5.10.246-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.10.246-rc1 review
This is the start of the stable review cycle for the 5.10.246 release. There are 332 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Oct 2025 18:34:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.246-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.246-rc1
Li Jinlin <[email protected]>
fsdax: Fix infinite loop in dax_iomap_rw()
Anup Patel <[email protected]>
RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs
Zhengchao Shao <[email protected]>
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
Kaushlendra Kumar <[email protected]>
arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
Darrick J. Wong <[email protected]>
fuse: fix livelock in synchronous file put from fuseblk workers
Chuck Lever <[email protected]>
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
Jan Kara <[email protected]>
vfs: Don't leak disconnected dentries on umount
Gui-Dong Han <[email protected]>
drm/amdgpu: use atomic functions with memory barriers for vm fault info
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before DAC access
Theodore Ts'o <[email protected]>
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
Brian Norris <[email protected]>
PCI/sysfs: Ensure devices are powered for config reads
Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Use sysfs_emit() and sysfs_emit_at() in "show" functions
Maximilian Luz <[email protected]>
PCI: Add sysfs attribute for device power state
Siddharth Vadapalli <[email protected]>
PCI: j721e: Fix programming sequence of "strap" settings
Muhammad Usama Anjum <[email protected]>
wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
Vidya Sagar <[email protected]>
PCI: tegra194: Handle errors in BPMP response
Thomas Fourier <[email protected]>
crypto: rockchip - Fix dma_unmap_sg() nents value
Eric Biggers <[email protected]>
KEYS: trusted_tpm1: Compare HMAC values in constant time
Sergey Bashirov <[email protected]>
NFSD: Fix last write offset handling in layoutcommit
Sergey Bashirov <[email protected]>
NFSD: Minor cleanup in layoutcommit processing
Sergey Bashirov <[email protected]>
NFSD: Rework encoding and decoding of nfsd4_deviceid
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Simplify pm_runtime setup
Bence Csókás <[email protected]>
PM: runtime: Add new devm functions
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
David Lechner <[email protected]>
iio: imu: inv_icm42600: use = { } instead of memset()Xiao Liang <[email protected]>
padata: Reset next CPU when reorder sequence wraps around
Arnd Bergmann <[email protected]>
media: s5p-mfc: remove an unused/uninitialized variable
Stefano Garzarella <[email protected]>
vsock: fix lock inversion in vsock_assign_transport()
Mark Rutland <[email protected]>
arm64: errata: Apply workarounds for Neoverse-V3AE
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-V3AE definitions
Florian Eckert <[email protected]>
serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
Victoria Votokina <[email protected]>
most: usb: hdm_probe: Fix calling put_device() before device initialization
Victoria Votokina <[email protected]>
most: usb: Fix use-after-free in hdm_disconnect
Alexander Usyskin <[email protected]>
mei: me: add wildcat lake P DID
Deepanshu Kartikey <[email protected]>
comedi: fix divide-by-zero in comedi_buf_munge()
Alice Ryhl <[email protected]>
binder: remove "invalid inc weak" check
Mathias Nyman <[email protected]>
xhci: dbc: enable back DbC in resume if it was enabled before suspend
Andrey Konovalov <[email protected]>
usb: raw-gadget: do not limit transfer length
Tim Guttzeit <[email protected]>
usb/core/quirks: Add Huawei ME906S to wakeup quirk
LI Qingwu <[email protected]>
USB: serial: option: add Telit FN920C04 ECM compositions
Reinhard Speyerer <[email protected]>
USB: serial: option: add Quectel RG255C
Renjun Wang <[email protected]>
USB: serial: option: add UNISOC UIS7720
Anup Patel <[email protected]>
RISC-V: Don't print details of CPUs disabled in DT
Sunil V L <[email protected]>
riscv: cpu: Add 64bit hartid support on RV64
Tsukasa OI <[email protected]>
RISC-V: Minimal parser for "riscv, isa" strings
Tsukasa OI <[email protected]>
RISC-V: Correctly print supported extensions
Rob Herring <[email protected]>
riscv: Use of_get_cpu_hwid()
Lad Prabhakar <[email protected]>
net: ravb: Ensure memory write completes before ringing TX doorbell
Michal Pecio <[email protected]>
net: usb: rtl8150: Fix frame padding
Deepanshu Kartikey <[email protected]>
ocfs2: clear extent cache after moving/defragmenting extents
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
Rafael J. Wysocki <[email protected]>
Revert "cpuidle: menu: Avoid discarding useful information"
Tonghao Zhang <[email protected]>
net: bonding: fix possible peer notify event loss or dup issue
Alexey Simakov <[email protected]>
sctp: avoid NULL dereference when chunk data buffer is missing
Huang Ying <[email protected]>
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
Ioana Ciornei <[email protected]>
dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
Wei Fang <[email protected]>
net: enetc: correct the value of ENETC_RXB_TRUESIZE
Johannes Wiesböck <[email protected]>
rtnetlink: Allow deleting FDB entries in user namespace
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
Nikolay Aleksandrov <[email protected]>
net: add ndo_fdb_del_bulk
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add bulk delete support flag
Nikolay Aleksandrov <[email protected]>
net: netlink: add NLM_F_BULK delete request modifier
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: use BIT for flag values
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add helper to extract msg type's kind
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add msg kind names
Geert Uytterhoeven <[email protected]>
m68k: bitops: Fix find_*_bit() signatures
Yangtao Li <[email protected]>
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
Viacheslav Dubeyko <[email protected]>
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
Alexander Aring <[email protected]>
dlm: check for defined force value in dlm_lockspace_release
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
Yang Chenzhi <[email protected]>
hfs: validate record offset in hfsplus_bmap_alloc
Viacheslav Dubeyko <[email protected]>
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
Viacheslav Dubeyko <[email protected]>
hfs: make proper initalization of struct hfs_find_data
Viacheslav Dubeyko <[email protected]>
hfs: clear offset and space out of valid records in b-tree node
Xichao Zhao <[email protected]>
exec: Fix incorrect type for ret
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
Randy Dunlap <[email protected]>
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
Vincent Guittot <[email protected]>
sched/fair: Fix pelt lost idle time detection
Ingo Molnar <[email protected]>
sched/balancing: Rename newidle_balance() => sched_balance_newidle()
Barry Song <[email protected]>
sched/fair: Trivial correction of the newidle_balance() comment
Timur Kristóf <[email protected]>
drm/amd/powerplay: Fix CIK shutdown temperature
I Viswanath <[email protected]>
net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
Jakub Kicinski <[email protected]>
net: usb: use eth_hw_addr_set() instead of ether_addr_copy()
Sabrina Dubroca <[email protected]>
tls: don't rely on tx_work during send()
Sabrina Dubroca <[email protected]>
tls: always set record_type in tls_process_cmsg
Alexey Simakov <[email protected]>
tg3: prevent use of uninitialized remote_adv and local_adv variables
Eric Dumazet <[email protected]>
tcp: fix tcp_tso_should_defer() vs large RTT
Raju Rangoju <[email protected]>
amd-xgbe: Avoid spurious link down messages during interface toggle
Dmitry Safonov <[email protected]>
net/ip6_tunnel: Prevent perpetual tunnel growth
Linmao Li <[email protected]>
r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
Yeounsu Moon <[email protected]>
net: dlink: handle dma_map_single() failure properly
Yuezhang Mo <[email protected]>
dax: skip read lock assertion for read-only filesystems
Christoph Hellwig <[email protected]>
fsdax: switch dax_iomap_rw to use iomap_iter
Christoph Hellwig <[email protected]>
iomap: add the new iomap_iter model
Benjamin Tissoires <[email protected]>
HID: multitouch: fix sticky fingers
Jason Andryuk <[email protected]>
xen/events: Update virq_to_irq on migration
Ma Ke <[email protected]>
media: lirc: Fix error handling in lirc_register()
keliu <[email protected]>
media: rc: Directly use ida_free()
Kaustabh Chakraborty <[email protected]>
drm/exynos: exynos7_drm_decon: remove ctx->suspended
Adam Xue <[email protected]>
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
Anderson Nascimento <[email protected]>
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
Yu Kuai <[email protected]>
blk-crypto: fix missing blktrace bio split events
Jisheng Zhang <[email protected]>
pwm: berlin: Fix wrong register in suspend/resume
Deepanshu Kartikey <[email protected]>
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
Zhang Yi <[email protected]>
jbd2: ensure that all ongoing I/O complete before freeing blocks
Jason A. Donenfeld <[email protected]>
wifi: rt2x00: use explicitly signed or unsigned types
Dan Carpenter <[email protected]>
mm/slab: make __free(kfree) accept error pointers
Mikhail Kobuk <[email protected]>
media: pci: ivtv: Add check for DMA map result
Thomas Fourier <[email protected]>
media: cx18: Add missing check after DMA map
Thomas Fourier <[email protected]>
media: pci: ivtv: Add missing check after DMA map
Christophe JAILLET <[email protected]>
media: pci/ivtv: switch from 'pci_' to 'dma_' API
David Laight <[email protected]>
minmax.h: remove some #defines that are only expanded once
David Laight <[email protected]>
minmax.h: simplify the variants of clamp()
David Laight <[email protected]>
minmax.h: move all the clamp() definitions after the min/max() ones
David Laight <[email protected]>
minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
David Laight <[email protected]>
minmax.h: reduce the #define expansion of min(), max() and clamp()
David Laight <[email protected]>
minmax.h: update some comments
David Laight <[email protected]>
minmax.h: add whitespace around operators and after commas
Linus Torvalds <[email protected]>
minmax: fix up min3() and max3() too
Linus Torvalds <[email protected]>
minmax: improve macro expansion and type checking
Linus Torvalds <[email protected]>
minmax: simplify min()/max()/clamp() implementation
Linus Torvalds <[email protected]>
minmax: don't use max() in situations that want a C constant expression
Linus Torvalds <[email protected]>
minmax: make generic MIN() and MAX() macros available everywhere
Linus Torvalds <[email protected]>
minmax: simplify and clarify min_t()/max_t() implementation
Linus Torvalds <[email protected]>
minmax: add a few more MIN_T/MAX_T users
Linus Torvalds <[email protected]>
minmax: avoid overly complicated constant expressions in VM code
David Laight <[email protected]>
minmax: relax check to allow comparison between unsigned arguments and signed constants
David Laight <[email protected]>
minmax: allow comparisons of 'int' against 'unsigned char/short'
David Laight <[email protected]>
minmax: fix indentation of __cmp_once() and __clamp_once()
David Laight <[email protected]>
minmax: allow min()/max()/clamp() if the arguments have the same signedness.
Andy Shevchenko <[email protected]>
minmax: fix header inclusions
Andy Shevchenko <[email protected]>
minmax: deduplicate __unconst_integer_typeof()
Herve Codina <[email protected]>
minmax: Introduce {min,max}_array()
Matthew Wilcox (Oracle) <[email protected]>
minmax: add in_range() macro
Jason A. Donenfeld <[email protected]>
minmax: clamp more efficiently by avoiding extra comparison
Jason A. Donenfeld <[email protected]>
minmax: sanity check constant bounds when clamping
Johannes Thumshirn <[email protected]>
btrfs: remove duplicated in_range() macro
Bart Van Assche <[email protected]>
overflow, tracing: Define the is_signed_type() macro once
Catalin Marinas <[email protected]>
arm64: mte: Do not flag the zero page as PG_mte_tagged
Aleksa Sarai <[email protected]>
fscontext: do not consume log entries when returning -EMSGSIZE
Peter Zijlstra <[email protected]>
locking: Introduce __cleanup() based infrastructure
Tetsuo Handa <[email protected]>
cramfs: Verify inode mode when loading from disk
Lichen Liu <[email protected]>
fs: Add 'initramfs_options' to set initramfs mount options
gaoxiang17 <[email protected]>
pid: Add a judgment for ns null in pid_nr_ns
Tetsuo Handa <[email protected]>
minixfs: Verify inode mode when loading from disk
Nalivayko Sergey <[email protected]>
net/9p: fix double req put in p9_fd_cancelled
Sean Christopherson <[email protected]>
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
Ma Ke <[email protected]>
ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wcd934x: Simplify with dev_err_probe
Larshin Sergey <[email protected]>
fs: udf: fix OOB read in lengthAllocDescs handling
Gianfranco Trad <[email protected]>
udf: fix uninit-value use in udf_get_fileshortad
Phillip Lougher <[email protected]>
Squashfs: reject negative file sizes in squashfs_read_inode()
Phillip Lougher <[email protected]>
Squashfs: add additional inode sanity checking
Edward Adam Davis <[email protected]>
media: mc: Clear minor number before put device
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
Zheng Qixing <[email protected]>
dm: fix NULL pointer dereference in __dm_suspend()
Yuan Chen <[email protected]>
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
Stephan Gerhold <[email protected]>
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
Nathan Chancellor <[email protected]>
lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
Ahmet Eray Karadag <[email protected]>
ext4: guard against EA inode refcount underflow in xattr update
Ojaswin Mujoo <[email protected]>
ext4: correctly handle queries for metadata mappings
Yongjian Sun <[email protected]>
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
Olga Kornievskaia <[email protected]>
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
Thorsten Blum <[email protected]>
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
Sean Christopherson <[email protected]>
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
Sean Christopherson <[email protected]>
x86/umip: Check that the instruction opcode is at least two bytes
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before INDAC access
Niklas Cassel <[email protected]>
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
Siddharth Vadapalli <[email protected]>
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
Lukas Wunner <[email protected]>
PCI/AER: Support errors introduced by PCIe r6.0
Niklas Schnelle <[email protected]>
PCI/AER: Fix missing uevent on recovery when a reset is requested
Lukas Wunner <[email protected]>
PCI/ERR: Fix uevent on failure to recover
Niklas Schnelle <[email protected]>
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
Sean Christopherson <[email protected]>
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
Esben Haabendal <[email protected]>
rtc: interface: Fix long-standing race when setting alarm
Esben Haabendal <[email protected]>
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
Zhen Ni <[email protected]>
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
Rex Chen <[email protected]>
mmc: core: SPI mode remove cmd7
Linus Walleij <[email protected]>
mtd: rawnand: fsmc: Default to autodetect buswidth
Ma Ke <[email protected]>
sparc: fix error handling in scan_one_device()
Anthony Yznaga <[email protected]>
sparc64: fix hugetlb for sun4u
Eric Biggers <[email protected]>
sctp: Fix MAC comparison to be constant-time
Thorsten Blum <[email protected]>
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
Sam James <[email protected]>
parisc: don't reference obsolete termio struct for TC* constants
Askar Safin <[email protected]>
openat2: don't trigger automounts with RESOLVE_NO_XDEV
Johan Hovold <[email protected]>
lib/genalloc: fix device leak in of_gen_pool_get()
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
Huacai Chen <[email protected]>
init: handle bootloader identifier in kernel parameters
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix prescaler usage.
Qianfeng Rong <[email protected]>
iio: dac: ad5421: use int type to store negative error codes
Qianfeng Rong <[email protected]>
iio: dac: ad5360: use int type to store negative error codes
Thomas Fourier <[email protected]>
crypto: atmel - Fix dma_unmap_sg() direction
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Simon Schuster <[email protected]>
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
Shuhao Fu <[email protected]>
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
Qianfeng Rong <[email protected]>
media: i2c: mt9v111: fix incorrect type for ret
Johan Hovold <[email protected]>
firmware: meson_sm: fix device leak at probe
Lukas Wunner <[email protected]>
xen/manage: Fix suspend error path
Jason Andryuk <[email protected]>
xen/events: Cleanup find_virq() return codes
Miaoqian Lin <[email protected]>
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Add missing MDSS reset
Amir Mohammad Jahangirzad <[email protected]>
ACPI: debug: fix signedness issues in read/write helpers
Daniel Tang <[email protected]>
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: mark the GPIO controller as sleeping
Andy Shevchenko <[email protected]>
gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
Gunnar Kudrjavets <[email protected]>
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
Herbert Xu <[email protected]>
crypto: essiv - Check ssize for decryption and in-place encryption
Timur Kristóf <[email protected]>
drm/amd/display: Properly disable scaling on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
Alex Deucher <[email protected]>
drm/amdgpu: Add additional DCE6 SCL registers
Daniel Borkmann <[email protected]>
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
Leo Yan <[email protected]>
tools build: Align warning options with perf
Erick Karanja <[email protected]>
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Kuniyuki Iwashima <[email protected]>
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Alexandr Sapozhnikov <[email protected]>
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Use-after-free in validation
Dan Carpenter <[email protected]>
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
Duoming Zhou <[email protected]>
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
John Garry <[email protected]>
scsi: mvsas: Use sas_task_find_rq() for tagging
John Garry <[email protected]>
scsi: mvsas: Delete mvs_tag_init()
John Garry <[email protected]>
scsi: libsas: Add sas_task_find_rq()
Alok Tiwari <[email protected]>
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
Brian Masney <[email protected]>
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
Leo Yan <[email protected]>
perf session: Fix handling when buffer exceeds 2 GiB
Rob Herring (Arm) <[email protected]>
rtc: x1205: Fix Xicor X1205 vendor prefix
Yunseong Kim <[email protected]>
perf util: Fix compression checks returning -1 as bool
Brian Masney <[email protected]>
clk: at91: peripheral: fix return value
Ian Rogers <[email protected]>
libperf event: Ensure tracing data is multiple of 8 sized
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
Zhen Ni <[email protected]>
clocksource/drivers/clps711x: Fix resource leaks in error paths
Thomas Weißschuh <[email protected]>
fs: always return zero on success from replace_fd()
Salah Triki <[email protected]>
bus: fsl-mc: Check return value of platform_get_resource()
Bartosz Golaszewski <[email protected]>
pinctrl: check the return value of pinmux_ops::get_function_name()
Zhen Ni <[email protected]>
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
Marek Vasut <[email protected]>
Input: atmel_mxt_ts - allow reset GPIO to sleep
Yang Shi <[email protected]>
mm: hugetlb: avoid soft lockup when mprotect to large memory area
Bartosz Golaszewski <[email protected]>
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
Naman Jain <[email protected]>
uio_hv_generic: Let userspace take care of interrupt mask
Phillip Lougher <[email protected]>
Squashfs: fix uninit-value in squashfs_get_parent
Jakub Kicinski <[email protected]>
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Yeounsu Moon <[email protected]>
net: dlink: handle copy_thresh allocation failure
Kohei Enju <[email protected]>
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Kohei Enju <[email protected]>
nfp: fix RSS hash key size when RSS is not supported
Donet Tom <[email protected]>
drivers/base/node: fix double free in register_one_node()
Dan Carpenter <[email protected]>
ocfs2: fix double free in user_cluster_connect()
Nishanth Menon <[email protected]>
hwrng: ks-sa - fix division by zero in ks_sa_rng_init
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
I Viswanath <[email protected]>
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
Bernard Metzler <[email protected]>
RDMA/siw: Always report immediate post SQ errors
Cristian Ciocaltea <[email protected]>
usb: vhci-hcd: Prevent suspending virtually attached devices
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
Slavin Liu <[email protected]>
ipvs: Defer ip_vs_ftp unregister during netns cleanup
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix backchannel max_resp_sz verification check
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
Baochen Qiang <[email protected]>
wifi: ath10k: avoid unnecessary wait for service ready message
Bagas Sanjaya <[email protected]>
Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
Vlad Dumitrescu <[email protected]>
IB/sa: Fix sa_local_svc_timeout_ms read race
Parav Pandit <[email protected]>
RDMA/core: Resolve MAC of next-hop device without ARP support
Colin Ian King <[email protected]>
ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
Abdun Nihaal <[email protected]>
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
Håkon Bugge <[email protected]>
RDMA/cm: Rate limit destroy CM ID timeout error message
Donet Tom <[email protected]>
drivers/base/node: handle error properly in register_one_node()
Christophe Leroy <[email protected]>
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
Zhen Ni <[email protected]>
netfilter: ipset: Remove unused htable_bits in macro ahash_region
Hans de Goede <[email protected]>
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
Takashi Iwai <[email protected]>
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
Takashi Iwai <[email protected]>
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
Takashi Iwai <[email protected]>
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
Wang Liang <[email protected]>
pps: fix warning in pps_register_cdev when register device fail
Colin Ian King <[email protected]>
misc: genwqe: Fix incorrect cmd field being reported in error
William Wu <[email protected]>
usb: gadget: configfs: Correctly set use_os_string at bind
Xichao Zhao <[email protected]>
usb: phy: twl6030: Fix incorrect type for ret
Eric Dumazet <[email protected]>
tcp: fix __tcp_close() to only send RST when required
Alok Tiwari <[email protected]>
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
Stefan Kerkmann <[email protected]>
wifi: mwifiex: send world regulatory domain to driver
Timur Kristóf <[email protected]>
drm/amdgpu: Power up UVD 3 for FW validation (v2)
Qianfeng Rong <[email protected]>
ALSA: lx_core: use int type to store negative error codes
Zhang Shurong <[email protected]>
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
Thomas Fourier <[email protected]>
scsi: myrs: Fix dma_alloc_coherent() error check
Niklas Cassel <[email protected]>
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
Dan Carpenter <[email protected]>
serial: max310x: Add error checking in probe()
Dan Carpenter <[email protected]>
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
Brahmajit Das <[email protected]>
drm/radeon/r600_cs: clean up of dead code in r600_cs
Kunihiko Hayashi <[email protected]>
i2c: designware: Add disabling clocks when probe fails
Leilk.Liu <[email protected]>
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
Paul Chaignon <[email protected]>
bpf: Explicitly check accesses to bpf_sock_addr
Akhilesh Patil <[email protected]>
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
Uwe Kleine-König <[email protected]>
pwm: tiehrpwm: Fix corner case in clock divisor calculation
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
Qianfeng Rong <[email protected]>
pinctrl: renesas: Use int type to store negative error codes
Rafael J. Wysocki <[email protected]>
PM: sleep: core: Clear power.must_resume in noirq suspend error path
Qianfeng Rong <[email protected]>
block: use int to store blk_stack_limits() return value
Li Nan <[email protected]>
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
Da Xue <[email protected]>
pinctrl: meson-gxl: add missing i2c_d pinmux
Sneh Mankad <[email protected]>
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
Huisong Li <[email protected]>
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
Yureka Lilian <[email protected]>
libbpf: Fix reuse of DEVMAP
Geert Uytterhoeven <[email protected]>
regmap: Remove superfluous check for !config in __regmap_init()
Uros Bizjak <[email protected]>
x86/vdso: Fix output operand size of RDPID
Leo Yan <[email protected]>
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
Bala-Vignesh-Reddy <[email protected]>
selftests: arm64: Check fread return value in exec_target
Jeff Layton <[email protected]>
filelock: add FL_RECLAIM to show_fl_flags() macro
Herbert Xu <[email protected]>
crypto: rng - Ensure set_ent is always present
Igor Artemiev <[email protected]>
drm/amd/display: Fix potential null dereference
Roman Li <[email protected]>
drm/amd/display: Remove redundant safeguards for dmub-srv destroy()
Rafael J. Wysocki <[email protected]>
driver core/PM: Set power.no_callbacks along with power.no_pm
Ovidiu Panait <[email protected]>
staging: axis-fifo: flush RX FIFO on read errors
Ovidiu Panait <[email protected]>
staging: axis-fifo: fix maximum TX packet length check
Raphael Gallais-Pou <[email protected]>
serial: stm32: allow selecting console when the driver is module
Arnaud Lecomte <[email protected]>
hid: fix I2C read buffer overflow in raw_event() for mcp2221
hupu <[email protected]>
perf subcmd: avoid crash in exclude_cmds when excludes is empty
Mikulas Patocka <[email protected]>
dm-integrity: limit MAX_TAG_SIZE to 255
Bitterblue Smith <[email protected]>
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
Xiaowei Li <[email protected]>
USB: serial: option: add SIMCom 8230C compositions
Duoming Zhou <[email protected]>
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
Duoming Zhou <[email protected]>
media: tuner: xc5000: Fix use-after-free in xc5000_release
Ricardo Ribalda <[email protected]>
media: tunner: xc5000: Refactor firmware load
Kuniyuki Iwashima <[email protected]>
udp: Fix memory accounting leak.
Larshin Sergey <[email protected]>
media: rc: fix races with imon_disconnect()
Duoming Zhou <[email protected]>
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Wang Haoran <[email protected]>
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-pci | 9 + Documentation/admin-guide/kernel-parameters.txt | 3 + Documentation/arm64/silicon-errata.rst | 2 + Documentation/trace/histogram-design.rst | 4 +- Makefile | 4 +- arch/arm/mach-omap2/pm33xx-core.c | 6 +- arch/arm/mm/pageattr.c | 6 +- arch/arm64/Kconfig | 1 + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 + arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 +- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/pgtable.h | 3 +- arch/arm64/kernel/cpu_errata.c | 1 + arch/arm64/kernel/cpufeature.c | 10 +- arch/arm64/kernel/mte.c | 3 +- arch/m68k/include/asm/bitops.h | 25 +- arch/mips/mti-malta/malta-setup.c | 2 +- arch/parisc/include/uapi/asm/ioctls.h | 8 +- arch/riscv/include/asm/processor.h | 4 +- arch/riscv/kernel/cpu.c | 28 ++- arch/riscv/kernel/cpufeature.c | 84 +++++-- arch/riscv/kernel/smpboot.c | 9 +- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + arch/sparc/lib/M7memcpy.S | 20 +- arch/sparc/lib/Memcpy_utils.S | 9 + arch/sparc/lib/NG4memcpy.S | 2 +- arch/sparc/lib/NGmemcpy.S | 29 ++- arch/sparc/lib/U1memcpy.S | 19 +- arch/sparc/lib/U3memcpy.S | 2 +- arch/sparc/mm/hugetlbpage.c | 20 ++ arch/um/drivers/mconsole_user.c | 2 + arch/x86/include/asm/segment.h | 8 +- arch/x86/kernel/umip.c | 15 +- arch/x86/kvm/emulate.c | 11 +- arch/x86/kvm/kvm_emulate.h | 2 +- arch/x86/kvm/x86.c | 9 +- arch/x86/mm/pgtable.c | 2 +- block/blk-crypto-fallback.c | 3 + block/blk-mq-sysfs.c | 6 +- block/blk-settings.c | 3 +- crypto/essiv.c | 14 +- crypto/rng.c | 8 + drivers/acpi/acpi_dbg.c | 26 +- drivers/acpi/acpi_tad.c | 3 + drivers/acpi/nfit/core.c | 2 +- drivers/acpi/processor_idle.c | 3 + drivers/android/binder.c | 11 +- drivers/base/arch_topology.c | 2 +- drivers/base/node.c | 4 + drivers/base/power/main.c | 14 +- drivers/base/power/runtime.c | 44 ++++ drivers/base/regmap/regmap.c | 2 +- drivers/bus/fsl-mc/fsl-mc-bus.c | 3 + drivers/bus/mhi/host/init.c | 5 +- drivers/char/hw_random/ks-sa-rng.c | 4 + drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/clk/at91/clk-peripheral.c | 7 +- drivers/clk/nxp/clk-lpc18xx-cgu.c | 20 +- drivers/clocksource/clps711x-timer.c | 23 +- drivers/clocksource/timer-riscv.c | 15 +- drivers/cpufreq/intel_pstate.c | 8 +- drivers/cpuidle/governors/menu.c | 21 +- drivers/crypto/atmel-tdes.c | 2 +- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 3 +- drivers/dma/ioat/dma.c | 12 +- drivers/edac/sb_edac.c | 4 +- drivers/edac/skx_common.h | 1 - drivers/firmware/meson/meson_sm.c | 7 +- drivers/gpio/gpio-wcd934x.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 +- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 ++- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 21 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 4 + .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 2 + .../gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 + .../drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h | 14 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +- drivers/gpu/drm/arm/display/include/malidp_utils.h | 2 +- .../drm/arm/display/komeda/komeda_pipeline_state.c | 24 +- drivers/gpu/drm/drm_color_mgmt.c | 2 +- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 --- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 6 - drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/radeon/evergreen_cs.c | 2 + drivers/gpu/drm/radeon/r600_cs.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +- drivers/hid/hid-mcp2221.c | 4 + drivers/hid/hid-multitouch.c | 27 ++- drivers/hwmon/adt7475.c | 24 +- drivers/i2c/busses/i2c-designware-platdrv.c | 1 + drivers/i2c/busses/i2c-mt65xx.c | 17 +- drivers/iio/dac/ad5360.c | 2 +- drivers/iio/dac/ad5421.c | 2 +- drivers/iio/frequency/adf4350.c | 20 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 5 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 39 +-- drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 5 +- drivers/iio/inkern.c | 2 +- drivers/infiniband/core/addr.c | 10 +- drivers/infiniband/core/cm.c | 4 +- drivers/infiniband/core/sa_query.c | 6 +- drivers/infiniband/sw/siw/siw_verbs.c | 25 +- drivers/input/misc/uinput.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/cyttsp4_core.c | 2 +- drivers/irqchip/irq-riscv-intc.c | 7 +- drivers/irqchip/irq-sifive-plic.c | 7 +- drivers/mailbox/zynqmp-ipi-mailbox.c | 7 +- drivers/md/dm-integrity.c | 8 +- drivers/md/dm.c | 7 +- drivers/media/dvb-frontends/stv0367_priv.h | 3 + drivers/media/i2c/mt9v111.c | 2 +- drivers/media/i2c/rj54n1cb0c.c | 9 +- drivers/media/i2c/tc358743.c | 4 +- drivers/media/mc/mc-devnode.c | 6 +- drivers/media/pci/b2c2/flexcop-pci.c | 2 +- drivers/media/pci/cx18/cx18-queue.c | 12 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-queue.c | 18 +- drivers/media/pci/ivtv/ivtv-streams.c | 22 +- drivers/media/pci/ivtv/ivtv-udma.c | 27 ++- drivers/media/pci/ivtv/ivtv-yuv.c | 24 +- drivers/media/pci/ivtv/ivtvfb.c | 6 +- drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c | 35 +-- drivers/media/rc/imon.c | 27 ++- drivers/media/rc/lirc_dev.c | 15 +- drivers/media/rc/rc-main.c | 6 +- drivers/media/tuners/xc5000.c | 41 ++-- drivers/memory/samsung/exynos-srom.c | 10 +- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 5 +- drivers/mfd/vexpress-sysreg.c | 6 +- drivers/misc/genwqe/card_ddcb.c | 2 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/mmc/core/sdio.c | 6 +- drivers/most/most_usb.c | 13 +- drivers/mtd/nand/raw/fsmc_nand.c | 6 +- drivers/net/bonding/bond_main.c | 40 ++- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + drivers/net/ethernet/broadcom/tg3.c | 5 +- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 18 +- drivers/net/ethernet/dlink/dl2k.c | 30 ++- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 3 +- drivers/net/ethernet/freescale/enetc/enetc.h | 2 +- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 - drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 17 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 5 +- drivers/net/ethernet/renesas/ravb_main.c | 8 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/fjes/fjes_main.c | 4 +- drivers/net/usb/aqc111.c | 2 +- drivers/net/usb/lan78xx.c | 42 +++- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/rndis_host.c | 2 +- drivers/net/usb/rtl8150.c | 15 +- drivers/net/wireless/ath/ath10k/wmi.c | 39 ++- drivers/net/wireless/ath/ath11k/core.c | 6 +- drivers/net/wireless/ath/ath11k/hal.c | 16 ++ drivers/net/wireless/ath/ath11k/hal.h | 1 + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 8 +- drivers/net/wireless/ralink/rt2x00/rt2400pci.h | 2 +- drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 8 +- drivers/net/wireless/ralink/rt2x00/rt2500pci.h | 2 +- drivers/net/wireless/ralink/rt2x00/rt2500usb.c | 8 +- drivers/net/wireless/ralink/rt2x00/rt2500usb.h | 2 +- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 36 +-- drivers/net/wireless/ralink/rt2x00/rt2800lib.h | 8 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 6 +- drivers/net/wireless/ralink/rt2x00/rt61pci.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt61pci.h | 2 +- drivers/net/wireless/ralink/rt2x00/rt73usb.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt73usb.h | 2 +- .../net/wireless/realtek/rtlwifi/rtl8192cu/sw.c | 1 - drivers/nfc/pn544/i2c.c | 2 - drivers/pci/controller/cadence/pci-j721e.c | 25 ++ drivers/pci/controller/dwc/pci-keystone.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 22 +- drivers/pci/controller/pci-tegra.c | 2 +- drivers/pci/iov.c | 5 + drivers/pci/pci-driver.c | 1 + drivers/pci/pci-label.c | 10 +- drivers/pci/pci-sysfs.c | 98 +++++--- drivers/pci/pcie/aer.c | 12 +- drivers/pci/pcie/err.c | 8 +- drivers/perf/arm_spe_pmu.c | 3 +- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 + drivers/pinctrl/pinmux.c | 2 +- drivers/pinctrl/renesas/pinctrl.c | 3 +- drivers/platform/x86/sony-laptop.c | 1 - drivers/pps/kapi.c | 5 +- drivers/pps/pps.c | 5 +- drivers/pwm/pwm-berlin.c | 4 +- drivers/pwm/pwm-tiehrpwm.c | 4 +- drivers/remoteproc/qcom_q6v5.c | 3 - drivers/rtc/interface.c | 27 +++ drivers/rtc/rtc-x1205.c | 2 +- drivers/scsi/hpsa.c | 21 +- drivers/scsi/isci/init.c | 6 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 13 +- drivers/scsi/mvsas/mv_sas.c | 42 ++-- drivers/scsi/mvsas/mv_sas.h | 8 +- drivers/scsi/myrs.c | 8 +- drivers/scsi/pm8001/pm8001_sas.c | 9 +- drivers/soc/qcom/rpmh-rsc.c | 7 +- drivers/spi/spi-cadence-quadspi.c | 5 + drivers/staging/axis-fifo/axis-fifo.c | 32 ++- drivers/staging/comedi/comedi_buf.c | 2 +- .../pci/hive_isp_css_include/math_support.h | 5 - drivers/target/target_core_configfs.c | 2 +- drivers/tty/serial/8250/8250_exar.c | 11 + drivers/tty/serial/Kconfig | 2 +- drivers/tty/serial/max310x.c | 2 + drivers/uio/uio_hv_generic.c | 7 +- drivers/usb/core/quirks.c | 2 + drivers/usb/gadget/configfs.c | 2 + drivers/usb/gadget/legacy/raw_gadget.c | 2 - drivers/usb/host/max3421-hcd.c | 2 +- drivers/usb/host/xhci-dbgcap.c | 9 +- drivers/usb/phy/phy-twl6030-usb.c | 3 +- drivers/usb/serial/option.c | 16 ++ drivers/usb/usbip/vhci_hcd.c | 22 ++ drivers/watchdog/mpc8xxx_wdt.c | 2 + drivers/xen/events/events_base.c | 20 +- drivers/xen/manage.c | 3 +- fs/btrfs/ctree.h | 2 - fs/btrfs/export.c | 8 +- fs/btrfs/extent_io.c | 1 + fs/btrfs/file-item.c | 1 + fs/btrfs/misc.h | 2 - fs/btrfs/raid56.c | 1 + fs/btrfs/tree-checker.c | 2 +- fs/cramfs/inode.c | 11 +- fs/dax.c | 54 +++-- fs/dcache.c | 2 + fs/dlm/lockspace.c | 2 +- fs/erofs/zdata.h | 2 +- fs/exec.c | 2 +- fs/ext2/balloc.c | 2 - fs/ext4/ext4.h | 2 - fs/ext4/fsmap.c | 14 +- fs/ext4/inode.c | 18 +- fs/ext4/super.c | 10 +- fs/ext4/xattr.c | 15 +- fs/file.c | 5 +- fs/fsopen.c | 70 +++--- fs/fuse/file.c | 8 +- fs/hfs/bfind.c | 8 +- fs/hfs/brec.c | 27 ++- fs/hfs/mdb.c | 2 +- fs/hfsplus/bfind.c | 8 +- fs/hfsplus/bnode.c | 41 ---- fs/hfsplus/btree.c | 6 + fs/hfsplus/hfsplus_fs.h | 42 ++++ fs/hfsplus/super.c | 25 +- fs/hfsplus/unicode.c | 24 ++ fs/iomap/apply.c | 74 +++++- fs/iomap/trace.h | 37 ++- fs/jbd2/transaction.c | 13 +- fs/minix/inode.c | 8 +- fs/namei.c | 8 + fs/namespace.c | 11 +- fs/nfs/nfs4proc.c | 2 +- fs/nfsd/blocklayout.c | 5 +- fs/nfsd/blocklayoutxdr.c | 7 +- fs/nfsd/flexfilelayout.c | 8 + fs/nfsd/flexfilelayoutxdr.c | 3 +- fs/nfsd/lockd.c | 15 ++ fs/nfsd/nfs4layouts.c | 1 - fs/nfsd/nfs4proc.c | 36 ++- fs/nfsd/nfs4xdr.c | 14 +- fs/nfsd/xdr4.h | 36 ++- fs/ocfs2/move_extents.c | 5 + fs/ocfs2/stack_user.c | 1 + fs/squashfs/inode.c | 31 ++- fs/squashfs/squashfs_fs_i.h | 2 +- fs/udf/inode.c | 12 +- fs/ufs/util.h | 6 - include/linux/cleanup.h | 171 +++++++++++++ include/linux/compiler-clang.h | 9 + include/linux/compiler.h | 15 ++ include/linux/compiler_attributes.h | 6 + include/linux/device.h | 10 + include/linux/file.h | 6 + include/linux/iio/frequency/adf4350.h | 2 +- include/linux/iomap.h | 56 +++++ include/linux/irqflags.h | 7 + include/linux/minmax.h | 267 ++++++++++++++++----- include/linux/mutex.h | 4 + include/linux/netdevice.h | 9 + include/linux/overflow.h | 1 - include/linux/percpu.h | 4 + include/linux/pm_runtime.h | 4 + include/linux/preempt.h | 5 + include/linux/rcupdate.h | 3 + include/linux/rwsem.h | 9 + include/linux/sched/task.h | 2 + include/linux/slab.h | 3 + include/linux/spinlock.h | 32 +++ include/linux/srcu.h | 5 + include/linux/trace_events.h | 2 - include/net/ip_tunnels.h | 15 ++ include/net/rtnetlink.h | 16 +- include/scsi/libsas.h | 18 ++ include/trace/events/filelock.h | 3 +- include/uapi/linux/netlink.h | 1 + init/main.c | 14 ++ kernel/fork.c | 2 +- kernel/padata.c | 6 +- kernel/pid.c | 2 +- kernel/sched/fair.c | 38 +-- kernel/trace/preemptirq_delay_test.c | 2 - kernel/trace/trace_kprobe.c | 11 +- kernel/trace/trace_probe.h | 9 +- kernel/trace/trace_uprobe.c | 12 +- lib/btree.c | 1 - lib/crypto/Makefile | 4 + lib/decompress_unlzma.c | 2 + lib/genalloc.c | 5 +- lib/logic_pio.c | 3 - lib/vsprintf.c | 2 +- lib/zstd/zstd_internal.h | 2 - mm/hugetlb.c | 2 + mm/zsmalloc.c | 1 - net/9p/trans_fd.c | 8 +- net/bluetooth/mgmt.c | 10 +- net/core/filter.c | 18 +- net/core/rtnetlink.c | 87 +++++-- net/ipv4/ip_tunnel.c | 14 -- net/ipv4/proc.c | 2 +- net/ipv4/tcp.c | 9 +- net/ipv4/tcp_input.c | 1 - net/ipv4/tcp_output.c | 19 +- net/ipv4/udp.c | 16 +- net/ipv6/ip6_tunnel.c | 3 +- net/ipv6/proc.c | 2 +- net/netfilter/ipset/ip_set_hash_gen.h | 8 +- net/netfilter/ipvs/ip_vs_ftp.c | 4 +- net/netfilter/nf_nat_core.c | 6 +- net/sctp/inqueue.c | 13 +- net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/tipc/core.h | 2 +- net/tipc/link.c | 10 +- net/tls/tls_main.c | 7 +- net/tls/tls_sw.c | 13 + net/vmw_vsock/af_vsock.c | 38 +-- scripts/checkpatch.pl | 2 +- security/keys/trusted-keys/trusted_tpm1.c | 7 +- sound/firewire/amdtp-stream.h | 2 +- sound/pci/lx6464es/lx_core.c | 4 +- sound/soc/codecs/wcd934x.c | 30 ++- sound/soc/intel/boards/bytcht_es8316.c | 20 +- sound/soc/intel/boards/bytcr_rt5640.c | 7 +- sound/soc/intel/boards/bytcr_rt5651.c | 26 +- tools/build/feature/Makefile | 4 +- tools/lib/bpf/libbpf.c | 10 + tools/lib/perf/include/perf/event.h | 1 + tools/lib/subcmd/help.c | 3 + tools/perf/util/lzma.c | 2 +- tools/perf/util/session.c | 2 +- tools/perf/util/zlib.c | 2 +- tools/testing/selftests/arm64/pauth/exec_target.c | 7 +- tools/testing/selftests/rseq/rseq.c | 8 +- tools/testing/selftests/watchdog/watchdog-test.c | 6 + 380 files changed, 2926 insertions(+), 1387 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/332 scsi: target: target_core_configfs: Add length check to avoid buffer overflow
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Haoran <[email protected]>
commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream.
A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes).
snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes.
Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error.
An additional check of the return value of snprintf() can avoid this buffer overflow.
--- drivers/target/target_core_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/target_core_configfs.c +1 -1
@@ -2637,7 +2637,7 @@ static ssize_t target_lu_gp_members_show config_item_name(&dev->dev_group.cg_item)); cur_len++;/* Extra byte for NULL terminator */ -if ((cur_len + len) >PAGE_SIZE ) { +if ((cur_len + len) >PAGE_SIZE || cur_len >LU_GROUP_NAME_BUF ) {pr_warn ("Ran out of lu_gp_show_attr" "_members buffer\n" );break ;
Greg Kroah-Hartman
maintainerPATCH 2/332 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
commit 01e03fb7db419d39e18d6090d4873c1bff103914 upstream.
The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
flexcop_pci_remove() | flexcop_pci_irq_check_work()
cancel_delayed_work() |
flexcop_device_kfree(fc_pci->fc_dev) |
| fc = fc_pci->fc_dev; // UAFThis is confirmed by a KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 135: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work has finished before the device memory is deallocated.
This bug was initially identified through static analysis. To reproduce and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced artificial delays within the flexcop_pci_irq_check_work() function to increase the likelihood of triggering the bug.
--- drivers/media/pci/b2c2/flexcop-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/b2c2/flexcop-pci.c +1 -1
@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pcstruct flexcop_pci *fc_pci =pci_get_drvdata (pdev);if (irq_chk_intv >0 ) -cancel_delayed_work (&fc_pci->irq_check_work); +cancel_delayed_work_sync (&fc_pci->irq_check_work);flexcop_pci_dma_exit (fc_pci);flexcop_device_exit (fc_pci->fc_dev);
Greg Kroah-Hartman
maintainerPATCH 3/332 media: rc: fix races with imon_disconnect()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larshin Sergey <[email protected]>
commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb upstream.
Syzbot reports a KASAN issue as below:
BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device.
Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage.
As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer.
Thread 1 vfd_write Thread 2 imon_disconnect
...
if
usb_put_dev(ictx->usbdev_intf0)
else
usb_put_dev(ictx->usbdev_intf1)
...
while
send_packet
if
pipe = usb_sndintpipe(
ictx->usbdev_intf0) UAF
else
pipe = usb_sndctrlpipe(
ictx->usbdev_intf0, 0) UAFGuard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present.
Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations.
Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/media/rc/imon.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
drivers/media/rc/imon.c +20 -7
@@ -536,7 +536,9 @@ static int display_open(struct inode *inmutex_lock (&ictx->lock); -if (!ictx->display_supported) { +if (ictx->disconnected) { + retval = -ENODEV ; + }else if (!ictx->display_supported) {pr_err ("display not supported by device\n" ); retval = -ENODEV ; }else if (ictx->display_isopen) {
@@ -598,6 +600,9 @@ static int send_packet(struct imon_conteint retval =0 ;struct usb_ctrlrequest *control_req =NULL ; +if (ictx->disconnected) +return -ENODEV ; +/* Check if we need to use control or interrupt urb */ if (!ictx->tx_control) { pipe = usb_sndintpipe(ictx->usbdev_intf0,
@@ -954,12 +959,14 @@ static ssize_t vfd_write(struct file *fistatic const unsigned char vfd_packet6[] = {0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0xFF ,0xFF }; -if (ictx->disconnected) -return -ENODEV ; -if (mutex_lock_interruptible (&ictx->lock))return -ERESTARTSYS ; +if (ictx->disconnected) { + retval = -ENODEV ; + goto exit; + } +if (!ictx->dev_present_intf0) {pr_err_ratelimited ("no iMON device present\n" ); retval = -ENODEV ;
@@ -1034,11 +1041,13 @@ static ssize_t lcd_write(struct file *fiint retval =0 ;struct imon_context *ictx = file->private_data; -if (ictx->disconnected) -return -ENODEV ; -mutex_lock (&ictx->lock); +if (ictx->disconnected) { + retval = -ENODEV ; + goto exit; + } +if (!ictx->display_supported) {pr_err_ratelimited ("no iMON display present\n" ); retval = -ENODEV ;
@@ -2502,7 +2511,11 @@ static void imon_disconnect(struct usb_iint ifnum; ictx =usb_get_intfdata (interface); + +mutex_lock (&ictx->lock); ictx->disconnected = true; +mutex_unlock (&ictx->lock); + dev = ictx->dev; ifnum = interface->cur_altsetting->desc.bInterfaceNumber;
Greg Kroah-Hartman
maintainerPATCH 4/332 udp: Fix memory accounting leak.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit df207de9d9e7a4d92f8567e2c539d9c8c12fd99d upstream.
Matt Dowling reported a weird UDP memory usage issue.
Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288 pages and never dropped. Moreover, the value doubled when the application was terminated. Finally, it caused intermittent packet drops.
We can reproduce the issue with the script below [0]:
1. /proc/net/sockstat reports 0 pages
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 02. Run the script till the report reaches 524,288
# python3 test.py & sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 3 mem 524288 <-- (INT_MAX + 1) >> PAGE_SHIFT3. Kill the socket and confirm the number never drops
# pkill python3 && sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 524288 4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()
# python3 test.py & sleep 1 && pkill python3
5. The number doubles
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 1048577The application set INT_MAX to SO_RCVBUF, which triggered an integer overflow in udp_rmem_release().
When a socket is close()d, udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable.
The total size is then passed to udp_rmem_release() to adjust memory accounting. However, because the function takes a signed integer argument, the total size can wrap around, causing an overflow.
Then, the released amount is calculated as follows:
1) Add size to sk->sk_forward_alloc.
2) Round down sk->sk_forward_alloc to the nearest lower multiple of PAGE_SIZE and assign it to amount.
3) Subtract amount from sk->sk_forward_alloc.
4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().
When the issue occurred, the total in udp_destruct_common() was 2147484480 (INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().
At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and
2) sets -2147479552 to amount. 3) reverts the wraparound, so we don't see a warning in inet_sock_destruct(). However, udp_memory_allocated ends up doubling at 4).
Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for memory_allocated"), memory usage no longer doubles immediately after a socket is close()d because __sk_mem_reduce_allocated() caches the amount in udp_memory_per_cpu_fw_alloc. However, the next time a UDP socket receives a packet, the subtraction takes effect, causing UDP memory usage to double.
This issue makes further memory allocation fail once the socket's sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet drops.
To prevent this issue, let's use unsigned int for the calculation and call sk_forward_alloc_add() only once for the small delta.
Note that first_packet_length() also potentially has the same problem.
[0]:
from socket import *
SO_RCVBUFFORCE = 33INT_MAX = (2 ** 31) - 1
s = socket(AF_INET, SOCK_DGRAM)s.bind(('', 0))s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)
c = socket(AF_INET, SOCK_DGRAM)
c.connect(s.getsockname())
data = b'a' * 100
while True:
c.send(data)
--- net/ipv4/udp.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
net/ipv4/udp.c +7 -9
@@ -1445,12 +1445,12 @@ static bool udp_skb_has_head_state(struc }/* fully reclaim rmem/fwd memory allocated for skb */ -static void udp_rmem_release (struct sock *sk,int size,int partial, -bool rx_queue_lock_held) +static void udp_rmem_release (struct sock *sk,unsigned int size, +int partial,bool rx_queue_lock_held) {struct udp_sock *up =udp_sk (sk);struct sk_buff_head *sk_queue; -int amt; +unsigned int amt;if (likely (partial)) { up->forward_deficit += size;
@@ -1470,10 +1470,8 @@ static void udp_rmem_release(struct sockif (!rx_queue_lock_held)spin_lock (&sk_queue->lock); - - sk->sk_forward_alloc += size; - amt = (sk->sk_forward_alloc - partial) & ~(SK_MEM_QUANTUM -1 ); - sk->sk_forward_alloc -= amt; + amt = (size + sk->sk_forward_alloc - partial) & ~(PAGE_SIZE -1 ); + sk->sk_forward_alloc += size - amt;if (amt)__sk_mem_reduce_allocated (sk, amt >>SK_MEM_QUANTUM_SHIFT );
@@ -1657,7 +1655,7 @@ EXPORT_SYMBOL_GPL(skb_consume_udp);static struct sk_buff *__first_packet_length (struct sock *sk,struct sk_buff_head *rcvq, -int *total) +unsigned int *total) {struct sk_buff *skb;
@@ -1690,8 +1688,8 @@ static int first_packet_length(struct so {struct sk_buff_head *rcvq = &udp_sk (sk)->reader_queue;struct sk_buff_head *sk_queue = &sk->sk_receive_queue; +unsigned int total =0 ;struct sk_buff *skb; -int total =0 ;int res;spin_lock_bh (&rcvq->lock);
Greg Kroah-Hartman
maintainerPATCH 5/332 media: tunner: xc5000: Refactor firmware load
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 8e1f5da59dd4a1966f859639860b803a7e8b8bfb ]
Make sure the firmware is released when we leavexc_load_fw_and_init_tuner()
This change makes smatch happy:drivers/media/tuners/xc5000.c:1213 xc_load_fw_and_init_tuner() warn: 'fw' from request_firmware() not released on lines: 1213.
Stable-dep-of: 40b7a19f321e ("media: tuner: xc5000: Fix use-after-free in xc5000_release")
--- drivers/media/tuners/xc5000.c | 41 ++++++++++++++++++----------------------- 1 file changed, 18 insertions(+), 23 deletions(-)
drivers/media/tuners/xc5000.c +18 -23
@@ -58,7 +58,7 @@ struct xc5000_priv {struct dvb_frontend *fe;struct delayed_work timer_sleep; -const struct firmware *firmware; +bool inited; };/* Misc Defines */
@@ -1110,23 +1110,19 @@ static int xc_load_fw_and_init_tuner(strif (!force &&xc5000_is_firmware_loaded (fe) ==0 )return 0 ; -if (!priv->firmware) { - ret =request_firmware (&fw, desired_fw->name, - priv->i2c_props.adap->dev.parent); -if (ret) { -pr_err ("xc5000: Upload failed. rc %d\n" , ret); -return ret; - } -dprintk (1 ,"firmware read %zu bytes.\n" , fw->size); - -if (fw->size != desired_fw->size) { -pr_err ("xc5000: Firmware file with incorrect size\n" ); -release_firmware (fw); -return -EINVAL ; - } - priv->firmware = fw; - }else - fw = priv->firmware; + ret =request_firmware (&fw, desired_fw->name, + priv->i2c_props.adap->dev.parent); +if (ret) { +pr_err ("xc5000: Upload failed. rc %d\n" , ret); +return ret; + } +dprintk (1 ,"firmware read %zu bytes.\n" , fw->size); + +if (fw->size != desired_fw->size) { +pr_err ("xc5000: Firmware file with incorrect size\n" ); +release_firmware (fw); +return -EINVAL ; + }/* Try up to 5 times to load firmware */ for (i =0 ; i <5 ; i++) {
@@ -1204,6 +1200,7 @@ static int xc_load_fw_and_init_tuner(str } err: +release_firmware (fw);if (!ret)printk (KERN_INFO "xc5000: Firmware %s loaded and running.\n" , desired_fw->name);
@@ -1274,7 +1271,7 @@ static int xc5000_resume(struct dvb_fron/* suspended before firmware is loaded. Avoid firmware load in resume path. */ -if (!priv->firmware) +if (!priv->inited)return 0 ;return xc5000_set_params (fe);
@@ -1293,6 +1290,8 @@ static int xc5000_init(struct dvb_fronteif (debug)xc_debug_dump (priv); + priv->inited = true; +return 0 ; }
@@ -1306,10 +1305,6 @@ static void xc5000_release(struct dvb_frif (priv) {cancel_delayed_work (&priv->timer_sleep); -if (priv->firmware) { -release_firmware (priv->firmware); - priv->firmware =NULL ; - }hybrid_tuner_release_state (priv); }
Greg Kroah-Hartman
maintainerPATCH 6/332 media: tuner: xc5000: Fix use-after-free in xc5000_release
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 40b7a19f321e65789612ebaca966472055dab48c ]
The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv.
A typical race condition is illustrated below:
CPU 0 (release thread) | CPU 1 (delayed work callback)
xc5000_release() | xc5000_do_timer_sleep()
cancel_delayed_work() |
hybrid_tuner_release_state(priv) |
kfree(priv) |
| priv = container_of() // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated.
A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here.
This bug was initially identified through static analysis.
--- drivers/media/tuners/xc5000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/tuners/xc5000.c +1 -1
@@ -1304,7 +1304,7 @@ static void xc5000_release(struct dvb_frmutex_lock (&xc5000_list_mutex);if (priv) { -cancel_delayed_work (&priv->timer_sleep); +cancel_delayed_work_sync (&priv->timer_sleep);hybrid_tuner_release_state (priv); }
Greg Kroah-Hartman
maintainerPATCH 7/332 media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 79d10f4f21a92e459b2276a77be62c59c1502c9d ]
The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming itself. Using timer_delete() fails to guarantee the timer isn't still running when destroyed, similarly cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has terminated if already executing. During probe failure after timer initialization, these may continue running as orphans and reference the already-freed tc358743_state object through tc358743_irq_poll_timer.
The following is the trace captured by KASAN.
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800ded83c8 by task swapper/1/0 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
Allocated by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Replace timer_delete() with timer_delete_sync() and cancel_delayed_work() with cancel_delayed_work_sync() to ensure proper termination of timer and work items before resource cleanup.
This bug was initially identified through static analysis. For reproduction and testing, I created a functional emulation of the tc358743 device via a kernel module and introduced faults through the debugfs interface.
--- drivers/media/i2c/tc358743.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/tc358743.c +2 -2
@@ -2201,10 +2201,10 @@ static int tc358743_probe(struct i2c_cli err_work_queues:cec_unregister_adapter (state->cec_adap);if (!state->i2c_client->irq) { -del_timer (&state->timer); +timer_delete_sync (&state->timer);flush_work (&state->work_i2c_poll); } -cancel_delayed_work (&state->delayed_work_enable_hotplug); +cancel_delayed_work_sync (&state->delayed_work_enable_hotplug);mutex_destroy (&state->confctl_mutex); err_hdl:media_entity_cleanup (&sd->entity);
Greg Kroah-Hartman
maintainerPATCH 8/332 USB: serial: option: add SIMCom 8230C compositions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaowei Li <[email protected]>
commit 0e0ba0ecec3d6e819e0c2348331ff99afe2eb5d5 upstream.
Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip.
USB Device Listings:
0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet (QMI mode) + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9071 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x9078: tty (DM) + tty (NMEA) + tty (AT) + ECM + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9078 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x907b: RNDIS + tty (DM) + tty (NMEA) + tty (AT) + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=907b Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=ef(misc ) Sub=04 Prot=01
I:* If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -2114,6 +2114,12 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ .driver_info = RSVD(7) }, + { USB_DEVICE(0x1e0e, 0x9071), /* Simcom SIM8230 RMNET mode */ + .driver_info = RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9078, 0xff), /* Simcom SIM8230 ECM mode */ + .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x907b, 0xff), /* Simcom SIM8230 RNDIS mode */ + .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
Greg Kroah-Hartman
maintainerPATCH 9/332 wifi: rtlwifi: rtl8192cu: Dont claim USB ID 07b8:8188
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
commit e798f2ac6040f46a04795d7de977341fa9aeabae upstream.
This ID appears to be RTL8188SU, not RTL8188CU. This is the wrong driver for RTL8188SU. The r8712u driver from staging used to handle this ID.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c +0 -1
@@ -296,7 +296,6 @@ static const struct usb_device_id rtl819 {RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/ {RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/ {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/ - {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/
Greg Kroah-Hartman
maintainerPATCH 10/332 dm-integrity: limit MAX_TAG_SIZE to 255
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size = ic->tag_size" assignment. We need to limit it to 255.
--- drivers/md/dm-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-integrity.c +1 -1
@@ -119,7 +119,7 @@ struct journal_sector {commit_id_t commit_id; }; -#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) +#define MAX_TAG_SIZE 255#define METADATA_PADDING_SECTORS 8
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/332 perf subcmd: avoid crash in exclude_cmds when excludes is empty
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: hupu <[email protected]>
[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
When cross-compiling the perf tool for ARM64, perf help may crash with the following assertion failure:
help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
This happens when the perf binary is not named exactly "perf" or when multiple "perf-*" binaries exist in the same directory. In such cases, the excludes command list can be empty, which leads to the final assertion in exclude_cmds() being triggered.
Add a simple guard at the beginning of exclude_cmds() to return early if excludes->cnt is zero, preventing the crash.
--- tools/lib/subcmd/help.c | 3 +++ 1 file changed, 3 insertions(+)
tools/lib/subcmd/help.c +3 -0
@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)size_t ci, cj, ei;int cmp; +if (!excludes->cnt) +return ; + ci = cj = ei =0 ;while (ci < cmds->cnt && ei < excludes->cnt) { cmp =strcmp (cmds->names[ci]->name, excludes->names[ei]->name);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/332 hid: fix I2C read buffer overflow in raw_event() for mcp2221
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Lecomte <[email protected]>
commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 upstream.
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have:
"The number of read-back data bytes to follow in this packet:
from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
--- drivers/hid/hid-mcp2221.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hid/hid-mcp2221.c +4 -0
@@ -791,6 +791,10 @@ static int mcp2221_raw_event(struct hid_ }if (data[2 ] ==MCP2221_I2C_READ_COMPL || data[2 ] ==MCP2221_I2C_READ_PARTIAL ) { +if (!mcp->rxbuf || mcp->rxbuf_idx <0 || data[3 ] >60 ) { + mcp->status = -EINVAL ; +break ; + } buf = mcp->rxbuf;memcpy (&buf[mcp->rxbuf_idx], &data[4 ], data[3 ]); mcp->rxbuf_idx = mcp->rxbuf_idx + data[3 ];
Greg Kroah-Hartman
maintainerPATCH 13/332 serial: stm32: allow selecting console when the driver is module
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Gallais-Pou <[email protected]>
commit cc4d900d0d6d8dd5c41832a93ff3cfa629a78f9a upstream.
Console can be enabled on the UART compile as module.
Change dependency to allow console mode when the driver is built as module.
--- drivers/tty/serial/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/Kconfig +1 -1
@@ -1494,7 +1494,7 @@ config SERIAL_STM32 config SERIAL_STM32_CONSOLE bool "Support for console on STM32" - depends on SERIAL_STM32=y + depends on SERIAL_STM32 select SERIAL_CORE_CONSOLE config SERIAL_MVEBU_UART
Greg Kroah-Hartman
maintainerPATCH 14/332 staging: axis-fifo: fix maximum TX packet length check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
commit 52ff2b840bc723f3be1f096f8017c78e0515858c upstream.
Since commit 2ca34b508774 ("staging: axis-fifo: Correct handling of tx_fifo_depth for size validation"), write() operations with packets larger than 'tx_fifo_depth - 4' words are no longer rejected with -EINVAL.
Fortunately, the packets are not actually getting transmitted to hardware, otherwise they would be raising a 'Transmit Packet Overrun Error' interrupt, which requires a reset of the TX circuit to recover from.
Instead, the request times out inside wait_event_interruptible_timeout() and always returns -EAGAIN, since the wake up condition can never be true for these packets. But still, they unnecessarily block other tasks from writing to the FIFO and the EAGAIN return code signals userspace to retry the write() call, even though it will always fail and time out.
According to the AXI4-Stream FIFO reference manual (PG080), the maximum valid packet length is 'tx_fifo_depth - 4' words, so attempting to send larger packets is invalid and should not be happening in the first place:
Quoted 2 lines
The maximum packet that can be transmitted is limited by the size of the FIFO, which is (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes.
Therefore, bring back the old behavior and outright reject packets larger than 'tx_fifo_depth - 4' with -EINVAL. Add a comment to explain why the check is necessary. The dev_err() message was removed to avoid cluttering the dmesg log if an invalid packet is received from userspace.
--- drivers/staging/axis-fifo/axis-fifo.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +10 -4
@@ -494,11 +494,17 @@ static ssize_t axis_fifo_write(struct fireturn -EINVAL ; } -if (words_to_write > fifo->tx_fifo_depth) { -dev_err (fifo->dt_device,"tried to write more words [%u] than slots in the fifo buffer [%u]\n" , - words_to_write, fifo->tx_fifo_depth); +/* +* In 'Store-and-Forward' mode, the maximum packet that can be +* transmitted is limited by the size of the FIFO, which is +* (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. +* +* Do not attempt to send a packet larger than 'tx_fifo_depth - 4', +* otherwise a 'Transmit Packet Overrun Error' interrupt will be +* raised, which requires a reset of the TX circuit to recover. +*/ +if (words_to_write > (fifo->tx_fifo_depth -4 ))return -EINVAL ; - }if (fifo->write_flags &O_NONBLOCK ) {/*
Greg Kroah-Hartman
maintainerPATCH 15/332 staging: axis-fifo: flush RX FIFO on read errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
commit 82a051e2553b9e297cba82a975d9c538b882c79e upstream.
Flush stale data from the RX FIFO in case of errors, to avoid reading old data when new packets arrive.
Commit c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") removed full FIFO resets from the read error paths, which fixed potential TX data losses, but introduced this RX issue.
--- drivers/staging/axis-fifo/axis-fifo.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +11 -7
@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil } bytes_available =ioread32 (fifo->base_addr +XLLF_RLR_OFFSET ); + words_available = bytes_available /sizeof (u32);if (!bytes_available) {dev_err (fifo->dt_device,"received a packet of length 0\n" ); ret = -EIO ;
@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fildev_err (fifo->dt_device,"user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n" , bytes_available, len); ret = -EINVAL ; - goto end_unlock; + goto err_flush_rx; }if (bytes_available %sizeof (u32)) {
@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil*/ dev_err (fifo->dt_device,"received a packet that isn't word-aligned\n" ); ret = -EIO ; - goto end_unlock; + goto err_flush_rx; } - words_available = bytes_available /sizeof (u32); -/* read data into an intermediate buffer, copying the contents * to userspace when the buffer is full */
@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil tmp_buf[i] =ioread32 (fifo->base_addr +XLLF_RDFD_OFFSET ); } + words_available -= copy;if (copy_to_user (buf + copied *sizeof (u32), tmp_buf, copy *sizeof (u32))) { ret = -EFAULT ; - goto end_unlock; + goto err_flush_rx; } copied += copy; - words_available -= copy; } +mutex_unlock (&fifo->read_lock); + +return bytes_available; - ret = bytes_available; +err_flush_rx: +while (words_available--) +ioread32 (fifo->base_addr +XLLF_RDFD_OFFSET ); end_unlock:mutex_unlock (&fifo->read_lock);
Greg Kroah-Hartman
maintainerPATCH 16/332 driver core/PM: Set power.no_callbacks along with power.no_pm
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit c2ce2453413d429e302659abc5ace634e873f6f5 upstream.
Devices with power.no_pm set are not expected to need any power management at all, so modify device_set_pm_not_required() to set power.no_callbacks for them too in case runtime PM will be enabled for any of them (which in principle may be done for convenience if such a device participates in a dependency chain).
Since device_set_pm_not_required() must be called before device_add() or it would not have any effect, it can update power.no_callbacks without locking, unlike pm_runtime_no_callbacks() that can be called after registering the target device.
--- include/linux/device.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/device.h +3 -0
@@ -740,6 +740,9 @@ static inline bool device_pm_not_requirestatic inline void device_set_pm_not_required (struct device *dev) { dev->power.no_pm = true; +#ifdef CONFIG_PM + dev->power.no_callbacks = true; +#endif }static inline void dev_pm_syscore_device (struct device *dev,bool val)
Greg Kroah-Hartman
maintainerPATCH 17/332 drm/amd/display: Remove redundant safeguards for dmub-srv destroy()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Li <[email protected]>
commit 3beac533b8daa18358dabbe5059c417d192b2a93 upstream.
[Why]dc_dmub_srv_destroy() has internal null-check and null assignment. No need to duplicate them externally.
[How]
Remove redundant safeguards.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -4
@@ -1141,10 +1141,8 @@ static void amdgpu_dm_fini(struct amdgpuif (adev->dm.dc)dc_deinit_callbacks (adev->dm.dc);#endif -if (adev->dm.dc->ctx->dmub_srv) { -dc_dmub_srv_destroy (&adev->dm.dc->ctx->dmub_srv); - adev->dm.dc->ctx->dmub_srv =NULL ; - } + +dc_dmub_srv_destroy (&adev->dm.dc->ctx->dmub_srv);if (adev->dm.dmub_bo) amdgpu_bo_free_kernel(&adev->dm.dmub_bo,
Greg Kroah-Hartman
maintainerPATCH 18/332 drm/amd/display: Fix potential null dereference
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Artemiev <[email protected]>
commit 52f1783ff4146344342422c1cd94fcb4ce39b6fe upstream.
The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() without checking.
Add a NULL pointer check before calling dc_dmub_srv_destroy().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -1
@@ -1142,7 +1142,8 @@ static void amdgpu_dm_fini(struct amdgpudc_deinit_callbacks (adev->dm.dc);#endif -dc_dmub_srv_destroy (&adev->dm.dc->ctx->dmub_srv); +if (adev->dm.dc) +dc_dmub_srv_destroy (&adev->dm.dc->ctx->dmub_srv);if (adev->dm.dmub_bo) amdgpu_bo_free_kernel(&adev->dm.dmub_bo,
Greg Kroah-Hartman
maintainerPATCH 19/332 crypto: rng - Ensure set_ent is always present
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit c0d36727bf39bb16ef0a67ed608e279535ebf0da upstream.
Ensure that set_ent is always set since only drbg provides it.
--- crypto/rng.c | 8 ++++++++ 1 file changed, 8 insertions(+)
crypto/rng.c +8 -0
@@ -174,6 +174,11 @@ out:EXPORT_SYMBOL_GPL (crypto_del_default_rng);#endif +static void rng_default_set_ent (struct crypto_rng *tfm,const u8 *data, +unsigned int len) +{ +} +int crypto_register_rng (struct rng_alg *alg) {struct crypto_alg *base = &alg->base;
@@ -185,6 +190,9 @@ int crypto_register_rng(struct rng_alg * base->cra_flags &= ~CRYPTO_ALG_TYPE_MASK ; base->cra_flags |=CRYPTO_ALG_TYPE_RNG ; +if (!alg->set_ent) + alg->set_ent = rng_default_set_ent; +return crypto_register_alg (base); }EXPORT_SYMBOL_GPL (crypto_register_rng);
Greg Kroah-Hartman
maintainerPATCH 20/332 filelock: add FL_RECLAIM to show_fl_flags() macro
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
Show the FL_RECLAIM flag symbolically in tracepoints.
--- include/trace/events/filelock.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/trace/events/filelock.h +2 -1
@@ -27,7 +27,8 @@ { FL_SLEEP, "FL_SLEEP" }, \ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ - { FL_OFDLCK, "FL_OFDLCK" }) + { FL_OFDLCK, "FL_OFDLCK" }, \ + { FL_RECLAIM, "FL_RECLAIM"}) #define show_fl_type(val) \ __print_symbolic(val, \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/332 selftests: arm64: Check fread return value in exec_target
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bala-Vignesh-Reddy <[email protected]>
[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
Fix -Wunused-result warning generated when compiled with gcc 13.3.0, by checking fread's return value and handling errors, preventing potential failures when reading from stdin.
Fixes compiler warning:
warning: ignoring return value of 'fread' declared with attribute 'warn_unused_result' [-Wunused-result]
--- tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
tools/testing/selftests/arm64/pauth/exec_target.c +6 -1
@@ -13,7 +13,12 @@ int main(void)unsigned long hwcaps;size_t val; -fread (&val,sizeof (size_t ),1 , stdin); +size_t size =fread (&val,sizeof (size_t ),1 , stdin); + +if (size !=1 ) { +fprintf (stderr,"Could not read input from stdin\n" ); +return EXIT_FAILURE ; + }/* don't try to execute illegal (unimplemented) instructions) caller * should have checked this and keep worker simple
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/332 perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
--- drivers/perf/arm_spe_pmu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/perf/arm_spe_pmu.c +2 -1
@@ -93,7 +93,8 @@ struct arm_spe_pmu {#define to_spe_pmu (p) (container_of(p, struct arm_spe_pmu, pmu))/* Convert a free-running index from perf into an SPE buffer offset */ -#define PERF_IDX2OFF (idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) +#define PERF_IDX2OFF (idx, buf) \ + ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))/* Keep track of our dynamic hotplug state */ static enum cpuhp_state arm_spe_pmu_online;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/332 x86/vdso: Fix output operand size of RDPID
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <[email protected]>
[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
RDPID instruction outputs to a word-sized register (64-bit on x86_64 and 32-bit on x86_32). Use an unsigned long variable to store the correct size.
LSL outputs to 32-bit register, use %k operand prefix to always print the 32-bit name of the register.
Use RDPID insn mnemonic while at it as the minimum binutils version of 2.30 supports it.
[ bp: Merge two patches touching the same function into a single one. ]
--- arch/x86/include/asm/segment.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/x86/include/asm/segment.h +4 -4
@@ -242,7 +242,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)static inline void vdso_read_cpunode (unsigned *cpu,unsigned *node) { -unsigned int p; +unsigned long p;/* * Load CPU and node number from the GDT. LSL is faster than RDTSCP
@@ -252,10 +252,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)* * If RDPID is available, use it. */ -alternative_io ("lsl %[seg],%[p]" , -".byte 0xf3,0x0f,0xc7,0xf8" ,/* RDPID %eax/rax */ +alternative_io ("lsl %[seg],%k[p]" , +"rdpid %[p]" , X86_FEATURE_RDPID, - [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); + [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); if (cpu) *cpu = (p & VDSO_CPUNODE_MASK);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/332 regmap: Remove superfluous check for !config in __regmap_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
The first thing __regmap_init() do is check if config is non-NULL, so there is no need to check for this again later.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -853,7 +853,7 @@ struct regmap *__regmap_init(struct device *dev, map->read_flag_mask = bus->read_flag_mask; } -if (config && config->read && config->write) { +if (config->read && config->write) { map->reg_read = _regmap_bus_read;/* Bulk read/write */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/332 libbpf: Fix reuse of DEVMAP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yureka Lilian <[email protected]>
[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
Previously, re-using pinned DEVMAP maps would always fail, because get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from get_map_info when checking for compatibility with an existing DEVMAP.
The same problem is handled in a third-party ebpf library:
- https://github.com/cilium/ebpf/issues/925
- https://github.com/cilium/ebpf/pull/930
--- tools/lib/bpf/libbpf.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
tools/lib/bpf/libbpf.c +10 -0
@@ -4091,6 +4091,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)return false; } +/* +* bpf_get_map_info_by_fd() for DEVMAP will always return flags with +* BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. +* Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +* bpf_get_map_info_by_fd() when checking for compatibility with an +* existing DEVMAP. +*/ +if (map->def.type ==BPF_MAP_TYPE_DEVMAP || map->def.type ==BPF_MAP_TYPE_DEVMAP_HASH ) + map_info.map_flags &= ~BPF_F_RDONLY_PROG ; + return (map_info.type == map->def.type && map_info.key_size == map->def.key_size && map_info.value_size == map->def.value_size &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/332 ACPI: processor: idle: Fix memory leak when register cpuidle device failed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huisong Li <[email protected]>
[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
The cpuidle device's memory is leaked when cpuidle device registration fails in acpi_processor_power_init(). Free it as appropriate.
--- drivers/acpi/processor_idle.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/processor_idle.c +3 -0
@@ -1406,6 +1406,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)if (retval) {if (acpi_processor_registered ==0 )cpuidle_unregister_driver (&acpi_idle_driver); + +per_cpu (acpi_cpuidle_device, pr->id) =NULL ; +kfree (dev);return retval; } acpi_processor_registered++;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/332 soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sneh Mankad <[email protected]>
[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a transaction completes. Previously this bit was only cleared when a wake TCS was borrowed as an AMC TCS but not for dedicated AMC TCS. Leaving this bit set for AMC TCS and entering deeper low power modes can generate a false completion IRQ.
Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER bit upon receiving a completion IRQ.
--- drivers/soc/qcom/rpmh-rsc.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/soc/qcom/rpmh-rsc.c +2 -5
@@ -432,13 +432,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)trace_rpmh_tx_done (drv, i, req, err); -/* -* If wake tcs was re-purposed for sending active -* votes, clear AMC trigger & enable modes and +/* Clear AMC trigger & enable modes and * disable interrupt for this TCS */ -if (!drv->tcs[ACTIVE_TCS ].num_tcs) -__tcs_set_trigger (drv, i, false); +__tcs_set_trigger (drv, i, false); skip:/* Reclaim the TCS */ write_tcs_reg (drv,RSC_DRV_CMD_ENABLE , i,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/332 pinctrl: meson-gxl: add missing i2c_d pinmux
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Da Xue <[email protected]>
[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
--- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/pinctrl/meson/pinctrl-meson-gxl.c +10 -0
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };static const unsigned int i2c_sck_c_dv19_pins[] = {GPIODV_19 };static const unsigned int i2c_sda_c_dv18_pins[] = {GPIODV_18 }; +static const unsigned int i2c_sck_d_pins[] = {GPIOX_11 }; +static const unsigned int i2c_sda_d_pins[] = {GPIOX_10 }; +static const unsigned int eth_mdio_pins[] = {GPIOZ_0 };static const unsigned int eth_mdc_pins[] = {GPIOZ_1 };static const unsigned int eth_clk_rx_clk_pins[] = {GPIOZ_2 };
@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {GPIO_GROUP (GPIO_TEST_N ),/* Bank X */ +GROUP (i2c_sda_d,5 ,5 ), +GROUP (i2c_sck_d,5 ,4 ),GROUP (sdio_d0,5 ,31 ),GROUP (sdio_d1,5 ,30 ), GROUP(sdio_d2, 5, 29),
@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", }; +static const char *const i2c_d_groups[] = { +"i2c_sck_d" ,"i2c_sda_d" , +}; +static const char *const eth_groups[] = {"eth_mdio" ,"eth_mdc" ,"eth_clk_rx_clk" ,"eth_rx_dv" ,"eth_rxd0" ,"eth_rxd1" ,"eth_rxd2" ,"eth_rxd3" ,
@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {FUNCTION (i2c_a),FUNCTION (i2c_b),FUNCTION (i2c_c), +FUNCTION (i2c_d),FUNCTION (eth),FUNCTION (pwm_a), FUNCTION(pwm_b),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/332 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning:
kernfs: can not remove 'nr_tags', no directory
WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk]
kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it.
--- block/blk-mq-sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
block/blk-mq-sysfs.c +4 -2
@@ -233,9 +233,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)return ;hctx_for_each_ctx (hctx, ctx, i) -kobject_del (&ctx->kobj); +if (ctx->kobj.state_in_sysfs) +kobject_del (&ctx->kobj); -kobject_del (&hctx->kobj); +if (hctx->kobj.state_in_sysfs) +kobject_del (&hctx->kobj); }static int blk_mq_register_hctx (struct blk_mq_hw_ctx *hctx)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/332 block: use int to store blk_stack_limits() return value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
Change the 'ret' variable in blk_stack_limits() from unsigned int to int, as it needs to store negative value -1.
Storing the negative error codes in unsigned type, or performing equality comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
--- block/blk-settings.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-settings.c +2 -1
@@ -523,7 +523,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbint blk_stack_limits (struct queue_limits *t,struct queue_limits *b,sector_t start) { -unsigned int top, bottom, alignment, ret =0 ; +unsigned int top, bottom, alignment; +int ret =0 ; t->max_sectors =min_not_zero (t->max_sectors, b->max_sectors); t->max_hw_sectors =min_not_zero (t->max_hw_sectors, b->max_hw_sectors);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/332 PM: sleep: core: Clear power.must_resume in noirq suspend error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
If system suspend is aborted in the "noirq" phase (for instance, due to an error returned by one of the device callbacks), power.is_noirq_suspended will not be set for some devices and device_resume_noirq() will return early for them. Consequently, noirq resume callbacks will not run for them at all because the noirq suspend callbacks have not run for them yet.
If any of them has power.must_resume set and late suspend has been skipped for it (due to power.smart_suspend), early resume should be skipped for it either, or its state may become inconsistent (for instance, if the early resume assumes that it will always follow noirq resume).
Make that happen by clearing power.must_resume in device_resume_noirq() for devices with power.is_noirq_suspended clear that have been left in suspend by device_suspend_late(), which will subsequently cause device_resume_early() to leave the device in suspend and avoid changing its state.
--- drivers/base/power/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/base/power/main.c +13 -1
@@ -604,8 +604,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool aif (dev->power.syscore || dev->power.direct_complete) goto Out; -if (!dev->power.is_noirq_suspended) +if (!dev->power.is_noirq_suspended) { +/* +* This means that system suspend has been aborted in the noirq +* phase before invoking the noirq suspend callback for the +* device, so if device_suspend_late() has left it in suspend, +* device_resume_early() should leave it in suspend either in +* case the early resume of it depends on the noirq resume that +* has not run. +*/ +if (dev_pm_skip_suspend (dev)) + dev->power.must_resume = false; + goto Out; + }if (!dpm_wait_for_superior (dev, async)) goto Out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/332 pinctrl: renesas: Use int type to store negative error codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned int to int, as it needs to store either negative error codes or zero returned by sh_pfc_pinconf_set().
No effect on runtime.
--- drivers/pinctrl/renesas/pinctrl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/renesas/pinctrl.c +2 -1
@@ -745,7 +745,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,struct sh_pfc_pinctrl *pmx =pinctrl_dev_get_drvdata (pctldev);const unsigned int *pins;unsigned int num_pins; -unsigned int i, ret; +unsigned int i; +int ret; pins = pmx->pfc->info->groups[group].pins; num_pins = pmx->pfc->info->groups[group].nr_pins;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/332 arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
This devicetree contained only the SoC compatible but lacked the machine specific one: add a "mediatek,mt8516-pumpkin" compatible to the list to fix dtbs_check warnings.
--- arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +1 -1
@@ -11,7 +11,7 @@ / { model = "Pumpkin MT8516"; - compatible = "mediatek,mt8516"; + compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; memory@40000000 { device_type = "memory";
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/332 pwm: tiehrpwm: Fix corner case in clock divisor calculation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
The function set_prescale_div() is responsible for calculating the clock divisor settings such that the input clock rate is divided down such that the required period length is at most 0x10000 clock ticks. If period_cycles is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is good enough. So round up in the calculation of the required divisor and compare it using >= instead of >.
--- drivers/pwm/pwm-tiehrpwm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-tiehrpwm.c +2 -2
@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, *prescale_div = (1 << clkdiv) * (hspclkdiv ? (hspclkdiv *2 ) :1 ); -if (*prescale_div > rqst_prescaler) { +if (*prescale_div >= rqst_prescaler) { *tb_clk_div = (clkdiv <<TBCTL_CLKDIV_SHIFT ) | (hspclkdiv <<TBCTL_HSPCLKDIV_SHIFT );return 0 ;
@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, pc->period_cycles[pwm->hwpwm] = period_cycles;/* Configure clock prescaler to support Low frequency PWM wave */ -if (set_prescale_div (period_cycles/PERIOD_MAX , &ps_divval, +if (set_prescale_div (DIV_ROUND_UP (period_cycles,PERIOD_MAX ), &ps_divval, &tb_divval)) {dev_err (chip->dev,"Unsupported values\n" );return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/332 selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhilesh Patil <[email protected]>
[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
Check if watchdog device supports WDIOF_KEEPALIVEPING option before entering keep_alive() ping test loop. Fix watchdog-test silently looping if ioctl based ping is not supported by the device. Exit from test in such case instead of getting stuck in loop executing failing keep_alive()
watchdog_info:
identity: m41t93 rtc Watchdog
firmware_version: 0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.WDIOC_KEEPALIVE not supported by this device
without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)
Updated change log at commit time:
Shuah Khan <[email protected]>
--- tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/watchdog/watchdog-test.c +6 -0
@@ -240,6 +240,12 @@ int main(int argc, char *argv[])if (oneshot) goto end; +/* Check if WDIOF_KEEPALIVEPING is supported */ +if (!(info.options &WDIOF_KEEPALIVEPING )) { +printf ("WDIOC_KEEPALIVE not supported by this device\n" ); + goto end; + } +printf ("Watchdog Ticking Away!\n" );/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/332 bpf: Explicitly check accesses to bpf_sock_addr
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
Syzkaller found a kernel warning on the following sock_addr program:
0: r0 = 0
1: r2 = *(u32 *)(r1 +60)
2: exitwhich triggers:
verifier bug: error during ctx access conversion (0)
This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access.
This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access.
I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
--- net/core/filter.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/core/filter.c +10 -6
@@ -8149,13 +8149,17 @@ static bool sock_addr_is_valid_access(int off, int size,return false; info->reg_type =PTR_TO_SOCKET ;break ; -default : -if (type ==BPF_READ ) { -if (size != size_default) -return false; - }else { + case bpf_ctx_range(struct bpf_sock_addr, user_family): + case bpf_ctx_range(struct bpf_sock_addr, family): + case bpf_ctx_range(struct bpf_sock_addr, type): + case bpf_ctx_range(struct bpf_sock_addr, protocol): +if (type !=BPF_READ )return false; - } +if (size != size_default) +return false; +break ; +default : +return false; }return true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/332 i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leilk.Liu <[email protected]>
[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
The old IC does not support the I2C_MASTER_WRRD (write-then-read) function, but the current code’s handling of i2c->auto_restart may potentially lead to entering the I2C_MASTER_WRRD software flow, resulting in unexpected bugs.
Instead of repurposing the auto_restart flag, add a separate flag to signal I2C_MASTER_WRRD operations.
Also fix handling of msgs. If the operation (i2c->op) is I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. For all other operations, msgs is simply incremented by 1.
--- drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/i2c/busses/i2c-mt65xx.c +10 -7
@@ -1065,6 +1065,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, {int ret;int left_num = num; +bool write_then_read_en = false;struct mtk_i2c *i2c =i2c_get_adapdata (adap); ret =mtk_i2c_clock_enable (i2c);
@@ -1078,6 +1079,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,if (!(msgs[0 ].flags &I2C_M_RD ) && (msgs[1 ].flags &I2C_M_RD ) && msgs[0 ].addr == msgs[1 ].addr) { i2c->auto_restart =0 ; + write_then_read_en = true; } }
@@ -1102,12 +1104,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,else i2c->op =I2C_MASTER_WR ; -if (!i2c->auto_restart) { -if (num >1 ) { -/* combined two messages into one transaction */ - i2c->op =I2C_MASTER_WRRD ; - left_num--; - } +if (write_then_read_en) { +/* combined two messages into one transaction */ + i2c->op =I2C_MASTER_WRRD ; + left_num--; }/* always use DMA mode. */
@@ -1115,7 +1115,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,if (ret <0 ) goto err_exit; - msgs++; +if (i2c->op ==I2C_MASTER_WRRD ) + msgs +=2 ; +else + msgs++; }/* the return value is number of executed messages */ ret = num;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/332 i2c: designware: Add disabling clocks when probe fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <[email protected]>
[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is called. However, this function doesn't disable clocks and the clock-enable count keeps increasing. Should disable these clocks explicitly.
--- drivers/i2c/busses/i2c-designware-platdrv.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-designware-platdrv.c +1 -0
@@ -327,6 +327,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) exit_probe:dw_i2c_plat_pm_cleanup (dev); +i2c_dw_prepare_clk (dev, false); exit_reset:reset_control_assert (dev->rst);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/332 drm/radeon/r600_cs: clean up of dead code in r600_cs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
GCC 16 enables -Werror=unused-but-set-variable= which results in build error with the following message.
drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
1411 | unsigned offset, i, level;
| ^~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
level although is set, but in never used in the function r600_texture_size. Thus resulting in dead code and this error getting triggered.
--- drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/r600_cs.c +2 -2
@@ -1409,7 +1409,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, unsigned block_align, unsigned height_align, unsigned base_align, unsigned *l0_size, unsigned *mipmap_size) { - unsigned offset, i, level; + unsigned offset, i;unsigned width, height, depth, size;unsigned blocksize;unsigned nbx, nby;
@@ -1421,7 +1421,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, w0 =r600_mip_minify (w0,0 ); h0 =r600_mip_minify (h0,0 ); d0 =r600_mip_minify (d0,0 ); -for (i =0 , offset =0 , level = blevel; i < nlevels; i++, level++) { +for (i =0 , offset =0 ; i < nlevels; i++) { width =r600_mip_minify (w0, i); nbx =r600_fmt_get_nblocksx (format, width);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/332 usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it.
--- drivers/usb/host/max3421-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/max3421-hcd.c +1 -1
@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)if (hcd) {kfree (max3421_hcd->tx);kfree (max3421_hcd->rx); -if (max3421_hcd->spi_thread) +if (!IS_ERR_OR_NULL (max3421_hcd->spi_thread))kthread_stop (max3421_hcd->spi_thread);usb_put_hcd (hcd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/332 serial: max310x: Add error checking in probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
Check if devm_i2c_new_dummy_device() fails.
--- drivers/tty/serial/max310x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/max310x.c +2 -0
@@ -1660,6 +1660,8 @@ static int max310x_i2c_probe(struct i2c_client *client) port_client =devm_i2c_new_dummy_device (&client->dev, client->adapter, port_addr); +if (IS_ERR (port_client)) +return PTR_ERR (port_client); regmaps[i] =devm_regmap_init_i2c (port_client, ®cfg_i2c); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/332 scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports:
UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]'
on rmmod when using an expander.
For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id.
I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander).
E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30.
The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander.
Thus, we can only clear phy_attached for devices that are directly attached.
--- drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_sas.c +8 -1
@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)unsigned long flags =0 ;struct pm8001_hba_info *pm8001_ha;struct pm8001_device *pm8001_dev = dev->lldd_dev; +struct domain_device *parent_dev = dev->parent; pm8001_ha =pm8001_find_ha_by_dev (dev);spin_lock_irqsave (&pm8001_ha->lock, flags);
@@ -892,7 +893,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)spin_lock_irqsave (&pm8001_ha->lock, flags); }PM8001_CHIP_DISP ->dereg_dev_req (pm8001_ha, device_id); - pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached =0 ; + +/* +* The phy array only contains local phys. Thus, we cannot clear +* phy_attached for a device behind an expander. +*/ +if (!(parent_dev &&dev_is_expander (parent_dev->dev_type))) + pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached =0 ;pm8001_free_dev (pm8001_dev); }else {pm8001_dbg (pm8001_ha,DISC ,"Found dev has gone.\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/332 scsi: myrs: Fix dma_alloc_coherent() error check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
Check for NULL return value with dma_alloc_coherent(), because DMA address is not always set by dma_alloc_coherent() on failure.
--- drivers/scsi/myrs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/myrs.c +4 -4
@@ -499,14 +499,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,/* Temporary dma mapping, used only in the scope of this function */ mbox =dma_alloc_coherent (&pdev->dev,sizeof (union myrs_cmd_mbox ), &mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, mbox_addr)) +if (!mbox)return false;/* These are the base addresses for the command memory mailbox array */ cs->cmd_mbox_size =MYRS_MAX_CMD_MBOX *sizeof (union myrs_cmd_mbox ); cmd_mbox =dma_alloc_coherent (&pdev->dev, cs->cmd_mbox_size, &cs->cmd_mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->cmd_mbox_addr)) { +if (!cmd_mbox) {dev_err (&pdev->dev,"Failed to map command mailbox\n" ); goto out_free; }
@@ -521,7 +521,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, cs->stat_mbox_size =MYRS_MAX_STAT_MBOX *sizeof (struct myrs_stat_mbox ); stat_mbox =dma_alloc_coherent (&pdev->dev, cs->stat_mbox_size, &cs->stat_mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->stat_mbox_addr)) { +if (!stat_mbox) {dev_err (&pdev->dev,"Failed to map status mailbox\n" ); goto out_free; }
@@ -534,7 +534,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, cs->fwstat_buf =dma_alloc_coherent (&pdev->dev,sizeof (struct myrs_fwstat ), &cs->fwstat_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->fwstat_addr)) { +if (!cs->fwstat_buf) {dev_err (&pdev->dev,"Failed to map firmware health buffer\n" ); cs->fwstat_buf =NULL ; goto out_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/332 media: rj54n1cb0c: Fix memleak in rj54n1_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
rj54n1_probe() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.
--- drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/media/i2c/rj54n1cb0c.c +6 -3
@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client, V4L2_CID_GAIN, 0, 127, 1, 66);v4l2_ctrl_new_std (&rj54n1->hdl, &rj54n1_ctrl_ops,V4L2_CID_AUTO_WHITE_BALANCE ,0 ,1 ,1 ,1 ); - rj54n1->subdev.ctrl_handler = &rj54n1->hdl; -if (rj54n1->hdl.error) -return rj54n1->hdl.error; +if (rj54n1->hdl.error) { + ret = rj54n1->hdl.error; + goto err_free_ctrl; + } + + rj54n1->subdev.ctrl_handler = &rj54n1->hdl; rj54n1->clk_div = clk_div; rj54n1->rect.left =RJ54N1_COLUMN_SKIP ; rj54n1->rect.top =RJ54N1_ROW_SKIP ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/332 ALSA: lx_core: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
Change the 'ret' variable from u16 to int to store negative error codes or zero returned by lx_message_send_atomic().
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
--- sound/pci/lx6464es/lx_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/lx6464es/lx_core.c +2 -2
@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)/* low-level dsp access */ int lx_dsp_get_version (struct lx6464es *chip,u32 *rdsp_version) { -u16 ret; +int ret;mutex_lock (&chip->msg_lock);
@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)int lx_dsp_get_clock_frequency (struct lx6464es *chip,u32 *rfreq) { -u16 ret =0 ;u32 freq_raw =0 ;u32 freq =0 ;u32 frequency =0 ; +int ret;mutex_lock (&chip->msg_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/332 drm/amdgpu: Power up UVD 3 for FW validation (v2)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
Unlike later versions, UVD 3 has firmware validation. For this to work, the UVD should be powered up correctly.
When DPM is enabled and the display clock is off, the SMU may choose a power state which doesn't power the UVD, which can result in failure to initialize UVD.
v2:
Add code comments to explain about the UVD power state and how UVD clock is turned on/off.
--- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +25 -4
@@ -621,7 +621,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,* * @adev: amdgpu_device pointer * -* Initialize the hardware, boot up the VCPU and do some testing +* Initialize the hardware, boot up the VCPU and do some testing. +* +* On SI, the UVD is meant to be used in a specific power state, +* or alternatively the driver can manually enable its clock. +* In amdgpu we use the dedicated UVD power state when DPM is enabled. +* Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state +* for the SMU and afterwards enables the UVD clock. +* This is automatically done by amdgpu_uvd_ring_begin_use when work +* is submitted to the UVD ring. Here, we have to call it manually +* in order to power up UVD before firmware validation. +* +* Note that we must not disable the UVD clock here, as that would +* cause the ring test to fail. However, UVD is powered off +* automatically after the ring test: amdgpu_uvd_ring_end_use calls +* the UVD idle work handler which will disable the UVD clock when +* all fences are signalled. */ static int uvd_v3_1_hw_init (void *handle) {
@@ -631,6 +646,15 @@ static int uvd_v3_1_hw_init(void *handle)int r;uvd_v3_1_mc_resume (adev); +uvd_v3_1_enable_mgcg (adev, true); + +/* Make sure UVD is powered during FW validation. +* It's going to be automatically powered off after the ring test. +*/ +if (adev->pm.dpm_enabled) +amdgpu_dpm_enable_uvd (adev, true); +else +amdgpu_asic_set_uvd_clocks (adev,53300 ,40000 ); r =uvd_v3_1_fw_validate (adev);if (r) {
@@ -638,9 +662,6 @@ static int uvd_v3_1_hw_init(void *handle)return r; } -uvd_v3_1_enable_mgcg (adev, true); -amdgpu_asic_set_uvd_clocks (adev,53300 ,40000 ); -uvd_v3_1_start (adev); r =amdgpu_ring_test_helper (ring);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/332 wifi: mwifiex: send world regulatory domain to driver
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kerkmann <[email protected]>
[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
The world regulatory domain is a restrictive subset of channel configurations which allows legal operation of the adapter all over the world. Changing to this domain should not be prevented.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +3 -4
@@ -663,10 +663,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,return ; } -/* Don't send world or same regdom info to firmware */ -if (strncmp (request->alpha2,"00" ,2 ) && -strncmp (request->alpha2, adapter->country_code, -sizeof (request->alpha2))) { +/* Don't send same regdom info to firmware */ +if (strncmp (request->alpha2, adapter->country_code, +sizeof (request->alpha2)) !=0 ) {memcpy (adapter->country_code, request->alpha2,sizeof (request->alpha2));mwifiex_send_domain_info_cmd_fw (wiphy);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/332 PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
Fix incorrect argument order in devm_kcalloc() when allocating port->phys. The original call used sizeof(phy) as the number of elements and port->lanes as the element size, which is reversed. While this happens to produce the correct total allocation size with current pointer size and lane counts, the argument order is wrong.
--- drivers/pci/controller/pci-tegra.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pci-tegra.c +1 -1
@@ -1365,7 +1365,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)unsigned int i;int err; - port->phys =devm_kcalloc (dev,sizeof (phy), port->lanes,GFP_KERNEL ); + port->phys =devm_kcalloc (dev, port->lanes,sizeof (phy),GFP_KERNEL );if (!port->phys)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/332 tcp: fix __tcp_close() to only send RST when required
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
If the receive queue contains payload that was already received, __tcp_close() can send an unexpected RST.
Refine the code to take tp->copied_seq into account, as we already do in tcp recvmsg().
--- net/ipv4/tcp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/tcp.c +5 -4
@@ -2536,8 +2536,8 @@ bool tcp_check_oom(struct sock *sk, int shift)void __tcp_close (struct sock *sk,long timeout) { +bool data_was_unread = false;struct sk_buff *skb; -int data_was_unread =0 ;int state;WRITE_ONCE (sk->sk_shutdown,SHUTDOWN_MASK );
@@ -2556,11 +2556,12 @@ void __tcp_close(struct sock *sk, long timeout)* reader process may not have drained the data yet! */ while ((skb =__skb_dequeue (&sk->sk_receive_queue)) !=NULL ) { -u32 len =TCP_SKB_CB (skb)->end_seq -TCP_SKB_CB (skb)->seq; +u32 end_seq =TCP_SKB_CB (skb)->end_seq;if (TCP_SKB_CB (skb)->tcp_flags &TCPHDR_FIN ) - len--; - data_was_unread += len; + end_seq--; +if (after (end_seq,tcp_sk (sk)->copied_seq)) + data_was_unread = true;__kfree_skb (skb); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/332 usb: phy: twl6030: Fix incorrect type for ret
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xichao Zhao <[email protected]>
[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
In the twl6030_usb_probe(), the variable ret is declared as a u32 type. However, since ret may receive -ENODEV when accepting the return value of omap_usb2_set_comparator().Therefore, its type should be changed to int.
--- drivers/usb/phy/phy-twl6030-usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/phy/phy-twl6030-usb.c +1 -2
@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)static int twl6030_usb_probe (struct platform_device *pdev) { -u32 ret;struct twl6030_usb *twl; -int status, err; +int status, err, ret;struct device_node *np = pdev->dev.of_node;struct device *dev = &pdev->dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/332 usb: gadget: configfs: Correctly set use_os_string at bind
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <[email protected]>
[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
Once the use_os_string flag is set to true for some functions (e.g. adb/mtp) which need to response the OS string, and then if we re-bind the ConfigFS gadget to use the other functions (e.g. hid) which should not to response the OS string, however, because the use_os_string flag is still true, so the usb gadget response the OS string descriptor incorrectly, this can cause the USB device to be unrecognizable on the Windows system.
An example of this as follows:
echo 1 > os_desc/use
ln -s functions/ffs.adb configs/b.1/function0
start adbd
echo "<udc device>" > UDC #succeed
stop adbd
rm configs/b.1/function0
echo 0 > os_desc/use
ln -s functions/hid.gs0 configs/b.1/function0 echo "<udc device>" > UDC #fail to connect on Windows
This patch sets the use_os_string flag to false at bind if the functions not support OS Descriptors.
--- drivers/usb/gadget/configfs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/configfs.c +2 -0
@@ -1358,6 +1358,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, cdev->use_os_string = true; cdev->b_vendor_code = gi->b_vendor_code;memcpy (cdev->qw_sign, gi->qw_sign,OS_STRING_QW_SIGN_LEN ); + }else { + cdev->use_os_string = false; }if (gadget_is_otg (gadget) && !otg_desc[0 ]) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/332 misc: genwqe: Fix incorrect cmd field being reported in error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
There is a dev_err message that is reporting the value of cmd->asiv_length when it should be reporting cmd->asv_length instead. Fix this.
--- drivers/misc/genwqe/card_ddcb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/genwqe/card_ddcb.c +1 -1
@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, }if (cmd->asv_length >DDCB_ASV_LENGTH ) {dev_err (&pci_dev->dev,"[%s] err: wrong asv_length of %d\n" , - __func__, cmd->asiv_length); + __func__, cmd->asv_length);return -EINVAL ; } rc =__genwqe_enqueue_ddcb (cd, req, f_flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/332 pps: fix warning in pps_register_cdev when register device fail
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen.
------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it.
Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.
--- drivers/pps/kapi.c | 5 +---- drivers/pps/pps.c | 5 ++--- 2 files changed, 3 insertions(+), 7 deletions(-)
drivers/pps/kapi.c +1 -4
@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,if (err <0 ) {pr_err ("%s: unable to create char device\n" , info->name); - goto kfree_pps; + goto pps_register_source_exit; }dev_dbg (&pps->dev,"new PPS source %s\n" , info->name);return pps; -kfree_pps: -kfree (pps); - pps_register_source_exit:pr_err ("%s: unable to register source\n" , info->name);
drivers/pps/pps.c +2 -3
@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) pps->info.name); err = -EBUSY ; } +kfree (pps); goto out_unlock; } pps->id = err;
@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) pps->dev.devt =MKDEV (pps_major, pps->id);dev_set_drvdata (&pps->dev, pps);dev_set_name (&pps->dev,"pps%d" , pps->id); + pps->dev.release = pps_device_destruct; err =device_register (&pps->dev);if (err) goto free_idr; -/* Override the release function with our own */ - pps->dev.release = pps_device_destruct; -pr_debug ("source %s got cdev (%d:%d)\n" , pps->info.name, pps_major, pps->id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/332 ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
When an invalid value is passed via quirk option, currently bytcht_es8316 driver just ignores and leaves as is, which may lead to unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
sound/soc/intel/boards/bytcht_es8316.c +17 -3
@@ -46,7 +46,8 @@ enum { BYT_CHT_ES8316_INTMIC_IN2_MAP, }; -#define BYT_CHT_ES8316_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) +#define BYT_CHT_ES8316_MAP (quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)#define BYT_CHT_ES8316_SSP0 BIT(16)#define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)#define BYT_CHT_ES8316_JD_INVERTED BIT(18)
@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");static void log_quirks (struct device *dev) { -if (BYT_CHT_ES8316_MAP (quirk) ==BYT_CHT_ES8316_INTMIC_IN1_MAP ) +int map; + + map =BYT_CHT_ES8316_MAP (quirk); +switch (map) { +case BYT_CHT_ES8316_INTMIC_IN1_MAP :dev_info (dev,"quirk IN1_MAP enabled" ); -if (BYT_CHT_ES8316_MAP (quirk) ==BYT_CHT_ES8316_INTMIC_IN2_MAP ) +break ; +case BYT_CHT_ES8316_INTMIC_IN2_MAP :dev_info (dev,"quirk IN2_MAP enabled" ); +break ; +default : +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n" , map); + quirk &= ~BYT_CHT_ES8316_MAP_MASK ; + quirk |=BYT_CHT_ES8316_INTMIC_IN1_MAP ; +break ; + } +if (quirk &BYT_CHT_ES8316_SSP0 )dev_info (dev,"quirk SSP0 enabled" );if (quirk &BYT_CHT_ES8316_MONO_SPEAKER )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/332 ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB access.
This patch corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/intel/boards/bytcr_rt5640.c +5 -2
@@ -59,7 +59,8 @@ enum { BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), }; -#define BYT_RT5640_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5640_MAP_MASK GENMASK(3, 0) +#define BYT_RT5640_MAP (quirk) ((quirk) & BYT_RT5640_MAP_MASK)#define BYT_RT5640_JDSRC (quirk) (((quirk) & GENMASK(7, 4)) >> 4)#define BYT_RT5640_OVCD_TH (quirk) (((quirk) & GENMASK(12, 8)) >> 8)#define BYT_RT5640_OVCD_SF (quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -119,7 +120,9 @@ static void log_quirks(struct device *dev)dev_info (dev,"quirk IN3_MAP enabled\n" );break ;default : -dev_err (dev,"quirk map 0x%x is not supported, microphone input will not work\n" , map); +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n" , map); + byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK ; + byt_rt5640_quirk |=BYT_RT5640_DMIC1_MAP ;break ; }if (BYT_RT5640_JDSRC (byt_rt5640_quirk)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/332 ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
sound/soc/intel/boards/bytcr_rt5651.c +21 -5
@@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP (quirk) ((quirk) & BYT_RT5651_MAP_MASK)#define BYT_RT5651_JDSRC (quirk) (((quirk) & GENMASK(7, 4)) >> 4)#define BYT_RT5651_OVCD_TH (quirk) (((quirk) & GENMASK(12, 8)) >> 8)#define BYT_RT5651_OVCD_SF (quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");static void log_quirks (struct device *dev) { -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_DMIC_MAP ) +int map; + + map =BYT_RT5651_MAP (byt_rt5651_quirk); +switch (map) { +case BYT_RT5651_DMIC_MAP :dev_info (dev,"quirk DMIC_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN1_MAP ) +break ; +case BYT_RT5651_IN1_MAP :dev_info (dev,"quirk IN1_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN2_MAP ) +break ; +case BYT_RT5651_IN2_MAP :dev_info (dev,"quirk IN2_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN1_IN2_MAP ) +break ; +case BYT_RT5651_IN1_IN2_MAP :dev_info (dev,"quirk IN1_IN2_MAP enabled" ); +break ; +default : +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to DMIC_MAP\n" , map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK ; + byt_rt5651_quirk |=BYT_RT5651_DMIC_MAP ; +break ; + } +if (BYT_RT5651_JDSRC (byt_rt5651_quirk)) {dev_info (dev,"quirk realtek,jack-detect-source %ld\n" ,BYT_RT5651_JDSRC (byt_rt5651_quirk));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/332 iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
Fix iio_convert_raw_to_processed() offset handling for channels without a scale attribute.
The offset has been applied to the raw64 value not to the original raw value. Use the raw64 value so that the offset is taken into account.
--- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/inkern.c +1 -1
@@ -600,7 +600,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,* If no channel scaling is available apply consumer scale to * raw value and return. */ - *processed = raw * scale; + *processed = raw64 * scale;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/332 netfilter: ipset: Remove unused htable_bits in macro ahash_region
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
Since the ahash_region() macro was redefined to calculate the region index solely from HTABLE_REGION_BITS, the htable_bits parameter became unused.
Remove the unused htable_bits argument and its call sites, simplifying the code without changing semantics.
--- net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/ipset/ip_set_hash_gen.h +4 -4
@@ -87,7 +87,7 @@ struct hbucket { : jhash_size((htable_bits) - HTABLE_REGION_BITS))#define ahash_sizeof_regions (htable_bits) \ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) -#define ahash_region (n, htable_bits) \ +#define ahash_region (n) \ ((n) / jhash_size(HTABLE_REGION_BITS))#define ahash_bucket_start (h, htable_bits) \ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
@@ -716,7 +716,7 @@ mtype_resize(struct ip_set *set, bool retried)#endif key =HKEY (data, h->initval, htable_bits); m =__ipset_dereference (hbucket (t, key)); - nr =ahash_region (key, htable_bits); + nr =ahash_region (key);if (!m) { m = kzalloc(sizeof(*m) + AHASH_INIT_SIZE * dsize,
@@ -866,7 +866,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,rcu_read_lock_bh (); t =rcu_dereference_bh (h->table); key =HKEY (value, h->initval, t->htable_bits); - r =ahash_region (key, t->htable_bits); + r =ahash_region (key);atomic_inc (&t->uref); elements = t->hregion[r].elements; maxelem = t->maxelem;
@@ -1059,7 +1059,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,rcu_read_lock_bh (); t =rcu_dereference_bh (h->table); key =HKEY (value, h->initval, t->htable_bits); - r =ahash_region (key, t->htable_bits); + r =ahash_region (key);atomic_inc (&t->uref);rcu_read_unlock_bh ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/332 watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
When the watchdog gets enabled with this driver, it leaves enough time for the core watchdog subsystem to start pinging it. But when the watchdog is already started by hardware or by the boot loader, little time remains before it fires and it happens that the core watchdog subsystem doesn't have time to start pinging it.
Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") pinging was managed by the driver itself and the watchdog was immediately pinged by setting the timer expiry to 0.
So restore similar behaviour by pinging it when enabling it so that if it was already enabled the watchdog timer counter is reloaded.
--- drivers/watchdog/mpc8xxx_wdt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/watchdog/mpc8xxx_wdt.c +2 -0
@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) ddata->swtc = tmp >>16 ;set_bit (WDOG_HW_RUNNING , &ddata->wdd.status); +mpc8xxx_wdt_keepalive (ddata); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/332 drivers/base/node: handle error properly in register_one_node()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
If register_node() returns an error, it is not handled correctly. The function will proceed further and try to register CPUs under the node, which is not correct.
So, in this patch, if register_node() returns an error, we return immediately from the function.
--- drivers/base/node.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/base/node.c +5 -0
@@ -961,6 +961,11 @@ int __register_one_node(int nid)return -ENOMEM ; error =register_node (node_devices[nid], nid); +if (error) { + node_devices[nid] =NULL ; +kfree (node); +return error; + }/* link cpu under this node */ for_each_present_cpu (cpu) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/332 RDMA/cm: Rate limit destroy CM ID timeout error message
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Håkon Bugge <[email protected]>
[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
When the destroy CM ID timeout kicks in, you typically get a storm of them which creates a log flooding. Hence, change pr_err() to pr_err_ratelimited() in cm_destroy_id_wait_timeout().
--- drivers/infiniband/core/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/core/cm.c +2 -2
@@ -1063,8 +1063,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,struct cm_id_private *cm_id_priv; cm_id_priv = container_of(cm_id, struct cm_id_private, id); -pr_err ("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n" , __func__, - cm_id, old_state, cm_id->state,refcount_read (&cm_id_priv->refcount)); +pr_err_ratelimited ("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n" , __func__, + cm_id, old_state, cm_id->state,refcount_read (&cm_id_priv->refcount)); }static void cm_destroy_id (struct ib_cm_id *cm_id,int err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/332 wifi: mt76: fix potential memory leak in mt76_wmac_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory is allocated for both struct ieee80211_hw and a workqueue. However, on the error path, the workqueue is not freed. Fix that by calling mt76_free_device() on the error path.
--- drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7603/soc.c +1 -1
@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)return 0 ; error: -ieee80211_free_hw (mt76_hw (dev)); +mt76_free_device (mdev);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/332 ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
There appears to be a cut-n-paste error with the incorrect field ndr_desc->numa_node being reported for the target node. Fix this by using ndr_desc->target_node instead.
--- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/nfit/core.c +1 -1
@@ -3032,7 +3032,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,if (ndr_desc->target_node ==NUMA_NO_NODE ) { ndr_desc->target_node =phys_to_target_node (spa->address);dev_info (acpi_desc->dev,"changing target node from %d to %d for nfit region [%pa-%pa]" , -NUMA_NO_NODE , ndr_desc->numa_node, &res.start, &res.end); +NUMA_NO_NODE , ndr_desc->target_node, &res.start, &res.end); }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/332 RDMA/core: Resolve MAC of next-hop device without ARP support
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <[email protected]>
[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
Currently, if the next-hop netdevice does not support ARP resolution, the destination MAC address is silently set to zero without reporting an error. This leads to incorrect behavior and may result in packet transmission failures.
Fix this by deferring MAC resolution to the IP stack via neighbour lookup, allowing proper resolution or error reporting as appropriate.
--- drivers/infiniband/core/addr.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/infiniband/core/addr.c +3 -7
@@ -461,14 +461,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, {int ret =0 ; -if (ndev_flags &IFF_LOOPBACK ) { +if (ndev_flags &IFF_LOOPBACK )memcpy (addr->dst_dev_addr, addr->src_dev_addr,MAX_ADDR_LEN ); - }else { -if (!(ndev_flags &IFF_NOARP )) { -/* If the device doesn't do ARP internally */ - ret =fetch_ha (dst, addr, dst_in, seq); - } - } +else + ret =fetch_ha (dst, addr, dst_in, seq);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/332 IB/sa: Fix sa_local_svc_timeout_ms read race
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Dumitrescu <[email protected]>
[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
When computing the delta, the sa_local_svc_timeout_ms is read without ib_nl_request_lock held. Though unlikely in practice, this can cause a race condition if multiple local service threads are managing the timeout.
--- drivers/infiniband/core/sa_query.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/core/sa_query.c +4 -2
@@ -1036,6 +1036,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,if (timeout >IB_SA_LOCAL_SVC_TIMEOUT_MAX ) timeout =IB_SA_LOCAL_SVC_TIMEOUT_MAX ; +spin_lock_irqsave (&ib_nl_request_lock, flags); + delta = timeout - sa_local_svc_timeout_ms;if (delta <0 ) abs_delta = -delta;
@@ -1043,7 +1045,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, abs_delta = delta;if (delta !=0 ) { -spin_lock_irqsave (&ib_nl_request_lock, flags); sa_local_svc_timeout_ms = timeout;list_for_each_entry (query, &ib_nl_request_list, list) {if (delta <0 && abs_delta > query->timeout)
@@ -1061,9 +1062,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,if (delay)mod_delayed_work (ib_nl_wq, &ib_nl_timed_work, (unsigned long )delay); -spin_unlock_irqrestore (&ib_nl_request_lock, flags); } +spin_unlock_irqrestore (&ib_nl_request_lock, flags); + settimeout_out:return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/332 Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
Section heading for sched_waking histogram is shown as normal paragraph instead due to codeblock marker for the following diagram being in the same line as the section underline. Separate them.
Message-ID: <[email protected]>
--- Documentation/trace/histogram-design.rst | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Documentation/trace/histogram-design.rst +3 -1
@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking trigger above. sched_waking histogram -----------------------:: +---------------------- + +.. code-block:: +------------------+ | hist_data |<-------------------------------------------------------+
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/332 wifi: ath10k: avoid unnecessary wait for service ready message
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") works around the failure in waiting for the service ready message by active polling. Note the polling is triggered after initial wait timeout, which means that the wait-till-timeout can not be avoided even the message is ready.
A possible fix is to do polling once before wait as well, however this can not handle the race that the message arrives right after polling. So the solution is to do periodic polling until timeout.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- 1 file changed, 19 insertions(+), 20 deletions(-)
drivers/net/wireless/ath/ath10k/wmi.c +19 -20
@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,int ath10k_wmi_wait_for_service_ready (struct ath10k *ar) { +unsigned long timeout = jiffies +WMI_SERVICE_READY_TIMEOUT_HZ ;unsigned long time_left, i; - time_left =wait_for_completion_timeout (&ar->wmi.service_ready, -WMI_SERVICE_READY_TIMEOUT_HZ ); -if (!time_left) { -/* Sometimes the PCI HIF doesn't receive interrupt -* for the service ready message even if the buffer -* was completed. PCIe sniffer shows that it's -* because the corresponding CE ring doesn't fires -* it. Workaround here by polling CE rings once. -*/ -ath10k_warn (ar,"failed to receive service ready completion, polling..\n" ); - +/* Sometimes the PCI HIF doesn't receive interrupt +* for the service ready message even if the buffer +* was completed. PCIe sniffer shows that it's +* because the corresponding CE ring doesn't fires +* it. Workaround here by polling CE rings. Since +* the message could arrive at any time, continue +* polling until timeout. +*/ +do {for (i =0 ; i <CE_COUNT ; i++)ath10k_hif_send_complete_check (ar, i,1 ); +/* The 100 ms granularity is a tradeoff considering scheduler +* overhead and response latency +*/ time_left =wait_for_completion_timeout (&ar->wmi.service_ready, -WMI_SERVICE_READY_TIMEOUT_HZ ); -if (!time_left) { -ath10k_warn (ar,"polling timed out\n" ); -return -ETIMEDOUT ; - } - -ath10k_warn (ar,"service ready completion received, continuing normally\n" ); - } +msecs_to_jiffies (100 )); +if (time_left) +return 0 ; + }while (time_before (jiffies, timeout)); -return 0 ; +ath10k_warn (ar,"failed to receive service ready completion\n" ); +return -ETIMEDOUT ; }int ath10k_wmi_wait_for_unified_ready (struct ath10k *ar)
Signature · 1 line
2.51.0
Re: [PATCH 5.10 067/332] wifi: ath10k: avoid unnecessary wait for service ready message
Quoted 1 line · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
Same comments as 5.4
Please do not propagate this. This had adverse effects on some platforms and a revert is already in the pipeline:
The revert should hopefully land in v6.18-rc4.
/jeff
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 067/332] wifi: ath10k: avoid unnecessary wait for service ready message
Quoted 10 lines · Jeff Johnson
Quoted 1 line · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
Same comments as 5.4
Please do not propagate this. This had adverse effects on some platforms and a revert is already in the pipeline:The revert should hopefully land in v6.18-rc4.
Thanks, will go drop this from 5.4.y and 5.10.y
greg k-h
Greg Kroah-Hartman
maintainerPATCH 68/332 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/sparc/lib/U1memcpy.S +10 -9
@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) retl add %o0, %o2, %o0 ENDPROC(U1_gs_40_fp) -ENTRY(U1_g3_0_fp) - VISExitHalf - retl - add %g3, %o2, %o0 -ENDPROC(U1_g3_0_fp) ENTRY(U1_g3_8_fp) VISExitHalf add %g3, 8, %g3 retl add %g3, %o2, %o0 ENDPROC(U1_g3_8_fp) +ENTRY(U1_g3_16_fp) + VISExitHalf + add %g3, 16, %g3 + retl + add %g3, %o2, %o0 +ENDPROC(U1_g3_16_fp) ENTRY(U1_o2_0_fp) VISExitHalf retl
@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ 62: FINISH_VISCHUNK(o0, f44, f46) 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) -93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) +93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f0, %f2, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bl,pn %xcc, 95f add %o0, 8, %o0 - EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) + EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f2, %f0, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bge,pt %xcc, 93b add %o0, 8, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/332 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy.
The BUG_ON has been reported in
https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/U3memcpy.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/lib/U3memcpy.S +1 -1
@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ faligndata %f10, %f12, %f26 EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + and %o2, 0x3f, %o2 subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE add %o1, 0x40, %o1 bgu,pt %XCC, 1f
@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ * Also notice how this code is careful not to perform a * load past the end of the src buffer. */ - and %o2, 0x3f, %o2 andcc %o2, 0x38, %g2 be,pn %XCC, 2f subcc %g2, 0x8, %g2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/332 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations and a broken epilogue in the exception handlers. This will prevent crashes and ensure correct return values of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
arch/sparc/lib/NGmemcpy.S +18 -11
@@ -80,8 +80,8 @@ #ifndef EX_RETVAL #define EX_RETVAL(x) x __restore_asi: - ret wr %g0, ASI_AIUS, %asi + ret restore ENTRY(NG_ret_i2_plus_i4_plus_1) ba,pt %xcc, __restore_asi
@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) ba,pt %xcc, __restore_asi add %i2, %g1, %i0 ENDPROC(NG_ret_i2_plus_g1_minus_56) -ENTRY(NG_ret_i2_plus_i4) +ENTRY(NG_ret_i2_plus_i4_plus_16) + add %i4, 16, %i4 ba,pt %xcc, __restore_asi add %i2, %i4, %i0 -ENDPROC(NG_ret_i2_plus_i4) -ENTRY(NG_ret_i2_plus_i4_minus_8) - sub %i4, 8, %i4 +ENDPROC(NG_ret_i2_plus_i4_plus_16) +ENTRY(NG_ret_i2_plus_i4_plus_8) + add %i4, 8, %i4 ba,pt %xcc, __restore_asi add %i2, %i4, %i0 -ENDPROC(NG_ret_i2_plus_i4_minus_8) +ENDPROC(NG_ret_i2_plus_i4_plus_8) ENTRY(NG_ret_i2_plus_8) ba,pt %xcc, __restore_asi add %i2, 8, %i0
@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) ba,pt %xcc, __restore_asi add %i2, %i4, %i0 ENDPROC(NG_ret_i2_and_7_plus_i4) +ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) + and %i2, 7, %i2 + add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +ENDPROC(NG_ret_i2_and_7_plus_i4) #endif .align 64
@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ andn %i2, 0xf, %i4 and %i2, 0xf, %i2 1: subcc %i4, 0x10, %i4 - EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) + EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) add %i1, 0x08, %i1 - EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) + EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) sub %i1, 0x08, %i1 - EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) + EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) add %i1, 0x8, %i1 - EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) + EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) bgu,pt %XCC, 1b add %i1, 0x8, %i1 73: andcc %i2, 0x8, %g0
@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ subcc %i4, 0x8, %i4 srlx %g3, %i3, %i5 or %i5, %g2, %i5 - EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) + EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) add %o0, 0x8, %o0 bgu,pt %icc, 1b sllx %g3, %g1, %g2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/332 sparc: fix accurate exception reporting in copy_to_user for Niagara 4
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a bad calculation. This will fix the return value of copy_to_user in a specific faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/NG4memcpy.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/lib/NG4memcpy.S +1 -1
@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ subcc %o5, 0x20, %o5 EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) - EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) + EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) bne,pt %icc, 1b add %o0, 0x20, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/332 sparc: fix accurate exception reporting in copy_{from,to}_user for M7
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ 2 files changed, 19 insertions(+), 10 deletions(-)
arch/sparc/lib/M7memcpy.S +10 -10
@@ -696,16 +696,16 @@ FUNC_NAME: EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) faligndata %f24, %f26, %f10 EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) - EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) + EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) faligndata %f26, %f28, %f12 - EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) add %o4, 64, %o4 - EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) + EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) faligndata %f28, %f30, %f14 - EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) - EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) + EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) add %o0, 64, %o0 - EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) fsrc2 %f30, %f14 bgu,pt %xcc, .Lunalign_sloop prefetch [%o4 + (8 * BLOCK_SIZE)], 20
@@ -728,7 +728,7 @@ FUNC_NAME: add %o4, 8, %o4 faligndata %f0, %f2, %f16 subcc %o5, 8, %o5 - EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) + EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) fsrc2 %f2, %f0 bgu,pt %xcc, .Lunalign_by8 add %o0, 8, %o0
@@ -772,7 +772,7 @@ FUNC_NAME: subcc %o5, 0x20, %o5 EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) - EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) + EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) bne,pt %xcc, 1b add %o0, 0x20, %o0
@@ -804,12 +804,12 @@ FUNC_NAME: brz,pt %o3, 2f sub %o2, %o3, %o2 -1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) +1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) add %o1, 1, %o1 subcc %o3, 1, %o3 add %o0, 1, %o0 bne,pt %xcc, 1b - EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) + EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) 2: and %o1, 0x7, %o3 brz,pn %o3, .Lmedium_noprefetch_cp
arch/sparc/lib/Memcpy_utils.S +9 -0
@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) ba,pt %xcc, __restore_asi add %o2, 8, %o0 ENDPROC(memcpy_retl_o2_plus_63_8) +ENTRY(memcpy_retl_o2_plus_o3) + ba,pt %xcc, __restore_asi + add %o2, %o3, %o0 +ENDPROC(memcpy_retl_o2_plus_o3) +ENTRY(memcpy_retl_o2_plus_o3_plus_1) + add %o3, 1, %o3 + ba,pt %xcc, __restore_asi + add %o2, %o3, %o0 +ENDPROC(memcpy_retl_o2_plus_o3_plus_1) ENTRY(memcpy_retl_o2_plus_o5) ba,pt %xcc, __restore_asi add %o2, %o5, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/332 remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
enable_irq() and disable_irq() are reference counted, so we must make sure that each enable_irq() is always paired with a single disable_irq(). If we call disable_irq() twice followed by just a single enable_irq(), the IRQ will remain disabled forever.
For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() will end up being called twice, because disable_irq() also happens in qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more sense to have the rollback handled always by qcom_q6v5_unprepare().
--- drivers/remoteproc/qcom_q6v5.c | 3 --- 1 file changed, 3 deletions(-)
drivers/remoteproc/qcom_q6v5.c +0 -3
@@ -115,9 +115,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)int ret; ret =wait_for_completion_timeout (&q6v5->start_done, timeout); -if (!ret) -disable_irq (q6v5->handover_irq); -return !ret ? -ETIMEDOUT :0 ; }EXPORT_SYMBOL_GPL (qcom_q6v5_wait_for_start);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/332 NFSv4.1: fix backchannel max_resp_sz verification check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
When the client max_resp_sz is larger than what the server encodes in its reply, the nfs4_verify_back_channel_attrs() check fails and this causes nfs4_proc_create_session() to fail, in cases where the client page size is larger than that of the server and the server does not want to negotiate upwards.
While this is not a problem with the linux nfs server that will reflect the proposed value in its reply irrespective of the local page size, other nfs server implementations may insist on their own max_resp_sz value, which could be smaller.
Fix this by accepting smaller max_resp_sz values from the server, as this does not violate the protocol. The server is allowed to decrease but not increase proposed the size, and as such values smaller than the client-proposed ones are valid.
--- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4proc.c +1 -1
@@ -8971,7 +8971,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args goto out;if (rcvd->max_rqst_sz > sent->max_rqst_sz)return -EINVAL ; -if (rcvd->max_resp_sz < sent->max_resp_sz) +if (rcvd->max_resp_sz > sent->max_resp_sz)return -EINVAL ;if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/332 ipvs: Defer ip_vs_ftp unregister during netns cleanup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slavin Liu <[email protected]>
[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free.
Fix this by introducing a global exiting_module flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.
--- net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/ipvs/ip_vs_ftp.c +3 -1
@@ -53,6 +53,7 @@ enum { IP_VS_FTP_EPSV, }; +static bool exiting_module;/* * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper * First port is set to the default port.
@@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net) {struct netns_ipvs *ipvs =net_ipvs (net); -if (!ipvs) +if (!ipvs || !exiting_module)return ;unregister_ip_vs_app (ipvs, &ip_vs_ftp);
@@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void)*/ static void __exit ip_vs_ftp_exit(void) { + exiting_module = true;unregister_pernet_subsys (&ip_vs_ftp_ops);/* rcu_barrier() is called by netns */ }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/332 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device.
Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal.
[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] <TASK> [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_transport.c +3 -5
@@ -811,11 +811,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,list_for_each_entry_safe (mpt3sas_phy, next_phy, &mpt3sas_port->phy_list, port_siblings) {if ((ioc->logging_level &MPT_DEBUG_TRANSPORT )) -dev_printk (KERN_INFO , &mpt3sas_port->port->dev, -"remove: sas_addr(0x%016llx), phy(%d)\n" , - (unsigned long long ) - mpt3sas_port->remote_identify.sas_address, - mpt3sas_phy->phy_id); +ioc_info (ioc,"remove: sas_addr(0x%016llx), phy(%d)\n" , + (unsigned long long ) mpt3sas_port->remote_identify.sas_address, + mpt3sas_phy->phy_id); mpt3sas_phy->phy_belongs_to_port =0 ;if (!ioc->remove_host) sas_port_delete_phy(mpt3sas_port->port,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/332 usb: vhci-hcd: Prevent suspending virtually attached devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
The VHCI platform driver aims to forbid entering system suspend when at least one of the virtual USB ports are bound to an active USB/IP connection.
However, in some cases, the detection logic doesn't work reliably, i.e. when all devices attached to the virtual root hub have been already suspended, leading to a broken suspend state, with unrecoverable resume.
Ensure the virtually attached devices do not enter suspend by setting the syscore PM flag. Note this is currently limited to the client side only, since the server side doesn't implement system suspend prevention.
--- drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/usb/usbip/vhci_hcd.c +22 -0
@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag ctrlreq->wValue, vdev->rhport); vdev->udev =usb_get_dev (urb->dev); +/* +* NOTE: A similar operation has been done via +* USB_REQ_GET_DESCRIPTOR handler below, which is +* supposed to always precede USB_REQ_SET_ADDRESS. +* +* It's not entirely clear if operating on a different +* usb_device instance here is a real possibility, +* otherwise this call and vdev->udev assignment above +* should be dropped. +*/ +dev_pm_syscore_device (&vdev->udev->dev, true);usb_put_dev (old);spin_lock (&vdev->ud.lock);
@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); vdev->udev =usb_get_dev (urb->dev); +/* +* Set syscore PM flag for the virtually attached +* devices to ensure they will not enter suspend on +* the client side. +* +* Note this doesn't have any impact on the physical +* devices attached to the host system on the server +* side, hence there is no need to undo the operation +* on disconnect. +*/ +dev_pm_syscore_device (&vdev->udev->dev, true);usb_put_dev (old); goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/332 RDMA/siw: Always report immediate post SQ errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernard Metzler <[email protected]>
[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
In siw_post_send(), any immediate error encountered during processing of the work request list must be reported to the caller, even if previous work requests in that list were just accepted and added to the send queue.
Not reporting those errors confuses the caller, which would wait indefinitely for the failing and potentially subsequently aborted work requests completion.
This fixes a case where immediate errors were overwritten by subsequent code in siw_post_send().
--- drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/infiniband/sw/siw/siw_verbs.c +14 -11
@@ -757,7 +757,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,struct siw_wqe *wqe =tx_wqe (qp);unsigned long flags; -int rv =0 ; +int rv =0 , imm_err =0 ;if (wr && !rdma_is_kernel_res (&qp->base_qp.res)) {siw_dbg_qp (qp,"wr must be empty for user mapped sq\n" );
@@ -943,9 +943,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,* Send directly if SQ processing is not in progress. * Eventual immediate errors (rv < 0) do not affect the involved * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ -* processing, if new work is already pending. But rv must be passed -* to caller. +* processing, if new work is already pending. But rv and pointer +* to failed work request must be passed to caller. */ +if (unlikely (rv <0 )) { +/* +* Immediate error +*/ +siw_dbg_qp (qp,"Immediate error %d\n" , rv); + imm_err = rv; + *bad_wr = wr; + }if (wqe->wr_status !=SIW_WR_IDLE ) {spin_unlock_irqrestore (&qp->sq_lock, flags); goto skip_direct_sending;
@@ -970,15 +978,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,up_read (&qp->state_lock); -if (rv >=0 ) -return 0 ; -/* -* Immediate error -*/ -siw_dbg_qp (qp,"error %d\n" , rv); +if (unlikely (imm_err)) +return imm_err; - *bad_wr = wr; -return rv; +return (rv >=0 ) ?0 : rv; }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/332 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: I Viswanath <[email protected]>
[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning:
rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb);
}rtl8150_set_multicast() {
netif_stop_queue();
netif_wake_queue(); <-- wakes up TX queue before URB is done
}rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb); <-- double submission
}rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization.
The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.
--- drivers/net/usb/rtl8150.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/usb/rtl8150.c +0 -2
@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)rtl8150_t *dev =netdev_priv (netdev);u16 rx_creg =0x9e ; -netif_stop_queue (netdev);if (netdev->flags &IFF_PROMISC ) { rx_creg |=0x0001 ;dev_info (&netdev->dev,"%s: promiscuous mode\n" , netdev->name);
@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rx_creg &=0x00fc ; }async_set_registers (dev,RCR ,sizeof (rx_creg), rx_creg); -netif_wake_queue (netdev); } static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/332 Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO was not called with a specific index which breaks the likes of bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an adapter is plugged, so instead of depending hdev not to be set just enable the UUID on any index like it was done with iso_sock_uuid.
--- net/bluetooth/mgmt.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
net/bluetooth/mgmt.c +4 -6
@@ -3801,13 +3801,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,memset (&buf,0 ,sizeof (buf));#ifdef CONFIG_BT_FEATURE_DEBUG -if (!hdev) { - flags =bt_dbg_get () ?BIT (0 ) :0 ; + flags =bt_dbg_get () ?BIT (0 ) :0 ; -memcpy (rp->features[idx].uuid, debug_uuid,16 ); - rp->features[idx].flags =cpu_to_le32 (flags); - idx++; - } +memcpy (rp->features[idx].uuid, debug_uuid,16 ); + rp->features[idx].flags =cpu_to_le32 (flags); + idx++;#endif if (hdev) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/332 hwrng: ks-sa - fix division by zero in ks_sa_rng_init
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
Fix division by zero in ks_sa_rng_init caused by missing clock pointer initialization. The clk_get_rate() call is performed on an uninitialized clk pointer, resulting in division by zero when calculating delay values.
Add clock initialization code before using the clock.
drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ 1 file changed, 7 insertions(+)
--- drivers/char/hw_random/ks-sa-rng.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/char/hw_random/ks-sa-rng.c +4 -0
@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)return -EINVAL ; } + ks_sa_rng->clk =devm_clk_get_enabled (dev,NULL ); +if (IS_ERR (ks_sa_rng->clk)) +return dev_err_probe (dev,PTR_ERR (ks_sa_rng->clk),"Failed to get clock\n" ); +pm_runtime_enable (dev); ret =pm_runtime_get_sync (dev);if (ret <0 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/332 ocfs2: fix double free in user_cluster_connect()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.
--- fs/ocfs2/stack_user.c | 1 + 1 file changed, 1 insertion(+)
fs/ocfs2/stack_user.c +1 -0
@@ -1032,6 +1032,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)printk (KERN_ERR "ocfs2: Could not determine" " locking version\n" );user_cluster_disconnect (conn); + lc =NULL ; goto out; }wait_event (lc->oc_wait, (atomic_read (&lc->oc_this_node) >0 ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/332 drivers/base/node: fix double free in register_one_node()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
When device_register() fails in register_node(), it calls put_device(&node->dev). This triggers node_device_release(), which calls kfree(to_node(dev)), thereby freeing the entire node structure.
As a result, when register_node() returns an error, the node memory has already been freed. Calling kfree(node) again in register_one_node() leads to a double free.
This patch removes the redundant kfree(node) from register_one_node() to prevent the double free.
--- drivers/base/node.c | 1 - 1 file changed, 1 deletion(-)
drivers/base/node.c +0 -1
@@ -963,7 +963,6 @@ int __register_one_node(int nid) error =register_node (node_devices[nid], nid);if (error) { node_devices[nid] =NULL ; -kfree (node);return error; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/332 nfp: fix RSS hash key size when RSS is not supported
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when devices don't support RSS, and callers treat the negative value as a large positive value since the return type is u32.
Return 0 when devices don't support RSS, aligning with the ethtool interface .get_rxfh_key_size() that requires returning 0 in such cases.
--- drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +1 -1
@@ -1012,7 +1012,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)struct nfp_net *nn =netdev_priv (netdev);if (!(nn->cap &NFP_NET_CFG_CTRL_RSS_ANY )) -return -EOPNOTSUPP ; +return 0 ;return nfp_net_rss_key_sz (nn); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/332 net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
In EC2 instances where the RSS hash key is not configurable, ethtool shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally returns ENA_HASH_KEY_SIZE.
Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") added proper handling for devices that don't support RSS hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
When the RSS hash key is not configurable, return 0 instead of ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
Tested on m5 instance families.
Without patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
With patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: Operation not supported
--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +4 -1
@@ -681,7 +681,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)static u32 ena_get_rxfh_key_size (struct net_device *netdev) { -return ENA_HASH_KEY_SIZE ; +struct ena_adapter *adapter =netdev_priv (netdev); +struct ena_rss *rss = &adapter->ena_dev->rss; + +return rss->hash_key ?ENA_HASH_KEY_SIZE :0 ; } static int ena_indirection_table_set(struct ena_adapter *adapter,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/332 net: dlink: handle copy_thresh allocation failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <[email protected]>
[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
The driver did not handle failure of netdev_alloc_skb_ip_align(). If the allocation failed, dereferencing skb->protocol could lead to a NULL pointer dereference.
This patch tries to allocate skb. If the allocation fails, it falls back to the normal path.
Tested-on: D-Link DGE-550T Rev-A3
--- drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/dlink/dl2k.c +5 -2
@@ -957,15 +957,18 @@ receive_packet (struct net_device *dev) }else {struct sk_buff *skb; + skb =NULL ;/* Small skbuffs for short packets */ -if (pkt_len > copy_thresh) { +if (pkt_len <= copy_thresh) + skb =netdev_alloc_skb_ip_align (dev, pkt_len); +if (!skb) {dma_unmap_single (&np->pdev->dev,desc_to_dma (desc), np->rx_buf_sz,DMA_FROM_DEVICE );skb_put (skb = np->rx_skbuff[entry], pkt_len); np->rx_skbuff[entry] =NULL ; - }else if ((skb =netdev_alloc_skb_ip_align (dev, pkt_len))) { + }else { dma_sync_single_for_cpu(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/332 Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
Commit in question breaks the mapping of PGs to pools for some SKUs. Specifically multi-host NICs seem to be shipped with a custom buffer configuration which maps the lossy PG to pool 4. But the bad commit overrides this with pool 0 which does not have sufficient buffer space reserved. Resulting in ~40% packet loss. The commit also breaks BMC / OOB connection completely (100% packet loss).
Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set""). The breakage is exactly the same, the only difference is that quoted commit would break the NIC immediately on boot, and the currently reverted commit only when MTU is changed.
Note: "good" kernels do not restore the configuration, so downgrade isn't enough to recover machines. A NIC power cycle seems to be necessary to return to a healthy state (or overriding the relevant registers using a custom patch).
--- drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 ---------- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 17 --------------- 2 files changed, 1 insertion(+), 28 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +0 -12
@@ -63,23 +63,11 @@ struct mlx5e_port_buffer {struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER ]; }; -#ifdef CONFIG_MLX5_CORE_EN_DCB int mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv,u32 change,unsigned int mtu,struct ieee_pfc *pfc,u32 *buffer_size,u8 *prio2buffer); -#else -static inline int -mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv, -u32 change,unsigned int mtu, -void *pfc, -u32 *buffer_size, -u8 *prio2buffer) -{ -return 0 ; -} -#endif int mlx5e_port_query_buffer (struct mlx5e_priv *priv,struct mlx5e_port_buffer *port_buffer);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -16
@@ -42,7 +42,6 @@#include "eswitch.h" #include "en.h" #include "en/txrx.h" -#include "en/port_buffer.h" #include "en_tc.h" #include "en_rep.h" #include "en_accel/ipsec.h"
@@ -2875,11 +2874,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_struct mlx5e_params *params = &priv->channels.params;struct net_device *netdev = priv->netdev;struct mlx5_core_dev *mdev = priv->mdev; -u16 mtu, prev_mtu; +u16 mtu;int err; -mlx5e_query_mtu (mdev, params, &prev_mtu); - err =mlx5e_set_mtu (mdev, params, params->sw_mtu);if (err)return err;
@@ -2889,18 +2886,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_netdev_warn (netdev,"%s: VPort MTU %d is different than netdev mtu %d\n" , __func__, mtu, params->sw_mtu); -if (mtu != prev_mtu &&MLX5_BUFFER_SUPPORTED (mdev)) { - err =mlx5e_port_manual_buffer_config (priv,0 , mtu, -NULL ,NULL ,NULL ); -if (err) { -netdev_warn (netdev,"%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n" , - __func__, mtu, err, prev_mtu); - -mlx5e_set_mtu (mdev, params, prev_mtu); -return err; - } - } - params->sw_mtu = mtu;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 88/332 Squashfs: fix uninit-value in squashfs_get_parent
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.
Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.
This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory.
Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field.
unsigned int parent_ino = squashfs_i(inode)->parent;
Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access.
The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned.
Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0.
--- fs/squashfs/inode.c | 7 +++++++ fs/squashfs/squashfs_fs_i.h | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-)
fs/squashfs/inode.c +7 -0
@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *insquashfs_i (inode)->start =le32_to_cpu (sqsh_ino->start_block);squashfs_i (inode)->block_list_start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *insquashfs_i (inode)->start =le64_to_cpu (sqsh_ino->start_block);squashfs_i (inode)->block_list_start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *in inode->i_mode |=S_IFLNK ;squashfs_i (inode)->start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ;if (type ==SQUASHFS_LSYMLINK_TYPE ) {__le32 xattr;
@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *inset_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); rdev =le32_to_cpu (sqsh_ino->rdev);init_special_inode (inode, inode->i_mode,new_decode_dev (rdev)); +squashfs_i (inode)->parent =0 ;TRACE ("Device inode %x:%x, rdev %x\n" ,SQUASHFS_INODE_BLK (ino), offset, rdev);
@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *inset_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); rdev =le32_to_cpu (sqsh_ino->rdev);init_special_inode (inode, inode->i_mode,new_decode_dev (rdev)); +squashfs_i (inode)->parent =0 ;TRACE ("Device inode %x:%x, rdev %x\n" ,SQUASHFS_INODE_BLK (ino), offset, rdev);
@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *in inode->i_mode |=S_IFSOCK ;set_nlink (inode,le32_to_cpu (sqsh_ino->nlink));init_special_inode (inode, inode->i_mode,0 ); +squashfs_i (inode)->parent =0 ;break ; }case SQUASHFS_LFIFO_TYPE :
@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *in inode->i_op = &squashfs_inode_ops;set_nlink (inode,le32_to_cpu (sqsh_ino->nlink));init_special_inode (inode, inode->i_mode,0 ); +squashfs_i (inode)->parent =0 ;break ; }default :
fs/squashfs/squashfs_fs_i.h +1 -1
@@ -16,6 +16,7 @@ struct squashfs_inode_info {u64 xattr;unsigned int xattr_size;int xattr_count; +int parent; union { struct { u64 fragment_block;
@@ -27,7 +28,6 @@ struct squashfs_inode_info {u64 dir_idx_start;int dir_idx_offset;int dir_idx_cnt; -int parent; }; };struct inode vfs_inode;
Greg Kroah-Hartman
maintainerPATCH 89/332 uio_hv_generic: Let userspace take care of interrupt mask
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naman Jain <[email protected]>
commit b15b7d2a1b09ef5428a8db260251897405a19496 upstream.
Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, and the user-mode driver will miss an interrupt which will cause a hang.
For eg- when the driver sets inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. So let’s assume that happens, the host puts a message into the ring buffer but does not interrupt.
Subsequently, the user space code in the guest sets the inbound ring buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”. User space code then calls pread() to wait for an interrupt. Then one of two things happens:
* The host never sends another message. So the pread() waits forever.
* The host does send another message. But because there’s already a message in the ring buffer, it doesn’t generate an interrupt. This is the correct behavior, because the host should only send an interrupt when the inbound ring buffer transitions from empty to not-empty. Adding an additional message to a ring buffer that is not empty is not supposed to generate an interrupt on the guest. Since the guest is waiting in pread() and not removing messages from the ring buffer, the pread() waits forever.
This could be easily reproduced in hv_fcopy_uio_daemon if we delay setting interrupt mask to 0.
Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1, there’s a race condition. Once user space empties the inbound ring buffer, but before user space sets interrupt_mask to 0, the host could put another message in the ring buffer but it wouldn’t interrupt. Then the next pread() would hang.
Fix these by removing all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable userspace control the interrupt mask by writing 0/1 to /dev/uioX.
--- drivers/uio/uio_hv_generic.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/uio/uio_hv_generic.c +1 -6
@@ -96,7 +96,6 @@ static void hv_uio_channel_cb(void *contstruct hv_device *hv_dev = chan->device_obj;struct hv_uio_private_data *pdata =hv_get_drvdata (hv_dev); - chan->inbound.ring_buffer->interrupt_mask =1 ;virt_mb ();uio_event_notify (&pdata->info);
@@ -173,8 +172,6 @@ hv_uio_new_channel(struct vmbus_channelreturn ; } -/* Disable interrupts on sub channel */ - new_sc->inbound.ring_buffer->interrupt_mask =1 ;set_channel_read_mode (new_sc,HV_CALL_ISR ); ret =sysfs_create_bin_file (&new_sc->kobj, &ring_buffer_bin_attr);
@@ -218,9 +215,7 @@ hv_uio_open(struct uio_info *info, struc ret =vmbus_connect_ring (dev->channel, hv_uio_channel_cb, dev->channel); -if (ret ==0 ) - dev->channel->inbound.ring_buffer->interrupt_mask =1 ; -else +if (ret)atomic_dec (&pdata->refcnt);return ret;
Greg Kroah-Hartman
maintainerPATCH 90/332 mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 1efbee6852f1ff698a9981bd731308dd027189fb upstream.
Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells") removed the return value check from the call to gpiochip_add_data() (or rather gpiochip_add() back then and later converted to devres) with no explanation. This function however can still fail, so check the return value and bail-out if it does.
--- drivers/mfd/vexpress-sysreg.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mfd/vexpress-sysreg.c +5 -1
@@ -98,6 +98,7 @@ static int vexpress_sysreg_probe(structstruct resource *mem;void __iomem *base;struct gpio_chip *mmc_gpio_chip; +int ret; mem =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!mem)
@@ -118,7 +119,10 @@ static int vexpress_sysreg_probe(structbgpio_init (mmc_gpio_chip, &pdev->dev,0x4 , base +SYS_MCI ,NULL ,NULL ,NULL ,NULL ,0 ); mmc_gpio_chip->ngpio =2 ; -devm_gpiochip_add_data (&pdev->dev, mmc_gpio_chip,NULL ); + + ret =devm_gpiochip_add_data (&pdev->dev, mmc_gpio_chip,NULL ); +if (ret) +return ret; return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, vexpress_sysreg_cells,
Greg Kroah-Hartman
maintainerPATCH 91/332 mm: hugetlb: avoid soft lockup when mprotect to large memory area
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream.
When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:
watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24
lr : mte_sync_tags+0x1c0/0x240
sp : ffff80003150bb80
x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000
x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458
x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000
x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000
Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8
Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.
Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.
So add cond_resched() for hugetlb to avoid soft lockup.
--- mm/hugetlb.c | 2 ++ 1 file changed, 2 insertions(+)
mm/hugetlb.c +2 -0
@@ -5119,6 +5119,8 @@ unsigned long hugetlb_change_protection( pages++; }spin_unlock (ptl); + +cond_resched (); }/* * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare
Greg Kroah-Hartman
maintainerPATCH 92/332 Input: atmel_mxt_ts - allow reset GPIO to sleep
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 upstream.
The reset GPIO is not toggled in any critical section where it couldn't sleep, allow the reset GPIO to sleep. This allows the driver to operate reset GPIOs connected to I2C GPIO expanders.
--- drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/atmel_mxt_ts.c +1 -1
@@ -3156,7 +3156,7 @@ static int mxt_probe(struct i2c_client *if (data->reset_gpio) {/* Wait a while and then de-assert the RESET GPIO line */ msleep (MXT_RESET_GPIO_TIME ); -gpiod_set_value (data->reset_gpio,0 ); +gpiod_set_value_cansleep (data->reset_gpio,0 );msleep (MXT_RESET_INVALID_CHG ); }
Greg Kroah-Hartman
maintainerPATCH 93/332 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.
Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace.
Initialize ff_up_compat to zero before filling valid fields.
--- drivers/input/misc/uinput.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/misc/uinput.c +1 -0
@@ -741,6 +741,7 @@ static int uinput_ff_upload_to_user(charif (in_compat_syscall ()) {struct uinput_ff_upload_compat ff_up_compat; +memset (&ff_up_compat,0 ,sizeof (ff_up_compat)); ff_up_compat.request_id = ff_up->request_id; ff_up_compat.retval = ff_up->retval;/*
Greg Kroah-Hartman
maintainerPATCH 94/332 pinctrl: check the return value of pinmux_ops::get_function_name()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 upstream.
While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux_ops - pinmux_generic_get_function_name() - can fail and return NULL. This is already checked in pinmux_check_ops() so add a similar check in pinmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dereferenced. This is normal operation when adding new pinfunctions.
--- drivers/pinctrl/pinmux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinmux.c +1 -1
@@ -327,7 +327,7 @@ static int pinmux_func_name_to_selector(while (selector < nfuncs) {const char *fname = ops->get_function_name (pctldev, selector); -if (!strcmp (function, fname)) +if (fname && !strcmp (function, fname))return selector; selector++;
Greg Kroah-Hartman
maintainerPATCH 95/332 bus: fsl-mc: Check return value of platform_get_resource()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salah Triki <[email protected]>
commit 25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae upstream.
platform_get_resource() returns NULL in case of failure, so check its return value and propagate the error in order to prevent NULL pointer dereference.
--- drivers/bus/fsl-mc/fsl-mc-bus.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bus/fsl-mc/fsl-mc-bus.c +3 -0
@@ -1014,6 +1014,9 @@ static int fsl_mc_bus_probe(struct platf* Get physical address of MC portal for the root DPRC: */ plat_res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!plat_res) +return -EINVAL ; + mc_portal_phys_addr = plat_res->start; mc_portal_size =resource_size (plat_res); mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff ;
Greg Kroah-Hartman
maintainerPATCH 96/332 fs: always return zero on success from replace_fd()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 upstream.
replace_fd() returns the number of the new file descriptor through the return value of do_dup2(). However its callers never care about the specific returned number. In fact the caller in receive_fd_replace() treats any non-zero return value as an error and therefore never calls __receive_sock() for most file descriptors, which is a bug.
To fix the bug in receive_fd_replace() and to avoid the same issue happening in future callers, signal success through a plain zero.
--- fs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/file.c +4 -1
@@ -1095,7 +1095,10 @@ int replace_fd(unsigned fd, struct file err =expand_files (files, fd);if (unlikely (err <0 )) goto out_unlock; -return do_dup2 (files, file, fd, flags); + err =do_dup2 (files, file, fd, flags); +if (err <0 ) +return err; +return 0 ; out_unlock:spin_unlock (&files->file_lock);
Greg Kroah-Hartman
maintainerPATCH 97/332 clocksource/drivers/clps711x: Fix resource leaks in error paths
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit cd32e596f02fc981674573402c1138f616df1728 upstream.
The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths.
--- drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/clps711x-timer.c +16 -7
@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(stunsigned int irq =irq_of_parse_and_map (np,0 );struct clk *clock =of_clk_get (np,0 );void __iomem *base =of_iomap (np,0 ); +int ret =0 ;if (!base)return -ENOMEM ; -if (!irq) -return -EINVAL ; -if (IS_ERR (clock)) -return PTR_ERR (clock); +if (!irq) { + ret = -EINVAL ; + goto unmap_io; + } +if (IS_ERR (clock)) { + ret =PTR_ERR (clock); + goto unmap_io; + }switch (of_alias_get_id (np,"timer" )) {case CLPS711X_CLKSRC_CLOCKSOURCE :clps711x_clksrc_init (clock, base);break ;case CLPS711X_CLKSRC_CLOCKEVENT : -return _clps711x_clkevt_init (clock, base, irq); + ret =_clps711x_clkevt_init (clock, base, irq); +break ;default : -return -EINVAL ; + ret = -EINVAL ; +break ; } -return 0 ; +unmap_io: +iounmap (base); +return ret; }TIMER_OF_DECLARE (clps711x,"cirrus,ep7209-timer" , clps711x_timer_init);
Greg Kroah-Hartman
maintainerPATCH 98/332 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly.
--- include/linux/iio/frequency/adf4350.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/frequency/adf4350.h +1 -1
@@ -51,7 +51,7 @@/* REG3 Bit Definitions */ #define ADF4350_REG3_12BIT_CLKDIV (x) ((x) << 3) -#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 16) +#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 15)#define ADF4350_REG3_12BIT_CSR_EN (1 << 18)#define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)#define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
Greg Kroah-Hartman
maintainerPATCH 99/332 libperf event: Ensure tracing data is multiple of 8 sized
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
Perf's synthetic-events.c will ensure 8-byte alignment of tracing data, writing it after a perf_record_header_tracing_data event.
Add padding to struct perf_record_header_tracing_data to make it 16-byte rather than 12-byte sized.
--- tools/lib/perf/include/perf/event.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/perf/include/perf/event.h +1 -0
@@ -201,6 +201,7 @@ struct perf_record_header_event_type {struct perf_record_header_tracing_data {struct perf_event_header header;__u32 size; +__u32 pad; };#define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/332 clk: at91: peripheral: fix return value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
determine_rate() is expected to return an error code, or 0 on success. clk_sam9x5_peripheral_determine_rate() has a branch that returns the parent rate on a certain case. This is the behavior of round_rate(), so let's go ahead and fix this by setting req->rate.
--- drivers/clk/at91/clk-peripheral.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/at91/clk-peripheral.c +5 -2
@@ -268,8 +268,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,long best_diff =LONG_MIN ;u32 shift; -if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) -return parent_rate; +if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) { + req->rate = parent_rate; + +return 0 ; + }/* Fist step: check the available dividers. */ for (shift =0 ; shift <=PERIPHERAL_MAX_SHIFT ; shift++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/332 perf util: Fix compression checks returning -1 as bool
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1.
A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers.
Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch.
--- tools/perf/util/lzma.c | 2 +- tools/perf/util/zlib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/lzma.c +1 -1
@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
tools/perf/util/zlib.c +1 -1
@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/332 rtc: x1205: Fix Xicor X1205 vendor prefix
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered.
--- drivers/rtc/rtc-x1205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-x1205.c +1 -1
@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = {MODULE_DEVICE_TABLE (i2c, x1205_id);static const struct of_device_id x1205_dt_ids[] = { - { .compatible ="xircom,x1205" , }, + { .compatible ="xicor,x1205" , }, {}, };MODULE_DEVICE_TABLE (of, x1205_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/332 perf session: Fix handling when buffer exceeds 2 GiB
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative.
As a result, the perf record command reports an error:
0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly.
--- tools/perf/util/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/session.c +1 -1
@@ -1570,7 +1570,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,struct perf_tool *tool = session->tool;struct perf_sample sample = { .time =0 , };int fd =perf_data__fd (session->data); -int err; +s64 err;if (event->header.type !=PERF_RECORD_COMPRESSED || tool->compressed == perf_session__process_compressed_event_stub)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/332 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series.
Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +9 -7
@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,return 0 ; } -static long lpc18xx_pll0_round_rate (struct clk_hw *hw,unsigned long rate, -unsigned long *prate) +static int lpc18xx_pll0_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) {unsigned long m; -if (*prate < rate) { +if (req->best_parent_rate < req->rate) {pr_warn ("%s: pll dividers not supported\n" , __func__);return -EINVAL ; } - m =DIV_ROUND_UP_ULL (*prate, rate *2 ); + m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 );if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { -pr_warn ("%s: unable to support rate %lu\n" , __func__, rate); +pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; } -return 2 * *prate * m; + req->rate =2 * req->best_parent_rate * m; + +return 0 ; } static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,static const struct clk_ops lpc18xx_pll0_ops = { .recalc_rate = lpc18xx_pll0_recalc_rate, - .round_rate = lpc18xx_pll0_round_rate, + .determine_rate = lpc18xx_pll0_determine_rate, .set_rate = lpc18xx_pll0_set_rate, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/332 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
This ensures proper bounds checking during clk rate setting and rounding.
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +2 -2
@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, } m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; }
@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, } m =DIV_ROUND_UP_ULL (parent_rate, rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, rate);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/332 scsi: libsas: Add sas_task_find_rq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
blk-mq already provides a unique tag per request. Some libsas LLDDs - like hisi_sas - already use this tag as the unique per-I/O HW tag.
Add a common function to provide the request associated with a sas_task for all libsas LLDDs.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- include/scsi/libsas.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/scsi/libsas.h +18 -0
@@ -622,6 +622,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags);extern struct sas_task *sas_alloc_slow_task (gfp_t flags);extern void sas_free_task (struct sas_task *task); +static inline struct request *sas_task_find_rq (struct sas_task *task) +{ +struct scsi_cmnd *scmd; + +if (task->task_proto &SAS_PROTOCOL_STP_ALL ) { +struct ata_queued_cmd *qc = task->uldd_task; + + scmd = qc ? qc->scsicmd :NULL ; + }else { + scmd = task->uldd_task; + } + +if (!scmd) +return NULL ; + +return scsi_cmd_to_rq (scmd); +} +struct sas_domain_function_template {/* The class calls these to notify the LLDD of an event. */ void (*lldd_port_formed)(struct asd_sas_phy *);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/332 scsi: mvsas: Delete mvs_tag_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
All mvs_tag_init() does is zero the tag bitmap, but this is already done with the kzalloc() call to alloc the tags, so delete this unneeded function.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_init.c | 2 -- drivers/scsi/mvsas/mv_sas.c | 7 ------- drivers/scsi/mvsas/mv_sas.h | 1 - 3 files changed, 10 deletions(-)
drivers/scsi/mvsas/mv_init.c +0 -2
@@ -287,8 +287,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) } mvi->tags_num = slot_nr; -/* Initialize tags */ -mvs_tag_init (mvi);return 0 ; err_out:return 1 ;
drivers/scsi/mvsas/mv_sas.c +0 -7
@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)return 0 ; } -void mvs_tag_init (struct mvs_info *mvi) -{ -int i; -for (i =0 ; i < mvi->tags_num; ++i) -mvs_tag_clear (mvi, i); -} -static struct mvs_info *mvs_find_dev_mvi (struct domain_device *dev) {unsigned long i =0 , j =0 , hi =0 ;
drivers/scsi/mvsas/mv_sas.h +0 -1
@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);void mvs_tag_free (struct mvs_info *mvi,u32 tag);void mvs_tag_set (struct mvs_info *mvi,unsigned int tag);int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out); -void mvs_tag_init (struct mvs_info *mvi);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/332 scsi: mvsas: Use sas_task_find_rq() for tagging
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
The request associated with a SCSI command coming from the block layer has a unique tag, so use that when possible for getting a slot.
Unfortunately we don't support reserved commands in the SCSI midlayer yet. As such, SMP tasks - as an example - will not have a request associated, so in the interim continue to manage those tags for that type of sas_task internally.
We reserve an arbitrary 4 tags for these internal tags. Indeed, we already decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 slots are used for is not obvious.
Also make the tag management functions static, where possible.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 9 +++++---- drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- drivers/scsi/mvsas/mv_sas.h | 7 +------ 4 files changed, 29 insertions(+), 23 deletions(-)
drivers/scsi/mvsas/mv_defs.h +1 -0
@@ -40,6 +40,7 @@ enum driver_configuration {MVS_ATA_CMD_SZ =96 ,/* SATA command table buffer size */ MVS_OAF_SZ =64 ,/* Open address frame buffer size */ MVS_QUEUE_SIZE =64 ,/* Support Queue depth */ +MVS_RSVD_SLOTS =4 , MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, };
drivers/scsi/mvsas/mv_init.c +5 -4
@@ -143,7 +143,7 @@ static void mvs_free(struct mvs_info *mvi)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry)cancel_delayed_work (&mwq->work_q); -kfree (mvi->tags); +kfree (mvi->rsvd_tags);kfree (mvi); }
@@ -285,7 +285,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)printk (KERN_DEBUG "failed to create dma pool %s.\n" , pool_name); goto err_out; } - mvi->tags_num = slot_nr;return 0 ; err_out:
@@ -368,8 +367,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, mvi->sas = sha; mvi->shost = shost; - mvi->tags =kzalloc (MVS_CHIP_SLOT_SZ >>3 ,GFP_KERNEL ); -if (!mvi->tags) + mvi->rsvd_tags =bitmap_zalloc (MVS_RSVD_SLOTS ,GFP_KERNEL ); +if (!mvi->rsvd_tags) goto err_out;if (MVS_CHIP_DISP ->chip_ioremap (mvi))
@@ -470,6 +469,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,else can_queue =MVS_CHIP_SLOT_SZ ; + can_queue -=MVS_RSVD_SLOTS ; + shost->sg_tablesize =min_t (u16,SG_ALL ,MVS_MAX_SG ); shost->can_queue = can_queue; mvi->shost->cmd_per_lun =MVS_QUEUE_SIZE ;
drivers/scsi/mvsas/mv_sas.c +22 -13
@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)return 0 ; } -void mvs_tag_clear (struct mvs_info *mvi,u32 tag) +static void mvs_tag_clear (struct mvs_info *mvi,u32 tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;clear_bit (tag, bitmap); } -void mvs_tag_free (struct mvs_info *mvi,u32 tag) +static void mvs_tag_free (struct mvs_info *mvi,u32 tag) { +if (tag >=MVS_RSVD_SLOTS ) +return ; +mvs_tag_clear (mvi, tag); } -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) +static void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;set_bit (tag, bitmap); } -inline int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) +static int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) {unsigned int index, tag; -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags; - index =find_first_zero_bit (bitmap, mvi->tags_num); + index =find_first_zero_bit (bitmap,MVS_RSVD_SLOTS ); tag = index; -if (tag >= mvi->tags_num) +if (tag >=MVS_RSVD_SLOTS )return -SAS_QUEUE_FULL ;mvs_tag_set (mvi, tag); *tag_out = tag;
@@ -691,6 +694,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmfstruct mvs_task_exec_info tei;struct mvs_slot_info *slot;u32 tag =0xdeadbeef , n_elem =0 ; +struct request *rq;int rc =0 ;if (!dev->port) {
@@ -755,9 +759,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf n_elem = task->num_scatter; } - rc =mvs_tag_alloc (mvi, &tag); -if (rc) - goto err_out; + rq =sas_task_find_rq (task); +if (rq) { + tag = rq->tag +MVS_RSVD_SLOTS ; + }else { + rc =mvs_tag_alloc (mvi, &tag); +if (rc) + goto err_out; + } slot = &mvi->slot_info[tag];
@@ -860,7 +869,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)static void mvs_slot_free (struct mvs_info *mvi,u32 rx_desc) {u32 slot_idx = rx_desc &RXQ_SLOT_MASK ; -mvs_tag_clear (mvi, slot_idx); +mvs_tag_free (mvi, slot_idx); } static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
drivers/scsi/mvsas/mv_sas.h +1 -6
@@ -370,8 +370,7 @@ struct mvs_info {u32 chip_id;const struct mvs_chip_info *chip; -int tags_num; -unsigned long *tags; +unsigned long *rsvd_tags;/* further per-slot information */ struct mvs_phy phy[MVS_MAX_PHYS ];struct mvs_port port[MVS_MAX_PHYS ];
@@ -424,10 +423,6 @@ struct mvs_task_exec_info {/******************** function prototype *********************/ void mvs_get_sas_addr (void *buf,u32 buflen); -void mvs_tag_clear (struct mvs_info *mvi,u32 tag); -void mvs_tag_free (struct mvs_info *mvi,u32 tag); -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag); -int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/332 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
mvs_pci_remove() |
mvs_free() | mvs_work_queue()
cancel_delayed_work() |
kfree(mvi) |
| mvi-> // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.
This bug was found by static analysis.
--- drivers/scsi/mvsas/mv_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mvsas/mv_init.c +1 -1
@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi)if (mvi->shost)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry) -cancel_delayed_work (&mwq->work_q); +cancel_delayed_work_sync (&mwq->work_q);kfree (mvi->rsvd_tags);kfree (mvi); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/332 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1176,9 +1176,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,mlx4_unregister_mac (mdev->dev, priv->port, mac);hlist_del_rcu (&entry->hlist); -kfree_rcu (entry, rcu);en_dbg (DRV , priv,"Removed MAC %pM on port:%d\n" , entry->mac, priv->port); +kfree_rcu (entry, rcu); ++removed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/332 drm/vmwgfx: Fix Use-after-free in validation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +3 -1
@@ -342,8 +342,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, } } node->res =vmw_resource_reference_unless_doomed (res); -if (!node->res) +if (!node->res) { +hash_del_rcu (&node->hash.head);return -ESRCH ; + } node->first_usage =1 ;if (!res->dev_priv->has_mob) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/332 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandr Sapozhnikov <[email protected]>
[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
--- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sm_statefuns.c +2 -1
@@ -873,7 +873,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,return SCTP_DISPOSITION_CONSUME ; nomem_authev: -sctp_ulpevent_free (ai_ev); +if (ai_ev) +sctp_ulpevent_free (ai_ev); nomem_aiev:sctp_ulpevent_free (ev); nomem_ev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/332 tcp: Dont call reqsk_fastopen_remove() in tcp_conn_request().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]:refcount_t: underflow; use-after-free.
WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
--- net/ipv4/tcp_input.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/tcp_input.c +0 -1
@@ -7000,7 +7000,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, &foc, TCP_SYNACK_FASTOPEN, skb);/* Add the child socket directly into the accept queue */ if (!inet_csk_reqsk_queue_add (sk, req, fastopen_sk)) { -reqsk_fastopen_remove (fastopen_sk, req, false);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk); goto drop_and_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/332 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <[email protected]>
[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node.
--- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fsl_pq_mdio.c +2 -0
@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)"missing 'reg' property in node %pOF\n" , tbi); err = -EBUSY ; +of_node_put (tbi); goto error; }set_tbipa (*prop, pdev, data->get_tbipa, priv->map, &res); +of_node_put (tbi); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/332 tools build: Align warning options with perf
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks.
Make the feature test program use the same warning options as perf.
--- tools/build/feature/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +2 -2
@@ -263,10 +263,10 @@ $(OUTPUT)test-sync-compare-and-swap.bin: $(BUILD) $(OUTPUT)test-compile-32.bin: - $(CC) -m32 -o $@ test-compile.c + $(CC) -m32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-compile-x32.bin: - $(CC) -mx32 -o $@ test-compile.c + $(CC) -mx32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-zlib.bin: $(BUILD) -lz
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/332 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary.
Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - 1 file changed, 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +0 -1
@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (ipi_mbox->dev.parent) { -mbox_controller_unregister (&ipi_mbox->mbox);if (device_is_registered (&ipi_mbox->dev))device_unregister (&ipi_mbox->dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/332 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes.
device_is_registered() is the canonical and robust method to verify the registration status.
Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +2 -4
@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) i = pdata->num_mboxes;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i]; -if (ipi_mbox->dev.parent) { -if (device_is_registered (&ipi_mbox->dev)) -device_unregister (&ipi_mbox->dev); - } +if (device_is_registered (&ipi_mbox->dev)) +device_unregister (&ipi_mbox->dev); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/332 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster.
The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing.
The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first.
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -2268,6 +2268,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,if (IS_ERR (dst)) goto out_drop; +skb_dst_drop (skb);skb_dst_set (skb, dst); }else if (nh->nh_family !=AF_INET6 ) { goto out_drop;
@@ -2383,6 +2384,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } +skb_dst_drop (skb);skb_dst_set (skb, &rt->dst); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/332 drm/amdgpu: Add additional DCE6 SCL registers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
--- drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ 2 files changed, 9 insertions(+)
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +7 -0
@@ -4115,6 +4115,7 @@#define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40#define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL0_SCL_SCALER_ENABLE 0x1B42#define mmSCL0_SCL_CONTROL 0x1B44#define mmSCL0_SCL_DEBUG 0x1B6A#define mmSCL0_SCL_DEBUG2 0x1B69
@@ -4144,6 +4145,7 @@#define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55#define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40#define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 +#define mmSCL1_SCL_SCALER_ENABLE 0x1E42#define mmSCL1_SCL_CONTROL 0x1E44#define mmSCL1_SCL_DEBUG 0x1E6A#define mmSCL1_SCL_DEBUG2 0x1E69
@@ -4173,6 +4175,7 @@#define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155#define mmSCL2_SCL_COEF_RAM_SELECT 0x4140#define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 +#define mmSCL2_SCL_SCALER_ENABLE 0x4142#define mmSCL2_SCL_CONTROL 0x4144#define mmSCL2_SCL_DEBUG 0x416A#define mmSCL2_SCL_DEBUG2 0x4169
@@ -4202,6 +4205,7 @@#define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455#define mmSCL3_SCL_COEF_RAM_SELECT 0x4440#define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 +#define mmSCL3_SCL_SCALER_ENABLE 0x4442#define mmSCL3_SCL_CONTROL 0x4444#define mmSCL3_SCL_DEBUG 0x446A#define mmSCL3_SCL_DEBUG2 0x4469
@@ -4231,6 +4235,7 @@#define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755#define mmSCL4_SCL_COEF_RAM_SELECT 0x4740#define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 +#define mmSCL4_SCL_SCALER_ENABLE 0x4742#define mmSCL4_SCL_CONTROL 0x4744#define mmSCL4_SCL_DEBUG 0x476A#define mmSCL4_SCL_DEBUG2 0x4769
@@ -4260,6 +4265,7 @@#define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55#define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40#define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 +#define mmSCL5_SCL_SCALER_ENABLE 0x4A42#define mmSCL5_SCL_CONTROL 0x4A44#define mmSCL5_SCL_DEBUG 0x4A6A#define mmSCL5_SCL_DEBUG2 0x4A69
@@ -4287,6 +4293,7 @@#define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL_COEF_RAM_SELECT 0x1B40#define mmSCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL_SCALER_ENABLE 0x1B42#define mmSCL_CONTROL 0x1B44#define mmSCL_DEBUG 0x1B6A#define mmSCL_DEBUG2 0x1B69
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +2 -0
@@ -8646,6 +8646,8 @@#define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 +#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L +#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000#define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L#define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000#define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/332 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
Without these, it's impossible to program these registers.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,8 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \SRI (SCL_HORZ_FILTER_SCALE_RATIO ,SCL , id), \SRI (SCL_VERT_FILTER_SCALE_RATIO ,SCL , id), \ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/332 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
Previously, the code would set a bit field which didn't exist on DCE6 so it would be effectively a no-op.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +2 -4
@@ -528,8 +528,7 @@ static void dce60_transform_set_scaler(if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {/* 4. Program vertical filters */ if (xfm_dce->filter_v ==NULL ) -REG_SET (SCL_VERT_FILTER_CONTROL ,0 , -SCL_V_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_VERT_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.v_taps,
@@ -543,8 +542,7 @@ static void dce60_transform_set_scaler(/* 5. Program horizontal filters */ if (xfm_dce->filter_h ==NULL ) -REG_SET (SCL_HORZ_FILTER_CONTROL ,0 , -SCL_H_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_HORZ_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.h_taps,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/332 drm/amd/display: Properly disable scaling on DCE6
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
SCL_SCALER_ENABLE can be used to enable/disable the scaler on DCE6. Program it to 0 when scaling isn't used, 1 when used. Additionally, clear some other registers when scaling is disabled and program the SCL_UPDATE register as recommended.
This fixes visible glitches for users whose BIOS sets up a mode with scaling at boot, which DC was unable to clean up.
--- .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +11 -4
@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(REG_SET (SCL_BYPASS_CONTROL ,0 ,SCL_BYPASS_MODE ,0 );if (data->taps.h_taps + data->taps.v_taps <=2 ) { -/* Set bypass */ - -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +/* Disable scaler functionality */ +REG_WRITE (SCL_SCALER_ENABLE ,0 ); +/* Clear registers that can cause glitches even when the scaler is off */ +REG_WRITE (SCL_TAP_CONTROL ,0 ); +REG_WRITE (SCL_AUTOMATIC_MODE_CONTROL ,0 ); +REG_WRITE (SCL_F_SHARP_CONTROL ,0 );return false; }
@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(SCL_H_NUM_OF_TAPS , data->taps.h_taps -1 , SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +REG_WRITE (SCL_SCALER_ENABLE ,1 );/* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
@@ -503,6 +506,8 @@ static void dce60_transform_set_scaler(REG_SET (DC_LB_MEM_SIZE ,0 ,DC_LB_MEM_SIZE , xfm_dce->lb_memory_size); +REG_WRITE (SCL_UPDATE ,0x00010000 ); +/* Clear SCL_F_SHARP_CONTROL value to 0 */ REG_WRITE (SCL_F_SHARP_CONTROL ,0 );
@@ -566,6 +571,8 @@ static void dce60_transform_set_scaler(/* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ + + REG_WRITE(SCL_UPDATE, 0); }#endif
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,7 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_SCALER_ENABLE ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
@@ -592,6 +593,7 @@ struct dce_transform_registers {uint32_t SCL_VERT_FILTER_SCALE_RATIO ;uint32_t SCL_HORZ_FILTER_INIT ;#if defined(CONFIG_DRM_AMD_DC_SI ) +uint32_t SCL_SCALER_ENABLE ;uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA ;uint32_t SCL_HORZ_FILTER_INIT_CHROMA ;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/332 crypto: essiv - Check ssize for decryption and in-place encryption
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
--- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
crypto/essiv.c +6 -8
@@ -185,9 +185,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)const struct essiv_tfm_ctx *tctx =crypto_aead_ctx (tfm);struct essiv_aead_request_ctx *rctx =aead_request_ctx (req);struct aead_request *subreq = &rctx->aead_req; +int ivsize =crypto_aead_ivsize (tfm); +int ssize = req->assoclen - ivsize;struct scatterlist *src = req->src;int err; +if (ssize <0 ) +return -EINVAL ; +crypto_cipher_encrypt_one (tctx->essiv_cipher, req->iv, req->iv);/*
@@ -197,19 +202,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)*/ rctx->assoc =NULL ;if (req->src == req->dst || !enc) { -scatterwalk_map_and_copy (req->iv, req->dst, - req->assoclen -crypto_aead_ivsize (tfm), -crypto_aead_ivsize (tfm),1 ); +scatterwalk_map_and_copy (req->iv, req->dst, ssize, ivsize,1 ); }else {u8 *iv = (u8 *)aead_request_ctx (req) + tctx->ivoffset; -int ivsize =crypto_aead_ivsize (tfm); -int ssize = req->assoclen - ivsize;struct scatterlist *sg;int nents; -if (ssize <0 ) -return -EINVAL ; - nents =sg_nents_for_len (req->src, ssize);if (nents <0 )return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/332 tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gunnar Kudrjavets <[email protected]>
[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
The tpm_tis_write8() call specifies arguments in wrong order. Should be (data, addr, value) not (data, value, addr). The initial correct order was changed during the major refactoring when the code was split.
--- drivers/char/tpm/tpm_tis_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +2 -2
@@ -831,8 +831,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,* will call disable_irq which undoes all of the above. */ if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) { -tpm_tis_write8 (priv, original_int_vec, -TPM_INT_VECTOR (priv->locality)); +tpm_tis_write8 (priv,TPM_INT_VECTOR (priv->locality), + original_int_vec); rc =-1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/332 gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ]
The of_gpio_n_cells default is 2 when ->of_xlate() callback is not defined. No need to assign it explicitly in the driver.
Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping")
--- drivers/gpio/gpio-wcd934x.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpio/gpio-wcd934x.c +0 -1
@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev) chip->base =-1 ; chip->ngpio =WCD934X_NPINS ; chip->label =dev_name (dev); - chip->of_gpio_n_cells =2 ; chip->can_sleep = false;return devm_gpiochip_add_data (dev, chip, data);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/332 gpio: wcd934x: mark the GPIO controller as sleeping
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
The slimbus regmap passed to the GPIO driver down from MFD does not use fast_io. This means a mutex is used for locking and thus this GPIO chip must not be used in atomic context. Change the can_sleep switch in struct gpio_chip to true.
--- drivers/gpio/gpio-wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-wcd934x.c +1 -1
@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) chip->base =-1 ; chip->ngpio =WCD934X_NPINS ; chip->label =dev_name (dev); - chip->can_sleep = false; + chip->can_sleep = true;return devm_gpiochip_add_data (dev, chip, data); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/332 ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Tang <[email protected]>
commit 4aac453deca0d9c61df18d968f8864c3ae7d3d8d upstream.
Previously, after rmmod acpi_tad, modprobe acpi_tad would fail with this dmesg:
sysfs: cannot create duplicate filename '/devices/platform/ACPI000E:00/time'
Call Trace: <TASK> dump_stack_lvl+0x6c/0x90 dump_stack+0x10/0x20 sysfs_warn_dup+0x8b/0xa0 sysfs_add_file_mode_ns+0x122/0x130 internal_create_group+0x1dd/0x4c0 sysfs_create_group+0x13/0x20 acpi_tad_probe+0x147/0x1f0 [acpi_tad] platform_probe+0x42/0xb0 </TASK>
acpi-tad ACPI000E:00: probe with driver acpi-tad failed with error -17
--- drivers/acpi/acpi_tad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_tad.c +3 -0
@@ -563,6 +563,9 @@ static int acpi_tad_remove(struct platfopm_runtime_get_sync (dev); +if (dd->capabilities &ACPI_TAD_RT ) +sysfs_remove_group (&dev->kobj, &acpi_tad_time_attr_group); +if (dd->capabilities &ACPI_TAD_DC_WAKE )sysfs_remove_group (&dev->kobj, &acpi_tad_dc_attr_group);
Greg Kroah-Hartman
maintainerPATCH 128/332 ACPI: debug: fix signedness issues in read/write helpers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Mohammad Jahangirzad <[email protected]>
commit 496f9372eae14775e0524e83e952814691fe850a upstream.
In the ACPI debugger interface, the helper functions for read and write operations use "int" as the length parameter data type. When a large "size_t count" is passed from the file operations, this cast to "int" results in truncation and a negative value due to signed integer representation.
Logically, this negative number propagates to the min() calculation, where it is selected over the positive buffer space value, leading to unexpected behavior. Subsequently, when this negative value is used in copy_to_user() or copy_from_user(), it is interpreted as a large positive value due to the unsigned nature of the size parameter in these functions, causing the copy operations to attempt handling sizes far beyond the intended buffer limits.
Address the issue by:
- Changing the length parameters in acpi_aml_read_user() and acpi_aml_write_user() from "int" to "size_t", aligning with the expected unsigned size semantics.
- Updating return types and local variables in acpi_aml_read() and acpi_aml_write() to "ssize_t" for consistency with kernel file operation conventions.
- Using "size_t" for the "n" variable to ensure calculations remain unsigned.
- Using min_t() for circ_count_to_end() and circ_space_to_end() to ensure type-safe comparisons and prevent integer overflow.
--- drivers/acpi/acpi_dbg.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/acpi/acpi_dbg.c +13 -13
@@ -576,11 +576,11 @@ static int acpi_aml_release(struct inodereturn 0 ; } -static int acpi_aml_read_user (char __user *buf,int len) +static ssize_t acpi_aml_read_user (char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.out_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_read (crc,ACPI_AML_OUT_USER );
@@ -589,7 +589,7 @@ static int acpi_aml_read_user(char __use/* sync head before removing logs */ smp_rmb (); p = &crc->buf[crc->tail]; - n =min (len,circ_count_to_end (crc)); + n =min_t (size_t, len,circ_count_to_end (crc));if (copy_to_user (buf, p, n)) { ret = -EFAULT ; goto out;
@@ -606,8 +606,8 @@ out:static ssize_t acpi_aml_read (struct file *file,char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
@@ -646,11 +646,11 @@ again:return size >0 ? size : ret; } -static int acpi_aml_write_user (const char __user *buf,int len) +static ssize_t acpi_aml_write_user (const char __user *buf,size_t len) { -int ret;struct circ_buf *crc = &acpi_aml_io.in_crc; -int n; +ssize_t ret; +size_t n;char *p; ret =acpi_aml_lock_write (crc,ACPI_AML_IN_USER );
@@ -659,7 +659,7 @@ static int acpi_aml_write_user(const cha/* sync tail before inserting cmds */ smp_mb (); p = &crc->buf[crc->head]; - n =min (len,circ_space_to_end (crc)); + n =min_t (size_t, len,circ_space_to_end (crc));if (copy_from_user (p, buf, n)) { ret = -EFAULT ; goto out;
@@ -670,14 +670,14 @@ static int acpi_aml_write_user(const cha ret = n; out:acpi_aml_unlock_fifo (ACPI_AML_IN_USER , ret >=0 ); -return n; +return ret; }static ssize_t acpi_aml_write (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -int ret =0 ; -int size =0 ; +ssize_t ret =0 ; +ssize_t size =0 ;if (!count)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 129/332 arm64: dts: qcom: msm8916: Add missing MDSS reset
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 99b78773c2ae55dcc01025f94eae8ce9700ae985 upstream.
On most MSM8916 devices (aside from the DragonBoard 410c), the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state.
The reset for MDSS is currently missing in msm8916.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers:
dsi_err_worker: status=6
dsi_err_worker: status=6
dsi_err_worker: status=6
...
It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -0
@@ -899,6 +899,8 @@ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; + resets = <&gcc GCC_MDSS_BCR>; + interrupt-controller; #interrupt-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 130/332 ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 74139a64e8cedb6d971c78d5d17384efeced1725 upstream.
Add missing of_node_put() calls to release device node references obtained via of_parse_phandle().
--- arch/arm/mach-omap2/pm33xx-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/pm33xx-core.c +5 -1
@@ -393,12 +393,15 @@ static int __init amx3_idle_init(structif (!state_node)break ; -if (!of_device_is_available (state_node)) +if (!of_device_is_available (state_node)) { +of_node_put (state_node);continue ; + }if (i ==CPUIDLE_STATE_MAX ) {pr_warn ("%s: cpuidle states reached max possible\n" , __func__); +of_node_put (state_node);break ; }
@@ -408,6 +411,7 @@ static int __init amx3_idle_init(struct states[state_count].wfi_flags |=WFI_FLAG_WAKE_M3 |WFI_FLAG_FLUSH_CACHE ; +of_node_put (state_node); state_count++; }
Greg Kroah-Hartman
maintainerPATCH 131/332 xen/events: Cleanup find_virq() return codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream.
rc is overwritten by the evtchn_status hypercall in each iteration, so the return value will be whatever the last iteration is. This could incorrectly return success even if the event channel was not found. Change to an explicit -ENOENT for an un-found virq and return 0 on a successful match.
Message-ID: <[email protected]>
--- drivers/xen/events/events_base.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/xen/events/events_base.c +4 -3
@@ -1263,10 +1263,11 @@ static int find_virq(unsigned int virq, {struct evtchn_status status;evtchn_port_t port; -int rc = -ENOENT ;memset (&status,0 ,sizeof (status));for (port =0 ; port <xen_evtchn_max_channels (); port++) { +int rc; + status.dom =DOMID_SELF ; status.port = port; rc =HYPERVISOR_event_channel_op (EVTCHNOP_status, &status);
@@ -1276,10 +1277,10 @@ static int find_virq(unsigned int virq,continue ;if (status.u.virq == virq && status.vcpu ==xen_vcpu_nr (cpu)) { *evtchn = port; -break ; +return 0 ; } } -return rc; +return -ENOENT ; }/**
Greg Kroah-Hartman
maintainerPATCH 132/332 xen/manage: Fix suspend error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit f770c3d858687252f1270265ba152d5c622e793f upstream.
The device power management API has the following asymmetry:
* dpm_suspend_start() does not clean up on failure (it requires a call to dpm_resume_end())
* dpm_suspend_end() does clean up on failure
(it does not require a call to dpm_resume_start())
The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related patches for 2.6.27") in June 2008: It removed a call to device_resume() from device_suspend() (which was later renamed to dpm_suspend_start()).
When Xen began using the device power management API in May 2008 with commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did not yet exist. But since it was introduced, a call to dpm_resume_end() is missing in the error path of dpm_suspend_start(). Fix it.
Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de>
--- drivers/xen/manage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/manage.c +2 -1
@@ -116,7 +116,7 @@ static void do_suspend(void) err =dpm_suspend_start (PMSG_FREEZE );if (err) {pr_err ("%s: dpm_suspend_start %d\n" , __func__, err); - goto out_thaw; + goto out_resume_end; }printk (KERN_DEBUG "suspending xenstore...\n" );
@@ -156,6 +156,7 @@ out_resume:else xs_suspend_cancel (); +out_resume_end:dpm_resume_end (si.cancelled ?PMSG_THAW :PMSG_RESTORE ); out_thaw:
Greg Kroah-Hartman
maintainerPATCH 133/332 firmware: meson_sm: fix device leak at probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream.
Make sure to drop the reference to the secure monitor device taken by of_find_device_by_node() when looking up its driver data on behalf of other drivers (e.g. during probe).
Note that holding a reference to the platform device does not prevent its driver data from going away so there is no point in keeping the reference after the helper returns.
--- drivers/firmware/meson/meson_sm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/firmware/meson/meson_sm.c +6 -1
@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write);struct meson_sm_firmware *meson_sm_get (struct device_node *sm_node) {struct platform_device *pdev =of_find_device_by_node (sm_node); +struct meson_sm_firmware *fw;if (!pdev)return NULL ; -return platform_get_drvdata (pdev); + fw =platform_get_drvdata (pdev); + +put_device (&pdev->dev); + +return fw; }EXPORT_SYMBOL_GPL (meson_sm_get);
Greg Kroah-Hartman
maintainerPATCH 134/332 media: i2c: mt9v111: fix incorrect type for ret
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream.
Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() to store negative error codes or zero returned by __mt9v111_hw_reset() and other functions.
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants.
No effect on runtime.
--- drivers/media/i2c/mt9v111.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/mt9v111.c +1 -1
@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(strucstatic int mt9v111_hw_config (struct mt9v111_dev *mt9v111) {struct i2c_client *c = mt9v111->client; -unsigned int ret;u16 outfmtctrl2; +int ret;/* Force device reset. */ ret =__mt9v111_hw_reset (mt9v111);
Greg Kroah-Hartman
maintainerPATCH 135/332 drm/nouveau: fix bad ret code in nouveau_bo_move_prep
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 upstream.
In nouveau_bo_move_prep, if nouveau_mem_map fails, an error code should be returned. Currently, it returns zero even if vmm addr is not correctly mapped.
--- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -1
@@ -796,7 +796,7 @@ done:nvif_vmm_put (vmm, &old_mem->vma[1 ]);nvif_vmm_put (vmm, &old_mem->vma[0 ]); } -return 0 ; +return ret; } static int
Greg Kroah-Hartman
maintainerPATCH 136/332 copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <[email protected]>
commit 04ff48239f46e8b493571e260bd0e6c3a6400371 upstream.
With the introduction of clone3 in commit 7f192e3cd316 ("fork: add clone3") the effective bit width of clone_flags on all architectures was increased from 32-bit to 64-bit. However, the signature of the copy_* helper functions (e.g., copy_sighand) used by copy_process was not adapted.
As such, they truncate the flags on any 32-bit architectures that supports clone3 (arc, arm, csky, m68k, microblaze, mips32, openrisc, parisc32, powerpc32, riscv32, x86-32 and xtensa).
For copy_sighand with CLONE_CLEAR_SIGHAND being an actual u64 constant, this triggers an observable bug in kernel selftest clone3_clear_sighand:
if (clone_flags & CLONE_CLEAR_SIGHAND)
in function copy_sighand within fork.c will always fail given:
unsigned long /* == uint32_t */ clone_flags
#define CLONE_CLEAR_SIGHAND 0x100000000ULLThis commit fixes the bug by always passing clone_flags to copy_sighand via their declared u64 type, invariant of architecture-dependent integer sizes.
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -1519,7 +1519,7 @@ static int copy_io(unsigned long clone_freturn 0 ; } -static int copy_sighand (unsigned long clone_flags,struct task_struct *tsk) +static int copy_sighand (u64 clone_flags,struct task_struct *tsk) {struct sighand_struct *sig;
Greg Kroah-Hartman
maintainerPATCH 137/332 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream.
The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
--- drivers/cpufreq/intel_pstate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/intel_pstate.c +5 -3
@@ -1205,10 +1205,10 @@ static void update_qos_request(enum freqcontinue ; req = policy->driver_data; -cpufreq_cpu_put (policy); - -if (!req) +if (!req) { +cpufreq_cpu_put (policy);continue ; + }if (hwp_active)intel_pstate_get_hwp_max (cpu, &turbo_max, &max_state);
@@ -1227,6 +1227,8 @@ static void update_qos_request(enum freqif (freq_qos_update_request (req, freq) <0 )pr_warn ("Failed to update freq constraint: CPU%d\n" , i); + +cpufreq_cpu_put (policy); } }
Greg Kroah-Hartman
maintainerPATCH 138/332 crypto: atmel - Fix dma_unmap_sg() direction
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit f5d643156ef62216955c119216d2f3815bd51cb1 upstream.
It seems like everywhere in this file, dd->in_sg is mapped with DMA_TO_DEVICE and dd->out_sg is mapped with DMA_FROM_DEVICE.
--- drivers/crypto/atmel-tdes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/atmel-tdes.c +1 -1
@@ -558,7 +558,7 @@ static int atmel_tdes_crypt_start(structif (err && (dd->flags &TDES_FLAGS_FAST )) {dma_unmap_sg (dd->dev, dd->in_sg,1 ,DMA_TO_DEVICE ); -dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_TO_DEVICE ); +dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_FROM_DEVICE ); }return err;
Greg Kroah-Hartman
maintainerPATCH 139/332 iio: dac: ad5360: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit f9381ece76de999a2065d5b4fdd87fa17883978c upstream.
Change the 'ret' variable in ad5360_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5360_write_unlocked().
--- drivers/iio/dac/ad5360.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5360.c +1 -1
@@ -262,7 +262,7 @@ static int ad5360_update_ctrl(struct iio unsigned int clr) {struct ad5360_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 140/332 iio: dac: ad5421: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit 3379c900320954d768ed9903691fb2520926bbe3 upstream.
Change the 'ret' variable in ad5421_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5421_write_unlocked().
--- drivers/iio/dac/ad5421.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5421.c +1 -1
@@ -186,7 +186,7 @@ static int ad5421_update_ctrl(struct iio unsigned int clr) {struct ad5421_state *st =iio_priv (indio_dev); -unsigned int ret; +int ret;mutex_lock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 141/332 iio: frequency: adf4350: Fix prescaler usage.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d upstream.
The ADF4350/1 features a programmable dual-modulus prescaler of 4/5 or 8/9. When set to 4/5, the maximum RF frequency allowed is 3 GHz. Therefore, when operating the ADF4351 above 3 GHz, this must be set to 8/9. In this context not the RF output frequency is meant
- it's the VCO frequency.
Therefore move the prescaler selection after we derived the VCO frequency from the desired RF output frequency.
This BUG may have caused PLL lock instabilities when operating the VCO at the very high range close to 4.4 GHz.
--- drivers/iio/frequency/adf4350.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/iio/frequency/adf4350.c +13 -7
@@ -143,6 +143,19 @@ static int adf4350_set_freq(struct adf43if (freq >ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq)return -EINVAL ; + st->r4_rf_div_sel =0 ; + +/* +* !\TODO: The below computation is making sure we get a power of 2 +* shift (st->r4_rf_div_sel) so that freq becomes higher or equal to +* ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() +* and friends. +*/ +while (freq <ADF4350_MIN_VCO_FREQ ) { + freq <<=1 ; + st->r4_rf_div_sel++; + } +if (freq >ADF4350_MAX_FREQ_45_PRESC ) { prescaler =ADF4350_REG1_PRESCALER ; mdiv =75 ;
@@ -151,13 +164,6 @@ static int adf4350_set_freq(struct adf43 mdiv =23 ; } - st->r4_rf_div_sel =0 ; - -while (freq <ADF4350_MIN_VCO_FREQ ) { - freq <<=1 ; - st->r4_rf_div_sel++; - } -/* * Allow a predefined reference division factor * if not set, compute our own
Greg Kroah-Hartman
maintainerPATCH 142/332 init: handle bootloader identifier in kernel parameters
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit e416f0ed3c500c05c55fb62ee62662717b1c7f71 upstream.
BootLoaders (Grub, LILO, etc) may pass an identifier such as "BOOT_IMAGE= /boot/vmlinuz-x.y.z" to kernel parameters. But these identifiers are not recognized by the kernel itself so will be passed to userspace. However user space init program also don't recognize it.
KEXEC/KDUMP (kexec-tools) may also pass an identifier such as "kexec" on some architectures.
We cannot change BootLoader's behavior, because this behavior exists for many years, and there are already user space programs search BOOT_IMAGE= in /proc/cmdline to obtain the kernel image locations:
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/util.go
(search getBootOptions)
https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/main.go
(search getKernelReleaseWithBootOption) So the the best way is handle (ignore) it by the kernel itself, which can avoid such boot warnings (if we use something like init=/bin/bash, bootloader identifier can even cause a crash):
Kernel command line: BOOT_IMAGE=(hd0,1)/vmlinuz-6.x root=/dev/sda3 ro console=tty Unknown kernel command line parameters "BOOT_IMAGE=(hd0,1)/vmlinuz-6.x", will be passed to user space.
--- init/main.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
init/main.c +14 -0
@@ -531,9 +531,23 @@ static int __init unknown_bootoption(cha const char *unused, void *arg) { size_t len = strlen(param); +int i; + +/* +* Well-known bootloader identifiers: +* 1. LILO/Grub pass "BOOT_IMAGE=..."; +* 2. kexec/kdump (kexec-tools) pass "kexec". +*/ +const char *bootloader[] = {"BOOT_IMAGE=" ,"kexec" ,NULL };repair_env_string (param, val); +/* Handle bootloader identifier */ +for (i =0 ; bootloader[i]; i++) { +if (strstarts (param, bootloader[i])) +return 0 ; + } +/* Handle obsolete-style parameters */ if (obsolete_checksetup (param))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 143/332 iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
commit a95a0b4e471a6d8860f40c6ac8f1cad9dde3189a upstream.
Remove unnecessary calls to pm_runtime_disable(), pm_runtime_set_active(), and pm_runtime_enable() from the resume path. These operations are not required here and can interfere with proper pm_runtime state handling, especially when resuming from a pm_runtime suspended state.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +0 -4
@@ -730,10 +730,6 @@ static int __maybe_unused inv_icm42600_rif (ret) goto out_unlock; -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -/* restore sensors state */ ret = inv_icm42600_set_pwr_mgmt0(st, st->suspended.gyro, st->suspended.accel,
Greg Kroah-Hartman
maintainerPATCH 144/332 lib/genalloc: fix device leak in of_gen_pool_get()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1260cbcffa608219fc9188a6cbe9c45a300ef8b5 upstream.
Make sure to drop the reference taken when looking up the genpool platform device in of_gen_pool_get() before returning the pool.
Note that holding a reference to a device does typically not prevent its devres managed resources from being released so there is no point in keeping the reference.
--- lib/genalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
lib/genalloc.c +4 -1
@@ -893,8 +893,11 @@ struct gen_pool *of_gen_pool_get(structif (!name) name = np_pool->name; } -if (pdev) +if (pdev) { pool =gen_pool_get (&pdev->dev, name); +put_device (&pdev->dev); + } +of_node_put (np_pool);return pool;
Greg Kroah-Hartman
maintainerPATCH 145/332 openat2: dont trigger automounts with RESOLVE_NO_XDEV
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Askar Safin <[email protected]>
commit 042a60680de43175eb4df0977ff04a4eba9da082 upstream.
openat2 had a bug: if we pass RESOLVE_NO_XDEV, then openat2 doesn't traverse through automounts, but may still trigger them. (See the link for full bug report with reproducer.)
This commit fixes this bug.
--- fs/namei.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/namei.c +8 -0
@@ -1202,6 +1202,10 @@ static int follow_automount(struct path dentry->d_inode)return -EISDIR ; +/* No need to trigger automounts if mountpoint crossing is disabled. */ +if (lookup_flags &LOOKUP_NO_XDEV ) +return -EXDEV ; +if (count && (*count)++ >=MAXSYMLINKS )return -ELOOP ;
@@ -1225,6 +1229,10 @@ static int __traverse_mounts(struct path/* Allow the filesystem to manage the transit without i_mutex * being held. */ if (flags &DCACHE_MANAGE_TRANSIT ) { +if (lookup_flags &LOOKUP_NO_XDEV ) { + ret = -EXDEV ; +break ; + } ret = path->dentry->d_op->d_manage (path, false); flags =smp_load_acquire (&path->dentry->d_flags);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 146/332 parisc: dont reference obsolete termio struct for TC* constants
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam James <[email protected]>
commit 8ec5a066f88f89bd52094ba18792b34c49dcd55a upstream.
Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead.
This fixes building Python for example, which falls over like:
./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
--- arch/parisc/include/uapi/asm/ioctls.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/parisc/include/uapi/asm/ioctls.h +4 -4
@@ -10,10 +10,10 @@#define TCSETS _IOW('T', 17, struct termios)/* TCSETATTR */ #define TCSETSW _IOW('T', 18, struct termios)/* TCSETATTRD */ #define TCSETSF _IOW('T', 19, struct termios)/* TCSETATTRF */ -#define TCGETA _IOR('T', 1, struct termio) -#define TCSETA _IOW('T', 2, struct termio) -#define TCSETAW _IOW('T', 3, struct termio) -#define TCSETAF _IOW('T', 4, struct termio) +#define TCGETA 0x40125401 +#define TCSETA 0x80125402 +#define TCSETAW 0x80125403 +#define TCSETAF 0x80125404#define TCSBRK _IO('T', 5)#define TCXONC _IO('T', 6)#define TCFLSH _IO('T', 7)
Greg Kroah-Hartman
maintainerPATCH 147/332 scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit b81296591c567b12d3873b05a37b975707959b94 upstream.
Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally.
Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0).
--- drivers/scsi/hpsa.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/scsi/hpsa.c +12 -9
@@ -6500,18 +6500,21 @@ static int hpsa_big_passthru_ioctl(strucwhile (left) { sz = (left > ioc->malloc_size) ? ioc->malloc_size : left; buff_size[sg_used] = sz; - buff[sg_used] =kmalloc (sz,GFP_KERNEL ); -if (buff[sg_used] ==NULL ) { - status = -ENOMEM ; - goto cleanup1; - } +if (ioc->Request.Type.Direction &XFER_WRITE ) { -if (copy_from_user (buff[sg_used], data_ptr, sz)) { - status = -EFAULT ; + buff[sg_used] =memdup_user (data_ptr, sz); +if (IS_ERR (buff[sg_used])) { + status =PTR_ERR (buff[sg_used]); + goto cleanup1; + } + }else { + buff[sg_used] =kzalloc (sz,GFP_KERNEL ); +if (!buff[sg_used]) { + status = -ENOMEM ; goto cleanup1; } - }else -memset (buff[sg_used],0 , sz); + } + left -= sz; data_ptr += sz; sg_used++;
Greg Kroah-Hartman
maintainerPATCH 148/332 sctp: Fix MAC comparison to be constant-time
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit dd91c79e4f58fbe2898dac84858033700e0e99fb upstream.
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
--- net/sctp/sm_make_chunk.c | 3 ++- net/sctp/sm_statefuns.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/sctp/sm_make_chunk.c +2 -1
@@ -31,6 +31,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt#include <crypto/hash.h> +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -1751,7 +1752,7 @@ struct sctp_association *sctp_unpack_coo } } -if (memcmp (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { +if (crypto_memneq (digest, cookie->signature,SCTP_SIGNATURE_SIZE )) { *error = -SCTP_IERROR_BAD_SIG ; goto fail; }
net/sctp/sm_statefuns.c +2 -1
@@ -30,6 +30,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h>
@@ -4303,7 +4304,7 @@ static enum sctp_ierror sctp_sf_authenti sh_key, GFP_ATOMIC);/* Discard the packet if the digests do not match */ -if (memcmp (save_digest, digest, sig_len)) { +if (crypto_memneq (save_digest, digest, sig_len)) {kfree (save_digest);return SCTP_IERROR_BAD_SIG ; }
Greg Kroah-Hartman
maintainerPATCH 149/332 sparc64: fix hugetlb for sun4u
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Yznaga <[email protected]>
commit 6fd44a481b3c6111e4801cec964627791d0f3ec5 upstream.
An attempt to exercise sparc hugetlb code in a sun4u-based guest running under qemu results in the guest hanging due to being stuck in a trap loop. This is due to invalid hugetlb TTEs being installed that do not have the expected _PAGE_PMD_HUGE and page size bits set. Although the breakage has gone apparently unnoticed for several years, fix it now so there is the option to exercise sparc hugetlb code under qemu. This can be useful because sun4v support in qemu does not support linux guests currently and sun4v-based hardware resources may not be readily available.
Fix tested with a 6.15.2 and 6.16-rc6 kernels by running libhugetlbfs tests on a qemu guest running Debian 13.
--- arch/sparc/mm/hugetlbpage.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
arch/sparc/mm/hugetlbpage.c +20 -0
@@ -133,6 +133,26 @@ hugetlb_get_unmapped_area(struct file *fstatic pte_t sun4u_hugepage_shift_to_tte (pte_t entry,unsigned int shift) { +unsigned long hugepage_size = _PAGE_SZ4MB_4U; + +pte_val (entry) =pte_val (entry) & ~_PAGE_SZALL_4U; + +switch (shift) { +case HPAGE_256MB_SHIFT : + hugepage_size = _PAGE_SZ256MB_4U; +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_SHIFT : +pte_val (entry) |= _PAGE_PMD_HUGE; +break ; +case HPAGE_64K_SHIFT : + hugepage_size = _PAGE_SZ64K_4U; +break ; +default : +WARN_ONCE (1 ,"unsupported hugepage shift=%u\n" , shift); + } + +pte_val (entry) =pte_val (entry) | hugepage_size;return entry; }
Greg Kroah-Hartman
maintainerPATCH 150/332 sparc: fix error handling in scan_one_device()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 302c04110f0ce70d25add2496b521132548cd408 upstream.
Once of_device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it could cause memory leak. So fix this by calling put_device(), then the name can be freed in kobject_cleanup().
Calling path: of_device_register() -> of_device_add() -> device_add(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.
Found by code review.
--- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + 2 files changed, 2 insertions(+)
arch/sparc/kernel/of_device_32.c +1 -0
@@ -387,6 +387,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
arch/sparc/kernel/of_device_64.c +1 -0
@@ -680,6 +680,7 @@ static struct platform_device * __init sif (of_device_register (op)) {printk ("%pOF: Could not register of device.\n" , dp); +put_device (&op->dev);kfree (op); op =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 151/332 mtd: rawnand: fsmc: Default to autodetect buswidth
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit b8df622cf7f6808c85764e681847150ed6d85f3d upstream.
If you don't specify buswidth 2 (16 bits) in the device tree, FSMC doesn't even probe anymore:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro 10100000.flash
nand: bus width 8 instead of 16 bits
nand: No NAND device found
fsmc-nand 10100000.flash: probe with driver fsmc-nand failed
with error -22
With this patch to use autodetection unless buswidth is specified, the device is properly detected again:
fsmc-nand 10100000.flash: FSMC device partno 090,
manufacturer 80, revision 00, config 00
nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1
nand: ST Micro NAND 128MiB 1,8V 16-bit
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 fsmc-nand 10100000.flash: Using 1-bit HW ECC scheme Scanning device for bad blocks
I don't know where or how this happened, I think some change in the nand core.
--- drivers/mtd/nand/raw/fsmc_nand.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/fsmc_nand.c +5 -1
@@ -865,10 +865,14 @@ static int fsmc_nand_probe_config_dt(strif (!of_property_read_u32 (np,"bank-width" , &val)) {if (val ==2 ) { nand->options |=NAND_BUSWIDTH_16 ; - }else if (val !=1 ) { + }else if (val ==1 ) { + nand->options |=NAND_BUSWIDTH_AUTO ; + }else {dev_err (&pdev->dev,"invalid bank-width %u\n" , val);return -EINVAL ; } + }else { + nand->options |=NAND_BUSWIDTH_AUTO ; }if (of_get_property (np,"nand-skip-bbtscan" ,NULL ))
Greg Kroah-Hartman
maintainerPATCH 152/332 mmc: core: SPI mode remove cmd7
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Chen <[email protected]>
commit fec40f44afdabcbc4a7748e4278f30737b54bb1a upstream.
SPI mode doesn't support cmd7, so remove it in mmc_sdio_alive() and confirm if sdio is active by checking CCCR register value is available or not.
--- drivers/mmc/core/sdio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/core/sdio.c +5 -1
@@ -929,7 +929,11 @@ static void mmc_sdio_remove(struct mmc_h*/ static int mmc_sdio_alive (struct mmc_host *host) { -return mmc_select_card (host->card); +if (!mmc_host_is_spi (host)) +return mmc_select_card (host->card); +else +return mmc_io_rw_direct (host->card,0 ,0 ,SDIO_CCCR_CCCR ,0 , +NULL ); }/*
Greg Kroah-Hartman
maintainerPATCH 153/332 memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit 6744085079e785dae5f7a2239456135407c58b25 upstream.
The of_platform_populate() call at the end of the function has a possible failure path, causing a resource leak.
Replace of_iomap() with devm_platform_ioremap_resource() to ensure automatic cleanup of srom->reg_base.
This issue was detected by smatch static analysis:drivers/memory/samsung/exynos-srom.c:155 exynos_srom_probe()warn:
'srom->reg_base' from of_iomap() not released on lines: 155.
--- drivers/memory/samsung/exynos-srom.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/memory/samsung/exynos-srom.c +4 -6
@@ -121,20 +121,18 @@ static int exynos_srom_probe(struct platreturn -ENOMEM ; srom->dev = dev; - srom->reg_base =of_iomap (np,0 ); -if (!srom->reg_base) { + srom->reg_base =devm_platform_ioremap_resource (pdev,0 ); +if (IS_ERR (srom->reg_base)) {dev_err (&pdev->dev,"iomap of exynos srom controller failed\n" ); -return -ENOMEM ; +return PTR_ERR (srom->reg_base); }platform_set_drvdata (pdev, srom); srom->reg_offset =exynos_srom_alloc_reg_dump (exynos_srom_offsets,ARRAY_SIZE (exynos_srom_offsets)); -if (!srom->reg_offset) { -iounmap (srom->reg_base); +if (!srom->reg_offset)return -ENOMEM ; - }for_each_child_of_node (np, child) {if (exynos_srom_configure_bank (srom, child)) {
Greg Kroah-Hartman
maintainerPATCH 154/332 rtc: interface: Ensure alarm irq is enabled when UIE is enabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 9db26d5855d0374d4652487bfb5aacf40821c469 upstream.
When setting a normal alarm, user-space is responsible for using RTC_AIE_ON/RTC_AIE_OFF to control if alarm irq should be enabled.
But when RTC_UIE_ON is used, interrupts must be enabled so that the requested irq events are generated.
When RTC_UIE_OFF is used, alarm irq is disabled if there are no other alarms queued, so this commit brings symmetry to that.
--- drivers/rtc/interface.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/rtc/interface.c +4 -0
@@ -579,6 +579,10 @@ int rtc_update_irq_enable(struct rtc_dev rtc->uie_rtctimer.node.expires =ktime_add (now, onesec); rtc->uie_rtctimer.period =ktime_set (1 ,0 ); err =rtc_timer_enqueue (rtc, &rtc->uie_rtctimer); +if (!err && rtc->ops && rtc->ops->alarm_irq_enable) + err = rtc->ops->alarm_irq_enable (rtc->dev.parent,1 ); +if (err) + goto out; }else {rtc_timer_remove (rtc, &rtc->uie_rtctimer); }
Greg Kroah-Hartman
maintainerPATCH 155/332 rtc: interface: Fix long-standing race when setting alarm
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
commit 795cda8338eab036013314dbc0b04aae728880ab upstream.
As described in the old comment dating back to
commit 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") from 2010, we have been living with a race window when setting alarm with an expiry in the near future (i.e. next second).
With 1 second resolution, it can happen that the second ticks after the check for the timer having expired, but before the alarm is actually set. When this happen, no alarm IRQ is generated, at least not with some RTC chips (isl12022 is an example of this).
With UIE RTC timer being implemented on top of alarm irq, being re-armed every second, UIE will occasionally fail to work, as an alarm irq lost due to this race will stop the re-arming loop.
For now, I have limited the additional expiry check to only be done for alarms set to next seconds. I expect it should be good enough, although I don't know if we can now for sure that systems with loads could end up causing the same problems for alarms set 2 seconds or even longer in the future.
I haven't been able to reproduce the problem with this check in place.
--- drivers/rtc/interface.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/rtc/interface.c +23 -0
@@ -442,6 +442,29 @@ static int __rtc_set_alarm(struct rtc_deelse err = rtc->ops->set_alarm (rtc->dev.parent, alarm); +/* +* Check for potential race described above. If the waiting for next +* second, and the second just ticked since the check above, either +* +* 1) It ticked after the alarm was set, and an alarm irq should be +* generated. +* +* 2) It ticked before the alarm was set, and alarm irq most likely will +* not be generated. +* +* While we cannot easily check for which of these two scenarios we +* are in, we can return -ETIME to signal that the timer has already +* expired, which is true in both cases. +*/ +if ((scheduled - now) <=1 ) { + err =__rtc_read_time (rtc, &tm); +if (err) +return err; + now =rtc_tm_to_time64 (&tm); +if (scheduled <= now) +return -ETIME ; + } +trace_rtc_set_alarm (rtc_tm_to_time64 (&alarm->time), err);return err; }
Greg Kroah-Hartman
maintainerPATCH 156/332 rseq/selftests: Use weak symbol reference, not definition, to link with glibc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit a001cd248ab244633c5fabe4f7c707e13fc1d1cc upstream.
Add "extern" to the glibc-defined weak rseq symbols to convert the rseq selftest's usage from weak symbol definitions to weak symbol _references_. Effectively re-defining the glibc symbols wreaks havoc when building with -fno-common, e.g. generates segfaults when running multi-threaded programs, as dynamically linked applications end up with multiple versions of the symbols.
Building with -fcommon, which until recently has the been the default for GCC and clang, papers over the bug by allowing the linker to resolve the weak/tentative definition to glibc's "real" definition.
Note, the symbol itself (or rather its address), not the value of the symbol, is set to 0/NULL for unresolved weak symbol references, as the symbol doesn't exist and thus can't have a value. Check for a NULL rseq size pointer to handle the scenario where the test is statically linked against a libc that doesn't support rseq in any capacity.
--- tools/testing/selftests/rseq/rseq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/rseq/rseq.c +4 -4
@@ -38,9 +38,9 @@* Define weak versions to play nice with binaries that are statically linked * against a libc that doesn't support registering its own rseq. */ -__weak ptrdiff_t __rseq_offset; -__weak unsigned int __rseq_size; -__weak unsigned int __rseq_flags; +extern __weak ptrdiff_t __rseq_offset; +extern __weak unsigned int __rseq_size; +extern __weak unsigned int __rseq_flags;static const ptrdiff_t *libc_rseq_offset_p = &__rseq_offset;static const unsigned int *libc_rseq_size_p = &__rseq_size;
@@ -124,7 +124,7 @@ void rseq_init(void)* libc not having registered a restartable sequence. Try to find the * symbols if that's the case. */ -if (!*libc_rseq_size_p) { +if (!libc_rseq_size_p || !*libc_rseq_size_p) { libc_rseq_offset_p =dlsym (RTLD_NEXT ,"__rseq_offset" ); libc_rseq_size_p =dlsym (RTLD_NEXT ,"__rseq_size" ); libc_rseq_flags_p =dlsym (RTLD_NEXT ,"__rseq_flags" );
Greg Kroah-Hartman
maintainerPATCH 157/332 PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 upstream.
Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs.
Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()") such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls.
On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed:
PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56)
GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001
00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8
#0 [3800313fb20] device_del at c9158ad5c
#1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390
#9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2.
This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy.
Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper.
Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking.
--- drivers/pci/iov.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/iov.c +5 -0
@@ -444,15 +444,18 @@ static int sriov_add_vfs(struct pci_devif (dev->no_vf_scan)return 0 ; +pci_lock_rescan_remove ();for (i =0 ; i < num_vfs; i++) { rc =pci_iov_add_virtfn (dev, i);if (rc) goto failed; } +pci_unlock_rescan_remove ();return 0 ; failed:while (i--)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove ();return rc; }
@@ -572,8 +575,10 @@ static void sriov_del_vfs(struct pci_devstruct pci_sriov *iov = dev->sriov;int i; +pci_lock_rescan_remove ();for (i =0 ; i < iov->num_VFs; i++)pci_iov_remove_virtfn (dev, i); +pci_unlock_rescan_remove (); }static void sriov_disable (struct pci_dev *dev)
Greg Kroah-Hartman
maintainerPATCH 158/332 PCI/ERR: Fix uevent on failure to recover
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 1cbc5e25fb70e942a7a735a1f3d6dd391afc9b29 upstream.
Upon failure to recover from a PCIe error through AER, DPC or EDR, a uevent is sent to inform user space about disconnection of the bridge whose subordinate devices failed to recover.
However the bridge itself is not disconnected. Instead, a uevent should be sent for each of the subordinate devices.
Only if the "bridge" happens to be a Root Complex Event Collector or Integrated Endpoint does it make sense to send a uevent for it (because there are no subordinate devices).
Right now if there is a mix of subordinate devices with and without pci_error_handlers, a BEGIN_RECOVERY event is sent for those with pci_error_handlers but no FAILED_RECOVERY event is ever sent for them afterwards. Fix it.
--- drivers/pci/pcie/err.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pci/pcie/err.c +7 -1
@@ -102,6 +102,12 @@ static int report_normal_detected(structreturn report_error_detected (dev, pci_channel_io_normal, data); } +static int report_perm_failure_detected (struct pci_dev *dev,void *data) +{ +pci_uevent_ers (dev,PCI_ERS_RESULT_DISCONNECT ); +return 0 ; +} +static int report_mmio_enabled (struct pci_dev *dev,void *data) {pci_ers_result_t vote, *result = data;
@@ -263,7 +269,7 @@ pci_ers_result_t pcie_do_recovery(struct failed:pci_walk_bridge (bridge, pci_pm_runtime_put,NULL ); -pci_uevent_ers (bridge,PCI_ERS_RESULT_DISCONNECT ); +pci_walk_bridge (bridge, report_perm_failure_detected,NULL );/* TODO: Should kernel panic here? */ pci_info (bridge,"device recovery failed\n" );
Greg Kroah-Hartman
maintainerPATCH 159/332 PCI/AER: Fix missing uevent on recovery when a reset is requested
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
commit bbf7d0468d0da71d76cc6ec9bc8a224325d07b6b upstream.
Since commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") AER uses the result of error_detected() as parameter to pci_uevent_ers(). As pci_uevent_ers() however does not handle PCI_ERS_RESULT_NEED_RESET this results in a missing uevent for the beginning of recovery if drivers request a reset. Fix this by treating PCI_ERS_RESULT_NEED_RESET as beginning recovery.
--- drivers/pci/pci-driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/pci-driver.c +1 -0
@@ -1546,6 +1546,7 @@ void pci_uevent_ers(struct pci_dev *pdevswitch (err_type) {case PCI_ERS_RESULT_NONE :case PCI_ERS_RESULT_CAN_RECOVER : +case PCI_ERS_RESULT_NEED_RESET : envp[idx++] ="ERROR_EVENT=BEGIN_RECOVERY" ; envp[idx++] ="DEVICE_ONLINE=0" ;break ;
Greg Kroah-Hartman
maintainerPATCH 160/332 PCI/AER: Support errors introduced by PCIe r6.0
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 6633875250b38b18b8638cf01e695de031c71f02 upstream.
PCIe r6.0 defined five additional errors in the Uncorrectable Error Status, Mask and Severity Registers (PCIe r7.0 sec 7.8.4.2ff).
lspci has been supporting them since commit 144b0911cc0b ("ls-ecaps:
extend decode support for more fields for AER CE and UE status"):
https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/commit/?id=144b0911cc0b
Amend the AER driver to recognize them as well, instead of logging them as "Unknown Error Bit".
--- drivers/pci/pcie/aer.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/pcie/aer.c +6 -6
@@ -37,7 +37,7 @@#define AER_ERROR_SOURCES_MAX 128#define AER_MAX_TYPEOF_COR_ERRS 16/* as per PCI_ERR_COR_STATUS */ -#define AER_MAX_TYPEOF_UNCOR_ERRS 27/* as per PCI_ERR_UNCOR_STATUS*/ +#define AER_MAX_TYPEOF_UNCOR_ERRS 32/* as per PCI_ERR_UNCOR_STATUS*/ struct aer_err_source {unsigned int status;
@@ -513,11 +513,11 @@ static const char *aer_uncorrectable_err"AtomicOpBlocked" ,/* Bit Position 24 */ "TLPBlockedErr" ,/* Bit Position 25 */ "PoisonTLPBlocked" ,/* Bit Position 26 */ -NULL ,/* Bit Position 27 */ -NULL ,/* Bit Position 28 */ -NULL ,/* Bit Position 29 */ -NULL ,/* Bit Position 30 */ - NULL, /* Bit Position 31 */ +"DMWrReqBlocked" ,/* Bit Position 27 */ +"IDECheck" ,/* Bit Position 28 */ +"MisIDETLP" ,/* Bit Position 29 */ +"PCRC_CHECK" ,/* Bit Position 30 */ + "TLPXlatBlocked", /* Bit Position 31 */ }; static const char *aer_agent_string[] = {
Greg Kroah-Hartman
maintainerPATCH 161/332 PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit e51d05f523e43ce5d2bad957943a2b14f68078cd upstream.
Commit under Fixes introduced the IRQ handler for "ks-pcie-error-irq". The interrupt is acquired using "request_irq()" but is never freed if the driver exits due to an error. Although the section in the driver that invokes "request_irq()" has moved around over time, the issue hasn't been addressed until now.
Fix this by using "devm_request_irq()" which automatically frees the interrupt if the driver exits.
--- drivers/pci/controller/dwc/pci-keystone.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pci-keystone.c +2 -2
@@ -1261,8 +1261,8 @@ static int ks_pcie_probe(struct platformif (irq <0 )return irq; - ret =request_irq (irq, ks_pcie_err_irq_handler,IRQF_SHARED , -"ks-pcie-error-irq" , ks_pcie); + ret =devm_request_irq (dev, irq, ks_pcie_err_irq_handler,IRQF_SHARED , +"ks-pcie-error-irq" , ks_pcie);if (ret <0 ) {dev_err (dev,"failed to request error IRQ %d\n" , irq);
Greg Kroah-Hartman
maintainerPATCH 162/332 PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit b640d42a6ac9ba01abe65ec34f7c73aaf6758ab8 upstream.
The pci_epc_raise_irq() supplies a MSI or MSI-X interrupt number in range (1-N), as per the pci_epc_raise_irq() kdoc, where N is 32 for MSI.
But tegra_pcie_ep_raise_msi_irq() incorrectly uses the interrupt number as the MSI vector. This causes wrong MSI vector to be triggered, leading to the failure of PCI endpoint Kselftest MSI_TEST test case.
To fix this issue, convert the interrupt number to MSI vector.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -2
@@ -1844,10 +1844,10 @@ static int tegra_pcie_ep_raise_legacy_irstatic int tegra_pcie_ep_raise_msi_irq (struct tegra_pcie_dw *pcie,u16 irq) { -if (unlikely (irq >31 )) +if (unlikely (irq >32 ))return -EINVAL ; -appl_writel (pcie,BIT (irq),APPL_MSI_CTRL_1 ); +appl_writel (pcie,BIT (irq -1 ),APPL_MSI_CTRL_1 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 163/332 spi: cadence-quadspi: Flush posted register writes before INDAC access
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
commit 29e0b471ccbd674d20d4bbddea1a51e7105212c5 upstream.
cqspi_indirect_read_execute() and cqspi_indirect_write_execute() first set the enable bit on APB region and then start reading/writing to the AHB region. On TI K3 SoCs these regions lie on different endpoints. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level.
It is possible for the AHB write to be executed before the APB write to enable the indirect controller, causing the transaction to be invalid and the write erroring out. Read back the APB region write before accessing the AHB region to make sure the write got flushed and the race condition is eliminated.
Message-ID: <[email protected]>
--- drivers/spi/spi-cadence-quadspi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-cadence-quadspi.c +3 -0
@@ -502,6 +502,7 @@ static int cqspi_indirect_read_execute(sreinit_completion (&cqspi->transfer_complete);writel (CQSPI_REG_INDIRECTRD_START_MASK , reg_base +CQSPI_REG_INDIRECTRD ); +readl (reg_base +CQSPI_REG_INDIRECTRD );/* Flush posted write. */ while (remaining > 0) { if (!wait_for_completion_timeout(&cqspi->transfer_complete,
@@ -611,6 +612,8 @@ static int cqspi_indirect_write_execute(reinit_completion (&cqspi->transfer_complete);writel (CQSPI_REG_INDIRECTWR_START_MASK , reg_base +CQSPI_REG_INDIRECTWR ); +readl (reg_base +CQSPI_REG_INDIRECTWR );/* Flush posted write. */ +/* * As per 66AK2G02 TRM SPRUHY8F section 11.15.5.3 Indirect Access * Controller programming sequence, couple of cycles of
Greg Kroah-Hartman
maintainerPATCH 164/332 x86/umip: Check that the instruction opcode is at least two bytes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 32278c677947ae2f042c9535674a7fff9a245dd3 upstream.
When checking for a potential UMIP violation on #GP, verify the decoder found at least two opcode bytes to avoid false positives when the kernel encounters an unknown instruction that starts with 0f. Because the array of opcode.bytes is zero-initialized by insn_init(), peeking at bytes[1] will misinterpret garbage as a potential SLDT or STR instruction, and can incorrectly trigger emulation.
E.g. if a VPALIGNR instruction
62 83 c5 05 0f 08 ff vpalignr xmm17{k5},xmm23,XMMWORD PTR [r8],0xff
hits a #GP, the kernel emulates it as STR and squashes the #GP (and corrupts the userspace code stream).
Arguably the check should look for exactly two bytes, but no three byte opcodes use '0f 00 xx' or '0f 01 xx' as an escape, i.e. it should be impossible to get a false positive if the first two opcode bytes match '0f 00' or '0f 01'. Go with a more conservative check with respect to the existing code to minimize the chances of breaking userspace, e.g. due to decoder weirdness.
Analyzed by Nick Bray <[email protected]>.
--- arch/x86/kernel/umip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/umip.c +2 -2
@@ -156,8 +156,8 @@ static int identify_insn(struct insn *inif (!insn->modrm.nbytes)return -EINVAL ; -/* All the instructions of interest start with 0x0f. */ -if (insn->opcode.bytes[0 ] !=0xf ) +/* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */ +if (insn->opcode.nbytes <2 || insn->opcode.bytes[0 ] !=0xf )return -EINVAL ;if (insn->opcode.bytes[1 ] ==0x1 ) {
Greg Kroah-Hartman
maintainerPATCH 165/332 x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 27b1fd62012dfe9d3eb8ecde344d7aa673695ecf upstream.
Filter out the register forms of 0F 01 when determining whether or not to emulate in response to a potential UMIP violation #GP, as SGDT and SIDT only accept memory operands. The register variants of 0F 01 are used to encode instructions for things like VMX and SGX, i.e. not checking the Mod field would cause the kernel to incorrectly emulate on #GP, e.g. due to a CPL violation on VMLAUNCH.
--- arch/x86/kernel/umip.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kernel/umip.c +11 -0
@@ -163,8 +163,19 @@ static int identify_insn(struct insn *inif (insn->opcode.bytes[1 ] ==0x1 ) {switch (X86_MODRM_REG (insn->modrm.value)) {case 0 : +/* The reg form of 0F 01 /0 encodes VMX instructions. */ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SGDT ;case 1 : +/* +* The reg form of 0F 01 /1 encodes MONITOR/MWAIT, +* STAC/CLAC, and ENCLS. +*/ +if (X86_MODRM_MOD (insn->modrm.value) ==3 ) +return -EINVAL ; +return UMIP_INST_SIDT ;case 4 :return UMIP_INST_SMSW ;
Greg Kroah-Hartman
maintainerPATCH 166/332 NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit ab1c282c010c4f327bd7addc3c0035fd8e3c1721 upstream.
Commit 5304877936c0 ("NFSD: Fix strncpy() fortify warning") replaced strncpy(,, sizeof(..)) with strlcpy(,, sizeof(..) - 1), but strlcpy() already guaranteed NUL-termination of the destination buffer and subtracting one byte potentially truncated the source string.
The incorrect size was then carried over in commit 72f78ae00a8e ("NFSD:
move from strlcpy with unused retval to strscpy") when switching from strlcpy() to strscpy().
Fix this off-by-one error by using the full size of the destination buffer again.
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -1335,7 +1335,7 @@ try_again:return 0 ; }if (work) { -strscpy (work->nsui_ipaddr, ipaddr,sizeof (work->nsui_ipaddr) -1 ); +strscpy (work->nsui_ipaddr, ipaddr,sizeof (work->nsui_ipaddr));refcount_set (&work->nsui_refcnt,2 ); work->nsui_busy = true;list_add_tail (&work->nsui_list, &nn->nfsd_ssc_mount_list);
Greg Kroah-Hartman
maintainerPATCH 167/332 nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit a082e4b4d08a4a0e656d90c2c05da85f23e6d0c9 upstream.
When v3 NLM request finds a conflicting delegation, it triggers a delegation recall and nfsd_open fails with EAGAIN. nfsd_open then translates EAGAIN into nfserr_jukebox. In nlm_fopen, instead of returning nlm_failed for when there is a conflicting delegation, drop this NLM request so that the client retries. Once delegation is recalled and if a local lock is claimed, a retry would lead to nfsd returning a nlm_lck_blocked error or a successful nlm lock.
--- fs/nfsd/lockd.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/nfsd/lockd.c +15 -0
@@ -48,6 +48,21 @@ nlm_fopen(struct svc_rqst *rqstp, structswitch (nfserr) {case nfs_ok:return 0 ; +case nfserr_jukebox: +/* this error can indicate a presence of a conflicting +* delegation to an NLM lock request. Options are: +* (1) For now, drop this request and make the client +* retry. When delegation is returned, client's lock retry +* will complete. +* (2) NLM4_DENIED as per "spec" signals to the client +* that the lock is unavailable now but client can retry. +* Linux client implementation does not. It treats +* NLM4_DENIED same as NLM4_FAILED and errors the request. +* (3) For the future, treat this as blocked lock and try +* to callback when the delegation is returned but might +* not have a proper lock request to block on. +*/ + fallthrough;case nfserr_dropit:return nlm_drop_reply;case nfserr_stale: