->desc.bInterfaceNumber;
@@ -2540,11 +2537,9 @@ static void imon_disconnect(struct usb_i } } -if (!ictx->dev_present_intf0 && !ictx->dev_present_intf1) +if (refcount_dec_and_test (&ictx->users))free_imon_context (ictx); -mutex_unlock (&driver_lock); -dev_dbg (dev,"%s: iMON device (intf%d) disconnected\n" , __func__, ifnum); }
Greg Kroah-Hartman
maintainerPATCH 9/224 media: imon: grab lock earlier in imon_ir_change_protocol()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 7019553ab850ce1d3f0e512e16d14ab153f91c04 ]
Move mutex_trylock() in imon_ir_change_protocol() to the beginning, for memcpy() which modifies ictx->usb_tx_buf should be protected by ictx->lock.
Also, verify at the beginning of send_packet() that ictx->lock is held in case send_packet() is by error called from imon_ir_change_protocol() when mutex_trylock() failed due to concurrent requests.
Stable-dep-of: fa0f61cc1d82 ("media: rc: fix races with imon_disconnect()")
--- drivers/media/rc/imon.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/rc/imon.c +3 -3
@@ -598,6 +598,8 @@ static int send_packet(struct imon_conteint retval =0 ;struct usb_ctrlrequest *control_req =NULL ; +lockdep_assert_held (&ictx->lock); +/* Check if we need to use control or interrupt urb */ if (!ictx->tx_control) { pipe = usb_sndintpipe(ictx->usbdev_intf0,
@@ -1126,7 +1128,7 @@ static int imon_ir_change_protocol(strucint retval;struct imon_context *ictx = rc->priv;struct device *dev = ictx->dev; -bool unlock = false; +const bool unlock =mutex_trylock (&ictx->lock);unsigned char ir_proto_packet[] = {0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x86 };
@@ -1153,8 +1155,6 @@ static int imon_ir_change_protocol(strucmemcpy (ictx->usb_tx_buf, &ir_proto_packet,sizeof (ir_proto_packet)); - unlock =mutex_trylock (&ictx->lock); - retval =send_packet (ictx);if (retval) goto out;
Greg Kroah-Hartman
maintainerPATCH 10/224 media: rc: fix races with imon_disconnect()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larshin Sergey <[email protected]>
[ Upstream commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb ]
Syzbot reports a KASAN issue as below:
BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device.
Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage.
As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer.
Thread 1 vfd_write Thread 2 imon_disconnect
...
if
usb_put_dev(ictx->usbdev_intf0)
else
usb_put_dev(ictx->usbdev_intf1)
...
while
send_packet
if
pipe = usb_sndintpipe(
ictx->usbdev_intf0) UAF
else
pipe = usb_sndctrlpipe(
ictx->usbdev_intf0, 0) UAFGuard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present.
Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations.
Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/media/rc/imon.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
drivers/media/rc/imon.c +20 -7
@@ -536,7 +536,9 @@ static int display_open(struct inode *inmutex_lock (&ictx->lock); -if (!ictx->display_supported) { +if (ictx->disconnected) { + retval = -ENODEV ; + }else if (!ictx->display_supported) {pr_err ("display not supported by device\n" ); retval = -ENODEV ; }else if (ictx->display_isopen) {
@@ -600,6 +602,9 @@ static int send_packet(struct imon_contelockdep_assert_held (&ictx->lock); +if (ictx->disconnected) +return -ENODEV ; +/* Check if we need to use control or interrupt urb */ if (!ictx->tx_control) { pipe = usb_sndintpipe(ictx->usbdev_intf0,
@@ -956,12 +961,14 @@ static ssize_t vfd_write(struct file *fistatic const unsigned char vfd_packet6[] = {0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0xFF ,0xFF }; -if (ictx->disconnected) -return -ENODEV ; -if (mutex_lock_interruptible (&ictx->lock))return -ERESTARTSYS ; +if (ictx->disconnected) { + retval = -ENODEV ; + goto exit; + } +if (!ictx->dev_present_intf0) {pr_err_ratelimited ("no iMON device present\n" ); retval = -ENODEV ;
@@ -1036,11 +1043,13 @@ static ssize_t lcd_write(struct file *fiint retval =0 ;struct imon_context *ictx = file->private_data; -if (ictx->disconnected) -return -ENODEV ; -mutex_lock (&ictx->lock); +if (ictx->disconnected) { + retval = -ENODEV ; + goto exit; + } +if (!ictx->display_supported) {pr_err_ratelimited ("no iMON display present\n" ); retval = -ENODEV ;
@@ -2496,7 +2505,11 @@ static void imon_disconnect(struct usb_iint ifnum; ictx =usb_get_intfdata (interface); + +mutex_lock (&ictx->lock); ictx->disconnected = true; +mutex_unlock (&ictx->lock); + dev = ictx->dev; ifnum = interface->cur_altsetting->desc.bInterfaceNumber;
Greg Kroah-Hartman
maintainerPATCH 11/224 USB: serial: option: add SIMCom 8230C compositions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaowei Li <[email protected]>
commit 0e0ba0ecec3d6e819e0c2348331ff99afe2eb5d5 upstream.
Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip.
USB Device Listings:
0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet (QMI mode) + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9071 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x9078: tty (DM) + tty (NMEA) + tty (AT) + ECM + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9078 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x907b: RNDIS + tty (DM) + tty (NMEA) + tty (AT) + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=907b Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=ef(misc ) Sub=04 Prot=01
I:* If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -2114,6 +2114,12 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ .driver_info = RSVD(7) }, + { USB_DEVICE(0x1e0e, 0x9071), /* Simcom SIM8230 RMNET mode */ + .driver_info = RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9078, 0xff), /* Simcom SIM8230 ECM mode */ + .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x907b, 0xff), /* Simcom SIM8230 RNDIS mode */ + .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
Greg Kroah-Hartman
maintainerPATCH 12/224 wifi: rtlwifi: rtl8192cu: Dont claim USB ID 07b8:8188
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
commit e798f2ac6040f46a04795d7de977341fa9aeabae upstream.
This ID appears to be RTL8188SU, not RTL8188CU. This is the wrong driver for RTL8188SU. The r8712u driver from staging used to handle this ID.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c +0 -1
@@ -297,7 +297,6 @@ static const struct usb_device_id rtl819 {RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/ {RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/ {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/ - {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/
Greg Kroah-Hartman
maintainerPATCH 13/224 dm-integrity: limit MAX_TAG_SIZE to 255
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size = ic->tag_size" assignment. We need to limit it to 255.
--- drivers/md/dm-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-integrity.c +1 -1
@@ -116,7 +116,7 @@ struct journal_sector {commit_id_t commit_id; }; -#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) +#define MAX_TAG_SIZE 255#define METADATA_PADDING_SECTORS 8
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/224 perf subcmd: avoid crash in exclude_cmds when excludes is empty
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: hupu <[email protected]>
[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
When cross-compiling the perf tool for ARM64, perf help may crash with the following assertion failure:
help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
This happens when the perf binary is not named exactly "perf" or when multiple "perf-*" binaries exist in the same directory. In such cases, the excludes command list can be empty, which leads to the final assertion in exclude_cmds() being triggered.
Add a simple guard at the beginning of exclude_cmds() to return early if excludes->cnt is zero, preventing the crash.
--- tools/lib/subcmd/help.c | 3 +++ 1 file changed, 3 insertions(+)
tools/lib/subcmd/help.c +3 -0
@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)size_t ci, cj, ei;int cmp; +if (!excludes->cnt) +return ; + ci = cj = ei =0 ;while (ci < cmds->cnt && ei < excludes->cnt) { cmp =strcmp (cmds->names[ci]->name, excludes->names[ei]->name);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/224 staging: axis-fifo: fix maximum TX packet length check
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
commit 52ff2b840bc723f3be1f096f8017c78e0515858c upstream.
Since commit 2ca34b508774 ("staging: axis-fifo: Correct handling of tx_fifo_depth for size validation"), write() operations with packets larger than 'tx_fifo_depth - 4' words are no longer rejected with -EINVAL.
Fortunately, the packets are not actually getting transmitted to hardware, otherwise they would be raising a 'Transmit Packet Overrun Error' interrupt, which requires a reset of the TX circuit to recover from.
Instead, the request times out inside wait_event_interruptible_timeout() and always returns -EAGAIN, since the wake up condition can never be true for these packets. But still, they unnecessarily block other tasks from writing to the FIFO and the EAGAIN return code signals userspace to retry the write() call, even though it will always fail and time out.
According to the AXI4-Stream FIFO reference manual (PG080), the maximum valid packet length is 'tx_fifo_depth - 4' words, so attempting to send larger packets is invalid and should not be happening in the first place:
Quoted 2 lines
The maximum packet that can be transmitted is limited by the size of the FIFO, which is (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes.
Therefore, bring back the old behavior and outright reject packets larger than 'tx_fifo_depth - 4' with -EINVAL. Add a comment to explain why the check is necessary. The dev_err() message was removed to avoid cluttering the dmesg log if an invalid packet is received from userspace.
--- drivers/staging/axis-fifo/axis-fifo.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +10 -4
@@ -494,11 +494,17 @@ static ssize_t axis_fifo_write(struct fireturn -EINVAL ; } -if (words_to_write > fifo->tx_fifo_depth) { -dev_err (fifo->dt_device,"tried to write more words [%u] than slots in the fifo buffer [%u]\n" , - words_to_write, fifo->tx_fifo_depth); +/* +* In 'Store-and-Forward' mode, the maximum packet that can be +* transmitted is limited by the size of the FIFO, which is +* (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. +* +* Do not attempt to send a packet larger than 'tx_fifo_depth - 4', +* otherwise a 'Transmit Packet Overrun Error' interrupt will be +* raised, which requires a reset of the TX circuit to recover. +*/ +if (words_to_write > (fifo->tx_fifo_depth -4 ))return -EINVAL ; - }if (fifo->write_flags &O_NONBLOCK ) {/*
Greg Kroah-Hartman
maintainerPATCH 16/224 staging: axis-fifo: flush RX FIFO on read errors
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
commit 82a051e2553b9e297cba82a975d9c538b882c79e upstream.
Flush stale data from the RX FIFO in case of errors, to avoid reading old data when new packets arrive.
Commit c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") removed full FIFO resets from the read error paths, which fixed potential TX data losses, but introduced this RX issue.
--- drivers/staging/axis-fifo/axis-fifo.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +11 -7
@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil } bytes_available =ioread32 (fifo->base_addr +XLLF_RLR_OFFSET ); + words_available = bytes_available /sizeof (u32);if (!bytes_available) {dev_err (fifo->dt_device,"received a packet of length 0\n" ); ret = -EIO ;
@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fildev_err (fifo->dt_device,"user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n" , bytes_available, len); ret = -EINVAL ; - goto end_unlock; + goto err_flush_rx; }if (bytes_available %sizeof (u32)) {
@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil*/ dev_err (fifo->dt_device,"received a packet that isn't word-aligned\n" ); ret = -EIO ; - goto end_unlock; + goto err_flush_rx; } - words_available = bytes_available /sizeof (u32); -/* read data into an intermediate buffer, copying the contents * to userspace when the buffer is full */
@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil tmp_buf[i] =ioread32 (fifo->base_addr +XLLF_RDFD_OFFSET ); } + words_available -= copy;if (copy_to_user (buf + copied *sizeof (u32), tmp_buf, copy *sizeof (u32))) { ret = -EFAULT ; - goto end_unlock; + goto err_flush_rx; } copied += copy; - words_available -= copy; } +mutex_unlock (&fifo->read_lock); + +return bytes_available; - ret = bytes_available; +err_flush_rx: +while (words_available--) +ioread32 (fifo->base_addr +XLLF_RDFD_OFFSET ); end_unlock:mutex_unlock (&fifo->read_lock);
Greg Kroah-Hartman
maintainerPATCH 17/224 driver core/PM: Set power.no_callbacks along with power.no_pm
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit c2ce2453413d429e302659abc5ace634e873f6f5 upstream.
Devices with power.no_pm set are not expected to need any power management at all, so modify device_set_pm_not_required() to set power.no_callbacks for them too in case runtime PM will be enabled for any of them (which in principle may be done for convenience if such a device participates in a dependency chain).
Since device_set_pm_not_required() must be called before device_add() or it would not have any effect, it can update power.no_callbacks without locking, unlike pm_runtime_no_callbacks() that can be called after registering the target device.
--- include/linux/device.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/device.h +3 -0
@@ -1441,6 +1441,9 @@ static inline bool device_pm_not_requirestatic inline void device_set_pm_not_required (struct device *dev) { dev->power.no_pm = true; +#ifdef CONFIG_PM + dev->power.no_callbacks = true; +#endif }static inline void dev_pm_syscore_device (struct device *dev,bool val)
Greg Kroah-Hartman
maintainerPATCH 18/224 perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
--- drivers/perf/arm_spe_pmu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/perf/arm_spe_pmu.c +2 -1
@@ -75,7 +75,8 @@ struct arm_spe_pmu {#define to_spe_pmu (p) (container_of(p, struct arm_spe_pmu, pmu))/* Convert a free-running index from perf into an SPE buffer offset */ -#define PERF_IDX2OFF (idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) +#define PERF_IDX2OFF (idx, buf) \ + ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))/* Keep track of our dynamic hotplug state */ static enum cpuhp_state arm_spe_pmu_online;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/224 x86/vdso: Fix output operand size of RDPID
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <[email protected]>
[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
RDPID instruction outputs to a word-sized register (64-bit on x86_64 and 32-bit on x86_32). Use an unsigned long variable to store the correct size.
LSL outputs to 32-bit register, use %k operand prefix to always print the 32-bit name of the register.
Use RDPID insn mnemonic while at it as the minimum binutils version of 2.30 supports it.
[ bp: Merge two patches touching the same function into a single one. ]
--- arch/x86/include/asm/segment.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/x86/include/asm/segment.h +4 -4
@@ -253,7 +253,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)static inline void vdso_read_cpunode (unsigned *cpu,unsigned *node) { -unsigned int p; +unsigned long p;/* * Load CPU and node number from the GDT. LSL is faster than RDTSCP
@@ -263,10 +263,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)* * If RDPID is available, use it. */ -alternative_io ("lsl %[seg],%[p]" , -".byte 0xf3,0x0f,0xc7,0xf8" ,/* RDPID %eax/rax */ +alternative_io ("lsl %[seg],%k[p]" , +"rdpid %[p]" , X86_FEATURE_RDPID, - [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); + [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); if (cpu) *cpu = (p & VDSO_CPUNODE_MASK);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/224 regmap: Remove superfluous check for !config in __regmap_init()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
The first thing __regmap_init() do is check if config is non-NULL, so there is no need to check for this again later.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -824,7 +824,7 @@ struct regmap *__regmap_init(struct device *dev, map->read_flag_mask = bus->read_flag_mask; } -if (config && config->read && config->write) { +if (config->read && config->write) { map->reg_read = _regmap_bus_read;/* Bulk read/write */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/224 ACPI: processor: idle: Fix memory leak when register cpuidle device failed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huisong Li <[email protected]>
[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
The cpuidle device's memory is leaked when cpuidle device registration fails in acpi_processor_power_init(). Free it as appropriate.
--- drivers/acpi/processor_idle.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/processor_idle.c +3 -0
@@ -1506,6 +1506,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)if (retval) {if (acpi_processor_registered ==0 )cpuidle_unregister_driver (&acpi_idle_driver); + +per_cpu (acpi_cpuidle_device, pr->id) =NULL ; +kfree (dev);return retval; } acpi_processor_registered++;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/224 soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sneh Mankad <[email protected]>
[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a transaction completes. Previously this bit was only cleared when a wake TCS was borrowed as an AMC TCS but not for dedicated AMC TCS. Leaving this bit set for AMC TCS and entering deeper low power modes can generate a false completion IRQ.
Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER bit upon receiving a completion IRQ.
--- drivers/soc/qcom/rpmh-rsc.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/soc/qcom/rpmh-rsc.c +2 -5
@@ -265,13 +265,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)trace_rpmh_tx_done (drv, i, req, err); -/* -* If wake tcs was re-purposed for sending active -* votes, clear AMC trigger & enable modes and +/* Clear AMC trigger & enable modes and * disable interrupt for this TCS */ -if (!drv->tcs[ACTIVE_TCS ].num_tcs) -__tcs_set_trigger (drv, i, false); +__tcs_set_trigger (drv, i, false); skip:/* Reclaim the TCS */ write_tcs_reg (drv,RSC_DRV_CMD_ENABLE , i,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/224 pinctrl: meson-gxl: add missing i2c_d pinmux
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Da Xue <[email protected]>
[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
--- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/pinctrl/meson/pinctrl-meson-gxl.c +10 -0
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };static const unsigned int i2c_sck_c_dv19_pins[] = {GPIODV_19 };static const unsigned int i2c_sda_c_dv18_pins[] = {GPIODV_18 }; +static const unsigned int i2c_sck_d_pins[] = {GPIOX_11 }; +static const unsigned int i2c_sda_d_pins[] = {GPIOX_10 }; +static const unsigned int eth_mdio_pins[] = {GPIOZ_0 };static const unsigned int eth_mdc_pins[] = {GPIOZ_1 };static const unsigned int eth_clk_rx_clk_pins[] = {GPIOZ_2 };
@@ -400,6 +403,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {GPIO_GROUP (GPIO_TEST_N ),/* Bank X */ +GROUP (i2c_sda_d,5 ,5 ), +GROUP (i2c_sck_d,5 ,4 ),GROUP (sdio_d0,5 ,31 ),GROUP (sdio_d1,5 ,30 ), GROUP(sdio_d2, 5, 29),
@@ -631,6 +636,10 @@ static const char * const i2c_c_groups[] = { "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", }; +static const char *const i2c_d_groups[] = { +"i2c_sck_d" ,"i2c_sda_d" , +}; +static const char *const eth_groups[] = {"eth_mdio" ,"eth_mdc" ,"eth_clk_rx_clk" ,"eth_rx_dv" ,"eth_rxd0" ,"eth_rxd1" ,"eth_rxd2" ,"eth_rxd3" ,
@@ -751,6 +760,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {FUNCTION (i2c_a),FUNCTION (i2c_b),FUNCTION (i2c_c), +FUNCTION (i2c_d),FUNCTION (eth),FUNCTION (pwm_a), FUNCTION(pwm_b),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/224 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning:
kernfs: can not remove 'nr_tags', no directory
WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk]
kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it.
--- block/blk-mq-sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
block/blk-mq-sysfs.c +4 -2
@@ -241,9 +241,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)return ;hctx_for_each_ctx (hctx, ctx, i) -kobject_del (&ctx->kobj); +if (ctx->kobj.state_in_sysfs) +kobject_del (&ctx->kobj); -kobject_del (&hctx->kobj); +if (hctx->kobj.state_in_sysfs) +kobject_del (&hctx->kobj); }static int blk_mq_register_hctx (struct blk_mq_hw_ctx *hctx)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/224 block: use int to store blk_stack_limits() return value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
Change the 'ret' variable in blk_stack_limits() from unsigned int to int, as it needs to store negative value -1.
Storing the negative error codes in unsigned type, or performing equality comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
--- block/blk-settings.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-settings.c +2 -1
@@ -505,7 +505,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbint blk_stack_limits (struct queue_limits *t,struct queue_limits *b,sector_t start) { -unsigned int top, bottom, alignment, ret =0 ; +unsigned int top, bottom, alignment; +int ret =0 ; t->max_sectors =min_not_zero (t->max_sectors, b->max_sectors); t->max_hw_sectors =min_not_zero (t->max_hw_sectors, b->max_hw_sectors);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/224 pwm: tiehrpwm: Fix corner case in clock divisor calculation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
The function set_prescale_div() is responsible for calculating the clock divisor settings such that the input clock rate is divided down such that the required period length is at most 0x10000 clock ticks. If period_cycles is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is good enough. So round up in the calculation of the required divisor and compare it using >= instead of >.
--- drivers/pwm/pwm-tiehrpwm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-tiehrpwm.c +2 -2
@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, *prescale_div = (1 << clkdiv) * (hspclkdiv ? (hspclkdiv *2 ) :1 ); -if (*prescale_div > rqst_prescaler) { +if (*prescale_div >= rqst_prescaler) { *tb_clk_div = (clkdiv <<TBCTL_CLKDIV_SHIFT ) | (hspclkdiv <<TBCTL_HSPCLKDIV_SHIFT );return 0 ;
@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, pc->period_cycles[pwm->hwpwm] = period_cycles;/* Configure clock prescaler to support Low frequency PWM wave */ -if (set_prescale_div (period_cycles/PERIOD_MAX , &ps_divval, +if (set_prescale_div (DIV_ROUND_UP (period_cycles,PERIOD_MAX ), &ps_divval, &tb_divval)) {dev_err (chip->dev,"Unsupported values\n" );return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/224 selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhilesh Patil <[email protected]>
[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
Check if watchdog device supports WDIOF_KEEPALIVEPING option before entering keep_alive() ping test loop. Fix watchdog-test silently looping if ioctl based ping is not supported by the device. Exit from test in such case instead of getting stuck in loop executing failing keep_alive()
watchdog_info:
identity: m41t93 rtc Watchdog
firmware_version: 0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.WDIOC_KEEPALIVE not supported by this device
without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)
Updated change log at commit time:
Shuah Khan <[email protected]>
--- tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/watchdog/watchdog-test.c +6 -0
@@ -240,6 +240,12 @@ int main(int argc, char *argv[])if (oneshot) goto end; +/* Check if WDIOF_KEEPALIVEPING is supported */ +if (!(info.options &WDIOF_KEEPALIVEPING )) { +printf ("WDIOC_KEEPALIVE not supported by this device\n" ); + goto end; + } +printf ("Watchdog Ticking Away!\n" );/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/224 bpf: Explicitly check accesses to bpf_sock_addr
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
Syzkaller found a kernel warning on the following sock_addr program:
0: r0 = 0
1: r2 = *(u32 *)(r1 +60)
2: exitwhich triggers:
verifier bug: error during ctx access conversion (0)
This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access.
This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access.
I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
--- net/core/filter.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/core/filter.c +10 -6
@@ -7132,13 +7132,17 @@ static bool sock_addr_is_valid_access(int off, int size,return false; info->reg_type =PTR_TO_SOCKET ;break ; -default : -if (type ==BPF_READ ) { -if (size != size_default) -return false; - }else { + case bpf_ctx_range(struct bpf_sock_addr, user_family): + case bpf_ctx_range(struct bpf_sock_addr, family): + case bpf_ctx_range(struct bpf_sock_addr, type): + case bpf_ctx_range(struct bpf_sock_addr, protocol): +if (type !=BPF_READ )return false; - } +if (size != size_default) +return false; +break ; +default : +return false; }return true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/224 i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leilk.Liu <[email protected]>
[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
The old IC does not support the I2C_MASTER_WRRD (write-then-read) function, but the current code’s handling of i2c->auto_restart may potentially lead to entering the I2C_MASTER_WRRD software flow, resulting in unexpected bugs.
Instead of repurposing the auto_restart flag, add a separate flag to signal I2C_MASTER_WRRD operations.
Also fix handling of msgs. If the operation (i2c->op) is I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. For all other operations, msgs is simply incremented by 1.
--- drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/i2c/busses/i2c-mt65xx.c +10 -7
@@ -782,6 +782,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, {int ret;int left_num = num; +bool write_then_read_en = false;struct mtk_i2c *i2c =i2c_get_adapdata (adap); ret =mtk_i2c_clock_enable (i2c);
@@ -795,6 +796,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,if (!(msgs[0 ].flags &I2C_M_RD ) && (msgs[1 ].flags &I2C_M_RD ) && msgs[0 ].addr == msgs[1 ].addr) { i2c->auto_restart =0 ; + write_then_read_en = true; } }
@@ -818,12 +820,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,else i2c->op =I2C_MASTER_WR ; -if (!i2c->auto_restart) { -if (num >1 ) { -/* combined two messages into one transaction */ - i2c->op =I2C_MASTER_WRRD ; - left_num--; - } +if (write_then_read_en) { +/* combined two messages into one transaction */ + i2c->op =I2C_MASTER_WRRD ; + left_num--; }/* always use DMA mode. */
@@ -831,7 +831,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,if (ret <0 ) goto err_exit; - msgs++; +if (i2c->op ==I2C_MASTER_WRRD ) + msgs +=2 ; +else + msgs++; }/* the return value is number of executed messages */ ret = num;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/224 i2c: designware: Add disabling clocks when probe fails
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <[email protected]>
[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is called. However, this function doesn't disable clocks and the clock-enable count keeps increasing. Should disable these clocks explicitly.
--- drivers/i2c/busses/i2c-designware-platdrv.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-designware-platdrv.c +1 -0
@@ -414,6 +414,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) exit_probe:dw_i2c_plat_pm_cleanup (dev); +i2c_dw_prepare_clk (dev, false); exit_reset:reset_control_assert (dev->rst);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/224 drm/radeon/r600_cs: clean up of dead code in r600_cs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
GCC 16 enables -Werror=unused-but-set-variable= which results in build error with the following message.
drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
1411 | unsigned offset, i, level;
| ^~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
level although is set, but in never used in the function r600_texture_size. Thus resulting in dead code and this error getting triggered.
--- drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/r600_cs.c +2 -2
@@ -1411,7 +1411,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, unsigned block_align, unsigned height_align, unsigned base_align, unsigned *l0_size, unsigned *mipmap_size) { - unsigned offset, i, level; + unsigned offset, i;unsigned width, height, depth, size;unsigned blocksize;unsigned nbx, nby;
@@ -1423,7 +1423,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, w0 =r600_mip_minify (w0,0 ); h0 =r600_mip_minify (h0,0 ); d0 =r600_mip_minify (d0,0 ); -for (i =0 , offset =0 , level = blevel; i < nlevels; i++, level++) { +for (i =0 , offset =0 ; i < nlevels; i++) { width =r600_mip_minify (w0, i); nbx =r600_fmt_get_nblocksx (format, width);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/224 usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it.
--- drivers/usb/host/max3421-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/max3421-hcd.c +1 -1
@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)if (hcd) {kfree (max3421_hcd->tx);kfree (max3421_hcd->rx); -if (max3421_hcd->spi_thread) +if (!IS_ERR_OR_NULL (max3421_hcd->spi_thread))kthread_stop (max3421_hcd->spi_thread);usb_put_hcd (hcd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/224 serial: max310x: Add error checking in probe()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
Check if devm_i2c_new_dummy_device() fails.
--- drivers/tty/serial/max310x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/max310x.c +2 -0
@@ -1660,6 +1660,8 @@ static int max310x_i2c_probe(struct i2c_client *client) port_client =devm_i2c_new_dummy_device (&client->dev, client->adapter, port_addr); +if (IS_ERR (port_client)) +return PTR_ERR (port_client); regmaps[i] =devm_regmap_init_i2c (port_client, ®cfg_i2c); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/224 scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports:
UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]'
on rmmod when using an expander.
For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id.
I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander).
E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30.
The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander.
Thus, we can only clear phy_attached for devices that are directly attached.
--- drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_sas.c +8 -1
@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)unsigned long flags =0 ;struct pm8001_hba_info *pm8001_ha;struct pm8001_device *pm8001_dev = dev->lldd_dev; +struct domain_device *parent_dev = dev->parent; pm8001_ha =pm8001_find_ha_by_dev (dev);spin_lock_irqsave (&pm8001_ha->lock, flags);
@@ -893,7 +894,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)spin_lock_irqsave (&pm8001_ha->lock, flags); }PM8001_CHIP_DISP ->dereg_dev_req (pm8001_ha, device_id); - pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached =0 ; + +/* +* The phy array only contains local phys. Thus, we cannot clear +* phy_attached for a device behind an expander. +*/ +if (!(parent_dev &&dev_is_expander (parent_dev->dev_type))) + pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached =0 ;pm8001_free_dev (pm8001_dev); }else { PM8001_DISC_DBG(pm8001_ha,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/224 scsi: myrs: Fix dma_alloc_coherent() error check
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
Check for NULL return value with dma_alloc_coherent(), because DMA address is not always set by dma_alloc_coherent() on failure.
--- drivers/scsi/myrs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/myrs.c +4 -4
@@ -499,14 +499,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,/* Temporary dma mapping, used only in the scope of this function */ mbox =dma_alloc_coherent (&pdev->dev,sizeof (union myrs_cmd_mbox ), &mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, mbox_addr)) +if (!mbox)return false;/* These are the base addresses for the command memory mailbox array */ cs->cmd_mbox_size =MYRS_MAX_CMD_MBOX *sizeof (union myrs_cmd_mbox ); cmd_mbox =dma_alloc_coherent (&pdev->dev, cs->cmd_mbox_size, &cs->cmd_mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->cmd_mbox_addr)) { +if (!cmd_mbox) {dev_err (&pdev->dev,"Failed to map command mailbox\n" ); goto out_free; }
@@ -521,7 +521,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, cs->stat_mbox_size =MYRS_MAX_STAT_MBOX *sizeof (struct myrs_stat_mbox ); stat_mbox =dma_alloc_coherent (&pdev->dev, cs->stat_mbox_size, &cs->stat_mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->stat_mbox_addr)) { +if (!stat_mbox) {dev_err (&pdev->dev,"Failed to map status mailbox\n" ); goto out_free; }
@@ -534,7 +534,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, cs->fwstat_buf =dma_alloc_coherent (&pdev->dev,sizeof (struct myrs_fwstat ), &cs->fwstat_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->fwstat_addr)) { +if (!cs->fwstat_buf) {dev_err (&pdev->dev,"Failed to map firmware health buffer\n" ); cs->fwstat_buf =NULL ; goto out_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/224 media: rj54n1cb0c: Fix memleak in rj54n1_probe()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
rj54n1_probe() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.
--- drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/media/i2c/rj54n1cb0c.c +6 -3
@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client, V4L2_CID_GAIN, 0, 127, 1, 66);v4l2_ctrl_new_std (&rj54n1->hdl, &rj54n1_ctrl_ops,V4L2_CID_AUTO_WHITE_BALANCE ,0 ,1 ,1 ,1 ); - rj54n1->subdev.ctrl_handler = &rj54n1->hdl; -if (rj54n1->hdl.error) -return rj54n1->hdl.error; +if (rj54n1->hdl.error) { + ret = rj54n1->hdl.error; + goto err_free_ctrl; + } + + rj54n1->subdev.ctrl_handler = &rj54n1->hdl; rj54n1->clk_div = clk_div; rj54n1->rect.left =RJ54N1_COLUMN_SKIP ; rj54n1->rect.top =RJ54N1_ROW_SKIP ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/224 ALSA: lx_core: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
Change the 'ret' variable from u16 to int to store negative error codes or zero returned by lx_message_send_atomic().
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
--- sound/pci/lx6464es/lx_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/lx6464es/lx_core.c +2 -2
@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)/* low-level dsp access */ int lx_dsp_get_version (struct lx6464es *chip,u32 *rdsp_version) { -u16 ret; +int ret;mutex_lock (&chip->msg_lock);
@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)int lx_dsp_get_clock_frequency (struct lx6464es *chip,u32 *rfreq) { -u16 ret =0 ;u32 freq_raw =0 ;u32 freq =0 ;u32 frequency =0 ; +int ret;mutex_lock (&chip->msg_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/224 wifi: mwifiex: send world regulatory domain to driver
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kerkmann <[email protected]>
[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
The world regulatory domain is a restrictive subset of channel configurations which allows legal operation of the adapter all over the world. Changing to this domain should not be prevented.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +3 -4
@@ -667,10 +667,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,return ; } -/* Don't send world or same regdom info to firmware */ -if (strncmp (request->alpha2,"00" ,2 ) && -strncmp (request->alpha2, adapter->country_code, -sizeof (request->alpha2))) { +/* Don't send same regdom info to firmware */ +if (strncmp (request->alpha2, adapter->country_code, +sizeof (request->alpha2)) !=0 ) {memcpy (adapter->country_code, request->alpha2,sizeof (request->alpha2));mwifiex_send_domain_info_cmd_fw (wiphy);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/224 PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
Fix incorrect argument order in devm_kcalloc() when allocating port->phys. The original call used sizeof(phy) as the number of elements and port->lanes as the element size, which is reversed. While this happens to produce the correct total allocation size with current pointer size and lane counts, the argument order is wrong.
--- drivers/pci/controller/pci-tegra.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pci-tegra.c +1 -1
@@ -1394,7 +1394,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)unsigned int i;int err; - port->phys =devm_kcalloc (dev,sizeof (phy), port->lanes,GFP_KERNEL ); + port->phys =devm_kcalloc (dev, port->lanes,sizeof (phy),GFP_KERNEL );if (!port->phys)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/224 tcp: fix __tcp_close() to only send RST when required
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
If the receive queue contains payload that was already received, __tcp_close() can send an unexpected RST.
Refine the code to take tp->copied_seq into account, as we already do in tcp recvmsg().
--- net/ipv4/tcp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/tcp.c +5 -4
@@ -2359,8 +2359,8 @@ bool tcp_check_oom(struct sock *sk, int shift)void __tcp_close (struct sock *sk,long timeout) { +bool data_was_unread = false;struct sk_buff *skb; -int data_was_unread =0 ;int state;WRITE_ONCE (sk->sk_shutdown,SHUTDOWN_MASK );
@@ -2379,11 +2379,12 @@ void __tcp_close(struct sock *sk, long timeout)* reader process may not have drained the data yet! */ while ((skb =__skb_dequeue (&sk->sk_receive_queue)) !=NULL ) { -u32 len =TCP_SKB_CB (skb)->end_seq -TCP_SKB_CB (skb)->seq; +u32 end_seq =TCP_SKB_CB (skb)->end_seq;if (TCP_SKB_CB (skb)->tcp_flags &TCPHDR_FIN ) - len--; - data_was_unread += len; + end_seq--; +if (after (end_seq,tcp_sk (sk)->copied_seq)) + data_was_unread = true;__kfree_skb (skb); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/224 usb: phy: twl6030: Fix incorrect type for ret
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xichao Zhao <[email protected]>
[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
In the twl6030_usb_probe(), the variable ret is declared as a u32 type. However, since ret may receive -ENODEV when accepting the return value of omap_usb2_set_comparator().Therefore, its type should be changed to int.
--- drivers/usb/phy/phy-twl6030-usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/phy/phy-twl6030-usb.c +1 -2
@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)static int twl6030_usb_probe (struct platform_device *pdev) { -u32 ret;struct twl6030_usb *twl; -int status, err; +int status, err, ret;struct device_node *np = pdev->dev.of_node;struct device *dev = &pdev->dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/224 usb: gadget: configfs: Correctly set use_os_string at bind
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <[email protected]>
[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
Once the use_os_string flag is set to true for some functions (e.g. adb/mtp) which need to response the OS string, and then if we re-bind the ConfigFS gadget to use the other functions (e.g. hid) which should not to response the OS string, however, because the use_os_string flag is still true, so the usb gadget response the OS string descriptor incorrectly, this can cause the USB device to be unrecognizable on the Windows system.
An example of this as follows:
echo 1 > os_desc/use
ln -s functions/ffs.adb configs/b.1/function0
start adbd
echo "<udc device>" > UDC #succeed
stop adbd
rm configs/b.1/function0
echo 0 > os_desc/use
ln -s functions/hid.gs0 configs/b.1/function0 echo "<udc device>" > UDC #fail to connect on Windows
This patch sets the use_os_string flag to false at bind if the functions not support OS Descriptors.
--- drivers/usb/gadget/configfs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/configfs.c +2 -0
@@ -1327,6 +1327,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, cdev->use_os_string = true; cdev->b_vendor_code = gi->b_vendor_code;memcpy (cdev->qw_sign, gi->qw_sign,OS_STRING_QW_SIGN_LEN ); + }else { + cdev->use_os_string = false; }if (gadget_is_otg (gadget) && !otg_desc[0 ]) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/224 misc: genwqe: Fix incorrect cmd field being reported in error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
There is a dev_err message that is reporting the value of cmd->asiv_length when it should be reporting cmd->asv_length instead. Fix this.
--- drivers/misc/genwqe/card_ddcb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/genwqe/card_ddcb.c +1 -1
@@ -918,7 +918,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, }if (cmd->asv_length >DDCB_ASV_LENGTH ) {dev_err (&pci_dev->dev,"[%s] err: wrong asv_length of %d\n" , - __func__, cmd->asiv_length); + __func__, cmd->asv_length);return -EINVAL ; } rc =__genwqe_enqueue_ddcb (cd, req, f_flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/224 pps: fix warning in pps_register_cdev when register device fail
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen.
------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it.
Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.
--- drivers/pps/kapi.c | 5 +---- drivers/pps/pps.c | 5 ++--- 2 files changed, 3 insertions(+), 7 deletions(-)
drivers/pps/kapi.c +1 -4
@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,if (err <0 ) {pr_err ("%s: unable to create char device\n" , info->name); - goto kfree_pps; + goto pps_register_source_exit; }dev_dbg (&pps->dev,"new PPS source %s\n" , info->name);return pps; -kfree_pps: -kfree (pps); - pps_register_source_exit:pr_err ("%s: unable to register source\n" , info->name);
drivers/pps/pps.c +2 -3
@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) pps->info.name); err = -EBUSY ; } +kfree (pps); goto out_unlock; } pps->id = err;
@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) pps->dev.devt =MKDEV (pps_major, pps->id);dev_set_drvdata (&pps->dev, pps);dev_set_name (&pps->dev,"pps%d" , pps->id); + pps->dev.release = pps_device_destruct; err =device_register (&pps->dev);if (err) goto free_idr; -/* Override the release function with our own */ - pps->dev.release = pps_device_destruct; -pr_debug ("source %s got cdev (%d:%d)\n" , pps->info.name, pps_major, pps->id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/224 ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
When an invalid value is passed via quirk option, currently bytcht_es8316 driver just ignores and leaves as is, which may lead to unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
sound/soc/intel/boards/bytcht_es8316.c +17 -3
@@ -46,7 +46,8 @@ enum { BYT_CHT_ES8316_INTMIC_IN2_MAP, }; -#define BYT_CHT_ES8316_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) +#define BYT_CHT_ES8316_MAP (quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)#define BYT_CHT_ES8316_SSP0 BIT(16)#define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)#define BYT_CHT_ES8316_JD_INVERTED BIT(18)
@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");static void log_quirks (struct device *dev) { -if (BYT_CHT_ES8316_MAP (quirk) ==BYT_CHT_ES8316_INTMIC_IN1_MAP ) +int map; + + map =BYT_CHT_ES8316_MAP (quirk); +switch (map) { +case BYT_CHT_ES8316_INTMIC_IN1_MAP :dev_info (dev,"quirk IN1_MAP enabled" ); -if (BYT_CHT_ES8316_MAP (quirk) ==BYT_CHT_ES8316_INTMIC_IN2_MAP ) +break ; +case BYT_CHT_ES8316_INTMIC_IN2_MAP :dev_info (dev,"quirk IN2_MAP enabled" ); +break ; +default : +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n" , map); + quirk &= ~BYT_CHT_ES8316_MAP_MASK ; + quirk |=BYT_CHT_ES8316_INTMIC_IN1_MAP ; +break ; + } +if (quirk &BYT_CHT_ES8316_SSP0 )dev_info (dev,"quirk SSP0 enabled" );if (quirk &BYT_CHT_ES8316_MONO_SPEAKER )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/224 ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB access.
This patch corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/intel/boards/bytcr_rt5640.c +5 -2
@@ -60,7 +60,8 @@ enum { BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), }; -#define BYT_RT5640_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5640_MAP_MASK GENMASK(3, 0) +#define BYT_RT5640_MAP (quirk) ((quirk) & BYT_RT5640_MAP_MASK)#define BYT_RT5640_JDSRC (quirk) (((quirk) & GENMASK(7, 4)) >> 4)#define BYT_RT5640_OVCD_TH (quirk) (((quirk) & GENMASK(12, 8)) >> 8)#define BYT_RT5640_OVCD_SF (quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -118,7 +119,9 @@ static void log_quirks(struct device *dev)dev_info (dev,"quirk IN3_MAP enabled\n" );break ;default : -dev_err (dev,"quirk map 0x%x is not supported, microphone input will not work\n" , map); +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n" , map); + byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK ; + byt_rt5640_quirk |=BYT_RT5640_DMIC1_MAP ;break ; }if (BYT_RT5640_JDSRC (byt_rt5640_quirk)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/224 ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
sound/soc/intel/boards/bytcr_rt5651.c +21 -5
@@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP (quirk) ((quirk) & BYT_RT5651_MAP_MASK)#define BYT_RT5651_JDSRC (quirk) (((quirk) & GENMASK(7, 4)) >> 4)#define BYT_RT5651_OVCD_TH (quirk) (((quirk) & GENMASK(12, 8)) >> 8)#define BYT_RT5651_OVCD_SF (quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -99,14 +100,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");static void log_quirks (struct device *dev) { -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_DMIC_MAP ) +int map; + + map =BYT_RT5651_MAP (byt_rt5651_quirk); +switch (map) { +case BYT_RT5651_DMIC_MAP :dev_info (dev,"quirk DMIC_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN1_MAP ) +break ; +case BYT_RT5651_IN1_MAP :dev_info (dev,"quirk IN1_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN2_MAP ) +break ; +case BYT_RT5651_IN2_MAP :dev_info (dev,"quirk IN2_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN1_IN2_MAP ) +break ; +case BYT_RT5651_IN1_IN2_MAP :dev_info (dev,"quirk IN1_IN2_MAP enabled" ); +break ; +default : +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to DMIC_MAP\n" , map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK ; + byt_rt5651_quirk |=BYT_RT5651_DMIC_MAP ; +break ; + } +if (BYT_RT5651_JDSRC (byt_rt5651_quirk)) {dev_info (dev,"quirk realtek,jack-detect-source %ld\n" ,BYT_RT5651_JDSRC (byt_rt5651_quirk));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/224 iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
Fix iio_convert_raw_to_processed() offset handling for channels without a scale attribute.
The offset has been applied to the raw64 value not to the original raw value. Use the raw64 value so that the offset is taken into account.
--- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/inkern.c +1 -1
@@ -627,7 +627,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,* If no channel scaling is available apply consumer scale to * raw value and return. */ - *processed = raw * scale; + *processed = raw64 * scale;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/224 netfilter: ipset: Remove unused htable_bits in macro ahash_region
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
Since the ahash_region() macro was redefined to calculate the region index solely from HTABLE_REGION_BITS, the htable_bits parameter became unused.
Remove the unused htable_bits argument and its call sites, simplifying the code without changing semantics.
--- net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/ipset/ip_set_hash_gen.h +4 -4
@@ -87,7 +87,7 @@ struct hbucket { : jhash_size((htable_bits) - HTABLE_REGION_BITS))#define ahash_sizeof_regions (htable_bits) \ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) -#define ahash_region (n, htable_bits) \ +#define ahash_region (n) \ ((n) / jhash_size(HTABLE_REGION_BITS))#define ahash_bucket_start (h, htable_bits) \ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
@@ -716,7 +716,7 @@ mtype_resize(struct ip_set *set, bool retried)#endif key =HKEY (data, h->initval, htable_bits); m =__ipset_dereference (hbucket (t, key)); - nr =ahash_region (key, htable_bits); + nr =ahash_region (key);if (!m) { m = kzalloc(sizeof(*m) + AHASH_INIT_SIZE * dsize,
@@ -866,7 +866,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,rcu_read_lock_bh (); t =rcu_dereference_bh (h->table); key =HKEY (value, h->initval, t->htable_bits); - r =ahash_region (key, t->htable_bits); + r =ahash_region (key);atomic_inc (&t->uref); elements = t->hregion[r].elements; maxelem = t->maxelem;
@@ -1059,7 +1059,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,rcu_read_lock_bh (); t =rcu_dereference_bh (h->table); key =HKEY (value, h->initval, t->htable_bits); - r =ahash_region (key, t->htable_bits); + r =ahash_region (key);atomic_inc (&t->uref);rcu_read_unlock_bh ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/224 watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
When the watchdog gets enabled with this driver, it leaves enough time for the core watchdog subsystem to start pinging it. But when the watchdog is already started by hardware or by the boot loader, little time remains before it fires and it happens that the core watchdog subsystem doesn't have time to start pinging it.
Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") pinging was managed by the driver itself and the watchdog was immediately pinged by setting the timer expiry to 0.
So restore similar behaviour by pinging it when enabling it so that if it was already enabled the watchdog timer counter is reloaded.
--- drivers/watchdog/mpc8xxx_wdt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/watchdog/mpc8xxx_wdt.c +2 -0
@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) ddata->swtc = tmp >>16 ;set_bit (WDOG_HW_RUNNING , &ddata->wdd.status); +mpc8xxx_wdt_keepalive (ddata); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/224 drivers/base/node: handle error properly in register_one_node()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
If register_node() returns an error, it is not handled correctly. The function will proceed further and try to register CPUs under the node, which is not correct.
So, in this patch, if register_node() returns an error, we return immediately from the function.
--- drivers/base/node.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/base/node.c +5 -0
@@ -938,6 +938,11 @@ int __register_one_node(int nid)return -ENOMEM ; error =register_node (node_devices[nid], nid); +if (error) { + node_devices[nid] =NULL ; +kfree (node); +return error; + }/* link cpu under this node */ for_each_present_cpu (cpu) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/224 wifi: mt76: fix potential memory leak in mt76_wmac_probe()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory is allocated for both struct ieee80211_hw and a workqueue. However, on the error path, the workqueue is not freed. Fix that by calling mt76_free_device() on the error path.
--- drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7603/soc.c +1 -1
@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)return 0 ; error: -ieee80211_free_hw (mt76_hw (dev)); +mt76_free_device (mdev);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/224 RDMA/core: Resolve MAC of next-hop device without ARP support
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <[email protected]>
[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
Currently, if the next-hop netdevice does not support ARP resolution, the destination MAC address is silently set to zero without reporting an error. This leads to incorrect behavior and may result in packet transmission failures.
Fix this by deferring MAC resolution to the IP stack via neighbour lookup, allowing proper resolution or error reporting as appropriate.
--- drivers/infiniband/core/addr.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/infiniband/core/addr.c +3 -7
@@ -459,14 +459,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, {int ret =0 ; -if (ndev_flags &IFF_LOOPBACK ) { +if (ndev_flags &IFF_LOOPBACK )memcpy (addr->dst_dev_addr, addr->src_dev_addr,MAX_ADDR_LEN ); - }else { -if (!(ndev_flags &IFF_NOARP )) { -/* If the device doesn't do ARP internally */ - ret =fetch_ha (dst, addr, dst_in, seq); - } - } +else + ret =fetch_ha (dst, addr, dst_in, seq);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/224 IB/sa: Fix sa_local_svc_timeout_ms read race
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Dumitrescu <[email protected]>
[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
When computing the delta, the sa_local_svc_timeout_ms is read without ib_nl_request_lock held. Though unlikely in practice, this can cause a race condition if multiple local service threads are managing the timeout.
--- drivers/infiniband/core/sa_query.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/core/sa_query.c +4 -2
@@ -1036,6 +1036,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,if (timeout >IB_SA_LOCAL_SVC_TIMEOUT_MAX ) timeout =IB_SA_LOCAL_SVC_TIMEOUT_MAX ; +spin_lock_irqsave (&ib_nl_request_lock, flags); + delta = timeout - sa_local_svc_timeout_ms;if (delta <0 ) abs_delta = -delta;
@@ -1043,7 +1045,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, abs_delta = delta;if (delta !=0 ) { -spin_lock_irqsave (&ib_nl_request_lock, flags); sa_local_svc_timeout_ms = timeout;list_for_each_entry (query, &ib_nl_request_list, list) {if (delta <0 && abs_delta > query->timeout)
@@ -1061,9 +1062,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,if (delay)mod_delayed_work (ib_nl_wq, &ib_nl_timed_work, (unsigned long )delay); -spin_unlock_irqrestore (&ib_nl_request_lock, flags); } +spin_unlock_irqrestore (&ib_nl_request_lock, flags); + settimeout_out:return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/224 wifi: ath10k: avoid unnecessary wait for service ready message
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") works around the failure in waiting for the service ready message by active polling. Note the polling is triggered after initial wait timeout, which means that the wait-till-timeout can not be avoided even the message is ready.
A possible fix is to do polling once before wait as well, however this can not handle the race that the message arrives right after polling. So the solution is to do periodic polling until timeout.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- 1 file changed, 19 insertions(+), 20 deletions(-)
drivers/net/wireless/ath/ath10k/wmi.c +19 -20
@@ -1720,33 +1720,32 @@ void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,int ath10k_wmi_wait_for_service_ready (struct ath10k *ar) { +unsigned long timeout = jiffies +WMI_SERVICE_READY_TIMEOUT_HZ ;unsigned long time_left, i; - time_left =wait_for_completion_timeout (&ar->wmi.service_ready, -WMI_SERVICE_READY_TIMEOUT_HZ ); -if (!time_left) { -/* Sometimes the PCI HIF doesn't receive interrupt -* for the service ready message even if the buffer -* was completed. PCIe sniffer shows that it's -* because the corresponding CE ring doesn't fires -* it. Workaround here by polling CE rings once. -*/ -ath10k_warn (ar,"failed to receive service ready completion, polling..\n" ); - +/* Sometimes the PCI HIF doesn't receive interrupt +* for the service ready message even if the buffer +* was completed. PCIe sniffer shows that it's +* because the corresponding CE ring doesn't fires +* it. Workaround here by polling CE rings. Since +* the message could arrive at any time, continue +* polling until timeout. +*/ +do {for (i =0 ; i <CE_COUNT ; i++)ath10k_hif_send_complete_check (ar, i,1 ); +/* The 100 ms granularity is a tradeoff considering scheduler +* overhead and response latency +*/ time_left =wait_for_completion_timeout (&ar->wmi.service_ready, -WMI_SERVICE_READY_TIMEOUT_HZ ); -if (!time_left) { -ath10k_warn (ar,"polling timed out\n" ); -return -ETIMEDOUT ; - } - -ath10k_warn (ar,"service ready completion received, continuing normally\n" ); - } +msecs_to_jiffies (100 )); +if (time_left) +return 0 ; + }while (time_before (jiffies, timeout)); -return 0 ; +ath10k_warn (ar,"failed to receive service ready completion\n" ); +return -ETIMEDOUT ; }int ath10k_wmi_wait_for_unified_ready (struct ath10k *ar)
Signature · 1 line
2.51.0
Re: [PATCH 5.4 055/224] wifi: ath10k: avoid unnecessary wait for service ready message
Quoted 1 line · Greg Kroah-Hartman
5.4-stable review patch. If anyone has any objections, please let me know.
Please do not propagate this. This had adverse effects on some platforms and a revert is already in the pipeline:
The revert should hopefully land in v6.18-rc4.
/jeff
Greg Kroah-Hartman
maintainerPATCH 56/224 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/sparc/lib/U1memcpy.S +10 -9
@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) retl add %o0, %o2, %o0 ENDPROC(U1_gs_40_fp) -ENTRY(U1_g3_0_fp) - VISExitHalf - retl - add %g3, %o2, %o0 -ENDPROC(U1_g3_0_fp) ENTRY(U1_g3_8_fp) VISExitHalf add %g3, 8, %g3 retl add %g3, %o2, %o0 ENDPROC(U1_g3_8_fp) +ENTRY(U1_g3_16_fp) + VISExitHalf + add %g3, 16, %g3 + retl + add %g3, %o2, %o0 +ENDPROC(U1_g3_16_fp) ENTRY(U1_o2_0_fp) VISExitHalf retl
@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ 62: FINISH_VISCHUNK(o0, f44, f46) 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) -93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) +93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f0, %f2, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bl,pn %xcc, 95f add %o0, 8, %o0 - EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) + EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f2, %f0, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bge,pt %xcc, 93b add %o0, 8, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/224 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy.
The BUG_ON has been reported in
https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/U3memcpy.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/lib/U3memcpy.S +1 -1
@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ faligndata %f10, %f12, %f26 EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + and %o2, 0x3f, %o2 subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE add %o1, 0x40, %o1 bgu,pt %XCC, 1f
@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ * Also notice how this code is careful not to perform a * load past the end of the src buffer. */ - and %o2, 0x3f, %o2 andcc %o2, 0x38, %g2 be,pn %XCC, 2f subcc %g2, 0x8, %g2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/224 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations and a broken epilogue in the exception handlers. This will prevent crashes and ensure correct return values of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
arch/sparc/lib/NGmemcpy.S +18 -11
@@ -80,8 +80,8 @@ #ifndef EX_RETVAL #define EX_RETVAL(x) x __restore_asi: - ret wr %g0, ASI_AIUS, %asi + ret restore ENTRY(NG_ret_i2_plus_i4_plus_1) ba,pt %xcc, __restore_asi
@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) ba,pt %xcc, __restore_asi add %i2, %g1, %i0 ENDPROC(NG_ret_i2_plus_g1_minus_56) -ENTRY(NG_ret_i2_plus_i4) +ENTRY(NG_ret_i2_plus_i4_plus_16) + add %i4, 16, %i4 ba,pt %xcc, __restore_asi add %i2, %i4, %i0 -ENDPROC(NG_ret_i2_plus_i4) -ENTRY(NG_ret_i2_plus_i4_minus_8) - sub %i4, 8, %i4 +ENDPROC(NG_ret_i2_plus_i4_plus_16) +ENTRY(NG_ret_i2_plus_i4_plus_8) + add %i4, 8, %i4 ba,pt %xcc, __restore_asi add %i2, %i4, %i0 -ENDPROC(NG_ret_i2_plus_i4_minus_8) +ENDPROC(NG_ret_i2_plus_i4_plus_8) ENTRY(NG_ret_i2_plus_8) ba,pt %xcc, __restore_asi add %i2, 8, %i0
@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) ba,pt %xcc, __restore_asi add %i2, %i4, %i0 ENDPROC(NG_ret_i2_and_7_plus_i4) +ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) + and %i2, 7, %i2 + add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +ENDPROC(NG_ret_i2_and_7_plus_i4) #endif .align 64
@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ andn %i2, 0xf, %i4 and %i2, 0xf, %i2 1: subcc %i4, 0x10, %i4 - EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) + EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) add %i1, 0x08, %i1 - EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) + EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) sub %i1, 0x08, %i1 - EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) + EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) add %i1, 0x8, %i1 - EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) + EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) bgu,pt %XCC, 1b add %i1, 0x8, %i1 73: andcc %i2, 0x8, %g0
@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ subcc %i4, 0x8, %i4 srlx %g3, %i3, %i5 or %i5, %g2, %i5 - EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) + EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) add %o0, 0x8, %o0 bgu,pt %icc, 1b sllx %g3, %g1, %g2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/224 sparc: fix accurate exception reporting in copy_to_user for Niagara 4
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a bad calculation. This will fix the return value of copy_to_user in a specific faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/NG4memcpy.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/lib/NG4memcpy.S +1 -1
@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ subcc %o5, 0x20, %o5 EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) - EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) + EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) bne,pt %icc, 1b add %o0, 0x20, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/224 sparc: fix accurate exception reporting in copy_{from,to}_user for M7
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ 2 files changed, 19 insertions(+), 10 deletions(-)
arch/sparc/lib/M7memcpy.S +10 -10
@@ -696,16 +696,16 @@ FUNC_NAME: EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) faligndata %f24, %f26, %f10 EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) - EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) + EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) faligndata %f26, %f28, %f12 - EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) add %o4, 64, %o4 - EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) + EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) faligndata %f28, %f30, %f14 - EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) - EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) + EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) add %o0, 64, %o0 - EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) fsrc2 %f30, %f14 bgu,pt %xcc, .Lunalign_sloop prefetch [%o4 + (8 * BLOCK_SIZE)], 20
@@ -728,7 +728,7 @@ FUNC_NAME: add %o4, 8, %o4 faligndata %f0, %f2, %f16 subcc %o5, 8, %o5 - EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) + EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) fsrc2 %f2, %f0 bgu,pt %xcc, .Lunalign_by8 add %o0, 8, %o0
@@ -772,7 +772,7 @@ FUNC_NAME: subcc %o5, 0x20, %o5 EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) - EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) + EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) bne,pt %xcc, 1b add %o0, 0x20, %o0
@@ -804,12 +804,12 @@ FUNC_NAME: brz,pt %o3, 2f sub %o2, %o3, %o2 -1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) +1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) add %o1, 1, %o1 subcc %o3, 1, %o3 add %o0, 1, %o0 bne,pt %xcc, 1b - EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) + EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) 2: and %o1, 0x7, %o3 brz,pn %o3, .Lmedium_noprefetch_cp
arch/sparc/lib/Memcpy_utils.S +9 -0
@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) ba,pt %xcc, __restore_asi add %o2, 8, %o0 ENDPROC(memcpy_retl_o2_plus_63_8) +ENTRY(memcpy_retl_o2_plus_o3) + ba,pt %xcc, __restore_asi + add %o2, %o3, %o0 +ENDPROC(memcpy_retl_o2_plus_o3) +ENTRY(memcpy_retl_o2_plus_o3_plus_1) + add %o3, 1, %o3 + ba,pt %xcc, __restore_asi + add %o2, %o3, %o0 +ENDPROC(memcpy_retl_o2_plus_o3_plus_1) ENTRY(memcpy_retl_o2_plus_o5) ba,pt %xcc, __restore_asi add %o2, %o5, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/224 remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
enable_irq() and disable_irq() are reference counted, so we must make sure that each enable_irq() is always paired with a single disable_irq(). If we call disable_irq() twice followed by just a single enable_irq(), the IRQ will remain disabled forever.
For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() will end up being called twice, because disable_irq() also happens in qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more sense to have the rollback handled always by qcom_q6v5_unprepare().
--- drivers/remoteproc/qcom_q6v5.c | 3 --- 1 file changed, 3 deletions(-)
drivers/remoteproc/qcom_q6v5.c +0 -3
@@ -113,9 +113,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)int ret; ret =wait_for_completion_timeout (&q6v5->start_done, timeout); -if (!ret) -disable_irq (q6v5->handover_irq); -return !ret ? -ETIMEDOUT :0 ; }EXPORT_SYMBOL_GPL (qcom_q6v5_wait_for_start);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/224 NFSv4.1: fix backchannel max_resp_sz verification check
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
When the client max_resp_sz is larger than what the server encodes in its reply, the nfs4_verify_back_channel_attrs() check fails and this causes nfs4_proc_create_session() to fail, in cases where the client page size is larger than that of the server and the server does not want to negotiate upwards.
While this is not a problem with the linux nfs server that will reflect the proposed value in its reply irrespective of the local page size, other nfs server implementations may insist on their own max_resp_sz value, which could be smaller.
Fix this by accepting smaller max_resp_sz values from the server, as this does not violate the protocol. The server is allowed to decrease but not increase proposed the size, and as such values smaller than the client-proposed ones are valid.
--- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4proc.c +1 -1
@@ -8686,7 +8686,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args goto out;if (rcvd->max_rqst_sz > sent->max_rqst_sz)return -EINVAL ; -if (rcvd->max_resp_sz < sent->max_resp_sz) +if (rcvd->max_resp_sz > sent->max_resp_sz)return -EINVAL ;if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/224 ipvs: Defer ip_vs_ftp unregister during netns cleanup
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slavin Liu <[email protected]>
[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free.
Fix this by introducing a global exiting_module flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.
--- net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/ipvs/ip_vs_ftp.c +3 -1
@@ -53,6 +53,7 @@ enum { IP_VS_FTP_EPSV, }; +static bool exiting_module;/* * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper * First port is set to the default port.
@@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net) {struct netns_ipvs *ipvs =net_ipvs (net); -if (!ipvs) +if (!ipvs || !exiting_module)return ;unregister_ip_vs_app (ipvs, &ip_vs_ftp);
@@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void)*/ static void __exit ip_vs_ftp_exit(void) { + exiting_module = true;unregister_pernet_subsys (&ip_vs_ftp_ops);/* rcu_barrier() is called by netns */ }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/224 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device.
Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal.
[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] <TASK> [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_transport.c +3 -5
@@ -812,11 +812,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,list_for_each_entry_safe (mpt3sas_phy, next_phy, &mpt3sas_port->phy_list, port_siblings) {if ((ioc->logging_level &MPT_DEBUG_TRANSPORT )) -dev_printk (KERN_INFO , &mpt3sas_port->port->dev, -"remove: sas_addr(0x%016llx), phy(%d)\n" , - (unsigned long long ) - mpt3sas_port->remote_identify.sas_address, - mpt3sas_phy->phy_id); +ioc_info (ioc,"remove: sas_addr(0x%016llx), phy(%d)\n" , + (unsigned long long ) mpt3sas_port->remote_identify.sas_address, + mpt3sas_phy->phy_id); mpt3sas_phy->phy_belongs_to_port =0 ;if (!ioc->remove_host) sas_port_delete_phy(mpt3sas_port->port,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/224 usb: vhci-hcd: Prevent suspending virtually attached devices
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
The VHCI platform driver aims to forbid entering system suspend when at least one of the virtual USB ports are bound to an active USB/IP connection.
However, in some cases, the detection logic doesn't work reliably, i.e. when all devices attached to the virtual root hub have been already suspended, leading to a broken suspend state, with unrecoverable resume.
Ensure the virtually attached devices do not enter suspend by setting the syscore PM flag. Note this is currently limited to the client side only, since the server side doesn't implement system suspend prevention.
--- drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/usb/usbip/vhci_hcd.c +22 -0
@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag ctrlreq->wValue, vdev->rhport); vdev->udev =usb_get_dev (urb->dev); +/* +* NOTE: A similar operation has been done via +* USB_REQ_GET_DESCRIPTOR handler below, which is +* supposed to always precede USB_REQ_SET_ADDRESS. +* +* It's not entirely clear if operating on a different +* usb_device instance here is a real possibility, +* otherwise this call and vdev->udev assignment above +* should be dropped. +*/ +dev_pm_syscore_device (&vdev->udev->dev, true);usb_put_dev (old);spin_lock (&vdev->ud.lock);
@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); vdev->udev =usb_get_dev (urb->dev); +/* +* Set syscore PM flag for the virtually attached +* devices to ensure they will not enter suspend on +* the client side. +* +* Note this doesn't have any impact on the physical +* devices attached to the host system on the server +* side, hence there is no need to undo the operation +* on disconnect. +*/ +dev_pm_syscore_device (&vdev->udev->dev, true);usb_put_dev (old); goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/224 RDMA/siw: Always report immediate post SQ errors
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernard Metzler <[email protected]>
[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
In siw_post_send(), any immediate error encountered during processing of the work request list must be reported to the caller, even if previous work requests in that list were just accepted and added to the send queue.
Not reporting those errors confuses the caller, which would wait indefinitely for the failing and potentially subsequently aborted work requests completion.
This fixes a case where immediate errors were overwritten by subsequent code in siw_post_send().
--- drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/infiniband/sw/siw/siw_verbs.c +14 -11
@@ -779,7 +779,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,struct siw_wqe *wqe =tx_wqe (qp);unsigned long flags; -int rv =0 ; +int rv =0 , imm_err =0 ;if (wr && !qp->kernel_verbs) {siw_dbg_qp (qp,"wr must be empty for user mapped sq\n" );
@@ -965,9 +965,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,* Send directly if SQ processing is not in progress. * Eventual immediate errors (rv < 0) do not affect the involved * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ -* processing, if new work is already pending. But rv must be passed -* to caller. +* processing, if new work is already pending. But rv and pointer +* to failed work request must be passed to caller. */ +if (unlikely (rv <0 )) { +/* +* Immediate error +*/ +siw_dbg_qp (qp,"Immediate error %d\n" , rv); + imm_err = rv; + *bad_wr = wr; + }if (wqe->wr_status !=SIW_WR_IDLE ) {spin_unlock_irqrestore (&qp->sq_lock, flags); goto skip_direct_sending;
@@ -992,15 +1000,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,up_read (&qp->state_lock); -if (rv >=0 ) -return 0 ; -/* -* Immediate error -*/ -siw_dbg_qp (qp,"error %d\n" , rv); +if (unlikely (imm_err)) +return imm_err; - *bad_wr = wr; -return rv; +return (rv >=0 ) ?0 : rv; }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/224 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: I Viswanath <[email protected]>
[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning:
rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb);
}rtl8150_set_multicast() {
netif_stop_queue();
netif_wake_queue(); <-- wakes up TX queue before URB is done
}rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb); <-- double submission
}rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization.
The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.
--- drivers/net/usb/rtl8150.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/usb/rtl8150.c +0 -2
@@ -684,7 +684,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)rtl8150_t *dev =netdev_priv (netdev);u16 rx_creg =0x9e ; -netif_stop_queue (netdev);if (netdev->flags &IFF_PROMISC ) { rx_creg |=0x0001 ;dev_info (&netdev->dev,"%s: promiscuous mode\n" , netdev->name);
@@ -698,7 +697,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rx_creg &=0x00fc ; }async_set_registers (dev,RCR ,sizeof (rx_creg), rx_creg); -netif_wake_queue (netdev); } static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/224 ocfs2: fix double free in user_cluster_connect()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.
--- fs/ocfs2/stack_user.c | 1 + 1 file changed, 1 insertion(+)
fs/ocfs2/stack_user.c +1 -0
@@ -1032,6 +1032,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)printk (KERN_ERR "ocfs2: Could not determine" " locking version\n" );user_cluster_disconnect (conn); + lc =NULL ; goto out; }wait_event (lc->oc_wait, (atomic_read (&lc->oc_this_node) >0 ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/224 drivers/base/node: fix double free in register_one_node()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
When device_register() fails in register_node(), it calls put_device(&node->dev). This triggers node_device_release(), which calls kfree(to_node(dev)), thereby freeing the entire node structure.
As a result, when register_node() returns an error, the node memory has already been freed. Calling kfree(node) again in register_one_node() leads to a double free.
This patch removes the redundant kfree(node) from register_one_node() to prevent the double free.
--- drivers/base/node.c | 1 - 1 file changed, 1 deletion(-)
drivers/base/node.c +0 -1
@@ -940,7 +940,6 @@ int __register_one_node(int nid) error =register_node (node_devices[nid], nid);if (error) { node_devices[nid] =NULL ; -kfree (node);return error; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/224 nfp: fix RSS hash key size when RSS is not supported
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when devices don't support RSS, and callers treat the negative value as a large positive value since the return type is u32.
Return 0 when devices don't support RSS, aligning with the ethtool interface .get_rxfh_key_size() that requires returning 0 in such cases.
--- drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +1 -1
@@ -914,7 +914,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)struct nfp_net *nn =netdev_priv (netdev);if (!(nn->cap &NFP_NET_CFG_CTRL_RSS_ANY )) -return -EOPNOTSUPP ; +return 0 ;return nfp_net_rss_key_sz (nn); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/224 net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
In EC2 instances where the RSS hash key is not configurable, ethtool shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally returns ENA_HASH_KEY_SIZE.
Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") added proper handling for devices that don't support RSS hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
When the RSS hash key is not configurable, return 0 instead of ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
Tested on m5 instance families.
Without patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
With patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: Operation not supported
--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +4 -1
@@ -633,7 +633,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)static u32 ena_get_rxfh_key_size (struct net_device *netdev) { -return ENA_HASH_KEY_SIZE ; +struct ena_adapter *adapter =netdev_priv (netdev); +struct ena_rss *rss = &adapter->ena_dev->rss; + +return rss->hash_key ?ENA_HASH_KEY_SIZE :0 ; }static int ena_indirection_table_get (struct ena_adapter *adapter,u32 *indir)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/224 Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
Commit in question breaks the mapping of PGs to pools for some SKUs. Specifically multi-host NICs seem to be shipped with a custom buffer configuration which maps the lossy PG to pool 4. But the bad commit overrides this with pool 0 which does not have sufficient buffer space reserved. Resulting in ~40% packet loss. The commit also breaks BMC / OOB connection completely (100% packet loss).
Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set""). The breakage is exactly the same, the only difference is that quoted commit would break the NIC immediately on boot, and the currently reverted commit only when MTU is changed.
Note: "good" kernels do not restore the configuration, so downgrade isn't enough to recover machines. A NIC power cycle seems to be necessary to return to a healthy state (or overriding the relevant registers using a custom patch).
--- drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 ---------- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 17 --------------- 2 files changed, 1 insertion(+), 28 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +0 -12
@@ -64,23 +64,11 @@ struct mlx5e_port_buffer {struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER ]; }; -#ifdef CONFIG_MLX5_CORE_EN_DCB int mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv,u32 change,unsigned int mtu,struct ieee_pfc *pfc,u32 *buffer_size,u8 *prio2buffer); -#else -static inline int -mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv, -u32 change,unsigned int mtu, -void *pfc, -u32 *buffer_size, -u8 *prio2buffer) -{ -return 0 ; -} -#endif int mlx5e_port_query_buffer (struct mlx5e_priv *priv,struct mlx5e_port_buffer *port_buffer);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -16
@@ -42,7 +42,6 @@#include "eswitch.h" #include "en.h" #include "en/txrx.h" -#include "en/port_buffer.h" #include "en_tc.h" #include "en_rep.h" #include "en_accel/ipsec.h"
@@ -2895,11 +2894,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_struct mlx5e_params *params = &priv->channels.params;struct net_device *netdev = priv->netdev;struct mlx5_core_dev *mdev = priv->mdev; -u16 mtu, prev_mtu; +u16 mtu;int err; -mlx5e_query_mtu (mdev, params, &prev_mtu); - err =mlx5e_set_mtu (mdev, params, params->sw_mtu);if (err)return err;
@@ -2909,18 +2906,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_netdev_warn (netdev,"%s: VPort MTU %d is different than netdev mtu %d\n" , __func__, mtu, params->sw_mtu); -if (mtu != prev_mtu &&MLX5_BUFFER_SUPPORTED (mdev)) { - err =mlx5e_port_manual_buffer_config (priv,0 , mtu, -NULL ,NULL ,NULL ); -if (err) { -netdev_warn (netdev,"%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n" , - __func__, mtu, err, prev_mtu); - -mlx5e_set_mtu (mdev, params, prev_mtu); -return err; - } - } - params->sw_mtu = mtu;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 73/224 Squashfs: fix uninit-value in squashfs_get_parent
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.
Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.
This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory.
Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field.
unsigned int parent_ino = squashfs_i(inode)->parent;
Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access.
The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned.
Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0.
--- fs/squashfs/inode.c | 7 +++++++ fs/squashfs/squashfs_fs_i.h | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-)
fs/squashfs/inode.c +7 -0
@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *insquashfs_i (inode)->start =le32_to_cpu (sqsh_ino->start_block);squashfs_i (inode)->block_list_start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *insquashfs_i (inode)->start =le64_to_cpu (sqsh_ino->start_block);squashfs_i (inode)->block_list_start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *in inode->i_mode |=S_IFLNK ;squashfs_i (inode)->start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ;if (type ==SQUASHFS_LSYMLINK_TYPE ) {__le32 xattr;
@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *inset_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); rdev =le32_to_cpu (sqsh_ino->rdev);init_special_inode (inode, inode->i_mode,new_decode_dev (rdev)); +squashfs_i (inode)->parent =0 ;TRACE ("Device inode %x:%x, rdev %x\n" ,SQUASHFS_INODE_BLK (ino), offset, rdev);
@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *inset_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); rdev =le32_to_cpu (sqsh_ino->rdev);init_special_inode (inode, inode->i_mode,new_decode_dev (rdev)); +squashfs_i (inode)->parent =0 ;TRACE ("Device inode %x:%x, rdev %x\n" ,SQUASHFS_INODE_BLK (ino), offset, rdev);
@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *in inode->i_mode |=S_IFSOCK ;set_nlink (inode,le32_to_cpu (sqsh_ino->nlink));init_special_inode (inode, inode->i_mode,0 ); +squashfs_i (inode)->parent =0 ;break ; }case SQUASHFS_LFIFO_TYPE :
@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *in inode->i_op = &squashfs_inode_ops;set_nlink (inode,le32_to_cpu (sqsh_ino->nlink));init_special_inode (inode, inode->i_mode,0 ); +squashfs_i (inode)->parent =0 ;break ; }default :
fs/squashfs/squashfs_fs_i.h +1 -1
@@ -16,6 +16,7 @@ struct squashfs_inode_info {u64 xattr;unsigned int xattr_size;int xattr_count; +int parent; union { struct { u64 fragment_block;
@@ -27,7 +28,6 @@ struct squashfs_inode_info {u64 dir_idx_start;int dir_idx_offset;int dir_idx_cnt; -int parent; }; };struct inode vfs_inode;
Greg Kroah-Hartman
maintainerPATCH 74/224 uio_hv_generic: Let userspace take care of interrupt mask
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naman Jain <[email protected]>
commit b15b7d2a1b09ef5428a8db260251897405a19496 upstream.
Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, and the user-mode driver will miss an interrupt which will cause a hang.
For eg- when the driver sets inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. So let’s assume that happens, the host puts a message into the ring buffer but does not interrupt.
Subsequently, the user space code in the guest sets the inbound ring buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”. User space code then calls pread() to wait for an interrupt. Then one of two things happens:
* The host never sends another message. So the pread() waits forever.
* The host does send another message. But because there’s already a message in the ring buffer, it doesn’t generate an interrupt. This is the correct behavior, because the host should only send an interrupt when the inbound ring buffer transitions from empty to not-empty. Adding an additional message to a ring buffer that is not empty is not supposed to generate an interrupt on the guest. Since the guest is waiting in pread() and not removing messages from the ring buffer, the pread() waits forever.
This could be easily reproduced in hv_fcopy_uio_daemon if we delay setting interrupt mask to 0.
Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1, there’s a race condition. Once user space empties the inbound ring buffer, but before user space sets interrupt_mask to 0, the host could put another message in the ring buffer but it wouldn’t interrupt. Then the next pread() would hang.
Fix these by removing all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable userspace control the interrupt mask by writing 0/1 to /dev/uioX.
--- drivers/uio/uio_hv_generic.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/uio/uio_hv_generic.c +1 -6
@@ -96,7 +96,6 @@ static void hv_uio_channel_cb(void *contstruct hv_device *hv_dev = chan->device_obj;struct hv_uio_private_data *pdata =hv_get_drvdata (hv_dev); - chan->inbound.ring_buffer->interrupt_mask =1 ;virt_mb ();uio_event_notify (&pdata->info);
@@ -173,8 +172,6 @@ hv_uio_new_channel(struct vmbus_channelreturn ; } -/* Disable interrupts on sub channel */ - new_sc->inbound.ring_buffer->interrupt_mask =1 ;set_channel_read_mode (new_sc,HV_CALL_ISR ); ret =sysfs_create_bin_file (&new_sc->kobj, &ring_buffer_bin_attr);
@@ -218,9 +215,7 @@ hv_uio_open(struct uio_info *info, struc ret =vmbus_connect_ring (dev->channel, hv_uio_channel_cb, dev->channel); -if (ret ==0 ) - dev->channel->inbound.ring_buffer->interrupt_mask =1 ; -else +if (ret)atomic_dec (&pdata->refcnt);return ret;
Greg Kroah-Hartman
maintainerPATCH 75/224 mm: hugetlb: avoid soft lockup when mprotect to large memory area
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream.
When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:
watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24
lr : mte_sync_tags+0x1c0/0x240
sp : ffff80003150bb80
x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000
x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458
x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000
x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000
Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8
Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.
Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.
So add cond_resched() for hugetlb to avoid soft lockup.
--- mm/hugetlb.c | 2 ++ 1 file changed, 2 insertions(+)
mm/hugetlb.c +2 -0
@@ -4703,6 +4703,8 @@ unsigned long hugetlb_change_protection( pages++; }spin_unlock (ptl); + +cond_resched (); }/* * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare
Greg Kroah-Hartman
maintainerPATCH 76/224 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.
Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace.
Initialize ff_up_compat to zero before filling valid fields.
--- drivers/input/misc/uinput.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/misc/uinput.c +1 -0
@@ -740,6 +740,7 @@ static int uinput_ff_upload_to_user(charif (in_compat_syscall ()) {struct uinput_ff_upload_compat ff_up_compat; +memset (&ff_up_compat,0 ,sizeof (ff_up_compat)); ff_up_compat.request_id = ff_up->request_id; ff_up_compat.retval = ff_up->retval;/*
Greg Kroah-Hartman
maintainerPATCH 77/224 pinctrl: check the return value of pinmux_ops::get_function_name()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 upstream.
While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux_ops - pinmux_generic_get_function_name() - can fail and return NULL. This is already checked in pinmux_check_ops() so add a similar check in pinmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dereferenced. This is normal operation when adding new pinfunctions.
--- drivers/pinctrl/pinmux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinmux.c +1 -1
@@ -324,7 +324,7 @@ static int pinmux_func_name_to_selector(while (selector < nfuncs) {const char *fname = ops->get_function_name (pctldev, selector); -if (!strcmp (function, fname)) +if (fname && !strcmp (function, fname))return selector; selector++;
Greg Kroah-Hartman
maintainerPATCH 78/224 clocksource/drivers/clps711x: Fix resource leaks in error paths
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit cd32e596f02fc981674573402c1138f616df1728 upstream.
The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths.
--- drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/clps711x-timer.c +16 -7
@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(stunsigned int irq =irq_of_parse_and_map (np,0 );struct clk *clock =of_clk_get (np,0 );void __iomem *base =of_iomap (np,0 ); +int ret =0 ;if (!base)return -ENOMEM ; -if (!irq) -return -EINVAL ; -if (IS_ERR (clock)) -return PTR_ERR (clock); +if (!irq) { + ret = -EINVAL ; + goto unmap_io; + } +if (IS_ERR (clock)) { + ret =PTR_ERR (clock); + goto unmap_io; + }switch (of_alias_get_id (np,"timer" )) {case CLPS711X_CLKSRC_CLOCKSOURCE :clps711x_clksrc_init (clock, base);break ;case CLPS711X_CLKSRC_CLOCKEVENT : -return _clps711x_clkevt_init (clock, base, irq); + ret =_clps711x_clkevt_init (clock, base, irq); +break ;default : -return -EINVAL ; + ret = -EINVAL ; +break ; } -return 0 ; +unmap_io: +iounmap (base); +return ret; }TIMER_OF_DECLARE (clps711x,"cirrus,ep7209-timer" , clps711x_timer_init);
Greg Kroah-Hartman
maintainerPATCH 79/224 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly.
--- include/linux/iio/frequency/adf4350.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/frequency/adf4350.h +1 -1
@@ -51,7 +51,7 @@/* REG3 Bit Definitions */ #define ADF4350_REG3_12BIT_CLKDIV (x) ((x) << 3) -#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 16) +#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 15)#define ADF4350_REG3_12BIT_CSR_EN (1 << 18)#define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)#define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
Greg Kroah-Hartman
maintainerPATCH 80/224 perf util: Fix compression checks returning -1 as bool
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1.
A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers.
Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch.
--- tools/perf/util/lzma.c | 2 +- tools/perf/util/zlib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/lzma.c +1 -1
@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
tools/perf/util/zlib.c +1 -1
@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/224 rtc: x1205: Fix Xicor X1205 vendor prefix
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered.
--- drivers/rtc/rtc-x1205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-x1205.c +1 -1
@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = {MODULE_DEVICE_TABLE (i2c, x1205_id);static const struct of_device_id x1205_dt_ids[] = { - { .compatible ="xircom,x1205" , }, + { .compatible ="xicor,x1205" , }, {}, };MODULE_DEVICE_TABLE (of, x1205_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/224 perf session: Fix handling when buffer exceeds 2 GiB
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative.
As a result, the perf record command reports an error:
0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly.
--- tools/perf/util/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/session.c +1 -1
@@ -1504,7 +1504,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,struct perf_tool *tool = session->tool;struct perf_sample sample = { .time =0 , };int fd =perf_data__fd (session->data); -int err; +s64 err;if (event->header.type !=PERF_RECORD_COMPRESSED || tool->compressed == perf_session__process_compressed_event_stub)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/224 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series.
Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +9 -7
@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,return 0 ; } -static long lpc18xx_pll0_round_rate (struct clk_hw *hw,unsigned long rate, -unsigned long *prate) +static int lpc18xx_pll0_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) {unsigned long m; -if (*prate < rate) { +if (req->best_parent_rate < req->rate) {pr_warn ("%s: pll dividers not supported\n" , __func__);return -EINVAL ; } - m =DIV_ROUND_UP_ULL (*prate, rate *2 ); + m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 );if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { -pr_warn ("%s: unable to support rate %lu\n" , __func__, rate); +pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; } -return 2 * *prate * m; + req->rate =2 * req->best_parent_rate * m; + +return 0 ; } static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,static const struct clk_ops lpc18xx_pll0_ops = { .recalc_rate = lpc18xx_pll0_recalc_rate, - .round_rate = lpc18xx_pll0_round_rate, + .determine_rate = lpc18xx_pll0_determine_rate, .set_rate = lpc18xx_pll0_set_rate, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/224 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
This ensures proper bounds checking during clk rate setting and rounding.
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +2 -2
@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, } m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; }
@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, } m =DIV_ROUND_UP_ULL (parent_rate, rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, rate);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/224 scsi: libsas: Add sas_task_find_rq()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
blk-mq already provides a unique tag per request. Some libsas LLDDs - like hisi_sas - already use this tag as the unique per-I/O HW tag.
Add a common function to provide the request associated with a sas_task for all libsas LLDDs.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- include/scsi/libsas.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/scsi/libsas.h +18 -0
@@ -620,6 +620,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags);extern struct sas_task *sas_alloc_slow_task (gfp_t flags);extern void sas_free_task (struct sas_task *task); +static inline struct request *sas_task_find_rq (struct sas_task *task) +{ +struct scsi_cmnd *scmd; + +if (task->task_proto &SAS_PROTOCOL_STP_ALL ) { +struct ata_queued_cmd *qc = task->uldd_task; + + scmd = qc ? qc->scsicmd :NULL ; + }else { + scmd = task->uldd_task; + } + +if (!scmd) +return NULL ; + +return scsi_cmd_to_rq (scmd); +} +struct sas_domain_function_template {/* The class calls these to notify the LLDD of an event. */ void (*lldd_port_formed)(struct asd_sas_phy *);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/224 scsi: mvsas: Delete mvs_tag_init()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
All mvs_tag_init() does is zero the tag bitmap, but this is already done with the kzalloc() call to alloc the tags, so delete this unneeded function.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_init.c | 2 -- drivers/scsi/mvsas/mv_sas.c | 7 ------- drivers/scsi/mvsas/mv_sas.h | 1 - 3 files changed, 10 deletions(-)
drivers/scsi/mvsas/mv_init.c +0 -2
@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) } mvi->tags_num = slot_nr; -/* Initialize tags */ -mvs_tag_init (mvi);return 0 ; err_out:return 1 ;
drivers/scsi/mvsas/mv_sas.c +0 -7
@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)return 0 ; } -void mvs_tag_init (struct mvs_info *mvi) -{ -int i; -for (i =0 ; i < mvi->tags_num; ++i) -mvs_tag_clear (mvi, i); -} -static struct mvs_info *mvs_find_dev_mvi (struct domain_device *dev) {unsigned long i =0 , j =0 , hi =0 ;
drivers/scsi/mvsas/mv_sas.h +0 -1
@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);void mvs_tag_free (struct mvs_info *mvi,u32 tag);void mvs_tag_set (struct mvs_info *mvi,unsigned int tag);int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out); -void mvs_tag_init (struct mvs_info *mvi);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/224 scsi: mvsas: Use sas_task_find_rq() for tagging
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
The request associated with a SCSI command coming from the block layer has a unique tag, so use that when possible for getting a slot.
Unfortunately we don't support reserved commands in the SCSI midlayer yet. As such, SMP tasks - as an example - will not have a request associated, so in the interim continue to manage those tags for that type of sas_task internally.
We reserve an arbitrary 4 tags for these internal tags. Indeed, we already decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 slots are used for is not obvious.
Also make the tag management functions static, where possible.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 9 +++++---- drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- drivers/scsi/mvsas/mv_sas.h | 7 +------ 4 files changed, 29 insertions(+), 23 deletions(-)
drivers/scsi/mvsas/mv_defs.h +1 -0
@@ -40,6 +40,7 @@ enum driver_configuration {MVS_ATA_CMD_SZ =96 ,/* SATA command table buffer size */ MVS_OAF_SZ =64 ,/* Open address frame buffer size */ MVS_QUEUE_SIZE =64 ,/* Support Queue depth */ +MVS_RSVD_SLOTS =4 , MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, };
drivers/scsi/mvsas/mv_init.c +5 -4
@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry)cancel_delayed_work (&mwq->work_q); -kfree (mvi->tags); +kfree (mvi->rsvd_tags);kfree (mvi); }
@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)printk (KERN_DEBUG "failed to create dma pool %s.\n" , pool_name); goto err_out; } - mvi->tags_num = slot_nr;return 0 ; err_out:
@@ -368,8 +367,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, mvi->sas = sha; mvi->shost = shost; - mvi->tags =kzalloc (MVS_CHIP_SLOT_SZ >>3 ,GFP_KERNEL ); -if (!mvi->tags) + mvi->rsvd_tags =bitmap_zalloc (MVS_RSVD_SLOTS ,GFP_KERNEL ); +if (!mvi->rsvd_tags) goto err_out;if (MVS_CHIP_DISP ->chip_ioremap (mvi))
@@ -470,6 +469,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,else can_queue =MVS_CHIP_SLOT_SZ ; + can_queue -=MVS_RSVD_SLOTS ; + shost->sg_tablesize =min_t (u16,SG_ALL ,MVS_MAX_SG ); shost->can_queue = can_queue; mvi->shost->cmd_per_lun =MVS_QUEUE_SIZE ;
drivers/scsi/mvsas/mv_sas.c +22 -13
@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)return 0 ; } -void mvs_tag_clear (struct mvs_info *mvi,u32 tag) +static void mvs_tag_clear (struct mvs_info *mvi,u32 tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;clear_bit (tag, bitmap); } -void mvs_tag_free (struct mvs_info *mvi,u32 tag) +static void mvs_tag_free (struct mvs_info *mvi,u32 tag) { +if (tag >=MVS_RSVD_SLOTS ) +return ; +mvs_tag_clear (mvi, tag); } -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) +static void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;set_bit (tag, bitmap); } -inline int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) +static int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) {unsigned int index, tag; -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags; - index =find_first_zero_bit (bitmap, mvi->tags_num); + index =find_first_zero_bit (bitmap,MVS_RSVD_SLOTS ); tag = index; -if (tag >= mvi->tags_num) +if (tag >=MVS_RSVD_SLOTS )return -SAS_QUEUE_FULL ;mvs_tag_set (mvi, tag); *tag_out = tag;
@@ -693,6 +696,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmfstruct mvs_task_exec_info tei;struct mvs_slot_info *slot;u32 tag =0xdeadbeef , n_elem =0 ; +struct request *rq;int rc =0 ;if (!dev->port) {
@@ -757,9 +761,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf n_elem = task->num_scatter; } - rc =mvs_tag_alloc (mvi, &tag); -if (rc) - goto err_out; + rq =sas_task_find_rq (task); +if (rq) { + tag = rq->tag +MVS_RSVD_SLOTS ; + }else { + rc =mvs_tag_alloc (mvi, &tag); +if (rc) + goto err_out; + } slot = &mvi->slot_info[tag];
@@ -862,7 +871,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)static void mvs_slot_free (struct mvs_info *mvi,u32 rx_desc) {u32 slot_idx = rx_desc &RXQ_SLOT_MASK ; -mvs_tag_clear (mvi, slot_idx); +mvs_tag_free (mvi, slot_idx); } static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
drivers/scsi/mvsas/mv_sas.h +1 -6
@@ -370,8 +370,7 @@ struct mvs_info {u32 chip_id;const struct mvs_chip_info *chip; -int tags_num; -unsigned long *tags; +unsigned long *rsvd_tags;/* further per-slot information */ struct mvs_phy phy[MVS_MAX_PHYS ];struct mvs_port port[MVS_MAX_PHYS ];
@@ -424,10 +423,6 @@ struct mvs_task_exec_info {/******************** function prototype *********************/ void mvs_get_sas_addr (void *buf,u32 buflen); -void mvs_tag_clear (struct mvs_info *mvi,u32 tag); -void mvs_tag_free (struct mvs_info *mvi,u32 tag); -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag); -int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/224 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
mvs_pci_remove() |
mvs_free() | mvs_work_queue()
cancel_delayed_work() |
kfree(mvi) |
| mvi-> // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.
This bug was found by static analysis.
--- drivers/scsi/mvsas/mv_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mvsas/mv_init.c +1 -1
@@ -138,7 +138,7 @@ static void mvs_free(struct mvs_info *mvi)if (mvi->shost)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry) -cancel_delayed_work (&mwq->work_q); +cancel_delayed_work_sync (&mwq->work_q);kfree (mvi->rsvd_tags);kfree (mvi); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/224 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1175,9 +1175,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,mlx4_unregister_mac (mdev->dev, priv->port, mac);hlist_del_rcu (&entry->hlist); -kfree_rcu (entry, rcu);en_dbg (DRV , priv,"Removed MAC %pM on port:%d\n" , entry->mac, priv->port); +kfree_rcu (entry, rcu); ++removed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/224 drm/vmwgfx: Fix Use-after-free in validation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +3 -1
@@ -339,8 +339,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, } } node->res =vmw_resource_reference_unless_doomed (res); -if (!node->res) +if (!node->res) { +hash_del_rcu (&node->hash.head);return -ESRCH ; + } node->first_usage =1 ;if (!res->dev_priv->has_mob) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/224 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandr Sapozhnikov <[email protected]>
[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
--- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sm_statefuns.c +2 -1
@@ -873,7 +873,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,return SCTP_DISPOSITION_CONSUME ; nomem_authev: -sctp_ulpevent_free (ai_ev); +if (ai_ev) +sctp_ulpevent_free (ai_ev); nomem_aiev:sctp_ulpevent_free (ev); nomem_ev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/224 tcp: Dont call reqsk_fastopen_remove() in tcp_conn_request().
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]:refcount_t: underflow; use-after-free.
WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
--- net/ipv4/tcp_input.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/tcp_input.c +0 -1
@@ -6800,7 +6800,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, &foc, TCP_SYNACK_FASTOPEN);/* Add the child socket directly into the accept queue */ if (!inet_csk_reqsk_queue_add (sk, req, fastopen_sk)) { -reqsk_fastopen_remove (fastopen_sk, req, false);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk); goto drop_and_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/224 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <[email protected]>
[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node.
--- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fsl_pq_mdio.c +2 -0
@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)"missing 'reg' property in node %pOF\n" , tbi); err = -EBUSY ; +of_node_put (tbi); goto error; }set_tbipa (*prop, pdev, data->get_tbipa, priv->map, &res); +of_node_put (tbi); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/224 tools build: Align warning options with perf
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks.
Make the feature test program use the same warning options as perf.
--- tools/build/feature/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +2 -2
@@ -258,10 +258,10 @@ $(OUTPUT)test-sync-compare-and-swap.bin: $(BUILD) $(OUTPUT)test-compile-32.bin: - $(CC) -m32 -o $@ test-compile.c + $(CC) -m32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-compile-x32.bin: - $(CC) -mx32 -o $@ test-compile.c + $(CC) -mx32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-zlib.bin: $(BUILD) -lz
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/224 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary.
Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - 1 file changed, 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +0 -1
@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (ipi_mbox->dev.parent) { -mbox_controller_unregister (&ipi_mbox->mbox);if (device_is_registered (&ipi_mbox->dev))device_unregister (&ipi_mbox->dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/224 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes.
device_is_registered() is the canonical and robust method to verify the registration status.
Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +2 -4
@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) i = pdata->num_mboxes;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i]; -if (ipi_mbox->dev.parent) { -if (device_is_registered (&ipi_mbox->dev)) -device_unregister (&ipi_mbox->dev); - } +if (device_is_registered (&ipi_mbox->dev)) +device_unregister (&ipi_mbox->dev); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/224 crypto: essiv - Check ssize for decryption and in-place encryption
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
--- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
crypto/essiv.c +6 -8
@@ -203,9 +203,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)const struct essiv_tfm_ctx *tctx =crypto_aead_ctx (tfm);struct essiv_aead_request_ctx *rctx =aead_request_ctx (req);struct aead_request *subreq = &rctx->aead_req; +int ivsize =crypto_aead_ivsize (tfm); +int ssize = req->assoclen - ivsize;struct scatterlist *src = req->src;int err; +if (ssize <0 ) +return -EINVAL ; +crypto_cipher_encrypt_one (tctx->essiv_cipher, req->iv, req->iv);/*
@@ -215,19 +220,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)*/ rctx->assoc =NULL ;if (req->src == req->dst || !enc) { -scatterwalk_map_and_copy (req->iv, req->dst, - req->assoclen -crypto_aead_ivsize (tfm), -crypto_aead_ivsize (tfm),1 ); +scatterwalk_map_and_copy (req->iv, req->dst, ssize, ivsize,1 ); }else {u8 *iv = (u8 *)aead_request_ctx (req) + tctx->ivoffset; -int ivsize =crypto_aead_ivsize (tfm); -int ssize = req->assoclen - ivsize;struct scatterlist *sg;int nents; -if (ssize <0 ) -return -EINVAL ; - nents =sg_nents_for_len (req->src, ssize);if (nents <0 )return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/224 tpm, tpm_tis: Claim locality before writing interrupt registers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lino Sanfilippo <[email protected]>
[ Upstream commit 15d7aa4e46eba87242a320f39773aa16faddadee ]
In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR, TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts. Currently these modifications are done without holding a locality thus they have no effect. Fix this by claiming the (default) locality before the registers are written.
Since now tpm_tis_gen_interrupt() is called with the locality already claimed remove locality request and release from this function.
Stable-dep-of: 8a81236f2cb0 ("tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single")
--- drivers/char/tpm/tpm_tis_core.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/char/tpm/tpm_tis_core.c +11 -9
@@ -633,16 +633,10 @@ static void tpm_tis_gen_interrupt(struct tpm_chip *chip)cap_t cap;int ret; - ret =request_locality (chip,0 ); -if (ret <0 ) -return ; -if (chip->flags &TPM_CHIP_FLAG_TPM2 ) ret =tpm2_get_tpm_pt (chip,0x100 , &cap2, desc);else ret =tpm1_getcap (chip,TPM_CAP_PROP_TIS_TIMEOUT , &cap, desc,0 ); - -release_locality (chip,0 ); }/* Register the IRQ and issue a command that will cause an interrupt. If an
@@ -665,10 +659,16 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, } priv->irq = irq; + rc =request_locality (chip,0 ); +if (rc <0 ) +return rc; + rc =tpm_tis_read8 (priv,TPM_INT_VECTOR (priv->locality), &original_int_vec); -if (rc <0 ) +if (rc <0 ) { +release_locality (chip, priv->locality);return rc; + } rc =tpm_tis_write8 (priv,TPM_INT_VECTOR (priv->locality), irq);if (rc <0 )
@@ -702,10 +702,12 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) {tpm_tis_write8 (priv, original_int_vec,TPM_INT_VECTOR (priv->locality)); -return -1 ; + rc =-1 ; } -return 0 ; +release_locality (chip, priv->locality); + +return rc; }/* Try to find the IRQ the TPM is using. This is for legacy x86 systems that
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/224 tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gunnar Kudrjavets <[email protected]>
[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
The tpm_tis_write8() call specifies arguments in wrong order. Should be (data, addr, value) not (data, value, addr). The initial correct order was changed during the major refactoring when the code was split.
--- drivers/char/tpm/tpm_tis_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +2 -2
@@ -700,8 +700,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,* will call disable_irq which undoes all of the above. */ if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) { -tpm_tis_write8 (priv, original_int_vec, -TPM_INT_VECTOR (priv->locality)); +tpm_tis_write8 (priv,TPM_INT_VECTOR (priv->locality), + original_int_vec); rc =-1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/224 ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Tang <[email protected]>
commit 4aac453deca0d9c61df18d968f8864c3ae7d3d8d upstream.
Previously, after rmmod acpi_tad, modprobe acpi_tad would fail with this dmesg:
sysfs: cannot create duplicate filename '/devices/platform/ACPI000E:00/time'
Call Trace: <TASK> dump_stack_lvl+0x6c/0x90 dump_stack+0x10/0x20 sysfs_warn_dup+0x8b/0xa0 sysfs_add_file_mode_ns+0x122/0x130 internal_create_group+0x1dd/0x4c0 sysfs_create_group+0x13/0x20 acpi_tad_probe+0x147/0x1f0 [acpi_tad] platform_probe+0x42/0xb0 </TASK>
acpi-tad ACPI000E:00: probe with driver acpi-tad failed with error -17
--- drivers/acpi/acpi_tad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_tad.c +3 -0
@@ -563,6 +563,9 @@ static int acpi_tad_remove(struct platfopm_runtime_get_sync (dev); +if (dd->capabilities &ACPI_TAD_RT ) +sysfs_remove_group (&dev->kobj, &acpi_tad_time_attr_group); +if (dd->capabilities &ACPI_TAD_DC_WAKE )sysfs_remove_group (&dev->kobj, &acpi_tad_dc_attr_group);
Greg Kroah-Hartman
maintainerPATCH 101/224 ACPI: debug: fix signedness issues in read/write helpers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Mohammad Jahangirzad <[email protected]>
commit 496f9372eae14775e0524e83e952814691fe850a upstream.
In the ACPI debugger interface, the helper functions for read and write operations use "int" as the length parameter data type. When a large "size_t count" is passed from the file operations, this cast to "int" results in truncation and a negative value due to signed integer representation.
Logically, this negative number propagates to the min() calculation, where it is selected over the positive buffer space value, leading to unexpected behavior. Subsequently, when this negative value is used in copy_to_user() or copy_from_user(), it is interpreted as a large positive value due to the unsigned nature of the size parameter in these functions, causing the copy operations to attempt handling sizes far beyond the intended buffer limits.
Address the issue by:
- Changing the length parameters in acpi_aml_read_user() and acpi_aml_write_user() from "int" to "size_t", aligning with the expected unsigned size semantics.
- Updating return types and local variables in acpi_aml_read() and acpi_aml_write() to "ssize_t" for consistency with kernel file operation conventions.
- Using "size_t" for the "n" variable to ensure calculations remain unsigned.
- Using min_t() for circ_count_to_end() and circ_space_to_end() to ensure type-safe comparisons and prevent integer overflow.
--- drivers/acpi/acpi_dbg.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/acpi/acpi_dbg.c +13 -13
@@ -576,11 +576,11 @@ static int acpi_aml_release(struct inodereturn 0 ; } -static int acpi_aml_read_user (char __user *buf,int len) +static ssize_t acpi_aml_read_user (char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.out_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_read (crc,ACPI_AML_OUT_USER );
@@ -589,7 +589,7 @@ static int acpi_aml_read_user(char __use/* sync head before removing logs */ smp_rmb (); p = &crc->buf[crc->tail]; - n =min (len,circ_count_to_end (crc)); + n =min_t (size_t, len,circ_count_to_end (crc));if (copy_to_user (buf, p, n)) { ret = -EFAULT ; goto out;
@@ -606,8 +606,8 @@ out:static ssize_t acpi_aml_read (struct file *file,char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
@@ -646,11 +646,11 @@ again:return size >0 ? size : ret; } -static int acpi_aml_write_user (const char __user *buf,int len) +static ssize_t acpi_aml_write_user (const char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.in_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_write (crc,ACPI_AML_IN_USER );
@@ -659,7 +659,7 @@ static int acpi_aml_write_user(const cha/* sync tail before inserting cmds */ smp_mb (); p = &crc->buf[crc->head]; - n =min (len,circ_space_to_end (crc)); + n =min_t (size_t, len,circ_space_to_end (crc));if (copy_from_user (p, buf, n)) { ret = -EFAULT ; goto out;
@@ -670,14 +670,14 @@ static int acpi_aml_write_user(const cha ret = n; out:acpi_aml_unlock_fifo (ACPI_AML_IN_USER , ret >=0 ); -return n; +return ret; }static ssize_t acpi_aml_write (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 102/224 arm64: dts: qcom: msm8916: Add missing MDSS reset
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 99b78773c2ae55dcc01025f94eae8ce9700ae985 upstream.
On most MSM8916 devices (aside from the DragonBoard 410c), the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state.
The reset for MDSS is currently missing in msm8916.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers:
dsi_err_worker: status=6
dsi_err_worker: status=6
dsi_err_worker: status=6
...
It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -0
@@ -1599,6 +1599,8 @@ hexagon_smp2p_in: slave-kernel { qcom,entry-name = "slave-kernel"; + resets = <&gcc GCC_MDSS_BCR>; + interrupt-controller; #interrupt-cells = <2>; };
Greg Kroah-Hartman
maintainerPATCH 103/224 xen/manage: Fix suspend error path
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit f770c3d858687252f1270265ba152d5c622e793f upstream.
The device power management API has the following asymmetry:
* dpm_suspend_start() does not clean up on failure (it requires a call to dpm_resume_end())
* dpm_suspend_end() does clean up on failure
(it does not require a call to dpm_resume_start())
The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related patches for 2.6.27") in June 2008: It removed a call to device_resume() from device_suspend() (which was later renamed to dpm_suspend_start()).
When Xen began using the device power management API in May 2008 with commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did not yet exist. But since it was introduced, a call to dpm_resume_end() is missing in the error path of dpm_suspend_start(). Fix it.
Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de>
--- drivers/xen/manage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/manage.c +2 -1
@@ -116,7 +116,7 @@ static void do_suspend(void) err =dpm_suspend_start (PMSG_FREEZE );if (err) {pr_err ("%s: dpm_suspend_start %d\n" , __func__, err); - goto out_thaw; + goto out_resume_end; }printk (KERN_DEBUG "suspending xenstore...\n" );
@@ -156,6 +156,7 @@ out_resume:else xs_suspend_cancel (); +out_resume_end:dpm_resume_end (si.cancelled ?PMSG_THAW :PMSG_RESTORE ); out_thaw:
Greg Kroah-Hartman
maintainerPATCH 104/224 firmware: meson_sm: fix device leak at probe
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream.
Make sure to drop the reference to the secure monitor device taken by of_find_device_by_node() when looking up its driver data on behalf of other drivers (e.g. during probe).
Note that holding a reference to the platform device does not prevent its driver data from going away so there is no point in keeping the reference after the helper returns.
--- drivers/firmware/meson/meson_sm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/firmware/meson/meson_sm.c +6 -1
@@ -223,11 +223,16 @@ EXPORT_SYMBOL(meson_sm_call_write);struct meson_sm_firmware *meson_sm_get (struct device_node *sm_node) {struct platform_device *pdev =of_find_device_by_node (sm_node); +struct meson_sm_firmware *fw;if (!pdev)return NULL ; -return platform_get_drvdata (pdev); + fw =platform_get_drvdata (pdev); + +put_device (&pdev->dev); + +return fw; }EXPORT_SYMBOL_GPL (meson_sm_get);
Greg Kroah-Hartman
maintainerPATCH 105/224 media: i2c: mt9v111: fix incorrect type for ret
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream.
Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() to store negative error codes or zero returned by __mt9v111_hw_reset() and other functions.
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants.
No effect on runtime.
--- drivers/media/i2c/mt9v111.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/mt9v111.c +1 -1
@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(strucstatic int mt9v111_hw_config (struct mt9v111_dev *mt9v111) {struct i2c_client *c = mt9v111->client; -unsigned int ret;u16 outfmtctrl2; +int ret;/* Force device reset. */ ret =__mt9v111_hw_reset (mt9v111);
Greg Kroah-Hartman
maintainerPATCH 106/224 drm/nouveau: fix bad ret code in nouveau_bo_move_prep
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 upstream.
In nouveau_bo_move_prep, if nouveau_mem_map fails, an error code should be returned. Currently, it returns zero even if vmm addr is not correctly mapped.
--- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -1
@@ -1122,7 +1122,7 @@ done:nvif_vmm_put (vmm, &old_mem->vma[1 ]);nvif_vmm_put (vmm, &old_mem->vma[0 ]); } -return 0 ; +return ret; } static int
Greg Kroah-Hartman
maintainerPATCH 107/224 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream.
The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
--- drivers/cpufreq/intel_pstate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/intel_pstate.c +5 -3
@@ -1092,10 +1092,10 @@ static void update_qos_request(enum freqcontinue ; req = policy->driver_data; -cpufreq_cpu_put (policy); - -if (!req) +if (!req) { +cpufreq_cpu_put (policy);continue ; + }if (hwp_active)intel_pstate_get_hwp_max (i, &turbo_max, &max_state);
@@ -1114,6 +1114,8 @@ static void update_qos_request(enum freqif (freq_qos_update_request (req, freq) <0 )pr_warn ("Failed to update freq constraint: CPU%d\n" , i); + +cpufreq_cpu_put (policy); } }
Greg Kroah-Hartman
maintainerPATCH 108/224 crypto: atmel - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit f5d643156ef62216955c119216d2f3815bd51cb1 upstream.
It seems like everywhere in this file, dd->in_sg is mapped with DMA_TO_DEVICE and dd->out_sg is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/atmel-tdes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/atmel-tdes.c +1 -1
@@ -565,7 +565,7 @@ static int atmel_tdes_crypt_start(structif (err && (dd->flags &TDES_FLAGS_FAST )) {dma_unmap_sg (dd->dev, dd->in_sg,1 ,DMA_TO_DEVICE ); -dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_TO_DEVICE ); +dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_FROM_DEVICE ); }return err;
Greg Kroah-Hartman
maintainerPATCH 109/224 iio: dac: ad5360: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit f9381ece76de999a2065d5b4fdd87fa17883978c upstream.
Change the 'ret' variable in ad5360_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5360_write_unlocked().
--- drivers/iio/dac/ad5360.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5360.c +1 -1
@@ -259,7 +259,7 @@ static int ad5360_update_ctrl(struct iio unsigned int clr) {struct ad5360_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&indio_dev->mlock);
Greg Kroah-Hartman
maintainerPATCH 110/224 iio: dac: ad5421: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit 3379c900320954d768ed9903691fb2520926bbe3 upstream.
Change the 'ret' variable in ad5421_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5421_write_unlocked().
--- drivers/iio/dac/ad5421.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5421.c +1 -1
@@ -183,7 +183,7 @@ static int ad5421_update_ctrl(struct iio unsigned int clr) {struct ad5421_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&indio_dev->mlock);
Greg Kroah-Hartman
maintainerPATCH 111/224 iio: frequency: adf4350: Fix prescaler usage.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d upstream.
The ADF4350/1 features a programmable dual-modulus prescaler of 4/5 or 8/9. When set to 4/5, the maximum RF frequency allowed is 3 GHz. Therefore, when operating the ADF4351 above 3 GHz, this must be set to 8/9. In this context not the RF output frequency is meant
- it's the VCO frequency.
Therefore move the prescaler selection after we derived the VCO frequency from the desired RF output frequency.
This BUG may have caused PLL lock instabilities when operating the VCO at the very high range close to 4.4 GHz.
--- drivers/iio/frequency/adf4350.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/iio/frequency/adf4350.c +13 -7
@@ -137,6 +137,19 @@ static int adf4350_set_freq(struct adf43if (freq >ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq)return -EINVAL ; + st->r4_rf_div_sel =0 ; + +/* +* !\TODO: The below computation is making sure we get a power of 2 +* shift (st->r4_rf_div_sel) so that freq becomes higher or equal to +* ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() +* and friends. +*/ +while (freq <ADF4350_MIN_VCO_FREQ ) { + freq <<=1 ; + st->r4_rf_div_sel++; + } +if (freq >ADF4350_MAX_FREQ_45_PRESC ) { prescaler =ADF4350_REG1_PRESCALER ; mdiv =75 ;
@@ -145,13 +158,6 @@ static int adf4350_set_freq(struct adf43 mdiv =23 ; } - st->r4_rf_div_sel =0 ; - -while (freq <ADF4350_MIN_VCO_FREQ ) { - freq <<=1 ; - st->r4_rf_div_sel++; - } -/* * Allow a predefined reference division factor * if not set, compute our own
Greg Kroah-Hartman
maintainerPATCH 112/224 lib/genalloc: fix device leak in of_gen_pool_get()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1260cbcffa608219fc9188a6cbe9c45a300ef8b5 upstream.
Make sure to drop the reference taken when looking up the genpool platform device in of_gen_pool_get() before returning the pool.
Note that holding a reference to a device does typically not prevent its devres managed resources from being released so there is no point in keeping the reference.
--- lib/genalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
lib/genalloc.c +4 -1
@@ -892,8 +892,11 @@ struct gen_pool *of_gen_pool_get(structif (!name) name = np_pool->name; } -if (pdev) +if (pdev) { pool =gen_pool_get (&pdev->dev, name); +put_device (&pdev->dev); + } +of_node_put (np_pool);return pool;
Greg Kroah-Hartman
maintainerPATCH 113/224 parisc: dont reference obsolete termio struct for TC* constants
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam James <[email protected]>
commit 8ec5a066f88f89bd52094ba18792b34c49dcd55a upstream.
Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead.
This fixes building Python for example, which falls over like:
./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
--- arch/parisc/include/uapi/asm/ioctls.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/parisc/include/uapi/asm/ioctls.h +4 -4
@@ -10,10 +10,10 @@#define TCSETS _IOW('T', 17, struct termios)/* TCSETATTR */ #define TCSETSW _IOW('T', 18, struct termios)/* TCSETATTRD */ #define TCSETSF _IOW('T', 19, struct termios)/* TCSETATTRF */ -#define TCGETA _IOR('T', 1, struct termio) -#define TCSETA _IOW('T', 2, struct termio) -#define TCSETAW _IOW('T', 3, struct termio) -#define TCSETAF _IOW('T', 4, struct termio) +#define TCGETA 0x40125401 +#define TCSETA 0x80125402 +#define TCSETAW 0x80125403 +#define TCSETAF 0x80125404#define TCSBRK _IO('T', 5)#define TCXONC _IO('T', 6)#define TCFLSH _IO('T', 7)
Greg Kroah-Hartman
maintainerPATCH 114/224 scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit b81296591c567b12d3873b05a37b975707959b94 upstream.
Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally.
Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0).
--- drivers/scsi/hpsa.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/scsi/hpsa.c +12 -9
@@ -6508,18 +6508,21 @@ static int hpsa_big_passthru_ioctl(strucwhile (left) { sz = (left > ioc->malloc_size) ? ioc->malloc_size : left; buff_size[sg_used] = sz; - buff[sg_used] =kmalloc (sz,GFP_KERNEL ); -if (buff[sg_used] ==NULL ) { - status = -ENOMEM ; - goto cleanup1; - } +if (ioc->Request.Type.Direction &XFER_WRITE ) { -if (copy_from_user (buff[sg_used], data_ptr, sz)) { - status = -EFAULT ; + buff[sg_used] =memdup_user (data_ptr, sz); +if (IS_ERR (buff[sg_used])) { + status =PTR_ERR (buff[sg_used]); + goto cleanup1; + } + }else { + buff[sg_used] =kzalloc (sz,GFP_KERNEL ); +if (!buff[sg_used]) { + status = -ENOMEM ; goto cleanup1; } - }else -memset (buff[sg_used],0 , sz); + } + left -= sz; data_ptr += sz; sg_used++;
Greg Kroah-Hartman
maintainerPATCH 115/224 sctp: Fix MAC comparison to be constant-time
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit dd91c79e4f58fbe2898dac84858033700e0e99fb upstream.
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
--- net/sctp/sm_make_chunk.c | 3 ++- net/sctp/sm_statefuns.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/sctp/sm_make_chunk.c +2 -1
@@ -31,6 +31,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt#include <crypto/hash.h> +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -1758,7 +1759,7 @@ struct sctp_association *sctp_unpack_coo } } -if (memcmp (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { +if (crypto_memneq (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { *error = -SCTP_IERROR_BAD_SIG ; goto fail; }
net/sctp/sm_statefuns.c +2 -1
@@ -30,6 +30,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -4303,7 +4304,7 @@ static enum sctp_ierror sctp_sf_authenti sh_key, GFP_ATOMIC);/* Discard the packet if the digests do not match */ -if (memcmp (save_digest, digest, sig_len)) { +if (crypto_memneq (save_digest, digest, sig_len)) {kfree (save_digest);return SCTP_IERROR_BAD_SIG ; }
Greg Kroah-Hartman
maintainerPATCH 116/224 sparc64: fix hugetlb for sun4u
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Yznaga <[email protected]>
commit 6fd44a481b3c6111e4801cec964627791d0f3ec5 upstream.
An attempt to exercise sparc hugetlb code in a sun4u-based guest running under qemu results in the guest hanging due to being stuck in a trap loop. This is due to invalid hugetlb TTEs being installed that do not have the expected _PAGE_PMD_HUGE and page size bits set. Although the breakage has gone apparently unnoticed for several years, fix it now so there is the option to exercise sparc hugetlb code under qemu. This can be useful because sun4v support in qemu does not support linux guests currently and sun4v-based hardware resources may not be readily available.
Fix tested with a 6.15.2 and 6.16-rc6 kernels by running libhugetlbfs tests on a qemu guest running Debian 13.
--- arch/sparc/mm/hugetlbpage.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
arch/sparc/mm/hugetlbpage.c +20 -0
@@ -134,6 +134,26 @@ hugetlb_get_unmapped_area(struct file *fstatic pte_t sun4u_hugepage_shift_to_tte (pte_t entry,unsigned int shift) { +unsigned long hugepage_size = _PAGE_SZ4MB_4U; + +pte_val (entry) =pte_val (entry) & ~_PAGE_SZALL_4U; + +switch (shift) { +case HPAGE_256MB_SHIFT : + hugepage_size = _PAGE_SZ256MB_4U; +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_SHIFT : +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_64K_SHIFT : + hugepage_size = _PAGE_SZ64K_4U; +break ; +default : +WARN_ONCE (1 ,"unsupported hugepage shift=%u\n" , shift); + } + +pte_val (entry) =pte_val (entry) | hugepage_size;return entry; }
Greg Kroah-Hartman
maintainerPATCH 117/224 sparc: fix error handling in scan_one_device()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 302c04110f0ce70d25add2496b521132548cd408 upstream.
Once of_device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it could cause memory leak. So fix this by calling put_device(), then the name can be freed in kobject_cleanup().
Calling path: of_device_register() -> of_device_add() -> device_add(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.
Found by code review.
--- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + 2 files changed, 2 insertions(+)
arch/sparc/kernel/of_device_32.c +1 -0
@@ -387,6 +387,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
arch/sparc/kernel/of_device_64.c +1 -0
@@ -680,6 +680,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 118/224 mtd: rawnand: fsmc: Default to autodetect buswidth
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit b8df622cf7f6808c85764e681847150ed6d85f3d upstream.
If you don't specify buswidth 2 (16 bits) in the device tree, FSMC doesn't even probe anymore:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro 10100000.flash
nand: bus width 8 instead of 16 bits
nand: No NAND device found
fsmc-nand 10100000.flash: probe with driver fsmc-nand failed
with error -22
With this patch to use autodetection unless buswidth is specified, the device is properly detected again:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro NAND 128MiB 1,8V 16-bit
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 fsmc-nand 10100000.flash: Using 1-bit HW ECC scheme Scanning device for bad blocks
I don't know where or how this happened, I think some change in the nand core.
--- drivers/mtd/nand/raw/fsmc_nand.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/fsmc_nand.c +5 -1
@@ -861,10 +861,14 @@ static int fsmc_nand_probe_config_dt(strif (!of_property_read_u32 (np,"bank-width" , &val)) {if (val ==2 ) { nand->options |=NAND_BUSWIDTH_16 ; - }else if (val !=1 ) { + }else if (val ==1 ) { + nand->options |=NAND_BUSWIDTH_AUTO ; + }else {dev_err (&pdev->dev,"invalid bank-width %u\n" , val);return -EINVAL ; } + }else { + nand->options |=NAND_BUSWIDTH_AUTO ; }if (of_get_property (np,"nand-skip-bbtscan" ,NULL ))
Greg Kroah-Hartman
maintainerPATCH 119/224 mmc: core: SPI mode remove cmd7
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Chen <[email protected]>
commit fec40f44afdabcbc4a7748e4278f30737b54bb1a upstream.
SPI mode doesn't support cmd7, so remove it in mmc_sdio_alive() and confirm if sdio is active by checking CCCR register value is available or not.
--- drivers/mmc/core/sdio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/core/sdio.c +5 -1
@@ -868,7 +868,11 @@ static void mmc_sdio_remove(struct mmc_h*/ static int mmc_sdio_alive (struct mmc_host *host) { -return mmc_select_card (host->card); +if (!mmc_host_is_spi (host)) +return mmc_select_card (host->card); +else +return mmc_io_rw_direct (host->card,0 ,0 ,SDIO_CCCR_CCCR ,0 , +NULL ); }/*
Greg Kroah-Hartman
maintainerPATCH 120/224 rtc: interface: Ensure alarm irq is enabled when UIE is enabled
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 9db26d5855d0374d4652487bfb5aacf40821c469 upstream.
When setting a normal alarm, user-space is responsible for using RTC_AIE_ON/RTC_AIE_OFF to control if alarm irq should be enabled.
But when RTC_UIE_ON is used, interrupts must be enabled so that the requested irq events are generated.
When RTC_UIE_OFF is used, alarm irq is disabled if there are no other alarms queued, so this commit brings symmetry to that.
--- drivers/rtc/interface.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/rtc/interface.c +4 -0
@@ -577,6 +577,10 @@ int rtc_update_irq_enable(struct rtc_dev rtc->uie_rtctimer.node.expires =ktime_add (now, onesec); rtc->uie_rtctimer.period =ktime_set (1 ,0 ); err =rtc_timer_enqueue (rtc, &rtc->uie_rtctimer); +if (!err && rtc->ops && rtc->ops->alarm_irq_enable) + err = rtc->ops->alarm_irq_enable (rtc->dev.parent,1 ); +if (err) + goto out; }else {rtc_timer_remove (rtc, &rtc->uie_rtctimer); }
Greg Kroah-Hartman
maintainerPATCH 121/224 rtc: interface: Fix long-standing race when setting alarm
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 795cda8338eab036013314dbc0b04aae728880ab upstream.
As described in the old comment dating back to
commit 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") from 2010, we have been living with a race window when setting alarm with an expiry in the near future (i.e. next second).
With 1 second resolution, it can happen that the second ticks after the check for the timer having expired, but before the alarm is actually set. When this happen, no alarm IRQ is generated, at least not with some RTC chips (isl12022 is an example of this).
With UIE RTC timer being implemented on top of alarm irq, being re-armed every second, UIE will occasionally fail to work, as an alarm irq lost due to this race will stop the re-arming loop.
For now, I have limited the additional expiry check to only be done for alarms set to next seconds. I expect it should be good enough, although I don't know if we can now for sure that systems with loads could end up causing the same problems for alarms set 2 seconds or even longer in the future.
I haven't been able to reproduce the problem with this check in place.
--- drivers/rtc/interface.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/rtc/interface.c +23 -0
@@ -442,6 +442,29 @@ static int __rtc_set_alarm(struct rtc_deelse err = rtc->ops->set_alarm (rtc->dev.parent, alarm); +/* +* Check for potential race described above. If the waiting for next +* second, and the second just ticked since the check above, either +* +* 1) It ticked after the alarm was set, and an alarm irq should be +* generated. +* +* 2) It ticked before the alarm was set, and alarm irq most likely will +* not be generated. +* +* While we cannot easily check for which of these two scenarios we +* are in, we can return -ETIME to signal that the timer has already +* expired, which is true in both cases. +*/ +if ((scheduled - now) <=1 ) { + err =__rtc_read_time (rtc, &tm); +if (err) +return err; + now =rtc_tm_to_time64 (&tm); +if (scheduled <= now) +return -ETIME ; + } +trace_rtc_set_alarm (rtc_tm_to_time64 (&alarm->time), err);return err; }
Greg Kroah-Hartman
maintainerPATCH 122/224 rseq/selftests: Use weak symbol reference, not definition, to link with glibc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit a001cd248ab244633c5fabe4f7c707e13fc1d1cc upstream.
Add "extern" to the glibc-defined weak rseq symbols to convert the rseq selftest's usage from weak symbol definitions to weak symbol _references_. Effectively re-defining the glibc symbols wreaks havoc when building with -fno-common, e.g. generates segfaults when running multi-threaded programs, as dynamically linked applications end up with multiple versions of the symbols.
Building with -fcommon, which until recently has the been the default for GCC and clang, papers over the bug by allowing the linker to resolve the weak/tentative definition to glibc's "real" definition.
Note, the symbol itself (or rather its address), not the value of the symbol, is set to 0/NULL for unresolved weak symbol references, as the symbol doesn't exist and thus can't have a value. Check for a NULL rseq size pointer to handle the scenario where the test is statically linked against a libc that doesn't support rseq in any capacity.
--- tools/testing/selftests/rseq/rseq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/rseq/rseq.c +4 -4
@@ -38,9 +38,9 @@* Define weak versions to play nice with binaries that are statically linked * against a libc that doesn't support registering its own rseq. */ -__weak ptrdiff_t __rseq_offset; -__weak unsigned int __rseq_size; -__weak unsigned int __rseq_flags; +extern __weak ptrdiff_t __rseq_offset; +extern __weak unsigned int __rseq_size; +extern __weak unsigned int __rseq_flags;static const ptrdiff_t *libc_rseq_offset_p = &__rseq_offset;static const unsigned int *libc_rseq_size_p = &__rseq_size;
@@ -124,7 +124,7 @@ void rseq_init(void)* libc not having registered a restartable sequence. Try to find the * symbols if that's the case. */ -if (!*libc_rseq_size_p) { +if (!libc_rseq_size_p || !*libc_rseq_size_p) { libc_rseq_offset_p =dlsym (RTLD_NEXT ,"__rseq_offset" ); libc_rseq_size_p =dlsym (RTLD_NEXT ,"__rseq_size" ); libc_rseq_flags_p =dlsym (RTLD_NEXT ,"__rseq_flags" );
Greg Kroah-Hartman
maintainerPATCH 123/224 PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 upstream.
Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs.
Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()") such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls.
On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed:
PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56)
GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001
00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8
#0 [3800313fb20] device_del at c9158ad5c
#1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390
#9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2.
This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy.
Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper.
Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking.
--- drivers/pci/iov.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/iov.c +5 -0
@@ -431,15 +431,18 @@ static int sriov_add_vfs(struct pci_devif (dev->no_vf_scan)return 0 ; +pci_lock_rescan_remove ();for (i =0 ; i < num_vfs; i++) { rc =pci_iov_add_virtfn (dev, i);if (rc) goto failed; } +pci_unlock_rescan_remove ();return 0 ; failed:while (i--)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove ();return rc; }
@@ -562,8 +565,10 @@ static void sriov_del_vfs(struct pci_devif (dev->no_vf_scan)return ; +pci_lock_rescan_remove ();for (i =0 ; i < iov->num_VFs; i++)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove (); }static void sriov_disable (struct pci_dev *dev)
Greg Kroah-Hartman
maintainerPATCH 124/224 PCI/AER: Fix missing uevent on recovery when a reset is requested
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit bbf7d0468d0da71d76cc6ec9bc8a224325d07b6b upstream.
Since commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") AER uses the result of error_detected() as parameter to pci_uevent_ers(). As pci_uevent_ers() however does not handle PCI_ERS_RESULT_NEED_RESET this results in a missing uevent for the beginning of recovery if drivers request a reset. Fix this by treating PCI_ERS_RESULT_NEED_RESET as beginning recovery.
--- drivers/pci/pci-driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/pci-driver.c +1 -0
@@ -1603,6 +1603,7 @@ void pci_uevent_ers(struct pci_dev *pdevswitch (err_type) {case PCI_ERS_RESULT_NONE :case PCI_ERS_RESULT_CAN_RECOVER : +case PCI_ERS_RESULT_NEED_RESET : envp[idx++] ="ERROR_EVENT=BEGIN_RECOVERY" ; envp[idx++] ="DEVICE_ONLINE=0" ;break ;
Greg Kroah-Hartman
maintainerPATCH 125/224 PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit e51d05f523e43ce5d2bad957943a2b14f68078cd upstream.
Commit under Fixes introduced the IRQ handler for "ks-pcie-error-irq". The interrupt is acquired using "request_irq()" but is never freed if the driver exits due to an error. Although the section in the driver that invokes "request_irq()" has moved around over time, the issue hasn't been addressed until now.
Fix this by using "devm_request_irq()" which automatically frees the interrupt if the driver exits.
--- drivers/pci/controller/dwc/pci-keystone.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pci-keystone.c +2 -2
@@ -1294,8 +1294,8 @@ static int ks_pcie_probe(struct platformreturn irq; } - ret =request_irq (irq, ks_pcie_err_irq_handler,IRQF_SHARED , -"ks-pcie-error-irq" , ks_pcie); + ret =devm_request_irq (dev, irq, ks_pcie_err_irq_handler,IRQF_SHARED , +"ks-pcie-error-irq" , ks_pcie);if (ret <0 ) {dev_err (dev,"failed to request error IRQ %d\n" , irq);
Greg Kroah-Hartman
maintainerPATCH 126/224 x86/umip: Check that the instruction opcode is at least two bytes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 32278c677947ae2f042c9535674a7fff9a245dd3 upstream.
When checking for a potential UMIP violation on #GP, verify the decoder found at least two opcode bytes to avoid false positives when the kernel encounters an unknown instruction that starts with 0f. Because the array of opcode.bytes is zero-initialized by insn_init(), peeking at bytes[1] will misinterpret garbage as a potential SLDT or STR instruction, and can incorrectly trigger emulation.
E.g. if a VPALIGNR instruction
62 83 c5 05 0f 08 ff vpalignr xmm17{k5},xmm23,XMMWORD PTR [r8],0xff
hits a #GP, the kernel emulates it as STR and squashes the #GP (and corrupts the userspace code stream).
Arguably the check should look for exactly two bytes, but no three byte opcodes use '0f 00 xx' or '0f 01 xx' as an escape, i.e. it should be impossible to get a false positive if the first two opcode bytes match '0f 00' or '0f 01'. Go with a more conservative check with respect to the existing code to minimize the chances of breaking userspace, e.g. due to decoder weirdness.
Analyzed by Nick Bray <[email protected]>.
--- arch/x86/kernel/umip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/umip.c +2 -2
@@ -155,8 +155,8 @@ static int identify_insn(struct insn *inif (!insn->modrm.nbytes)return -EINVAL ; -/* All the instructions of interest start with 0x0f. */ -if (insn->opcode.bytes[0 ] !=0xf ) +/* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */ +if (insn->opcode.nbytes <2 || insn->opcode.bytes[0 ] !=0xf )return -EINVAL ;if (insn->opcode.bytes[1 ] ==0x1 ) {
Greg Kroah-Hartman
maintainerPATCH 127/224 x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 27b1fd62012dfe9d3eb8ecde344d7aa673695ecf upstream.
Filter out the register forms of 0F 01 when determining whether or not to emulate in response to a potential UMIP violation #GP, as SGDT and SIDT only accept memory operands. The register variants of 0F 01 are used to encode instructions for things like VMX and SGX, i.e. not checking the Mod field would cause the kernel to incorrectly emulate on #GP, e.g. due to a CPL violation on VMLAUNCH.
--- arch/x86/kernel/umip.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kernel/umip.c +11 -0
@@ -162,8 +162,19 @@ static int identify_insn(struct insn *inif (insn->opcode.bytes[1 ] ==0x1 ) {switch (X86_MODRM_REG (insn->modrm.value)) {case 0 : +/* The reg form of 0F 01 /0 encodes VMX instructions. */ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SGDT ;case 1 : +/* +* The reg form of 0F 01 /1 encodes MONITOR/MWAIT, +* STAC/CLAC, and ENCLS. +*/ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SIDT ;case 4 :return UMIP_INST_SMSW ;
Greg Kroah-Hartman
maintainerPATCH 128/224 nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit a082e4b4d08a4a0e656d90c2c05da85f23e6d0c9 upstream.
When v3 NLM request finds a conflicting delegation, it triggers a delegation recall and nfsd_open fails with EAGAIN. nfsd_open then translates EAGAIN into nfserr_jukebox. In nlm_fopen, instead of returning nlm_failed for when there is a conflicting delegation, drop this NLM request so that the client retries. Once delegation is recalled and if a local lock is claimed, a retry would lead to nfsd returning a nlm_lck_blocked error or a successful nlm lock.
--- fs/nfsd/lockd.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/nfsd/lockd.c +15 -0
@@ -44,6 +44,21 @@ nlm_fopen(struct svc_rqst *rqstp, structswitch (nfserr) {case nfs_ok:return 0 ; +case nfserr_jukebox: +/* this error can indicate a presence of a conflicting +* delegation to an NLM lock request. Options are: +* (1) For now, drop this request and make the client +* retry. When delegation is returned, client's lock retry +* will complete. +* (2) NLM4_DENIED as per "spec" signals to the client +* that the lock is unavailable now but client can retry. +* Linux client implementation does not. It treats +* NLM4_DENIED same as NLM4_FAILED and errors the request. +* (3) For the future, treat this as blocked lock and try +* to callback when the delegation is returned but might +* not have a proper lock request to block on. +*/ + fallthrough;case nfserr_dropit:return nlm_drop_reply;case nfserr_stale:
Greg Kroah-Hartman
maintainerPATCH 129/224 ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Sun <[email protected]>
commit 9d80eaa1a1d37539224982b76c9ceeee736510b9 upstream.
After running a stress test combined with fault injection, we performed fsck -a followed by fsck -fn on the filesystem image. During the second pass, fsck -fn reported:
Inode 131512, end of extent exceeds allowed value
(logical block 405, physical block 1180540, len 2)
This inode was not in the orphan list. Analysis revealed the following call chain that leads to the inconsistency:
ext4_da_write_end()
//does not update i_disksize
ext4_punch_hole()
//truncate folio, keep size
ext4_page_mkwrite()
ext4_block_page_mkwrite()
ext4_block_write_begin()
ext4_get_block()
//insert written extent without update i_disksizejournal commit
echo 1 > /sys/block/xxx/device/delete
da-write path updates i_size but does not update i_disksize. Then ext4_punch_hole truncates the da-folio yet still leaves i_disksize unchanged(in the ext4_update_disksize_before_punch function, the condition offset + len < size is met). Then ext4_page_mkwrite sees ext4_nonda_switch return 1 and takes the nodioread_nolock path, the folio about to be written has just been punched out, and it’s offset sits beyond the current i_disksize. This may result in a written extent being inserted, but again does not update i_disksize. If the journal gets committed and then the block device is yanked, we might run into this. It should be noted that replacing ext4_punch_hole with ext4_zero_range in the call sequence may also trigger this issue, as neither will update i_disksize under these circumstances.
To fix this, we can modify ext4_update_disksize_before_punch to increase i_disksize to min(i_size, offset + len) when both i_size and (offset + len) are greater than i_disksize.
Message-ID: <[email protected]>
--- fs/ext4/inode.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/ext4/inode.c +8 -2
@@ -4247,7 +4247,11 @@ int ext4_can_truncate(struct inode *inod* We have to make sure i_disksize gets properly updated before we truncate * page cache due to hole punching or zero range. Otherwise i_disksize update * can get lost as it may have been postponed to submission of writeback but -* that will never happen after we truncate page cache. +* that will never happen if we remove the folio containing i_size from the +* page cache. Also if we punch hole within i_size but above i_disksize, +* following ext4_page_mkwrite() may mistakenly allocate written blocks over +* the hole and thus introduce allocated blocks beyond i_disksize which is +* not allowed (e2fsck would complain in case of crash). */ int ext4_update_disksize_before_punch (struct inode *inode,loff_t offset,loff_t len)
@@ -4256,9 +4260,11 @@ int ext4_update_disksize_before_punch(stloff_t size =i_size_read (inode);WARN_ON (!inode_is_locked (inode)); -if (offset > size || offset + len < size) +if (offset > size)return 0 ; +if (offset + len < size) + size = offset + len;if (EXT4_I (inode)->i_disksize >= size)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 130/224 ext4: correctly handle queries for metadata mappings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
commit 46c22a8bb4cb03211da1100d7ee4a2005bf77c70 upstream.
Currently, our handling of metadata is _ambiguous_ in some scenarios, that is, we end up returning unknown if the range only covers the mapping partially.
For example, in the following case:
$ xfs_io -c fsmap -d
0: 254:16 [0..7]: static fs metadata 8
1: 254:16 [8..15]: special 102:1 8
2: 254:16 [16..5127]: special 102:2 5112
3: 254:16 [5128..5255]: special 102:3 128
4: 254:16 [5256..5383]: special 102:4 128
5: 254:16 [5384..70919]: inodes 65536
6: 254:16 [70920..70967]: unknown 48
...
$ xfs_io -c fsmap -d 24 33
0: 254:16 [24..39]: unknown 16 <--- incomplete reporting
$ xfs_io -c fsmap -d 24 33 (With patch)
0: 254:16 [16..5127]: special 102:2 5112
This is because earlier in ext4_getfsmap_meta_helper, we end up ignoring any extent that starts before our queried range, but overlaps it. While the man page [1] is a bit ambiguous on this, this fix makes the output make more sense since we are anyways returning an "unknown" extent. This is also consistent to how XFS does it:
$ xfs_io -c fsmap -d
...
6: 254:16 [104..127]: free space 24
7: 254:16 [128..191]: inodes 64
...
$ xfs_io -c fsmap -d 137 150
0: 254:16 [128..191]: inodes 64 <-- full extent returned
[1] https://man7.org/linux/man-pages/man2/ioctl_getfsmap.2.html
Message-ID: <023f37e35ee280cd9baac0296cbadcbe10995cab.1757058211.git.ojaswin@linux.ibm.com>
--- fs/ext4/fsmap.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/ext4/fsmap.c +9 -5
@@ -74,7 +74,8 @@ static int ext4_getfsmap_dev_compare(constatic bool ext4_getfsmap_rec_before_low_key (struct ext4_getfsmap_info *info,struct ext4_fsmap *rec) { -return rec->fmr_physical < info->gfi_low.fmr_physical; +return rec->fmr_physical + rec->fmr_length <= + info->gfi_low.fmr_physical; }/*
@@ -200,15 +201,18 @@ static int ext4_getfsmap_meta_helper(str ext4_group_first_block_no(sb, agno)); fs_end = fs_start +EXT4_C2B (sbi, len); -/* Return relevant extents from the meta_list */ +/* +* Return relevant extents from the meta_list. We emit all extents that +* partially/fully overlap with the query range +*/ list_for_each_entry_safe (p, tmp, &info->gfi_meta_list, fmr_list) { -if (p->fmr_physical < info->gfi_next_fsblk) { +if (p->fmr_physical + p->fmr_length <= info->gfi_next_fsblk) {list_del (&p->fmr_list);kfree (p);continue ; } -if (p->fmr_physical <= fs_start || - p->fmr_physical + p->fmr_length <= fs_end) { +if (p->fmr_physical <= fs_end && + p->fmr_physical + p->fmr_length > fs_start) {/* Emit the retained free extent record if present */ if (info->gfi_lastfree.fmr_owner) { error = ext4_getfsmap_helper(sb, info,
Greg Kroah-Hartman
maintainerPATCH 131/224 ext4: guard against EA inode refcount underflow in xattr update
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmet Eray Karadag <[email protected]>
commit 57295e835408d8d425bef58da5253465db3d6888 upstream.
syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:
EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117
Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode().
This prevents the underflow and the follow-on orphan/cleanup churn.
Message-ID: <[email protected]>
--- fs/ext4/xattr.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
fs/ext4/xattr.c +8 -7
@@ -1030,7 +1030,7 @@ static int ext4_xattr_inode_update_ref(h int ref_change) {struct ext4_iloc iloc; -s64 ref_count; +u64 ref_count;int ret;inode_lock_nested (ea_inode,I_MUTEX_XATTR );
@@ -1040,13 +1040,17 @@ static int ext4_xattr_inode_update_ref(h goto out; ref_count =ext4_xattr_inode_get_ref (ea_inode); +if ((ref_count ==0 && ref_change <0 ) || (ref_count ==U64_MAX && ref_change >0 )) { +ext4_error_inode (ea_inode, __func__, __LINE__,0 , +"EA inode %lu ref wraparound: ref_count=%lld ref_change=%d" , + ea_inode->i_ino, ref_count, ref_change); + ret = -EFSCORRUPTED ; + goto out; + } ref_count += ref_change;ext4_xattr_inode_set_ref (ea_inode, ref_count);if (ref_change >0 ) { -WARN_ONCE (ref_count <=0 ,"EA inode %lu ref_count=%lld" , - ea_inode->i_ino, ref_count); -if (ref_count ==1 ) {WARN_ONCE (ea_inode->i_nlink,"EA inode %lu i_nlink=%u" , ea_inode->i_ino, ea_inode->i_nlink);
@@ -1055,9 +1059,6 @@ static int ext4_xattr_inode_update_ref(hext4_orphan_del (handle, ea_inode); } }else { -WARN_ONCE (ref_count <0 ,"EA inode %lu ref_count=%lld" , - ea_inode->i_ino, ref_count); -if (ref_count ==0 ) { WARN_ONCE(ea_inode->i_nlink != 1, "EA inode %lu i_nlink=%u",
Greg Kroah-Hartman
maintainerPATCH 132/224 net/9p: fix double req put in p9_fd_cancelled
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nalivayko Sergey <[email protected]>
[ Upstream commit 674b56aa57f9379854cb6798c3bbcef7e7b51ab7 ]
Syzkaller reports a KASAN issue as below:
general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734 Call Trace: <TASK> p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
This happens because of a race condition between:
- The 9p client sending an invalid flush request and later cleaning it up;
- The 9p client in p9_read_work() canceled all pending requests.
Thread 1 Thread 2
...
p9_client_create()
...
p9_fd_create()
...
p9_conn_create()
...
// start Thread 2
INIT_WORK(&m->rq, p9_read_work);
p9_read_work()
...
p9_client_rpc()
...
...
p9_conn_cancel()
...
spin_lock(&m->req_lock);
...
p9_fd_cancelled()
...
...
spin_unlock(&m->req_lock);
// status rewrite
p9_client_cb(m->client, req, REQ_STATUS_ERROR)
// first remove
list_del(&req->req_list);
...
spin_lock(&m->req_lock)
...
// second remove
list_del(&req->req_list);
spin_unlock(&m->req_lock)...
Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD.
Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Message-ID: <[email protected]>
--- net/9p/trans_fd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/9p/trans_fd.c +4 -4
@@ -711,10 +711,10 @@ static int p9_fd_cancelled(struct p9_clip9_debug (P9_DEBUG_TRANS ,"client %p req %p\n" , client, req);spin_lock (&client->lock); -/* Ignore cancelled request if message has been received -* before lock. -*/ -if (req->status ==REQ_STATUS_RCVD ) { +/* Ignore cancelled request if status changed since the request was +* processed in p9_client_flush() +*/ +if (req->status !=REQ_STATUS_SENT ) {spin_unlock (&client->lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 133/224 KVM: x86: Dont (re)check L1 intercepts when completing userspace I/O
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit e750f85391286a4c8100275516973324b621a269 ]
When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access.
Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP.
The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction.
WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>
--- arch/x86/include/asm/kvm_emulate.h | 2 +- arch/x86/kvm/emulate.c | 10 ++++------ arch/x86/kvm/x86.c | 9 ++++++++- 3 files changed, 13 insertions(+), 8 deletions(-)
arch/x86/include/asm/kvm_emulate.h +1 -1
@@ -448,7 +448,7 @@ bool x86_page_table_writing_insn(struct#define EMULATION_RESTART 1#define EMULATION_INTERCEPTED 2void init_decode_cache (struct x86_emulate_ctxt *ctxt); -int x86_emulate_insn (struct x86_emulate_ctxt *ctxt); +int x86_emulate_insn (struct x86_emulate_ctxt *ctxt,bool check_intercepts);int emulator_task_switch (struct x86_emulate_ctxt *ctxt,u16 tss_selector,int idt_index,int reason,bool has_error_code,u32 error_code);
arch/x86/kvm/emulate.c +4 -6
@@ -5605,12 +5605,11 @@ void init_decode_cache(struct x86_emulat ctxt->mem_read.end =0 ; } -int x86_emulate_insn (struct x86_emulate_ctxt *ctxt) +int x86_emulate_insn (struct x86_emulate_ctxt *ctxt,bool check_intercepts) {const struct x86_emulate_ops *ops = ctxt->ops;int rc =X86EMUL_CONTINUE ;int saved_dst_type = ctxt->dst.type; -unsigned emul_flags; ctxt->mem_read.pos =0 ;
@@ -5625,7 +5624,6 @@ int x86_emulate_insn(struct x86_emulate_ goto done; } - emul_flags = ctxt->ops->get_hflags (ctxt);if (unlikely (ctxt->d & (No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) { if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) ||
@@ -5659,7 +5657,7 @@ int x86_emulate_insn(struct x86_emulate_fetch_possible_mmx_operand (ctxt, &ctxt->dst); } -if (unlikely (emul_flags &X86EMUL_GUEST_MASK ) && ctxt->intercept) { +if (unlikely (check_intercepts) && ctxt->intercept) { rc =emulator_check_intercept (ctxt, ctxt->intercept,X86_ICPT_PRE_EXCEPT );if (rc !=X86EMUL_CONTINUE )
@@ -5688,7 +5686,7 @@ int x86_emulate_insn(struct x86_emulate_ goto done; } -if (unlikely (emul_flags &X86EMUL_GUEST_MASK ) && (ctxt->d & Intercept)) { +if (unlikely (check_intercepts) && (ctxt->d & Intercept)) { rc =emulator_check_intercept (ctxt, ctxt->intercept,X86_ICPT_POST_EXCEPT );if (rc !=X86EMUL_CONTINUE )
@@ -5742,7 +5740,7 @@ int x86_emulate_insn(struct x86_emulate_ special_insn: -if (unlikely (emul_flags &X86EMUL_GUEST_MASK ) && (ctxt->d & Intercept)) { +if (unlikely (check_intercepts) && (ctxt->d & Intercept)) { rc =emulator_check_intercept (ctxt, ctxt->intercept,X86_ICPT_POST_MEMACCESS );if (rc !=X86EMUL_CONTINUE )
arch/x86/kvm/x86.c +8 -1
@@ -6855,7 +6855,14 @@ restart:/* Save the faulting GPA (cr2) in the address field */ ctxt->exception.address = cr2_or_gpa; - r =x86_emulate_insn (ctxt); +/* +* Check L1's instruction intercepts when emulating instructions for +* L2, unless KVM is re-emulating a previously decoded instruction, +* e.g. to complete userspace I/O, in which case KVM has already +* checked the intercepts. +*/ + r =x86_emulate_insn (ctxt,is_guest_mode (vcpu) && + !(emulation_type &EMULTYPE_NO_DECODE ));if (r ==EMULATION_INTERCEPTED )return 1 ;
Greg Kroah-Hartman
maintainerPATCH 134/224 fs: udf: fix OOB read in lengthAllocDescs handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larshin Sergey <[email protected]>
[ Upstream commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 ]
When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read.
BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
Validate the computed total length against epos->bh->b_size.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- fs/udf/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/udf/inode.c +3 -0
@@ -2202,6 +2202,9 @@ int8_t udf_current_aext(struct inode *inif (check_add_overflow (sizeof (struct allocExtDesc ),le32_to_cpu (header->lengthAllocDescs), &alen))return -1 ; + +if (alen > epos->bh->b_size) +return -1 ; }switch (iinfo->i_alloc_type) {
Greg Kroah-Hartman
maintainerPATCH 135/224 mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 1efbee6852f1ff698a9981bd731308dd027189fb ]
Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells") removed the return value check from the call to gpiochip_add_data() (or rather gpiochip_add() back then and later converted to devres) with no explanation. This function however can still fail, so check the return value and bail-out if it does.
--- drivers/mfd/vexpress-sysreg.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mfd/vexpress-sysreg.c +5 -1
@@ -160,6 +160,7 @@ static int vexpress_sysreg_probe(structstruct gpio_chip *mmc_gpio_chip;int master;u32 dt_hbi; +int ret; mem =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!mem)
@@ -195,7 +196,10 @@ static int vexpress_sysreg_probe(structbgpio_init (mmc_gpio_chip, &pdev->dev,0x4 , base +SYS_MCI ,NULL ,NULL ,NULL ,NULL ,0 ); mmc_gpio_chip->ngpio =2 ; -gpiochip_add_data (mmc_gpio_chip,NULL ); + + ret =gpiochip_add_data (mmc_gpio_chip,NULL ); +if (ret) +return ret; return mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, vexpress_sysreg_cells,
Greg Kroah-Hartman
maintainerPATCH 136/224 media: mc: Clear minor number before put device
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 8cfc8cec1b4da88a47c243a11f384baefd092a50 ]
The device minor should not be cleared after the device is released.
--- drivers/media/mc/mc-devnode.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/media/mc/mc-devnode.c +1 -5
@@ -50,11 +50,6 @@ static void media_devnode_release(struct {struct media_devnode *devnode =to_media_devnode (cd); -mutex_lock (&media_devnode_lock); -/* Mark device node number as free */ -clear_bit (devnode->minor, media_devnode_nums); -mutex_unlock (&media_devnode_lock); -/* Release media_devnode and perform other cleanups as needed. */ if (devnode->release) devnode->release (devnode);
@@ -283,6 +278,7 @@ void media_devnode_unregister(struct med/* Delete the cdev on this minor as well */ cdev_device_del (&devnode->cdev, &devnode->dev); devnode->media_dev =NULL ; +clear_bit (devnode->minor, media_devnode_nums);mutex_unlock (&media_devnode_lock);put_device (&devnode->dev);
Greg Kroah-Hartman
maintainerPATCH 137/224 Squashfs: add additional inode sanity checking
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 9ee94bfbe930a1b39df53fa2d7b31141b780eb5a ]
Patch series "Squashfs: performance improvement and a sanity check".
This patchset adds an additional sanity check when reading regular file inodes, and adds support for SEEK_DATA/SEEK_HOLE lseek() whence values.
This patch (of 2):
Add an additional sanity check when reading regular file inodes.
A regular file if the file size is an exact multiple of the filesystem block size cannot have a fragment. This is because by definition a fragment block stores tailends which are not a whole block in size.
Stable-dep-of: 9f1c14c1de1b ("Squashfs: reject negative file sizes in squashfs_read_inode()")
--- fs/squashfs/inode.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
fs/squashfs/inode.c +18 -2
@@ -140,8 +140,17 @@ int squashfs_read_inode(struct inode *inif (err <0 ) goto failed_read; + inode->i_size =le32_to_cpu (sqsh_ino->file_size); frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) { +/* +* the file cannot have a fragment (tailend) and have a +* file size a multiple of the block size +*/ +if ((inode->i_size & (msblk->block_size -1 )) ==0 ) { + err = -EINVAL ; + goto failed_read; + } frag_offset =le32_to_cpu (sqsh_ino->offset); frag_size =squashfs_frag_lookup (sb, frag, &frag_blk);if (frag_size <0 ) {
@@ -155,7 +164,6 @@ int squashfs_read_inode(struct inode *in }set_nlink (inode,1 ); - inode->i_size =le32_to_cpu (sqsh_ino->file_size); inode->i_fop = &generic_ro_fops; inode->i_mode |=S_IFREG ; inode->i_blocks = ((inode->i_size -1 ) >>9 ) +1 ;
@@ -184,8 +192,17 @@ int squashfs_read_inode(struct inode *inif (err <0 ) goto failed_read; + inode->i_size =le64_to_cpu (sqsh_ino->file_size); frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) { +/* +* the file cannot have a fragment (tailend) and have a +* file size a multiple of the block size +*/ +if ((inode->i_size & (msblk->block_size -1 )) ==0 ) { + err = -EINVAL ; + goto failed_read; + } frag_offset =le32_to_cpu (sqsh_ino->offset); frag_size =squashfs_frag_lookup (sb, frag, &frag_blk);if (frag_size <0 ) {
@@ -200,7 +217,6 @@ int squashfs_read_inode(struct inode *in xattr_id =le32_to_cpu (sqsh_ino->xattr);set_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); - inode->i_size =le64_to_cpu (sqsh_ino->file_size); inode->i_op = &squashfs_inode_ops; inode->i_fop = &generic_ro_fops; inode->i_mode |=S_IFREG ;
Greg Kroah-Hartman
maintainerPATCH 138/224 Squashfs: reject negative file sizes in squashfs_read_inode()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b ]
Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.
This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.
This commit checks for a negative file size and returns EINVAL.
--- fs/squashfs/inode.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/squashfs/inode.c +4 -0
@@ -193,6 +193,10 @@ int squashfs_read_inode(struct inode *in goto failed_read; inode->i_size =le64_to_cpu (sqsh_ino->file_size); +if (inode->i_size <0 ) { + err = -EINVAL ; + goto failed_read; + } frag =le32_to_cpu (sqsh_ino->fragment);if (frag !=SQUASHFS_INVALID_FRAG ) {/*
Greg Kroah-Hartman
maintainerPATCH 139/224 mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 70e997e0107e5ed85c1a3ef2adfccbe351c29d71 ]
The max_register = 128 setting in the regmap config is not valid.
The Intel Dollar Cove TI PMIC has an eeprom unlock register at address 0x88 and a number of EEPROM registers at 0xF?. Increase max_register to 0xff so that these registers can be accessed.
Stable-dep-of: 64e0d839c589 ("mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag")
--- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/intel_soc_pmic_chtdc_ti.c +1 -1
@@ -81,7 +81,7 @@ static struct mfd_cell chtdc_ti_dev[] =static const struct regmap_config chtdc_ti_regmap_config = { .reg_bits =8 , .val_bits =8 , - .max_register =128 , + .max_register =0xff , .cache_type =REGCACHE_NONE , };
Greg Kroah-Hartman
maintainerPATCH 140/224 mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 9eb99c08508714906db078b5efbe075329a3fb06 ]
REGCACHE_NONE is the default type of the cache when not provided. Drop unneeded explicit assignment to it.
Note, it's defined to 0, and if ever be redefined, it will break literally a lot of the drivers, so it very unlikely to happen.
Stable-dep-of: 64e0d839c589 ("mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag")
--- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 1 - 1 file changed, 1 deletion(-)
drivers/mfd/intel_soc_pmic_chtdc_ti.c +0 -1
@@ -82,7 +82,6 @@ static const struct regmap_config chtdc_ .reg_bits = 8, .val_bits = 8, .max_register = 0xff, - .cache_type = REGCACHE_NONE, };static const struct regmap_irq chtdc_ti_irqs[] = {
Greg Kroah-Hartman
maintainerPATCH 141/224 mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 64e0d839c589f4f2ecd2e3e5bdb5cee6ba6bade9 ]
Testing has shown that reading multiple registers at once (for 10-bit ADC values) does not work. Set the use_single_read regmap_config flag to make regmap split these for us.
This should fix temperature opregion accesses done by drivers/acpi/pmic/intel_pmic_chtdc_ti.c and is also necessary for the upcoming drivers for the ADC and battery MFD cells.
--- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mfd/intel_soc_pmic_chtdc_ti.c +2 -0
@@ -82,6 +82,8 @@ static const struct regmap_config chtdc_ .reg_bits = 8, .val_bits = 8, .max_register = 0xff, + /* The hardware does not support reading multiple registers at once */ + .use_single_read = true, };static const struct regmap_irq chtdc_ti_irqs[] = {
Greg Kroah-Hartman
maintainerPATCH 142/224 dm: fix NULL pointer dereference in __dm_suspend()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 8d33a030c566e1f105cd5bf27f37940b6367f3be ]
There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:
BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace: <TASK> blk_mq_quiesce_queue+0x2c/0x50 dm_stop_queue+0xd/0x20 __dm_suspend+0x130/0x330 dm_suspend+0x11a/0x180 dev_suspend+0x27e/0x560 ctl_ioctl+0x4cf/0x850 dm_ctl_ioctl+0xd/0x20 vfs_ioctl+0x1d/0x50 __se_sys_ioctl+0x9b/0xc0 __x64_sys_ioctl+0x19/0x30 x64_sys_call+0x2c4a/0x4620 do_syscall_64+0x9e/0x1b0
The issue can be triggered as below:
T1 T2dm_suspend table_load__dm_suspend dm_setup_md_queue
dm_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion => q->tag_set NULL pointer! (2) => q->tag_set = set; (3)
Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.
Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences.
--- drivers/md/dm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/md/dm.c +4 -3
@@ -2595,7 +2595,7 @@ static int __dm_suspend(struct mapped_de {bool do_lockfs = suspend_flags &DM_SUSPEND_LOCKFS_FLAG ;bool noflush = suspend_flags &DM_SUSPEND_NOFLUSH_FLAG ; -int r; +int r =0 ;lockdep_assert_held (&md->suspend_lock);
@@ -2648,7 +2648,7 @@ static int __dm_suspend(struct mapped_de* Stop md->queue before flushing md->wq in case request-based * dm defers requests to md->wq from md->queue. */ -if (dm_request_based (md)) +if (map &&dm_request_based (md))dm_stop_queue (md->queue);flush_workqueue (md->wq);
@@ -2658,7 +2658,8 @@ static int __dm_suspend(struct mapped_de* We call dm_wait_for_completion to wait for all existing requests * to finish. */ - r =dm_wait_for_completion (md, task_state); +if (map) + r =dm_wait_for_completion (md, task_state);if (!r)set_bit (dmf_suspended_flag, &md->flags);
Greg Kroah-Hartman
maintainerPATCH 143/224 tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <[email protected]>
[ Upstream commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f ]
There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash.
[1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000 ... [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12: 0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace: [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception+0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0
kernel/trace/trace_kprobe.c: 13080xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21, [x24,#120]include/linux/compiler.h: 2940xffff3df8995039f0 <kprobe_perf_func+0x30>: ldr x1, [x21,x0]
kernel/trace/trace_kprobe.c
1308: head = this_cpu_ptr(call->perf_events);
1309: if (hlist_empty(head))
1310: return 0;
crash> struct trace_event_call -o
struct trace_event_call {
...
[120] struct hlist_head *perf_events; //(call->perf_event)
...
}
crash> struct trace_event_call ffffaf015340e528
struct trace_event_call {
...
perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0
...
}
Race Condition Analysis:
The race occurs between kprobe activation and perf_events initialization:
CPU0 CPU1
==== ====
perf_kprobe_init
perf_trace_event_init
tp_event->perf_events = list;(1)
tp_event->class->reg (2)← KPROBE ACTIVE
Debug exception triggers
...
kprobe_dispatcher
kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE)
head = this_cpu_ptr(call->perf_events)(3)
(perf_events is still NULL)Problem:
1. CPU0 executes (1) assigning tp_event->perf_events = list
2. CPU0 executes (2) enabling kprobe functionality via class->reg()
3. CPU1 triggers and reaches kprobe_dispatcher
4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
5. CPU1 calls kprobe_perf_func() and crashes at (3) because call->perf_events is still NULL
CPU1 sees that kprobe functionality is enabled but does not see that perf_events has been assigned.
Add pairing read and write memory barriers to guarantee that if CPU1 sees that kprobe functionality is enabled, it must also see that perf_events has been assigned.
--- kernel/trace/trace_kprobe.c | 11 +++++++---- kernel/trace/trace_probe.h | 9 +++++++-- kernel/trace/trace_uprobe.c | 12 ++++++++---- 3 files changed, 22 insertions(+), 10 deletions(-)
kernel/trace/trace_kprobe.c +7 -4
@@ -1585,14 +1585,15 @@ static int kprobe_register(struct trace_static int kprobe_dispatcher (struct kprobe *kp,struct pt_regs *regs) { struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp); +unsigned int flags =trace_probe_load_flag (&tk->tp);int ret =0 ;raw_cpu_inc (*tk->nhit); -if (trace_probe_test_flag (&tk->tp,TP_FLAG_TRACE )) +if (flags &TP_FLAG_TRACE )kprobe_trace_func (tk, regs);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tk->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE ) ret =kprobe_perf_func (tk, regs);#endif return ret;
@@ -1603,13 +1604,15 @@ static int kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) { struct trace_kprobe *tk = container_of(ri->rp, struct trace_kprobe, rp); +unsigned int flags;raw_cpu_inc (*tk->nhit); -if (trace_probe_test_flag (&tk->tp,TP_FLAG_TRACE )) + flags =trace_probe_load_flag (&tk->tp); +if (flags &TP_FLAG_TRACE )kretprobe_trace_func (tk, ri, regs);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tk->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE )kretprobe_perf_func (tk, ri, regs);#endif return 0 ;/* We don't tweek kernel, so just return 0 */
kernel/trace/trace_probe.h +7 -2
@@ -252,16 +252,21 @@ struct event_file_link {struct list_head list; }; +static inline unsigned int trace_probe_load_flag (struct trace_probe *tp) +{ +return smp_load_acquire (&tp->event->flags); +} +static inline bool trace_probe_test_flag (struct trace_probe *tp,unsigned int flag) { -return !!(tp->event->flags & flag); +return !!(trace_probe_load_flag (tp) & flag); }static inline void trace_probe_set_flag (struct trace_probe *tp,unsigned int flag) { - tp->event->flags |= flag; +smp_store_release (&tp->event->flags, tp->event->flags | flag); } static inline void trace_probe_clear_flag(struct trace_probe *tp,
kernel/trace/trace_uprobe.c +8 -4
@@ -1465,6 +1465,7 @@ static int uprobe_dispatcher(struct uprostruct uprobe_dispatch_data udd;struct uprobe_cpu_buffer *ucb;int dsize, esize; +unsigned int flags;int ret =0 ;
@@ -1485,11 +1486,12 @@ static int uprobe_dispatcher(struct upro ucb =uprobe_buffer_get ();store_trace_args (ucb->buf, &tu->tp, regs, esize, dsize); -if (trace_probe_test_flag (&tu->tp,TP_FLAG_TRACE )) + flags =trace_probe_load_flag (&tu->tp); +if (flags &TP_FLAG_TRACE ) ret |=uprobe_trace_func (tu, regs, ucb, dsize);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tu->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE ) ret |=uprobe_perf_func (tu, regs, ucb, dsize);#endif uprobe_buffer_put (ucb);
@@ -1503,6 +1505,7 @@ static int uretprobe_dispatcher(struct ustruct uprobe_dispatch_data udd;struct uprobe_cpu_buffer *ucb;int dsize, esize; +unsigned int flags; tu = container_of(con, struct trace_uprobe, consumer);
@@ -1520,11 +1523,12 @@ static int uretprobe_dispatcher(struct u ucb =uprobe_buffer_get ();store_trace_args (ucb->buf, &tu->tp, regs, esize, dsize); -if (trace_probe_test_flag (&tu->tp,TP_FLAG_TRACE )) + flags =trace_probe_load_flag (&tu->tp); +if (flags &TP_FLAG_TRACE )uretprobe_trace_func (tu, func, regs, ucb, dsize);#ifdef CONFIG_PERF_EVENTS -if (trace_probe_test_flag (&tu->tp,TP_FLAG_PROFILE )) +if (flags &TP_FLAG_PROFILE )uretprobe_perf_func (tu, func, regs, ucb, dsize);#endif uprobe_buffer_put (ucb);
Greg Kroah-Hartman
maintainerPATCH 144/224 minixfs: Verify inode mode when loading from disk
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 73861970938ad1323eb02bbbc87f6fbd1e5bacca ]
The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does.
--- fs/minix/inode.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/minix/inode.c +7 -1
@@ -470,8 +470,14 @@ void minix_set_inode(struct inode *inode, dev_t rdev) inode->i_op = &minix_symlink_inode_operations;inode_nohighmem (inode); inode->i_mapping->a_ops = &minix_aops; - }else + }else if (S_ISCHR (inode->i_mode) ||S_ISBLK (inode->i_mode) || +S_ISFIFO (inode->i_mode) ||S_ISSOCK (inode->i_mode)) {init_special_inode (inode, inode->i_mode, rdev); + }else { +printk (KERN_DEBUG "MINIX-fs: Invalid file type 0%04o for inode %lu.\n" , + inode->i_mode, inode->i_ino); +make_bad_inode (inode); + } }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/224 pid: Add a judgment for ns null in pid_nr_ns
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: gaoxiang17 <[email protected]>
[ Upstream commit 006568ab4c5ca2309ceb36fa553e390b4aa9c0c7 ]
__task_pid_nr_ns
ns = task_active_pid_ns(current);
pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns);
if (pid && ns->level <= pid->level) {Sometimes null is returned for task_active_pid_ns. Then it will trigger kernel panic in pid_nr_ns.
For example:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=00000002175aa000 [0000000000000058] pgd=08000002175ab003, p4d=08000002175ab003, pud=08000002175ab003, pmd=08000002175be003, pte=0000000000000000 pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __task_pid_nr_ns+0x74/0xd0 lr : __task_pid_nr_ns+0x24/0xd0 sp : ffffffc08001bd10 x29: ffffffc08001bd10 x28: ffffffd4422b2000 x27: 0000000000000001 x26: ffffffd442821168 x25: ffffffd442821000 x24: 00000f89492eab31 x23: 00000000000000c0 x22: ffffff806f5693c0 x21: ffffff806f5693c0 x20: 0000000000000001 x19: 0000000000000000 x18: 0000000000000000 x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 00000000023a1adc x14: 0000000000000003 x13: 00000000007ef6d8 x12: 001167c391c78800 x11: 00ffffffffffffff x10: 0000000000000000 x9 : 0000000000000001 x8 : ffffff80816fa3c0 x7 : 0000000000000000 x6 : 49534d702d535449 x5 : ffffffc080c4c2c0 x4 : ffffffd43ee128c8 x3 : ffffffd43ee124dc x2 : 0000000000000000 x1 : 0000000000000001 x0 : ffffff806f5693c0 Call trace: __task_pid_nr_ns+0x74/0xd0 ... __handle_irq_event_percpu+0xd4/0x284 handle_irq_event+0x48/0xb0 handle_fasteoi_irq+0x160/0x2d8 generic_handle_domain_irq+0x44/0x60 gic_handle_irq+0x4c/0x114 call_on_irq_stack+0x3c/0x74 do_interrupt_handler+0x4c/0x84 el1_interrupt+0x34/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c account_kernel_stack+0x60/0x144 exit_task_stack_account+0x1c/0x80 do_exit+0x7e4/0xaf8 ... get_signal+0x7bc/0x8d8 do_notify_resume+0x128/0x828 el0_svc+0x6c/0x70 el0t_64_sync_handler+0x68/0xbc el0t_64_sync+0x1a8/0x1ac Code: 35fffe54 911a02a8 f9400108 b4000128 (b9405a69) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt
--- kernel/pid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/pid.c +1 -1
@@ -407,7 +407,7 @@ pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)struct upid *upid;pid_t nr =0 ; -if (pid && ns->level <= pid->level) { +if (pid && ns && ns->level <= pid->level) { upid = &pid->numbers[ns->level];if (upid->ns == ns) nr = upid->nr;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 146/224 fs: Add initramfs_options to set initramfs mount options
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lichen Liu <[email protected]>
[ Upstream commit 278033a225e13ec21900f0a92b8351658f5377f2 ]
When CONFIG_TMPFS is enabled, the initial root filesystem is a tmpfs. By default, a tmpfs mount is limited to using 50% of the available RAM for its content. This can be problematic in memory-constrained environments, particularly during a kdump capture.
In a kdump scenario, the capture kernel boots with a limited amount of memory specified by the 'crashkernel' parameter. If the initramfs is large, it may fail to unpack into the tmpfs rootfs due to insufficient space. This is because to get X MB of usable space in tmpfs, 2*X MB of memory must be available for the mount. This leads to an OOM failure during the early boot process, preventing a successful crash dump.
This patch introduces a new kernel command-line parameter, initramfs_options, which allows passing specific mount options directly to the rootfs when it is first mounted. This gives users control over the rootfs behavior.
For example, a user can now specify initramfs_options=size=75% to allow the tmpfs to use up to 75% of the available memory. This can significantly reduce the memory pressure for kdump.
Consider a practical example:
To unpack a 48MB initramfs, the tmpfs needs 48MB of usable space. With the default 50% limit, this requires a memory pool of 96MB to be available for the tmpfs mount. The total memory requirement is therefore
approximately: 16MB (vmlinuz) + 48MB (loaded initramfs) + 48MB (unpacked kernel) + 96MB (for tmpfs) + 12MB (runtime overhead) ≈ 220MB.
By using initramfs_options=size=75%, the memory pool required for the 48MB tmpfs is reduced to 48MB / 0.75 = 64MB. This reduces the total memory requirement by 32MB (96MB - 64MB), allowing the kdump to succeed with a smaller crashkernel size, such as 192MB.
An alternative approach of reusing the existing rootflags parameter was considered. However, a new, dedicated initramfs_options parameter was chosen to avoid altering the current behavior of rootflags (which applies to the final root filesystem) and to prevent any potential regressions.
Also add documentation for the new kernel parameter "initramfs_options"
This approach is inspired by prior discussions and patches on the topic.
Ref: https://www.lightofdawn.org/blog/?viewDetailed=00128
Ref: https://landley.net/notes-2015.html#01-01-2015
Ref: https://lkml.org/lkml/2021/6/29/783
Ref: https://www.kernel.org/doc/html/latest/filesystems/ramfs-rootfs-initramfs.html#what-is-rootfs
--- Documentation/admin-guide/kernel-parameters.txt | 3 +++ fs/namespace.c | 11 ++++++++++- 2 files changed, 13 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +3 -0
@@ -4409,6 +4409,9 @@ rootflags= [KNL] Set root filesystem mount option string + initramfs_options= [KNL] + Specify mount options for for the initramfs mount. + rootfstype= [KNL] Set root filesystem type rootwait [KNL] Wait (indefinitely) for root device to show up.
fs/namespace.c +10 -1
@@ -62,6 +62,15 @@ static int __init set_mphash_entries(char *str) }__setup ("mphash_entries=" , set_mphash_entries); +static char *__initdata initramfs_options; +static int __init initramfs_options_setup (char *str) +{ + initramfs_options = str; +return 1 ; +} + +__setup ("initramfs_options=" , initramfs_options_setup); +static u64 event;static DEFINE_IDA (mnt_id_ida);static DEFINE_IDA (mnt_group_ida);
@@ -3829,7 +3838,7 @@ static void __init init_mount_tree(void)struct mnt_namespace *ns;struct path root; - mnt =vfs_kern_mount (&rootfs_fs_type,0 ,"rootfs" ,NULL ); + mnt =vfs_kern_mount (&rootfs_fs_type,0 ,"rootfs" , initramfs_options);if (IS_ERR (mnt))panic ("Can't create rootfs" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 147/224 cramfs: Verify inode mode when loading from disk
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 7f9d34b0a7cb93d678ee7207f0634dbf79e47fe5 ]
The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does.
--- fs/cramfs/inode.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/cramfs/inode.c +10 -1
@@ -117,9 +117,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb,inode_nohighmem (inode); inode->i_data.a_ops = &cramfs_aops;break ; -default : +case S_IFCHR : +case S_IFBLK : +case S_IFIFO : +case S_IFSOCK :init_special_inode (inode, cramfs_inode->mode,old_decode_dev (cramfs_inode->size)); +break ; +default : +printk (KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n" , + inode->i_mode, inode->i_ino); +iget_failed (inode); +return ERR_PTR (-EIO ); } inode->i_mode = cramfs_inode->mode;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 148/224 xen/events: Cleanup find_virq() return codes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
[ Upstream commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a ]
rc is overwritten by the evtchn_status hypercall in each iteration, so the return value will be whatever the last iteration is. This could incorrectly return success even if the event channel was not found. Change to an explicit -ENOENT for an un-found virq and return 0 on a successful match.
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/xen/events/events_base.c +6 -6
@@ -1210,10 +1210,12 @@ EXPORT_SYMBOL_GPL(bind_interdomain_evtchstatic int find_virq (unsigned int virq,unsigned int cpu) {struct evtchn_status status; -int port, rc = -ENOENT ; +int port;memset (&status,0 ,sizeof (status));for (port =0 ; port <xen_evtchn_max_channels (); port++) { +int rc; + status.dom =DOMID_SELF ; status.port = port; rc =HYPERVISOR_event_channel_op (EVTCHNOP_status, &status);
@@ -1221,12 +1223,10 @@ static int find_virq(unsigned int virq,continue ;if (status.status != EVTCHNSTAT_virq)continue ; -if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) { - rc = port; -break ; - } +if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) +return port; } -return rc; +return -ENOENT ; }/**
Greg Kroah-Hartman
maintainerPATCH 149/224 media: cx18: Add missing check after DMA map
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 23b53639a793477326fd57ed103823a8ab63084f ]
The DMA map functions can fail and should be tested for errors. If the mapping fails, dealloc buffers, and return.
--- drivers/media/pci/cx18/cx18-queue.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/media/pci/cx18/cx18-queue.c +10 -2
@@ -379,14 +379,22 @@ int cx18_stream_alloc(struct cx18_streambreak ; } + buf->dma_handle =dma_map_single (&s->cx->pci_dev->dev, + buf->buf, s->buf_size, + s->dma); +if (dma_mapping_error (&s->cx->pci_dev->dev, buf->dma_handle)) { +kfree (buf->buf); +kfree (mdl); +kfree (buf); +break ; + } +INIT_LIST_HEAD (&mdl->list);INIT_LIST_HEAD (&mdl->buf_list); mdl->id = s->mdl_base_idx;/* a somewhat safe value */ cx18_enqueue (s, mdl, &s->q_idle);INIT_LIST_HEAD (&buf->list); - buf->dma_handle =pci_map_single (s->cx->pci_dev, - buf->buf, s->buf_size, s->dma);cx18_buf_sync_for_cpu (s, buf);list_add_tail (&buf->list, &s->buf_pool); }
Greg Kroah-Hartman
maintainerPATCH 150/224 pwm: berlin: Fix wrong register in suspend/resume
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
commit 3a4b9d027e4061766f618292df91760ea64a1fcc upstream.
The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu exception then kernel panic during suspend/resume.
--- drivers/pwm/pwm-berlin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-berlin.c +2 -2
@@ -249,7 +249,7 @@ static int berlin_pwm_suspend(struct devif (!channel)continue ; - channel->enable =berlin_pwm_readl (pwm, i,BERLIN_PWM_ENABLE ); + channel->enable =berlin_pwm_readl (pwm, i,BERLIN_PWM_EN ); channel->ctrl =berlin_pwm_readl (pwm, i,BERLIN_PWM_CONTROL ); channel->duty =berlin_pwm_readl (pwm, i,BERLIN_PWM_DUTY ); channel->tcnt =berlin_pwm_readl (pwm, i,BERLIN_PWM_TCNT );
@@ -280,7 +280,7 @@ static int berlin_pwm_resume(struct deviberlin_pwm_writel (pwm, i, channel->ctrl,BERLIN_PWM_CONTROL );berlin_pwm_writel (pwm, i, channel->duty,BERLIN_PWM_DUTY );berlin_pwm_writel (pwm, i, channel->tcnt,BERLIN_PWM_TCNT ); -berlin_pwm_writel (pwm, i, channel->enable,BERLIN_PWM_ENABLE ); +berlin_pwm_writel (pwm, i, channel->enable,BERLIN_PWM_EN ); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 151/224 btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Nascimento <[email protected]>
[ Upstream commit dff4f9ff5d7f289e4545cc936362e01ed3252742 ]
The function btrfs_encode_fh() does not properly account for the three cases it handles.
Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes).
However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes).
If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned.
This results in an 8-byte out-of-bounds write atfid->parent_root_objectid = parent_root_id.
A previous attempt to fix this issue was made but was lost.
https://lore.kernel.org/all/[email protected]/
Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data.
--- fs/btrfs/export.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/btrfs/export.c +7 -1
@@ -22,7 +22,11 @@ static int btrfs_encode_fh(struct inodeint type;if (parent && (len <BTRFS_FID_SIZE_CONNECTABLE )) { - *max_len =BTRFS_FID_SIZE_CONNECTABLE ; +if (BTRFS_I (inode)->root->root_key.objectid != +BTRFS_I (parent)->root->root_key.objectid) + *max_len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; +else + *max_len =BTRFS_FID_SIZE_CONNECTABLE ;return FILEID_INVALID ; }else if (len <BTRFS_FID_SIZE_NON_CONNECTABLE ) { *max_len =BTRFS_FID_SIZE_NON_CONNECTABLE ;
@@ -44,6 +48,8 @@ static int btrfs_encode_fh(struct inode parent_root_id =BTRFS_I (parent)->root->root_key.objectid;if (parent_root_id != fid->root_objectid) { +if (*max_len <BTRFS_FID_SIZE_CONNECTABLE_ROOT ) +return FILEID_INVALID ; fid->parent_root_objectid = parent_root_id; len =BTRFS_FID_SIZE_CONNECTABLE_ROOT ; type =FILEID_BTRFS_WITH_PARENT_ROOT ;
Greg Kroah-Hartman
maintainerPATCH 152/224 drm/exynos: exynos7_drm_decon: remove ctx->suspended
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
[ Upstream commit e1361a4f1be9cb69a662c6d7b5ce218007d6e82b ]
Condition guards are found to be redundant, as the call flow is properly managed now, as also observed in the Exynos5433 DECON driver. Since state checking is no longer necessary, remove it.
This also fixes an issue which prevented decon_commit() from decon_atomic_enable() due to an incorrect state change setting.
--- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 ----------------------------- 1 file changed, 36 deletions(-)
drivers/gpu/drm/exynos/exynos7_drm_decon.c +0 -36
@@ -51,7 +51,6 @@ struct decon_context {void __iomem *regs;unsigned long irq_flags;bool i80_if; -bool suspended;wait_queue_head_t wait_vsync_queue;atomic_t wait_vsync_event;
@@ -85,9 +84,6 @@ static void decon_wait_for_vblank(struct {struct decon_context *ctx = crtc->ctx; -if (ctx->suspended) -return ; -atomic_set (&ctx->wait_vsync_event,1 );/*
@@ -155,9 +151,6 @@ static void decon_commit(struct exynos_dstruct drm_display_mode *mode = &crtc->base.state->adjusted_mode;u32 val, clkdiv; -if (ctx->suspended) -return ; -/* nothing to do if we haven't set the mode yet */ if (mode->htotal ==0 || mode->vtotal ==0 )return ;
@@ -219,9 +212,6 @@ static int decon_enable_vblank(struct exstruct decon_context *ctx = crtc->ctx;u32 val; -if (ctx->suspended) -return -EPERM ; -if (!test_and_set_bit (0 , &ctx->irq_flags)) { val =readl (ctx->regs +VIDINTCON0 );
@@ -244,9 +234,6 @@ static void decon_disable_vblank(structstruct decon_context *ctx = crtc->ctx;u32 val; -if (ctx->suspended) -return ; -if (test_and_clear_bit (0 , &ctx->irq_flags)) { val =readl (ctx->regs +VIDINTCON0 );
@@ -369,9 +356,6 @@ static void decon_atomic_begin(struct exstruct decon_context *ctx = crtc->ctx;int i; -if (ctx->suspended) -return ; -for (i =0 ; i <WINDOWS_NR ; i++)decon_shadow_protect_win (ctx, i, true); }
@@ -391,9 +375,6 @@ static void decon_update_plane(struct exunsigned int cpp = fb->format->cpp[0 ];unsigned int pitch = fb->pitches[0 ]; -if (ctx->suspended) -return ; -/* * SHADOWCON/PRTCON register is used for enabling timing. *
@@ -481,9 +462,6 @@ static void decon_disable_plane(struct eunsigned int win = plane->index;u32 val; -if (ctx->suspended) -return ; -/* protect windows */ decon_shadow_protect_win (ctx, win, true);
@@ -502,9 +480,6 @@ static void decon_atomic_flush(struct exstruct decon_context *ctx = crtc->ctx;int i; -if (ctx->suspended) -return ; -for (i =0 ; i <WINDOWS_NR ; i++)decon_shadow_protect_win (ctx, i, false);exynos_crtc_handle_event (crtc);
@@ -531,9 +506,6 @@ static void decon_enable(struct exynos_d {struct decon_context *ctx = crtc->ctx; -if (!ctx->suspended) -return ; -pm_runtime_get_sync (ctx->dev);decon_init (ctx);
@@ -543,8 +515,6 @@ static void decon_enable(struct exynos_ddecon_enable_vblank (ctx->crtc);decon_commit (ctx->crtc); - - ctx->suspended = false; }static void decon_disable (struct exynos_drm_crtc *crtc)
@@ -552,9 +522,6 @@ static void decon_disable(struct exynos_struct decon_context *ctx = crtc->ctx;int i; -if (ctx->suspended) -return ; -/* * We need to make sure that all windows are disabled before we * suspend that connector. Otherwise we might try to scan from
@@ -564,8 +531,6 @@ static void decon_disable(struct exynos_decon_disable_plane (crtc, &ctx->planes[i]);pm_runtime_put_sync (ctx->dev); - - ctx->suspended = true; }static const struct exynos_drm_crtc_ops decon_crtc_ops = {
@@ -687,7 +652,6 @@ static int decon_probe(struct platform_dreturn -ENOMEM ; ctx->dev = dev; - ctx->suspended = true; i80_if_timings =of_get_child_by_name (dev->of_node,"i80-if-timings" );if (i80_if_timings)
Greg Kroah-Hartman
maintainerPATCH 153/224 media: rc: Directly use ida_free()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: keliu <[email protected]>
[ Upstream commit cd54ff938091d890edf78e6555ec30c63dcd2eb5 ]
Use ida_alloc() and ida_free() instead of the deprecated ida_simple_get() and ida_simple_remove().
Stable-dep-of: 4f4098c57e13 ("media: lirc: Fix error handling in lirc_register()")
--- drivers/media/rc/lirc_dev.c | 6 +++--- drivers/media/rc/rc-main.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/media/rc/lirc_dev.c +3 -3
@@ -746,7 +746,7 @@ int ir_lirc_register(struct rc_dev *dev)const char *rx_type, *tx_type;int err, minor; - minor =ida_simple_get (&lirc_ida,0 ,RC_DEV_MAX ,GFP_KERNEL ); + minor =ida_alloc_max (&lirc_ida,RC_DEV_MAX -1 ,GFP_KERNEL );if (minor <0 )return minor;
@@ -791,7 +791,7 @@ int ir_lirc_register(struct rc_dev *dev)return 0 ; out_ida: -ida_simple_remove (&lirc_ida, minor); +ida_free (&lirc_ida, minor);return err; }
@@ -809,7 +809,7 @@ void ir_lirc_unregister(struct rc_dev *dspin_unlock_irqrestore (&dev->lirc_fh_lock, flags);cdev_device_del (&dev->lirc_cdev, &dev->lirc_dev); -ida_simple_remove (&lirc_ida,MINOR (dev->lirc_dev.devt)); +ida_free (&lirc_ida,MINOR (dev->lirc_dev.devt)); }int __init lirc_dev_init (void )
drivers/media/rc/rc-main.c +3 -3
@@ -1861,7 +1861,7 @@ int rc_register_device(struct rc_dev *deif (!dev)return -EINVAL ; - minor =ida_simple_get (&rc_ida,0 ,RC_DEV_MAX ,GFP_KERNEL ); + minor =ida_alloc_max (&rc_ida,RC_DEV_MAX -1 ,GFP_KERNEL );if (minor <0 )return minor;
@@ -1944,7 +1944,7 @@ out_rx_free: out_raw:ir_raw_event_free (dev); out_minor: -ida_simple_remove (&rc_ida, minor); +ida_free (&rc_ida, minor);return rc; }EXPORT_SYMBOL_GPL (rc_register_device);
@@ -2004,7 +2004,7 @@ void rc_unregister_device(struct rc_devdevice_del (&dev->dev); -ida_simple_remove (&rc_ida, dev->minor); +ida_free (&rc_ida, dev->minor);if (!dev->managed_alloc)rc_free_device (dev);
Greg Kroah-Hartman
maintainerPATCH 154/224 media: lirc: Fix error handling in lirc_register()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 4f4098c57e139ad972154077fb45c3e3141555dd ]
When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count.
Found by code review.
--- drivers/media/rc/lirc_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/rc/lirc_dev.c +5 -4
@@ -762,11 +762,11 @@ int ir_lirc_register(struct rc_dev *dev)cdev_init (&dev->lirc_cdev, &lirc_fops); +get_device (&dev->dev); + err =cdev_device_add (&dev->lirc_cdev, &dev->lirc_dev);if (err) - goto out_ida; - -get_device (&dev->dev); + goto out_put_device;switch (dev->driver_type) {case RC_DRIVER_SCANCODE :
@@ -790,7 +790,8 @@ int ir_lirc_register(struct rc_dev *dev)return 0 ; -out_ida: +out_put_device: +put_device (&dev->lirc_dev);ida_free (&lirc_ida, minor);return err; }
Greg Kroah-Hartman
maintainerPATCH 155/224 xen/events: Update virq_to_irq on migration
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
[ Upstream commit 3fcc8e146935415d69ffabb5df40ecf50e106131 ]
VIRQs come in 3 flavors, per-VPU, per-domain, and global, and the VIRQs are tracked in per-cpu virq_to_irq arrays.
Per-domain and global VIRQs must be bound on CPU 0, and bind_virq_to_irq() sets the per_cpu virq_to_irq at registration time Later, the interrupt can migrate, and info->cpu is updated. When calling __unbind_from_irq(), the per-cpu virq_to_irq is cleared for a different cpu. If bind_virq_to_irq() is called again with CPU 0, the stale irq is returned. There won't be any irq_info for the irq, so things break.
Make xen_rebind_evtchn_to_cpu() update the per_cpu virq_to_irq mappings to keep them update to date with the current cpu. This ensures the correct virq_to_irq is cleared in __unbind_from_irq().
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/xen/events/events_base.c +12 -1
@@ -1717,9 +1717,20 @@ static int xen_rebind_evtchn_to_cpu(stru* virq or IPI channel, which don't actually need to be rebound. Ignore * it, but don't do the xenlinux-level rebind in that case. */ -if (HYPERVISOR_event_channel_op (EVTCHNOP_bind_vcpu, &bind_vcpu) >=0 ) +if (HYPERVISOR_event_channel_op (EVTCHNOP_bind_vcpu, &bind_vcpu) >=0 ) { +int old_cpu = info->cpu; +bind_evtchn_to_cpu (evtchn, tcpu); +if (info->type ==IRQT_VIRQ ) { +int virq = info->u.virq; +int irq =per_cpu (virq_to_irq, old_cpu)[virq]; + +per_cpu (virq_to_irq, old_cpu)[virq] =-1 ; +per_cpu (virq_to_irq, tcpu)[virq] = irq; + } + } +do_unmask (info,EVT_MASK_REASON_TEMPORARY );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 156/224 media: pci/ivtv: switch from pci_ to dma_ API
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1 ]
The wrappers in include/linux/pci-dma-compat.h should go away.
The patch has been generated with the coccinelle script below. It has been compile tested.
No memory allocation in involved in this patch, so no GFP_ tweak is needed.
@@ @@
- PCI_DMA_BIDIRECTIONAL
+ DMA_BIDIRECTIONAL
@@ @@
- PCI_DMA_TODEVICE
+ DMA_TO_DEVICE
@@ @@
- PCI_DMA_FROMDEVICE
+ DMA_FROM_DEVICE
@@ @@
- PCI_DMA_NONE
+ DMA_NONE
@@
expression e1, e2, e3;
@@
- pci_alloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3;
@@
- pci_zalloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3, e4;
@@
- pci_free_consistent(e1, e2, e3, e4)
+ dma_free_coherent(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_single(e1, e2, e3, e4)
+ dma_map_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_single(e1, e2, e3, e4)
+ dma_unmap_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4, e5;
@@
- pci_map_page(e1, e2, e3, e4, e5)
+ dma_map_page(&e1->dev, e2, e3, e4, e5)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_page(e1, e2, e3, e4)
+ dma_unmap_page(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_sg(e1, e2, e3, e4)
+ dma_map_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_sg(e1, e2, e3, e4)
+ dma_unmap_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_cpu(e1, e2, e3, e4)
+ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_device(e1, e2, e3, e4)
+ dma_sync_single_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4)
+ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_device(e1, e2, e3, e4)
+ dma_sync_sg_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2;
@@
- pci_dma_mapping_error(e1, e2)
+ dma_mapping_error(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_dma_mask(e1, e2)
+ dma_set_mask(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_consistent_dma_mask(e1, e2)
+ dma_set_coherent_mask(&e1->dev, e2)
Stable-dep-of: 1069a4fe637d ("media: pci: ivtv: Add missing check after DMA map")
--- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/ivtv/ivtv-queue.c | 18 ++++++++++-------- drivers/media/pci/ivtv/ivtv-streams.c | 22 +++++++++++----------- drivers/media/pci/ivtv/ivtv-udma.c | 19 ++++++++++++------- drivers/media/pci/ivtv/ivtv-yuv.c | 10 +++++++--- 5 files changed, 41 insertions(+), 30 deletions(-)
drivers/media/pci/ivtv/ivtv-driver.c +1 -1
@@ -843,7 +843,7 @@ static int ivtv_setup_pci(struct ivtv *iIVTV_ERR ("Can't enable device!\n" );return -EIO ; } -if (pci_set_dma_mask (pdev,DMA_BIT_MASK (32 ))) { +if (dma_set_mask (&pdev->dev,DMA_BIT_MASK (32 ))) {IVTV_ERR ("No suitable DMA available.\n" );return -EIO ; }
drivers/media/pci/ivtv/ivtv-queue.c +10 -8
@@ -188,7 +188,7 @@ int ivtv_stream_alloc(struct ivtv_streamreturn 0 ;IVTV_DEBUG_INFO ("Allocate %s%s stream: %d x %d buffers (%dkB total)\n" , - s->dma !=PCI_DMA_NONE ?"DMA " :"" , + s->dma !=DMA_NONE ?"DMA " :"" , s->name, s->buffers, s->buf_size, s->buffers * s->buf_size /1024 ); s->sg_pending =kzalloc (SGsize,GFP_KERNEL |__GFP_NOWARN);
@@ -218,8 +218,9 @@ int ivtv_stream_alloc(struct ivtv_streamreturn -ENOMEM ; }if (ivtv_might_use_dma (s)) { - s->sg_handle =pci_map_single (itv->pdev, s->sg_dma, -sizeof (struct ivtv_sg_element ),PCI_DMA_TODEVICE ); + s->sg_handle =dma_map_single (&itv->pdev->dev, s->sg_dma, +sizeof (struct ivtv_sg_element ), +DMA_TO_DEVICE );ivtv_stream_sync_for_cpu (s); }
@@ -237,7 +238,7 @@ int ivtv_stream_alloc(struct ivtv_stream }INIT_LIST_HEAD (&buf->list);if (ivtv_might_use_dma (s)) { - buf->dma_handle =pci_map_single (s->itv->pdev, + buf->dma_handle =dma_map_single (&s->itv->pdev->dev, buf->buf, s->buf_size +256 , s->dma);ivtv_buf_sync_for_cpu (s, buf); }
@@ -260,8 +261,8 @@ void ivtv_stream_free(struct ivtv_stream/* empty q_free */ while ((buf =ivtv_dequeue (s, &s->q_free))) {if (ivtv_might_use_dma (s)) -pci_unmap_single (s->itv->pdev, buf->dma_handle, - s->buf_size +256 , s->dma); +dma_unmap_single (&s->itv->pdev->dev, buf->dma_handle, + s->buf_size +256 , s->dma);kfree (buf->buf);kfree (buf); }
@@ -269,8 +270,9 @@ void ivtv_stream_free(struct ivtv_stream/* Free SG Array/Lists */ if (s->sg_dma !=NULL ) {if (s->sg_handle !=IVTV_DMA_UNMAPPED ) { -pci_unmap_single (s->itv->pdev, s->sg_handle, -sizeof (struct ivtv_sg_element ),PCI_DMA_TODEVICE ); +dma_unmap_single (&s->itv->pdev->dev, s->sg_handle, +sizeof (struct ivtv_sg_element ), +DMA_TO_DEVICE ); s->sg_handle =IVTV_DMA_UNMAPPED ; }kfree (s->sg_pending);
drivers/media/pci/ivtv/ivtv-streams.c +11 -11
@@ -100,7 +100,7 @@ static struct { {/* IVTV_ENC_STREAM_TYPE_MPG */ "encoder MPG" ,VFL_TYPE_VIDEO ,0 , -PCI_DMA_FROMDEVICE ,0 , +DMA_FROM_DEVICE ,0 ,V4L2_CAP_VIDEO_CAPTURE |V4L2_CAP_TUNER |V4L2_CAP_AUDIO |V4L2_CAP_READWRITE , &ivtv_v4l2_enc_fops
@@ -108,7 +108,7 @@ static struct { {/* IVTV_ENC_STREAM_TYPE_YUV */ "encoder YUV" ,VFL_TYPE_VIDEO ,IVTV_V4L2_ENC_YUV_OFFSET , -PCI_DMA_FROMDEVICE ,0 , +DMA_FROM_DEVICE ,0 ,V4L2_CAP_VIDEO_CAPTURE |V4L2_CAP_TUNER |V4L2_CAP_AUDIO |V4L2_CAP_READWRITE , &ivtv_v4l2_enc_fops
@@ -116,7 +116,7 @@ static struct { {/* IVTV_ENC_STREAM_TYPE_VBI */ "encoder VBI" ,VFL_TYPE_VBI ,0 , -PCI_DMA_FROMDEVICE ,0 , +DMA_FROM_DEVICE ,0 ,V4L2_CAP_VBI_CAPTURE |V4L2_CAP_SLICED_VBI_CAPTURE |V4L2_CAP_TUNER |V4L2_CAP_AUDIO |V4L2_CAP_READWRITE , &ivtv_v4l2_enc_fops
@@ -124,42 +124,42 @@ static struct { {/* IVTV_ENC_STREAM_TYPE_PCM */ "encoder PCM" ,VFL_TYPE_VIDEO ,IVTV_V4L2_ENC_PCM_OFFSET , -PCI_DMA_FROMDEVICE ,0 , +DMA_FROM_DEVICE ,0 ,V4L2_CAP_TUNER |V4L2_CAP_AUDIO |V4L2_CAP_READWRITE , &ivtv_v4l2_enc_fops }, { /* IVTV_ENC_STREAM_TYPE_RAD */"encoder radio" ,VFL_TYPE_RADIO ,0 , -PCI_DMA_NONE ,1 , +DMA_NONE ,1 ,V4L2_CAP_RADIO |V4L2_CAP_TUNER , &ivtv_v4l2_radio_fops }, { /* IVTV_DEC_STREAM_TYPE_MPG */"decoder MPG" ,VFL_TYPE_VIDEO ,IVTV_V4L2_DEC_MPG_OFFSET , -PCI_DMA_TODEVICE ,0 , +DMA_TO_DEVICE ,0 ,V4L2_CAP_VIDEO_OUTPUT |V4L2_CAP_AUDIO |V4L2_CAP_READWRITE , &ivtv_v4l2_dec_fops }, { /* IVTV_DEC_STREAM_TYPE_VBI */"decoder VBI" ,VFL_TYPE_VBI ,IVTV_V4L2_DEC_VBI_OFFSET , -PCI_DMA_NONE ,1 , +DMA_NONE ,1 ,V4L2_CAP_SLICED_VBI_CAPTURE |V4L2_CAP_READWRITE , &ivtv_v4l2_enc_fops }, { /* IVTV_DEC_STREAM_TYPE_VOUT */"decoder VOUT" ,VFL_TYPE_VBI ,IVTV_V4L2_DEC_VOUT_OFFSET , -PCI_DMA_NONE ,1 , +DMA_NONE ,1 ,V4L2_CAP_SLICED_VBI_OUTPUT |V4L2_CAP_AUDIO |V4L2_CAP_READWRITE , &ivtv_v4l2_dec_fops }, { /* IVTV_DEC_STREAM_TYPE_YUV */"decoder YUV" ,VFL_TYPE_VIDEO ,IVTV_V4L2_DEC_YUV_OFFSET , -PCI_DMA_TODEVICE ,0 , +DMA_TO_DEVICE ,0 ,V4L2_CAP_VIDEO_OUTPUT |V4L2_CAP_AUDIO |V4L2_CAP_READWRITE , &ivtv_v4l2_dec_fops }
@@ -179,7 +179,7 @@ static void ivtv_stream_init(struct ivtv s->vdev.device_caps = ivtv_stream_info[type].v4l2_caps;if (ivtv_stream_info[type].pio) - s->dma =PCI_DMA_NONE ; + s->dma =DMA_NONE ;else s->dma = ivtv_stream_info[type].dma; s->buf_size = itv->stream_buf_size[type];
@@ -217,7 +217,7 @@ static int ivtv_prep_dev(struct ivtv *it/* User explicitly selected 0 buffers for these streams, so don't create them. */ -if (ivtv_stream_info[type].dma !=PCI_DMA_NONE && +if (ivtv_stream_info[type].dma !=DMA_NONE && itv->options.kilobytes[type] ==0 ) {IVTV_INFO ("Disabled %s device\n" , ivtv_stream_info[type].name);return 0 ;
drivers/media/pci/ivtv/ivtv-udma.c +12 -7
@@ -81,8 +81,10 @@ void ivtv_udma_alloc(struct ivtv *itv) {if (itv->udma.SG_handle ==0 ) {/* Map DMA Page Array Buffer */ - itv->udma.SG_handle =pci_map_single (itv->pdev, itv->udma.SGarray, -sizeof (itv->udma.SGarray),PCI_DMA_TODEVICE ); + itv->udma.SG_handle =dma_map_single (&itv->pdev->dev, + itv->udma.SGarray, +sizeof (itv->udma.SGarray), +DMA_TO_DEVICE );ivtv_udma_sync_for_cpu (itv); } }
@@ -138,7 +140,8 @@ int ivtv_udma_setup(struct ivtv *itv, un }/* Map SG List */ - dma->SG_length =pci_map_sg (itv->pdev, dma->SGlist, dma->page_count,PCI_DMA_TODEVICE ); + dma->SG_length =dma_map_sg (&itv->pdev->dev, dma->SGlist, + dma->page_count,DMA_TO_DEVICE );/* Fill SG Array with new values */ ivtv_udma_fill_sg_array (dma, ivtv_dest_addr,0 ,-1 );
@@ -163,7 +166,8 @@ void ivtv_udma_unmap(struct ivtv *itv)/* Unmap Scatterlist */ if (dma->SG_length) { -pci_unmap_sg (itv->pdev, dma->SGlist, dma->page_count,PCI_DMA_TODEVICE ); +dma_unmap_sg (&itv->pdev->dev, dma->SGlist, dma->page_count, +DMA_TO_DEVICE ); dma->SG_length =0 ; }/* sync DMA */
@@ -182,13 +186,14 @@ void ivtv_udma_free(struct ivtv *itv)/* Unmap SG Array */ if (itv->udma.SG_handle) { -pci_unmap_single (itv->pdev, itv->udma.SG_handle, -sizeof (itv->udma.SGarray),PCI_DMA_TODEVICE ); +dma_unmap_single (&itv->pdev->dev, itv->udma.SG_handle, +sizeof (itv->udma.SGarray),DMA_TO_DEVICE ); }/* Unmap Scatterlist */ if (itv->udma.SG_length) { -pci_unmap_sg (itv->pdev, itv->udma.SGlist, itv->udma.page_count,PCI_DMA_TODEVICE ); +dma_unmap_sg (&itv->pdev->dev, itv->udma.SGlist, + itv->udma.page_count,DMA_TO_DEVICE ); }for (i =0 ; i <IVTV_DMA_SG_OSD_ENT ; i++) {
drivers/media/pci/ivtv/ivtv-yuv.c +7 -3
@@ -118,7 +118,8 @@ static int ivtv_yuv_prep_user_dma(struct dma->page_count =0 ;return -ENOMEM ; } - dma->SG_length =pci_map_sg (itv->pdev, dma->SGlist, dma->page_count,PCI_DMA_TODEVICE ); + dma->SG_length =dma_map_sg (&itv->pdev->dev, dma->SGlist, + dma->page_count,DMA_TO_DEVICE );/* Fill SG Array with new values */ ivtv_udma_fill_sg_array (dma, y_buffer_offset, uv_buffer_offset, y_size);
@@ -925,7 +926,9 @@ static void ivtv_yuv_init(struct ivtv *i/* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */ yi->blanking_ptr =kzalloc (720 *16 ,GFP_ATOMIC |__GFP_NOWARN);if (yi->blanking_ptr) { - yi->blanking_dmaptr =pci_map_single (itv->pdev, yi->blanking_ptr,720 *16 ,PCI_DMA_TODEVICE ); + yi->blanking_dmaptr =dma_map_single (&itv->pdev->dev, + yi->blanking_ptr, +720 *16 ,DMA_TO_DEVICE ); }else { yi->blanking_dmaptr =0 ;IVTV_DEBUG_WARN ("Failed to allocate yuv blanking buffer\n" );
@@ -1269,7 +1272,8 @@ void ivtv_yuv_close(struct ivtv *itv)if (yi->blanking_ptr) {kfree (yi->blanking_ptr); yi->blanking_ptr =NULL ; -pci_unmap_single (itv->pdev, yi->blanking_dmaptr,720 *16 ,PCI_DMA_TODEVICE ); +dma_unmap_single (&itv->pdev->dev, yi->blanking_dmaptr, +720 *16 ,DMA_TO_DEVICE ); }/* Invalidate the old dimension information */