6.17.6-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.17.6-rc1 review
This is the start of the stable review cycle for the 6.17.6 release. There are 184 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.6-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.17.6-rc1
William Breathitt Gray <[email protected]>
gpio: idio-16: Define fixed direction of the GPIO lines
Ioana Ciornei <[email protected]>
gpio: regmap: add the .fixed_direction_output configuration parameter
Mathieu Dubois-Briand <[email protected]>
gpio: regmap: Allow to allocate regmap-irq device
Darrick J. Wong <[email protected]>
xfs: always warn about deprecated mount options
David Hildenbrand <[email protected]>
vmw_balloon: indicate success when effectively deflating during migration
David Hildenbrand <[email protected]>
treewide: remove MIGRATEPAGE_SUCCESS
David Hildenbrand <[email protected]>
mm/migrate: remove MIGRATEPAGE_UNMAP
Dave Penkler <[email protected]>
staging: gpib: Fix sending clear and trigger events
Dave Penkler <[email protected]>
staging: gpib: Return -EINTR on device clear
Dave Penkler <[email protected]>
staging: gpib: Fix no EOI on 1 and 2 byte writes
Ma Ke <[email protected]>
staging: gpib: Fix device reference leak in fmh_gpib driver
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove useless enable of enhanced features
Daniel Golle <[email protected]>
serial: 8250_mtk: Enable baud clock and manage in runtime PM
Florian Eckert <[email protected]>
serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
Artem Shimko <[email protected]>
serial: 8250_dw: handle reset control deassert error
Krishna Kurapati <[email protected]>
dt-bindings: usb: qcom,snps-dwc3: Fix bindings for X1E80100
Xu Yang <[email protected]>
dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
Geert Uytterhoeven <[email protected]>
dt-bindings: serial: sh-sci: Fix r8a78000 interrupts
Cosmin Tanislav <[email protected]>
tty: serial: sh-sci: fix RSCI FIFO overrun handling
Michael Grzeschik <[email protected]>
tcpm: switch check for role_sw device with fw_node
Victoria Votokina <[email protected]>
most: usb: hdm_probe: Fix calling put_device() before device initialization
Victoria Votokina <[email protected]>
most: usb: Fix use-after-free in hdm_disconnect
Junhao Xie <[email protected]>
misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
Cosmin Tanislav <[email protected]>
nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE
Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function
Alexander Usyskin <[email protected]>
mei: me: add wildcat lake P DID
Deepanshu Kartikey <[email protected]>
comedi: fix divide-by-zero in comedi_buf_munge()
Alice Ryhl <[email protected]>
binder: remove "invalid inc weak" check
Andrew Cooper <[email protected]>
x86/microcode: Fix Entrysign revision check for Zen1/Naples
Mathias Nyman <[email protected]>
xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
Mathias Nyman <[email protected]>
xhci: dbc: enable back DbC in resume if it was enabled before suspend
Andrey Konovalov <[email protected]>
usb: raw-gadget: do not limit transfer length
Tim Guttzeit <[email protected]>
usb/core/quirks: Add Huawei ME906S to wakeup quirk
LI Qingwu <[email protected]>
USB: serial: option: add Telit FN920C04 ECM compositions
Reinhard Speyerer <[email protected]>
USB: serial: option: add Quectel RG255C
Renjun Wang <[email protected]>
USB: serial: option: add UNISOC UIS7720
Andy Shevchenko <[email protected]>
sched: Remove never used code in mm_cid_get()
Alok Tiwari <[email protected]>
io_uring: correct __must_hold annotation in io_install_fixed_file
Haotian Zhang <[email protected]>
gpio: ljca: Fix duplicated IRQ mapping
Christoph Hellwig <[email protected]>
block: require LBA dma_alignment when using PI
Lorenzo Pieralisi <[email protected]>
of/irq: Add msi-parent check to of_msi_xlate()
Lorenzo Pieralisi <[email protected]>
of/irq: Convert of_msi_map_id() callers to of_msi_xlate()
Jocelyn Falempe <[email protected]>
drm/panic: Fix 24bit pixel crossing page boundaries
Jocelyn Falempe <[email protected]>
drm/panic: Fix qr_code, ensure vmargin is positive
Jocelyn Falempe <[email protected]>
drm/panic: Fix drawing the logo on a small narrow screen
Ondrej Mosnacek <[email protected]>
nbd: override creds to kernel when calling sock_{send,recv}msg()
Alok Tiwari <[email protected]>
io_uring: fix incorrect unlikely() usage in io_waitid_prep()
Guenter Roeck <[email protected]>
hwmon: (sht3x) Fix error handling
Li Qiang <[email protected]>
hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc()
Erick Karanja <[email protected]>
hwmon: (pmbus/isl68137) Fix child node reference leak on early return
Paul Walmsley <[email protected]>
riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
Anup Patel <[email protected]>
RISC-V: Don't print details of CPUs disabled in DT
Anup Patel <[email protected]>
RISC-V: Define pgprot_dmacoherent() for non-coherent devices
Akash Goel <[email protected]>
drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
Fernando Fernandez Mancera <[email protected]>
sysfs: check visibility before changing group attribute ownership
Mikhail Kshevetskiy <[email protected]>
spi: airoha: fix reading/writing of flashes with more than one plane per lun
Mikhail Kshevetskiy <[email protected]>
spi: airoha: switch back to non-dma mode in the case of error
Mikhail Kshevetskiy <[email protected]>
spi: airoha: add support of dual/quad wires spi modes to exec_op() handler
Mikhail Kshevetskiy <[email protected]>
spi: airoha: return an error for continuous mode dirmap creation cases
Artem Shimko <[email protected]>
firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
Cristian Marussi <[email protected]>
include: trace: Fix inflight count helper on failed initialization
Cristian Marussi <[email protected]>
firmware: arm_scmi: Account for failed debug initialization
Peter Robinson <[email protected]>
arm64: dts: broadcom: bcm2712: Define VGIC interrupt
Krzysztof Kozlowski <[email protected]>
arm64: dts: broadcom: bcm2712: Add default GIC address cells
Mattijs Korpershoek <[email protected]>
spi: cadence-quadspi: Fix pm_runtime unbalance on dma EPROBE_DEFER
Haibo Chen <[email protected]>
spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection
Han Xu <[email protected]>
spi: spi-nxp-fspi: add extra delay after dll locked
Haibo Chen <[email protected]>
spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate
Haibo Chen <[email protected]>
spi: spi-nxp-fspi: add the support for sample data from DQS pad
Sudeep Holla <[email protected]>
firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor
Marek Szyprowski <[email protected]>
spi: rockchip-sfc: Fix DMA-API usage
SeongJae Park <[email protected]>
mm/damon/sysfs: dealloc commit test ctx always
SeongJae Park <[email protected]>
mm/damon/sysfs: catch commit test ctx alloc failure
Enze Li <[email protected]>
mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme
SeongJae Park <[email protected]>
mm/damon/core: fix list_add_tail() call on damon_call()
SeongJae Park <[email protected]>
mm/damon/core: use damos_commit_quota_goal() for new goal commit
Charlene Liu <[email protected]>
drm/amd/display: increase max link count and fix link->enc NULL pointer access
Matthew Brost <[email protected]>
drm/xe: Check return value of GGTT workqueue allocation
Lorenzo Stoakes <[email protected]>
mm/mremap: correctly account old mapping after MREMAP_DONTUNMAP remap
Qiuxu Zhuo <[email protected]>
mm: prevent poison consumption when splitting THP
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: mark implicit tests as skipped if not supported
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: mark 'flush re-add' as skipped if not supported
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
Lad Prabhakar <[email protected]>
net: ravb: Ensure memory write completes before ringing TX doorbell
Lad Prabhakar <[email protected]>
net: ravb: Enforce descriptor type ordering
Michal Pecio <[email protected]>
net: usb: rtl8150: Fix frame padding
Sebastian Reichel <[email protected]>
net: stmmac: dwmac-rk: Fix disabling set_clock_selection
Tonghao Zhang <[email protected]>
net: bonding: update the slave array for broadcast mode
Stefano Garzarella <[email protected]>
vsock: fix lock inversion in vsock_assign_transport()
Nam Cao <[email protected]>
rv: Make rtapp/pagefault monitor depends on CONFIG_MMU
Nam Cao <[email protected]>
rv: Fully convert enabled_monitors to use list_head as iterator
Deepanshu Kartikey <[email protected]>
ocfs2: clear extent cache after moving/defragmenting extents
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
Alexis Czezar Torreno <[email protected]>
hwmon: (pmbus/max34440) Update adpm12160 coeff due to latest FW
Maarten Lankhorst <[email protected]>
devcoredump: Fix circular locking dependency with devcd->mutex.
David Howells <[email protected]>
cifs: Fix TCP_Server_Info::credits to be signed
Marc Kleine-Budde <[email protected]>
can: netlink: can_changelink(): allow disabling of automatic restart
Catalin Marinas <[email protected]>
arm64: mte: Do not warn if the page is already tagged in copy_highpage()
Xi Ruoyao <[email protected]>
ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
Paulo Alcantara <[email protected]>
smb: client: get rid of d_drop() in cifs_do_rename()
Hao Ge <[email protected]>
slab: Fix obj_ext mistakenly considered NULL due to race condition
Hao Ge <[email protected]>
slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
Danilo Krummrich <[email protected]>
rust: device: fix device context of Device::parent()
Paul Walmsley <[email protected]>
riscv: cpufeature: avoid uninitialized variable in has_thead_homogeneous_vlenb()
Rafael J. Wysocki <[email protected]>
Revert "cpuidle: menu: Avoid discarding useful information"
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers
tr1x_em <[email protected]>
platform/x86: alienware-wmi-wmax: Add AWCC support to Dell G15 5530
Darrick J. Wong <[email protected]>
xfs: fix locking in xchk_nlinks_collect_dir
William Breathitt Gray <[email protected]>
gpio: 104-idio-16: Define maximum valid register address offset
William Breathitt Gray <[email protected]>
gpio: pci-idio-16: Define maximum valid register address offset
Amit Dhingra <[email protected]>
btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree()
Ting-Chang Hou <[email protected]>
btrfs: send: fix duplicated rmdir operations when using extrefs
Dewei Meng <[email protected]>
btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()
Jens Axboe <[email protected]>
io_uring/sqpoll: be smarter on when to update the stime usage
Jens Axboe <[email protected]>
io_uring/sqpoll: switch away from getrusage() for CPU accounting
Jingwei Wang <[email protected]>
riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot
Kaushlendra Kumar <[email protected]>
arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
Jason Wang <[email protected]>
virtio-net: zero unused hash fields
Marek Szyprowski <[email protected]>
dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
Alexei Starovoitov <[email protected]>
mm: don't spin in add_stack_record when gfp flags don't allow
Lance Yang <[email protected]>
hung_task: fix warnings caused by unaligned lock pointers
Tonghao Zhang <[email protected]>
net: bonding: fix possible peer notify event loss or dup issue
Jakub Acs <[email protected]>
fs/notify: call exportfs_encode_fid with s_umount
Patrisious Haddad <[email protected]>
net/mlx5: Fix IPsec cleanup over MPV device
Robert Marko <[email protected]>
net: phy: micrel: always set shared->phydev for LAN8814
Ralf Lici <[email protected]>
ovpn: use datagram_poll_queue for socket readiness in TCP
Ralf Lici <[email protected]>
net: datagram: introduce datagram_poll_queue for custom receive queues
Ralf Lici <[email protected]>
espintcp: use datagram_poll_queue for socket readiness
Fernando Fernandez Mancera <[email protected]>
net: hsr: prevent creation of HSR device with slaves from another netns
Alexey Simakov <[email protected]>
sctp: avoid NULL dereference when chunk data buffer is missing
Jiasheng Jiang <[email protected]>
ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
Heiner Kallweit <[email protected]>
net: hibmcge: select FIXED_PHY
Gao Xiang <[email protected]>
erofs: avoid infinite loops due to corrupted subpage compact indexes
Huang Ying <[email protected]>
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
Aksh Garg <[email protected]>
net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions
Wang Liang <[email protected]>
net/smc: fix general protection fault in __smc_diag_dump
Amery Hung <[email protected]>
net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
Amery Hung <[email protected]>
net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
Xin Long <[email protected]>
selftests: net: fix server bind failure in sctp_vrf.sh
Marc Kleine-Budde <[email protected]>
can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
Marc Kleine-Budde <[email protected]>
can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
Marc Kleine-Budde <[email protected]>
can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
Aleksander Jan Bajkowski <[email protected]>
net: phy: realtek: fix rtl8221b-vm-cg name
Ioana Ciornei <[email protected]>
dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
Wei Fang <[email protected]>
net: enetc: correct the value of ENETC_RXB_TRUESIZE
Jianpeng Chang <[email protected]>
net: enetc: fix the deadlock of enetc_mdio_lock
Gao Xiang <[email protected]>
erofs: fix crafted invalid cases for encoded extents
Johannes Wiesböck <[email protected]>
rtnetlink: Allow deleting FDB entries in user namespace
Nathan Chancellor <[email protected]>
net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size()
Mario Limonciello (AMD) <[email protected]>
cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate
David Thompson <[email protected]>
platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init
Linus Torvalds <[email protected]>
Unbreak 'make tools/*' for user-space targets
Stefan Metzmacher <[email protected]>
smb: server: let smb_direct_flush_send_list() invalidate a remote key first
Stefan Metzmacher <[email protected]>
smb: client: make use of ib_wc_status_msg() and skip IB_WC_WR_FLUSH_ERR logging
Stefan Metzmacher <[email protected]>
smb: client: limit the range of info->receive_credit_target
Stefan Metzmacher <[email protected]>
smb: client: queue post_recv_credits_work also if the peer raises the credit target
Heiko Carstens <[email protected]>
s390/mm: Use __GFP_ACCOUNT for user page table allocations
Yicong Yang <[email protected]>
drivers/perf: hisi: Relax the event ID check in the framework
Clément Léger <[email protected]>
riscv: cpufeature: add validation for zfa, zfh and zfhmin
Junhui Liu <[email protected]>
riscv: mm: Use mmu-type from FDT to limit SATP mode
Junhui Liu <[email protected]>
riscv: mm: Return intended SATP mode for noXlvl options
Christophe Leroy <[email protected]>
powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
Geert Uytterhoeven <[email protected]>
m68k: bitops: Fix find_*_bit() signatures
Andreas Gruenbacher <[email protected]>
gfs2: Fix unlikely race in gdlm_put_lock
Fuad Tabba <[email protected]>
arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
Junjie Cao <[email protected]>
lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
Kees Cook <[email protected]>
PCI: Test for bit underflow in pcie_set_readrq()
Yangtao Li <[email protected]>
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
Viacheslav Dubeyko <[email protected]>
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
Alexander Aring <[email protected]>
dlm: check for defined force value in dlm_lockspace_release
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
Yang Chenzhi <[email protected]>
hfs: validate record offset in hfsplus_bmap_alloc
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
Viacheslav Dubeyko <[email protected]>
hfs: make proper initalization of struct hfs_find_data
Viacheslav Dubeyko <[email protected]>
hfs: clear offset and space out of valid records in b-tree node
Harald Freudenberger <[email protected]>
s390/pkey: Forward keygenflags to ep11_unwrapkey
Simon Schuster <[email protected]>
nios2: ensure that memblock.current_limit is set when setting pfn limits
Xichao Zhao <[email protected]>
exec: Fix incorrect type for ret
Alexander Aring <[email protected]>
dlm: move to rinfo for all middle conversion cases
Randy Dunlap <[email protected]>
cgroup/misc: fix misc_res_type kernel-doc warning
Jan Kara <[email protected]>
expfs: Fix exportfs_can_encode_fh() for EXPORT_FH_FID
Nipun Gupta <[email protected]>
vfio/cdx: update driver to build without CONFIG_GENERIC_MSI_IRQ
K Prateek Nayak <[email protected]>
sched/fair: Block delayed tasks on throttled hierarchy during dequeue
-------------
Diffstat:
.../devicetree/bindings/serial/renesas,scif.yaml | 1 + .../devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml | 10 +- .../devicetree/bindings/usb/qcom,snps-dwc3.yaml | 3 + Makefile | 8 +- arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 3 + arch/arm64/include/asm/pgtable.h | 3 +- arch/arm64/mm/copypage.c | 11 +- arch/arm64/tools/sysreg | 4 +- arch/m68k/include/asm/bitops.h | 25 ++-- arch/mips/mti-malta/malta-setup.c | 2 +- arch/nios2/kernel/setup.c | 15 +++ arch/powerpc/include/asm/pgtable.h | 12 -- arch/powerpc/mm/book3s32/mmu.c | 4 +- arch/powerpc/mm/pgtable_32.c | 2 +- arch/powerpc/platforms/pseries/cmm.c | 2 +- arch/riscv/include/asm/hwprobe.h | 7 ++ arch/riscv/include/asm/pgtable.h | 2 + arch/riscv/include/asm/vdso/arch_data.h | 6 + arch/riscv/kernel/cpu.c | 4 +- arch/riscv/kernel/cpufeature.c | 10 +- arch/riscv/kernel/pi/cmdline_early.c | 4 +- arch/riscv/kernel/pi/fdt_early.c | 40 ++++++ arch/riscv/kernel/pi/pi.h | 1 + arch/riscv/kernel/sys_hwprobe.c | 94 ++++++++++---- arch/riscv/kernel/unaligned_access_speed.c | 9 +- arch/riscv/kernel/vdso/hwprobe.c | 2 +- arch/riscv/mm/init.c | 11 +- arch/s390/mm/pgalloc.c | 13 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- block/blk-settings.c | 10 ++ drivers/acpi/acpica/tbprint.c | 6 + drivers/android/binder.c | 11 +- drivers/base/arch_topology.c | 2 +- drivers/base/devcoredump.c | 136 +++++++++++++-------- drivers/block/nbd.c | 15 +++ drivers/comedi/comedi_buf.c | 2 +- drivers/cpufreq/amd-pstate.c | 6 +- drivers/cpuidle/governors/menu.c | 21 ++-- drivers/firmware/arm_ffa/driver.c | 37 ++++-- drivers/firmware/arm_scmi/common.h | 32 ++++- drivers/firmware/arm_scmi/driver.c | 54 +++----- drivers/gpio/gpio-104-idio-16.c | 1 + drivers/gpio/gpio-idio-16.c | 5 + drivers/gpio/gpio-ljca.c | 14 +-- drivers/gpio/gpio-pci-idio-16.c | 1 + drivers/gpio/gpio-regmap.c | 53 +++++++- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 3 + drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h | 8 +- drivers/gpu/drm/drm_panic.c | 54 +++++++- drivers/gpu/drm/panthor/panthor_mmu.c | 10 +- drivers/gpu/drm/xe/xe_ggtt.c | 3 + drivers/hwmon/cgbc-hwmon.c | 3 + drivers/hwmon/pmbus/isl68137.c | 3 +- drivers/hwmon/pmbus/max34440.c | 12 +- drivers/hwmon/sht3x.c | 27 ++-- drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c | 2 +- drivers/misc/fastrpc.c | 2 + drivers/misc/lkdtm/fortify.c | 6 + drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/vmw_balloon.c | 8 +- drivers/most/most_usb.c | 13 +- drivers/net/bonding/bond_main.c | 47 ++++--- drivers/net/can/bxcan.c | 2 +- drivers/net/can/dev/netlink.c | 6 +- drivers/net/can/esd/esdacc.c | 2 +- drivers/net/can/rockchip/rockchip_canfd-tx.c | 2 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 3 +- drivers/net/ethernet/freescale/enetc/enetc.c | 25 +++- drivers/net/ethernet/freescale/enetc/enetc.h | 2 +- drivers/net/ethernet/hisilicon/Kconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/params.c | 2 +- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 5 + .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 25 +++- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 51 ++++++-- drivers/net/ethernet/renesas/ravb_main.c | 24 +++- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 9 +- drivers/net/ethernet/ti/am65-cpts.c | 63 +++++++--- drivers/net/ovpn/tcp.c | 26 +++- drivers/net/phy/micrel.c | 4 +- drivers/net/phy/realtek/realtek_main.c | 16 +-- drivers/net/usb/rtl8150.c | 11 +- drivers/nvmem/rcar-efuse.c | 1 + drivers/of/irq.c | 62 ++++++---- drivers/pci/msi/irqdomain.c | 2 +- drivers/pci/pci.c | 6 +- drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +- drivers/perf/hisilicon/hisi_uncore_pmu.h | 3 +- drivers/platform/mellanox/mlxbf-pmc.c | 1 + drivers/platform/x86/dell/alienware-wmi-wmax.c | 12 +- drivers/ptp/ptp_ocp.c | 2 +- drivers/s390/crypto/zcrypt_ep11misc.c | 4 +- drivers/spi/spi-airoha-snfi.c | 128 ++++++++++++++----- drivers/spi/spi-cadence-quadspi.c | 5 +- drivers/spi/spi-nxp-fspi.c | 80 +++++++++++- drivers/spi/spi-rockchip-sfc.c | 12 +- .../staging/gpib/agilent_82350b/agilent_82350b.c | 12 +- drivers/staging/gpib/fmh_gpib/fmh_gpib.c | 5 + drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 13 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/8250/8250_exar.c | 11 ++ drivers/tty/serial/8250/8250_mtk.c | 6 +- drivers/tty/serial/sc16is7xx.c | 7 -- drivers/tty/serial/sh-sci.c | 14 ++- drivers/usb/core/quirks.c | 2 + drivers/usb/gadget/legacy/raw_gadget.c | 2 - drivers/usb/host/xhci-dbgcap.c | 15 ++- drivers/usb/serial/option.c | 10 ++ drivers/usb/typec/tcpm/tcpm.c | 4 +- drivers/vfio/cdx/Makefile | 6 +- drivers/vfio/cdx/private.h | 14 +++ drivers/virtio/virtio_balloon.c | 2 +- fs/aio.c | 2 +- fs/btrfs/inode.c | 4 +- fs/btrfs/ref-verify.c | 2 +- fs/btrfs/send.c | 56 +++++++-- fs/btrfs/super.c | 8 +- fs/dlm/lock.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/dlm/recover.c | 2 +- fs/erofs/zmap.c | 39 +++--- fs/exec.c | 2 +- fs/gfs2/lock_dlm.c | 11 +- fs/hfs/bfind.c | 8 +- fs/hfs/brec.c | 27 +++- fs/hfs/mdb.c | 2 +- fs/hfsplus/bfind.c | 8 +- fs/hfsplus/bnode.c | 41 ------- fs/hfsplus/btree.c | 6 + fs/hfsplus/hfsplus_fs.h | 42 +++++++ fs/hfsplus/super.c | 25 +++- fs/hugetlbfs/inode.c | 4 +- fs/jfs/jfs_metapage.c | 8 +- fs/notify/fdinfo.c | 6 + fs/ocfs2/move_extents.c | 5 + fs/smb/client/cifsglob.h | 2 +- fs/smb/client/inode.c | 5 +- fs/smb/client/smbdirect.c | 30 +++-- fs/smb/client/smbdirect.h | 2 +- fs/smb/server/transport_rdma.c | 11 +- fs/sysfs/group.c | 26 +++- fs/xfs/scrub/nlinks.c | 34 +++++- fs/xfs/xfs_super.c | 33 +++-- include/linux/arm_ffa.h | 21 +++- include/linux/exportfs.h | 7 +- include/linux/gpio/regmap.h | 16 +++ include/linux/hung_task.h | 8 +- include/linux/migrate.h | 11 +- include/linux/misc_cgroup.h | 2 +- include/linux/of_irq.h | 6 - include/linux/skbuff.h | 3 + include/linux/virtio_net.h | 4 + io_uring/fdinfo.c | 8 +- io_uring/filetable.c | 2 +- io_uring/sqpoll.c | 65 +++++++--- io_uring/sqpoll.h | 1 + io_uring/waitid.c | 2 +- kernel/dma/debug.c | 5 +- kernel/sched/fair.c | 9 +- kernel/sched/sched.h | 2 - kernel/trace/rv/monitors/pagefault/Kconfig | 1 + kernel/trace/rv/rv.c | 12 +- mm/damon/core.c | 7 +- mm/damon/sysfs.c | 7 +- mm/huge_memory.c | 3 + mm/migrate.c | 88 +++++++------ mm/migrate_device.c | 2 +- mm/mremap.c | 15 +-- mm/page_owner.c | 3 + mm/slub.c | 23 ++-- mm/zsmalloc.c | 4 +- net/core/datagram.c | 44 +++++-- net/core/rtnetlink.c | 3 - net/hsr/hsr_netlink.c | 8 +- net/mptcp/pm_kernel.c | 6 + net/sctp/inqueue.c | 13 +- net/smc/smc_inet.c | 13 -- net/vmw_vsock/af_vsock.c | 38 +++--- net/xfrm/espintcp.c | 6 +- rust/kernel/auxiliary.rs | 8 +- rust/kernel/device.rs | 4 +- tools/objtool/check.c | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 +- tools/testing/selftests/net/sctp_hello.c | 17 +-- tools/testing/selftests/net/sctp_vrf.sh | 73 ++++++----- 186 files changed, 1849 insertions(+), 834 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/184 sched/fair: Block delayed tasks on throttled hierarchy during dequeue
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: K Prateek Nayak <[email protected]>
Dequeuing a fair task on a throttled hierarchy returns early on encountering a throttled cfs_rq since the throttle path has already dequeued the hierarchy above and has adjusted the h_nr_* accounting till the root cfs_rq.
dequeue_entities() crucially misses calling __block_task() for delayed tasks being dequeued on the throttled hierarchies, but this was mostly harmless until commit b7ca5743a260 ("sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks") since all existing cases would re-enqueue the task if task_on_rq_queued() returned true and the task would eventually be blocked at pick after the hierarchy was unthrottled.
wait_task_inactive() is special as it expects the delayed task on throttled hierarchy to reach the blocked state on dequeue but since __block_task() is never called, task_on_rq_queued() continues to return true. Furthermore, since the task is now off the hierarchy, the pick never reaches it to fully block the task even after unthrottle leading to wait_task_inactive() looping endlessly.
Remedy this by calling __block_task() if a delayed task is being dequeued on a throttled hierarchy.
This fix is only required for stabled kernels implementing delay dequeue (>= v6.12) before v6.18 since upstream commit e1fad12dcb66 ("sched/fair:
Switch to task based throttle model") indirectly fixes this by removing the early return conditions in dequeue_entities() as part of the per-task throttle feature.
--- kernel/sched/fair.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
kernel/sched/fair.c +6 -3
@@ -6969,6 +6969,7 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags)int h_nr_runnable =0 ;struct cfs_rq *cfs_rq;u64 slice =0 ; +int ret =0 ;if (entity_is_task (se)) { p =task_of (se);
@@ -6998,7 +6999,7 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags)/* end evaluation on encountering a throttled cfs_rq */ if (cfs_rq_throttled (cfs_rq)) -return 0 ; + goto out;/* Don't dequeue parent if it has other entities besides us */ if (cfs_rq->load.weight) {
@@ -7039,7 +7040,7 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags)/* end evaluation on encountering a throttled cfs_rq */ if (cfs_rq_throttled (cfs_rq)) -return 0 ; + goto out; }sub_nr_running (rq, h_nr_queued);
@@ -7048,6 +7049,8 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags)if (unlikely (!was_sched_idle &&sched_idle_rq (rq))) rq->next_balance = jiffies; + ret =1 ; +out:if (p && task_delayed) {WARN_ON_ONCE (!task_sleep);WARN_ON_ONCE (p->on_rq !=1 );
@@ -7063,7 +7066,7 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags)__block_task (rq, p); } -return 1 ; +return ret; }/*
base-commit: 6c7871823908a4330e145d635371582f76ce1407
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 2/184 vfio/cdx: update driver to build without CONFIG_GENERIC_MSI_IRQ
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nipun Gupta <[email protected]>
commit 9f3acb3d9a1872e2fa36af068ca2e93a8a864089 upstream.
Define dummy MSI related APIs in VFIO CDX driver to build the driver without enabling CONFIG_GENERIC_MSI_IRQ flag.
--- drivers/vfio/cdx/Makefile | 6 +++++- drivers/vfio/cdx/private.h | 14 ++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-)
drivers/vfio/cdx/Makefile +5 -1
@@ -5,4 +5,8 @@ obj-$(CONFIG_VFIO_CDX) += vfio-cdx.o -vfio-cdx-objs := main.o intr.o +vfio-cdx-objs := main.o + +ifdef CONFIG_GENERIC_MSI_IRQ +vfio-cdx-objs += intr.o +endif
drivers/vfio/cdx/private.h +14 -0
@@ -38,11 +38,25 @@ struct vfio_cdx_device { u8 config_msi; }; +#ifdef CONFIG_GENERIC_MSI_IRQ int vfio_cdx_set_irqs_ioctl (struct vfio_cdx_device *vdev,u32 flags,unsigned int index,unsigned int start,unsigned int count,void *data);void vfio_cdx_irqs_cleanup (struct vfio_cdx_device *vdev); +#else +static int vfio_cdx_set_irqs_ioctl (struct vfio_cdx_device *vdev, +u32 flags,unsigned int index, +unsigned int start,unsigned int count, +void *data) +{ +return -EINVAL ; +} + +static void vfio_cdx_irqs_cleanup (struct vfio_cdx_device *vdev) +{ +} +#endif #endif /* VFIO_CDX_PRIVATE_H */
Greg Kroah-Hartman
maintainerPATCH 3/184 expfs: Fix exportfs_can_encode_fh() for EXPORT_FH_FID
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 48b77733d0dbaf8cd0a122712072f92b2d95d894 ]
After commit 5402c4d4d200 ("exportfs: require ->fh_to_parent() to encode connectable file handles") we will fail to create non-decodable file handles for filesystems without export operations. Fix it.
--- include/linux/exportfs.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
include/linux/exportfs.h +4 -3
@@ -314,9 +314,6 @@ static inline bool exportfs_can_decode_fh(const struct export_operations *nop)static inline bool exportfs_can_encode_fh (const struct export_operations *nop,int fh_flags) { -if (!nop) -return false; -/* * If a non-decodeable file handle was requested, we only need to make * sure that filesystem did not opt-out of encoding fid.
@@ -324,6 +321,10 @@ static inline bool exportfs_can_encode_fh(const struct export_operations *nop,if (fh_flags &EXPORT_FH_FID )return exportfs_can_encode_fid (nop); +/* Normal file handles cannot be created without export ops */ +if (!nop) +return false; +/* * If a connectable file handle was requested, we need to make sure that * filesystem can also decode connected file handles.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/184 cgroup/misc: fix misc_res_type kernel-doc warning
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 0fbbcab7f9082cdc233da5e5e353f69830f11956 ]
Format the kernel-doc for SCALE_HW_CALIB_INVALID correctly to avoid a kernel-doc warning:
Warning: include/linux/misc_cgroup.h:26 Enum value
'MISC_CG_RES_TDX' not described in enum 'misc_res_type'
--- include/linux/misc_cgroup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/misc_cgroup.h +1 -1
@@ -19,7 +19,7 @@ enum misc_res_type { MISC_CG_RES_SEV_ES,#endif #ifdef CONFIG_INTEL_TDX_HOST -/* Intel TDX HKIDs resource */ +/** @MISC_CG_RES_TDX: Intel TDX HKIDs resource */ MISC_CG_RES_TDX,#endif /** @MISC_CG_RES_TYPES: count of enum misc_res_type constants */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/184 dlm: move to rinfo for all middle conversion cases
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit a8abcff174f7f9ce4587c6451b1a2450d01f52c9 ]
Since commit f74dacb4c8116 ("dlm: fix recovery of middle conversions") we introduced additional debugging information if we hit the middle conversion by using log_limit(). The DLM log_limit() functionality requires a DLM debug option being enabled. As this case is so rarely and excempt any potential introduced new issue with recovery we switching it to log_rinfo() ad this is ratelimited under normal DLM loglevel.
--- fs/dlm/lock.c | 2 +- fs/dlm/recover.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/dlm/lock.c +1 -1
@@ -5576,7 +5576,7 @@ static int receive_rcom_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,if (rl->rl_status ==DLM_LKSTS_CONVERT &&middle_conversion (lkb)) {/* We may need to adjust grmode depending on other granted locks. */ -log_limit (ls,"%s %x middle convert gr %d rq %d remote %d %x" , +log_rinfo (ls,"%s %x middle convert gr %d rq %d remote %d %x" , __func__, lkb->lkb_id, lkb->lkb_grmode, lkb->lkb_rqmode, lkb->lkb_nodeid, lkb->lkb_remid);rsb_set_flag (r,RSB_RECOVER_CONVERT );
fs/dlm/recover.c +1 -1
@@ -842,7 +842,7 @@ static void recover_conversion(struct dlm_rsb *r)*/ if (((lkb->lkb_grmode ==DLM_LOCK_PR ) && (other_grmode ==DLM_LOCK_CW )) || ((lkb->lkb_grmode ==DLM_LOCK_CW ) && (other_grmode ==DLM_LOCK_PR ))) { -log_limit (ls,"%s %x gr %d rq %d, remote %d %x, other_lkid %u, other gr %d, set gr=NL" , +log_rinfo (ls,"%s %x gr %d rq %d, remote %d %x, other_lkid %u, other gr %d, set gr=NL" , __func__, lkb->lkb_id, lkb->lkb_grmode, lkb->lkb_rqmode, lkb->lkb_nodeid, lkb->lkb_remid, other_lkid, other_grmode);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/184 exec: Fix incorrect type for ret
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xichao Zhao <[email protected]>
[ Upstream commit 5e088248375d171b80c643051e77ade6b97bc386 ]
In the setup_arg_pages(), ret is declared as an unsigned long. The ret might take a negative value. Therefore, its type should be changed to int.
--- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/exec.c +1 -1
@@ -599,7 +599,7 @@ int setup_arg_pages(struct linux_binprm *bprm,unsigned long stack_top, int executable_stack) { -unsigned long ret; + int ret;unsigned long stack_shift;struct mm_struct *mm = current->mm;struct vm_area_struct *vma = bprm->vma;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/184 nios2: ensure that memblock.current_limit is set when setting pfn limits
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <[email protected]>
[ Upstream commit a20b83cf45be2057f3d073506779e52c7fa17f94 ]
On nios2, with CONFIG_FLATMEM set, the kernel relies on memblock_get_current_limit() to determine the limits of mem_map, in particular for max_low_pfn.
Unfortunately, memblock.current_limit is only default initialized to MEMBLOCK_ALLOC_ANYWHERE at this point of the bootup, potentially leading to situations where max_low_pfn can erroneously exceed the value of max_pfn and, thus, the valid range of available DRAM.
This can in turn cause kernel-level paging failures, e.g.:
[ 76.900000] Unable to handle kernel paging request at virtual address 20303000 [ 76.900000] ea = c0080890, ra = c000462c, cause = 14 [ 76.900000] Kernel panic - not syncing: Oops [ 76.900000] ---[ end Kernel panic - not syncing: Oops ]---
This patch fixes this by pre-calculating memblock.current_limit based on the upper limits of the available memory ranges via adjust_lowmem_bounds, a simplified version of the equivalent implementation within the arm architecture.
--- arch/nios2/kernel/setup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
arch/nios2/kernel/setup.c +15 -0
@@ -142,6 +142,20 @@ static void __init find_limits(unsigned long *min, unsigned long *max_low, *max_high =PFN_DOWN (memblock_end_of_DRAM ()); } +static void __init adjust_lowmem_bounds (void ) +{ +phys_addr_t block_start, block_end; +u64 i; +phys_addr_t memblock_limit =0 ; + +for_each_mem_range (i, &block_start, &block_end) { +if (block_end > memblock_limit) + memblock_limit = block_end; + } + +memblock_set_current_limit (memblock_limit); +} +void __init setup_arch (char **cmdline_p) {console_verbose ();
@@ -157,6 +171,7 @@ void __init setup_arch(char **cmdline_p)/* Keep a copy of command line */ *cmdline_p = boot_command_line; +adjust_lowmem_bounds ();find_limits (&min_low_pfn, &max_low_pfn, &max_pfn);memblock_reserve (__pa_symbol (_stext), _end - _stext);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/184 s390/pkey: Forward keygenflags to ep11_unwrapkey
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
[ Upstream commit 11aa54ba4cfa5390ea47c9a1fc62502abce1f6b9 ]
The pkey ioctl PKEY_CLR2SECK2 describes in the pkey.h header file the parameter 'keygenflags' which is forwarded to the handler functions which actually deal with the clear key to secure key operation. The ep11 handler module function ep11_clr2keyblob() function receives this parameter but does not forward it to the underlying function ep11_unwrapkey() on invocation. So in the end the user of this ioctl could not forward additional key generation flags to the ep11 implementation and thus was unable to modify the key generation process in any way. So now call ep11_unwrapkey() with the real keygenflags instead of 0 and thus the user of this ioctl can for example via keygenflags provide valid combinations of XCP_BLOB_* flags.
--- drivers/s390/crypto/zcrypt_ep11misc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/s390/crypto/zcrypt_ep11misc.c +3 -1
@@ -1405,7 +1405,9 @@ int ep11_clr2keyblob(u16 card, u16 domain, u32 keybitsize, u32 keygenflags,/* Step 3: import the encrypted key value as a new key */ rc =ep11_unwrapkey (card, domain, kek, keklen, encbuf, encbuflen,0 , def_iv, - keybitsize,0 , keybuf, keybufsize, keytype, xflags); + keybitsize, keygenflags, + keybuf, keybufsize, + keytype, xflags);if (rc) {ZCRYPT_DBF_ERR ("%s importing key value as new key failed, rc=%d\n" , __func__, rc);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/184 hfs: clear offset and space out of valid records in b-tree node
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 18b07c44f245beb03588b00b212b38fce9af7cc9 ]
Currently, hfs_brec_remove() executes moving records towards the location of deleted record and it updates offsets of moved records. However, the hfs_brec_remove() logic ignores the "mess" of b-tree node's free space and it doesn't touch the offsets out of records number. Potentially, it could confuse fsck or driver logic or to be a reason of potential corruption cases.
This patch reworks the logic of hfs_brec_remove() by means of clearing freed space of b-tree node after the records moving. And it clear the last offset that keeping old location of free space because now the offset before this one is keeping the actual offset to the free space after the record deletion.
--- fs/hfs/brec.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-)
fs/hfs/brec.c +23 -4
@@ -179,6 +179,7 @@ int hfs_brec_remove(struct hfs_find_data *fd)struct hfs_btree *tree;struct hfs_bnode *node, *parent;int end_off, rec_off, data_off, size; +int src, dst, len; tree = fd->tree; node = fd->bnode;
@@ -208,10 +209,14 @@ int hfs_brec_remove(struct hfs_find_data *fd) }hfs_bnode_write_u16 (node, offsetof(struct hfs_bnode_desc , num_recs), node->num_recs); -if (rec_off == end_off) - goto skip; size = fd->keylength + fd->entrylength; +if (rec_off == end_off) { + src = fd->keyoffset; +hfs_bnode_clear (node, src, size); + goto skip; + } + do { data_off = hfs_bnode_read_u16(node, rec_off); hfs_bnode_write_u16(node, rec_off + 2, data_off - size);
@@ -219,9 +224,23 @@ int hfs_brec_remove(struct hfs_find_data *fd) }while (rec_off >= end_off);/* fill hole */ -hfs_bnode_move (node, fd->keyoffset, fd->keyoffset + size, - data_off - fd->keyoffset - size); + dst = fd->keyoffset; + src = fd->keyoffset + size; + len = data_off - src; + +hfs_bnode_move (node, dst, src, len); + + src = dst + len; + len = data_off - src; + +hfs_bnode_clear (node, src, len); + skip: +/* +* Remove the obsolete offset to free space. +*/ +hfs_bnode_write_u16 (node, end_off,0 ); +hfs_bnode_dump (node);if (!fd->record)hfs_brec_update_parent (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/184 hfs: make proper initalization of struct hfs_find_data
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit c62663a986acee7c4485c1fa9de5fc40194b6290 ]
Potenatially, __hfs_ext_read_extent() could operate by not initialized values of fd->key after hfs_brec_find() call:
static inline int __hfs_ext_read_extent(struct hfs_find_data *fd, struct hfs_extent *extent,
u32 cnid, u32 block, u8 type)
{
int res;
hfs_ext_build_key(fd->search_key, cnid, block, type);
fd->key->ext.FNum = 0;
res = hfs_brec_find(fd);
if (res && res != -ENOENT)
return res;
if (fd->key->ext.FNum != fd->search_key->ext.FNum ||
fd->key->ext.FkType != fd->search_key->ext.FkType)
return -ENOENT;
if (fd->entrylength != sizeof(hfs_extent_rec))
return -EIO;
hfs_bnode_read(fd->bnode, extent, fd->entryoffset, sizeof(hfs_extent_rec));
return 0;
}This patch changes kmalloc() on kzalloc() in hfs_find_init() and intializes fd->record, fd->keyoffset, fd->keylength, fd->entryoffset, fd->entrylength for the case if hfs_brec_find() has been found nothing in the b-tree node.
--- fs/hfs/bfind.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/hfs/bfind.c +7 -1
@@ -21,7 +21,7 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) fd->tree = tree; fd->bnode =NULL ; - ptr =kmalloc (tree->max_key_len *2 +4 ,GFP_KERNEL ); + ptr =kzalloc (tree->max_key_len *2 +4 ,GFP_KERNEL );if (!ptr)return -ENOMEM ; fd->search_key = ptr;
@@ -115,6 +115,12 @@ int hfs_brec_find(struct hfs_find_data *fd)__be32 data;int height, res; + fd->record =-1 ; + fd->keyoffset =-1 ; + fd->keylength =-1 ; + fd->entryoffset =-1 ; + fd->entrylength =-1 ; + tree = fd->tree;if (fd->bnode)hfs_bnode_put (fd->bnode);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/184 hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 4840ceadef4290c56cc422f0fc697655f3cbf070 ]
The syzbot reported issue in __hfsplus_ext_cache_extent():
[ 70.194323][ T9350] BUG: KMSAN: uninit-value in __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195022][ T9350] __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195530][ T9350] hfsplus_file_extend+0x74f/0x1cf0 [ 70.195998][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.196458][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.196959][ T9350] cont_write_begin+0x1000/0x1950 [ 70.197416][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.197873][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.198374][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.198892][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.199393][ T9350] vfs_write+0xb0f/0x14e0 [ 70.199771][ T9350] ksys_write+0x23e/0x490 [ 70.200149][ T9350] __x64_sys_write+0x97/0xf0 [ 70.200570][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.201065][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.201506][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.202054][ T9350] [ 70.202279][ T9350] Uninit was created at: [ 70.202693][ T9350] __kmalloc_noprof+0x621/0xf80 [ 70.203149][ T9350] hfsplus_find_init+0x8d/0x1d0 [ 70.203602][ T9350] hfsplus_file_extend+0x6ca/0x1cf0 [ 70.204087][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.204561][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.205074][ T9350] cont_write_begin+0x1000/0x1950 [ 70.205547][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.206017][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.206519][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.207042][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.207552][ T9350] vfs_write+0xb0f/0x14e0 [ 70.207961][ T9350] ksys_write+0x23e/0x490 [ 70.208375][ T9350] __x64_sys_write+0x97/0xf0 [ 70.208810][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.209255][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.209680][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.210230][ T9350] [ 70.210454][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Not tainted 6.12.0-rc5 #5 [ 70.211174][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.212115][ T9350] ===================================================== [ 70.212734][ T9350] Disabling lock debugging due to kernel taint [ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic set ... [ 70.213858][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Tainted: G B 6.12.0-rc5 #5 [ 70.214679][ T9350] Tainted: [B]=BAD_PAGE [ 70.215057][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.215999][ T9350] Call Trace: [ 70.216309][ T9350] <TASK> [ 70.216585][ T9350] dump_stack_lvl+0x1fd/0x2b0 [ 70.217025][ T9350] dump_stack+0x1e/0x30 [ 70.217421][ T9350] panic+0x502/0xca0 [ 70.217803][ T9350] ? kmsan_get_metadata+0x13e/0x1c0
[ 70.218294][ Message fromT sy9350] kmsan_report+0x296/slogd@syzkaller 0x2aat Aug 18 22:11:058 ... kernel :[ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic [ 70.220179][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 set ... [ 70.221254][ T9350] ? __msan_warning+0x96/0x120 [ 70.222066][ T9350] ? __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.223023][ T9350] ? hfsplus_file_extend+0x74f/0x1cf0 [ 70.224120][ T9350] ? hfsplus_get_block+0xe16/0x17b0 [ 70.224946][ T9350] ? __block_write_begin_int+0x962/0x2ce0 [ 70.225756][ T9350] ? cont_write_begin+0x1000/0x1950 [ 70.226337][ T9350] ? hfsplus_write_begin+0x85/0x130 [ 70.226852][ T9350] ? generic_perform_write+0x3e8/0x1060 [ 70.227405][ T9350] ? __generic_file_write_iter+0x215/0x460 [ 70.227979][ T9350] ? generic_file_write_iter+0x109/0x5e0 [ 70.228540][ T9350] ? vfs_write+0xb0f/0x14e0 [ 70.228997][ T9350] ? ksys_write+0x23e/0x490 [ 70.229458][ T9350] ? __x64_sys_write+0x97/0xf0 [ 70.229939][ T9350] ? x64_sys_call+0x3015/0x3cf0 [ 70.230432][ T9350] ? do_syscall_64+0xd9/0x1d0 [ 70.230941][ T9350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.231926][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.232738][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.233711][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.234516][ T9350] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.235398][ T9350] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.236323][ T9350] ? hfsplus_brec_find+0x218/0x9f0 [ 70.237090][ T9350] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 70.237938][ T9350] ? __msan_instrument_asm_store+0xbf/0xf0 [ 70.238827][ T9350] ? __msan_metadata_ptr_for_store_4+0x27/0x40 [ 70.239772][ T9350] ? __hfsplus_ext_write_extent+0x536/0x620 [ 70.240666][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.241175][ T9350] __msan_warning+0x96/0x120 [ 70.241645][ T9350] __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.242223][ T9350] hfsplus_file_extend+0x74f/0x1cf0 [ 70.242748][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.243255][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.243878][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.244400][ T9350] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.244967][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.245531][ T9350] ? __pfx_hfsplus_get_block+0x10/0x10 [ 70.246079][ T9350] cont_write_begin+0x1000/0x1950 [ 70.246598][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.247105][ T9350] ? __pfx_hfsplus_get_block+0x10/0x10 [ 70.247650][ T9350] ? __pfx_hfsplus_write_begin+0x10/0x10 [ 70.248211][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.248752][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.249314][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.249856][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.250487][ T9350] vfs_write+0xb0f/0x14e0 [ 70.250930][ T9350] ? __pfx_generic_file_write_iter+0x10/0x10 [ 70.251530][ T9350] ksys_write+0x23e/0x490 [ 70.251974][ T9350] __x64_sys_write+0x97/0xf0 [ 70.252450][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.252924][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.253384][ T9350] ? irqentry_exit+0x16/0x60 [ 70.253844][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.254430][ T9350] RIP: 0033:0x7f7a92adffc9 [ 70.254873][ T9350] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 70.256674][ T9350] RSP: 002b:00007fff0bca3188 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 70.257485][ T9350] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7a92adffc9 [ 70.258246][ T9350] RDX: 000000000208e24b RSI: 0000000020000100 RDI: 0000000000000004 [ 70.258998][ T9350] RBP: 00007fff0bca31a0 R08: 00007fff0bca31a0 R09: 00007fff0bca31a0 [ 70.259769][ T9350] R10: 0000000000000000 R11: 0000000000000202 R12: 000055e0d75f8250 [ 70.260520][ T9350] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.261286][ T9350] </TASK> [ 70.262026][ T9350] Kernel Offset: disabled
(gdb) l *__hfsplus_ext_cache_extent+0x7d00xffffffff8318aef0 is in __hfsplus_ext_cache_extent (fs/hfsplus/extents.c:168).
163 fd->key->ext.cnid = 0;
164 res = hfs_brec_find(fd, hfs_find_rec_by_key);
165 if (res && res != -ENOENT)
166 return res;
167 if (fd->key->ext.cnid != fd->search_key->ext.cnid ||
168 fd->key->ext.fork_type != fd->search_key->ext.fork_type)
169 return -ENOENT;
170 if (fd->entrylength != sizeof(hfsplus_extent_rec))
171 return -EIO;
172 hfs_bnode_read(fd->bnode, extent, fd->entryoffset,
The __hfsplus_ext_cache_extent() calls __hfsplus_ext_read_extent():
res = __hfsplus_ext_read_extent(fd, hip->cached_extents, inode->i_ino,
block, HFSPLUS_IS_RSRC(inode) ? HFSPLUS_TYPE_RSRC : HFSPLUS_TYPE_DATA);
And if inode->i_ino could be equal to zero or any non-available CNID, then hfs_brec_find() could not find the record in the tree. As a result, fd->key could be compared with fd->search_key. But hfsplus_find_init() uses kmalloc() for fd->key and fd->search_key allocation:
int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) {
<skipped>
ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL);
if (!ptr)
return -ENOMEM;
fd->search_key = ptr;
fd->key = ptr + tree->max_key_len + 2;<skipped>
}
Finally, fd->key is still not initialized if hfs_brec_find() has found nothing.
This patch changes kmalloc() on kzalloc() in hfs_find_init() and intializes fd->record, fd->keyoffset, fd->keylength, fd->entryoffset, fd->entrylength for the case if hfs_brec_find() has been found nothing in the b-tree node.
--- fs/hfsplus/bfind.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/hfsplus/bfind.c +7 -1
@@ -18,7 +18,7 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) fd->tree = tree; fd->bnode =NULL ; - ptr =kmalloc (tree->max_key_len *2 +4 ,GFP_KERNEL ); + ptr =kzalloc (tree->max_key_len *2 +4 ,GFP_KERNEL );if (!ptr)return -ENOMEM ; fd->search_key = ptr;
@@ -158,6 +158,12 @@ int hfs_brec_find(struct hfs_find_data *fd, search_strategy_t do_key_compare)__be32 data;int height, res; + fd->record =-1 ; + fd->keyoffset =-1 ; + fd->keylength =-1 ; + fd->entryoffset =-1 ; + fd->entrylength =-1 ; + tree = fd->tree;if (fd->bnode)hfs_bnode_put (fd->bnode);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/184 hfs: validate record offset in hfsplus_bmap_alloc
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Chenzhi <[email protected]>
[ Upstream commit 738d5a51864ed8d7a68600b8c0c63fe6fe5c4f20 ]
hfsplus_bmap_alloc can trigger a crash if a
record offset or length is larger than node_size
[ 15.264282] BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc+0x887/0x8b0 [ 15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183 [ 15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(voluntary) [ 15.266165] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] Call Trace: [ 15.266168] <TASK> [ 15.266169] dump_stack_lvl+0x53/0x70 [ 15.266173] print_report+0xd0/0x660 [ 15.266181] kasan_report+0xce/0x100 [ 15.266185] hfsplus_bmap_alloc+0x887/0x8b0 [ 15.266208] hfs_btree_inc_height.isra.0+0xd5/0x7c0 [ 15.266217] hfsplus_brec_insert+0x870/0xb00 [ 15.266222] __hfsplus_ext_write_extent+0x428/0x570 [ 15.266225] __hfsplus_ext_cache_extent+0x5e/0x910 [ 15.266227] hfsplus_ext_read_extent+0x1b2/0x200 [ 15.266233] hfsplus_file_extend+0x5a7/0x1000 [ 15.266237] hfsplus_get_block+0x12b/0x8c0 [ 15.266238] __block_write_begin_int+0x36b/0x12c0 [ 15.266251] block_write_begin+0x77/0x110 [ 15.266252] cont_write_begin+0x428/0x720 [ 15.266259] hfsplus_write_begin+0x51/0x100 [ 15.266262] cont_write_begin+0x272/0x720 [ 15.266270] hfsplus_write_begin+0x51/0x100 [ 15.266274] generic_perform_write+0x321/0x750 [ 15.266285] generic_file_write_iter+0xc3/0x310 [ 15.266289] __kernel_write_iter+0x2fd/0x800 [ 15.266296] dump_user_range+0x2ea/0x910 [ 15.266301] elf_core_dump+0x2a94/0x2ed0 [ 15.266320] vfs_coredump+0x1d85/0x45e0 [ 15.266349] get_signal+0x12e3/0x1990 [ 15.266357] arch_do_signal_or_restart+0x89/0x580 [ 15.266362] irqentry_exit_to_user_mode+0xab/0x110 [ 15.266364] asm_exc_page_fault+0x26/0x30 [ 15.266366] RIP: 0033:0x41bd35 [ 15.266367] Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8f [ 15.266369] RSP: 002b:00007ffc9e62d078 EFLAGS: 00010283 [ 15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX: 0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [ 15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 15.266375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000400000000000 [ 15.266376] </TASK>
When calling hfsplus_bmap_alloc to allocate a free node, this function first retrieves the bitmap from header node and map node using node->page together with the offset and length from hfs_brec_lenoff
``` len = hfs_brec_lenoff(node, 2, &off16); off = off16; off += node->page_offset; pagep = node->page + (off >> PAGE_SHIFT); data = kmap_local_page(*pagep); ```
However, if the retrieved offset or length is invalid(i.e. exceeds node_size), the code may end up accessing pages outside the allocated range for this node.
This patch adds proper validation of both offset and length before use, preventing out-of-bounds page access. Move is_bnode_offset_valid and check_and_correct_requested_length to hfsplus_fs.h, as they may be required by other functions.
--- fs/hfsplus/bnode.c | 41 ---------------------------------------- fs/hfsplus/btree.c | 6 ++++++ fs/hfsplus/hfsplus_fs.h | 42 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 48 insertions(+), 41 deletions(-)
fs/hfsplus/bnode.c +0 -41
@@ -18,47 +18,6 @@#include "hfsplus_fs.h" #include "hfsplus_raw.h" -static inline -bool is_bnode_offset_valid (struct hfs_bnode *node,int off) -{ -bool is_valid = off < node->tree->node_size; - -if (!is_valid) { -pr_err ("requested invalid offset: " -"NODE: id %u, type %#x, height %u, " -"node_size %u, offset %d\n" , - node->this, node->type, node->height, - node->tree->node_size, off); - } - -return is_valid; -} - -static inline -int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) -{ -unsigned int node_size; - -if (!is_bnode_offset_valid (node, off)) -return 0 ; - - node_size = node->tree->node_size; - -if ((off + len) > node_size) { -int new_len = (int )node_size - off; - -pr_err ("requested length has been corrected: " -"NODE: id %u, type %#x, height %u, " -"node_size %u, offset %d, " -"requested_len %d, corrected_len %d\n" , - node->this, node->type, node->height, - node->tree->node_size, off, len, new_len); - -return new_len; - } - -return len; -}/* Copy a specified range of bytes from the raw data of a node */ void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len)
fs/hfsplus/btree.c +6 -0
@@ -393,6 +393,12 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) len =hfs_brec_lenoff (node,2 , &off16); off = off16; +if (!is_bnode_offset_valid (node, off)) { +hfs_bnode_put (node); +return ERR_PTR (-EIO ); + } + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); data =kmap_local_page (*pagep);
fs/hfsplus/hfsplus_fs.h +42 -0
48 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/184 hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 9b3d15a758910bb98ba8feb4109d99cc67450ee4 ]
The syzbot reported issue in hfsplus_delete_cat():
[ 70.682285][ T9333] ===================================================== [ 70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec+0x1d7/0x220 [ 70.683640][ T9333] hfsplus_subfolders_dec+0x1d7/0x220 [ 70.684141][ T9333] hfsplus_delete_cat+0x105d/0x12b0 [ 70.684621][ T9333] hfsplus_rmdir+0x13d/0x310 [ 70.685048][ T9333] vfs_rmdir+0x5ba/0x810 [ 70.685447][ T9333] do_rmdir+0x964/0xea0 [ 70.685833][ T9333] __x64_sys_rmdir+0x71/0xb0 [ 70.686260][ T9333] x64_sys_call+0xcd8/0x3cf0 [ 70.686695][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.687119][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.687646][ T9333] [ 70.687856][ T9333] Uninit was stored to memory at: [ 70.688311][ T9333] hfsplus_subfolders_inc+0x1c2/0x1d0 [ 70.688779][ T9333] hfsplus_create_cat+0x148e/0x1800 [ 70.689231][ T9333] hfsplus_mknod+0x27f/0x600 [ 70.689730][ T9333] hfsplus_mkdir+0x5a/0x70 [ 70.690146][ T9333] vfs_mkdir+0x483/0x7a0 [ 70.690545][ T9333] do_mkdirat+0x3f2/0xd30 [ 70.690944][ T9333] __x64_sys_mkdir+0x9a/0xf0 [ 70.691380][ T9333] x64_sys_call+0x2f89/0x3cf0 [ 70.691816][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.692229][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.692773][ T9333] [ 70.692990][ T9333] Uninit was stored to memory at: [ 70.693469][ T9333] hfsplus_subfolders_inc+0x1c2/0x1d0 [ 70.693960][ T9333] hfsplus_create_cat+0x148e/0x1800 [ 70.694438][ T9333] hfsplus_fill_super+0x21c1/0x2700 [ 70.694911][ T9333] mount_bdev+0x37b/0x530 [ 70.695320][ T9333] hfsplus_mount+0x4d/0x60 [ 70.695729][ T9333] legacy_get_tree+0x113/0x2c0 [ 70.696167][ T9333] vfs_get_tree+0xb3/0x5c0 [ 70.696588][ T9333] do_new_mount+0x73e/0x1630 [ 70.697013][ T9333] path_mount+0x6e3/0x1eb0 [ 70.697425][ T9333] __se_sys_mount+0x733/0x830 [ 70.697857][ T9333] __x64_sys_mount+0xe4/0x150 [ 70.698269][ T9333] x64_sys_call+0x2691/0x3cf0 [ 70.698704][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.699117][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.699730][ T9333] [ 70.699946][ T9333] Uninit was created at: [ 70.700378][ T9333] __alloc_pages_noprof+0x714/0xe60 [ 70.700843][ T9333] alloc_pages_mpol_noprof+0x2a2/0x9b0 [ 70.701331][ T9333] alloc_pages_noprof+0xf8/0x1f0 [ 70.701774][ T9333] allocate_slab+0x30e/0x1390 [ 70.702194][ T9333] ___slab_alloc+0x1049/0x33a0 [ 70.702635][ T9333] kmem_cache_alloc_lru_noprof+0x5ce/0xb20 [ 70.703153][ T9333] hfsplus_alloc_inode+0x5a/0xd0 [ 70.703598][ T9333] alloc_inode+0x82/0x490 [ 70.703984][ T9333] iget_locked+0x22e/0x1320 [ 70.704428][ T9333] hfsplus_iget+0x5c/0xba0 [ 70.704827][ T9333] hfsplus_btree_open+0x135/0x1dd0 [ 70.705291][ T9333] hfsplus_fill_super+0x1132/0x2700 [ 70.705776][ T9333] mount_bdev+0x37b/0x530 [ 70.706171][ T9333] hfsplus_mount+0x4d/0x60 [ 70.706579][ T9333] legacy_get_tree+0x113/0x2c0 [ 70.707019][ T9333] vfs_get_tree+0xb3/0x5c0 [ 70.707444][ T9333] do_new_mount+0x73e/0x1630 [ 70.707865][ T9333] path_mount+0x6e3/0x1eb0 [ 70.708270][ T9333] __se_sys_mount+0x733/0x830 [ 70.708711][ T9333] __x64_sys_mount+0xe4/0x150 [ 70.709158][ T9333] x64_sys_call+0x2691/0x3cf0 [ 70.709630][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.710053][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.710611][ T9333] [ 70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17 [ 70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.712490][ T9333] ===================================================== [ 70.713085][ T9333] Disabling lock debugging due to kernel taint [ 70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ... [ 70.714159][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Tainted: G B 6.12.0-rc6-dirty #17 [ 70.715007][ T9333] Tainted: [B]=BAD_PAGE [ 70.715365][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.716311][ T9333] Call Trace: [ 70.716621][ T9333] <TASK> [ 70.716899][ T9333] dump_stack_lvl+0x1fd/0x2b0 [ 70.717350][ T9333] dump_stack+0x1e/0x30 [ 70.717743][ T9333] panic+0x502/0xca0 [ 70.718116][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.718611][ T9333] kmsan_report+0x296/0x2a0 [ 70.719038][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.719859][ T9333] ? __msan_warning+0x96/0x120 [ 70.720345][ T9333] ? hfsplus_subfolders_dec+0x1d7/0x220 [ 70.720881][ T9333] ? hfsplus_delete_cat+0x105d/0x12b0 [ 70.721412][ T9333] ? hfsplus_rmdir+0x13d/0x310 [ 70.721880][ T9333] ? vfs_rmdir+0x5ba/0x810 [ 70.722458][ T9333] ? do_rmdir+0x964/0xea0 [ 70.722883][ T9333] ? __x64_sys_rmdir+0x71/0xb0 [ 70.723397][ T9333] ? x64_sys_call+0xcd8/0x3cf0 [ 70.723915][ T9333] ? do_syscall_64+0xd9/0x1d0 [ 70.724454][ T9333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.725110][ T9333] ? vprintk_emit+0xd1f/0xe60 [ 70.725616][ T9333] ? vprintk_default+0x3f/0x50 [ 70.726175][ T9333] ? vprintk+0xce/0xd0 [ 70.726628][ T9333] ? _printk+0x17e/0x1b0 [ 70.727129][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.727739][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.728324][ T9333] __msan_warning+0x96/0x120 [ 70.728854][ T9333] hfsplus_subfolders_dec+0x1d7/0x220 [ 70.729479][ T9333] hfsplus_delete_cat+0x105d/0x12b0 [ 70.729984][ T9333] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.730646][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.731296][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.731863][ T9333] hfsplus_rmdir+0x13d/0x310 [ 70.732390][ T9333] ? __pfx_hfsplus_rmdir+0x10/0x10 [ 70.732919][ T9333] vfs_rmdir+0x5ba/0x810 [ 70.733416][ T9333] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.734044][ T9333] do_rmdir+0x964/0xea0 [ 70.734537][ T9333] __x64_sys_rmdir+0x71/0xb0 [ 70.735032][ T9333] x64_sys_call+0xcd8/0x3cf0 [ 70.735579][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.736092][ T9333] ? irqentry_exit+0x16/0x60 [ 70.736637][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.737269][ T9333] RIP: 0033:0x7fa9424eafc9 [ 70.737775][ T9333] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 70.739844][ T9333] RSP: 002b:00007fff099cd8d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000054 [ 70.740760][ T9333] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa9424eafc9 [ 70.741642][ T9333] RDX: 006c6f72746e6f63 RSI: 000000000000000a RDI: 0000000020000100 [ 70.742543][ T9333] RBP: 00007fff099cd8e0 R08: 00007fff099cd910 R09: 00007fff099cd910 [ 70.743376][ T9333] R10: 0000000000000000 R11: 0000000000000202 R12: 0000565430642260 [ 70.744247][ T9333] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.745082][ T9333] </TASK>
The main reason of the issue that struct hfsplus_inode_info has not been properly initialized for the case of root folder. In the case of root folder, hfsplus_fill_super() calls the hfsplus_iget() that implements only partial initialization of struct hfsplus_inode_info and subfolders field is not initialized by hfsplus_iget() logic.
This patch implements complete initialization of struct hfsplus_inode_info in the hfsplus_iget() logic with the goal to prevent likewise issues for the case of root folder.
--- fs/hfsplus/super.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
fs/hfsplus/super.c +18 -5
@@ -68,13 +68,26 @@ struct inode *hfsplus_iget(struct super_block *sb, unsigned long ino)if (!(inode->i_state &I_NEW ))return inode; -INIT_LIST_HEAD (&HFSPLUS_I (inode)->open_dir_list); -spin_lock_init (&HFSPLUS_I (inode)->open_dir_lock); -mutex_init (&HFSPLUS_I (inode)->extents_lock); -HFSPLUS_I (inode)->flags =0 ; +atomic_set (&HFSPLUS_I (inode)->opencnt,0 ); +HFSPLUS_I (inode)->first_blocks =0 ; +HFSPLUS_I (inode)->clump_blocks =0 ; +HFSPLUS_I (inode)->alloc_blocks =0 ; +HFSPLUS_I (inode)->cached_start =U32_MAX ; +HFSPLUS_I (inode)->cached_blocks =0 ; +memset (HFSPLUS_I (inode)->first_extents,0 ,sizeof (hfsplus_extent_rec)); +memset (HFSPLUS_I (inode)->cached_extents,0 ,sizeof (hfsplus_extent_rec));HFSPLUS_I (inode)->extent_state =0 ; +mutex_init (&HFSPLUS_I (inode)->extents_lock);HFSPLUS_I (inode)->rsrc_inode =NULL ; -atomic_set (&HFSPLUS_I (inode)->opencnt,0 ); +HFSPLUS_I (inode)->create_date =0 ; +HFSPLUS_I (inode)->linkid =0 ; +HFSPLUS_I (inode)->flags =0 ; +HFSPLUS_I (inode)->fs_blocks =0 ; +HFSPLUS_I (inode)->userflags =0 ; +HFSPLUS_I (inode)->subfolders =0 ; +INIT_LIST_HEAD (&HFSPLUS_I (inode)->open_dir_list); +spin_lock_init (&HFSPLUS_I (inode)->open_dir_lock); +HFSPLUS_I (inode)->phys_size =0 ;if (inode->i_ino >=HFSPLUS_FIRSTUSER_CNID || inode->i_ino ==HFSPLUS_ROOT_CNID ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/184 dlm: check for defined force value in dlm_lockspace_release
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit 6af515c9f3ccec3eb8a262ca86bef2c499d07951 ]
Force values over 3 are undefined, so don't treat them as 3.
--- fs/dlm/lockspace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dlm/lockspace.c +1 -1
@@ -730,7 +730,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)dlm_device_deregister (ls); -if (force <3 &&dlm_user_daemon_available ()) +if (force !=3 &&dlm_user_daemon_available ())do_uevent (ls,0 );dlm_recoverd_stop (ls);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/184 hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd ]
The syzbot reported issue in hfs_find_set_zero_bits():
=====================================================
BUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151 hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408 hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353 __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151 block_write_begin fs/buffer.c:2262 [inline] cont_write_begin+0x10e1/0x1bc0 fs/buffer.c:2601 hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52 cont_expand_zero fs/buffer.c:2528 [inline] cont_write_begin+0x35a/0x1bc0 fs/buffer.c:2591 hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52 hfs_file_truncate+0x1d6/0xe60 fs/hfs/extent.c:494 hfs_inode_setattr+0x964/0xaa0 fs/hfs/inode.c:654 notify_change+0x1993/0x1aa0 fs/attr.c:552 do_truncate+0x28f/0x310 fs/open.c:68 do_ftruncate+0x698/0x730 fs/open.c:195 do_sys_ftruncate fs/open.c:210 [inline] __do_sys_ftruncate fs/open.c:215 [inline] __se_sys_ftruncate fs/open.c:213 [inline] __x64_sys_ftruncate+0x11b/0x250 fs/open.c:213 x64_sys_call+0xfe3/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:78 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4154 [inline] slab_alloc_node mm/slub.c:4197 [inline] __kmalloc_cache_noprof+0x7f7/0xed0 mm/slub.c:4354 kmalloc_noprof include/linux/slab.h:905 [inline] hfs_mdb_get+0x1cc8/0x2a90 fs/hfs/mdb.c:175 hfs_fill_super+0x3d0/0xb80 fs/hfs/super.c:337 get_tree_bdev_flags+0x6e3/0x920 fs/super.c:1681 get_tree_bdev+0x38/0x50 fs/super.c:1704 hfs_get_tree+0x35/0x40 fs/hfs/super.c:388 vfs_get_tree+0xb0/0x5c0 fs/super.c:1804 do_new_mount+0x738/0x1610 fs/namespace.c:3902 path_mount+0x6db/0x1e90 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount+0x6eb/0x7d0 fs/namespace.c:4427 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4427 x64_sys_call+0xfa7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:166 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 12609 Comm: syz.1.2692 Not tainted 6.16.0-syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 =====================================================
The HFS_SB(sb)->bitmap buffer is allocated in hfs_mdb_get():
HFS_SB(sb)->bitmap = kmalloc(8192, GFP_KERNEL);
Finally, it can trigger the reported issue because kmalloc() doesn't clear the allocated memory. If allocated memory contains only zeros, then everything will work pretty fine.
But if the allocated memory contains the "garbage", then it can affect the bitmap operations and it triggers the reported issue.
This patch simply exchanges the kmalloc() on kzalloc() with the goal to guarantee the correctness of bitmap operations. Because, newly created allocation bitmap should have all available blocks free. Potentially, initialization bitmap's read operation could not fill the whole allocated memory and "garbage" in the not initialized memory will be the reason of volume coruptions and file system driver bugs.
--- fs/hfs/mdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/hfs/mdb.c +1 -1
@@ -172,7 +172,7 @@ int hfs_mdb_get(struct super_block *sb)pr_warn ("continuing without an alternate MDB\n" ); } -HFS_SB (sb)->bitmap =kmalloc (8192 ,GFP_KERNEL ); +HFS_SB (sb)->bitmap =kzalloc (8192 ,GFP_KERNEL );if (!HFS_SB (sb)->bitmap) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/184 hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 9282bc905f0949fab8cf86c0f620ca988761254c ]
If Catalog File contains corrupted record for the case of hidden directory's type, regard it as I/O error instead of Invalid argument.
--- fs/hfsplus/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/hfsplus/super.c +1 -1
@@ -537,7 +537,7 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)if (!hfs_brec_read (&fd, &entry,sizeof (entry))) {hfs_find_exit (&fd);if (entry.type !=cpu_to_be16 (HFSPLUS_FOLDER )) { - err = -EINVAL ; + err = -EIO ; goto out_put_root; } inode =hfsplus_iget (sb,be32_to_cpu (entry.folder.id));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/184 PCI: Test for bit underflow in pcie_set_readrq()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 00e58ff924b3a684b076f9512fe2753be87b50e1 ]
In preparation for the future commit ("bitops: Add __attribute_const__ to generic ffs()-family implementations"), which allows GCC's value range tracker to see past ffs(), GCC 8 on ARM thinks that it might be possible that "ffs(rq) - 8" used here:
v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
could wrap below 0, leading to a very large value, which would be out of range for the FIELD_PREP() usage:
drivers/pci/pci.c: In function 'pcie_set_readrq':include/linux/compiler_types.h:572:38: error: call to '__compiletime_assert_471' declared with attribute error: FIELD_PREP: value too large for the field
...drivers/pci/pci.c:5896:6: note: in expansion of macro 'FIELD_PREP'
v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
^~~~~~~~~~If the result of the ffs() is bounds checked before being used in FIELD_PREP(), the value tracker seems happy again. :)
--- drivers/pci/pci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/pci/pci.c +5 -1
@@ -5932,6 +5932,7 @@ int pcie_set_readrq(struct pci_dev *dev, int rq) {u16 v;int ret; +unsigned int firstbit;struct pci_host_bridge *bridge =pci_find_host_bridge (dev->bus);if (rq <128 || rq >4096 || !is_power_of_2 (rq))
@@ -5949,7 +5950,10 @@ int pcie_set_readrq(struct pci_dev *dev, int rq) rq = mps; } - v =FIELD_PREP (PCI_EXP_DEVCTL_READRQ ,ffs (rq) -8 ); + firstbit =ffs (rq); +if (firstbit <8 ) +return -EINVAL ; + v =FIELD_PREP (PCI_EXP_DEVCTL_READRQ , firstbit -8 );if (bridge->no_inc_mrrs) {int max_mrrs =pcie_get_readrq (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/184 lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <[email protected]>
[ Upstream commit 01c7344e21c2140e72282d9d16d79a61f840fc20 ]
Add missing NULL pointer checks after kmalloc() calls in lkdtm_FORTIFY_STR_MEMBER() and lkdtm_FORTIFY_MEM_MEMBER() functions.
--- drivers/misc/lkdtm/fortify.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/misc/lkdtm/fortify.c +6 -0
@@ -44,6 +44,9 @@ static void lkdtm_FORTIFY_STR_MEMBER(void)char *src; src =kmalloc (size,GFP_KERNEL ); +if (!src) +return ; +strscpy (src,"over ten bytes" , size); size =strlen (src) +1 ;
@@ -109,6 +112,9 @@ static void lkdtm_FORTIFY_MEM_MEMBER(void)char *src; src =kmalloc (size,GFP_KERNEL ); +if (!src) +return ; +strscpy (src,"over ten bytes" , size); size =strlen (src) +1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/184 arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <[email protected]>
[ Upstream commit f4d4ebc84995178273740f3e601e97fdefc561d2 ]
The ID_AA64MMFR4_EL1.EIESB field, is an unsigned enumeration, but was incorrectly defined as a SignedEnum when introduced in commit cfc680bb04c5 ("arm64: sysreg: Add layout for ID_AA64MMFR4_EL1"). This is corrected to UnsignedEnum.
Conversely, the ID_AA64DFR0_EL1.DoubleLock field, is a signed enumeration, but was incorrectly defined as an UnsignedEnum. This is corrected to SignedEnum, which wasn't correctly set when annotated as such in commit ad16d4cf0b4f ("arm64/sysreg: Initial unsigned annotations for ID registers").
--- arch/arm64/tools/sysreg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/tools/sysreg +2 -2
@@ -1693,7 +1693,7 @@ UnsignedEnum 43:40 TraceFilt 0b0000 NI 0b0001 IMP EndEnum -UnsignedEnum 39:36 DoubleLock +SignedEnum 39:36 DoubleLock 0b0000 IMP 0b1111 NI EndEnum
@@ -2409,7 +2409,7 @@ UnsignedEnum 11:8 ASID2 0b0000 NI 0b0001 IMP EndEnum -SignedEnum 7:4 EIESB +UnsignedEnum 7:4 EIESB 0b0000 NI 0b0001 ToEL3 0b0010 ToELx
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/184 gfs2: Fix unlikely race in gdlm_put_lock
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 28c4d9bc0708956c1a736a9e49fee71b65deee81 ]
In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released.
--- fs/gfs2/lock_dlm.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
fs/gfs2/lock_dlm.c +5 -6
@@ -361,12 +361,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl)gfs2_sbstats_inc (gl,GFS2_LKS_DCOUNT );gfs2_update_request_times (gl); -/* don't want to call dlm if we've unmounted the lock protocol */ -if (test_bit (DFL_UNMOUNT , &ls->ls_recover_flags)) { -gfs2_glock_free (gl); -return ; - } -/* * When the lockspace is released, all remaining glocks will be * unlocked automatically. This is more efficient than unlocking them
@@ -396,6 +390,11 @@ static void gdlm_put_lock(struct gfs2_glock *gl) goto again; } +if (error == -ENODEV ) { +gfs2_glock_free (gl); +return ; + } +if (error) { fs_err(sdp, "gdlm_unlock %x,%llx err=%d\n", gl->gl_name.ln_type,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/184 m68k: bitops: Fix find_*_bit() signatures
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 6d5674090543b89aac0c177d67e5fb32ddc53804 ]
The function signatures of the m68k-optimized implementations of the find_{first,next}_{,zero_}bit() helpers do not match the generic variants.
Fix this by changing all non-pointer inputs and outputs to "unsigned long", and updating a few local variables.
--- arch/m68k/include/asm/bitops.h | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
arch/m68k/include/asm/bitops.h +14 -11
@@ -350,12 +350,12 @@ static inline bool xor_unlock_is_negative_byte(unsigned long mask,#include <asm-generic/bitops/ffz.h> #else -static inline int find_first_zero_bit (const unsigned long *vaddr, -unsigned size) +static inline unsigned long find_first_zero_bit (const unsigned long *vaddr, +unsigned long size) {const unsigned long *p = vaddr; -int res =32 ; -unsigned int words; +unsigned long res =32 ; +unsigned long words;unsigned long num;if (!size)
@@ -376,8 +376,9 @@ static inline int find_first_zero_bit(const unsigned long *vaddr, }#define find_first_zero_bit find_first_zero_bit -static inline int find_next_zero_bit (const unsigned long *vaddr,int size, -int offset) +static inline unsigned long find_next_zero_bit (const unsigned long *vaddr, +unsigned long size, +unsigned long offset) {const unsigned long *p = vaddr + (offset >>5 );int bit = offset &31UL , res;
@@ -406,11 +407,12 @@ static inline int find_next_zero_bit(const unsigned long *vaddr, int size, }#define find_next_zero_bit find_next_zero_bit -static inline int find_first_bit (const unsigned long *vaddr,unsigned size) +static inline unsigned long find_first_bit (const unsigned long *vaddr, +unsigned long size) {const unsigned long *p = vaddr; -int res =32 ; -unsigned int words; +unsigned long res =32 ; +unsigned long words;unsigned long num;if (!size)
@@ -431,8 +433,9 @@ static inline int find_first_bit(const unsigned long *vaddr, unsigned size) }#define find_first_bit find_first_bit -static inline int find_next_bit (const unsigned long *vaddr,int size, -int offset) +static inline unsigned long find_next_bit (const unsigned long *vaddr, +unsigned long size, +unsigned long offset) {const unsigned long *p = vaddr + (offset >>5 );int bit = offset &31UL , res;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/184 powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 9316512b717f6f25c4649b3fdb0a905b6a318e9f ]
PAGE_KERNEL_TEXT is an old macro that is used to tell kernel whether kernel text has to be mapped read-only or read-write based on build time options.
But nowadays, with functionnalities like jump_labels, static links, etc ... more only less all kernels need to be read-write at some point, and some combinations of configs failed to work due to innacurate setting of PAGE_KERNEL_TEXT. On the other hand, today we have CONFIG_STRICT_KERNEL_RWX which implements a more controlled access to kernel modifications.
Instead of trying to keep PAGE_KERNEL_TEXT accurate with all possible options that may imply kernel text modification, always set kernel text read-write at startup and rely on CONFIG_STRICT_KERNEL_RWX to provide accurate protection.
Do this by passing PAGE_KERNEL_X to map_kernel_page() in __maping_ram_chunk() instead of passing PAGE_KERNEL_TEXT. Once this is done, the only remaining user of PAGE_KERNEL_TEXT is mmu_mark_initmem_nx() which uses it in a call to setibat(). As setibat() ignores the RW/RO, we can seamlessly replace PAGE_KERNEL_TEXT by PAGE_KERNEL_X here as well and get rid of PAGE_KERNEL_TEXT completely.
--- arch/powerpc/include/asm/pgtable.h | 12 ------------ arch/powerpc/mm/book3s32/mmu.c | 4 ++-- arch/powerpc/mm/pgtable_32.c | 2 +- 3 files changed, 3 insertions(+), 15 deletions(-)
arch/powerpc/include/asm/pgtable.h +0 -12
@@ -20,18 +20,6 @@ struct mm_struct;#include <asm/nohash/pgtable.h> #endif /* !CONFIG_PPC_BOOK3S */ -/* -* Protection used for kernel text. We want the debuggers to be able to -* set breakpoints anywhere, so don't write protect the kernel text -* on platforms where such control is possible. -*/ -#if defined(CONFIG_KGDB ) || defined(CONFIG_XMON ) || defined(CONFIG_BDI_SWITCH ) || \ - defined(CONFIG_KPROBES ) || defined(CONFIG_DYNAMIC_FTRACE ) -#define PAGE_KERNEL_TEXT PAGE_KERNEL_X -#else -#define PAGE_KERNEL_TEXT PAGE_KERNEL_ROX -#endif -/* Make modules code happy. We don't set RO yet */ #define PAGE_KERNEL_EXEC PAGE_KERNEL_X
arch/powerpc/mm/book3s32/mmu.c +2 -2
@@ -204,7 +204,7 @@ int mmu_mark_initmem_nx(void)for (i =0 ; i < nb -1 && base < top;) { size =bat_block_size (base, top); -setibat (i++,PAGE_OFFSET + base, base, size,PAGE_KERNEL_TEXT ); +setibat (i++,PAGE_OFFSET + base, base, size,PAGE_KERNEL_X ); base += size; }if (base < top) {
@@ -215,7 +215,7 @@ int mmu_mark_initmem_nx(void)pr_warn ("Some RW data is getting mapped X. " "Adjust CONFIG_DATA_SHIFT to avoid that.\n" ); } -setibat (i++,PAGE_OFFSET + base, base, size,PAGE_KERNEL_TEXT ); +setibat (i++,PAGE_OFFSET + base, base, size,PAGE_KERNEL_X ); base += size; }for (; i < nb; i++)
arch/powerpc/mm/pgtable_32.c +1 -1
@@ -104,7 +104,7 @@ static void __init __mapin_ram_chunk(unsigned long offset, unsigned long top) p = memstart_addr + s;for (; s < top; s +=PAGE_SIZE ) { ktext =core_kernel_text (v); -map_kernel_page (v, p, ktext ?PAGE_KERNEL_TEXT :PAGE_KERNEL ); +map_kernel_page (v, p, ktext ?PAGE_KERNEL_X :PAGE_KERNEL ); v +=PAGE_SIZE ; p +=PAGE_SIZE ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/184 riscv: mm: Return intended SATP mode for noXlvl options
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junhui Liu <[email protected]>
[ Upstream commit f3243bed39c26ce0f13e6392a634f91d409b2d02 ]
Change the return value of match_noXlvl() to return the SATP mode that will be used, rather than the mode being disabled. This enables unified logic for return value judgement with the function that obtains mmu-type from the fdt, avoiding extra conversion. This only changes the naming, with no functional impact.
--- arch/riscv/kernel/pi/cmdline_early.c | 4 ++-- arch/riscv/mm/init.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/riscv/kernel/pi/cmdline_early.c +2 -2
@@ -41,9 +41,9 @@ static char *get_early_cmdline(uintptr_t dtb_pa)static u64 match_noXlvl (char *cmdline) {if (strstr (cmdline,"no4lvl" )) -return SATP_MODE_48 ; +return SATP_MODE_39 ;else if (strstr (cmdline,"no5lvl" )) -return SATP_MODE_57 ; +return SATP_MODE_48 ;return 0 ; }
arch/riscv/mm/init.c +2 -2
@@ -864,9 +864,9 @@ static __init void set_satp_mode(uintptr_t dtb_pa) kernel_map.page_offset =PAGE_OFFSET_L5 ; -if (satp_mode_cmdline ==SATP_MODE_57 ) { +if (satp_mode_cmdline ==SATP_MODE_48 ) {disable_pgtable_l5 (); - }else if (satp_mode_cmdline ==SATP_MODE_48 ) { + }else if (satp_mode_cmdline ==SATP_MODE_39 ) {disable_pgtable_l5 ();disable_pgtable_l4 ();return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/184 riscv: mm: Use mmu-type from FDT to limit SATP mode
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junhui Liu <[email protected]>
[ Upstream commit 17e9521044c9b3ee839f861d1ac35c5b5c20d16b ]
Some RISC-V implementations may hang when attempting to write an unsupported SATP mode, even though the latest RISC-V specification states such writes should have no effect. To avoid this issue, the logic for selecting SATP mode has been refined:
The kernel now determines the SATP mode limit by taking the minimum of the value specified by the kernel command line (noXlvl) and the "mmu-type" property in the device tree (FDT). If only one is specified, use that.
- If the resulting limit is sv48 or higher, the kernel will probe SATP modes from this limit downward until a supported mode is found.
- If the limit is sv39, the kernel will directly use sv39 without probing.
This ensures SATP mode selection is safe and compatible with both hardware and user configuration, minimizing the risk of hangs.
--- arch/riscv/kernel/pi/fdt_early.c | 40 ++++++++++++++++++++++++++++++++ arch/riscv/kernel/pi/pi.h | 1 + arch/riscv/mm/init.c | 11 ++++++--- 3 files changed, 49 insertions(+), 3 deletions(-)
arch/riscv/kernel/pi/fdt_early.c +40 -0
@@ -3,6 +3,7 @@#include <linux/init.h> #include <linux/libfdt.h> #include <linux/ctype.h> +#include <asm/csr.h> #include "pi.h"
@@ -183,3 +184,42 @@ bool fdt_early_match_extension_isa(const void *fdt, const char *ext_name)return ret; } + +/** +* set_satp_mode_from_fdt - determine SATP mode based on the MMU type in fdt +* +* @dtb_pa: physical address of the device tree blob +* +* Returns the SATP mode corresponding to the MMU type of the first enabled CPU, +* 0 otherwise +*/ +u64 set_satp_mode_from_fdt (uintptr_t dtb_pa) +{ +const void *fdt = (const void *)dtb_pa; +const char *mmu_type; +int node, parent; + + parent =fdt_path_offset (fdt,"/cpus" ); +if (parent <0 ) +return 0 ; + +fdt_for_each_subnode (node, fdt, parent) { +if (!fdt_node_name_eq (fdt, node,"cpu" )) +continue ; + +if (!fdt_device_is_available (fdt, node)) +continue ; + + mmu_type =fdt_getprop (fdt, node,"mmu-type" ,NULL ); +if (!mmu_type) +break ; + +if (!strcmp (mmu_type,"riscv,sv39" )) +return SATP_MODE_39 ; +else if (!strcmp (mmu_type,"riscv,sv48" )) +return SATP_MODE_48 ; +break ; + } + +return 0 ; +}
arch/riscv/kernel/pi/pi.h +1 -0
@@ -14,6 +14,7 @@ u64 get_kaslr_seed(uintptr_t dtb_pa);u64 get_kaslr_seed_zkr (const uintptr_t dtb_pa);bool set_nokaslr_from_cmdline (uintptr_t dtb_pa);u64 set_satp_mode_from_cmdline (uintptr_t dtb_pa); +u64 set_satp_mode_from_fdt (uintptr_t dtb_pa);bool fdt_early_match_extension_isa (const void *fdt,const char *ext_name);
arch/riscv/mm/init.c +8 -3
@@ -816,6 +816,7 @@ static __meminit pgprot_t pgprot_from_va(uintptr_t va)#if defined(CONFIG_64BIT ) && !defined(CONFIG_XIP_KERNEL )u64 __pi_set_satp_mode_from_cmdline (uintptr_t dtb_pa); +u64 __pi_set_satp_mode_from_fdt (uintptr_t dtb_pa);static void __init disable_pgtable_l5 (void ) {
@@ -855,18 +856,22 @@ static void __init set_mmap_rnd_bits_max(void)* underlying hardware: establish 1:1 mapping in 4-level page table mode * then read SATP to see if the configuration was taken into account * meaning sv48 is supported. +* The maximum SATP mode is limited by both the command line and the "mmu-type" +* property in the device tree, since some platforms may hang if an unsupported +* SATP mode is attempted. */ static __init void set_satp_mode (uintptr_t dtb_pa) {u64 identity_satp, hw_satp;uintptr_t set_satp_mode_pmd = ((unsigned long )set_satp_mode) &PMD_MASK ; -u64 satp_mode_cmdline =__pi_set_satp_mode_from_cmdline (dtb_pa); +u64 satp_mode_limit =min_not_zero (__pi_set_satp_mode_from_cmdline (dtb_pa), +__pi_set_satp_mode_from_fdt (dtb_pa)); kernel_map.page_offset =PAGE_OFFSET_L5 ; -if (satp_mode_cmdline ==SATP_MODE_48 ) { +if (satp_mode_limit ==SATP_MODE_48 ) {disable_pgtable_l5 (); - }else if (satp_mode_cmdline ==SATP_MODE_39 ) { + }else if (satp_mode_limit ==SATP_MODE_39 ) {disable_pgtable_l5 ();disable_pgtable_l4 ();return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/184 riscv: cpufeature: add validation for zfa, zfh and zfhmin
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 2e2cf5581fccc562f7faf174ffb9866fed5cafbd ]
These extensions depends on the F one. Add a validation callback checking for the F extension to be present. Now that extensions are correctly reported using the F/D presence, we can remove the has_fpu() check in hwprobe_isa_ext0().
--- arch/riscv/kernel/cpufeature.c | 6 +++--- arch/riscv/kernel/sys_hwprobe.c | 14 ++++++-------- 2 files changed, 9 insertions(+), 11 deletions(-)
arch/riscv/kernel/cpufeature.c +3 -3
@@ -474,10 +474,10 @@ const struct riscv_isa_ext_data riscv_isa_ext[] = {__RISCV_ISA_EXT_DATA (zacas,RISCV_ISA_EXT_ZACAS ),__RISCV_ISA_EXT_DATA (zalrsc,RISCV_ISA_EXT_ZALRSC ),__RISCV_ISA_EXT_DATA (zawrs,RISCV_ISA_EXT_ZAWRS ), -__RISCV_ISA_EXT_DATA (zfa,RISCV_ISA_EXT_ZFA ), +__RISCV_ISA_EXT_DATA_VALIDATE (zfa,RISCV_ISA_EXT_ZFA , riscv_ext_f_depends),__RISCV_ISA_EXT_DATA_VALIDATE (zfbfmin,RISCV_ISA_EXT_ZFBFMIN , riscv_ext_f_depends), -__RISCV_ISA_EXT_DATA (zfh,RISCV_ISA_EXT_ZFH ), -__RISCV_ISA_EXT_DATA (zfhmin,RISCV_ISA_EXT_ZFHMIN ), +__RISCV_ISA_EXT_DATA_VALIDATE (zfh,RISCV_ISA_EXT_ZFH , riscv_ext_f_depends), +__RISCV_ISA_EXT_DATA_VALIDATE (zfhmin,RISCV_ISA_EXT_ZFHMIN , riscv_ext_f_depends),__RISCV_ISA_EXT_DATA (zca,RISCV_ISA_EXT_ZCA ),__RISCV_ISA_EXT_DATA_VALIDATE (zcb,RISCV_ISA_EXT_ZCB , riscv_ext_zca_depends), __RISCV_ISA_EXT_DATA_VALIDATE(zcd, RISCV_ISA_EXT_ZCD, riscv_ext_zcd_validate),
arch/riscv/kernel/sys_hwprobe.c +6 -8
@@ -153,14 +153,12 @@ static void hwprobe_isa_ext0(struct riscv_hwprobe *pair,EXT_KEY (ZVKT ); } -if (has_fpu ()) { -EXT_KEY (ZCD ); -EXT_KEY (ZCF ); -EXT_KEY (ZFA ); -EXT_KEY (ZFBFMIN ); -EXT_KEY (ZFH ); -EXT_KEY (ZFHMIN ); - } +EXT_KEY (ZCD ); +EXT_KEY (ZCF ); +EXT_KEY (ZFA ); +EXT_KEY (ZFBFMIN ); +EXT_KEY (ZFH ); +EXT_KEY (ZFHMIN );if (IS_ENABLED (CONFIG_RISCV_ISA_SUPM ))EXT_KEY (SUPM );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/184 drivers/perf: hisi: Relax the event ID check in the framework
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 43de0ac332b815cf56dbdce63687de9acfd35d49 ]
Event ID is only using the attr::config bit [7, 0] but we check the event range using the whole 64bit field. It blocks the usage of the rest field of attr::config. Relax the check by only using the bit [7, 0].
--- drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +- drivers/perf/hisilicon/hisi_uncore_pmu.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/perf/hisilicon/hisi_uncore_pmu.c +1 -1
@@ -234,7 +234,7 @@ int hisi_uncore_pmu_event_init(struct perf_event *event)return -EINVAL ; hisi_pmu =to_hisi_pmu (event->pmu); -if (event->attr.config > hisi_pmu->check_event) +if ((event->attr.config &HISI_EVENTID_MASK ) > hisi_pmu->check_event)return -EINVAL ;if (hisi_pmu->on_cpu ==-1 )
drivers/perf/hisilicon/hisi_uncore_pmu.h +2 -1
@@ -43,7 +43,8 @@return FIELD_GET (GENMASK_ULL (hi, lo), event->attr.config); \ } -#define HISI_GET_EVENTID (ev) (ev->hw.config_base & 0xff) +#define HISI_EVENTID_MASK GENMASK(7, 0) +#define HISI_GET_EVENTID (ev) ((ev)->hw.config_base & HISI_EVENTID_MASK)#define HISI_PMU_EVTYPE_BITS 8#define HISI_PMU_EVTYPE_SHIFT (idx) ((idx) % 4 * HISI_PMU_EVTYPE_BITS)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/184 s390/mm: Use __GFP_ACCOUNT for user page table allocations
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 5671ce2a1fc6b4a16cff962423bc416b92cac3c8 ]
Add missing kmemcg accounting of user page table allocations.
--- arch/s390/mm/pgalloc.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
arch/s390/mm/pgalloc.c +10 -3
@@ -16,9 +16,13 @@unsigned long *crst_table_alloc (struct mm_struct *mm) { -struct ptdesc *ptdesc =pagetable_alloc (GFP_KERNEL ,CRST_ALLOC_ORDER ); +gfp_t gfp =GFP_KERNEL_ACCOUNT ; +struct ptdesc *ptdesc;unsigned long *table; +if (mm == &init_mm) + gfp &= ~__GFP_ACCOUNT; + ptdesc =pagetable_alloc (gfp,CRST_ALLOC_ORDER );if (!ptdesc)return NULL ; table =ptdesc_to_virt (ptdesc);
@@ -117,7 +121,7 @@ struct ptdesc *page_table_alloc_pgste(struct mm_struct *mm)struct ptdesc *ptdesc;u64 *table; - ptdesc =pagetable_alloc (GFP_KERNEL ,0 ); + ptdesc =pagetable_alloc (GFP_KERNEL_ACCOUNT ,0 );if (ptdesc) { table = (u64 *)ptdesc_to_virt (ptdesc);__arch_set_page_dat (table,1 );
@@ -136,10 +140,13 @@ void page_table_free_pgste(struct ptdesc *ptdesc)unsigned long *page_table_alloc (struct mm_struct *mm) { +gfp_t gfp =GFP_KERNEL_ACCOUNT ;struct ptdesc *ptdesc;unsigned long *table; - ptdesc =pagetable_alloc (GFP_KERNEL ,0 ); +if (mm == &init_mm) + gfp &= ~__GFP_ACCOUNT; + ptdesc =pagetable_alloc (gfp,0 );if (!ptdesc)return NULL ;if (!pagetable_pte_ctor (mm, ptdesc)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/184 smb: client: queue post_recv_credits_work also if the peer raises the credit target
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
[ Upstream commit 02548c477a90481c1fd0d6e7c84b4504ec2fcc12 ]
This is already handled in the server, but currently it done in a very complex way there. So we do it much simpler.
Note that put_receive_buffer() will take care of it in case data_length is 0.
--- fs/smb/client/smbdirect.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/smb/client/smbdirect.c +5 -0
@@ -537,6 +537,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)struct smbdirect_socket_parameters *sp = &sc->parameters;struct smbd_connection *info = container_of(sc, struct smbd_connection, socket); +int old_recv_credit_target;u32 data_offset =0 ;u32 data_length =0 ;u32 remaining_data_length =0 ;
@@ -599,6 +600,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) }atomic_dec (&info->receive_credits); + old_recv_credit_target = info->receive_credit_target; info->receive_credit_target =le16_to_cpu (data_transfer->credits_requested);if (le16_to_cpu (data_transfer->credits_granted)) {
@@ -629,6 +631,9 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)* reassembly queue and wake up the reading thread */ if (data_length) { +if (info->receive_credit_target > old_recv_credit_target) +queue_work (info->workqueue, &info->post_send_credits_work); +enqueue_reassembly (info, response, data_length);wake_up_interruptible (&sc->recv_io.reassembly.wait_queue); }else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/184 smb: client: limit the range of info->receive_credit_target
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
[ Upstream commit 9219f8cac296769324bbe8a28c289586114244c4 ]
This simplifies further changes...
--- fs/smb/client/smbdirect.c | 7 ++++++- fs/smb/client/smbdirect.h | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-)
fs/smb/client/smbdirect.c +6 -1
@@ -429,6 +429,7 @@ static bool process_negotiation_response(return false; } info->receive_credit_target =le16_to_cpu (packet->credits_requested); + info->receive_credit_target =min_t (u16, info->receive_credit_target, sp->recv_credit_max);if (packet->credits_granted ==0 ) {log_rdma_event (ERR ,"error: credits_granted==0\n" );
@@ -537,7 +538,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)struct smbdirect_socket_parameters *sp = &sc->parameters;struct smbd_connection *info = container_of(sc, struct smbd_connection, socket); -int old_recv_credit_target; +u16 old_recv_credit_target;u32 data_offset =0 ;u32 data_length =0 ;u32 remaining_data_length =0 ;
@@ -603,6 +604,10 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) old_recv_credit_target = info->receive_credit_target; info->receive_credit_target =le16_to_cpu (data_transfer->credits_requested); + info->receive_credit_target = +min_t (u16, info->receive_credit_target, sp->recv_credit_max); + info->receive_credit_target = +max_t (u16, info->receive_credit_target,1 );if (le16_to_cpu (data_transfer->credits_granted)) {atomic_add (le16_to_cpu (data_transfer->credits_granted), &info->send_credits);
fs/smb/client/smbdirect.h +1 -1
@@ -63,7 +63,7 @@ struct smbd_connection {int protocol;atomic_t send_credits;atomic_t receive_credits; -int receive_credit_target; +u16 receive_credit_target;/* Memory registrations */ /* Maximum number of RDMA read/write outstanding on this connection */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/184 smb: client: make use of ib_wc_status_msg() and skip IB_WC_WR_FLUSH_ERR logging
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
[ Upstream commit a8e970358b31a5abba8b5737a67ba7b8d26f4258 ]
There's no need to get log message for every IB_WC_WR_FLUSH_ERR completion, but any other error should be logged at level ERR.
--- fs/smb/client/smbdirect.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
fs/smb/client/smbdirect.c +12 -8
@@ -362,8 +362,8 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)struct smbd_connection *info = container_of(sc, struct smbd_connection, socket); -log_rdma_send (INFO ,"smbdirect_send_io 0x%p completed wc->status=%d\n" , - request, wc->status); +log_rdma_send (INFO ,"smbdirect_send_io 0x%p completed wc->status=%s\n" , + request,ib_wc_status_msg (wc->status));for (i =0 ; i < request->num_sge; i++) ib_dma_unmap_single(sc->ib.dev,
@@ -372,8 +372,9 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc) DMA_TO_DEVICE);if (wc->status !=IB_WC_SUCCESS || wc->opcode !=IB_WC_SEND ) { -log_rdma_send (ERR ,"wc->status=%d wc->opcode=%d\n" , - wc->status, wc->opcode); +if (wc->status !=IB_WC_WR_FLUSH_ERR ) +log_rdma_send (ERR ,"wc->status=%s wc->opcode=%d\n" , +ib_wc_status_msg (wc->status), wc->opcode);mempool_free (request, sc->send_io.mem.pool);smbd_disconnect_rdma_connection (info);return ;
@@ -543,13 +544,16 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)u32 data_length =0 ;u32 remaining_data_length =0 ; -log_rdma_recv (INFO ,"response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n" , - response, sc->recv_io.expected, wc->status, wc->opcode, +log_rdma_recv (INFO , +"response=0x%p type=%d wc status=%s wc opcode %d byte_len=%d pkey_index=%u\n" , + response, sc->recv_io.expected, +ib_wc_status_msg (wc->status), wc->opcode, wc->byte_len, wc->pkey_index);if (wc->status !=IB_WC_SUCCESS || wc->opcode !=IB_WC_RECV ) { -log_rdma_recv (INFO ,"wc->status=%d opcode=%d\n" , - wc->status, wc->opcode); +if (wc->status !=IB_WC_WR_FLUSH_ERR ) +log_rdma_recv (ERR ,"wc->status=%s opcode=%d\n" , +ib_wc_status_msg (wc->status), wc->opcode); goto error; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/184 smb: server: let smb_direct_flush_send_list() invalidate a remote key first
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
[ Upstream commit 1b53426334c3c942db47e0959a2527a4f815af50 ]
If we want to invalidate a remote key we should do that as soon as possible, so do it in the first send work request.
--- fs/smb/server/transport_rdma.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/smb/server/transport_rdma.c +7 -4
@@ -939,12 +939,15 @@ static int smb_direct_flush_send_list(struct smb_direct_transport *t, struct smb_direct_sendmsg, list); +if (send_ctx->need_invalidate_rkey) { + first->wr.opcode =IB_WR_SEND_WITH_INV ; + first->wr.ex.invalidate_rkey = send_ctx->remote_key; + send_ctx->need_invalidate_rkey = false; + send_ctx->remote_key =0 ; + } + last->wr.send_flags =IB_SEND_SIGNALED ; last->wr.wr_cqe = &last->cqe; -if (is_last && send_ctx->need_invalidate_rkey) { - last->wr.opcode =IB_WR_SEND_WITH_INV ; - last->wr.ex.invalidate_rkey = send_ctx->remote_key; - } ret =smb_direct_post_send (t, &first->wr);if (!ret) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/184 Unbreak make tools/* for user-space targets
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit ee916dccd4df6e2fd19c3606c4735282b72f1473 ]
This pattern isn't very documented, and apparently not used much outside of 'make tools/help', but it has existed for over a decade (since commitea01fa9f63ae: "tools: Connect to the kernel build system").
However, it doesn't work very well for most cases, particularly the useful "tools/all" target, because it overrides the LDFLAGS value with an empty one.
And once overridden, 'make' will then not honor the tooling makefiles trying to change it - which then makes any LDFLAGS use in the tooling directory break, typically causing odd link errors.
Remove that LDFLAGS override, since it seems to be entirely historical. The core kernel makefiles no longer modify LDFLAGS as part of the build, and use kernel-specific link flags instead (eg 'KBUILD_LDFLAGS' and friends).
This allows more of the 'make tools/*' cases to work. I say 'more', because some of the tooling build rules make various other assumptions or have other issues, so it's still a bit hit-or-miss. But those issues tend to show up with the 'make -C tools xyz' pattern too, so now it's no longer an issue of this particular 'tools/*' build rule being special.
--- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Makefile +2 -2
@@ -1444,11 +1444,11 @@ endif tools/: FORCE $(Q)mkdir -p $(objtree)/tools - $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ + $(Q)$(MAKE) O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ tools/%: FORCE $(Q)mkdir -p $(objtree)/tools - $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* + $(Q)$(MAKE) O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* # --------------------------------------------------------------------------- # Kernel selftest
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/184 platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit a7b4747d8e0e7871c3d4971cded1dcc9af6af9e9 ]
The lock-related debug logic (CONFIG_LOCK_STAT) in the kernel is noting the following warning when the BlueField-3 SOC is booted:
BUG: key ffff00008a3402a8 has not been registered! ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 4 PID: 592 at kernel/locking/lockdep.c:4801 lockdep_init_map_type+0x1d4/0x2a0 <snip> Call trace: lockdep_init_map_type+0x1d4/0x2a0 __kernfs_create_file+0x84/0x140 sysfs_add_file_mode_ns+0xcc/0x1cc internal_create_group+0x110/0x3d4 internal_create_groups.part.0+0x54/0xcc sysfs_create_groups+0x24/0x40 device_add+0x6e8/0x93c device_register+0x28/0x40 __hwmon_device_register+0x4b0/0x8a0 devm_hwmon_device_register_with_groups+0x7c/0xe0 mlxbf_pmc_probe+0x1e8/0x3e0 [mlxbf_pmc] platform_probe+0x70/0x110
The mlxbf_pmc driver must call sysfs_attr_init() during the initialization of the "count_clock" data structure to avoid this warning.
--- drivers/platform/mellanox/mlxbf-pmc.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/mellanox/mlxbf-pmc.c +1 -0
@@ -2015,6 +2015,7 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, unsigned int blk_if (pmc->block[blk_num].type ==MLXBF_PMC_TYPE_CRSPACE ) {/* Program crspace counters to count clock cycles using "count_clock" sysfs */ attr = &pmc->block[blk_num].attr_count_clock; +sysfs_attr_init (&attr->dev_attr.attr); attr->dev_attr.attr.mode =0644 ; attr->dev_attr.show = mlxbf_pmc_count_clock_show; attr->dev_attr.store = mlxbf_pmc_count_clock_store;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/184 cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit 85d7dda5a9f665ea579741ec873a8841f37e8943 ]
After resuming from S4, all CPUs except the boot CPU have the wrong EPP hint programmed. This is because when the CPUs were offlined the EPP value was reset to 0.
This is a similar problem as fixed by
commit ba3319e590571 ("cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume") and the solution is also similar. When offlining rather than reset the values to zero, reset them to match those chosen by the policy. When the CPUs are onlined again these values will be restored.
--- drivers/cpufreq/amd-pstate.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/cpufreq/amd-pstate.c +5 -1
@@ -1614,7 +1614,11 @@ static int amd_pstate_cpu_offline(struct cpufreq_policy *policy)* min_perf value across kexec reboots. If this CPU is just onlined normally after this, the * limits, epp and desired perf will get reset to the cached values in cpudata struct */ -return amd_pstate_update_perf (policy, perf.bios_min_perf,0U ,0U ,0U , false); +return amd_pstate_update_perf (policy, perf.bios_min_perf, +FIELD_GET (AMD_CPPC_DES_PERF_MASK , cpudata->cppc_req_cached), +FIELD_GET (AMD_CPPC_MAX_PERF_MASK , cpudata->cppc_req_cached), +FIELD_GET (AMD_CPPC_EPP_PERF_MASK , cpudata->cppc_req_cached), + false); }static int amd_pstate_suspend (struct cpufreq_policy *policy)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/184 net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit aaf043a5688114703ae2c1482b92e7e0754d684e ]
When building with Clang 20 or newer, there are some objtool warnings from unexpected fallthroughs to other functions:
vmlinux.o: warning: objtool: mlx5e_mpwrq_mtts_per_wqe() falls through to next function mlx5e_mpwrq_max_num_entries() vmlinux.o: warning: objtool: mlx5e_mpwrq_max_log_rq_size() falls through to next function mlx5e_get_linear_rq_headroom()
LLVM 20 contains an (admittedly problematic [1]) optimization [2] to convert divide by zero into the equivalent of __builtin_unreachable(), which invokes undefined behavior and destroys code generation when it is encountered in a control flow graph.
mlx5e_mpwrq_umr_entry_size() returns 0 in the default case of an unrecognized mlx5e_mpwrq_umr_mode value. mlx5e_mpwrq_mtts_per_wqe(), which is inlined into mlx5e_mpwrq_max_log_rq_size(), uses the result of mlx5e_mpwrq_umr_entry_size() in a divide operation without checking for zero, so LLVM is able to infer there will be a divide by zero in this case and invokes undefined behavior. While there is some proposed work to isolate this undefined behavior and avoid the destructive code generation that results in these objtool warnings, code should still be defensive against divide by zero.
As the WARN_ONCE() implies that an invalid value should be handled gracefully, return 1 instead of 0 in the default case so that the results of this division operation is always valid.
--- drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/params.c +1 -1
@@ -99,7 +99,7 @@ u8 mlx5e_mpwrq_umr_entry_size(enum mlx5e_mpwrq_umr_mode mode)return sizeof (struct mlx5_ksm ) *4 ; }WARN_ONCE (1 ,"MPWRQ UMR mode %d is not known\n" , mode); -return 0 ; +return 1 ; } u8 mlx5e_mpwrq_log_wqe_sz(struct mlx5_core_dev *mdev, u8 page_shift,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/184 rtnetlink: Allow deleting FDB entries in user namespace
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Wiesböck <[email protected]>
[ Upstream commit bf29555f5bdc017bac22ca66fcb6c9f46ec8788f ]
Creating FDB entries is possible from a non-initial user namespace when having CAP_NET_ADMIN, yet, when deleting FDB entries, processes receive an EPERM because the capability is always checked against the initial user namespace. This restricts the FDB management from unprivileged containers.
Drop the netlink_capable check in rtnl_fdb_del as it was originally dropped in c5c351088ae7 and reintroduced in 1690be63a27b without intention.
This patch was tested using a container on GyroidOS, where it was possible to delete FDB entries from an unprivileged user namespace and private network namespace.
--- net/core/rtnetlink.c | 3 --- 1 file changed, 3 deletions(-)
net/core/rtnetlink.c +0 -3
@@ -4707,9 +4707,6 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,int err;u16 vid; -if (!netlink_capable (skb,CAP_NET_ADMIN )) -return -EPERM ; -if (!del_bulk) { err =nlmsg_parse_deprecated (nlh,sizeof (*ndm), tb,NDA_MAX ,NULL , extack);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/184 erofs: fix crafted invalid cases for encoded extents
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit a429b76114aaca3ef1aff4cd469dcf025431bd11 ]
Robert recently reported two corrupted images that can cause system crashes, which are related to the new encoded extents introduced in Linux 6.15:
- The first one [1] has plen != 0 (e.g. plen == 0x2000000) but
(plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent
special extents such as sparse extents (!EROFS_MAP_MAPPED), but
previously only plen == 0 was handled; - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000,
then "cur [0xfffffffffffff000] += bvec.bv_len [0x1000]" in
"} while ((cur += bvec.bv_len) < end);" wraps around, causing an
out-of-bound access of pcl->compressed_bvecs[] in
z_erofs_submit_queue(). EROFS only supports 48-bit physical block
addresses (up to 1EiB for 4k blocks), so add a sanity check to
enforce this.--- fs/erofs/zmap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/erofs/zmap.c +6 -1
@@ -596,7 +596,7 @@ static int z_erofs_map_blocks_ext(struct inode *inode, vi->z_fragmentoff = map->m_plen;if (recsz > offsetof(struct z_erofs_extent , pstart_lo)) vi->z_fragmentoff |= map->m_pa <<32 ; - }else if (map->m_plen) { + }else if (map->m_plen &Z_EROFS_EXTENT_PLEN_MASK ) { map->m_flags |=EROFS_MAP_MAPPED |EROFS_MAP_FULL_MAPPED |EROFS_MAP_ENCODED ; fmt = map->m_plen >>Z_EROFS_EXTENT_PLEN_FMT_BIT ;
@@ -715,6 +715,7 @@ static int z_erofs_map_sanity_check(struct inode *inode, struct erofs_map_blocks *map) {struct erofs_sb_info *sbi =EROFS_I_SB (inode); +u64 pend;if (!(map->m_flags &EROFS_MAP_ENCODED ))return 0 ;
@@ -732,6 +733,10 @@ static int z_erofs_map_sanity_check(struct inode *inode,if (unlikely (map->m_plen >Z_EROFS_PCLUSTER_MAX_SIZE || map->m_llen >Z_EROFS_PCLUSTER_MAX_DSIZE ))return -EOPNOTSUPP ; +/* Filesystems beyond 48-bit physical block addresses are invalid */ +if (unlikely (check_add_overflow (map->m_pa, map->m_plen, &pend) || + (pend >> sbi->blkszbits) >=BIT_ULL (48 ))) +return -EFSCORRUPTED ;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/184 net: enetc: fix the deadlock of enetc_mdio_lock
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianpeng Chang <[email protected]>
[ Upstream commit 50bd33f6b3922a6b760aa30d409cae891cec8fb5 ]
After applying the workaround for err050089, the LS1028A platform experiences RCU stalls on RT kernel. This issue is caused by the recursive acquisition of the read lock enetc_mdio_lock. Here list some of the call stacks identified under the enetc_poll path that may lead to a deadlock:
enetc_poll
-> enetc_lock_mdio
-> enetc_clean_rx_ring OR napi_complete_done
-> napi_gro_receive
-> enetc_start_xmit
-> enetc_lock_mdio
-> enetc_map_tx_buffs
-> enetc_unlock_mdio -> enetc_unlock_mdio
After enetc_poll acquires the read lock, a higher-priority writer attempts to acquire the lock, causing preemption. The writer detects that a read lock is already held and is scheduled out. However, readers under enetc_poll cannot acquire the read lock again because a writer is already waiting, leading to a thread hang.
Currently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent recursive lock acquisition.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 25 ++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +21 -4
@@ -1558,6 +1558,8 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring,/* next descriptor to process */ i = rx_ring->next_to_clean; +enetc_lock_mdio (); +while (likely (rx_frm_cnt < work_limit)) {union enetc_rx_bd *rxbd;struct sk_buff *skb;
@@ -1593,7 +1595,9 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, rx_byte_cnt += skb->len +ETH_HLEN ; rx_frm_cnt++; +enetc_unlock_mdio ();napi_gro_receive (napi, skb); +enetc_lock_mdio (); } rx_ring->next_to_clean = i;
@@ -1601,6 +1605,8 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, rx_ring->stats.packets += rx_frm_cnt; rx_ring->stats.bytes += rx_byte_cnt; +enetc_unlock_mdio (); +return rx_frm_cnt; }
@@ -1910,6 +1916,8 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,/* next descriptor to process */ i = rx_ring->next_to_clean; +enetc_lock_mdio (); +while (likely (rx_frm_cnt < work_limit)) {union enetc_rx_bd *rxbd, *orig_rxbd;struct xdp_buff xdp_buff;
@@ -1973,7 +1981,9 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,*/ enetc_bulk_flip_buff (rx_ring, orig_i, i); +enetc_unlock_mdio ();napi_gro_receive (napi, skb); +enetc_lock_mdio ();break ;case XDP_TX : tx_ring = priv->xdp_tx_ring[rx_ring->index];
@@ -2008,7 +2018,9 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, }break ;case XDP_REDIRECT : +enetc_unlock_mdio (); err =xdp_do_redirect (rx_ring->ndev, &xdp_buff, prog); +enetc_lock_mdio ();if (unlikely (err)) {enetc_xdp_drop (rx_ring, orig_i, i); rx_ring->stats.xdp_redirect_failures++;
@@ -2028,8 +2040,11 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, rx_ring->stats.packets += rx_frm_cnt; rx_ring->stats.bytes += rx_byte_cnt; -if (xdp_redirect_frm_cnt) +if (xdp_redirect_frm_cnt) { +enetc_unlock_mdio ();xdp_do_flush (); +enetc_lock_mdio (); + }if (xdp_tx_frm_cnt)enetc_update_tx_ring_tail (tx_ring);
@@ -2038,6 +2053,8 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,enetc_refill_rx_ring (rx_ring,enetc_bd_unused (rx_ring) - rx_ring->xdp.xdp_tx_in_flight); +enetc_unlock_mdio (); +return rx_frm_cnt; }
@@ -2056,6 +2073,7 @@ static int enetc_poll(struct napi_struct *napi, int budget)for (i =0 ; i < v->count_tx_rings; i++)if (!enetc_clean_tx_ring (&v->tx_ring[i], budget)) complete = false; +enetc_unlock_mdio (); prog = rx_ring->xdp.prog;if (prog)
@@ -2067,10 +2085,8 @@ static int enetc_poll(struct napi_struct *napi, int budget)if (work_done) v->rx_napi_work = true; -if (!complete) { -enetc_unlock_mdio (); +if (!complete)return budget; - }napi_complete_done (napi, work_done);
@@ -2079,6 +2095,7 @@ static int enetc_poll(struct napi_struct *napi, int budget) v->rx_napi_work = false; +enetc_lock_mdio ();/* enable interrupts */ enetc_wr_reg_hot (v->rbier,ENETC_RBIER_RXTIE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/184 net: enetc: correct the value of ENETC_RXB_TRUESIZE
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit e59bc32df2e989f034623a580e30a2a72af33b3f ]
The ENETC RX ring uses the page halves flipping mechanism, each page is split into two halves for the RX ring to use. And ENETC_RXB_TRUESIZE is defined to 2048 to indicate the size of half a page. However, the page size is configurable, for ARM64 platform, PAGE_SIZE is default to 4K, but it could be configured to 16K or 64K.
When PAGE_SIZE is set to 16K or 64K, ENETC_RXB_TRUESIZE is not correct, and the RX ring will always use the first half of the page. This is not consistent with the description in the relevant kernel doc and commit messages.
This issue is invisible in most cases, but if users want to increase PAGE_SIZE to receive a Jumbo frame with a single buffer for some use cases, it will not work as expected, because the buffer size of each RX BD is fixed to 2048 bytes.
Based on the above two points, we expect to correct ENETC_RXB_TRUESIZE to (PAGE_SIZE >> 1), as described in the comment.
--- drivers/net/ethernet/freescale/enetc/enetc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/enetc/enetc.h +1 -1
@@ -67,7 +67,7 @@ struct enetc_lso_t {#define ENETC_LSO_MAX_DATA_LEN SZ_256K#define ENETC_RX_MAXFRM_SIZE ENETC_MAC_MAXFRM_SIZE -#define ENETC_RXB_TRUESIZE 2048/* PAGE_SIZE >> 1 */ +#define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)#define ENETC_RXB_PAD NET_SKB_PAD/* add extra space if needed */ #define ENETC_RXB_DMA_SIZE \ (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/184 dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <[email protected]>
[ Upstream commit 902e81e679d86846a2404630d349709ad9372d0d ]
The blamed commit increased the needed headroom to account for alignment. This means that the size required to always align a Tx buffer was added inside the dpaa2_eth_needed_headroom() function. By doing that, a manual adjustment of the pointer passed to PTR_ALIGN() was no longer correct since the 'buffer_start' variable was already pointing to the start of the skb's memory.
The behavior of the dpaa2-eth driver without this patch was to drop frames on Tx even when the headroom was matching the 128 bytes necessary. Fix this by removing the manual adjust of 'buffer_start' from the PTR_MODE call.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +1 -2
@@ -1077,8 +1077,7 @@ static int dpaa2_eth_build_single_fd(struct dpaa2_eth_priv *priv,dma_addr_t addr; buffer_start = skb->data -dpaa2_eth_needed_headroom (skb); - aligned_start =PTR_ALIGN (buffer_start -DPAA2_ETH_TX_BUF_ALIGN , -DPAA2_ETH_TX_BUF_ALIGN ); + aligned_start =PTR_ALIGN (buffer_start,DPAA2_ETH_TX_BUF_ALIGN );if (aligned_start >= skb->head) buffer_start = aligned_start;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/184 net: phy: realtek: fix rtl8221b-vm-cg name
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit ffff5c8fc2af2218a3332b3d5b97654599d50cde ]
When splitting the RTL8221B-VM-CG into C22 and C45 variants, the name was accidentally changed to RTL8221B-VN-CG. This patch brings back the previous part number.
--- drivers/net/phy/realtek/realtek_main.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/phy/realtek/realtek_main.c +8 -8
@@ -156,7 +156,7 @@#define RTL_8211FVD_PHYID 0x001cc878#define RTL_8221B 0x001cc840#define RTL_8221B_VB_CG 0x001cc849 -#define RTL_8221B_VN_CG 0x001cc84a +#define RTL_8221B_VM_CG 0x001cc84a#define RTL_8251B 0x001cc862#define RTL_8261C 0x001cc890
@@ -1362,16 +1362,16 @@ static int rtl8221b_vb_cg_c45_match_phy_device(struct phy_device *phydev,return rtlgen_is_c45_match (phydev,RTL_8221B_VB_CG , true); } -static int rtl8221b_vn_cg_c22_match_phy_device (struct phy_device *phydev, +static int rtl8221b_vm_cg_c22_match_phy_device (struct phy_device *phydev,const struct phy_driver *phydrv) { -return rtlgen_is_c45_match (phydev,RTL_8221B_VN_CG , false); +return rtlgen_is_c45_match (phydev,RTL_8221B_VM_CG , false); } -static int rtl8221b_vn_cg_c45_match_phy_device (struct phy_device *phydev, +static int rtl8221b_vm_cg_c45_match_phy_device (struct phy_device *phydev,const struct phy_driver *phydrv) { -return rtlgen_is_c45_match (phydev,RTL_8221B_VN_CG , true); +return rtlgen_is_c45_match (phydev,RTL_8221B_VM_CG , true); } static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev,
@@ -1718,7 +1718,7 @@ static struct phy_driver realtek_drvs[] = { .suspend = genphy_c45_pma_suspend, .resume = rtlgen_c45_resume, }, { - .match_phy_device = rtl8221b_vn_cg_c22_match_phy_device, + .match_phy_device = rtl8221b_vm_cg_c22_match_phy_device, .name = "RTL8221B-VM-CG 2.5Gbps PHY (C22)", .probe = rtl822x_probe, .get_features = rtl822x_get_features,
@@ -1731,8 +1731,8 @@ static struct phy_driver realtek_drvs[] = { .read_page = rtl821x_read_page, .write_page = rtl821x_write_page, }, { - .match_phy_device = rtl8221b_vn_cg_c45_match_phy_device, - .name = "RTL8221B-VN-CG 2.5Gbps PHY (C45)", + .match_phy_device = rtl8221b_vm_cg_c45_match_phy_device, + .name = "RTL8221B-VM-CG 2.5Gbps PHY (C45)", .probe = rtl822x_probe, .config_init = rtl822xb_config_init, .get_rate_matching = rtl822xb_get_rate_matching,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/184 can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 3a20c444cd123e820e10ae22eeaf00e189315aa1 ]
In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly.
Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode.
--- drivers/net/can/bxcan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/bxcan.c +1 -1
@@ -842,7 +842,7 @@ static netdev_tx_t bxcan_start_xmit(struct sk_buff *skb,u32 id;int i, j; -if (can_dropped_invalid_skb (ndev, skb)) +if (can_dev_dropped_skb (ndev, skb))return NETDEV_TX_OK ;if (bxcan_tx_busy (priv))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/184 can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 0bee15a5caf36fe513fdeee07fd4f0331e61c064 ]
In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly.
Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode.
--- drivers/net/can/esd/esdacc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/esd/esdacc.c +1 -1
@@ -254,7 +254,7 @@ netdev_tx_t acc_start_xmit(struct sk_buff *skb, struct net_device *netdev)u32 acc_id;u32 acc_dlc; -if (can_dropped_invalid_skb (netdev, skb)) +if (can_dev_dropped_skb (netdev, skb))return NETDEV_TX_OK ;/* Access core->tx_fifo_tail only once because it may be changed
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/184 can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 3a3bc9bbb3a0287164a595787df0c70d91e77cfd ]
In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly.
Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode.
--- drivers/net/can/rockchip/rockchip_canfd-tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/rockchip/rockchip_canfd-tx.c +1 -1
@@ -72,7 +72,7 @@ netdev_tx_t rkcanfd_start_xmit(struct sk_buff *skb, struct net_device *ndev)int err;u8 i; -if (can_dropped_invalid_skb (ndev, skb)) +if (can_dev_dropped_skb (ndev, skb))return NETDEV_TX_OK ; if (!netif_subqueue_maybe_stop(priv->ndev, 0,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/184 selftests: net: fix server bind failure in sctp_vrf.sh
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit a73ca0449bcb7c238097cc6a1bf3fd82a78374df ]
sctp_vrf.sh could fail:
TEST 12: bind vrf-2 & 1 in server, connect from client 1 & 2, N [FAIL] not ok 1 selftests: net: sctp_vrf.sh # exit=3
The failure happens when the server bind in a new run conflicts with an existing association from the previous run:
[1] ip netns exec $SERVER_NS ./sctp_hello server ...
[2] ip netns exec $CLIENT_NS ./sctp_hello client ...
[3] ip netns exec $SERVER_NS pkill sctp_hello ...
[4] ip netns exec $SERVER_NS ./sctp_hello server ...
It occurs if the client in [2] sends a message and closes immediately. With the message unacked, no SHUTDOWN is sent. Killing the server in [3] triggers a SHUTDOWN the client also ignores due to the unacked message, leaving the old association alive. This causes the bind at [4] to fail until the message is acked and the client responds to a second SHUTDOWN after the server’s T2 timer expires (3s).
This patch fixes the issue by preventing the client from sending data. Instead, the client blocks on recv() and waits for the server to close. It also waits until both the server and the client sockets are fully released in stop_server and wait_client before restarting.
Additionally, replace 2>&1 >/dev/null with -q in sysctl and grep, and drop other redundant 2>&1 >/dev/null redirections, and fix a typo from N to Y (connect successfully) in the description of the last test.
--- tools/testing/selftests/net/sctp_hello.c | 17 +----- tools/testing/selftests/net/sctp_vrf.sh | 73 +++++++++++++++--------- 2 files changed, 47 insertions(+), 43 deletions(-)
tools/testing/selftests/net/sctp_hello.c +2 -15
@@ -29,7 +29,6 @@ static void set_addr(struct sockaddr_storage *ss, char *ip, char *port, int *lenstatic int do_client (int argc,char *argv[]) {struct sockaddr_storage ss; -char buf[] ="hello" ;int csk, ret, len;if (argc <5 ) {
@@ -56,16 +55,10 @@ static int do_client(int argc, char *argv[])set_addr (&ss, argv[3 ], argv[4 ], &len); ret =connect (csk, (struct sockaddr *)&ss, len); -if (ret <0 ) { -printf ("failed to connect to peer\n" ); +if (ret <0 )return -1 ; - } - ret =send (csk, buf,strlen (buf) +1 ,0 ); -if (ret <0 ) { -printf ("failed to send msg %d\n" , ret); -return -1 ; - } +recv (csk,NULL ,0 ,0 );close (csk);return 0 ;
@@ -75,7 +68,6 @@ int main(int argc, char *argv[]) {struct sockaddr_storage ss;int lsk, csk, ret, len; -char buf[20 ];if (argc <2 || (strcmp (argv[1 ],"server" ) &&strcmp (argv[1 ],"client" ))) {printf ("%s server|client ...\n" , argv[0 ]);
@@ -125,11 +117,6 @@ int main(int argc, char *argv[])return -1 ; } - ret =recv (csk, buf,sizeof (buf),0 ); -if (ret <=0 ) { -printf ("failed to recv msg %d\n" , ret); -return -1 ; - }close (csk);close (lsk);
tools/testing/selftests/net/sctp_vrf.sh +45 -28
124 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/184 net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <[email protected]>
[ Upstream commit afd5ba577c10639f62e8120df67dc70ea4b61176 ]
XDP programs can release xdp_buff fragments when calling bpf_xdp_adjust_tail(). The driver currently assumes the number of fragments to be unchanged and may generate skb with wrong truesize or containing invalid frags. Fix the bug by generating skb according to xdp_buff after the XDP program runs.
--- .../net/ethernet/mellanox/mlx5/core/en_rx.c | 25 ++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +19 -6
@@ -1773,14 +1773,27 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi } prog =rcu_dereference (rq->xdp_prog); -if (prog &&mlx5e_xdp_handle (rq, prog, mxbuf)) { -if (__test_and_clear_bit (MLX5E_RQ_FLAG_XDP_XMIT , rq->flags)) { -struct mlx5e_wqe_frag_info *pwi; +if (prog) { +u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; + +if (mlx5e_xdp_handle (rq, prog, mxbuf)) { +if (__test_and_clear_bit (MLX5E_RQ_FLAG_XDP_XMIT , + rq->flags)) { +struct mlx5e_wqe_frag_info *pwi; + + wi -= old_nr_frags - sinfo->nr_frags; + +for (pwi = head_wi; pwi < wi; pwi++) + pwi->frag_page->frags++; + } +return NULL ;/* page/packet was consumed by XDP */ + } -for (pwi = head_wi; pwi < wi; pwi++) - pwi->frag_page->frags++; + nr_frags_free = old_nr_frags - sinfo->nr_frags; +if (unlikely (nr_frags_free)) { + wi -= nr_frags_free; + truesize -= nr_frags_free * frag_info->frag_stride; } -return NULL ;/* page/packet was consumed by XDP */ } skb = mlx5e_build_linear_skb(
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/184 net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <[email protected]>
[ Upstream commit 87bcef158ac1faca1bd7e0104588e8e2956d10be ]
XDP programs can change the layout of an xdp_buff through bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver cannot assume the size of the linear data area nor fragments. Fix the bug in mlx5 by generating skb according to xdp_buff after XDP programs run.
Currently, when handling multi-buf XDP, the mlx5 driver assumes the layout of an xdp_buff to be unchanged. That is, the linear data area continues to be empty and fragments remain the same. This may cause the driver to generate erroneous skb or triggering a kernel warning. When an XDP program added linear data through bpf_xdp_adjust_head(), the linear data will be ignored as mlx5e_build_linear_skb() builds an skb without linear data and then pull data from fragments to fill the linear data area. When an XDP program has shrunk the non-linear data through bpf_xdp_adjust_tail(), the delta passed to __pskb_pull_tail() may exceed the actual nonlinear data size and trigger the BUG_ON in it.
To fix the issue, first record the original number of fragments. If the number of fragments changes after the XDP program runs, rewind the end fragment pointer by the difference and recalculate the truesize. Then, build the skb with the linear data area matching the xdp_buff. Finally, only pull data in if there is non-linear data and fill the linear part up to 256 bytes.
--- .../net/ethernet/mellanox/mlx5/core/en_rx.c | 26 ++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +23 -3
@@ -2017,6 +2017,7 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wu32 byte_cnt = cqe_bcnt;struct skb_shared_info *sinfo;unsigned int truesize =0 ; +u32 pg_consumed_bytes;struct bpf_prog *prog;struct sk_buff *skb;u32 linear_frame_sz;
@@ -2070,7 +2071,8 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wwhile (byte_cnt) {/* Non-linear mode, hence non-XSK, which always uses PAGE_SIZE. */ -u32 pg_consumed_bytes =min_t (u32,PAGE_SIZE - frag_offset, byte_cnt); + pg_consumed_bytes = +min_t (u32,PAGE_SIZE - frag_offset, byte_cnt);if (test_bit (MLX5E_RQ_STATE_SHAMPO , &rq->state)) truesize += pg_consumed_bytes;
@@ -2086,10 +2088,15 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w }if (prog) { +u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; +u32 len; +if (mlx5e_xdp_handle (rq, prog, mxbuf)) {if (__test_and_clear_bit (MLX5E_RQ_FLAG_XDP_XMIT , rq->flags)) {struct mlx5e_frag_page *pfp; + frag_page -= old_nr_frags - sinfo->nr_frags; +for (pfp = head_page; pfp < frag_page; pfp++) pfp->frags++;
@@ -2100,9 +2107,19 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wreturn NULL ;/* page/packet was consumed by XDP */ } + nr_frags_free = old_nr_frags - sinfo->nr_frags; +if (unlikely (nr_frags_free)) { + frag_page -= nr_frags_free; + truesize -= (nr_frags_free -1 ) *PAGE_SIZE + +ALIGN (pg_consumed_bytes, +BIT (rq->mpwqe.log_stride_sz)); + } + + len = mxbuf->xdp.data_end - mxbuf->xdp.data; + skb =mlx5e_build_linear_skb ( rq, mxbuf->xdp.data_hard_start, linear_frame_sz, - mxbuf->xdp.data - mxbuf->xdp.data_hard_start,0 , + mxbuf->xdp.data - mxbuf->xdp.data_hard_start, len, mxbuf->xdp.data - mxbuf->xdp.data_meta);if (unlikely (!skb)) { mlx5e_page_release_fragmented(rq->page_pool,
@@ -2127,8 +2144,11 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wdo pagep->frags++;while (++pagep < frag_page); + + headlen =min_t (u16,MLX5E_RX_MAX_HEAD - len, + skb->data_len); +__pskb_pull_tail (skb, headlen); } -__pskb_pull_tail (skb, headlen); }else {dma_addr_t addr;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/184 net/smc: fix general protection fault in __smc_diag_dump
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit f584239a9ed25057496bf397c370cc5163dde419 ]
The syzbot report a crash:
Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a0000003: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead4ead00000018-0xdead4ead0000001f] CPU: 1 UID: 0 PID: 6949 Comm: syz.0.335 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump.constprop.0+0x3ca/0x2550 net/smc/smc_diag.c:89 Call Trace: <TASK> smc_diag_dump_proto+0x26d/0x420 net/smc/smc_diag.c:217 smc_diag_dump+0x27/0x90 net/smc/smc_diag.c:234 netlink_dump+0x539/0xd30 net/netlink/af_netlink.c:2327 __netlink_dump_start+0x6d6/0x990 net/netlink/af_netlink.c:2442 netlink_dump_start include/linux/netlink.h:341 [inline] smc_diag_handler_dump+0x1f9/0x240 net/smc/smc_diag.c:251 __sock_diag_cmd net/core/sock_diag.c:249 [inline] sock_diag_rcv_msg+0x438/0x790 net/core/sock_diag.c:285 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5a7/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg net/socket.c:729 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668 __sys_sendmsg+0x16d/0x220 net/socket.c:2700 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
The process like this:
(CPU1) | (CPU2)
---------------------------------|-------------------------------
inet_create() |
// init clcsock to NULL |
sk = sk_alloc() |
|
// unexpectedly change clcsock |
inet_init_csk_locks() |
|
// add sk to hash table |
smc_inet_init_sock() |
smc_sk_init() |
smc_hash_sk() |
| // traverse the hash table
| smc_diag_dump_proto
| __smc_diag_dump()
| // visit wrong clcsock
| smc_diag_msg_common_fill()
// alloc clcsock |
smc_create_clcsk |
sock_create_kern |With CONFIG_DEBUG_LOCK_ALLOC=y, the smc->clcsock is unexpectedly changed in inet_init_csk_locks(). The INET_PROTOSW_ICSK flag is no need by smc, just remove it.
After removing the INET_PROTOSW_ICSK flag, this patch alse revert commit 6fd27ea183c2 ("net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC") to avoid casting smc_sock to inet_connection_sock.
--- net/smc/smc_inet.c | 13 ------------- 1 file changed, 13 deletions(-)
net/smc/smc_inet.c +0 -13
@@ -56,7 +56,6 @@ static struct inet_protosw smc_inet_protosw = { .protocol = IPPROTO_SMC, .prot = &smc_inet_prot, .ops = &smc_inet_stream_ops, - .flags = INET_PROTOSW_ICSK, };#if IS_ENABLED (CONFIG_IPV6 )
@@ -104,27 +103,15 @@ static struct inet_protosw smc_inet6_protosw = { .protocol = IPPROTO_SMC, .prot = &smc_inet6_prot, .ops = &smc_inet6_stream_ops, - .flags = INET_PROTOSW_ICSK, };#endif /* CONFIG_IPV6 */ -static unsigned int smc_sync_mss (struct sock *sk,u32 pmtu) -{ -/* No need pass it through to clcsock, mss can always be set by -* sock_create_kern or smc_setsockopt. -*/ -return 0 ; -} -static int smc_inet_init_sock (struct sock *sk) {struct net *net =sock_net (sk);/* init common smc sock */ smc_sk_init (net, sk,IPPROTO_SMC ); - -inet_csk (sk)->icsk_sync_mss = smc_sync_mss; -/* create clcsock */ return smc_create_clcsk (net, sk, sk->sk_family); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/184 net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aksh Garg <[email protected]>
[ Upstream commit 49d34f3dd8519581030547eb7543a62f9ab5fa08 ]
Resolve race conditions in timestamp events list handling between TX and RX paths causing missed timestamps.
The current implementation uses a single events list for both TX and RX timestamps. The am65_cpts_find_ts() function acquires the lock, splices all events (TX as well as RX events) to a temporary list, and releases the lock. This function performs matching of timestamps for TX packets only. Before it acquires the lock again to put the non-TX events back to the main events list, a concurrent RX processing thread could acquire the lock (as observed in practice), find an empty events list, and fail to attach timestamp to it, even though a relevant event exists in the spliced list which is yet to be restored to the main list.
Fix this by creating separate events lists to handle TX and RX timestamps independently.
--- drivers/net/ethernet/ti/am65-cpts.c | 63 ++++++++++++++++++++--------- 1 file changed, 43 insertions(+), 20 deletions(-)
drivers/net/ethernet/ti/am65-cpts.c +43 -20
@@ -163,7 +163,9 @@ struct am65_cpts {struct device_node *clk_mux_np;struct clk *refclk;u32 refclk_freq; -struct list_head events; +/* separate lists to handle TX and RX timestamp independently */ +struct list_head events_tx; +struct list_head events_rx;struct list_head pool;struct am65_cpts_event pool_data[AM65_CPTS_MAX_EVENTS ];spinlock_t lock;/* protects events lists*/
@@ -227,6 +229,24 @@ static void am65_cpts_disable(struct am65_cpts *cpts)am65_cpts_write32 (cpts,0 , int_enable); } +static int am65_cpts_purge_event_list (struct am65_cpts *cpts, +struct list_head *events) +{ +struct list_head *this, *next; +struct am65_cpts_event *event; +int removed =0 ; + +list_for_each_safe (this, next, events) { + event = list_entry(this, struct am65_cpts_event, list); +if (time_after (jiffies, event->tmo)) { +list_del_init (&event->list); +list_add (&event->list, &cpts->pool); + ++removed; + } + } +return removed; +} +static int am65_cpts_event_get_port (struct am65_cpts_event *event) { return (event->event1 & AM65_CPTS_EVENT_1_PORT_NUMBER_MASK) >>
@@ -239,20 +259,12 @@ static int am65_cpts_event_get_type(struct am65_cpts_event *event)AM65_CPTS_EVENT_1_EVENT_TYPE_SHIFT ; } -static int am65_cpts_cpts_purge_events (struct am65_cpts *cpts) +static int am65_cpts_purge_events (struct am65_cpts *cpts) { -struct list_head *this, *next; -struct am65_cpts_event *event;int removed =0 ; -list_for_each_safe (this, next, &cpts->events) { - event = list_entry(this, struct am65_cpts_event, list); -if (time_after (jiffies, event->tmo)) { -list_del_init (&event->list); -list_add (&event->list, &cpts->pool); - ++removed; - } - } + removed +=am65_cpts_purge_event_list (cpts, &cpts->events_tx); + removed +=am65_cpts_purge_event_list (cpts, &cpts->events_rx);if (removed)dev_dbg (cpts->dev,"event pool cleaned up %d\n" , removed);
@@ -287,7 +299,7 @@ static int __am65_cpts_fifo_read(struct am65_cpts *cpts) struct am65_cpts_event, list);if (!event) { -if (am65_cpts_cpts_purge_events (cpts)) { +if (am65_cpts_purge_events (cpts)) {dev_err (cpts->dev,"cpts: event pool empty\n" ); ret =-1 ; goto out;
@@ -306,11 +318,21 @@ static int __am65_cpts_fifo_read(struct am65_cpts *cpts) cpts->timestamp);break ;case AM65_CPTS_EV_RX : + event->tmo = jiffies + +msecs_to_jiffies (AM65_CPTS_EVENT_RX_TX_TIMEOUT ); + +list_move_tail (&event->list, &cpts->events_rx); + +dev_dbg (cpts->dev, +"AM65_CPTS_EV_RX e1:%08x e2:%08x t:%lld\n" , + event->event1, event->event2, + event->timestamp); +break ;case AM65_CPTS_EV_TX : event->tmo = jiffies +msecs_to_jiffies (AM65_CPTS_EVENT_RX_TX_TIMEOUT ); -list_move_tail (&event->list, &cpts->events); +list_move_tail (&event->list, &cpts->events_tx); dev_dbg(cpts->dev, "AM65_CPTS_EV_TX e1:%08x e2:%08x t:%lld\n",
@@ -828,7 +850,7 @@ static bool am65_cpts_match_tx_ts(struct am65_cpts *cpts,return found; } -static void am65_cpts_find_ts (struct am65_cpts *cpts) +static void am65_cpts_find_tx_ts (struct am65_cpts *cpts) {struct am65_cpts_event *event;struct list_head *this, *next;
@@ -837,7 +859,7 @@ static void am65_cpts_find_ts(struct am65_cpts *cpts)LIST_HEAD (events);spin_lock_irqsave (&cpts->lock, flags); -list_splice_init (&cpts->events, &events); +list_splice_init (&cpts->events_tx, &events);spin_unlock_irqrestore (&cpts->lock, flags);list_for_each_safe (this, next, &events) {
@@ -850,7 +872,7 @@ static void am65_cpts_find_ts(struct am65_cpts *cpts) }spin_lock_irqsave (&cpts->lock, flags); -list_splice_tail (&events, &cpts->events); +list_splice_tail (&events, &cpts->events_tx);list_splice_tail (&events_free, &cpts->pool);spin_unlock_irqrestore (&cpts->lock, flags); }
@@ -861,7 +883,7 @@ static long am65_cpts_ts_work(struct ptp_clock_info *ptp)unsigned long flags;long delay =-1 ; -am65_cpts_find_ts (cpts); +am65_cpts_find_tx_ts (cpts);spin_lock_irqsave (&cpts->txq.lock, flags);if (!skb_queue_empty (&cpts->txq))
@@ -905,7 +927,7 @@ static u64 am65_cpts_find_rx_ts(struct am65_cpts *cpts, u32 skb_mtype_seqid)spin_lock_irqsave (&cpts->lock, flags);__am65_cpts_fifo_read (cpts); -list_for_each_safe (this, next, &cpts->events) { +list_for_each_safe (this, next, &cpts->events_rx) { event = list_entry(this, struct am65_cpts_event, list);if (time_after (jiffies, event->tmo)) {list_move (&event->list, &cpts->pool);
@@ -1155,7 +1177,8 @@ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs,return ERR_PTR (ret);mutex_init (&cpts->ptp_clk_lock); -INIT_LIST_HEAD (&cpts->events); +INIT_LIST_HEAD (&cpts->events_tx); +INIT_LIST_HEAD (&cpts->events_rx);INIT_LIST_HEAD (&cpts->pool);spin_lock_init (&cpts->lock);skb_queue_head_init (&cpts->txq);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/184 arm64, mm: avoid always making PTE dirty in pte_mkwrite()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Ying <[email protected]>
[ Upstream commit 143937ca51cc6ae2fccc61a1cb916abb24cd34f5 ]
Current pte_mkwrite_novma() makes PTE dirty unconditionally. This may mark some pages that are never written dirty wrongly. For example, do_swap_page() may map the exclusive pages with writable and clean PTEs if the VMA is writable and the page fault is for read access. However, current pte_mkwrite_novma() implementation always dirties the PTE. This may cause unnecessary disk writing if the pages are never written before being reclaimed.
So, change pte_mkwrite_novma() to clear the PTE_RDONLY bit only if the PTE_DIRTY bit is set to make it possible to make the PTE writable and clean.
The current behavior was introduced in commit 73e86cb03cf2 ("arm64:
Move PTE_RDONLY bit handling out of set_pte_at()"). Before that, pte_mkwrite() only sets the PTE_WRITE bit, while set_pte_at() only clears the PTE_RDONLY bit if both the PTE_WRITE and the PTE_DIRTY bits are set.
To test the performance impact of the patch, on an arm64 server machine, run 16 redis-server processes on socket 1 and 16 memtier_benchmark processes on socket 0 with mostly get transactions (that is, redis-server will mostly read memory only). The memory footprint of redis-server is larger than the available memory, so swap out/in will be triggered. Test results show that the patch can avoid most swapping out because the pages are mostly clean. And the benchmark throughput improves ~23.9% in the test.
--- arch/arm64/include/asm/pgtable.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/pgtable.h +2 -1
@@ -293,7 +293,8 @@ static inline pmd_t set_pmd_bit(pmd_t pmd, pgprot_t prot)static inline pte_t pte_mkwrite_novma (pte_t pte) { pte =set_pte_bit (pte,__pgprot (PTE_WRITE )); - pte =clear_pte_bit (pte,__pgprot (PTE_RDONLY )); +if (pte_sw_dirty (pte)) + pte =clear_pte_bit (pte,__pgprot (PTE_RDONLY ));return pte; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/184 erofs: avoid infinite loops due to corrupted subpage compact indexes
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit e13d315ae077bb7c3c6027cc292401bc0f4ec683 ]
Robert reported an infinite loop observed by two crafted images.
The root cause is that clusterofs can be larger than lclustersize for !NONHEAD lclusters in corrupted subpage compact indexes, e.g.:
blocksize = lclustersize = 512 lcn = 6 clusterofs = 515
Move the corresponding check for full compress indexes to z_erofs_load_lcluster_from_disk() to also cover subpage compact compress indexes.
It also fixes the position of m->type >= Z_EROFS_LCLUSTER_TYPE_MAX check, since it should be placed right after z_erofs_load_{compact,full}_lcluster().
--- fs/erofs/zmap.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-)
fs/erofs/zmap.c +18 -14
@@ -55,10 +55,6 @@ static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m, }else { m->partialref = !!(advise &Z_EROFS_LI_PARTIAL_REF ); m->clusterofs =le16_to_cpu (di->di_clusterofs); -if (m->clusterofs >=1 << vi->z_lclusterbits) { -DBG_BUGON (1 ); -return -EFSCORRUPTED ; - } m->pblk =le32_to_cpu (di->di_u.blkaddr); }return 0 ;
@@ -240,21 +236,29 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,static int z_erofs_load_lcluster_from_disk (struct z_erofs_maprecorder *m,unsigned int lcn,bool lookahead) { +struct erofs_inode *vi =EROFS_I (m->inode); +int err; + +if (vi->datalayout ==EROFS_INODE_COMPRESSED_COMPACT ) { + err =z_erofs_load_compact_lcluster (m, lcn, lookahead); + }else { +DBG_BUGON (vi->datalayout !=EROFS_INODE_COMPRESSED_FULL ); + err =z_erofs_load_full_lcluster (m, lcn); + } +if (err) +return err; +if (m->type >=Z_EROFS_LCLUSTER_TYPE_MAX ) {erofs_err (m->inode->i_sb,"unknown type %u @ lcn %u of nid %llu" , - m->type, lcn,EROFS_I (m->inode)->nid); + m->type, lcn,EROFS_I (m->inode)->nid);DBG_BUGON (1 );return -EOPNOTSUPP ; + }else if (m->type !=Z_EROFS_LCLUSTER_TYPE_NONHEAD && + m->clusterofs >= (1 << vi->z_lclusterbits)) { +DBG_BUGON (1 ); +return -EFSCORRUPTED ; } - -switch (EROFS_I (m->inode)->datalayout) { -case EROFS_INODE_COMPRESSED_FULL : -return z_erofs_load_full_lcluster (m, lcn); -case EROFS_INODE_COMPRESSED_COMPACT : -return z_erofs_load_compact_lcluster (m, lcn, lookahead); -default : -return -EINVAL ; - } +return 0 ; } static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/184 net: hibmcge: select FIXED_PHY
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit d63f0391d6c7b75e1a847e1a26349fa8cad0004d ]
hibmcge uses fixed_phy_register() et al, but doesn't cater for the case that hibmcge is built-in and fixed_phy is a module. To solve this select FIXED_PHY.
--- drivers/net/ethernet/hisilicon/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/Kconfig +1 -0
@@ -148,6 +148,7 @@ config HIBMCGE tristate "Hisilicon BMC Gigabit Ethernet Device Support" depends on PCI && PCI_MSI select PHYLIB + select FIXED_PHY select MOTORCOMM_PHY select REALTEK_PHY help
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/184 ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit a767957e7a83f9e742be196aa52a48de8ac5a7e4 ]
In ptp_ocp_sma_fb_init(), the code mistakenly used bp->sma[1] instead of bp->sma[i] inside a for-loop, which caused only SMA[1] to have its DIRECTION_CAN_CHANGE capability cleared. This led to inconsistent capability flags across SMA pins.
--- drivers/ptp/ptp_ocp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ptp/ptp_ocp.c +1 -1
@@ -2550,7 +2550,7 @@ ptp_ocp_sma_fb_init(struct ptp_ocp *bp)for (i =0 ; i <OCP_SMA_NUM ; i++) { bp->sma[i].fixed_fcn = true; bp->sma[i].fixed_dir = true; - bp->sma[1 ].dpll_prop.capabilities &= + bp->sma[i].dpll_prop.capabilities &= ~DPLL_PIN_CAPABILITIES_DIRECTION_CAN_CHANGE ; }return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/184 sctp: avoid NULL dereference when chunk data buffer is missing
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Simakov <[email protected]>
[ Upstream commit 441f0647f7673e0e64d4910ef61a5fb8f16bfb82 ]
chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only.
chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition.
--- net/sctp/inqueue.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/sctp/inqueue.c +7 -6
@@ -169,13 +169,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) chunk->head_skb = chunk->skb;/* skbs with "cover letter" */ -if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) +if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) { +if (WARN_ON (!skb_shinfo (chunk->skb)->frag_list)) { +__SCTP_INC_STATS (dev_net (chunk->skb->dev), +SCTP_MIB_IN_PKT_DISCARDS ); +sctp_chunk_free (chunk); + goto next_chunk; + } chunk->skb =skb_shinfo (chunk->skb)->frag_list; - -if (WARN_ON (!chunk->skb)) { -__SCTP_INC_STATS (dev_net (chunk->skb->dev),SCTP_MIB_IN_PKT_DISCARDS ); -sctp_chunk_free (chunk); - goto next_chunk; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/184 net: hsr: prevent creation of HSR device with slaves from another netns
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit c0178eec8884231a5ae0592b9fce827bccb77e86 ]
HSR/PRP driver does not handle correctly having slaves/interlink devices in a different net namespace. Currently, it is possible to create a HSR link in a different net namespace than the slaves/interlink with the following command:
ip link add hsr0 netns hsr-ns type hsr slave1 eth1 slave2 eth2
As there is no use-case on supporting this scenario, enforce that HSR device link matches netns defined by IFLA_LINK_NETNSID.
The iproute2 command mentioned above will throw the following error:
Error: hsr: HSR slaves/interlink must be on the same net namespace than HSR link.
--- net/hsr/hsr_netlink.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/hsr/hsr_netlink.c +7 -1
@@ -34,12 +34,18 @@ static int hsr_newlink(struct net_device *dev, struct netlink_ext_ack *extack) {struct net *link_net =rtnl_newlink_link_net (params); +struct net_device *link[2 ], *interlink =NULL ;struct nlattr **data = params->data;enum hsr_version proto_version;unsigned char multicast_spec;u8 proto =HSR_PROTOCOL_HSR ; -struct net_device *link[2 ], *interlink =NULL ; +if (!net_eq (link_net,dev_net (dev))) { +NL_SET_ERR_MSG_MOD (extack, +"HSR slaves/interlink must be on the same net namespace than HSR link" ); +return -EINVAL ; + } +if (!data) {NL_SET_ERR_MSG_MOD (extack,"No slave devices specified" );return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/184 espintcp: use datagram_poll_queue for socket readiness
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit 0fc3e32c2c069f541f2724d91f5e98480b640326 ]
espintcp uses a custom queue (ike_queue) to deliver packets to userspace. The polling logic relies on datagram_poll, which checks sk_receive_queue, which can lead to false readiness signals when that queue contains non-userspace packets.
Switch espintcp_poll to use datagram_poll_queue with ike_queue, ensuring poll only signals readiness when userspace data is actually available.
--- net/xfrm/espintcp.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/xfrm/espintcp.c +1 -5
@@ -555,14 +555,10 @@ static void espintcp_close(struct sock *sk, long timeout)static __poll_t espintcp_poll (struct file *file,struct socket *sock,poll_table *wait) { -__poll_t mask =datagram_poll (file, sock, wait);struct sock *sk = sock->sk;struct espintcp_ctx *ctx =espintcp_getctx (sk); -if (!skb_queue_empty (&ctx->ike_queue)) - mask |=EPOLLIN |EPOLLRDNORM ; - -return mask; +return datagram_poll_queue (file, sock, wait, &ctx->ike_queue); } static void build_protos(struct proto *espintcp_prot,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/184 net: datagram: introduce datagram_poll_queue for custom receive queues
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit f6ceec6434b5efff62cecbaa2ff74fc29b96c0c6 ]
Some protocols using TCP encapsulation (e.g., espintcp, openvpn) deliver userspace-bound packets through a custom skb queue rather than the standard sk_receive_queue.
Introduce datagram_poll_queue that accepts an explicit receive queue, and convert datagram_poll into a wrapper around datagram_poll_queue. This allows protocols with custom skb queues to reuse the core polling logic without relying on sk_receive_queue.
Stable-dep-of: efd729408bc7 ("ovpn: use datagram_poll_queue for socket readiness in TCP")
--- include/linux/skbuff.h | 3 +++ net/core/datagram.c | 44 ++++++++++++++++++++++++++++++++---------- 2 files changed, 37 insertions(+), 10 deletions(-)
include/linux/skbuff.h +3 -0
@@ -4157,6 +4157,9 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk,struct sk_buff_head *sk_queue, unsigned int flags, int *off, int *err);struct sk_buff *skb_recv_datagram (struct sock *sk,unsigned int flags,int *err); +__poll_t datagram_poll_queue (struct file *file,struct socket *sock, +struct poll_table_struct *wait, +struct sk_buff_head *rcv_queue);__poll_t datagram_poll (struct file *file,struct socket *sock,struct poll_table_struct *wait); int skb_copy_datagram_iter(const struct sk_buff *from, int offset,
net/core/datagram.c +34 -10
66 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/184 ovpn: use datagram_poll_queue for socket readiness in TCP
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit efd729408bc7d57e0c8d027b9ff514187fc1a05b ]
openvpn TCP encapsulation uses a custom queue to deliver packets to userspace. Currently it relies on datagram_poll, which checks sk_receive_queue, leading to false readiness signals when that queue contains non-userspace packets.
Switch ovpn_tcp_poll to use datagram_poll_queue with the peer's user_queue, ensuring poll only signals readiness when userspace data is actually available. Also refactor ovpn_tcp_poll in order to enforce the assumption we can make on the lifetime of ovpn_sock and peer.
--- drivers/net/ovpn/tcp.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
drivers/net/ovpn/tcp.c +22 -4
@@ -560,16 +560,34 @@ static void ovpn_tcp_close(struct sock *sk, long timeout)static __poll_t ovpn_tcp_poll (struct file *file,struct socket *sock,poll_table *wait) { -__poll_t mask =datagram_poll (file, sock, wait); +struct sk_buff_head *queue = &sock->sk->sk_receive_queue;struct ovpn_socket *ovpn_sock; +struct ovpn_peer *peer =NULL ; +__poll_t mask;rcu_read_lock (); ovpn_sock =rcu_dereference_sk_user_data (sock->sk); -if (ovpn_sock && ovpn_sock->peer && - !skb_queue_empty (&ovpn_sock->peer->tcp.user_queue)) - mask |=EPOLLIN |EPOLLRDNORM ; +/* if we landed in this callback, we expect to have a +* meaningful state. The ovpn_socket lifecycle would +* prevent it otherwise. +*/ +if (WARN (!ovpn_sock || !ovpn_sock->peer, +"ovpn: null state in ovpn_tcp_poll!" )) { +rcu_read_unlock (); +return 0 ; + } + +if (ovpn_peer_hold (ovpn_sock->peer)) { + peer = ovpn_sock->peer; + queue = &peer->tcp.user_queue; + }rcu_read_unlock (); + mask =datagram_poll_queue (file, sock, wait, queue); + +if (peer) +ovpn_peer_put (peer); +return mask; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/184 net: phy: micrel: always set shared->phydev for LAN8814
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Marko <[email protected]>
[ Upstream commit 399d10934740ae8cdaa4e3245f7c5f6c332da844 ]
Currently, during the LAN8814 PTP probe shared->phydev is only set if PTP clock gets actually set, otherwise the function will return before setting it.
This is an issue as shared->phydev is unconditionally being used when IRQ is being handled, especially in lan8814_gpio_process_cap and since it was not set it will cause a NULL pointer exception and crash the kernel.
So, simply always set shared->phydev to avoid the NULL pointer exception.
--- drivers/net/phy/micrel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/micrel.c +2 -2
@@ -4109,6 +4109,8 @@ static int lan8814_ptp_probe_once(struct phy_device *phydev) {struct lan8814_shared_priv *shared =phy_package_get_priv (phydev); + shared->phydev = phydev; +/* Initialise shared lock for clock*/ mutex_init (&shared->shared_lock);
@@ -4164,8 +4166,6 @@ static int lan8814_ptp_probe_once(struct phy_device *phydev)phydev_dbg (phydev,"successfully registered ptp clock\n" ); - shared->phydev = phydev; -/* The EP.4 is shared between all the PHYs in the package and also it * can be accessed by any of the PHYs */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/184 net/mlx5: Fix IPsec cleanup over MPV device
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 664f76be38a18c61151d0ef248c7e2f3afb4f3c7 ]
When we do mlx5e_detach_netdev() we eventually disable blocking events notifier, among those events are IPsec MPV events from IB to core.
So before disabling those blocking events, make sure to also unregister the devcom device and mark all this device operations as complete, in order to prevent the other device from using invalid netdev during future devcom events which could cause the trace below.
BUG: kernel NULL pointer dereference, address: 0000000000000010 PGD 146427067 P4D 146427067 PUD 146488067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 1 UID: 0 PID: 7735 Comm: devlink Tainted: GW 6.12.0-rc6_for_upstream_min_debug_2024_11_08_00_46 #1 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] Code: 00 01 48 83 05 23 32 1e 00 01 41 b8 ed ff ff ff e9 60 ff ff ff 48 83 05 00 32 1e 00 01 eb e3 66 0f 1f 44 00 00 0f 1f 44 00 00 <48> 8b 47 10 48 83 05 5f 32 1e 00 01 48 8b 50 40 48 85 d2 74 05 40 RSP: 0018:ffff88811a5c35f8 EFLAGS: 00010206 RAX: ffff888106e8ab80 RBX: ffff888107d7e200 RCX: ffff88810d6f0a00 RDX: ffff88810d6f0a00 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff88811a17e620 R08: 0000000000000040 R09: 0000000000000000 R10: ffff88811a5c3618 R11: 0000000de85d51bd R12: ffff88811a17e600 R13: ffff88810d6f0a00 R14: 0000000000000000 R15: ffff8881034bda80 FS: 00007f27bdf89180(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000010f159005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] mlx5e_devcom_event_mpv+0x42/0x60 [mlx5_core] mlx5_devcom_send_event+0x8c/0x170 [mlx5_core] blocking_event+0x17b/0x230 [mlx5_core] notifier_call_chain+0x35/0xa0 blocking_notifier_call_chain+0x3d/0x60 mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core] mlx5_core_mp_event_replay+0x12/0x20 [mlx5_core] mlx5_ib_bind_slave_port+0x228/0x2c0 [mlx5_ib] mlx5_ib_stage_init_init+0x664/0x9d0 [mlx5_ib] ? idr_alloc_cyclic+0x50/0xb0 ? __kmalloc_cache_noprof+0x167/0x340 ? __kmalloc_noprof+0x1a7/0x430 __mlx5_ib_add+0x34/0xd0 [mlx5_ib] mlx5r_probe+0xe9/0x310 [mlx5_ib] ? kernfs_add_one+0x107/0x150 ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib] auxiliary_bus_probe+0x3e/0x90 really_probe+0xc5/0x3a0 ? driver_probe_device+0x90/0x90 __driver_probe_device+0x80/0x160 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 bus_for_each_drv+0x80/0xd0 __device_attach+0xbc/0x1f0 bus_probe_device+0x86/0xa0 device_add+0x62d/0x830 __auxiliary_device_add+0x3b/0xa0 ? auxiliary_device_init+0x41/0x90 add_adev+0xd1/0x150 [mlx5_core] mlx5_rescan_drivers_locked+0x21c/0x300 [mlx5_core] esw_mode_change+0x6c/0xc0 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x21e/0x640 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xe0 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x180/0x2b0 ? devlink_get_from_attrs_lock+0x170/0x170 ? devlink_nl_eswitch_get_doit+0x290/0x290 ? devlink_nl_pre_doit_port_optional+0x50/0x50 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1fc/0x2d0 netlink_sendmsg+0x1e4/0x410 __sock_sendmsg+0x38/0x60 ? sockfd_lookup_light+0x12/0x60 __sys_sendto+0x105/0x160 ? __sys_recvmsg+0x4e/0x90 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f27bc91b13a Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa 96 2c 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 f3 c3 0f 1f 40 00 41 55 41 54 4d 89 c5 55 RSP: 002b:00007fff369557e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000009c54b10 RCX: 00007f27bc91b13a RDX: 0000000000000038 RSI: 0000000009c54b10 RDI: 0000000000000006 RBP: 0000000009c54920 R08: 00007f27bd0030e0 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 </TASK> Modules linked in: mlx5_vdpa vringh vhost_iotlb vdpa xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi ib_umad scsi_transport_iscsi ib_ipoib rdma_cm iw_cm ib_cm mlx5_fwctl mlx5_ib ib_uverbs ib_core mlx5_core
CR2: 0000000000000010
--- .../mellanox/mlx5/core/en_accel/ipsec.h | 5 ++++ .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 25 +++++++++++++++++-- .../net/ethernet/mellanox/mlx5/core/en_main.c | 2 ++ 3 files changed, 30 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +5 -0
@@ -342,6 +342,7 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,void mlx5e_ipsec_handle_mpv_event (int event,struct mlx5e_priv *slave_priv,struct mlx5e_priv *master_priv);void mlx5e_ipsec_send_event (struct mlx5e_priv *priv,int event); +void mlx5e_ipsec_disable_events (struct mlx5e_priv *priv);static inline struct mlx5_core_dev *mlx5e_ipsec_sa2dev (struct mlx5e_ipsec_sa_entry *sa_entry)
@@ -387,6 +388,10 @@ static inline void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slstatic inline void mlx5e_ipsec_send_event (struct mlx5e_priv *priv,int event) { } + +static inline void mlx5e_ipsec_disable_events (struct mlx5e_priv *priv) +{ +}#endif #endif /* __MLX5E_IPSEC_H__ */
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +23 -2
@@ -2869,9 +2869,30 @@ void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv,void mlx5e_ipsec_send_event (struct mlx5e_priv *priv,int event) { -if (!priv->ipsec) -return ;/* IPsec not supported */ +if (!priv->ipsec ||mlx5_devcom_comp_get_size (priv->devcom) <2 ) +return ;/* IPsec not supported or no peers */ mlx5_devcom_send_event (priv->devcom, event, event, priv);wait_for_completion (&priv->ipsec->comp); } + +void mlx5e_ipsec_disable_events (struct mlx5e_priv *priv) +{ +struct mlx5_devcom_comp_dev *tmp =NULL ; +struct mlx5e_priv *peer_priv; + +if (!priv->devcom) +return ; + +if (!mlx5_devcom_for_each_peer_begin (priv->devcom)) + goto out; + + peer_priv =mlx5_devcom_get_next_peer_data (priv->devcom, &tmp); +if (peer_priv) +complete_all (&peer_priv->ipsec->comp); + +mlx5_devcom_for_each_peer_end (priv->devcom); +out: +mlx5_devcom_unregister_component (priv->devcom); + priv->devcom =NULL ; +}
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -0
@@ -261,6 +261,7 @@ static void mlx5e_devcom_cleanup_mpv(struct mlx5e_priv *priv) }mlx5_devcom_unregister_component (priv->devcom); + priv->devcom =NULL ; }static int blocking_event (struct notifier_block *nb,unsigned long event,void *data)
@@ -6068,6 +6069,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv)if (mlx5e_monitor_counter_supported (priv))mlx5e_monitor_counter_cleanup (priv); +mlx5e_ipsec_disable_events (priv);mlx5e_disable_blocking_events (priv);mlx5e_disable_async_events (priv);mlx5_lag_remove_netdev (mdev, priv->netdev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/184 fs/notify: call exportfs_encode_fid with s_umount
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Acs <[email protected]>
commit a7c4bb43bfdc2b9f06ee9d036028ed13a83df42a upstream.
Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr.
This issue was found by syzkaller.
Race Condition Diagram:
Thread 1 Thread 2
-------- --------
generic_shutdown_super()
shrink_dcache_for_umount
sb->s_root = NULL
|
| vfs_read()
| inotify_fdinfo()
| * inode get from mark *
| show_mark_fhandle(m, inode)
| exportfs_encode_fid(inode, ..)
| ovl_encode_fh(inode, ..)
| ovl_check_encode_origin(inode)
| * deref i_sb->s_root *
|
| v
fsnotify_sb_delete(sb)
Which then leads to:
[ 32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none)
<snip registers, unreliable trace>
[ 32.143353] Call Trace: [ 32.143732] ovl_encode_fh+0xd5/0x170 [ 32.144031] exportfs_encode_inode_fh+0x12f/0x300 [ 32.144425] show_mark_fhandle+0xbe/0x1f0 [ 32.145805] inotify_fdinfo+0x226/0x2d0 [ 32.146442] inotify_show_fdinfo+0x1c5/0x350 [ 32.147168] seq_show+0x530/0x6f0 [ 32.147449] seq_read_iter+0x503/0x12a0 [ 32.148419] seq_read+0x31f/0x410 [ 32.150714] vfs_read+0x1f0/0x9e0 [ 32.152297] ksys_read+0x125/0x240
IOW ovl_check_encode_origin derefs inode->i_sb->s_root, after it was set to NULL in the unmount path.
Fix it by protecting calling exportfs_encode_fid() from show_mark_fhandle() with s_umount lock.
This form of fix was suggested by Amir in [1].
[1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/
--- fs/notify/fdinfo.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/notify/fdinfo.c +6 -0
@@ -17,6 +17,7 @@#include "fanotify/fanotify.h" #include "fdinfo.h" #include "fsnotify.h" +#include "../internal.h" #if defined(CONFIG_PROC_FS )
@@ -46,7 +47,12 @@ static void show_mark_fhandle(struct seq size = f->handle_bytes >>2 ; +if (!super_trylock_shared (inode->i_sb)) +return ; + ret =exportfs_encode_fid (inode, (struct fid *)f->f_handle, &size); +up_read (&inode->i_sb->s_umount); +if ((ret ==FILEID_INVALID ) || (ret <0 ))return ;
Greg Kroah-Hartman
maintainerPATCH 62/184 net: bonding: fix possible peer notify event loss or dup issue
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tonghao Zhang <[email protected]>
commit 10843e1492e474c02b91314963161731fa92af91 upstream.
If the send_peer_notif counter and the peer event notify are not synchronized. It may cause problems such as the loss or dup of peer notify event.
Before this patch:
- If should_notify_peers is true and the lock for send_peer_notif-- fails, peer event may be sent again in next mii_monitor loop, because should_notify_peers is still true.
- If should_notify_peers is true and the lock for send_peer_notif-- succeeded, but the lock for peer event fails, the peer event will be lost.
This patch locks the RTNL for send_peer_notif, events, and commit simultaneously.
--- drivers/net/bonding/bond_main.c | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-)
drivers/net/bonding/bond_main.c +18 -22
@@ -2969,7 +2969,7 @@ static void bond_mii_monitor(struct work { struct bonding *bond = container_of(work, struct bonding, mii_work.work); -bool should_notify_peers = false; +bool should_notify_peers;bool commit;unsigned long delay;struct slave *slave;
@@ -2981,30 +2981,33 @@ static void bond_mii_monitor(struct work goto re_arm;rcu_read_lock (); + should_notify_peers =bond_should_notify_peers (bond); commit = !!bond_miimon_inspect (bond); -if (bond->send_peer_notif) { -rcu_read_unlock (); -if (rtnl_trylock ()) { - bond->send_peer_notif--; -rtnl_unlock (); - } - }else { -rcu_read_unlock (); - } -if (commit) { +rcu_read_unlock (); + +if (commit || bond->send_peer_notif) {/* Race avoidance with bond_close cancel of workqueue */ if (!rtnl_trylock ()) { delay =1 ; - should_notify_peers = false; goto re_arm; } -bond_for_each_slave (bond, slave, iter) { -bond_commit_link_state (slave,BOND_SLAVE_NOTIFY_LATER ); +if (commit) { +bond_for_each_slave (bond, slave, iter) { +bond_commit_link_state (slave, +BOND_SLAVE_NOTIFY_LATER ); + } +bond_miimon_commit (bond); + } + +if (bond->send_peer_notif) { + bond->send_peer_notif--; +if (should_notify_peers) +call_netdevice_notifiers (NETDEV_NOTIFY_PEERS , + bond->dev); } -bond_miimon_commit (bond);rtnl_unlock ();/* might sleep, hold no other locks */ }
@@ -3012,13 +3015,6 @@ static void bond_mii_monitor(struct work re_arm:if (bond->params.miimon)queue_delayed_work (bond->wq, &bond->mii_work, delay); - -if (should_notify_peers) { -if (!rtnl_trylock ()) -return ; -call_netdevice_notifiers (NETDEV_NOTIFY_PEERS , bond->dev); -rtnl_unlock (); - } } static int bond_upper_dev_walk(struct net_device *upper,
Greg Kroah-Hartman
maintainerPATCH 63/184 hung_task: fix warnings caused by unaligned lock pointers
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lance Yang <[email protected]>
commit c97513cddcfc235f2522617980838e500af21d01 upstream.
The blocker tracking mechanism assumes that lock pointers are at least 4-byte aligned to use their lower bits for type encoding.
However, as reported by Eero Tamminen, some architectures like m68k only guarantee 2-byte alignment of 32-bit values. This breaks the assumption and causes two related WARN_ON_ONCE checks to trigger.
To fix this, the runtime checks are adjusted to silently ignore any lock that is not 4-byte aligned, effectively disabling the feature in such cases and avoiding the related warnings.
Thanks to Geert Uytterhoeven for bisecting!
--- include/linux/hung_task.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
include/linux/hung_task.h +5 -3
@@ -20,6 +20,10 @@* always zero. So we can use these bits to encode the specific blocking * type. * +* Note that on architectures where this is not guaranteed, or for any +* unaligned lock, this tracking mechanism is silently skipped for that +* lock. +* * Type encoding: * 00 - Blocked on mutex (BLOCKER_TYPE_MUTEX) * 01 - Blocked on semaphore (BLOCKER_TYPE_SEM)
@@ -45,7 +49,7 @@ static inline void hung_task_set_blocker(void *lock, unsigned long type)* If the lock pointer matches the BLOCKER_TYPE_MASK, return * without writing anything. */ -if (WARN_ON_ONCE (lock_ptr &BLOCKER_TYPE_MASK )) +if (lock_ptr &BLOCKER_TYPE_MASK )return ;WRITE_ONCE (current->blocker, lock_ptr | type);
@@ -53,8 +57,6 @@ static inline void hung_task_set_blocker(void *lock, unsigned long type)static inline void hung_task_clear_blocker (void ) { -WARN_ON_ONCE (!READ_ONCE (current->blocker)); -WRITE_ONCE (current->blocker,0UL ); }
Signature · 1 line
2.51.1
Greg Kroah-Hartman
maintainerPATCH 64/184 mm: dont spin in add_stack_record when gfp flags dont allow
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
commit c83aab85e18103a6dc066b4939e2c92a02bb1b05 upstream.
syzbot was able to find the following path:
add_stack_record_to_list mm/page_owner.c:182 [inline] inc_stack_record_count mm/page_owner.c:214 [inline] __set_page_owner+0x2c3/0x4a0 mm/page_owner.c:333 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 alloc_pages_nolock_noprof+0x94/0x120 mm/page_alloc.c:7554
Don't spin in add_stack_record_to_list() when it is called from *_nolock() context.
--- mm/page_owner.c | 3 +++ 1 file changed, 3 insertions(+)
mm/page_owner.c +3 -0
@@ -168,6 +168,9 @@ static void add_stack_record_to_list(struct stack_record *stack_record,unsigned long flags;struct stack *stack; +if (!gfpflags_allow_spinning (gfp_mask)) +return ; +set_current_in_page_owner (); stack =kmalloc (sizeof (*stack),gfp_nested_mask (gfp_mask));if (!stack) {
Signature · 1 line
2.51.1
Greg Kroah-Hartman
maintainerPATCH 65/184 dma-debug: dont report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 03521c892bb8d0712c23e158ae9bdf8705897df8 upstream.
Commit 370645f41e6e ("dma-mapping: force bouncing if the kmalloc() size is not cache-line-aligned") introduced DMA_BOUNCE_UNALIGNED_KMALLOC feature and permitted architecture specific code configure kmalloc slabs with sizes smaller than the value of dma_get_cache_alignment().
When that feature is enabled, the physical address of some small kmalloc()-ed buffers might be not aligned to the CPU cachelines, thus not really suitable for typical DMA. To properly handle that case a SWIOTLB buffer bouncing is used, so no CPU cache corruption occurs. When that happens, there is no point reporting a false-positive DMA-API warning that the buffer is not properly aligned, as this is not a client driver fault.
--- kernel/dma/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/dma/debug.c +4 -1
@@ -23,6 +23,7 @@#include <linux/ctype.h> #include <linux/list.h> #include <linux/slab.h> +#include <linux/swiotlb.h> #include <asm/sections.h> #include "debug.h"
@@ -594,7 +595,9 @@ static void add_dma_entry(struct dma_debif (rc == -ENOMEM ) {pr_err_once ("cacheline tracking ENOMEM, dma-debug disabled\n" ); global_disable = true; - }else if (rc == -EEXIST && !(attrs &DMA_ATTR_SKIP_CPU_SYNC )) { + }else if (rc == -EEXIST && !(attrs &DMA_ATTR_SKIP_CPU_SYNC ) && + !(IS_ENABLED (CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC ) && +is_swiotlb_active (entry->dev))) {err_printk (entry->dev, entry,"cacheline tracking EEXIST, overlapping mappings aren't supported\n" ); }
Greg Kroah-Hartman
maintainerPATCH 66/184 virtio-net: zero unused hash fields
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
commit b2284768c6b32aa224ca7d0ef0741beb434f03aa upstream.
When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to initialize the tunnel metadata but forget to zero unused rxhash fields. This may leak information to another side. Fixing this by zeroing the unused hash fields.
--- include/linux/virtio_net.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/virtio_net.h +4 -0
@@ -401,6 +401,10 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,if (!tnl_hdr_negotiated)return -EINVAL ; + vhdr->hash_hdr.hash_value =0 ; + vhdr->hash_hdr.hash_report =0 ; + vhdr->hash_hdr.padding =0 ; +/* Let the basic parsing deal with plain GSO features. */ skb_shinfo (skb)->gso_type &= ~tnl_gso_type; ret =virtio_net_hdr_from_skb (skb, hdr, true, false, vlan_hlen);
Signature · 1 line
2.51.1
Greg Kroah-Hartman
maintainerPATCH 67/184 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
commit 2eead19334516c8e9927c11b448fbe512b1f18a1 upstream.
Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate().
Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns:
"The error code within @ptr if it is an error pointer; 0 otherwise."
This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL.
Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
--- drivers/base/arch_topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/arch_topology.c +1 -1
@@ -292,7 +292,7 @@ bool __init topology_parse_cpu_capacity(* frequency (by keeping the initial capacity_freq_ref value). */ cpu_clk =of_clk_get (cpu_node,0 ); -if (!PTR_ERR_OR_ZERO (cpu_clk)) { +if (!IS_ERR_OR_NULL (cpu_clk)) {per_cpu (capacity_freq_ref, cpu) =clk_get_rate (cpu_clk) /HZ_PER_KHZ ;clk_put (cpu_clk);
Greg Kroah-Hartman
maintainerPATCH 68/184 riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jingwei Wang <[email protected]>
commit 5d15d2ad36b0f7afab83ca9fc8a2a6e60cbe54c4 upstream.
The hwprobe vDSO data for some keys, like MISALIGNED_VECTOR_PERF, is determined by an asynchronous kthread. This can create a race condition where the kthread finishes after the vDSO data has already been populated, causing userspace to read stale values.
To fix this race, a new 'ready' flag is added to the vDSO data, initialized to 'false' during arch_initcall_sync. This flag is checked by both the vDSO's user-space code and the riscv_hwprobe syscall. The syscall serves as a one-time gate, using a completion to wait for any pending probes before populating the data and setting the flag to 'true', thus ensuring userspace reads fresh values on its first request.
--- arch/riscv/include/asm/hwprobe.h | 7 ++ arch/riscv/include/asm/vdso/arch_data.h | 6 ++ arch/riscv/kernel/sys_hwprobe.c | 70 ++++++++++++++++++++++++----- arch/riscv/kernel/unaligned_access_speed.c | 9 ++- arch/riscv/kernel/vdso/hwprobe.c | 2 5 files changed, 79 insertions(+), 15 deletions(-)
arch/riscv/include/asm/hwprobe.h +7 -0
@@ -41,4 +41,11 @@ static inline bool riscv_hwprobe_pair_cm return pair->value == other_pair->value; } +#ifdef CONFIG_MMU +void riscv_hwprobe_register_async_probe (void ); +void riscv_hwprobe_complete_async_probe (void ); +#else +static inline void riscv_hwprobe_register_async_probe (void ) {} +static inline void riscv_hwprobe_complete_async_probe (void ) {} +#endif #endif
arch/riscv/include/asm/vdso/arch_data.h +6 -0
@@ -12,6 +12,12 @@ struct vdso_arch_data {/* Boolean indicating all CPUs have the same static hwprobe values. */ __u8 homogeneous_cpus; + +/* +* A gate to check and see if the hwprobe data is actually ready, as +* probing is deferred to avoid boot slowdowns. +*/ + __u8 ready; };#endif /* __RISCV_ASM_VDSO_ARCH_DATA_H */
arch/riscv/kernel/sys_hwprobe.c +58 -12
105 lines not on this page · raw message
arch/riscv/kernel/unaligned_access_speed.c +7 -2
@@ -379,6 +379,7 @@ free:static int __init vec_check_unaligned_access_speed_all_cpus (void *unused__always_unused ) {schedule_on_each_cpu (check_vector_unaligned_access); +riscv_hwprobe_complete_async_probe ();return 0 ; }
@@ -473,8 +474,12 @@ static int __init check_unaligned_accessper_cpu (vector_misaligned_access, cpu) = unaligned_vector_speed_param; }else if (!check_vector_unaligned_access_emulated_all_cpus () &&IS_ENABLED (CONFIG_RISCV_PROBE_VECTOR_UNALIGNED_ACCESS )) { -kthread_run (vec_check_unaligned_access_speed_all_cpus, -NULL ,"vec_check_unaligned_access_speed_all_cpus" ); +riscv_hwprobe_register_async_probe (); +if (IS_ERR (kthread_run (vec_check_unaligned_access_speed_all_cpus, +NULL ,"vec_check_unaligned_access_speed_all_cpus" ))) { +pr_warn ("Failed to create vec_unalign_check kthread\n" ); +riscv_hwprobe_complete_async_probe (); + } }/*
arch/riscv/kernel/vdso/hwprobe.c +1 -1
@@ -27,7 +27,7 @@ static int riscv_vdso_get_values(struct* homogeneous, then this function can handle requests for arbitrary * masks. */ -if ((flags !=0 ) || (!all_cpus && !avd->homogeneous_cpus)) +if (flags !=0 || (!all_cpus && !avd->homogeneous_cpus) ||unlikely (!avd->ready))return riscv_hwprobe (pairs, pair_count, cpusetsize, cpus, flags);/* This is something we can handle, fill out the pairs. */
Greg Kroah-Hartman
maintainerPATCH 69/184 io_uring/sqpoll: switch away from getrusage() for CPU accounting
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 8ac9b0d33e5c0a995338ee5f25fe1b6ff7d97f65 upstream.
getrusage() does a lot more than what the SQPOLL accounting needs, the latter only cares about (and uses) the stime. Rather than do a full RUSAGE_SELF summation, just query the used stime instead.
--- io_uring/fdinfo.c | 8 ++++---- io_uring/sqpoll.c | 32 ++++++++++++++++++-------------- io_uring/sqpoll.h | 1 + 3 files changed, 23 insertions(+), 18 deletions(-)
io_uring/fdinfo.c +4 -4
@@ -59,7 +59,6 @@ static void __io_uring_show_fdinfo(struc {struct io_overflow_cqe *ocqe;struct io_rings *r = ctx->rings; -struct rusage sq_usage;unsigned int sq_mask = ctx->sq_entries -1 , cq_mask = ctx->cq_entries -1 ;unsigned int sq_head =READ_ONCE (r->sq.head);unsigned int sq_tail =READ_ONCE (r->sq.tail);
@@ -150,14 +149,15 @@ static void __io_uring_show_fdinfo(struc* thread termination. */ if (tsk) { +u64 usec; +get_task_struct (tsk);rcu_read_unlock (); -getrusage (tsk,RUSAGE_SELF , &sq_usage); + usec =io_sq_cpu_usec (tsk);put_task_struct (tsk); sq_pid = sq->task_pid; sq_cpu = sq->sq_cpu; - sq_total_time = (sq_usage.ru_stime.tv_sec *1000000 - + sq_usage.ru_stime.tv_usec); + sq_total_time = usec; sq_work_time = sq->work_time; }else {rcu_read_unlock ();
io_uring/sqpoll.c +18 -14
@@ -11,6 +11,7 @@#include <linux/audit.h> #include <linux/security.h> #include <linux/cpuset.h> +#include <linux/sched/cputime.h> #include <linux/io_uring.h> #include <uapi/linux/io_uring.h>
@@ -169,6 +170,20 @@ static inline bool io_sqd_events_pendingreturn READ_ONCE (sqd->state); } +u64 io_sq_cpu_usec (struct task_struct *tsk) +{ +u64 utime, stime; + +task_cputime_adjusted (tsk, &utime, &stime); +do_div (stime,1000 ); +return stime; +} + +static void io_sq_update_worktime (struct io_sq_data *sqd,u64 usec) +{ + sqd->work_time +=io_sq_cpu_usec (current) - usec; +} +static int __io_sq_thread (struct io_ring_ctx *ctx,bool cap_entries) {unsigned int to_submit;
@@ -255,26 +270,15 @@ static bool io_sq_tw_pending(struct llisreturn retry_list || !llist_empty (&tctx->task_list); } -static void io_sq_update_worktime (struct io_sq_data *sqd,struct rusage *start) -{ -struct rusage end; - -getrusage (current,RUSAGE_SELF , &end); - end.ru_stime.tv_sec -= start->ru_stime.tv_sec; - end.ru_stime.tv_usec -= start->ru_stime.tv_usec; - - sqd->work_time += end.ru_stime.tv_usec + end.ru_stime.tv_sec *1000000 ; -} -static int io_sq_thread (void *data) {struct llist_node *retry_list =NULL ;struct io_sq_data *sqd = data;struct io_ring_ctx *ctx; -struct rusage start;unsigned long timeout =0 ;char buf[TASK_COMM_LEN ] = {};DEFINE_WAIT (wait); +u64 start;/* offload context creation failed, just exit */ if (!current->io_uring) {
@@ -317,7 +321,7 @@ static int io_sq_thread(void *data) } cap_entries = !list_is_singular (&sqd->ctx_list); -getrusage (current,RUSAGE_SELF , &start); + start =io_sq_cpu_usec (current);list_for_each_entry (ctx, &sqd->ctx_list, sqd_list) {int ret =__io_sq_thread (ctx, cap_entries);
@@ -333,7 +337,7 @@ static int io_sq_thread(void *data)if (sqt_spin || !time_after (jiffies, timeout)) {if (sqt_spin) { -io_sq_update_worktime (sqd, &start); +io_sq_update_worktime (sqd, start); timeout = jiffies + sqd->sq_thread_idle; }if (unlikely (need_resched ())) {
io_uring/sqpoll.h +1 -0
@@ -29,6 +29,7 @@ void io_sq_thread_unpark(struct io_sq_davoid io_put_sq_data (struct io_sq_data *sqd);void io_sqpoll_wait_sq (struct io_ring_ctx *ctx);int io_sqpoll_wq_cpu_affinity (struct io_ring_ctx *ctx,cpumask_var_t mask); +u64 io_sq_cpu_usec (struct task_struct *tsk);static inline struct task_struct *sqpoll_task_locked (struct io_sq_data *sqd) {
Greg Kroah-Hartman
maintainerPATCH 70/184 io_uring/sqpoll: be smarter on when to update the stime usage
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit a94e0657269c5b8e1a90b17aa2c048b3d276e16d upstream.
The current approach is a bit naive, and hence calls the time querying way too often. Only start the "doing work" timer when there's actual work to do, and then use that information to terminate (and account) the work time once done. This greatly reduces the frequency of these calls, when they cannot have changed anyway.
Running a basic random reader that is setup to use SQPOLL, a profile before this change shows these as the top cycle consumers:
+ 32.60% iou-sqp-1074 [kernel.kallsyms] [k] thread_group_cputime_adjusted + 19.97% iou-sqp-1074 [kernel.kallsyms] [k] thread_group_cputime + 12.20% io_uring io_uring [.] submitter_uring_fn + 4.13% iou-sqp-1074 [kernel.kallsyms] [k] getrusage + 2.45% iou-sqp-1074 [kernel.kallsyms] [k] io_submit_sqes + 2.18% iou-sqp-1074 [kernel.kallsyms] [k] __pi_memset_generic + 2.09% iou-sqp-1074 [kernel.kallsyms] [k] cputime_adjust
and after this change, top of profile looks as follows:
+ 36.23% io_uring io_uring [.] submitter_uring_fn
+ 23.26% iou-sqp-819 [kernel.kallsyms] [k] io_sq_thread
+ 10.14% iou-sqp-819 [kernel.kallsyms] [k] io_sq_tw
+ 6.52% iou-sqp-819 [kernel.kallsyms] [k] tctx_task_work_run
+ 4.82% iou-sqp-819 [kernel.kallsyms] [k] nvme_submit_cmds.part.0
+ 2.91% iou-sqp-819 [kernel.kallsyms] [k] io_submit_sqes
[...]
0.02% iou-sqp-819 [kernel.kallsyms] [k] cputime_adjustwhere it's spending the cycles on things that actually matter.
--- io_uring/sqpoll.c | 43 ++++++++++++++++++++++++++++++++----------- 1 file changed, 32 insertions(+), 11 deletions(-)
io_uring/sqpoll.c +32 -11
@@ -170,6 +170,11 @@ static inline bool io_sqd_events_pendingreturn READ_ONCE (sqd->state); } +struct io_sq_time { +bool started; +u64 usec; +}; +u64 io_sq_cpu_usec (struct task_struct *tsk) {u64 utime, stime;
@@ -179,12 +184,24 @@ u64 io_sq_cpu_usec(struct task_struct *treturn stime; } -static void io_sq_update_worktime (struct io_sq_data *sqd,u64 usec) +static void io_sq_update_worktime (struct io_sq_data *sqd,struct io_sq_time *ist) { - sqd->work_time +=io_sq_cpu_usec (current) - usec; +if (!ist->started) +return ; + ist->started = false; + sqd->work_time +=io_sq_cpu_usec (current) - ist->usec; } -static int __io_sq_thread (struct io_ring_ctx *ctx,bool cap_entries) +static void io_sq_start_worktime (struct io_sq_time *ist) +{ +if (ist->started) +return ; + ist->started = true; + ist->usec =io_sq_cpu_usec (current); +} + +static int __io_sq_thread (struct io_ring_ctx *ctx,struct io_sq_data *sqd, +bool cap_entries,struct io_sq_time *ist) {unsigned int to_submit;int ret =0 ;
@@ -197,6 +214,8 @@ static int __io_sq_thread(struct io_ringif (to_submit || !wq_list_empty (&ctx->iopoll_list)) {const struct cred *creds =NULL ; +io_sq_start_worktime (ist); +if (ctx->sq_creds !=current_cred ()) creds =override_creds (ctx->sq_creds);
@@ -278,7 +297,6 @@ static int io_sq_thread(void *data)unsigned long timeout =0 ;char buf[TASK_COMM_LEN ] = {};DEFINE_WAIT (wait); -u64 start;/* offload context creation failed, just exit */ if (!current->io_uring) {
@@ -313,6 +331,7 @@ static int io_sq_thread(void *data)mutex_lock (&sqd->lock);while (1 ) {bool cap_entries, sqt_spin = false; +struct io_sq_time ist = { };if (io_sqd_events_pending (sqd) ||signal_pending (current)) {if (io_sqd_handle_event (sqd))
@@ -321,9 +340,8 @@ static int io_sq_thread(void *data) } cap_entries = !list_is_singular (&sqd->ctx_list); - start =io_sq_cpu_usec (current);list_for_each_entry (ctx, &sqd->ctx_list, sqd_list) { -int ret =__io_sq_thread (ctx, cap_entries); +int ret =__io_sq_thread (ctx, sqd, cap_entries, &ist);if (!sqt_spin && (ret >0 || !wq_list_empty (&ctx->iopoll_list))) sqt_spin = true;
@@ -331,15 +349,18 @@ static int io_sq_thread(void *data)if (io_sq_tw (&retry_list,IORING_TW_CAP_ENTRIES_VALUE )) sqt_spin = true; -list_for_each_entry (ctx, &sqd->ctx_list, sqd_list) -if (io_napi (ctx)) +list_for_each_entry (ctx, &sqd->ctx_list, sqd_list) { +if (io_napi (ctx)) { +io_sq_start_worktime (&ist);io_napi_sqpoll_busy_poll (ctx); + } + } + +io_sq_update_worktime (sqd, &ist);if (sqt_spin || !time_after (jiffies, timeout)) { -if (sqt_spin) { -io_sq_update_worktime (sqd, start); +if (sqt_spin) timeout = jiffies + sqd->sq_thread_idle; - }if (unlikely (need_resched ())) {mutex_unlock (&sqd->lock);cond_resched ();
Greg Kroah-Hartman
maintainerPATCH 71/184 btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dewei Meng <[email protected]>
commit 17679ac6df6c4830ba711835aa8cf961be36cfa1 upstream.
If fs_info->super_copy or fs_info->super_for_commit allocated failed in btrfs_get_tree_subvol(), then no need to call btrfs_free_fs_info(). Otherwise btrfs_check_leaked_roots() would access NULL pointer because fs_info->allocated_roots had not been initialised.
syzkaller reported the following information:
------------[ cut here ]------------ BUG: unable to handle page fault for address: fffffffffffffbb0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 64c9067 P4D 64c9067 PUD 64cb067 PMD 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 1402 Comm: syz.1.35 Not tainted 6.15.8 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), (...) RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:refcount_read include/linux/refcount.h:170 [inline] RIP: 0010:btrfs_check_leaked_roots+0x18f/0x2c0 fs/btrfs/disk-io.c:1230 [...] Call Trace: <TASK> btrfs_free_fs_info+0x310/0x410 fs/btrfs/disk-io.c:1280 btrfs_get_tree_subvol+0x592/0x6b0 fs/btrfs/super.c:2029 btrfs_get_tree+0x63/0x80 fs/btrfs/super.c:2097 vfs_get_tree+0x98/0x320 fs/super.c:1759 do_new_mount+0x357/0x660 fs/namespace.c:3899 path_mount+0x716/0x19c0 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount fs/namespace.c:4427 [inline] __x64_sys_mount+0x28c/0x310 fs/namespace.c:4427 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x92/0x180 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f032eaffa8d [...]
--- fs/btrfs/super.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/btrfs/super.c +7 -1
@@ -2070,7 +2070,13 @@ static int btrfs_get_tree_subvol(struct fs_info->super_copy =kzalloc (BTRFS_SUPER_INFO_SIZE ,GFP_KERNEL ); fs_info->super_for_commit =kzalloc (BTRFS_SUPER_INFO_SIZE ,GFP_KERNEL );if (!fs_info->super_copy || !fs_info->super_for_commit) { -btrfs_free_fs_info (fs_info); +/* +* Dont call btrfs_free_fs_info() to free it as it's still +* initialized partially. +*/ +kfree (fs_info->super_copy); +kfree (fs_info->super_for_commit); +kvfree (fs_info);return -ENOMEM ; }btrfs_init_fs_info (fs_info);
Greg Kroah-Hartman
maintainerPATCH 72/184 btrfs: send: fix duplicated rmdir operations when using extrefs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ting-Chang Hou <[email protected]>
commit 1fabe43b4e1a97597ec5d5ffcd2b7cf96e654b8f upstream.
Commit 29d6d30f5c8a ("Btrfs: send, don't send rmdir for same target multiple times") has fixed an issue that a send stream contained a rmdir operation for the same directory multiple times. After that fix we keep track of the last directory for which we sent a rmdir operation and compare with it before sending a rmdir for the parent inode of a deleted hardlink we are processing. But there is still a corner case that in between rmdir dir operations for the same inode we find deleted hardlinks for other parent inodes, so tracking just the last inode for which we sent a rmdir operation is not enough.
Hardlinks of a file in the same directory are stored in the same INODE_REF item, but if the number of hardlinks is too large and can not fit in a leaf, we use INODE_EXTREF items to store them. The key of an INODE_EXTREF item is (inode_id, INODE_EXTREF, hash[name, parent ino]), so between two hardlinks for the same parent directory, we can find others for other parent directories. For example for the reproducer below we get the following (from a btrfs inspect-internal dump-tree output):
item 0 key (259 INODE_EXTREF 2309449) itemoff 16257 itemsize 26
index 6925 parent 257 namelen 8 name: foo.6923
item 1 key (259 INODE_EXTREF 2311350) itemoff 16231 itemsize 26
index 6588 parent 258 namelen 8 name: foo.6587
item 2 key (259 INODE_EXTREF 2457395) itemoff 16205 itemsize 26
index 6611 parent 257 namelen 8 name: foo.6609
(...)So tracking the last directory's inode number does not work in this case since we process a link for parent inode 257, then for 258 and then back again for 257, and that second time we process a deleted link for 257 we think we have not yet sent a rmdir operation.
Fix this by using a rbtree to keep track of all the directories for which we have already sent rmdir operations, and add those directories to the 'check_dirs' ref list in process_recorded_refs() only if the directory is not yet in the rbtree, otherwise skip it since it means we have already sent a rmdir operation for that directory.
The following test script reproduces the problem:
$ cat test.sh #!/bin/bash
DEV=/dev/sdi
MNT=/mnt/sdi
mkfs.btrfs -f $DEV
mount $DEV $MNT
mkdir $MNT/a $MNT/b
echo 123 > $MNT/a/foo
for ((i = 1; i <= 1000; i++)); do
ln $MNT/a/foo $MNT/a/foo.$i
ln $MNT/a/foo $MNT/b/foo.$idone
btrfs subvolume snapshot -r $MNT $MNT/snap1
btrfs send $MNT/snap1 -f /tmp/base.send
rm -r $MNT/a $MNT/b
btrfs subvolume snapshot -r $MNT $MNT/snap2
btrfs send -p $MNT/snap1 $MNT/snap2 -f /tmp/incremental.send
umount $MNT
mkfs.btrfs -f $DEV
mount $DEV $MNT
btrfs receive $MNT -f /tmp/base.send
btrfs receive $MNT -f /tmp/incremental.send
rm -f /tmp/base.send /tmp/incremental.send
umount $MNT
When running it, it fails like this:
$ ./test.sh (...) At subvol snap1 At snapshot snap2 ERROR: rmdir o257-9-0 failed: No such file or directory
--- fs/btrfs/send.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 48 insertions(+), 8 deletions(-)
fs/btrfs/send.c +48 -8
@@ -4148,6 +4148,48 @@ out:return ret; } +static int rbtree_check_dir_ref_comp (const void *k,const struct rb_node *node) +{ +const struct recorded_ref *data = k; + const struct recorded_ref *ref = rb_entry(node, struct recorded_ref, node); + +if (data->dir > ref->dir) +return 1 ; +if (data->dir < ref->dir) +return -1 ; +if (data->dir_gen > ref->dir_gen) +return 1 ; +if (data->dir_gen < ref->dir_gen) +return -1 ; +return 0 ; +} + +static bool rbtree_check_dir_ref_less (struct rb_node *node,const struct rb_node *parent) +{ + const struct recorded_ref *entry = rb_entry(node, struct recorded_ref, node); + +return rbtree_check_dir_ref_comp (entry, parent) <0 ; +} + +static int record_check_dir_ref_in_tree (struct rb_root *root, +struct recorded_ref *ref,struct list_head *list) +{ +struct recorded_ref *tmp_ref; +int ret; + +if (rb_find (ref, root, rbtree_check_dir_ref_comp)) +return 0 ; + + ret =dup_ref (ref, list); +if (ret <0 ) +return ret; + + tmp_ref = list_last_entry(list, struct recorded_ref, list); +rb_add (&tmp_ref->node, root, rbtree_check_dir_ref_less); + tmp_ref->root = root; +return 0 ; +} +static int rename_current_inode (struct send_ctx *sctx,struct fs_path *current_path,struct fs_path *new_path)
@@ -4175,11 +4217,11 @@ static int process_recorded_refs(structstruct recorded_ref *cur;struct recorded_ref *cur2;LIST_HEAD (check_dirs); +struct rb_root rbtree_check_dirs =RB_ROOT ;struct fs_path *valid_path =NULL ;u64 ow_inode =0 ;u64 ow_gen;u64 ow_mode; -u64 last_dir_ino_rm =0 ;bool did_overwrite = false;bool is_orphan = false;bool can_rename = true;
@@ -4483,7 +4525,7 @@ static int process_recorded_refs(struct goto out; } } - ret =dup_ref (cur, &check_dirs); + ret =record_check_dir_ref_in_tree (&rbtree_check_dirs, cur, &check_dirs);if (ret <0 ) goto out; }
@@ -4511,7 +4553,7 @@ static int process_recorded_refs(struct }list_for_each_entry (cur, &sctx->deleted_refs, list) { - ret =dup_ref (cur, &check_dirs); + ret =record_check_dir_ref_in_tree (&rbtree_check_dirs, cur, &check_dirs);if (ret <0 ) goto out; }
@@ -4521,7 +4563,7 @@ static int process_recorded_refs(struct* We have a moved dir. Add the old parent to check_dirs */ cur = list_first_entry(&sctx->deleted_refs, struct recorded_ref, list); - ret =dup_ref (cur, &check_dirs); + ret =record_check_dir_ref_in_tree (&rbtree_check_dirs, cur, &check_dirs);if (ret <0 ) goto out; }else if (!S_ISDIR (sctx->cur_inode_mode)) {
@@ -4555,7 +4597,7 @@ static int process_recorded_refs(structif (is_current_inode_path (sctx, cur->full_path))fs_path_reset (&sctx->cur_inode_path); } - ret =dup_ref (cur, &check_dirs); + ret =record_check_dir_ref_in_tree (&rbtree_check_dirs, cur, &check_dirs);if (ret <0 ) goto out; }
@@ -4598,8 +4640,7 @@ static int process_recorded_refs(struct ret =cache_dir_utimes (sctx, cur->dir, cur->dir_gen);if (ret <0 ) goto out; - }else if (ret == inode_state_did_delete && - cur->dir != last_dir_ino_rm) { + }else if (ret == inode_state_did_delete) { ret =can_rmdir (sctx, cur->dir, cur->dir_gen);if (ret <0 ) goto out;
@@ -4611,7 +4652,6 @@ static int process_recorded_refs(struct ret =send_rmdir (sctx, valid_path);if (ret <0 ) goto out; - last_dir_ino_rm = cur->dir; } } }
Greg Kroah-Hartman
maintainerPATCH 73/184 btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Dhingra <[email protected]>
commit ada7d45b568abe4f1fd9c53d66e05fbea300674b upstream.
btrfs_extent_root()/btrfs_global_root() does not return error pointers, it returns NULL on error.
--- fs/btrfs/ref-verify.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/ref-verify.c +1 -1
@@ -982,7 +982,7 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) extent_root =btrfs_extent_root (fs_info,0 );/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ -if (IS_ERR (extent_root)) { +if (!extent_root) {btrfs_warn (fs_info,"ref-verify: extent tree not available, disabling" );btrfs_clear_opt (fs_info->mount_opt,REF_VERIFY );return 0 ;
Signature · 1 line
2.51.1
Greg Kroah-Hartman
maintainerPATCH 74/184 gpio: pci-idio-16: Define maximum valid register address offset
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
commit d37623132a6347b4ab9e2179eb3f2fa77863c364 upstream.
Attempting to load the pci-idio-16 module fails during regmap initialization with a return error -EINVAL. This is a result of the regmap cache failing initialization. Set the idio_16_regmap_config max_register member to fix this failure.
--- drivers/gpio/gpio-pci-idio-16.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpio-pci-idio-16.c +1 -0
@@ -41,6 +41,7 @@ static const struct regmap_config idio_1 .reg_stride = 1, .val_bits = 8, .io_port = true, + .max_register = 0x7, .wr_table = &idio_16_wr_table, .rd_table = &idio_16_rd_table, .volatile_table = &idio_16_rd_table,
Greg Kroah-Hartman
maintainerPATCH 75/184 gpio: 104-idio-16: Define maximum valid register address offset
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
commit c4d35e635f3a65aec291a6045cae8c99cede5bba upstream.
Attempting to load the 104-idio-16 module fails during regmap initialization with a return error -EINVAL. This is a result of the regmap cache failing initialization. Set the idio_16_regmap_config max_register member to fix this failure.
--- drivers/gpio/gpio-104-idio-16.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpio-104-idio-16.c +1 -0
@@ -59,6 +59,7 @@ static const struct regmap_config idio_1 .reg_stride = 1, .val_bits = 8, .io_port = true, + .max_register = 0x5, .wr_table = &idio_16_wr_table, .rd_table = &idio_16_rd_table, .volatile_table = &idio_16_rd_table,
Greg Kroah-Hartman
maintainerPATCH 76/184 xfs: fix locking in xchk_nlinks_collect_dir
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
commit f477af0cfa0487eddec66ffe10fd9df628ba6f52 upstream.
On a filesystem with parent pointers, xchk_nlinks_collect_dir walks both the directory entries (data fork) and the parent pointers (attr fork) to determine the correct link count. Unfortunately I forgot to update the lock mode logic to handle the case of a directory whose attr fork is in btree format and has not yet been loaded *and* whose data fork doesn't need loading.
This leads to a bunch of assertions from xfs/286 in xfs_iread_extents because we only took ILOCK_SHARED, not ILOCK_EXCL. You'd need the rare happenstance of a directory with a large number of non-pptr extended attributes set and enough memory pressure to cause the directory to be evicted and partially reloaded from disk.
I /think/ this only started in 6.18-rc1 because I've started seeing OOM errors with the maple tree slab using 70% of memory, and this didn't happen in 6.17. Yay dynamic systems!
--- fs/xfs/scrub/nlinks.c | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-)
fs/xfs/scrub/nlinks.c +31 -3
@@ -376,6 +376,36 @@ out_incomplete:return error; } +static uint +xchk_nlinks_ilock_dir ( +struct xfs_inode *ip) +{ +uint lock_mode =XFS_ILOCK_SHARED ; + +/* +* We're going to scan the directory entries, so we must be ready to +* pull the data fork mappings into memory if they aren't already. +*/ +if (xfs_need_iread_extents (&ip->i_df)) + lock_mode =XFS_ILOCK_EXCL ; + +/* +* We're going to scan the parent pointers, so we must be ready to +* pull the attr fork mappings into memory if they aren't already. +*/ +if (xfs_has_parent (ip->i_mount) &&xfs_inode_has_attr_fork (ip) && +xfs_need_iread_extents (&ip->i_af)) + lock_mode =XFS_ILOCK_EXCL ; + +/* +* Take the IOLOCK so that other threads cannot start a directory +* update while we're scanning. +*/ + lock_mode |=XFS_IOLOCK_SHARED ; +xfs_ilock (ip, lock_mode); +return lock_mode; +} +/* Walk a directory to bump the observed link counts of the children. */ STATIC int xchk_nlinks_collect_dir(
@@ -394,8 +424,7 @@ xchk_nlinks_collect_dir(return 0 ;/* Prevent anyone from changing this directory while we walk it. */ -xfs_ilock (dp,XFS_IOLOCK_SHARED ); - lock_mode =xfs_ilock_data_map_shared (dp); + lock_mode =xchk_nlinks_ilock_dir (dp);/* * The dotdot entry of an unlinked directory still points to the last
@@ -452,7 +481,6 @@ out_abort:xchk_iscan_abort (&xnc->collect_iscan); out_unlock:xfs_iunlock (dp, lock_mode); -xfs_iunlock (dp,XFS_IOLOCK_SHARED );return error; }
Greg Kroah-Hartman
maintainerPATCH 77/184 platform/x86: alienware-wmi-wmax: Add AWCC support to Dell G15 5530
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: tr1x_em <[email protected]>
commit 34cbd6e07fddf36e186c8bf26a456fb7f50af44e upstream.
Makes alienware-wmi load on G15 5530 by default
--- drivers/platform/x86/dell/alienware-wmi-wmax.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/platform/x86/dell/alienware-wmi-wmax.c +8 -0
@@ -210,6 +210,14 @@ static const struct dmi_system_id awcc_d .driver_data = &g_series_quirks, }, { + .ident = "Dell Inc. G15 5530", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5530"), + }, + .driver_data = &g_series_quirks, + }, + { .ident ="Dell Inc. G16 7630" , .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
Greg Kroah-Hartman
maintainerPATCH 78/184 platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
commit a49c4d48c3b60926e6a8cec217bf95aa65388ecc upstream.
Devices without the AWCC interface don't initialize awcc. Add a check before dereferencing it in sleep handlers.
--- drivers/platform/x86/dell/alienware-wmi-wmax.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/dell/alienware-wmi-wmax.c +2 -2
@@ -1647,7 +1647,7 @@ static int wmax_wmi_probe(struct wmi_devstatic int wmax_wmi_suspend (struct device *dev) { -if (awcc->hwmon) +if (awcc && awcc->hwmon)awcc_hwmon_suspend (dev);return 0 ;
@@ -1655,7 +1655,7 @@ static int wmax_wmi_suspend(struct devicstatic int wmax_wmi_resume (struct device *dev) { -if (awcc->hwmon) +if (awcc && awcc->hwmon)awcc_hwmon_resume (dev);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 79/184 Revert "cpuidle: menu: Avoid discarding useful information"
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 10fad4012234a7dea621ae17c0c9486824f645a0 upstream.
It is reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") led to a performance regression on Intel Jasper Lake systems because it reduced the time spent by CPUs in idle state C7 which is correlated to the maximum frequency the CPUs can get to because of an average running power limit [1].
Before that commit, get_typical_interval() would have returned UINT_MAX whenever it had been unable to make a high-confidence prediction which had led to selecting the deepest available idle state too often and both power and performance had been inadequate as a result of that on some systems. However, this had not been a problem on systems with relatively aggressive average running power limits, like the Jasper Lake systems in question, because on those systems it was compensated by the ability to run CPUs faster.
It was addressed by causing get_typical_interval() to return a number based on the recent idle duration information available to it even if it could not make a high-confidence prediction, but that clearly did not take the possible correlation between idle power and available CPU capacity into account.
For this reason, revert most of the changes made by commit 85975daeaa4d, except for one cosmetic cleanup, and add a comment explaining the rationale for returning UINT_MAX from get_typical_interval() when it is unable to make a high-confidence prediction.
--- drivers/cpuidle/governors/menu.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
drivers/cpuidle/governors/menu.c +9 -12
@@ -188,20 +188,17 @@ again:* * This can deal with workloads that have long pauses interspersed * with sporadic activity with a bunch of short pauses. +* +* However, if the number of remaining samples is too small to exclude +* any more outliers, allow the deepest available idle state to be +* selected because there are systems where the time spent by CPUs in +* deep idle states is correlated to the maximum frequency the CPUs +* can get to. On those systems, shallow idle states should be avoided +* unless there is a clear indication that the given CPU is most likley +* going to be woken up shortly. */ -if (divisor *4 <=INTERVALS *3 ) { -/* -* If there are sufficiently many data points still under -* consideration after the outliers have been eliminated, -* returning without a prediction would be a mistake because it -* is likely that the next interval will not exceed the current -* maximum, so return the latter in that case. -*/ -if (divisor >=INTERVALS /2 ) -return max; - +if (divisor *4 <=INTERVALS *3 )return UINT_MAX ; - }/* Update the thresholds for the next round. */ if (avg - min > max - avg)
Greg Kroah-Hartman
maintainerPATCH 80/184 riscv: cpufeature: avoid uninitialized variable in has_thead_homogeneous_vlenb()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Walmsley <[email protected]>
commit 2dc99ea2727640b2fe12f9aa0e38ea2fc3cbb92d upstream.
In has_thead_homogeneous_vlenb(), smatch detected that the vlenb variable could be used while uninitialized. It appears that this could happen if no CPUs described in DT have the "thead,vlenb" property.
Fix by initializing vlenb to 0, which will keep thead_vlenb_of set to 0 (as it was statically initialized). This in turn will cause riscv_v_setup_vsize() to fall back to CSR probing - the desired result if thead,vlenb isn't provided in the DT data.
While here, fix a nearby comment typo.
--- arch/riscv/kernel/cpufeature.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kernel/cpufeature.c +2 -2
@@ -932,9 +932,9 @@ static int has_thead_homogeneous_vlenb(v {int cpu;u32 prev_vlenb =0 ; -u32 vlenb; +u32 vlenb =0 ; -/* Ignore thead,vlenb property if xtheavector is not enabled in the kernel */ +/* Ignore thead,vlenb property if xtheadvector is not enabled in the kernel */ if (!IS_ENABLED (CONFIG_RISCV_ISA_XTHEADVECTOR ))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 81/184 rust: device: fix device context of Device::parent()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
commit cfec502b3d091ff7c24df6ccf8079470584315a0 upstream.
Regardless of the DeviceContext of a device, we can't give any guarantees about the DeviceContext of its parent device.
This is very subtle, since it's only caused by a simple typo, i.e.
Self::from_raw(parent)
which preserves the DeviceContext in this case, vs.
Device::from_raw(parent)
which discards the DeviceContext.
(I should have noticed it doing the correct thing in auxiliary::Device subsequently, but somehow missed it.)
Hence, fix both Device::parent() and auxiliary::Device::parent().
--- rust/kernel/auxiliary.rs | 8 +------- rust/kernel/device.rs | 4 ++-- 2 files changed, 3 insertions(+), 9 deletions(-)
rust/kernel/auxiliary.rs +1 -7
@@ -217,13 +217,7 @@ impl<Ctx: device::DeviceContext> Device</// Returns a reference to the parent [`device::Device`], if any. pub fn parent (&self) ->Option <&device::Device > { -let ptr: *const Self = self; -// CAST: `Device<Ctx: DeviceContext>` types are transparent to each other. -let ptr: *const Device = ptr.cast (); -// SAFETY: `ptr` was derived from `&self`. -let this =unsafe { &*ptr }; - - this.as_ref ().parent () + self.as_ref ().parent () } }
rust/kernel/device.rs +2 -2
@@ -250,7 +250,7 @@ impl<Ctx: DeviceContext> Device<Ctx> {/// Returns a reference to the parent device, if any. #[cfg_attr(not( CONFIG_AUXILIARY_BUS ), expect(dead_code))] -pub (crate )fn parent (&self) ->Option <&Self > { +pub (crate )fn parent (&self) ->Option <&Device > {// SAFETY: // - By the type invariant `self.as_raw()` is always valid. // - The parent device is only ever set at device creation.
@@ -263,7 +263,7 @@ impl<Ctx: DeviceContext> Device<Ctx> {// - Since `parent` is not NULL, it must be a valid pointer to a `struct device`. // - `parent` is valid for the lifetime of `self`, since a `struct device` holds a // reference count of its parent. -Some (unsafe {Self ::from_raw (parent) }) +Some (unsafe {Device ::from_raw (parent) }) } }
Greg Kroah-Hartman
maintainerPATCH 82/184 slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
commit 6ed8bfd24ce1cb31742b09a3eb557cd008533eec upstream.
If two competing threads enter alloc_slab_obj_exts() and one of them fails to allocate the object extension vector, it might override the valid slab->obj_exts allocated by the other thread with OBJEXTS_ALLOC_FAIL. This will cause the thread that lost this race and expects a valid pointer to dereference a NULL pointer later on.
Update slab->obj_exts atomically using cmpxchg() to avoid slab->obj_exts overrides by racing threads.
Thanks for Vlastimil and Suren's help with debugging.
--- mm/slub.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
mm/slub.c +6 -3
@@ -1978,7 +1978,7 @@ static inline void mark_objexts_empty(ststatic inline void mark_failed_objexts_alloc (struct slab *slab) { - slab->obj_exts =OBJEXTS_ALLOC_FAIL ; +cmpxchg (&slab->obj_exts,0 ,OBJEXTS_ALLOC_FAIL ); } static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
@@ -2043,6 +2043,7 @@ int alloc_slab_obj_exts(struct slab *sla#ifdef CONFIG_MEMCG new_exts |=MEMCG_DATA_OBJEXTS ;#endif +retry: old_exts =READ_ONCE (slab->obj_exts);handle_failed_objexts_alloc (old_exts, vec, objects);if (new_slab) {
@@ -2052,8 +2053,7 @@ int alloc_slab_obj_exts(struct slab *sla* be simply assigned. */ slab->obj_exts = new_exts; - }else if ((old_exts & ~OBJEXTS_FLAGS_MASK ) || -cmpxchg (&slab->obj_exts, old_exts, new_exts) != old_exts) { + }else if (old_exts & ~OBJEXTS_FLAGS_MASK ) {/* * If the slab is already in use, somebody can allocate and * assign slabobj_exts in parallel. In this case the existing
@@ -2062,6 +2062,9 @@ int alloc_slab_obj_exts(struct slab *slamark_objexts_empty (vec);kfree (vec);return 0 ; + }else if (cmpxchg (&slab->obj_exts, old_exts, new_exts) != old_exts) { +/* Retry if a racing thread changed slab->obj_exts from under us. */ + goto retry; }kmemleak_not_leak (vec);
Greg Kroah-Hartman
maintainerPATCH 83/184 slab: Fix obj_ext mistakenly considered NULL due to race condition
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
commit 7f434e1d9a17ca5f567c9796c9c105a65c18db9a upstream.
If two competing threads enter alloc_slab_obj_exts(), and the one that allocates the vector wins the cmpxchg(), the other thread that failed allocation mistakenly assumes that slab->obj_exts is still empty due to its own allocation failure. This will then trigger warnings with CONFIG_MEM_ALLOC_PROFILING_DEBUG checks in the subsequent free path.
Therefore, let's check the result of cmpxchg() to see if marking the allocation as failed was successful. If it wasn't, check whether the winning side has succeeded its allocation (it might have been also marking it as failed) and if yes, return success.
--- mm/slub.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
mm/slub.c +11 -5
@@ -1976,9 +1976,9 @@ static inline void mark_objexts_empty(st } } -static inline void mark_failed_objexts_alloc (struct slab *slab) +static inline bool mark_failed_objexts_alloc (struct slab *slab) { -cmpxchg (&slab->obj_exts,0 ,OBJEXTS_ALLOC_FAIL ); +return cmpxchg (&slab->obj_exts,0 ,OBJEXTS_ALLOC_FAIL ) ==0 ; } static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
@@ -2000,7 +2000,7 @@ static inline void handle_failed_objexts#else /* CONFIG_MEM_ALLOC_PROFILING_DEBUG */ static inline void mark_objexts_empty (struct slabobj_ext *obj_exts) {} -static inline void mark_failed_objexts_alloc (struct slab *slab) {} +static inline bool mark_failed_objexts_alloc (struct slab *slab) {return false; }static inline void handle_failed_objexts_alloc (unsigned long obj_exts,struct slabobj_ext *vec,unsigned int objects) {}
@@ -2033,8 +2033,14 @@ int alloc_slab_obj_exts(struct slab *sla vec =kcalloc_node (objects,sizeof (struct slabobj_ext ), gfp,slab_nid (slab));if (!vec) { -/* Mark vectors which failed to allocate */ -mark_failed_objexts_alloc (slab); +/* +* Try to mark vectors which failed to allocate. +* If this operation fails, there may be a racing process +* that has already completed the allocation. +*/ +if (!mark_failed_objexts_alloc (slab) && +slab_obj_exts (slab)) +return 0 ;return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 84/184 smb: client: get rid of d_drop() in cifs_do_rename()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
commit 72ed55b4c335703c203b942972558173e1e5ddee upstream.
There is no need to force a lookup by unhashing the moved dentry after successfully renaming the file on server. The file metadata will be re-fetched from server, if necessary, in the next call to ->d_revalidate() anyways.
--- fs/smb/client/inode.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
fs/smb/client/inode.c +1 -4
@@ -2484,11 +2484,8 @@ cifs_do_rename(const unsigned int xid, s }#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ do_rename_exit: -if (rc ==0 ) { +if (rc ==0 )d_move (from_dentry, to_dentry); -/* Force a new lookup */ -d_drop (from_dentry); - }cifs_put_tlink (tlink);return rc; }
Greg Kroah-Hartman
maintainerPATCH 85/184 ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
commit 6e3a4754717a74e931a9f00b5f953be708e07acb upstream.
When ACPI_MISALIGNMENT_NOT_SUPPORTED is set, GCC can produce a bogus -Wstringop-overread warning, see [1].
To me, it's very clear that we have a compiler bug here, thus just disable the warning.
--- drivers/acpi/acpica/tbprint.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/acpica/tbprint.c +6 -0
@@ -95,6 +95,11 @@ acpi_tb_print_table_header(acpi_physical {struct acpi_table_header local_header; +#pragma GCC diagnostic push +#if defined(__GNUC__) && __GNUC__ >=11 +#pragma GCC diagnostic ignored "-Wstringop-overread" +#endif +if (ACPI_COMPARE_NAMESEG (header->signature,ACPI_SIG_FACS )) {/* FACS only has signature and length fields */
@@ -135,4 +140,5 @@ acpi_tb_print_table_header(acpi_physical local_header.asl_compiler_id, local_header.asl_compiler_revision)); } +#pragma GCC diagnostic pop }
Greg Kroah-Hartman
maintainerPATCH 86/184 arm64: mte: Do not warn if the page is already tagged in copy_highpage()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit b98c94eed4a975e0c80b7e90a649a46967376f58 upstream.
The arm64 copy_highpage() assumes that the destination page is newly allocated and not MTE-tagged (PG_mte_tagged unset) and warns accordingly. However, following commit 060913999d7a ("mm: migrate:
support poisoned recover from migrate folio"), folio_mc_copy() is called before __folio_migrate_mapping(). If the latter fails (-EAGAIN), the copy will be done again to the same destination page. Since copy_highpage() already set the PG_mte_tagged flag, this second copy will warn.
Replace the WARN_ON_ONCE(page already tagged) in the arm64 copy_highpage() with a comment.
--- arch/arm64/mm/copypage.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
arch/arm64/mm/copypage.c +8 -3
@@ -35,7 +35,7 @@ void copy_highpage(struct page *to, stru from != folio_page(src, 0))return ; -WARN_ON_ONCE (!folio_try_hugetlb_mte_tagging (dst)); +folio_try_hugetlb_mte_tagging (dst);/* * Populate tags for all subpages.
@@ -51,8 +51,13 @@ void copy_highpage(struct page *to, stru }folio_set_hugetlb_mte_tagged (dst); }else if (page_mte_tagged (from)) { -/* It's a new page, shouldn't have been tagged yet */ -WARN_ON_ONCE (!try_page_mte_tagging (to)); +/* +* Most of the time it's a new page that shouldn't have been +* tagged yet. However, folio migration can end up reusing the +* same page without untagging it. Ignore the warning if the +* page is already tagged. +*/ +try_page_mte_tagging (to);mte_copy_page_tags (kto, kfrom);set_page_mte_tagged (to);
Greg Kroah-Hartman
maintainerPATCH 87/184 can: netlink: can_changelink(): allow disabling of automatic restart
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 8e93ac51e4c6dc399fad59ec21f55f2cfb46d27c upstream.
Since the commit c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode"), the automatic restart delay can only be set for devices that implement the restart handler struct can_priv::do_set_mode. As it makes no sense to configure a automatic restart for devices that doesn't support it.
However, since systemd commit 13ce5d4632e3 ("network/can: properly handle CAN.RestartSec=0") [1], systemd-networkd correctly handles a restart delay of "0" (i.e. the restart is disabled). Which means that a disabled restart is always configured in the kernel.
On systems with both changes active this causes that CAN interfaces that don't implement a restart handler cannot be brought up by systemd-networkd.
Solve this problem by allowing a delay of "0" to be configured, even if the device does not implement a restart handler.
[1] https://github.com/systemd/systemd/commit/13ce5d4632e395521e6205c954493c7fc1c4c6e0
--- drivers/net/can/dev/netlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/can/dev/netlink.c +4 -2
@@ -285,7 +285,9 @@ static int can_changelink(struct net_dev }if (data[IFLA_CAN_RESTART_MS ]) { -if (!priv->do_set_mode) { +unsigned int restart_ms =nla_get_u32 (data[IFLA_CAN_RESTART_MS ]); + +if (restart_ms !=0 && !priv->do_set_mode) {NL_SET_ERR_MSG (extack,"Device doesn't support restart from Bus Off" );return -EOPNOTSUPP ;
@@ -294,7 +296,7 @@ static int can_changelink(struct net_dev/* Do not allow changing restart delay while running */ if (dev->flags &IFF_UP )return -EBUSY ; - priv->restart_ms =nla_get_u32 (data[IFLA_CAN_RESTART_MS ]); + priv->restart_ms = restart_ms; }if (data[IFLA_CAN_RESTART ]) {
Greg Kroah-Hartman
maintainerPATCH 88/184 cifs: Fix TCP_Server_Info::credits to be signed
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 5b2ff4873aeab972f919d5aea11c51393322bf58 upstream.
Fix TCP_Server_Info::credits to be signed, just as echo_credits and oplock_credits are. This also fixes what ought to get at least a compilation warning if not an outright error in *get_credits_field() as a pointer to the unsigned server->credits field is passed back as a pointer to a signed int.
--- fs/smb/client/cifsglob.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/cifsglob.h +1 -1
@@ -740,7 +740,7 @@ struct TCP_Server_Info {bool nosharesock;bool tcp_nodelay;bool terminate; -unsigned int credits;/* send no more requests at once */ +int credits;/* send no more requests at once */ unsigned int max_credits;/* can override large 32000 default at mnt */ unsigned int in_flight;/* number of requests on the wire to server */ unsigned int max_in_flight;/* max number of requests that were on wire */
Greg Kroah-Hartman
maintainerPATCH 89/184 devcoredump: Fix circular locking dependency with devcd->mutex.
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
commit a91c8096590bd7801a26454789f2992094fe36da upstream.
The original code causes a circular locking dependency found by lockdep.
======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 Tainted: G S U
------------------------------------------------------
xe_fault_inject/5091 is trying to acquire lock:ffff888156815688 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}, at: __flush_work+0x25d/0x660
but task is already holding lock:
ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&devcd->mutex){+.+.}-{3:3}:
mutex_lock_nested+0x4e/0xc0
devcd_data_write+0x27/0x90
sysfs_kf_bin_write+0x80/0xf0
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #1 (kn->active#236){++++}-{0:0}:
kernfs_drain+0x1e2/0x200
__kernfs_remove+0xae/0x400
kernfs_remove_by_name_ns+0x5d/0xc0
remove_files+0x54/0x70
sysfs_remove_group+0x3d/0xa0
sysfs_remove_groups+0x2e/0x60
device_remove_attrs+0xc7/0x100
device_del+0x15d/0x3b0
devcd_del+0x19/0x30
process_one_work+0x22b/0x6f0
worker_thread+0x1e8/0x3d0
kthread+0x11c/0x250
ret_from_fork+0x26c/0x2e0
ret_from_fork_asm+0x1a/0x30
-> #0 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}:
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
__flush_work+0x27a/0x660
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
other info that might help us debug this:
Chain exists of: (work_completion)(&(&devcd->del_wk)->work) --> kn->active#236 --> &devcd->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&devcd->mutex);
lock(kn->active#236);
lock(&devcd->mutex);
lock((work_completion)(&(&devcd->del_wk)->work));
*** DEADLOCK ***
5 locks held by xe_fault_inject/5091:
#0: ffff8881129f9488 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x72/0xf0
#1: ffff88810c755078 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x123/0x220
#2: ffff8881054811a0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x55/0x280
#3: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0
#4: ffffffff8359e020 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x72/0x660
stack backtrace:
CPU: 14 UID: 0 PID: 5091 Comm: xe_fault_inject Tainted: G S U 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 PREEMPT_{RT,(lazy)}
Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
Hardware name: Micro-Star International Co., Ltd. MS-7D25/PRO Z690-A DDR4(MS-7D25), BIOS 1.10 12/13/2021
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
dump_stack+0x10/0x20
print_circular_bug+0x285/0x360
check_noncircular+0x135/0x150
? register_lock_class+0x48/0x4a0
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
? __flush_work+0x25d/0x660
? mark_held_locks+0x46/0x90
? __flush_work+0x25d/0x660
__flush_work+0x27a/0x660
? __flush_work+0x25d/0x660
? trace_hardirqs_on+0x1e/0xd0
? __pfx_wq_barrier_func+0x10/0x10
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
? bus_find_device+0xa8/0xe0
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
? __f_unlock_pos+0x15/0x20
? __x64_sys_getdents64+0x9b/0x130
? __pfx_filldir64+0x10/0x10
? do_syscall_64+0x1a2/0xb60
? clear_bhb_loop+0x30/0x80
? clear_bhb_loop+0x30/0x80
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x76e292edd574
Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
RSP: 002b:00007fffe247a828 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000076e292edd574
RDX: 000000000000000c RSI: 00006267f6306063 RDI: 000000000000000b
RBP: 000000000000000c R08: 000076e292fc4b20 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00006267f6306063
R13: 000000000000000b R14: 00006267e6859c00 R15: 000076e29322a000
</TASK>xe 0000:03:00.0: [drm] Xe device coredump has been deleted.
--- drivers/base/devcoredump.c | 136 +++++++++++++++++++++++++++------------------ 1 file changed, 83 insertions(+), 53 deletions(-)
drivers/base/devcoredump.c +83 -53
@@ -23,50 +23,46 @@ struct devcd_entry {void *data;size_t datalen;/* -* Here, mutex is required to serialize the calls to del_wk work between -* user/kernel space which happens when devcd is added with device_add() -* and that sends uevent to user space. User space reads the uevents, -* and calls to devcd_data_write() which try to modify the work which is -* not even initialized/queued from devcoredump. +* There are 2 races for which mutex is required. * +* The first race is between device creation and userspace writing to +* schedule immediately destruction. * +* This race is handled by arming the timer before device creation, but +* when device creation fails the timer still exists. * -* cpu0(X) cpu1(Y) +* To solve this, hold the mutex during device_add(), and set +* init_completed on success before releasing the mutex. * -* dev_coredump() uevent sent to user space -* device_add() ======================> user space process Y reads the -* uevents writes to devcd fd -* which results into writes to +* That way the timer will never fire until device_add() is called, +* it will do nothing if init_completed is not set. The timer is also +* cancelled in that case. * -* devcd_data_write() -* mod_delayed_work() -* try_to_grab_pending() -* timer_delete() -* debug_assert_init() -* INIT_DELAYED_WORK() -* schedule_delayed_work() -* -* -* Also, mutex alone would not be enough to avoid scheduling of -* del_wk work after it get flush from a call to devcd_free() -* mentioned as below. -* -* disabled_store() -* devcd_free() -* mutex_lock() devcd_data_write() -* flush_delayed_work() -* mutex_unlock() -* mutex_lock() -* mod_delayed_work() -* mutex_unlock() -* So, delete_work flag is required. +* The second race involves multiple parallel invocations of devcd_free(), +* add a deleted flag so only 1 can call the destructor. */ struct mutex mutex; -bool delete_work; +bool init_completed, deleted;struct module *owner;ssize_t (*read)(char *buffer,loff_t offset,size_t count,void *data,size_t datalen);void (*free)(void *data); +/* +* If nothing interferes and device_add() was returns success, +* del_wk will destroy the device after the timer fires. +* +* Multiple userspace processes can interfere in the working of the timer: +* - Writing to the coredump will reschedule the timer to run immediately, +* if still armed. +* +* This is handled by using "if (cancel_delayed_work()) { +* schedule_delayed_work() }", to prevent re-arming after having +* been previously fired. +* - Writing to /sys/class/devcoredump/disabled will destroy the +* coredump synchronously. +* This is handled by using disable_delayed_work_sync(), and then +* checking if deleted flag is set with &devcd->mutex held. +*/ struct delayed_work del_wk;struct device *failing_dev; };
@@ -95,14 +91,27 @@ static void devcd_dev_release(struct devkfree (devcd); } +static void __devcd_del (struct devcd_entry *devcd) +{ + devcd->deleted = true; +device_del (&devcd->devcd_dev); +put_device (&devcd->devcd_dev); +} +static void devcd_del (struct work_struct *wk) {struct devcd_entry *devcd; +bool init_completed; devcd = container_of(wk, struct devcd_entry, del_wk.work); -device_del (&devcd->devcd_dev); -put_device (&devcd->devcd_dev); +/* devcd->mutex serializes against dev_coredumpm_timeout */ +mutex_lock (&devcd->mutex); + init_completed = devcd->init_completed; +mutex_unlock (&devcd->mutex); + +if (init_completed) +__devcd_del (devcd); } static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj,
@@ -122,12 +131,12 @@ static ssize_t devcd_data_write(struct fstruct device *dev =kobj_to_dev (kobj);struct devcd_entry *devcd =dev_to_devcd (dev); -mutex_lock (&devcd->mutex); -if (!devcd->delete_work) { - devcd->delete_work = true; -mod_delayed_work (system_wq, &devcd->del_wk,0 ); - } -mutex_unlock (&devcd->mutex); +/* +* Although it's tempting to use mod_delayed work here, +* that will cause a reschedule if the timer already fired. +*/ +if (cancel_delayed_work (&devcd->del_wk)) +schedule_delayed_work (&devcd->del_wk,0 );return count; }
@@ -151,11 +160,21 @@ static int devcd_free(struct device *dev {struct devcd_entry *devcd =dev_to_devcd (dev); +/* +* To prevent a race with devcd_data_write(), disable work and +* complete manually instead. +* +* We cannot rely on the return value of +* disable_delayed_work_sync() here, because it might be in the +* middle of a cancel_delayed_work + schedule_delayed_work pair. +* +* devcd->mutex here guards against multiple parallel invocations +* of devcd_free(). +*/ +disable_delayed_work_sync (&devcd->del_wk);mutex_lock (&devcd->mutex); -if (!devcd->delete_work) - devcd->delete_work = true; - -flush_delayed_work (&devcd->del_wk); +if (!devcd->deleted) +__devcd_del (devcd);mutex_unlock (&devcd->mutex);return 0 ; }
@@ -179,12 +198,10 @@ static ssize_t disabled_show(const struc* put_device() <- last reference * error = fn(dev, data) devcd_dev_release() * devcd_free(dev, data) kfree(devcd) -* mutex_lock(&devcd->mutex); * * * In the above diagram, it looks like disabled_store() would be racing with parallelly -* running devcd_del() and result in memory abort while acquiring devcd->mutex which -* is called after kfree of devcd memory after dropping its last reference with +* running devcd_del() and result in memory abort after dropping its last reference with * put_device(). However, this will not happens as fn(dev, data) runs * with its own reference to device via klist_node so it is not its last reference. * so, above situation would not occur.
@@ -374,7 +391,7 @@ void dev_coredumpm_timeout(struct device devcd->read = read; devcd->free = free; devcd->failing_dev =get_device (dev); - devcd->delete_work = false; + devcd->deleted = false;mutex_init (&devcd->mutex);device_initialize (&devcd->devcd_dev);
@@ -383,8 +400,14 @@ void dev_coredumpm_timeout(struct device atomic_inc_return(&devcd_count)); devcd->devcd_dev.class = &devcd_class; -mutex_lock (&devcd->mutex);dev_set_uevent_suppress (&devcd->devcd_dev, true); + +/* devcd->mutex prevents devcd_del() completing until init finishes */ +mutex_lock (&devcd->mutex); + devcd->init_completed = false; +INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); +schedule_delayed_work (&devcd->del_wk, timeout); +if (device_add (&devcd->devcd_dev)) goto put_device;
@@ -401,13 +424,20 @@ void dev_coredumpm_timeout(struct devicedev_set_uevent_suppress (&devcd->devcd_dev, false);kobject_uevent (&devcd->devcd_dev.kobj,KOBJ_ADD ); -INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); -schedule_delayed_work (&devcd->del_wk, timeout); + +/* +* Safe to run devcd_del() now that we are done with devcd_dev. +* Alternatively we could have taken a ref on devcd_dev before +* dropping the lock. +*/ + devcd->init_completed = true;mutex_unlock (&devcd->mutex);return ; put_device: -put_device (&devcd->devcd_dev);mutex_unlock (&devcd->mutex); +cancel_delayed_work_sync (&devcd->del_wk); +put_device (&devcd->devcd_dev); + put_module:module_put (owner); free:
Greg Kroah-Hartman
maintainerPATCH 90/184 hwmon: (pmbus/max34440) Update adpm12160 coeff due to latest FW
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexis Czezar Torreno <[email protected]>
commit 41de7440e6a00b8e70a068c50e3fba2f56302e8a upstream.
adpm12160 is a dc-dc power module. The firmware was updated and the coeeficients in the pmbus_driver_info needs to be updated. Since the part has not yet released with older FW, this permanent change to reflect the latest should be ok.
--- drivers/hwmon/pmbus/max34440.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/hwmon/pmbus/max34440.c +6 -6
@@ -336,18 +336,18 @@ static struct pmbus_driver_info max34440 .format[PSC_CURRENT_IN] = direct, .format[PSC_CURRENT_OUT] = direct, .format[PSC_TEMPERATURE] = direct, - .m[PSC_VOLTAGE_IN] = 1, + .m[PSC_VOLTAGE_IN] = 125, .b[PSC_VOLTAGE_IN] = 0, .R[PSC_VOLTAGE_IN] = 0, - .m[PSC_VOLTAGE_OUT] = 1, + .m[PSC_VOLTAGE_OUT] = 125, .b[PSC_VOLTAGE_OUT] = 0, .R[PSC_VOLTAGE_OUT] = 0, - .m[PSC_CURRENT_IN] = 1, + .m[PSC_CURRENT_IN] = 250, .b[PSC_CURRENT_IN] = 0, - .R[PSC_CURRENT_IN] = 2, - .m[PSC_CURRENT_OUT] = 1, + .R[PSC_CURRENT_IN] = -1, + .m[PSC_CURRENT_OUT] = 250, .b[PSC_CURRENT_OUT] = 0, - .R[PSC_CURRENT_OUT] = 2, + .R[PSC_CURRENT_OUT] = -1, .m[PSC_TEMPERATURE] = 1, .b[PSC_TEMPERATURE] = 0, .R[PSC_TEMPERATURE] = 2,
Greg Kroah-Hartman
maintainerPATCH 91/184 MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit bf5570590a981d0659d0808d2d4bcda21b27a2a5 upstream.
MIPS Malta platform code registers the PCI southbridge legacy port I/O PS/2 keyboard range as a standard resource marked as busy. It prevents the i8042 driver from registering as it fails to claim the resource in a call to i8042_platform_init(). Consequently PS/2 keyboard and mouse devices cannot be used with this platform.
Fix the issue by removing the busy marker from the standard reservation, making the driver register successfully:
serio: i8042 KBD port at 0x60,0x64 irq 1
serio: i8042 AUX port at 0x60,0x64 irq 12
and the resource show up as expected among the legacy devices:
00000000-00ffffff : MSC PCI I/O
00000000-0000001f : dma1
00000020-00000021 : pic1
00000040-0000005f : timer
00000060-0000006f : keyboard
00000060-0000006f : i8042
00000070-00000077 : rtc0
00000080-0000008f : dma page reg
000000a0-000000a1 : pic2
000000c0-000000df : dma2
[...]If the i8042 driver has not been configured, then the standard resource will remain there preventing any conflicting dynamic assignment of this PCI port I/O address range.
--- arch/mips/mti-malta/malta-setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/mti-malta/malta-setup.c +1 -1
@@ -47,7 +47,7 @@ static struct resource standard_io_resou .name = "keyboard", .start = 0x60, .end = 0x6f, - .flags =IORESOURCE_IO |IORESOURCE_BUSY + .flags =IORESOURCE_IO }, { .name = "dma page reg",
Greg Kroah-Hartman
maintainerPATCH 92/184 ocfs2: clear extent cache after moving/defragmenting extents
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 78a63493f8e352296dbc7cb7b3f4973105e8679e upstream.
The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().
The problem occurs when:
1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
2. ioctl(FITRIM) triggers ocfs2_move_extents()
3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
5. The extent map cache is not invalidated after the move
6. Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers
Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.
--- fs/ocfs2/move_extents.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ocfs2/move_extents.c +5 -0
@@ -867,6 +867,11 @@ static int __ocfs2_move_extents_range(stmlog_errno (ret); goto out; } +/* +* Invalidate extent cache after moving/defragging to prevent +* stale cached data with outdated extent flags. +*/ +ocfs2_extent_map_trunc (inode, cpos); context->clusters_moved += alloc_size; next:
Greg Kroah-Hartman
maintainerPATCH 93/184 Fully convert enabled_monitors to use list_head as iterator
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 103541e6a5854b08a25e4caa61e990af1009a52e upstream.
The callbacks in enabled_monitors_seq_ops are inconsistent. Some treat the iterator as struct rv_monitor *, while others treat the iterator as struct list_head *.
This causes a wrong type cast and crashes the system as reported by Nathan.
Convert everything to use struct list_head * as iterator. This also makes enabled_monitors consistent with available_monitors.
--- kernel/trace/rv/rv.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
kernel/trace/rv/rv.c +6 -6
@@ -501,7 +501,7 @@ static void *enabled_monitors_next(struct seq_file *m, void *p, loff_t *pos)list_for_each_entry_continue (mon, &rv_monitors_list, list) {if (mon->enabled) -return mon; +return &mon->list; }return NULL ;
@@ -509,7 +509,7 @@ static void *enabled_monitors_next(struct seq_file *m, void *p, loff_t *pos)static void *enabled_monitors_start (struct seq_file *m,loff_t *pos) { -struct rv_monitor *mon; +struct list_head *head;loff_t l;mutex_lock (&rv_interface_lock);
@@ -517,15 +517,15 @@ static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)if (list_empty (&rv_monitors_list))return NULL ; - mon = list_entry(&rv_monitors_list, struct rv_monitor, list); + head = &rv_monitors_list;for (l =0 ; l <= *pos; ) { - mon =enabled_monitors_next (m, mon, &l); -if (!mon) + head =enabled_monitors_next (m, head, &l); +if (!head)break ; } -return mon; +return head; }/*
Signature · 1 line
2.51.1
Greg Kroah-Hartman
maintainerPATCH 94/184 Make rtapp/pagefault monitor depends on CONFIG_MMU
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 3d62f95bd8450cebb4a4741bf83949cd54edd4a3 upstream.
There is no page fault without MMU. Compiling the rtapp/pagefault monitor without CONFIG_MMU fails as page fault tracepoints' definitions are not available.
Make rtapp/pagefault monitor depends on CONFIG_MMU.
--- kernel/trace/rv/monitors/pagefault/Kconfig | 1 + 1 file changed, 1 insertion(+)
kernel/trace/rv/monitors/pagefault/Kconfig +1 -0
@@ -5,6 +5,7 @@ config RV_MON_PAGEFAULT select RV_LTL_MONITOR depends on RV_MON_RTAPP depends on X86 || RISCV + depends on MMU default y select LTL_MON_EVENTS_ID bool "pagefault monitor"
Signature · 1 line
2.51.1
Greg Kroah-Hartman
maintainerPATCH 95/184 vsock: fix lock inversion in vsock_assign_transport()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
commit f7c877e7535260cc7a21484c994e8ce7e8cb6780 upstream.
Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.
The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created.
Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().
--- net/vmw_vsock/af_vsock.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-)
net/vmw_vsock/af_vsock.c +19 -19
@@ -487,12 +487,26 @@ int vsock_assign_transport(struct vsock_ goto err; } -if (vsk->transport) { -if (vsk->transport == new_transport) { - ret =0 ; - goto err; - } +if (vsk->transport && vsk->transport == new_transport) { + ret =0 ; + goto err; + } + +/* We increase the module refcnt to prevent the transport unloading +* while there are open sockets assigned to it. +*/ +if (!new_transport || !try_module_get (new_transport->module)) { + ret = -ENODEV ; + goto err; + } + +/* It's safe to release the mutex after a successful try_module_get(). +* Whichever transport `new_transport` points at, it won't go away until +* the last module_put() below or in vsock_deassign_transport(). +*/ +mutex_unlock (&vsock_register_mutex); +if (vsk->transport) {/* transport->release() must be called with sock lock acquired. * This path can only be taken during vsock_connect(), where we * have already held the sock lock. In the other cases, this
@@ -512,20 +526,6 @@ int vsock_assign_transport(struct vsock_ vsk->peer_shutdown =0 ; } -/* We increase the module refcnt to prevent the transport unloading -* while there are open sockets assigned to it. -*/ -if (!new_transport || !try_module_get (new_transport->module)) { - ret = -ENODEV ; - goto err; - } - -/* It's safe to release the mutex after a successful try_module_get(). -* Whichever transport `new_transport` points at, it won't go away until -* the last module_put() below or in vsock_deassign_transport(). -*/ -mutex_unlock (&vsock_register_mutex); -if (sk->sk_type ==SOCK_SEQPACKET ) {if (!new_transport->seqpacket_allow || !new_transport->seqpacket_allow (remote_cid)) {
Greg Kroah-Hartman
maintainerPATCH 96/184 net: bonding: update the slave array for broadcast mode
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tonghao Zhang <[email protected]>
commit e0caeb24f538c3c9c94f471882ceeb43d9dc2739 upstream.
This patch fixes ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad"). Before this commit, on the broadcast mode, all devices were traversed using the bond_for_each_slave_rcu. This patch supports traversing devices by using all_slaves. Therefore, we need to update the slave array when enslave or release slave.
--- drivers/net/bonding/bond_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/bonding/bond_main.c +5 -2
@@ -2385,7 +2385,9 @@ skip_mac_set:unblock_netpoll_tx (); } -if (bond_mode_can_use_xmit_hash (bond)) +/* broadcast mode uses the all_slaves to loop through slaves. */ +if (bond_mode_can_use_xmit_hash (bond) || +BOND_MODE (bond) ==BOND_MODE_BROADCAST )bond_update_slave_arr (bond,NULL ); if (!slave_dev->netdev_ops->ndo_bpf ||
@@ -2561,7 +2563,8 @@ static int __bond_release_one(struct netbond_upper_dev_unlink (bond, slave); -if (bond_mode_can_use_xmit_hash (bond)) +if (bond_mode_can_use_xmit_hash (bond) || +BOND_MODE (bond) ==BOND_MODE_BROADCAST )bond_update_slave_arr (bond, slave); slave_info(bond_dev, slave_dev, "Releasing %s interface\n",
Greg Kroah-Hartman
maintainerPATCH 97/184 net: stmmac: dwmac-rk: Fix disabling set_clock_selection
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <[email protected]>
commit 7f864458e9a6d2000b726d14b3d3a706ac92a3b0 upstream.
On all platforms set_clock_selection() writes to a GRF register. This requires certain clocks running and thus should happen before the clocks are disabled.
This has been noticed on RK3576 Sige5, which hangs during system suspend when trying to suspend the second network interface. Note, that suspending the first interface works, because the second device ensures that the necessary clocks for the GRF are enabled.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +5 -4
@@ -1448,14 +1448,15 @@ static int gmac_clk_enable(struct rk_pri } }else {if (bsp_priv->clk_enabled) { +if (bsp_priv->ops && bsp_priv->ops->set_clock_selection) { + bsp_priv->ops->set_clock_selection (bsp_priv, + bsp_priv->clock_input, false); + } +clk_bulk_disable_unprepare (bsp_priv->num_clks, bsp_priv->clks);clk_disable_unprepare (bsp_priv->clk_phy); -if (bsp_priv->ops && bsp_priv->ops->set_clock_selection) - bsp_priv->ops->set_clock_selection (bsp_priv, - bsp_priv->clock_input, false); - bsp_priv->clk_enabled = false; } }
Greg Kroah-Hartman
maintainerPATCH 98/184 net: usb: rtl8150: Fix frame padding
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <[email protected]>
commit 75cea9860aa6b2350d90a8d78fed114d27c7eca2 upstream.
TX frames aren't padded and unknown memory is sent into the ether.
Theoretically, it isn't even guaranteed that the extra memory exists and can be sent out, which could cause further problems. In practice, I found that plenty of tailroom exists in the skb itself (in my test with ping at least) and skb_padto() easily succeeds, so use it here.
In the event of -ENOMEM drop the frame like other drivers do.
The use of one more padding byte instead of a USB zero-length packet is retained to avoid regression. I have a dodgy Etron xHCI controller which doesn't seem to support sending ZLPs at all.
--- drivers/net/usb/rtl8150.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/usb/rtl8150.c +9 -2
@@ -685,9 +685,16 @@ static netdev_tx_t rtl8150_start_xmit(strtl8150_t *dev =netdev_priv (netdev);int count, res; +/* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */ + count =max (skb->len,ETH_ZLEN ); +if (count %64 ==0 ) + count++; +if (skb_padto (skb, count)) { + netdev->stats.tx_dropped++; +return NETDEV_TX_OK ; + } +netif_stop_queue (netdev); - count = (skb->len <60 ) ?60 : skb->len; - count = (count &0x3f ) ? count : count +1 ; dev->tx_skb = skb;usb_fill_bulk_urb (dev->tx_urb, dev->udev,usb_sndbulkpipe (dev->udev,2 ), skb->data, count, write_bulk_callback, dev);
Greg Kroah-Hartman
maintainerPATCH 99/184 net: ravb: Enforce descriptor type ordering
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
commit 5370c31e84b0e0999c7b5ff949f4e104def35584 upstream.
Ensure the TX descriptor type fields are published in a safe order so the DMA engine never begins processing a descriptor chain before all descriptor fields are fully initialised.
For multi-descriptor transmits the driver writes DT_FEND into the last descriptor and DT_FSTART into the first. The DMA engine begins processing when it observes DT_FSTART. Move the dma_wmb() barrier so it executes immediately after DT_FEND and immediately before writing DT_FSTART (and before DT_FSINGLE in the single-descriptor case). This guarantees that all prior CPU writes to the descriptor memory are visible to the device before DT_FSTART is seen.
This avoids a situation where compiler/CPU reordering could publish DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to start on a partially initialised chain and causing corrupted transmissions or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as transmit queue timeouts and device resets.
--- drivers/net/ethernet/renesas/ravb_main.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +14 -2
@@ -2210,13 +2210,25 @@ static netdev_tx_t ravb_start_xmit(strucskb_tx_timestamp (skb); } -/* Descriptor type must be set after all the above writes */ -dma_wmb (); +if (num_tx_desc >1 ) { desc->die_dt =DT_FEND ; desc--; +/* When using multi-descriptors, DT_FEND needs to get written +* before DT_FSTART, but the compiler may reorder the memory +* writes in an attempt to optimize the code. +* Use a dma_wmb() barrier to make sure DT_FEND and DT_FSTART +* are written exactly in the order shown in the code. +* This is particularly important for cases where the DMA engine +* is already running when we are running this code. If the DMA +* sees DT_FSTART without the corresponding DT_FEND it will enter +* an error condition. +*/ +dma_wmb (); desc->die_dt =DT_FSTART ; }else { +/* Descriptor type must be set after all the above writes */ +dma_wmb (); desc->die_dt =DT_FSINGLE ; }ravb_modify (ndev,TCCR ,TCCR_TSRQ0 << q,TCCR_TSRQ0 << q);
Greg Kroah-Hartman
maintainerPATCH 100/184 net: ravb: Ensure memory write completes before ringing TX doorbell
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
commit 706136c5723626fcde8dd8f598a4dcd251e24927 upstream.
Add a final dma_wmb() barrier before triggering the transmit request (TCCR_TSRQ) to ensure all descriptor and buffer writes are visible to the DMA engine.
According to the hardware manual, a read-back operation is required before writing to the doorbell register to guarantee completion of previous writes. Instead of performing a dummy read, a dma_wmb() is used to both enforce the same ordering semantics on the CPU side and also to ensure completion of writes.
--- drivers/net/ethernet/renesas/ravb_main.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/renesas/ravb_main.c +8 -0
@@ -2231,6 +2231,14 @@ static netdev_tx_t ravb_start_xmit(strucdma_wmb (); desc->die_dt =DT_FSINGLE ; } + +/* Before ringing the doorbell we need to make sure that the latest +* writes have been committed to memory, otherwise it could delay +* things until the doorbell is rang again. +* This is in replacement of the read operation mentioned in the HW +* manuals. +*/ +dma_wmb ();ravb_modify (ndev,TCCR ,TCCR_TSRQ0 << q,TCCR_TSRQ0 << q); priv->cur_tx[q] += num_tx_desc;
Greg Kroah-Hartman
maintainerPATCH 101/184 mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc upstream.
The special C-flag case expects the ADD_ADDR to be received when switching to 'fully-established'. But for various reasons, the ADD_ADDR could be sent after the "4th ACK", and the special case doesn't work.
On NIPA, the new test validating this special case for the C-flag failed a few times, e.g.
102 default limits, server deny join id 0
syn rx [FAIL] got 0 JOIN[s] syn rx expected 2
Server ns stats
(...)
MPTcpExtAddAddrTx 1
MPTcpExtEchoAdd 1
Client ns stats
(...)
MPTcpExtAddAddr 1
MPTcpExtEchoAddTx 1
synack rx [FAIL] got 0 JOIN[s] synack rx expected 2
ack rx [FAIL] got 0 JOIN[s] ack rx expected 2
join Rx [FAIL] see above
syn tx [FAIL] got 0 JOIN[s] syn tx expected 2
join Tx [FAIL] see aboveI had a suspicion about what the issue could be: the ADD_ADDR might have been received after the switch to the 'fully-established' state. The issue was not easy to reproduce. The packet capture shown that the ADD_ADDR can indeed be sent with a delay, and the client would not try to establish subflows to it as expected.
A simple fix is not to mark the endpoints as 'used' in the C-flag case, when looking at creating subflows to the remote initial IP address and port. In this case, there is no need to try.
Note: newly added fullmesh endpoints will still continue to be used as expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case.
--- net/mptcp/pm_kernel.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/mptcp/pm_kernel.c +6 -0
@@ -333,6 +333,10 @@ static void mptcp_pm_create_subflow_or_s } subflow: +/* No need to try establishing subflows to remote id0 if not allowed */ +if (mptcp_pm_add_addr_c_flag_case (msk)) + goto exit; +/* check if should create a new subflow */ while (msk->pm.local_addr_used < local_addr_max && msk->pm.subflows < subflows_max) {
@@ -364,6 +368,8 @@ subflow:__mptcp_subflow_connect (sk, &local, &addrs[i]);spin_lock_bh (&msk->pm.lock); } + +exit:mptcp_pm_nl_check_work_pending (msk); }
Greg Kroah-Hartman
maintainerPATCH 102/184 selftests: mptcp: join: mark flush re-add as skipped if not supported
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit d68460bc31f9c8c6fc81fbb56ec952bec18409f1 upstream.
The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid.
Without that, the test is wrongly marked as passed on older kernels.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +1 -1
@@ -3927,7 +3927,7 @@ endpoint_tests() # flush and re-add if reset_with_tcp_filter "flush re-add" ns2 10.0.3.2 REJECT OUTPUT && - mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 0 2 pm_nl_set_limits $ns2 1 2 # broadcast IP: no packet for this address will be received on ns1
Greg Kroah-Hartman
maintainerPATCH 103/184 selftests: mptcp: join: mark implicit tests as skipped if not supported
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 973f80d715bd2504b4db6e049f292e694145cd79 upstream.
The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid.
Without that, the test is wrongly marked as passed on older kernels.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +2 -2
@@ -3751,7 +3751,7 @@ endpoint_tests() # subflow_rebuild_header is needed to support the implicit flag # userspace pm type prevents add_addr if reset "implicit EP" && - mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 2 2 pm_nl_set_limits $ns2 2 2 pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
@@ -3776,7 +3776,7 @@ endpoint_tests() fi if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT && - mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then start_events pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 0 3
Greg Kroah-Hartman
maintainerPATCH 104/184 selftests: mptcp: join: mark delete re-add signal as skipped if not supported
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 upstream.
The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid.
Without that, the test is wrongly marked as passed on older kernels.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +1 -1
@@ -3852,7 +3852,7 @@ endpoint_tests() # remove and re-add if reset_with_events "delete re-add signal" && - mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0 pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 3 3
Greg Kroah-Hartman
maintainerPATCH 105/184 mm: prevent poison consumption when splitting THP
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
commit 841a8bfcbad94bb1ba60f59ce34f75259074ae0d upstream.
When performing memory error injection on a THP (Transparent Huge Page) mapped to userspace on an x86 server, the kernel panics with the following trace. The expected behavior is to terminate the affected process instead of panicking the kernel, as the x86 Machine Check code can recover from an in-userspace #MC.
mce: [Hardware Error]: CPU 0: Machine Check Exception: f Bank 3: bd80000000070134
mce: [Hardware Error]: RIP 10:<ffffffff8372f8bc> {memchr_inv+0x4c/0xf0}
mce: [Hardware Error]: TSC afff7bbff88a ADDR 1d301b000 MISC 80 PPIN 1e741e77539027db
mce: [Hardware Error]: PROCESSOR 0:d06d0 TIME 1758093249 SOCKET 0 APIC 0 microcode 80000320
mce: [Hardware Error]: Run the above through 'mcelog --ascii'
mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel
Kernel panic - not syncing: Fatal local machine check
The root cause of this panic is that handling a memory failure triggered by an in-userspace #MC necessitates splitting the THP. The splitting process employs a mechanism, implemented in try_to_map_unused_to_zeropage(), which reads the pages in the THP to identify zero-filled pages. However, reading the pages in the THP results in a second in-kernel #MC, occurring before the initial memory_failure() completes, ultimately leading to a kernel panic. See the kernel panic call trace on the two #MCs.
First Machine Check occurs // [1]
memory_failure() // [2]
try_to_split_thp_page()
split_huge_page()
split_huge_page_to_list_to_order()
__folio_split() // [3]
remap_page()
remove_migration_ptes()
remove_migration_pte()
try_to_map_unused_to_zeropage() // [4]
memchr_inv() // [5]
Second Machine Check occurs // [6]
Kernel panic[1] Triggered by accessing a hardware-poisoned THP in userspace, which is typically recoverable by terminating the affected process.
[2] Call folio_set_has_hwpoisoned() before try_to_split_thp_page().
[3] Pass the RMP_USE_SHARED_ZEROPAGE remap flag to remap_page().
[4] Try to map the unused THP to zeropage.
[5] Re-access pages in the hw-poisoned THP in the kernel.
[6] Triggered in-kernel, leading to a panic kernel.
In Step[2], memory_failure() sets the poisoned flag on the page in the THP by TestSetPageHWPoison() before calling try_to_split_thp_page().
As suggested by David Hildenbrand, fix this panic by not accessing to the poisoned page in the THP during zeropage identification, while continuing to scan unaffected pages in the THP for possible zeropage mapping. This prevents a second in-kernel #MC that would cause kernel panic in Step[4].
Thanks to Andrew Zaborowski for his initial work on fixing this issue.
--- mm/huge_memory.c | 3 +++ mm/migrate.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-)
mm/huge_memory.c +3 -0
@@ -4120,6 +4120,9 @@ static bool thp_underused(struct folio *if (khugepaged_max_ptes_none ==HPAGE_PMD_NR -1 )return false; +if (folio_contain_hwpoisoned_page (folio)) +return false; +for (i =0 ; i <folio_nr_pages (folio); i++) {if (pages_identical (folio_page (folio, i),ZERO_PAGE (0 ))) {if (++num_zero_pages > khugepaged_max_ptes_none)
mm/migrate.c +2 -1
@@ -302,8 +302,9 @@ static bool try_to_map_unused_to_zeropagstruct page *page =folio_page (folio, idx);pte_t newpte; -if (PageCompound (page)) +if (PageCompound (page) ||PageHWPoison (page))return false; +VM_BUG_ON_PAGE (!PageAnon (page), page);VM_BUG_ON_PAGE (!PageLocked (page), page);VM_BUG_ON_PAGE (pte_present (old_pte), page);
Greg Kroah-Hartman
maintainerPATCH 106/184 mm/mremap: correctly account old mapping after MREMAP_DONTUNMAP remap
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
commit 0e59f47c15cec4cd88c51c5cda749607b719c82b upstream.
Commit b714ccb02a76 ("mm/mremap: complete refactor of move_vma()") mistakenly introduced a new behaviour - clearing the VM_ACCOUNT flag of the old mapping when a mapping is mremap()'d with the MREMAP_DONTUNMAP flag set.
While we always clear the VM_LOCKED and VM_LOCKONFAULT flags for the old mapping (the page tables have been moved, so there is no data that could possibly be locked in memory), there is no reason to touch any other VMA flags.
This is because after the move the old mapping is in a state as if it were freshly mapped. This implies that the attributes of the mapping ought to remain the same, including whether or not the mapping is accounted.
--- mm/mremap.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
mm/mremap.c +6 -9
@@ -1237,10 +1237,10 @@ static int copy_vma_and_data(struct vma_remap_struct *vrm, }/* -* Perform final tasks for MADV_DONTUNMAP operation, clearing mlock() and -* account flags on remaining VMA by convention (it cannot be mlock()'d any -* longer, as pages in range are no longer mapped), and removing anon_vma_chain -* links from it (if the entire VMA was copied over). +* Perform final tasks for MADV_DONTUNMAP operation, clearing mlock() flag on +* remaining VMA by convention (it cannot be mlock()'d any longer, as pages in +* range are no longer mapped), and removing anon_vma_chain links from it if the +* entire VMA was copied over. */ static void dontunmap_complete (struct vma_remap_struct *vrm,struct vm_area_struct *new_vma)
@@ -1250,11 +1250,8 @@ static void dontunmap_complete(struct vma_remap_struct *vrm,unsigned long old_start = vrm->vma->vm_start;unsigned long old_end = vrm->vma->vm_end; -/* -* We always clear VM_LOCKED[ONFAULT] | VM_ACCOUNT on the old -* vma. -*/ -vm_flags_clear (vrm->vma,VM_LOCKED_MASK |VM_ACCOUNT ); +/* We always clear VM_LOCKED[ONFAULT] on the old VMA. */ +vm_flags_clear (vrm->vma,VM_LOCKED_MASK );/* * anon_vma links of the old vma is no longer needed after its page
Signature · 1 line
2.51.1
Greg Kroah-Hartman
maintainerPATCH 107/184 drm/xe: Check return value of GGTT workqueue allocation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
commit ce29214ada6d08dbde1eeb5a69c3b09ddf3da146 upstream.
Workqueue allocation can fail, so check the return value of the GGTT workqueue allocation and fail driver initialization if the allocation fails.
--- drivers/gpu/drm/xe/xe_ggtt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xe/xe_ggtt.c +3 -0
@@ -291,6 +291,9 @@ int xe_ggtt_init_early(struct xe_ggtt *g ggtt->pt_ops = &xelp_pt_ops; ggtt->wq =alloc_workqueue ("xe-ggtt-wq" ,0 ,WQ_MEM_RECLAIM ); +if (!ggtt->wq) +return -ENOMEM ; +__xe_ggtt_init_early (ggtt,xe_wopcm_size (xe)); err =drmm_add_action_or_reset (&xe->drm, ggtt_fini_early, ggtt);
Greg Kroah-Hartman
maintainerPATCH 108/184 drm/amd/display: increase max link count and fix link->enc NULL pointer access
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charlene Liu <[email protected]>
commit bec947cbe9a65783adb475a5fb47980d7b4f4796 upstream.
[why]
1.) dc->links[MAX_LINKS] array size smaller than actual requested. max_connector + max_dpia + 4 virtual = 14.
increase from 12 to 14.
2.) hw_init() access null LINK_ENC for dpia non display_endpoint.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 3 +++ drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +3 -0
@@ -200,6 +200,9 @@ void dcn401_init_hw(struct dc *dc)*/ struct dc_link *link = dc->links[i]; +if (link->ep_type !=DISPLAY_ENDPOINT_PHY ) +continue ; + link->link_enc->funcs->hw_init (link->link_enc);/* Check for enabled DIG to identify enabled display */
drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h +7 -1
@@ -44,7 +44,13 @@*/ #define MAX_PIPES 6#define MAX_PHANTOM_PIPES (MAX_PIPES / 2) -#define MAX_LINKS (MAX_PIPES * 2 +2) + +#define MAX_DPIA 6 +#define MAX_CONNECTOR 6 +#define MAX_VIRTUAL_LINKS 4 + +#define MAX_LINKS (MAX_DPIA + MAX_CONNECTOR + MAX_VIRTUAL_LINKS) +#define MAX_DIG_LINK_ENCODERS 7#define MAX_DWB_PIPES 1#define MAX_HPO_DP2_ENCODERS 4
Greg Kroah-Hartman
maintainerPATCH 109/184 mm/damon/core: use damos_commit_quota_goal() for new goal commit
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 7eca961dd7188f20fdf8ce9ed5018280f79b2438 upstream.
When damos_commit_quota_goals() is called for adding new DAMOS quota goals of DAMOS_QUOTA_USER_INPUT metric, current_value fields of the new goals should be also set as requested.
However, damos_commit_quota_goals() is not updating the field for the case, since it is setting only metrics and target values using damos_new_quota_goal(), and metric-optional union fields using damos_commit_quota_goal_union(). As a result, users could see the first current_value parameter that committed online with a new quota goal is ignored. Users are assumed to commit the current_value for DAMOS_QUOTA_USER_INPUT quota goals, since it is being used as a feedback. Hence the real impact would be subtle. That said, this is obviously not intended behavior.
Fix the issue by using damos_commit_quota_goal() which sets all quota goal parameters, instead of damos_commit_quota_goal_union(), which sets only the union fields.
--- mm/damon/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/damon/core.c +1 -1
@@ -811,7 +811,7 @@ int damos_commit_quota_goals(struct damo src_goal->metric, src_goal->target_value);if (!new_goal)return -ENOMEM ; -damos_commit_quota_goal_union (new_goal, src_goal); +damos_commit_quota_goal (new_goal, src_goal);damos_add_quota_goal (dst, new_goal); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 110/184 mm/damon/core: fix list_add_tail() call on damon_call()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit c3fa5b1bfd8380d935fa961f2ac166bdf000f418 upstream.
Each damon_ctx maintains callback requests using a linked list (damon_ctx->call_controls). When a new callback request is received via damon_call(), the new request should be added to the list. However, the function is making a mistake at list_add_tail() invocation: putting the new item to add and the list head to add it before, in the opposite order. Because of the linked list manipulation implementation, the new request can still be reached from the context's list head. But the list items that were added before the new request are dropped from the list.
As a result, the callbacks are unexpectedly not invocated. Worse yet, if the dropped callback requests were dynamically allocated, the memory is leaked. Actually DAMON sysfs interface is using a dynamically allocated repeat-mode callback request for automatic essential stats update. And because the online DAMON parameters commit is using a non-repeat-mode callback request, the issue can easily be reproduced, like below.
# damo start --damos_action stat --refresh_stat 1s
# damo tune --damos_action stat --refresh_stat 1sThe first command dynamically allocates the repeat-mode callback request for automatic essential stat update. Users can see the essential stats are automatically updated for every second, using the sysfs interface.
The second command calls damon_commit() with a new callback request that was made for the commit. As a result, the previously added repeat-mode callback request is dropped from the list. The automatic stats refresh stops working, and the memory for the repeat-mode callback request is leaked. It can be confirmed using kmemleak.
Fix the mistake on the list_add_tail() call.
--- mm/damon/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/damon/core.c +1 -1
@@ -1422,7 +1422,7 @@ int damon_call(struct damon_ctx *ctx, stINIT_LIST_HEAD (&control->list);mutex_lock (&ctx->call_controls_lock); -list_add_tail (&ctx->call_controls, &control->list); +list_add_tail (&control->list, &ctx->call_controls);mutex_unlock (&ctx->call_controls_lock);if (!damon_is_running (ctx))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 111/184 mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enze Li <[email protected]>
commit 7071537159be845a5c4ed5fb7d3db25aa4bd04a3 upstream.
Currently, damon_destroy_scheme() only cleans up the filter list but leaves ops_filter untouched, which could lead to memory leaks when a scheme is destroyed.
This patch ensures both filter and ops_filter are properly freed in damon_destroy_scheme(), preventing potential memory leaks.
--- mm/damon/core.c | 3 +++ 1 file changed, 3 insertions(+)
mm/damon/core.c +3 -0
@@ -451,6 +451,9 @@ void damon_destroy_scheme(struct damos *damos_for_each_filter_safe (f, next, s)damos_destroy_filter (f); +damos_for_each_ops_filter_safe (f, next, s) +damos_destroy_filter (f); +kfree (s->migrate_dests.node_id_arr);kfree (s->migrate_dests.weight_arr);damon_del_scheme (s);
Greg Kroah-Hartman
maintainerPATCH 112/184 mm/damon/sysfs: catch commit test ctx alloc failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f upstream.
Patch series "mm/damon/sysfs: fix commit test damon_ctx [de]allocation".
DAMON sysfs interface dynamically allocates and uses a damon_ctx object for testing if given inputs for online DAMON parameters update is valid. The object is being used without an allocation failure check, and leaked when the test succeeds. Fix the two bugs.
This patch (of 2):
The damon_ctx for testing online DAMON parameters commit inputs is used without its allocation failure check. This could result in an invalid memory access. Fix it by directly returning an error when the allocation failed.
--- mm/damon/sysfs.c | 2 ++ 1 file changed, 2 insertions(+)
mm/damon/sysfs.c +2 -0
@@ -1435,6 +1435,8 @@ static int damon_sysfs_commit_input(voidif (IS_ERR (param_ctx))return PTR_ERR (param_ctx); test_ctx =damon_new_ctx (); +if (!test_ctx) +return -ENOMEM ; err =damon_commit_ctx (test_ctx, param_ctx);if (err) {damon_destroy_ctx (test_ctx);
Greg Kroah-Hartman
maintainerPATCH 113/184 mm/damon/sysfs: dealloc commit test ctx always
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 139e7a572af0b45f558b5e502121a768dc328ba8 upstream.
The damon_ctx for testing online DAMON parameters commit inputs is deallocated only when the test fails. This means memory is leaked for every successful online DAMON parameters commit. Fix the leak by always deallocating it.
--- mm/damon/sysfs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
mm/damon/sysfs.c +2 -3
@@ -1438,12 +1438,11 @@ static int damon_sysfs_commit_input(voidif (!test_ctx)return -ENOMEM ; err =damon_commit_ctx (test_ctx, param_ctx); -if (err) { -damon_destroy_ctx (test_ctx); +if (err) goto out; - } err =damon_commit_ctx (kdamond->damon_ctx, param_ctx); out: +damon_destroy_ctx (test_ctx);damon_destroy_ctx (param_ctx);return err; }
Greg Kroah-Hartman
maintainerPATCH 114/184 spi: rockchip-sfc: Fix DMA-API usage
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
[ Upstream commit ee795e82e10197c070efd380dc9615c73dffad6c ]
Use DMA-API dma_map_single() call for getting the DMA address of the transfer buffer instead of hacking with virt_to_phys().
This fixes the following DMA-API debug warning:
------------[ cut here ]------------ DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes] WARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151 Modules linked in: ... Hardware name: Hardkernel ODROID-M1 (DT) pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_sync+0x1d8/0x690 lr : check_sync+0x1d8/0x690 .. Call trace: check_sync+0x1d8/0x690 (P) debug_dma_sync_single_for_cpu+0x84/0x8c __dma_sync_single_for_cpu+0x88/0x234 rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc] spi_mem_exec_op+0x408/0x498 spi_nor_read_data+0x170/0x184 spi_nor_read_sfdp+0x74/0xe4 spi_nor_parse_sfdp+0x120/0x11f0 spi_nor_sfdp_init_params_deprecated+0x3c/0x8c spi_nor_scan+0x690/0xf88 spi_nor_probe+0xe4/0x304 spi_mem_probe+0x6c/0xa8 spi_probe+0x94/0xd4 really_probe+0xbc/0x298 ...
--- drivers/spi/spi-rockchip-sfc.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/spi/spi-rockchip-sfc.c +11 -1
@@ -704,7 +704,12 @@ static int rockchip_sfc_probe(struct platform_device *pdev) ret = -ENOMEM ; goto err_dma; } - sfc->dma_buffer =virt_to_phys (sfc->buffer); + sfc->dma_buffer =dma_map_single (dev, sfc->buffer, + sfc->max_iosize,DMA_BIDIRECTIONAL ); +if (dma_mapping_error (dev, sfc->dma_buffer)) { + ret = -ENOMEM ; + goto err_dma_map; + } } ret =devm_spi_register_controller (dev, host);
@@ -715,6 +720,9 @@ static int rockchip_sfc_probe(struct platform_device *pdev)return 0 ; err_register: +dma_unmap_single (dev, sfc->dma_buffer, sfc->max_iosize, +DMA_BIDIRECTIONAL ); +err_dma_map:free_pages ((unsigned long )sfc->buffer,get_order (sfc->max_iosize)); err_dma:pm_runtime_get_sync (dev);
@@ -736,6 +744,8 @@ static void rockchip_sfc_remove(struct platform_device *pdev)struct spi_controller *host = sfc->host;spi_unregister_controller (host); +dma_unmap_single (&pdev->dev, sfc->dma_buffer, sfc->max_iosize, +DMA_BIDIRECTIONAL );free_pages ((unsigned long )sfc->buffer,get_order (sfc->max_iosize));clk_disable_unprepare (sfc->clk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/184 firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 11fb1a82aefa6f7fea6ac82334edb5639b9927df ]
FF-A v1.2 introduced 16 byte IMPLEMENTATION DEFINED value in the endpoint memory access descriptor to allow any sender could to specify an its any custom value for each receiver. Also this value must be specified by the receiver when retrieving the memory region. The sender must ensure it informs the receiver of this value via an IMPLEMENTATION DEFINED mechanism such as a partition message.
So the FF-A driver can use the message interfaces to communicate the value and set the same in the ffa_mem_region_attributes structures when using the memory interfaces.
The driver ensure that the size of the endpoint memory access descriptors is set correctly based on the FF-A version.
Message-Id: <[email protected]>
--- drivers/firmware/arm_ffa/driver.c | 37 ++++++++++++++++++++++--------- include/linux/arm_ffa.h | 21 ++++++++++++++++-- 2 files changed, 46 insertions(+), 12 deletions(-)
drivers/firmware/arm_ffa/driver.c +27 -10
@@ -649,6 +649,26 @@ static u16 ffa_memory_attributes_get(u32 func_id)return FFA_MEM_NORMAL |FFA_MEM_WRITE_BACK |FFA_MEM_INNER_SHAREABLE ; } +static void ffa_emad_impdef_value_init (u32 version,void *dst,void *src) +{ +struct ffa_mem_region_attributes *ep_mem_access; + +if (FFA_EMAD_HAS_IMPDEF_FIELD (version)) +memcpy (dst, src,sizeof (ep_mem_access->impdef_val)); +} + +static void +ffa_mem_region_additional_setup (u32 version,struct ffa_mem_region *mem_region) +{ +if (!FFA_MEM_REGION_HAS_EP_MEM_OFFSET (version)) { + mem_region->ep_mem_size =0 ; + }else { + mem_region->ep_mem_size =ffa_emad_size_get (version); + mem_region->ep_mem_offset =sizeof (*mem_region); +memset (mem_region->reserved,0 ,12 ); + } +} +static int ffa_setup_and_transmit (u32 func_id,void *buffer,u32 max_fragsize,struct ffa_mem_ops_args *args)
@@ -667,27 +687,24 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, mem_region->flags = args->flags; mem_region->sender_id = drv_info->vm_id; mem_region->attributes =ffa_memory_attributes_get (func_id); - ep_mem_access = buffer + -ffa_mem_desc_offset (buffer,0 , drv_info->version); composite_offset =ffa_mem_desc_offset (buffer, args->nattrs, drv_info->version); -for (idx =0 ; idx < args->nattrs; idx++, ep_mem_access++) { +for (idx =0 ; idx < args->nattrs; idx++) { + ep_mem_access = buffer + +ffa_mem_desc_offset (buffer, idx, drv_info->version); ep_mem_access->receiver = args->attrs[idx].receiver; ep_mem_access->attrs = args->attrs[idx].attrs; ep_mem_access->composite_off = composite_offset; ep_mem_access->flag =0 ; ep_mem_access->reserved =0 ; +ffa_emad_impdef_value_init (drv_info->version, + ep_mem_access->impdef_val, + args->attrs[idx].impdef_val); } mem_region->handle =0 ; mem_region->ep_count = args->nattrs; -if (drv_info->version <=FFA_VERSION_1_0 ) { - mem_region->ep_mem_size =0 ; - }else { - mem_region->ep_mem_size =sizeof (*ep_mem_access); - mem_region->ep_mem_offset =sizeof (*mem_region); -memset (mem_region->reserved,0 ,12 ); - } +ffa_mem_region_additional_setup (drv_info->version, mem_region); composite = buffer + composite_offset; composite->total_pg_cnt =ffa_get_num_pages_sg (args->sg);
include/linux/arm_ffa.h +19 -2
@@ -337,6 +337,7 @@ struct ffa_mem_region_attributes {* an `struct ffa_mem_region_addr_range`. */ u32 composite_off; +u8 impdef_val[16 ];u64 reserved; };
@@ -416,15 +417,31 @@ struct ffa_mem_region {#define CONSTITUENTS_OFFSET (x) \ (offsetof(struct ffa_composite_mem_region, constituents[x])) +#define FFA_EMAD_HAS_IMPDEF_FIELD (version) ((version) >= FFA_VERSION_1_2) +#define FFA_MEM_REGION_HAS_EP_MEM_OFFSET (version) ((version) > FFA_VERSION_1_0) + +static inline u32 ffa_emad_size_get (u32 ffa_version) +{ +u32 sz; +struct ffa_mem_region_attributes *ep_mem_access; + +if (FFA_EMAD_HAS_IMPDEF_FIELD (ffa_version)) + sz =sizeof (*ep_mem_access); +else + sz =sizeof (*ep_mem_access) -sizeof (ep_mem_access->impdef_val); + +return sz; +} +static inline u32 ffa_mem_desc_offset (struct ffa_mem_region *buf,int count,u32 ffa_version) { -u32 offset = count *sizeof (struct ffa_mem_region_attributes ); +u32 offset = count *ffa_emad_size_get (ffa_version);/* * Earlier to v1.1, the endpoint memory descriptor array started at * offset 32(i.e. offset of ep_mem_offset in the current structure) */ -if (ffa_version <=FFA_VERSION_1_0 ) +if (!FFA_MEM_REGION_HAS_EP_MEM_OFFSET (ffa_version)) offset += offsetof(struct ffa_mem_region , ep_mem_offset);else offset +=sizeof (struct ffa_mem_region );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/184 spi: spi-nxp-fspi: add the support for sample data from DQS pad
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
[ Upstream commit c07f270323175b83779c2c2b80b360ed476baec5 ]
flexspi define four mode for sample clock source selection. Here is the list of modes:
mode 0: Dummy Read strobe generated by FlexSPI Controller and loopback
internally
mode 1: Dummy Read strobe generated by FlexSPI Controller and loopback
from DQS pad
mode 2: Reserved
mode 3: Flash provided Read strobe and input from DQS pad
In default, flexspi use mode 0 after reset. And for DTR mode, flexspi only support 8D-8D-8D mode. For 8D-8D-8D mode, IC suggest to use mode 3, otherwise read always get incorrect data.
For DTR mode, flexspi will automatically div 2 of the root clock and output to device. the formula is:
device_clock = root_clock / (is_dtr ? 2 : 1)
So correct the clock rate setting for DTR mode to get the max performance.
Stable-dep-of: a89103f67112 ("spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate")
--- drivers/spi/spi-nxp-fspi.c | 56 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 53 insertions(+), 3 deletions(-)
drivers/spi/spi-nxp-fspi.c +53 -3
@@ -399,7 +399,8 @@ struct nxp_fspi {struct mutex lock;struct pm_qos_request pm_qos_req;int selected; -#define FSPI_NEED_INIT (1 << 0) +#define FSPI_NEED_INIT BIT(0) +#define FSPI_DTR_MODE BIT(1)int flags; };
@@ -645,6 +646,40 @@ static void nxp_fspi_clk_disable_unprep(struct nxp_fspi *f)return ; } +/* +* Sample Clock source selection for Flash Reading +* Four modes defined by fspi: +* mode 0: Dummy Read strobe generated by FlexSPI Controller +* and loopback internally +* mode 1: Dummy Read strobe generated by FlexSPI Controller +* and loopback from DQS pad +* mode 2: Reserved +* mode 3: Flash provided Read strobe and input from DQS pad +* +* fspi default use mode 0 after reset +*/ +static void nxp_fspi_select_rx_sample_clk_source (struct nxp_fspi *f, +bool op_is_dtr) +{ +u32 reg; + +/* +* For 8D-8D-8D mode, need to use mode 3 (Flash provided Read +* strobe and input from DQS pad), otherwise read operaton may +* meet issue. +* This mode require flash device connect the DQS pad on board. +* For other modes, still use mode 0, keep align with before. +* spi_nor_suspend will disable 8D-8D-8D mode, also need to +* change the mode back to mode 0. +*/ + reg =fspi_readl (f, f->iobase +FSPI_MCR0 ); +if (op_is_dtr) + reg |=FSPI_MCR0_RXCLKSRC (3 ); +else /*select mode 0 */ + reg &= ~FSPI_MCR0_RXCLKSRC (3 ); +fspi_writel (f, reg, f->iobase +FSPI_MCR0 ); +} +static void nxp_fspi_dll_calibration (struct nxp_fspi *f) {int ret;
@@ -715,15 +750,18 @@ static void nxp_fspi_dll_calibration(struct nxp_fspi *f)static void nxp_fspi_select_mem (struct nxp_fspi *f,struct spi_device *spi,const struct spi_mem_op *op) { +/* flexspi only support one DTR mode: 8D-8D-8D */ +bool op_is_dtr = op->cmd.dtr && op->addr.dtr && op->dummy.dtr && op->data.dtr;unsigned long rate = op->max_freq;int ret;uint64_t size_kb;/* * Return, if previously selected target device is same as current -* requested target device. +* requested target device. Also the DTR or STR mode do not change. */ -if (f->selected ==spi_get_chipselect (spi,0 )) +if ((f->selected ==spi_get_chipselect (spi,0 )) && + (!!(f->flags &FSPI_DTR_MODE ) == op_is_dtr))return ;/* Reset FLSHxxCR0 registers */
@@ -740,6 +778,18 @@ static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi,dev_dbg (f->dev,"Target device [CS:%x] selected\n" ,spi_get_chipselect (spi,0 )); +nxp_fspi_select_rx_sample_clk_source (f, op_is_dtr); + +if (op_is_dtr) { + f->flags |=FSPI_DTR_MODE ; +/* For DTR mode, flexspi will default div 2 and output to device. +* so here to config the root clock to 2 * device rate. +*/ + rate = rate *2 ; + }else { + f->flags &= ~FSPI_DTR_MODE ; + } +nxp_fspi_clk_disable_unprep (f); ret =clk_set_rate (f->clk, rate);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/184 spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
[ Upstream commit a89103f67112453fa36c9513e951c19eed9d2d92 ]
Current operation contain the max_freq, so new coming operation may use new clock rate, need to re-config the clock rate to match the requirement.
--- drivers/spi/spi-nxp-fspi.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/spi/spi-nxp-fspi.c +13 -3
@@ -402,6 +402,8 @@ struct nxp_fspi {#define FSPI_NEED_INIT BIT(0)#define FSPI_DTR_MODE BIT(1)int flags; +/* save the previous operation clock rate */ +unsigned long pre_op_rate; };static inline int needs_ip_only (struct nxp_fspi *f)
@@ -757,11 +759,17 @@ static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi,uint64_t size_kb;/* -* Return, if previously selected target device is same as current -* requested target device. Also the DTR or STR mode do not change. +* Return when following condition all meet, +* 1, if previously selected target device is same as current +* requested target device. +* 2, the DTR or STR mode do not change. +* 3, previous operation max rate equals current one. +* +* For other case, need to re-config. */ if ((f->selected ==spi_get_chipselect (spi,0 )) && - (!!(f->flags &FSPI_DTR_MODE ) == op_is_dtr)) + (!!(f->flags &FSPI_DTR_MODE ) == op_is_dtr) && + (f->pre_op_rate == op->max_freq))return ;/* Reset FLSHxxCR0 registers */
@@ -807,6 +815,8 @@ static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi,if (rate >100000000 )nxp_fspi_dll_calibration (f); + f->pre_op_rate = op->max_freq; + f->selected =spi_get_chipselect (spi,0 ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/184 spi: spi-nxp-fspi: add extra delay after dll locked
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Xu <[email protected]>
[ Upstream commit b93b4269791fdebbac2a9ad26f324dc2abb9e60f ]
Due to the erratum ERR050272, the DLL lock status register STS2 [xREFLOCK, xSLVLOCK] bit may indicate DLL is locked before DLL is actually locked. Add an extra 4us delay as a workaround.
refer to ERR050272, on Page 20.
https://www.nxp.com/docs/en/errata/IMX8_1N94W.pdf
--- drivers/spi/spi-nxp-fspi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/spi/spi-nxp-fspi.c +6 -0
@@ -709,6 +709,12 @@ static void nxp_fspi_dll_calibration(struct nxp_fspi *f) 0, POLL_TOUT, true);if (ret)dev_warn (f->dev,"DLL lock failed, please fix it!\n" ); + +/* +* For ERR050272, DLL lock status bit is not accurate, +* wait for 4us more as a workaround. +*/ +udelay (4 ); }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/184 spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
[ Upstream commit f43579ef3500527649b1c233be7cf633806353aa ]
For different sample clock source selection, the max frequency flexspi supported are different. For mode 0, max frequency is 66MHz. For mode 3, the max frequency is 166MHz.
Refer to 3.9.9 FlexSPI timing parameters on page 65.
https://www.nxp.com/docs/en/data-sheet/IMX8MNCEC.pdf
Though flexspi maybe still work under higher frequency, but can't guarantee the stability. IC suggest to add this limitation on all SoCs which contain flexspi.
--- drivers/spi/spi-nxp-fspi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/spi/spi-nxp-fspi.c +8 -2
@@ -404,6 +404,8 @@ struct nxp_fspi {int flags;/* save the previous operation clock rate */ unsigned long pre_op_rate; +/* the max clock rate fspi output to device */ +unsigned long max_rate; };static inline int needs_ip_only (struct nxp_fspi *f)
@@ -675,10 +677,13 @@ static void nxp_fspi_select_rx_sample_clk_source(struct nxp_fspi *f,* change the mode back to mode 0. */ reg =fspi_readl (f, f->iobase +FSPI_MCR0 ); -if (op_is_dtr) +if (op_is_dtr) { reg |=FSPI_MCR0_RXCLKSRC (3 ); -else /*select mode 0 */ + f->max_rate =166000000 ; + }else {/*select mode 0 */ reg &= ~FSPI_MCR0_RXCLKSRC (3 ); + f->max_rate =66000000 ; + }fspi_writel (f, reg, f->iobase +FSPI_MCR0 ); }
@@ -793,6 +798,7 @@ static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi,dev_dbg (f->dev,"Target device [CS:%x] selected\n" ,spi_get_chipselect (spi,0 ));nxp_fspi_select_rx_sample_clk_source (f, op_is_dtr); + rate =min (f->max_rate, op->max_freq);if (op_is_dtr) { f->flags |=FSPI_DTR_MODE ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/184 spi: cadence-quadspi: Fix pm_runtime unbalance on dma EPROBE_DEFER
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mattijs Korpershoek <[email protected]>
[ Upstream commit 8735696acea24ac1f9d4490992418c71941ca68c ]
In csqspi_probe(), when cqspi_request_mmap_dma() returns -EPROBE_DEFER, we handle the error by jumping to probe_setup_failed.
In that label, we call pm_runtime_disable(), even if we never called pm_runtime_enable() before.
Because of this, the driver cannot probe:
[ 2.690018] cadence-qspi 47040000.spi: No Rx DMA available [ 2.699735] spi-nor spi0.0: resume failed with -13 [ 2.699741] spi-nor: probe of spi0.0 failed with error -13
Only call pm_runtime_disable() if it was enabled by adding a new label to handle cqspi_request_mmap_dma() failures.
--- drivers/spi/spi-cadence-quadspi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/spi/spi-cadence-quadspi.c +3 -2
@@ -1995,7 +1995,7 @@ static int cqspi_probe(struct platform_device *pdev)if (cqspi->use_direct_mode) { ret =cqspi_request_mmap_dma (cqspi);if (ret == -EPROBE_DEFER ) - goto probe_setup_failed; + goto probe_dma_failed; }if (!(ddata && (ddata->quirks &CQSPI_DISABLE_RUNTIME_PM ))) {
@@ -2019,9 +2019,10 @@ static int cqspi_probe(struct platform_device *pdev)return 0 ; probe_setup_failed: -cqspi_controller_enable (cqspi,0 );if (!(ddata && (ddata->quirks &CQSPI_DISABLE_RUNTIME_PM )))pm_runtime_disable (dev); +probe_dma_failed: +cqspi_controller_enable (cqspi,0 ); probe_reset_failed:if (cqspi->is_jh7110)cqspi_jh7110_disable_clk (pdev, cqspi);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/184 arm64: dts: broadcom: bcm2712: Add default GIC address cells
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 278b6cabf18bd804f956b98a2f1068717acdbfe3 ]
Add missing address-cells 0 to GIC interrupt node to silence W=1 warning:
bcm2712.dtsi:494.4-497.31: Warning (interrupt_map): /axi/pcie@1000110000:interrupt-map:
Missing property '#address-cells' in node /soc@107c000000/interrupt-controller@7fff9000, using 0 as fallback
Value '0' is correct because:
1. GIC interrupt controller does not have children,
2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0)
Stable-dep-of: aa960b597600 ("arm64: dts: broadcom: bcm2712: Define VGIC interrupt")
--- arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/broadcom/bcm2712.dtsi +1 -0
@@ -270,6 +270,7 @@ <0x7fffc000 0x2000>, <0x7fffe000 0x2000>; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <3>; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/184 arm64: dts: broadcom: bcm2712: Define VGIC interrupt
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <[email protected]>
[ Upstream commit aa960b597600bed80fe171729057dd6aa188b5b5 ]
Define the interrupt in the GICv2 for vGIC so KVM can be used, it was missed from the original upstream DTB for some reason.
--- arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/broadcom/bcm2712.dtsi +2 -0
@@ -271,6 +271,8 @@ <0x7fffe000 0x2000>; interrupt-controller; #address-cells = <0>; + interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | + IRQ_TYPE_LEVEL_HIGH)>; #interrupt-cells = <3>; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/184 firmware: arm_scmi: Account for failed debug initialization
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit 2290ab43b9d8eafb8046387f10a8dfa2b030ba46 ]
When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL.
Handle this fault condition in the SCMI debug helpers that maintain metrics counters.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/common.h | 24 ++++++++++++++-- drivers/firmware/arm_scmi/driver.c | 44 ++++++++++-------------------- 2 files changed, 35 insertions(+), 33 deletions(-)
drivers/firmware/arm_scmi/common.h +21 -3
@@ -309,10 +309,28 @@ enum debug_counters { SCMI_DEBUG_COUNTERS_LAST }; -static inline void scmi_inc_count (atomic_t *arr,int stat) +/** +* struct scmi_debug_info - Debug common info +* @top_dentry: A reference to the top debugfs dentry +* @name: Name of this SCMI instance +* @type: Type of this SCMI instance +* @is_atomic: Flag to state if the transport of this instance is atomic +* @counters: An array of atomic_c's used for tracking statistics (if enabled) +*/ +struct scmi_debug_info { +struct dentry *top_dentry; +const char *name; +const char *type; +bool is_atomic; +atomic_t counters[SCMI_DEBUG_COUNTERS_LAST ]; +}; + +static inline void scmi_inc_count (struct scmi_debug_info *dbg,int stat) { -if (IS_ENABLED (CONFIG_ARM_SCMI_DEBUG_COUNTERS )) -atomic_inc (&arr[stat]); +if (IS_ENABLED (CONFIG_ARM_SCMI_DEBUG_COUNTERS )) { +if (dbg) +atomic_inc (&dbg->counters[stat]); + } }static inline void scmi_dec_count (atomic_t *arr,int stat)
drivers/firmware/arm_scmi/driver.c +14 -30
127 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/184 include: trace: Fix inflight count helper on failed initialization
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit 289ce7e9a5e1a52ac7e522a3e389dc16be08d7a4 ]
Add a check to the scmi_inflight_count() helper to handle the case when the SCMI debug subsystem fails to initialize.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/common.h | 8 +++++--- drivers/firmware/arm_scmi/driver.c | 7 +++++-- 2 files changed, 10 insertions(+), 5 deletions(-)
drivers/firmware/arm_scmi/common.h +5 -3
@@ -333,10 +333,12 @@ static inline void scmi_inc_count(struct scmi_debug_info *dbg, int stat) } } -static inline void scmi_dec_count (atomic_t *arr,int stat) +static inline void scmi_dec_count (struct scmi_debug_info *dbg,int stat) { -if (IS_ENABLED (CONFIG_ARM_SCMI_DEBUG_COUNTERS )) -atomic_dec (&arr[stat]); +if (IS_ENABLED (CONFIG_ARM_SCMI_DEBUG_COUNTERS )) { +if (dbg) +atomic_dec (&dbg->counters[stat]); + } }enum scmi_bad_msg {
drivers/firmware/arm_scmi/driver.c +5 -2
@@ -594,7 +594,7 @@ scmi_xfer_inflight_register_unlocked(struct scmi_xfer *xfer,/* Set in-flight */ set_bit (xfer->hdr.seq, minfo->xfer_alloc_table);hash_add (minfo->pending_xfers, &xfer->node, xfer->hdr.seq); -scmi_inc_count (info->dbg->counters,XFERS_INFLIGHT ); +scmi_inc_count (info->dbg,XFERS_INFLIGHT ); xfer->pending = true; }
@@ -803,7 +803,7 @@ __scmi_xfer_put(struct scmi_xfers_info *minfo, struct scmi_xfer *xfer)hash_del (&xfer->node); xfer->pending = false; -scmi_dec_count (info->dbg->counters,XFERS_INFLIGHT ); +scmi_dec_count (info->dbg,XFERS_INFLIGHT ); }hlist_add_head (&xfer->node, &minfo->free_xfers); }
@@ -3407,6 +3407,9 @@ int scmi_inflight_count(const struct scmi_handle *handle)if (IS_ENABLED (CONFIG_ARM_SCMI_DEBUG_COUNTERS )) {struct scmi_info *info =handle_to_scmi_info (handle); +if (!info->dbg) +return 0 ; +return atomic_read (&info->dbg->counters[XFERS_INFLIGHT ]); }else {return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/184 firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Shimko <[email protected]>
[ Upstream commit 20b93a0088a595bceed4a026d527cbbac4e876c5 ]
The SCMI_XFER_FLAG_IS_RAW flag was being cleared prematurely in scmi_xfer_raw_put() before the transfer completion was properly acknowledged by the raw message handlers.
Move the clearing of SCMI_XFER_FLAG_IS_RAW and SCMI_XFER_FLAG_CHAN_SET from scmi_xfer_raw_put() to __scmi_xfer_put() to ensure the flags remain set throughout the entire raw message processing pipeline until the transfer is returned to the free pool.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/driver.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/firmware/arm_scmi/driver.c +1 -2
@@ -805,6 +805,7 @@ __scmi_xfer_put(struct scmi_xfers_info *minfo, struct scmi_xfer *xfer)scmi_dec_count (info->dbg,XFERS_INFLIGHT ); } + xfer->flags =0 ;hlist_add_head (&xfer->node, &minfo->free_xfers); }spin_unlock_irqrestore (&minfo->xfer_lock, flags);
@@ -823,8 +824,6 @@ void scmi_xfer_raw_put(const struct scmi_handle *handle, struct scmi_xfer *xfer) {struct scmi_info *info =handle_to_scmi_info (handle); - xfer->flags &= ~SCMI_XFER_FLAG_IS_RAW ; - xfer->flags &= ~SCMI_XFER_FLAG_CHAN_SET ;return __scmi_xfer_put (&info->tx_minfo, xfer); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/184 spi: airoha: return an error for continuous mode dirmap creation cases
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
[ Upstream commit 4314ffce4eb81a6c18700af1b6e29b6e0c6b9e37 ]
This driver can accelerate single page operations only, thus continuous reading mode should not be used.
Continuous reading will use sizes up to the size of one erase block. This size is much larger than the size of single flash page. Use this difference to identify continuous reading and return an error.
--- drivers/spi/spi-airoha-snfi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi-airoha-snfi.c +4 -0
@@ -618,6 +618,10 @@ static int airoha_snand_dirmap_create(struct spi_mem_dirmap_desc *desc)if (desc->info.offset + desc->info.length >U32_MAX )return -EINVAL ; +/* continuous reading is not supported */ +if (desc->info.length >SPI_NAND_CACHE_SIZE ) +return -E2BIG ; +if (!airoha_snand_supports_op (desc->mem, &desc->info.op_tmpl))return -EOPNOTSUPP ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/184 spi: airoha: add support of dual/quad wires spi modes to exec_op() handler
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
[ Upstream commit edd2e261b1babb92213089b5feadca12e3459322 ]
Booting without this patch and disabled dirmap support results in
[ 2.980719] spi-nand spi0.0: Micron SPI NAND was found. [ 2.986040] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128 [ 2.994709] 2 fixed-partitions partitions found on MTD device spi0.0 [ 3.001075] Creating 2 MTD partitions on "spi0.0": [ 3.005862] 0x000000000000-0x000000020000 : "bl2" [ 3.011272] 0x000000020000-0x000010000000 : "ubi" ... [ 6.195594] ubi0: attaching mtd1 [ 13.338398] ubi0: scanning is finished [ 13.342188] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 13.349784] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22 [ 13.356897] UBI error: cannot attach mtd1
If dirmap is disabled or not supported in the spi driver, the dirmap requests will be executed via exec_op() handler. Thus, if the hardware supports dual/quad spi modes, then corresponding requests will be sent to exec_op() handler. Current driver does not support such requests, so error is arrised. As result the flash can't be read/write.
This patch adds support of dual and quad wires spi modes to exec_op() handler.
--- drivers/spi/spi-airoha-snfi.c | 108 ++++++++++++++++++++++++++-------- 1 file changed, 82 insertions(+), 26 deletions(-)
drivers/spi/spi-airoha-snfi.c +82 -26
@@ -192,6 +192,14 @@#define SPI_NAND_OP_RESET 0xff#define SPI_NAND_OP_DIE_SELECT 0xc2 +/* SNAND FIFO commands */ +#define SNAND_FIFO_TX_BUSWIDTH_SINGLE 0x08 +#define SNAND_FIFO_TX_BUSWIDTH_DUAL 0x09 +#define SNAND_FIFO_TX_BUSWIDTH_QUAD 0x0a +#define SNAND_FIFO_RX_BUSWIDTH_SINGLE 0x0c +#define SNAND_FIFO_RX_BUSWIDTH_DUAL 0x0e +#define SNAND_FIFO_RX_BUSWIDTH_QUAD 0x0f +#define SPI_NAND_CACHE_SIZE (SZ_4K + SZ_256)#define SPI_MAX_TRANSFER_SIZE 511
@@ -387,10 +395,26 @@ static int airoha_snand_set_mode(struct airoha_snand_ctrl *as_ctrl,return regmap_write (as_ctrl->regmap_ctrl,REG_SPI_CTRL_DUMMY ,0 ); } -static int airoha_snand_write_data (struct airoha_snand_ctrl *as_ctrl,u8 cmd, -const u8 *data,int len) +static int airoha_snand_write_data (struct airoha_snand_ctrl *as_ctrl, +const u8 *data,int len,int buswidth) {int i, data_len; +u8 cmd; + +switch (buswidth) { +case 0 : +case 1 : + cmd =SNAND_FIFO_TX_BUSWIDTH_SINGLE ; +break ; +case 2 : + cmd =SNAND_FIFO_TX_BUSWIDTH_DUAL ; +break ; +case 4 : + cmd =SNAND_FIFO_TX_BUSWIDTH_QUAD ; +break ; +default : +return -EINVAL ; + }for (i =0 ; i < len; i += data_len) {int err;
@@ -409,16 +433,32 @@ static int airoha_snand_write_data(struct airoha_snand_ctrl *as_ctrl, u8 cmd,return 0 ; } -static int airoha_snand_read_data (struct airoha_snand_ctrl *as_ctrl,u8 *data, -int len) +static int airoha_snand_read_data (struct airoha_snand_ctrl *as_ctrl, +u8 *data,int len,int buswidth) {int i, data_len; +u8 cmd; + +switch (buswidth) { +case 0 : +case 1 : + cmd =SNAND_FIFO_RX_BUSWIDTH_SINGLE ; +break ; +case 2 : + cmd =SNAND_FIFO_RX_BUSWIDTH_DUAL ; +break ; +case 4 : + cmd =SNAND_FIFO_RX_BUSWIDTH_QUAD ; +break ; +default : +return -EINVAL ; + }for (i =0 ; i < len; i += data_len) {int err; data_len =min (len - i,SPI_MAX_TRANSFER_SIZE ); - err =airoha_snand_set_fifo_op (as_ctrl,0xc , data_len); + err =airoha_snand_set_fifo_op (as_ctrl, cmd, data_len);if (err)return err;
@@ -902,12 +942,28 @@ static ssize_t airoha_snand_dirmap_write(struct spi_mem_dirmap_desc *desc,static int airoha_snand_exec_op (struct spi_mem *mem,const struct spi_mem_op *op) { -u8 data[8 ], cmd, opcode = op->cmd.opcode;struct airoha_snand_ctrl *as_ctrl; +int op_len, addr_len, dummy_len; +u8 buf[20 ], *data;int i, err; as_ctrl =spi_controller_get_devdata (mem->spi->controller); + op_len = op->cmd.nbytes; + addr_len = op->addr.nbytes; + dummy_len = op->dummy.nbytes; + +if (op_len + dummy_len + addr_len >sizeof (buf)) +return -EIO ; + + data = buf; +for (i =0 ; i < op_len; i++) + *data++ = op->cmd.opcode >> (8 * (op_len - i -1 )); +for (i =0 ; i < addr_len; i++) + *data++ = op->addr.val >> (8 * (addr_len - i -1 )); +for (i =0 ; i < dummy_len; i++) + *data++ =0xff ; +/* switch to manual mode */ err =airoha_snand_set_mode (as_ctrl,SPI_MODE_MANUAL );if (err <0 )
@@ -918,40 +974,40 @@ static int airoha_snand_exec_op(struct spi_mem *mem,return err;/* opcode */ - err =airoha_snand_write_data (as_ctrl,0x8 , &opcode,sizeof (opcode)); + data = buf; + err =airoha_snand_write_data (as_ctrl, data, op_len, + op->cmd.buswidth);if (err)return err;/* addr part */ - cmd = opcode ==SPI_NAND_OP_GET_FEATURE ?0x11 :0x8 ; -put_unaligned_be64 (op->addr.val, data); - -for (i =ARRAY_SIZE (data) - op->addr.nbytes; - i <ARRAY_SIZE (data); i++) { - err =airoha_snand_write_data (as_ctrl, cmd, &data[i], -sizeof (data[0 ])); + data += op_len; +if (addr_len) { + err =airoha_snand_write_data (as_ctrl, data, addr_len, + op->addr.buswidth);if (err)return err; }/* dummy */ - data[0 ] =0xff ; -for (i =0 ; i < op->dummy.nbytes; i++) { - err =airoha_snand_write_data (as_ctrl,0x8 , &data[0 ], -sizeof (data[0 ])); + data += addr_len; +if (dummy_len) { + err =airoha_snand_write_data (as_ctrl, data, dummy_len, + op->dummy.buswidth);if (err)return err; }/* data */ -if (op->data.dir ==SPI_MEM_DATA_IN ) { - err =airoha_snand_read_data (as_ctrl, op->data.buf.in, - op->data.nbytes); -if (err) -return err; - }else { - err =airoha_snand_write_data (as_ctrl,0x8 , op->data.buf.out, - op->data.nbytes); +if (op->data.nbytes) { +if (op->data.dir ==SPI_MEM_DATA_IN ) + err =airoha_snand_read_data (as_ctrl, op->data.buf.in, + op->data.nbytes, + op->data.buswidth); +else + err =airoha_snand_write_data (as_ctrl, op->data.buf.out, + op->data.nbytes, + op->data.buswidth);if (err)return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/184 spi: airoha: switch back to non-dma mode in the case of error
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
[ Upstream commit 20d7b236b78c7ec685a22db5689b9c829975e0c3 ]
Current dirmap code does not switch back to non-dma mode in the case of error. This is wrong.
This patch fixes dirmap read/write error path.
--- drivers/spi/spi-airoha-snfi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/spi/spi-airoha-snfi.c +5 -2
@@ -698,13 +698,13 @@ static ssize_t airoha_snand_dirmap_read(struct spi_mem_dirmap_desc *desc, err =airoha_snand_nfi_config (as_ctrl);if (err) -return err; + goto error_dma_mode_off; dma_addr =dma_map_single (as_ctrl->dev, txrx_buf,SPI_NAND_CACHE_SIZE ,DMA_FROM_DEVICE ); err =dma_mapping_error (as_ctrl->dev, dma_addr);if (err) -return err; + goto error_dma_mode_off;/* set dma addr */ err = regmap_write(as_ctrl->regmap_nfi, REG_SPI_NFI_STRADDR,
@@ -804,6 +804,8 @@ static ssize_t airoha_snand_dirmap_read(struct spi_mem_dirmap_desc *desc, error_dma_unmap:dma_unmap_single (as_ctrl->dev, dma_addr,SPI_NAND_CACHE_SIZE ,DMA_FROM_DEVICE ); +error_dma_mode_off: +airoha_snand_set_mode (as_ctrl,SPI_MODE_MANUAL );return err; }
@@ -936,6 +938,7 @@ static ssize_t airoha_snand_dirmap_write(struct spi_mem_dirmap_desc *desc, error_dma_unmap:dma_unmap_single (as_ctrl->dev, dma_addr,SPI_NAND_CACHE_SIZE ,DMA_TO_DEVICE ); +airoha_snand_set_mode (as_ctrl,SPI_MODE_MANUAL );return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/184 spi: airoha: fix reading/writing of flashes with more than one plane per lun
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
[ Upstream commit 0b7d9b25e4bc2e478c9d06281a65f930769fca09 ]
Attaching UBI on the flash with more than one plane per lun will lead to the following error:
[ 2.980989] spi-nand spi0.0: Micron SPI NAND was found. [ 2.986309] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128 [ 2.994978] 2 fixed-partitions partitions found on MTD device spi0.0 [ 3.001350] Creating 2 MTD partitions on "spi0.0": [ 3.006159] 0x000000000000-0x000000020000 : "bl2" [ 3.011663] 0x000000020000-0x000010000000 : "ubi" ... [ 6.391748] ubi0: attaching mtd1 [ 6.412545] ubi0 error: ubi_attach: PEB 0 contains corrupted VID header, and the data does not contain all 0xFF [ 6.422677] ubi0 error: ubi_attach: this may be a non-UBI PEB or a severe VID header corruption which requires manual inspection [ 6.434249] Volume identifier header dump: [ 6.438349] magic 55424923 [ 6.441482] version 1 [ 6.444007] vol_type 0 [ 6.446539] copy_flag 0 [ 6.449068] compat 0 [ 6.451594] vol_id 0 [ 6.454120] lnum 1 [ 6.456651] data_size 4096 [ 6.459442] used_ebs 1061644134 [ 6.462748] data_pad 0 [ 6.465274] sqnum 0 [ 6.467805] hdr_crc 61169820 [ 6.470943] Volume identifier header hexdump: [ 6.475308] hexdump of PEB 0 offset 4096, length 126976 [ 6.507391] ubi0 warning: ubi_attach: valid VID header but corrupted EC header at PEB 4 [ 6.515415] ubi0 error: ubi_compare_lebs: unsupported on-flash UBI format [ 6.522222] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22 [ 6.529294] UBI error: cannot attach mtd1
Non dirmap reading works good. Looking to spi_mem_no_dirmap_read() code we'll see:
static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc,
u64 offs, size_t len, void *buf)
{
struct spi_mem_op op = desc->info.op_tmpl;
int ret;// --- see here ---
op.addr.val = desc->info.offset + offs; //----------------- op.data.buf.in = buf; op.data.nbytes = len; ret = spi_mem_adjust_op_size(desc->mem, &op); if (ret) return ret; ret = spi_mem_exec_op(desc->mem, &op); if (ret) return ret; return op.data.nbytes; }
The similar happens for spi_mem_no_dirmap_write(). Thus the address passed to the flash should take in the account the value of desc->info.offset.
This patch fix dirmap reading/writing of flashes with more than one plane per lun.
--- drivers/spi/spi-airoha-snfi.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/spi/spi-airoha-snfi.c +6 -3
@@ -733,8 +733,9 @@ static ssize_t airoha_snand_dirmap_read(struct spi_mem_dirmap_desc *desc,if (err) goto error_dma_unmap; -/* set read addr */ - err =regmap_write (as_ctrl->regmap_nfi,REG_SPI_NFI_RD_CTL3 ,0x0 ); +/* set read addr: zero page offset + descriptor read offset */ + err =regmap_write (as_ctrl->regmap_nfi,REG_SPI_NFI_RD_CTL3 , + desc->info.offset);if (err) goto error_dma_unmap;
@@ -870,7 +871,9 @@ static ssize_t airoha_snand_dirmap_write(struct spi_mem_dirmap_desc *desc,if (err) goto error_dma_unmap; - err =regmap_write (as_ctrl->regmap_nfi,REG_SPI_NFI_PG_CTL2 ,0x0 ); +/* set write addr: zero page offset + descriptor write offset */ + err =regmap_write (as_ctrl->regmap_nfi,REG_SPI_NFI_PG_CTL2 , + desc->info.offset);if (err) goto error_dma_unmap;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/184 sysfs: check visibility before changing group attribute ownership
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33 ]
Since commit 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)"), __dev_change_net_namespace() can hit WARN_ON() when trying to change owner of a file that isn't visible. See the trace below:
WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP: 0010:__dev_change_net_namespace+0xb89/0xc30 [...] Call Trace: <TASK> ? if6_seq_show+0x30/0x50 do_setlink.isra.0+0xc7/0x1270 ? __nla_validate_parse+0x5c/0xcc0 ? security_capable+0x94/0x1a0 rtnl_newlink+0x858/0xc20 ? update_curr+0x8e/0x1c0 ? update_entity_lag+0x71/0x80 ? sched_balance_newidle+0x358/0x450 ? psi_task_switch+0x113/0x2a0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x346/0x3e0 ? sched_clock+0x10/0x30 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x59/0x110 netlink_unicast+0x285/0x3c0 ? __alloc_skb+0xdb/0x1a0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x39f/0x3d0 ? import_iovec+0x2f/0x40 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x81/0x970 ? __sys_bind+0xe3/0x110 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? sock_alloc_file+0x63/0xc0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? alloc_fd+0x12e/0x190 ? put_unused_fd+0x2a/0x70 ? do_sys_openat2+0xa2/0xe0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK>
Fix this by checking is_visible() before trying to touch the attribute.
--- fs/sysfs/group.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
fs/sysfs/group.c +21 -5
@@ -498,17 +498,26 @@ int compat_only_sysfs_link_entry_to_kobj(struct kobject *kobj, }EXPORT_SYMBOL_GPL (compat_only_sysfs_link_entry_to_kobj); -static int sysfs_group_attrs_change_owner (struct kernfs_node *grp_kn, +static int sysfs_group_attrs_change_owner (struct kobject *kobj, +struct kernfs_node *grp_kn,const struct attribute_group *grp,struct iattr *newattrs) {struct kernfs_node *kn; -int error; +int error, i; +umode_t mode;if (grp->attrs) {struct attribute *const *attr; -for (attr = grp->attrs; *attr; attr++) { +for (i =0 , attr = grp->attrs; *attr; i++, attr++) { +if (grp->is_visible) { + mode = grp->is_visible (kobj, *attr, i); +if (mode &SYSFS_GROUP_INVISIBLE ) +break ; +if (!mode) +continue ; + } kn =kernfs_find_and_get (grp_kn, (*attr)->name);if (!kn)return -ENOENT ;
@@ -523,7 +532,14 @@ static int sysfs_group_attrs_change_owner(struct kernfs_node *grp_kn,if (grp->bin_attrs) {const struct bin_attribute *const *bin_attr; -for (bin_attr = grp->bin_attrs; *bin_attr; bin_attr++) { +for (i =0 , bin_attr = grp->bin_attrs; *bin_attr; i++, bin_attr++) { +if (grp->is_bin_visible) { + mode = grp->is_bin_visible (kobj, *bin_attr, i); +if (mode &SYSFS_GROUP_INVISIBLE ) +break ; +if (!mode) +continue ; + } kn =kernfs_find_and_get (grp_kn, (*bin_attr)->attr.name);if (!kn)return -ENOENT ;
@@ -573,7 +589,7 @@ int sysfs_group_change_owner(struct kobject *kobj, error =kernfs_setattr (grp_kn, &newattrs);if (!error) - error =sysfs_group_attrs_change_owner (grp_kn, grp, &newattrs); + error =sysfs_group_attrs_change_owner (kobj, grp_kn, grp, &newattrs);kernfs_put (grp_kn);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/184 drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akash Goel <[email protected]>
[ Upstream commit 4eabd0d8791eaf9a7b114ccbf56eb488aefe7b1f ]
This commit address a kernel panic issue that can happen if Userspace tries to partially unmap a GPU virtual region (aka drm_gpuva). The VM_BIND interface allows partial unmapping of a BO.
Panthor driver pre-allocates memory for the new drm_gpuva structures that would be needed for the map/unmap operation, done using drm_gpuvm layer. It expected that only one new drm_gpuva would be needed on umap but a partial unmap can require 2 new drm_gpuva and that's why it ended up doing a NULL pointer dereference causing a kernel panic.
Following dump was seen when partial unmap was exercised.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000078 Mem abort info: ESR = 0x0000000096000046 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000088a863000 [000000000000078] pgd=080000088a842003, p4d=080000088a842003, pud=0800000884bf5003, pmd=0000000000000000 Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP <snip> pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : panthor_gpuva_sm_step_remap+0xe4/0x330 [panthor] lr : panthor_gpuva_sm_step_remap+0x6c/0x330 [panthor] sp : ffff800085d43970 x29: ffff800085d43970 x28: ffff00080363e440 x27: ffff0008090c6000 x26: 0000000000000030 x25: ffff800085d439f8 x24: ffff00080d402000 x23: ffff800085d43b60 x22: ffff800085d439e0 x21: ffff00080abdb180 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000010 x17: 6e656c202c303030 x16: 3666666666646466 x15: 393d61766f69202c x14: 312d3d7361203a70 x13: 303030323d6e656c x12: ffff80008324bf58 x11: 0000000000000003 x10: 0000000000000002 x9 : ffff8000801a6a9c x8 : ffff00080360b300 x7 : 0000000000000000 x6 : 000000088aa35fc7 x5 : fff1000080000000 x4 : ffff8000842ddd30 x3 : 0000000000000001 x2 : 0000000100000000 x1 : 0000000000000001 x0 : 0000000000000078 Call trace: panthor_gpuva_sm_step_remap+0xe4/0x330 [panthor] op_remap_cb.isra.22+0x50/0x80 __drm_gpuvm_sm_unmap+0x10c/0x1c8 drm_gpuvm_sm_unmap+0x40/0x60 panthor_vm_exec_op+0xb4/0x3d0 [panthor] panthor_vm_bind_exec_sync_op+0x154/0x278 [panthor] panthor_ioctl_vm_bind+0x160/0x4a0 [panthor] drm_ioctl_kernel+0xbc/0x138 drm_ioctl+0x240/0x500 __arm64_sys_ioctl+0xb0/0xf8 invoke_syscall+0x4c/0x110 el0_svc_common.constprop.1+0x98/0xf8 do_el0_svc+0x24/0x38 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xc8 el0t_64_sync+0x174/0x178
--- drivers/gpu/drm/panthor/panthor_mmu.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/panthor/panthor_mmu.c +7 -3
@@ -1147,10 +1147,14 @@ panthor_vm_op_ctx_prealloc_vmas(struct panthor_vm_op_ctx *op_ctx)break ;case DRM_PANTHOR_VM_BIND_OP_TYPE_UNMAP : -/* Partial unmaps might trigger a remap with either a prev or a next VA, -* but not both. +/* Two VMAs can be needed for an unmap, as an unmap can happen +* in the middle of a drm_gpuva, requiring a remap with both +* prev & next VA. Or an unmap can span more than one drm_gpuva +* where the first and last ones are covered partially, requring +* a remap for the first with a prev VA and remap for the last +* with a next VA. */ - vma_count =1 ; + vma_count =2 ;break ;default :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/184 RISC-V: Define pgprot_dmacoherent() for non-coherent devices
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
[ Upstream commit ca525d53f994d45c8140968b571372c45f555ac1 ]
The pgprot_dmacoherent() is used when allocating memory for non-coherent devices and by default pgprot_dmacoherent() is same as pgprot_noncached() unless architecture overrides it.
Currently, there is no pgprot_dmacoherent() definition for RISC-V hence non-coherent device memory is being mapped as IO thereby making CPU access to such memory slow.
Define pgprot_dmacoherent() to be same as pgprot_writecombine() for RISC-V so that CPU access non-coherent device memory as NOCACHE which is better than accessing it as IO.
--- arch/riscv/include/asm/pgtable.h | 2 ++ 1 file changed, 2 insertions(+)
arch/riscv/include/asm/pgtable.h +2 -0
@@ -653,6 +653,8 @@ static inline pgprot_t pgprot_writecombine(pgprot_t _prot)return __pgprot (prot); } +#define pgprot_dmacoherent pgprot_writecombine +/* * Both Svade and Svadu control the hardware behavior when the PTE A/D bits need to be set. By * default the M-mode firmware enables the hardware updating scheme when only Svadu is present in
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/184 RISC-V: Dont print details of CPUs disabled in DT
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
[ Upstream commit d2721bb165b3ee00dd23525885381af07fec852a ]
Early boot stages may disable CPU DT nodes for unavailable CPUs based on SKU, pinstraps, eFuse, etc. Currently, the riscv_early_of_processor_hartid() prints details of a CPU if it is disabled in DT which has no value and gives a false impression to the users that there some issue with the CPU.
--- arch/riscv/kernel/cpu.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/riscv/kernel/cpu.c +1 -3
@@ -62,10 +62,8 @@ int __init riscv_early_of_processor_hartid(struct device_node *node, unsigned loreturn -ENODEV ; } -if (!of_device_is_available (node)) { -pr_info ("CPU with hartid=%lu is not available\n" , *hart); +if (!of_device_is_available (node))return -ENODEV ; - }if (of_property_read_string (node,"riscv,isa-base" , &isa)) goto old_interface;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/184 riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Walmsley <[email protected]>
[ Upstream commit b7776a802f2f80139f96530a489dd00fd7089eda ]
Resolve this smatch warning:
arch/riscv/kernel/sys_hwprobe.c:50 hwprobe_arch_id() error: uninitialized symbol 'cpu_id'.
This could happen if hwprobe_arch_id() was called with a key ID of something other than MVENDORID, MIMPID, and MARCHID. This does not happen in the current codebase. The only caller of hwprobe_arch_id() is a function that only passes one of those three key IDs.
For the sake of reducing static analyzer warning noise, and in the unlikely event that hwprobe_arch_id() is someday called with some other key ID, validate hwprobe_arch_id()'s input to ensure that 'cpu_id' is always initialized before use.
--- arch/riscv/kernel/sys_hwprobe.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/riscv/kernel/sys_hwprobe.c +6 -0
@@ -30,6 +30,11 @@ static void hwprobe_arch_id(struct riscvbool first = true;int cpu; +if (pair->key !=RISCV_HWPROBE_KEY_MVENDORID && + pair->key !=RISCV_HWPROBE_KEY_MIMPID && + pair->key !=RISCV_HWPROBE_KEY_MARCHID ) + goto out; +for_each_cpu (cpu, cpus) {u64 cpu_id;
@@ -60,6 +65,7 @@ static void hwprobe_arch_id(struct riscv } } +out: pair->value = id; }
Greg Kroah-Hartman
maintainerPATCH 135/184 hwmon: (pmbus/isl68137) Fix child node reference leak on early return
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <[email protected]>
[ Upstream commit 57f6f47920ef2f598c46d0a04bd9c8984c98e6df ]
In the case of an early return, the reference to the child node needs to be released.
Use for_each_child_of_node_scoped to fix the issue.
--- drivers/hwmon/pmbus/isl68137.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/hwmon/pmbus/isl68137.c +1 -2
@@ -334,10 +334,9 @@ static int isl68137_probe_from_dt(struct device *dev, struct isl68137_data *data) {const struct device_node *np = dev->of_node; -struct device_node *child;int err; -for_each_child_of_node (np, child) { +for_each_child_of_node_scoped (np, child) {if (strcmp (child->name,"channel" ))continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/184 hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <[email protected]>
[ Upstream commit a09a5aa8bf258ddc99a22c30f17fe304b96b5350 ]
The driver allocates memory for sensor data using devm_kzalloc(), but did not check if the allocation succeeded. In case of memory allocation failure, dereferencing the NULL pointer would lead to a kernel crash.
Add a NULL pointer check and return -ENOMEM to handle allocation failure properly.
--- drivers/hwmon/cgbc-hwmon.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hwmon/cgbc-hwmon.c +3 -0
@@ -107,6 +107,9 @@ static int cgbc_hwmon_probe_sensors(struct device *dev, struct cgbc_hwmon_data * nb_sensors = data[0 ]; hwmon->sensors =devm_kzalloc (dev,sizeof (*hwmon->sensors) * nb_sensors,GFP_KERNEL ); +if (!hwmon->sensors) +return -ENOMEM ; + sensor = hwmon->sensors;for (i =0 ; i < nb_sensors; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/184 hwmon: (sht3x) Fix error handling
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 8dcc66ad379ec0642fb281c45ccfd7d2d366e53f ]
Handling of errors when reading status, temperature, and humidity returns the error number as negative attribute value. Fix it up by returning the error as return value.
--- drivers/hwmon/sht3x.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/hwmon/sht3x.c +17 -10
@@ -291,24 +291,26 @@ static struct sht3x_data *sht3x_update_client(struct device *dev)return data; } -static int temp1_input_read (struct device *dev) +static int temp1_input_read (struct device *dev,long *temp) {struct sht3x_data *data =sht3x_update_client (dev);if (IS_ERR (data))return PTR_ERR (data); -return data->temperature; + *temp = data->temperature; +return 0 ; } -static int humidity1_input_read (struct device *dev) +static int humidity1_input_read (struct device *dev,long *humidity) {struct sht3x_data *data =sht3x_update_client (dev);if (IS_ERR (data))return PTR_ERR (data); -return data->humidity; + *humidity = data->humidity; +return 0 ; }/*
@@ -706,6 +708,7 @@ static int sht3x_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, int channel, long *val) { enum sht3x_limits index; +int ret;switch (type) {case hwmon_chip:
@@ -720,10 +723,12 @@ static int sht3x_read(struct device *dev, enum hwmon_sensor_types type,case hwmon_temp:switch (attr) {case hwmon_temp_input: - *val =temp1_input_read (dev); -break ; +return temp1_input_read (dev, val);case hwmon_temp_alarm: - *val =temp1_alarm_read (dev); + ret =temp1_alarm_read (dev); +if (ret <0 ) +return ret; + *val = ret;break ;case hwmon_temp_max: index = limit_max;
@@ -748,10 +753,12 @@ static int sht3x_read(struct device *dev, enum hwmon_sensor_types type,case hwmon_humidity:switch (attr) {case hwmon_humidity_input: - *val =humidity1_input_read (dev); -break ; +return humidity1_input_read (dev, val);case hwmon_humidity_alarm: - *val =humidity1_alarm_read (dev); + ret =humidity1_alarm_read (dev); +if (ret <0 ) +return ret; + *val = ret;break ;case hwmon_humidity_max: index = limit_max;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/184 io_uring: fix incorrect unlikely() usage in io_waitid_prep()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 4ec703ec0c384a2199808c4eb2e9037236285a8d ]
The negation operator is incorrectly placed outside the unlikely() macro:
if (!unlikely(iwa))
This inverts the compiler branch prediction hint, marking the NULL case as likely instead of unlikely. The intent is to indicate that allocation failures are rare, consistent with common kernel patterns.
Moving the negation inside unlikely():
if (unlikely(!iwa))
--- io_uring/waitid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/waitid.c +1 -1
@@ -252,7 +252,7 @@ int io_waitid_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)return -EINVAL ; iwa =io_uring_alloc_async_data (NULL , req); -if (!unlikely (iwa)) +if (unlikely (!iwa))return -ENOMEM ; iwa->req = req;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/184 nbd: override creds to kernel when calling sock_{send,recv}msg()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 81ccca31214e11ea2b537fd35d4f66d7cf46268e ]
sock_{send,recv}msg() internally calls security_socket_{send,recv}msg(), which does security checks (e.g. SELinux) for socket access against the current task. However, _sock_xmit() in drivers/block/nbd.c may be called indirectly from a userspace syscall, where the NBD socket access would be incorrectly checked against the calling userspace task (which simply tries to read/write a file that happens to reside on an NBD device).
To fix this, temporarily override creds to kernel ones before calling the sock_*() functions. This allows the security modules to recognize this as internal access by the kernel, which will normally be allowed.
A way to trigger the issue is to do the following (on a system with SELinux set to enforcing):
### Create nbd device:
truncate -s 256M /tmp/testfile
nbd-server localhost:10809 /tmp/testfile
### Connect to the nbd server:
nbd-client localhost
### Create mdraid array
mdadm --create -l 1 -n 2 /dev/md/testarray /dev/nbd0 missing
After these steps, assuming the SELinux policy doesn't allow the unexpected access pattern, errors will be visible on the kernel console:
[ 142.204243] nbd0: detected capacity change from 0 to 524288 [ 165.189967] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 165.252299] md/raid1:md127: active with 1 out of 2 mirrors [ 165.252725] md127: detected capacity change from 0 to 522240 [ 165.255434] block nbd0: Send control failed (result -13) [ 165.255718] block nbd0: Request send failed, requeueing [ 165.256006] block nbd0: Dead connection, failed to find a fallback [ 165.256041] block nbd0: Receive control failed (result -32) [ 165.256423] block nbd0: shutting down sockets [ 165.257196] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.257736] Buffer I/O error on dev md127, logical block 0, async page read [ 165.258263] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.259376] Buffer I/O error on dev md127, logical block 0, async page read [ 165.259920] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.260628] Buffer I/O error on dev md127, logical block 0, async page read [ 165.261661] ldm_validate_partition_table(): Disk read failed. [ 165.262108] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.262769] Buffer I/O error on dev md127, logical block 0, async page read [ 165.263697] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.264412] Buffer I/O error on dev md127, logical block 0, async page read [ 165.265412] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.265872] Buffer I/O error on dev md127, logical block 0, async page read [ 165.266378] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.267168] Buffer I/O error on dev md127, logical block 0, async page read [ 165.267564] md127: unable to read partition table [ 165.269581] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.269960] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.270316] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.270913] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.271253] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.271809] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.272074] ldm_validate_partition_table(): Disk read failed. [ 165.272360] nbd0: unable to read partition table [ 165.289004] ldm_validate_partition_table(): Disk read failed. [ 165.289614] nbd0: unable to read partition table
The corresponding SELinux denial on Fedora/RHEL will look like this
(assuming it's not silenced):
type=AVC msg=audit(1758104872.510:116): avc: denied { write } for pid=1908 comm="mdadm" laddr=::1 lport=32772 faddr=::1 fport=10809 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0
The respective backtrace looks like this:
@security[mdadm, -13,
handshake_exit+221615650
handshake_exit+221615650
handshake_exit+221616465
security_socket_sendmsg+5
sock_sendmsg+106
handshake_exit+221616150
sock_sendmsg+5
__sock_xmit+162
nbd_send_cmd+597
nbd_handle_cmd+377
nbd_queue_rq+63
blk_mq_dispatch_rq_list+653
__blk_mq_do_dispatch_sched+184
__blk_mq_sched_dispatch_requests+333
blk_mq_sched_dispatch_requests+38
blk_mq_run_hw_queue+239
blk_mq_dispatch_plug_list+382
blk_mq_flush_plug_list.part.0+55
__blk_flush_plug+241
__submit_bio+353
submit_bio_noacct_nocheck+364
submit_bio_wait+84
__blkdev_direct_IO_simple+232
blkdev_read_iter+162
vfs_read+591
ksys_read+95
do_syscall_64+92
entry_SYSCALL_64_after_hwframe+120]: 1
The issue has started to appear since commit 060406c61c7c ("block: add plug while submitting IO").
--- drivers/block/nbd.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/block/nbd.c +15 -0
@@ -52,6 +52,7 @@static DEFINE_IDR (nbd_index_idr);static DEFINE_MUTEX (nbd_index_mutex);static struct workqueue_struct *nbd_del_wq; +static struct cred *nbd_cred;static int nbd_total_devices =0 ;struct nbd_sock {
@@ -554,6 +555,7 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send,int result;struct msghdr msg = {} ;unsigned int noreclaim_flag; +const struct cred *old_cred;if (unlikely (!sock)) { dev_err_ratelimited(disk_to_dev(nbd->disk),
@@ -562,6 +564,8 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send,return -EINVAL ; } + old_cred =override_creds (nbd_cred); + msg.msg_iter = *iter; noreclaim_flag =memalloc_noreclaim_save ();
@@ -586,6 +590,8 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send,memalloc_noreclaim_restore (noreclaim_flag); +revert_creds (old_cred); +return result; }
@@ -2677,7 +2683,15 @@ static int __init nbd_init(void)return -ENOMEM ; } + nbd_cred =prepare_kernel_cred (&init_task); +if (!nbd_cred) { +destroy_workqueue (nbd_del_wq); +unregister_blkdev (NBD_MAJOR ,"nbd" ); +return -ENOMEM ; + } +if (genl_register_family (&nbd_genl_family)) { +put_cred (nbd_cred);destroy_workqueue (nbd_del_wq);unregister_blkdev (NBD_MAJOR ,"nbd" );return -EINVAL ;
@@ -2732,6 +2746,7 @@ static void __exit nbd_cleanup(void)/* Also wait for nbd_dev_remove_work() completes */ destroy_workqueue (nbd_del_wq); +put_cred (nbd_cred);idr_destroy (&nbd_index_idr);unregister_blkdev (NBD_MAJOR ,"nbd" ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 140/184 drm/panic: Fix drawing the logo on a small narrow screen
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jocelyn Falempe <[email protected]>
[ Upstream commit 179753aa5b7890b311968c033d08f558f0a7be21 ]
If the logo width is bigger than the framebuffer width, and the height is big enough to hold the logo and the message, it will draw at x coordinate that are higher than the width, and ends up in a corrupted image.
--- drivers/gpu/drm/drm_panic.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/drm_panic.c +3 -0
@@ -429,6 +429,9 @@ static void drm_panic_logo_rect(struct drm_rect *rect, const struct font_desc *fstatic void drm_panic_logo_draw (struct drm_scanout_buffer *sb,struct drm_rect *rect,const struct font_desc *font,u32 fg_color) { +if (rect->x2 > sb->width || rect->y2 > sb->height) +return ; +if (logo_mono)drm_panic_blit (sb, rect, logo_mono->data,DIV_ROUND_UP (drm_rect_width (rect),8 ),1 , fg_color);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 141/184 drm/panic: Fix qr_code, ensure vmargin is positive
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jocelyn Falempe <[email protected]>
[ Upstream commit 4fcffb5e5c8c0c8e2ad9c99a22305a0afbecc294 ]
Depending on qr_code size and screen size, the vertical margin can be negative, that means there is not enough room to draw the qr_code.
So abort early, to avoid a segfault by trying to draw at negative coordinates.
--- drivers/gpu/drm/drm_panic.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_panic.c +4 -1
@@ -736,7 +736,10 @@ static int _draw_panic_static_qr_code(struct drm_scanout_buffer *sb)pr_debug ("QR width %d and scale %d\n" , qr_width, scale); r_qr_canvas =DRM_RECT_INIT (0 ,0 , qr_canvas_width * scale, qr_canvas_width * scale); - v_margin = (sb->height -drm_rect_height (&r_qr_canvas) -drm_rect_height (&r_msg)) /5 ; + v_margin = sb->height -drm_rect_height (&r_qr_canvas) -drm_rect_height (&r_msg); +if (v_margin <0 ) +return -ENOSPC ; + v_margin /=5 ;drm_rect_translate (&r_qr_canvas, (sb->width - r_qr_canvas.x2) /2 ,2 * v_margin); r_qr = DRM_RECT_INIT(r_qr_canvas.x1 + QR_MARGIN * scale, r_qr_canvas.y1 + QR_MARGIN * scale,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 142/184 drm/panic: Fix 24bit pixel crossing page boundaries
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jocelyn Falempe <[email protected]>
[ Upstream commit 23437509a69476d4f896891032d62ac868731668 ]
When using page list framebuffer, and using RGB888 format, some pixels can cross the page boundaries, and this case was not handled, leading to writing 1 or 2 bytes on the next virtual address.
Add a check and a specific function to handle this case.
--- drivers/gpu/drm/drm_panic.c | 46 +++++++++++++++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_panic.c +44 -2
@@ -174,6 +174,33 @@ static void drm_panic_write_pixel24(void *vaddr, unsigned int offset, u32 color) *p = color &0xff ; } +/* +* Special case if the pixel crosses page boundaries +*/ +static void drm_panic_write_pixel24_xpage (void *vaddr,struct page *next_page, +unsigned int offset,u32 color) +{ +u8 *vaddr2; +u8 *p = vaddr + offset; + + vaddr2 =kmap_local_page_try_from_panic (next_page); + + *p++ = color &0xff ; + color >>=8 ; + +if (offset ==PAGE_SIZE -1 ) + p = vaddr2; + + *p++ = color &0xff ; + color >>=8 ; + +if (offset ==PAGE_SIZE -2 ) + p = vaddr2; + + *p = color &0xff ; +kunmap_local (vaddr2); +} +static void drm_panic_write_pixel32 (void *vaddr,unsigned int offset,u32 color) {u32 *p = vaddr + offset;
@@ -231,7 +258,14 @@ static void drm_panic_blit_page(struct page **pages, unsigned int dpitch, page = new_page; vaddr =kmap_local_page_try_from_panic (pages[page]); } -if (vaddr) +if (!vaddr) +continue ; + +// Special case for 24bit, as a pixel might cross page boundaries +if (cpp ==3 && offset +3 >PAGE_SIZE ) +drm_panic_write_pixel24_xpage (vaddr, pages[page +1 ], + offset, fg32); +else drm_panic_write_pixel (vaddr, offset, fg32, cpp); } }
@@ -321,7 +355,15 @@ static void drm_panic_fill_page(struct page **pages, unsigned int dpitch, page = new_page; vaddr =kmap_local_page_try_from_panic (pages[page]); } -drm_panic_write_pixel (vaddr, offset, color, cpp); +if (!vaddr) +continue ; + +// Special case for 24bit, as a pixel might cross page boundaries +if (cpp ==3 && offset +3 >PAGE_SIZE ) +drm_panic_write_pixel24_xpage (vaddr, pages[page +1 ], + offset, color); +else +drm_panic_write_pixel (vaddr, offset, color, cpp); } }if (vaddr)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 143/184 of/irq: Convert of_msi_map_id() callers to of_msi_xlate()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <[email protected]>
[ Upstream commit a576a849d5f33356e0d8fd3eae4fbaf8869417e5 ]
With the introduction of the of_msi_xlate() function, the OF layer provides an API to map a device ID and retrieve the MSI controller node the ID is mapped to with a single call.
of_msi_map_id() is currently used to map a deviceID to a specific MSI controller node; of_msi_xlate() can be used for that purpose too, there is no need to keep the two functions.
Convert of_msi_map_id() to of_msi_xlate() calls and update the of_msi_xlate() documentation to describe how the struct device_node pointer passed in should be set-up to either provide the MSI controller node target or receive its pointer upon mapping completion.
Stable-dep-of: 119aaeed0b67 ("of/irq: Add msi-parent check to of_msi_xlate()")
--- drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c | 2 +- drivers/of/irq.c | 25 +++++---------------- drivers/pci/msi/irqdomain.c | 2 +- include/linux/of_irq.h | 6 ----- 4 files changed, 7 insertions(+), 28 deletions(-)
drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c +1 -1
@@ -30,7 +30,7 @@ static u32 fsl_mc_msi_domain_get_msi_id(struct irq_domain *domain,u32 out_id; of_node =irq_domain_get_of_node (domain); - out_id = of_node ?of_msi_map_id (&mc_dev->dev, of_node, mc_dev->icid) : + out_id = of_node ?of_msi_xlate (&mc_dev->dev, &of_node, mc_dev->icid) :iort_msi_map_id (&mc_dev->dev, mc_dev->icid);return out_id;
drivers/of/irq.c +5 -20
@@ -673,13 +673,14 @@ void __init of_irq_init(const struct of_device_id *matches)/** * of_msi_xlate - map a MSI ID and find relevant MSI controller node * @dev: device for which the mapping is to be done. -* @msi_np: Pointer to store the MSI controller node +* @msi_np: Pointer to target MSI controller node * @id_in: Device ID. * * Walk up the device hierarchy looking for devices with a "msi-map" -* property. If found, apply the mapping to @id_in. @msi_np pointed -* value must be NULL on entry, if an MSI controller is found @msi_np is -* initialized to the MSI controller node with a reference held. +* property. If found, apply the mapping to @id_in. +* If @msi_np points to a non-NULL device node pointer, only entries targeting +* that node will be matched; if it points to a NULL value, it will receive the +* device node of the first matching target phandle, with a reference held. * * Returns: The mapped MSI id. */
@@ -699,22 +700,6 @@ u32 of_msi_xlate(struct device *dev, struct device_node **msi_np, u32 id_in)return id_out; } -/** -* of_msi_map_id - Map a MSI ID for a device. -* @dev: device for which the mapping is to be done. -* @msi_np: device node of the expected msi controller. -* @id_in: unmapped MSI ID for the device. -* -* Walk up the device hierarchy looking for devices with a "msi-map" -* property. If found, apply the mapping to @id_in. -* -* Return: The mapped MSI ID. -*/ -u32 of_msi_map_id (struct device *dev,struct device_node *msi_np,u32 id_in) -{ -return of_msi_xlate (dev, &msi_np, id_in); -} -/** * of_msi_map_get_device_domain - Use msi-map to find the relevant MSI domain * @dev: device for which the mapping is to be done.
drivers/pci/msi/irqdomain.c +1 -1
@@ -479,7 +479,7 @@ u32 pci_msi_domain_get_msi_rid(struct irq_domain *domain, struct pci_dev *pdev)pci_for_each_dma_alias (pdev, get_msi_id_cb, &rid); of_node =irq_domain_get_of_node (domain); - rid = of_node ?of_msi_map_id (&pdev->dev, of_node, rid) : + rid = of_node ?of_msi_xlate (&pdev->dev, &of_node, rid) :iort_msi_map_id (&pdev->dev, rid);return rid;
include/linux/of_irq.h +0 -6
@@ -55,7 +55,6 @@ extern struct irq_domain *of_msi_map_get_device_domain(struct device *dev, u32 bus_token);extern void of_msi_configure (struct device *dev,const struct device_node *np);extern u32 of_msi_xlate (struct device *dev,struct device_node **msi_np,u32 id_in); -u32 of_msi_map_id (struct device *dev,struct device_node *msi_np,u32 id_in);#else static inline void of_irq_init (const struct of_device_id *matches) {
@@ -105,11 +104,6 @@ static inline u32 of_msi_xlate(struct device *dev, struct device_node **msi_np, {return id_in; } -static inline u32 of_msi_map_id (struct device *dev, -struct device_node *msi_np,u32 id_in) -{ -return id_in; -}#endif #if defined(CONFIG_OF_IRQ ) || defined(CONFIG_SPARC )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 144/184 of/irq: Add msi-parent check to of_msi_xlate()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <[email protected]>
[ Upstream commit 119aaeed0b6729293f41ea33be05ecd27a947d48 ]
In some legacy platforms the MSI controller for a PCI host bridge is identified by an msi-parent property whose phandle points at an MSI controller node with no #msi-cells property, that implicitly means #msi-cells == 0.
For such platforms, mapping a device ID and retrieving the MSI controller node becomes simply a matter of checking whether in the device hierarchy there is an msi-parent property pointing at an MSI controller node with such characteristics.
Add a helper function to of_msi_xlate() to check the msi-parent property in addition to msi-map and retrieve the MSI controller node (with a 1:1 ID deviceID-IN<->deviceID-OUT mapping) to provide support for deviceID mapping and MSI controller node retrieval for such platforms.
--- drivers/of/irq.c | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-)
drivers/of/irq.c +36 -3
@@ -670,6 +670,36 @@ void __init of_irq_init(const struct of_device_id *matches) } } +static int of_check_msi_parent (struct device_node *dev_node,struct device_node **msi_node) +{ +struct of_phandle_args msi_spec; +int ret; + +/* +* An msi-parent phandle with a missing or == 0 #msi-cells +* property identifies a 1:1 ID translation mapping. +* +* Set the msi controller node if the firmware matches this +* condition. +*/ + ret =of_parse_phandle_with_optional_args (dev_node,"msi-parent" ,"#msi-cells" , +0 , &msi_spec); +if (ret) +return ret; + +if ((*msi_node && *msi_node != msi_spec.np) || msi_spec.args_count !=0 ) + ret = -EINVAL ; + +if (!ret) { +/* Return with a node reference held */ + *msi_node = msi_spec.np; +return 0 ; + } +of_node_put (msi_spec.np); + +return ret; +} +/** * of_msi_xlate - map a MSI ID and find relevant MSI controller node * @dev: device for which the mapping is to be done.
@@ -677,7 +707,7 @@ void __init of_irq_init(const struct of_device_id *matches)* @id_in: Device ID. * * Walk up the device hierarchy looking for devices with a "msi-map" -* property. If found, apply the mapping to @id_in. +* or "msi-parent" property. If found, apply the mapping to @id_in. * If @msi_np points to a non-NULL device node pointer, only entries targeting * that node will be matched; if it points to a NULL value, it will receive the * device node of the first matching target phandle, with a reference held.
@@ -691,12 +721,15 @@ u32 of_msi_xlate(struct device *dev, struct device_node **msi_np, u32 id_in)/* * Walk up the device parent links looking for one with a -* "msi-map" property. +* "msi-map" or an "msi-parent" property. */ -for (parent_dev = dev; parent_dev; parent_dev = parent_dev->parent) +for (parent_dev = dev; parent_dev; parent_dev = parent_dev->parent) {if (!of_map_id (parent_dev->of_node, id_in,"msi-map" ,"msi-map-mask" , msi_np, &id_out))break ; +if (!of_check_msi_parent (parent_dev->of_node, msi_np)) +break ; + }return id_out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/184 block: require LBA dma_alignment when using PI
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 4c8cf6bd28d6fea23819f082ddc8063fd6fa963a ]
The block layer PI generation / verification code expects the bio_vecs to have at least LBA size (or more correctly integrity internal) granularity. With the direct I/O alignment relaxation in 2022, user space can now feed bios with less alignment than that, leading to scribbling outside the PI buffers. Apparently this wasn't noticed so far because none of the tests generate such buffers, but since 851c4c96db00 ("xfs: implement XFS_IOC_DIOINFO in terms of vfs_getattr"), xfstests generic/013 by default generates such I/O now that the relaxed alignment is advertised by the XFS_IOC_DIOINFO ioctl.
Fix this by increasing the required alignment when using PI, although handling arbitrary alignment in the long run would be even nicer.
--- block/blk-settings.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
block/blk-settings.c +10 -0
@@ -184,6 +184,16 @@ static int blk_validate_integrity_limits(struct queue_limits *lim)if (!bi->interval_exp) bi->interval_exp =ilog2 (lim->logical_block_size); +/* +* The PI generation / validation helpers do not expect intervals to +* straddle multiple bio_vecs. Enforce alignment so that those are +* never generated, and that each buffer is aligned as expected. +*/ +if (bi->csum_type) { + lim->dma_alignment =max (lim->dma_alignment, + (1U << bi->interval_exp) -1 ); + } +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 146/184 gpio: ljca: Fix duplicated IRQ mapping
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 4c4e6ea4a120cc5ab58e437c6ba123cbfc357d45 ]
The generic_handle_domain_irq() function resolves the hardware IRQ internally. The driver performed a duplicative mapping by calling irq_find_mapping() first, which could lead to an RCU stall.
Delete the redundant irq_find_mapping() call and pass the hardware IRQ directly to generic_handle_domain_irq().
--- drivers/gpio/gpio-ljca.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/gpio/gpio-ljca.c +3 -11
@@ -286,22 +286,14 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data, {const struct ljca_gpio_packet *packet = evt_data;struct ljca_gpio_dev *ljca_gpio = context; -int i, irq; +int i;if (cmd !=LJCA_GPIO_INT_EVENT )return ;for (i =0 ; i < packet->num; i++) { - irq =irq_find_mapping (ljca_gpio->gc.irq.domain, - packet->item[i].index); -if (!irq) { -dev_err (ljca_gpio->gc.parent, -"gpio_id %u does not mapped to IRQ yet\n" , - packet->item[i].index); -return ; - } - -generic_handle_domain_irq (ljca_gpio->gc.irq.domain, irq); +generic_handle_domain_irq (ljca_gpio->gc.irq.domain, + packet->item[i].index);set_bit (packet->item[i].index, ljca_gpio->reenable_irqs); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 147/184 io_uring: correct __must_hold annotation in io_install_fixed_file
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit c5efc6a0b3940381d67887302ddb87a5cf623685 ]
The __must_hold annotation references &req->ctx->uring_lock, but req is not in scope in io_install_fixed_file. This change updates the annotation to reference the correct ctx->uring_lock. improving code clarity.
--- io_uring/filetable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/filetable.c +1 -1
@@ -57,7 +57,7 @@ void io_free_file_tables(struct io_ring_ctx *ctx, struct io_file_table *table)static int io_install_fixed_file (struct io_ring_ctx *ctx,struct file *file,u32 slot_index) - __must_hold(&req->ctx->uring_lock) + __must_hold(&ctx->uring_lock) {struct io_rsrc_node *node;
Signature · 1 line
2.51.0