6.12.59-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.12.59-rc1 review
This is the start of the stable review cycle for the 6.12.59 release. There are 185 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 23 Nov 2025 13:01:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.59-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.59-rc1
Pauli Virtanen <[email protected]>
Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
Jialin Wang <[email protected]>
proc: proc_maps_open allow proc_mem_open to return NULL
John Sperbeck <[email protected]>
net: netpoll: ensure skb_pool list is always initialized
Horatiu Vultur <[email protected]>
net: phy: micrel: Fix lan8814_config_init
Abdun Nihaal <[email protected]>
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
Zi Yan <[email protected]>
mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
Zi Yan <[email protected]>
mm/huge_memory: do not change split_huge_page*() target order silently
Lance Yang <[email protected]>
mm/secretmem: fix use-after-free race in fault handler
Kiryl Shutsemau <[email protected]>
mm/truncate: unmap large folio on split failure
Kiryl Shutsemau <[email protected]>
mm/memory: do not populate page table entries beyond i_size
Long Li <[email protected]>
uio_hv_generic: Set event for all channels on the device
Miguel Ojeda <[email protected]>
rust: kbuild: workaround rustdoc doctests modifier bug
Miguel Ojeda <[email protected]>
rust: kbuild: treat build_error and rustdoc as kernel objects
Olivier Langlois <[email protected]>
io_uring/napi: fix io_napi_entry RCU accesses
Denis Arefev <[email protected]>
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
Sukrit Bhatnagar <[email protected]>
KVM: VMX: Fix check for valid GVA on an EPT violation
Sean Christopherson <[email protected]>
KVM: VMX: Split out guts of EPT violation to common/exposed function
Breno Leitao <[email protected]>
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
Breno Leitao <[email protected]>
net: netpoll: flush skb pool during cleanup
Breno Leitao <[email protected]>
net: netpoll: Individualize the skb pool
Sean Christopherson <[email protected]>
KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying
Yan Zhao <[email protected]>
KVM: guest_memfd: Remove RCU-protected attribute from slot->gmem.file
Sean Christopherson <[email protected]>
KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn()
Michal Hocko <[email protected]>
mm, percpu: do not consider sleepable allocations atomic
Benjamin Berg <[email protected]>
wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work
Benjamin Berg <[email protected]>
wifi: cfg80211: add an hrtimer based delayed work item
Paolo Abeni <[email protected]>
mptcp: fix MSG_PEEK stream corruption
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: properly kill background tasks
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: userspace: longer transfer
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: trunc: read all recv data
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: endpoints: longer transfer
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: rm: set backup flag
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: fix fallback note due to OoO
André Draszik <[email protected]>
pmdomain: samsung: plug potential memleak during probe
Miaoqian Lin <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_remove
Sudeep Holla <[email protected]>
pmdomain: arm: scmi: Fix genpd leak on provider registration failure
Vitaly Prosyak <[email protected]>
drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
Jonathan Kim <[email protected]>
drm/amdkfd: relax checks for over allocation of save area
Zilin Guan <[email protected]>
btrfs: release root after error in data_reloc_print_warning_inode()
Filipe Manana <[email protected]>
btrfs: do not update last_log_commit when logging inode due to a new name
Zilin Guan <[email protected]>
btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
Naohiro Aota <[email protected]>
btrfs: zoned: fix conventional zone capacity calculation
Mario Limonciello (AMD) <[email protected]>
PM: hibernate: Use atomic64_t for compressed_size variable
Mario Limonciello (AMD) <[email protected]>
PM: hibernate: Emit an error when image writing fails
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
Niravkumar L Rabara <[email protected]>
EDAC/altera: Handle OCRAM ECC enable after warm reset
Huacai Chen <[email protected]>
LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
Song Liu <[email protected]>
ftrace: Fix BPF fexit with livepatch
Ankit Khushwaha <[email protected]>
selftests/user_events: fix type cast for write_index packed member in perf_test
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
Hans de Goede <[email protected]>
spi: Try to get ACPI GPIO IRQ earlier
Henrique Carvalho <[email protected]>
smb: client: fix cifs_pick_channel when channel needs reconnect
Miaoqian Lin <[email protected]>
crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value
Sourabh Jain <[email protected]>
crash: fix crashkernel resource shrink
Hao Ge <[email protected]>
codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext
Edward Adam Davis <[email protected]>
cifs: client: fix memory leak in smb3_fs_context_parse_param
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
Shawn Lin <[email protected]>
mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
Shawn Lin <[email protected]>
mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
Kairui Song <[email protected]>
mm/shmem: fix THP allocation and fallback loop
Isaac J. Manjarres <[email protected]>
mm/mm_init: fix hash table order logging in alloc_large_system_hash()
Wei Yang <[email protected]>
fs/proc: fix uaf in proc_readdir_de()
Johannes Berg <[email protected]>
wifi: mac80211: reject address change while connecting
Steven Rostedt <[email protected]>
selftests/tracing: Run sample events to clear page cache events
Edward Adam Davis <[email protected]>
nilfs2: avoid having an active sc_timer before freeing sci
Chuang Wang <[email protected]>
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
Tianyang Zhang <[email protected]>
LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
Huacai Chen <[email protected]>
LoongArch: Use correct accessor to read FWPC/MWPC
Qinxin Xia <[email protected]>
dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
Nate Karstens <[email protected]>
strparser: Fix signed/unsigned mismatch bug
Pedro Demarchi Gomes <[email protected]>
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
Joshua Rogers <[email protected]>
ksmbd: close accepted socket when per-IP limit rejects connection
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 15
Olga Kornievskaia <[email protected]>
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
Olga Kornievskaia <[email protected]>
nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
NeilBrown <[email protected]>
nfsd: fix refcount leak in nfsd_set_fh_dentry()
Yosry Ahmed <[email protected]>
KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
Bibo Mao <[email protected]>
LoongArch: KVM: Add delay until timer interrupt injected
Bibo Mao <[email protected]>
LoongArch: KVM: Restore guest PMU if it is enabled
Vladimir Oltean <[email protected]>
net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()
Abdun Nihaal <[email protected]>
HID: uclogic: Fix potential memory leak in error path
Abdun Nihaal <[email protected]>
HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
Masami Ichikawa <[email protected]>
HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
Jihed Chaibi <[email protected]>
ARM: dts: imx51-zii-rdu1: Fix audmux node names
Dragan Simic <[email protected]>
arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic
Anand Moon <[email protected]>
arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject duplicate device on updates
Pablo Neira Ayuso <[email protected]>
Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications"
Zqiang <[email protected]>
sched_ext: Fix unsafe locking in the scx_dump_state()
Andrei Vagin <[email protected]>
fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
Alok Tiwari <[email protected]>
virtio-fs: fix incorrect check for fsvq->kobj
Dan Carpenter <[email protected]>
mtd: onenand: Pass correct pointer to IRQ handler
Hongbo Li <[email protected]>
hostfs: Fix only passing host root in boot stage with new mount
Chao Yu <[email protected]>
f2fs: fix to avoid overflow while left shift operation
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix possible UAFs
Ye Bin <[email protected]>
ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
Eric Biggers <[email protected]>
lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
Ye Bin <[email protected]>
ext4: introduce ITAIL helper
Penglei Jiang <[email protected]>
proc: fix the issue of proc_mem_open returning NULL
Manivannan Sadhasivam <[email protected]>
wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path
Nick Hu <[email protected]>
irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
Eduard Zingerman <[email protected]>
bpf: account for current allocated stack depth in widen_imprecise_scalars()
Eric Dumazet <[email protected]>
bpf: Add bpf_prog_run_data_pointers()
Dave Jiang <[email protected]>
acpi/hmat: Fix lockdep warning for hmem_register_resource()
Haein Lee <[email protected]>
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
Dai Ngo <[email protected]>
NFS: Fix LTP test failures when timestamps are delegated
Trond Myklebust <[email protected]>
NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
Yang Xiuwei <[email protected]>
NFS: sysfs: fix leak when nfs_client kobject add fails
Trond Myklebust <[email protected]>
NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
Al Viro <[email protected]>
simplify nfs_atomic_open_v23()
Trond Myklebust <[email protected]>
pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
Trond Myklebust <[email protected]>
pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
Shenghao Ding <[email protected]>
ASoC: tas2781: fix getting the wrong device number
Ian Forbes <[email protected]>
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Haotian Zhang <[email protected]>
ASoC: codecs: va-macro: fix resource leak in probe error path
Haotian Zhang <[email protected]>
ASoC: cs4271: Fix regulator leak on probe failure
Haotian Zhang <[email protected]>
regulator: fixed: fix GPIO descriptor leak on register failure
Shuai Xue <[email protected]>
acpi,srat: Fix incorrect device handle check for Generic Initiator
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: export l2cap_chan_hold for modules
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Perform fast check switch only for online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Check _CPC validity for only the online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Detect preferred core availability on online CPUs
Felix Maurer <[email protected]>
hsr: Fix supervision frame sending on HSRv0
Xuan Zhuo <[email protected]>
virtio-net: fix incorrect flags recording in big mode
Eric Dumazet <[email protected]>
net_sched: limit try_bulk_dequeue_skb() batches
Gal Pressman <[email protected]>
net/mlx5e: Fix potentially misleading debug message
Gal Pressman <[email protected]>
net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
Gal Pressman <[email protected]>
net/mlx5e: Fix maxrate wraparound in threshold between units
Ranganath V N <[email protected]>
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
Ranganath V N <[email protected]>
net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
Eric Dumazet <[email protected]>
net_sched: act_connmark: use RCU in tcf_connmark_dump()
Kuniyuki Iwashima <[email protected]>
af_unix: Initialise scc_index in unix_add_edge().
Benjamin Berg <[email protected]>
wifi: mac80211: skip rate verification for not captured PSDUs
Buday Csaba <[email protected]>
net: mdio: fix resource leak in mdiobus_register_device()
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free in tipc_mon_reinit_self().
Aksh Garg <[email protected]>
net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism
Aksh Garg <[email protected]>
net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout
Zilin Guan <[email protected]>
net/handshake: Fix memory leak in tls_handshake_accept()
D. Wythe <[email protected]>
net/smc: fix mismatch between CLC header and proposal
Eric Dumazet <[email protected]>
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
Pauli Virtanen <[email protected]>
Bluetooth: MGMT: cancel mesh send timer when hdev removed
Chuck Lever <[email protected]>
NFSD: Skip close replay processing if XDR encoding fails
Xi Ruoyao <[email protected]>
rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags
Horatiu Vultur <[email protected]>
net: phy: micrel: lan8814 fix reset of the QSGMII interface
Horatiu Vultur <[email protected]>
net: phy: micrel: Replace hardcoded pages with defines
Horatiu Vultur <[email protected]>
net: phy: micrel: Introduce lanphy_modify_page_reg
Wei Fang <[email protected]>
net: fec: correct rx_bytes statistic for the case SHIFT16 is set
Alexander Sverdlin <[email protected]>
selftests: net: local_termination: Wait for interfaces to come up
Gao Xiang <[email protected]>
erofs: avoid infinite loop due to incomplete zstd-compressed data
Nicolas Escande <[email protected]>
wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
Sharique Mohammad <[email protected]>
ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
Stuart Hayhurst <[email protected]>
HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
ZhangGuoDong <[email protected]>
smb/server: fix possible refcount leak in smb2_sess_setup()
ZhangGuoDong <[email protected]>
smb/server: fix possible memory leak in smb2_read()
Jaehun Gou <[email protected]>
exfat: fix improper check of dentry.stream.valid_size
Oleg Makarenko <[email protected]>
HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
Scott Mayhew <[email protected]>
NFS: check if suid/sgid was cleared after a write as needed
Vicki Pfau <[email protected]>
HID: nintendo: Wait longer for initial probe
Tristan Lobb <[email protected]>
HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
Joshua Watt <[email protected]>
NFS4: Apply delay_retrans to async operations
Joshua Watt <[email protected]>
NFS4: Fix state renewals missing after boot
Jesse.Zhang <[email protected]>
drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
Christian König <[email protected]>
drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
Timur Kristóf <[email protected]>
drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
Christian König <[email protected]>
drm/amdgpu: remove two invalid BUG_ON()s
Han Gao <[email protected]>
riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
Danil Skrebenkov <[email protected]>
RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
Feng Jiang <[email protected]>
riscv: Build loader.bin exclusively for Canaan K210
Peter Zijlstra <[email protected]>
compiler_types: Move unused static inline functions warning to W=2
Yang Shi <[email protected]>
arm64: kprobes: check the return value of set_memory_rox()
Jouni Högander <[email protected]>
drm/xe: Do clean shutdown also when using flr
Tejas Upadhyay <[email protected]>
drm/xe: Move declarations under conditional branch
Balasubramani Vivekanandan <[email protected]>
drm/xe/guc: Synchronize Dead CT worker with unbind
Mario Limonciello <[email protected]>
drm/amd: Fix suspend failure with secure display TA
Jason Gunthorpe <[email protected]>
iommufd: Make vfio_compat's unmap succeed if the range is already empty
Shuhao Fu <[email protected]>
smb: client: fix refcount leak in smb2_set_path_attr
Umesh Nerlige Ramappa <[email protected]>
drm/i915: Fix conversion between clock ticks and nanoseconds
Janusz Krzysztofik <[email protected]>
drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
Jason-JH Lin <[email protected]>
drm/mediatek: Add pm_runtime support for GCE power control
-------------
Diffstat:
Makefile | 4 +- .../boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 +- arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 +- arch/arm/crypto/Kconfig | 2 +- arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 + arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3588j.dtsi | 2 +- arch/arm64/kernel/probes/kprobes.c | 5 +- arch/loongarch/include/asm/hw_breakpoint.h | 4 +- arch/loongarch/include/asm/pgtable.h | 11 +- arch/loongarch/kernel/traps.c | 4 +- arch/loongarch/kvm/timer.c | 2 + arch/loongarch/kvm/vcpu.c | 5 + arch/riscv/Makefile | 2 +- arch/riscv/kernel/cpu-hotplug.c | 1 + arch/riscv/kernel/setup.c | 7 +- arch/x86/kernel/acpi/cppc.c | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 1 + arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/vmx/common.h | 34 ++ arch/x86/kvm/vmx/vmx.c | 25 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/numa/hmat.c | 46 +- drivers/acpi/numa/srat.c | 2 +- drivers/bluetooth/btusb.c | 13 +- drivers/crypto/hisilicon/qm.c | 2 + drivers/edac/altera_edac.c | 22 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 12 + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 - drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 12 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 + drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 +- drivers/gpu/drm/i915/i915_vma.c | 16 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 + drivers/gpu/drm/xe/xe_device.c | 14 +- drivers/gpu/drm/xe/xe_guc_ct.c | 3 + drivers/hid/hid-ids.h | 4 + drivers/hid/hid-logitech-hidpp.c | 21 + drivers/hid/hid-nintendo.c | 2 +- drivers/hid/hid-ntrig.c | 7 +- drivers/hid/hid-playstation.c | 2 + drivers/hid/hid-quirks.c | 2 + drivers/hid/hid-uclogic-params.c | 4 +- drivers/iommu/iommufd/io_pagetable.c | 12 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/irqchip/irq-riscv-intc.c | 3 +- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +- drivers/mmc/host/dw_mmc-rockchip.c | 4 +- drivers/mmc/host/sdhci-of-dwcmshc.c | 2 +- drivers/mtd/nand/onenand/onenand_samsung.c | 2 +- drivers/net/dsa/sja1105/sja1105_static_config.c | 6 +- drivers/net/ethernet/freescale/fec_main.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 33 +- drivers/net/ethernet/ti/am65-cpsw-qos.c | 53 ++- drivers/net/phy/mdio_bus.c | 5 +- drivers/net/phy/micrel.c | 515 +++++++++++++-------- drivers/net/virtio_net.c | 16 +- drivers/net/wireless/ath/ath11k/pci.c | 2 + drivers/net/wireless/ath/ath11k/wmi.c | 3 + drivers/pmdomain/arm/scmi_pm_domain.c | 13 +- drivers/pmdomain/imx/gpc.c | 2 + drivers/pmdomain/samsung/exynos-pm-domains.c | 11 +- drivers/regulator/fixed.c | 1 + drivers/spi/spi.c | 10 + drivers/uio/uio_hv_generic.c | 32 +- fs/btrfs/inode.c | 4 +- fs/btrfs/scrub.c | 2 + fs/btrfs/tree-log.c | 2 +- fs/btrfs/zoned.c | 4 +- fs/erofs/decompressor_zstd.c | 11 +- fs/exfat/namei.c | 6 +- fs/ext4/inode.c | 5 + fs/ext4/xattr.c | 32 +- fs/ext4/xattr.h | 10 + fs/f2fs/compress.c | 2 +- fs/fuse/virtio_fs.c | 2 +- fs/hostfs/hostfs_kern.c | 29 +- fs/namespace.c | 32 +- fs/nfs/dir.c | 23 +- fs/nfs/inode.c | 18 +- fs/nfs/nfs3client.c | 14 +- fs/nfs/nfs4client.c | 15 +- fs/nfs/nfs4proc.c | 22 +- fs/nfs/pnfs_nfs.c | 34 +- fs/nfs/sysfs.c | 1 + fs/nfs/write.c | 3 +- fs/nfsd/nfs4state.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/nfsd.h | 1 + fs/nfsd/nfsfh.c | 6 +- fs/nilfs2/segment.c | 7 +- fs/proc/base.c | 12 +- fs/proc/generic.c | 12 +- fs/proc/task_mmu.c | 8 +- fs/proc/task_nommu.c | 4 +- fs/smb/client/fs_context.c | 2 + fs/smb/client/smb2inode.c | 2 + fs/smb/client/transport.c | 2 +- fs/smb/server/smb2pdu.c | 2 + fs/smb/server/transport_tcp.c | 5 +- include/linux/compiler_types.h | 5 +- include/linux/filter.h | 20 + include/linux/huge_mm.h | 21 +- include/linux/kvm_host.h | 7 +- include/linux/map_benchmark.h | 1 + include/linux/netpoll.h | 1 + include/linux/nfs_xdr.h | 1 + include/net/bluetooth/mgmt.h | 2 +- include/net/cfg80211.h | 78 ++++ include/net/tc_act/tc_connmark.h | 1 + include/uapi/linux/mount.h | 2 +- io_uring/napi.c | 19 +- kernel/bpf/trampoline.c | 5 - kernel/bpf/verifier.c | 6 +- kernel/crash_core.c | 2 +- kernel/gcov/gcc_4_7.c | 4 +- kernel/power/swap.c | 17 +- kernel/sched/ext.c | 4 +- kernel/trace/ftrace.c | 20 +- mm/filemap.c | 20 +- mm/huge_memory.c | 32 +- mm/ksm.c | 113 ++++- mm/memory.c | 23 +- mm/mm_init.c | 2 +- mm/percpu.c | 8 +- mm/secretmem.c | 2 +- mm/shmem.c | 9 +- mm/slub.c | 6 +- mm/truncate.c | 27 +- net/bluetooth/6lowpan.c | 103 +++-- net/bluetooth/l2cap_core.c | 1 + net/bluetooth/mgmt.c | 260 ++++++++--- net/bluetooth/mgmt_util.c | 46 ++ net/bluetooth/mgmt_util.h | 3 + net/core/netpoll.c | 56 ++- net/handshake/tlshd.c | 1 + net/hsr/hsr_device.c | 3 + net/ipv4/route.c | 5 + net/mac80211/chan.c | 2 +- net/mac80211/ieee80211_i.h | 4 +- net/mac80211/iface.c | 14 +- net/mac80211/link.c | 4 +- net/mac80211/mlme.c | 18 +- net/mac80211/rx.c | 10 +- net/mptcp/protocol.c | 36 +- net/netfilter/nf_tables_api.c | 66 ++- net/sched/act_bpf.c | 6 +- net/sched/act_connmark.c | 30 +- net/sched/act_ife.c | 12 +- net/sched/cls_bpf.c | 6 +- net/sched/sch_generic.c | 17 +- net/sctp/transport.c | 13 +- net/smc/smc_clc.c | 1 + net/strparser/strparser.c | 2 +- net/tipc/net.c | 2 + net/unix/garbage.c | 14 +- net/wireless/core.c | 56 +++ net/wireless/trace.h | 21 + rust/Makefile | 16 +- sound/pci/hda/hda_component.c | 4 + sound/soc/codecs/cs4271.c | 10 +- sound/soc/codecs/lpass-va-macro.c | 2 +- sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/tas2781-i2c.c | 9 +- sound/usb/endpoint.c | 5 + sound/usb/mixer.c | 2 + .../ftrace/test.d/filter/event-filter-function.tc | 4 + tools/testing/selftests/iommu/iommufd.c | 2 + .../selftests/net/forwarding/local_termination.sh | 2 + tools/testing/selftests/net/mptcp/mptcp_connect.c | 18 +- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 90 ++-- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 21 + tools/testing/selftests/user_events/perf_test.c | 2 +- virt/kvm/guest_memfd.c | 89 ++-- 182 files changed, 2094 insertions(+), 912 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/185 drm/mediatek: Add pm_runtime support for GCE power control
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit afcfb6c8474d9e750880aaa77952cc588f859613 ]
Call pm_runtime_resume_and_get() before accessing GCE hardware in mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the cmdq callback to release the PM reference and start autosuspend for GCE. This ensures correct power management for the GCE device.
--- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/mediatek/mtk_crtc.c +7 -0
@@ -283,6 +283,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)unsigned int i;unsigned long flags; +/* release GCE HW usage and start autosuspend */ +pm_runtime_mark_last_busy (cmdq_cl->chan->mbox->dev); +pm_runtime_put_autosuspend (cmdq_cl->chan->mbox->dev); +if (data->sta <0 )return ;
@@ -618,6 +622,9 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank) mtk_crtc->config_updating = false;spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); +if (pm_runtime_resume_and_get (mtk_crtc->cmdq_client.chan->mbox->dev) <0 ) + goto update_config_out; +mbox_send_message (mtk_crtc->cmdq_client.chan, cmdq_handle);mbox_client_txdone (mtk_crtc->cmdq_client.chan,0 ); goto update_config_out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/185 drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <[email protected]>
[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
On completion of i915_vma_pin_ww(), a synchronous variant of dma_fence_work_commit() is called. When pinning a VMA to GGTT address space on a Cherry View family processor, or on a Broxton generation SoC with VTD enabled, i.e., when stop_machine() is then called from intel_ggtt_bind_vma(), that can potentially lead to lock inversion among reservation_ww and cpu_hotplug locks.
[86.861179] ======================================================
[86.861193] WARNING: possible circular locking dependency detected
[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
[86.861226] ------------------------------------------------------
[86.861238] i915_module_loa/1432 is trying to acquire lock:
[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
[86.861290]
but task is already holding lock:
[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.862233]
which lock already depends on the new lock.
[86.862251]
the existing dependency chain (in reverse order) is:
[86.862265]
-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
[86.862292] dma_resv_lockdep+0x19a/0x390
[86.862315] do_one_initcall+0x60/0x3f0
[86.862334] kernel_init_freeable+0x3cd/0x680
[86.862353] kernel_init+0x1b/0x200
[86.862369] ret_from_fork+0x47/0x70
[86.862383] ret_from_fork_asm+0x1a/0x30
[86.862399]
-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
[86.862425] dma_resv_lockdep+0x178/0x390
[86.862440] do_one_initcall+0x60/0x3f0
[86.862454] kernel_init_freeable+0x3cd/0x680
[86.862470] kernel_init+0x1b/0x200
[86.862482] ret_from_fork+0x47/0x70
[86.862495] ret_from_fork_asm+0x1a/0x30
[86.862509]
-> #3 (&mm->mmap_lock){++++}-{3:3}:
[86.862531] down_read_killable+0x46/0x1e0
[86.862546] lock_mm_and_find_vma+0xa2/0x280
[86.862561] do_user_addr_fault+0x266/0x8e0
[86.862578] exc_page_fault+0x8a/0x2f0
[86.862593] asm_exc_page_fault+0x27/0x30
[86.862607] filldir64+0xeb/0x180
[86.862620] kernfs_fop_readdir+0x118/0x480
[86.862635] iterate_dir+0xcf/0x2b0
[86.862648] __x64_sys_getdents64+0x84/0x140
[86.862661] x64_sys_call+0x1058/0x2660
[86.862675] do_syscall_64+0x91/0xe90
[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.862703]
-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
[86.862725] down_write+0x3e/0xf0
[86.862738] kernfs_add_one+0x30/0x3c0
[86.862751] kernfs_create_dir_ns+0x53/0xb0
[86.862765] internal_create_group+0x134/0x4c0
[86.862779] sysfs_create_group+0x13/0x20
[86.862792] topology_add_dev+0x1d/0x30
[86.862806] cpuhp_invoke_callback+0x4b5/0x850
[86.862822] cpuhp_issue_call+0xbf/0x1f0
[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
[86.862852] __cpuhp_setup_state+0xb0/0x220
[86.862866] topology_sysfs_init+0x30/0x50
[86.862879] do_one_initcall+0x60/0x3f0
[86.862893] kernel_init_freeable+0x3cd/0x680
[86.862908] kernel_init+0x1b/0x200
[86.862921] ret_from_fork+0x47/0x70
[86.862934] ret_from_fork_asm+0x1a/0x30
[86.862947]
-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
[86.862969] __mutex_lock+0xaa/0xed0
[86.862982] mutex_lock_nested+0x1b/0x30
[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
[86.863012] __cpuhp_setup_state+0xb0/0x220
[86.863026] page_alloc_init_cpuhp+0x2d/0x60
[86.863041] mm_core_init+0x22/0x2d0
[86.863054] start_kernel+0x576/0xbd0
[86.863068] x86_64_start_reservations+0x18/0x30
[86.863084] x86_64_start_kernel+0xbf/0x110
[86.863098] common_startup_64+0x13e/0x141
[86.863114]
-> #0 (cpu_hotplug_lock){++++}-{0:0}:
[86.863135] __lock_acquire+0x1635/0x2810
[86.863152] lock_acquire+0xc4/0x2f0
[86.863166] cpus_read_lock+0x41/0x100
[86.863180] stop_machine+0x1c/0x50
[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
[86.864735] __vma_bind+0x55/0x70 [i915]
[86.865510] fence_work+0x26/0xa0 [i915]
[86.866248] fence_notify+0xa1/0x140 [i915]
[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
[86.870001] initial_plane_vma+0x307/0x840 [i915]
[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
[86.873057] i915_pci_probe+0xe6/0x220 [i915]
[86.873782] local_pci_probe+0x47/0xb0
[86.873802] pci_device_probe+0xf3/0x260
[86.873817] really_probe+0xf1/0x3c0
[86.873833] __driver_probe_device+0x8c/0x180
[86.873848] driver_probe_device+0x24/0xd0
[86.873862] __driver_attach+0x10f/0x220
[86.873876] bus_for_each_dev+0x7f/0xe0
[86.873892] driver_attach+0x1e/0x30
[86.873904] bus_add_driver+0x151/0x290
[86.873917] driver_register+0x5e/0x130
[86.873931] __pci_register_driver+0x7d/0x90
[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
[86.874678] i915_init+0x37/0x120 [i915]
[86.875347] do_one_initcall+0x60/0x3f0
[86.875369] do_init_module+0x97/0x2a0
[86.875385] load_module+0x2c54/0x2d80
[86.875398] init_module_from_file+0x96/0xe0
[86.875413] idempotent_init_module+0x117/0x330
[86.875426] __x64_sys_finit_module+0x77/0x100
[86.875440] x64_sys_call+0x24de/0x2660
[86.875454] do_syscall_64+0x91/0xe90
[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.875486]
other info that might help us debug this:
[86.875502] Chain exists of:
cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
[86.875539] Possible unsafe locking scenario:
[86.875552] CPU0 CPU1
[86.875563] ---- ----
[86.875573] lock(reservation_ww_class_mutex);
[86.875588] lock(reservation_ww_class_acquire);
[86.875606] lock(reservation_ww_class_mutex);
[86.875624] rlock(cpu_hotplug_lock);
[86.875637]
*** DEADLOCK ***
[86.875650] 3 locks held by i915_module_loa/1432:
[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.877305]
stack backtrace:
[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
[86.877334] Tainted: [U]=USER
[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
[86.877339] Call Trace:
[86.877344] <TASK>
[86.877353] dump_stack_lvl+0x91/0xf0
[86.877364] dump_stack+0x10/0x20
[86.877369] print_circular_bug+0x285/0x360
[86.877379] check_noncircular+0x135/0x150
[86.877390] __lock_acquire+0x1635/0x2810
[86.877403] lock_acquire+0xc4/0x2f0
[86.877408] ? stop_machine+0x1c/0x50
[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
[86.878173] cpus_read_lock+0x41/0x100
[86.878182] ? stop_machine+0x1c/0x50
[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
[86.878916] stop_machine+0x1c/0x50
[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
[86.880375] __vma_bind+0x55/0x70 [i915]
[86.881133] fence_work+0x26/0xa0 [i915]
[86.881851] fence_notify+0xa1/0x140 [i915]
[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
[86.886281] initial_plane_vma+0x307/0x840 [i915]
[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
[86.889293] ? mutex_unlock+0x12/0x20
[86.889301] ? drm_privacy_screen_get+0x171/0x190
[86.889308] ? acpi_dev_found+0x66/0x80
[86.889321] i915_pci_probe+0xe6/0x220 [i915]
[86.890038] local_pci_probe+0x47/0xb0
[86.890049] pci_device_probe+0xf3/0x260
[86.890058] really_probe+0xf1/0x3c0
[86.890067] __driver_probe_device+0x8c/0x180
[86.890072] driver_probe_device+0x24/0xd0
[86.890078] __driver_attach+0x10f/0x220
[86.890083] ? __pfx___driver_attach+0x10/0x10
[86.890088] bus_for_each_dev+0x7f/0xe0
[86.890097] driver_attach+0x1e/0x30
[86.890101] bus_add_driver+0x151/0x290
[86.890107] driver_register+0x5e/0x130
[86.890113] __pci_register_driver+0x7d/0x90
[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
[86.890833] i915_init+0x37/0x120 [i915]
[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
[86.892135] do_one_initcall+0x60/0x3f0
[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
[86.892157] do_init_module+0x97/0x2a0
[86.892164] load_module+0x2c54/0x2d80
[86.892168] ? __kernel_read+0x15c/0x300
[86.892185] ? kernel_read_file+0x2b1/0x320
[86.892195] init_module_from_file+0x96/0xe0
[86.892199] ? init_module_from_file+0x96/0xe0
[86.892211] idempotent_init_module+0x117/0x330
[86.892224] __x64_sys_finit_module+0x77/0x100
[86.892230] x64_sys_call+0x24de/0x2660
[86.892236] do_syscall_64+0x91/0xe90
[86.892243] ? irqentry_exit+0x77/0xb0
[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.892261] RIP: 0033:0x7303e1b2725d
[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
[86.892304] </TASK>Call asynchronous variant of dma_fence_work_commit() in that case.
v3: Provide more verbose in-line comment (Andi),
- mention target environments in commit message.
--- drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/i915_vma.c +14 -2
@@ -1595,8 +1595,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, err_vma_res:i915_vma_resource_free (vma_res); err_fence: -if (work) -dma_fence_work_commit_imm (&work->base); +if (work) { +/* +* When pinning VMA to GGTT on CHV or BXT with VTD enabled, +* commit VMA binding asynchronously to avoid risk of lock +* inversion among reservation_ww locks held here and +* cpu_hotplug_lock acquired from stop_machine(), which we +* wrap around GGTT updates when running in those environments. +*/ +if (i915_vma_is_ggtt (vma) && +intel_vm_no_concurrent_access_wa (vma->vm->i915)) +dma_fence_work_commit (&work->base); +else +dma_fence_work_commit_imm (&work->base); + } err_rpm:intel_runtime_pm_put (&vma->vm->i915->runtime_pm, wakeref);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/185 drm/i915: Fix conversion between clock ticks and nanoseconds
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umesh Nerlige Ramappa <[email protected]>
[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ]
When tick values are large, the multiplication by NSEC_PER_SEC is larger than 64 bits and results in bad conversions.
The issue is seen in PMU busyness counters that look like they have wrapped around due to bad conversion. i915 PMU implementation returns monotonically increasing counters. If a count is lesser than previous one, it will only return the larger value until the smaller value catches up. The user will see this as zero delta between two measurements even though the engines are busy.
Fix it by using mul_u64_u32_div()
--- drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +2 -2
@@ -209,7 +209,7 @@ static u64 div_u64_roundup(u64 nom, u32 den)u64 intel_gt_clock_interval_to_ns (const struct intel_gt *gt,u64 count) { -return div_u64_roundup (count *NSEC_PER_SEC , gt->clock_frequency); +return mul_u64_u32_div (count,NSEC_PER_SEC , gt->clock_frequency); }u64 intel_gt_pm_interval_to_ns (const struct intel_gt *gt,u64 count)
@@ -219,7 +219,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)u64 intel_gt_ns_to_clock_interval (const struct intel_gt *gt,u64 ns) { -return div_u64_roundup (gt->clock_frequency * ns,NSEC_PER_SEC ); +return mul_u64_u32_div (ns, gt->clock_frequency,NSEC_PER_SEC ); }u64 intel_gt_ns_to_pm_interval (const struct intel_gt *gt,u64 ns)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/185 smb: client: fix refcount leak in smb2_set_path_attr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ]
Fix refcount leak in smb2_set_path_attr when path conversion fails.
Function cifs_get_writable_path returns cfile with its reference counter cfile->count increased on success. Function smb2_compound_op would decrease the reference counter for cfile, as stated in its comment. By calling smb2_rename_path, the reference counter of cfile would leak if cifs_convert_path_to_utf16 fails in smb2_set_path_attr.
--- fs/smb/client/smb2inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/smb/client/smb2inode.c +2 -0
@@ -1132,6 +1132,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, smb2_to_name =cifs_convert_path_to_utf16 (to_name, cifs_sb);if (smb2_to_name ==NULL ) { rc = -ENOMEM ; +if (cfile) +cifsFileInfo_put (cfile); goto smb2_rename_path; } in_iov.iov_base = smb2_to_name;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/185 iommufd: Make vfio_compats unmap succeed if the range is already empty
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ]
iommufd returns ENOENT when attempting to unmap a range that is already empty, while vfio type1 returns success. Fix vfio_compat to match.
--- drivers/iommu/iommufd/io_pagetable.c | 12 +++--------- drivers/iommu/iommufd/ioas.c | 4 ++++ tools/testing/selftests/iommu/iommufd.c | 2 ++ 3 files changed, 9 insertions(+), 9 deletions(-)
drivers/iommu/iommufd/io_pagetable.c +3 -9
@@ -660,7 +660,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,struct iopt_area *area;unsigned long unmapped_bytes =0 ;unsigned int tries =0 ; -int rc = -ENOENT ; +/* If there are no mapped entries then success */ +int rc =0 ;/* * The domains_rwsem must be held in read mode any time any area->pages
@@ -724,8 +725,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,down_write (&iopt->iova_rwsem); } -if (unmapped_bytes) - rc =0 ; out_unlock_iova:up_write (&iopt->iova_rwsem);
@@ -762,13 +761,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova,int iopt_unmap_all (struct io_pagetable *iopt,unsigned long *unmapped) { -int rc; - - rc =iopt_unmap_iova_range (iopt,0 ,ULONG_MAX , unmapped);/* If the IOVAs are empty then unmap all succeeds */ -if (rc == -ENOENT ) -return 0 ; -return rc; +return iopt_unmap_iova_range (iopt,0 ,ULONG_MAX , unmapped); }/* The caller must always free all the nodes in the allowed_iova rb_root. */
drivers/iommu/iommufd/ioas.c +4 -0
@@ -317,6 +317,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd) &unmapped);if (rc) goto out_put; +if (!unmapped) { + rc = -ENOENT ; + goto out_put; + } } cmd->length = unmapped;
tools/testing/selftests/iommu/iommufd.c +2 -0
@@ -2329,6 +2329,8 @@ TEST_F(vfio_compat_mock_domain, map)ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_MAP_DMA , &map_cmd));ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_UNMAP_DMA , &unmap_cmd));ASSERT_EQ (BUFFER_SIZE , unmap_cmd.size); +/* Unmap of empty is success */ +ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_UNMAP_DMA , &unmap_cmd));/* UNMAP_FLAG_ALL requires 0 iova/size */ ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_MAP_DMA , &map_cmd));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/185 drm/amd: Fix suspend failure with secure display TA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ]
commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded successfully") attempted to fix extra messages, but failed to port the cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable secure display TA multiple times") to prevent multiple tries.
Add that to the failure handling path even on a quick failure.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +4 -1
@@ -2174,8 +2174,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp)if (!ret && !psp->securedisplay_context.context.resp_status) { psp->securedisplay_context.context.initialized = true;mutex_init (&psp->securedisplay_context.mutex); - }else + }else { +/* don't try again */ + psp->securedisplay_context.context.bin_desc.size_bytes =0 ;return ret; + }mutex_lock (&psp->securedisplay_context.mutex);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/185 drm/xe/guc: Synchronize Dead CT worker with unbind
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balasubramani Vivekanandan <[email protected]>
[ Upstream commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea ]
Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation.
--- drivers/gpu/drm/xe/xe_guc_ct.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xe/xe_guc_ct.c +3 -0
@@ -188,6 +188,9 @@ static void guc_ct_fini(struct drm_device *drm, void *arg) {struct xe_guc_ct *ct = arg; +#if IS_ENABLED (CONFIG_DRM_XE_DEBUG ) +cancel_work_sync (&ct->dead.worker); +#endif ct_exit_safe_mode (ct);destroy_workqueue (ct->g2h_wq);xa_destroy (&ct->fence_lookup);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/185 drm/xe: Move declarations under conditional branch
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejas Upadhyay <[email protected]>
[ Upstream commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 ]
The xe_device_shutdown() function was needing a few declarations that were only required under a specific condition. This change moves those declarations to be within that conditional branch to avoid unnecessary declarations.
Stable-dep-of: b11a020d914c ("drm/xe: Do clean shutdown also when using flr")
--- drivers/gpu/drm/xe/xe_device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/xe/xe_device.c +3 -3
@@ -809,12 +809,12 @@ void xe_device_remove(struct xe_device *xe)void xe_device_shutdown (struct xe_device *xe) { -struct xe_gt *gt; -u8 id; -drm_dbg (&xe->drm,"Shutting down device\n" );if (xe_driver_flr_disabled (xe)) { +struct xe_gt *gt; +u8 id; +xe_display_pm_shutdown (xe);xe_irq_suspend (xe);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/185 drm/xe: Do clean shutdown also when using flr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Högander <[email protected]>
[ Upstream commit b11a020d914c3b7628f56a9ea476a5b03679489b ]
Currently Xe driver is triggering flr without any clean-up on shutdown. This is causing random warnings from pending related works as the underlying hardware is reset in the middle of their execution.
Fix this by performing clean shutdown also when using flr.
--- drivers/gpu/drm/xe/xe_device.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/gpu/drm/xe/xe_device.c +9 -9
@@ -809,21 +809,21 @@ void xe_device_remove(struct xe_device *xe)void xe_device_shutdown (struct xe_device *xe) { +struct xe_gt *gt; +u8 id; +drm_dbg (&xe->drm,"Shutting down device\n" ); -if (xe_driver_flr_disabled (xe)) { -struct xe_gt *gt; -u8 id; +xe_display_pm_shutdown (xe); -xe_display_pm_shutdown (xe); +xe_irq_suspend (xe); -xe_irq_suspend (xe); +for_each_gt (gt, xe, id) +xe_gt_shutdown (gt); -for_each_gt (gt, xe, id) -xe_gt_shutdown (gt); +xe_display_pm_shutdown_late (xe); -xe_display_pm_shutdown_late (xe); - }else { +if (!xe_driver_flr_disabled (xe)) {/* BOOM! */ __xe_driver_flr (xe); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/185 arm64: kprobes: check the return value of set_memory_rox()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
[ Upstream commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c ]
Since commit a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full"), __change_memory_common has more chance to fail due to memory allocation failure when splitting page table. So check the return value of set_memory_rox(), then bail out if it fails otherwise we may have RW memory mapping for kprobes insn page.
--- arch/arm64/kernel/probes/kprobes.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/arm64/kernel/probes/kprobes.c +4 -1
@@ -49,7 +49,10 @@ void *alloc_insn_page(void) addr =execmem_alloc (EXECMEM_KPROBES ,PAGE_SIZE );if (!addr)return NULL ; -set_memory_rox ((unsigned long )addr,1 ); +if (set_memory_rox ((unsigned long )addr,1 )) { +execmem_free (addr); +return NULL ; + }return addr; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/185 compiler_types: Move unused static inline functions warning to W=2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
Per Nathan, clang catches unused "static inline" functions in C files since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build").
Quoted 8 lines · Linus
So I entirely ignore W=1 issues, because I think so many of the extra warnings are bogus.
But if this one in particular is causing more problems than most - some teams do seem to use W=1 as part of their test builds - it's fine to send me a patch that just moves bad warnings to W=2.
And if anybody uses W=2 for their test builds, that's THEIR problem..
Here is the change to bump the warning from W=1 to W=2.
--- include/linux/compiler_types.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/compiler_types.h +2 -3
@@ -250,10 +250,9 @@ struct ftrace_likely_data {/* * GCC does not warn about unused static inline functions for -Wunused-function. * Suppress the warning in clang as well by using __maybe_unused, but enable it -* for W=1 build. This will allow clang to find unused functions. Remove the -* __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. +* for W=2 build. This will allow clang to find unused functions. */ -#ifdef KBUILD_EXTRA_WARN1 +#ifdef KBUILD_EXTRA_WARN2 #define __inline_maybe_unused#else #define __inline_maybe_unused __maybe_unused
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/185 riscv: Build loader.bin exclusively for Canaan K210
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Jiang <[email protected]>
[ Upstream commit 3ad1b71fdc5707d14332d9ae710a237de936be9b ]
According to the explanation in commit ef10bdf9c3e6 ("riscv:Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"), loader.bin is a special feature of the Canaan K210 and is not applicable to other SoCs.
--- arch/riscv/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/Makefile +1 -1
@@ -161,7 +161,7 @@ boot-image-$(CONFIG_KERNEL_LZO) := Image.lzo boot-image-$(CONFIG_KERNEL_ZSTD) := Image.zst boot-image-$(CONFIG_KERNEL_XZ) := Image.xz ifdef CONFIG_RISCV_M_MODE -boot-image-$(CONFIG_ARCH_CANAAN) := loader.bin +boot-image-$(CONFIG_SOC_CANAAN_K210) := loader.bin endif boot-image-$(CONFIG_EFI_ZBOOT) := vmlinuz.efi boot-image-$(CONFIG_XIP_KERNEL) := xipImage
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/185 RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danil Skrebenkov <[email protected]>
[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
openSBI v1.7 adds harts checks for ipi operations. Especially it adds comparison between hmask passed as an argument from linux and mask of online harts (from openSBI side). If they don't fit each other the error occurs.
When cpu is offline, cpu_online_mask is explicitly cleared in __cpu_disable. However, there is no explicit clearing of mm_cpumask. mm_cpumask is used for rfence operations that call openSBI RFENCE extension which uses ipi to remote harts. If hart is offline there may be error if mask of linux is not as mask of online harts in openSBI.
this patch adds explicit clearing of mm_cpumask for offline hart.
--- arch/riscv/kernel/cpu-hotplug.c | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kernel/cpu-hotplug.c +1 -0
@@ -54,6 +54,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu)pr_notice ("CPU%u: off\n" , cpu); +clear_tasks_mm_cpumask (cpu);/* Verify from the firmware if the cpu is really stopped*/ if (cpu_ops->cpu_is_stopped) ret = cpu_ops->cpu_is_stopped (cpu);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/185 riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Gao <[email protected]>
[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ]
Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose to boot from acpi then disable FDT"), let's not do DT hardware probing if ACPI is enabled in early boot. This avoids errors caused by repeated driver probing.
--- arch/riscv/kernel/setup.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/riscv/kernel/setup.c +5 -2
@@ -298,11 +298,14 @@ void __init setup_arch(char **cmdline_p)/* Parse the ACPI tables for possible boot-time configuration */ acpi_boot_table_init (); +if (acpi_disabled) {#if IS_ENABLED (CONFIG_BUILTIN_DTB ) -unflatten_and_copy_device_tree (); +unflatten_and_copy_device_tree ();#else -unflatten_device_tree (); +unflatten_device_tree ();#endif + } +misc_mem_init ();init_resources ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/185 drm/amdgpu: remove two invalid BUG_ON()s
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 ]
Those can be triggered trivially by userspace.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 -- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 -- 2 files changed, 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +0 -2
@@ -5632,8 +5632,6 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,unsigned vmid =AMDGPU_JOB_GET_VMID (job);u32 header, control =0 ; -BUG_ON (ib->flags &AMDGPU_IB_FLAG_CE ); - header =PACKET3 (PACKET3_INDIRECT_BUFFER ,2 ); control |= ib->length_dw | (vmid <<24 );
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +0 -2
@@ -4330,8 +4330,6 @@ static void gfx_v12_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,unsigned vmid =AMDGPU_JOB_GET_VMID (job);u32 header, control =0 ; -BUG_ON (ib->flags &AMDGPU_IB_FLAG_CE ); - header =PACKET3 (PACKET3_INDIRECT_BUFFER ,2 ); control |= ib->length_dw | (vmid <<24 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/185 drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ]
On various SI GPUs, a flickering can be observed near the bottom edge of the screen when using a single 4K 60Hz monitor over DP. Disabling MCLK switching works around this problem.
--- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +5 -0
@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,* for these GPUs to calculate bandwidth requirements. */ if (high_pixelclock_count) { +/* Work around flickering lines at the bottom edge +* of the screen when using a single 4K 60Hz monitor. +*/ + disable_mclk_switching = true; +/* On Oland, we observe some flickering when two 4K 60Hz * displays are connected, possibly because voltage is too low. * Raise the voltage by requiring a higher SCLK.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/185 drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 33cc891b56b93cad1a83263eaf2e417436f70c82 ]
Otherwise accessing them can cause a crash.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +3 -0
@@ -234,6 +234,9 @@ static umode_t amdgpu_vram_attrs_is_visible(struct kobject *kobj, !adev->gmc.vram_vendor)return 0 ; +if (!ttm_resource_manager_used (&adev->mman.vram_mgr.manager)) +return 0 ; +return attr->mode; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/185 drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse.Zhang <[email protected]>
[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ]
Previously, APU platforms (and other scenarios with uninitialized VRAM managers) triggered a NULL pointer dereference in ttm_resource_manager_usage(). The root cause is not that the struct ttm_resource_manager *man pointer itself is NULL, but that man->bdev (the backing device pointer within the manager) remains uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully set up VRAM manager structures. When ttm_resource_manager_usage() attempts to acquire man->bdev->lru_lock, it dereferences the NULL man->bdev, leading to a kernel OOPS.
1. **amdgpu_cs.c**: Extend the existing bandwidth control check in amdgpu_cs_get_threshold_for_moves() to include a check for ttm_resource_manager_used(). If the manager is not used (uninitialized bdev), return 0 for migration thresholds immediately—skipping VRAM-specific logic that would trigger the NULL dereference.
2. **amdgpu_kms.c**: Update the AMDGPU_INFO_VRAM_USAGE ioctl and memory info reporting to use a conditional: if the manager is used, return the real VRAM usage; otherwise, return 0. This avoids accessing man->bdev when it is NULL.
3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) data write path. Use ttm_resource_manager_used() to check validity: if the manager is usable, calculate fb_usage from VRAM usage; otherwise, set fb_usage to 0 (APUs have no discrete framebuffer to report).
This approach is more robust than APU-specific checks because it:
- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
- Aligns with TTM's design by using its native helper function,
- Preserves correct behavior for discrete GPUs (which have fully initialized man->bdev and pass the ttm_resource_manager_used() check).
v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++-- 3 files changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +1 -1
@@ -691,7 +691,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,*/ const s64 us_upper_bound =200000 ; -if (!adev->mm_stats.log2_max_MBps) { +if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used (&adev->mman.vram_mgr.manager)) { *max_bytes =0 ; *max_vis_bytes =0 ;return ;
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +4 -3
@@ -707,7 +707,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) ui64 =atomic64_read (&adev->num_vram_cpu_page_faults);return copy_to_user (out, &ui64,min (size,8u )) ? -EFAULT :0 ;case AMDGPU_INFO_VRAM_USAGE : - ui64 =ttm_resource_manager_usage (&adev->mman.vram_mgr.manager); + ui64 =ttm_resource_manager_used (&adev->mman.vram_mgr.manager) ? +ttm_resource_manager_usage (&adev->mman.vram_mgr.manager) :0 ;return copy_to_user (out, &ui64,min (size,8u )) ? -EFAULT :0 ;case AMDGPU_INFO_VIS_VRAM_USAGE : ui64 =amdgpu_vram_mgr_vis_usage (&adev->mman.vram_mgr);
@@ -753,8 +754,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) mem.vram.usable_heap_size = adev->gmc.real_vram_size -atomic64_read (&adev->vram_pin_size) -AMDGPU_VM_RESERVED_VRAM ; - mem.vram.heap_usage = -ttm_resource_manager_usage (vram_man); + mem.vram.heap_usage =ttm_resource_manager_used (&adev->mman.vram_mgr.manager) ? +ttm_resource_manager_usage (vram_man) :0 ; mem.vram.max_allocation = mem.vram.usable_heap_size *3 /4 ; mem.cpu_accessible_vram.total_heap_size =
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +2 -2
@@ -595,8 +595,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) vf2pf_info->driver_cert =0 ; vf2pf_info->os_info.all =0 ; - vf2pf_info->fb_usage = -ttm_resource_manager_usage (&adev->mman.vram_mgr.manager) >>20 ; + vf2pf_info->fb_usage =ttm_resource_manager_used (&adev->mman.vram_mgr.manager) ? +ttm_resource_manager_usage (&adev->mman.vram_mgr.manager) >>20 :0 ; vf2pf_info->fb_vis_usage =amdgpu_vram_mgr_vis_usage (&adev->mman.vram_mgr) >>20 ; vf2pf_info->fb_size = adev->gmc.real_vram_size >>20 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/185 NFS4: Fix state renewals missing after boot
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <[email protected]>
[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
Since the last renewal time was initialized to 0 and jiffies start counting at -5 minutes, any clients connected in the first 5 minutes after a reboot would have their renewal timer set to a very long interval. If the connection was idle, this would result in the client state timing out on the server and the next call to the server would return NFS4ERR_BADSESSION.
Fix this by initializing the last renewal time to the current jiffies instead of 0.
--- fs/nfs/nfs4client.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/nfs4client.c +1 -0
@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) clp->cl_state =1 <<NFS4CLNT_LEASE_EXPIRED ; clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; clp->cl_mig_gen =1 ; + clp->cl_last_renewal = jiffies;#if IS_ENABLED (CONFIG_NFS_V4_1 )init_waitqueue_head (&clp->cl_lock_waitq);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/185 NFS4: Apply delay_retrans to async operations
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <[email protected]>
[ Upstream commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 ]
The setting of delay_retrans is applied to synchronous RPC operations because the retransmit count is stored in same struct nfs4_exception that is passed each time an error is checked. However, for asynchronous operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct nfs4_exception is made on the stack each time the task callback is invoked. This means that the retransmit count is always zero and thus delay_retrans never takes effect.
Apply delay_retrans to these operations by tracking and updating their retransmit count.
--- fs/nfs/nfs4proc.c | 13 +++++++++++++ include/linux/nfs_xdr.h | 1 + 2 files changed, 14 insertions(+)
fs/nfs/nfs4proc.c +13 -0
@@ -3612,6 +3612,7 @@ struct nfs4_closedata { } lr;struct nfs_fattr fattr;unsigned long timestamp; +unsigned short retrans; };static void nfs4_free_closedata (void *data)
@@ -3640,6 +3641,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) .state = state, .inode = calldata->inode, .stateid = &calldata->arg.stateid, + .retrans = calldata->retrans, };if (!nfs4_sequence_done (task, &calldata->res.seq_res))
@@ -3687,6 +3689,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)default : task->tk_status =nfs4_async_handle_exception (task, server, task->tk_status, &exception); + calldata->retrans = exception.retrans;if (exception.retry) goto out_restart; }
@@ -5546,9 +5549,11 @@ static int nfs4_read_done_cb(struct rpc_task *task, struct nfs_pgio_header *hdr) .inode = hdr->inode, .state = hdr->args.context->state, .stateid = &hdr->args.stateid, + .retrans = hdr->retrans, }; task->tk_status =nfs4_async_handle_exception (task, server, task->tk_status, &exception); + hdr->retrans = exception.retrans;if (exception.retry) {rpc_restart_call_prepare (task);return -EAGAIN ;
@@ -5662,10 +5667,12 @@ static int nfs4_write_done_cb(struct rpc_task *task, .inode = hdr->inode, .state = hdr->args.context->state, .stateid = &hdr->args.stateid, + .retrans = hdr->retrans, }; task->tk_status =nfs4_async_handle_exception (task,NFS_SERVER (inode), task->tk_status, &exception); + hdr->retrans = exception.retrans;if (exception.retry) {rpc_restart_call_prepare (task);return -EAGAIN ;
@@ -6677,6 +6684,7 @@ struct nfs4_delegreturndata {struct nfs_fh fh;nfs4_stateid stateid;unsigned long timestamp; +unsigned short retrans;struct {struct nfs4_layoutreturn_args arg;struct nfs4_layoutreturn_res res;
@@ -6697,6 +6705,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) .inode = data->inode, .stateid = &data->stateid, .task_is_privileged = data->args.seq_args.sa_privileged, + .retrans = data->retrans, };if (!nfs4_sequence_done (task, &data->res.seq_res))
@@ -6768,6 +6777,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) task->tk_status =nfs4_async_handle_exception (task, data->res.server, task->tk_status, &exception); + data->retrans = exception.retrans;if (exception.retry) goto out_restart; }
@@ -7044,6 +7054,7 @@ struct nfs4_unlockdata {struct file_lock fl;struct nfs_server *server;unsigned long timestamp; +unsigned short retrans; }; static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
@@ -7098,6 +7109,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)struct nfs4_exception exception = { .inode = calldata->lsp->ls_state->inode, .stateid = &calldata->arg.stateid, + .retrans = calldata->retrans, };if (!nfs4_sequence_done (task, &calldata->res.seq_res))
@@ -7131,6 +7143,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) task->tk_status =nfs4_async_handle_exception (task, calldata->server, task->tk_status, &exception); + calldata->retrans = exception.retrans;if (exception.retry)rpc_restart_call_prepare (task); }
include/linux/nfs_xdr.h +1 -0
@@ -1660,6 +1660,7 @@ struct nfs_pgio_header {void *netfs;#endif +unsigned short retrans;int pnfs_error;int error;/* merge with pnfs_error */ unsigned int good_bytes;/* boundary of good data */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/185 HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Lobb <[email protected]>
[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
The Cooler Master Mice Dongle includes a vendor defined HID interface alongside its mouse interface. Not polling it will cause the mouse to stop responding to polls on any interface once woken up again after going into power saving mode.
Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and the Dongle's PID.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -338,6 +338,9 @@#define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500#define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff +#define USB_VENDOR_ID_COOLER_MASTER 0x2516 +#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 +#define USB_VENDOR_ID_CORSAIR 0x1b1c#define USB_DEVICE_ID_CORSAIR_K90 0x1b02#define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
drivers/hid/hid-quirks.c +1 -0
@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/185 HID: nintendo: Wait longer for initial probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vicki Pfau <[email protected]>
[ Upstream commit b73bc6a51f0c0066912c7e181acee41091c70fe6 ]
Some third-party controllers, such as the PB Tails CHOC, won't always respond quickly on startup. Since this packet is needed for probe, and only once during probe, let's just wait an extra second, which makes connecting consistent.
--- drivers/hid/hid-nintendo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-nintendo.c +1 -1
@@ -2424,7 +2424,7 @@ static int joycon_read_info(struct joycon_ctlr *ctlr)struct joycon_input_report *report; req.subcmd_id =JC_SUBCMD_REQ_DEV_INFO ; - ret =joycon_send_subcmd (ctlr, &req,0 ,HZ ); + ret =joycon_send_subcmd (ctlr, &req,0 ,2 *HZ );if (ret) {hid_err (ctlr->hdev,"Failed to get joycon info; ret=%d\n" , ret);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/185 NFS: check if suid/sgid was cleared after a write as needed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <[email protected]>
[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
I noticed xfstests generic/193 and generic/355 started failing against knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE").
I ran those same tests against ONTAP (which has had write delegation support for a lot longer than knfsd) and they fail there too... so while it's a new failure against knfsd, it isn't an entirely new failure.
Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation doesn't keep the inode from being revalidated to fetch the updated mode.
--- fs/nfs/write.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/write.c +2 -1
@@ -1577,7 +1577,8 @@ static int nfs_writeback_done(struct rpc_task *task,/* Deal with the suid/sgid bit corner case */ if (nfs_should_remove_suid (inode)) {spin_lock (&inode->i_lock); -nfs_set_cache_invalid (inode,NFS_INO_INVALID_MODE ); +nfs_set_cache_invalid (inode,NFS_INO_INVALID_MODE + |NFS_INO_REVAL_FORCED );spin_unlock (&inode->i_lock); }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/185 HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Makarenko <[email protected]>
[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ]
This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick. This device reboots itself every 8-10 seconds if it is not polled.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -1420,6 +1420,7 @@#define USB_VENDOR_ID_VRS 0x0483#define USB_DEVICE_ID_VRS_DFP 0xa355 +#define USB_DEVICE_ID_VRS_R295 0xa44c#define USB_VENDOR_ID_VTL 0x0306#define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f
drivers/hid/hid-quirks.c +1 -0
@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/185 exfat: fix improper check of dentry.stream.valid_size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaehun Gou <[email protected]>
[ Upstream commit 82ebecdc74ff555daf70b811d854b1f32a296bea ]
We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the kernel to hang.
Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue.
This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability.
--- fs/exfat/namei.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/exfat/namei.c +5 -1
@@ -635,10 +635,14 @@ static int exfat_find(struct inode *dir, struct qstr *qname, info->type =exfat_get_entry_type (ep); info->attr =le16_to_cpu (ep->dentry.file.attr); - info->size =le64_to_cpu (ep2->dentry.stream.valid_size); info->valid_size =le64_to_cpu (ep2->dentry.stream.valid_size); info->size =le64_to_cpu (ep2->dentry.stream.size); +if (info->valid_size <0 ) { +exfat_fs_error (sb,"data valid size is invalid(%lld)" , info->valid_size); +return -EIO ; + } +if (unlikely (EXFAT_B_TO_CLU_ROUND_UP (info->size, sbi) > sbi->used_clusters)) {exfat_fs_error (sb,"data size is invalid(%lld)" , info->size);return -EIO ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/185 smb/server: fix possible memory leak in smb2_read()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <[email protected]>
[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ]
Memory leak occurs when ksmbd_vfs_read() fails. Fix this by adding the missing kvfree().
--- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/smb2pdu.c +1 -0
@@ -6782,6 +6782,7 @@ int smb2_read(struct ksmbd_work *work) nbytes =ksmbd_vfs_read (work, fp, length, &offset, aux_payload_buf);if (nbytes <0 ) { +kvfree (aux_payload_buf); err = nbytes; goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/185 smb/server: fix possible refcount leak in smb2_sess_setup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <[email protected]>
[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ]
Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put().
--- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/smb2pdu.c +1 -0
@@ -1798,6 +1798,7 @@ int smb2_sess_setup(struct ksmbd_work *work)if (ksmbd_conn_need_reconnect (conn)) { rc = -EFAULT ; +ksmbd_user_session_put (sess); sess =NULL ; goto out_err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/185 HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayhurst <[email protected]>
[ Upstream commit ed80cc4667ac997b84546e6d35f0a0ae525d239c ]
The Logitech G502 Hero Wireless's high resolution scrolling resets after being unplugged without notifying the driver, causing extremely slow scrolling.
The only indication of this is a battery update packet, so add a quirk to detect when the device is unplugged and re-enable the scrolling.
--- drivers/hid/hid-logitech-hidpp.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/hid/hid-logitech-hidpp.c +21 -0
@@ -75,6 +75,7 @@ MODULE_PARM_DESC(disable_tap_to_click,#define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(27)#define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(28)#define HIDPP_QUIRK_WIRELESS_STATUS BIT(29) +#define HIDPP_QUIRK_RESET_HI_RES_SCROLL BIT(30)/* These are just aliases for now */ #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS
@@ -193,6 +194,7 @@ struct hidpp_device {void *private_data;struct work_struct work; +struct work_struct reset_hi_res_work;struct kfifo delayed_work_fifo;struct input_dev *delayed_input;
@@ -3864,6 +3866,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,struct hidpp_report *answer = hidpp->send_receive_buf;struct hidpp_report *report = (struct hidpp_report *)data;int ret; +int last_online;/* * If the mutex is locked then we have a pending answer from a
@@ -3905,6 +3908,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, "See: https://gitlab.freedesktop.org/jwrdegoede/logitech-27mhz-keyboard-encryption-setup/\n"); } + last_online = hidpp->battery.online;if (hidpp->capabilities &HIDPP_CAPABILITY_HIDPP20_BATTERY ) { ret =hidpp20_battery_event_1000 (hidpp, data, size);if (ret !=0 )
@@ -3929,6 +3933,11 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,return ret; } +if (hidpp->quirks &HIDPP_QUIRK_RESET_HI_RES_SCROLL ) { +if (last_online ==0 && hidpp->battery.online ==1 ) +schedule_work (&hidpp->reset_hi_res_work); + } +if (hidpp->quirks &HIDPP_QUIRK_HIDPP_WHEELS ) { ret =hidpp10_wheel_raw_event (hidpp, data, size);if (ret !=0 )
@@ -4302,6 +4311,13 @@ static void hidpp_connect_event(struct work_struct *work) hidpp->delayed_input = input; } +static void hidpp_reset_hi_res_handler (struct work_struct *work) +{ + struct hidpp_device *hidpp = container_of(work, struct hidpp_device, reset_hi_res_work); + +hi_res_scroll_enable (hidpp); +} + static DEVICE_ATTR(builtin_power_supply, 0000, NULL, NULL);static struct attribute *sysfs_attrs[] = {
@@ -4432,6 +4448,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) }INIT_WORK (&hidpp->work, hidpp_connect_event); +INIT_WORK (&hidpp->reset_hi_res_work, hidpp_reset_hi_res_handler);mutex_init (&hidpp->send_mutex);init_waitqueue_head (&hidpp->wait);
@@ -4527,6 +4544,7 @@ static void hidpp_remove(struct hid_device *hdev)hid_hw_stop (hdev);cancel_work_sync (&hidpp->work); +cancel_work_sync (&hidpp->reset_hi_res_work);mutex_destroy (&hidpp->send_mutex); }
@@ -4574,6 +4592,9 @@ static const struct hid_device_id hidpp_devices[] = { {/* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */ LDJ_DEVICE(0xb30b), .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, + { /* Logitech G502 Lightspeed Wireless Gaming Mouse */ + LDJ_DEVICE(0x407f), + .driver_data = HIDPP_QUIRK_RESET_HI_RES_SCROLL }, { LDJ_DEVICE(HID_ANY_ID) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/185 ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sharique Mohammad <[email protected]>
[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they are turned on or off, the required startup or shutdown sequences must be taken care by the max98090_shdn_event.
--- sound/soc/codecs/max98090.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/codecs/max98090.c +4 -2
@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {SND_SOC_DAPM_INPUT ("DMIC4" ),SND_SOC_DAPM_SUPPLY ("DMIC3_ENA" ,M98090_REG_DIGITAL_MIC_ENABLE , -M98090_DIGMIC3_SHIFT ,0 ,NULL ,0 ), +M98090_DIGMIC3_SHIFT ,0 , max98090_shdn_event, +SND_SOC_DAPM_POST_PMU ),SND_SOC_DAPM_SUPPLY ("DMIC4_ENA" ,M98090_REG_DIGITAL_MIC_ENABLE , - M98090_DIGMIC4_SHIFT, 0, NULL, 0), +M98090_DIGMIC4_SHIFT ,0 , max98090_shdn_event, + SND_SOC_DAPM_POST_PMU), }; static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/185 wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Escande <[email protected]>
[ Upstream commit 9065b968752334f972e0d48e50c4463a172fc2a7 ]
When reporting tx completion using ieee80211_tx_status_xxx() family of functions, the status part of the struct ieee80211_tx_info nested in the skb is used to report things like transmit rates & retry count to mac80211
On the TX data path, this is correctly memset to 0 before calling ieee80211_tx_status_ext(), but on the tx mgmt path this was not done.
This leads to mac80211 treating garbage values as valid transmit counters (like tx retries for example) and accounting them as real statistics that makes their way to userland via station dump.
The same issue was resolved in ath12k by commit 9903c0986f78 ("wifi:
ath12k: Add memset and update default rate value in wmi tx completion")
Tested-on: QCN9074 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/wmi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath11k/wmi.c +3 -0
@@ -5961,6 +5961,9 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar,dma_unmap_single (ar->ab->dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE ); info =IEEE80211_SKB_CB (msdu); +memset (&info->status,0 ,sizeof (info->status)); + info->status.rates[0 ].idx =-1 ; +if ((!(info->flags &IEEE80211_TX_CTL_NO_ACK )) && !tx_compl_param->status) { info->flags |=IEEE80211_TX_STAT_ACK ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/185 erofs: avoid infinite loop due to incomplete zstd-compressed data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit f2a12cc3b97f062186568a7b94ddb7aa2ef68140 ]
Currently, the decompression logic incorrectly spins if compressed data is truncated in crafted (deliberately corrupted) images.
--- fs/erofs/decompressor_zstd.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/erofs/decompressor_zstd.c +7 -4
@@ -178,7 +178,6 @@ static int z_erofs_zstd_decompress(struct z_erofs_decompress_req *rq, dctx.bounce = strm->bounce; do { - dctx.avail_out = out_buf.size - out_buf.pos; dctx.inbuf_sz = in_buf.size; dctx.inbuf_pos = in_buf.pos; err = z_erofs_stream_switch_bufs(&dctx, &out_buf.dst,
@@ -194,14 +193,18 @@ static int z_erofs_zstd_decompress(struct z_erofs_decompress_req *rq, in_buf.pos = dctx.inbuf_pos; zerr =zstd_decompress_stream (stream, &out_buf, &in_buf); -if (zstd_is_error (zerr) || (!zerr && rq->outputsize)) { + dctx.avail_out = out_buf.size - out_buf.pos; +if (zstd_is_error (zerr) || + ((rq->outputsize + dctx.avail_out) && (!zerr || (zerr >0 && + !(rq->inputsize + in_buf.size - in_buf.pos))))) {erofs_err (sb,"failed to decompress in[%u] out[%u]: %s" , rq->inputsize, rq->outputsize, - zerr ?zstd_get_error_name (zerr) :"unexpected end of stream" ); +zstd_is_error (zerr) ?zstd_get_error_name (zerr) : +"unexpected end of stream" ); err = -EFSCORRUPTED ;break ; } - }while (rq->outputsize || out_buf.pos < out_buf.size); + }while (rq->outputsize + dctx.avail_out);if (dctx.kout)kunmap_local (dctx.kout);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/185 selftests: net: local_termination: Wait for interfaces to come up
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
[ Upstream commit 57531b3416448d1ced36a2a974a4085ec43d57b0 ]
It seems that most of the tests prepare the interfaces once before the test run (setup_prepare()), rely on setup_wait() to wait for link and only then run the test(s).
local_termination brings the physical interfaces down and up during test run but never wait for them to come up. If the auto-negotiation takes some seconds, first test packets are being lost, which leads to false-negative test results.
Use setup_wait() in run_test() to make sure auto-negotiation has been completed after all simple_if_init() calls on physical interfaces and test packets will not be lost because of the race against link establishment.
--- tools/testing/selftests/net/forwarding/local_termination.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/local_termination.sh +2 -0
@@ -176,6 +176,8 @@ run_test() local rcv_dmac=$(mac_get $rcv_if_name) local should_receive + setup_wait + tcpdump_start $rcv_if_name mc_route_prepare $send_if_name
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/185 net: fec: correct rx_bytes statistic for the case SHIFT16 is set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit ad17e7e92a7c52ce70bb764813fcf99464f96903 ]
Two additional bytes in front of each frame received into the RX FIFO if SHIFT16 is set, so we need to subtract the extra two bytes from pkt_len to correct the statistic of rx_bytes.
--- drivers/net/ethernet/freescale/fec_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +2 -0
@@ -1799,6 +1799,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id) ndev->stats.rx_packets++; pkt_len =fec16_to_cpu (bdp->cbd_datlen); ndev->stats.rx_bytes += pkt_len; +if (fep->quirks &FEC_QUIRK_HAS_RACC ) + ndev->stats.rx_bytes -=2 ; index =fec_enet_get_bd_index (bdp, &rxq->bd); page = rxq->rx_skb_info[index].page;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/185 net: phy: micrel: Introduce lanphy_modify_page_reg
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit a0de636ed7a264a329c6a9c7d50727af02138536 ]
As the name suggests this function modifies the register in an extended page. It has the same parameters as phy_modify_mmd. This function was introduce because there are many places in the code where the registers was read then the value was modified and written back. So replace all this code with this function to make it clear.
Stable-dep-of: 96a9178a29a6 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface")
--- drivers/net/phy/micrel.c | 231 ++++++++++++++++++++------------------- 1 file changed, 116 insertions(+), 115 deletions(-)
drivers/net/phy/micrel.c +116 -115
@@ -2591,6 +2591,27 @@ static int lanphy_write_page_reg(struct phy_device *phydev, int page, u16 addr,return val; } +static int lanphy_modify_page_reg (struct phy_device *phydev,int page,u16 addr, +u16 mask,u16 set) +{ +int ret; + +phy_lock_mdio_bus (phydev); +__phy_write (phydev,LAN_EXT_PAGE_ACCESS_CONTROL , page); +__phy_write (phydev,LAN_EXT_PAGE_ACCESS_ADDRESS_DATA , addr); +__phy_write (phydev,LAN_EXT_PAGE_ACCESS_CONTROL , + (page |LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC )); + ret =__phy_modify_changed (phydev,LAN_EXT_PAGE_ACCESS_ADDRESS_DATA , + mask, set); +phy_unlock_mdio_bus (phydev); + +if (ret <0 ) +phydev_err (phydev,"__phy_modify_changed() failed: %pe\n" , +ERR_PTR (ret)); + +return ret; +} +static int lan8814_config_ts_intr (struct phy_device *phydev,bool enable) {u16 val =0 ;
@@ -2680,7 +2701,6 @@ static int lan8814_hwtstamp(struct mii_timestamper *mii_ts,struct lan8814_ptp_rx_ts *rx_ts, *tmp;int txcfg =0 , rxcfg =0 ;int pkt_ts_enable; -int tx_mod; ptp_priv->hwts_tx_type = config->tx_type; ptp_priv->rx_filter = config->rx_filter;
@@ -2727,13 +2747,14 @@ static int lan8814_hwtstamp(struct mii_timestamper *mii_ts,lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_TIMESTAMP_EN , pkt_ts_enable);lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_TIMESTAMP_EN , pkt_ts_enable); - tx_mod =lanphy_read_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD );if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) { -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , - tx_mod |PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); +lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ , +PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); }else if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ON ) { -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , - tx_mod & ~PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); +lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ , +0 ); }if (config->rx_filter !=HWTSTAMP_FILTER_NONE )
@@ -3136,73 +3157,66 @@ static void lan8814_ptp_set_reload(struct phy_device *phydev, int event,static void lan8814_ptp_enable_event (struct phy_device *phydev,int event,int pulse_width) { -u16 val; - - val =lanphy_read_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG ); -/* Set the pulse width of the event */ - val &= ~(LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_MASK (event)); -/* Make sure that the target clock will be incremented each time when +/* Set the pulse width of the event, +* Make sure that the target clock will be incremented each time when * local time reaches or pass it +* Set the polarity high */ - val |=LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET (event, pulse_width); - val &= ~(LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event)); -/* Set the polarity high */ - val |=LAN8814_PTP_GENERAL_CONFIG_POLARITY_X (event); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , +LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_MASK (event) | +LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET (event, pulse_width) | +LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event) | +LAN8814_PTP_GENERAL_CONFIG_POLARITY_X (event), +LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET (event, pulse_width) | +LAN8814_PTP_GENERAL_CONFIG_POLARITY_X (event)); }static void lan8814_ptp_disable_event (struct phy_device *phydev,int event) { -u16 val; -/* Set target to too far in the future, effectively disabling it */ lan8814_ptp_set_target (phydev, event,0xFFFFFFFF ,0 );/* And then reload once it recheas the target */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG ); - val |=LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , +LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event), +LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event)); }static void lan8814_ptp_perout_off (struct phy_device *phydev,int pin) { -u16 val; -/* Disable gpio alternate function, * 1: select as gpio, * 0: select alt func */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin)); - val |=LAN8814_GPIO_EN_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +LAN8814_GPIO_EN_BIT (pin), +LAN8814_GPIO_EN_BIT (pin)); - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - val &= ~LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +0 ); - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin)); - val &= ~LAN8814_GPIO_BUF_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +LAN8814_GPIO_BUF_BIT (pin), +0 ); }static void lan8814_ptp_perout_on (struct phy_device *phydev,int pin) { -int val; -/* Set as gpio output */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - val |=LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +LAN8814_GPIO_DIR_BIT (pin));/* Enable gpio 0:for alternate function, 1:gpio */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin)); - val &= ~LAN8814_GPIO_EN_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +LAN8814_GPIO_EN_BIT (pin), +0 );/* Set buffer type to push pull */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin)); - val |=LAN8814_GPIO_BUF_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +LAN8814_GPIO_BUF_BIT (pin), +LAN8814_GPIO_BUF_BIT (pin)); } static int lan8814_ptp_perout(struct ptp_clock_info *ptpci,
@@ -3321,61 +3335,59 @@ static int lan8814_ptp_perout(struct ptp_clock_info *ptpci,static void lan8814_ptp_extts_on (struct phy_device *phydev,int pin,u32 flags) { -u16 tmp; -/* Set as gpio input */ - tmp =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - tmp &= ~LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), tmp); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +0 );/* Map the pin to ltc pin 0 of the capture map registers */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO ); - tmp |= pin; -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , + pin, + pin);/* Enable capture on the edges of the ltc pin */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_EN );if (flags &PTP_RISING_EDGE ) - tmp |=PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ), +PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ));if (flags &PTP_FALLING_EDGE ) - tmp |=PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ), +PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ));/* Enable interrupt top interrupt */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_COMMON_INT_ENA ); - tmp |=PTP_COMMON_INT_ENA_GPIO_CAP_EN ; -lanphy_write_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +PTP_COMMON_INT_ENA_GPIO_CAP_EN , +PTP_COMMON_INT_ENA_GPIO_CAP_EN ); }static void lan8814_ptp_extts_off (struct phy_device *phydev,int pin) { -u16 tmp; -/* Set as gpio out */ - tmp =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - tmp |=LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), tmp); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +LAN8814_GPIO_DIR_BIT (pin));/* Enable alternate, 0:for alternate function, 1:gpio */ - tmp =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin)); - tmp &= ~LAN8814_GPIO_EN_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), tmp); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +LAN8814_GPIO_EN_BIT (pin), +0 );/* Clear the mapping of pin to registers 0 of the capture registers */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO ); - tmp &= ~GENMASK (3 ,0 ); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , +GENMASK (3 ,0 ), +0 );/* Disable capture on both of the edges */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_EN ); - tmp &= ~PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (pin); - tmp &= ~PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (pin); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (pin) | +PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (pin), +0 );/* Disable interrupt top interrupt */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_COMMON_INT_ENA ); - tmp &= ~PTP_COMMON_INT_ENA_GPIO_CAP_EN ; -lanphy_write_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +PTP_COMMON_INT_ENA_GPIO_CAP_EN , +0 ); } static int lan8814_ptp_extts(struct ptp_clock_info *ptpci,
@@ -3620,9 +3632,9 @@ static int lan8814_gpio_process_cap(struct lan8814_shared_priv *shared)/* This is 0 because whatever was the input pin it was mapped it to * ltc gpio pin 0 */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_SEL ); - tmp |=PTP_GPIO_SEL_GPIO_SEL (0 ); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_SEL , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_SEL , +PTP_GPIO_SEL_GPIO_SEL (0 ), +PTP_GPIO_SEL_GPIO_SEL (0 )); tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_STS ); if (!(tmp & PTP_GPIO_CAP_STS_PTP_GPIO_RE_STS(0)) &&
@@ -3669,13 +3681,10 @@ static int lan8814_handle_gpio_interrupt(struct phy_device *phydev, u16 status)static int lan8804_config_init (struct phy_device *phydev) { -int val; -/* MDI-X setting for swap A,B transmit */ - val =lanphy_read_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP ); - val &= ~LAN8804_ALIGN_TX_A_B_SWAP_MASK ; - val |=LAN8804_ALIGN_TX_A_B_SWAP ; -lanphy_write_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP , val); +lanphy_modify_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP , +LAN8804_ALIGN_TX_A_B_SWAP_MASK , +LAN8804_ALIGN_TX_A_B_SWAP );/* Make sure that the PHY will not stop generating the clock when the * link partner goes down
@@ -3817,7 +3826,6 @@ static void lan8814_ptp_init(struct phy_device *phydev) {struct kszphy_priv *priv = phydev->priv;struct kszphy_ptp_priv *ptp_priv = &priv->ptp_priv; -u32 temp;if (!IS_ENABLED (CONFIG_PTP_1588_CLOCK ) || !IS_ENABLED (CONFIG_NETWORK_PHY_TIMESTAMPING ))
@@ -3825,13 +3833,13 @@ static void lan8814_ptp_init(struct phy_device *phydev)lanphy_write_page_reg (phydev,5 ,TSU_HARD_RESET ,TSU_HARD_RESET_ ); - temp =lanphy_read_page_reg (phydev,5 ,PTP_TX_MOD ); - temp |=PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ; -lanphy_write_page_reg (phydev,5 ,PTP_TX_MOD , temp); +lanphy_modify_page_reg (phydev,5 ,PTP_TX_MOD , +PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ , +PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ); - temp =lanphy_read_page_reg (phydev,5 ,PTP_RX_MOD ); - temp |=PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ; -lanphy_write_page_reg (phydev,5 ,PTP_RX_MOD , temp); +lanphy_modify_page_reg (phydev,5 ,PTP_RX_MOD , +PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ , +PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ );lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_CONFIG ,0 );lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_CONFIG ,0 );
@@ -3953,23 +3961,21 @@ static void lan8814_setup_led(struct phy_device *phydev, int val)static int lan8814_config_init (struct phy_device *phydev) {struct kszphy_priv *lan8814 = phydev->priv; -int val;/* Reset the PHY */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET ); - val |=LAN8814_QSGMII_SOFT_RESET_BIT ; -lanphy_write_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET , +LAN8814_QSGMII_SOFT_RESET_BIT , +LAN8814_QSGMII_SOFT_RESET_BIT );/* Disable ANEG with QSGMII PCS Host side */ - val =lanphy_read_page_reg (phydev,5 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG ); - val &= ~LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA ; -lanphy_write_page_reg (phydev,5 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG , +LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA , +0 );/* MDI-X setting for swap A,B transmit */ - val =lanphy_read_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP ); - val &= ~LAN8814_ALIGN_TX_A_B_SWAP_MASK ; - val |=LAN8814_ALIGN_TX_A_B_SWAP ; -lanphy_write_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP , val); +lanphy_modify_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP , +LAN8814_ALIGN_TX_A_B_SWAP_MASK , +LAN8814_ALIGN_TX_A_B_SWAP );if (lan8814->led_mode >=0 )lan8814_setup_led (phydev, lan8814->led_mode);
@@ -4000,29 +4006,24 @@ static int lan8814_release_coma_mode(struct phy_device *phydev)static void lan8814_clear_2psp_bit (struct phy_device *phydev) { -u16 val; -/* It was noticed that when traffic is passing through the PHY and the * cable is removed then the LED was still one even though there is no * link */ - val =lanphy_read_page_reg (phydev,2 ,LAN8814_EEE_STATE ); - val &= ~LAN8814_EEE_STATE_MASK2P5P ; -lanphy_write_page_reg (phydev,2 ,LAN8814_EEE_STATE , val); +lanphy_modify_page_reg (phydev,2 ,LAN8814_EEE_STATE , +LAN8814_EEE_STATE_MASK2P5P , +0 ); }static void lan8814_update_meas_time (struct phy_device *phydev) { -u16 val; -/* By setting the measure time to a value of 0xb this will allow cables * longer than 100m to be used. This configuration can be used * regardless of the mode of operation of the PHY */ - val =lanphy_read_page_reg (phydev,1 ,LAN8814_PD_CONTROLS ); - val &= ~LAN8814_PD_CONTROLS_PD_MEAS_TIME_MASK ; - val |=LAN8814_PD_CONTROLS_PD_MEAS_TIME_VAL ; -lanphy_write_page_reg (phydev,1 ,LAN8814_PD_CONTROLS , val); +lanphy_modify_page_reg (phydev,1 ,LAN8814_PD_CONTROLS , +LAN8814_PD_CONTROLS_PD_MEAS_TIME_MASK , +LAN8814_PD_CONTROLS_PD_MEAS_TIME_VAL ); }static int lan8814_probe (struct phy_device *phydev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/185 net: phy: micrel: Replace hardcoded pages with defines
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit d471793a9b67bbe3d7198ff695004190fd7b6bc7 ]
The functions lan_*_page_reg gets as a second parameter the page where the register is. In all the functions the page was hardcoded. Replace the hardcoded values with defines to make it more clear what are those parameters.
Stable-dep-of: 96a9178a29a6 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface")
--- drivers/net/phy/micrel.c | 342 ++++++++++++++++++++++++++------------- 1 file changed, 233 insertions(+), 109 deletions(-)
drivers/net/phy/micrel.c +233 -109
@@ -2541,6 +2541,52 @@ static int ksz886x_cable_test_get_status(struct phy_device *phydev,return ret; } +/** +* LAN8814_PAGE_AFE_PMA - Selects Extended Page 1. +* +* This page appears to control the Analog Front-End (AFE) and Physical +* Medium Attachment (PMA) layers. It is used to access registers like +* LAN8814_PD_CONTROLS and LAN8814_LINK_QUALITY. +*/ +#define LAN8814_PAGE_AFE_PMA 1 + +/** +* LAN8814_PAGE_PCS_DIGITAL - Selects Extended Page 2. +* +* This page seems dedicated to the Physical Coding Sublayer (PCS) and other +* digital logic. It is used for MDI-X alignment (LAN8814_ALIGN_SWAP) and EEE +* state (LAN8814_EEE_STATE) in the LAN8814, and is repurposed for statistics +* and self-test counters in the LAN8842. +*/ +#define LAN8814_PAGE_PCS_DIGITAL 2 + +/** +* LAN8814_PAGE_COMMON_REGS - Selects Extended Page 4. +* +* This page contains device-common registers that affect the entire chip. +* It includes controls for chip-level resets, strap status, GPIO, +* QSGMII, the shared 1588 PTP block, and the PVT monitor. +*/ +#define LAN8814_PAGE_COMMON_REGS 4 + +/** +* LAN8814_PAGE_PORT_REGS - Selects Extended Page 5. +* +* This page contains port-specific registers that must be accessed +* on a per-port basis. It includes controls for port LEDs, QSGMII PCS, +* rate adaptation FIFOs, and the per-port 1588 TSU block. +*/ +#define LAN8814_PAGE_PORT_REGS 5 + +/** +* LAN8814_PAGE_SYSTEM_CTRL - Selects Extended Page 31. +* +* This page appears to hold fundamental system or global controls. In the +* driver, it is used by the related LAN8804 to access the +* LAN8814_CLOCK_MANAGEMENT register. +*/ +#define LAN8814_PAGE_SYSTEM_CTRL 31 +#define LAN_EXT_PAGE_ACCESS_CONTROL 0x16#define LAN_EXT_PAGE_ACCESS_ADDRESS_DATA 0x17#define LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC 0x4000
@@ -2622,35 +2668,46 @@ static int lan8814_config_ts_intr(struct phy_device *phydev, bool enable)PTP_TSU_INT_EN_PTP_RX_TS_EN_ |PTP_TSU_INT_EN_PTP_RX_TS_OVRFL_EN_ ; -return lanphy_write_page_reg (phydev,5 ,PTP_TSU_INT_EN , val); +return lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TSU_INT_EN , val); }static void lan8814_ptp_rx_ts_get (struct phy_device *phydev,u32 *seconds,u32 *nano_seconds,u16 *seq_id) { - *seconds =lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_SEC_HI ); + *seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_SEC_HI ); *seconds = (*seconds <<16 ) | -lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_SEC_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_SEC_LO ); - *nano_seconds =lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_NS_HI ); + *nano_seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_NS_HI ); *nano_seconds = ((*nano_seconds &0x3fff ) <<16 ) | -lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_NS_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_NS_LO ); - *seq_id =lanphy_read_page_reg (phydev,5 ,PTP_RX_MSG_HEADER2 ); + *seq_id =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_MSG_HEADER2 ); }static void lan8814_ptp_tx_ts_get (struct phy_device *phydev,u32 *seconds,u32 *nano_seconds,u16 *seq_id) { - *seconds =lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_SEC_HI ); + *seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_SEC_HI ); *seconds = *seconds <<16 | -lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_SEC_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_SEC_LO ); - *nano_seconds =lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_NS_HI ); + *nano_seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_NS_HI ); *nano_seconds = ((*nano_seconds &0x3fff ) <<16 ) | -lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_NS_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_NS_LO ); - *seq_id =lanphy_read_page_reg (phydev,5 ,PTP_TX_MSG_HEADER2 ); + *seq_id =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_MSG_HEADER2 ); }static int lan8814_ts_info (struct mii_timestamper *mii_ts,struct kernel_ethtool_ts_info *info)
@@ -2685,11 +2742,11 @@ static void lan8814_flush_fifo(struct phy_device *phydev, bool egress)int i;for (i =0 ; i <FIFO_SIZE ; ++i) -lanphy_read_page_reg (phydev,5 , +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , egress ?PTP_TX_MSG_HEADER2 :PTP_RX_MSG_HEADER2 );/* Read to clear overflow status bit */ -lanphy_read_page_reg (phydev,5 ,PTP_TSU_INT_STS ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_TSU_INT_STS ); } static int lan8814_hwtstamp(struct mii_timestamper *mii_ts,
@@ -2739,20 +2796,26 @@ static int lan8814_hwtstamp(struct mii_timestamper *mii_ts, rxcfg |=PTP_RX_PARSE_CONFIG_IPV4_EN_ |PTP_RX_PARSE_CONFIG_IPV6_EN_ ; txcfg |=PTP_TX_PARSE_CONFIG_IPV4_EN_ |PTP_TX_PARSE_CONFIG_IPV6_EN_ ; } -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_PARSE_CONFIG , rxcfg); -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_PARSE_CONFIG , txcfg); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_CONFIG , rxcfg); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_CONFIG , txcfg); pkt_ts_enable =PTP_TIMESTAMP_EN_SYNC_ |PTP_TIMESTAMP_EN_DREQ_ |PTP_TIMESTAMP_EN_PDREQ_ |PTP_TIMESTAMP_EN_PDRES_ ; -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_TIMESTAMP_EN , pkt_ts_enable); -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_TIMESTAMP_EN , pkt_ts_enable); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_TIMESTAMP_EN , pkt_ts_enable); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_TIMESTAMP_EN , pkt_ts_enable);if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) { -lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +lanphy_modify_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_MOD ,PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ,PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); }else if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ON ) { -lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +lanphy_modify_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_MOD ,PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ,0 ); }
@@ -2876,29 +2939,41 @@ static bool lan8814_rxtstamp(struct mii_timestamper *mii_ts, struct sk_buff *skbstatic void lan8814_ptp_clock_set (struct phy_device *phydev,time64_t sec,u32 nsec) { -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_SEC_LO ,lower_16_bits (sec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_SEC_MID ,upper_16_bits (sec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_SEC_HI ,upper_32_bits (sec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_NS_LO ,lower_16_bits (nsec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_NS_HI ,upper_16_bits (nsec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_SEC_LO ,lower_16_bits (sec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_SEC_MID ,upper_16_bits (sec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_SEC_HI ,upper_32_bits (sec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_NS_LO ,lower_16_bits (nsec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_NS_HI ,upper_16_bits (nsec)); -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_CLOCK_LOAD_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL , +PTP_CMD_CTL_PTP_CLOCK_LOAD_ ); }static void lan8814_ptp_clock_get (struct phy_device *phydev,time64_t *sec,u32 *nsec) { -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_CLOCK_READ_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL , +PTP_CMD_CTL_PTP_CLOCK_READ_ ); - *sec =lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_SEC_HI ); + *sec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_SEC_HI ); *sec <<=16 ; - *sec |=lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_SEC_MID ); + *sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_SEC_MID ); *sec <<=16 ; - *sec |=lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_SEC_LO ); + *sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_SEC_LO ); - *nsec =lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_NS_HI ); + *nsec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_NS_HI ); *nsec <<=16 ; - *nsec |=lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_NS_LO ); + *nsec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_NS_LO ); } static int lan8814_ptpci_gettime64(struct ptp_clock_info *ptpci,
@@ -2937,14 +3012,18 @@ static void lan8814_ptp_set_target(struct phy_device *phydev, int event, s64 start_sec, u32 start_nsec) {/* Set the start time */ - lanphy_write_page_reg(phydev, 4, LAN8814_PTP_CLOCK_TARGET_SEC_LO(event), +lanphy_write_page_reg (phydev ,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_SEC_LO (event ),lower_16_bits (start_sec )); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_CLOCK_TARGET_SEC_HI (event), +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_SEC_HI (event),upper_16_bits (start_sec)); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_CLOCK_TARGET_NS_LO (event), +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_NS_LO (event),lower_16_bits (start_nsec)); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_CLOCK_TARGET_NS_HI (event), +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_NS_HI (event),upper_16_bits (start_nsec) &0x3fff ); }
@@ -3042,9 +3121,11 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, adjustment_value_lo = adjustment_value &0xffff ; adjustment_value_hi = (adjustment_value >>16 ) &0x3fff ; -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_LO , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_LO , adjustment_value_lo); -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_HI , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_HI ,PTP_LTC_STEP_ADJ_DIR_ | adjustment_value_hi); seconds -= ((s32 )adjustment_value);
@@ -3062,9 +3143,11 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, adjustment_value_lo = adjustment_value &0xffff ; adjustment_value_hi = (adjustment_value >>16 ) &0x3fff ; -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_LO , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_LO , adjustment_value_lo); -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_HI , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_HI , adjustment_value_hi); seconds += ((s32 )adjustment_value);
@@ -3072,8 +3155,8 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, set_seconds += adjustment_value;lan8814_ptp_update_target (phydev, set_seconds); } -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL , -PTP_CMD_CTL_PTP_LTC_STEP_SEC_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CMD_CTL ,PTP_CMD_CTL_PTP_LTC_STEP_SEC_ ); }if (nano_seconds) {u16 nano_seconds_lo;
@@ -3082,12 +3165,14 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, nano_seconds_lo = nano_seconds &0xffff ; nano_seconds_hi = (nano_seconds >>16 ) &0x3fff ; -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_LO , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_LO , nano_seconds_lo); -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_HI , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_HI ,PTP_LTC_STEP_ADJ_DIR_ | nano_seconds_hi); -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_LTC_STEP_NSEC_ ); } }
@@ -3129,8 +3214,10 @@ static int lan8814_ptpci_adjfine(struct ptp_clock_info *ptpci, long scaled_ppm) kszphy_rate_adj_hi |=PTP_CLOCK_RATE_ADJ_DIR_ ;mutex_lock (&shared->shared_lock); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_RATE_ADJ_HI , kszphy_rate_adj_hi); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_RATE_ADJ_LO , kszphy_rate_adj_lo); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CLOCK_RATE_ADJ_HI , + kszphy_rate_adj_hi); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CLOCK_RATE_ADJ_LO , + kszphy_rate_adj_lo);mutex_unlock (&shared->shared_lock);return 0 ;
@@ -3139,17 +3226,17 @@ static int lan8814_ptpci_adjfine(struct ptp_clock_info *ptpci, long scaled_ppm)static void lan8814_ptp_set_reload (struct phy_device *phydev,int event,s64 period_sec,u32 period_nsec) { -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_SEC_LO (event),lower_16_bits (period_sec)); -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_SEC_HI (event),upper_16_bits (period_sec)); -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_NS_LO (event),lower_16_bits (period_nsec)); -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_NS_HI (event),upper_16_bits (period_nsec) &0x3fff ); }
@@ -3162,7 +3249,7 @@ static void lan8814_ptp_enable_event(struct phy_device *phydev, int event,* local time reaches or pass it * Set the polarity high */ - lanphy_modify_page_reg(phydev, 4, LAN8814_PTP_GENERAL_CONFIG, + lanphy_modify_page_reg(phydev, LAN8814_PAGE_COMMON_REGS, LAN8814_PTP_GENERAL_CONFIG, LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_MASK(event) | LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET(event, pulse_width) | LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X(event) |
@@ -3177,7 +3264,7 @@ static void lan8814_ptp_disable_event(struct phy_device *phydev, int event)lan8814_ptp_set_target (phydev, event,0xFFFFFFFF ,0 );/* And then reload once it recheas the target */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_GENERAL_CONFIG ,LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event),LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event)); }
@@ -3188,15 +3275,18 @@ static void lan8814_ptp_perout_off(struct phy_device *phydev, int pin)* 1: select as gpio, * 0: select alt func */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_EN_ADDR (pin),LAN8814_GPIO_EN_BIT (pin),LAN8814_GPIO_EN_BIT (pin)); -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),0 ); -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_BUF_ADDR (pin),LAN8814_GPIO_BUF_BIT (pin),0 ); }
@@ -3204,17 +3294,20 @@ static void lan8814_ptp_perout_off(struct phy_device *phydev, int pin)static void lan8814_ptp_perout_on (struct phy_device *phydev,int pin) {/* Set as gpio output */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),LAN8814_GPIO_DIR_BIT (pin));/* Enable gpio 0:for alternate function, 1:gpio */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_EN_ADDR (pin),LAN8814_GPIO_EN_BIT (pin),0 );/* Set buffer type to push pull */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_BUF_ADDR (pin),LAN8814_GPIO_BUF_BIT (pin),LAN8814_GPIO_BUF_BIT (pin)); }
@@ -3336,27 +3429,29 @@ static int lan8814_ptp_perout(struct ptp_clock_info *ptpci,static void lan8814_ptp_extts_on (struct phy_device *phydev,int pin,u32 flags) {/* Set as gpio input */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),0 );/* Map the pin to ltc pin 0 of the capture map registers */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , - pin, - pin); +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_MAP_LO , pin, pin);/* Enable capture on the edges of the ltc pin */ if (flags &PTP_RISING_EDGE ) -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_EN ,PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ),PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ));if (flags &PTP_FALLING_EDGE ) -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_EN ,PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ),PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ));/* Enable interrupt top interrupt */ -lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_COMMON_INT_ENA ,PTP_COMMON_INT_ENA_GPIO_CAP_EN ,PTP_COMMON_INT_ENA_GPIO_CAP_EN ); }
@@ -3364,28 +3459,31 @@ static void lan8814_ptp_extts_on(struct phy_device *phydev, int pin, u32 flags)static void lan8814_ptp_extts_off (struct phy_device *phydev,int pin) {/* Set as gpio out */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),LAN8814_GPIO_DIR_BIT (pin));/* Enable alternate, 0:for alternate function, 1:gpio */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_EN_ADDR (pin),LAN8814_GPIO_EN_BIT (pin),0 );/* Clear the mapping of pin to registers 0 of the capture registers */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_MAP_LO ,GENMASK (3 ,0 ),0 );/* Disable capture on both of the edges */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_GPIO_CAP_EN ,PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (pin) |PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (pin),0 );/* Disable interrupt top interrupt */ -lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_COMMON_INT_ENA ,PTP_COMMON_INT_ENA_GPIO_CAP_EN ,0 ); }
@@ -3522,7 +3620,8 @@ static void lan8814_get_tx_ts(struct kszphy_ptp_priv *ptp_priv)/* If other timestamps are available in the FIFO, * process them. */ - reg =lanphy_read_page_reg (phydev,5 ,PTP_CAP_INFO ); + reg =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_CAP_INFO ); }while (PTP_CAP_INFO_TX_TS_CNT_GET_ (reg) >0 ); }
@@ -3595,7 +3694,8 @@ static void lan8814_get_rx_ts(struct kszphy_ptp_priv *ptp_priv)/* If other timestamps are available in the FIFO, * process them. */ - reg =lanphy_read_page_reg (phydev,5 ,PTP_CAP_INFO ); + reg =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_CAP_INFO ); }while (PTP_CAP_INFO_RX_TS_CNT_GET_ (reg) >0 ); }
@@ -3632,31 +3732,40 @@ static int lan8814_gpio_process_cap(struct lan8814_shared_priv *shared)/* This is 0 because whatever was the input pin it was mapped it to * ltc gpio pin 0 */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_SEL , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_GPIO_SEL ,PTP_GPIO_SEL_GPIO_SEL (0 ),PTP_GPIO_SEL_GPIO_SEL (0 )); - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_STS ); + tmp =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_STS );if (!(tmp &PTP_GPIO_CAP_STS_PTP_GPIO_RE_STS (0 )) && !(tmp &PTP_GPIO_CAP_STS_PTP_GPIO_FE_STS (0 )))return -1 ;if (tmp &BIT (0 )) { - sec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_SEC_HI_CAP ); + sec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_SEC_HI_CAP ); sec <<=16 ; - sec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_SEC_LO_CAP ); + sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_SEC_LO_CAP ); - nsec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_NS_HI_CAP ) &0x3fff ; + nsec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_NS_HI_CAP ) &0x3fff ; nsec <<=16 ; - nsec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_NS_LO_CAP ); + nsec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_NS_LO_CAP ); }else { - sec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_FE_LTC_SEC_HI_CAP ); + sec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_FE_LTC_SEC_HI_CAP ); sec <<=16 ; - sec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_FE_LTC_SEC_LO_CAP ); + sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_FE_LTC_SEC_LO_CAP ); - nsec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_FE_LTC_NS_HI_CAP ) &0x3fff ; + nsec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_FE_LTC_NS_HI_CAP ) &0x3fff ; nsec <<=16 ; - nsec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_NS_LO_CAP ); + nsec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_NS_LO_CAP ); } ptp_event.index =0 ;
@@ -3682,15 +3791,16 @@ static int lan8814_handle_gpio_interrupt(struct phy_device *phydev, u16 status)static int lan8804_config_init (struct phy_device *phydev) {/* MDI-X setting for swap A,B transmit */ -lanphy_modify_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PCS_DIGITAL ,LAN8804_ALIGN_SWAP ,LAN8804_ALIGN_TX_A_B_SWAP_MASK ,LAN8804_ALIGN_TX_A_B_SWAP );/* Make sure that the PHY will not stop generating the clock when the * link partner goes down */ -lanphy_write_page_reg (phydev,31 ,LAN8814_CLOCK_MANAGEMENT ,0x27e ); -lanphy_read_page_reg (phydev,1 ,LAN8814_LINK_QUALITY ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_SYSTEM_CTRL , +LAN8814_CLOCK_MANAGEMENT ,0x27e ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_AFE_PMA ,LAN8814_LINK_QUALITY );return 0 ; }
@@ -3772,7 +3882,8 @@ static irqreturn_t lan8814_handle_interrupt(struct phy_device *phydev) }while (true) { - irq_status =lanphy_read_page_reg (phydev,5 ,PTP_TSU_INT_STS ); + irq_status =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TSU_INT_STS );if (!irq_status)break ;
@@ -3800,7 +3911,7 @@ static int lan8814_config_intr(struct phy_device *phydev) {int err; -lanphy_write_page_reg (phydev,4 ,LAN8814_INTR_CTRL_REG , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_INTR_CTRL_REG ,LAN8814_INTR_CTRL_REG_POLARITY |LAN8814_INTR_CTRL_REG_INTR_ENABLE );
@@ -3831,29 +3942,36 @@ static void lan8814_ptp_init(struct phy_device *phydev) !IS_ENABLED(CONFIG_NETWORK_PHY_TIMESTAMPING)) return; -lanphy_write_page_reg (phydev,5 ,TSU_HARD_RESET ,TSU_HARD_RESET_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +TSU_HARD_RESET ,TSU_HARD_RESET_ ); -lanphy_modify_page_reg (phydev,5 ,PTP_TX_MOD , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_TX_MOD ,PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ,PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ); -lanphy_modify_page_reg (phydev,5 ,PTP_RX_MOD , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_RX_MOD ,PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ,PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ); -lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_CONFIG ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_CONFIG ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_CONFIG ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_CONFIG ,0 );/* Removing default registers configs related to L2 and IP */ -lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_L2_ADDR_EN ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_L2_ADDR_EN ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_IP_ADDR_EN ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_IP_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_L2_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_L2_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_IP_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_IP_ADDR_EN ,0 );/* Disable checking for minorVersionPTP field */ -lanphy_write_page_reg (phydev,5 ,PTP_RX_VERSION , +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_RX_VERSION ,PTP_MAX_VERSION (0xff ) |PTP_MIN_VERSION (0x0 )); -lanphy_write_page_reg (phydev,5 ,PTP_TX_VERSION , +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_TX_VERSION ,PTP_MAX_VERSION (0xff ) |PTP_MIN_VERSION (0x0 ));skb_queue_head_init (&ptp_priv->tx_queue);
@@ -3934,12 +4052,14 @@ static int lan8814_ptp_probe_once(struct phy_device *phydev)/* The EP.4 is shared between all the PHYs in the package and also it * can be accessed by any of the PHYs */ -lanphy_write_page_reg (phydev,4 ,LTC_HARD_RESET ,LTC_HARD_RESET_ ); -lanphy_write_page_reg (phydev,4 ,PTP_OPERATING_MODE , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LTC_HARD_RESET ,LTC_HARD_RESET_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_OPERATING_MODE ,PTP_OPERATING_MODE_STANDALONE_ );/* Enable ptp to run LTC clock for ptp and gpio 1PPS operation */ -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_ENABLE_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL , +PTP_CMD_CTL_PTP_ENABLE_ );return 0 ; }
@@ -3948,14 +4068,16 @@ static void lan8814_setup_led(struct phy_device *phydev, int val) {int temp; - temp =lanphy_read_page_reg (phydev,5 ,LAN8814_LED_CTRL_1 ); + temp =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +LAN8814_LED_CTRL_1 );if (val) temp |=LAN8814_LED_CTRL_1_KSZ9031_LED_MODE_ ;else temp &= ~LAN8814_LED_CTRL_1_KSZ9031_LED_MODE_ ; -lanphy_write_page_reg (phydev,5 ,LAN8814_LED_CTRL_1 , temp); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +LAN8814_LED_CTRL_1 , temp); }static int lan8814_config_init (struct phy_device *phydev)
@@ -3963,17 +4085,19 @@ static int lan8814_config_init(struct phy_device *phydev)struct kszphy_priv *lan8814 = phydev->priv;/* Reset the PHY */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_QSGMII_SOFT_RESET ,LAN8814_QSGMII_SOFT_RESET_BIT ,LAN8814_QSGMII_SOFT_RESET_BIT );/* Disable ANEG with QSGMII PCS Host side */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_QSGMII_PCS1G_ANEG_CONFIG ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA ,0 );/* MDI-X setting for swap A,B transmit */ -lanphy_modify_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PCS_DIGITAL ,LAN8814_ALIGN_SWAP ,LAN8814_ALIGN_TX_A_B_SWAP_MASK ,LAN8814_ALIGN_TX_A_B_SWAP );
@@ -4010,7 +4134,7 @@ static void lan8814_clear_2psp_bit(struct phy_device *phydev)* cable is removed then the LED was still one even though there is no * link */ -lanphy_modify_page_reg (phydev,2 ,LAN8814_EEE_STATE , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PCS_DIGITAL ,LAN8814_EEE_STATE ,LAN8814_EEE_STATE_MASK2P5P ,0 ); }
@@ -4021,7 +4145,7 @@ static void lan8814_update_meas_time(struct phy_device *phydev)* longer than 100m to be used. This configuration can be used * regardless of the mode of operation of the PHY */ -lanphy_modify_page_reg (phydev,1 ,LAN8814_PD_CONTROLS , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_AFE_PMA ,LAN8814_PD_CONTROLS ,LAN8814_PD_CONTROLS_PD_MEAS_TIME_MASK ,LAN8814_PD_CONTROLS_PD_MEAS_TIME_VAL ); }
@@ -4046,7 +4170,7 @@ static int lan8814_probe(struct phy_device *phydev)/* Strap-in value for PHY address, below register read gives starting * phy address value */ - addr =lanphy_read_page_reg (phydev,4 ,0 ) &0x1F ; + addr =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,0 ) &0x1F ;devm_phy_package_join (&phydev->mdio.dev, phydev, addr,sizeof (struct lan8814_shared_priv ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/185 net: phy: micrel: lan8814 fix reset of the QSGMII interface
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 96a9178a29a6b84bb632ebeb4e84cf61191c73d5 ]
The lan8814 is a quad-phy and it is using QSGMII towards the MAC. The problem is that everytime when one of the ports is configured then the PCS is reseted for all the PHYs. Meaning that the other ports can loose traffic until the link is establish again.
To fix this, do the reset one time for the entire PHY package.
--- drivers/net/phy/micrel.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/phy/micrel.c +6 -6
@@ -4084,12 +4084,6 @@ static int lan8814_config_init(struct phy_device *phydev) {struct kszphy_priv *lan8814 = phydev->priv; -/* Reset the PHY */ -lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , -LAN8814_QSGMII_SOFT_RESET , -LAN8814_QSGMII_SOFT_RESET_BIT , -LAN8814_QSGMII_SOFT_RESET_BIT ); -/* Disable ANEG with QSGMII PCS Host side */ lanphy_modify_page_reg(phydev, LAN8814_PAGE_COMMON_REGS, LAN8814_QSGMII_PCS1G_ANEG_CONFIG,
@@ -4175,6 +4169,12 @@ static int lan8814_probe(struct phy_device *phydev) addr, sizeof(struct lan8814_shared_priv));if (phy_package_init_once (phydev)) { +/* Reset the PHY */ +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_QSGMII_SOFT_RESET , +LAN8814_QSGMII_SOFT_RESET_BIT , +LAN8814_QSGMII_SOFT_RESET_BIT ); + err =lan8814_release_coma_mode (phydev);if (err)return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/185 rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
[ Upstream commit fe4b3a34e9a9654d98d274218dac0270779db0ae ]
It's used to work around an objtool issue since commit abb2a5572264 ("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference"), but it's then passed to bindgen and cause an error because Clang does not have this option.
--- rust/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/Makefile +1 -1
@@ -249,7 +249,7 @@ bindgen_skip_c_flags := -mno-fp-ret-in-387 -mpreferred-stack-boundary=% \ -fno-inline-functions-called-once -fsanitize=bounds-strict \ -fstrict-flex-arrays=% -fmin-function-alignment=% \ -fzero-init-padding-bits=% -mno-fdpic \ - --param=% --param asan-% + --param=% --param asan-% -fno-isolate-erroneous-paths-dereference # Derived from `scripts/Makefile.clang`. BINDGEN_TARGET_x86 := x86_64-linux-gnu
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/185 NFSD: Skip close replay processing if XDR encoding fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit ff8141e49cf70d2d093a5228f5299ce188de6142 ]
The replay logic added by commit 9411b1d4c7df ("nfsd4: cleanup handling of nfsv4.0 closed stateid's") cannot be done if encoding failed due to a short send buffer; there's no guarantee that the operation encoder has actually encoded the data that is being copied to the replay cache.
--- fs/nfsd/nfs4xdr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/nfsd/nfs4xdr.c +1 -2
@@ -5800,8 +5800,7 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)*/ warn_on_nonidempotent_op (op);xdr_truncate_encode (xdr, op_status_offset +XDR_UNIT ); - } -if (so) { + }else if (so) {int len = xdr->buf->len - (op_status_offset +XDR_UNIT ); so->so_replay.rp_status = op->status;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/185 Bluetooth: MGMT: cancel mesh send timer when hdev removed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 55fb52ffdd62850d667ebed842815e072d3c9961 ]
mesh_send_done timer is not canceled when hdev is removed, which causes crash if the timer triggers after hdev is gone.
Cancel the timer when MGMT removes the hdev, like other MGMT timers.
Should fix the BUG: sporadically seen by BlueZ test bot (in "Mesh - Send cancel - 1" test).
Log:
------
BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0 ... Freed by task 36: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210 kobject_put+0x100/0x1e0 vhci_release+0x18b/0x240
------
--- net/bluetooth/mgmt.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/mgmt.c +1 -0
@@ -9492,6 +9492,7 @@ void mgmt_index_removed(struct hci_dev *hdev)cancel_delayed_work_sync (&hdev->discov_off);cancel_delayed_work_sync (&hdev->service_cache);cancel_delayed_work_sync (&hdev->rpa_expired); +cancel_delayed_work_sync (&hdev->mesh_send_done); }void mgmt_power_on (struct hci_dev *hdev,int err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/185 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <[email protected]>
[ Upstream commit 23d22f2f71768034d6ef86168213843fc49bf550 ]
There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF.
Fix by moving the accesses to btusb data to before the data is free'd.
--- drivers/bluetooth/btusb.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/bluetooth/btusb.c +6 -7
@@ -4179,6 +4179,11 @@ static void btusb_disconnect(struct usb_interface *intf)hci_unregister_dev (hdev); +if (data->oob_wake_irq) +device_init_wakeup (&data->udev->dev, false); +if (data->reset_gpio) +gpiod_put (data->reset_gpio); +if (intf == data->intf) {if (data->isoc)usb_driver_release_interface (&btusb_driver, data->isoc);
@@ -4189,17 +4194,11 @@ static void btusb_disconnect(struct usb_interface *intf)usb_driver_release_interface (&btusb_driver, data->diag);usb_driver_release_interface (&btusb_driver, data->intf); }else if (intf == data->diag) { -usb_driver_release_interface (&btusb_driver, data->intf);if (data->isoc)usb_driver_release_interface (&btusb_driver, data->isoc); +usb_driver_release_interface (&btusb_driver, data->intf); } -if (data->oob_wake_irq) -device_init_wakeup (&data->udev->dev, false); - -if (data->reset_gpio) -gpiod_put (data->reset_gpio); -hci_free_dev (hdev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/185 Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 3b78f50918276ab28fb22eac9aa49401ac436a3b ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace: <IRQ> ... packet_rcv (net/packet/af_packet.c:2152) ... <TASK>
__local_bh_enable_ip (kernel/softirq.c:407)netif_rx (net/core/dev.c:5648)chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
--- net/bluetooth/6lowpan.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/6lowpan.c +1 -0
@@ -288,6 +288,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev, local_skb->pkt_type =PACKET_HOST ; local_skb->dev = dev; +skb_reset_mac_header (local_skb);skb_set_transport_header (local_skb,sizeof (struct ipv6hdr ));if (give_skb_to_upper (local_skb, dev) !=NET_RX_SUCCESS ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/185 Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit b454505bf57a2e4f5d49951d4deb03730a9348d9 ]
Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types, e.g. debugfs "connect" command takes the former, and "disconnect" and "connect" to already connected device take the latter. This is due to using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le which take different dst_type values.
Fix address type passed to hci_conn_hash_lookup_le().
Retain the debugfs API difference between "connect" and "disconnect" commands since it's been like this since 2015 and nobody apparently complained.
--- net/bluetooth/6lowpan.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
net/bluetooth/6lowpan.c +24 -4
@@ -956,10 +956,11 @@ static struct l2cap_chan *bt_6lowpan_listen(void) }static int get_l2cap_conn (char *buf,bdaddr_t *addr,u8 *addr_type, -struct l2cap_conn **conn) +struct l2cap_conn **conn,bool disconnect) {struct hci_conn *hcon;struct hci_dev *hdev; +int le_addr_type;int n; n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
@@ -970,13 +971,32 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,if (n <7 )return -EINVAL ; +if (disconnect) { +/* The "disconnect" debugfs command has used different address +* type constants than "connect" since 2015. Let's retain that +* for now even though it's obviously buggy... +*/ + *addr_type +=1 ; + } + +switch (*addr_type) { +case BDADDR_LE_PUBLIC : + le_addr_type =ADDR_LE_DEV_PUBLIC ; +break ; +case BDADDR_LE_RANDOM : + le_addr_type =ADDR_LE_DEV_RANDOM ; +break ; +default : +return -EINVAL ; + } +/* The LE_PUBLIC address type is ignored because of BDADDR_ANY */ hdev =hci_get_route (addr,BDADDR_ANY ,BDADDR_LE_PUBLIC );if (!hdev)return -ENOENT ;hci_dev_lock (hdev); - hcon =hci_conn_hash_lookup_le (hdev, addr, *addr_type); + hcon =hci_conn_hash_lookup_le (hdev, addr, le_addr_type);hci_dev_unlock (hdev);hci_dev_put (hdev);
@@ -1103,7 +1123,7 @@ static ssize_t lowpan_control_write(struct file *fp, buf[buf_size] ='\0' ;if (memcmp (buf,"connect " ,8 ) ==0 ) { - ret =get_l2cap_conn (&buf[8 ], &addr, &addr_type, &conn); + ret =get_l2cap_conn (&buf[8 ], &addr, &addr_type, &conn, false);if (ret == -EINVAL )return ret;
@@ -1140,7 +1160,7 @@ static ssize_t lowpan_control_write(struct file *fp, }if (memcmp (buf,"disconnect " ,11 ) ==0 ) { - ret =get_l2cap_conn (&buf[11 ], &addr, &addr_type, &conn); + ret =get_l2cap_conn (&buf[11 ], &addr, &addr_type, &conn, true);if (ret <0 )return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/185 Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 98454bc812f3611551e4b1f81732da4aa7b9597e ]
disconnect_all_peers() calls sleeping function (l2cap_chan_close) under spinlock. Holding the lock doesn't actually do any good -- we work on a local copy of the list, and the lock doesn't protect against peer->chan having already been freed.
Fix by taking refcounts of peer->chan instead. Clean up the code and old comments a bit.
Take devices_lock instead of RCU, because the kfree_rcu(); l2cap_chan_put(); construct in chan_close_cb() does not guarantee peer->chan is necessarily valid in RCU.
Also take l2cap_chan_lock() which is required for l2cap_chan_close().
Log: (bluez 6lowpan-tester Client Connect - Disable)
------
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 ... <TASK>
...l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495)
...
? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809)do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068)
------
--- net/bluetooth/6lowpan.c | 68 ++++++++++++++++++++++++++--------------- 1 file changed, 43 insertions(+), 25 deletions(-)
net/bluetooth/6lowpan.c +43 -25
@@ -52,6 +52,11 @@ static bool enable_6lowpan;static struct l2cap_chan *listen_chan;static DEFINE_MUTEX (set_lock); +enum { +LOWPAN_PEER_CLOSING , +LOWPAN_PEER_MAXBITS +}; +struct lowpan_peer {struct list_head list;struct rcu_head rcu;
@@ -60,6 +65,8 @@ struct lowpan_peer {/* peer addresses in various formats */ unsigned char lladdr[ETH_ALEN ];struct in6_addr peer_addr; + +DECLARE_BITMAP (flags,LOWPAN_PEER_MAXBITS ); };struct lowpan_btle_dev {
@@ -1013,41 +1020,52 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,static void disconnect_all_peers (void ) {struct lowpan_btle_dev *entry; -struct lowpan_peer *peer, *tmp_peer, *new_peer; -struct list_head peers; - -INIT_LIST_HEAD (&peers); +struct lowpan_peer *peer; +int nchans; -/* We make a separate list of peers as the close_cb() will -* modify the device peers list so it is better not to mess -* with the same list at the same time. +/* l2cap_chan_close() cannot be called from RCU, and lock ordering +* chan->lock > devices_lock prevents taking write side lock, so copy +* then close. */ rcu_read_lock (); +list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) +list_for_each_entry_rcu (peer, &entry->peers, list) +clear_bit (LOWPAN_PEER_CLOSING , peer->flags); +rcu_read_unlock (); -list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) { -list_for_each_entry_rcu (peer, &entry->peers, list) { - new_peer =kmalloc (sizeof (*new_peer),GFP_ATOMIC ); -if (!new_peer) -break ; +do { +struct l2cap_chan *chans[32 ]; +int i; - new_peer->chan = peer->chan; -INIT_LIST_HEAD (&new_peer->list); + nchans =0 ; -list_add (&new_peer->list, &peers); - } - } +spin_lock (&devices_lock); -rcu_read_unlock (); +list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) { +list_for_each_entry_rcu (peer, &entry->peers, list) { +if (test_and_set_bit (LOWPAN_PEER_CLOSING , + peer->flags)) +continue ; -spin_lock (&devices_lock); -list_for_each_entry_safe (peer, tmp_peer, &peers, list) { -l2cap_chan_close (peer->chan,ENOENT ); +l2cap_chan_hold (peer->chan); + chans[nchans++] = peer->chan; -list_del_rcu (&peer->list); -kfree_rcu (peer, rcu); - } -spin_unlock (&devices_lock); +if (nchans >=ARRAY_SIZE (chans)) + goto done; + } + } + +done: +spin_unlock (&devices_lock); + +for (i =0 ; i < nchans; ++i) { +l2cap_chan_lock (chans[i]); +l2cap_chan_close (chans[i],ENOENT ); +l2cap_chan_unlock (chans[i]); +l2cap_chan_put (chans[i]); + } + }while (nchans); }struct set_enable {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/185 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 1534ff77757e44bcc4b98d0196bc5c0052fce5fa ]
syzbot reported a possible shift-out-of-bounds [1]
Blamed commit added rto_alpha_max and rto_beta_max set to 1000.
It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta.
In order to prevent user regression, perform the test at run time.
Also add READ_ONCE() annotations as sysctl values can change under us.
[1]
UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]
--- net/sctp/transport.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/sctp/transport.c +9 -4
@@ -495,6 +495,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)if (tp->rttvar || tp->srtt) {struct net *net = tp->asoc->base.net; +unsigned int rto_beta, rto_alpha;/* 6.3.1 C3) When a new RTT measurement R' is made, set * RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'| * SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
@@ -506,10 +507,14 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)* For example, assuming the default value of RTO.Alpha of * 1/8, rto_alpha would be expressed as 3. */ - tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta) - + (((__u32 )abs ((__s64 )tp->srtt - (__s64 )rtt)) >> net->sctp.rto_beta); - tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha) - + (rtt >> net->sctp.rto_alpha); + rto_beta =READ_ONCE (net->sctp.rto_beta); +if (rto_beta <32 ) + tp->rttvar = tp->rttvar - (tp->rttvar >> rto_beta) + + (((__u32 )abs ((__s64 )tp->srtt - (__s64 )rtt)) >> rto_beta); + rto_alpha =READ_ONCE (net->sctp.rto_alpha); +if (rto_alpha <32 ) + tp->srtt = tp->srtt - (tp->srtt >> rto_alpha) + + (rtt >> rto_alpha); }else {/* 6.3.1 C2) When the first RTT measurement R is made, set * SRTT <- R, RTTVAR <- R/2.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/185 net/smc: fix mismatch between CLC header and proposal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <[email protected]>
[ Upstream commit ec33f2e5a2d0dbbfd71435209aee812fdc9369b8 ]
The current CLC proposal message construction uses a mix of ini->smc_type_v1/v2 and pclc_base->hdr.typev1/v2 to decide whether to include optional extensions (IPv6 prefix extension for v1, and v2 extension). This leads to a critical inconsistency: when smc_clc_prfx_set() fails - for example, in IPv6-only environments with only link-local addresses, or when the local IP address and the outgoing interface’s network address are not in the same subnet.
As a result, the proposal message is assembled using the stale ini->smc_type_v1 value—causing the IPv6 prefix extension to be included even though the header indicates v1 is not supported. The peer then receives a malformed CLC proposal where the header type does not match the payload, and immediately resets the connection.
The fix ensures consistency between the CLC header flags and the actual payload by synchronizing ini->smc_type_v1 with pclc_base->hdr.typev1 when prefix setup fails.
--- net/smc/smc_clc.c | 1 + 1 file changed, 1 insertion(+)
net/smc/smc_clc.c +1 -0
@@ -887,6 +887,7 @@ int smc_clc_send_proposal(struct smc_sock *smc, struct smc_init_info *ini)return SMC_CLC_DECL_CNFERR ; } pclc_base->hdr.typev1 =SMC_TYPE_N ; + ini->smc_type_v1 =SMC_TYPE_N ; }else { pclc_base->iparea_offset =htons (sizeof (*pclc_smcd)); plen += sizeof(*pclc_prfx) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/185 net/handshake: Fix memory leak in tls_handshake_accept()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 3072f00bba764082fa41b3c3a2a7b013335353d2 ]
In tls_handshake_accept(), a netlink message is allocated using genlmsg_new(). In the error handling path, genlmsg_cancel() is called to cancel the message construction, but the message itself is not freed. This leads to a memory leak.
Fix this by calling nlmsg_free() in the error path after genlmsg_cancel() to release the allocated memory.
--- net/handshake/tlshd.c | 1 + 1 file changed, 1 insertion(+)
net/handshake/tlshd.c +1 -0
@@ -253,6 +253,7 @@ static int tls_handshake_accept(struct handshake_req *req, out_cancel:genlmsg_cancel (msg, hdr); +nlmsg_free (msg); out:return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/185 net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aksh Garg <[email protected]>
[ Upstream commit 49b3916465176a5abcb29a0e464825f553d55d58 ]
The CPSW module uses the MAC_VERIFY_CNT bit field in the CPSW_PN_IET_VERIFY_REG_k register to set the verify/response timeout count. This register specifies the number of clock cycles to wait before resending a verify packet if the verification fails.
The verify/response timeout count, as being set by the function am65_cpsw_iet_set_verify_timeout_count() is hardcoded for 125MHz clock frequency, which varies based on PHY mode and link speed.
The respective clock frequencies are as follows:
- RGMII mode:
* 1000 Mbps: 125 MHz
* 100 Mbps: 25 MHz
* 10 Mbps: 2.5 MHz
- QSGMII/SGMII mode: 125 MHz (all speeds)
Fix this by adding logic to calculate the correct timeout counts based on the actual PHY interface mode and link speed.
--- drivers/net/ethernet/ti/am65-cpsw-qos.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/am65-cpsw-qos.c +23 -1
@@ -276,9 +276,31 @@ static int am65_cpsw_iet_set_verify_timeout_count(struct am65_cpsw_port *port)/* The number of wireside clocks contained in the verify * timeout counter. The default is 0x1312d0 * (10ms at 125Mhz in 1G mode). +* The frequency of the clock depends on the link speed +* and the PHY interface. */ - val =125 *HZ_PER_MHZ ;/* assuming 125MHz wireside clock */ +switch (port->slave.phy_if) { +case PHY_INTERFACE_MODE_RGMII : +case PHY_INTERFACE_MODE_RGMII_ID : +case PHY_INTERFACE_MODE_RGMII_RXID : +case PHY_INTERFACE_MODE_RGMII_TXID : +if (port->qos.link_speed ==SPEED_1000 ) + val =125 *HZ_PER_MHZ ;/* 125 MHz at 1000Mbps*/ +else if (port->qos.link_speed ==SPEED_100 ) + val =25 *HZ_PER_MHZ ;/* 25 MHz at 100Mbps*/ +else + val = (25 *HZ_PER_MHZ ) /10 ;/* 2.5 MHz at 10Mbps*/ +break ; + +case PHY_INTERFACE_MODE_QSGMII : +case PHY_INTERFACE_MODE_SGMII : + val =125 *HZ_PER_MHZ ;/* 125 MHz */ +break ; +default : +netdev_err (port->ndev,"selected mode does not supported IET\n" ); +return -EOPNOTSUPP ; + } val /=MILLIHZ_PER_HZ ;/* count per ms timeout */ val *= verify_time_ms;/* count for timeout ms */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/185 net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aksh Garg <[email protected]>
[ Upstream commit d4b00d132d7cb70a74bc039c91c1d6120943c71b ]
The am65_cpsw_iet_verify_wait() function attempts verification 20 times, toggling the AM65_CPSW_PN_IET_MAC_LINKFAIL bit in each iteration. When the LINKFAIL bit transitions from 1 to 0, the MAC merge layer initiates the verification process and waits for the timeout configured in MAC_VERIFY_CNT before automatically retransmitting. The MAC_VERIFY_CNT register is configured according to the user-defined verify/response timeout in am65_cpsw_iet_set_verify_timeout_count(). As per IEEE 802.3 Clause 99, the hardware performs this automatic retry up to 3 times.
Current implementation toggles LINKFAIL after the user-configured verify/response timeout in each iteration, forcing the hardware to restart verification instead of respecting the MAC_VERIFY_CNT timeout. This bypasses the hardware's automatic retry mechanism.
Fix this by moving the LINKFAIL bit toggle outside the retry loop and reducing the retry count from 20 to 3. The software now only monitors the status register while the hardware autonomously handles the 3 verification attempts at proper MAC_VERIFY_CNT intervals.
--- drivers/net/ethernet/ti/am65-cpsw-qos.c | 27 +++++++++++++------------ 1 file changed, 14 insertions(+), 13 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-qos.c +14 -13
@@ -317,20 +317,21 @@ static int am65_cpsw_iet_verify_wait(struct am65_cpsw_port *port)u32 ctrl, status;int try; - try =20 ; - do { - /* Reset the verify state machine by writing 1 - * to LINKFAIL - */ - ctrl = readl(port->port_base + AM65_CPSW_PN_REG_IET_CTRL); - ctrl |= AM65_CPSW_PN_IET_MAC_LINKFAIL; - writel(ctrl, port->port_base + AM65_CPSW_PN_REG_IET_CTRL); + try =3 ; - /* Clear MAC_LINKFAIL bit to start Verify. */ - ctrl = readl(port->port_base + AM65_CPSW_PN_REG_IET_CTRL); - ctrl &= ~AM65_CPSW_PN_IET_MAC_LINKFAIL; - writel(ctrl, port->port_base + AM65_CPSW_PN_REG_IET_CTRL); +/* Reset the verify state machine by writing 1 +* to LINKFAIL +*/ + ctrl =readl (port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); + ctrl |=AM65_CPSW_PN_IET_MAC_LINKFAIL ; +writel (ctrl, port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); +/* Clear MAC_LINKFAIL bit to start Verify. */ + ctrl =readl (port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); + ctrl &= ~AM65_CPSW_PN_IET_MAC_LINKFAIL ; +writel (ctrl, port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); + + do { msleep(port->qos.iet.verify_time_ms); status = readl(port->port_base + AM65_CPSW_PN_REG_IET_STATUS);
@@ -352,7 +353,7 @@ static int am65_cpsw_iet_verify_wait(struct am65_cpsw_port *port)netdev_dbg (port->ndev,"MAC Merge verify error\n" );return -ENODEV ; } - }while (try-- >0 ); + }while (--try >0 );netdev_dbg (port->ndev,"MAC Merge verify timeout\n" );return -ETIMEDOUT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/185 tipc: Fix use-after-free in tipc_mon_reinit_self().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 0725e6afb55128be21a2ca36e9674f573ccec173 ]
syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0]
The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL.
tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work().
Let's hold RTNL in tipc_net_finalize_work().
[0]:
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989
CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events tipc_net_finalize_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]
rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]
rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244
rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243
write_lock_bh include/linux/rwlock_rt.h:99 [inline]
tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718
tipc_net_finalize+0x115/0x190 net/tipc/net.c:140
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6089:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657
tipc_enable_bearer net/tipc/bearer.c:357 [inline]
__tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047
__tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]
tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393
tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]
tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:729
____sys_sendmsg+0x508/0x820 net/socket.c:2614
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6088:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x195/0x550 mm/slub.c:4894
tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166
unregister_netdevice_many net/core/dev.c:12229 [inline]
unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073
unregister_netdevice include/linux/netdevice.h:3385 [inline]
__tun_detach+0xe4d/0x1620 drivers/net/tun.c:621
tun_detach drivers/net/tun.c:637 [inline]
tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433
__fput+0x458/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/tipc/net.c | 2 ++ 1 file changed, 2 insertions(+)
net/tipc/net.c +2 -0
@@ -145,7 +145,9 @@ void tipc_net_finalize_work(struct work_struct *work) { struct tipc_net *tn = container_of(work, struct tipc_net, work); +rtnl_lock ();tipc_net_finalize (tipc_link_net (tn->bcl), tn->trial_addr); +rtnl_unlock (); }void tipc_net_stop (struct net *net)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/185 net: mdio: fix resource leak in mdiobus_register_device()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Buday Csaba <[email protected]>
[ Upstream commit e6ca8f533ed41129fcf052297718f417f021cc7d ]
Fix a possible leak in mdiobus_register_device() when both a reset-gpio and a reset-controller are present.
Clean up the already claimed reset-gpio, when the registration of the reset-controller fails, so when an error code is returned, the device retains its state before the registration attempt.
--- drivers/net/phy/mdio_bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/phy/mdio_bus.c +4 -1
@@ -79,8 +79,11 @@ int mdiobus_register_device(struct mdio_device *mdiodev)return err; err =mdiobus_register_reset (mdiodev); -if (err) +if (err) { +gpiod_put (mdiodev->reset_gpio); + mdiodev->reset_gpio =NULL ;return err; + }/* Assert the reset signal */ mdio_device_reset (mdiodev,1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/185 wifi: mac80211: skip rate verification for not captured PSDUs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 7fe0d21f5633af8c3fab9f0ef0706c6156623484 ]
If for example the sniffer did not follow any AIDs in an MU frame, then some of the information may not be filled in or is even expected to be invalid. As an example, in that case it is expected that Nss is zero.
--- net/mac80211/rx.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/mac80211/rx.c +7 -3
@@ -5402,10 +5402,14 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,if (WARN_ON (!local->started)) goto drop; -if (likely (!(status->flag &RX_FLAG_FAILED_PLCP_CRC ))) { +if (likely (!(status->flag &RX_FLAG_FAILED_PLCP_CRC ) && + !(status->flag &RX_FLAG_NO_PSDU && + status->zero_length_psdu_type == +IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED ))) {/* -* Validate the rate, unless a PLCP error means that -* we probably can't have a valid rate here anyway. +* Validate the rate, unless there was a PLCP error which may +* have an invalid rate or the PSDU was not capture and may be +* missing rate information. */ switch (status->encoding) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/185 af_unix: Initialise scc_index in unix_add_edge().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 60e6489f8e3b086bd1130ad4450a2c112e863791 ]
Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3
Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.
At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.
unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.
3-c decrements sk-A's file refcnt to 1.
Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:
sk-A -> sk-B (-> sk-C)
sk-X -> sk-X
This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.
However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.
unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! &&
sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree
^-- 1 in-flight count for sk-B
-> sk-A is dead !?
The problem is that unix_add_edge() does not initialise scc_index.
Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.
Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.
This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.
--- net/unix/garbage.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
net/unix/garbage.c +11 -3
@@ -136,6 +136,7 @@ enum unix_vertex_index { };static unsigned long unix_vertex_unvisited_index =UNIX_VERTEX_INDEX_MARK1 ; +static unsigned long unix_vertex_max_scc_index =UNIX_VERTEX_INDEX_START ;static void unix_add_edge (struct scm_fp_list *fpl,struct unix_edge *edge) {
@@ -144,6 +145,7 @@ static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge)if (!vertex) { vertex =list_first_entry (&fpl->vertices,typeof (*vertex), entry); vertex->index = unix_vertex_unvisited_index; + vertex->scc_index = ++unix_vertex_max_scc_index; vertex->out_degree =0 ;INIT_LIST_HEAD (&vertex->edges);INIT_LIST_HEAD (&vertex->scc_entry);
@@ -480,10 +482,15 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde scc_dead =unix_vertex_dead (v); } -if (scc_dead) +if (scc_dead) {unix_collect_skb (&scc, hitlist); -else if (!unix_graph_maybe_cyclic) - unix_graph_maybe_cyclic =unix_scc_cyclic (&scc); + }else { +if (unix_vertex_max_scc_index < vertex->scc_index) + unix_vertex_max_scc_index = vertex->scc_index; + +if (!unix_graph_maybe_cyclic) + unix_graph_maybe_cyclic =unix_scc_cyclic (&scc); + }list_del (&scc); }
@@ -498,6 +505,7 @@ static void unix_walk_scc(struct sk_buff_head *hitlist)unsigned long last_index =UNIX_VERTEX_INDEX_START ; unix_graph_maybe_cyclic = false; + unix_vertex_max_scc_index =UNIX_VERTEX_INDEX_START ;/* Visit every vertex exactly once. * __unix_walk_scc() moves visited vertices to unix_visited_vertices.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/185 net_sched: act_connmark: use RCU in tcf_connmark_dump()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0d752877705c0252ef2726e4c63c5573f048951c ]
Also storing tcf_action into struct tcf_connmark_parms makes sure there is no discrepancy in tcf_connmark_act().
Stable-dep-of: 62b656e43eae ("net: sched: act_connmark: initialize struct tc_ife to fix kernel leak")
--- include/net/tc_act/tc_connmark.h | 1 + net/sched/act_connmark.c | 18 ++++++++++-------- 2 files changed, 11 insertions(+), 8 deletions(-)
include/net/tc_act/tc_connmark.h +1 -0
@@ -7,6 +7,7 @@struct tcf_connmark_parms {struct net *net;u16 zone; +int action;struct rcu_head rcu; };
net/sched/act_connmark.c +10 -8
@@ -88,7 +88,7 @@ TC_INDIRECT_SCOPE int tcf_connmark_act(struct sk_buff *skb,/* using overlimits stats to count how many packets marked */ tcf_action_inc_overlimit_qstats (&ca->common); out: -return READ_ONCE (ca->tcf_action); +return parms->action; }static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX +1 ] = {
@@ -167,6 +167,8 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,if (err <0 ) goto release_idr; + nparms->action = parm->action; +spin_lock_bh (&ci->tcf_lock); goto_ch =tcf_action_set_ctrlact (*a, parm->action, goto_ch); oparms =rcu_replace_pointer (ci->parms, nparms,lockdep_is_held (&ci->tcf_lock));
@@ -190,20 +192,20 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,static inline int tcf_connmark_dump (struct sk_buff *skb,struct tc_action *a,int bind,int ref) { +const struct tcf_connmark_info *ci =to_connmark (a);unsigned char *b =skb_tail_pointer (skb); -struct tcf_connmark_info *ci =to_connmark (a); +const struct tcf_connmark_parms *parms;struct tc_connmark opt = { .index = ci->tcf_index, .refcnt =refcount_read (&ci->tcf_refcnt) - ref, .bindcnt =atomic_read (&ci->tcf_bindcnt) - bind, }; -struct tcf_connmark_parms *parms;struct tcf_t t; -spin_lock_bh (&ci->tcf_lock); - parms =rcu_dereference_protected (ci->parms,lockdep_is_held (&ci->tcf_lock)); +rcu_read_lock (); + parms =rcu_dereference (ci->parms); - opt.action = ci->tcf_action; + opt.action = parms->action; opt.zone = parms->zone;if (nla_put (skb,TCA_CONNMARK_PARMS ,sizeof (opt), &opt)) goto nla_put_failure;
@@ -212,12 +214,12 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,if (nla_put_64bit (skb,TCA_CONNMARK_TM ,sizeof (t), &t,TCA_CONNMARK_PAD )) goto nla_put_failure; -spin_unlock_bh (&ci->tcf_lock); +rcu_read_unlock ();return skb->len; nla_put_failure: -spin_unlock_bh (&ci->tcf_lock); +rcu_read_unlock ();nlmsg_trim (skb, b);return -1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/185 net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <[email protected]>
[ Upstream commit 62b656e43eaeae445a39cd8021a4f47065af4389 ]
In tcf_connmark_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied.
--- net/sched/act_connmark.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/sched/act_connmark.c +7 -5
@@ -195,13 +195,15 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,const struct tcf_connmark_info *ci =to_connmark (a);unsigned char *b =skb_tail_pointer (skb);const struct tcf_connmark_parms *parms; -struct tc_connmark opt = { - .index = ci->tcf_index, - .refcnt =refcount_read (&ci->tcf_refcnt) - ref, - .bindcnt =atomic_read (&ci->tcf_bindcnt) - bind, - }; +struct tc_connmark opt;struct tcf_t t; +memset (&opt,0 ,sizeof (opt)); + + opt.index = ci->tcf_index; + opt.refcnt =refcount_read (&ci->tcf_refcnt) - ref; + opt.bindcnt =atomic_read (&ci->tcf_bindcnt) - bind; +rcu_read_lock (); parms =rcu_dereference (ci->parms);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/185 net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <[email protected]>
[ Upstream commit ce50039be49eea9b4cd8873ca6eccded1b4a130a ]
Fix a KMSAN kernel-infoleak detected by the syzbot .
[net?] KMSAN: kernel-infoleak in __skb_datagram_iter
In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied.
This change silences the KMSAN report and prevents potential information leaks from the kernel memory.
This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak.
--- net/sched/act_ife.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/sched/act_ife.c +7 -5
@@ -644,13 +644,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind,unsigned char *b =skb_tail_pointer (skb);struct tcf_ife_info *ife =to_ife (a);struct tcf_ife_params *p; -struct tc_ife opt = { - .index = ife->tcf_index, - .refcnt =refcount_read (&ife->tcf_refcnt) - ref, - .bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, - }; +struct tc_ife opt;struct tcf_t t; +memset (&opt,0 ,sizeof (opt)); + + opt.index = ife->tcf_index, + opt.refcnt =refcount_read (&ife->tcf_refcnt) - ref, + opt.bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, +spin_lock_bh (&ife->tcf_lock); opt.action = ife->tcf_action; p = rcu_dereference_protected(ife->params,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/185 net/mlx5e: Fix maxrate wraparound in threshold between units
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit a7bf4d5063c7837096aab2853224eb23628514d9 ]
The previous calculation used roundup() which caused an overflow for rates between 25.5Gbps and 26Gbps.
For example, a rate of 25.6Gbps would result in using 100Mbps units with value of 256, which would overflow the 8 bits field.
Simplify the upper_limit_mbps calculation by removing the unnecessary roundup, and adjust the comparison to use <= to correctly handle the boundary condition.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +3 -2
@@ -595,18 +595,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,struct mlx5_core_dev *mdev = priv->mdev;u8 max_bw_value[IEEE_8021QAZ_MAX_TCS ];u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS ]; -__u64 upper_limit_mbps =roundup (255 *MLX5E_100MB ,MLX5E_1GB ); +__u64 upper_limit_mbps;int i;memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit)); + upper_limit_mbps =255 *MLX5E_100MB ;for (i =0 ; i <=mlx5_max_tc (mdev); i++) {if (!maxrate->tc_maxrate[i]) { max_bw_unit[i] =MLX5_BW_NO_LIMIT ;continue ; } -if (maxrate->tc_maxrate[i] < upper_limit_mbps) { +if (maxrate->tc_maxrate[i] <= upper_limit_mbps) { max_bw_value[i] =div_u64 (maxrate->tc_maxrate[i],MLX5E_100MB ); max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] :1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/185 net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e ]
Add validation to reject rates exceeding 255 Gbps that would overflow the 8 bits max bandwidth field.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +9 -1
@@ -596,11 +596,13 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,u8 max_bw_value[IEEE_8021QAZ_MAX_TCS ];u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS ];__u64 upper_limit_mbps; +__u64 upper_limit_gbps;int i;memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit)); upper_limit_mbps =255 *MLX5E_100MB ; + upper_limit_gbps =255 *MLX5E_1GB ;for (i =0 ; i <=mlx5_max_tc (mdev); i++) {if (!maxrate->tc_maxrate[i]) {
@@ -612,10 +614,16 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, MLX5E_100MB); max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] :1 ; max_bw_unit[i] =MLX5_100_MBPS_UNIT ; - }else { + }else if (max_bw_value[i] <= upper_limit_gbps) { max_bw_value[i] =div_u64 (maxrate->tc_maxrate[i],MLX5E_1GB ); max_bw_unit[i] =MLX5_GBPS_UNIT ; + }else { +netdev_err (netdev, +"tc_%d maxrate %llu Kbps exceeds limit %llu\n" , + i, maxrate->tc_maxrate[i], + upper_limit_gbps); +return -EINVAL ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/185 net/mlx5e: Fix potentially misleading debug message
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 9fcc2b6c10523f7e75db6387946c86fcf19dc97e ]
Change the debug message to print the correct units instead of always assuming Gbps, as the value can be in either 100 Mbps or 1 Gbps units.
--- .../net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +16 -2
@@ -598,6 +598,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,__u64 upper_limit_mbps;__u64 upper_limit_gbps;int i; +struct { +int scale; +const char *units_str; + } units[] = { + [MLX5_100_MBPS_UNIT ] = { + .scale =100 , + .units_str ="Mbps" , + }, + [MLX5_GBPS_UNIT ] = { + .scale =1 , + .units_str ="Gbps" , + }, + };memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit));
@@ -628,8 +641,9 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, }for (i =0 ; i <IEEE_8021QAZ_MAX_TCS ; i++) { -netdev_dbg (netdev,"%s: tc_%d <=> max_bw %d Gbps\n" , - __func__, i, max_bw_value[i]); +netdev_dbg (netdev,"%s: tc_%d <=> max_bw %u %s\n" , __func__, i, + max_bw_value[i] * units[max_bw_unit[i]].scale, + units[max_bw_unit[i]].units_str); }return mlx5_modify_port_ets_rate_limit (mdev, max_bw_value, max_bw_unit);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/185 net_sched: limit try_bulk_dequeue_skb() batches
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0345552a653ce5542affeb69ac5aa52177a5199b ]
After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption") I started seeing many qdisc requeues on IDPF under high TX workload.
$ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1: qdisc mq 1: root Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114) backlog 1056Kb 6675p requeues 3532840114 qdisc mq 1: root Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653) backlog 781164b 4822p requeues 3537737653
This is caused by try_bulk_dequeue_skb() being only limited by BQL budget.
perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script
...
netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200 netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500 netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100 netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00 netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300 netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00 netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000
...
This is bad because :
1) Large batches hold one victim cpu for a very long time.
2) Driver often hit their own TX ring limit (all slots are used).
3) We call dev_requeue_skb()
4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to implement FQ or priority scheduling.
5) dequeue_skb() gets packets from q->gso_skb one skb at a time with no xmit_more support. This is causing many spinlock games between the qdisc and the device driver.
Requeues were supposed to be very rare, lets keep them this way.
Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as __qdisc_run() was designed to use.
--- net/sched/sch_generic.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
net/sched/sch_generic.c +10 -7
@@ -179,9 +179,10 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)static void try_bulk_dequeue_skb (struct Qdisc *q,struct sk_buff *skb,const struct netdev_queue *txq, -int *packets) +int *packets,int budget) {int bytelimit =qdisc_avail_bulklimit (txq) - skb->len; +int cnt =0 ;while (bytelimit >0 ) {struct sk_buff *nskb = q->dequeue (q);
@@ -192,8 +193,10 @@ static void try_bulk_dequeue_skb(struct Qdisc *q, bytelimit -= nskb->len;/* covers GSO len */ skb->next = nskb; skb = nskb; - (*packets)++;/* GSO counts as one pkt */ +if (++cnt >= budget) +break ; } + (*packets) += cnt;skb_mark_not_on_list (skb); }
@@ -227,7 +230,7 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,* A requeued skb (via q->gso_skb) can also be a SKB list. */ static struct sk_buff *dequeue_skb (struct Qdisc *q,bool *validate, -int *packets) +int *packets,int budget) {const struct netdev_queue *txq = q->dev_queue;struct sk_buff *skb =NULL ;
@@ -294,7 +297,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,if (skb) { bulk:if (qdisc_may_bulk (q)) -try_bulk_dequeue_skb (q, skb, txq, packets); +try_bulk_dequeue_skb (q, skb, txq, packets, budget);else try_bulk_dequeue_skb_slow (q, skb, packets); }
@@ -386,7 +389,7 @@ bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,* >0 - queue is not empty. * */ -static inline bool qdisc_restart (struct Qdisc *q,int *packets) +static inline bool qdisc_restart (struct Qdisc *q,int *packets,int budget) {spinlock_t *root_lock =NULL ;struct netdev_queue *txq;
@@ -395,7 +398,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets)bool validate;/* Dequeue packet */ - skb =dequeue_skb (q, &validate, packets); + skb =dequeue_skb (q, &validate, packets, budget);if (unlikely (!skb))return false;
@@ -413,7 +416,7 @@ void __qdisc_run(struct Qdisc *q)int quota =READ_ONCE (net_hotdata.dev_tx_weight);int packets; -while (qdisc_restart (q, &packets)) { +while (qdisc_restart (q, &packets, quota)) { quota -= packets;if (quota <=0 ) {if (q->flags &TCQ_F_NOLOCK )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/185 virtio-net: fix incorrect flags recording in big mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuan Zhuo <[email protected]>
[ Upstream commit 0eff2eaa5322b5b141ff5d5ded26fac4a52b5f7b ]
The purpose of commit 703eec1b2422 ("virtio_net: fixing XDP for fully checksummed packets handling") is to record the flags in advance, as their value may be overwritten in the XDP case. However, the flags recorded under big mode are incorrect, because in big mode, the passed buf does not point to the rx buffer, but rather to the page of the submitted buffer. This commit fixes this issue.
For the small mode, the commit c11a49d58ad2 ("virtio_net: Fix mismatched buf address when unmapping for small packets") fixed it.
--- drivers/net/virtio_net.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/net/virtio_net.c +11 -5
@@ -2455,22 +2455,28 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,return ; } -/* 1. Save the flags early, as the XDP program might overwrite them. +/* About the flags below: +* 1. Save the flags early, as the XDP program might overwrite them. * These flags ensure packets marked as VIRTIO_NET_HDR_F_DATA_VALID * stay valid after XDP processing. * 2. XDP doesn't work with partially checksummed packets (refer to * virtnet_xdp_set()), so packets marked as * VIRTIO_NET_HDR_F_NEEDS_CSUM get dropped during XDP processing. */ - flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; -if (vi->mergeable_rx_bufs) +if (vi->mergeable_rx_bufs) { + flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; skb =receive_mergeable (dev, vi, rq, buf, ctx, len, xdp_xmit, stats); -else if (vi->big_packets) + }else if (vi->big_packets) { +void *p =page_address ((struct page *)buf); + + flags = ((struct virtio_net_common_hdr *)p)->hdr.flags; skb =receive_big (dev, vi, rq, buf, len, stats); -else + }else { + flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; skb =receive_small (dev, vi, rq, buf, ctx, len, xdp_xmit, stats); + }if (unlikely (!skb))return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/185 hsr: Fix supervision frame sending on HSRv0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Maurer <[email protected]>
[ Upstream commit 96a3a03abf3d8cc38cd9cb0d280235fbcf7c3f7f ]
On HSRv0, no supervision frames were sent. The supervison frames were generated successfully, but failed the check for a sufficiently long mac header, i.e., at least sizeof(struct hsr_ethhdr), in hsr_fill_frame_info() because the mac header only contained the ethernet header.
Fix this by including the HSR header in the mac header when generating HSR supervision frames. Note that the mac header now also includes the TLV fields. This matches how we set the headers on rx and also the size of struct hsrv0_ethhdr_sp.
--- net/hsr/hsr_device.c | 3 +++ 1 file changed, 3 insertions(+)
net/hsr/hsr_device.c +3 -0
@@ -320,6 +320,9 @@ static void send_hsr_supervision_frame(struct hsr_port *port, } hsr_stag =skb_put (skb,sizeof (struct hsr_sup_tag )); +skb_set_network_header (skb,ETH_HLEN +HSR_HLEN ); +skb_reset_mac_len (skb); +set_hsr_stag_path (hsr_stag, (hsr->prot_version ?0x0 :0xf ));set_hsr_stag_HSR_ver (hsr_stag, hsr->prot_version);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/185 ACPI: CPPC: Detect preferred core availability on online CPUs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 4fe5934db4a7187d358f1af1b3ef9b6dd59bce58 ]
Commit 279f838a61f9 ("x86/amd: Detect preferred cores in amd_get_boost_ratio_numerator()") introduced the ability to detect the preferred core on AMD platforms by checking if there at least two distinct highest_perf values.
However, it uses for_each_present_cpu() to iterate through all the CPUs in the platform, which is problematic when the kernel is booted with "nosmt=force" commandline option.
Hence limit the search to only the online CPUs.
--- arch/x86/kernel/acpi/cppc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/acpi/cppc.c +1 -1
@@ -194,7 +194,7 @@ int amd_detect_prefcore(bool *detected)break ; } -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) {u32 tmp;int ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/185 ACPI: CPPC: Check _CPC validity for only the online CPUs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 6dd3b8a709a130a4d55c866af9804c81b8486d28 ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe().
However the function acpi_cpc_valid() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force".
Hence check the validity of the _CPC objects of only the online CPUs.
--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
@@ -447,7 +447,7 @@ bool acpi_cpc_valid(void)if (acpi_disabled)return false; -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) { cpc_ptr =per_cpu (cpc_desc_ptr, cpu);if (!cpc_ptr)return false;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/185 ACPI: CPPC: Perform fast check switch only for online CPUs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 8821c8e80a65bc4eb73daf63b34aac6b8ad69461 ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe().
However the function cppc_allow_fast_switch() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force".
Check fast_switch capability only on online CPUs
--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
@@ -463,7 +463,7 @@ bool cppc_allow_fast_switch(void)struct cpc_desc *cpc_ptr;int cpu; -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) { cpc_ptr =per_cpu (cpc_desc_ptr, cpu); desired_reg = &cpc_ptr->cpc_regs[DESIRED_PERF ]; if (!CPC_IN_SYSTEM_MEMORY(desired_reg) &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/185 ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 0fce75870666b46b700cfbd3216380b422f975da ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPU via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe().
However the function cppc_perf_ctrs_in_pcc() checks if the CPPC perf-ctrs are in a PCC region for all the present CPUs, which breaks when the kernel is booted with "nosmt=force".
Hence, limit the check only to the online CPUs.
--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
@@ -1366,7 +1366,7 @@ bool cppc_perf_ctrs_in_pcc(void) {int cpu; -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) {struct cpc_register_resource *ref_perf_reg;struct cpc_desc *cpc_desc;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/185 Bluetooth: L2CAP: export l2cap_chan_hold for modules
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c ]
l2cap_chan_put() is exported, so export also l2cap_chan_hold() for modules.
l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c
--- net/bluetooth/l2cap_core.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/l2cap_core.c +1 -0
@@ -497,6 +497,7 @@ void l2cap_chan_hold(struct l2cap_chan *c)kref_get (&c->kref); } +EXPORT_SYMBOL_GPL (l2cap_chan_hold);struct l2cap_chan *l2cap_chan_hold_unless_zero (struct l2cap_chan *c) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/185 acpi,srat: Fix incorrect device handle check for Generic Initiator
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit 7c3643f204edf1c5edb12b36b34838683ee5f8dc ]
The Generic Initiator Affinity Structure in SRAT table uses device handle type field to indicate the device type. According to ACPI specification, the device handle type value of 1 represents PCI device, not 0.
--- drivers/acpi/numa/srat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/numa/srat.c +1 -1
@@ -143,7 +143,7 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)struct acpi_srat_generic_affinity *p = (struct acpi_srat_generic_affinity *)header; -if (p->device_handle_type ==0 ) { +if (p->device_handle_type ==1 ) {/* * For pci devices this may be the only place they * are assigned a proximity domain
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/185 regulator: fixed: fix GPIO descriptor leak on register failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 636f4618b1cd96f6b5a2b8c7c4f665c8533ecf13 ]
In the commit referenced by the Fixes tag, devm_gpiod_get_optional() was replaced by manual
GPIO management, relying on the regulator core to release the GPIO descriptor. However, this approach does not account for the error path: when regulator registration fails, the core never takes over the GPIO, resulting in a resource leak.
Add gpiod_put() before returning on regulator registration failure.
--- drivers/regulator/fixed.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/fixed.c +1 -0
@@ -334,6 +334,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) ret =dev_err_probe (&pdev->dev,PTR_ERR (drvdata->dev),"Failed to register regulator: %ld\n" ,PTR_ERR (drvdata->dev)); +gpiod_put (cfg.ena_gpiod);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/185 ASoC: cs4271: Fix regulator leak on probe failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 6b6eddc63ce871897d3a5bc4f8f593e698aef104 ]
The probe function enables regulators at the beginning but fails to disable them in its error handling path. If any operation after enabling the regulators fails, the probe will exit with an error, leaving the regulators permanently enabled, which could lead to a resource leak.
Add a proper error handling path to call regulator_bulk_disable() before returning an error.
--- sound/soc/codecs/cs4271.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/cs4271.c +7 -3
@@ -581,17 +581,17 @@ static int cs4271_component_probe(struct snd_soc_component *component) ret =regcache_sync (cs4271->regmap);if (ret <0 ) -return ret; + goto err_disable_regulator; ret =regmap_update_bits (cs4271->regmap,CS4271_MODE2 ,CS4271_MODE2_PDN |CS4271_MODE2_CPEN ,CS4271_MODE2_PDN |CS4271_MODE2_CPEN );if (ret <0 ) -return ret; + goto err_disable_regulator; ret =regmap_update_bits (cs4271->regmap,CS4271_MODE2 ,CS4271_MODE2_PDN ,0 );if (ret <0 ) -return ret; + goto err_disable_regulator;/* Power-up sequence requires 85 uS */ udelay (85 );
@@ -601,6 +601,10 @@ static int cs4271_component_probe(struct snd_soc_component *component) CS4271_MODE2_MUTECAEQUB);return 0 ; + +err_disable_regulator: +regulator_bulk_disable (ARRAY_SIZE (cs4271->supplies), cs4271->supplies); +return ret; }static void cs4271_component_remove (struct snd_soc_component *component)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/185 ASoC: codecs: va-macro: fix resource leak in probe error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 3dc8c73365d3ca25c99e7e1a0f493039d7291df5 ]
In the commit referenced by the Fixes tag, clk_hw_get_clk() was added in va_macro_probe() to get the fsgen clock, but forgot to add the corresponding clk_put() in va_macro_remove(). This leads to a clock reference leak when the driver is unloaded.
Switch to devm_clk_hw_get_clk() to automatically manage the clock resource.
--- sound/soc/codecs/lpass-va-macro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/lpass-va-macro.c +1 -1
@@ -1637,7 +1637,7 @@ static int va_macro_probe(struct platform_device *pdev)if (ret) goto err_clkout; - va->fsgen =clk_hw_get_clk (&va->hw,"fsgen" ); + va->fsgen =devm_clk_hw_get_clk (dev, &va->hw,"fsgen" );if (IS_ERR (va->fsgen)) { ret =PTR_ERR (va->fsgen); goto err_clkout;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/185 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af ]
This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +5 -0
@@ -3686,6 +3686,11 @@ static int vmw_cmd_check(struct vmw_private *dev_priv, cmd_id = header->id; +if (header->size >SVGA_CMD_MAX_DATASIZE ) { +VMW_DEBUG_USER ("SVGA3D command: %d is too big.\n" , + cmd_id +SVGA_3D_CMD_BASE ); +return -E2BIG ; + } *size = header->size +sizeof (SVGA3dCmdHeader); cmd_id -=SVGA_3D_CMD_BASE ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/185 ASoC: tas2781: fix getting the wrong device number
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
[ Upstream commit 29528c8e643bb0c54da01237a35010c6438423d2 ]
The return value of device_property_read_u32_array used for getting the property is the status instead of the number of the property.
--- sound/soc/codecs/tas2781-i2c.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2781-i2c.c +7 -2
@@ -1635,7 +1635,8 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) {struct i2c_client *client = (struct i2c_client *)tas_priv->client;unsigned int dev_addrs[TASDEVICE_MAX_CHANNELS ]; -int i, ndev =0 ; +int ndev =0 ; +int i, rc;if (tas_priv->isacpi) { ndev = device_property_read_u32_array(&client->dev,
@@ -1646,8 +1647,12 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) }else { ndev = (ndev <ARRAY_SIZE (dev_addrs)) ? ndev :ARRAY_SIZE (dev_addrs); - ndev =device_property_read_u32_array (&client->dev, + rc =device_property_read_u32_array (&client->dev,"ti,audio-slots" , dev_addrs, ndev); +if (rc !=0 ) { + ndev =1 ; + dev_addrs[0 ] = client->addr; + } } tas_priv->irq =
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/185 pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 28e19737e1570c7c71890547c2e43c3e0da79df9 ]
Don't try to add an RDMA transport to a client that is already marked as being a TCP/TLS transport.
--- fs/nfs/pnfs_nfs.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-)
fs/nfs/pnfs_nfs.c +17 -17
@@ -867,7 +867,10 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, u32 minor_version) {struct nfs_client *clp =ERR_PTR (-EIO ); +struct nfs_client *mds_clp = mds_srv->nfs_client; +enum xprtsec_policies xprtsec_policy = mds_clp->cl_xprtsec.policy;struct nfs4_pnfs_ds_addr *da; +int ds_proto;int status =0 ;dprintk ("--> %s DS %s\n" , __func__, ds->ds_remotestr);
@@ -895,12 +898,8 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, .data = &xprtdata, }; -if (da->da_transport != clp->cl_proto && - clp->cl_proto !=XPRT_TRANSPORT_TCP_TLS ) -continue ; -if (da->da_transport ==XPRT_TRANSPORT_TCP && - mds_srv->nfs_client->cl_proto == -XPRT_TRANSPORT_TCP_TLS ) { +if (xprt_args.ident ==XPRT_TRANSPORT_TCP && + clp->cl_proto ==XPRT_TRANSPORT_TCP_TLS ) {struct sockaddr *addr = (struct sockaddr *)&da->da_addr; struct sockaddr_in *sin =
@@ -931,7 +930,10 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, xprt_args.ident =XPRT_TRANSPORT_TCP_TLS ; xprt_args.servername = servername; } -if (da->da_addr.ss_family != clp->cl_addr.ss_family) +if (xprt_args.ident != clp->cl_proto) +continue ; +if (xprt_args.dstaddr->sa_family != + clp->cl_addr.ss_family)continue ;/**
@@ -945,15 +947,14 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,if (xprtdata.cred)put_cred (xprtdata.cred); }else { -if (da->da_transport ==XPRT_TRANSPORT_TCP && - mds_srv->nfs_client->cl_proto == -XPRT_TRANSPORT_TCP_TLS ) - da->da_transport =XPRT_TRANSPORT_TCP_TLS ; - clp =nfs4_set_ds_client (mds_srv, - &da->da_addr, - da->da_addrlen, - da->da_transport, timeo, - retrans, minor_version); + ds_proto = da->da_transport; +if (ds_proto ==XPRT_TRANSPORT_TCP && + xprtsec_policy !=RPC_XPRTSEC_NONE ) + ds_proto =XPRT_TRANSPORT_TCP_TLS ; + + clp =nfs4_set_ds_client (mds_srv, &da->da_addr, + da->da_addrlen, ds_proto, + timeo, retrans, minor_version);if (IS_ERR (clp))continue ;
@@ -964,7 +965,6 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, clp =ERR_PTR (-EIO );continue ; } - } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/185 pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 8ab523ce78d4ca13add6b4ecbacff0f84c274603 ]
The default setting for the transport security policy must be RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS. Conversely, when using TLS, the security policy needs to be set.
--- fs/nfs/nfs3client.c | 14 ++++++++++++-- fs/nfs/nfs4client.c | 14 ++++++++++++-- 2 files changed, 24 insertions(+), 4 deletions(-)
fs/nfs/nfs3client.c +12 -2
@@ -2,6 +2,7 @@#include <linux/nfs_fs.h> #include <linux/nfs_mount.h> #include <linux/sunrpc/addr.h> +#include <net/handshake.h> #include "internal.h" #include "nfs3_fs.h" #include "netns.h"
@@ -98,7 +99,11 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, .net = mds_clp->cl_net, .timeparms = &ds_timeout, .cred = mds_srv->cred, - .xprtsec = mds_clp->cl_xprtsec, + .xprtsec = { + .policy = RPC_XPRTSEC_NONE, + .cert_serial = TLS_NO_CERT, + .privkey_serial = TLS_NO_PRIVKEY, + }, .connect_timeout = connect_timeout, .reconnect_timeout = connect_timeout, };
@@ -111,9 +116,14 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, cl_init.hostname = buf;switch (ds_proto) { +case XPRT_TRANSPORT_TCP_TLS : +if (mds_clp->cl_xprtsec.policy !=RPC_XPRTSEC_NONE ) + cl_init.xprtsec = mds_clp->cl_xprtsec; +else + ds_proto =XPRT_TRANSPORT_TCP ; + fallthrough;case XPRT_TRANSPORT_RDMA :case XPRT_TRANSPORT_TCP : -case XPRT_TRANSPORT_TCP_TLS :if (mds_clp->cl_nconnect >1 ) cl_init.nconnect = mds_clp->cl_nconnect; }
fs/nfs/nfs4client.c +12 -2
@@ -11,6 +11,7 @@#include <linux/sunrpc/xprt.h> #include <linux/sunrpc/bc_xprt.h> #include <linux/sunrpc/rpc_pipe_fs.h> +#include <net/handshake.h> #include "internal.h" #include "callback.h" #include "delegation.h"
@@ -992,7 +993,11 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, .net = mds_clp->cl_net, .timeparms = &ds_timeout, .cred = mds_srv->cred, - .xprtsec = mds_srv->nfs_client->cl_xprtsec, + .xprtsec = { + .policy = RPC_XPRTSEC_NONE, + .cert_serial = TLS_NO_CERT, + .privkey_serial = TLS_NO_PRIVKEY, + }, };char buf[INET6_ADDRSTRLEN +1 ];
@@ -1001,9 +1006,14 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, cl_init.hostname = buf;switch (ds_proto) { +case XPRT_TRANSPORT_TCP_TLS : +if (mds_srv->nfs_client->cl_xprtsec.policy !=RPC_XPRTSEC_NONE ) + cl_init.xprtsec = mds_srv->nfs_client->cl_xprtsec; +else + ds_proto =XPRT_TRANSPORT_TCP ; + fallthrough;case XPRT_TRANSPORT_RDMA :case XPRT_TRANSPORT_TCP : -case XPRT_TRANSPORT_TCP_TLS :if (mds_clp->cl_nconnect >1 ) { cl_init.nconnect = mds_clp->cl_nconnect; cl_init.max_connect =NFS_MAX_TRANSPORTS ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/185 simplify nfs_atomic_open_v23()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit aae9db5739164353fa1894db000fabad940a835b ]
1) finish_no_open() takes ERR_PTR() as dentry now.
2) caller of ->atomic_open() will call d_lookup_done() itself, no need to do it here.
Stable-dep-of: 85d2c2392ac6 ("NFSv2/v3: Fix error handling in nfs_atomic_open_v23()")
--- fs/nfs/dir.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
fs/nfs/dir.c +5 -11
@@ -2270,7 +2270,7 @@ int nfs_atomic_open_v23(struct inode *dir, struct dentry *dentry, struct file *file, unsigned int open_flags, umode_t mode) { - + struct dentry *res = NULL;/* Same as look+open from lookup_open(), but with different O_TRUNC * handling. */
@@ -2285,21 +2285,15 @@ int nfs_atomic_open_v23(struct inode *dir, struct dentry *dentry,if (error)return error;return finish_open (file, dentry,NULL ); - }else if (d_in_lookup (dentry)) { + } +if (d_in_lookup (dentry)) {/* The only flags nfs_lookup considers are * LOOKUP_EXCL and LOOKUP_RENAME_TARGET, and * we want those to be zero so the lookup isn't skipped. */ -struct dentry *res =nfs_lookup (dir, dentry,0 ); - -d_lookup_done (dentry); -if (unlikely (res)) { -if (IS_ERR (res)) -return PTR_ERR (res); -return finish_no_open (file, res); - } + res =nfs_lookup (dir, dentry,0 ); } -return finish_no_open (file,NULL ); +return finish_no_open (file, res); }EXPORT_SYMBOL_GPL (nfs_atomic_open_v23);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/185 NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 85d2c2392ac6348e1171d627497034a341a250c1 ]
When nfs_do_create() returns an EEXIST error, it means that a regular file could not be created. That could mean that a symlink needs to be resolved. If that's the case, a lookup needs to be kicked off.
--- fs/nfs/dir.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfs/dir.c +4 -3
@@ -2280,11 +2280,12 @@ int nfs_atomic_open_v23(struct inode *dir, struct dentry *dentry,return -ENAMETOOLONG ;if (open_flags &O_CREAT ) { - file->f_mode |=FMODE_CREATED ; error =nfs_do_create (dir, dentry, mode, open_flags); -if (error) +if (!error) { + file->f_mode |=FMODE_CREATED ; +return finish_open (file, dentry,NULL ); + }else if (error != -EEXIST || open_flags &O_EXCL )return error; -return finish_open (file, dentry,NULL ); }if (d_in_lookup (dentry)) {/* The only flags nfs_lookup considers are
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/185 NFS: sysfs: fix leak when nfs_client kobject add fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Xiuwei <[email protected]>
[ Upstream commit 7a7a3456520b309a0bffa1d9d62bd6c9dcab89b3 ]
If adding the second kobject fails, drop both references to avoid sysfs residue and memory leak.
--- fs/nfs/sysfs.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/sysfs.c +1 -0
@@ -189,6 +189,7 @@ static struct nfs_netns_client *nfs_netns_client_alloc(struct kobject *parent,return p;kobject_put (&p->kobject); +kobject_put (&p->nfs_net_kobj); }return NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/185 NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 1f214e9c3aef2d0936be971072e991d78a174d71 ]
The Smatch static checker noted that in _nfs4_proc_lookupp(), the flag RPC_TASK_TIMEOUT is being passed as an argument to nfs4_init_sequence(), which is clearly incorrect.
Since LOOKUPP is an idempotent operation, nfs4_init_sequence() should not ask the server to cache the result. The RPC_TASK_TIMEOUT flag needs to be passed down to the RPC layer.
--- fs/nfs/nfs4proc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/nfs/nfs4proc.c +6 -3
@@ -4695,16 +4695,19 @@ static int _nfs4_proc_lookupp(struct inode *inode, };unsigned short task_flags =0 ; -if (NFS_SERVER (inode)->flags &NFS_MOUNT_SOFTREVAL ) +if (server->flags &NFS_MOUNT_SOFTREVAL ) task_flags |=RPC_TASK_TIMEOUT ; +if (server->caps &NFS_CAP_MOVEABLE ) + task_flags |=RPC_TASK_MOVEABLE ; args.bitmask =nfs4_bitmask (server, fattr->label);nfs_fattr_init (fattr); +nfs4_init_sequence (&args.seq_args, &res.seq_res,0 ,0 );dprintk ("NFS call lookupp ino=0x%lx\n" , inode->i_ino); - status =nfs4_call_sync (clnt, server, &msg, &args.seq_args, - &res.seq_res, task_flags); + status =nfs4_do_call_sync (clnt, server, &msg, &args.seq_args, + &res.seq_res, task_flags);dprintk ("NFS reply lookupp: %d\n" , status);return status; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/185 NFS: Fix LTP test failures when timestamps are delegated
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
[ Upstream commit b623390045a81fc559decb9bfeb79319721d3dfb ]
The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the 'nobody' user ID.
The problem can be reproduced as follow:
# echo "/media *(rw,no_root_squash,sync)" >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp -d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06
This issue occurs because nfs_setattr does not verify the inode's UID against the caller's fsuid when delegated timestamps are permitted for the inode.
This patch adds the UID check and if it does not match then the request is sent to the server for permission checking.
--- fs/nfs/inode.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
fs/nfs/inode.c +12 -6
@@ -711,6 +711,8 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,struct inode *inode =d_inode (dentry);struct nfs_fattr *fattr;int error =0 ; +kuid_t task_uid =current_fsuid (); +kuid_t owner_uid = inode->i_uid;nfs_inc_stats (inode,NFSIOS_VFSSETATTR );
@@ -732,9 +734,11 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,if (nfs_have_delegated_mtime (inode) && attr->ia_valid &ATTR_MTIME ) {spin_lock (&inode->i_lock);if (attr->ia_valid &ATTR_MTIME_SET ) { -nfs_set_timestamps_to_ts (inode, attr); - attr->ia_valid &= ~(ATTR_MTIME |ATTR_MTIME_SET | +if (uid_eq (task_uid, owner_uid)) { +nfs_set_timestamps_to_ts (inode, attr); + attr->ia_valid &= ~(ATTR_MTIME |ATTR_MTIME_SET |ATTR_ATIME |ATTR_ATIME_SET ); + } }else {nfs_update_timestamps (inode, attr->ia_valid); attr->ia_valid &= ~(ATTR_MTIME |ATTR_ATIME );
@@ -744,10 +748,12 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, attr->ia_valid & ATTR_ATIME && !(attr->ia_valid & ATTR_MTIME)) {if (attr->ia_valid &ATTR_ATIME_SET ) { -spin_lock (&inode->i_lock); -nfs_set_timestamps_to_ts (inode, attr); -spin_unlock (&inode->i_lock); - attr->ia_valid &= ~(ATTR_ATIME |ATTR_ATIME_SET ); +if (uid_eq (task_uid, owner_uid)) { +spin_lock (&inode->i_lock); +nfs_set_timestamps_to_ts (inode, attr); +spin_unlock (&inode->i_lock); + attr->ia_valid &= ~(ATTR_ATIME |ATTR_ATIME_SET ); + } }else {nfs_update_delegated_atime (inode); attr->ia_valid &= ~ATTR_ATIME ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/185 ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haein Lee <[email protected]>
[ Upstream commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 ]
In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.
--- sound/usb/mixer.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/mixer.c +2 -0
@@ -3079,6 +3079,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,int i; assoc =usb_ifnum_to_if (dev, ctrlif)->intf_assoc; +if (!assoc) +return -EINVAL ;/* Detect BADD capture/playback channels from AS EP descriptors */ for (i =0 ; i < assoc->bInterfaceCount; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/185 acpi/hmat: Fix lockdep warning for hmem_register_resource()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit 214291cbaaceeb28debd773336642b1fca393ae0 ]
The following lockdep splat was observed while kernel auto-online a CXL memory region:
======================================================
WARNING: possible circular locking dependency detected
6.17.0djtest+ #53 Tainted: G W
------------------------------------------------------
systemd-udevd/3334 is trying to acquire lock:ffffffff90346188 (hmem_resource_lock){+.+.}-{4:4}, at: hmem_register_resource+0x31/0x50
but task is already holding lock:ffffffff90338890 ((node_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x2e/0x70
which lock already depends on the new lock.
[..]
Chain exists of: hmem_resource_lock --> mem_hotplug_lock --> (node_chain).rwsem Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock((node_chain).rwsem);
lock(mem_hotplug_lock);
lock((node_chain).rwsem); lock(hmem_resource_lock);
The lock ordering can cause potential deadlock. There are instances where hmem_resource_lock is taken after (node_chain).rwsem, and vice versa.
Split out the target update section of hmat_register_target() so that hmat_callback() only envokes that section instead of attempt to register hmem devices that it does not need to.
[ dj: Fix up comment to be closer to 80cols. (Jonathan) ]
--- drivers/acpi/numa/hmat.c | 46 ++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 21 deletions(-)
drivers/acpi/numa/hmat.c +25 -21
@@ -864,10 +864,32 @@ static void hmat_register_target_devices(struct memory_target *target) } } -static void hmat_register_target (struct memory_target *target) +static void hmat_hotplug_target (struct memory_target *target) {int nid =pxm_to_node (target->memory_pxm); +/* +* Skip offline nodes. This can happen when memory marked EFI_MEMORY_SP, +* "specific purpose", is applied to all the memory in a proximity +* domain leading to * the node being marked offline / unplugged, or if +* memory-only "hotplug" node is offline. +*/ +if (nid ==NUMA_NO_NODE || !node_online (nid)) +return ; + +guard (mutex)(&target_lock); +if (target->registered) +return ; + +hmat_register_target_initiators (target); +hmat_register_target_cache (target); +hmat_register_target_perf (target,ACCESS_COORDINATE_LOCAL ); +hmat_register_target_perf (target,ACCESS_COORDINATE_CPU ); + target->registered = true; +} + +static void hmat_register_target (struct memory_target *target) +{/* * Devices may belong to either an offline or online * node, so unconditionally add them.
@@ -885,25 +907,7 @@ static void hmat_register_target(struct memory_target *target) }mutex_unlock (&target_lock); -/* -* Skip offline nodes. This can happen when memory -* marked EFI_MEMORY_SP, "specific purpose", is applied -* to all the memory in a proximity domain leading to -* the node being marked offline / unplugged, or if -* memory-only "hotplug" node is offline. -*/ -if (nid ==NUMA_NO_NODE || !node_online (nid)) -return ; - -mutex_lock (&target_lock); -if (!target->registered) { -hmat_register_target_initiators (target); -hmat_register_target_cache (target); -hmat_register_target_perf (target,ACCESS_COORDINATE_LOCAL ); -hmat_register_target_perf (target,ACCESS_COORDINATE_CPU ); - target->registered = true; - } -mutex_unlock (&target_lock); +hmat_hotplug_target (target); }static void hmat_register_targets (void )
@@ -929,7 +933,7 @@ static int hmat_callback(struct notifier_block *self,if (!target)return NOTIFY_OK ; -hmat_register_target (target); +hmat_hotplug_target (target);return NOTIFY_OK ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/185 bpf: Add bpf_prog_run_data_pointers()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4ef92743625818932b9c320152b58274c05e5053 ]
syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline] WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214
struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong interaction with db58ba459202 ("bpf: wire in data and data_end for cls_act_bpf").
drop_reason was added later.
Add bpf_prog_run_data_pointers() helper to save/restore the net_sched storage colliding with BPF data_meta/data_end.
--- include/linux/filter.h | 20 ++++++++++++++++++++ net/sched/act_bpf.c | 6 ++---- net/sched/cls_bpf.c | 6 ++---- 3 files changed, 24 insertions(+), 8 deletions(-)
include/linux/filter.h +20 -0
@@ -881,6 +881,26 @@ static inline void bpf_compute_data_pointers(struct sk_buff *skb) cb->data_end = skb->data +skb_headlen (skb); } +static inline int bpf_prog_run_data_pointers ( +const struct bpf_prog *prog, +struct sk_buff *skb) +{ +struct bpf_skb_data_end *cb = (struct bpf_skb_data_end *)skb->cb; +void *save_data_meta, *save_data_end; +int res; + + save_data_meta = cb->data_meta; + save_data_end = cb->data_end; + +bpf_compute_data_pointers (skb); + res =bpf_prog_run (prog, skb); + + cb->data_meta = save_data_meta; + cb->data_end = save_data_end; + +return res; +} +/* Similar to bpf_compute_data_pointers(), except that save orginal * data in cb->data and cb->meta_data for restore. */
net/sched/act_bpf.c +2 -4
@@ -47,12 +47,10 @@ TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb, filter =rcu_dereference (prog->filter);if (at_ingress) {__skb_push (skb, skb->mac_len); -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (filter, skb); + filter_res =bpf_prog_run_data_pointers (filter, skb);__skb_pull (skb, skb->mac_len); }else { -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (filter, skb); + filter_res =bpf_prog_run_data_pointers (filter, skb); }if (unlikely (!skb->tstamp && skb->tstamp_type)) skb->tstamp_type =SKB_CLOCK_REALTIME ;
net/sched/cls_bpf.c +2 -4
@@ -97,12 +97,10 @@ TC_INDIRECT_SCOPE int cls_bpf_classify(struct sk_buff *skb, }else if (at_ingress) {/* It is safe to push/pull even if skb_shared() */ __skb_push (skb, skb->mac_len); -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (prog->filter, skb); + filter_res =bpf_prog_run_data_pointers (prog->filter, skb);__skb_pull (skb, skb->mac_len); }else { -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (prog->filter, skb); + filter_res =bpf_prog_run_data_pointers (prog->filter, skb); }if (unlikely (!skb->tstamp && skb->tstamp_type)) skb->tstamp_type =SKB_CLOCK_REALTIME ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/185 bpf: account for current allocated stack depth in widen_imprecise_scalars()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit b0c8e6d3d866b6a7f73877f71968dbffd27b7785 ]
The usage pattern for widen_imprecise_scalars() looks as follows:
prev_st = find_prev_entry(env, ...);
queued_st = push_stack(...);
widen_imprecise_scalars(env, prev_st, queued_st);Where prev_st is an ancestor of the queued_st in the explored states tree. This ancestor is not guaranteed to have same allocated stack depth as queued_st. E.g. in the following case:
def main():
for i in 1..2:
foo(i) // same callsite, differnt param
def foo(i):
if i == 1:
use 128 bytes of stack
iterator based loopHere, for a second 'foo' call prev_st->allocated_stack is 128, while queued_st->allocated_stack is much smaller. widen_imprecise_scalars() needs to take this into account and avoid accessing bpf_verifier_state->frame[*]->stack out of bounds.
--- kernel/bpf/verifier.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/bpf/verifier.c +4 -2
@@ -8228,7 +8228,7 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env, struct bpf_verifier_state *cur) {struct bpf_func_state *fold, *fcur; -int i, fr; +int i, fr, num_slots;reset_idmap_scratch (env);for (fr = old->curframe; fr >=0 ; fr--) {
@@ -8241,7 +8241,9 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env, &fcur->regs[i], &env->idmap_scratch); -for (i =0 ; i < fold->allocated_stack /BPF_REG_SIZE ; i++) { + num_slots =min (fold->allocated_stack /BPF_REG_SIZE , + fcur->allocated_stack /BPF_REG_SIZE ); +for (i =0 ; i < num_slots; i++) {if (!is_spilled_reg (&fold->stack[i]) || !is_spilled_reg (&fcur->stack[i]))continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/185 irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Hu <[email protected]>
[ Upstream commit 14473a1f88596fd729e892782efc267c0097dd1d ]
The irq_domain_free_irqs() helper requires that the irq_domain_ops->free callback is implemented. Otherwise, the kernel reports the warning message "NULL pointer, cannot free irq" when irq_dispose_mapping() is invoked to release the per-HART local interrupts.
Set irq_domain_ops->free to irq_domain_free_irqs_top() to cure that.
--- drivers/irqchip/irq-riscv-intc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/irqchip/irq-riscv-intc.c +2 -1
@@ -166,7 +166,8 @@ static int riscv_intc_domain_alloc(struct irq_domain *domain,static const struct irq_domain_ops riscv_intc_domain_ops = { .map = riscv_intc_domain_map, .xlate = irq_domain_xlate_onecell, - .alloc = riscv_intc_domain_alloc + .alloc = riscv_intc_domain_alloc, + .free = irq_domain_free_irqs_top, };static struct fwnode_handle *riscv_intc_hwnode (void )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/185 wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 68410c5bd381a81bcc92b808e7dc4e6b9ed25d11 ]
If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right after the allocation of IRQ vectors in ath11k_pci_alloc_msi(). This does no harm unless one of the functions requesting the IRQ fails and attempt to free the IRQ. This results in the below warning:
WARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c Call trace: free_irq+0x278/0x29c ath11k_pcic_free_irq+0x70/0x10c [ath11k] ath11k_pci_probe+0x800/0x820 [ath11k_pci] local_pci_probe+0x40/0xbc
The warning is due to not clearing the affinity hint before freeing the IRQs.
So to fix this issue, clear the IRQ affinity hint before calling ath11k_pcic_free_irq() in the error path. The affinity will be cleared once again further down the error path due to code organization, but that does no harm.
Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1
--- drivers/net/wireless/ath/ath11k/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/ath/ath11k/pci.c +2 -0
@@ -936,6 +936,8 @@ static int ath11k_pci_probe(struct pci_dev *pdev,return 0 ; err_free_irq: +/* __free_irq() expects the caller to have cleared the affinity hint */ +ath11k_pci_set_irq_affinity_hint (ab_pci,NULL );ath11k_pcic_free_irq (ab); err_ce_free:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/185 proc: fix the issue of proc_mem_open returning NULL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Penglei Jiang <[email protected]>
[ Upstream commit 65c66047259fad1b868d4454bc5af95b46a5f954 ]
proc_mem_open() can return an errno, NULL, or mm_struct*. If it fails to acquire mm, it returns NULL, but the caller does not check for the case when the return value is NULL.
The following conditions lead to failure in acquiring mm:
- The task is a kernel thread (PF_KTHREAD)
- The task is exiting (PF_EXITING)
Changes:
- Add documentation comments for the return value of proc_mem_open().
- Add checks in the caller to return -ESRCH when proc_mem_open() returns NULL.
--- fs/proc/base.c | 12 +++++++++--- fs/proc/task_mmu.c | 12 ++++++------ fs/proc/task_nommu.c | 4 ++-- 3 files changed, 17 insertions(+), 11 deletions(-)
fs/proc/base.c +9 -3
@@ -828,7 +828,13 @@ static const struct file_operations proc_single_file_operations = { .release = single_release, }; - +/* +* proc_mem_open() can return errno, NULL or mm_struct*. +* +* - Returns NULL if the task has no mm (PF_KTHREAD or PF_EXITING) +* - Returns mm_struct* on success +* - Returns error code on failure +*/ struct mm_struct *proc_mem_open (struct inode *inode,unsigned int mode) {struct task_struct *task =get_proc_task (inode);
@@ -853,8 +859,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) {struct mm_struct *mm =proc_mem_open (inode, mode); -if (IS_ERR (mm)) -return PTR_ERR (mm); +if (IS_ERR_OR_NULL (mm)) +return mm ?PTR_ERR (mm) : -ESRCH ; file->private_data = mm;return 0 ;
fs/proc/task_mmu.c +6 -6
@@ -212,8 +212,8 @@ static int proc_maps_open(struct inode *inode, struct file *file, priv->inode = inode; priv->mm =proc_mem_open (inode,PTRACE_MODE_READ ); -if (IS_ERR (priv->mm)) { -int err =PTR_ERR (priv->mm); +if (IS_ERR_OR_NULL (priv->mm)) { +int err = priv->mm ?PTR_ERR (priv->mm) : -ESRCH ;seq_release_private (inode, file);return err;
@@ -1316,8 +1316,8 @@ static int smaps_rollup_open(struct inode *inode, struct file *file) priv->inode = inode; priv->mm =proc_mem_open (inode,PTRACE_MODE_READ ); -if (IS_ERR (priv->mm)) { - ret =PTR_ERR (priv->mm); +if (IS_ERR_OR_NULL (priv->mm)) { + ret = priv->mm ?PTR_ERR (priv->mm) : -ESRCH ;single_release (inode, file); goto out_free;
@@ -2049,8 +2049,8 @@ static int pagemap_open(struct inode *inode, struct file *file)struct mm_struct *mm; mm =proc_mem_open (inode,PTRACE_MODE_READ ); -if (IS_ERR (mm)) -return PTR_ERR (mm); +if (IS_ERR_OR_NULL (mm)) +return mm ?PTR_ERR (mm) : -ESRCH ; file->private_data = mm;return 0 ; }
fs/proc/task_nommu.c +2 -2
@@ -260,8 +260,8 @@ static int maps_open(struct inode *inode, struct file *file, priv->inode = inode; priv->mm =proc_mem_open (inode,PTRACE_MODE_READ ); -if (IS_ERR (priv->mm)) { -int err =PTR_ERR (priv->mm); +if (IS_ERR_OR_NULL (priv->mm)) { +int err = priv->mm ?PTR_ERR (priv->mm) : -ESRCH ;seq_release_private (inode, file);return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/185 ext4: introduce ITAIL helper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 69f3a3039b0d0003de008659cafd5a1eaaa0a7a4 ]
Introduce ITAIL helper to get the bound of xattr in inode.
--- fs/ext4/xattr.c | 10 +++++----- fs/ext4/xattr.h | 3 +++ 2 files changed, 8 insertions(+), 5 deletions(-)
fs/ext4/xattr.c +5 -5
@@ -653,7 +653,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,return error; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); error =xattr_check_inode (inode, header, end);if (error) goto cleanup;
@@ -797,7 +797,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)return error; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); error =xattr_check_inode (inode, header, end);if (error) goto cleanup;
@@ -883,7 +883,7 @@ int ext4_get_inode_usage(struct inode *inode, qsize_t *usage) goto out; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); ret =xattr_check_inode (inode, header, end);if (ret) goto out;
@@ -2249,7 +2249,7 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, header =IHDR (inode, raw_inode); is->s.base = is->s.first =IFIRST (header); is->s.here = is->s.first; - is->s.end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + is->s.end =ITAIL (inode, raw_inode);if (ext4_test_inode_state (inode,EXT4_STATE_XATTR )) { error =xattr_check_inode (inode, header, is->s.end);if (error)
@@ -2800,7 +2800,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,*/ base =IFIRST (header); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); min_offs = end - base; total_ino =sizeof (struct ext4_xattr_ibody_header ) +sizeof (u32);
fs/ext4/xattr.h +3 -0
@@ -67,6 +67,9 @@ struct ext4_xattr_entry { ((void *)raw_inode + \ EXT4_GOOD_OLD_INODE_SIZE + \ EXT4_I(inode)->i_extra_isize)) +#define ITAIL (inode, raw_inode) \ + ((void *)(raw_inode) + \ + EXT4_SB((inode)->i_sb)->s_inode_size)#define IFIRST (hdr) ((struct ext4_xattr_entry *)((hdr)+1))/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/185 lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 44e8241c51f762aafa50ed116da68fd6ecdcc954 upstream.
On big endian arm kernels, the arm optimized Curve25519 code produces incorrect outputs and fails the Curve25519 test. This has been true ever since this code was added.
It seems that hardly anyone (or even no one?) actually uses big endian arm kernels. But as long as they're ostensibly supported, we should disable this code on them so that it's not accidentally used.
Note: for future-proofing, use !CPU_BIG_ENDIAN instead of CPU_LITTLE_ENDIAN. Both of these are arch-specific options that could get removed in the future if big endian support gets dropped.
--- arch/arm/crypto/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/crypto/Kconfig +1 -1
@@ -4,7 +4,7 @@ menu "Accelerated Cryptographic Algorithms for CPU (arm)" config CRYPTO_CURVE25519_NEON tristate - depends on KERNEL_MODE_NEON + depends on KERNEL_MODE_NEON && !CPU_BIG_ENDIAN select CRYPTO_KPP select CRYPTO_LIB_CURVE25519_GENERIC select CRYPTO_ARCH_HAVE_LIB_CURVE25519
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/185 ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 5701875f9609b000d91351eaa6bfd97fe2f157f4 ]
There's issue as follows:
BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790
Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172
CPU: 3 PID: 15172 Comm: syz-executor.0
Call Trace:
__dump_stack lib/dump_stack.c:82 [inline]
dump_stack+0xbe/0xfd lib/dump_stack.c:123
print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400
__kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560
kasan_report+0x3a/0x50 mm/kasan/report.c:585
ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137
ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896
ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323
evict+0x39f/0x880 fs/inode.c:622
iput_final fs/inode.c:1746 [inline]
iput fs/inode.c:1772 [inline]
iput+0x525/0x6c0 fs/inode.c:1758
ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]
ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300
mount_bdev+0x355/0x410 fs/super.c:1446
legacy_get_tree+0xfe/0x220 fs/fs_context.c:611
vfs_get_tree+0x8d/0x2f0 fs/super.c:1576
do_new_mount fs/namespace.c:2983 [inline]
path_mount+0x119a/0x1ad0 fs/namespace.c:3316
do_mount+0xfc/0x110 fs/namespace.c:3329
__do_sys_mount fs/namespace.c:3540 [inline]
__se_sys_mount+0x219/0x2e0 fs/namespace.c:3514
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Memory state around the buggy address:
ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffAbove issue happens as ext4_xattr_delete_inode() isn't check xattr is valid if xattr is in inode.
To solve above issue call xattr_check_inode() check if xattr if valid in inode. In fact, we can directly verify in ext4_iget_extra_inode(), so that there is no divergent verification.
--- fs/ext4/inode.c | 5 +++++ fs/ext4/xattr.c | 26 +------------------------- fs/ext4/xattr.h | 7 +++++++ 3 files changed, 13 insertions(+), 25 deletions(-)
fs/ext4/inode.c +5 -0
@@ -4688,6 +4688,11 @@ static inline int ext4_iget_extra_inode(struct inode *inode, *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {int err; + err =xattr_check_inode (inode,IHDR (inode, raw_inode), +ITAIL (inode, raw_inode)); +if (err) +return err; +ext4_set_inode_state (inode,EXT4_STATE_XATTR ); err =ext4_find_inline_data_nolock (inode);if (!err &&ext4_has_inline_data (inode))
fs/ext4/xattr.c +1 -25
@@ -312,7 +312,7 @@ __ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh, __ext4_xattr_check_block((inode), (bh), __func__, __LINE__) -static inline int +int __xattr_check_inode (struct inode *inode,struct ext4_xattr_ibody_header *header,void *end,const char *function,unsigned int line) {
@@ -320,9 +320,6 @@ __xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header, function, line); } -#define xattr_check_inode (inode, header, end) \ - __xattr_check_inode((inode), (header), (end), __func__, __LINE__) -static int xattr_find_entry (struct inode *inode,struct ext4_xattr_entry **pentry,void *end,int name_index,const char *name,int sorted)
@@ -654,9 +651,6 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); end =ITAIL (inode, raw_inode); - error =xattr_check_inode (inode, header, end); -if (error) - goto cleanup; entry =IFIRST (header); error =xattr_find_entry (inode, &entry, end, name_index, name,0 );if (error)
@@ -787,7 +781,6 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)struct ext4_xattr_ibody_header *header;struct ext4_inode *raw_inode;struct ext4_iloc iloc; -void *end;int error;if (!ext4_test_inode_state (inode,EXT4_STATE_XATTR ))
@@ -797,14 +790,9 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)return error; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end =ITAIL (inode, raw_inode); - error =xattr_check_inode (inode, header, end); -if (error) - goto cleanup; error =ext4_xattr_list_entries (dentry,IFIRST (header), buffer, buffer_size); -cleanup:brelse (iloc.bh);return error; }
@@ -872,7 +860,6 @@ int ext4_get_inode_usage(struct inode *inode, qsize_t *usage)struct ext4_xattr_ibody_header *header;struct ext4_xattr_entry *entry;qsize_t ea_inode_refs =0 ; -void *end;int ret;lockdep_assert_held_read (&EXT4_I (inode)->xattr_sem);
@@ -883,10 +870,6 @@ int ext4_get_inode_usage(struct inode *inode, qsize_t *usage) goto out; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end =ITAIL (inode, raw_inode); - ret =xattr_check_inode (inode, header, end); -if (ret) - goto out;for (entry =IFIRST (header); !IS_LAST_ENTRY (entry); entry =EXT4_XATTR_NEXT (entry))
@@ -2251,9 +2234,6 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, is->s.here = is->s.first; is->s.end =ITAIL (inode, raw_inode);if (ext4_test_inode_state (inode,EXT4_STATE_XATTR )) { - error =xattr_check_inode (inode, header, is->s.end); -if (error) -return error;/* Find the named attribute. */ error =xattr_find_entry (inode, &is->s.here, is->s.end, i->name_index, i->name,0 );
@@ -2804,10 +2784,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, min_offs = end - base; total_ino =sizeof (struct ext4_xattr_ibody_header ) +sizeof (u32); - error =xattr_check_inode (inode, header, end); -if (error) - goto cleanup; - ifree =ext4_xattr_free_space (base, &min_offs, base, &total_ino);if (ifree >= isize_diff) goto shift;
fs/ext4/xattr.h +7 -0
@@ -209,6 +209,13 @@ extern int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,extern struct mb_cache *ext4_xattr_create_cache (void );extern void ext4_xattr_destroy_cache (struct mb_cache *); +extern int +__xattr_check_inode (struct inode *inode,struct ext4_xattr_ibody_header *header, +void *end,const char *function,unsigned int line); + +#define xattr_check_inode (inode, header, end) \ + __xattr_check_inode((inode), (header), (end), __func__, __LINE__) +#ifdef CONFIG_EXT4_FS_SECURITY extern int ext4_init_security (handle_t *handle,struct inode *inode,struct inode *dir,const struct qstr *qstr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/185 Bluetooth: MGMT: Fix possible UAFs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 302a1f674c00dd5581ab8e493ef44767c5101aab ]
This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pending_valid is introduce and use to check if the mgmt_pending hasn't been removed from the pending list, on the complete callbacks it is used to check and in addtion remove the cmd from the list while holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd is left on the list it can still be accessed and freed.
BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 Read of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55 CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 12210: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247 add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 sock_write_iter+0x258/0x330 net/socket.c:1133 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12221: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4648 [inline] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline] hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192 sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/bluetooth/mgmt.c | 259 ++++++++++++++++++++++++++------------ net/bluetooth/mgmt_util.c | 46 +++++++ net/bluetooth/mgmt_util.h | 3 + 3 files changed, 231 insertions(+), 77 deletions(-)
net/bluetooth/mgmt.c +182 -77
@@ -1318,8 +1318,7 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)struct mgmt_mode *cp;/* Make sure cmd still outstanding. */ -if (err == -ECANCELED || - cmd !=pending_find (MGMT_OP_SET_POWERED , hdev)) +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ; cp = cmd->param;
@@ -1346,23 +1345,29 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) mgmt_status(err)); } -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); }static int set_powered_sync (struct hci_dev *hdev,void *data) {struct mgmt_pending_cmd *cmd = data; -struct mgmt_mode *cp; +struct mgmt_mode cp; + +mutex_lock (&hdev->mgmt_pending_lock);/* Make sure cmd still outstanding. */ -if (cmd !=pending_find (MGMT_OP_SET_POWERED , hdev)) +if (!__mgmt_pending_listed (hdev, cmd)) { +mutex_unlock (&hdev->mgmt_pending_lock);return -ECANCELED ; + } - cp = cmd->param; +memcpy (&cp, cmd->param,sizeof (cp)); + +mutex_unlock (&hdev->mgmt_pending_lock);BT_DBG ("%s" , hdev->name); -return hci_set_powered_sync (hdev, cp->val); +return hci_set_powered_sync (hdev, cp.val); } static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -1511,8 +1516,7 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,bt_dev_dbg (hdev,"err %d" , err);/* Make sure cmd still outstanding. */ -if (err == -ECANCELED || - cmd !=pending_find (MGMT_OP_SET_DISCOVERABLE , hdev)) +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ;hci_dev_lock (hdev);
@@ -1534,12 +1538,15 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,new_settings (hdev, cmd->sk); done: -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd);hci_dev_unlock (hdev); }static int set_discoverable_sync (struct hci_dev *hdev,void *data) { +if (!mgmt_pending_listed (hdev, data)) +return -ECANCELED ; +BT_DBG ("%s" , hdev->name);return hci_update_discoverable_sync (hdev);
@@ -1686,8 +1693,7 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,bt_dev_dbg (hdev,"err %d" , err);/* Make sure cmd still outstanding. */ -if (err == -ECANCELED || - cmd !=pending_find (MGMT_OP_SET_CONNECTABLE , hdev)) +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ;hci_dev_lock (hdev);
@@ -1702,7 +1708,7 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,new_settings (hdev, cmd->sk); done: -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd);hci_dev_unlock (hdev); }
@@ -1738,6 +1744,9 @@ static int set_connectable_update_settings(struct hci_dev *hdev,static int set_connectable_sync (struct hci_dev *hdev,void *data) { +if (!mgmt_pending_listed (hdev, data)) +return -ECANCELED ; +BT_DBG ("%s" , hdev->name);return hci_update_connectable_sync (hdev);
@@ -1914,14 +1923,17 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) {struct cmd_lookup match = {NULL , hdev };struct mgmt_pending_cmd *cmd = data; -struct mgmt_mode *cp = cmd->param; -u8 enable = cp->val; +struct mgmt_mode *cp; +u8 enable;bool changed;/* Make sure cmd still outstanding. */ -if (err == -ECANCELED || cmd !=pending_find (MGMT_OP_SET_SSP , hdev)) +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ; + cp = cmd->param; + enable = cp->val; +if (err) {u8 mgmt_err =mgmt_status (err);
@@ -1930,8 +1942,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)new_settings (hdev,NULL ); } -mgmt_pending_foreach (MGMT_OP_SET_SSP , hdev, true, - cmd_status_rsp, &mgmt_err); +mgmt_cmd_status (cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);return ; }
@@ -1941,7 +1952,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) changed =hci_dev_test_and_clear_flag (hdev,HCI_SSP_ENABLED ); } -mgmt_pending_foreach (MGMT_OP_SET_SSP , hdev, true, settings_rsp, &match); +settings_rsp (cmd, &match);if (changed)new_settings (hdev, match.sk);
@@ -1955,14 +1966,25 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)static int set_ssp_sync (struct hci_dev *hdev,void *data) {struct mgmt_pending_cmd *cmd = data; -struct mgmt_mode *cp = cmd->param; +struct mgmt_mode cp;bool changed = false;int err; -if (cp->val) +mutex_lock (&hdev->mgmt_pending_lock); + +if (!__mgmt_pending_listed (hdev, cmd)) { +mutex_unlock (&hdev->mgmt_pending_lock); +return -ECANCELED ; + } + +memcpy (&cp, cmd->param,sizeof (cp)); + +mutex_unlock (&hdev->mgmt_pending_lock); + +if (cp.val) changed = !hci_dev_test_and_set_flag (hdev,HCI_SSP_ENABLED ); - err =hci_write_ssp_mode_sync (hdev, cp->val); + err =hci_write_ssp_mode_sync (hdev, cp.val);if (!err && changed)hci_dev_clear_flag (hdev,HCI_SSP_ENABLED );
@@ -2055,32 +2077,50 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)static void set_le_complete (struct hci_dev *hdev,void *data,int err) { +struct mgmt_pending_cmd *cmd = data;struct cmd_lookup match = {NULL , hdev };u8 status =mgmt_status (err);bt_dev_dbg (hdev,"err %d" , err); -if (status) { -mgmt_pending_foreach (MGMT_OP_SET_LE , hdev, true, cmd_status_rsp, - &status); +if (err == -ECANCELED || !mgmt_pending_valid (hdev, data))return ; + +if (status) { +mgmt_cmd_status (cmd->sk, cmd->hdev->id, cmd->opcode, status); + goto done; } -mgmt_pending_foreach (MGMT_OP_SET_LE , hdev, true, settings_rsp, &match); +settings_rsp (cmd, &match);new_settings (hdev, match.sk);if (match.sk)sock_put (match.sk); + +done: +mgmt_pending_free (cmd); }static int set_le_sync (struct hci_dev *hdev,void *data) {struct mgmt_pending_cmd *cmd = data; -struct mgmt_mode *cp = cmd->param; -u8 val = !!cp->val; +struct mgmt_mode cp; +u8 val;int err; +mutex_lock (&hdev->mgmt_pending_lock); + +if (!__mgmt_pending_listed (hdev, cmd)) { +mutex_unlock (&hdev->mgmt_pending_lock); +return -ECANCELED ; + } + +memcpy (&cp, cmd->param,sizeof (cp)); + val = !!cp.val; + +mutex_unlock (&hdev->mgmt_pending_lock); +if (!val) {hci_clear_adv_instance_sync (hdev,NULL ,0x00 , true);
@@ -2122,7 +2162,12 @@ static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) {struct mgmt_pending_cmd *cmd = data;u8 status =mgmt_status (err); -struct sock *sk = cmd->sk; +struct sock *sk; + +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd)) +return ; + + sk = cmd->sk;if (status) { mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, true,
@@ -2137,24 +2182,37 @@ static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)static int set_mesh_sync (struct hci_dev *hdev,void *data) {struct mgmt_pending_cmd *cmd = data; -struct mgmt_cp_set_mesh *cp = cmd->param; -size_t len = cmd->param_len; +struct mgmt_cp_set_mesh cp; +size_t len; + +mutex_lock (&hdev->mgmt_pending_lock); + +if (!__mgmt_pending_listed (hdev, cmd)) { +mutex_unlock (&hdev->mgmt_pending_lock); +return -ECANCELED ; + } + +memcpy (&cp, cmd->param,sizeof (cp)); + +mutex_unlock (&hdev->mgmt_pending_lock); + + len = cmd->param_len;memset (hdev->mesh_ad_types,0 ,sizeof (hdev->mesh_ad_types)); -if (cp->enable) +if (cp.enable)hci_dev_set_flag (hdev,HCI_MESH );else hci_dev_clear_flag (hdev,HCI_MESH ); - hdev->le_scan_interval =__le16_to_cpu (cp->period); - hdev->le_scan_window =__le16_to_cpu (cp->window); + hdev->le_scan_interval =__le16_to_cpu (cp.period); + hdev->le_scan_window =__le16_to_cpu (cp.window); - len -=sizeof (*cp); + len -=sizeof (cp);/* If filters don't fit, forward all adv pkts */ if (len <=sizeof (hdev->mesh_ad_types)) -memcpy (hdev->mesh_ad_types, cp->ad_types, len); +memcpy (hdev->mesh_ad_types, cp.ad_types, len);hci_update_passive_scan_sync (hdev);return 0 ;
@@ -3801,15 +3859,16 @@ static int name_changed_sync(struct hci_dev *hdev, void *data)static void set_name_complete (struct hci_dev *hdev,void *data,int err) {struct mgmt_pending_cmd *cmd = data; -struct mgmt_cp_set_local_name *cp = cmd->param; +struct mgmt_cp_set_local_name *cp;u8 status =mgmt_status (err);bt_dev_dbg (hdev,"err %d" , err); -if (err == -ECANCELED || - cmd !=pending_find (MGMT_OP_SET_LOCAL_NAME , hdev)) +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ; + cp = cmd->param; +if (status) {mgmt_cmd_status (cmd->sk, hdev->id,MGMT_OP_SET_LOCAL_NAME , status);
@@ -3821,16 +3880,27 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err)hci_cmd_sync_queue (hdev, name_changed_sync,NULL ,NULL ); } -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); }static int set_name_sync (struct hci_dev *hdev,void *data) {struct mgmt_pending_cmd *cmd = data; -struct mgmt_cp_set_local_name *cp = cmd->param; +struct mgmt_cp_set_local_name cp; + +mutex_lock (&hdev->mgmt_pending_lock); + +if (!__mgmt_pending_listed (hdev, cmd)) { +mutex_unlock (&hdev->mgmt_pending_lock); +return -ECANCELED ; + } + +memcpy (&cp, cmd->param,sizeof (cp)); + +mutex_unlock (&hdev->mgmt_pending_lock);if (lmp_bredr_capable (hdev)) { -hci_update_name_sync (hdev, cp->name); +hci_update_name_sync (hdev, cp.name);hci_update_eir_sync (hdev); }
@@ -3982,12 +4052,10 @@ int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)static void set_default_phy_complete (struct hci_dev *hdev,void *data,int err) {struct mgmt_pending_cmd *cmd = data; -struct sk_buff *skb = cmd->skb; +struct sk_buff *skb;u8 status =mgmt_status (err); -if (err == -ECANCELED || - cmd !=pending_find (MGMT_OP_SET_PHY_CONFIGURATION , hdev)) -return ; + skb = cmd->skb;if (!status) {if (!skb)
@@ -4014,7 +4082,7 @@ static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)if (skb && !IS_ERR (skb))kfree_skb (skb); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); }static int set_default_phy_sync (struct hci_dev *hdev,void *data)
@@ -4022,7 +4090,9 @@ static int set_default_phy_sync(struct hci_dev *hdev, void *data)struct mgmt_pending_cmd *cmd = data;struct mgmt_cp_set_phy_configuration *cp = cmd->param;struct hci_cp_le_set_default_phy cp_phy; -u32 selected_phys =__le32_to_cpu (cp->selected_phys); +u32 selected_phys; + + selected_phys =__le32_to_cpu (cp->selected_phys);memset (&cp_phy,0 ,sizeof (cp_phy));
@@ -4162,7 +4232,7 @@ static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, goto unlock; } - cmd =mgmt_pending_add (sk,MGMT_OP_SET_PHY_CONFIGURATION , hdev, data, + cmd =mgmt_pending_new (sk,MGMT_OP_SET_PHY_CONFIGURATION , hdev, data, len);if (!cmd) err = -ENOMEM ;
@@ -5252,7 +5322,17 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, {struct mgmt_rp_add_adv_patterns_monitor rp;struct mgmt_pending_cmd *cmd = data; -struct adv_monitor *monitor = cmd->user_data; +struct adv_monitor *monitor; + +/* This is likely the result of hdev being closed and mgmt_index_removed +* is attempting to clean up any pending command so +* hci_adv_monitors_clear is about to be called which will take care of +* freeing the adv_monitor instances. +*/ +if (status == -ECANCELED && !mgmt_pending_valid (hdev, cmd)) +return ; + + monitor = cmd->user_data;hci_dev_lock (hdev);
@@ -5278,9 +5358,20 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,static int mgmt_add_adv_patterns_monitor_sync (struct hci_dev *hdev,void *data) {struct mgmt_pending_cmd *cmd = data; -struct adv_monitor *monitor = cmd->user_data; +struct adv_monitor *mon; + +mutex_lock (&hdev->mgmt_pending_lock); + +if (!__mgmt_pending_listed (hdev, cmd)) { +mutex_unlock (&hdev->mgmt_pending_lock); +return -ECANCELED ; + } + + mon = cmd->user_data; + +mutex_unlock (&hdev->mgmt_pending_lock); -return hci_add_adv_monitor (hdev, monitor); +return hci_add_adv_monitor (hdev, mon); } static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
@@ -5547,7 +5638,8 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, status); } -static void read_local_oob_data_complete (struct hci_dev *hdev,void *data,int err) +static void read_local_oob_data_complete (struct hci_dev *hdev,void *data, +int err) {struct mgmt_rp_read_local_oob_data mgmt_rp;size_t rp_size =sizeof (mgmt_rp);
@@ -5567,7 +5659,8 @@ static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int ebt_dev_dbg (hdev,"status %d" , status);if (status) { -mgmt_cmd_status (cmd->sk, hdev->id,MGMT_OP_READ_LOCAL_OOB_DATA , status); +mgmt_cmd_status (cmd->sk, hdev->id,MGMT_OP_READ_LOCAL_OOB_DATA , + status); goto remove; }
@@ -5872,17 +5965,12 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)bt_dev_dbg (hdev,"err %d" , err); -if (err == -ECANCELED ) -return ; - -if (cmd !=pending_find (MGMT_OP_START_DISCOVERY , hdev) && - cmd !=pending_find (MGMT_OP_START_LIMITED_DISCOVERY , hdev) && - cmd !=pending_find (MGMT_OP_START_SERVICE_DISCOVERY , hdev)) +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ;mgmt_cmd_complete (cmd->sk, cmd->hdev->id, cmd->opcode,mgmt_status (err), cmd->param,1 ); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd);hci_discovery_set_state (hdev, err ?DISCOVERY_STOPPED :DISCOVERY_FINDING );
@@ -5890,6 +5978,9 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)static int start_discovery_sync (struct hci_dev *hdev,void *data) { +if (!mgmt_pending_listed (hdev, data)) +return -ECANCELED ; +return hci_start_discovery_sync (hdev); }
@@ -6112,15 +6203,14 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) {struct mgmt_pending_cmd *cmd = data; -if (err == -ECANCELED || - cmd !=pending_find (MGMT_OP_STOP_DISCOVERY , hdev)) +if (err == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ;bt_dev_dbg (hdev,"err %d" , err);mgmt_cmd_complete (cmd->sk, cmd->hdev->id, cmd->opcode,mgmt_status (err), cmd->param,1 ); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd);if (!err)hci_discovery_set_state (hdev,DISCOVERY_STOPPED );
@@ -6128,6 +6218,9 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)static int stop_discovery_sync (struct hci_dev *hdev,void *data) { +if (!mgmt_pending_listed (hdev, data)) +return -ECANCELED ; +return hci_stop_discovery_sync (hdev); }
@@ -6337,14 +6430,18 @@ static void enable_advertising_instance(struct hci_dev *hdev, int err)static void set_advertising_complete (struct hci_dev *hdev,void *data,int err) { +struct mgmt_pending_cmd *cmd = data;struct cmd_lookup match = {NULL , hdev };u8 instance;struct adv_info *adv_instance;u8 status =mgmt_status (err); +if (err == -ECANCELED || !mgmt_pending_valid (hdev, data)) +return ; +if (status) { -mgmt_pending_foreach (MGMT_OP_SET_ADVERTISING , hdev, true, - cmd_status_rsp, &status); +mgmt_cmd_status (cmd->sk, cmd->hdev->id, cmd->opcode, status); +mgmt_pending_free (cmd);return ; }
@@ -6353,8 +6450,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)else hci_dev_clear_flag (hdev,HCI_ADVERTISING ); -mgmt_pending_foreach (MGMT_OP_SET_ADVERTISING , hdev, true, settings_rsp, - &match); +settings_rsp (cmd, &match);new_settings (hdev, match.sk);
@@ -6386,10 +6482,23 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)static int set_adv_sync (struct hci_dev *hdev,void *data) {struct mgmt_pending_cmd *cmd = data; -struct mgmt_mode *cp = cmd->param; -u8 val = !!cp->val; +struct mgmt_mode cp; +u8 val; -if (cp->val ==0x02 ) +mutex_lock (&hdev->mgmt_pending_lock); + +if (!__mgmt_pending_listed (hdev, cmd)) { +mutex_unlock (&hdev->mgmt_pending_lock); +return -ECANCELED ; + } + +memcpy (&cp, cmd->param,sizeof (cp)); + +mutex_unlock (&hdev->mgmt_pending_lock); + + val = !!cp.val; + +if (cp.val ==0x02 )hci_dev_set_flag (hdev,HCI_ADVERTISING_CONNECTABLE );else hci_dev_clear_flag (hdev,HCI_ADVERTISING_CONNECTABLE );
@@ -8142,10 +8251,6 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,u8 status =mgmt_status (err);u16 eir_len; -if (err == -ECANCELED || - cmd !=pending_find (MGMT_OP_READ_LOCAL_OOB_EXT_DATA , hdev)) -return ; -if (!status) {if (!skb) status =MGMT_STATUS_FAILED ;
@@ -8252,7 +8357,7 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,kfree_skb (skb);kfree (mgmt_rp); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); } static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
@@ -8261,7 +8366,7 @@ static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,struct mgmt_pending_cmd *cmd;int err; - cmd =mgmt_pending_add (sk,MGMT_OP_READ_LOCAL_OOB_EXT_DATA , hdev, + cmd =mgmt_pending_new (sk,MGMT_OP_READ_LOCAL_OOB_EXT_DATA , hdev, cp,sizeof (*cp));if (!cmd)return -ENOMEM ;
net/bluetooth/mgmt_util.c +46 -0
52 lines not on this page · raw message
net/bluetooth/mgmt_util.h +3 -0
@@ -65,6 +65,9 @@ struct mgmt_pending_cmd *mgmt_pending_new(struct sock *sk, u16 opcode, void *data, u16 len);void mgmt_pending_free (struct mgmt_pending_cmd *cmd);void mgmt_pending_remove (struct mgmt_pending_cmd *cmd); +bool __mgmt_pending_listed (struct hci_dev *hdev,struct mgmt_pending_cmd *cmd); +bool mgmt_pending_listed (struct hci_dev *hdev,struct mgmt_pending_cmd *cmd); +bool mgmt_pending_valid (struct hci_dev *hdev,struct mgmt_pending_cmd *cmd);void mgmt_mesh_foreach (struct hci_dev *hdev,void (*cb)(struct mgmt_mesh_tx *mesh_tx,void *data),void *data,struct sock *sk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/185 f2fs: fix to avoid overflow while left shift operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb ]
Should cast type of folio->index from pgoff_t to loff_t to avoid overflow while left shift operation.
[ Modification: Using rpages[i]->index instead of folio->index due to it was changed since commit:1cda5bc0b2fe ("f2fs: Use a folio in f2fs_truncate_partial_cluster()") on 6.14 ]
--- fs/f2fs/compress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/compress.c +1 -1
@@ -1236,7 +1236,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)int i;for (i = cluster_size -1 ; i >=0 ; i--) { -loff_t start = rpages[i]->index <<PAGE_SHIFT ; +loff_t start = (loff_t )rpages[i]->index <<PAGE_SHIFT ;if (from <= start) {zero_user_segment (rpages[i],0 ,PAGE_SIZE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/185 hostfs: Fix only passing host root in boot stage with new mount
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongbo Li <[email protected]>
[ Upstream commit 2c2b67af5f5f77fc68261a137ad65dcfb8e52506 ]
In the old mount proceedure, hostfs could only pass root directory during boot. This is because it constructed the root directory using the @root_ino event without any mount options. However, when using it with the new mount API, this step is no longer triggered. As a result, if users mounts without specifying any mount options, the @host_root_path remains uninitialized. To prevent this issue, the @host_root_path should be initialized at the time of allocation.
--- fs/hostfs/hostfs_kern.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
fs/hostfs/hostfs_kern.c +18 -11
@@ -972,7 +972,7 @@ static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param) {struct hostfs_fs_info *fsi = fc->s_fs_info;struct fs_parse_result result; -char *host_root; +char *host_root, *tmp_root;int opt; opt =fs_parse (fc, hostfs_param_specs, param, &result);
@@ -983,11 +983,13 @@ static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param)case Opt_hostfs: host_root = param->string;if (!*host_root) - host_root ="" ; - fsi->host_root_path = -kasprintf (GFP_KERNEL ,"%s/%s" , root_ino, host_root); -if (fsi->host_root_path ==NULL ) +break ; + tmp_root =kasprintf (GFP_KERNEL ,"%s%s" , + fsi->host_root_path, host_root); +if (!tmp_root)return -ENOMEM ; +kfree (fsi->host_root_path); + fsi->host_root_path = tmp_root;break ; }
@@ -997,17 +999,17 @@ static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param)static int hostfs_parse_monolithic (struct fs_context *fc,void *data) {struct hostfs_fs_info *fsi = fc->s_fs_info; -char *host_root = (char *)data; +char *tmp_root, *host_root = (char *)data;/* NULL is printed as '(null)' by printf(): avoid that. */ if (host_root ==NULL ) - host_root ="" ; +return 0 ; - fsi->host_root_path = -kasprintf (GFP_KERNEL ,"%s/%s" , root_ino, host_root); -if (fsi->host_root_path ==NULL ) + tmp_root =kasprintf (GFP_KERNEL ,"%s%s" , fsi->host_root_path, host_root); +if (!tmp_root)return -ENOMEM ; - +kfree (fsi->host_root_path); + fsi->host_root_path = tmp_root;return 0 ; }
@@ -1042,6 +1044,11 @@ static int hostfs_init_fs_context(struct fs_context *fc)if (!fsi)return -ENOMEM ; + fsi->host_root_path =kasprintf (GFP_KERNEL ,"%s/" , root_ino); +if (!fsi->host_root_path) { +kfree (fsi); +return -ENOMEM ; + } fc->s_fs_info = fsi; fc->ops = &hostfs_context_ops;return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/185 mtd: onenand: Pass correct pointer to IRQ handler
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 97315e7c901a1de60e8ca9b11e0e96d0f9253e18 ]
This was supposed to pass "onenand" instead of "&onenand" with the ampersand. Passing a random stack address which will be gone when the function ends makes no sense. However the good thing is that the pointer is never used, so this doesn't cause a problem at run time.
--- drivers/mtd/nand/onenand/onenand_samsung.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/onenand/onenand_samsung.c +1 -1
@@ -906,7 +906,7 @@ static int s3c_onenand_probe(struct platform_device *pdev) err =devm_request_irq (&pdev->dev, r->start, s5pc110_onenand_irq,IRQF_SHARED ,"onenand" , - &onenand); + onenand);if (err) {dev_err (&pdev->dev,"failed to get irq\n" );return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/185 virtio-fs: fix incorrect check for fsvq->kobj
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit c014021253d77cd89b2d8788ce522283d83fbd40 ]
In virtio_fs_add_queues_sysfs(), the code incorrectly checks fs->mqs_kobj after calling kobject_create_and_add(). Change the check to fsvq->kobj (fs->mqs_kobj -> fsvq->kobj) to ensure the per-queue kobject is successfully created.
--- fs/fuse/virtio_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/virtio_fs.c +1 -1
@@ -372,7 +372,7 @@ static int virtio_fs_add_queues_sysfs(struct virtio_fs *fs)sprintf (buff,"%d" , i); fsvq->kobj =kobject_create_and_add (buff, fs->mqs_kobj); -if (!fs->mqs_kobj) { +if (!fsvq->kobj) { ret = -ENOMEM ; goto out_del; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/185 fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Vagin <[email protected]>
[ Upstream commit 78f0e33cd6c939a555aa80dbed2fec6b333a7660 ]
grab_requested_mnt_ns was changed to return error codes on failure, but its callers were not updated to check for error pointers, still checking only for a NULL return value.
This commit updates the callers to use IS_ERR() or IS_ERR_OR_NULL() and PTR_ERR() to correctly check for and propagate errors.
This also makes sure that the logic actually works and mount namespace file descriptors can be used to refere to mounts.
Christian Brauner <[email protected]> says:
Rework the patch to be more ergonomic and in line with our overall error handling patterns.
--- fs/namespace.c | 32 ++++++++++++++++---------------- include/uapi/linux/mount.h | 2 +- 2 files changed, 17 insertions(+), 17 deletions(-)
fs/namespace.c +16 -16
@@ -158,7 +158,8 @@ static void mnt_ns_release(struct mnt_namespace *ns)kfree (ns); } } -DEFINE_FREE(mnt_ns_release, struct mnt_namespace *, if (_T) mnt_ns_release(_T)) +DEFINE_FREE(mnt_ns_release, struct mnt_namespace *, + if (!IS_ERR(_T)) mnt_ns_release(_T))static void mnt_ns_tree_remove (struct mnt_namespace *ns) {
@@ -5325,7 +5326,7 @@ static int copy_mnt_id_req(const struct mnt_id_req __user *req, ret =copy_struct_from_user (kreq,sizeof (*kreq), req, usize);if (ret)return ret; -if (kreq->spare !=0 ) +if (kreq->mnt_ns_fd !=0 && kreq->mnt_ns_id)return -EINVAL ;/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ if (kreq->mnt_id <=MNT_UNIQUE_ID_OFFSET )
@@ -5342,16 +5343,12 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq {struct mnt_namespace *mnt_ns; -if (kreq->mnt_ns_id && kreq->spare) -return ERR_PTR (-EINVAL ); - -if (kreq->mnt_ns_id) -return lookup_mnt_ns (kreq->mnt_ns_id); - -if (kreq->spare) { +if (kreq->mnt_ns_id) { + mnt_ns =lookup_mnt_ns (kreq->mnt_ns_id); + }else if (kreq->mnt_ns_fd) {struct ns_common *ns; -CLASS (fd, f)(kreq->spare); +CLASS (fd, f)(kreq->mnt_ns_fd);if (fd_empty (f))return ERR_PTR (-EBADF );
@@ -5366,6 +5363,8 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq }else { mnt_ns = current->nsproxy->mnt_ns; } +if (!mnt_ns) +return ERR_PTR (-ENOENT );refcount_inc (&mnt_ns->passive);return mnt_ns;
@@ -5390,8 +5389,8 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,return ret; ns =grab_requested_mnt_ns (&kreq); -if (!ns) -return -ENOENT ; +if (IS_ERR (ns)) +return PTR_ERR (ns);if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && !ns_capable_noaudit (ns->user_ns,CAP_SYS_ADMIN ))
@@ -5500,8 +5499,8 @@ static void __free_klistmount_free(const struct klistmount *kls)static inline int prepare_klistmount (struct klistmount *kls,struct mnt_id_req *kreq,size_t nr_mnt_ids) { -u64 last_mnt_id = kreq->param; +struct mnt_namespace *ns;/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ if (last_mnt_id !=0 && last_mnt_id <=MNT_UNIQUE_ID_OFFSET )
@@ -5515,9 +5514,10 @@ static inline int prepare_klistmount(struct klistmount *kls, struct mnt_id_req *if (!kls->kmnt_ids)return -ENOMEM ; - kls->ns =grab_requested_mnt_ns (kreq); -if (!kls->ns) -return -ENOENT ; + ns =grab_requested_mnt_ns (kreq); +if (IS_ERR (ns)) +return PTR_ERR (ns); + kls->ns = ns; kls->mnt_parent_id = kreq->mnt_id;return 0 ;
include/uapi/linux/mount.h +1 -1
@@ -186,7 +186,7 @@ struct statmount {*/ struct mnt_id_req {__u32 size; -__u32 spare; +__u32 mnt_ns_fd;__u64 mnt_id;__u64 param;__u64 mnt_ns_id;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/185 sched_ext: Fix unsafe locking in the scx_dump_state()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 5f02151c411dda46efcc5dc57b0845efcdcfc26d ]
For built with CONFIG_PREEMPT_RT=y kernels, the dump_lock will be converted sleepable spinlock and not disable-irq, so the following scenarios occur:
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. irq_work/0/27 [HC0[0]:SC0[0]:HE1:SE1] takes:
(&rq->__lock){?...}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x40 {IN-HARDIRQ-W} state was registered at:
lock_acquire+0x1e1/0x510 _raw_spin_lock_nested+0x42/0x80 raw_spin_rq_lock_nested+0x2b/0x40 sched_tick+0xae/0x7b0 update_process_times+0x14c/0x1b0 tick_periodic+0x62/0x1f0 tick_handle_periodic+0x48/0xf0 timer_interrupt+0x55/0x80 __handle_irq_event_percpu+0x20a/0x5c0 handle_irq_event_percpu+0x18/0xc0 handle_irq_event+0xb5/0x150 handle_level_irq+0x220/0x460 __common_interrupt+0xa2/0x1e0 common_interrupt+0xb0/0xd0 asm_common_interrupt+0x2b/0x40 _raw_spin_unlock_irqrestore+0x45/0x80 __setup_irq+0xc34/0x1a30 request_threaded_irq+0x214/0x2f0 hpet_time_init+0x3e/0x60 x86_late_time_init+0x5b/0xb0 start_kernel+0x308/0x410 x86_64_start_reservations+0x1c/0x30 x86_64_start_kernel+0x96/0xa0 common_startup_64+0x13e/0x148
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&rq->__lock);
<Interrupt>
lock(&rq->__lock);*** DEADLOCK ***
stack backtrace: CPU: 0 UID: 0 PID: 27 Comm: irq_work/0 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 print_usage_bug+0x42e/0x690 mark_lock.part.44+0x867/0xa70 ? __pfx_mark_lock.part.44+0x10/0x10 ? string_nocheck+0x19c/0x310 ? number+0x739/0x9f0 ? __pfx_string_nocheck+0x10/0x10 ? __pfx_check_pointer+0x10/0x10 ? kvm_sched_clock_read+0x15/0x30 ? sched_clock_noinstr+0xd/0x20 ? local_clock_noinstr+0x1c/0xe0 __lock_acquire+0xc4b/0x62b0 ? __pfx_format_decode+0x10/0x10 ? __pfx_string+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 lock_acquire+0x1e1/0x510 ? raw_spin_rq_lock_nested+0x2b/0x40 ? __pfx_lock_acquire+0x10/0x10 ? dump_line+0x12e/0x270 ? raw_spin_rq_lock_nested+0x20/0x40 _raw_spin_lock_nested+0x42/0x80 ? raw_spin_rq_lock_nested+0x2b/0x40 raw_spin_rq_lock_nested+0x2b/0x40 scx_dump_state+0x3b3/0x1270 ? finish_task_switch+0x27e/0x840 scx_ops_error_irq_workfn+0x67/0x80 irq_work_single+0x113/0x260 irq_work_run_list.part.3+0x44/0x70 run_irq_workd+0x6b/0x90 ? __pfx_run_irq_workd+0x10/0x10 smpboot_thread_fn+0x529/0x870 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x305/0x3f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x40/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
This commit therefore use rq_lock_irqsave/irqrestore() to replace rq_lock/unlock() in the scx_dump_state().
--- kernel/sched/ext.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/sched/ext.c +2 -2
@@ -4966,7 +4966,7 @@ static void scx_dump_state(struct scx_exit_info *ei, size_t dump_len)size_t avail, used;bool idle; -rq_lock (rq, &rf); +rq_lock_irqsave (rq, &rf); idle =list_empty (&rq->scx.runnable_list) && rq->curr->sched_class == &idle_sched_class;
@@ -5034,7 +5034,7 @@ static void scx_dump_state(struct scx_exit_info *ei, size_t dump_len)list_for_each_entry (p, &rq->scx.runnable_list, scx.runnable_node)scx_dump_task (&s, &dctx, p,' ' ); next: -rq_unlock (rq, &rf); +rq_unlock_irqrestore (rq, &rf); }if (seq_buf_has_overflowed (&s) && dump_len >=sizeof (trunc_marker))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/185 Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
This is a partial revert of commit dbe85d3115c7e6b5124c8b028f4f602856ea51dd.
This update breaks old nftables userspace because monitor parser cannot handle this shortened deletion, this patch was added as a Stable-dep:, let's revert it.
--- net/netfilter/nf_tables_api.c | 36 ++--------------------------------- 1 file changed, 2 insertions(+), 34 deletions(-)
net/netfilter/nf_tables_api.c +2 -34
@@ -1032,12 +1032,6 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, NFTA_TABLE_PAD)) goto nla_put_failure; -if (event ==NFT_MSG_DELTABLE || - event ==NFT_MSG_DESTROYTABLE ) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (nla_put_be32 (skb,NFTA_TABLE_FLAGS ,htonl (table->flags &NFT_TABLE_F_MASK ))) goto nla_put_failure;
@@ -1893,13 +1887,6 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, NFTA_CHAIN_PAD)) goto nla_put_failure; -if (!hook_list && - (event ==NFT_MSG_DELCHAIN || - event ==NFT_MSG_DESTROYCHAIN )) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (nft_is_base_chain (chain)) {const struct nft_base_chain *basechain =nft_base_chain (chain);struct nft_stats __percpu *stats;
@@ -4685,12 +4672,6 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, NFTA_SET_PAD)) goto nla_put_failure; -if (event ==NFT_MSG_DELSET || - event ==NFT_MSG_DESTROYSET ) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (set->flags !=0 )if (nla_put_be32 (skb,NFTA_SET_FLAGS ,htonl (set->flags))) goto nla_put_failure;
@@ -8021,18 +8002,12 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,if (nla_put_string (skb,NFTA_OBJ_TABLE , table->name) ||nla_put_string (skb,NFTA_OBJ_NAME , obj->key.name) || -nla_put_be32 (skb,NFTA_OBJ_TYPE ,htonl (obj->ops->type->type)) ||nla_put_be64 (skb,NFTA_OBJ_HANDLE ,cpu_to_be64 (obj->handle),NFTA_OBJ_PAD )) goto nla_put_failure; -if (event ==NFT_MSG_DELOBJ || - event ==NFT_MSG_DESTROYOBJ ) { -nlmsg_end (skb, nlh); -return 0 ; - } - -if (nla_put_be32 (skb,NFTA_OBJ_USE ,htonl (obj->use)) || +if (nla_put_be32 (skb,NFTA_OBJ_TYPE ,htonl (obj->ops->type->type)) || +nla_put_be32 (skb,NFTA_OBJ_USE ,htonl (obj->use)) ||nft_object_dump (skb,NFTA_OBJ_DATA , obj, reset)) goto nla_put_failure;
@@ -9048,13 +9023,6 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, NFTA_FLOWTABLE_PAD)) goto nla_put_failure; -if (!hook_list && - (event ==NFT_MSG_DELFLOWTABLE || - event ==NFT_MSG_DESTROYFLOWTABLE )) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (nla_put_be32 (skb,NFTA_FLOWTABLE_USE ,htonl (flowtable->use)) ||nla_put_be32 (skb,NFTA_FLOWTABLE_FLAGS ,htonl (flowtable->data.flags))) goto nla_put_failure;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/185 netfilter: nf_tables: reject duplicate device on updates
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973 upstream.
A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device.
Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case.
WARNING is hit when unregistering the hook:
[49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150
--- net/netfilter/nf_tables_api.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
net/netfilter/nf_tables_api.c +30 -0
@@ -2642,6 +2642,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,struct nft_chain *chain = ctx->chain;struct nft_chain_hook hook = {};struct nft_stats *stats =NULL ; +struct nftables_pernet *nft_net;struct nft_hook *h, *next;struct nf_hook_ops *ops;struct nft_trans *trans;
@@ -2682,6 +2683,20 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,if (nft_hook_list_find (&basechain->hook_list, h)) {list_del (&h->list);kfree (h); +continue ; + } + + nft_net =nft_pernet (ctx->net); +list_for_each_entry (trans, &nft_net->commit_list, list) { +if (trans->msg_type !=NFT_MSG_NEWCHAIN || + trans->table != ctx->table || + !nft_trans_chain_update (trans)) +continue ; + +if (nft_hook_list_find (&nft_trans_chain_hooks (trans), h)) { +nft_chain_release_hook (&hook); +return -EEXIST ; + } } } }else {
@@ -8686,6 +8701,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, {const struct nlattr *const *nla = ctx->nla;struct nft_flowtable_hook flowtable_hook; +struct nftables_pernet *nft_net;struct nft_hook *hook, *next;struct nft_trans *trans;bool unregister = false;
@@ -8701,6 +8717,20 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,if (nft_hook_list_find (&flowtable->hook_list, hook)) {list_del (&hook->list);kfree (hook); +continue ; + } + + nft_net =nft_pernet (ctx->net); +list_for_each_entry (trans, &nft_net->commit_list, list) { +if (trans->msg_type !=NFT_MSG_NEWFLOWTABLE || + trans->table != ctx->table || + !nft_trans_flowtable_update (trans)) +continue ; + +if (nft_hook_list_find (&nft_trans_flowtable_hooks (trans), hook)) { + err = -EEXIST ; + goto err_flowtable_update_hook; + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/185 arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anand Moon <[email protected]>
[ Upstream commit d425aef66e62221fa6bb0ccb94296df29e4cc107 ]
Enable proper pin multiplexing for the I2S1 8-channel transmit interface by adding the default pinctrl configuration which esures correct signal routing and avoids pinmux conflicts during audio playback.
Changes fix the error
[ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s [ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s) [ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl [ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back
I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0 and SDO0 signals, so limit the claimed pins to those.
With this change audio output works as expected:
$ aplay -l **** List of PLAYBACK Hardware Devices **** card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0] Subdevices: 1/1 Subdevice #0: subdevice #0 card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0] Subdevices: 1/1 Subdevice #0: subdevice #0
--- arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +2 -0
@@ -482,6 +482,8 @@ }; &i2s1_8ch { + pinctrl-names = "default"; + pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>; rockchip,trcm-sync-tx-only; status = "okay"; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/185 arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
[ Upstream commit b3fd04e23f6e4496f5a2279466a33fbdc83500f0 ]
Unify the naming of the existing GPU OPP table nodes found in the RK3588 and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following the more "modern" node naming scheme.
--- arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3588j.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi +1 -1
@@ -115,7 +115,7 @@ }; }; - gpu_opp_table: opp-table { + gpu_opp_table: opp-table-gpu { compatible = "operating-points-v2"; opp-300000000 {
arch/arm64/boot/dts/rockchip/rk3588j.dtsi +1 -1
@@ -66,7 +66,7 @@ }; }; - gpu_opp_table: opp-table { + gpu_opp_table: opp-table-gpu { compatible = "operating-points-v2"; opp-300000000 {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/185 ARM: dts: imx51-zii-rdu1: Fix audmux node names
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <[email protected]>
[ Upstream commit f31e261712a0d107f09fb1d3dc8f094806149c83 ]
Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the audmux configuration of imx51-zii-rdu1.dts to comply with the naming convention in imx-audmux.yaml.
This fixes the following dt-schema warning:
imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2' do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$'
--- arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts +2 -2
@@ -259,7 +259,7 @@ pinctrl-0 = <&pinctrl_audmux>; status = "okay"; - ssi2 { + mux-ssi2 { fsl,audmux-port = <1>; fsl,port-config = < (IMX_AUDMUX_V2_PTCR_SYN |
@@ -271,7 +271,7 @@ >; }; - aud3 { + mux-aud3 { fsl,audmux-port = <2>; fsl,port-config = < IMX_AUDMUX_V2_PTCR_SYN
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/185 HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Ichikawa <[email protected]>
[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
Use a scope-based cleanup helper for the buffer allocated with kmalloc() in ntrig_report_version() to simplify the cleanup logic and prevent memory leaks (specifically the !hid_is_usb()-case one).
--- drivers/hid/hid-ntrig.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/hid/hid-ntrig.c +2 -5
@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)int ret;char buf[20 ];struct usb_device *usb_dev =hid_to_usb_dev (hdev); -unsigned char *data =kmalloc (8 ,GFP_KERNEL ); + unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);if (!hid_is_usb (hdev))return ;if (!data) - goto err_free; +return ; ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), USB_REQ_CLEAR_FEATURE,
@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)hid_info (hdev,"Firmware version: %s (%02x%02x %02x%02x)\n" , buf, data[2 ], data[3 ], data[4 ], data[5 ]); } - -err_free: -kfree (data); } static ssize_t show_phys_width(struct device *dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/185 ARM: dts: BCM53573: Fix address of Luxul XAP-1440s Ethernet PHY
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b ]
Luxul XAP-1440 has BCM54210E PHY at address 25.
--- arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts +2 -2
@@ -55,8 +55,8 @@ mdio { /delete-node/ switch@1e; - bcm54210e: ethernet-phy@0 { - reg = <0>; + bcm54210e: ethernet-phy@25 { + reg = <25>; }; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/185 HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 8513c154f8ad7097653dd9bf43d6155e5aad4ab3 ]
The memory allocated for buf is not freed in the error paths when ps_get_report() fails. Free buf before jumping to transfer_failed label
--- drivers/hid/hid-playstation.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-playstation.c +2 -0
@@ -1807,6 +1807,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)hid_warn (hdev,"Failed to retrieve DualShock4 calibration info: %d\n" , ret); ret = -EILSEQ ; +kfree (buf); goto transfer_failed; }else {break ;
@@ -1824,6 +1825,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)if (ret) {hid_warn (hdev,"Failed to retrieve DualShock4 calibration info: %d\n" , ret); +kfree (buf); goto transfer_failed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/185 HID: uclogic: Fix potential memory leak in error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit a78eb69d60ce893de48dd75f725ba21309131fc2 ]
In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for event_hook is not freed in the next error path. Fix that by freeing it.
--- drivers/hid/hid-uclogic-params.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-uclogic-params.c +3 -1
@@ -1367,8 +1367,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev, event_hook->hdev = hdev; event_hook->size =ARRAY_SIZE (reconnect_event); event_hook->event =kmemdup (reconnect_event, event_hook->size,GFP_KERNEL ); -if (!event_hook->event) +if (!event_hook->event) { +kfree (event_hook);return -ENOMEM ; + }list_add_tail (&event_hook->list, &p->event_hooks->list);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/185 net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 5f2b28b79d2d1946ee36ad8b3dc0066f73c90481 ]
There are actually 2 problems:
- deleting the last element doesn't require the memmove of elements [i + 1, end) over it. Actually, element i+1 is out of bounds.
- The memmove itself should move size - i - 1 elements, because the last element is out of bounds.
The out-of-bounds element still remains out of bounds after being accessed, so the problem is only that we touch it, not that it becomes in active use. But I suppose it can lead to issues if the out-of-bounds element is part of an unmapped page.
--- drivers/net/dsa/sja1105/sja1105_static_config.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/dsa/sja1105/sja1105_static_config.c +4 -2
@@ -1921,8 +1921,10 @@ int sja1105_table_delete_entry(struct sja1105_table *table, int i)if (i > table->entry_count)return -ERANGE ; -memmove (entries + i * entry_size, entries + (i +1 ) * entry_size, - (table->entry_count - i) * entry_size); +if (i +1 < table->entry_count) { +memmove (entries + i * entry_size, entries + (i +1 ) * entry_size, + (table->entry_count - i -1 ) * entry_size); + } table->entry_count--;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/185 LoongArch: KVM: Restore guest PMU if it is enabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit 5001bcf86edf2de02f025a0f789bcac37fa040e6 upstream.
On LoongArch system, guest PMU hardware is shared by guest and host but PMU interrupt is separated. PMU is pass-through to VM, and there is PMU context switch when exit to host and return to guest.
There is optimiation to check whether PMU is enabled by guest. If not, it is not necessary to return to guest. However, if it is enabled, PMU context for guest need switch on. Now KVM_REQ_PMU notification is set on vCPU context switch, but it is missing if there is no vCPU context switch while PMU is used by guest VM, so fix it.
--- arch/loongarch/kvm/vcpu.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/loongarch/kvm/vcpu.c +5 -0
@@ -127,6 +127,9 @@ static void kvm_lose_pmu(struct kvm_vcpu* Clear KVM_LARCH_PMU if the guest is not using PMU CSRs when * exiting the guest, so that the next time trap into the guest. * We don't need to deal with PMU CSRs contexts. +* +* Otherwise set the request bit KVM_REQ_PMU to restore guest PMU +* before entering guest VM */ val =kvm_read_sw_gcsr (csr,LOONGARCH_CSR_PERFCTRL0 ); val |=kvm_read_sw_gcsr (csr,LOONGARCH_CSR_PERFCTRL1 );
@@ -134,6 +137,8 @@ static void kvm_lose_pmu(struct kvm_vcpu val |=kvm_read_sw_gcsr (csr,LOONGARCH_CSR_PERFCTRL3 );if (!(val &KVM_PMU_EVENT_ENABLED )) vcpu->arch.aux_inuse &= ~KVM_LARCH_PMU ; +else +kvm_make_request (KVM_REQ_PMU , vcpu);kvm_restore_host_pmu (vcpu); }
Greg Kroah-Hartman
maintainerPATCH 108/185 LoongArch: KVM: Add delay until timer interrupt injected
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit d3c9515e4f9d10ccb113adb4809db5cc31e7ef65 upstream.
When timer is fired in oneshot mode, CSR.TVAL will stop with value -1 rather than 0. However when the register CSR.TVAL is restored, it will continue to count down rather than stop there.
Now the method is to write 0 to CSR.TVAL, wait to count down for 1 cycle at least, which is 10ns with a timer freq 100MHz, and then retore timer interrupt status. Here add 2 cycles delay to assure that timer interrupt is injected.
With this patch, timer selftest case passes to run always.
--- arch/loongarch/kvm/timer.c | 2 ++ 1 file changed, 2 insertions(+)
arch/loongarch/kvm/timer.c +2 -0
@@ -4,6 +4,7 @@*/ #include <linux/kvm_host.h> +#include <asm/delay.h> #include <asm/kvm_csr.h> #include <asm/kvm_vcpu.h>
@@ -95,6 +96,7 @@ void kvm_restore_timer(struct kvm_vcpu ** and set CSR TVAL with -1 */ write_gcsr_timertick (0 ); +__delay (2 );/* Wait cycles until timer interrupt injected */ /* * Writing CSR_TINTCLR_TI to LOONGARCH_CSR_TINTCLR will clear
Greg Kroah-Hartman
maintainerPATCH 109/185 KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <[email protected]>
commit dc55b3c3f61246e483e50c85d8d5366f9567e188 upstream.
The APM lists the DbgCtlMsr field as being tracked by the VMCB_LBR clean bit. Always clear the bit when MSR_IA32_DEBUGCTLMSR is updated.
The history is complicated, it was correctly cleared for L1 before commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running"). At that point svm_set_msr() started to rely on svm_update_lbrv() to clear the bit, but when nested virtualization is enabled the latter does not always clear it even if MSR_IA32_DEBUGCTLMSR changed. Go back to clearing it directly in svm_set_msr().
--- arch/x86/kvm/svm/svm.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/kvm/svm/svm.c +4 -0
@@ -3257,7 +3257,11 @@ static int svm_set_msr(struct kvm_vcpu *if (data &DEBUGCTL_RESERVED_BITS )return 1 ; +if (svm_get_lbr_vmcb (svm)->save.dbgctl == data) +break ; +svm_get_lbr_vmcb (svm)->save.dbgctl = data; +vmcb_mark_dirty (svm->vmcb,VMCB_LBR );svm_update_lbrv (vcpu);break ;case MSR_VM_HSAVE_PA :
Greg Kroah-Hartman
maintainerPATCH 110/185 nfsd: fix refcount leak in nfsd_set_fh_dentry()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c upstream.
nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem.
If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service.
Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle.
To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected.
--- fs/nfsd/nfsfh.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/nfsd/nfsfh.c +3 -3
@@ -268,9 +268,6 @@ static __be32 nfsd_set_fh_dentry(struct dentry); } - fhp->fh_dentry = dentry; - fhp->fh_export = exp; -switch (fhp->fh_maxsize) {case NFS4_FHSIZE :if (dentry->d_sb->s_export_op->flags &EXPORT_OP_NOATOMIC_ATTR )
@@ -292,6 +289,9 @@ static __be32 nfsd_set_fh_dentry(struct goto out; } + fhp->fh_dentry = dentry; + fhp->fh_export = exp; +return 0 ; out:exp_put (exp);
Greg Kroah-Hartman
maintainerPATCH 111/185 nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit 4d3dbc2386fe051e44efad663e0ec828b98ab53f upstream.
RFC 7862 Section 4.1.2 says that if the server supports CLONE it MUST support clone_blksize attribute.
--- fs/nfsd/nfsd.h | 1 + 1 file changed, 1 insertion(+)
fs/nfsd/nfsd.h +1 -0
@@ -458,6 +458,7 @@ enum {#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \ (NFSD4_1_SUPPORTED_ATTRS_WORD2 | \ FATTR4_WORD2_MODE_UMASK | \ + FATTR4_WORD2_CLONE_BLKSIZE | \ NFSD4_2_SECURITY_ATTRS | \ FATTR4_WORD2_XATTR_SUPPORT)
Greg Kroah-Hartman
maintainerPATCH 112/185 NFSD: free copynotify stateid in nfs4_free_ol_stateid()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream.
Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period.
However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred
WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]
This patch, instead, frees the associated copynotify stateid here.
If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later.
[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs
--- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4state.c +2 -1
@@ -1528,7 +1528,8 @@ static void nfs4_free_ol_stateid(structrelease_all_access (stp);if (stp->st_stateowner)nfs4_put_stateowner (stp->st_stateowner); -WARN_ON (!list_empty (&stid->sc_cp_list)); +if (!list_empty (&stid->sc_cp_list)) +nfs4_free_cpntf_statelist (stid->sc_client->net, stid);kmem_cache_free (stateid_slab, stid); }
Greg Kroah-Hartman
maintainerPATCH 113/185 gcov: add support for GCC 15
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
commit ec4d11fc4b2dd4a2fa8c9d801ee9753b74623554 upstream.
Using gcov on kernels compiled with GCC 15 results in truncated 16-byte long .gcda files with no usable data. To fix this, update GCOV_COUNTERS to match the value defined by GCC 15.
Tested with GCC 14.3.0 and GCC 15.2.0.
--- kernel/gcov/gcc_4_7.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/gcov/gcc_4_7.c +3 -1
@@ -18,7 +18,9 @@#include <linux/mm.h> #include "gcov.h" -#if (__GNUC__ >=14 ) +#if (__GNUC__ >=15 ) +#define GCOV_COUNTERS 10 +#elif (__GNUC__ >=14 )#define GCOV_COUNTERS 9#elif (__GNUC__ >=10 )#define GCOV_COUNTERS 8
Greg Kroah-Hartman
maintainerPATCH 114/185 ksmbd: close accepted socket when per-IP limit rejects connection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <[email protected]>
commit 98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9 upstream.
When the per-IP connection limit is exceeded in ksmbd_kthread_fn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. That leaks one socket per rejected attempt from a single IP and enables a trivial remote DoS.
Release client_sk before continuing.
This bug was found with ZeroPath.
--- fs/smb/server/transport_tcp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/smb/server/transport_tcp.c +4 -1
@@ -286,8 +286,11 @@ static int ksmbd_kthread_fn(void *p) } }up_read (&conn_list_lock); -if (ret == -EAGAIN ) +if (ret == -EAGAIN ) { +/* Per-IP limit hit: release the just-accepted socket. */ +sock_release (client_sk);continue ; + } skip_max_ip_conns_limit: if (server_conf.max_connections &&
Greg Kroah-Hartman
maintainerPATCH 115/185 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Demarchi Gomes <[email protected]>
commit f5548c318d6520d4fa3c5ed6003eeb710763cbc5 upstream.
Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages.
This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1].
Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page:
#include <unistd.h>
#include <stdio.h>
#include <sys/mman.h>
/* 32 TiB */
const size_t size = 32ul * 1024 * 1024 * 1024 * 1024;
int main() {
char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,
MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);
if (area == MAP_FAILED) {
perror("mmap() failed\n");
return -1;
}
/* Populate a single page such that we get an anon_vma. */
*area = 0;
/* Enable KSM. */
madvise(area, size, MADV_MERGEABLE);
pause();
return 0;
}$ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run
Without this patch ksmd uses 100% of the cpu for a long time (more then 1 hour in my test machine) scanning all the 32 TiB virtual address space that contain only one mapped page. This makes ksmd essentially deadlocked not able to deduplicate anything of value. With this patch ksmd walks only the one mapped page and skips the rest of the 32 TiB virtual address space, making the scan fast using little cpu.
--- mm/ksm.c | 113 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 104 insertions(+), 9 deletions(-)
mm/ksm.c +104 -9
@@ -2447,6 +2447,95 @@ static bool should_skip_rmap_item(structreturn true; } +struct ksm_next_page_arg { +struct folio *folio; +struct page *page; +unsigned long addr; +}; + +static int ksm_next_page_pmd_entry (pmd_t *pmdp,unsigned long addr,unsigned long end, +struct mm_walk *walk) +{ +struct ksm_next_page_arg *private = walk->private; +struct vm_area_struct *vma = walk->vma; +pte_t *start_ptep =NULL , *ptep, pte; +struct mm_struct *mm = walk->mm; +struct folio *folio; +struct page *page; +spinlock_t *ptl; +pmd_t pmd; + +if (ksm_test_exit (mm)) +return 0 ; + +cond_resched (); + + pmd =pmdp_get_lockless (pmdp); +if (!pmd_present (pmd)) +return 0 ; + +if (IS_ENABLED (CONFIG_TRANSPARENT_HUGEPAGE ) &&pmd_leaf (pmd)) { + ptl =pmd_lock (mm, pmdp); + pmd =pmdp_get (pmdp); + +if (!pmd_present (pmd)) { + goto not_found_unlock; + }else if (pmd_leaf (pmd)) { + page =vm_normal_page_pmd (vma, addr, pmd); +if (!page) + goto not_found_unlock; + folio =page_folio (page); + +if (folio_is_zone_device (folio) || !folio_test_anon (folio)) + goto not_found_unlock; + + page += ((addr & (PMD_SIZE -1 )) >>PAGE_SHIFT ); + goto found_unlock; + } +spin_unlock (ptl); + } + + start_ptep =pte_offset_map_lock (mm, pmdp, addr, &ptl); +if (!start_ptep) +return 0 ; + +for (ptep = start_ptep; addr < end; ptep++, addr +=PAGE_SIZE ) { + pte =ptep_get (ptep); + +if (!pte_present (pte)) +continue ; + + page =vm_normal_page (vma, addr, pte); +if (!page) +continue ; + folio =page_folio (page); + +if (folio_is_zone_device (folio) || !folio_test_anon (folio)) +continue ; + goto found_unlock; + } + +not_found_unlock: +spin_unlock (ptl); +if (start_ptep) +pte_unmap (start_ptep); +return 0 ; +found_unlock: +folio_get (folio); +spin_unlock (ptl); +if (start_ptep) +pte_unmap (start_ptep); + private->page = page; + private->folio = folio; + private->addr = addr; +return 1 ; +} + +static struct mm_walk_ops ksm_next_page_ops = { + .pmd_entry = ksm_next_page_pmd_entry, + .walk_lock =PGWALK_RDLOCK , +}; +static struct ksm_rmap_item *scan_get_next_rmap_item (struct page **page) {struct mm_struct *mm;
@@ -2534,21 +2623,27 @@ next_mm: ksm_scan.address = vma->vm_end;while (ksm_scan.address < vma->vm_end) { +struct ksm_next_page_arg ksm_next_page_arg;struct page *tmp_page =NULL ; -struct folio_walk fw;struct folio *folio;if (ksm_test_exit (mm))break ; - folio =folio_walk_start (&fw, vma, ksm_scan.address,0 ); -if (folio) { -if (!folio_is_zone_device (folio) && -folio_test_anon (folio)) { -folio_get (folio); - tmp_page = fw.page; - } -folio_walk_end (&fw, vma); +int found; + + found =walk_page_range_vma (vma, ksm_scan.address, + vma->vm_end, + &ksm_next_page_ops, + &ksm_next_page_arg); + +if (found >0 ) { + folio = ksm_next_page_arg.folio; + tmp_page = ksm_next_page_arg.page; + ksm_scan.address = ksm_next_page_arg.addr; + }else { +VM_WARN_ON_ONCE (found <0 ); + ksm_scan.address = vma->vm_end -PAGE_SIZE ; }if (tmp_page) {
Greg Kroah-Hartman
maintainerPATCH 116/185 strparser: Fix signed/unsigned mismatch bug
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nate Karstens <[email protected]>
commit 4da4e4bde1c453ac5cc2dce5def81d504ae257ee upstream.
The len member of the sk_buff is an unsigned int. This is cast to ssize_t (a signed type) for the first sk_buff in the comparison, but not the second sk_buff. On 32-bit systems, this can result in an integer underflow for certain values because unsigned arithmetic is being used.
This appears to be an oversight: if the intention was to use unsigned arithmetic, then the first cast would have been omitted. The change ensures both len values are cast to ssize_t.
The underflow causes an issue with ktls when multiple TLS PDUs are included in a single TCP segment. The mainline kernel does not use strparser for ktls anymore, but this is still useful for other features that still use strparser, and for backporting.
--- net/strparser/strparser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/strparser/strparser.c +1 -1
@@ -238,7 +238,7 @@ static int __strp_recv(read_descriptor_tstrp_parser_err (strp, -EMSGSIZE , desc);break ; }else if (len <= (ssize_t )head->len - - skb->len - stm->strp.offset) { + (ssize_t )skb->len - stm->strp.offset) {/* Length must be into new skb (and also * greater than zero) */
Greg Kroah-Hartman
maintainerPATCH 117/185 dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qinxin Xia <[email protected]>
commit 23ee8a2563a0f24cf4964685ced23c32be444ab8 upstream.
The padding field in the structure was previously reserved to maintain a stable interface for potential new fields, ensuring compatibility with user-space shared data structures. However,it was accidentally removed by tiantao in a prior commit, which may lead to incompatibility between user space and the kernel.
This patch reinstates the padding to restore the original structure layout and preserve compatibility.
--- include/linux/map_benchmark.h | 1 + 1 file changed, 1 insertion(+)
include/linux/map_benchmark.h +1 -0
@@ -27,5 +27,6 @@ struct map_benchmark {__u32 dma_dir;/* DMA data direction */ __u32 dma_trans_ns;/* time for DMA transmission in ns */ __u32 granule;/* how many PAGE_SIZE will do map/unmap once a time */ + __u8 expansion[76]; /* For future use */ };#endif /* _KERNEL_DMA_BENCHMARK_H */
Greg Kroah-Hartman
maintainerPATCH 118/185 LoongArch: Use correct accessor to read FWPC/MWPC
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit eeeeaafa62ea0cd4b86390f657dc0aea73bff4f5 upstream.
CSR.FWPC and CSR.MWPC are 32bit registers, so use csr_read32() rather than csr_read64() to read the values of FWPC/MWPC.
--- arch/loongarch/include/asm/hw_breakpoint.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/loongarch/include/asm/hw_breakpoint.h +2 -2
@@ -134,13 +134,13 @@ static inline void hw_breakpoint_thread_/* Determine number of BRP registers available. */ static inline int get_num_brps (void ) { -return csr_read64 (LOONGARCH_CSR_FWPC ) &CSR_FWPC_NUM ; +return csr_read32 (LOONGARCH_CSR_FWPC ) &CSR_FWPC_NUM ; }/* Determine number of WRP registers available. */ static inline int get_num_wrps (void ) { -return csr_read64 (LOONGARCH_CSR_MWPC ) &CSR_MWPC_NUM ; +return csr_read32 (LOONGARCH_CSR_MWPC ) &CSR_MWPC_NUM ; }#endif /* __KERNEL__ */
Greg Kroah-Hartman
maintainerPATCH 119/185 LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianyang Zhang <[email protected]>
commit a073d637c8cfbfbab39b7272226a3fbf3b887580 upstream.
Now if the PTE/PMD is dirty with _PAGE_DIRTY but without _PAGE_MODIFIED, after {pte,pmd}_modify() we lose _PAGE_DIRTY, then {pte,pmd}_dirty() return false and lead to data loss. This can happen in certain scenarios such as HW PTW doesn't set _PAGE_MODIFIED automatically, so here we need _PAGE_MODIFIED to record the dirty status (_PAGE_DIRTY).
The new modification involves checking whether the original PTE/PMD has the _PAGE_DIRTY flag. If it exists, the _PAGE_MODIFIED bit is also set, ensuring that the {pte,pmd}_dirty() interface can always return accurate information.
--- arch/loongarch/include/asm/pgtable.h | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
arch/loongarch/include/asm/pgtable.h +8 -3
@@ -431,6 +431,9 @@ static inline unsigned long pte_accessibstatic inline pte_t pte_modify (pte_t pte,pgprot_t newprot) { +if (pte_val (pte) & _PAGE_DIRTY) +pte_val (pte) |= _PAGE_MODIFIED; +return __pte ((pte_val (pte) & _PAGE_CHG_MASK) | (pgprot_val (newprot) & ~_PAGE_CHG_MASK)); }
@@ -565,9 +568,11 @@ static inline struct page *pmd_page(pmd_static inline pmd_t pmd_modify (pmd_t pmd,pgprot_t newprot) { -pmd_val (pmd) = (pmd_val (pmd) & _HPAGE_CHG_MASK) | - (pgprot_val (newprot) & ~_HPAGE_CHG_MASK); -return pmd; +if (pmd_val (pmd) & _PAGE_DIRTY) +pmd_val (pmd) |= _PAGE_MODIFIED; + +return __pmd ((pmd_val (pmd) & _HPAGE_CHG_MASK) | + (pgprot_val (newprot) & ~_HPAGE_CHG_MASK)); }static inline pmd_t pmd_mkinvalid (pmd_t pmd)
Greg Kroah-Hartman
maintainerPATCH 120/185 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuang Wang <[email protected]>
commit ac1499fcd40fe06479e9b933347b837ccabc2a40 upstream.
The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called to delete entries exceeding FNHE_RECLAIM_DEPTH+random.
The race window is between fnhe_remove_oldest() selecting fnheX for deletion and the subsequent kfree_rcu(). During this time, the concurrent path's __mkroute_output() -> find_exception() can fetch the soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a new dst using a dst_hold(). When the original fnheX is freed via RCU, the dst reference remains permanently leaked.
CPU 0 CPU 1__mkroute_output()
find_exception() [fnheX]
update_or_create_fnhe()
fnhe_remove_oldest() [fnheX]
rt_bind_exception() [bind dst]
RCU callback [fnheX freed, dst leak]
This issue manifests as a device reference count leak and a warning in dmesg when unregistering the net device:
unregister_netdevice: waiting for sitX to become free. Usage count = N
Ido Schimmel provided the simple test validation method [1].
The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes(). Since rt_bind_exception() checks this field, setting it to zero prevents the stale fnhe from being reused and bound to a new dst just before it is freed.
[1]
ip netns add ns1
ip -n ns1 link set dev lo up
ip -n ns1 address add 192.0.2.1/32 dev lo
ip -n ns1 link add name dummy1 up type dummy
ip -n ns1 route add 192.0.2.2/32 dev dummy1
ip -n ns1 link add name gretap1 up arp off type gretap \
local 192.0.2.1 remote 192.0.2.2
ip -n ns1 route add 198.51.0.0/16 dev gretap1
taskset -c 0 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
taskset -c 2 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &sleep 10
ip netns pids ns1 | xargs kill
ip netns del ns1
--- net/ipv4/route.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ipv4/route.c +5 -0
@@ -605,6 +605,11 @@ static void fnhe_remove_oldest(struct fn oldest_p = fnhe_p; } } + +/* Clear oldest->fnhe_daddr to prevent this fnhe from being +* rebound with new dsts in rt_bind_exception(). +*/ + oldest->fnhe_daddr =0 ;fnhe_flush_routes (oldest); *oldest_p = oldest->fnhe_next;kfree_rcu (oldest, rcu);
Greg Kroah-Hartman
maintainerPATCH 121/185 nilfs2: avoid having an active sc_timer before freeing sci
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 9a6b60cb147d53968753a34805211d2e5e08c027 upstream.
Because kthread_stop did not stop sc_task properly and returned -EINTR, the sc_timer was not properly closed, ultimately causing the problem [1] reported by syzbot when freeing sci due to the sc_timer not being closed.
Because the thread sc_task main function nilfs_segctor_thread() returns 0 when it succeeds, when the return value of kthread_stop() is not 0 in nilfs_segctor_destroy(), we believe that it has not properly closed sc_timer.
We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and set the value of sc_task to NULL under the protection of lock sc_state_lock, so as to avoid the issue caused by sc_timer not being properly shutdowned.
[1]
ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout
Call trace: nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline] nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877 nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509
--- fs/nilfs2/segment.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nilfs2/segment.c +6 -1
@@ -2787,7 +2787,12 @@ static void nilfs_segctor_destroy(structif (sci->sc_task) {wake_up (&sci->sc_wait_daemon); -kthread_stop (sci->sc_task); +if (kthread_stop (sci->sc_task)) { +spin_lock (&sci->sc_state_lock); + sci->sc_task =NULL ; +timer_shutdown_sync (&sci->sc_timer); +spin_unlock (&sci->sc_state_lock); + } }spin_lock (&sci->sc_state_lock);
Greg Kroah-Hartman
maintainerPATCH 122/185 selftests/tracing: Run sample events to clear page cache events
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit dd4adb986a86727ed8f56c48b6d0695f1e211e65 upstream.
The tracing selftest "event-filter-function.tc" was failing because it first runs the "sample_events" function that triggers the kmem_cache_free event and it looks at what function was used during a call to "ls".
But the first time it calls this, it could trigger events that are used to pull pages into the page cache.
The rest of the test uses the function it finds during that call to see if it will be called in subsequent "sample_events" calls. But if there's no need to pull pages into the page cache, it will not trigger that function and the test will fail.
Call the "sample_events" twice to trigger all the page cache work before it calls it to find a function to use in subsequent checks.
--- tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc +4 -0
@@ -20,6 +20,10 @@ sample_events() { echo 0 > tracing_on echo 0 > events/enable +# Clear functions caused by page cache; run sample_events twice +sample_events +sample_events + echo "Get the most frequently calling function" echo > trace sample_events
Greg Kroah-Hartman
maintainerPATCH 123/185 wifi: mac80211: reject address change while connecting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit a9da90e618cd0669a22bcc06a96209db5dd96e9b upstream.
While connecting, the MAC address can already no longer be changed. The change is already rejected if netif_carrier_ok(), but of course that's not true yet while connecting. Check for auth_data or assoc_data, so the MAC address cannot be changed.
Also more comprehensively check that there are no stations on the interface being changed - if any peer station is added it will know about our address already, so we cannot change it.
--- net/mac80211/iface.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
net/mac80211/iface.c +11 -3
@@ -224,6 +224,10 @@ static int ieee80211_can_powered_addr_chif (netif_carrier_ok (sdata->dev))return -EBUSY ; +/* if any stations are set known (so they know this vif too), reject */ +if (sta_info_get_by_idx (sdata,0 )) +return -EBUSY ; +/* First check no ROC work is happening on this iface */ list_for_each_entry (roc, &local->roc_list, list) {if (roc->sdata != sdata)
@@ -243,12 +247,16 @@ static int ieee80211_can_powered_addr_ch ret = -EBUSY ; } +/* +* More interface types could be added here but changing the +* address while powered makes the most sense in client modes. +*/ switch (sdata->vif.type) {case NL80211_IFTYPE_STATION :case NL80211_IFTYPE_P2P_CLIENT : -/* More interface types could be added here but changing the -* address while powered makes the most sense in client modes. -*/ +/* refuse while connecting */ +if (sdata->u.mgd.auth_data || sdata->u.mgd.assoc_data) +return -EBUSY ;break ;default : ret = -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 124/185 fs/proc: fix uaf in proc_readdir_de()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
commit 895b4c0c79b092d732544011c3cecaf7322c36a1 upstream.
Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access.
We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows:
1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3;
2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab;
3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access.
CPU 0 | CPU 1
-------------------------------------------------------------------------
traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2
sys_getdents64() |
iterate_dir() |
proc_readdir() |
proc_readdir_de() | snmp6_unregister_dev()
pde_get(de); | proc_remove()
read_unlock(&proc_subdir_lock); | remove_proc_subtree()
| write_lock(&proc_subdir_lock);
[time window] | rb_erase(&root->subdir_node, &parent->subdir);
| write_unlock(&proc_subdir_lock);
read_lock(&proc_subdir_lock); |
next = pde_subdir_next(de); |
pde_put(de); |
de = next; //UAF |rbtree of dev_snmp6
|
pde(tun3)
/ \
NULL pde(tun2)--- fs/proc/generic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/proc/generic.c +9 -3
@@ -694,6 +694,12 @@ void pde_put(struct proc_dir_entry *pde) } } +static void pde_erase (struct proc_dir_entry *pde,struct proc_dir_entry *parent) +{ +rb_erase (&pde->subdir_node, &parent->subdir); +RB_CLEAR_NODE (&pde->subdir_node); +} +/* * Remove a /proc entry and free it if it's not currently in use. */
@@ -716,7 +722,7 @@ void remove_proc_entry(const char *name,WARN (1 ,"removing permanent /proc entry '%s'" , de->name); de =NULL ; }else { -rb_erase (&de->subdir_node, &parent->subdir); +pde_erase (de, parent);if (S_ISDIR (de->mode)) parent->nlink--; }
@@ -760,7 +766,7 @@ int remove_proc_subtree(const char *name root->parent->name, root->name);return -EINVAL ; } -rb_erase (&root->subdir_node, &parent->subdir); +pde_erase (root, parent); de = root;while (1 ) {
@@ -772,7 +778,7 @@ int remove_proc_subtree(const char *name next->parent->name, next->name);return -EINVAL ; } -rb_erase (&next->subdir_node, &de->subdir); +pde_erase (next, de); de = next;continue ; }
Greg Kroah-Hartman
maintainerPATCH 125/185 mm/mm_init: fix hash table order logging in alloc_large_system_hash()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <[email protected]>
commit 0d6c356dd6547adac2b06b461528e3573f52d953 upstream.
When emitting the order of the allocation for a hash table, alloc_large_system_hash() unconditionally subtracts PAGE_SHIFT from log base 2 of the allocation size. This is not correct if the allocation size is smaller than a page, and yields a negative value for the order as seen below:
TCP established hash table entries: 32 (order: -4, 256 bytes, linear) TCP bind hash table entries: 32 (order: -2, 1024 bytes, linear)
Use get_order() to compute the order when emitting the hash table information to correctly handle cases where the allocation size is smaller than a page:
TCP established hash table entries: 32 (order: 0, 256 bytes, linear) TCP bind hash table entries: 32 (order: 0, 1024 bytes, linear)
--- mm/mm_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/mm_init.c +1 -1
@@ -2428,7 +2428,7 @@ void *__init alloc_large_system_hash(conpanic ("Failed to allocate %s hash table\n" , tablename);pr_info ("%s hash table entries: %ld (order: %d, %lu bytes, %s)\n" , - tablename,1UL << log2qty,ilog2 (size) -PAGE_SHIFT , size, + tablename,1UL << log2qty,get_order (size), size, virt ? (huge ?"vmalloc hugepage" :"vmalloc" ) :"linear" );if (_hash_shift)
Greg Kroah-Hartman
maintainerPATCH 126/185 mm/shmem: fix THP allocation and fallback loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kairui Song <[email protected]>
commit fc745ff317566ec299e16346ebb9eacc8fe5b9d2 upstream.
The order check and fallback loop is updating the index value on every loop. This will cause the index to be wrongly aligned by a larger value while the loop shrinks the order.
This may result in inserting and returning a folio of the wrong index and cause data corruption with some userspace workloads [1].
--- mm/shmem.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
mm/shmem.c +6 -3
@@ -1785,6 +1785,7 @@ static struct folio *shmem_alloc_and_addstruct shmem_inode_info *info =SHMEM_I (inode);unsigned long suitable_orders =0 ;struct folio *folio =NULL ; +pgoff_t aligned_index;long pages;int error, order;
@@ -1798,10 +1799,12 @@ static struct folio *shmem_alloc_and_add order =highest_order (suitable_orders);while (suitable_orders) { pages =1UL << order; - index =round_down (index, pages); - folio =shmem_alloc_folio (gfp, order, info, index); -if (folio) + aligned_index =round_down (index, pages); + folio =shmem_alloc_folio (gfp, order, info, aligned_index); +if (folio) { + index = aligned_index; goto allocated; + }if (pages ==HPAGE_PMD_NR )count_vm_event (THP_FILE_FALLBACK );
Greg Kroah-Hartman
maintainerPATCH 127/185 mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit a28352cf2d2f8380e7aca8cb61682396dca7a991 upstream.
strbin signal delay under 0x8 configuration is not stable after massive test. The recommandation of it should be 0x4.
--- drivers/mmc/host/sdhci-of-dwcmshc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sdhci-of-dwcmshc.c +1 -1
@@ -94,7 +94,7 @@#define DLL_TXCLK_TAPNUM_DEFAULT 0x10#define DLL_TXCLK_TAPNUM_90_DEGREES 0xA#define DLL_TXCLK_TAPNUM_FROM_SW BIT(24) -#define DLL_STRBIN_TAPNUM_DEFAULT 0x8 +#define DLL_STRBIN_TAPNUM_DEFAULT 0x4#define DLL_STRBIN_TAPNUM_FROM_SW BIT(24)#define DLL_STRBIN_DELAY_NUM_SEL BIT(26)#define DLL_STRBIN_DELAY_NUM_OFFSET 16
Greg Kroah-Hartman
maintainerPATCH 128/185 mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit 739f04f4a46237536aff07ff223c231da53ed8ce upstream.
ciu clock is 2 times of io clock, but the sample clk used is derived from io clock provided to the card. So we should use io clock to calculate the phase.
--- drivers/mmc/host/dw_mmc-rockchip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/dw_mmc-rockchip.c +2 -2
@@ -43,7 +43,7 @@ struct dw_mci_rockchip_priv_data {*/ static int rockchip_mmc_get_internal_phase (struct dw_mci *host,bool sample) { -unsigned long rate =clk_get_rate (host->ciu_clk); +unsigned long rate =clk_get_rate (host->ciu_clk) /RK3288_CLKGEN_DIV ;u32 raw_value;u16 degrees;u32 delay_num =0 ;
@@ -86,7 +86,7 @@ static int rockchip_mmc_get_phase(structstatic int rockchip_mmc_set_internal_phase (struct dw_mci *host,bool sample,int degrees) { -unsigned long rate =clk_get_rate (host->ciu_clk); +unsigned long rate =clk_get_rate (host->ciu_clk) /RK3288_CLKGEN_DIV ;u8 nineties, remainder;u8 delay_num;u32 raw_value;
Greg Kroah-Hartman
maintainerPATCH 129/185 ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 05a1fc5efdd8560f34a3af39c9cf1e1526cc3ddf upstream.
The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot.
Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations.
This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since it's always equal or greater than ep->packsize[0].
--- sound/usb/endpoint.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/usb/endpoint.c +5 -0
@@ -1386,6 +1386,11 @@ int snd_usb_endpoint_set_params(struct s ep->sample_rem = ep->cur_rate % ep->pps; ep->packsize[0 ] = ep->cur_rate / ep->pps; ep->packsize[1 ] = (ep->cur_rate + (ep->pps -1 )) / ep->pps; +if (ep->packsize[1 ] > ep->maxpacksize) { +usb_audio_dbg (chip,"Too small maxpacksize %u for rate %u / pps %u\n" , + ep->maxpacksize, ep->cur_rate, ep->pps); +return -EINVAL ; + }/* calculate the frequency in 16.16 format */ ep->freqm = ep->freqn;
Greg Kroah-Hartman
maintainerPATCH 130/185 cifs: client: fix memory leak in smb3_fs_context_parse_param
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit e8c73eb7db0a498cd4b22d2819e6ab1a6f506bd6 upstream.
The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation.
To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing.
syzbot reported:
BUG: memory leak
unreferenced object 0xffff888128afa360 (size 96):
backtrace (crc 79c9c7ba):
kstrdup+0x3c/0x80 mm/util.c:84
smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444
BUG: memory leak
unreferenced object 0xffff888112c7d900 (size 96):
backtrace (crc 79c9c7ba):
smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629
smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438--- fs/smb/client/fs_context.c | 2 ++ 1 file changed, 2 insertions(+)
fs/smb/client/fs_context.c +2 -0
@@ -1380,12 +1380,14 @@ static int smb3_fs_context_parse_param(scifs_errorf (fc,"Unknown error parsing devname\n" ); goto cifs_parse_mount_err; } +kfree (ctx->source); ctx->source =smb3_fs_context_fullpath (ctx,'/' );if (IS_ERR (ctx->source)) { ctx->source =NULL ;cifs_errorf (fc,"OOM when copying UNC string\n" ); goto cifs_parse_mount_err; } +kfree (fc->source); fc->source =kstrdup (ctx->source,GFP_KERNEL );if (fc->source ==NULL ) {cifs_errorf (fc,"OOM when copying UNC string\n" );
Greg Kroah-Hartman
maintainerPATCH 131/185 codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
commit 1abbdf3d57aa964e572940d67c9ec5dc87710738 upstream.
When alloc_slab_obj_exts() fails and then later succeeds in allocating a slab extension vector, it calls handle_failed_objexts_alloc() to mark all objects in the vector as empty. As a result all objects in this slab (slabA) will have their extensions set to CODETAG_EMPTY.
Later on if this slabA is used to allocate a slabobj_ext vector for another slab (slabB), we end up with the slabB->obj_exts pointing to a slabobj_ext vector that itself has a non-NULL slabobj_ext equal to CODETAG_EMPTY. When slabB gets freed, free_slab_obj_exts() is called to free slabB->obj_exts vector.
free_slab_obj_exts() calls mark_objexts_empty(slabB->obj_exts) which will generate a warning because it expects slabobj_ext vectors to have a NULL obj_ext, not CODETAG_EMPTY.
Modify mark_objexts_empty() to skip the warning and setting the obj_ext value if it's already set to CODETAG_EMPTY.
To quickly detect this WARN, I modified the code from WARN_ON(slab_exts[offs].ref.ct) to BUG_ON(slab_exts[offs].ref.ct == 1);
We then obtained this message:
[21630.898561] ------------[ cut here ]------------ [21630.898596] kernel BUG at mm/slub.c:2050! [21630.898611] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [21630.900372] Modules linked in: squashfs isofs vfio_iommu_type1
vhost_vsock vfio vhost_net vmw_vsock_virtio_transport_common vhost tap vhost_iotlb iommufd vsock binfmt_misc nfsv3 nfs_acl nfs lockd grace netfs tls rds dns_resolver tun brd overlay ntfs3 exfat btrfs blake2b_generic xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables rfkill ip_set sunrpc vfat fat joydev sg sch_fq_codel nfnetlink virtio_gpu sr_mod cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper drm ghash_ce backlight virtio_net virtio_blk virtio_scsi net_failover virtio_console failover virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod fuse i2c_dev virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_ring autofs4 aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject]
[21630.909177] CPU: 3 UID: 0 PID: 3787 Comm: kylin-process-m Kdump: loaded Tainted: G W 6.18.0-rc1+ #74 PREEMPT(voluntary) [21630.910495] Tainted: [W]=WARN [21630.910867] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [21630.911625] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [21630.912392] pc : __free_slab+0x228/0x250 [21630.912868] lr : __free_slab+0x18c/0x250[21630.913334] sp : ffff8000a02f73e0 [21630.913830] x29: ffff8000a02f73e0 x28: fffffdffc43fc800 x27: ffff0000c0011c40 [21630.914677] x26: ffff0000c000cac0 x25: ffff00010fe5e5f0 x24: ffff000102199b40 [21630.915469] x23: 0000000000000003 x22: 0000000000000003 x21: ffff0000c0011c40 [21630.916259] x20: fffffdffc4086600 x19: fffffdffc43fc800 x18: 0000000000000000 [21630.917048] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [21630.917837] x14: 0000000000000000 x13: 0000000000000000 x12: ffff70001405ee66 [21630.918640] x11: 1ffff0001405ee65 x10: ffff70001405ee65 x9 : ffff800080a295dc [21630.919442] x8 : ffff8000a02f7330 x7 : 0000000000000000 x6 : 0000000000003000 [21630.920232] x5 : 0000000024924925 x4 : 0000000000000001 x3 : 0000000000000007 [21630.921021] x2 : 0000000000001b40 x1 : 000000000000001f x0 : 0000000000000001 [21630.921810] Call trace: [21630.922130] __free_slab+0x228/0x250 (P) [21630.922669] free_slab+0x38/0x118 [21630.923079] free_to_partial_list+0x1d4/0x340 [21630.923591] __slab_free+0x24c/0x348 [21630.924024] ___cache_free+0xf0/0x110 [21630.924468] qlist_free_all+0x78/0x130 [21630.924922] kasan_quarantine_reduce+0x114/0x148 [21630.925525] __kasan_slab_alloc+0x7c/0xb0 [21630.926006] kmem_cache_alloc_noprof+0x164/0x5c8 [21630.926699] __alloc_object+0x44/0x1f8 [21630.927153] __create_object+0x34/0xc8 [21630.927604] kmemleak_alloc+0xb8/0xd8 [21630.928052] kmem_cache_alloc_noprof+0x368/0x5c8 [21630.928606] getname_flags.part.0+0xa4/0x610 [21630.929112] getname_flags+0x80/0xd8 [21630.929557] vfs_fstatat+0xc8/0xe0 [21630.929975] __do_sys_newfstatat+0xa0/0x100 [21630.930469] __arm64_sys_newfstatat+0x90/0xd8 [21630.931046] invoke_syscall+0xd4/0x258 [21630.931685] el0_svc_common.constprop.0+0xb4/0x240 [21630.932467] do_el0_svc+0x48/0x68 [21630.932972] el0_svc+0x40/0xe0 [21630.933472] el0t_64_sync_handler+0xa0/0xe8 [21630.934151] el0t_64_sync+0x1ac/0x1b0 [21630.934923] Code: aa1803e0 97ffef2b a9446bf9 17ffff9c (d4210000) [21630.936461] SMP: stopping secondary CPUs [21630.939550] Starting crashdump kernel... [21630.940108] Bye!
--- mm/slub.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
mm/slub.c +5 -1
@@ -1935,7 +1935,11 @@ static inline void mark_objexts_empty(stif (slab_exts) {unsigned int offs =obj_to_index (obj_exts_slab->slab_cache, obj_exts_slab, obj_exts); -/* codetag should be NULL */ + +if (unlikely (is_codetag_empty (&slab_exts[offs].ref))) +return ; + +/* codetag should be NULL here */ WARN_ON (slab_exts[offs].ref.ct);set_codetag_empty (&slab_exts[offs].ref); }
Greg Kroah-Hartman
maintainerPATCH 132/185 crash: fix crashkernel resource shrink
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
commit 00fbff75c5acb4755f06f08bd1071879c63940c5 upstream.
When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues:
1. Invalid crashkernel resource objects
2. Kernel crash if crashkernel shrinking is done twice
For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as:
cat /proc/iomem | grep -i crash
af000000-beffffff : Crash kernel
433000000-43f7fffff : Crash kernel
If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved:
af000000-beffffff : Crash kernel
Instead, it should show 50MB:
af000000-b21fffff : Crash kernel
Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86):
BUG: kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI <snip...> Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? __release_resource+0xd/0xb0 release_resource+0x26/0x40 __crash_shrink_memory+0xe5/0x110 crash_shrink_memory+0x12a/0x190 kexec_crash_size_store+0x41/0x80 kernfs_fop_write_iter+0x141/0x1f0 vfs_write+0x294/0x460 ksys_write+0x6d/0xf0
<snip...>
This happens because __crash_shrink_memory()/kernel/crash_core.c incorrectly updates the crashk_res resource object even when crashk_low_res should be updated.
Fix this by ensuring the correct crashkernel resource object is updated when shrinking crashkernel memory.
--- kernel/crash_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/crash_core.c +1 -1
@@ -352,7 +352,7 @@ static int __crash_shrink_memory(struct old_res->start =0 ; old_res->end =0 ; }else { - crashk_res.end = ram_res->start -1 ; + old_res->end = ram_res->start -1 ; }crash_free_reserved_phys_range (ram_res->start, ram_res->end);
Greg Kroah-Hartman
maintainerPATCH 133/185 crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 59b0afd01b2ce353ab422ea9c8375b03db313a21 upstream.
The qm_get_qos_value() function calls bus_find_device_by_name() which increases the device reference count, but fails to call put_device() to balance the reference count and lead to a device reference leak.
Add put_device() calls in both the error path and success path to properly balance the reference count.
Found via static analysis.
--- drivers/crypto/hisilicon/qm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/hisilicon/qm.c +2 -0
@@ -3688,10 +3688,12 @@ static ssize_t qm_get_qos_value(struct h pdev = container_of(dev, struct pci_dev, dev);if (pci_physfn (pdev) != qm->pdev) {pci_err (qm->pdev,"the pdev input does not match the pf!\n" ); +put_device (dev);return -EINVAL ; } *fun_index = pdev->devfn; +put_device (dev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 134/185 smb: client: fix cifs_pick_channel when channel needs reconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
commit 79280191c2fd7f24899bbd640003b5389d3c109c upstream.
cifs_pick_channel iterates candidate channels using cur. The reconnect-state test mistakenly used a different variable.
This checked the wrong slot and would cause us to skip a healthy channel and to dispatch on one that needs reconnect, occasionally failing operations when a channel was down.
Fix by replacing for the correct variable.
--- fs/smb/client/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/transport.c +1 -1
@@ -1050,7 +1050,7 @@ struct TCP_Server_Info *cifs_pick_channeif (!server || server->terminate)continue ; -if (CIFS_CHAN_NEEDS_RECONNECT (ses, i)) +if (CIFS_CHAN_NEEDS_RECONNECT (ses, cur))continue ;/*
Greg Kroah-Hartman
maintainerPATCH 135/185 spi: Try to get ACPI GPIO IRQ earlier
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 3cd2018e15b3d66d2187d92867e265f45ad79e6f upstream.
Since commit d24cfee7f63d ("spi: Fix acpi deferred irq probe"), the acpi_dev_gpio_irq_get() call gets delayed till spi_probe() is called on the SPI device.
If there is no driver for the SPI device then the move to spi_probe() results in acpi_dev_gpio_irq_get() never getting called. This may cause problems by leaving the GPIO pin floating because this call is responsible for setting up the GPIO pin direction and/or bias according to the values from the ACPI tables.
Re-add the removed acpi_dev_gpio_irq_get() in acpi_register_spi_device() to ensure the GPIO pin is always correctly setup, while keeping the acpi_dev_gpio_irq_get() call added to spi_probe() to deal with -EPROBE_DEFER returns caused by the GPIO controller not having a driver yet.
--- drivers/spi/spi.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/spi/spi.c +10 -0
@@ -2879,6 +2879,16 @@ static acpi_status acpi_register_spi_devacpi_set_modalias (adev,acpi_device_hid (adev), spi->modalias,sizeof (spi->modalias)); +/* +* This gets re-tried in spi_probe() for -EPROBE_DEFER handling in case +* the GPIO controller does not have a driver yet. This needs to be done +* here too, because this call sets the GPIO direction and/or bias. +* Setting these needs to be done even if there is no driver, in which +* case spi_probe() will never get called. +*/ +if (spi->irq <0 ) + spi->irq =acpi_dev_gpio_irq_get (adev,0 ); +acpi_device_set_enumerated (adev); adev->power.flags.ignore_parent = true;
Greg Kroah-Hartman
maintainerPATCH 136/185 x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit dd14022a7ce96963aa923e35cf4bcc8c32f95840 upstream.
Add the minimum Entrysign revision for that model+stepping to the list of minimum revisions.
--- arch/x86/kernel/cpu/microcode/amd.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/microcode/amd.c +1 -0
@@ -212,6 +212,7 @@ static bool need_sha_check(u32 cur_rev)case 0xb1010 :return cur_rev <=0xb101046 ;break ;case 0xb2040 :return cur_rev <=0xb204031 ;break ;case 0xb4040 :return cur_rev <=0xb404031 ;break ; +case 0xb4041 :return cur_rev <=0xb404101 ;break ;case 0xb6000 :return cur_rev <=0xb600031 ;break ;case 0xb6080 :return cur_rev <=0xb608031 ;break ;case 0xb7000 :return cur_rev <=0xb700031 ;break ;
Greg Kroah-Hartman
maintainerPATCH 137/185 selftests/user_events: fix type cast for write_index packed member in perf_test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Khushwaha <[email protected]>
commit 216158f063fe24fb003bd7da0cd92cd6e2c4d48b upstream.
Accessing 'reg.write_index' directly triggers a -Waddress-of-packed-member warning due to potential unaligned pointer access:
perf_test.c:239:38: warning: taking address of packed member 'write_index' of class or structure 'user_reg' may result in an unaligned pointer value [-Waddress-of-packed-member]
239 | ASSERT_NE(-1, write(self->data_fd, ®.write_index,
| ^~~~~~~~~~~~~~~
Since write(2) works with any alignment. Casting '®.write_index' explicitly to 'void *' to suppress this warning.
--- tools/testing/selftests/user_events/perf_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/user_events/perf_test.c +1 -1
@@ -236,7 +236,7 @@ TEST_F(user, perf_empty_events) {ASSERT_EQ (1 << reg.enable_bit, self->check);/* Ensure write shows up at correct offset */ -ASSERT_NE (-1 ,write (self->data_fd, ®.write_index, +ASSERT_NE (-1 ,write (self->data_fd, (void *)®.write_index,sizeof (reg.write_index))); val = (void *)(((char *)perf_page) + perf_page->data_offset);ASSERT_EQ (PERF_RECORD_SAMPLE , *val);
Greg Kroah-Hartman
maintainerPATCH 138/185 ftrace: Fix BPF fexit with livepatch
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Liu <[email protected]>
commit 56b3c85e153b84f27e6cff39623ba40a1ad299d3 upstream.
When livepatch is attached to the same function as bpf trampoline with a fexit program, bpf trampoline code calls register_ftrace_direct() twice. The first time will fail with -EAGAIN, and the second time it will succeed. This requires register_ftrace_direct() to unregister the address on the first attempt. Otherwise, the bpf trampoline cannot attach. Here is an easy way to reproduce this issue:
insmod samples/livepatch/livepatch-sample.ko
bpftrace -e 'fexit:cmdline_proc_show {}'
ERROR: Unable to attach probe: fexit:vmlinux:cmdline_proc_show...
Fix this by cleaning up the hash when register_ftrace_function_nolock hits errors.
Also, move the code that resets ops->func and ops->trampoline to the error path of register_ftrace_direct(); and add a helper function reset_direct() in register_ftrace_direct() and unregister_ftrace_direct().
--- kernel/bpf/trampoline.c | 5 ----- kernel/trace/ftrace.c | 20 ++++++++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-)
kernel/bpf/trampoline.c +0 -5
@@ -479,11 +479,6 @@ again:* BPF_TRAMP_F_SHARE_IPMODIFY is set, we can generate the * trampoline again, and retry register. */ -/* reset fops->func and fops->trampoline for re-register */ - tr->fops->func =NULL ; - tr->fops->trampoline =0 ; - -/* free im memory and reallocate later */ bpf_tramp_image_free (im); goto again; }
kernel/trace/ftrace.c +14 -6
@@ -5894,6 +5894,17 @@ static void register_ftrace_direct_cb(stfree_ftrace_hash (fhp); } +static void reset_direct (struct ftrace_ops *ops,unsigned long addr) +{ +struct ftrace_hash *hash = ops->func_hash->filter_hash; + +remove_direct_functions_hash (hash, addr); + +/* cleanup for possible another register call */ + ops->func =NULL ; + ops->trampoline =0 ; +} +/** * register_ftrace_direct - Call a custom trampoline directly * for multiple functions registered in @ops
@@ -5989,6 +6000,8 @@ int register_ftrace_direct(struct ftrace ops->direct_call = addr; err =register_ftrace_function_nolock (ops); +if (err) +reset_direct (ops, addr); out_unlock:mutex_unlock (&direct_mutex);
@@ -6021,7 +6034,6 @@ EXPORT_SYMBOL_GPL(register_ftrace_directint unregister_ftrace_direct (struct ftrace_ops *ops,unsigned long addr,bool free_filters) { -struct ftrace_hash *hash = ops->func_hash->filter_hash;int err;if (check_direct_multi (ops))
@@ -6031,13 +6043,9 @@ int unregister_ftrace_direct(struct ftramutex_lock (&direct_mutex); err =unregister_ftrace_function (ops); -remove_direct_functions_hash (hash, addr); +reset_direct (ops, addr);mutex_unlock (&direct_mutex); -/* cleanup for possible another register call */ - ops->func =NULL ; - ops->trampoline =0 ; -if (free_filters)ftrace_free_filter (ops);return err;
Greg Kroah-Hartman
maintainerPATCH 139/185 LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 4e67526840fc55917581b90f6a4b65849a616dd8 upstream.
Now we use virtual addresses to fill CSR_MERRENTRY/CSR_TLBRENTRY, but hardware hope physical addresses. Now it works well because the high bits are ignored above PA_BITS (48 bits), but explicitly use physical addresses can avoid potential bugs. So fix it.
--- arch/loongarch/kernel/traps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/loongarch/kernel/traps.c +2 -2
@@ -1123,8 +1123,8 @@ static void configure_exception_vector(v tlbrentry = (unsigned long )exception_handlers +80 *VECSIZE ;csr_write64 (eentry,LOONGARCH_CSR_EENTRY ); -csr_write64 (eentry,LOONGARCH_CSR_MERRENTRY ); -csr_write64 (tlbrentry,LOONGARCH_CSR_TLBRENTRY ); +csr_write64 (__pa (eentry),LOONGARCH_CSR_MERRENTRY ); +csr_write64 (__pa (tlbrentry),LOONGARCH_CSR_TLBRENTRY ); }void per_cpu_trap_init (int cpu)
Greg Kroah-Hartman
maintainerPATCH 140/185 EDAC/altera: Handle OCRAM ECC enable after warm reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 upstream.
The OCRAM ECC is always enabled either by the BootROM or by the Secure Device Manager (SDM) during a power-on reset on SoCFPGA.
However, during a warm reset, the OCRAM content is retained to preserve data, while the control and status registers are reset to their default values. As a result, ECC must be explicitly re-enabled after a warm reset.
--- drivers/edac/altera_edac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/edac/altera_edac.c +15 -3
@@ -1184,10 +1184,22 @@ altr_check_ocram_deps_init(struct altr_eif (ret)return ret; -/* Verify OCRAM has been initialized */ +/* +* Verify that OCRAM has been initialized. +* During a warm reset, OCRAM contents are retained, but the control +* and status registers are reset to their default values. Therefore, +* ECC must be explicitly re-enabled in the control register. +* Error condition: if INITCOMPLETEA is clear and ECC_EN is already set. +*/ if (!ecc_test_bits (ALTR_A10_ECC_INITCOMPLETEA , - (base +ALTR_A10_ECC_INITSTAT_OFST ))) -return -ENODEV ; + (base +ALTR_A10_ECC_INITSTAT_OFST ))) { +if (!ecc_test_bits (ALTR_A10_ECC_EN , + (base +ALTR_A10_ECC_CTRL_OFST ))) +ecc_set_bits (ALTR_A10_ECC_EN , + (base +ALTR_A10_ECC_CTRL_OFST )); +else +return -ENODEV ; + }/* Enable IRQ on Single Bit Error */ writel (ALTR_A10_ECC_SERRINTEN , (base +ALTR_A10_ECC_ERRINTENS_OFST ));
Greg Kroah-Hartman
maintainerPATCH 141/185 EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
commit 281326be67252ac5794d1383f67526606b1d6b13 upstream.
The current single-bit error injection mechanism flips bits directly in ECC RAM by performing write and read operations. When the ECC RAM is actively used by the Ethernet or USB controller, this approach sometimes trigger a false double-bit error.
Switch both Ethernet and USB EDAC devices to use the INTTEST register (altr_edac_a10_device_inject_fops) for single-bit error injection, similar to the existing double-bit error injection method.
--- drivers/edac/altera_edac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/edac/altera_edac.c +2 -2
@@ -1369,7 +1369,7 @@ static const struct edac_device_prv_data .ue_set_mask = ALTR_A10_ECC_TDERRA, .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, .ecc_irq_handler = altr_edac_a10_ecc_irq, - .inject_fops = &altr_edac_a10_device_inject2_fops, + .inject_fops = &altr_edac_a10_device_inject_fops, };#endif /* CONFIG_EDAC_ALTERA_ETHERNET */
@@ -1459,7 +1459,7 @@ static const struct edac_device_prv_data .ue_set_mask = ALTR_A10_ECC_TDERRA, .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, .ecc_irq_handler = altr_edac_a10_ecc_irq, - .inject_fops = &altr_edac_a10_device_inject2_fops, + .inject_fops = &altr_edac_a10_device_inject_fops, };#endif /* CONFIG_EDAC_ALTERA_USB */
Greg Kroah-Hartman
maintainerPATCH 142/185 PM: hibernate: Emit an error when image writing fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 62b9ca1706e1bbb60d945a58de7c7b5826f6b2a2 upstream.
If image writing fails, a return code is passed up to the caller, but none of the callers log anything to the log and so the only record of it is the return code that userspace gets.
Adjust the logging so that the image size and speed of writing is only emitted on success and if there is an error, it's saved to the logs.
--- kernel/power/swap.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
kernel/power/swap.c +7 -4
@@ -882,11 +882,14 @@ out_finish: stop =ktime_get ();if (!ret) ret = err2; -if (!ret) +if (!ret) { +swsusp_show_speed (start, stop, nr_to_write,"Wrote" ); +pr_info ("Image size after compression: %d kbytes\n" , + (atomic_read (&compressed_size) /1024 ));pr_info ("Image saving done\n" ); -swsusp_show_speed (start, stop, nr_to_write,"Wrote" ); -pr_info ("Image size after compression: %d kbytes\n" , - (atomic_read (&compressed_size) /1024 )); + }else { +pr_err ("Image saving failed: %d\n" , ret); + } out_clean:hib_finish_batch (&hb);
Greg Kroah-Hartman
maintainerPATCH 143/185 PM: hibernate: Use atomic64_t for compressed_size variable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 66ededc694f1d06a71ca35a3c8e3689e9b85b3ce upstream.
compressed_size can overflow, showing nonsensical values.
Change from atomic_t to atomic64_t to prevent overflow.
--- kernel/power/swap.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/power/swap.c +5 -5
@@ -648,7 +648,7 @@ struct cmp_data { };/* Indicates the image size after compression */ -static atomic_t compressed_size =ATOMIC_INIT (0 ); +static atomic64_t compressed_size =ATOMIC_INIT (0 );/* * Compression function that runs in its own thread.
@@ -676,7 +676,7 @@ static int compress_threadfn(void *data) &cmp_len); d->cmp_len = cmp_len; -atomic_set (&compressed_size,atomic_read (&compressed_size) + d->cmp_len); +atomic64_add (d->cmp_len, &compressed_size);atomic_set_release (&d->stop,1 );wake_up (&d->done); }
@@ -708,7 +708,7 @@ static int save_compressed_image(structhib_init_batch (&hb); -atomic_set (&compressed_size,0 ); +atomic64_set (&compressed_size,0 );/* * We'll limit the number of threads for compression to limit memory
@@ -884,8 +884,8 @@ out_finish: ret = err2;if (!ret) {swsusp_show_speed (start, stop, nr_to_write,"Wrote" ); -pr_info ("Image size after compression: %d kbytes\n" , - (atomic_read (&compressed_size) /1024 )); +pr_info ("Image size after compression: %lld kbytes\n" , + (atomic64_read (&compressed_size) /1024 ));pr_info ("Image saving done\n" ); }else {pr_err ("Image saving failed: %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 144/185 btrfs: zoned: fix conventional zone capacity calculation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit 94f54924b96d3565c6b559294b3401b5496c21ac upstream.
When a block group contains both conventional zone and sequential zone, the capacity of the block group is wrongly set to the block group's full length. The capacity should be calculated in btrfs_load_block_group_* using the last allocation offset.
--- fs/btrfs/zoned.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/zoned.c +2 -2
@@ -1300,6 +1300,7 @@ static int btrfs_load_zone_info(struct bif (!btrfs_dev_is_sequential (device, info->physical)) {up_read (&dev_replace->rwsem); info->alloc_offset =WP_CONVENTIONAL ; + info->capacity = device->zone_info->zone_size;return 0 ; }
@@ -1598,8 +1599,6 @@ int btrfs_load_block_group_zone_info(strset_bit (BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE , &cache->runtime_flags);if (num_conventional >0 ) { -/* Zone capacity is always zone size in emulation */ - cache->zone_capacity = cache->length; ret =calculate_alloc_pointer (cache, &last_alloc, new);if (ret) { btrfs_err(fs_info,
@@ -1608,6 +1607,7 @@ int btrfs_load_block_group_zone_info(str goto out; }else if (map->num_stripes == num_conventional) { cache->alloc_offset = last_alloc; + cache->zone_capacity = cache->length;set_bit (BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE , &cache->runtime_flags); goto out; }
Greg Kroah-Hartman
maintainerPATCH 145/185 btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
commit 5fea61aa1ca70c4b3738eebad9ce2d7e7938ebbd upstream.
scrub_raid56_parity_stripe() allocates a bio with bio_alloc(), but fails to release it on some error paths, leading to a potential memory leak.
Add the missing bio_put() calls to properly drop the bio reference in those error cases.
--- fs/btrfs/scrub.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/scrub.c +2 -0
@@ -2091,6 +2091,7 @@ static int scrub_raid56_parity_stripe(st ret =btrfs_map_block (fs_info,BTRFS_MAP_WRITE , full_stripe_start, &length, &bioc,NULL ,NULL );if (ret <0 ) { +bio_put (bio);btrfs_put_bioc (bioc);btrfs_bio_counter_dec (fs_info); goto out;
@@ -2100,6 +2101,7 @@ static int scrub_raid56_parity_stripe(stbtrfs_put_bioc (bioc);if (!rbio) { ret = -ENOMEM ; +bio_put (bio);btrfs_bio_counter_dec (fs_info); goto out; }
Greg Kroah-Hartman
maintainerPATCH 146/185 btrfs: do not update last_log_commit when logging inode due to a new name
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit bfe3d755ef7cec71aac6ecda34a107624735aac7 upstream.
When logging that a new name exists, we skip updating the inode's last_log_commit field to prevent a later explicit fsync against the inode from doing nothing (as updating last_log_commit makes btrfs_inode_in_log() return true). We are detecting, at btrfs_log_inode(), that logging a new name is happening by checking the logging mode is not LOG_INODE_EXISTS, but that is not enough because we may log parent directories when logging a new name of a file in LOG_INODE_ALL mode - we need to check that the logging_new_name field of the log context too.
An example scenario where this results in an explicit fsync against a directory not persisting changes to the directory is the following:
$ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt
$ touch /mnt/foo
$ sync
$ mkdir /mnt/dir
# Write some data to our file and fsync it.
$ xfs_io -c "pwrite -S 0xab 0 64K" -c "fsync" /mnt/foo
# Add a new link to our file. Since the file was logged before, we
# update it in the log tree by calling btrfs_log_new_name(). $ ln /mnt/foo /mnt/dir/bar
# fsync the root directory - we expect it to persist the dentry for # the new directory "dir". $ xfs_io -c "fsync" /mnt
<power fail>
After mounting the fs the entry for directory "dir" does not exists, despite the explicit fsync on the root directory.
Here's why this happens:
1) When we fsync the file we log the inode, so that it's present in the log tree;
2) When adding the new link we enter btrfs_log_new_name(), and since the inode is in the log tree we proceed to updating the inode in the log tree;
3) We first set the inode's last_unlink_trans to the current transaction (early in btrfs_log_new_name());
4) We then eventually enter btrfs_log_inode_parent(), and after logging the file's inode, we call btrfs_log_all_parents() because the inode's last_unlink_trans matches the current transaction's ID (updated in the previous step);
5) So btrfs_log_all_parents() logs the root directory by calling btrfs_log_inode() for the root's inode with a log mode of LOG_INODE_ALL so that new dentries are logged;
6) At btrfs_log_inode(), because the log mode is LOG_INODE_ALL, we update root inode's last_log_commit to the last transaction that changed the inode (->last_sub_trans field of the inode), which corresponds to the current transaction's ID;
7) Then later when user space explicitly calls fsync against the root directory, we enter btrfs_sync_file(), which calls skip_inode_logging() and that returns true, since its call to btrfs_inode_in_log() returns true and there are no ordered extents (it's a directory, never has ordered extents). This results in btrfs_sync_file() returning without syncing the log or committing the current transaction, so all the updates we did when logging the new name, including logging the root directory, are not persisted.
So fix this by but updating the inode's last_log_commit if we are sure we are not logging a new name (if ctx->logging_new_name is false).
A test case for fstests will follow soon.
--- fs/btrfs/tree-log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/tree-log.c +1 -1
@@ -6795,7 +6795,7 @@ log_extents:* a power failure unless the log was synced as part of an fsync * against any other unrelated inode. */ -if (inode_only !=LOG_INODE_EXISTS ) +if (!ctx->logging_new_name && inode_only !=LOG_INODE_EXISTS ) inode->last_log_commit = inode->last_sub_trans;spin_unlock (&inode->lock);