6.17.10-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.17.10-rc1 review
This is the start of the stable review cycle for the 6.17.10 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 29 Nov 2025 14:40:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.17.10-rc1
Emil Tsalapatis <[email protected]>
sched_ext: fix flag check for deferred callbacks
Andrea Righi <[email protected]>
sched_ext: Fix scx_kick_pseqs corruption on concurrent scheduler loads
Ankit Nautiyal <[email protected]>
drm/i915/dp: Add device specific quirk to limit eDP rate to HBR2
Ankit Nautiyal <[email protected]>
Revert "drm/i915/dp: Reject HBR3 when sink doesn't support TPS4"
Jari Ruusu <[email protected]>
tty/vt: fix up incorrect backport to stable releases
Fangzhi Zuo <[email protected]>
drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
Charlene Liu <[email protected]>
drm/amd/display: Insert dccg log for easy debug
Gang Yan <[email protected]>
mptcp: fix address removal logic in mptcp_pm_nl_rm_addr
Darrick J. Wong <[email protected]>
xfs: fix out of bounds memory read error in symlink repair
Marcelo Moreira <[email protected]>
xfs: Replace strncpy with memcpy
Sathishkumar S <[email protected]>
drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1
Sathishkumar S <[email protected]>
drm/amdgpu/jpeg: Move parse_cs to amdgpu_jpeg.c
Imre Deak <[email protected]>
drm/i915/dp_mst: Disable Panel Replay
Jouni Högander <[email protected]>
drm/i915/psr: Check drm_dp_dpcd_read return value on PSR dpcd init
Henrique Carvalho <[email protected]>
smb: client: fix incomplete backport in cfids_invalidation_worker()
Samuel Zhang <[email protected]>
drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
Filipe Manana <[email protected]>
btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name
Zhang Chujun <[email protected]>
tracing/tools: Fix incorrcet short option in usage text for --threads
Nishanth Menon <[email protected]>
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
Nitin Rawat <[email protected]>
scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
René Rebe <[email protected]>
ALSA: usb-audio: fix uac2 clock source at terminal parser
Shuicheng Lin <[email protected]>
drm/xe: Prevent BIT() overflow when handling invalid prefetch region
Jakub Horký <[email protected]>
kconfig/nconf: Initialize the default locale at startup
Jakub Horký <[email protected]>
kconfig/mconf: Initialize the default locale at startup
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Extend Zen6 model range
Shahar Shitrit <[email protected]>
net: tls: Cancel RX async resync request on rcd_delta overflow
Carlos Llamas <[email protected]>
blk-crypto: use BLK_STS_INVAL for alignment errors
Shahar Shitrit <[email protected]>
net: tls: Change async resync helpers argument
Po-Hsu Lin <[email protected]>
selftests: net: use BASH for bareudp testing
Paulo Alcantara <[email protected]>
smb: client: handle lack of IPC in dfs_cache_refresh()
Sidharth Seela <[email protected]>
selftests: cachestat: Fix warning on declaration under label
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Limit Entrysign signature checking to known generations
dongsheng <[email protected]>
perf/x86/intel/uncore: Add uncore PMU support for Wildcat Lake
Eren Demir <[email protected]>
ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D)
Bart Van Assche <[email protected]>
scsi: core: Fix a regression triggered by scsi_host_busy()
Steve French <[email protected]>
cifs: fix typo in enable_gcm_256 module parameter
Shuming Fan <[email protected]>
ASoC: rt721: fix prepare clock stop failed
Rob Clark <[email protected]>
drm/msm: Fix pgtable prealloc error path
Emil Tsalapatis <[email protected]>
sched_ext: defer queue_balance_callback() until after ops.dispatch
Rafał Miłecki <[email protected]>
bcma: don't register devices disabled in OF
Tejun Heo <[email protected]>
sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc()
J-Donald Tournier <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 2-in-1 14AKP10
Thomas Bogendoerfer <[email protected]>
MIPS: kernel: Fix random segmentation faults
Malaya Kumar Rout <[email protected]>
timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths
Michal Luczaj <[email protected]>
vsock: Ignore signal/timeout on connect() if already established
Dapeng Mi <[email protected]>
perf: Fix 0 count issue of cpu-clock
Shaurya Rane <[email protected]>
cifs: fix memory leak in smb3_fs_context_parse_param error path
Thomas Weißschuh <[email protected]>
LoongArch: Use UAPI types in ptrace UAPI header
Wen Yang <[email protected]>
tick/sched: Fix bogus condition in report_idle_softirq()
Wei Fang <[email protected]>
net: phylink: add missing supported link modes for the fixed-link
Bartosz Golaszewski <[email protected]>
gpio: cdev: make sure the cdev fd is still active before emitting events
Kuniyuki Iwashima <[email protected]>
af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic().
Pradyumn Rahar <[email protected]>
net/mlx5: Clean up only new IRQ glue on request_irq() failure
Shay Drory <[email protected]>
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
Jared Kangas <[email protected]>
pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
Jared Kangas <[email protected]>
pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
Grzegorz Nitka <[email protected]>
ice: fix PTP cleanup on driver removal in error path
Emil Tantilov <[email protected]>
idpf: fix possible vport_config NULL pointer deref in remove
Venkata Ramana Nayana <[email protected]>
drm/xe/irq: Handle msix vector0 interrupt
Matt Roper <[email protected]>
drm/xe/kunit: Fix forcewake assertion in mocs test
Dnyaneshwar Bhadane <[email protected]>
drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A
Dnyaneshwar Bhadane <[email protected]>
drm/i915/display: Add definition for wcl as subplatform
Dnyaneshwar Bhadane <[email protected]>
drm/pcids: Split PTL pciids group to make wcl subplatform
Pavel Zhigulin <[email protected]>
net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
Randy Dunlap <[email protected]>
platform/x86: intel-uncore-freq: fix all header kernel-doc warnings
Haotian Zhang <[email protected]>
platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos
Lorenzo Bianconi <[email protected]>
net: airoha: Do not loopback traffic to GDM2 if it is available on the device
Lorenzo Bianconi <[email protected]>
net: airoha: Add wlan flowtable TX offload
Ido Schimmel <[email protected]>
selftests: net: lib: Do not overwrite error messages
Aleksei Nikiforov <[email protected]>
s390/ctcm: Fix double-kfree
Dnyaneshwar Bhadane <[email protected]>
drm/i915/xe3lpd: Load DMC for Xe3_LPD version 30.02
Shin'ichiro Kawasaki <[email protected]>
nvme-multipath: fix lockdep WARN due to partition scan work
Alistair Francis <[email protected]>
nvmet-auth: update sc_c in target host hash calculation
Chen Pei <[email protected]>
tools: riscv: Fixed misalignment of CSR related definitions
Jesper Dangaard Brouer <[email protected]>
veth: more robust handing of race to avoid txq getting stuck
Ilya Maximets <[email protected]>
net: openvswitch: remove never-working support for setting nsh fields
Pavel Zhigulin <[email protected]>
net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get()
Pavel Zhigulin <[email protected]>
net: dsa: hellcreek: fix missing error handling in LED registration
Prateek Agarwal <[email protected]>
drm/tegra: Add call to put_pid()
Zilin Guan <[email protected]>
mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
Jiaming Zhang <[email protected]>
net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()
Aleksander Jan Bajkowski <[email protected]>
mips: dts: econet: fix EN751221 core type
Armin Wolf <[email protected]>
platform/x86: msi-wmi-platform: Fix typo in WMI GUID
Armin Wolf <[email protected]>
platform/x86: msi-wmi-platform: Only load on MSI devices
Haotian Zhang <[email protected]>
pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
Jianbo Liu <[email protected]>
xfrm: Prevent locally generated packets from direct output in tunnel mode
Jianbo Liu <[email protected]>
xfrm: Determine inner GSO type from packet inner protocol
Jianbo Liu <[email protected]>
xfrm: Check inner packet family directly from skb_dst
Yu-Chun Lin <[email protected]>
pinctrl: realtek: Select REGMAP_MMIO for RTD driver
Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate
Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical
Jernej Skrabec <[email protected]>
clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical
Sabrina Dubroca <[email protected]>
xfrm: set err and extack on failure to create pcpu SA
Sabrina Dubroca <[email protected]>
xfrm: call xfrm_dev_state_delete when xfrm_state_migrate fails to add the state
Sabrina Dubroca <[email protected]>
xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
Sabrina Dubroca <[email protected]>
xfrm: drop SA reference in xfrm_state_update if dir doesn't match
Louis-Alexis Eyraud <[email protected]>
pinctrl: mediatek: mt8189: align register base names to dt-bindings ones
Louis-Alexis Eyraud <[email protected]>
pinctrl: mediatek: mt8196: align register base names to dt-bindings ones
Kiryl Shutsemau <[email protected]>
mm/truncate: unmap large folio on split failure
Ivan Lipski <[email protected]>
drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix pbn to kbps Conversion
Mario Limonciello (AMD) <[email protected]>
drm/amd/display: Move sleep into each retry for retrieve_link_cap()
Mario Limonciello (AMD) <[email protected]>
drm/amd/display: Increase DPCD read retries
Yifan Zha <[email protected]>
drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
Mario Limonciello <[email protected]>
drm/amd: Skip power ungate during suspend for VPE
Ville Syrjälä <[email protected]>
drm/plane: Fix create_in_format_blob() return value
Robert McClinton <[email protected]>
drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
Ma Ke <[email protected]>
drm/tegra: dc: Fix reference leak in tegra_dc_couple()
Paolo Abeni <[email protected]>
mptcp: do not fallback when OoO is present
Paolo Abeni <[email protected]>
mptcp: decouple mptcp fastclose from tcp close
Paolo Abeni <[email protected]>
mptcp: avoid unneeded subflow-level drops
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: userspace: longer timeout
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: endpoints: longer timeout
Paolo Abeni <[email protected]>
mptcp: fix premature close in case of fallback
Paolo Abeni <[email protected]>
mptcp: fix duplicate reset on fastclose
Paolo Abeni <[email protected]>
mptcp: fix ack generation for fallback msk
Eric Dumazet <[email protected]>
mptcp: fix a race in mptcp_pm_del_add_timer()
Eric Dumazet <[email protected]>
mptcp: fix race condition in mptcp_schedule_work()
Anthony Wong <[email protected]>
platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Add support for the whole "G" family
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Add support for the whole "X" family
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Add support for the whole "M" family
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order
Bibo Mao <[email protected]>
LoongArch: Fix NUMA node parsing with numa_memblks
Huacai Chen <[email protected]>
LoongArch: Don't panic if no valid cache info for PCI
Vincent Li <[email protected]>
LoongArch: BPF: Disable trampoline for kernel module function trace
Krzysztof Kozlowski <[email protected]>
dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix !EVA SOC-it PCI MMIO
Hamza Mahfooz <[email protected]>
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
Bart Van Assche <[email protected]>
scsi: sg: Do not sleep in atomic context
Saket Kumar Bhaskar <[email protected]>
sched_ext: Fix scx_enable() crash on helper kthread creation failure
Rafael J. Wysocki <[email protected]>
PM: sleep: core: Fix runtime PM enabling in device_resume_early()
Ewan D. Milne <[email protected]>
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
Ewan D. Milne <[email protected]>
nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
Nam Cao <[email protected]>
nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
Vlastimil Babka <[email protected]>
mm/mempool: fix poisoning order>0 pages with HIGHMEM
Seungjin Bae <[email protected]>
Input: pegasus-notetaker - fix potential out-of-bounds access
Dan Carpenter <[email protected]>
Input: imx_sc_key - fix memory corruption on unload
Hans de Goede <[email protected]>
Input: goodix - add support for ACPI ID GDIX1003
Tzung-Bi Shih <[email protected]>
Input: cros_ec_keyb - fix an invalid memory access
Diogo Ivo <[email protected]>
Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"
Oleksij Rempel <[email protected]>
net: dsa: microchip: lan937x: Fix RGMII delay tuning
Jens Axboe <[email protected]>
io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
Andrey Vatoropin <[email protected]>
be2net: pass wrb_params in case of OS2BMC
Yihang Li <[email protected]>
ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
Bitterblue Smith <[email protected]>
wifi: rtw89: hw_scan: Don't let the operating channel be last
Henrique Carvalho <[email protected]>
smb: client: introduce close_cached_dir_locked()
Stephen Smalley <[email protected]>
selinux: move avdcache to per-task security struct
Stephen Smalley <[email protected]>
selinux: rename task_security_struct to cred_security_struct
Maciej W. Rozycki <[email protected]>
MIPS: mm: Prevent a TLB shutdown on initial uniquification
Niklas Cassel <[email protected]>
ata: libata-scsi: Fix system suspend for a security locked drive
Tony Luck <[email protected]>
ACPI: APEI: EINJ: Fix EINJV2 initialization and injection
Pasha Tatashin <[email protected]>
lib/test_kho: check if KHO is enabled
Jiayuan Chen <[email protected]>
mptcp: Fix proto fallback detection with BPF
Heiko Carstens <[email protected]>
s390/mm: Fix __ptep_rdp() inline assembly
Jiayuan Chen <[email protected]>
mptcp: Disallow MPTCP subflows from sockmap
Yongpeng Yang <[email protected]>
exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
Mike Yuan <[email protected]>
shmem: fix tmpfs reconfiguration (remount) when noswap is set
Yongpeng Yang <[email protected]>
isofs: check the return value of sb_min_blocksize() in isofs_fill_super
Yongpeng Yang <[email protected]>
xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super
Dan Carpenter <[email protected]>
mtdchar: fix integer overflow in read/write ioctls
Zhen Ni <[email protected]>
fs: Fix uninitialized 'offp' in statmount_string()
Niravkumar L Rabara <[email protected]>
mtd: rawnand: cadence: fix DMA device NULL pointer dereference
Yongpeng Yang <[email protected]>
vfat: fix missing sb_min_blocksize() return value checks
Yosry Ahmed <[email protected]>
KVM: SVM: Fix redundant updates of LBR MSR intercepts
Quentin Schulz <[email protected]>
arm64: dts: rockchip: disable HS400 on RK3588 Tiger
Quentin Schulz <[email protected]>
arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1
Laurentiu Mihalcea <[email protected]>
reset: imx8mp-audiomix: Fix bad mask values
Mykola Kvach <[email protected]>
arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
Diederik de Haas <[email protected]>
arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2
Zhang Heng <[email protected]>
HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
Mario Limonciello (AMD) <[email protected]>
HID: amd_sfh: Stop sensor before starting
Alexey Charkov <[email protected]>
arm64: dts: rockchip: Remove non-functioning CPU OPPs from RK3576
Yipeng Zou <[email protected]>
timers: Fix NULL function pointer race in timer_shutdown_sync()
Sebastian Ene <[email protected]>
KVM: arm64: Check the untrusted offset in FF-A memory share
-------------
Diffstat:
.../bindings/pinctrl/toshiba,visconti-pinctrl.yaml | 26 +++-- Documentation/wmi/driver-development-guide.rst | 1 + Makefile | 4 +- arch/arm64/boot/dts/rockchip/rk3399-op1.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3566-pinetab2.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3576.dtsi | 12 -- arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi | 4 +- .../arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts | 4 +- arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +- arch/loongarch/include/uapi/asm/ptrace.h | 40 +++---- arch/loongarch/kernel/numa.c | 60 +++------- arch/loongarch/net/bpf_jit.c | 3 + arch/loongarch/pci/pci.c | 8 +- arch/mips/boot/dts/econet/en751221.dtsi | 2 +- arch/mips/kernel/process.c | 2 +- arch/mips/mm/tlb-r4k.c | 102 ++++++++++------- arch/mips/mti-malta/malta-init.c | 20 ++-- arch/s390/include/asm/pgtable.h | 12 +- arch/s390/mm/pgtable.c | 4 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 20 +++- arch/x86/kvm/svm/svm.c | 9 +- arch/x86/kvm/svm/svm.h | 1 + block/blk-crypto.c | 2 +- drivers/acpi/apei/einj-core.c | 64 +++++++---- drivers/ata/libata-scsi.c | 11 +- drivers/base/power/main.c | 25 +++-- drivers/bcma/main.c | 6 + drivers/clk/sunxi-ng/ccu-sun55i-a523-r.c | 4 +- drivers/clk/sunxi-ng/ccu-sun55i-a523.c | 2 +- drivers/gpio/gpiolib-cdev.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 65 +++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.h | 10 ++ drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 4 +- drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 58 +--------- drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.h | 6 - drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 4 +- drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 2 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 59 ++++------ .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 4 +- .../gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 26 ++++- .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 8 ++ .../display/dc/link/protocols/link_dp_capability.c | 11 +- drivers/gpu/drm/drm_plane.c | 4 +- drivers/gpu/drm/i915/display/intel_cx0_phy.c | 14 +-- .../gpu/drm/i915/display/intel_display_device.c | 13 +++ .../gpu/drm/i915/display/intel_display_device.h | 4 +- drivers/gpu/drm/i915/display/intel_dmc.c | 10 +- drivers/gpu/drm/i915/display/intel_dp.c | 30 ++--- drivers/gpu/drm/i915/display/intel_psr.c | 36 ++++-- drivers/gpu/drm/i915/display/intel_quirks.c | 9 ++ drivers/gpu/drm/i915/display/intel_quirks.h | 1 + drivers/gpu/drm/msm/msm_iommu.c | 5 + drivers/gpu/drm/nouveau/nvkm/falcon/fw.c | 2 + drivers/gpu/drm/radeon/radeon_fence.c | 7 -- drivers/gpu/drm/tegra/dc.c | 1 + drivers/gpu/drm/tegra/dsi.c | 9 -- drivers/gpu/drm/tegra/uapi.c | 7 +- drivers/gpu/drm/xe/tests/xe_mocs.c | 2 +- drivers/gpu/drm/xe/xe_irq.c | 18 +-- drivers/gpu/drm/xe/xe_pci.c | 1 + drivers/gpu/drm/xe/xe_vm.c | 4 +- drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 2 + drivers/hid/hid-ids.h | 4 +- drivers/hid/hid-quirks.c | 13 ++- drivers/input/keyboard/cros_ec_keyb.c | 6 + drivers/input/keyboard/imx_sc_key.c | 2 +- drivers/input/tablet/pegasus_notetaker.c | 9 ++ drivers/input/touchscreen/goodix.c | 1 + drivers/mtd/mtdchar.c | 6 +- drivers/mtd/nand/raw/cadence-nand-controller.c | 3 +- drivers/net/dsa/hirschmann/hellcreek_ptp.c | 14 ++- drivers/net/dsa/microchip/lan937x_main.c | 1 + drivers/net/ethernet/airoha/airoha_eth.h | 11 ++ drivers/net/ethernet/airoha/airoha_ppe.c | 95 +++++++++++----- drivers/net/ethernet/emulex/benet/be_main.c | 7 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 22 +++- drivers/net/ethernet/intel/idpf/idpf_main.c | 2 + .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 6 +- .../net/ethernet/mellanox/mlxsw/core_linecards.c | 2 + .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +- drivers/net/ethernet/ti/netcp_core.c | 10 +- drivers/net/phy/phylink.c | 3 + drivers/net/veth.c | 38 ++++--- drivers/net/wireless/realtek/rtw89/fw.c | 7 ++ drivers/nvme/host/fc.c | 15 +-- drivers/nvme/host/multipath.c | 2 +- drivers/nvme/target/auth.c | 4 +- drivers/nvme/target/fabrics-cmd-auth.c | 1 + drivers/nvme/target/nvmet.h | 1 + drivers/perf/riscv_pmu_sbi.c | 2 +- drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 21 +++- drivers/pinctrl/mediatek/pinctrl-mt8189.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mt8196.c | 6 +- drivers/pinctrl/nxp/pinctrl-s32cc.c | 3 +- drivers/pinctrl/realtek/Kconfig | 1 + drivers/platform/x86/Kconfig | 1 + drivers/platform/x86/dell/alienware-wmi-wmax.c | 104 +++++------------- .../x86/intel/speed_select_if/isst_if_mmio.c | 4 +- .../uncore-frequency/uncore-frequency-common.h | 9 +- drivers/platform/x86/msi-wmi-platform.c | 43 +++++++- drivers/reset/reset-imx8mp-audiomix.c | 4 +- drivers/s390/net/ctcm_mpc.c | 1 - drivers/scsi/hosts.c | 5 +- drivers/scsi/sg.c | 10 +- drivers/soc/ti/knav_dma.c | 14 +-- drivers/target/loopback/tcm_loop.c | 3 + drivers/tty/vt/vt_ioctl.c | 4 +- drivers/ufs/host/ufs-qcom.c | 15 ++- fs/btrfs/inode.c | 1 - fs/btrfs/tree-log.c | 3 + fs/exfat/super.c | 5 +- fs/fat/inode.c | 6 +- fs/isofs/inode.c | 5 + fs/namespace.c | 4 +- fs/smb/client/cached_dir.c | 43 +++++++- fs/smb/client/cifsfs.c | 2 +- fs/smb/client/cifsproto.h | 2 + fs/smb/client/connect.c | 38 +++---- fs/smb/client/dfs_cache.c | 55 ++++++++-- fs/smb/client/fs_context.c | 4 + fs/xfs/scrub/symlink_repair.c | 4 +- fs/xfs/xfs_super.c | 5 +- include/drm/intel/pciids.h | 5 +- include/linux/ata.h | 1 + include/net/tls.h | 25 +++-- include/net/xfrm.h | 3 +- io_uring/cmd_net.c | 2 +- kernel/events/core.c | 2 +- kernel/sched/ext.c | 121 +++++++++++++++++++-- kernel/sched/sched.h | 1 + kernel/time/tick-sched.c | 11 +- kernel/time/timekeeping.c | 21 ++-- kernel/time/timer.c | 7 +- lib/test_kho.c | 3 + mm/mempool.c | 32 +++++- mm/shmem.c | 15 ++- mm/truncate.c | 35 +++++- net/core/dev_ioctl.c | 3 + net/devlink/rate.c | 4 +- net/ipv4/esp4_offload.c | 6 +- net/ipv6/esp6_offload.c | 6 +- net/mptcp/options.c | 54 ++++++++- net/mptcp/pm.c | 20 ++-- net/mptcp/pm_kernel.c | 2 +- net/mptcp/protocol.c | 84 +++++++++----- net/mptcp/protocol.h | 3 +- net/mptcp/subflow.c | 8 ++ net/openvswitch/actions.c | 68 +----------- net/openvswitch/flow_netlink.c | 64 ++--------- net/openvswitch/flow_netlink.h | 2 - net/tls/tls_device.c | 4 +- net/unix/af_unix.c | 3 +- net/vmw_vsock/af_vsock.c | 40 +++++-- net/xfrm/xfrm_device.c | 2 +- net/xfrm/xfrm_output.c | 8 +- net/xfrm/xfrm_state.c | 16 ++- net/xfrm/xfrm_user.c | 5 +- scripts/kconfig/mconf.c | 3 + scripts/kconfig/nconf.c | 3 + security/selinux/hooks.c | 79 +++++++------- security/selinux/include/objsec.h | 20 +++- sound/hda/codecs/realtek/alc269.c | 2 + sound/soc/codecs/rt721-sdca.c | 4 + sound/soc/codecs/rt721-sdca.h | 1 + sound/usb/mixer.c | 2 +- tools/arch/riscv/include/asm/csr.h | 5 +- tools/testing/selftests/cachestat/test_cachestat.c | 4 +- tools/testing/selftests/net/bareudp.sh | 2 +- .../selftests/net/forwarding/lib_sh_test.sh | 7 ++ tools/testing/selftests/net/lib.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 +-- tools/tracing/latency/latency-collector.c | 2 +- 184 files changed, 1552 insertions(+), 952 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/175 KVM: arm64: Check the untrusted offset in FF-A memory share
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ene <[email protected]>
commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream.
Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel.
--- arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/arm64/kvm/hyp/nvhe/ffa.c +7 -2
@@ -437,7 +437,7 @@ static void __do_ffa_mem_xfer(const u64struct ffa_mem_region_attributes *ep_mem_access;struct ffa_composite_mem_region *reg;struct ffa_mem_region *buf; -u32 offset, nr_ranges; +u32 offset, nr_ranges, checked_offset;int ret =0 ; if (addr_mbz || npages_mbz || fraglen > len ||
@@ -474,7 +474,12 @@ static void __do_ffa_mem_xfer(const u64 goto out_unlock; } -if (fraglen < offset +sizeof (struct ffa_composite_mem_region )) { +if (check_add_overflow (offset,sizeof (struct ffa_composite_mem_region ), &checked_offset)) { + ret =FFA_RET_INVALID_PARAMETERS ; + goto out_unlock; + } + +if (fraglen < checked_offset) { ret =FFA_RET_INVALID_PARAMETERS ; goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 2/175 timers: Fix NULL function pointer race in timer_shutdown_sync()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yipeng Zou <[email protected]>
commit 20739af07383e6eb1ec59dcd70b72ebfa9ac362c upstream.
There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers().
The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this:
CPU0 CPU1
<SOFTIRQ> lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ...
timer_shutdown_sync()lock_timer_base()
// For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger <SOFTIRQ> expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL;
unlock_timer_base()
The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers().
Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running.
--- kernel/time/timer.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/time/timer.c +4 -3
@@ -1458,10 +1458,11 @@ static int __try_to_del_timer_sync(struc base =lock_timer_base (timer, &flags); -if (base->running_timer != timer) +if (base->running_timer != timer) { ret =detach_if_pending (timer, base, true); -if (shutdown) - timer->function =NULL ; +if (shutdown) + timer->function =NULL ; + }raw_spin_unlock_irqrestore (&base->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 3/175 arm64: dts: rockchip: Remove non-functioning CPU OPPs from RK3576
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <[email protected]>
commit 05b80cd1f37db042e074ecc7ee0d39869fed2f52 upstream.
Drop the top-frequency OPPs from both the LITTLE and big CPU clusters on RK3576, as neither the opensource TF-A [1] nor the recent (after v1.08) binary BL31 images provided by Rockchip expose those.
This fixes the problem [2] when the cpufreq governor tries to jump directly to the highest-frequency OPP, which results in a failed SCMI call leaving the system stuck at the previous OPP before the attempted change.
[1] https://github.com/ARM-software/arm-trusted-firmware/blob/master/plat/rockchip/rk3576/scmi/rk3576_clk.c#L264-L304
[2] https://lore.kernel.org/linux-rockchip/CABjd4Yz4NbqzZH4Qsed3ias56gcga9K6CmYA+BLDBxtbG915Ag@mail.gmail.com/
--- arch/arm64/boot/dts/rockchip/rk3576.dtsi | 12 ------------ 1 file changed, 12 deletions(-)
arch/arm64/boot/dts/rockchip/rk3576.dtsi +0 -12
@@ -269,12 +269,6 @@ opp-microvolt = <900000 900000 950000>; clock-latency-ns = <40000>; }; - - opp-2208000000 { - opp-hz = /bits/ 64 <2208000000>; - opp-microvolt = <950000 950000 950000>; - clock-latency-ns = <40000>; - }; }; cluster1_opp_table: opp-table-cluster1 {
@@ -341,12 +335,6 @@ opp-microvolt = <925000 925000 950000>; clock-latency-ns = <40000>; }; - - opp-2304000000 { - opp-hz = /bits/ 64 <2304000000>; - opp-microvolt = <950000 950000 950000>; - clock-latency-ns = <40000>; - }; }; gpu_opp_table: opp-table-gpu {
Greg Kroah-Hartman
maintainerPATCH 4/175 HID: amd_sfh: Stop sensor before starting
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 4d3a13afa8b64dc49293b3eab3e7beac11072c12 upstream.
Titas reports that the accelerometer sensor on their laptop only works after a warm boot or unloading/reloading the amd-sfh kernel module.
Presumably the sensor is in a bad state on cold boot and failing to start, so explicitly stop it before starting.
--- drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c +2 -0
@@ -194,6 +194,8 @@ static int amd_sfh1_1_hid_client_init(stif (rc) goto cleanup; + mp2_ops->stop (privdata, cl_data->sensor_idx[i]); +amd_sfh_wait_for_response (privdata, cl_data->sensor_idx[i],DISABLE_SENSOR );writel (0 , privdata->mmio +amd_get_p2c_val (privdata,0 )); mp2_ops->start (privdata, info); status = amd_sfh_wait_for_response
Greg Kroah-Hartman
maintainerPATCH 5/175 HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
commit beab067dbcff642243291fd528355d64c41dc3b2 upstream.
Based on available evidence, the USB ID 4c4a:4155 used by multiple devices has been attributed to Jieli. The commit 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") affected touchscreen functionality. Added checks for manufacturer and serial number to maintain microphone compatibility, enabling both devices to function properly.
--- drivers/hid/hid-ids.h | 4 ++-- drivers/hid/hid-quirks.c | 13 ++++++++++++- 2 files changed, 14 insertions(+), 3 deletions(-)
drivers/hid/hid-ids.h +2 -2
@@ -1543,7 +1543,7 @@#define USB_VENDOR_ID_SIGNOTEC 0x2133#define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 -#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a -#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155 +#define USB_VENDOR_ID_JIELI_SDK_DEFAULT 0x4c4a +#define USB_DEVICE_ID_JIELI_SDK_4155 0x4155#endif
drivers/hid/hid-quirks.c +12 -1
@@ -915,7 +915,6 @@ static const struct hid_device_id hid_ig#endif { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, - { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) }, { } };
@@ -1064,6 +1063,18 @@ bool hid_ignore(struct hid_device *hdev) strlen(elan_acpi_id[i].id)))return true;break ; +case USB_VENDOR_ID_JIELI_SDK_DEFAULT : +/* +* Multiple USB devices with identical IDs (mic & touchscreen). +* The touch screen requires hid core processing, but the +* microphone does not. They can be distinguished by manufacturer +* and serial number. +*/ +if (hdev->product ==USB_DEVICE_ID_JIELI_SDK_4155 && +strncmp (hdev->name,"SmartlinkTechnology" ,19 ) ==0 && +strncmp (hdev->uniq,"20201111000001" ,14 ) ==0 ) +return true; +break ; } if (hdev->type == HID_TYPE_USBMOUSE &&
Greg Kroah-Hartman
maintainerPATCH 6/175 arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diederik de Haas <[email protected]>
commit 03c7e964a02e388ee168c804add7404eda23908c upstream.
Page 13 of the PineTab2 v2 schematic dd 20230417 shows VCCIO4's power source is VCCIO_WL. Page 19 shows that VCCIO_WL is connected to VCCA1V8_PMU, so fix the PineTab2 dtsi to reflect that.
--- arch/arm64/boot/dts/rockchip/rk3566-pinetab2.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3566-pinetab2.dtsi +1 -1
@@ -789,7 +789,7 @@ vccio1-supply = <&vccio_acodec>; vccio2-supply = <&vcc_1v8>; vccio3-supply = <&vccio_sd>; - vccio4-supply = <&vcc_1v8>; + vccio4-supply = <&vcca1v8_pmu>; vccio5-supply = <&vcc_1v8>; vccio6-supply = <&vcc1v8_dvp>; vccio7-supply = <&vcc_3v3>;
Greg Kroah-Hartman
maintainerPATCH 7/175 arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mykola Kvach <[email protected]>
commit b5414520793e68d266fdd97a84989d9831156aad upstream.
The vcc3v3_pcie20 fixed regulator powers the PCIe device-side 3.3V rail for pcie2x1l2 via vpcie3v3-supply. The DTS mistakenly set its regulator-min/max-microvolt to 1800000 (1.8 V). Correct both to 3300000 (3.3 V) to match the rail name, the PCIe/M.2 power requirement, and the actual hardware wiring on Orange Pi 5.
--- arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts +2 -2
@@ -14,8 +14,8 @@ gpios = <&gpio0 RK_PC5 GPIO_ACTIVE_HIGH>; regulator-name = "vcc3v3_pcie20"; regulator-boot-on; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; startup-delay-us = <50000>; vin-supply = <&vcc5v0_sys>; };
Greg Kroah-Hartman
maintainerPATCH 8/175 reset: imx8mp-audiomix: Fix bad mask values
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurentiu Mihalcea <[email protected]>
commit 997c06330fd5c2e220b692f2a358986c6c8fd5a2 upstream.
As per the i.MX8MP TRM, section 14.2 "AUDIO_BLK_CTRL", table 14.2.3.1.1 "memory map", the definition of the EARC control register shows that the EARC controller software reset is controlled via bit 0, while the EARC PHY software reset is controlled via bit 1.
This means that the current definitions of IMX8MP_AUDIOMIX_EARC_RESET_MASK and IMX8MP_AUDIOMIX_EARC_PHY_RESET_MASK are wrong since their values would imply that the EARC controller software reset is controlled via bit 1 and the EARC PHY software reset is controlled via bit 2. Fix them.
--- drivers/reset/reset-imx8mp-audiomix.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/reset/reset-imx8mp-audiomix.c +2 -2
@@ -14,8 +14,8 @@#include <linux/reset-controller.h> #define IMX8MP_AUDIOMIX_EARC_RESET_OFFSET 0x200 -#define IMX8MP_AUDIOMIX_EARC_RESET_MASK BIT(1) -#define IMX8MP_AUDIOMIX_EARC_PHY_RESET_MASK BIT(2) +#define IMX8MP_AUDIOMIX_EARC_RESET_MASK BIT(0) +#define IMX8MP_AUDIOMIX_EARC_PHY_RESET_MASK BIT(1)#define IMX8MP_AUDIOMIX_DSP_RUNSTALL_OFFSET 0x108#define IMX8MP_AUDIOMIX_DSP_RUNSTALL_MASK BIT(5)
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 9/175 arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
commit 08d70143e3033d267507deb98a5fd187df3e6640 upstream.
In commit 296602b8e5f7 ("arm64: dts: rockchip: Move RK3399 OPPs to dtsi files for SoC variants"), everything shared between variants of RK3399 was put into rk3399-base.dtsi and the rest in variant-specific DTSI, such as rk3399-t, rk3399-op1, rk3399, etc.
Therefore, the variant-specific DTSI should include rk3399-base.dtsi and not another variant's DTSI.
rk3399-op1 wrongly includes rk3399 (a variant) DTSI instead of rk3399-base DTSI, let's fix this oversight by including the intended DTSI.
Fortunately, this had no impact on the resulting DTB since all nodes were named the same and all node properties were overridden in rk3399-op1.dtsi. This was checked by doing a checksum of rk3399-op1 DTBs before and after this commit.
No intended change in behavior.
--- arch/arm64/boot/dts/rockchip/rk3399-op1.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-op1.dtsi +1 -1
@@ -3,7 +3,7 @@ * Copyright (c) 2016-2017 Fuzhou Rockchip Electronics Co., Ltd */ -#include "rk3399.dtsi" +#include "rk3399-base.dtsi" / { cluster0_opp: opp-table-0 {
Greg Kroah-Hartman
maintainerPATCH 10/175 arm64: dts: rockchip: disable HS400 on RK3588 Tiger
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
commit baa18d577cd445145039e731d3de0fa49ca57204 upstream.
We've had reports from the field that some RK3588 Tiger have random issues with eMMC errors.
Applying commit a28352cf2d2f ("mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4") didn't help and seemed to have made things worse for our board.
Our HW department checked the eMMC lines and reported that they are too long and don't look great so signal integrity is probably not the best.
Note that not all Tigers with the same eMMC chip have errors, so the suspicion is that we're really on the edge in terms of signal integrity and only a handful devices are failing. Additionally, we have RK3588 Jaguars with the same eMMC chip but the layout is different and we also haven't received reports about those so far.
Lowering the max-frequency to 150MHz from 200MHz instead of simply disabling HS400 was briefly tested and seem to work as well. We've disabled HS400 downstream and haven't received reports since so we'll go with that instead of lowering the max-frequency.
--- arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi +1 -3
@@ -382,14 +382,12 @@ cap-mmc-highspeed; mmc-ddr-1_8v; mmc-hs200-1_8v; - mmc-hs400-1_8v; - mmc-hs400-enhanced-strobe; mmc-pwrseq = <&emmc_pwrseq>; no-sdio; no-sd; non-removable; pinctrl-names = "default"; - pinctrl-0 = <&emmc_bus8 &emmc_cmd &emmc_clk &emmc_data_strobe>; + pinctrl-0 = <&emmc_bus8 &emmc_cmd &emmc_clk>; vmmc-supply = <&vcc_3v3_s3>; vqmmc-supply = <&vcc_1v8_s3>; status = "okay";
Greg Kroah-Hartman
maintainerPATCH 11/175 KVM: SVM: Fix redundant updates of LBR MSR intercepts
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <[email protected]>
commit 3fa05f96fc08dff5e846c2cc283a249c1bf029a1 upstream.
Don't update the LBR MSR intercept bitmaps if they're already up-to-date, as unconditionally updating the intercepts forces KVM to recalculate the MSR bitmaps for vmcb02 on every nested VMRUN. The redundant updates are functionally okay; however, they neuter an optimization in Hyper-V nested virtualization enlightenments and this manifests as a self-test failure.
In particular, Hyper-V lets L1 mark "nested enlightenments" as clean, i.e. tell KVM that no changes were made to the MSR bitmap since the last VMRUN. The hyperv_svm_test KVM selftest intentionally changes the MSR bitmap "without telling KVM about it" to verify that KVM honors the clean hint, correctly fails because KVM notices the changed bitmap anyway:
==== Test Assertion Failure ==== x86/hyperv_svm_test.c:120: vmcb->control.exit_code == 0x081 pid=193558 tid=193558 errno=4 - Interrupted system call
1 0x0000000000411361: assert_on_unhandled_exception at processor.c:659
2 0x0000000000406186: _vcpu_run at kvm_util.c:1699
3 (inlined by) vcpu_run at kvm_util.c:1710
4 0x0000000000401f2a: main at hyperv_svm_test.c:175
5 0x000000000041d0d3: __libc_start_call_main at libc-start.o:?
6 0x000000000041f27c: __libc_start_main_impl at ??:?
7 0x00000000004021a0: _start at ??:? vmcb->control.exit_code == SVM_EXIT_VMMCALL
Do *not* fix this by skipping svm_hv_vmcb_dirty_nested_enlightenments() when svm_set_intercept_for_msr() performs a no-op change. changes to the L0 MSR interception bitmap are only triggered by full CPUID updates and MSR filter updates, both of which should be rare. Changing svm_set_intercept_for_msr() risks hiding unintended pessimizations like this one, and is actually more complex than this change.
--- arch/x86/kvm/svm/svm.c | 9 ++++++++- arch/x86/kvm/svm/svm.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/svm.c +8 -1
@@ -713,7 +713,11 @@ void *svm_alloc_permissions_map(unsignedstatic void svm_recalc_lbr_msr_intercepts (struct kvm_vcpu *vcpu) { -bool intercept = !(to_svm (vcpu)->vmcb->control.virt_ext &LBR_CTL_ENABLE_MASK ); +struct vcpu_svm *svm =to_svm (vcpu); +bool intercept = !(svm->vmcb->control.virt_ext &LBR_CTL_ENABLE_MASK ); + +if (intercept == svm->lbr_msrs_intercepted) +return ;svm_set_intercept_for_msr (vcpu,MSR_IA32_LASTBRANCHFROMIP ,MSR_TYPE_RW , intercept);svm_set_intercept_for_msr (vcpu,MSR_IA32_LASTBRANCHTOIP ,MSR_TYPE_RW , intercept);
@@ -722,6 +726,8 @@ static void svm_recalc_lbr_msr_interceptif (sev_es_guest (vcpu->kvm))svm_set_intercept_for_msr (vcpu,MSR_IA32_DEBUGCTLMSR ,MSR_TYPE_RW , intercept); + + svm->lbr_msrs_intercepted = intercept; }void svm_set_x2apic_msr_interception (struct vcpu_svm *svm,bool intercept)
@@ -1278,6 +1284,7 @@ static int svm_vcpu_create(struct kvm_vc } svm->x2avic_msrs_intercepted = true; + svm->lbr_msrs_intercepted = true; svm->vmcb01.ptr =page_address (vmcb01_page); svm->vmcb01.pa =__sme_set (page_to_pfn (vmcb01_page) <<PAGE_SHIFT );
arch/x86/kvm/svm/svm.h +1 -0
@@ -334,6 +334,7 @@ struct vcpu_svm {bool guest_state_loaded;bool x2avic_msrs_intercepted; +bool lbr_msrs_intercepted;/* Guest GIF value, used when vGIF is not enabled */ bool guest_gif;
Greg Kroah-Hartman
maintainerPATCH 12/175 vfat: fix missing sb_min_blocksize() return value checks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
commit 63b5aa01da0f38cdbd97d021477258e511631497 upstream.
When emulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, but without format, a kernel panic was triggered during the early boot stage while attempting to mount a vfat filesystem.
[95553.682035] EXT4-fs (nvme0n1): unable to set blocksize [95553.684326] EXT4-fs (nvme0n1): unable to set blocksize [95553.686501] EXT4-fs (nvme0n1): unable to set blocksize [95553.696448] ISOFS: unsupported/invalid hardware sector size 8192 [95553.697117] ------------[ cut here ]------------ [95553.697567] kernel BUG at fs/buffer.c:1582! [95553.697984] Oops: invalid opcode: 0000 [#1] SMP NOPTI [95553.698602] CPU: 0 UID: 0 PID: 7212 Comm: mount Kdump: loaded Not tainted 6.18.0-rc2+ #38 PREEMPT(voluntary) [95553.699511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [95553.700534] RIP: 0010:folio_alloc_buffers+0x1bb/0x1c0 [95553.701018] Code: 48 8b 15 e8 93 18 02 65 48 89 35 e0 93 18 02 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 90 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f [95553.702648] RSP: 0018:ffffd1b0c676f990 EFLAGS: 00010246 [95553.703132] RAX: ffff8cfc4176d820 RBX: 0000000000508c48 RCX: 0000000000000001 [95553.703805] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 0000000000000000 [95553.704481] RBP: ffffd1b0c676f9c8 R08: 0000000000000000 R09: 0000000000000000 [95553.705148] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [95553.705816] R13: 0000000000002000 R14: fffff8bc8257e800 R15: 0000000000000000 [95553.706483] FS: 000072ee77315840(0000) GS:ffff8cfdd2c8d000(0000) knlGS:0000000000000000 [95553.707248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [95553.707782] CR2: 00007d8f2a9e5a20 CR3: 0000000039d0c006 CR4: 0000000000772ef0 [95553.708439] PKRU: 55555554 [95553.708734] Call Trace: [95553.709015] <TASK> [95553.709266] __getblk_slow+0xd2/0x230 [95553.709641] ? find_get_block_common+0x8b/0x530 [95553.710084] bdev_getblk+0x77/0xa0 [95553.710449] __bread_gfp+0x22/0x140 [95553.710810] fat_fill_super+0x23a/0xfc0 [95553.711216] ? __pfx_setup+0x10/0x10 [95553.711580] ? __pfx_vfat_fill_super+0x10/0x10 [95553.712014] vfat_fill_super+0x15/0x30 [95553.712401] get_tree_bdev_flags+0x141/0x1e0 [95553.712817] get_tree_bdev+0x10/0x20 [95553.713177] vfat_get_tree+0x15/0x20 [95553.713550] vfs_get_tree+0x2a/0x100 [95553.713910] vfs_cmd_create+0x62/0xf0 [95553.714273] __do_sys_fsconfig+0x4e7/0x660 [95553.714669] __x64_sys_fsconfig+0x20/0x40 [95553.715062] x64_sys_call+0x21ee/0x26a0 [95553.715453] do_syscall_64+0x80/0x670 [95553.715816] ? __fs_parse+0x65/0x1e0 [95553.716172] ? fat_parse_param+0x103/0x4b0 [95553.716587] ? vfs_parse_fs_param_source+0x21/0xa0 [95553.717034] ? __do_sys_fsconfig+0x3d9/0x660 [95553.717548] ? __x64_sys_fsconfig+0x20/0x40 [95553.717957] ? x64_sys_call+0x21ee/0x26a0 [95553.718360] ? do_syscall_64+0xb8/0x670 [95553.718734] ? __x64_sys_fsconfig+0x20/0x40 [95553.719141] ? x64_sys_call+0x21ee/0x26a0 [95553.719545] ? do_syscall_64+0xb8/0x670 [95553.719922] ? x64_sys_call+0x1405/0x26a0 [95553.720317] ? do_syscall_64+0xb8/0x670 [95553.720702] ? __x64_sys_close+0x3e/0x90 [95553.721080] ? x64_sys_call+0x1b5e/0x26a0 [95553.721478] ? do_syscall_64+0xb8/0x670 [95553.721841] ? irqentry_exit+0x43/0x50 [95553.722211] ? exc_page_fault+0x90/0x1b0 [95553.722681] entry_SYSCALL_64_after_hwframe+0x76/0x7e [95553.723166] RIP: 0033:0x72ee774f3afe [95553.723562] Code: 73 01 c3 48 8b 0d 0a 33 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 af 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d da 32 0f 00 f7 d8 64 89 01 48 [95553.725188] RSP: 002b:00007ffe97148978 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [95553.725892] RAX: ffffffffffffffda RBX: 00005dcfe53d0080 RCX: 000072ee774f3afe [95553.726526] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [95553.727176] RBP: 00007ffe97148ac0 R08: 0000000000000000 R09: 000072ee775e7ac0 [95553.727818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [95553.728459] R13: 00005dcfe53d04b0 R14: 000072ee77670b00 R15: 00005dcfe53d1a28 [95553.729086] </TASK>
The panic occurs as follows:
1. logical_block_size is 8KiB, causing {struct super_block *sb}->s_blocksize is initialized to 0.vfat_fill_super
- fat_fill_super
- sb_min_blocksize
- sb_set_blocksize //return 0 when size is 8KiB.
2. __bread_gfp is called with size == 0, causing folio_alloc_buffers() to compute an offset equal to folio_size(folio), which triggers a BUG_ON. fat_fill_super
- sb_bread
- __bread_gfp // size == {struct super_block *sb}->s_blocksize == 0
- bdev_getblk
- __getblk_slow
- grow_buffers
- grow_dev_folio
- folio_alloc_buffers // size == 0
- folio_set_bh //offset == folio_size(folio) and panic
To fix this issue, add proper return value checks for sb_min_blocksize().
--- fs/fat/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/fat/inode.c +5 -1
@@ -1595,8 +1595,12 @@ int fat_fill_super(struct super_block *sb, struct fs_context *fc,setup (sb);/* flavour-specific stuff that needs options */ + error = -EINVAL ; +if (!sb_min_blocksize (sb,512 )) { +fat_msg (sb,KERN_ERR ,"unable to set blocksize" ); + goto out_fail; + } error = -EIO ; -sb_min_blocksize (sb,512 ); bh =sb_bread (sb,0 );if (bh ==NULL ) {fat_msg (sb,KERN_ERR ,"unable to read boot sector" );
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 13/175 mtd: rawnand: cadence: fix DMA device NULL pointer dereference
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
commit 5c56bf214af85ca042bf97f8584aab2151035840 upstream.
The DMA device pointer dma_dev was being dereferenced before ensuring that cdns_ctrl->dmac is properly initialized.
Move the assignment of dma_dev after successfully acquiring the DMA channel to ensure the pointer is valid before use.
--- drivers/mtd/nand/raw/cadence-nand-controller.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/cadence-nand-controller.c +2 -1
@@ -2871,7 +2871,7 @@ cadence_nand_irq_cleanup(int irqnum, strstatic int cadence_nand_init (struct cdns_nand_ctrl *cdns_ctrl) {dma_cap_mask_t mask; -struct dma_device *dma_dev = cdns_ctrl->dmac->device; +struct dma_device *dma_dev;int ret; cdns_ctrl->cdma_desc = dma_alloc_coherent(cdns_ctrl->dev,
@@ -2915,6 +2915,7 @@ static int cadence_nand_init(struct cdns } } + dma_dev = cdns_ctrl->dmac->device; cdns_ctrl->io.iova_dma =dma_map_resource (dma_dev->dev, cdns_ctrl->io.dma, cdns_ctrl->io.size,DMA_BIDIRECTIONAL ,0 );
Greg Kroah-Hartman
maintainerPATCH 14/175 fs: Fix uninitialized offp in statmount_string()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit 0778ac7df5137d5041783fadfc201f8fd55a1d9b upstream.
In statmount_string(), most flags assign an output offset pointer (offp) which is later updated with the string offset. However, the STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the struct fields instead of using offp. This leaves offp uninitialized, leading to a possible uninitialized dereference when *offp is updated.
Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the code path consistent.
--- fs/namespace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/namespace.c +2 -2
@@ -5601,11 +5601,11 @@ static int statmount_string(struct kstat ret =statmount_sb_source (s, seq);break ;case STATMOUNT_MNT_UIDMAP : - sm->mnt_uidmap = start; + offp = &sm->mnt_uidmap; ret =statmount_mnt_uidmap (s, seq);break ;case STATMOUNT_MNT_GIDMAP : - sm->mnt_gidmap = start; + offp = &sm->mnt_gidmap; ret =statmount_mnt_gidmap (s, seq);break ;default :
Greg Kroah-Hartman
maintainerPATCH 15/175 mtdchar: fix integer overflow in read/write ioctls
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit e4185bed738da755b191aa3f2e16e8b48450e1b8 upstream.
The "req.start" and "req.len" variables are u64 values that come from the user at the start of the function. We mask away the high 32 bits of "req.len" so that's capped at U32_MAX but the "req.start" variable can go up to U64_MAX which means that the addition can still integer overflow.
Use check_add_overflow() to fix this bug.
--- drivers/mtd/mtdchar.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/mtd/mtdchar.c +4 -2
@@ -599,6 +599,7 @@ mtdchar_write_ioctl(struct mtd_info *mtduint8_t *datbuf =NULL , *oobbuf =NULL ;size_t datbuf_len, oobbuf_len;int ret =0 ; +u64 end;if (copy_from_user (&req, argp,sizeof (req)))return -EFAULT ;
@@ -618,7 +619,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd req.len &=0xffffffff ; req.ooblen &=0xffffffff ; -if (req.start + req.len > mtd->size) +if (check_add_overflow (req.start, req.len, &end) || end > mtd->size)return -EINVAL ; datbuf_len =min_t (size_t, req.len, mtd->erasesize);
@@ -698,6 +699,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd,size_t datbuf_len, oobbuf_len;size_t orig_len, orig_ooblen;int ret =0 ; +u64 end;if (copy_from_user (&req, argp,sizeof (req)))return -EFAULT ;
@@ -724,7 +726,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, req.len &=0xffffffff ; req.ooblen &=0xffffffff ; -if (req.start + req.len > mtd->size) { +if (check_add_overflow (req.start, req.len, &end) || end > mtd->size) { ret = -EINVAL ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 16/175 xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
commit 124af0868ec6929ba838fb76d25f00c06ba8fc0d upstream.
sb_min_blocksize() may return 0. Check its return value to avoid the filesystem super block when sb->s_blocksize is 0.
--- fs/xfs/xfs_super.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/xfs/xfs_super.c +4 -1
@@ -1710,7 +1710,10 @@ xfs_fs_fill_super(if (error)return error; -sb_min_blocksize (sb,BBSIZE ); +if (!sb_min_blocksize (sb,BBSIZE )) { +xfs_err (mp,"unable to set blocksize" ); +return -EINVAL ; + } sb->s_xattr = xfs_xattr_handlers; sb->s_export_op = &xfs_export_operations;#ifdef CONFIG_XFS_QUOTA
Greg Kroah-Hartman
maintainerPATCH 17/175 isofs: check the return value of sb_min_blocksize() in isofs_fill_super
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
commit e106e269c5cb38315eb0a0e7e38f71e9b20c8c66 upstream.
sb_min_blocksize() may return 0. Check its return value to avoid opt->blocksize and sb->s_blocksize is 0.
--- fs/isofs/inode.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/isofs/inode.c +5 -0
@@ -610,6 +610,11 @@ static int isofs_fill_super(struct super goto out_freesbi; } opt->blocksize =sb_min_blocksize (s, opt->blocksize); +if (!opt->blocksize) { +printk (KERN_ERR +"ISOFS: unable to set blocksize\n" ); + goto out_freesbi; + } sbi->s_high_sierra =0 ;/* default is iso9660 */ sbi->s_session = opt->session;
Greg Kroah-Hartman
maintainerPATCH 18/175 shmem: fix tmpfs reconfiguration (remount) when noswap is set
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Yuan <[email protected]>
commit 3cd1548a278c7d6a9bdef1f1866e7cf66bfd3518 upstream.
In systemd we're trying to switch the internal credentials setup logic to new mount API [1], and I noticed fsconfig(FSCONFIG_CMD_RECONFIGURE) consistently fails on tmpfs with noswap option. This can be trivially reproduced with the following:
```
int fs_fd = fsopen("tmpfs", 0);
fsconfig(fs_fd, FSCONFIG_SET_FLAG, "noswap", NULL, 0);
fsconfig(fs_fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0);
fsmount(fs_fd, 0, 0);
fsconfig(fs_fd, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0); <------ EINVAL
```After some digging the culprit is shmem_reconfigure() rejecting !(ctx->seen & SHMEM_SEEN_NOSWAP) && sbinfo->noswap, which is bogus as ctx->seen serves as a mask for whether certain options are touched at all. On top of that, noswap option doesn't use fsparam_flag_no, hence it's not really possible to "reenable" swap to begin with. Drop the check and redundant SHMEM_SEEN_NOSWAP flag.
[1] https://github.com/systemd/systemd/pull/39637
--- mm/shmem.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
mm/shmem.c +7 -8
@@ -131,8 +131,7 @@ struct shmem_options {#define SHMEM_SEEN_INODES 2#define SHMEM_SEEN_HUGE 4#define SHMEM_SEEN_INUMS 8 -#define SHMEM_SEEN_NOSWAP 16 -#define SHMEM_SEEN_QUOTA 32 +#define SHMEM_SEEN_QUOTA 16 };#ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -4744,7 +4743,6 @@ static int shmem_parse_one(struct fs_con "Turning off swap in unprivileged tmpfs mounts unsupported"); } ctx->noswap = true; - ctx->seen |=SHMEM_SEEN_NOSWAP ;break ;case Opt_quota:if (fc->user_ns != &init_user_ns)
@@ -4894,14 +4892,15 @@ static int shmem_reconfigure(struct fs_c err ="Current inum too high to switch to 32-bit inums" ; goto out; } -if ((ctx->seen &SHMEM_SEEN_NOSWAP ) && ctx->noswap && !sbinfo->noswap) { + +/* +* "noswap" doesn't use fsparam_flag_no, i.e. there's no "swap" +* counterpart for (re-)enabling swap. +*/ +if (ctx->noswap && !sbinfo->noswap) { err ="Cannot disable swap on remount" ; goto out; } -if (!(ctx->seen &SHMEM_SEEN_NOSWAP ) && !ctx->noswap && sbinfo->noswap) { - err ="Cannot enable swap on remount if it was disabled on first mount" ; - goto out; - }if (ctx->seen &SHMEM_SEEN_QUOTA && !sb_any_quota_loaded (fc->root->d_sb)) {
Greg Kroah-Hartman
maintainerPATCH 19/175 exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
commit f2c1f631630e01821fe4c3fdf6077bc7a8284f82 upstream.
sb_min_blocksize() may return 0. Check its return value to avoid accessing the filesystem super block when sb->s_blocksize is 0.
--- fs/exfat/super.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/exfat/super.c +4 -1
@@ -423,7 +423,10 @@ static int exfat_read_boot_sector(structstruct exfat_sb_info *sbi =EXFAT_SB (sb);/* set block size to read super block */ -sb_min_blocksize (sb,512 ); +if (!sb_min_blocksize (sb,512 )) { +exfat_err (sb,"unable to set blocksize" ); +return -EINVAL ; + }/* read boot sector */ sbi->boot_bh =sb_bread (sb,0 );
Greg Kroah-Hartman
maintainerPATCH 20/175 mptcp: Disallow MPTCP subflows from sockmap
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
commit fbade4bd08ba52cbc74a71c4e86e736f059f99f7 upstream.
The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces.
'''tcp_rcv_state_process()
subflow_syn_recv_sock()
tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
bpf_skops_established <== sockops
bpf_sock_map_update(sk) <== call bpf helper
tcp_bpf_update_proto() <== update sk_prot'''
Consider two scenarios:
1. When the server has MPTCP enabled and the client also requests MPTCP, the sk passed to the BPF program is a subflow sk. Since subflows only handle partial data, replacing their sk_prot is meaningless and will cause traffic disruption.
2. When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. '''
subflow_ulp_fallback()
subflow_drop_ctx()
mptcp_subflow_ops_undo_override()
'''
Subsequently, accept::mptcp_stream_accept::mptcp_fallback_tcp_ops() converts the subflow to plain TCP.
For the first case, we should prevent it from being combined with sockmap by setting sk_prot->psock_update_sk_prot to NULL, which will be blocked by sockmap's own flow.
For the second case, since subflow_syn_recv_sock() has already restored sk_prot to native tcp_prot/tcpv6_prot, no further action is needed.
--- net/mptcp/subflow.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/mptcp/subflow.c +8 -0
@@ -2144,6 +2144,10 @@ void __init mptcp_subflow_init(void) tcp_prot_override = tcp_prot; tcp_prot_override.release_cb = tcp_release_cb_override; tcp_prot_override.diag_destroy = tcp_abort_override; +#ifdef CONFIG_BPF_SYSCALL +/* Disable sockmap processing for subflows */ + tcp_prot_override.psock_update_sk_prot =NULL ; +#endif #if IS_ENABLED (CONFIG_MPTCP_IPV6 )/* In struct mptcp_subflow_request_sock, we assume the TCP request sock
@@ -2180,6 +2184,10 @@ void __init mptcp_subflow_init(void) tcpv6_prot_override = tcpv6_prot; tcpv6_prot_override.release_cb = tcp_release_cb_override; tcpv6_prot_override.diag_destroy = tcp_abort_override; +#ifdef CONFIG_BPF_SYSCALL +/* Disable sockmap processing for subflows */ + tcpv6_prot_override.psock_update_sk_prot =NULL ; +#endif #endif mptcp_diag_subflow_init (&subflow_ulp_ops);
Greg Kroah-Hartman
maintainerPATCH 21/175 s390/mm: Fix __ptep_rdp() inline assembly
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 31475b88110c4725b4f9a79c3a0d9bbf97e69e1c upstream.
When a zero ASCE is passed to the __ptep_rdp() inline assembly, the generated instruction should have the R3 field of the instruction set to zero. However the inline assembly is written incorrectly: for such cases a zero is loaded into a register allocated by the compiler and this register is then used by the instruction.
This means that selected TLB entries may not be flushed since the specified ASCE does not match the one which was used when the selected TLB entries were created.
Fix this by removing the asce and opt parameters of __ptep_rdp(), since all callers always pass zero, and use a hard-coded register zero for the R3 field.
--- arch/s390/include/asm/pgtable.h | 12 +++++------- arch/s390/mm/pgtable.c | 4 ++-- 2 files changed, 7 insertions(+), 9 deletions(-)
arch/s390/include/asm/pgtable.h +5 -7
@@ -1154,17 +1154,15 @@ static inline pte_t pte_mkhuge(pte_t pte#define IPTE_NODAT 0x400#define IPTE_GUEST_ASCE 0x800 -static __always_inline void __ptep_rdp(unsigned long addr, pte_t *ptep, -unsigned long opt,unsigned long asce, -int local) +static __always_inline void __ptep_rdp(unsigned long addr, pte_t *ptep, int local) {unsigned long pto; pto =__pa (ptep) & ~(PTRS_PER_PTE *sizeof (pte_t) -1 ); - asmvolatile (".insn rrf,0xb98b0000,%[r1],%[r2],%[asce],%[m4]" + asmvolatile (".insn rrf,0xb98b0000,%[r1],%[r2],%%r0,%[m4]" :"+m" (*ptep) - : [r1]"a" (pto), [r2]"a" ((addr &PAGE_MASK ) | opt), - [asce]"a" (asce), [m4]"i" (local)); + : [r1]"a" (pto), [r2]"a" (addr &PAGE_MASK ), + [m4]"i" (local)); } static __always_inline void __ptep_ipte(unsigned long address, pte_t *ptep,
@@ -1348,7 +1346,7 @@ static inline void flush_tlb_fix_spuriou* A local RDP can be used to do the flush. */ if (cpu_has_rdp () && !(pte_val (*ptep) & _PAGE_PROTECT)) -__ptep_rdp (address, ptep,0 ,0 ,1 ); +__ptep_rdp (address, ptep,1 ); }#define flush_tlb_fix_spurious_fault flush_tlb_fix_spurious_fault
arch/s390/mm/pgtable.c +2 -2
@@ -274,9 +274,9 @@ void ptep_reset_dat_prot(struct mm_strucpreempt_disable ();atomic_inc (&mm->context.flush_count);if (cpumask_equal (mm_cpumask (mm),cpumask_of (smp_processor_id ()))) -__ptep_rdp (addr, ptep,0 ,0 ,1 ); +__ptep_rdp (addr, ptep,1 );else -__ptep_rdp (addr, ptep,0 ,0 ,0 ); +__ptep_rdp (addr, ptep,0 );/* * PTE is not invalidated by RDP, only _PAGE_PROTECT is cleared. That * means it is still valid and active, and must not be changed according
Greg Kroah-Hartman
maintainerPATCH 22/175 mptcp: Fix proto fallback detection with BPF
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f upstream.
The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces.
'''tcp_rcv_state_process()
syn_recv_sock()/subflow_syn_recv_sock()
tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
bpf_skops_established <== sockops
bpf_sock_map_update(sk) <== call bpf helper
tcp_bpf_update_proto() <== update sk_prot'''
When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. '''subflow_syn_recv_sock()
subflow_ulp_fallback()
subflow_drop_ctx()
mptcp_subflow_ops_undo_override()
'''
Then, this subflow can be normally used by sockmap, which replaces the native sk_prot with sockmap's custom sk_prot. The issue occurs when the user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). Here, it uses sk->sk_prot to compare with the native sk_prot, but this is incorrect when sockmap is used, as we may incorrectly set sk->sk_socket->ops.
This fix uses the more generic sk_family for the comparison instead.
Additionally, this also prevents a WARNING from occurring:
result from ./scripts/decode_stacktrace.sh:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ (net/mptcp/protocol.c:4005) Modules linked in:
...
PKRU: 55555554
Call Trace: <TASK>
do_accept (net/socket.c:1989)__sys_accept4 (net/socket.c:2028 net/socket.c:2057) __x64_sys_accept (net/socket.c:2067)x64_sys_call (arch/x86/entry/syscall_64.c:41)do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
RIP: 0033:0x7f87ac92b83d ---[ end trace 0000000000000000 ]---
--- net/mptcp/protocol.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/mptcp/protocol.c +4 -2
@@ -60,11 +60,13 @@ static u64 mptcp_wnd_end(const struct mpstatic const struct proto_ops *mptcp_fallback_tcp_ops (const struct sock *sk) { +unsigned short family =READ_ONCE (sk->sk_family); +#if IS_ENABLED (CONFIG_MPTCP_IPV6 ) -if (sk->sk_prot == &tcpv6_prot) +if (family ==AF_INET6 )return &inet6_stream_ops;#endif -WARN_ON_ONCE (sk->sk_prot != &tcp_prot); +WARN_ON_ONCE (family !=AF_INET );return &inet_stream_ops; }
Greg Kroah-Hartman
maintainerPATCH 23/175 lib/test_kho: check if KHO is enabled
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pasha Tatashin <[email protected]>
commit a26ec8f3d4e56d4a7ffa301e8032dca9df0bbc05 upstream.
We must check whether KHO is enabled prior to issuing KHO commands, otherwise KHO internal data structures are not initialized.
--- lib/test_kho.c | 3 +++ 1 file changed, 3 insertions(+)
lib/test_kho.c +3 -0
@@ -272,6 +272,9 @@ static int __init kho_test_init(void)phys_addr_t fdt_phys;int err; +if (!kho_is_enabled ()) +return 0 ; + err =kho_retrieve_subtree (KHO_TEST_FDT , &fdt_phys);if (!err)return kho_test_restore (fdt_phys);
Greg Kroah-Hartman
maintainerPATCH 24/175 ACPI: APEI: EINJ: Fix EINJV2 initialization and injection
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit d2932a59c2d4fb364396f21df58431c44918dd47 upstream.
ACPI 6.6 specification for EINJV2 appends an extra structure to the end of the existing struct set_error_type_with_address.
Several issues showed up in testing.
1) Initialization was broken by an earlier fix [1] since is_v2 is only set while performing an injection, not during initialization.
2) A buggy BIOS provided invalid "revision" and "length" for the extension structure. Add several sanity checks.
3) When injecting legacy error types on an EINJV2 capable system, don't copy the component arrays.
--- drivers/acpi/apei/einj-core.c | 64 ++++++++++++++++++++++++++---------------- 1 file changed, 41 insertions(+), 23 deletions(-)
drivers/acpi/apei/einj-core.c +41 -23
@@ -182,6 +182,7 @@ bool einj_initialized __ro_after_init;static void __iomem *einj_param;static u32 v5param_size; +static u32 v66param_size;static bool is_v2;static void einj_exec_ctx_init (struct apei_exec_context *ctx)
@@ -283,6 +284,24 @@ static void check_vendor_extension(u64 pacpi_os_unmap_iomem (p,sizeof (v)); } +static u32 einjv2_init (struct einjv2_extension_struct *e) +{ +if (e->revision !=1 ) { +pr_info ("Unknown v2 extension revision %u\n" , e->revision); +return 0 ; + } +if (e->length <sizeof (*e) || e->length >PAGE_SIZE ) { +pr_info (FW_BUG "Bad1 v2 extension length %u\n" , e->length); +return 0 ; + } +if ((e->length -sizeof (*e)) %sizeof (e->component_arr[0 ])) { +pr_info (FW_BUG "Bad2 v2 extension length %u\n" , e->length); +return 0 ; + } + +return (e->length -sizeof (*e)) /sizeof (e->component_arr[0 ]); +} +static void __iomem *einj_get_parameter_address (void ) {int i;
@@ -310,28 +329,21 @@ static void __iomem *einj_get_parameter_ v5param_size =sizeof (v5param); p =acpi_os_map_iomem (pa_v5,sizeof (*p));if (p) { -int offset, len; -memcpy_fromio (&v5param, p, v5param_size); acpi5 =1 ;check_vendor_extension (pa_v5, &v5param); -if (is_v2 && available_error_type &ACPI65_EINJV2_SUPP ) { - len = v5param.einjv2_struct.length; - offset = offsetof(struct einjv2_extension_struct , component_arr); - max_nr_components = (len - offset) / -sizeof (v5param.einjv2_struct.component_arr[0 ]); -/* -* The first call to acpi_os_map_iomem above does not include the -* component array, instead it is used to read and calculate maximum -* number of components supported by the system. Below, the mapping -* is expanded to include the component array. -*/ +if (available_error_type &ACPI65_EINJV2_SUPP ) { +struct einjv2_extension_struct *e; + + e = &v5param.einjv2_struct; + max_nr_components =einjv2_init (e); + +/* remap including einjv2_extension_struct */ acpi_os_unmap_iomem (p, v5param_size); - offset = offsetof(struct set_error_type_with_address , einjv2_struct); - v5param_size = offset +struct_size (&v5param.einjv2_struct, - component_arr, max_nr_components); - p =acpi_os_map_iomem (pa_v5, v5param_size); + v66param_size = v5param_size -sizeof (*e) + e->length; + p =acpi_os_map_iomem (pa_v5, v66param_size); } +return p; } }
@@ -527,6 +539,7 @@ static int __einj_error_inject(u32 type, u64 param3, u64 param4) {struct apei_exec_context ctx; +u32 param_size = is_v2 ? v66param_size : v5param_size;u64 val, trigger_paddr, timeout =FIRMWARE_TIMEOUT ;int i, rc;
@@ -539,11 +552,11 @@ static int __einj_error_inject(u32 type,if (acpi5) {struct set_error_type_with_address *v5param; - v5param =kmalloc (v5param_size,GFP_KERNEL ); + v5param =kmalloc (param_size,GFP_KERNEL );if (!v5param)return -ENOMEM ; -memcpy_fromio (v5param, einj_param, v5param_size); +memcpy_fromio (v5param, einj_param, param_size); v5param->type = type;if (type &ACPI5_VENDOR_BIT ) {switch (vendor_flags) {
@@ -601,7 +614,7 @@ static int __einj_error_inject(u32 type,break ; } } -memcpy_toio (einj_param, v5param, v5param_size); +memcpy_toio (einj_param, v5param, param_size);kfree (v5param); }else { rc =apei_exec_run (&ctx,ACPI_EINJ_SET_ERROR_TYPE );
@@ -1099,9 +1112,14 @@ static void einj_remove(struct faux_devistruct apei_exec_context ctx;if (einj_param) { -acpi_size size = (acpi5) ? - v5param_size : -sizeof (struct einj_parameter ); +acpi_size size; + +if (v66param_size) + size = v66param_size; +else if (acpi5) + size = v5param_size; +else + size =sizeof (struct einj_parameter );acpi_os_unmap_iomem (einj_param, size);if (vendor_errors.size)
Greg Kroah-Hartman
maintainerPATCH 25/175 ata: libata-scsi: Fix system suspend for a security locked drive
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit b11890683380a36b8488229f818d5e76e8204587 upstream.
Commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") fixed ata_to_sense_error() to properly generate sense key ABORTED COMMAND (without any additional sense code), instead of the previous bogus sense key ILLEGAL REQUEST with the additional sense code UNALIGNED WRITE COMMAND, for a failed command.
However, this broke suspend for Security locked drives (drives that have Security enabled, and have not been Security unlocked by boot firmware).
The reason for this is that the SCSI disk driver, for the Synchronize Cache command only, treats any sense data with sense key ILLEGAL REQUEST as a successful command (regardless of ASC / ASCQ).
After commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") the code that treats any sense data with sense key ILLEGAL REQUEST as a successful command is no longer applicable, so the command fails, which causes the system suspend to be aborted:
sd 1:0:0:0: PM: dpm_run_callback(): scsi_bus_suspend returns -5 sd 1:0:0:0: PM: failed to suspend async: error -5
PM: Some devices failed to suspend, or early wake event detected
To make suspend work once again, for a Security locked device only, return sense data LOGICAL UNIT ACCESS NOT AUTHORIZED, the actual sense data which a real SCSI device would have returned if locked. The SCSI disk driver treats this sense data as a successful command.
--- drivers/ata/libata-scsi.c | 7 +++++++ include/linux/ata.h | 1 + 2 files changed, 8 insertions(+)
drivers/ata/libata-scsi.c +7 -0
@@ -992,6 +992,13 @@ static void ata_gen_ata_sense(struct atareturn ; } +if (ata_id_is_locked (dev->id)) { +/* Security locked */ +/* LOGICAL UNIT ACCESS NOT AUTHORIZED */ +ata_scsi_set_sense (dev, cmd,DATA_PROTECT ,0x74 ,0x71 ); +return ; + } +if (!(qc->flags &ATA_QCFLAG_RTF_FILLED )) {ata_dev_dbg (dev,"Missing result TF: reporting aborted command\n" );
include/linux/ata.h +1 -0
@@ -566,6 +566,7 @@ struct ata_bmdma_prd {#define ata_id_has_ncq (id) ((id)[ATA_ID_SATA_CAPABILITY] & (1 << 8))#define ata_id_queue_depth (id) (((id)[ATA_ID_QUEUE_DEPTH] & 0x1f) + 1)#define ata_id_removable (id) ((id)[ATA_ID_CONFIG] & (1 << 7)) +#define ata_id_is_locked (id) (((id)[ATA_ID_DLF] & 0x7) == 0x7)#define ata_id_has_atapi_AN (id) \ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \
Greg Kroah-Hartman
maintainerPATCH 26/175 MIPS: mm: Prevent a TLB shutdown on initial uniquification
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 upstream.
Depending on the particular CPU implementation a TLB shutdown may occur if multiple matching entries are detected upon the execution of a TLBP or the TLBWI/TLBWR instructions. Given that we don't know what entries we have been handed we need to be very careful with the initial TLB setup and avoid all these instructions.
Therefore read all the TLB entries one by one with the TLBR instruction, bypassing the content addressing logic, and truncate any large pages in place so as to avoid a case in the second step where an incoming entry for a large page at a lower address overlaps with a replacement entry chosen at another index. Then preinitialize the TLB using addresses outside our usual unique range and avoiding clashes with any entries received, before making the usual call to local_flush_tlb_all().
This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual address).
--- arch/mips/mm/tlb-r4k.c | 102 ++++++++++++++++++++++++++++++------------------- 1 file changed, 64 insertions(+), 38 deletions(-)
arch/mips/mm/tlb-r4k.c +64 -38
@@ -15,6 +15,7 @@#include <linux/mm.h> #include <linux/hugetlb.h> #include <linux/export.h> +#include <linux/sort.h> #include <asm/cpu.h> #include <asm/cpu-type.h>
@@ -508,55 +509,79 @@ static int __init set_ntlb(char *str)__setup ("ntlb=" , set_ntlb); -/* Initialise all TLB entries with unique values */ + +/* Comparison function for EntryHi VPN fields. */ +static int r4k_vpn_cmp (const void *a,const void *b) +{ +long v = *(unsigned long *)a - *(unsigned long *)b; +int s =sizeof (long ) >sizeof (int ) ?sizeof (long ) *8 -1 :0 ; +return s ? (v !=0 ) | v >> s : v; +} + +/* +* Initialise all TLB entries with unique values that do not clash with +* what we have been handed over and what we'll be using ourselves. +*/ static void r4k_tlb_uniquify (void ) { -int entry =num_wired_entries (); +unsigned long tlb_vpns[1 <<MIPS_CONF1_TLBS_SIZE ]; +int tlbsize = current_cpu_data.tlbsize; +int start =num_wired_entries (); +unsigned long vpn_mask; +int cnt, ent, idx, i; + + vpn_mask =GENMASK (cpu_vmbits -1 ,13 ); + vpn_mask |=IS_ENABLED (CONFIG_64BIT ) ?3ULL <<62 :1 <<31 ;htw_stop (); -write_c0_entrylo0 (0 ); -write_c0_entrylo1 (0 ); -while (entry < current_cpu_data.tlbsize) { -unsigned long asid_mask =cpu_asid_mask (¤t_cpu_data); -unsigned long asid =0 ; -int idx; +for (i = start, cnt =0 ; i < tlbsize; i++, cnt++) { +unsigned long vpn; -/* Skip wired MMID to make ginvt_mmid work */ -if (cpu_has_mmid) - asid =MMID_KERNEL_WIRED +1 ; +write_c0_index (i); +mtc0_tlbr_hazard (); +tlb_read (); +tlb_read_hazard (); + vpn =read_c0_entryhi (); + vpn &= vpn_mask &PAGE_MASK ; + tlb_vpns[cnt] = vpn; -/* Check for match before using UNIQUE_ENTRYHI */ -do { -if (cpu_has_mmid) { -write_c0_memorymapid (asid); -write_c0_entryhi (UNIQUE_ENTRYHI (entry)); - }else { -write_c0_entryhi (UNIQUE_ENTRYHI (entry) | asid); - } -mtc0_tlbw_hazard (); -tlb_probe (); -tlb_probe_hazard (); - idx =read_c0_index (); -/* No match or match is on current entry */ -if (idx <0 || idx == entry) -break ; -/* -* If we hit a match, we need to try again with -* a different ASID. -*/ - asid++; - }while (asid < asid_mask); - -if (idx >=0 && idx != entry) -panic ("Unable to uniquify TLB entry %d" , idx); - -write_c0_index (entry); +/* Prevent any large pages from overlapping regular ones. */ +write_c0_pagemask (read_c0_pagemask () &PM_DEFAULT_MASK );mtc0_tlbw_hazard ();tlb_write_indexed (); - entry++; +tlbw_use_hazard (); } +sort (tlb_vpns, cnt,sizeof (tlb_vpns[0 ]), r4k_vpn_cmp,NULL ); + +write_c0_pagemask (PM_DEFAULT_MASK ); +write_c0_entrylo0 (0 ); +write_c0_entrylo1 (0 ); + + idx =0 ; + ent = tlbsize; +for (i = start; i < tlbsize; i++) +while (1 ) { +unsigned long entryhi, vpn; + + entryhi =UNIQUE_ENTRYHI (ent); + vpn = entryhi & vpn_mask &PAGE_MASK ; + +if (idx >= cnt || vpn < tlb_vpns[idx]) { +write_c0_entryhi (entryhi); +write_c0_index (i); +mtc0_tlbw_hazard (); +tlb_write_indexed (); + ent++; +break ; + }else if (vpn == tlb_vpns[idx]) { + ent++; + }else { + idx++; + } + } +tlbw_use_hazard ();htw_start ();flush_micro_tlb ();
@@ -602,6 +627,7 @@ static void r4k_tlb_configure(void)/* From this point on the ARC firmware is dead. */ r4k_tlb_uniquify (); +local_flush_tlb_all ();/* Did I tell you that ARC SUCKS? */ }
Re: [PATCH 6.17 026/175] MIPS: mm: Prevent a TLB shutdown on initial uniquification
Quoted 7 lines · Greg Kroah-Hartman
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit
9f048fa487409e364cf866c957cf0b0d782ca5a3upstream.
So this caused a regression for a subset of systems. A fix is in review,
so I think this will best be dropped at this point and then cherry-picked along the fix. I've arranged for this to happen via patch prerequisites already. Please let me know if there's an issue with this approach.
Maciej
Greg Kroah-Hartman
maintainerRe: [PATCH 6.17 026/175] MIPS: mm: Prevent a TLB shutdown on initial uniquification
Quoted 6 lines · Maciej W. Rozycki
Quoted 4 lines · Greg Kroah-Hartman
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
Quoted 8 lines
Quoted 3 lines
From: Maciej W. Rozycki <[email protected]>
commit
9f048fa487409e364cf866c957cf0b0d782ca5a3upstream.So this caused a regression for a subset of systems. A fix is in review,
so I think this will best be dropped at this point and then cherry-picked along the fix. I've arranged for this to happen via patch prerequisites already. Please let me know if there's an issue with this approach.
Now dropped from all stable queues, thanks!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 27/175 selinux: rename task_security_struct to cred_security_struct
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit 75f72fe289a7f76204a728668edcf20e4a2a6097 upstream.
Before Linux had cred structures, the SELinux task_security_struct was per-task and although the structure was switched to being per-cred long ago, the name was never updated. This change renames it to cred_security_struct to avoid confusion and pave the way for the introduction of an actual per-task security structure for SELinux. No functional change.
--- security/selinux/hooks.c | 68 +++++++++++++++++++------------------- security/selinux/include/objsec.h | 8 ++-- 2 files changed, 38 insertions(+), 38 deletions(-)
security/selinux/hooks.c +34 -34
@@ -210,7 +210,7 @@ static int selinux_lsm_notifier_avc_call*/ static void cred_init_security (void ) { -struct task_security_struct *tsec; +struct cred_security_struct *tsec;/* NOTE: the lsm framework zeros out the buffer on allocation */
@@ -223,7 +223,7 @@ static void cred_init_security(void)*/ static inline u32 cred_sid (const struct cred *cred) { -const struct task_security_struct *tsec; +const struct cred_security_struct *tsec; tsec =selinux_cred (cred);return tsec->sid;
@@ -437,7 +437,7 @@ static int may_context_mount_sb_relabel(struct superblock_security_struct *sbsec, const struct cred *cred) { - const struct task_security_struct *tsec = selinux_cred(cred); + const struct cred_security_struct *tsec = selinux_cred(cred);int rc; rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
@@ -454,7 +454,7 @@ static int may_context_mount_inode_relabstruct superblock_security_struct *sbsec, const struct cred *cred) { - const struct task_security_struct *tsec = selinux_cred(cred); + const struct cred_security_struct *tsec = selinux_cred(cred);int rc; rc =avc_has_perm (tsec->sid, sbsec->sid,SECCLASS_FILESYSTEM ,FILESYSTEM__RELABELFROM ,NULL );
@@ -1784,7 +1784,7 @@ out:* Determine the label for an inode that might be unioned. */ static int -selinux_determine_inode_label (const struct task_security_struct *tsec, +selinux_determine_inode_label (const struct cred_security_struct *tsec,struct inode *dir,const struct qstr *name,u16 tclass,u32 *_new_isid)
@@ -1813,7 +1813,7 @@ static int may_create(struct inode *dir, struct dentry *dentry, u16 tclass) { -const struct task_security_struct *tsec =selinux_cred (current_cred ()); +const struct cred_security_struct *tsec =selinux_cred (current_cred ());struct inode_security_struct *dsec;struct superblock_security_struct *sbsec;u32 sid, newsid;
@@ -2247,8 +2247,8 @@ static u32 ptrace_parent_sid(void) }static int check_nnp_nosuid (const struct linux_binprm *bprm, -const struct task_security_struct *old_tsec, -const struct task_security_struct *new_tsec) +const struct cred_security_struct *old_tsec, +const struct cred_security_struct *new_tsec) {int nnp = (bprm->unsafe &LSM_UNSAFE_NO_NEW_PRIVS );int nosuid = !mnt_may_suid (bprm->file->f_path.mnt);
@@ -2301,8 +2301,8 @@ static int check_nnp_nosuid(const structstatic int selinux_bprm_creds_for_exec (struct linux_binprm *bprm) { -const struct task_security_struct *old_tsec; -struct task_security_struct *new_tsec; +const struct cred_security_struct *old_tsec; +struct cred_security_struct *new_tsec;struct inode_security_struct *isec;struct common_audit_data ad;struct inode *inode =file_inode (bprm->file);
@@ -2479,7 +2479,7 @@ static inline void flush_unauthorized_fi*/ static void selinux_bprm_committing_creds (const struct linux_binprm *bprm) { -struct task_security_struct *new_tsec; +struct cred_security_struct *new_tsec;struct rlimit *rlim, *initrlim;int rc, i;
@@ -2525,7 +2525,7 @@ static void selinux_bprm_committing_cred*/ static void selinux_bprm_committed_creds (const struct linux_binprm *bprm) { -const struct task_security_struct *tsec =selinux_cred (current_cred ()); +const struct cred_security_struct *tsec =selinux_cred (current_cred ());u32 osid, sid;int rc;
@@ -2907,7 +2907,7 @@ static int selinux_dentry_create_files_a {u32 newsid;int rc; -struct task_security_struct *tsec; +struct cred_security_struct *tsec; rc = selinux_determine_inode_label(selinux_cred(old), d_inode(dentry->d_parent), name,
@@ -2925,7 +2925,7 @@ static int selinux_inode_init_security(sconst struct qstr *qstr, struct xattr *xattrs, int *xattr_count) { - const struct task_security_struct *tsec = selinux_cred(current_cred()); + const struct cred_security_struct *tsec = selinux_cred(current_cred());struct superblock_security_struct *sbsec;struct xattr *xattr =lsm_get_xattr_slot (xattrs, xattr_count);u32 newsid, clen;
@@ -3106,7 +3106,7 @@ static noinline int audit_inode_permissi* Clear the task's AVD cache in @tsec and reset it to the current policy's * and task's info. */ -static inline void task_avdcache_reset (struct task_security_struct *tsec) +static inline void task_avdcache_reset (struct cred_security_struct *tsec) {memset (&tsec->avdcache.dir,0 ,sizeof (tsec->avdcache.dir)); tsec->avdcache.sid = tsec->sid;
@@ -3123,7 +3123,7 @@ static inline void task_avdcache_reset(s* Search @tsec for a AVD cache entry that matches @isec and return it to the * caller via @avdc. Returns 0 if a match is found, negative values otherwise. */ -static inline int task_avdcache_search (struct task_security_struct *tsec, +static inline int task_avdcache_search (struct cred_security_struct *tsec,struct inode_security_struct *isec,struct avdc_entry **avdc) {
@@ -3163,7 +3163,7 @@ static inline int task_avdcache_search(s* Update the AVD cache in @tsec with the @avdc and @audited info associated * with @isec. */ -static inline void task_avdcache_update (struct task_security_struct *tsec, +static inline void task_avdcache_update (struct cred_security_struct *tsec,struct inode_security_struct *isec,struct av_decision *avd,u32 audited)
@@ -3197,7 +3197,7 @@ static int selinux_inode_permission(stru {int mask;u32 perms; -struct task_security_struct *tsec; +struct cred_security_struct *tsec;struct inode_security_struct *isec;struct avdc_entry *avdc;int rc, rc2;
@@ -3279,7 +3279,7 @@ static int selinux_inode_setattr(structstatic int selinux_inode_getattr (const struct path *path) { -struct task_security_struct *tsec; +struct cred_security_struct *tsec; tsec =selinux_cred (current_cred ());
@@ -3655,7 +3655,7 @@ static void selinux_inode_getlsmprop(strstatic int selinux_inode_copy_up (struct dentry *src,struct cred **new) {struct lsm_prop prop; -struct task_security_struct *tsec; +struct cred_security_struct *tsec;struct cred *new_creds = *new;if (new_creds ==NULL ) {
@@ -3693,7 +3693,7 @@ static int selinux_inode_copy_up_xattr(sstatic int selinux_kernfs_init_security (struct kernfs_node *kn_dir,struct kernfs_node *kn) { -const struct task_security_struct *tsec =selinux_cred (current_cred ()); +const struct cred_security_struct *tsec =selinux_cred (current_cred ());u32 parent_sid, newsid, clen;int rc;char *context;
@@ -4157,8 +4157,8 @@ static int selinux_task_alloc(struct tasstatic int selinux_cred_prepare (struct cred *new,const struct cred *old,gfp_t gfp) { -const struct task_security_struct *old_tsec =selinux_cred (old); -struct task_security_struct *tsec =selinux_cred (new); +const struct cred_security_struct *old_tsec =selinux_cred (old); +struct cred_security_struct *tsec =selinux_cred (new); *tsec = *old_tsec;return 0 ;
@@ -4169,8 +4169,8 @@ static int selinux_cred_prepare(struct c*/ static void selinux_cred_transfer (struct cred *new,const struct cred *old) { -const struct task_security_struct *old_tsec =selinux_cred (old); -struct task_security_struct *tsec =selinux_cred (new); +const struct cred_security_struct *old_tsec =selinux_cred (old); +struct cred_security_struct *tsec =selinux_cred (new); *tsec = *old_tsec; }
@@ -4191,7 +4191,7 @@ static void selinux_cred_getlsmprop(cons*/ static int selinux_kernel_act_as (struct cred *new,u32 secid) { -struct task_security_struct *tsec =selinux_cred (new); +struct cred_security_struct *tsec =selinux_cred (new);u32 sid =current_sid ();int ret;
@@ -4215,7 +4215,7 @@ static int selinux_kernel_act_as(structstatic int selinux_kernel_create_files_as (struct cred *new,struct inode *inode) {struct inode_security_struct *isec =inode_security (inode); -struct task_security_struct *tsec =selinux_cred (new); +struct cred_security_struct *tsec =selinux_cred (new);u32 sid =current_sid ();int ret;
@@ -4740,7 +4740,7 @@ static int selinux_conn_sid(u32 sk_sid,/* socket security operations */ -static int socket_sockcreate_sid (const struct task_security_struct *tsec, +static int socket_sockcreate_sid (const struct cred_security_struct *tsec,u16 secclass,u32 *socksid) {if (tsec->sockcreate_sid >SECSID_NULL ) {
@@ -4793,7 +4793,7 @@ static int sock_has_perm(struct sock *skstatic int selinux_socket_create (int family,int type,int protocol,int kern) { -const struct task_security_struct *tsec =selinux_cred (current_cred ()); +const struct cred_security_struct *tsec =selinux_cred (current_cred ());u32 newsid;u16 secclass;int rc;
@@ -4812,7 +4812,7 @@ static int selinux_socket_create(int famstatic int selinux_socket_post_create (struct socket *sock,int family,int type,int protocol,int kern) { -const struct task_security_struct *tsec =selinux_cred (current_cred ()); +const struct cred_security_struct *tsec =selinux_cred (current_cred ());struct inode_security_struct *isec =inode_security_novalidate (SOCK_INODE (sock));struct sk_security_struct *sksec;u16 sclass =socket_type_to_security_class (family, type, protocol);
@@ -6522,7 +6522,7 @@ static void selinux_d_instantiate(structstatic int selinux_lsm_getattr (unsigned int attr,struct task_struct *p,char **value) { -const struct task_security_struct *tsec; +const struct cred_security_struct *tsec;int error;u32 sid;u32 len;
@@ -6577,7 +6577,7 @@ err_unlock:static int selinux_lsm_setattr (u64 attr,void *value,size_t size) { -struct task_security_struct *tsec; +struct cred_security_struct *tsec;struct cred *new;u32 mysid =current_sid (), sid =0 , ptsid;int error;
@@ -6872,7 +6872,7 @@ static int selinux_inode_getsecctx(strucstatic int selinux_key_alloc (struct key *k,const struct cred *cred,unsigned long flags) { -const struct task_security_struct *tsec; +const struct cred_security_struct *tsec;struct key_security_struct *ksec =selinux_key (k); tsec =selinux_cred (cred);
@@ -7169,7 +7169,7 @@ static void selinux_bpf_token_free(struc#endif struct lsm_blob_sizes selinux_blob_sizes__ro_after_init = { - .lbs_cred =sizeof (struct task_security_struct ), + .lbs_cred =sizeof (struct cred_security_struct ), .lbs_file =sizeof (struct file_security_struct ), .lbs_inode =sizeof (struct inode_security_struct ), .lbs_ipc =sizeof (struct ipc_security_struct ),
security/selinux/include/objsec.h +4 -4
@@ -36,7 +36,7 @@ struct avdc_entry {bool permissive;/* AVC permissive flag */ }; -struct task_security_struct { +struct cred_security_struct {u32 osid;/* SID prior to last execve */ u32 sid;/* current SID */ u32 exec_sid;/* exec SID */
@@ -53,7 +53,7 @@ struct task_security_struct { } avdcache; } __randomize_layout; -static inline bool task_avdcache_permnoaudit (struct task_security_struct *tsec) +static inline bool task_avdcache_permnoaudit (struct cred_security_struct *tsec) { return (tsec->avdcache.permissive_neveraudit && tsec->sid == tsec->avdcache.sid &&
@@ -171,7 +171,7 @@ struct perf_event_security_struct { };extern struct lsm_blob_sizes selinux_blob_sizes; -static inline struct task_security_struct *selinux_cred (const struct cred *cred) +static inline struct cred_security_struct *selinux_cred (const struct cred *cred) {return cred->security + selinux_blob_sizes.lbs_cred; }
@@ -206,7 +206,7 @@ selinux_ipc(const struct kern_ipc_perm **/ static inline u32 current_sid (void ) { -const struct task_security_struct *tsec =selinux_cred (current_cred ()); +const struct cred_security_struct *tsec =selinux_cred (current_cred ());return tsec->sid; }
Greg Kroah-Hartman
maintainerPATCH 28/175 selinux: move avdcache to per-task security struct
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit dde3a5d0f4dce1d1a6095e6b8eeb59b75d28fb3b upstream.
The avdcache is meant to be per-task; move it to a new task_security_struct that is duplicated per-task.
--- security/selinux/hooks.c | 31 ++++++++++++++++++------------- security/selinux/include/objsec.h | 14 ++++++++++++-- 2 files changed, 30 insertions(+), 15 deletions(-)
security/selinux/hooks.c +18 -13
@@ -215,7 +215,7 @@ static void cred_init_security(void)/* NOTE: the lsm framework zeros out the buffer on allocation */ tsec =selinux_cred (unrcu_pointer (current->real_cred)); - tsec->osid = tsec->sid = tsec->avdcache.sid =SECINITSID_KERNEL ; + tsec->osid = tsec->sid =SECINITSID_KERNEL ; }/*
@@ -3106,10 +3106,10 @@ static noinline int audit_inode_permissi* Clear the task's AVD cache in @tsec and reset it to the current policy's * and task's info. */ -static inline void task_avdcache_reset (struct cred_security_struct *tsec) +static inline void task_avdcache_reset (struct task_security_struct *tsec) {memset (&tsec->avdcache.dir,0 ,sizeof (tsec->avdcache.dir)); - tsec->avdcache.sid = tsec->sid; + tsec->avdcache.sid =current_sid (); tsec->avdcache.seqno =avc_policy_seqno (); tsec->avdcache.dir_spot =TSEC_AVDC_DIR_SIZE -1 ; }
@@ -3123,7 +3123,7 @@ static inline void task_avdcache_reset(s* Search @tsec for a AVD cache entry that matches @isec and return it to the * caller via @avdc. Returns 0 if a match is found, negative values otherwise. */ -static inline int task_avdcache_search (struct cred_security_struct *tsec, +static inline int task_avdcache_search (struct task_security_struct *tsec,struct inode_security_struct *isec,struct avdc_entry **avdc) {
@@ -3133,7 +3133,7 @@ static inline int task_avdcache_search(sif (isec->sclass !=SECCLASS_DIR )return -ENOENT ; -if (unlikely (tsec->sid != tsec->avdcache.sid || +if (unlikely (current_sid () != tsec->avdcache.sid || tsec->avdcache.seqno !=avc_policy_seqno ())) {task_avdcache_reset (tsec);return -ENOENT ;
@@ -3163,7 +3163,7 @@ static inline int task_avdcache_search(s* Update the AVD cache in @tsec with the @avdc and @audited info associated * with @isec. */ -static inline void task_avdcache_update (struct cred_security_struct *tsec, +static inline void task_avdcache_update (struct task_security_struct *tsec,struct inode_security_struct *isec,struct av_decision *avd,u32 audited)
@@ -3197,7 +3197,8 @@ static int selinux_inode_permission(stru {int mask;u32 perms; -struct cred_security_struct *tsec; +u32 sid =current_sid (); +struct task_security_struct *tsec;struct inode_security_struct *isec;struct avdc_entry *avdc;int rc, rc2;
@@ -3209,8 +3210,8 @@ static int selinux_inode_permission(struif (!mask)return 0 ; - tsec =selinux_cred (current_cred ()); -if (task_avdcache_permnoaudit (tsec)) + tsec =selinux_task (current); +if (task_avdcache_permnoaudit (tsec, sid))return 0 ; isec =inode_security_rcu (inode, requested &MAY_NOT_BLOCK );
@@ -3230,7 +3231,7 @@ static int selinux_inode_permission(strustruct av_decision avd;/* Cache miss. */ - rc =avc_has_perm_noaudit (tsec->sid, isec->sid, isec->sclass, + rc =avc_has_perm_noaudit (sid, isec->sid, isec->sclass, perms,0 , &avd); audited = avc_audit_required(perms, &avd, rc, (requested & MAY_ACCESS) ? FILE__AUDIT_ACCESS : 0,
@@ -3279,11 +3280,11 @@ static int selinux_inode_setattr(structstatic int selinux_inode_getattr (const struct path *path) { -struct cred_security_struct *tsec; +struct task_security_struct *tsec; - tsec =selinux_cred (current_cred ()); + tsec =selinux_task (current); -if (task_avdcache_permnoaudit (tsec)) +if (task_avdcache_permnoaudit (tsec,current_sid ()))return 0 ;return path_has_perm (current_cred (), path,FILE__GETATTR );
@@ -4147,7 +4148,10 @@ static int selinux_task_alloc(struct tas unsigned long clone_flags) {u32 sid =current_sid (); +struct task_security_struct *old_tsec =selinux_task (current); +struct task_security_struct *new_tsec =selinux_task (task); + *new_tsec = *old_tsec;return avc_has_perm (sid, sid,SECCLASS_PROCESS ,PROCESS__FORK ,NULL ); }
@@ -7170,6 +7174,7 @@ static void selinux_bpf_token_free(strucstruct lsm_blob_sizes selinux_blob_sizes__ro_after_init = { .lbs_cred =sizeof (struct cred_security_struct ), + .lbs_task =sizeof (struct task_security_struct ), .lbs_file =sizeof (struct file_security_struct ), .lbs_inode =sizeof (struct inode_security_struct ), .lbs_ipc =sizeof (struct ipc_security_struct ),
security/selinux/include/objsec.h +12 -2
@@ -43,6 +43,9 @@ struct cred_security_struct {u32 create_sid;/* fscreate SID */ u32 keycreate_sid;/* keycreate SID */ u32 sockcreate_sid;/* fscreate SID */ +} __randomize_layout; + +struct task_security_struct {#define TSEC_AVDC_DIR_SIZE (1 << 2)struct {u32 sid;/* current SID for cached entries */
@@ -53,10 +56,11 @@ struct cred_security_struct { } avdcache; } __randomize_layout; -static inline bool task_avdcache_permnoaudit (struct cred_security_struct *tsec) +static inline bool task_avdcache_permnoaudit (struct task_security_struct *tsec, +u32 sid) {return (tsec->avdcache.permissive_neveraudit && - tsec->sid == tsec->avdcache.sid && + sid == tsec->avdcache.sid && tsec->avdcache.seqno ==avc_policy_seqno ()); }
@@ -176,6 +180,12 @@ static inline struct cred_security_strucreturn cred->security + selinux_blob_sizes.lbs_cred; } +static inline struct task_security_struct * +selinux_task (const struct task_struct *task) +{ +return task->security + selinux_blob_sizes.lbs_task; +} +static inline struct file_security_struct *selinux_file (const struct file *file) {return file->f_security + selinux_blob_sizes.lbs_file;
Greg Kroah-Hartman
maintainerPATCH 29/175 smb: client: introduce close_cached_dir_locked()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
commit a9d1f38df7ecd0e21233447c9cc6fa1799eddaf3 upstream.
Replace close_cached_dir() calls under cfid_list_lock with a new close_cached_dir_locked() variant that uses kref_put() instead of kref_put_lock() to avoid recursive locking when dropping references.
While the existing code works if the refcount >= 2 invariant holds, this area has proven error-prone. Make deadlocks impossible and WARN on invariant violations.
--- fs/smb/client/cached_dir.c | 41 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-)
fs/smb/client/cached_dir.c +38 -3
@@ -16,6 +16,7 @@ static struct cached_fid *init_cached_distatic void free_cached_dir (struct cached_fid *cfid);static void smb2_close_cached_fid (struct kref *ref);static void cfids_laundromat_worker (struct work_struct *work); +static void close_cached_dir_locked (struct cached_fid *cfid);struct cached_dir_dentry {struct list_head entry;
@@ -389,7 +390,7 @@ out:* lease. Release one here, and the second below. */ cfid->has_lease = false; -close_cached_dir (cfid); +close_cached_dir_locked (cfid); }spin_unlock (&cfids->cfid_list_lock);
@@ -476,18 +477,52 @@ void drop_cached_dir_by_name(const unsigspin_lock (&cfid->cfids->cfid_list_lock);if (cfid->has_lease) { cfid->has_lease = false; -close_cached_dir (cfid); +close_cached_dir_locked (cfid); }spin_unlock (&cfid->cfids->cfid_list_lock);close_cached_dir (cfid); } - +/** +* close_cached_dir - drop a reference of a cached dir +* +* The release function will be called with cfid_list_lock held to remove the +* cached dirs from the list before any other thread can take another @cfid +* ref. Must not be called with cfid_list_lock held; use +* close_cached_dir_locked() called instead. +* +* @cfid: cached dir +*/ void close_cached_dir (struct cached_fid *cfid) { +lockdep_assert_not_held (&cfid->cfids->cfid_list_lock);kref_put_lock (&cfid->refcount, smb2_close_cached_fid, &cfid->cfids->cfid_list_lock); } +/** +* close_cached_dir_locked - put a reference of a cached dir with +* cfid_list_lock held +* +* Calling close_cached_dir() with cfid_list_lock held has the potential effect +* of causing a deadlock if the invariant of refcount >= 2 is false. +* +* This function is used in paths that hold cfid_list_lock and expect at least +* two references. If that invariant is violated, WARNs and returns without +* dropping a reference; the final put must still go through +* close_cached_dir(). +* +* @cfid: cached dir +*/ +static void close_cached_dir_locked (struct cached_fid *cfid) +{ +lockdep_assert_held (&cfid->cfids->cfid_list_lock); + +if (WARN_ON (kref_read (&cfid->refcount) <2 )) +return ; + +kref_put (&cfid->refcount, smb2_close_cached_fid); +} +/* * Called from cifs_kill_sb when we unmount a share */
Greg Kroah-Hartman
maintainerPATCH 30/175 wifi: rtw89: hw_scan: Dont let the operating channel be last
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
commit e837b9091b277ae6f309d7e9fc93cb0308cf461f upstream.
Scanning can be offloaded to the firmware. To that end, the driver prepares a list of channels to scan, including periodic visits back to the operating channel, and sends the list to the firmware.
When the channel list is too long to fit in a single H2C message, the driver splits the list, sends the first part, and tells the firmware to scan. When the scan is complete, the driver sends the next part of the list and tells the firmware to scan.
When the last channel that fit in the H2C message is the operating channel something seems to go wrong in the firmware. It will acknowledge receiving the list of channels but apparently it will not do anything more. The AP can't be pinged anymore. The driver still receives beacons, though.
One way to avoid this is to split the list of channels before the operating channel.
Affected devices:
* RTL8851BU with firmware 0.29.41.3
* RTL8832BU with firmware 0.29.29.8
* RTL8852BE with firmware 0.29.29.8
The commit 57a5fbe39a18 ("wifi: rtw89: refactor flow that hw scan handles channel list") is found by git blame, but it is actually to refine the scan flow, but not a culprit, so skip Fixes tag.
--- drivers/net/wireless/realtek/rtw89/fw.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/realtek/rtw89/fw.c +7 -0
@@ -7705,6 +7705,13 @@ int rtw89_hw_scan_add_chan_list_be(strucINIT_LIST_HEAD (&list);list_for_each_entry_safe (ch_info, tmp, &scan_info->chan_list, list) { +/* The operating channel (tx_null == true) should +* not be last in the list, to avoid breaking +* RTL8851BU and RTL8832BU. +*/ +if (list_len +1 ==RTW89_SCAN_LIST_LIMIT_AX && ch_info->tx_null) +break ; +list_move_tail (&ch_info->list, &list); list_len++;
Greg Kroah-Hartman
maintainerPATCH 31/175 ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
commit b32cc17d607e8ae7af037303fe101368cb4dc44c upstream.
Call scsi_device_put() in ata_scsi_dev_rescan() if the device or its queue are not running.
--- drivers/ata/libata-scsi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ata/libata-scsi.c +3 -1
@@ -4901,8 +4901,10 @@ void ata_scsi_dev_rescan(struct work_strspin_unlock_irqrestore (ap->lock, flags);if (do_resume) { ret =scsi_resume_device (sdev); -if (ret == -EWOULDBLOCK ) +if (ret == -EWOULDBLOCK ) { +scsi_device_put (sdev); goto unlock_scan; + } dev->flags &= ~ATA_DFLAG_RESUMING ; } ret =scsi_rescan_device (sdev);
Greg Kroah-Hartman
maintainerPATCH 32/175 be2net: pass wrb_params in case of OS2BMC
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <[email protected]>
commit 7d277a7a58578dd62fd546ddaef459ec24ccae36 upstream.
be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states.
The correct way would be to pass the wrb_params from be_xmit().
--- drivers/net/ethernet/emulex/benet/be_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +4 -3
@@ -1296,7 +1296,8 @@ static void be_xmit_flush(struct be_adap (adapter->bmc_filt_mask & BMC_FILT_MULTICAST)static bool be_send_pkt_to_bmc (struct be_adapter *adapter, -struct sk_buff **skb) +struct sk_buff **skb, +struct be_wrb_params *wrb_params) {struct ethhdr *eh = (struct ethhdr *)(*skb)->data;bool os2bmc = false;
@@ -1360,7 +1361,7 @@ done:* to BMC, asic expects the vlan to be inline in the packet. */ if (os2bmc) - *skb =be_insert_vlan_in_pkt (adapter, *skb,NULL ); + *skb =be_insert_vlan_in_pkt (adapter, *skb, wrb_params);return os2bmc; }
@@ -1387,7 +1388,7 @@ static netdev_tx_t be_xmit(struct sk_buf/* if os2bmc is enabled and if the pkt is destined to bmc, * enqueue the pkt a 2nd time with mgmt bit set. */ -if (be_send_pkt_to_bmc (adapter, &skb)) { +if (be_send_pkt_to_bmc (adapter, &skb, &wrb_params)) {BE_WRB_F_SET (wrb_params.features,OS2BMC ,1 ); wrb_cnt =be_xmit_enqueue (adapter, txo, skb, &wrb_params);if (unlikely (!wrb_cnt))
Greg Kroah-Hartman
maintainerPATCH 33/175 io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 46447367a52965e9d35f112f5b26fc8ff8ec443d upstream.
If timestamp retriving needs to be retried and the local list of SKB's already has entries, then it's spliced back into the socket queue. However, the arguments for the splice helper are transposed, causing exactly the wrong direction of splicing into the on-stack list. Fix that up.
--- io_uring/cmd_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/cmd_net.c +1 -1
@@ -126,7 +126,7 @@ static int io_uring_cmd_timestamp(structif (!unlikely (skb_queue_empty (&list))) { scoped_guard(spinlock_irqsave, &q->lock) -skb_queue_splice (q, &list); +skb_queue_splice (&list, q); }return -EAGAIN ; }
Greg Kroah-Hartman
maintainerPATCH 34/175 net: dsa: microchip: lan937x: Fix RGMII delay tuning
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 3ceb6ac2116ecda1c5d779bb73271479e70fccb4 upstream.
Correct RGMII delay application logic in lan937x_set_tune_adj().
The function was missing data16 &= ~PORT_TUNE_ADJ before setting the new delay value. This caused the new value to be bitwise-OR'd with the existing PORT_TUNE_ADJ field instead of replacing it.
For example, when setting the RGMII 2 TX delay on port 4, the intended TUNE_ADJUST value of 0 (RGMII_2_TX_DELAY_2NS) was incorrectly OR'd with the default 0x1B (from register value 0xDA3), leaving the delay at the wrong setting.
This patch adds the missing mask to clear the field, ensuring the correct delay value is written. Physical measurements on the RGMII TX lines confirm the fix, showing the delay changing from ~1ns (before change) to ~2ns.
While testing on i.MX 8MP showed this was within the platform's timing tolerance, it did not match the intended hardware-characterized value.
--- drivers/net/dsa/microchip/lan937x_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/dsa/microchip/lan937x_main.c +1 -0
@@ -540,6 +540,7 @@ static void lan937x_set_tune_adj(structksz_pread16 (dev, port, reg, &data16);/* Update tune Adjust */ + data16 &= ~PORT_TUNE_ADJ ; data16 |=FIELD_PREP (PORT_TUNE_ADJ , val);ksz_pwrite16 (dev, port, reg, data16);
Greg Kroah-Hartman
maintainerPATCH 35/175 Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diogo Ivo <[email protected]>
commit 660b299bed2a2a55a1f9102d029549d0235f881c upstream.
Commit b6bcbce33596 ("soc/tegra: pmc: Ensure power-domains are in a known state") was introduced so that all power domains get initialized to a known working state when booting and it does this by shutting them down (including asserting resets and disabling clocks) before registering each power domain with the genpd framework, leaving it to each driver to later on power its needed domains.
This caused the Google Pixel C to hang when booting due to a workaround in the DSI driver introduced in commit b22fd0b9639e ("drm/tegra: dsi:
Clear enable register if powered by bootloader") meant to handle the case where the bootloader enabled the DSI hardware module. The workaround relies on reading a hardware register to determine the current status and after b6bcbce33596 that now happens in a powered down state thus leading to the boot hang.
Fix this by reverting b22fd0b9639e since currently we are guaranteed that the hardware will be fully reset by the time we start enabling the DSI module.
--- drivers/gpu/drm/tegra/dsi.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/gpu/drm/tegra/dsi.c +0 -9
@@ -913,15 +913,6 @@ static void tegra_dsi_encoder_enable(stru32 value;int err; -/* If the bootloader enabled DSI it needs to be disabled -* in order for the panel initialization commands to be -* properly sent. -*/ - value =tegra_dsi_readl (dsi,DSI_POWER_CONTROL ); - -if (value &DSI_POWER_CONTROL_ENABLE ) -tegra_dsi_disable (dsi); - err =tegra_dsi_prepare (dsi);if (err <0 ) {dev_err (dsi->dev,"failed to prepare: %d\n" , err);
Greg Kroah-Hartman
maintainerPATCH 36/175 Input: cros_ec_keyb - fix an invalid memory access
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
commit e08969c4d65ac31297fcb4d31d4808c789152f68 upstream.
If cros_ec_keyb_register_matrix() isn't called (due to buttons_switches_only) in cros_ec_keyb_probe(), ckdev->idev remains NULL. An invalid memory access is observed in cros_ec_keyb_process() when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work() in such case.
Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: input_event cros_ec_keyb_work blocking_notifier_call_chain ec_irq_thread
It's still unknown about why the kernel receives such malformed event, in any cases, the kernel shouldn't access ckdev->idev and friends if the driver doesn't intend to initialize them.
--- drivers/input/keyboard/cros_ec_keyb.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/keyboard/cros_ec_keyb.c +6 -0
@@ -261,6 +261,12 @@ static int cros_ec_keyb_work(struct noticase EC_MKBP_EVENT_KEY_MATRIX :pm_wakeup_event (ckdev->dev,0 ); +if (!ckdev->idev) { +dev_warn_once (ckdev->dev, +"Unexpected key matrix event\n" ); +return NOTIFY_OK ; + } +if (ckdev->ec->event_size != ckdev->cols) {dev_err (ckdev->dev,"Discarded incomplete key matrix event.\n" );
Greg Kroah-Hartman
maintainerPATCH 37/175 Input: goodix - add support for ACPI ID GDIX1003
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit c6d99e488117201c63efd747ce17b80687c3f5a9 upstream.
Some newer devices use an ACPI hardware ID of GDIX1003 for their Goodix touchscreen controller, instead of GDIX1001 / GDIX1002. Add GDIX1003 to the goodix_acpi_match[] table.
--- drivers/input/touchscreen/goodix.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/touchscreen/goodix.c +1 -0
@@ -1557,6 +1557,7 @@ MODULE_DEVICE_TABLE(i2c, goodix_ts_id);static const struct acpi_device_id goodix_acpi_match[] = { {"GDIX1001" ,0 }, {"GDIX1002" ,0 }, + {"GDIX1003" ,0 }, {"GDX9110" ,0 }, { } };
Greg Kroah-Hartman
maintainerPATCH 38/175 Input: imx_sc_key - fix memory corruption on unload
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4 upstream.
This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.
--- drivers/input/keyboard/imx_sc_key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/keyboard/imx_sc_key.c +1 -1
@@ -158,7 +158,7 @@ static int imx_sc_key_probe(struct platfreturn error; } - error =devm_add_action_or_reset (&pdev->dev, imx_sc_key_action, &priv); + error =devm_add_action_or_reset (&pdev->dev, imx_sc_key_action, priv);if (error)return error;
Greg Kroah-Hartman
maintainerPATCH 39/175 Input: pegasus-notetaker - fix potential out-of-bounds access
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
commit 69aeb507312306f73495598a055293fa749d454e upstream.
In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer.
Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access.
--- drivers/input/tablet/pegasus_notetaker.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/input/tablet/pegasus_notetaker.c +9 -0
@@ -63,6 +63,9 @@#define BUTTON_PRESSED 0xb5#define COMMAND_VERSION 0xa9 +/* 1 Status + 1 Color + 2 X + 2 Y = 6 bytes */ +#define NOTETAKER_PACKET_SIZE 6 +/* in xy data packet */ #define BATTERY_NO_REPORT 0x40#define BATTERY_LOW 0x41
@@ -311,6 +314,12 @@ static int pegasus_probe(struct usb_inte } pegasus->data_len =usb_maxpacket (dev, pipe); +if (pegasus->data_len <NOTETAKER_PACKET_SIZE ) { +dev_err (&intf->dev,"packet size is too small (%d)\n" , + pegasus->data_len); + error = -EINVAL ; + goto err_free_mem; + } pegasus->data =usb_alloc_coherent (dev, pegasus->data_len,GFP_KERNEL , &pegasus->data_dma);
Greg Kroah-Hartman
maintainerPATCH 40/175 mm/mempool: fix poisoning order>0 pages with HIGHMEM
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <[email protected]>
commit ec33b59542d96830e3c89845ff833cf7b25ef172 upstream.
The kernel test has reported:
BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page *pde = 03171067 *pte = 00000000 Oops: Oops: 0002 [#1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17) Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56 EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287 CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690 Call Trace: poison_element (mm/mempool.c:83 mm/mempool.c:102) mempool_init_node (mm/mempool.c:142 mm/mempool.c:226) mempool_init_noprof (mm/mempool.c:250 (discriminator 1)) ? mempool_alloc_pages (mm/mempool.c:640) bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8)) ? mempool_alloc_pages (mm/mempool.c:640) do_one_initcall (init/main.c:1283)
Christoph found out this is due to the poisoning code not dealing properly with CONFIG_HIGHMEM because only the first page is mapped but then the whole potentially high-order page is accessed.
We could give up on HIGHMEM here, but it's straightforward to fix this with a loop that's mapping, poisoning or checking and unmapping individual pages.
--- mm/mempool.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-)
mm/mempool.c +26 -6
@@ -68,10 +68,20 @@ static void check_element(mempool_t *poo }else if (pool->free == mempool_free_pages) {/* Mempools backed by page allocator */ int order = (int )(long )pool->pool_data; -void *addr =kmap_local_page ((struct page *)element); -__check_element (pool, addr,1UL << (PAGE_SHIFT + order)); -kunmap_local (addr); +#ifdef CONFIG_HIGHMEM +for (int i =0 ; i < (1 << order); i++) { +struct page *page = (struct page *)element; +void *addr =kmap_local_page (page + i); + +__check_element (pool, addr,PAGE_SIZE ); +kunmap_local (addr); + } +#else +void *addr =page_address ((struct page *)element); + +__check_element (pool, addr,PAGE_SIZE << order); +#endif } }
@@ -97,10 +107,20 @@ static void poison_element(mempool_t *po } else if (pool->alloc == mempool_alloc_pages) {/* Mempools backed by page allocator */ int order = (int )(long )pool->pool_data; -void *addr =kmap_local_page ((struct page *)element); -__poison_element (addr,1UL << (PAGE_SHIFT + order)); -kunmap_local (addr); +#ifdef CONFIG_HIGHMEM +for (int i =0 ; i < (1 << order); i++) { +struct page *page = (struct page *)element; +void *addr =kmap_local_page (page + i); + +__poison_element (addr,PAGE_SIZE ); +kunmap_local (addr); + } +#else +void *addr =page_address ((struct page *)element); + +__poison_element (addr,PAGE_SIZE << order); +#endif } }#else /* CONFIG_SLUB_DEBUG_ON */
Greg Kroah-Hartman
maintainerPATCH 41/175 nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 949f1fd2225baefbea2995afa807dba5cbdb6bd3 upstream.
nvkm_falcon_fw::boot is allocated, but no one frees it. This causes a kmemleak warning.
Make sure this data is deallocated.
--- drivers/gpu/drm/nouveau/nvkm/falcon/fw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/nouveau/nvkm/falcon/fw.c +2 -0
@@ -159,6 +159,8 @@ nvkm_falcon_fw_dtor(struct nvkm_falcon_fnvkm_memory_unref (&fw->inst);nvkm_falcon_fw_dtor_sigs (fw);nvkm_firmware_dtor (&fw->fw); +kfree (fw->boot); + fw->boot =NULL ; } static const struct nvkm_firmware_func
Greg Kroah-Hartman
maintainerPATCH 42/175 nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ewan D. Milne <[email protected]>
commit ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 upstream.
Now target is removed from nvme_fc_ctrl_free() which is the ctrl->ref release handler. And even admin queue is unquiesced there, this way is definitely wrong because the ctr->ref is grabbed when submitting command.
And Marco observed that nvme_fc_ctrl_free() can be called from request completion code path, and trigger kernel warning since request completes from softirq context.
Fix the issue by moveing target removal into nvme_fc_delete_ctrl(), which is also aligned with nvme-tcp and nvme-rdma.
Patch originally proposed by Ming Lei, then modified to move the tagset removal down to after nvme_fc_delete_association() after further testing.
--- drivers/nvme/host/fc.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/nvme/host/fc.c +7 -6
@@ -2355,17 +2355,11 @@ nvme_fc_ctrl_free(struct kref *ref) container_of(ref, struct nvme_fc_ctrl, ref);unsigned long flags; -if (ctrl->ctrl.tagset) -nvme_remove_io_tag_set (&ctrl->ctrl); -/* remove from rport list */ spin_lock_irqsave (&ctrl->rport->lock, flags);list_del (&ctrl->ctrl_list);spin_unlock_irqrestore (&ctrl->rport->lock, flags); -nvme_unquiesce_admin_queue (&ctrl->ctrl); -nvme_remove_admin_tag_set (&ctrl->ctrl); -kfree (ctrl->queues);put_device (ctrl->dev);
@@ -3261,11 +3255,18 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nccancel_work_sync (&ctrl->ioerr_work);cancel_delayed_work_sync (&ctrl->connect_work); +/* * kill the association on the link side. this will block * waiting for io to terminate */ nvme_fc_delete_association (ctrl); + +if (ctrl->ctrl.tagset) +nvme_remove_io_tag_set (&ctrl->ctrl); + +nvme_unquiesce_admin_queue (&ctrl->ctrl); +nvme_remove_admin_tag_set (&ctrl->ctrl); } static void
Greg Kroah-Hartman
maintainerPATCH 43/175 nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ewan D. Milne <[email protected]>
commit 0a2c5495b6d1ecb0fa18ef6631450f391a888256 upstream.
nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise the following can occur:
[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[ cut here ]------------ [ 1135.922336] kernel BUG at lib/list_debug.c:52! [ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary) [ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025 [ 1135.950969] Workqueue: 0x0 (nvme-wq) [ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b [ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046 [ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000 [ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0 [ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08 [ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100 [ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0 [ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000 [ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0 [ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1136.055910] PKRU: 55555554 [ 1136.058623] Call Trace: [ 1136.061074] <TASK> [ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.071898] ? move_linked_works+0x4a/0xa0 [ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.081744] ? __die_body.cold+0x8/0x12 [ 1136.085584] ? die+0x2e/0x50 [ 1136.088469] ? do_trap+0xca/0x110 [ 1136.091789] ? do_error_trap+0x65/0x80 [ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.101289] ? exc_invalid_op+0x50/0x70 [ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20 [ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.120806] move_linked_works+0x4a/0xa0 [ 1136.124733] worker_thread+0x216/0x3a0 [ 1136.128485] ? __pfx_worker_thread+0x10/0x10 [ 1136.132758] kthread+0xfa/0x240 [ 1136.135904] ? __pfx_kthread+0x10/0x10 [ 1136.139657] ret_from_fork+0x31/0x50 [ 1136.143236] ? __pfx_kthread+0x10/0x10 [ 1136.146988] ret_from_fork_asm+0x1a/0x30 [ 1136.150915] </TASK>
--- drivers/nvme/host/fc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/fc.c +1 -1
@@ -3253,7 +3253,6 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nc {struct nvme_fc_ctrl *ctrl =to_fc_ctrl (nctrl); -cancel_work_sync (&ctrl->ioerr_work);cancel_delayed_work_sync (&ctrl->connect_work);/*
@@ -3261,6 +3260,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nc* waiting for io to terminate */ nvme_fc_delete_association (ctrl); +cancel_work_sync (&ctrl->ioerr_work);if (ctrl->ctrl.tagset)nvme_remove_io_tag_set (&ctrl->ctrl);
Greg Kroah-Hartman
maintainerPATCH 44/175 PM: sleep: core: Fix runtime PM enabling in device_resume_early()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit f384497a76ed9539f70f6e8fe81a193441c943d2 upstream.
Runtime PM should only be enabled in device_resume_early() if it has been disabled for the given device by device_suspend_late(). Otherwise, it may cause runtime PM callbacks to run prematurely in some cases which leads to further functional issues.
Make two changes to address this problem.
First, reorder device_suspend_late() to only disable runtime PM for a device when it is going to look for the device's callback or if the device is a "syscore" one. In all of the other cases, disabling runtime PM for the device is not in fact necessary. However, if the device's callback returns an error and the power.is_late_suspended flag is not going to be set, enable runtime PM so it only remains disabled when power.is_late_suspended is set.
Second, make device_resume_early() only enable runtime PM for the devices with the power.is_late_suspended flag set.
--- drivers/base/power/main.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/base/power/main.c +16 -9
@@ -888,12 +888,15 @@ static void device_resume_early(struct device *dev, pm_message_t state, bool asyTRACE_DEVICE (dev);TRACE_RESUME (0 ); -if (dev->power.syscore || dev->power.direct_complete) +if (dev->power.direct_complete) goto Out;if (!dev->power.is_late_suspended) goto Out; +if (dev->power.syscore) + goto Skip; +if (!dpm_wait_for_superior (dev, async)) goto Out;
@@ -926,11 +929,11 @@ static void device_resume_early(struct device *dev, pm_message_t state, bool asy Skip: dev->power.is_late_suspended = false; +pm_runtime_enable (dev); Out:TRACE_RESUME (error); -pm_runtime_enable (dev);complete_all (&dev->power.completion);if (error) {
@@ -1615,12 +1618,6 @@ static void device_suspend_late(struct device *dev, pm_message_t state, bool asyTRACE_DEVICE (dev);TRACE_SUSPEND (0 ); -/* -* Disable runtime PM for the device without checking if there is a -* pending resume request for it. -*/ -__pm_runtime_disable (dev, false); -dpm_wait_for_subordinate (dev, async);if (READ_ONCE (async_error))
@@ -1631,9 +1628,18 @@ static void device_suspend_late(struct device *dev, pm_message_t state, bool asy goto Complete; } -if (dev->power.syscore || dev->power.direct_complete) +if (dev->power.direct_complete) goto Complete; +/* +* Disable runtime PM for the device without checking if there is a +* pending resume request for it. +*/ +__pm_runtime_disable (dev, false); + +if (dev->power.syscore) + goto Skip; +if (dev->pm_domain) { info ="late power domain " ; callback =pm_late_early_op (&dev->pm_domain->ops, state);
@@ -1664,6 +1670,7 @@ static void device_suspend_late(struct device *dev, pm_message_t state, bool asyWRITE_ONCE (async_error, error);dpm_save_failed_dev (dev_name (dev));pm_dev_err (dev, state, async ?" async late" :" late" , error); +pm_runtime_enable (dev); goto Complete; }dpm_propagate_wakeup_to_parent (dev);
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 45/175 sched_ext: Fix scx_enable() crash on helper kthread creation failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Kumar Bhaskar <[email protected]>
commit 7b6216baae751369195fa3c83d434d23bcda406a upstream.
A crash was observed when the sched_ext selftests runner was terminated with Ctrl+\ while test 15 was running:
NIP [c00000000028fa58] scx_enable.constprop.0+0x358/0x12b0 LR [c00000000028fa2c] scx_enable.constprop.0+0x32c/0x12b0
Call Trace: scx_enable.constprop.0+0x32c/0x12b0 (unreliable) bpf_struct_ops_link_create+0x18c/0x22c __sys_bpf+0x23f8/0x3044 sys_bpf+0x2c/0x6c system_call_exception+0x124/0x320 system_call_vectored_common+0x15c/0x2ec
kthread_run_worker() returns an ERR_PTR() on failure rather than NULL, but the current code in scx_alloc_and_add_sched() only checks for a NULL helper. Incase of failure on SIGQUIT, the error is not handled in scx_alloc_and_add_sched() and scx_enable() ends up dereferencing an error pointer.
Error handling is fixed in scx_alloc_and_add_sched() to propagate PTR_ERR() into ret, so that scx_enable() jumps to the existing error path, avoiding random dereference on failure.
--- kernel/sched/ext.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/sched/ext.c +4 -1
@@ -4446,8 +4446,11 @@ static struct scx_sched *scx_alloc_and_a goto err_free_gdsqs; sch->helper =kthread_run_worker (0 ,"sched_ext_helper" ); -if (!sch->helper) +if (IS_ERR (sch->helper)) { + ret =PTR_ERR (sch->helper); goto err_free_pcpu; + } +sched_set_fifo (sch->helper->task);atomic_set (&sch->exit_kind,SCX_EXIT_NONE );
Greg Kroah-Hartman
maintainerPATCH 46/175 scsi: sg: Do not sleep in atomic context
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 90449f2d1e1f020835cba5417234636937dd657e upstream.
sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled.
--- drivers/scsi/sg.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/scsi/sg.c +9 -1
@@ -2209,9 +2209,17 @@ sg_remove_sfp_usercontext(struct work_stwrite_lock_irqsave (&sfp->rq_list_lock, iflags);while (!list_empty (&sfp->rq_list)) { srp =list_first_entry (&sfp->rq_list, Sg_request, entry); -sg_finish_rem_req (srp);list_del (&srp->entry); +write_unlock_irqrestore (&sfp->rq_list_lock, iflags); + +sg_finish_rem_req (srp); +/* +* sg_rq_end_io() uses srp->parentfp. Hence, only clear +* srp->parentfp after blk_mq_free_request() has been called. +*/ srp->parentfp =NULL ; + +write_lock_irqsave (&sfp->rq_list_lock, iflags); }write_unlock_irqrestore (&sfp->rq_list_lock, iflags);
Greg Kroah-Hartman
maintainerPATCH 47/175 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamza Mahfooz <[email protected]>
commit e6965188f84a7883e6a0d3448e86b0cf29b24dfc upstream.
If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it.
Unable to allocate struct scsi_host
BUG: kernel NULL pointer dereference, address: 0000000000000194 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024 RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop] ... Call Trace: <TASK> configfs_read_iter+0x12d/0x1d0 [configfs] vfs_read+0x1b5/0x300 ksys_read+0x6f/0xf0
...
--- drivers/target/loopback/tcm_loop.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/target/loopback/tcm_loop.c +3 -0
@@ -894,6 +894,9 @@ static ssize_t tcm_loop_tpg_address_show struct tcm_loop_tpg, tl_se_tpg);struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba; +if (!tl_hba->sh) +return -ENODEV ; +return snprintf (page,PAGE_SIZE ,"%d:0:%d\n" , tl_hba->sh->host_no, tl_tpg->tl_tpgt); }
Greg Kroah-Hartman
maintainerPATCH 48/175 MIPS: Malta: Fix !EVA SOC-it PCI MMIO
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit ebd729fef31620e0bf74cbf8a4c7fda73a2a4e7e upstream.
Fix a regression that has caused accesses to the PCI MMIO window to complete unclaimed in non-EVA configurations with the SOC-it family of system controllers, preventing PCI devices from working that use MMIO.
In the non-EVA case PHYS_OFFSET is set to 0, meaning that PCI_BAR0 is set with an empty mask (and PCI_HEAD4 matches addresses starting from 0 accordingly). Consequently all addresses are matched for incoming DMA accesses from PCI. This seems to confuse the system controller's logic and outgoing bus cycles targeting the PCI MMIO window seem not to make it to the intended devices.
This happens as well when a wider mask is used with PCI_BAR0, such as 0x80000000 or 0xe0000000, that makes addresses match that overlap with the PCI MMIO window, which starts at 0x10000000 in our configuration.
Set the mask in PCI_BAR0 to 0xf0000000 for non-EVA then, covering the non-EVA maximum 256 MiB of RAM, which is what YAMON does and which used to work correctly up to the offending commit. Set PCI_P2SCMSKL to match PCI_BAR0 as required by the system controller's specification, and match PCI_P2SCMAPL to PCI_HEAD4 for identity mapping.
Verified with:
Core board type/revision = 0x0d (Core74K) / 0x01 System controller/revision = MIPS SOC-it 101 OCP / 1.3 SDR-FW-4:1 Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x1c Processor ID/revision = 0x97 (MIPS 74Kf) / 0x4c
for non-EVA and with:
Core board type/revision = 0x0c (CoreFPGA-5) / 0x00 System controller/revision = MIPS ROC-it2 / 0.0 FW-1:1 (CLK_unknown) GIC Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x00 Processor ID/revision = 0xa0 (MIPS interAptiv UP) / 0x20
for EVA/non-EVA, fixing:
defxx 0000:00:12.0: assign IRQ: got 10
defxx: v1.12 2021/03/10 Lawrence V. Stefani and others 0000:00:12.0: Could not read adapter factory MAC address!
vs:
defxx 0000:00:12.0: assign IRQ: got 10
defxx: v1.12 2021/03/10 Lawrence V. Stefani and others
0000:00:12.0: DEFPA at MMIO addr = 0x10142000, IRQ = 10, Hardware addr = 00-00-f8-xx-xx-xx 0000:00:12.0: registered as fddi0
for non-EVA and causing no change for EVA.
--- arch/mips/mti-malta/malta-init.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
arch/mips/mti-malta/malta-init.c +13 -7
@@ -241,16 +241,22 @@ mips_pci_controller:#endif /* -* Setup the Malta max (2GB) memory for PCI DMA in host bridge -* in transparent addressing mode. +* Set up memory mapping in host bridge for PCI DMA masters, +* in transparent addressing mode. For EVA use the Malta +* maximum of 2 GiB memory in the alias space at 0x80000000 +* as per PHYS_OFFSET. Otherwise use 256 MiB of memory in +* the regular space, avoiding mapping the PCI MMIO window +* for DMA as it seems to confuse the system controller's +* logic, causing PCI MMIO to stop working. */ - mask =PHYS_OFFSET |PCI_BASE_ADDRESS_MEM_PREFETCH ; -MSC_WRITE (MSC01_PCI_BAR0 , mask); -MSC_WRITE (MSC01_PCI_HEAD4 , mask); + mask =PHYS_OFFSET ?PHYS_OFFSET :0xf0000000 ; +MSC_WRITE (MSC01_PCI_BAR0 , + mask |PCI_BASE_ADDRESS_MEM_PREFETCH ); +MSC_WRITE (MSC01_PCI_HEAD4 , +PHYS_OFFSET |PCI_BASE_ADDRESS_MEM_PREFETCH ); - mask &=MSC01_PCI_BAR0_SIZE_MSK ;MSC_WRITE (MSC01_PCI_P2SCMSKL , mask); -MSC_WRITE (MSC01_PCI_P2SCMAPL , mask); +MSC_WRITE (MSC01_PCI_P2SCMAPL ,PHYS_OFFSET );/* Don't handle target retries indefinitely. */ if ((data & MSC01_PCI_CFG_MAXRTRY_MSK) ==
Greg Kroah-Hartman
maintainerPATCH 49/175 dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 316e361b5d2cdeb8d778983794a1c6eadcb26814 upstream.
The "groups" property can hold multiple entries (e.g. toshiba/tmpv7708-rm-mbrc.dts file), so allow that by dropping incorrect type (pinmux-node.yaml schema already defines that as string-array) and adding constraints for items. This fixes dtbs_check warnings like:
toshiba/tmpv7708-rm-mbrc.dtb: pinctrl@24190000 (toshiba,tmpv7708-pinctrl):
pwm-pins:groups: ['pwm0_gpio16_grp', 'pwm1_gpio17_grp', 'pwm2_gpio18_grp', 'pwm3_gpio19_grp'] is too long
--- Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml | 26 +++++----- 1 file changed, 14 insertions(+), 12 deletions(-)
Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml +14 -12
@@ -50,18 +50,20 @@ patternProperties: groups: description: Name of the pin group to use for the functions. - $ref: /schemas/types.yaml#/definitions/string - enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp, - i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp, - spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp, - spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp, - uart0_grp, uart1_grp, uart2_grp, uart3_grp, - pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp, - pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp, - pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp, - pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp, - pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp, - pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp] + items: + enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp, + i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp, + spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp, + spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp, + uart0_grp, uart1_grp, uart2_grp, uart3_grp, + pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp, + pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp, + pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp, + pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp, + pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp, + pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp] + minItems: 1 + maxItems: 8 drive-strength: enum: [2, 4, 6, 8, 16, 24, 32]
Greg Kroah-Hartman
maintainerPATCH 50/175 LoongArch: BPF: Disable trampoline for kernel module function trace
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Li <[email protected]>
commit 677e6123e3d24adaa252697dc89740f2ac07664e upstream.
The current LoongArch BPF trampoline implementation is incompatible with tracing functions in kernel modules. This causes several severe and user-visible problems:
* The bpf_selftests/module_attach test fails consistently.
* Kernel lockup when a BPF program is attached to a module function [1].
* Critical kernel modules like WireGuard experience traffic disruption when their functions are traced with fentry [2].
Given the severity and the potential for other unknown side-effects, it is safest to disable the feature entirely for now. This patch prevents the BPF subsystem from allowing trampoline attachments to kernel module functions on LoongArch.
This is a temporary mitigation until the core issues in the trampoline code for kernel module handling can be identified and fixed.
[root@fedora bpf]# ./test_progs -a module_attach -v bpf_testmod.ko is already unloaded.
Loading bpf_testmod.ko...
Successfully loaded bpf_testmod.ko. test_module_attach:PASS:skel_open 0 nsec test_module_attach:PASS:set_attach_target 0 nsec test_module_attach:PASS:set_attach_target_explicit 0 nsec test_module_attach:PASS:skel_load 0 nsec
libbpf: prog 'handle_fentry': failed to attach: -ENOTSUPP
libbpf: prog 'handle_fentry': failed to auto-attach: -ENOTSUPP test_module_attach:FAIL:skel_attach skeleton attach failed: -524
Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
Successfully unloaded bpf_testmod.ko.
[1]: https://lore.kernel.org/loongarch/CAK3+h2wDmpC-hP4u4pJY8T-yfKyk4yRzpu2LMO+C13FMT58oqQ@mail.gmail.com/
[2]: https://lore.kernel.org/loongarch/CAK3+h2wYcpc+OwdLDUBvg2rF9rvvyc5amfHT-KcFaK93uoELPg@mail.gmail.com/
--- arch/loongarch/net/bpf_jit.c | 3 +++ 1 file changed, 3 insertions(+)
arch/loongarch/net/bpf_jit.c +3 -0
@@ -1626,6 +1626,9 @@ static int __arch_prepare_bpf_trampoline/* Direct jump skips 5 NOP instructions */ else if (is_bpf_text_address((unsigned long)orig_call)) orig_call += LOONGARCH_BPF_FENTRY_NBYTES; +/* Module tracing not supported - cause kernel lockups */ + else if (is_module_text_address((unsigned long)orig_call)) + return -ENOTSUPP;if (flags &BPF_TRAMP_F_CALL_ORIG ) {move_addr (ctx,LOONGARCH_GPR_A0 , (const u64 )im);
Greg Kroah-Hartman
maintainerPATCH 51/175 LoongArch: Dont panic if no valid cache info for PCI
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit a6b533adfc05ba15360631e019d3e18275080275 upstream.
If there is no valid cache info detected (may happen in virtual machine) for pci_dfl_cache_line_size, kernel shouldn't panic. Because in the PCI core it will be evaluated to (L1_CACHE_BYTES >> 2).
--- arch/loongarch/pci/pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/loongarch/pci/pci.c +4 -4
@@ -50,11 +50,11 @@ static int __init pcibios_init(void)*/ lsize =cpu_last_level_cache_line_size (); -BUG_ON (!lsize); +if (lsize) { + pci_dfl_cache_line_size = lsize >>2 ; - pci_dfl_cache_line_size = lsize >>2 ; - -pr_debug ("PCI: pci_cache_line_size set to %d bytes\n" , lsize); +pr_debug ("PCI: pci_cache_line_size set to %d bytes\n" , lsize); + }return 0 ; }
Re: [PATCH 6.17 051/175] LoongArch: Dont panic if no valid cache info for PCI
Hi,Greg,
Quoted 6 lines
-----原始邮件-----
发件人: "Greg Kroah-Hartman" <[email protected]>
发送时间:2025-11-27 22:45:04 (星期四)
收件人: [email protected]
抄送: "Greg Kroah-Hartman" <[email protected]>, [email protected], "Jiaxun Yang" <[email protected]>, "Huacai Chen" <[email protected]> 主题: [PATCH 6.17 051/175] LoongArch: Dont panic if no valid cache info for PCI
Why Don't became Dont when backport this patch to stable branchs?
Huacai
Quoted 30 lines
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit
a6b533adfc05ba15360631e019d3e18275080275upstream.If there is no valid cache info detected (may happen in virtual machine) for
pci_dfl_cache_line_size, kernel shouldn't panic. Because in the PCI core it will be evaluated to (L1_CACHE_BYTES>> 2).Cc <[email protected]>Signed-off-by Jiaxun Yang <[email protected]>Signed-off-by Huacai Chen <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- arch/loongarch/pci/pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)arch/loongarch/pci/pci.c +1
-1@@ -50,11 +50,11 @@ static int __init pcibios_init(void)*/ lsize =cpu_last_level_cache_line_size (); -BUG_ON (!lsize); +if (lsize) {
arch/loongarch/pci/pci.c static int __init pcibios_init(void) · line 60
Quoted 10 lines
arch/loongarch/pci/pci.c +3
-3+ pci_dfl_cache_line_size = lsize >>2 ; - pci_dfl_cache_line_size = lsize >>2 ; - -pr_debug ("PCI: pci_cache_line_size set to %d bytes\n" , lsize); +pr_debug ("PCI: pci_cache_line_size set to %d bytes\n" , lsize); + }return 0 ; }
本邮件及其附件含有龙芯中科的商业秘密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制或散发）本邮件及其附件中的信息。如果您错收本邮件，请您立即电话或邮件通知发件人并删除本邮件。
This email and its attachments contain confidential information from Loongson Technology , which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this email in error, please notify the sender by phone or email immediately and delete it.
Greg Kroah-Hartman
maintainerRe: [PATCH 6.17 051/175] LoongArch: Dont panic if no valid cache info for PCI
Quoted 10 lines · 陈华才
Hi,Greg,
Quoted 6 lines
-----原始邮件-----
发件人: "Greg Kroah-Hartman" <[email protected]>
发送时间:2025-11-27 22:45:04 (星期四)
收件人: [email protected]
抄送: "Greg Kroah-Hartman" <[email protected]>, [email protected], "Jiaxun Yang" <[email protected]>, "Huacai Chen" <[email protected]> 主题: [PATCH 6.17 051/175] LoongArch: Dont panic if no valid cache info for PCIWhy Don't became Dont when backport this patch to stable branchs?
Odd, I do not know.
Quoted 2 lines
本邮件及其附件含有龙芯中科的商业秘密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制或散发）本邮件及其附件中的信息。如果您错收本邮件，请您立即电话或邮件通知发件人并删除本邮件。
This email and its attachments contain confidential information from Loongson Technology , which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this email in error, please notify the sender by phone or email immediately and delete it.
Oops, now deleted!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 52/175 LoongArch: Fix NUMA node parsing with numa_memblks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit acf5de1b23b0275eb69f235c8e9f2cef19fa39a1 upstream.
On physical machine, NUMA node id comes from high bit 44:48 of physical address. However it is not true on virt machine. With general method, it comes from ACPI SRAT table.
Here the common function numa_memblks_init() is used to parse NUMA node information with numa_memblks.
--- arch/loongarch/kernel/numa.c | 60 ++++++++++++------------------------------- 1 file changed, 18 insertions(+), 42 deletions(-)
arch/loongarch/kernel/numa.c +18 -42
@@ -158,35 +158,9 @@ static void __init node_mem_init(unsigne#ifdef CONFIG_ACPI_NUMA -/* -* add_numamem_region -* -* Add a uasable memory region described by BIOS. The -* routine gets each intersection between BIOS's region -* and node's region, and adds them into node's memblock -* pool. -* -*/ -static void __init add_numamem_region (u64 start,u64 end,u32 type) -{ -u32 node =pa_to_nid (start); -u64 size = end - start; -static unsigned long num_physpages; - -if (start >= end) { -pr_debug ("Invalid region: %016llx-%016llx\n" , start, end); -return ; - } - - num_physpages += (size >>PAGE_SHIFT ); -pr_info ("Node%d: mem_type:%d, mem_start:0x%llx, mem_size:0x%llx Bytes\n" , - node, type, start, size); -pr_info (" start_pfn:0x%llx, end_pfn:0x%llx, num_physpages:0x%lx\n" , - start >>PAGE_SHIFT , end >>PAGE_SHIFT , num_physpages); -memblock_set_node (start, size, &memblock.memory, node); -} +static unsigned long num_physpages; -static void __init init_node_memblock (void ) +static void __init info_node_memblock (void ) {u32 mem_type;u64 mem_end, mem_start, mem_size;
@@ -206,12 +180,20 @@ static void __init init_node_memblock(vocase EFI_BOOT_SERVICES_DATA :case EFI_PERSISTENT_MEMORY :case EFI_CONVENTIONAL_MEMORY : -add_numamem_region (mem_start, mem_end, mem_type); + num_physpages += (mem_size >>PAGE_SHIFT ); +pr_info ("Node%d: mem_type:%d, mem_start:0x%llx, mem_size:0x%llx Bytes\n" , + (u32 )pa_to_nid (mem_start), mem_type, mem_start, mem_size); +pr_info (" start_pfn:0x%llx, end_pfn:0x%llx, num_physpages:0x%lx\n" , + mem_start >>PAGE_SHIFT , mem_end >>PAGE_SHIFT , num_physpages);break ;case EFI_PAL_CODE :case EFI_UNUSABLE_MEMORY :case EFI_ACPI_RECLAIM_MEMORY : -add_numamem_region (mem_start, mem_end, mem_type); + num_physpages += (mem_size >>PAGE_SHIFT ); +pr_info ("Node%d: mem_type:%d, mem_start:0x%llx, mem_size:0x%llx Bytes\n" , + (u32 )pa_to_nid (mem_start), mem_type, mem_start, mem_size); +pr_info (" start_pfn:0x%llx, end_pfn:0x%llx, num_physpages:0x%lx\n" , + mem_start >>PAGE_SHIFT , mem_end >>PAGE_SHIFT , num_physpages); fallthrough;case EFI_RESERVED_TYPE :case EFI_RUNTIME_SERVICES_CODE :
@@ -249,22 +231,16 @@ int __init init_numa_memory(void)for (i =0 ; i <NR_CPUS ; i++)set_cpuid_to_node (i,NUMA_NO_NODE ); -numa_reset_distance (); -nodes_clear (numa_nodes_parsed); -nodes_clear (node_possible_map); -nodes_clear (node_online_map); -WARN_ON (memblock_clear_hotplug (0 ,PHYS_ADDR_MAX )); -/* Parse SRAT and SLIT if provided by firmware. */ - ret = acpi_disabled ?fake_numa_init () :acpi_numa_init (); +if (!acpi_disabled) + ret =numa_memblks_init (acpi_numa_init, false); +else + ret =numa_memblks_init (fake_numa_init, false); +if (ret <0 )return ret; - node_possible_map = numa_nodes_parsed; -if (WARN_ON (nodes_empty (node_possible_map))) -return -EINVAL ; - -init_node_memblock (); +info_node_memblock ();if (!memblock_validate_numa_coverage (SZ_1M ))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 53/175 platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
commit bd4f9f113dda07293ed4002a17d14f62121d324f upstream.
Quirks are matched using dmi_first_match(), therefore move the "Alienware m16 R1 AMD" entry above other m16 entries.
--- drivers/platform/x86/dell/alienware-wmi-wmax.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/platform/x86/dell/alienware-wmi-wmax.c +6 -6
@@ -122,20 +122,20 @@ static const struct dmi_system_id awcc_d .driver_data = &generic_quirks, }, { - .ident = "Alienware m16 R1", + .ident = "Alienware m16 R1 AMD", .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Alienware" ), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m16 R1"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m16 R1 AMD"), }, - .driver_data = &g_series_quirks, + .driver_data = &generic_quirks, }, { - .ident ="Alienware m16 R1 AMD" , + .ident ="Alienware m16 R1" , .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Alienware" ), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m16 R1 AMD"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m16 R1"), }, - .driver_data = &generic_quirks, + .driver_data = &g_series_quirks, }, { .ident = "Alienware m16 R2",
Greg Kroah-Hartman
maintainerPATCH 54/175 platform/x86: alienware-wmi-wmax: Add support for the whole "M" family
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
commit e8c3c875e1017c04c594f0e6127ba82095b1cb87 upstream.
Add support for the whole "Alienware M" laptop family.
--- drivers/platform/x86/dell/alienware-wmi-wmax.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-)
drivers/platform/x86/dell/alienware-wmi-wmax.c +6 -14
@@ -106,18 +106,10 @@ static const struct dmi_system_id awcc_d .driver_data = &generic_quirks, }, { - .ident = "Alienware m15 R5", + .ident = "Alienware m15", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Alienware"), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m15 R5"), - }, - .driver_data = &generic_quirks, - }, - { - .ident = "Alienware m15 R7", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Alienware"), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m15 R7"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m15"), }, .driver_data = &generic_quirks, },
@@ -146,18 +138,18 @@ static const struct dmi_system_id awcc_d .driver_data = &generic_quirks, }, { - .ident = "Alienware m17 R5", + .ident = "Alienware m17", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Alienware"), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m17 R5 AMD"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m17"), }, .driver_data = &generic_quirks, }, { - .ident = "Alienware m18 R2", + .ident = "Alienware m18", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Alienware"), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m18 R2"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m18"), }, .driver_data = &generic_quirks, },
Greg Kroah-Hartman
maintainerPATCH 55/175 platform/x86: alienware-wmi-wmax: Add support for the whole "X" family
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
commit 21ebfff1cf4727bc325c89b94ed93741f870744f upstream.
Add support for the whole "Alienware X" laptop family.
--- drivers/platform/x86/dell/alienware-wmi-wmax.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/platform/x86/dell/alienware-wmi-wmax.c +4 -12
@@ -154,26 +154,18 @@ static const struct dmi_system_id awcc_d .driver_data = &generic_quirks, }, { - .ident = "Alienware x15 R1", + .ident = "Alienware x15", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Alienware"), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware x15 R1"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware x15"), }, .driver_data = &generic_quirks, }, { - .ident = "Alienware x15 R2", + .ident = "Alienware x17", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Alienware"), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware x15 R2"), - }, - .driver_data = &generic_quirks, - }, - { - .ident = "Alienware x17 R2", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Alienware"), - DMI_MATCH(DMI_PRODUCT_NAME, "Alienware x17 R2"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware x17"), }, .driver_data = &generic_quirks, },
Greg Kroah-Hartman
maintainerPATCH 56/175 platform/x86: alienware-wmi-wmax: Add support for the whole "G" family
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
commit a6003d90f02863898babbcb3f55b1cd33f7867c2 upstream.
Add support for the whole "Dell G" laptop family.
--- drivers/platform/x86/dell/alienware-wmi-wmax.c | 56 +++---------------------- 1 file changed, 8 insertions(+), 48 deletions(-)
drivers/platform/x86/dell/alienware-wmi-wmax.c +8 -48
@@ -170,74 +170,34 @@ static const struct dmi_system_id awcc_d .driver_data = &generic_quirks, }, { - .ident = "Dell Inc. G15 5510", + .ident = "Dell Inc. G15", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5510"), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15"), }, .driver_data = &g_series_quirks, }, { - .ident = "Dell Inc. G15 5511", + .ident = "Dell Inc. G16", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5511"), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell G16"), }, .driver_data = &g_series_quirks, }, { - .ident = "Dell Inc. G15 5515", + .ident = "Dell Inc. G3", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5515"), + DMI_MATCH(DMI_PRODUCT_NAME, "G3"), }, .driver_data = &g_series_quirks, }, { - .ident = "Dell Inc. G15 5530", + .ident = "Dell Inc. G5", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5530"), - }, - .driver_data = &g_series_quirks, - }, - { - .ident = "Dell Inc. G16 7630", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "Dell G16 7630"), - }, - .driver_data = &g_series_quirks, - }, - { - .ident = "Dell Inc. G3 3500", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "G3 3500"), - }, - .driver_data = &g_series_quirks, - }, - { - .ident = "Dell Inc. G3 3590", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "G3 3590"), - }, - .driver_data = &g_series_quirks, - }, - { - .ident = "Dell Inc. G5 5500", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "G5 5500"), - }, - .driver_data = &g_series_quirks, - }, - { - .ident = "Dell Inc. G5 5505", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "G5 5505"), + DMI_MATCH(DMI_PRODUCT_NAME, "G5"), }, .driver_data = &g_series_quirks, },
Greg Kroah-Hartman
maintainerPATCH 57/175 platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Wong <[email protected]>
commit 6f91ad24c6639220f2edb0ad8edb199b43cc3b22 upstream.
Add AWCC support to Alienware 16 Aurora
--- drivers/platform/x86/dell/alienware-wmi-wmax.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/platform/x86/dell/alienware-wmi-wmax.c +8 -0
@@ -90,6 +90,14 @@ static struct awcc_quirks empty_quirks;static const struct dmi_system_id awcc_dmi_table[]__initconst = { { + .ident ="Alienware 16 Aurora" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Alienware" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Alienware 16 Aurora" ), + }, + .driver_data = &g_series_quirks, + }, + { .ident ="Alienware Area-51m" , .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Alienware" ),
Greg Kroah-Hartman
maintainerPATCH 58/175 mptcp: fix race condition in mptcp_schedule_work()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 035bca3f017ee9dea3a5a756e77a6f7138cc6eea upstream.
syzbot reported use-after-free in mptcp_schedule_work() [1]
Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker().
[A] if (schedule_work(...)) {
[B] sock_hold(sk);
return true;
}Problem is that mptcp_worker() can run immediately and complete before [B]
We need instead :
sock_hold(sk);
if (schedule_work(...))
return true;
sock_put(sk);[1]refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
--- net/mptcp/protocol.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/mptcp/protocol.c +12 -7
@@ -895,14 +895,19 @@ static void mptcp_reset_rtx_timer(structbool mptcp_schedule_work (struct sock *sk) { -if (inet_sk_state_load (sk) !=TCP_CLOSE && -schedule_work (&mptcp_sk (sk)->work)) { -/* each subflow already holds a reference to the sk, and the -* workqueue is invoked by a subflow, so sk can't go away here. -*/ -sock_hold (sk); +if (inet_sk_state_load (sk) ==TCP_CLOSE ) +return false; + +/* Get a reference on this socket, mptcp_worker() will release it. +* As mptcp_worker() might complete before us, we can not avoid +* a sock_hold()/sock_put() if schedule_work() returns false. +*/ +sock_hold (sk); + +if (schedule_work (&mptcp_sk (sk)->work))return true; - } + +sock_put (sk);return false; }
Greg Kroah-Hartman
maintainerPATCH 59/175 mptcp: fix a race in mptcp_pm_del_add_timer()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 426358d9be7ce3518966422f87b96f1bad27295f upstream.
mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot.
Add RCU protection to fix this issue.
Also change confusing add_timer variable with stop_timer boolean.
syzbot report:
BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616
Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44
CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events mptcp_worker
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616
sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631
mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362
mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174
tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361
tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441
tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931
tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374
ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6079 [inline]
__netif_receive_skb+0x143/0x380 net/core/dev.c:6192
process_backlog+0x31e/0x900 net/core/dev.c:6544
__napi_poll+0xb6/0x540 net/core/dev.c:7594
napi_poll net/core/dev.c:7657 [inline]
net_rx_action+0x5f7/0xda0 net/core/dev.c:7784
handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
__local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302
mptcp_pm_send_ack net/mptcp/pm.c:210 [inline]
mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1
mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002
mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 44:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417
kasan_kmalloc include/linux/kasan.h:262 [inline]
__kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748
kmalloc_noprof include/linux/slab.h:957 [inline]
mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385
mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355
mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline]
__mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529
mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008
mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6630:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2523 [inline]
slab_free mm/slub.c:6611 [inline]
kfree+0x197/0x950 mm/slub.c:6818
mptcp_remove_anno_list_by_saddr+0x2d/0x40 net/mptcp/pm.c:158
mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_kernel.c:1209 [inline]
mptcp_nl_flush_addrs_list net/mptcp/pm_kernel.c:1240 [inline]
mptcp_pm_nl_flush_addrs_doit+0x593/0xbb0 net/mptcp/pm_kernel.c:1281
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742
____sys_sendmsg+0x508/0x820 net/socket.c:2630
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684
__sys_sendmsg net/socket.c:2716 [inline]
__do_sys_sendmsg net/socket.c:2721 [inline]
__se_sys_sendmsg net/socket.c:2719 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/mptcp/pm.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
net/mptcp/pm.c +13 -7
@@ -18,6 +18,7 @@ struct mptcp_pm_add_entry {u8 retrans_times;struct timer_list add_timer;struct mptcp_sock *sock; +struct rcu_head rcu; };static DEFINE_SPINLOCK (mptcp_pm_list_lock);
@@ -155,7 +156,7 @@ bool mptcp_remove_anno_list_by_saddr(str entry =mptcp_pm_del_add_timer (msk, addr, false); ret = entry; -kfree (entry); +kfree_rcu (entry, rcu);return ret; }
@@ -324,22 +325,27 @@ mptcp_pm_del_add_timer(struct mptcp_sock {struct mptcp_pm_add_entry *entry;struct sock *sk = (struct sock *)msk; -struct timer_list *add_timer =NULL ; +bool stop_timer = false; + +rcu_read_lock ();spin_lock_bh (&msk->pm.lock); entry =mptcp_lookup_anno_list_by_saddr (msk, addr);if (entry && (!check_id || entry->addr.id == addr->id)) { entry->retrans_times =ADD_ADDR_RETRANS_MAX ; - add_timer = &entry->add_timer; + stop_timer = true; }if (!check_id && entry)list_del (&entry->list);spin_unlock_bh (&msk->pm.lock); -/* no lock, because sk_stop_timer_sync() is calling timer_delete_sync() */ -if (add_timer) -sk_stop_timer_sync (sk, add_timer); +/* Note: entry might have been removed by another thread. +* We hold rcu_read_lock() to ensure it is not freed under us. +*/ +if (stop_timer) +sk_stop_timer_sync (sk, &entry->add_timer); +rcu_read_unlock ();return entry; }
@@ -395,7 +401,7 @@ static void mptcp_pm_free_anno_list(strulist_for_each_entry_safe (entry, tmp, &free_list, list) {sk_stop_timer_sync (sk, &entry->add_timer); -kfree (entry); +kfree_rcu (entry, rcu); } }
Greg Kroah-Hartman
maintainerPATCH 60/175 mptcp: fix ack generation for fallback msk
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 5e15395f6d9ec07395866c5511f4b4ac566c0c9b upstream.
mptcp_cleanup_rbuf() needs to know the last most recent, mptcp-level rcv_wnd sent, and such information is tracked into the msk->old_wspace field, updated at ack transmission time by mptcp_write_options().
Fallback socket do not add any mptcp options, such helper is never invoked, and msk->old_wspace value remain stale. That in turn makes ack generation at recvmsg() time quite random.
Address the issue ensuring mptcp_write_options() is invoked even for fallback sockets, and just update the needed info in such a case.
The issue went unnoticed for a long time, as mptcp currently overshots the fallback socket receive buffer autotune significantly. It is going to change in the near future.
--- net/mptcp/options.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
net/mptcp/options.c +22 -1
@@ -838,8 +838,11 @@ bool mptcp_established_options(struct so opts->suboptions =0 ; +/* Force later mptcp_write_options(), but do not use any actual +* option space. +*/ if (unlikely (__mptcp_check_fallback (msk) && !mptcp_check_infinite_map (skb))) -return false; +return true;if (unlikely (skb &&TCP_SKB_CB (skb)->tcp_flags &TCPHDR_RST )) { if (mptcp_established_options_fastclose(sk, &opt_size, remaining, opts) ||
@@ -1319,6 +1322,20 @@ update_wspace:WRITE_ONCE (msk->old_wspace, tp->rcv_wnd); } +static void mptcp_track_rwin (struct tcp_sock *tp) +{ +const struct sock *ssk = (const struct sock *)tp; +struct mptcp_subflow_context *subflow; +struct mptcp_sock *msk; + +if (!ssk) +return ; + + subflow =mptcp_subflow_ctx (ssk); + msk =mptcp_sk (subflow->conn); +WRITE_ONCE (msk->old_wspace, tp->rcv_wnd); +} +__sum16 __mptcp_make_csum (u64 data_seq,u32 subflow_seq,u16 data_len,__wsum sum) {struct csum_pseudo_header header;
@@ -1611,6 +1628,10 @@ mp_rst: opts->reset_transient, opts->reset_reason);return ; + }else if (unlikely (!opts->suboptions)) { +/* Fallback to TCP */ +mptcp_track_rwin (tp); +return ; }if (OPTION_MPTCP_PRIO & opts->suboptions) {
Greg Kroah-Hartman
maintainerPATCH 61/175 mptcp: fix duplicate reset on fastclose
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit ae155060247be8dcae3802a95bd1bdf93ab3215d upstream.
The CI reports sporadic failures of the fastclose self-tests. The root cause is a duplicate reset, not carrying the relevant MPTCP option. In the failing scenario the bad reset is received by the peer before the fastclose one, preventing the reception of the latter.
Indeed there is window of opportunity at fastclose time for the following race:
mptcp_do_fastclose
__mptcp_close_ssk
__tcp_close()
tcp_set_state() [1]
tcp_send_active_reset() [2]After [1] the stack will send reset to in-flight data reaching the now closed port. Such reset may race with [2].
Address the issue explicitly sending a single reset on fastclose before explicitly moving the subflow to close status.
--- net/mptcp/protocol.c | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-)
net/mptcp/protocol.c +23 -13
@@ -2377,7 +2377,6 @@ bool __mptcp_retransmit_pending_data(str/* flags for __mptcp_close_ssk() */ #define MPTCP_CF_PUSH BIT(1) -#define MPTCP_CF_FASTCLOSE BIT(2)/* be sure to send a reset only if the caller asked for it, also * clean completely the subflow status when the subflow reaches
@@ -2388,7 +2387,7 @@ static void __mptcp_subflow_disconnect(s unsigned int flags) {if (((1 << ssk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN )) || - (flags &MPTCP_CF_FASTCLOSE )) { + subflow->send_fastclose) {/* The MPTCP code never wait on the subflow sockets, TCP-level * disconnect should never fail */
@@ -2435,14 +2434,8 @@ static void __mptcp_close_ssk(struct soclock_sock_nested (ssk,SINGLE_DEPTH_NESTING ); -if ((flags &MPTCP_CF_FASTCLOSE ) && !__mptcp_check_fallback (msk)) { -/* be sure to force the tcp_close path -* to generate the egress reset -*/ - ssk->sk_lingertime =0 ; -sock_set_flag (ssk,SOCK_LINGER ); - subflow->send_fastclose =1 ; - } +if (subflow->send_fastclose && ssk->sk_state !=TCP_CLOSE ) +tcp_set_state (ssk,TCP_CLOSE ); need_push = (flags &MPTCP_CF_PUSH ) &&__mptcp_retransmit_pending_data (sk);if (!dispose_it) {
@@ -2745,9 +2738,26 @@ static void mptcp_do_fastclose(struct sostruct mptcp_sock *msk =mptcp_sk (sk);mptcp_set_state (sk,TCP_CLOSE ); -mptcp_for_each_subflow_safe (msk, subflow, tmp) -__mptcp_close_ssk (sk,mptcp_subflow_tcp_sock (subflow), - subflow,MPTCP_CF_FASTCLOSE ); + +/* Explicitly send the fastclose reset as need */ +if (__mptcp_check_fallback (msk)) +return ; + +mptcp_for_each_subflow_safe (msk, subflow, tmp) { +struct sock *ssk =mptcp_subflow_tcp_sock (subflow); + +lock_sock (ssk); + +/* Some subflow socket states don't allow/need a reset.*/ +if ((1 << ssk->sk_state) & (TCPF_LISTEN |TCPF_CLOSE )) + goto unlock; + + subflow->send_fastclose =1 ; +tcp_send_active_reset (ssk, ssk->sk_allocation, +SK_RST_REASON_TCP_ABORT_ON_CLOSE ); +unlock: +release_sock (ssk); + } }static void mptcp_worker (struct work_struct *work)
Greg Kroah-Hartman
maintainerPATCH 62/175 mptcp: fix premature close in case of fallback
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 17393fa7b7086664be519e7230cb6ed7ec7d9462 upstream.
I'm observing very frequent self-tests failures in case of fallback when running on a CONFIG_PREEMPT kernel.
The root cause is that subflow_sched_work_if_closed() closes any subflow as soon as it is half-closed and has no incoming data pending.
That works well for regular subflows - MPTCP needs bi-directional connectivity to operate on a given subflow - but for fallback socket is race prone.
When TCP peer closes the connection before the MPTCP one, subflow_sched_work_if_closed() will schedule the MPTCP worker to gracefully close the subflow, and shortly after will do another schedule to inject and process a dummy incoming DATA_FIN.
On CONFIG_PREEMPT kernel, the MPTCP worker can kick-in and close the fallback subflow before subflow_sched_work_if_closed() is able to create the dummy DATA_FIN, unexpectedly interrupting the transfer.
Address the issue explicitly avoiding closing fallback subflows on when the peer is only half-closed.
Note that, when the subflow is able to create the DATA_FIN before the worker invocation, the worker will change the msk state before trying to close the subflow and will skip the latter operation as the msk will not match anymore the precondition in __mptcp_close_subflow().
--- net/mptcp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +2 -1
@@ -2531,7 +2531,8 @@ static void __mptcp_close_subflow(structif (ssk_state !=TCP_CLOSE && (ssk_state !=TCP_CLOSE_WAIT || -inet_sk_state_load (sk) !=TCP_ESTABLISHED )) +inet_sk_state_load (sk) !=TCP_ESTABLISHED || +__mptcp_check_fallback (msk)))continue ;/* 'subflow_data_ready' will re-sched once rx queue is empty */
Greg Kroah-Hartman
maintainerPATCH 63/175 selftests: mptcp: join: endpoints: longer timeout
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit fb13c6bb810ca871964e062cf91882d1c83db509 upstream.
In rare cases, when the test environment is very slow, some endpoints tests can fail because some expected events have not been seen.
Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to have a longer timeout, and even go over the default one. This connection will be killed at the end, after the verifications: increasing the timeout doesn't change anything, apart from avoiding it to end before the end of the verifications.
To play it safe, all endpoints tests not waiting for the end of the transfer are now having a longer timeout: 2 minutes.
The Fixes commit was making the connection longer, but still, the default timeout would have stopped it after 1 minute, which might not be enough in very slow environments.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +4 -4
@@ -3757,7 +3757,7 @@ endpoint_tests() pm_nl_set_limits $ns1 2 2 pm_nl_set_limits $ns2 2 2 pm_nl_add_endpoint $ns1 10.0.2.1 flags signal - { test_linkfail=128 speed=slow \ + { timeout_test=120 test_linkfail=128 speed=slow \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$!
@@ -3784,7 +3784,7 @@ endpoint_tests() pm_nl_set_limits $ns2 0 3 pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow - { test_linkfail=128 speed=5 \ + { timeout_test=120 test_linkfail=128 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$!
@@ -3862,7 +3862,7 @@ endpoint_tests() # broadcast IP: no packet for this address will be received on ns1 pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal - { test_linkfail=128 speed=5 \ + { timeout_test=120 test_linkfail=128 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$!
@@ -3935,7 +3935,7 @@ endpoint_tests() # broadcast IP: no packet for this address will be received on ns1 pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow - { test_linkfail=128 speed=20 \ + { timeout_test=120 test_linkfail=128 speed=20 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$!
Greg Kroah-Hartman
maintainerPATCH 64/175 selftests: mptcp: join: userspace: longer timeout
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 0e4ec14dc1ee4b1ec347729c225c3ca950f2bcf6 upstream.
In rare cases, when the test environment is very slow, some userspace tests can fail because some expected events have not been seen.
Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to have a longer timeout, and even go over the default one. This connection will be killed at the end, after the verifications: increasing the timeout doesn't change anything, apart from avoiding it to end before the end of the verifications.
To play it safe, all userspace tests not waiting for the end of the transfer are now having a longer timeout: 2 minutes.
The Fixes commit was making the connection longer, but still, the default timeout would have stopped it after 1 minute, which might not be enough in very slow environments.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +5 -5
@@ -3620,7 +3620,7 @@ userspace_tests() continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns1 pm_nl_set_limits $ns2 2 2 - { test_linkfail=128 speed=5 \ + { timeout_test=120 test_linkfail=128 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$! wait_mpj $ns1
@@ -3653,7 +3653,7 @@ userspace_tests() continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns2 pm_nl_set_limits $ns1 0 1 - { test_linkfail=128 speed=5 \ + { timeout_test=120 test_linkfail=128 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$! wait_mpj $ns2
@@ -3681,7 +3681,7 @@ userspace_tests() continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns2 pm_nl_set_limits $ns1 0 1 - { test_linkfail=128 speed=5 \ + { timeout_test=120 test_linkfail=128 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$! wait_mpj $ns2
@@ -3702,7 +3702,7 @@ userspace_tests() continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns2 pm_nl_set_limits $ns1 0 1 - { test_linkfail=128 speed=5 \ + { timeout_test=120 test_linkfail=128 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$! wait_mpj $ns2
@@ -3726,7 +3726,7 @@ userspace_tests() continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns1 pm_nl_set_limits $ns2 1 1 - { test_linkfail=128 speed=5 \ + { timeout_test=120 test_linkfail=128 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null local tests_pid=$! wait_mpj $ns1
Greg Kroah-Hartman
maintainerPATCH 65/175 mptcp: avoid unneeded subflow-level drops
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 4f102d747cadd8f595f2b25882eed9bec1675fb1 upstream.
The rcv window is shared among all the subflows. Currently, MPTCP sync the TCP-level rcv window with the MPTCP one at tcp_transmit_skb() time.
The above means that incoming data may sporadically observe outdated TCP-level rcv window and being wrongly dropped by TCP.
Address the issue checking for the edge condition before queuing the data at TCP level, and eventually syncing the rcv window as needed.
Note that the issue is actually present from the very first MPTCP implementation, but backports older than the blamed commit below will range from impossible to useless.
Before:
$ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow TcpExtBeyondWindow 14 0.0
After:
$ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow TcpExtBeyondWindow 0 0.0
--- net/mptcp/options.c | 31 +++++++++++++++++++++++++++++++ net/mptcp/protocol.h | 1 + 2 files changed, 32 insertions(+)
net/mptcp/options.c +31 -0
@@ -1044,6 +1044,31 @@ static void __mptcp_snd_una_update(strucWRITE_ONCE (msk->snd_una, new_snd_una); } +static void rwin_update (struct mptcp_sock *msk,struct sock *ssk, +struct sk_buff *skb) +{ +struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk); +struct tcp_sock *tp =tcp_sk (ssk); +u64 mptcp_rcv_wnd; + +/* Avoid touching extra cachelines if TCP is going to accept this +* skb without filling the TCP-level window even with a possibly +* outdated mptcp-level rwin. +*/ +if (!skb->len || skb->len <tcp_receive_window (tp)) +return ; + + mptcp_rcv_wnd =atomic64_read (&msk->rcv_wnd_sent); +if (!after64 (mptcp_rcv_wnd, subflow->rcv_wnd_sent)) +return ; + +/* Some other subflow grew the mptcp-level rwin since rcv_wup, +* resync. +*/ + tp->rcv_wnd += mptcp_rcv_wnd - subflow->rcv_wnd_sent; + subflow->rcv_wnd_sent = mptcp_rcv_wnd; +} +static void ack_update_msk (struct mptcp_sock *msk,struct sock *ssk,struct mptcp_options_received *mp_opt)
@@ -1211,6 +1236,7 @@ bool mptcp_incoming_options(struct sock*/ if (mp_opt.use_ack)ack_update_msk (msk, sk, &mp_opt); +rwin_update (msk, sk, skb);/* Zero-data-length packets are dropped by the caller and not * propagated to the MPTCP layer, so the skb extension does not
@@ -1297,6 +1323,10 @@ static void mptcp_set_rwin(struct tcp_soif (rcv_wnd_new != rcv_wnd_old) { raise_win: +/* The msk-level rcv wnd is after the tcp level one, +* sync the latter. +*/ + rcv_wnd_new = rcv_wnd_old; win = rcv_wnd_old - ack_seq; tp->rcv_wnd =min_t (u64, win,U32_MAX ); new_win = tp->rcv_wnd;
@@ -1320,6 +1350,7 @@ raise_win: update_wspace:WRITE_ONCE (msk->old_wspace, tp->rcv_wnd); + subflow->rcv_wnd_sent = rcv_wnd_new; }static void mptcp_track_rwin (struct tcp_sock *tp)
net/mptcp/protocol.h +1 -0
@@ -509,6 +509,7 @@ struct mptcp_subflow_context {u64 remote_key;u64 idsn;u64 map_seq; +u64 rcv_wnd_sent;u32 snd_isn;u32 token;u32 rel_write_seq;
Greg Kroah-Hartman
maintainerPATCH 66/175 mptcp: decouple mptcp fastclose from tcp close
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit fff0c87996672816a84c3386797a5e69751c5888 upstream.
With the current fastclose implementation, the mptcp_do_fastclose() helper is in charge of two distinct actions: send the fastclose reset and cleanup the subflows.
Formally decouple the two steps, ensuring that mptcp explicitly closes all the subflows after the mentioned helper.
This will make the upcoming fix simpler, and allows dropping the 2nd argument from mptcp_destroy_common(). The Fixes tag is then the same as in the next commit to help with the backports.
--- net/mptcp/protocol.c | 13 +++++++++---- net/mptcp/protocol.h | 2 +- 2 files changed, 10 insertions(+), 5 deletions(-)
net/mptcp/protocol.c +9 -4
@@ -2785,7 +2785,11 @@ static void mptcp_worker(struct work_str__mptcp_close_subflow (sk);if (mptcp_close_tout_expired (sk)) { +struct mptcp_subflow_context *subflow, *tmp; +mptcp_do_fastclose (sk); +mptcp_for_each_subflow_safe (msk, subflow, tmp) +__mptcp_close_ssk (sk, subflow->tcp_sock, subflow,0 );mptcp_close_wake_up (sk); }
@@ -3210,7 +3214,8 @@ static int mptcp_disconnect(struct sock/* msk->subflow is still intact, the following will not free the first * subflow */ -mptcp_destroy_common (msk,MPTCP_CF_FASTCLOSE ); +mptcp_do_fastclose (sk); +mptcp_destroy_common (msk);/* The first subflow is already in TCP_CLOSE status, the following * can't overlap with a fallback anymore
@@ -3389,7 +3394,7 @@ void mptcp_rcv_space_init(struct mptcp_s msk->rcvq_space.space =TCP_INIT_CWND *TCP_MSS_DEFAULT ; } -void mptcp_destroy_common (struct mptcp_sock *msk,unsigned int flags) +void mptcp_destroy_common (struct mptcp_sock *msk) {struct mptcp_subflow_context *subflow, *tmp;struct sock *sk = (struct sock *)msk;
@@ -3398,7 +3403,7 @@ void mptcp_destroy_common(struct mptcp_s/* join list will be eventually flushed (with rst) at sock lock release time */ mptcp_for_each_subflow_safe (msk, subflow, tmp) -__mptcp_close_ssk (sk,mptcp_subflow_tcp_sock (subflow), subflow, flags); +__mptcp_close_ssk (sk,mptcp_subflow_tcp_sock (subflow), subflow,0 );__skb_queue_purge (&sk->sk_receive_queue);skb_rbtree_purge (&msk->out_of_order_queue);
@@ -3416,7 +3421,7 @@ static void mptcp_destroy(struct sock *s/* allow the following to close even the initial subflow */ msk->free_first =1 ; -mptcp_destroy_common (msk,0 ); +mptcp_destroy_common (msk);sk_sockets_allocated_dec (sk); }
net/mptcp/protocol.h +1 -1
@@ -979,7 +979,7 @@ static inline void mptcp_propagate_sndbulocal_bh_enable (); } -void mptcp_destroy_common (struct mptcp_sock *msk,unsigned int flags); +void mptcp_destroy_common (struct mptcp_sock *msk);#define MPTCP_TOKEN_MAX_RETRIES 4
Greg Kroah-Hartman
maintainerPATCH 67/175 mptcp: do not fallback when OoO is present
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 upstream.
In case of DSS corruption, the MPTCP protocol tries to avoid the subflow reset if fallback is possible. Such corruptions happen in the receive path; to ensure fallback is possible the stack additionally needs to check for OoO data, otherwise the fallback will break the data stream.
--- net/mptcp/protocol.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/mptcp/protocol.c +7 -0
@@ -77,6 +77,13 @@ bool __mptcp_try_fallback(struct mptcp_sif (__mptcp_check_fallback (msk))return true; +/* The caller possibly is not holding the msk socket lock, but +* in the fallback case only the current subflow is touching +* the OoO queue. +*/ +if (!RB_EMPTY_ROOT (&msk->out_of_order_queue)) +return false; +spin_lock_bh (&msk->fallback_lock);if (!msk->allow_infinite_fallback) {spin_unlock_bh (&msk->fallback_lock);
Greg Kroah-Hartman
maintainerPATCH 68/175 drm/tegra: dc: Fix reference leak in tegra_dc_couple()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 4c5376b4b143c4834ebd392aef2215847752b16a upstream.
driver_find_device() calls get_device() to increment the reference count once a matching device is found, but there is no put_device() to balance the reference count. To avoid reference count leakage, add put_device() to decrease the reference count.
Found by code review.
--- drivers/gpu/drm/tegra/dc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/tegra/dc.c +1 -0
@@ -3148,6 +3148,7 @@ static int tegra_dc_couple(struct tegra_ dc->client.parent = &parent->client;dev_dbg (dc->dev,"coupled to %s\n" ,dev_name (companion)); +put_device (companion); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 69/175 drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert McClinton <[email protected]>
commit 9eb00b5f5697bd56baa3222c7a1426fa15bacfb5 upstream.
Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock.
dma-fence_ops::signaled can be called with the fence lock in unknown state. For radeon, the fence lock is also the wait queue lock. This can cause a self deadlock when signaled() tries to make forward progress on the wait queue. But advancing the queue is unneeded because incorrectly returning false from signaled() is perfectly acceptable.
--- drivers/gpu/drm/radeon/radeon_fence.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/gpu/drm/radeon/radeon_fence.c +0 -7
@@ -360,13 +360,6 @@ static bool radeon_fence_is_signaled(strif (atomic64_read (&rdev->fence_drv[ring].last_seq) >= seq)return true; -if (down_read_trylock (&rdev->exclusive_lock)) { -radeon_fence_process (rdev, ring); -up_read (&rdev->exclusive_lock); - -if (atomic64_read (&rdev->fence_drv[ring].last_seq) >= seq) -return true; - }return false; }
Greg Kroah-Hartman
maintainerPATCH 70/175 drm/plane: Fix create_in_format_blob() return value
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
commit cead55e24cf9e092890cf51c0548eccd7569defa upstream.
create_in_format_blob() is either supposed to return a valid pointer or an error, but never NULL. The caller will dereference the blob when it is not an error, and thus will oops if NULL returned. Return proper error values in the failure cases.
--- drivers/gpu/drm/drm_plane.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_plane.c +2 -2
@@ -210,7 +210,7 @@ static struct drm_property_blob *create_in_format_blob(struct drm_device *dev, formats_size =sizeof (__u32) * plane->format_count;if (WARN_ON (!formats_size)) {/* 0 formats are never expected */ -return 0 ; +return ERR_PTR (-EINVAL ); } modifiers_size =
@@ -226,7 +226,7 @@ static struct drm_property_blob *create_in_format_blob(struct drm_device *dev, blob =drm_property_create_blob (dev, blob_size,NULL );if (IS_ERR (blob)) -return NULL ; +return blob; blob_data = blob->data; blob_data->version =FORMAT_BLOB_CURRENT ;
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 71/175 drm/amd: Skip power ungate during suspend for VPE
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 31ab31433c9bd2f255c48dc6cb9a99845c58b1e4 upstream.
During the suspend sequence VPE is already going to be power gated as part of vpe_suspend(). It's unnecessary to call during calls to amdgpu_device_set_pg_state().
It actually can expose a race condition with the firmware if s0i3 sequence starts as well. Drop these calls.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -1
@@ -3360,10 +3360,11 @@ int amdgpu_device_set_pg_state(struct am (adev->ip_blocks[i].version->type ==AMD_IP_BLOCK_TYPE_GFX || adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_SDMA)) continue; -/* skip CG for VCE/UVD, it's handled specially */ +/* skip CG for VCE/UVD/VPE, it's handled specially */ if (adev->ip_blocks[i].version->type !=AMD_IP_BLOCK_TYPE_UVD && adev->ip_blocks[i].version->type !=AMD_IP_BLOCK_TYPE_VCE && adev->ip_blocks[i].version->type !=AMD_IP_BLOCK_TYPE_VCN && + adev->ip_blocks[i].version->type !=AMD_IP_BLOCK_TYPE_VPE && adev->ip_blocks[i].version->type !=AMD_IP_BLOCK_TYPE_JPEG && adev->ip_blocks[i].version->funcs->set_powergating_state) {/* enable powergating to save power */
Greg Kroah-Hartman
maintainerPATCH 72/175 drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifan Zha <[email protected]>
commit 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 upstream.
[Why]
Accoreding to CP updated to RS64 on gfx11,WRITE_DATA with PREEMPTION_META_MEMORY(dst_sel=8) is illegal for CP FW. That packet is used for MCBP on F32 based system.
So it would lead to incorrect GRBM write and FW is not handling that extra case correctly.
[How]
With gfx11 rs64 enabled, skip emit de meta data.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +2 -2
@@ -5874,9 +5874,9 @@ static void gfx_v11_0_ring_emit_ib_gfx(sif (flags &AMDGPU_IB_PREEMPTED ) control |=INDIRECT_BUFFER_PRE_RESUME (1 ); -if (vmid) +if (vmid && !ring->adev->gfx.rs64_enable)gfx_v11_0_ring_emit_de_meta (ring, - (!amdgpu_sriov_vf (ring->adev) && flags &AMDGPU_IB_PREEMPTED ) ? true : false); + !amdgpu_sriov_vf (ring->adev) && (flags &AMDGPU_IB_PREEMPTED )); }amdgpu_ring_write (ring, header);
Greg Kroah-Hartman
maintainerPATCH 73/175 drm/amd/display: Increase DPCD read retries
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 8612badc331bcab2068baefa69e1458085ed89e3 upstream.
[Why]
Empirical measurement of some monitors that fail to read EDID while booting shows that the number of retries with a 30ms delay between tries is as high as 16.
[How]
Increase number of retries to 20.
--- drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +1 -1
@@ -1691,7 +1691,7 @@ static bool retrieve_link_cap(struct dc_union edp_configuration_cap edp_config_cap;union dp_downstream_port_present ds_port = {0 };enum dc_status status =DC_ERROR_UNEXPECTED ; -uint32_t read_dpcd_retry_cnt =3 ; +uint32_t read_dpcd_retry_cnt =20 ;int i;struct dp_sink_hw_fw_revision dp_hw_fw_revision;const uint32_t post_oui_delay =30 ;// 30ms
Greg Kroah-Hartman
maintainerPATCH 74/175 drm/amd/display: Move sleep into each retry for retrieve_link_cap()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 71ad9054c1f241be63f9d11df8cbd0aa0352fe16 upstream.
[Why]
When a monitor is booting it's possible that it isn't ready to retrieve link caps and this can lead to an EDID read failure:
``` [drm:retrieve_link_cap [amdgpu]] *ERROR* retrieve_link_cap: Read receiver caps dpcd data failed. amdgpu 0000:c5:00.0: [drm] *ERROR* No EDID read. ```
[How]
Rather than msleep once and try a few times, msleep each time. Should be no changes for existing working monitors, but should correct reading caps on a monitor that is slow to boot.
--- drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +5 -4
@@ -1734,12 +1734,13 @@ static bool retrieve_link_cap(struct dc_ }dpcd_set_source_specific_data (link); -/* Sink may need to configure internals based on vendor, so allow some -* time before proceeding with possibly vendor specific transactions -*/ -msleep (post_oui_delay);for (i =0 ; i < read_dpcd_retry_cnt; i++) { +/* +* Sink may need to configure internals based on vendor, so allow some +* time before proceeding with possibly vendor specific transactions +*/ +msleep (post_oui_delay); status = core_link_read_dpcd( link, DP_DPCD_REV,
Greg Kroah-Hartman
maintainerPATCH 75/175 drm/amd/display: Fix pbn to kbps Conversion
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <[email protected]>
commit 1788ef30725da53face7e311cdf62ad65fababcd upstream.
[Why]
Existing routine has two conversion sequence, pbn_to_kbps and kbps_to_pbn with margin.
Non of those has without-margin calculation.
kbps_to_pbn with margin conversion includes fec overhead which has already been included in pbn_div calculation with 0.994 factor considered. It is a double counted fec overhead factor that causes potential bw loss.
[How]
Add without-margin calculation.
Fix fec overhead double counted issue.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 59 ++++-------- 1 file changed, 23 insertions(+), 36 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +23 -36
@@ -852,26 +852,28 @@ struct dsc_mst_fairness_params { };#if defined(CONFIG_DRM_AMD_DC_FP ) -static uint16_t get_fec_overhead_multiplier (struct dc_link *dc_link) +static uint64_t kbps_to_pbn (int kbps,bool is_peak_pbn) { -u8 link_coding_cap; -uint16_t fec_overhead_multiplier_x1000 =PBN_FEC_OVERHEAD_MULTIPLIER_8B_10B ; +uint64_t effective_kbps = (uint64_t )kbps; - link_coding_cap =dc_link_dp_mst_decide_link_encoding_format (dc_link); -if (link_coding_cap == DP_128b_132b_ENCODING) - fec_overhead_multiplier_x1000 =PBN_FEC_OVERHEAD_MULTIPLIER_128B_132B ; +if (is_peak_pbn) {// add 0.6% (1006/1000) overhead into effective kbps + effective_kbps *=1006 ; + effective_kbps =div_u64 (effective_kbps,1000 ); + } -return fec_overhead_multiplier_x1000; +return (uint64_t )DIV64_U64_ROUND_UP (effective_kbps *64 , (54 *8 *1000 )); } -static int kbps_to_peak_pbn (int kbps,uint16_t fec_overhead_multiplier_x1000) +static uint32_t pbn_to_kbps (unsigned int pbn,bool with_margin) { -u64 peak_kbps = kbps; +uint64_t pbn_effective = (uint64_t )pbn; + +if (with_margin)// deduct 0.6% (994/1000) overhead from effective pbn + pbn_effective *= (1000000 /PEAK_FACTOR_X1000 ); +else + pbn_effective *=1000 ; - peak_kbps *=1006 ; - peak_kbps *= fec_overhead_multiplier_x1000; - peak_kbps =div_u64 (peak_kbps,1000 *1000 ); -return (int )DIV64_U64_ROUND_UP (peak_kbps *64 , (54 *8 *1000 )); +return DIV_U64_ROUND_UP (pbn_effective *8 *54 ,64 ); } static void set_dsc_configs_from_fairness_vars(struct dsc_mst_fairness_params *params,
@@ -942,7 +944,7 @@ static int bpp_x16_from_pbn(struct dsc_mdc_dsc_get_default_config_option (param.sink->ctx->dc, &dsc_options); dsc_options.max_target_bpp_limit_override_x16 = drm_connector->display_info.max_dsc_bpp *16 ; - kbps =div_u64 ((u64 )pbn *994 *8 *54 ,64 ); + kbps =pbn_to_kbps (pbn, false); dc_dsc_compute_config( param.sink->ctx->dc->res_pool->dscs[0], ¶m.sink->dsc_caps.dsc_dec_caps,
@@ -971,12 +973,11 @@ static int increase_dsc_bpp(struct drm_aint link_timeslots_used;int fair_pbn_alloc;int ret =0 ; -uint16_t fec_overhead_multiplier_x1000 =get_fec_overhead_multiplier (dc_link);for (i =0 ; i < count; i++) {if (vars[i + k].dsc_enabled) { initial_slack[i] = -kbps_to_peak_pbn (params[i].bw_range.max_kbps, fec_overhead_multiplier_x1000) - vars[i + k].pbn; +kbps_to_pbn (params[i].bw_range.max_kbps, false) - vars[i + k].pbn; bpp_increased[i] = false; remaining_to_increase +=1 ; }else {
@@ -1072,7 +1073,6 @@ static int try_disable_dsc(struct drm_atint next_index;int remaining_to_try =0 ;int ret; -uint16_t fec_overhead_multiplier_x1000 =get_fec_overhead_multiplier (dc_link);int var_pbn;for (i =0 ; i < count; i++) {
@@ -1105,7 +1105,7 @@ static int try_disable_dsc(struct drm_atDRM_DEBUG_DRIVER ("MST_DSC index #%d, try no compression\n" , next_index); var_pbn = vars[next_index].pbn; - vars[next_index].pbn =kbps_to_peak_pbn (params[next_index].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + vars[next_index].pbn =kbps_to_pbn (params[next_index].bw_range.stream_kbps, true); ret = drm_dp_atomic_find_time_slots(state, params[next_index].port->mgr, params[next_index].port,
@@ -1165,7 +1165,6 @@ static int compute_mst_dsc_configs_for_lint count =0 ;int i, k, ret;bool debugfs_overwrite = false; -uint16_t fec_overhead_multiplier_x1000 =get_fec_overhead_multiplier (dc_link);struct drm_connector_state *new_conn_state;memset (params,0 ,sizeof (params));
@@ -1246,7 +1245,7 @@ static int compute_mst_dsc_configs_for_lDRM_DEBUG_DRIVER ("MST_DSC Try no compression\n" );for (i =0 ; i < count; i++) { vars[i + k].aconnector = params[i].aconnector; - vars[i + k].pbn =kbps_to_peak_pbn (params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + vars[i + k].pbn =kbps_to_pbn (params[i].bw_range.stream_kbps, false); vars[i + k].dsc_enabled = false; vars[i + k].bpp_x16 =0 ; ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, params[i].port,
@@ -1268,7 +1267,7 @@ static int compute_mst_dsc_configs_for_lDRM_DEBUG_DRIVER ("MST_DSC Try max compression\n" );for (i =0 ; i < count; i++) {if (params[i].compression_possible && params[i].clock_force_enable !=DSC_CLK_FORCE_DISABLE ) { - vars[i + k].pbn =kbps_to_peak_pbn (params[i].bw_range.min_kbps, fec_overhead_multiplier_x1000); + vars[i + k].pbn =kbps_to_pbn (params[i].bw_range.min_kbps, false); vars[i + k].dsc_enabled = true; vars[i + k].bpp_x16 = params[i].bw_range.min_target_bpp_x16; ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr,
@@ -1276,7 +1275,7 @@ static int compute_mst_dsc_configs_for_lif (ret <0 )return ret; }else { - vars[i + k].pbn =kbps_to_peak_pbn (params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + vars[i + k].pbn =kbps_to_pbn (params[i].bw_range.stream_kbps, false); vars[i + k].dsc_enabled = false; vars[i + k].bpp_x16 =0 ; ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr,
@@ -1731,18 +1730,6 @@ clean_exit:return ret; } -static uint32_t kbps_from_pbn (unsigned int pbn) -{ -uint64_t kbps = (uint64_t )pbn; - - kbps *= (1000000 /PEAK_FACTOR_X1000 ); - kbps *=8 ; - kbps *=54 ; - kbps /=64 ; - -return (uint32_t )kbps; -} -static bool is_dsc_common_config_possible (struct dc_stream_state *stream,struct dc_dsc_bw_range *bw_range) {
@@ -1835,7 +1822,7 @@ enum dc_status dm_dp_mst_is_port_support dc_link_get_highest_encoding_format(stream->link)); cur_link_settings = stream->link->verified_link_cap; root_link_bw_in_kbps =dc_link_bandwidth_kbps (aconnector->dc_link, &cur_link_settings); - virtual_channel_bw_in_kbps =kbps_from_pbn (aconnector->mst_output_port->full_pbn); + virtual_channel_bw_in_kbps =pbn_to_kbps (aconnector->mst_output_port->full_pbn, true);/* pick the end to end bw bottleneck */ end_to_end_bw_in_kbps =min (root_link_bw_in_kbps, virtual_channel_bw_in_kbps);
@@ -1886,7 +1873,7 @@ enum dc_status dm_dp_mst_is_port_support immediate_upstream_port = aconnector->mst_output_port->parent->port_parent;if (immediate_upstream_port) { - virtual_channel_bw_in_kbps =kbps_from_pbn (immediate_upstream_port->full_pbn); + virtual_channel_bw_in_kbps =pbn_to_kbps (immediate_upstream_port->full_pbn, true); virtual_channel_bw_in_kbps =min (root_link_bw_in_kbps, virtual_channel_bw_in_kbps); }else {/* For topology LCT 1 case - only one mstb*/
Greg Kroah-Hartman
maintainerPATCH 76/175 drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Lipski <[email protected]>
commit 5bab4c89390f32b2f491f49a151948cd226dd909 upstream.
[Why]
On DCN20 & DCN30, the 6th DPP's & HUBP's are powered on permanently and cannot be power gated. Thus, when dpp_reset() is invoked for the DPP5, while it's still powered on, the cached cursor_state (dpp_base->pos.cur0_ctl.bits.cur0_enable)
and the actual state (CUR0_ENABLE) bit are unsycned. This can cause a double cursor in full screen with non-native scaling.
[How]
Force disable cursor on DPP5 on plane powerdown for ASICs w/ 6 DPPs/HUBPs.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +8 -0
@@ -614,6 +614,14 @@ void dcn20_dpp_pg_control(* DOMAIN11_PGFSM_PWR_STATUS, pwr_status, * 1, 1000); */ + +/* Force disable cursor on plane powerdown on DPP 5 using dpp_force_disable_cursor */ +if (!power_on) { +struct dpp *dpp5 = hws->ctx->dc->res_pool->dpps[dpp_inst]; +if (dpp5 && dpp5->funcs->dpp_force_disable_cursor) + dpp5->funcs->dpp_force_disable_cursor (dpp5); + } +break ;default :BREAK_TO_DEBUGGER ();
Greg Kroah-Hartman
maintainerPATCH 77/175 mm/truncate: unmap large folio on split failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau <[email protected]>
commit fa04f5b60fda62c98a53a60de3a1e763f11feb41 upstream.
Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS.
This behavior might not be respected on truncation.
During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved.
However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD.
Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics.
Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size.
--- mm/truncate.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-)
mm/truncate.c +29 -6
@@ -177,6 +177,32 @@ int truncate_inode_folio(struct address_return 0 ; } +static int try_folio_split_or_unmap (struct folio *folio,struct page *split_at, +unsigned long min_order) +{ +enum ttu_flags ttu_flags = +TTU_SYNC | +TTU_SPLIT_HUGE_PMD | +TTU_IGNORE_MLOCK ; +int ret; + + ret =try_folio_split_to_order (folio, split_at, min_order); + +/* +* If the split fails, unmap the folio, so it will be refaulted +* with PTEs to respect SIGBUS semantics. +* +* Make an exception for shmem/tmpfs that for long time +* intentionally mapped with PMDs across i_size. +*/ +if (ret && !shmem_mapping (folio->mapping)) { +try_to_unmap (folio, ttu_flags); +WARN_ON (folio_mapped (folio)); + } + +return ret; +} +/* * Handle partial folios. The folio may be entirely within the * range if a split has raced with us. If not, we zero the part of the
@@ -226,7 +252,7 @@ bool truncate_inode_partial_folio(struct min_order =mapping_min_folio_order (folio->mapping); split_at =folio_page (folio,PAGE_ALIGN_DOWN (offset) /PAGE_SIZE ); -if (!try_folio_split_to_order (folio, split_at, min_order)) { +if (!try_folio_split_or_unmap (folio, split_at, min_order)) {/* * try to split at offset + length to make sure folios within * the range can be dropped, especially to avoid memory waste
@@ -250,13 +276,10 @@ bool truncate_inode_partial_folio(structif (!folio_trylock (folio2)) goto out; -/* -* make sure folio2 is large and does not change its mapping. -* Its split result does not matter here. -*/ +/* make sure folio2 is large and does not change its mapping */ if (folio_test_large (folio2) && folio2->mapping == folio->mapping) -try_folio_split_to_order (folio2, split_at2, min_order); +try_folio_split_or_unmap (folio2, split_at2, min_order);folio_unlock (folio2); out:
Greg Kroah-Hartman
maintainerPATCH 78/175 pinctrl: mediatek: mt8196: align register base names to dt-bindings ones
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis-Alexis Eyraud <[email protected]>
[ Upstream commit 404ee89b4008cf2130554dac2c64cd8412601356 ]
The mt8196-pinctrl driver requires to probe that a device tree uses in the device node the same names than mt8196_pinctrl_register_base_names array. But they are not matching the required ones in the "mediatek,mt8196-pinctrl" dt-bindings, leading to possible dtbs check issues.
So, align all mt8196_pinctrl_register_base_names entries on dt-bindings ones.
--- drivers/pinctrl/mediatek/pinctrl-mt8196.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pinctrl/mediatek/pinctrl-mt8196.c +2 -4
@@ -1801,10 +1801,8 @@ static const struct mtk_pin_reg_calc mt8196_reg_cals[PINCTRL_PIN_REG_MAX] = { };static const char *const mt8196_pinctrl_register_base_names[] = { -"iocfg0" ,"iocfg_rt" ,"iocfg_rm1" ,"iocfg_rm2" , -"iocfg_rb" ,"iocfg_bm1" ,"iocfg_bm2" ,"iocfg_bm3" , -"iocfg_lt" ,"iocfg_lm1" ,"iocfg_lm2" ,"iocfg_lb1" , -"iocfg_lb2" ,"iocfg_tm1" ,"iocfg_tm2" ,"iocfg_tm3" , +"base" ,"rt" ,"rm1" ,"rm2" ,"rb" ,"bm1" ,"bm2" ,"bm3" , +"lt" ,"lm1" ,"lm2" ,"lb1" ,"lb2" ,"tm1" ,"tm2" ,"tm3" , };static const struct mtk_eint_hw mt8196_eint_hw = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/175 pinctrl: mediatek: mt8189: align register base names to dt-bindings ones
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis-Alexis Eyraud <[email protected]>
[ Upstream commit 518919276c4119e34e24334003af70ab12477f00 ]
The mt8189-pinctrl driver requires to probe that a device tree uses in the device node the same names than mt8189_pinctrl_register_base_names array. But they are not matching the required ones in the "mediatek,mt8189-pinctrl" dt-bindings, leading to possible dtbs check issues. The mt8189_pinctrl_register_base_names entry order is also different.
So, align all mt8189_pinctrl_register_base_names entry names and order on dt-bindings.
--- drivers/pinctrl/mediatek/pinctrl-mt8189.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/pinctrl/mediatek/pinctrl-mt8189.c +1 -3
@@ -1642,9 +1642,7 @@ static const struct mtk_pin_reg_calc mt8189_reg_cals[PINCTRL_PIN_REG_MAX] = { };static const char *const mt8189_pinctrl_register_base_names[] = { -"gpio_base" ,"iocfg_bm0_base" ,"iocfg_bm1_base" ,"iocfg_bm2_base" ,"iocfg_lm_base" , -"iocfg_lt0_base" ,"iocfg_lt1_base" ,"iocfg_rb0_base" ,"iocfg_rb1_base" , -"iocfg_rt_base" +"base" ,"lm" ,"rb0" ,"rb1" ,"bm0" ,"bm1" ,"bm2" ,"lt0" ,"lt1" ,"rt" , };static const struct mtk_eint_hw mt8189_eint_hw = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/175 xfrm: drop SA reference in xfrm_state_update if dir doesnt match
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 8d2a2a49c30f67a480fa9ed25e08436a446f057e ]
We're not updating x1, but we still need to put() it.
--- net/xfrm/xfrm_state.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/xfrm/xfrm_state.c +6 -2
@@ -2191,14 +2191,18 @@ int xfrm_state_update(struct xfrm_state *x) }if (x1->km.state ==XFRM_STATE_ACQ ) { -if (x->dir && x1->dir != x->dir) +if (x->dir && x1->dir != x->dir) { + to_put = x1; goto out; + }__xfrm_state_insert (x); x =NULL ; }else { -if (x1->dir != x->dir) +if (x1->dir != x->dir) { + to_put = x1; goto out; + } } err =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/175 xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 10deb69864840ccf96b00ac2ab3a2055c0c04721 ]
In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists.
In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel.
There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved.
At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).
--- net/xfrm/xfrm_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/xfrm/xfrm_state.c +2 -1
@@ -592,6 +592,7 @@ void xfrm_state_free(struct xfrm_state *x) }EXPORT_SYMBOL (xfrm_state_free); +static void xfrm_state_delete_tunnel (struct xfrm_state *x);static void xfrm_state_gc_destroy (struct xfrm_state *x) {if (x->mode_cbs && x->mode_cbs->destroy_state)
@@ -607,6 +608,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)kfree (x->replay_esn);kfree (x->preplay_esn);xfrm_unset_type_offload (x); +xfrm_state_delete_tunnel (x);if (x->type) { x->type->destructor (x);xfrm_put_type (x->type);
@@ -806,7 +808,6 @@ void __xfrm_state_destroy(struct xfrm_state *x) }EXPORT_SYMBOL (__xfrm_state_destroy); -static void xfrm_state_delete_tunnel (struct xfrm_state *x);int __xfrm_state_delete (struct xfrm_state *x) {struct net *net =xs_net (x);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/175 xfrm: call xfrm_dev_state_delete when xfrm_state_migrate fails to add the state
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7f02285764790e0ff1a731b4187fa3e389ed02c7 ]
In case xfrm_state_migrate fails after calling xfrm_dev_state_add, we directly release the last reference and destroy the new state, without calling xfrm_dev_state_delete (this only happens in __xfrm_state_delete, which we're not calling on this path, since the state was never added).
Call xfrm_dev_state_delete on error when an offload configuration was provided.
--- net/xfrm/xfrm_state.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/xfrm/xfrm_state.c +4 -1
@@ -2158,10 +2158,13 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,xfrm_state_insert (xc); }else {if (xfrm_state_add (xc) <0 ) - goto error; + goto error_add; }return xc; +error_add: +if (xuo) +xfrm_dev_state_delete (xc); error:xfrm_state_put (xc);return NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/175 xfrm: set err and extack on failure to create pcpu SA
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 1dcf617bec5cb85f68ca19969e7537ef6f6931d3 ]
xfrm_state_construct can fail without setting an error if the requested pcpu_num value is too big. Set err and add an extack message to avoid confusing userspace.
--- net/xfrm/xfrm_user.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/xfrm/xfrm_user.c +4 -1
@@ -947,8 +947,11 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,if (attrs[XFRMA_SA_PCPU ]) { x->pcpu_num =nla_get_u32 (attrs[XFRMA_SA_PCPU ]); -if (x->pcpu_num >=num_possible_cpus ()) +if (x->pcpu_num >=num_possible_cpus ()) { + err = -ERANGE ; +NL_SET_ERR_MSG (extack,"pCPU number too big" ); goto error; + } } err =__xfrm_init_state (x, extack);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/175 clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <[email protected]>
[ Upstream commit 1dba74abf3e2fa4484b924d8ba6e54e64ebb8c82 ]
bus-r-cpucfg clock is important for peripheral which takes care of powering CPU cores on and off. Since this operation is done by firmware (TF-A), mark it as critical. That way Linux won't interfere with that clock.
--- drivers/clk/sunxi-ng/ccu-sun55i-a523-r.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sunxi-ng/ccu-sun55i-a523-r.c +1 -1
@@ -125,7 +125,7 @@ static SUNXI_CCU_GATE_HW(bus_r_dma_clk, "bus-r-dma", static SUNXI_CCU_GATE_HW(bus_r_rtc_clk, "bus-r-rtc", &r_apb0_clk.common.hw, 0x20c, BIT(0), 0); static SUNXI_CCU_GATE_HW(bus_r_cpucfg_clk, "bus-r-cpucfg", - &r_apb0_clk.common.hw, 0x22c, BIT(0), 0); + &r_apb0_clk.common.hw, 0x22c, BIT(0), CLK_IS_CRITICAL);static struct ccu_common *sun55i_a523_r_ccu_clks[] = { &r_ahb_clk.common,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/175 clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 5888533c6011de319c5f23ae147f1f291ce81582 ]
The "bus-r-dma" clock in the A523's PRCM clock controller is also referred to as "DMA_CLKEN_SW" or "DMA ADB400 gating". It is unclear how this ties into the DMA controller MBUS clock gate; however if the clock is not enabled, the DMA controller in the MCU block will fail to access DRAM, even failing to retrieve the DMA descriptors.
Mark this clock as critical. This sort of mirrors what is done for the main DMA controller's MBUS clock, which has a separate toggle that is currently left out of the main clock controller driver.
--- drivers/clk/sunxi-ng/ccu-sun55i-a523-r.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sunxi-ng/ccu-sun55i-a523-r.c +1 -1
@@ -121,7 +121,7 @@ static SUNXI_CCU_GATE_HW(bus_r_ir_rx_clk, "bus-r-ir-rx", &r_apb0_clk.common.hw, 0x1cc, BIT(0), 0); static SUNXI_CCU_GATE_HW(bus_r_dma_clk, "bus-r-dma", - &r_apb0_clk.common.hw, 0x1dc, BIT(0), 0); + &r_apb0_clk.common.hw, 0x1dc, BIT(0), CLK_IS_CRITICAL); static SUNXI_CCU_GATE_HW(bus_r_rtc_clk, "bus-r-rtc", &r_apb0_clk.common.hw, 0x20c, BIT(0), 0); static SUNXI_CCU_GATE_HW(bus_r_cpucfg_clk, "bus-r-cpucfg",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/175 clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 2050280a4bb660b47f8cccf75a69293ae7cbb087 ]
While the user manual states that the PLL's rate should be between 180 MHz and 3 GHz in the register defninition section, it also says the actual operating frequency is 22.5792*4 MHz in the PLL features table.
22.5792*4 MHz is one of the actual clock rates that we want and is is available in the SDM table. Lower the minimum clock rate to 90 MHz so that both rates in the SDM table can be used.
--- drivers/clk/sunxi-ng/ccu-sun55i-a523.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sunxi-ng/ccu-sun55i-a523.c +1 -1
@@ -299,7 +299,7 @@ static struct ccu_nm pll_audio0_4x_clk = { .m = _SUNXI_CCU_DIV(16, 6), .sdm =_SUNXI_CCU_SDM (pll_audio0_sdm_table,BIT (24 ), 0x178, BIT(31)), - .min_rate = 180000000U, + .min_rate = 90000000U, .max_rate = 3000000000U, .common = { .reg = 0x078,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/175 pinctrl: realtek: Select REGMAP_MMIO for RTD driver
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <[email protected]>
[ Upstream commit 369f772299821f93f872bf1b4d7d7ed2fc50243b ]
The pinctrl-rtd driver uses 'devm_regmap_init_mmio', which requires 'REGMAP_MMIO' to be enabled.
Without this selection, the build fails with an undefined reference:
aarch64-none-linux-gnu-ld: drivers/pinctrl/realtek/pinctrl-rtd.o: in function rtd_pinctrl_probe': pinctrl-rtd.c:(.text+0x5a0): undefined reference to __devm_regmap_init_mmio_clk'
Fix this by selecting 'REGMAP_MMIO' in the Kconfig.
--- drivers/pinctrl/realtek/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/realtek/Kconfig +1 -0
@@ -6,6 +6,7 @@ config PINCTRL_RTD default y select PINMUX select GENERIC_PINCONF + select REGMAP_MMIO config PINCTRL_RTD1619B tristate "Realtek DHC 1619B pin controller driver"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/175 xfrm: Check inner packet family directly from skb_dst
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 082ef944e55da8a9a8df92e3842ca82a626d359a ]
In the output path, xfrm_dev_offload_ok and xfrm_get_inner_ipproto need to determine the protocol family of the inner packet (skb) before it gets encapsulated.
In xfrm_dev_offload_ok, the code checked x->inner_mode.family. This is unreliable because, for states handling both IPv4 and IPv6, the relevant inner family could be either x->inner_mode.family or x->inner_mode_iaf.family. Checking only the former can lead to a mismatch with the actual packet being processed.
In xfrm_get_inner_ipproto, the code checked x->outer_mode.family. This is also incorrect for tunnel mode, as the inner packet's family can be different from the outer header's family.
At both of these call sites, the skb variable holds the original inner packet. The most direct and reliable source of truth for its protocol family is its destination entry. This patch fixes the issue by using skb_dst(skb)->ops->family to ensure protocol-specific headers are only accessed for the correct packet type.
--- net/xfrm/xfrm_device.c | 2 +- net/xfrm/xfrm_output.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/xfrm/xfrm_device.c +1 -1
@@ -438,7 +438,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) check_tunnel_size = x->xso.type ==XFRM_DEV_OFFLOAD_PACKET && x->props.mode ==XFRM_MODE_TUNNEL ; -switch (x->inner_mode.family) { +switch (skb_dst (skb)->ops->family) {case AF_INET :/* Check for IPv4 options */ if (ip_hdr (skb)->ihl !=5 )
net/xfrm/xfrm_output.c +1 -1
@@ -698,7 +698,7 @@ static void xfrm_get_inner_ipproto(struct sk_buff *skb, struct xfrm_state *x)return ;if (x->outer_mode.encap ==XFRM_MODE_TUNNEL ) { -switch (x->outer_mode.family) { +switch (skb_dst (skb)->ops->family) {case AF_INET : xo->inner_ipproto =ip_hdr (skb)->protocol;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/175 xfrm: Determine inner GSO type from packet inner protocol
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 61fafbee6cfed283c02a320896089f658fa67e56 ]
The GSO segmentation functions for ESP tunnel mode (xfrm4_tunnel_gso_segment and xfrm6_tunnel_gso_segment) were determining the inner packet's L2 protocol type by checking the static x->inner_mode.family field from the xfrm state.
This is unreliable. In tunnel mode, the state's actual inner family could be defined by x->inner_mode.family or by x->inner_mode_iaf.family. Checking only the former can lead to a mismatch with the actual packet being processed, causing GSO to create segments with the wrong L2 header type.
This patch fixes the bug by deriving the inner mode directly from the packet's inner protocol stored in XFRM_MODE_SKB_CB(skb)->protocol.
Instead of replicating the code, this patch modifies the xfrm_ip2inner_mode helper function. It now correctly returns &x->inner_mode if the selector family (x->sel.family) is already specified, thereby handling both specific and AF_UNSPEC cases appropriately.
With this change, ESP GSO can use xfrm_ip2inner_mode to get the correct inner mode. It doesn't affect existing callers, as the updated logic now mirrors the checks they were already performing externally.
--- include/net/xfrm.h | 3 ++- net/ipv4/esp4_offload.c | 6 ++++-- net/ipv6/esp6_offload.c | 6 ++++-- 3 files changed, 10 insertions(+), 5 deletions(-)
include/net/xfrm.h +2 -1
@@ -536,7 +536,8 @@ static inline int xfrm_af2proto(unsigned int family)static inline const struct xfrm_mode *xfrm_ip2inner_mode (struct xfrm_state *x,int ipproto) { -if ((ipproto ==IPPROTO_IPIP && x->props.family ==AF_INET ) || +if ((x->sel.family !=AF_UNSPEC ) || + (ipproto ==IPPROTO_IPIP && x->props.family ==AF_INET ) || (ipproto ==IPPROTO_IPV6 && x->props.family ==AF_INET6 ))return &x->inner_mode;else
net/ipv4/esp4_offload.c +4 -2
@@ -122,8 +122,10 @@ static struct sk_buff *xfrm4_tunnel_gso_segment(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features) { -__be16 type = x->inner_mode.family ==AF_INET6 ?htons (ETH_P_IPV6 ) - :htons (ETH_P_IP ); +const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, +XFRM_MODE_SKB_CB (skb)->protocol); +__be16 type = inner_mode->family ==AF_INET6 ?htons (ETH_P_IPV6 ) + :htons (ETH_P_IP );return skb_eth_gso_segment (skb, features, type); }
net/ipv6/esp6_offload.c +4 -2
@@ -158,8 +158,10 @@ static struct sk_buff *xfrm6_tunnel_gso_segment(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features) { -__be16 type = x->inner_mode.family ==AF_INET ?htons (ETH_P_IP ) - :htons (ETH_P_IPV6 ); +const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, +XFRM_MODE_SKB_CB (skb)->protocol); +__be16 type = inner_mode->family ==AF_INET ?htons (ETH_P_IP ) + :htons (ETH_P_IPV6 );return skb_eth_gso_segment (skb, features, type); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/175 xfrm: Prevent locally generated packets from direct output in tunnel mode
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 59630e2ccd728703cc826e3a3515d70f8c7a766c ]
Add a check to ensure locally generated packets (skb->sk != NULL) do not use direct output in tunnel mode, as these packets require proper L2 header setup that is handled by the normal XFRM processing path.
--- net/xfrm/xfrm_output.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/xfrm/xfrm_output.c +5 -1
@@ -772,8 +772,12 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)/* Exclusive direct xmit for tunnel mode, as * some filtering or matching rules may apply * in transport mode. +* Locally generated packets also require +* the normal XFRM path for L2 header setup, +* as the hardware needs the L2 header to match +* for encryption, so skip direct output as well. */ -if (x->props.mode ==XFRM_MODE_TUNNEL ) +if (x->props.mode ==XFRM_MODE_TUNNEL && !skb->sk)return xfrm_dev_direct_output (sk, x, skb);return xfrm_output_resume (sk, skb,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/175 pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 9b07cdf86a0b90556f5b68a6b20b35833b558df3 ]
The driver calls fwnode_get_named_child_node() which takes a reference on the child node, but never releases it, which causes a reference leak.
Fix by using devm_add_action_or_reset() to automatically release the reference when the device is removed.
--- drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/pinctrl/cirrus/pinctrl-cs42l43.c +19 -4
@@ -532,6 +532,11 @@ static int cs42l43_gpio_add_pin_ranges(struct gpio_chip *chip)return ret; } +static void cs42l43_fwnode_put (void *data) +{ +fwnode_handle_put (data); +} +static int cs42l43_pin_probe (struct platform_device *pdev) {struct cs42l43 *cs42l43 =dev_get_drvdata (pdev->dev.parent);
@@ -563,10 +568,20 @@ static int cs42l43_pin_probe(struct platform_device *pdev) priv->gpio_chip.ngpio =CS42L43_NUM_GPIOS ;if (is_of_node (fwnode)) { - fwnode =fwnode_get_named_child_node (fwnode,"pinctrl" ); - -if (fwnode && !fwnode->dev) - fwnode->dev = priv->dev; +struct fwnode_handle *child; + + child =fwnode_get_named_child_node (fwnode,"pinctrl" ); +if (child) { + ret =devm_add_action_or_reset (&pdev->dev, + cs42l43_fwnode_put, child); +if (ret) { +fwnode_handle_put (child); +return ret; + } +if (!child->dev) + child->dev = priv->dev; + fwnode = child; + } } priv->gpio_chip.fwnode = fwnode;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/175 platform/x86: msi-wmi-platform: Only load on MSI devices
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit c93433fd4e2bbbe7caa67b53d808b4a084852ff3 ]
It turns out that the GUID used by the msi-wmi-platform driver (ABBC0F60-8EA1-11D1-00A0-C90629100000) is not unique, but was instead copied from the WIndows Driver Samples. This means that this driver could load on devices from other manufacturers that also copied this GUID, potentially causing hardware errors.
Prevent this by only loading on devices whitelisted via DMI. The DMI matches where taken from the msi-ec driver.
--- drivers/platform/x86/Kconfig | 1 + drivers/platform/x86/msi-wmi-platform.c | 41 ++++++++++++++++++++++++- 2 files changed, 41 insertions(+), 1 deletion(-)
drivers/platform/x86/Kconfig +1 -0
@@ -533,6 +533,7 @@ config MSI_WMI config MSI_WMI_PLATFORM tristate "MSI WMI Platform features" depends on ACPI_WMI + depends on DMI depends on HWMON help Say Y here if you want to have support for WMI-based platform features
drivers/platform/x86/msi-wmi-platform.c +40 -1
53 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/175 platform/x86: msi-wmi-platform: Fix typo in WMI GUID
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 97b726eb1dc2b4a2532544eb3da72bb6acbd39a3 ]
The WMI driver core only supports GUID strings containing only uppercase characters, however the GUID string used by the msi-wmi-platform driver contains a single lowercase character. This prevents the WMI driver core from matching said driver to its WMI device.
Fix this by turning the lowercase character into a uppercase character. Also update the WMI driver development guide to warn about this.
--- Documentation/wmi/driver-development-guide.rst | 1 + drivers/platform/x86/msi-wmi-platform.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
Documentation/wmi/driver-development-guide.rst +1 -0
@@ -54,6 +54,7 @@ to matching WMI devices using a struct wmi_device_id table: :: static const struct wmi_device_id foo_id_table[] = { + /* Only use uppercase letters! */ { "936DA01F-9ABD-4D9D-80C7-02AF85C822A8", NULL }, { } };
drivers/platform/x86/msi-wmi-platform.c +1 -1
@@ -29,7 +29,7 @@#define DRIVER_NAME "msi-wmi-platform" -#define MSI_PLATFORM_GUID "ABBC0F6E-8EA1-11d1-00A0-C90629100000" +#define MSI_PLATFORM_GUID "ABBC0F6E-8EA1-11D1-00A0-C90629100000"#define MSI_WMI_PLATFORM_INTERFACE_VERSION 2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/175 mips: dts: econet: fix EN751221 core type
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 09782e72eec451fa14d327595f86cdc338ebe53c ]
In fact, it is a multi-threaded MIPS34Kc, not a single-threaded MIPS24Kc.
--- arch/mips/boot/dts/econet/en751221.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/boot/dts/econet/en751221.dtsi +1 -1
@@ -18,7 +18,7 @@ cpu@0 { device_type = "cpu"; - compatible = "mips,mips24KEc"; + compatible = "mips,mips34Kc"; reg = <0>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/175 net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaming Zhang <[email protected]>
[ Upstream commit f796a8dec9beafcc0f6f0d3478ed685a15c5e062 ]
The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as:
tsconfig_prepare_data() ->
dev_get_hwtstamp_phylib() ->
vlan_hwtstamp_get() ->
generic_hwtstamp_get_lower() ->
generic_hwtstamp_ioctl_lower()
results in generic_hwtstamp_ioctl_lower() being called with kernel_cfg->ifr as NULL.
The generic_hwtstamp_ioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash.
Fix this by adding a NULL check for kernel_cfg->ifr in generic_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL.
--- net/core/dev_ioctl.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/dev_ioctl.c +3 -0
@@ -443,6 +443,9 @@ static int generic_hwtstamp_ioctl_lower(struct net_device *dev, int cmd,struct ifreq ifrr;int err; +if (!kernel_cfg->ifr) +return -EINVAL ; +strscpy_pad (ifrr.ifr_name, dev->name,IFNAMSIZ ); ifrr.ifr_ifru = kernel_cfg->ifr->ifr_ifru;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/175 mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 407a06507c2358554958e8164dc97176feddcafc ]
The function mlxsw_sp_flower_stats() calls mlxsw_sp_acl_ruleset_get() to obtain a ruleset reference. If the subsequent call to mlxsw_sp_acl_rule_lookup() fails to find a rule, the function returns an error without releasing the ruleset reference, causing a memory leak.
Fix this by using a goto to the existing error handling label, which calls mlxsw_sp_acl_ruleset_put() to properly release the reference.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c +4 -2
@@ -830,8 +830,10 @@ int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,return -EINVAL ; rule =mlxsw_sp_acl_rule_lookup (mlxsw_sp, ruleset, f->cookie); -if (!rule) -return -EINVAL ; +if (!rule) { + err = -EINVAL ; + goto err_rule_get_stats; + } err =mlxsw_sp_acl_rule_get_stats (mlxsw_sp, rule, &packets, &bytes, &drops, &lastuse, &used_hw_stats);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/175 drm/tegra: Add call to put_pid()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prateek Agarwal <[email protected]>
[ Upstream commit 6cbab9f0da72b4dc3c3f9161197aa3b9daa1fa3a ]
Add a call to put_pid() corresponding to get_task_pid(). host1x_memory_context_alloc() does not take ownership of the PID so we need to free it here to avoid leaking.
--- drivers/gpu/drm/tegra/uapi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/tegra/uapi.c +5 -2
@@ -114,9 +114,12 @@ int tegra_drm_ioctl_channel_open(struct drm_device *drm, void *data, struct drm_if (err) goto put_channel; -if (supported) +if (supported) { +struct pid *pid =get_task_pid (current,PIDTYPE_TGID ); context->memory_context =host1x_memory_context_alloc ( - host, client->base.dev,get_task_pid (current,PIDTYPE_TGID )); + host, client->base.dev, pid); +put_pid (pid); + }if (IS_ERR (context->memory_context)) {if (PTR_ERR (context->memory_context) != -EOPNOTSUPP ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/175 net: dsa: hellcreek: fix missing error handling in LED registration
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <[email protected]>
[ Upstream commit e6751b0b19a6baab219a62e1e302b8aa6b5a55b2 ]
The LED setup routine registered both led_sync_good and led_is_gm devices without checking the return values of led_classdev_register(). If either registration failed, the function continued silently, leaving the driver in a partially-initialized state and leaking a registered LED classdev.
Add proper error handling
--- drivers/net/dsa/hirschmann/hellcreek_ptp.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/dsa/hirschmann/hellcreek_ptp.c +12 -2
@@ -376,8 +376,18 @@ static int hellcreek_led_setup(struct hellcreek *hellcreek)hellcreek_set_brightness (hellcreek,STATUS_OUT_IS_GM ,1 );/* Register both leds */ -led_classdev_register (hellcreek->dev, &hellcreek->led_sync_good); -led_classdev_register (hellcreek->dev, &hellcreek->led_is_gm); + ret =led_classdev_register (hellcreek->dev, &hellcreek->led_sync_good); +if (ret) { +dev_err (hellcreek->dev,"Failed to register sync_good LED\n" ); + goto out; + } + + ret =led_classdev_register (hellcreek->dev, &hellcreek->led_is_gm); +if (ret) { +dev_err (hellcreek->dev,"Failed to register is_gm LED\n" ); +led_classdev_unregister (&hellcreek->led_sync_good); + goto out; + } ret =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/175 net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <[email protected]>
[ Upstream commit b0c959fec18f4595a6a6317ffc30615cfa37bf69 ]
The call to devlink_info_version_fixed_put() in mlxsw_linecard_devlink_info_get() did not check for errors, although it is checked everywhere in the code.
Add missed 'err' check to the mlxsw_linecard_devlink_info_get()
--- drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/core_linecards.c +2 -0
@@ -601,6 +601,8 @@ int mlxsw_linecard_devlink_info_get(struct mlxsw_linecard *linecard, err =devlink_info_version_fixed_put (req,DEVLINK_INFO_VERSION_GENERIC_FW_PSID , info->psid); +if (err) + goto unlock;sprintf (buf,"%u.%u.%u" , info->fw_major, info->fw_minor, info->fw_sub_minor);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/175 net: openvswitch: remove never-working support for setting nsh fields
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <[email protected]>
[ Upstream commit dfe28c4167a9259fc0c372d9f9473e1ac95cff67 ]
The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible.
There is also confusion in the code between the 'masked' flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the 'is_mask' that says that the value we're parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn't allocate any memory for it:
BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: <TASK> validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860 [openvswitch] ovs_nla_copy_actions+0x8d/0x100 [openvswitch] ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch] genl_family_rcv_msg_doit+0xdb/0x130 genl_family_rcv_msg+0x14b/0x220 genl_rcv_msg+0x47/0xa0 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x280/0x3b0 netlink_sendmsg+0x1f7/0x430 ____sys_sendmsg+0x36b/0x3a0 ___sys_sendmsg+0x87/0xd0 __sys_sendmsg+0x6d/0xd0 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The third issue with this process is that while trying to convert the non-masked set into masked one, validate_set() copies and doubles the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested attributes. It should be copying each nested attribute and doubling them in size independently. And the process must be properly reversed during the conversion back from masked to a non-masked variant during the flow dump.
In the end, the only two outcomes of trying to use this action are either validation failure or a kernel crash. And if somehow someone manages to install a flow with such an action, it will most definitely not do what it is supposed to, since all the keys and the masks are mixed up.
Fixing all the issues is a complex task as it requires re-writing most of the validation code.
Given that and the fact that this functionality never worked since introduction, let's just remove it altogether. It's better to re-introduce it later with a proper implementation instead of trying to fix it in stable releases.
--- net/openvswitch/actions.c | 68 +--------------------------------- net/openvswitch/flow_netlink.c | 64 ++++---------------------------- net/openvswitch/flow_netlink.h | 2 - 3 files changed, 9 insertions(+), 125 deletions(-)
net/openvswitch/actions.c +1 -67
@@ -572,69 +572,6 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,return 0 ; } -static int set_nsh (struct sk_buff *skb,struct sw_flow_key *flow_key, -const struct nlattr *a) -{ -struct nshhdr *nh; -size_t length; -int err; -u8 flags; -u8 ttl; -int i; - -struct ovs_key_nsh key; -struct ovs_key_nsh mask; - - err =nsh_key_from_nlattr (a, &key, &mask); -if (err) -return err; - -/* Make sure the NSH base header is there */ -if (!pskb_may_pull (skb,skb_network_offset (skb) +NSH_BASE_HDR_LEN )) -return -ENOMEM ; - - nh =nsh_hdr (skb); - length =nsh_hdr_len (nh); - -/* Make sure the whole NSH header is there */ - err =skb_ensure_writable (skb,skb_network_offset (skb) + - length); -if (unlikely (err)) -return err; - - nh =nsh_hdr (skb); -skb_postpull_rcsum (skb, nh, length); - flags =nsh_get_flags (nh); - flags =OVS_MASKED (flags, key.base.flags, mask.base.flags); - flow_key->nsh.base.flags = flags; - ttl =nsh_get_ttl (nh); - ttl =OVS_MASKED (ttl, key.base.ttl, mask.base.ttl); - flow_key->nsh.base.ttl = ttl; -nsh_set_flags_and_ttl (nh, flags, ttl); - nh->path_hdr =OVS_MASKED (nh->path_hdr, key.base.path_hdr, - mask.base.path_hdr); - flow_key->nsh.base.path_hdr = nh->path_hdr; -switch (nh->mdtype) { -case NSH_M_TYPE1 : -for (i =0 ; i <NSH_MD1_CONTEXT_SIZE ; i++) { - nh->md1.context[i] = -OVS_MASKED (nh->md1.context[i], key.context[i], - mask.context[i]); - } -memcpy (flow_key->nsh.context, nh->md1.context, -sizeof (nh->md1.context)); -break ; -case NSH_M_TYPE2 : -memset (flow_key->nsh.context,0 , -sizeof (flow_key->nsh.context)); -break ; -default : -return -EINVAL ; - } -skb_postpush_rcsum (skb, nh, length); -return 0 ; -} -/* Must follow skb_ensure_writable() since that can move the skb data. */ static void set_tp_port (struct sk_buff *skb,__be16 *port,__be16 new_port,__sum16 *check)
@@ -1130,10 +1067,6 @@ static int execute_masked_set_action(struct sk_buff *skb, get_mask(a, struct ovs_key_ethernet *));break ; -case OVS_KEY_ATTR_NSH : - err =set_nsh (skb, flow_key, a); -break ; -case OVS_KEY_ATTR_IPV4 : err =set_ipv4 (skb, flow_key,nla_data (a), get_mask(a, struct ovs_key_ipv4 *));
@@ -1170,6 +1103,7 @@ static int execute_masked_set_action(struct sk_buff *skb,case OVS_KEY_ATTR_CT_LABELS :case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 :case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 : +case OVS_KEY_ATTR_NSH : err = -EINVAL ;break ; }
net/openvswitch/flow_netlink.c +8 -56
105 lines not on this page · raw message
net/openvswitch/flow_netlink.h +0 -2
@@ -65,8 +65,6 @@ int ovs_nla_put_actions(const struct nlattr *attr,void ovs_nla_free_flow_actions (struct sw_flow_actions *);void ovs_nla_free_flow_actions_rcu (struct sw_flow_actions *); -int nsh_key_from_nlattr (const struct nlattr *attr,struct ovs_key_nsh *nsh, -struct ovs_key_nsh *nsh_mask);int nsh_hdr_from_nlattr (const struct nlattr *attr,struct nshhdr *nh,size_t size);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/175 veth: more robust handing of race to avoid txq getting stuck
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesper Dangaard Brouer <[email protected]>
[ Upstream commit 5442a9da69789741bfda39f34ee7f69552bf0c56 ]
Commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max).
The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a "lost wakeup" where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts.
This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring->consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy.
This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer:
(1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely responsible for re-waking the TXQ.
This handles the race where veth_poll() consumes all packets and completes
NAPI *before* veth_xmit() on the producer side has called netif_tx_stop_queue. The __veth_xdp_flush(rq) will observe rx_notify_masked is false and schedule NAPI.
(2) On the consumer side, the logic for waking the peer TXQ is moved out of veth_xdp_rcv() and placed at the end of the veth_poll() function. This placement is part of fixing the race, as the netif_tx_queue_stopped() check must occur after rx_notify_masked is potentially set to false during NAPI completion.
This handles the race where veth_poll() consumes all packets, but haven't
finished (rx_notify_masked is still true). The producer veth_xmit() stops the TXQ and __veth_xdp_flush(rq) will observe rx_notify_masked is true, meaning not starting NAPI. Then veth_poll() change rx_notify_masked to false and stops NAPI. Before exiting veth_poll() will observe TXQ is stopped and wake it up.
--- drivers/net/veth.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-)
drivers/net/veth.c +20 -18
@@ -392,14 +392,12 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) }/* Restore Eth hdr pulled by dev_forward_skb/eth_type_trans */ __skb_push (skb,ETH_HLEN ); -/* Depend on prior success packets started NAPI consumer via -* __veth_xdp_flush(). Cancel TXQ stop if consumer stopped, -* paired with empty check in veth_poll(). -*/ netif_tx_stop_queue (txq); -smp_mb__after_atomic (); -if (unlikely (__ptr_ring_empty (&rq->xdp_ring))) -netif_tx_wake_queue (txq); +/* Makes sure NAPI peer consumer runs. Consumer is responsible +* for starting txq again, until then ndo_start_xmit (this +* function) will not be invoked by the netstack again. +*/ +__veth_xdp_flush (rq);break ;case NET_RX_DROP :/* same as NET_XMIT_DROP */ drop:
@@ -900,17 +898,9 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget,struct veth_xdp_tx_bq *bq, struct veth_stats *stats) { - struct veth_priv *priv = netdev_priv(rq->dev); -int queue_idx = rq->xdp_rxq.queue_index; -struct netdev_queue *peer_txq; -struct net_device *peer_dev; int i, done = 0, n_xdpf = 0;void *xdpf[VETH_XDP_BATCH ]; -/* NAPI functions as RCU section */ - peer_dev =rcu_dereference_check (priv->peer,rcu_read_lock_bh_held ()); - peer_txq = peer_dev ?netdev_get_tx_queue (peer_dev, queue_idx) :NULL ; -for (i =0 ; i < budget; i++) {void *ptr =__ptr_ring_consume (&rq->xdp_ring);
@@ -959,9 +949,6 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget, rq->stats.vs.xdp_packets += done;u64_stats_update_end (&rq->stats.syncp); -if (peer_txq &&unlikely (netif_tx_queue_stopped (peer_txq))) -netif_tx_wake_queue (peer_txq); -return done; }
@@ -969,12 +956,20 @@ static int veth_poll(struct napi_struct *napi, int budget) {struct veth_rq *rq = container_of(napi, struct veth_rq, xdp_napi); +struct veth_priv *priv =netdev_priv (rq->dev); +int queue_idx = rq->xdp_rxq.queue_index; +struct netdev_queue *peer_txq;struct veth_stats stats = {}; +struct net_device *peer_dev;struct veth_xdp_tx_bq bq;int done; bq.count =0 ; +/* NAPI functions as RCU section */ + peer_dev =rcu_dereference_check (priv->peer,rcu_read_lock_bh_held ()); + peer_txq = peer_dev ?netdev_get_tx_queue (peer_dev, queue_idx) :NULL ; +xdp_set_return_frame_no_direct (); done =veth_xdp_rcv (rq, budget, &bq, &stats);
@@ -996,6 +991,13 @@ static int veth_poll(struct napi_struct *napi, int budget)veth_xdp_flush (rq, &bq);xdp_clear_return_frame_no_direct (); +/* Release backpressure per NAPI poll */ +smp_rmb ();/* Paired with netif_tx_stop_queue set_bit */ +if (peer_txq &&netif_tx_queue_stopped (peer_txq)) { +txq_trans_cond_update (peer_txq); +netif_tx_wake_queue (peer_txq); + } +return done; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/175 tools: riscv: Fixed misalignment of CSR related definitions
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Pei <[email protected]>
[ Upstream commit e2cb69263e797c0aa6676bcef23e9e27e44c83b0 ]
The file tools/arch/riscv/include/asm/csr.h borrows from arch/riscv/include/asm/csr.h, and subsequent modifications related to CSR should maintain consistency.
--- drivers/perf/riscv_pmu_sbi.c | 2 +- tools/arch/riscv/include/asm/csr.h | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/perf/riscv_pmu_sbi.c +1 -1
@@ -1019,7 +1019,7 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)/* compute hardware counter index */ hidx = info->csr -CSR_CYCLE ; -/* check if the corresponding bit is set in sscountovf or overflow mask in shmem */ +/* check if the corresponding bit is set in scountovf or overflow mask in shmem */ if (!(overflow &BIT (hidx)))continue ;
tools/arch/riscv/include/asm/csr.h +3 -2
@@ -167,7 +167,8 @@#define VSIP_TO_HVIP_SHIFT (IRQ_VS_SOFT - IRQ_S_SOFT)#define VSIP_VALID_MASK ((_AC(1, UL) << IRQ_S_SOFT) | \ (_AC(1, UL) << IRQ_S_TIMER) | \ - (_AC(1, UL) << IRQ_S_EXT)) + (_AC(1, UL) << IRQ_S_EXT) | \ + (_AC(1, UL) << IRQ_PMU_OVF))/* AIA CSR bits */ #define TOPI_IID_SHIFT 16
@@ -280,7 +281,7 @@#define CSR_HPMCOUNTER30H 0xc9e#define CSR_HPMCOUNTER31H 0xc9f -#define CSR_SSCOUNTOVF 0xda0 +#define CSR_SCOUNTOVF 0xda0#define CSR_SSTATUS 0x100#define CSR_SIE 0x104
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/175 nvmet-auth: update sc_c in target host hash calculation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Francis <[email protected]>
[ Upstream commit 159de7a825aea4242d3f8d32de5853d269dbe72f ]
Commit 7e091add9c43 "nvme-auth: update sc_c in host response" added the sc_c variable to the dhchap queue context structure which is appropriately set during negotiate and then used in the host response.
This breaks secure concat connections with a Linux target as the target code wasn't updated at the same time. This patch fixes this by adding a new sc_c variable to the host hash calculations.
--- drivers/nvme/target/auth.c | 4 ++-- drivers/nvme/target/fabrics-cmd-auth.c | 1 + drivers/nvme/target/nvmet.h | 1 + 3 files changed, 4 insertions(+), 2 deletions(-)
drivers/nvme/target/auth.c +2 -2
@@ -298,7 +298,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,const char *hash_name;u8 *challenge = req->sq->dhchap_c1;struct nvme_dhchap_key *transformed_key; -u8 buf[4 ], sc_c = ctrl->concat ?1 :0 ; +u8 buf[4 ];int ret; hash_name =nvme_auth_hmac_name (ctrl->shash_id);
@@ -367,7 +367,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, ret =crypto_shash_update (shash, buf,2 );if (ret) goto out; - *buf = sc_c; + *buf = req->sq->sc_c; ret =crypto_shash_update (shash, buf,1 );if (ret) goto out;
drivers/nvme/target/fabrics-cmd-auth.c +1 -0
@@ -43,6 +43,7 @@ static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d) data->auth_protocol[0 ].dhchap.halen, data->auth_protocol[0].dhchap.dhlen); req->sq->dhchap_tid =le16_to_cpu (data->t_id); + req->sq->sc_c = data->sc_c;if (data->sc_c !=NVME_AUTH_SECP_NOSC ) {if (!IS_ENABLED (CONFIG_NVME_TARGET_TCP_TLS ))return NVME_AUTH_DHCHAP_FAILURE_CONCAT_MISMATCH ;
drivers/nvme/target/nvmet.h +1 -0
@@ -159,6 +159,7 @@ struct nvmet_sq {bool authenticated;struct delayed_work auth_expired_work;u16 dhchap_tid; +u8 sc_c;u8 dhchap_status;u8 dhchap_step;u8 *dhchap_c1;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/175 nvme-multipath: fix lockdep WARN due to partition scan work
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 6d87cd5335784351280f82c47cc8a657271929c3 ]
Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partition_scan_work completion.
To avoid the lockdep WARN and the potential deadlock, cut the dependency by running the partition_scan_work not by kblockd workqueue but by nvme_wq.
--- drivers/nvme/host/multipath.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/multipath.c +1 -1
@@ -793,7 +793,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns)return ; }nvme_add_ns_head_cdev (head); -kblockd_schedule_work (&head->partition_scan_work); +queue_work (nvme_wq, &head->partition_scan_work); }nvme_mpath_add_sysfs_link (ns->head);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/175 drm/i915/xe3lpd: Load DMC for Xe3_LPD version 30.02
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dnyaneshwar Bhadane <[email protected]>
[ Upstream commit fa766e759ff7b128ab77323d9d9c232434621bb6 ]
Load the DMC for Xe3_LPD version 30.02.
--- drivers/gpu/drm/i915/display/intel_dmc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/display/intel_dmc.c +7 -3
@@ -127,6 +127,9 @@ static bool dmc_firmware_param_disabled(struct intel_display *display)#define DISPLAY_VER13_DMC_MAX_FW_SIZE 0x20000#define DISPLAY_VER12_DMC_MAX_FW_SIZE ICL_DMC_MAX_FW_SIZE +#define XE3LPD_3002_DMC_PATH DMC_PATH(xe3lpd_3002) +MODULE_FIRMWARE (XE3LPD_3002_DMC_PATH ); +#define XE3LPD_DMC_PATH DMC_PATH(xe3lpd)MODULE_FIRMWARE (XE3LPD_DMC_PATH );
@@ -183,9 +186,10 @@ static const char *dmc_firmware_default(struct intel_display *display, u32 *size {const char *fw_path =NULL ;u32 max_fw_size =0 ; - -if (DISPLAY_VERx100 (display) ==3002 || -DISPLAY_VERx100 (display) ==3000 ) { +if (DISPLAY_VERx100 (display) ==3002 ) { + fw_path =XE3LPD_3002_DMC_PATH ; + max_fw_size =XE2LPD_DMC_MAX_FW_SIZE ; + }else if (DISPLAY_VERx100 (display) ==3000 ) { fw_path =XE3LPD_DMC_PATH ; max_fw_size =XE2LPD_DMC_MAX_FW_SIZE ; }else if (DISPLAY_VERx100 (display) ==2000 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/175 s390/ctcm: Fix double-kfree
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Nikiforov <[email protected]>
[ Upstream commit da02a1824884d6c84c5e5b5ac373b0c9e3288ec2 ]
The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again.
Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'.
Bug detected by the clang static analyzer.
--- drivers/s390/net/ctcm_mpc.c | 1 - 1 file changed, 1 deletion(-)
drivers/s390/net/ctcm_mpc.c +0 -1
@@ -701,7 +701,6 @@ static void mpc_rcvd_sweep_req(struct mpcg_info *mpcginfo) grp->sweep_req_pend_num--;ctcmpc_send_sweep_resp (ch); -kfree (mpcginfo);return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/175 selftests: net: lib: Do not overwrite error messages
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit bed22c7b90af732978715a1789bca1c3cfa245a6 ]
ret_set_ksft_status() calls ksft_status_merge() with the current return status and the last one. It treats a non-zero return code from ksft_status_merge() as an indication that the return status was overwritten by the last one and therefore overwrites the return message with the last one.
Currently, ksft_status_merge() returns a non-zero return code even if the current return status and the last one are equal. This results in return messages being overwritten which is counter-productive since we are more interested in the first failure message and not the last one.
Fix by changing ksft_status_merge() to only return a non-zero return code if the current return status was actually changed.
Add a test case which checks that the first error message is not overwritten.
Before:
# ./lib_sh_test.sh
[...]
TEST: RET tfail2 tfail -> fail [FAIL]
retmsg=tfail expected tfail2
[...]
# echo $?
1After:
# ./lib_sh_test.sh [...] TEST: RET tfail2 tfail -> fail [ OK ] [...] # echo $? 0
--- tools/testing/selftests/net/forwarding/lib_sh_test.sh | 7 +++++++ tools/testing/selftests/net/lib.sh | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/lib_sh_test.sh +7 -0
@@ -30,6 +30,11 @@ tfail() do_test "tfail" false } +tfail2() +{ + do_test "tfail2" false +} + txfail() { FAIL_TO_XFAIL=yes do_test "txfail" false
@@ -132,6 +137,8 @@ test_ret() ret_subtest $ksft_fail "tfail" txfail tfail ret_subtest $ksft_xfail "txfail" txfail txfail + + ret_subtest $ksft_fail "tfail2" tfail2 tfail } exit_status_tests_run()
tools/testing/selftests/net/lib.sh +1 -1
@@ -43,7 +43,7 @@ __ksft_status_merge() weights[$i]=$((weight++)) done - if [[ ${weights[$a]} > ${weights[$b]} ]]; then + if [[ ${weights[$a]} -ge ${weights[$b]} ]]; then echo "$a" return 0 else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/175 net: airoha: Add wlan flowtable TX offload
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit a8bdd935d1ddb7186358fb60ffe84253e85340c8 ]
Introduce support to offload the traffic received on the ethernet NIC and forwarded to the wireless one using HW Packet Processor Engine (PPE) capabilities.
Stable-dep-of: 8e0a754b0836 ("net: airoha: Do not loopback traffic to GDM2 if it is available on the device")
--- drivers/net/ethernet/airoha/airoha_eth.h | 11 +++ drivers/net/ethernet/airoha/airoha_ppe.c | 103 ++++++++++++++++------- 2 files changed, 85 insertions(+), 29 deletions(-)
drivers/net/ethernet/airoha/airoha_eth.h +11 -0
@@ -252,6 +252,10 @@ enum {#define AIROHA_FOE_MAC_SMAC_ID GENMASK(20, 16)#define AIROHA_FOE_MAC_PPPOE_ID GENMASK(15, 0) +#define AIROHA_FOE_MAC_WDMA_QOS GENMASK(15, 12) +#define AIROHA_FOE_MAC_WDMA_BAND BIT(11) +#define AIROHA_FOE_MAC_WDMA_WCID GENMASK(10, 0) +struct airoha_foe_mac_info_common {u16 vlan1;u16 etype;
@@ -481,6 +485,13 @@ struct airoha_flow_table_entry {unsigned long cookie; }; +struct airoha_wdma_info { +u8 idx; +u8 queue; +u16 wcid; +u8 bss; +}; +/* RX queue to IRQ mapping: BIT(q) in IRQ(n) */ #define RX_IRQ0_BANK_PIN_MASK 0x839f#define RX_IRQ1_BANK_PIN_MASK 0x7fe00000
drivers/net/ethernet/airoha/airoha_ppe.c +74 -29
147 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/175 net: airoha: Do not loopback traffic to GDM2 if it is available on the device
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 8e0a754b0836d996802713bbebc87bc1cc17925c ]
Airoha_eth driver forwards offloaded uplink traffic (packets received on GDM1 and forwarded to GDM{3,4}) to GDM2 in order to apply hw QoS. This is correct if the device does not support a dedicated GDM2 port. In this case, in order to enable hw offloading for uplink traffic, the packets should be sent to GDM{3,4} directly.
--- drivers/net/ethernet/airoha/airoha_ppe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/airoha/airoha_ppe.c +1 -1
@@ -281,7 +281,7 @@ static int airoha_ppe_foe_entry_prepare(struct airoha_eth *eth,if (!airoha_is_valid_gdm_port (eth, port))return -EINVAL ; -if (dsa_port >=0 ) +if (dsa_port >=0 || eth->ports[1 ]) pse_port = port->id ==4 ?FE_PSE_PORT_GDM4 : port->id;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/175 platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit d8bb447efc5622577994287dc77c684fa8840b30 ]
isst_if_probe() uses pci_read_config_dword() that returns PCIBIOS_* codes. The return code is returned from the probe function as is but probe functions should return normal errnos. A proper implementation can be found in drivers/leds/leds-ss4200.c.
Convert PCIBIOS_* return codes using pcibios_err_to_errno() into normal errno before returning.
--- drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c +2 -2
@@ -108,11 +108,11 @@ static int isst_if_probe(struct pci_dev *pdev, const struct pci_device_id *ent) ret =pci_read_config_dword (pdev,0xD0 , &mmio_base);if (ret) -return ret; +return pcibios_err_to_errno (ret); ret =pci_read_config_dword (pdev,0xFC , &pcu_base);if (ret) -return ret; +return pcibios_err_to_errno (ret); pcu_base &=GENMASK (10 ,0 ); base_addr = (u64 )mmio_base <<23 | (u64 ) pcu_base <<12 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/175 platform/x86: intel-uncore-freq: fix all header kernel-doc warnings
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit db30233361f94e1a84450c607989bdb671100fb6 ]
In file uncore-frequency/uncore-frequency-common.h,
correct all kernel-doc warnings by adding missing leading " *" to some lines, adding a missing kernel-doc entry, and fixing a name typo.
Warning: uncore-frequency-common.h:50 bad line:
Storage for kobject attribute elc_low_threshold_percent
Warning: uncore-frequency-common.h:52 bad line:
Storage for kobject attribute elc_high_threshold_percent
Warning: uncore-frequency-common.h:54 bad line:
Storage for kobject attribute elc_high_threshold_enable
Warning: uncore-frequency-common.h:92 struct member
'min_freq_khz_kobj_attr' not described in 'uncore_data'
Warning: uncore-frequency-common.h:92 struct member
'die_id_kobj_attr' not described in 'uncore_data'
--- .../x86/intel/uncore-frequency/uncore-frequency-common.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.h +5 -4
@@ -40,7 +40,7 @@* @agent_type_mask: Bit mask of all hardware agents for this domain * @uncore_attr_group: Attribute group storage * @max_freq_khz_kobj_attr: Storage for kobject attribute max_freq_khz -* @mix_freq_khz_kobj_attr: Storage for kobject attribute min_freq_khz +* @min_freq_khz_kobj_attr: Storage for kobject attribute min_freq_khz * @initial_max_freq_khz_kobj_attr: Storage for kobject attribute initial_max_freq_khz * @initial_min_freq_khz_kobj_attr: Storage for kobject attribute initial_min_freq_khz * @current_freq_khz_kobj_attr: Storage for kobject attribute current_freq_khz
@@ -48,13 +48,14 @@* @fabric_cluster_id_kobj_attr: Storage for kobject attribute fabric_cluster_id * @package_id_kobj_attr: Storage for kobject attribute package_id * @elc_low_threshold_percent_kobj_attr: -Storage for kobject attribute elc_low_threshold_percent +* Storage for kobject attribute elc_low_threshold_percent * @elc_high_threshold_percent_kobj_attr: -Storage for kobject attribute elc_high_threshold_percent +* Storage for kobject attribute elc_high_threshold_percent * @elc_high_threshold_enable_kobj_attr: -Storage for kobject attribute elc_high_threshold_enable +* Storage for kobject attribute elc_high_threshold_enable * @elc_floor_freq_khz_kobj_attr: Storage for kobject attribute elc_floor_freq_khz * @agent_types_kobj_attr: Storage for kobject attribute agent_type +* @die_id_kobj_attr: Attribute storage for die_id information * @uncore_attrs: Attribute storage for group creation * * This structure is used to encapsulate all data related to uncore sysfs
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/175 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <[email protected]>
[ Upstream commit 896f1a2493b59beb2b5ccdf990503dbb16cb2256 ]
The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array.
Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_fp.c +3 -2
@@ -4,6 +4,7 @@* Copyright (c) 2019-2020 Marvell International Ltd. */ +#include <linux/array_size.h> #include <linux/netdevice.h> #include <linux/etherdevice.h> #include <linux/skbuff.h>
@@ -960,7 +961,7 @@ static inline void qede_tpa_cont(struct qede_dev *edev, {int i; -for (i =0 ; cqe->len_list[i]; i++) +for (i =0 ; cqe->len_list[i] && i <ARRAY_SIZE (cqe->len_list); i++)qede_fill_frag_skb (edev, rxq, cqe->tpa_agg_index,le16_to_cpu (cqe->len_list[i]));
@@ -985,7 +986,7 @@ static int qede_tpa_end(struct qede_dev *edev,dma_unmap_page (rxq->dev, tpa_info->buffer.mapping,PAGE_SIZE , rxq->data_direction); -for (i =0 ; cqe->len_list[i]; i++) +for (i =0 ; cqe->len_list[i] && i <ARRAY_SIZE (cqe->len_list); i++)qede_fill_frag_skb (edev, rxq, cqe->tpa_agg_index,le16_to_cpu (cqe->len_list[i]));if (unlikely (i >1 ))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/175 drm/pcids: Split PTL pciids group to make wcl subplatform
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dnyaneshwar Bhadane <[email protected]>
[ Upstream commit 6eb2e056b0e418718fc5a3cfe79bdb41d9a2851d ]
To form the WCL platform as a subplatform of PTL in definition, WCL pci ids are splited into saparate group from PTL. So update the pciidlist struct to cover all the pci ids.
v2:
- Squash wcl description in single patch for display and xe.(jani,gustavo)
--- drivers/gpu/drm/i915/display/intel_display_device.c | 1 + drivers/gpu/drm/xe/xe_pci.c | 1 + include/drm/intel/pciids.h | 5 ++++- 3 files changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_display_device.c +1 -0
@@ -1469,6 +1469,7 @@ static const struct {INTEL_LNL_IDS (INTEL_DISPLAY_DEVICE , &lnl_desc),INTEL_BMG_IDS (INTEL_DISPLAY_DEVICE , &bmg_desc),INTEL_PTL_IDS (INTEL_DISPLAY_DEVICE , &ptl_desc), + INTEL_WCL_IDS(INTEL_DISPLAY_DEVICE, &ptl_desc), }; static const struct {
drivers/gpu/drm/xe/xe_pci.c +1 -0
@@ -367,6 +367,7 @@ static const struct pci_device_id pciidlist[] = {INTEL_LNL_IDS (INTEL_VGA_DEVICE , &lnl_desc),INTEL_BMG_IDS (INTEL_VGA_DEVICE , &bmg_desc),INTEL_PTL_IDS (INTEL_VGA_DEVICE , &ptl_desc), +INTEL_WCL_IDS (INTEL_VGA_DEVICE , &ptl_desc), { } };MODULE_DEVICE_TABLE (pci, pciidlist);
include/drm/intel/pciids.h +4 -1
@@ -872,7 +872,10 @@ MACRO__(0xB08F, ## __VA_ARGS__), \ MACRO__(0xB090, ## __VA_ARGS__), \ MACRO__(0xB0A0, ## __VA_ARGS__), \ - MACRO__(0xB0B0, ## __VA_ARGS__), \ + MACRO__(0xB0B0, ## __VA_ARGS__) + +/* WCL */ +#define INTEL_WCL_IDS (MACRO__ , ...) \ MACRO__(0xFD80, ## __VA_ARGS__), \ MACRO__(0xFD81, ## __VA_ARGS__)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/175 drm/i915/display: Add definition for wcl as subplatform
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dnyaneshwar Bhadane <[email protected]>
[ Upstream commit 913253ed47b9925454cbb17faa3e350015b3d67a ]
We will need to differentiate between WCL and PTL in intel_encoder_is_c10phy(). Since WCL and PTL use the same display architecture, let's define WCL as a subplatform of PTL to allow the differentiation.
v2: Update commit message and reorder wcl define (Gustavo)
--- drivers/gpu/drm/i915/display/intel_display_device.c | 12 ++++++++++++ drivers/gpu/drm/i915/display/intel_display_device.h | 4 +++- 2 files changed, 15 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_display_device.c +12 -0
@@ -1391,8 +1391,20 @@ static const struct platform_desc bmg_desc = { PLATFORM_GROUP(dgfx), }; +static const u16 wcl_ids[] = { +INTEL_WCL_IDS (ID ), +0 +}; +static const struct platform_desc ptl_desc = {PLATFORM (pantherlake), + .subplatforms = (const struct subplatform_desc []) { + { +SUBPLATFORM (pantherlake, wildcatlake), + .pciidlist = wcl_ids, + }, + {}, + } };__diag_pop ();
drivers/gpu/drm/i915/display/intel_display_device.h +3 -1
@@ -102,7 +102,9 @@ struct pci_dev;/* Display ver 14.1 (based on GMD ID) */ \ func(battlemage) \ /* Display ver 30 (based on GMD ID) */ \ - func(pantherlake) + func(pantherlake) \ + func(pantherlake_wildcatlake) + #define __MEMBER(name) unsigned long name:1; #define __COUNT(x) 1 +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/175 drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dnyaneshwar Bhadane <[email protected]>
[ Upstream commit 5474560381775bc70cc90ed2acefad48ffd6ee07 ]
On PTL, no combo PHY is connected to PORT B. However, PORT B can still be used for Type-C and will utilize the C20 PHY for eDP over Type-C. In such configurations, VBTs also enumerate PORT B.
This leads to issues where PORT B is incorrectly identified as using the C10 PHY, due to the assumption that returning true for PORT B in intel_encoder_is_c10phy() would not cause problems.
Quoted 1 line
From PTL's perspective, only PORT A/PHY A uses the C10 PHY.
Update the helper intel_encoder_is_c10phy() to return true only for PORT A/PHY on PTL.
v2: Change the condition code style for ptl/wcl
Bspec: 72571,73944
--- drivers/gpu/drm/i915/display/intel_cx0_phy.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/display/intel_cx0_phy.c +6 -8
@@ -39,14 +39,12 @@ bool intel_encoder_is_c10phy(struct intel_encoder *encoder)struct intel_display *display =to_intel_display (encoder);enum phy phy =intel_encoder_to_phy (encoder); -/* PTL doesn't have a PHY connected to PORT B; as such, -* there will never be a case where PTL uses PHY B. -* WCL uses PORT A and B with the C10 PHY. -* Reusing the condition for WCL and extending it for PORT B -* should not cause any issues for PTL. -*/ -if (display->platform.pantherlake && phy <PHY_C ) -return true; +if (display->platform.pantherlake) { +if (display->platform.pantherlake_wildcatlake) +return phy <=PHY_B ; +else +return phy ==PHY_A ; + }if ((display->platform.lunarlake || display->platform.meteorlake) && phy <PHY_C )return true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/175 drm/xe/kunit: Fix forcewake assertion in mocs test
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit 905a3468ec679293949438393de7e61310432662 ]
The MOCS kunit test calls KUNIT_ASSERT_TRUE_MSG() with a condition of 'true;' this prevents the assertion from ever failing. Replace KUNIT_ASSERT_TRUE_MSG with KUNIT_FAIL_AND_ABORT to get the intended failure behavior in cases where forcewake was not acquired successfully.
--- drivers/gpu/drm/xe/tests/xe_mocs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/tests/xe_mocs.c +1 -1
@@ -49,7 +49,7 @@ static void read_l3cc_table(struct xe_gt *gt, fw_ref =xe_force_wake_get (gt_to_fw (gt),XE_FORCEWAKE_ALL );if (!xe_force_wake_ref_has_domain (fw_ref,XE_FORCEWAKE_ALL )) {xe_force_wake_put (gt_to_fw (gt), fw_ref); -KUNIT_ASSERT_TRUE_MSG (test, true,"Forcewake Failed.\n" ); +KUNIT_FAIL_AND_ABORT (test,"Forcewake Failed.\n" ); }for (i =0 ; i < info->num_mocs_regs; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/175 drm/xe/irq: Handle msix vector0 interrupt
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkata Ramana Nayana <[email protected]>
[ Upstream commit 5b38c22687d9287d85dd3bef2fa708bf62cf3895 ]
Current gu2host handler registered as MSI-X vector 0 and as per bspec for a msix vector 0 interrupt, the driver must check the legacy registers 190008(TILE_INT_REG), 190060h (GT INTR Identity Reg 0) and other registers mentioned in "Interrupt Service Routine Pseudocode" otherwise it will block the next interrupts. To overcome this issue replacing guc2host handler with legacy xe_irq_handler.
Bspec: 62357
--- drivers/gpu/drm/xe/xe_irq.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-)
drivers/gpu/drm/xe/xe_irq.c +1 -17
@@ -843,22 +843,6 @@ static int xe_irq_msix_init(struct xe_device *xe)return 0 ; } -static irqreturn_t guc2host_irq_handler (int irq,void *arg) -{ -struct xe_device *xe = arg; -struct xe_tile *tile; -u8 id; - -if (!atomic_read (&xe->irq.enabled)) -return IRQ_NONE ; - -for_each_tile (tile, xe, id) -xe_guc_irq_handler (&tile->primary_gt->uc.guc, -GUC_INTR_GUC2HOST ); - -return IRQ_HANDLED ; -} -static irqreturn_t xe_irq_msix_default_hwe_handler (int irq,void *arg) {unsigned int tile_id, gt_id;
@@ -975,7 +959,7 @@ int xe_irq_msix_request_irqs(struct xe_device *xe)u16 msix; msix =GUC2HOST_MSIX ; - err =xe_irq_msix_request_irq (xe, guc2host_irq_handler, xe, + err =xe_irq_msix_request_irq (xe,xe_irq_handler (xe), xe,DRIVER_NAME "-guc2host" , false, &msix);if (err)return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/175 idpf: fix possible vport_config NULL pointer deref in remove
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Tantilov <[email protected]>
[ Upstream commit 118082368c2b6ddefe6cb607efc312285148f044 ]
Attempting to remove the driver will cause a crash in cases where the vport failed to initialize. Following trace is from an instance where the driver failed during an attempt to create a VF:
[ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated [ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms) [ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028 ... [ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf] ... [ 1723.364973] Call Trace: [ 1723.365475] <TASK> [ 1723.365972] pci_device_remove+0x42/0xb0 [ 1723.366481] device_release_driver_internal+0x1a9/0x210 [ 1723.366987] pci_stop_bus_device+0x6d/0x90 [ 1723.367488] pci_stop_and_remove_bus_device+0x12/0x20 [ 1723.367971] pci_iov_remove_virtfn+0xbd/0x120 [ 1723.368309] sriov_disable+0x34/0xe0 [ 1723.368643] idpf_sriov_configure+0x58/0x140 [idpf] [ 1723.368982] sriov_numvfs_store+0xda/0x1c0
Avoid the NULL pointer dereference by adding NULL pointer check for vport_config[i], before freeing user_config.q_coalesce.
--- drivers/net/ethernet/intel/idpf/idpf_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/idpf/idpf_main.c +2 -0
@@ -62,6 +62,8 @@ static void idpf_remove(struct pci_dev *pdev)destroy_workqueue (adapter->vc_event_wq);for (i =0 ; i < adapter->max_vports; i++) { +if (!adapter->vport_config[i]) +continue ;kfree (adapter->vport_config[i]->user_config.q_coalesce);kfree (adapter->vport_config[i]); adapter->vport_config[i] =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/175 ice: fix PTP cleanup on driver removal in error path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grzegorz Nitka <[email protected]>
[ Upstream commit 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0 ]
Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case.
Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal.
The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage):
[ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice]
...
[ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice]
...
[ T93022] Call Trace: [ T93022] <TASK> [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? __warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice
33d2647ad4f6d866d41eefff1806df37c68aef0c]
...
[ T93022] ---[ end trace 0000000000000000 ]---
[ T93022] ice: module unloaded
--- drivers/net/ethernet/intel/ice/ice_ptp.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/ice/ice_ptp.c +19 -3
@@ -3246,7 +3246,7 @@ void ice_ptp_init(struct ice_pf *pf) err =ice_ptp_init_port (pf, &ptp->port);if (err) - goto err_exit; + goto err_clean_pf;/* Start the PHY timestamping block */ ice_ptp_reset_phy_timestamping (pf);
@@ -3263,13 +3263,19 @@ void ice_ptp_init(struct ice_pf *pf)dev_info (ice_pf_to_dev (pf),"PTP init successful\n" );return ; +err_clean_pf: +mutex_destroy (&ptp->port.ps_lock); +ice_ptp_cleanup_pf (pf); err_exit:/* If we registered a PTP clock, release it */ if (pf->ptp.clock) {ptp_clock_unregister (ptp->clock); pf->ptp.clock =NULL ; } - ptp->state =ICE_PTP_ERROR ; +/* Keep ICE_PTP_UNINIT state to avoid ambiguity at driver unload +* and to avoid duplicated resources release. +*/ + ptp->state =ICE_PTP_UNINIT ;dev_err (ice_pf_to_dev (pf),"PTP failed %d\n" , err); }
@@ -3282,9 +3288,19 @@ void ice_ptp_init(struct ice_pf *pf)*/ void ice_ptp_release (struct ice_pf *pf) { -if (pf->ptp.state !=ICE_PTP_READY ) +if (pf->ptp.state ==ICE_PTP_UNINIT )return ; +if (pf->ptp.state !=ICE_PTP_READY ) { +mutex_destroy (&pf->ptp.port.ps_lock); +ice_ptp_cleanup_pf (pf); +if (pf->ptp.clock) { +ptp_clock_unregister (pf->ptp.clock); + pf->ptp.clock =NULL ; + } +return ; + } + pf->ptp.state =ICE_PTP_UNINIT ;/* Disable timestamping for both Tx and Rx */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/175 pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jared Kangas <[email protected]>
[ Upstream commit 97ea34defbb57bfaf71ce487b1b0865ffd186e81 ]
s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its fields are initialized. Notably, num_custom_params is used in pinconf_generic_parse_dt_config(), resulting in intermittent allocation errors, such as the following splat when probing i2c-imx:
WARNING: CPU: 0 PID: 176 at mm/page_alloc.c:4795 __alloc_pages_noprof+0x290/0x300
[...]
Hardware name: NXP S32G3 Reference Design Board 3 (S32G-VNP-RDB3) (DT)
[...]
Call trace:
__alloc_pages_noprof+0x290/0x300 (P)
___kmalloc_large_node+0x84/0x168
__kmalloc_large_node_noprof+0x34/0x120
__kmalloc_noprof+0x2ac/0x378
pinconf_generic_parse_dt_config+0x68/0x1a0
s32_dt_node_to_map+0x104/0x248
dt_to_map_one_config+0x154/0x1d8
pinctrl_dt_to_map+0x12c/0x280
create_pinctrl+0x6c/0x270
pinctrl_get+0xc0/0x170
devm_pinctrl_get+0x50/0xa0
pinctrl_bind_pins+0x60/0x2a0
really_probe+0x60/0x3a0
[...]
__platform_driver_register+0x2c/0x40
i2c_adap_imx_init+0x28/0xff8 [i2c_imx]
[...]This results in later parse failures that can cause issues in dependent drivers:
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property
[...]
pca953x 0-0022: failed writing register: -6
i2c i2c-0: IMX I2C adapter registered
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property
i2c i2c-1: IMX I2C adapter registered
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property
i2c i2c-2: IMX I2C adapter registeredFix this by initializing s32_pinctrl_desc with devm_kzalloc() instead of devm_kmalloc() in s32_pinctrl_probe(), which sets the previously uninitialized fields to zero.
--- drivers/pinctrl/nxp/pinctrl-s32cc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/nxp/pinctrl-s32cc.c +1 -1
@@ -951,7 +951,7 @@ int s32_pinctrl_probe(struct platform_device *pdev,spin_lock_init (&ipctl->gpio_configs_lock); s32_pinctrl_desc = -devm_kmalloc (&pdev->dev,sizeof (*s32_pinctrl_desc),GFP_KERNEL ); +devm_kzalloc (&pdev->dev,sizeof (*s32_pinctrl_desc),GFP_KERNEL );if (!s32_pinctrl_desc)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/175 pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jared Kangas <[email protected]>
[ Upstream commit 6010d4d8b55b5d3ae1efb5502c54312e15c14f21 ]
s32_pmx_gpio_request_enable() does not initialize the newly-allocated gpio_pin_config::list before adding it to s32_pinctrl::gpio_configs. This could result in a linked list corruption.
Initialize the new list_head with INIT_LIST_HEAD() to fix this.
--- drivers/pinctrl/nxp/pinctrl-s32cc.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/nxp/pinctrl-s32cc.c +1 -0
@@ -392,6 +392,7 @@ static int s32_pmx_gpio_request_enable(struct pinctrl_dev *pctldev, gpio_pin->pin_id = offset; gpio_pin->config = config; +INIT_LIST_HEAD (&gpio_pin->list);spin_lock_irqsave (&ipctl->gpio_configs_lock, flags);list_add (&gpio_pin->list, &ipctl->gpio_configs);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/175 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit f94c1a114ac209977bdf5ca841b98424295ab1f0 ]
The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific rate_leaf_parent_set or rate_node_parent_set ops and decrementing the parent's refcount, without actually setting the devlink_rate->parent pointer to NULL.
This leaves a dangling pointer in the devlink_rate struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of devlink_nl_rate_parent_node_set, where the parent pointer is correctly cleared.
This patch fixes the issue by explicitly setting devlink_rate->parent to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects.
[1]
repro steps:
echo 1 > /sys/bus/netdevsim/new_device
devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device
dmesg:refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
[2]
devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core
dmesg:refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
--- net/devlink/rate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/devlink/rate.c +3 -1
@@ -828,13 +828,15 @@ void devl_rate_nodes_destroy(struct devlink *devlink)if (!devlink_rate->parent)continue ; -refcount_dec (&devlink_rate->parent->refcnt);if (devlink_rate_is_leaf (devlink_rate)) ops->rate_leaf_parent_set (devlink_rate,NULL , devlink_rate->priv,NULL ,NULL );else if (devlink_rate_is_node (devlink_rate)) ops->rate_node_parent_set (devlink_rate,NULL , devlink_rate->priv,NULL ,NULL ); + +refcount_dec (&devlink_rate->parent->refcnt); + devlink_rate->parent =NULL ; }list_for_each_entry_safe (devlink_rate, tmp, &devlink->rate_list, list) {if (devlink_rate_is_node (devlink_rate)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/175 net/mlx5: Clean up only new IRQ glue on request_irq() failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pradyumn Rahar <[email protected]>
[ Upstream commit d47515af6cccd7484d8b0870376858c9848a18ec ]
The mlx5_irq_alloc() function can inadvertently free the entire rmap and end up in a crash[1] when the other threads tries to access this, when request_irq() fails due to exhausted IRQ vectors. This commit modifies the cleanup to remove only the specific IRQ mapping that was just added.
This prevents removal of other valid mappings and ensures precise cleanup of the failed IRQ allocation's associated glue object.
Note: This error is observed when both fwctl and rds configs are enabled.
[1]mlx5_core 0000:05:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28
infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining supportmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:06:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28
infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining supportmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28
general protection fault, probably for non-canonical address
0xe277a58fde16f291: 0000 [#1] SMP NOPTI
RIP: 0010:free_irq_cpu_rmap+0x23/0x7d Call Trace: <TASK> ? show_trace_log_lvl+0x1d6/0x2f9 ? show_trace_log_lvl+0x1d6/0x2f9 ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] ? __die_body.cold+0x8/0xa ? die_addr+0x39/0x53 ? exc_general_protection+0x1c4/0x3e9 ? dev_vprintk_emit+0x5f/0x90 ? asm_exc_general_protection+0x22/0x27 ? free_irq_cpu_rmap+0x23/0x7d mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] irq_pool_request_vector+0x7d/0x90 [mlx5_core] mlx5_irq_request+0x2e/0xe0 [mlx5_core] mlx5_irq_request_vector+0xad/0xf7 [mlx5_core] comp_irq_request_pci+0x64/0xf0 [mlx5_core] create_comp_eq+0x71/0x385 [mlx5_core] ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core] mlx5_comp_eqn_get+0x72/0x90 [mlx5_core] ? xas_load+0x8/0x91 mlx5_comp_irqn_get+0x40/0x90 [mlx5_core] mlx5e_open_channel+0x7d/0x3c7 [mlx5_core] mlx5e_open_channels+0xad/0x250 [mlx5_core] mlx5e_open_locked+0x3e/0x110 [mlx5_core] mlx5e_open+0x23/0x70 [mlx5_core] __dev_open+0xf1/0x1a5 __dev_change_flags+0x1e1/0x249 dev_change_flags+0x21/0x5c do_setlink+0x28b/0xcc4 ? __nla_parse+0x22/0x3d ? inet6_validate_link_af+0x6b/0x108 ? cpumask_next+0x1f/0x35 ? __snmp6_fill_stats64.constprop.0+0x66/0x107 ? __nla_validate_parse+0x48/0x1e6 __rtnl_newlink+0x5ff/0xa57 ? kmem_cache_alloc_trace+0x164/0x2ce rtnl_newlink+0x44/0x6e rtnetlink_rcv_msg+0x2bb/0x362 ? __netlink_sendskb+0x4c/0x6c ? netlink_unicast+0x28f/0x2ce ? rtnl_calcit.isra.0+0x150/0x146 netlink_rcv_skb+0x5f/0x112 netlink_unicast+0x213/0x2ce netlink_sendmsg+0x24f/0x4d9 __sock_sendmsg+0x65/0x6a ____sys_sendmsg+0x28f/0x2c9 ? import_iovec+0x17/0x2b ___sys_sendmsg+0x97/0xe0 __sys_sendmsg+0x81/0xd8 do_syscall_64+0x35/0x87 entry_SYSCALL_64_after_hwframe+0x6e/0x0 RIP: 0033:0x7fc328603727 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed
ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48
RSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727
RDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d
RBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ffe8eb3f3c8 R15: 00007ffe8eb3f3bc
</TASK> ---[ end trace f43ce73c3c2b13a2 ]--- RIP: 0010:free_irq_cpu_rmap+0x23/0x7d Code: 0f 1f 80 00 00 00 00 48 85 ff 74 6b 55 48 89 fd 53 66 83 7f 06 00 74 24 31 db 48 8b 55 08 0f b7 c3 48 8b 04 c2 48 85 c0 74 09 <8b> 38 31 f6 e8 c4 0a b8 ff 83 c3 01 66 3b 5d 06 72 de b8 ff ff ff RSP: 0018:ff384881640eaca0 EFLAGS: 00010282 RAX: e277a58fde16f291 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ff2335e2e20b3600 RSI: 0000000000000000 RDI: ff2335e2e20b3400 RBP: ff2335e2e20b3400 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 00000000ffffffe4 R12: ff384881640ead88 R13: ff2335c3760751e0 R14: ff2335e2e1672200 R15: ff2335c3760751f8 FS: 00007fc32ac22480(0000) GS:ff2335e2d6e00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f651ab54000 CR3: 00000029f1206003 CR4: 0000000000771ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x1dc00000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff)
kvm-guest: disable async PF for cpu 0
--- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +2 -4
@@ -324,10 +324,8 @@ struct mlx5_irq *mlx5_irq_alloc(struct mlx5_irq_pool *pool, int i,free_irq (irq->map.virq, &irq->nh); err_req_irq:#ifdef CONFIG_RFS_ACCEL -if (i && rmap && *rmap) { -free_irq_cpu_rmap (*rmap); - *rmap =NULL ; - } +if (i && rmap && *rmap) +irq_cpu_rmap_remove (*rmap, irq->map.virq); err_irq_rmap:#endif if (i &&pci_msix_can_alloc_dyn (dev->pdev))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/175 af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic().
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 7bf3a476ce43833c49fceddbe94ff3472e04e9bc ]
Miao Wang reported a bug of SO_PEEK_OFF on AF_UNIX SOCK_STREAM socket.
The unexpected behaviour is triggered when the peek offset is larger than the recv queue and the thread is unblocked by new data.
Let's assume a socket which has "aaaa" in the recv queue and the peek offset is 4.
First, unix_stream_read_generic() reads the offset 4 and skips the skb(s) of "aaaa" with the code below:
skip = max(sk_peek_offset(sk, flags), 0); /* @skip is 4. */
do {
...
while (skip >= unix_skb_len(skb)) {
skip -= unix_skb_len(skb);
...
skb = skb_peek_next(skb, &sk->sk_receive_queue);
if (!skb)
goto again; /* @skip is 0. */
}The thread jumps to the 'again' label and goes to sleep since new data has not arrived yet.
Later, new data "bbbb" unblocks the thread, and the thread jumps to the 'redo:' label to restart the entire process from the first skb in the recv queue.
do {
...
redo:
...
last = skb = skb_peek(&sk->sk_receive_queue);
...
again:
if (skb == NULL) {
...
timeo = unix_stream_data_wait(sk, timeo, last,
last_len, freezable);
...
goto redo; /* @skip is 0 !! */However, the peek offset is not reset in the path.
If the buffer size is 8, recv() will return "aaaabbbb" without skipping any data, and the final offset will be 12 (the original offset 4 + peeked skbs' length 8).
After sleeping in unix_stream_read_generic(), we have to fetch the peek offset again.
Let's move the redo label before mutex_lock(&u->iolock).
--- net/unix/af_unix.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/unix/af_unix.c +1 -2
@@ -2954,6 +2954,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, u =unix_sk (sk); +redo:/* Lock the socket to prevent queue disordering * while sleeps in memcpy_tomsg */
@@ -2965,7 +2966,6 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,struct sk_buff *skb, *last;int chunk; -redo:unix_state_lock (sk);if (sock_flag (sk,SOCK_DEAD )) { err = -ECONNRESET ;
@@ -3015,7 +3015,6 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, goto out; } -mutex_lock (&u->iolock); goto redo; unlock:unix_state_unlock (sk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/175 gpio: cdev: make sure the cdev fd is still active before emitting events
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 ]
With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier.
Using the regular get_file() routine in this situation triggers the following warning:
struct file::f_count incremented from zero; use-after-free condition present!
So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.
--- drivers/gpio/gpiolib-cdev.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpio/gpiolib-cdev.c +7 -2
@@ -2548,10 +2548,17 @@ static int lineinfo_changed_notify(struct notifier_block *nb, container_of(nb, struct gpio_chardev_data, lineinfo_changed_nb);struct lineinfo_changed_ctx *ctx;struct gpio_desc *desc = data; +struct file *fp;if (!test_bit (gpio_chip_hwgpio (desc), cdev->watched_lines))return NOTIFY_DONE ; +/* Keep the file descriptor alive for the duration of the notification. */ + fp =get_file_active (&cdev->fp); +if (!fp) +/* Chardev file descriptor was or is being released. */ +return NOTIFY_DONE ; +/* * If this is called from atomic context (for instance: with a spinlock * taken by the atomic notifier chain), any sleeping calls must be done
@@ -2575,8 +2582,6 @@ static int lineinfo_changed_notify(struct notifier_block *nb,/* Keep the GPIO device alive until we emit the event. */ ctx->gdev =gpio_device_get (desc->gdev); ctx->cdev = cdev; -/* Keep the file descriptor alive too. */ -get_file (ctx->cdev->fp);INIT_WORK (&ctx->work, lineinfo_changed_func);queue_work (ctx->gdev->line_state_wq, &ctx->work);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/175 net: phylink: add missing supported link modes for the fixed-link
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit e31a11be41cd134f245c01d1329e7bc89aba78fb ]
Pause, Asym_Pause and Autoneg bits are not set when pl->supported is initialized, so these link modes will not work for the fixed-link. This leads to a TCP performance degradation issue observed on the i.MX943 platform.
The switch CPU port of i.MX943 is connected to an ENETC MAC, this link is a fixed link and the link speed is 2.5Gbps. And one of the switch user ports is the RGMII interface, and its link speed is 1Gbps. If the flow-control of the fixed link is not enabled, we can easily observe the iperf performance of TCP packets is very low. Because the inbound rate on the CPU port is greater than the outbound rate on the user port, the switch is prone to congestion, leading to the loss of some TCP packets and requiring multiple retransmissions.
Solving this problem should be as simple as setting the Asym_Pause and Pause bits. The reason why the Autoneg bit needs to be set, Russell has gave a very good explanation in the thread [1], see below.
"As the advertising and lp_advertising bitmasks have to be non-empty, and the swphy reports aneg capable, aneg complete, and AN enabled, then for consistency with that state, Autoneg should be set. This is how it was prior to the blamed commit."
--- drivers/net/phy/phylink.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/phy/phylink.c +3 -0
@@ -637,6 +637,9 @@ static int phylink_validate(struct phylink *pl, unsigned long *supported,static void phylink_fill_fixedlink_supported (unsigned long *supported) { +linkmode_set_bit (ETHTOOL_LINK_MODE_Pause_BIT, supported); +linkmode_set_bit (ETHTOOL_LINK_MODE_Asym_Pause_BIT, supported); +linkmode_set_bit (ETHTOOL_LINK_MODE_Autoneg_BIT, supported);linkmode_set_bit (ETHTOOL_LINK_MODE_10baseT_Half_BIT, supported);linkmode_set_bit (ETHTOOL_LINK_MODE_10baseT_Full_BIT, supported);linkmode_set_bit (ETHTOOL_LINK_MODE_100baseT_Half_BIT, supported);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/175 tick/sched: Fix bogus condition in report_idle_softirq()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Yang <[email protected]>
[ Upstream commit 807e0d187da4c0b22036b5e34000f7a8c52f6e50 ]
In commit 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") the new function report_idle_softirq() was created by breaking code out of the existing can_stop_idle_tick() for kernels v5.18 and newer.
In doing so, the code essentially went from this form:
if (A) {
static int ratelimit;
if (ratelimit < 10 && !C && A&D) {
pr_warn("NOHZ tick-stop error: ...");
ratelimit++;
}
return false;
}to a new function:
static bool report_idle_softirq(void)
{
static int ratelimit;
if (likely(!A))
return false;
if (ratelimit < 10)
return false;
...
pr_warn("NOHZ tick-stop error: local softirq work is pending, handler #%02x!!!\n",
pending);
ratelimit++;
return true;
}commit a7e282c77785 ("tick/rcu: Fix bogus ratelimit condition") realized ratelimit was essentially set to zero instead of ten, and hence *no* softirq pending messages would ever be issued, but "fixed" it as:
- if (ratelimit < 10)
+ if (ratelimit >= 10)
return false;
However, this fix introduced another issue:
When ratelimit is greater than or equal 10, even if A is true, it will directly return false. While ratelimit in the original code was only used to control printing and will not affect the return value.
Restore the original logic and restrict ratelimit to control the printk and not the return value.
--- kernel/time/tick-sched.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
kernel/time/tick-sched.c +5 -6
@@ -1152,16 +1152,15 @@ static bool report_idle_softirq(void)return false; } -if (ratelimit >=10 ) -return false; -/* On RT, softirq handling may be waiting on some lock */ if (local_bh_blocked ())return false; -pr_warn ("NOHZ tick-stop error: local softirq work is pending, handler #%02x!!!\n" , - pending); - ratelimit++; +if (ratelimit <10 ) { +pr_warn ("NOHZ tick-stop error: local softirq work is pending, handler #%02x!!!\n" , + pending); + ratelimit++; + }return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/175 LoongArch: Use UAPI types in ptrace UAPI header
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 20d7338f2d3bcb570068dd6d39b16f1a909fe976 ]
The kernel UAPI headers already contain fixed-width integer types, there is no need to rely on the libc types. There may not be a libc available or the libc may not provides the <stdint.h>, like for example on nolibc.
This also aligns the header with the rest of the LoongArch UAPI headers.
--- arch/loongarch/include/uapi/asm/ptrace.h | 40 +++++++++++------------- 1 file changed, 18 insertions(+), 22 deletions(-)
arch/loongarch/include/uapi/asm/ptrace.h +18 -22
@@ -10,10 +10,6 @@#include <linux/types.h> -#ifndef __KERNEL__ -#include <stdint.h> -#endif -/* * For PTRACE_{POKE,PEEK}USR. 0 - 31 are GPRs, * 32 is syscall's original ARG0, 33 is PC, 34 is BADVADDR.
@@ -41,44 +37,44 @@ struct user_pt_regs { } __attribute__((aligned(8)));struct user_fp_state { -uint64_t fpr[32 ]; -uint64_t fcc; -uint32_t fcsr; +__u64 fpr[32 ]; +__u64 fcc; +__u32 fcsr; };struct user_lsx_state {/* 32 registers, 128 bits width per register. */ -uint64_t vregs[32 *2 ]; +__u64 vregs[32 *2 ]; };struct user_lasx_state {/* 32 registers, 256 bits width per register. */ -uint64_t vregs[32 *4 ]; +__u64 vregs[32 *4 ]; };struct user_lbt_state { -uint64_t scr[4 ]; -uint32_t eflags; -uint32_t ftop; +__u64 scr[4 ]; +__u32 eflags; +__u32 ftop; };struct user_watch_state { -uint64_t dbg_info; +__u64 dbg_info;struct { -uint64_t addr; -uint64_t mask; -uint32_t ctrl; -uint32_t pad; +__u64 addr; +__u64 mask; +__u32 ctrl; +__u32 pad; } dbg_regs[8 ]; };struct user_watch_state_v2 { -uint64_t dbg_info; +__u64 dbg_info;struct { -uint64_t addr; -uint64_t mask; -uint32_t ctrl; -uint32_t pad; +__u64 addr; +__u64 mask; +__u32 ctrl; +__u32 pad; } dbg_regs[14 ]; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/175 cifs: fix memory leak in smb3_fs_context_parse_param error path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <[email protected]>
[ Upstream commit 7e4d9120cfa413dd34f4f434befc5dbe6c38b2e5 ]
Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated for the source strings is correctly freed on all error paths, matching the cleanup already performed in the success path by smb3_cleanup_fs_context_contents().
Pointers are also set to NULL after freeing to prevent potential double-free issues.
This change fixes a memory leak originally detected by syzbot. The leak occurred when processing Opt_source mount options if an error happened after ctx->source and fc->source were successfully allocated but before the function completed.
The specific leak sequence was:
1. ctx->source = smb3_fs_context_fullpath(ctx, '/') allocates memory
2. fc->source = kstrdup(ctx->source, GFP_KERNEL) allocates more memory
3. A subsequent error jumps to cifs_parse_mount_err
4. The old error handler freed passwords but not the source strings, causing the memory to leak.
This issue was not addressed by commit e8c73eb7db0a ("cifs: client:
fix memory leak in smb3_fs_context_parse_param"), which only fixed leaks from repeated fsconfig() calls but not this error path.
Patch updated with minor change suggested by kernel test robot
--- fs/smb/client/fs_context.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/smb/client/fs_context.c +4 -0
@@ -1829,6 +1829,10 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, ctx->password =NULL ;kfree_sensitive (ctx->password2); ctx->password2 =NULL ; +kfree (ctx->source); + ctx->source =NULL ; +kfree (fc->source); + fc->source =NULL ;return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/175 perf: Fix 0 count issue of cpu-clock
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
[ Upstream commit f1f96511b1c4c33e53f05909dd267878e0643a9a ]
Currently cpu-clock event always returns 0 count, e.g.,
perf stat -e cpu-clock -- sleep 1
Performance counter stats for 'sleep 1':
0 cpu-clock # 0.000 CPUs utilized
1.002308394 seconds time elapsed
The root cause is the commit 'bc4394e5e79c ("perf: Fix the throttle
error of some clock events")' adds PERF_EF_UPDATE flag check before
calling cpu_clock_event_update() to update the count, however the PERF_EF_UPDATE flag is never set when the cpu-clock event is stopped in counting mode (pmu->dev() -> cpu_clock_event_del() -> cpu_clock_event_stop()). This leads to the cpu-clock event count is never updated.
To fix this issue, force to set PERF_EF_UPDATE flag for cpu-clock event just like what task-clock does.
--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -11885,7 +11885,7 @@ static int cpu_clock_event_add(struct perf_event *event, int flags)static void cpu_clock_event_del (struct perf_event *event,int flags) { -cpu_clock_event_stop (event, flags); +cpu_clock_event_stop (event,PERF_EF_UPDATE ); }static void cpu_clock_event_read (struct perf_event *event)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/175 vsock: Ignore signal/timeout on connect() if already established
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 002541ef650b742a198e4be363881439bb9d86b4 ]
During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues:
1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated vvs->bytes_unsent. Which, in turn, confuses the SOCK_LINGER handling.
2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs.
3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref.
Do not disconnect socket on signal/timeout. Keep the logic for unconnected
sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg().
[1]: https://lore.kernel.org/netdev/[email protected]/
[2]: https://lore.kernel.org/netdev/[email protected]/
[3]: https://lore.kernel.org/netdev/[email protected]/
--- net/vmw_vsock/af_vsock.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-)
net/vmw_vsock/af_vsock.c +31 -9
@@ -1666,18 +1666,40 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr, timeout =schedule_timeout (timeout);lock_sock (sk); -if (signal_pending (current)) { - err =sock_intr_errno (timeout); - sk->sk_state = sk->sk_state ==TCP_ESTABLISHED ?TCP_CLOSING :TCP_CLOSE ; - sock->state =SS_UNCONNECTED ; -vsock_transport_cancel_pkt (vsk); -vsock_remove_connected (vsk); - goto out_wait; - }else if ((sk->sk_state !=TCP_ESTABLISHED ) && (timeout ==0 )) { - err = -ETIMEDOUT ; +/* Connection established. Whatever happens to socket once we +* release it, that's not connect()'s concern. No need to go +* into signal and timeout handling. Call it a day. +* +* Note that allowing to "reset" an already established socket +* here is racy and insecure. +*/ +if (sk->sk_state ==TCP_ESTABLISHED ) +break ; + +/* If connection was _not_ established and a signal/timeout came +* to be, we want the socket's state reset. User space may want +* to retry. +* +* sk_state != TCP_ESTABLISHED implies that socket is not on +* vsock_connected_table. We keep the binding and the transport +* assigned. +*/ +if (signal_pending (current) || timeout ==0 ) { + err = timeout ==0 ? -ETIMEDOUT :sock_intr_errno (timeout); + +/* Listener might have already responded with +* VIRTIO_VSOCK_OP_RESPONSE. Its handling expects our +* sk_state == TCP_SYN_SENT, which hereby we break. +* In such case VIRTIO_VSOCK_OP_RST will follow. +*/ sk->sk_state =TCP_CLOSE ; sock->state =SS_UNCONNECTED ; + +/* Try to cancel VIRTIO_VSOCK_OP_REQUEST skb sent out by +* transport->connect(). +*/ vsock_transport_cancel_pkt (vsk); + goto out_wait; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/175 timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malaya Kumar Rout <[email protected]>
[ Upstream commit 7b5ab04f035f829ed6008e4685501ec00b3e73c9 ]
tk_aux_sysfs_init() returns immediately on error during the auxiliary clock initialization loop without cleaning up previously allocated kobjects and sysfs groups.
If kobject_create_and_add() or sysfs_create_group() fails during loop iteration, the parent kobjects (tko and auxo) and any previously created child kobjects are leaked.
Fix this by adding proper error handling with goto labels to ensure all allocated resources are cleaned up on failure. kobject_put() on the parent kobjects will handle cleanup of their children.
--- kernel/time/timekeeping.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
kernel/time/timekeeping.c +12 -9
@@ -3060,29 +3060,32 @@ static const struct attribute_group aux_clock_enable_attr_group = {static int __init tk_aux_sysfs_init (void ) {struct kobject *auxo, *tko =kobject_create_and_add ("time" , kernel_kobj); +int ret = -ENOMEM ;if (!tko) -return -ENOMEM ; +return ret; auxo =kobject_create_and_add ("aux_clocks" , tko); -if (!auxo) { -kobject_put (tko); -return -ENOMEM ; - } +if (!auxo) + goto err_clean;for (int i =0 ; i <MAX_AUX_CLOCKS ; i++) {char id[2 ] = { [0 ] ='0' + i, };struct kobject *clk =kobject_create_and_add (id, auxo);if (!clk) -return -ENOMEM ; - -int ret =sysfs_create_group (clk, &aux_clock_enable_attr_group); + goto err_clean; + ret =sysfs_create_group (clk, &aux_clock_enable_attr_group);if (ret) -return ret; + goto err_clean; }return 0 ; + +err_clean: +kobject_put (auxo); +kobject_put (tko); +return ret; }late_initcall (tk_aux_sysfs_init);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/175 MIPS: kernel: Fix random segmentation faults
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <[email protected]>
[ Upstream commit 14b46ba92bf547508b4a49370c99aba76cb53b53 ]
Commit 69896119dc9d ("MIPS: vdso: Switch to generic storage implementation") switches to a generic vdso storage, which increases the number of data pages from 1 to 4. But there is only one page reserved, which causes segementation faults depending where the VDSO area is randomized to. To fix this use the same size of reservation and allocation of the VDSO data pages.
--- arch/mips/kernel/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/process.c +1 -1
@@ -692,7 +692,7 @@ unsigned long mips_stack_top(void)/* Space for the VDSO, data page & GIC user page */ if (current->thread.abi) { top -=PAGE_ALIGN (current->thread.abi->vdso->size); - top -=PAGE_SIZE ; + top -=VDSO_NR_PAGES *PAGE_SIZE ; top -=mips_gic_present () ?PAGE_SIZE :0 ;/* Space to randomize the VDSO base */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/175 ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 2-in-1 14AKP10
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: J-Donald Tournier <[email protected]>
[ Upstream commit 1386d16761c0b569efedb998f56c1ae048a086e2 ]
This laptop requires the same quirk as Lenovo Yoga9 14IAP7 for fixing the bass speaker problems.
Use HDA_CODEC_QUIRK to match on the codec SSID to avoid conflict with the Lenovo Legion Slim 7 16IRH8, which has the same PCI SSID.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7082,6 +7082,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x38a9 ,"Thinkbook 16P" ,ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD ),SND_PCI_QUIRK (0x17aa ,0x38ab ,"Thinkbook 16P" ,ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD ),SND_PCI_QUIRK (0x17aa ,0x38b4 ,"Legion Slim 7 16IRH8" ,ALC287_FIXUP_CS35L41_I2C_2 ), +HDA_CODEC_QUIRK (0x17aa ,0x391c ,"Lenovo Yoga 7 2-in-1 14AKP10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x38b5 ,"Legion Slim 7 16IRH8" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x38b6 ,"Legion Slim 7 16APH8" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x17aa, 0x38b7, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/175 sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
[ Upstream commit 14c1da3895a116f4e32c20487046655f26d3999b ]
On systems with >4096 CPUs, scx_kick_cpus_pnt_seqs allocation fails during boot because it exceeds the 32,768 byte percpu allocator limit.
Restructure to use DEFINE_PER_CPU() for the per-CPU pointers, with each CPU pointing to its own kvzalloc'd array. Move allocation from boot time to scx_enable() and free in scx_disable(), so the O(nr_cpu_ids^2) memory is only consumed when sched_ext is active.
Use RCU to guard against racing with free. Arrays are freed via call_rcu() and kick_cpus_irq_workfn() uses rcu_dereference_bh() with a NULL check.
While at it, rename to scx_kick_pseqs for brevity and update comments to clarify these are pick_task sequence numbers.
v2: RCU protect scx_kick_seqs to manage kick_cpus_irq_workfn() racing
against disable as per Andrea.
v3: Fix bugs notcied by Andrea.
--- kernel/sched/ext.c | 89 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 79 insertions(+), 10 deletions(-)
kernel/sched/ext.c +79 -10
@@ -67,8 +67,19 @@ static unsigned long scx_watchdog_timestamp = INITIAL_JIFFIES;static struct delayed_work scx_watchdog_work; -/* for %SCX_KICK_WAIT */ -static unsigned long __percpu *scx_kick_cpus_pnt_seqs; +/* +* For %SCX_KICK_WAIT: Each CPU has a pointer to an array of pick_task sequence +* numbers. The arrays are allocated with kvzalloc() as size can exceed percpu +* allocator limits on large machines. O(nr_cpu_ids^2) allocation, allocated +* lazily when enabling and freed when disabling to avoid waste when sched_ext +* isn't active. +*/ +struct scx_kick_pseqs { +struct rcu_head rcu; +unsigned long seqs[]; +}; + +static DEFINE_PER_CPU(struct scx_kick_pseqs __rcu *, scx_kick_pseqs);/* * Direct dispatch marker.
@@ -3905,6 +3916,27 @@ static const char *scx_exit_reason(enum scx_exit_kind kind) } } +static void free_kick_pseqs_rcu (struct rcu_head *rcu) +{ + struct scx_kick_pseqs *pseqs = container_of(rcu, struct scx_kick_pseqs, rcu); + +kvfree (pseqs); +} + +static void free_kick_pseqs (void ) +{ +int cpu; + +for_each_possible_cpu (cpu) { +struct scx_kick_pseqs **pseqs =per_cpu_ptr (&scx_kick_pseqs, cpu); +struct scx_kick_pseqs *to_free; + + to_free =rcu_replace_pointer (*pseqs,NULL , true); +if (to_free) +call_rcu (&to_free->rcu, free_kick_pseqs_rcu); + } +} +static void scx_disable_workfn (struct kthread_work *work) { struct scx_sched *sch = container_of(work, struct scx_sched, disable_work);
@@ -4041,6 +4073,7 @@ static void scx_disable_workfn(struct kthread_work *work)free_percpu (scx_dsp_ctx); scx_dsp_ctx =NULL ; scx_dsp_max_batch =0 ; +free_kick_pseqs ();mutex_unlock (&scx_enable_mutex);
@@ -4402,6 +4435,33 @@ static void scx_vexit(struct scx_sched *sch,irq_work_queue (&sch->error_irq_work); } +static int alloc_kick_pseqs (void ) +{ +int cpu; + +/* +* Allocate per-CPU arrays sized by nr_cpu_ids. Use kvzalloc as size +* can exceed percpu allocator limits on large machines. +*/ +for_each_possible_cpu (cpu) { +struct scx_kick_pseqs **pseqs =per_cpu_ptr (&scx_kick_pseqs, cpu); +struct scx_kick_pseqs *new_pseqs; + +WARN_ON_ONCE (rcu_access_pointer (*pseqs)); + + new_pseqs =kvzalloc_node (struct_size (new_pseqs, seqs, nr_cpu_ids), +GFP_KERNEL ,cpu_to_node (cpu)); +if (!new_pseqs) { +free_kick_pseqs (); +return -ENOMEM ; + } + +rcu_assign_pointer (*pseqs, new_pseqs); + } + +return 0 ; +} +static struct scx_sched *scx_alloc_and_add_sched (struct sched_ext_ops *ops) {struct scx_sched *sch;
@@ -4547,15 +4607,19 @@ static int scx_enable(struct sched_ext_ops *ops, struct bpf_link *link)mutex_lock (&scx_enable_mutex); + ret =alloc_kick_pseqs (); +if (ret) + goto err_unlock; +if (scx_enable_state () !=SCX_DISABLED ) { ret = -EBUSY ; - goto err_unlock; + goto err_free_pseqs; } sch =scx_alloc_and_add_sched (ops);if (IS_ERR (sch)) { ret =PTR_ERR (sch); - goto err_unlock; + goto err_free_pseqs; }/*
@@ -4759,6 +4823,8 @@ static int scx_enable(struct sched_ext_ops *ops, struct bpf_link *link)return 0 ; +err_free_pseqs: +free_kick_pseqs (); err_unlock:mutex_unlock (&scx_enable_mutex);return ret;
@@ -5140,10 +5206,18 @@ static void kick_cpus_irq_workfn(struct irq_work *irq_work) {struct rq *this_rq =this_rq ();struct scx_rq *this_scx = &this_rq->scx; -unsigned long *pseqs =this_cpu_ptr (scx_kick_cpus_pnt_seqs); +struct scx_kick_pseqs __rcu *pseqs_pcpu =__this_cpu_read (scx_kick_pseqs);bool should_wait = false; +unsigned long *pseqs;s32 cpu; +if (unlikely (!pseqs_pcpu)) { +pr_warn_once ("kick_cpus_irq_workfn() called with NULL scx_kick_pseqs" ); +return ; + } + + pseqs =rcu_dereference_bh (pseqs_pcpu)->seqs; +for_each_cpu (cpu, this_scx->cpus_to_kick) { should_wait |=kick_one_cpu (cpu, this_rq, pseqs);cpumask_clear_cpu (cpu, this_scx->cpus_to_kick);
@@ -5266,11 +5340,6 @@ void __init init_sched_ext_class(void)scx_idle_init_masks (); - scx_kick_cpus_pnt_seqs = -__alloc_percpu (sizeof (scx_kick_cpus_pnt_seqs[0 ]) * nr_cpu_ids, - __alignof__(scx_kick_cpus_pnt_seqs [0 ])); -BUG_ON (!scx_kick_cpus_pnt_seqs); -for_each_possible_cpu (cpu) {struct rq *rq =cpu_rq (cpu);int n =cpu_to_node (cpu);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/175 bcma: dont register devices disabled in OF
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit a2a69add80411dd295c9088c1bcf925b1f4e53d7 ]
Some bus devices can be marked as disabled for specific SoCs or models. Those should not be registered to avoid probing them.
--- drivers/bcma/main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/bcma/main.c +6 -0
@@ -294,6 +294,8 @@ static int bcma_register_devices(struct bcma_bus *bus)int err;list_for_each_entry (core, &bus->cores, list) { +struct device_node *np; +/* We support that core ourselves */ switch (core->id.id) {case BCMA_CORE_4706_CHIPCOMMON :
@@ -311,6 +313,10 @@ static int bcma_register_devices(struct bcma_bus *bus)if (bcma_is_core_needed_early (core->id.id))continue ; + np = core->dev.of_node; +if (np && !of_device_is_available (np)) +continue ; +/* Only first GMAC core on BCM4706 is connected and working */ if (core->id.id ==BCMA_CORE_4706_MAC_GBIT && core->core_unit >0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/175 sched_ext: defer queue_balance_callback() until after ops.dispatch
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Tsalapatis <[email protected]>
[ Upstream commit a8ad873113d3fe01f9b5d737d4b0570fa36826b0 ]
The sched_ext code calls queue_balance_callback() during enqueue_task() to defer operations that drop multiple locks until we can unpin them. The call assumes that the rq lock is held until the callbacks are invoked, and the pending callbacks will not be visible to any other threads. This is enforced by a WARN_ON_ONCE() in rq_pin_lock().
However, balance_one() may actually drop the lock during a BPF dispatch call. Another thread may win the race to get the rq lock and see the pending callback. To avoid this, sched_ext must only queue the callback after the dispatch calls have completed.
CPU 0 CPU 1 CPU 2
scx_balance()
rq_unpin_lock()
scx_balance_one()
|= IN_BALANCE scx_enqueue()
ops.dispatch()
rq_unlock()
rq_lock()
queue_balance_callback()
rq_unlock()
[WARN] rq_pin_lock()
rq_lock()
&= ~IN_BALANCErq_repin_lock()
Changelog
v2-> v1 (https://lore.kernel.org/sched-ext/aOgOxtHCeyRT_7jn@gpd4)
- Fixed explanation in patch description (Andrea)
- Fixed scx_rq mask state updates (Andrea)
- Added Reviewed-by tag from Andrea
--- kernel/sched/ext.c | 29 +++++++++++++++++++++++++++-- kernel/sched/sched.h | 1 + 2 files changed, 28 insertions(+), 2 deletions(-)
kernel/sched/ext.c +27 -2
@@ -820,13 +820,23 @@ static void schedule_deferred(struct rq *rq)if (rq->scx.flags &SCX_RQ_IN_WAKEUP )return ; +/* Don't do anything if there already is a deferred operation. */ +if (rq->scx.flags &SCX_RQ_BAL_PENDING ) +return ; +/* * If in balance, the balance callbacks will be called before rq lock is * released. Schedule one. +* +* +* We can't directly insert the callback into the +* rq's list: The call can drop its lock and make the pending balance +* callback visible to unrelated code paths that call rq_pin_lock(). +* +* Just let balance_one() know that it must do it itself. */ if (rq->scx.flags &SCX_RQ_IN_BALANCE ) { -queue_balance_callback (rq, &rq->scx.deferred_bal_cb, - deferred_bal_cb_workfn); + rq->scx.flags |=SCX_RQ_BAL_CB_PENDING ;return ; }
@@ -2043,6 +2053,19 @@ static void flush_dispatch_buf(struct scx_sched *sch, struct rq *rq) dspc->cursor =0 ; } +static inline void maybe_queue_balance_callback (struct rq *rq) +{ +lockdep_assert_rq_held (rq); + +if (!(rq->scx.flags &SCX_RQ_BAL_CB_PENDING )) +return ; + +queue_balance_callback (rq, &rq->scx.deferred_bal_cb, + deferred_bal_cb_workfn); + + rq->scx.flags &= ~SCX_RQ_BAL_CB_PENDING ; +} +static int balance_one (struct rq *rq,struct task_struct *prev) {struct scx_sched *sch = scx_root;
@@ -2190,6 +2213,8 @@ static int balance_scx(struct rq *rq, struct task_struct *prev,#endif rq_repin_lock (rq, rf); +maybe_queue_balance_callback (rq); +return ret; }
kernel/sched/sched.h +1 -0
@@ -782,6 +782,7 @@ enum scx_rq_flags {SCX_RQ_BAL_KEEP =1 <<3 ,/* balance decided to keep current */ SCX_RQ_BYPASSING =1 <<4 ,SCX_RQ_CLK_VALID =1 <<5 ,/* RQ clock is fresh and valid */ +SCX_RQ_BAL_CB_PENDING =1 <<6 ,/* must queue a cb after dispatching */ SCX_RQ_IN_WAKEUP =1 <<16 , SCX_RQ_IN_BALANCE = 1 << 17,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/175 drm/msm: Fix pgtable prealloc error path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 830d68f2cb8ab6fb798bb9555016709a9e012af0 ]
The following splat was reported:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000008d0fd8000
[0000000000000010] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
CPU: 5 UID: 1000 PID: 149076 Comm: Xwayland Tainted: G S 6.16.0-rc2-00809-g0b6974bb4134-dirty #367 PREEMPT
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Qualcomm Technologies, Inc. SM8650 HDK (DT)
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : build_detached_freelist+0x28/0x224
lr : kmem_cache_free_bulk.part.0+0x38/0x244
sp : ffff000a508c7a20
x29: ffff000a508c7a20 x28: ffff000a508c7d50 x27: ffffc4e49d16f350
x26: 0000000000000058 x25: 00000000fffffffc x24: 0000000000000000
x23: ffff00098c4e1450 x22: 00000000fffffffc x21: 0000000000000000
x20: ffff000a508c7af8 x19: 0000000000000002 x18: 00000000000003e8
x17: ffff000809523850 x16: ffff000809523820 x15: 0000000000401640
x14: ffff000809371140 x13: 0000000000000130 x12: ffff0008b5711e30
x11: 00000000001058fa x10: 0000000000000a80 x9 : ffff000a508c7940
x8 : ffff000809371ba0 x7 : 781fffe033087fff x6 : 0000000000000000
x5 : ffff0008003cd000 x4 : 781fffe033083fff x3 : ffff000a508c7af8
x2 : fffffdffc0000000 x1 : 0001000000000000 x0 : ffff0008001a6a00
Call trace:
build_detached_freelist+0x28/0x224 (P)
kmem_cache_free_bulk.part.0+0x38/0x244
kmem_cache_free_bulk+0x10/0x1c
msm_iommu_pagetable_prealloc_cleanup+0x3c/0xd0
msm_vma_job_free+0x30/0x240
msm_ioctl_vm_bind+0x1d0/0x9a0
drm_ioctl_kernel+0x84/0x104
drm_ioctl+0x358/0x4d4
__arm64_sys_ioctl+0x8c/0xe0
invoke_syscall+0x44/0x100
el0_svc_common.constprop.0+0x3c/0xe0
do_el0_svc+0x18/0x20
el0_svc+0x30/0x100
el0t_64_sync_handler+0x104/0x130
el0t_64_sync+0x170/0x174
Code: aa0203f5 b26287e2 f2dfbfe2 aa0303f4 (f8737ab6)
---[ end trace 0000000000000000 ]---Since msm_vma_job_free() is called directly from the ioctl, this looks like an error path cleanup issue. Which I think results from prealloc_cleanup() called without a preceding successful prealloc_allocate() call. So handle that case better.
Patchwork: https://patchwork.freedesktop.org/patch/678677/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/msm_iommu.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/msm/msm_iommu.c +5 -0
@@ -338,6 +338,8 @@ msm_iommu_pagetable_prealloc_allocate(struct msm_mmu *mmu, struct msm_mmu_preall ret =kmem_cache_alloc_bulk (pt_cache,GFP_KERNEL , p->count, p->pages);if (ret != p->count) { +kfree (p->pages); + p->pages =NULL ; p->count = ret;return -ENOMEM ; }
@@ -351,6 +353,9 @@ msm_iommu_pagetable_prealloc_cleanup(struct msm_mmu *mmu, struct msm_mmu_preallostruct kmem_cache *pt_cache =get_pt_cache (mmu);uint32_t remaining_pt_count = p->count - p->ptr; +if (!p->pages) +return ; +if (p->count >0 )trace_msm_mmu_prealloc_cleanup (p->count, remaining_pt_count);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/175 ASoC: rt721: fix prepare clock stop failed
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <[email protected]>
[ Upstream commit d914ec6f07548f7c13a231a4f526e043e736e82e ]
This patch adds settings to prevent the 'prepare clock stop failed' error.
--- sound/soc/codecs/rt721-sdca.c | 4 ++++ sound/soc/codecs/rt721-sdca.h | 1 + 2 files changed, 5 insertions(+)
sound/soc/codecs/rt721-sdca.c +4 -0
@@ -281,6 +281,10 @@ static void rt721_sdca_jack_preset(struct rt721_sdca_priv *rt721)rt_sdca_index_write (rt721->mbq_regmap,RT721_BOOST_CTRL ,RT721_BST_4CH_TOP_GATING_CTRL1 ,0x002a );regmap_write (rt721->regmap,0x2f58 ,0x07 ); + +regmap_write (rt721->regmap,0x2f51 ,0x00 ); +rt_sdca_index_write (rt721->mbq_regmap,RT721_HDA_SDCA_FLOAT , +RT721_MISC_CTL ,0x0004 ); }static void rt721_sdca_jack_init (struct rt721_sdca_priv *rt721)
sound/soc/codecs/rt721-sdca.h +1 -0
@@ -137,6 +137,7 @@ struct rt721_sdca_dmic_kctrl_priv {#define RT721_HDA_LEGACY_UAJ_CTL 0x02#define RT721_HDA_LEGACY_CTL1 0x05#define RT721_HDA_LEGACY_RESET_CTL 0x06 +#define RT721_MISC_CTL 0x07#define RT721_XU_REL_CTRL 0x0c#define RT721_GE_REL_CTRL1 0x0d#define RT721_HDA_LEGACY_GPIO_WAKE_EN_CTL 0x0e
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 140/175 cifs: fix typo in enable_gcm_256 module parameter
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
[ Upstream commit f765fdfcd8b5bce92c6aa1a517ff549529ddf590 ]
Fix typo in description of enable_gcm_256 module parameter
--- fs/smb/client/cifsfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/cifsfs.c +1 -1
@@ -133,7 +133,7 @@ module_param(enable_oplocks, bool, 0644);MODULE_PARM_DESC (enable_oplocks,"Enable or disable oplocks. Default: y/Y/1" );module_param (enable_gcm_256, bool,0644 ); -MODULE_PARM_DESC (enable_gcm_256,"Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/0" ); +MODULE_PARM_DESC (enable_gcm_256,"Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/1" );module_param (require_gcm_256, bool,0644 );MODULE_PARM_DESC (require_gcm_256,"Require strongest (256 bit) GCM encryption. Default: n/N/0" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 141/175 scsi: core: Fix a regression triggered by scsi_host_busy()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit a0b7780602b1b196f47e527fec82166a7e67c4d0 ]
Commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag iterators") introduced the following regression:
Call trace: __srcu_read_lock+0x30/0x80 (P) blk_mq_tagset_busy_iter+0x44/0x300 scsi_host_busy+0x38/0x70 ufshcd_print_host_state+0x34/0x1bc ufshcd_link_startup.constprop.0+0xe4/0x2e0 ufshcd_init+0x944/0xf80 ufshcd_pltfrm_init+0x504/0x820 ufs_rockchip_probe+0x2c/0x88 platform_probe+0x5c/0xa4 really_probe+0xc0/0x38c __driver_probe_device+0x7c/0x150 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1e0 bus_for_each_dev+0x7c/0xdc driver_attach+0x24/0x30 bus_add_driver+0x110/0x230 driver_register+0x68/0x130 __platform_driver_register+0x20/0x2c ufs_rockchip_pltform_init+0x1c/0x28 do_one_initcall+0x60/0x1e0 kernel_init_freeable+0x248/0x2c4 kernel_init+0x20/0x140 ret_from_fork+0x10/0x20
Fix this regression by making scsi_host_busy() check whether the SCSI host tag set has already been initialized. tag_set->ops is set by scsi_mq_setup_tags() just before blk_mq_alloc_tag_set() is called. This fix is based on the assumption that scsi_host_busy() and scsi_mq_setup_tags() calls are serialized. This is the case in the UFS driver.
--- drivers/scsi/hosts.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/hosts.c +3 -2
@@ -611,8 +611,9 @@ int scsi_host_busy(struct Scsi_Host *shost) {int cnt =0 ; -blk_mq_tagset_busy_iter (&shost->tag_set, - scsi_host_check_in_flight, &cnt); +if (shost->tag_set.ops) +blk_mq_tagset_busy_iter (&shost->tag_set, + scsi_host_check_in_flight, &cnt);return cnt; }EXPORT_SYMBOL (scsi_host_busy);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 142/175 ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D)
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eren Demir <[email protected]>
[ Upstream commit 28935ee5e4789ad86c08ba9f2426edd6203d13fa ]
The quirk for Victus 15-fa1xxx wasn't working on Victus 15-fa1031nt due to a different board id. This patch enables the existing quirk for the board id 8BC8.
Tested on HP Victus 15-fa1031nt (MB 8C2D). The LED behaviour works as intended.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6580,6 +6580,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8c16 ,"HP Spectre x360 2-in-1 Laptop 16-aa0xxx" ,ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX ),SND_PCI_QUIRK (0x103c ,0x8c17 ,"HP Spectre 16" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8c21 ,"HP Pavilion Plus Laptop 14-ey0XXX" ,ALC245_FIXUP_HP_X360_MUTE_LEDS ), +SND_PCI_QUIRK (0x103c ,0x8c2d ,"HP Victus 15-fa1xxx (MB 8C2D)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8c30 ,"HP Victus 15-fb1xxx" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8c46 ,"HP EliteBook 830 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8c47, "HP EliteBook 840 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 143/175 perf/x86/intel/uncore: Add uncore PMU support for Wildcat Lake
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: dongsheng <[email protected]>
[ Upstream commit f4c12e5cefc8ec2eda93bc17ea734407228449ab ]
WildcatLake (WCL) is a variant of PantherLake (PTL) and shares the same uncore PMU features with PTL. Therefore, directly reuse Pantherlake's uncore PMU enabling code for WildcatLake.
--- arch/x86/events/intel/uncore.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/events/intel/uncore.c +1 -0
@@ -1895,6 +1895,7 @@ static const struct x86_cpu_id intel_uncore_match[] __initconst = {X86_MATCH_VFM (INTEL_ARROWLAKE_H , &mtl_uncore_init),X86_MATCH_VFM (INTEL_LUNARLAKE_M , &lnl_uncore_init),X86_MATCH_VFM (INTEL_PANTHERLAKE_L , &ptl_uncore_init), +X86_MATCH_VFM (INTEL_WILDCATLAKE_L , &ptl_uncore_init),X86_MATCH_VFM (INTEL_SAPPHIRERAPIDS_X , &spr_uncore_init),X86_MATCH_VFM (INTEL_EMERALDRAPIDS_X , &spr_uncore_init), X86_MATCH_VFM(INTEL_GRANITERAPIDS_X, &gnr_uncore_init),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 144/175 x86/microcode/AMD: Limit Entrysign signature checking to known generations
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 8a9fb5129e8e64d24543ebc70de941a2d77a9e77 ]
Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
X86_BUG cannot be used here because the loading on the BSP happens way too early, before the cpufeatures machinery has been set up.
--- arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +19 -1
@@ -236,13 +236,31 @@ static bool need_sha_check(u32 cur_rev)return true; } +static bool cpu_has_entrysign (void ) +{ +unsigned int fam =x86_family (bsp_cpuid_1_eax); +unsigned int model =x86_model (bsp_cpuid_1_eax); + +if (fam ==0x17 || fam ==0x19 ) +return true; + +if (fam ==0x1a ) { +if (model <=0x2f || + (0x40 <= model && model <=0x4f ) || + (0x60 <= model && model <=0x6f )) +return true; + } + +return false; +} +static bool verify_sha256_digest (u32 patch_id,u32 cur_rev,const u8 *data,unsigned int len) {struct patch_digest *pd =NULL ;u8 digest[SHA256_DIGEST_SIZE ];int i; -if (x86_family (bsp_cpuid_1_eax) <0x17 ) +if (!cpu_has_entrysign ())return true;if (!need_sha_check (cur_rev))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/175 selftests: cachestat: Fix warning on declaration under label
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidharth Seela <[email protected]>
[ Upstream commit 920aa3a7705a061cb3004572d8b7932b54463dbf ]
Fix warning caused from declaration under a case label. The proper way is to declare variable at the beginning of the function. The warning came from running clang using LLVM=1; and is as follows:
-test_cachestat.c:260:3: warning: label followed by a declaration is a C23 extension [-Wc23-extensions]
260 | char *map = mmap(NULL, filesize, PROT_READ | PROT_WRITE,
|
--- tools/testing/selftests/cachestat/test_cachestat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/cachestat/test_cachestat.c +2 -2
@@ -226,7 +226,7 @@ bool run_cachestat_test(enum file_type type)int syscall_ret;size_t compute_len =PS *512 ;struct cachestat_range cs_range = {PS , compute_len }; -char *filename ="tmpshmcstat" ; +char *filename ="tmpshmcstat" , *map;struct cachestat cs;bool ret = true;int fd;
@@ -257,7 +257,7 @@ bool run_cachestat_test(enum file_type type) }break ;case FILE_MMAP : -char *map =mmap (NULL , filesize,PROT_READ |PROT_WRITE , + map =mmap (NULL , filesize,PROT_READ |PROT_WRITE ,MAP_SHARED , fd,0 );if (map ==MAP_FAILED ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 146/175 smb: client: handle lack of IPC in dfs_cache_refresh()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit fac56c4651ae95f3f2b468c2cf1884cf0e6d18c1 ]
In very rare cases, DFS mounts could end up with SMB sessions without any IPC connections. These mounts are only possible when having unexpired cached DFS referrals, hence not requiring any IPC connections during the mount process.
Try to establish those missing IPC connections when refreshing DFS referrals. If the server is still rejecting it, then simply ignore and leave expired cached DFS referral for any potential DFS failovers.
--- fs/smb/client/cifsproto.h | 2 ++ fs/smb/client/connect.c | 38 ++++++++++++--------------- fs/smb/client/dfs_cache.c | 55 +++++++++++++++++++++++++++++++++------ 3 files changed, 66 insertions(+), 29 deletions(-)
fs/smb/client/cifsproto.h +2 -0
@@ -615,6 +615,8 @@ extern int E_md4hash(const unsigned char *passwd, unsigned char *p16,extern struct TCP_Server_Info *cifs_find_tcp_session (struct smb3_fs_context *ctx); +struct cifs_tcon *cifs_setup_ipc (struct cifs_ses *ses,bool seal); +void __cifs_put_smb_ses (struct cifs_ses *ses); extern struct cifs_ses *
fs/smb/client/connect.c +17 -21
@@ -2015,39 +2015,31 @@ static int match_session(struct cifs_ses *ses,/** * cifs_setup_ipc - helper to setup the IPC tcon for the session * @ses: smb session to issue the request on -* @ctx: the superblock configuration context to use for building the -* new tree connection for the IPC (interprocess communication RPC) +* @seal: if encryption is requested * * A new IPC connection is made and stored in the session * tcon_ipc. The IPC tcon has the same lifetime as the session. */ -static int -cifs_setup_ipc (struct cifs_ses *ses,struct smb3_fs_context *ctx) +struct cifs_tcon *cifs_setup_ipc (struct cifs_ses *ses,bool seal) {int rc =0 , xid;struct cifs_tcon *tcon;char unc[SERVER_NAME_LENGTH +sizeof ("//x/IPC$" )] = {0 }; -bool seal = false;struct TCP_Server_Info *server = ses->server;/* * If the mount request that resulted in the creation of the * session requires encryption, force IPC to be encrypted too. */ -if (ctx->seal) { -if (server->capabilities &SMB2_GLOBAL_CAP_ENCRYPTION ) - seal = true; -else { -cifs_server_dbg (VFS , -"IPC: server doesn't support encryption\n" ); -return -EOPNOTSUPP ; - } +if (seal && !(server->capabilities &SMB2_GLOBAL_CAP_ENCRYPTION )) { +cifs_server_dbg (VFS ,"IPC: server doesn't support encryption\n" ); +return ERR_PTR (-EOPNOTSUPP ); }/* no need to setup directory caching on IPC share, so pass in false */ tcon =tcon_info_alloc (false, netfs_trace_tcon_ref_new_ipc);if (tcon ==NULL ) -return -ENOMEM ; +return ERR_PTR (-ENOMEM );spin_lock (&server->srv_lock);scnprintf (unc,sizeof (unc),"\\\\%s\\IPC$" , server->hostname);
@@ -2057,13 +2049,13 @@ cifs_setup_ipc(struct cifs_ses *ses, struct smb3_fs_context *ctx) tcon->ses = ses; tcon->ipc = true; tcon->seal = seal; - rc = server->ops->tree_connect (xid, ses, unc, tcon, ctx->local_nls); + rc = server->ops->tree_connect (xid, ses, unc, tcon, ses->local_nls);free_xid (xid);if (rc) { -cifs_server_dbg (VFS ,"failed to connect to IPC (rc=%d)\n" , rc); +cifs_server_dbg (VFS |ONCE ,"failed to connect to IPC (rc=%d)\n" , rc);tconInfoFree (tcon, netfs_trace_tcon_ref_free_ipc_fail); - goto out; +return ERR_PTR (rc); }cifs_dbg (FYI ,"IPC tcon rc=%d ipc tid=0x%x\n" , rc, tcon->tid);
@@ -2071,9 +2063,7 @@ cifs_setup_ipc(struct cifs_ses *ses, struct smb3_fs_context *ctx)spin_lock (&tcon->tc_lock); tcon->status =TID_GOOD ;spin_unlock (&tcon->tc_lock); - ses->tcon_ipc = tcon; -out: -return rc; +return tcon; } static struct cifs_ses *
@@ -2347,6 +2337,7 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) {struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr; +struct cifs_tcon *ipc;struct cifs_ses *ses;unsigned int xid;int retries =0 ;
@@ -2525,7 +2516,12 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)list_add (&ses->smb_ses_list, &server->smb_ses_list);spin_unlock (&cifs_tcp_ses_lock); -cifs_setup_ipc (ses, ctx); + ipc =cifs_setup_ipc (ses, ctx->seal); +spin_lock (&cifs_tcp_ses_lock); +spin_lock (&ses->ses_lock); + ses->tcon_ipc = !IS_ERR (ipc) ? ipc :NULL ; +spin_unlock (&ses->ses_lock); +spin_unlock (&cifs_tcp_ses_lock);free_xid (xid);
fs/smb/client/dfs_cache.c +47 -8
92 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 147/175 selftests: net: use BASH for bareudp testing
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Po-Hsu Lin <[email protected]>
[ Upstream commit 9311e9540a8b406d9f028aa87fb072a3819d4c82 ]
In bareudp.sh, this script uses /bin/sh and it will load another lib.sh BASH script at the very beginning.
But on some operating systems like Ubuntu, /bin/sh is actually pointed to DASH, thus it will try to run BASH commands with DASH and consequently leads to syntax issues:
# ./bareudp.sh: 4: ./lib.sh: Bad substitution
# ./bareudp.sh: 5: ./lib.sh: source: not found
# ./bareudp.sh: 24: ./lib.sh: Syntax error: "(" unexpected
Fix this by explicitly using BASH for bareudp.sh. This fixes test execution failures on systems where /bin/sh is not BASH.
--- tools/testing/selftests/net/bareudp.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/bareudp.sh +1 -1
@@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # SPDX-License-Identifier: GPL-2.0 # Test various bareudp tunnel configurations.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 148/175 net: tls: Change async resync helpers argument
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <[email protected]>
[ Upstream commit 34892cfec0c2d96787c4be7bda0d5f18d7dacf85 ]
Update tls_offload_rx_resync_async_request_start() and tls_offload_rx_resync_async_request_end() to get a struct tls_offload_resync_async parameter directly, rather than extracting it from struct sock.
This change aligns the function signatures with the upcoming tls_offload_rx_resync_async_request_cancel() helper, which will be introduced in a subsequent patch.
--- .../mellanox/mlx5/core/en_accel/ktls_rx.c | 9 ++++++-- include/net/tls.h | 21 +++++++------------ 2 files changed, 15 insertions(+), 15 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +7 -2
@@ -425,12 +425,14 @@ void mlx5e_ktls_handle_get_psv_completion(struct mlx5e_icosq_wqe_info *wi, {struct mlx5e_ktls_rx_resync_buf *buf = wi->tls_get_params.buf;struct mlx5e_ktls_offload_context_rx *priv_rx; +struct tls_offload_context_rx *rx_ctx;u8 tracker_state, auth_state, *ctx;struct device *dev;u32 hw_seq; priv_rx = buf->priv_rx; dev =mlx5_core_dma_dev (sq->channel->mdev); + rx_ctx =tls_offload_ctx_rx (tls_get_ctx (priv_rx->sk));if (unlikely (test_bit (MLX5E_PRIV_RX_FLAG_DELETING , priv_rx->flags))) goto out;
@@ -447,7 +449,8 @@ void mlx5e_ktls_handle_get_psv_completion(struct mlx5e_icosq_wqe_info *wi, } hw_seq =MLX5_GET (tls_progress_params, ctx, hw_resync_tcp_sn); -tls_offload_rx_resync_async_request_end (priv_rx->sk,cpu_to_be32 (hw_seq)); +tls_offload_rx_resync_async_request_end (rx_ctx->resync_async, +cpu_to_be32 (hw_seq)); priv_rx->rq_stats->tls_resync_req_end++; out:mlx5e_ktls_priv_rx_put (priv_rx);
@@ -482,6 +485,7 @@ static bool resync_queue_get_psv(struct sock *sk)static void resync_update_sn (struct mlx5e_rq *rq,struct sk_buff *skb) {struct ethhdr *eth = (struct ethhdr *)(skb->data); +struct tls_offload_resync_async *resync_async;struct net_device *netdev = rq->netdev;struct net *net =dev_net (netdev);struct sock *sk =NULL ;
@@ -528,7 +532,8 @@ static void resync_update_sn(struct mlx5e_rq *rq, struct sk_buff *skb) seq = th->seq; datalen = skb->len - depth; -tls_offload_rx_resync_async_request_start (sk, seq, datalen); + resync_async =tls_offload_ctx_rx (tls_get_ctx (sk))->resync_async; +tls_offload_rx_resync_async_request_start (resync_async, seq, datalen); rq->stats->tls_resync_req_start++; unref:
include/net/tls.h +8 -13
@@ -451,25 +451,20 @@ static inline void tls_offload_rx_resync_request(struct sock *sk, __be32 seq)/* Log all TLS record header TCP sequences in [seq, seq+len] */ static inline void -tls_offload_rx_resync_async_request_start (struct sock *sk,__be32 seq,u16 len) +tls_offload_rx_resync_async_request_start (struct tls_offload_resync_async *resync_async, +__be32 seq,u16 len) { -struct tls_context *tls_ctx =tls_get_ctx (sk); -struct tls_offload_context_rx *rx_ctx =tls_offload_ctx_rx (tls_ctx); - -atomic64_set (&rx_ctx->resync_async->req, ((u64 )ntohl (seq) <<32 ) | +atomic64_set (&resync_async->req, ((u64 )ntohl (seq) <<32 ) | ((u64 )len <<16 ) |RESYNC_REQ |RESYNC_REQ_ASYNC ); - rx_ctx->resync_async->loglen =0 ; - rx_ctx->resync_async->rcd_delta =0 ; + resync_async->loglen =0 ; + resync_async->rcd_delta =0 ; }static inline void -tls_offload_rx_resync_async_request_end (struct sock *sk,__be32 seq) +tls_offload_rx_resync_async_request_end (struct tls_offload_resync_async *resync_async, +__be32 seq) { -struct tls_context *tls_ctx =tls_get_ctx (sk); -struct tls_offload_context_rx *rx_ctx =tls_offload_ctx_rx (tls_ctx); - -atomic64_set (&rx_ctx->resync_async->req, - ((u64 )ntohl (seq) <<32 ) |RESYNC_REQ ); +atomic64_set (&resync_async->req, ((u64 )ntohl (seq) <<32 ) |RESYNC_REQ ); } static inline void
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 149/175 blk-crypto: use BLK_STS_INVAL for alignment errors
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
[ Upstream commit 0b39ca457241aeca07a613002512573e8804f93a ]
Make __blk_crypto_bio_prep() propagate BLK_STS_INVAL when IO segments fail the data unit alignment check.
This was flagged by an LTP test that expects EINVAL when performing an O_DIRECT read with a misaligned buffer [1].
--- block/blk-crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-crypto.c +1 -1
@@ -292,7 +292,7 @@ bool __blk_crypto_bio_prep(struct bio **bio_ptr) }if (!bio_crypt_check_alignment (bio)) { - bio->bi_status =BLK_STS_IOERR ; + bio->bi_status =BLK_STS_INVAL ; goto fail; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 150/175 net: tls: Cancel RX async resync request on rcd_delta overflow
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <[email protected]>
[ Upstream commit c15d5c62ab313c19121f10e25d4fec852bd1c40c ]
When a netdev issues a RX async resync request for a TLS connection, the TLS module handles it by logging record headers and attempting to match them to the tcp_sn provided by the device. If a match is found, the TLS module approves the tcp_sn for resynchronization.
While waiting for a device response, the TLS module also increments rcd_delta each time a new TLS record is received, tracking the distance from the original resync request.
However, if the device response is delayed or fails (e.g due to unstable connection and device getting out of tracking, hardware errors, resource exhaustion etc.), the TLS module keeps logging and incrementing, which can lead to a WARN() when rcd_delta exceeds the threshold.
To address this, introduce tls_offload_rx_resync_async_request_cancel() to explicitly cancel resync requests when a device response failure is detected. Call this helper also as a final safeguard when rcd_delta crosses its threshold, as reaching this point implies that earlier cancellation did not occur.
--- include/net/tls.h | 6 ++++++ net/tls/tls_device.c | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-)
include/net/tls.h +6 -0
@@ -467,6 +467,12 @@ tls_offload_rx_resync_async_request_end(struct tls_offload_resync_async *resync_atomic64_set (&resync_async->req, ((u64 )ntohl (seq) <<32 ) |RESYNC_REQ ); } +static inline void +tls_offload_rx_resync_async_request_cancel (struct tls_offload_resync_async *resync_async) +{ +atomic64_set (&resync_async->req,0 ); +} +static inline void tls_offload_rx_resync_set_type (struct sock *sk,enum tls_offload_sync_type type) {
net/tls/tls_device.c +3 -1
@@ -723,8 +723,10 @@ tls_device_rx_resync_async(struct tls_offload_resync_async *resync_async,/* shouldn't get to wraparound: * too long in async stage, something bad happened */ -if (WARN_ON_ONCE (resync_async->rcd_delta ==USHRT_MAX )) +if (WARN_ON_ONCE (resync_async->rcd_delta ==USHRT_MAX )) { +tls_offload_rx_resync_async_request_cancel (resync_async);return false; + }/* asynchronous stage: log all headers seq such that * req_seq <= seq <= end_seq, and wait for real resync request
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 151/175 x86/CPU/AMD: Extend Zen6 model range
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 847ebc4476714f81d7dea73e5ea69448d7fe9d3a ]
Add some more Zen6 models.
--- arch/x86/kernel/cpu/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/amd.c +1 -1
@@ -516,7 +516,7 @@ static void bsp_init_amd(struct cpuinfo_x86 *c)setup_force_cpu_cap (X86_FEATURE_ZEN5 );break ; case 0x50 ... 0x5f: - case 0x90 ... 0xaf: + case 0x80 ... 0xaf: case 0xc0 ... 0xcf:setup_force_cpu_cap (X86_FEATURE_ZEN6 );break ;
Signature · 1 line
2.51.0