5.4.302-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.4.302-rc1 review
This is the start of the stable review cycle for the 5.4.302 release. There are 187 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 03 Dec 2025 11:22:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.302-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.302-rc1
Hugh Dickins <[email protected]>
mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()
Peter Xu <[email protected]>
mm/mprotect: use long for page accountings and retval
Vlastimil Babka <[email protected]>
mm/mempool: fix poisoning order>0 pages with HIGHMEM
Fabio M. De Francesco <[email protected]>
mm/mempool: replace kmap_atomic() with kmap_local_page()
Seungjin Bae <[email protected]>
Input: pegasus-notetaker - fix potential out-of-bounds access
Vincent Mailhol <[email protected]>
Input: remove third argument of usb_maxpacket()
Vincent Mailhol <[email protected]>
usb: deprecate the third argument of usb_maxpacket()
Niklas Cassel <[email protected]>
ata: libata-scsi: Fix system suspend for a security locked drive
Wei Yang <[email protected]>
fs/proc: fix uaf in proc_readdir_de()
Miaoqian Lin <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_remove
Sudeep Holla <[email protected]>
pmdomain: arm: scmi: Fix genpd leak on provider registration failure
Breno Leitao <[email protected]>
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
Nathan Chancellor <[email protected]>
net: qede: Initialize qede_ll_ops with designated initializer
Long Li <[email protected]>
uio_hv_generic: Set event for all channels on the device
Nishanth Menon <[email protected]>
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
René Rebe <[email protected]>
ALSA: usb-audio: fix uac2 clock source at terminal parser
Isaac J. Manjarres <[email protected]>
mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
Jakub Horký <[email protected]>
kconfig/nconf: Initialize the default locale at startup
Jakub Horký <[email protected]>
kconfig/mconf: Initialize the default locale at startup
Michal Luczaj <[email protected]>
vsock: Ignore signal/timeout on connect() if already established
Aleksei Nikiforov <[email protected]>
s390/ctcm: Fix double-kfree
Ilya Maximets <[email protected]>
net: openvswitch: remove never-working support for setting nsh fields
Zilin Guan <[email protected]>
mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix !EVA SOC-it PCI MMIO
Hamza Mahfooz <[email protected]>
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
Bart Van Assche <[email protected]>
scsi: sg: Do not sleep in atomic context
Tzung-Bi Shih <[email protected]>
Input: cros_ec_keyb - fix an invalid memory access
Andrey Vatoropin <[email protected]>
be2net: pass wrb_params in case of OS2BMC
Zhang Heng <[email protected]>
HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
Abdun Nihaal <[email protected]>
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
Niravkumar L Rabara <[email protected]>
EDAC/altera: Handle OCRAM ECC enable after warm reset
Hans de Goede <[email protected]>
spi: Try to get ACPI GPIO IRQ earlier
Chuang Wang <[email protected]>
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
Nate Karstens <[email protected]>
strparser: Fix signed/unsigned mismatch bug
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 15
Jakub Acs <[email protected]>
mm/ksm: fix flag-dropping behavior in ksm_madvise
Haein Lee <[email protected]>
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
Ian Forbes <[email protected]>
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Haotian Zhang <[email protected]>
ASoC: cs4271: Fix regulator leak on probe failure
Haotian Zhang <[email protected]>
regulator: fixed: fix GPIO descriptor leak on register failure
Chris Morgan <[email protected]>
regulator: fixed: use dev_err_probe for register
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: export l2cap_chan_hold for modules
Eric Dumazet <[email protected]>
net_sched: limit try_bulk_dequeue_skb() batches
Eric Dumazet <[email protected]>
net_sched: remove need_resched() from qdisc_run()
Gal Pressman <[email protected]>
net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
Gal Pressman <[email protected]>
net/mlx5e: Fix maxrate wraparound in threshold between units
Ranganath V N <[email protected]>
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
Benjamin Berg <[email protected]>
wifi: mac80211: skip rate verification for not captured PSDUs
Buday Csaba <[email protected]>
net: mdio: fix resource leak in mdiobus_register_device()
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free in tipc_mon_reinit_self().
Xin Long <[email protected]>
tipc: simplify the finalize work queue
Eric Dumazet <[email protected]>
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
Xin Long <[email protected]>
sctp: get netns from asoc and ep base
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
Wei Fang <[email protected]>
net: fec: correct rx_bytes statistic for the case SHIFT16 is set
Sharique Mohammad <[email protected]>
ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
Tristan Lobb <[email protected]>
HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
Joshua Watt <[email protected]>
NFS4: Fix state renewals missing after boot
Peter Zijlstra <[email protected]>
compiler_types: Move unused static inline functions warning to W=2
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Cleanup wakeup source only if it was enabled
Zilin Guan <[email protected]>
tracing: Fix memory leaks in create_field_var()
Qendrim Maxhuni <[email protected]>
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
Stefan Wiehler <[email protected]>
sctp: Prevent TOCTOU out-of-bounds write
Stefan Wiehler <[email protected]>
sctp: Hold RCU read lock while iterating over address list
Jonas Gorski <[email protected]>
net: dsa: b53: stop reading ARL entries if search is done
Jonas Gorski <[email protected]>
net: dsa: b53: fix enabling ip multicast
Jonas Gorski <[email protected]>
net: dsa: b53: fix resetting speed and pause on forced link
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
Russell King <[email protected]>
net: dsa/b53: change b53_force_port_config() pause argument
Hangbin Liu <[email protected]>
net: vlan: sync VLAN features with lower device
Viacheslav Dubeyko <[email protected]>
ceph: add checking of wait_for_completion_killable() return value
Albin Babu Varghese <[email protected]>
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
Ian Rogers <[email protected]>
tools bitmap: Add missing asm-generic/bitsperlong.h include
Sakari Ailus <[email protected]>
ACPI: property: Return present device nodes only on fwnode interface
Randall P. Embry <[email protected]>
9p: sysfs_init: don't hardcode error to ENOMEM
Randall P. Embry <[email protected]>
9p: fix /sys/fs/9p/caches overwriting itself
Yikang Yue <[email protected]>
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
Saket Dumbre <[email protected]>
ACPICA: Update dsmethod.c to get rid of unused variable warning
Mike Marshall <[email protected]>
orangefs: fix xattr related buffer overflow...
Dragos Tatulea <[email protected]>
page_pool: Clamp pool size to max 16K pages
Ivan Pravdin <[email protected]>
Bluetooth: bcsp: receive data only if registered
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix UAF on sco_conn_free
Théo Lebrun <[email protected]>
net: macb: avoid dealing with endianness in macb_set_hwaddr()
Al Viro <[email protected]>
nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix mount hang after CREATE_SESSION failure
Olga Kornievskaia <[email protected]>
NFSv4: handle ERR_GRACE on delegation recalls
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid handling handover twice
Koakuma <[email protected]>
sparc/module: Add R_SPARC_UA64 relocation handling
Brahmajit Das <[email protected]>
net: intel: fm10k: Fix parameter idx set but not used
Shaurya Rane <[email protected]>
jfs: fix uninitialized waitqueue in transaction manager
Tetsuo Handa <[email protected]>
jfs: Verify inode mode when loading from disk
Eric Dumazet <[email protected]>
ipv6: np->rxpmtu race annotation
Krishna Kurapati <[email protected]>
usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
Forest Crossman <[email protected]>
usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
Al Viro <[email protected]>
allow finish_no_open(file, ERR_PTR(-E...))
Justin Tee <[email protected]>
scsi: lpfc: Define size of debugfs entry for xri rebalancing
Justin Tee <[email protected]>
scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
Nai-Chen Cheng <[email protected]>
selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
Yafang Shao <[email protected]>
net/cls_cgroup: Fix task_get_classid() during qdisc run
David Ahern <[email protected]>
selftests: Replace sleep with slowwait
David Ahern <[email protected]>
selftests: Disable dad for ipv6 in fcnal-test.sh
Qianfeng Rong <[email protected]>
media: redrat3: use int type to store negative error codes
Niklas Söderlund <[email protected]>
net: sh_eth: Disable WoL if system can not suspend
Harikrishna Shenoy <[email protected]>
phy: cadence: cdns-dphy: Enable lower resolutions in dphy
William Wu <[email protected]>
usb: gadget: f_hid: Fix zero length packet transfer
Eric Dumazet <[email protected]>
net: call cond_resched() less often in __release_sock()
Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP Quark2
Juraj Šarinay <[email protected]>
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
Devendra K Verma <[email protected]>
dmaengine: dw-edma: Set status for callback_result
Rosen Penev <[email protected]>
dmaengine: mv_xor: match alloc_wc and free_wc
Thomas Andreatta <[email protected]>
dmaengine: sh: setup_xref error handling
Qianfeng Rong <[email protected]>
scsi: pm8001: Use int instead of u32 to store error codes
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename stp clock
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing device_type in pci node
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing properties to cpu node
Chelsy Ratnawat <[email protected]>
media: fix uninitialized symbol warnings
Amber Lin <[email protected]>
drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Fix wakeup source leaks on device unbind
Ujwal Kundur <[email protected]>
rds: Fix endianness annotation for RDS_MPATH_HASH
Sungho Kim <[email protected]>
PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
Kuniyuki Iwashima <[email protected]>
net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
Christoph Paasch <[email protected]>
net: When removing nexthops, don't call synchronize_net if it is not necessary
Zijun Hu <[email protected]>
char: misc: Does not request module for miscdevice with dynamic minor
raub camaioni <[email protected]>
usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
Rodrigo Gobbi <[email protected]>
iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
Tetsuo Handa <[email protected]>
media: imon: make send_packet() more robust
Charalampos Mitrodimas <[email protected]>
net: ipv6: fix field-spanning memcpy warning in AH output
Ido Schimmel <[email protected]>
bridge: Redirect to backup port when port is administratively down
Niklas Schnelle <[email protected]>
powerpc/eeh: Use result of error_detected() in uevent
Kirill A. Shutemov <[email protected]>
x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
Laurent Pinchart <[email protected]>
media: pci: ivtv: Don't create fake v4l2_fh
Geoffrey McRae <[email protected]>
drm/amdkfd: return -ENOTTY for unsupported IOCTLs
Wake Liu <[email protected]>
selftests/net: Ensure assert() triggers in psock_tpacket.c
Wake Liu <[email protected]>
selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
Marcos Del Sol Vives <[email protected]>
PCI: Disable MSI on RDC PCI to PCIe bridges
Seyediman Seyedarab <[email protected]>
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
Arnd Bergmann <[email protected]>
mfd: madera: Work around false-positive -Wininitialized warning
Alexander Stein <[email protected]>
mfd: stmpe-i2c: Add missing MODULE_LICENSE
Alexander Stein <[email protected]>
mfd: stmpe: Remove IRQ domain upon removal
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Prefer driver HWP limits
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Enhance HWP enable
Kaushlendra Kumar <[email protected]>
tools/cpupower: Fix incorrect size in cpuidle_state_disable()
Armin Wolf <[email protected]>
hwmon: (dell-smm) Add support for Dell OptiPlex 7040
Jiri Olsa <[email protected]>
uprobe: Do not emulate/sstep original instruction when ip is changed
Daniel Lezcano <[email protected]>
clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
Svyatoslav Ryhel <[email protected]>
video: backlight: lp855x_bl: Set correct EPROM start for LP8556
Amirreza Zarrabi <[email protected]>
tee: allow a driver to allocate a tee_device without a pool
Hans de Goede <[email protected]>
ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
Christian Bruel <[email protected]>
irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
Kees Cook <[email protected]>
arc: Fix __fls() const-foldability via __builtin_clzl()
Dennis Beier <[email protected]>
cpufreq/longhaul: handle NULL policy in longhaul_exit
Ricardo B. Marlière <[email protected]>
selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
Mario Limonciello (AMD) <[email protected]>
ACPI: video: force native for Lenovo 82K8
Jiayi Li <[email protected]>
memstick: Add timeout to prevent indefinite waiting
Biju Das <[email protected]>
mmc: host: renesas_sdhi: Fix the actual clock
Thomas Weißschuh <[email protected]>
bpf: Don't use %pK through printk
Thomas Weißschuh <[email protected]>
spi: loopback-test: Don't use %pK through printk
Jens Reidel <[email protected]>
soc: qcom: smem: Fix endian-unaware access of num_entries
Owen Gu <[email protected]>
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
Artem Shimko <[email protected]>
serial: 8250_dw: handle reset control deassert error
Andy Shevchenko <[email protected]>
serial: 8250_dw: Use devm_add_action_or_reset()
Andy Shevchenko <[email protected]>
serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
Celeste Liu <[email protected]>
can: gs_usb: increase max interface to U8_MAX
Maarten Lankhorst <[email protected]>
devcoredump: Fix circular locking dependency with devcd->mutex.
Lad Prabhakar <[email protected]>
net: ravb: Enforce descriptor type ordering
Babu Moger <[email protected]>
x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
Emanuele Ghidoli <[email protected]>
net: phy: dp83867: Disable EEE support as not implemented
Alexey Klimov <[email protected]>
regmap: slimbus: fix bus_context pointer in regmap init calls
Tomeu Vizoso <[email protected]>
drm/etnaviv: fix flush sequence logic
Lizhi Xu <[email protected]>
usbnet: Prevents free active kevent
Loic Poulain <[email protected]>
wifi: ath10k: Fix memory leak on unsupported WMI command
Srinivas Kandagatla <[email protected]>
ASoC: qdsp6: q6asm: do not sleep while atomic
Miaoqian Lin <[email protected]>
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
Florian Fuchs <[email protected]>
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
Junjie Cao <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_putcs*
Yuhao Jiang <[email protected]>
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
Daniel Palmer <[email protected]>
fbdev: atyfb: Check if pll_ops->init_pll failed
Miaoqian Lin <[email protected]>
net: usb: asix_devices: Check return value of usbnet_get_endpoints
Filipe Manana <[email protected]>
btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
David Kaplan <[email protected]>
x86/bugs: Fix reporting of LFENCE retpoline
Xiang Mei <[email protected]>
net/sched: sch_qfq: Fix null-deref in agg_dequeue
-------------
Diffstat:
Makefile | 4 +- arch/arc/include/asm/bitops.h | 2 + arch/mips/boot/dts/lantiq/danube.dtsi | 6 + arch/mips/lantiq/xway/sysctrl.c | 2 +- arch/mips/mti-malta/malta-init.c | 20 +-- arch/powerpc/kernel/eeh_driver.c | 2 +- arch/sparc/include/asm/elf_64.h | 1 + arch/sparc/kernel/module.c | 1 + arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++- arch/x86/kernel/cpu/bugs.c | 5 +- arch/x86/kernel/cpu/resctrl/monitor.c | 10 +- drivers/acpi/acpi_video.c | 4 +- drivers/acpi/acpica/dsmethod.c | 10 +- drivers/acpi/property.c | 24 +++- drivers/acpi/video_detect.c | 8 ++ drivers/ata/libata-scsi.c | 8 ++ drivers/base/devcoredump.c | 138 +++++++++++++-------- drivers/base/regmap/regmap-slimbus.c | 6 +- drivers/bluetooth/btusb.c | 13 +- drivers/bluetooth/hci_bcsp.c | 3 + drivers/char/misc.c | 8 +- drivers/clocksource/timer-vf-pit.c | 22 ++-- drivers/cpufreq/longhaul.c | 3 + drivers/dma/dw-edma/dw-edma-core.c | 22 ++++ drivers/dma/mv_xor.c | 4 +- drivers/dma/sh/shdma-base.c | 25 +++- drivers/dma/sh/shdmac.c | 17 ++- drivers/edac/altera_edac.c | 22 +++- drivers/extcon/extcon-adc-jack.c | 2 + drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 + drivers/hid/hid-ids.h | 7 +- drivers/hid/hid-quirks.c | 14 ++- drivers/hwmon/dell-smm-hwmon.c | 7 ++ drivers/iio/adc/spear_adc.c | 9 +- drivers/input/keyboard/cros_ec_keyb.c | 6 + drivers/input/misc/ati_remote2.c | 2 +- drivers/input/misc/cm109.c | 2 +- drivers/input/misc/powermate.c | 2 +- drivers/input/misc/yealink.c | 2 +- drivers/input/tablet/acecad.c | 2 +- drivers/input/tablet/pegasus_notetaker.c | 11 +- drivers/irqchip/irq-gic-v2m.c | 13 +- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 ++- drivers/media/i2c/ir-kbd-i2c.c | 6 +- drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 - drivers/media/pci/ivtv/ivtv-driver.h | 3 +- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +-- drivers/media/pci/ivtv/ivtv-irq.c | 4 +- drivers/media/rc/imon.c | 61 +++++---- drivers/media/rc/redrat3.c | 2 +- drivers/media/tuners/xc4000.c | 8 +- drivers/media/tuners/xc5000.c | 12 +- drivers/memstick/core/memstick.c | 8 +- drivers/mfd/madera-core.c | 4 +- drivers/mfd/stmpe-i2c.c | 1 + drivers/mfd/stmpe.c | 3 + drivers/mmc/host/renesas_sdhi_core.c | 6 +- drivers/mmc/host/sdhci-msm.c | 15 +++ drivers/net/can/usb/gs_usb.c | 23 ++-- drivers/net/dsa/b53/b53_common.c | 57 ++++++--- drivers/net/dsa/b53/b53_regs.h | 4 +- drivers/net/ethernet/cadence/macb_main.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 7 +- drivers/net/ethernet/freescale/fec_main.c | 2 + drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 +- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 ++- .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 16 ++- drivers/net/ethernet/renesas/sh_eth.c | 4 + drivers/net/ethernet/ti/netcp_core.c | 10 +- drivers/net/phy/dp83867.c | 6 + drivers/net/phy/mdio_bus.c | 5 +- drivers/net/usb/asix_devices.c | 12 +- drivers/net/usb/qmi_wwan.c | 6 + drivers/net/usb/usbnet.c | 2 + drivers/net/wireless/ath/ath10k/wmi.c | 1 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 21 ++-- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 +- drivers/pci/p2pdma.c | 2 +- drivers/pci/quirks.c | 1 + drivers/phy/cadence/cdns-dphy.c | 4 +- drivers/regulator/fixed.c | 6 +- drivers/remoteproc/qcom_q6v5.c | 5 + drivers/s390/net/ctcm_mpc.c | 1 - drivers/scsi/lpfc/lpfc_debugfs.h | 3 + drivers/scsi/lpfc/lpfc_scsi.c | 14 ++- drivers/scsi/pm8001/pm8001_ctl.c | 2 +- drivers/scsi/sg.c | 10 +- drivers/soc/imx/gpc.c | 2 + drivers/soc/qcom/smem.c | 2 +- drivers/soc/ti/knav_dma.c | 14 +-- drivers/spi/spi-loopback-test.c | 12 +- drivers/spi/spi.c | 10 ++ drivers/target/loopback/tcm_loop.c | 3 + drivers/tee/tee_core.c | 2 +- drivers/tty/serial/8250/8250_dw.c | 128 +++++++++---------- drivers/uio/uio_hv_generic.c | 21 +++- drivers/usb/gadget/function/f_fs.c | 8 +- drivers/usb/gadget/function/f_hid.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 3 +- drivers/usb/host/xhci-plat.c | 1 + drivers/usb/mon/mon_bin.c | 14 ++- drivers/video/backlight/lp855x_bl.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/core/bitblit.c | 33 ++++- drivers/video/fbdev/pvr2fb.c | 2 +- drivers/video/fbdev/valkyriefb.c | 2 + fs/9p/v9fs.c | 9 +- fs/btrfs/transaction.c | 2 +- fs/ceph/locks.c | 5 +- fs/hpfs/namei.c | 18 ++- fs/jfs/inode.c | 8 +- fs/jfs/jfs_txnmgr.c | 9 +- fs/nfs/nfs4client.c | 1 + fs/nfs/nfs4proc.c | 6 +- fs/nfs/nfs4state.c | 3 + fs/open.c | 10 +- fs/orangefs/xattr.c | 12 +- fs/proc/generic.c | 12 +- include/linux/ata.h | 1 + include/linux/compiler_types.h | 5 +- include/linux/filter.h | 2 +- include/linux/hugetlb.h | 4 +- include/linux/mm.h | 4 +- include/linux/shdma-base.h | 2 +- include/linux/usb.h | 16 +-- include/net/cls_cgroup.h | 2 +- include/net/nfc/nci_core.h | 2 +- include/net/pkt_sched.h | 25 +++- kernel/events/uprobes.c | 7 ++ kernel/gcov/gcc_4_7.c | 4 +- kernel/trace/trace_events_hist.c | 6 +- mm/hugetlb.c | 4 +- mm/mempolicy.c | 2 +- mm/mempool.c | 32 ++++- mm/mprotect.c | 124 ++++++++---------- mm/page_alloc.c | 2 +- net/8021q/vlan.c | 2 + net/bluetooth/6lowpan.c | 103 ++++++++++----- net/bluetooth/l2cap_core.c | 1 + net/bluetooth/sco.c | 7 ++ net/bridge/br_forward.c | 3 +- net/core/netpoll.c | 7 +- net/core/page_pool.c | 6 +- net/core/sock.c | 15 ++- net/ipv4/nexthop.c | 6 + net/ipv4/route.c | 5 + net/ipv6/ah6.c | 50 +++++--- net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- net/mac80211/rx.c | 10 +- net/openvswitch/actions.c | 68 +--------- net/openvswitch/flow_netlink.c | 64 ++-------- net/openvswitch/flow_netlink.h | 2 - net/rds/rds.h | 2 +- net/sched/act_ife.c | 12 +- net/sched/sch_api.c | 10 -- net/sched/sch_generic.c | 24 ++-- net/sched/sch_hfsc.c | 16 --- net/sched/sch_qfq.c | 2 +- net/sctp/associola.c | 10 +- net/sctp/chunk.c | 2 +- net/sctp/diag.c | 7 ++ net/sctp/endpointola.c | 6 +- net/sctp/input.c | 5 +- net/sctp/output.c | 2 +- net/sctp/outqueue.c | 6 +- net/sctp/sm_make_chunk.c | 7 +- net/sctp/sm_sideeffect.c | 16 +-- net/sctp/sm_statefuns.c | 2 +- net/sctp/socket.c | 12 +- net/sctp/stream.c | 3 +- net/sctp/stream_interleave.c | 23 ++-- net/sctp/transport.c | 15 ++- net/sctp/ulpqueue.c | 15 ++- net/strparser/strparser.c | 2 +- net/tipc/core.c | 4 +- net/tipc/core.h | 8 +- net/tipc/discover.c | 4 +- net/tipc/link.c | 5 + net/tipc/link.h | 1 + net/tipc/net.c | 17 +-- net/vmw_vsock/af_vsock.c | 40 ++++-- scripts/kconfig/mconf.c | 3 + scripts/kconfig/nconf.c | 3 + sound/soc/codecs/cs4271.c | 10 +- sound/soc/codecs/max98090.c | 6 +- sound/soc/qcom/qdsp6/q6asm.c | 2 +- sound/usb/mixer.c | 11 +- tools/include/linux/bitmap.h | 1 + tools/power/cpupower/lib/cpuidle.c | 5 +- .../x86_energy_perf_policy.c | 26 ++-- tools/testing/selftests/Makefile | 2 +- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- tools/testing/selftests/net/fcnal-test.sh | 4 +- tools/testing/selftests/net/psock_tpacket.c | 4 +- 206 files changed, 1385 insertions(+), 899 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/187 net/sched: sch_qfq: Fix null-deref in agg_dequeue
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
commit dd831ac8221e691e9e918585b1003c7071df0379 upstream.
To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c.
To avoid code duplication, the following changes are made:
1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function.
2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it.
3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
--- include/net/pkt_sched.h | 25 ++++++++++++++++++++++++- net/sched/sch_api.c | 10 ---------- net/sched/sch_hfsc.c | 16 ---------------- net/sched/sch_qfq.c | 2 +- 4 files changed, 25 insertions(+), 28 deletions(-)
include/net/pkt_sched.h +24 -1
@@ -109,7 +109,6 @@ struct qdisc_rate_table *qdisc_get_rtab( struct netlink_ext_ack *extack);void qdisc_put_rtab (struct qdisc_rate_table *tab);void qdisc_put_stab (struct qdisc_size_table *tab); -void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc);bool sch_direct_xmit (struct sk_buff *skb,struct Qdisc *q,struct net_device *dev,struct netdev_queue *txq,spinlock_t *root_lock,bool validate);
@@ -176,4 +175,28 @@ struct tc_taprio_qopt_offload *taprio_of *offload);void taprio_offload_free (struct tc_taprio_qopt_offload *offload); +static inline void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) +{ +if (!(qdisc->flags &TCQ_F_WARN_NONWC )) { +pr_warn ("%s: %s qdisc %X: is non-work-conserving?\n" , + txt, qdisc->ops->id, qdisc->handle >>16 ); + qdisc->flags |=TCQ_F_WARN_NONWC ; + } +} + +static inline unsigned int qdisc_peek_len (struct Qdisc *sch) +{ +struct sk_buff *skb; +unsigned int len; + + skb = sch->ops->peek (sch); +if (unlikely (skb ==NULL )) { +qdisc_warn_nonwc ("qdisc_peek_len" , sch); +return 0 ; + } + len =qdisc_pkt_len (skb); + +return len; +} +#endif
net/sched/sch_api.c +0 -10
@@ -592,16 +592,6 @@ out:qdisc_skb_cb (skb)->pkt_len = pkt_len; } -void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) -{ -if (!(qdisc->flags &TCQ_F_WARN_NONWC )) { -pr_warn ("%s: %s qdisc %X: is non-work-conserving?\n" , - txt, qdisc->ops->id, qdisc->handle >>16 ); - qdisc->flags |=TCQ_F_WARN_NONWC ; - } -} -EXPORT_SYMBOL (qdisc_warn_nonwc); -static enum hrtimer_restart qdisc_watchdog (struct hrtimer *timer) { struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
net/sched/sch_hfsc.c +0 -16
@@ -836,22 +836,6 @@ update_vf(struct hfsc_class *cl, unsigne } } -static unsigned int -qdisc_peek_len (struct Qdisc *sch) -{ -struct sk_buff *skb; -unsigned int len; - - skb = sch->ops->peek (sch); -if (unlikely (skb ==NULL )) { -qdisc_warn_nonwc ("qdisc_peek_len" , sch); -return 0 ; - } - len =qdisc_pkt_len (skb); - -return len; -} -static void hfsc_adjust_levels (struct hfsc_class *cl) {
net/sched/sch_qfq.c +1 -1
@@ -1003,7 +1003,7 @@ static struct sk_buff *agg_dequeue(strucif (cl->qdisc->q.qlen ==0 )/* no more packets, remove from list */ list_del_init (&cl->alist); -else if (cl->deficit <qdisc_pkt_len (cl->qdisc->ops->peek (cl->qdisc))) { +else if (cl->deficit <qdisc_peek_len (cl->qdisc)) { cl->deficit += agg->lmax;list_move_tail (&cl->alist, &agg->active); }
Greg Kroah-Hartman
maintainerPATCH 2/187 x86/bugs: Fix reporting of LFENCE retpoline
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Kaplan <[email protected]>
[ Upstream commit d1cc1baef67ac6c09b74629ca053bf3fb812f7dc ]
The LFENCE retpoline mitigation is not secure but the kernel prints inconsistent messages about this fact. The dmesg log says 'Mitigation:
LFENCE', implying the system is mitigated. But sysfs reports 'Vulnerable:
LFENCE' implying the system (correctly) is not mitigated.
Fix this by printing a consistent 'Vulnerable: LFENCE' string everywhere when this mitigation is selected.
--- arch/x86/kernel/cpu/bugs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/x86/kernel/cpu/bugs.c +1 -4
@@ -1188,7 +1188,7 @@ spectre_v2_user_select_mitigation(void)static const char *const spectre_v2_strings[] = { [SPECTRE_V2_NONE ] ="Vulnerable" , [SPECTRE_V2_RETPOLINE ] ="Mitigation: Retpolines" , - [SPECTRE_V2_LFENCE ] ="Mitigation: LFENCE" , + [SPECTRE_V2_LFENCE ] ="Vulnerable: LFENCE" , [SPECTRE_V2_EIBRS ] ="Mitigation: Enhanced / Automatic IBRS" , [SPECTRE_V2_EIBRS_LFENCE ] ="Mitigation: Enhanced / Automatic IBRS + LFENCE" , [SPECTRE_V2_EIBRS_RETPOLINE ] ="Mitigation: Enhanced / Automatic IBRS + Retpolines" ,
@@ -2280,9 +2280,6 @@ static char *pbrsb_eibrs_state(void)static ssize_t spectre_v2_show_state (char *buf) { -if (spectre_v2_enabled ==SPECTRE_V2_LFENCE ) -return sysfs_emit (buf,"Vulnerable: LFENCE\n" ); -if (spectre_v2_enabled ==SPECTRE_V2_EIBRS &&unprivileged_ebpf_enabled ())return sysfs_emit (buf,"Vulnerable: eIBRS with unprivileged eBPF\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/187 btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 45c222468d33202c07c41c113301a4b9c8451b8f ]
After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a full write barrier, smp_wmb(), but we don't need to, all we need is a smp_mb__after_atomic(). The use of the smp_wmb() is from the old days when we didn't use a bit and used instead an int field in the root to signal if cow is forced. After the int field was changed to a bit in the root's state (flags field), we forgot to update the memory barrier in create_pending_snapshot() to smp_mb__after_atomic(), but we did the change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root"). On the reader side, in should_cow_block(), we also use the counterpart smp_mb__before_atomic() which generates further confusion.
So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't even need any barrier at all since create_pending_snapshot() is called in the critical section of a transaction commit and therefore no one can concurrently join/attach the transaction, or start a new one, until the transaction is unblocked. By the time someone starts a new transaction and enters should_cow_block(), a lot of implicit memory barriers already took place by having acquired several locks such as fs_info->trans_lock and extent buffer locks on the root node at least. Nevertlheless, for consistency use smp_mb__after_atomic() after setting the force cow bit in create_pending_snapshot().
--- fs/btrfs/transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/transaction.c +1 -1
@@ -1546,7 +1546,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, }/* see comments in should_cow_block() */ set_bit (BTRFS_ROOT_FORCE_COW , &root->state); -smp_wmb (); +smp_mb__after_atomic ();btrfs_set_root_node (new_root_item, tmp);/* record when the snapshot was created in key.offset */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/187 net: usb: asix_devices: Check return value of usbnet_get_endpoints
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.
The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error.
Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").
--- drivers/net/usb/asix_devices.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/usb/asix_devices.c +9 -3
@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *dint i;unsigned long gpio_bits = dev->driver_info->data; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) + goto out;/* Toggle the GPIOs in a manufacturer/model specific way */ for (i =2 ; i >=0 ; i--) {
@@ -681,7 +683,9 @@ static int ax88772_bind(struct usbnet *du32 phyid;struct asix_common_private *priv; -usbnet_get_endpoints (dev, intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Maybe the boot loader passed the MAC address via device tree */ if (!eth_platform_get_mac_address (&dev->udev->dev, buf)) {
@@ -1063,7 +1067,9 @@ static int ax88178_bind(struct usbnet *dint ret;u8 buf[ETH_ALEN ] = {0 }; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Get the MAC address */ ret =asix_read_cmd (dev,AX_CMD_READ_NODE_ID ,0 ,0 ,ETH_ALEN , buf,0 );
Greg Kroah-Hartman
maintainerPATCH 5/187 fbdev: atyfb: Check if pll_ops->init_pll failed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.
Actually check the return value from pll_ops->init_pll() as it can return an error.
If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up.
[ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083) [ 61.476191] atyfb: using auxiliary register aperture [ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27] [ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK [ 61.496112] atyfb: Unsupported xclk source: 5.
--- drivers/video/fbdev/aty/atyfb_base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/video/fbdev/aty/atyfb_base.c +6 -2
@@ -2576,8 +2576,12 @@ static int aty_init(struct fb_info *info pr_cont("\n"); }#endif -if (par->pll_ops->init_pll) - par->pll_ops->init_pll (info, &par->pll); +if (par->pll_ops->init_pll) { + ret = par->pll_ops->init_pll (info, &par->pll); +if (ret) +return ret; + } +if (par->pll_ops->resume_pll) par->pll_ops->resume_pll (info, &par->pll);
Greg Kroah-Hartman
maintainerPATCH 6/187 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Jiang <[email protected]>
commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.
The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.
If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.
--- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/acpi_video.c +3 -1
@@ -2024,8 +2024,10 @@ static void acpi_video_bus_remove_notifystruct acpi_video_device *dev;mutex_lock (&video->device_list_lock); -list_for_each_entry (dev, &video->video_device_list, entry) +list_for_each_entry (dev, &video->video_device_list, entry) {acpi_video_dev_remove_notify_handler (dev); +cancel_delayed_work_sync (&dev->switch_brightness_work); + }mutex_unlock (&video->device_list_lock);acpi_video_bus_stop_devices (video);
Greg Kroah-Hartman
maintainerPATCH 7/187 fbdev: bitblit: bound-check glyph index in bit_putcs*
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <[email protected]>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.
bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
--- drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/bitblit.c +12 -4
@@ -80,12 +80,16 @@ static inline void bit_putcs_aligned(str struct fb_image *image, u8 *buf, u8 *dst) { u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff; +unsigned int charcnt = vc->vc_font.charcount;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
@@ -113,14 +117,18 @@ static inline void bit_putcs_unaligned(s u8 *dst) {u16 charmask = vc->vc_hi_font_mask ?0x1ff :0xff ; +unsigned int charcnt = vc->vc_font.charcount;u32 shift_low =0 , mod = vc->vc_font.width %8 ;u32 shift_high =8 ;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
Greg Kroah-Hartman
maintainerPATCH 8/187 fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.
Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled.
--- drivers/video/fbdev/pvr2fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/pvr2fb.c +1 -1
@@ -191,7 +191,7 @@ static unsigned long pvr2fb_map;#ifdef CONFIG_PVR2_DMA static unsigned int shdma =PVR2_CASCADE_CHAN ; -static unsigned int pvr2dma =ONCHIP_NR_DMA_CHANNELS ; +static unsigned int pvr2dma =CONFIG_NR_ONCHIP_DMA_CHANNELS ;#endif static struct fb_videomode pvr2_modedb[] = {
Greg Kroah-Hartman
maintainerPATCH 9/187 fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.
The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done.
Found via static analysis.
--- drivers/video/fbdev/valkyriefb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/valkyriefb.c +2 -0
@@ -336,11 +336,13 @@ int __init valkyriefb_init(void)if (of_address_to_resource (dp,0 , &r)) {printk (KERN_ERR "can't find address for valkyrie\n" ); +of_node_put (dp);return 0 ; } frame_buffer_phys = r.start; cmap_regs_phys = r.start +0x304000 ; + of_node_put(dp); }#endif /* ppc (!CONFIG_MAC) */
Greg Kroah-Hartman
maintainerPATCH 10/187 ASoC: qdsp6: q6asm: do not sleep while atomic
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
For some reason we ended up kfree between spinlock lock and unlock, which can sleep.
move the kfree out of spinlock section.
--- sound/soc/qcom/qdsp6/q6asm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/qcom/qdsp6/q6asm.c +1 -1
@@ -299,9 +299,9 @@ static void q6asm_audio_client_free_buf(spin_lock_irqsave (&ac->lock, flags); port->num_periods =0 ; +spin_unlock_irqrestore (&ac->lock, flags);kfree (port->buf); port->buf =NULL ; -spin_unlock_irqrestore (&ac->lock, flags); }/**
Greg Kroah-Hartman
maintainerPATCH 11/187 wifi: ath10k: Fix memory leak on unsupported WMI command
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/wmi.c +1 -0
@@ -1894,6 +1894,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)if (cmd_id ==WMI_CMD_UNSUPPORTED ) {ath10k_warn (ar,"wmi command %d is not supported by firmware\n" , cmd_id); +dev_kfree_skb_any (skb);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/187 usbnet: Prevents free active kevent
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit 420c84c330d1688b8c764479e5738bbdbf0a33de ]
The root cause of this issue are:
1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here.
2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed.
The solution to this problem is to cancel the kevent before executing free_netdev().
--- drivers/net/usb/usbnet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/usbnet.c +2 -0
@@ -1615,6 +1615,8 @@ void usbnet_disconnect (struct usb_interface *intf) net = dev->net;unregister_netdev (net); +cancel_work_sync (&dev->kevent); +while ((urb =usb_get_from_anchor (&dev->deferred))) {dev_kfree_skb (urb->context);kfree (urb->sg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/187 drm/etnaviv: fix flush sequence logic
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <[email protected]>
[ Upstream commit a042beac6e6f8ac1e923784cfff98b47cbabb185 ]
The current logic uses the flush sequence from the current address space. This is harmless when deducing the flush requirements for the current submit, as either the incoming address space is the same one as the currently active one or we switch context, in which case the flush is unconditional.
However, this sequence is also stored as the current flush sequence of the GPU. If we switch context the stored flush sequence will no longer belong to the currently active address space. This incoherency can then cause missed flushes, resulting in translation errors.
--- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_buffer.c +1 -1
@@ -346,7 +346,7 @@ void etnaviv_buffer_queue(struct etnavivu32 link_target, link_dwords;bool switch_context = gpu->exec_state != exec_state;bool switch_mmu_context = gpu->mmu_context != mmu_context; -unsigned int new_flush_seq =READ_ONCE (gpu->mmu_context->flush_seq); +unsigned int new_flush_seq =READ_ONCE (mmu_context->flush_seq);bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq;bool has_blt = !!(gpu->identity.minor_features5 & chipMinorFeatures5_BLT_ENGINE);
Greg Kroah-Hartman
maintainerPATCH 14/187 regmap: slimbus: fix bus_context pointer in regmap init calls
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
commit 434f7349a1f00618a620b316f091bd13a12bc8d2 upstream.
Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
--- drivers/base/regmap/regmap-slimbus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap-slimbus.c +2 -4
@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(strif (IS_ERR (bus))return ERR_CAST (bus); -return __regmap_init (&slimbus->dev, bus, &slimbus->dev, config, - lock_key, lock_name); +return __regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__regmap_init_slimbus);
@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbuif (IS_ERR (bus))return ERR_CAST (bus); -return __devm_regmap_init (&slimbus->dev, bus, &slimbus, config, - lock_key, lock_name); +return __devm_regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__devm_regmap_init_slimbus);
Greg Kroah-Hartman
maintainerPATCH 15/187 net: phy: dp83867: Disable EEE support as not implemented
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures.
The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY.
Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs.
--- drivers/net/phy/dp83867.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/phy/dp83867.c +6 -0
@@ -337,6 +337,12 @@ static int dp83867_config_init(struct phreturn ret; } +/* Although the DP83867 reports EEE capability through the +* MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature +* is not actually implemented in hardware. +*/ + phydev->eee_broken_modes =MDIO_EEE_100TX |MDIO_EEE_1000T ; +if (phy_interface_is_rgmii (phydev)) { val =phy_read (phydev,MII_DP83867_PHYCTRL );if (val <0 )
Greg Kroah-Hartman
maintainerPATCH 16/187 wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <[email protected]>
[ Upstream commit 3776c685ebe5f43e9060af06872661de55e80b9a ]
Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash.
[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)
Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver.
Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion().
And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 21 +++++------- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 - 3 files changed, 12 insertions(+), 15 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +1 -2
@@ -4963,8 +4963,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wipbrcmf_dbg (TRACE ,"Action frame, cookie=%lld, len=%d, freq=%d\n" , *cookie,le16_to_cpu (action_frame->len), freq); - ack =brcmf_p2p_send_action_frame (cfg,cfg_to_ndev (cfg), - af_params); + ack =brcmf_p2p_send_action_frame (vif->ifp, af_params);cfg80211_mgmt_tx_status (wdev, *cookie, buf, len, ack,GFP_KERNEL );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +10 -11
@@ -1477,6 +1477,7 @@ int brcmf_p2p_notify_action_tx_complete(/** * brcmf_p2p_tx_action_frame() - send action frame over fil. * +* @ifp: interface to transmit on. * @p2p: p2p info struct for vif. * @af_params: action frame data/info. *
@@ -1486,11 +1487,11 @@ int brcmf_p2p_notify_action_tx_complete(* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action * frame is transmitted. */ -static s32 brcmf_p2p_tx_action_frame (struct brcmf_p2p_info *p2p, +static s32 brcmf_p2p_tx_action_frame (struct brcmf_if *ifp, +struct brcmf_p2p_info *p2p,struct brcmf_fil_af_params_le *af_params) {struct brcmf_pub *drvr = p2p->cfg->pub; -struct brcmf_cfg80211_vif *vif;s32 err =0 ;s32 timeout =0 ;
@@ -1500,8 +1501,7 @@ static s32 brcmf_p2p_tx_action_frame(strclear_bit (BRCMF_P2P_STATUS_ACTION_TX_COMPLETED , &p2p->status);clear_bit (BRCMF_P2P_STATUS_ACTION_TX_NOACK , &p2p->status); - vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE ].vif; - err =brcmf_fil_bsscfg_data_set (vif->ifp,"actframe" , af_params, + err =brcmf_fil_bsscfg_data_set (ifp,"actframe" , af_params,sizeof (*af_params));if (err) {bphy_err (drvr," sending action frame has failed\n" );
@@ -1643,16 +1643,14 @@ static s32 brcmf_p2p_pub_af_tx(struct br/** * brcmf_p2p_send_action_frame() - send action frame . * -* @cfg: driver private data for cfg80211 interface. -* @ndev: net device to transmit on. +* @ifp: interface to transmit on. * @af_params: configuration data for action frame. */ -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params) { +struct brcmf_cfg80211_info *cfg = ifp->drvr->config;struct brcmf_p2p_info *p2p = &cfg->p2p; -struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_fil_action_frame_le *action_frame;struct brcmf_config_af_params config_af_params;struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1779,7 +1777,7 @@ bool brcmf_p2p_send_action_frame(struct tx_retry =0 ;while (!p2p->block_gon_req_tx && (ack == false) && (tx_retry <P2P_AF_TX_MAX_RETRY )) { - ack = !brcmf_p2p_tx_action_frame (p2p, af_params); + ack = !brcmf_p2p_tx_action_frame (ifp, p2p, af_params); tx_retry++; }if (ack == false) {
@@ -2137,7 +2135,6 @@ static struct wireless_dev *brcmf_p2p_crWARN_ON (p2p_ifp->bsscfgidx != bsscfgidx); -init_completion (&p2p->send_af_done);INIT_WORK (&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);init_completion (&p2p->afx_hdl.act_frm_scan);init_completion (&p2p->wait_next_af);
@@ -2390,6 +2387,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802 pri_ifp =brcmf_get_ifp (cfg->pub,0 ); p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY ].vif = pri_ifp->vif; +init_completion (&p2p->send_af_done); +if (p2pdev_forced) { err_ptr =brcmf_p2p_create_p2pdev (p2p,NULL ,NULL );if (IS_ERR (err_ptr)) {
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +1 -2
@@ -165,8 +165,7 @@ int brcmf_p2p_notify_action_frame_rx(strint brcmf_p2p_notify_action_tx_complete (struct brcmf_if *ifp,const struct brcmf_event_msg *e,void *data); -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params);bool brcmf_p2p_scan_finding_common_channel (struct brcmf_cfg80211_info *cfg,struct brcmf_bss_info_le *bi);
Greg Kroah-Hartman
maintainerPATCH 17/187 x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babu Moger <[email protected]>
[ Upstream commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92 ]
Users can create as many monitoring groups as the number of RMIDs supported by the hardware. However, on AMD systems, only a limited number of RMIDs are guaranteed to be actively tracked by the hardware. RMIDs that exceed this limit are placed in an "Unavailable" state.
When a bandwidth counter is read for such an RMID, the hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62). When such an RMID starts being tracked again the hardware counter is reset to zero. MSR_IA32_QM_CTR.Unavailable remains set on first read after tracking re-starts and is clear on all subsequent reads as long as the RMID is tracked.
resctrl miscounts the bandwidth events after an RMID transitions from the "Unavailable" state back to being tracked. This happens because when the hardware starts counting again after resetting the counter to zero, resctrl in turn compares the new count against the counter value stored from the previous time the RMID was tracked.
This results in resctrl computing an event value that is either undercounting (when new counter is more than stored counter) or a mistaken overflow (when new counter is less than stored counter).
Reset the stored value (arch_mbm_state::prev_msr) of MSR_IA32_QM_CTR to zero whenever the RMID is in the "Unavailable" state to ensure accurate counting after the RMID resets to zero when it starts to be tracked again.
Example scenario that results in mistaken overflow
==================================================
1. The resctrl filesystem is mounted, and a task is assigned to a monitoring group.
$mount -t resctrl resctrl /sys/fs/resctrl $mkdir /sys/fs/resctrl/mon_groups/test1/ $echo 1234 > /sys/fs/resctrl/mon_groups/test1/tasks
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
21323 <- Total bytes on domain 0
"Unavailable" <- Total bytes on domain 1
Task is running on domain 0. Counter on domain 1 is "Unavailable".
2. The task runs on domain 0 for a while and then moves to domain 1. The counter starts incrementing on domain 1.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
7345357 <- Total bytes on domain 0
4545 <- Total bytes on domain 1
3. At some point, the RMID in domain 0 transitions to the "Unavailable" state because the task is no longer executing in that domain.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
"Unavailable" <- Total bytes on domain 0
434341 <- Total bytes on domain 1
4. Since the task continues to migrate between domains, it may eventually return to domain 0.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 17592178699059 <- Overflow on domain 0
3232332 <- Total bytes on domain 1
In this case, the RMID on domain 0 transitions from "Unavailable" state to active state. The hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62) when the counter is read and begins tracking the RMID counting from 0.
Subsequent reads succeed but return a value smaller than the previously saved MSR value (7345357). Consequently, the resctrl's overflow logic is triggered, it compares the previous value (7345357) with the new, smaller value and incorrectly interprets this as a counter overflow, adding a large delta.
In reality, this is a false positive: the counter did not overflow but was simply reset when the RMID transitioned from "Unavailable" back to active state.
Here is the text from APM [1] available from [2].
"In PQOS Version 2.0 or higher, the MBM hardware will set the U bit on the first QM_CTR read when it begins tracking an RMID that it was not previously tracking. The U bit will be zero for all subsequent reads from that RMID while it is still tracked by the hardware. Therefore, a QM_CTR read with the U bit set when that RMID is in use by a processor can be considered 0 when calculating the difference with a subsequent read."
[1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3 Monitoring L3 Memory Bandwidth (MBM).
[ bp: Split commit message into smaller paragraph chunks for better
consumption. ]
--- arch/x86/kernel/cpu/resctrl/monitor.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/resctrl/monitor.c +9 -1
@@ -225,11 +225,19 @@ static u64 mbm_overflow_count(u64 prev_mstatic u64 __mon_event_count (u32 rmid,struct rmid_read *rr) { -struct mbm_state *m; +struct mbm_state *m =NULL ;u64 chunks, tval; tval =__rmid_read (rmid, rr->evtid);if (tval & (RMID_VAL_ERROR |RMID_VAL_UNAVAIL )) { +if (tval &RMID_VAL_UNAVAIL ) { +if (rr->evtid ==QOS_L3_MBM_TOTAL_EVENT_ID ) + m = &rr->d->mbm_total[rmid]; +else if (rr->evtid ==QOS_L3_MBM_LOCAL_EVENT_ID ) + m = &rr->d->mbm_local[rmid]; +if (m) + m->prev_msr =0 ; + }return tval; }switch (rr->evtid) {
Greg Kroah-Hartman
maintainerPATCH 18/187 net: ravb: Enforce descriptor type ordering
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 5370c31e84b0e0999c7b5ff949f4e104def35584 ]
Ensure the TX descriptor type fields are published in a safe order so the DMA engine never begins processing a descriptor chain before all descriptor fields are fully initialised.
For multi-descriptor transmits the driver writes DT_FEND into the last descriptor and DT_FSTART into the first. The DMA engine begins processing when it observes DT_FSTART. Move the dma_wmb() barrier so it executes immediately after DT_FEND and immediately before writing DT_FSTART (and before DT_FSINGLE in the single-descriptor case). This guarantees that all prior CPU writes to the descriptor memory are visible to the device before DT_FSTART is seen.
This avoids a situation where compiler/CPU reordering could publish DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to start on a partially initialised chain and causing corrupted transmissions or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as transmit queue timeouts and device resets.
--- drivers/net/ethernet/renesas/ravb_main.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +14 -2
@@ -1593,13 +1593,25 @@ static netdev_tx_t ravb_start_xmit(struc }skb_tx_timestamp (skb); -/* Descriptor type must be set after all the above writes */ -dma_wmb (); +if (num_tx_desc >1 ) { desc->die_dt =DT_FEND ; desc--; +/* When using multi-descriptors, DT_FEND needs to get written +* before DT_FSTART, but the compiler may reorder the memory +* writes in an attempt to optimize the code. +* Use a dma_wmb() barrier to make sure DT_FEND and DT_FSTART +* are written exactly in the order shown in the code. +* This is particularly important for cases where the DMA engine +* is already running when we are running this code. If the DMA +* sees DT_FSTART without the corresponding DT_FEND it will enter +* an error condition. +*/ +dma_wmb (); desc->die_dt =DT_FSTART ; }else { +/* Descriptor type must be set after all the above writes */ +dma_wmb (); desc->die_dt =DT_FSINGLE ; }
Greg Kroah-Hartman
maintainerPATCH 19/187 devcoredump: Fix circular locking dependency with devcd->mutex.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
[ Upstream commit a91c8096590bd7801a26454789f2992094fe36da ]
The original code causes a circular locking dependency found by lockdep.
======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 Tainted: G S U
------------------------------------------------------
xe_fault_inject/5091 is trying to acquire lock:ffff888156815688 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}, at: __flush_work+0x25d/0x660
but task is already holding lock:
ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&devcd->mutex){+.+.}-{3:3}:
mutex_lock_nested+0x4e/0xc0
devcd_data_write+0x27/0x90
sysfs_kf_bin_write+0x80/0xf0
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #1 (kn->active#236){++++}-{0:0}:
kernfs_drain+0x1e2/0x200
__kernfs_remove+0xae/0x400
kernfs_remove_by_name_ns+0x5d/0xc0
remove_files+0x54/0x70
sysfs_remove_group+0x3d/0xa0
sysfs_remove_groups+0x2e/0x60
device_remove_attrs+0xc7/0x100
device_del+0x15d/0x3b0
devcd_del+0x19/0x30
process_one_work+0x22b/0x6f0
worker_thread+0x1e8/0x3d0
kthread+0x11c/0x250
ret_from_fork+0x26c/0x2e0
ret_from_fork_asm+0x1a/0x30
-> #0 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}:
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
__flush_work+0x27a/0x660
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
other info that might help us debug this:
Chain exists of: (work_completion)(&(&devcd->del_wk)->work) --> kn->active#236 --> &devcd->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&devcd->mutex);
lock(kn->active#236);
lock(&devcd->mutex);
lock((work_completion)(&(&devcd->del_wk)->work));
*** DEADLOCK ***
5 locks held by xe_fault_inject/5091:
#0: ffff8881129f9488 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x72/0xf0
#1: ffff88810c755078 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x123/0x220
#2: ffff8881054811a0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x55/0x280
#3: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0
#4: ffffffff8359e020 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x72/0x660
stack backtrace:
CPU: 14 UID: 0 PID: 5091 Comm: xe_fault_inject Tainted: G S U 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 PREEMPT_{RT,(lazy)}
Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
Hardware name: Micro-Star International Co., Ltd. MS-7D25/PRO Z690-A DDR4(MS-7D25), BIOS 1.10 12/13/2021
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
dump_stack+0x10/0x20
print_circular_bug+0x285/0x360
check_noncircular+0x135/0x150
? register_lock_class+0x48/0x4a0
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
? __flush_work+0x25d/0x660
? mark_held_locks+0x46/0x90
? __flush_work+0x25d/0x660
__flush_work+0x27a/0x660
? __flush_work+0x25d/0x660
? trace_hardirqs_on+0x1e/0xd0
? __pfx_wq_barrier_func+0x10/0x10
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
? bus_find_device+0xa8/0xe0
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
? __f_unlock_pos+0x15/0x20
? __x64_sys_getdents64+0x9b/0x130
? __pfx_filldir64+0x10/0x10
? do_syscall_64+0x1a2/0xb60
? clear_bhb_loop+0x30/0x80
? clear_bhb_loop+0x30/0x80
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x76e292edd574
Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
RSP: 002b:00007fffe247a828 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000076e292edd574
RDX: 000000000000000c RSI: 00006267f6306063 RDI: 000000000000000b
RBP: 000000000000000c R08: 000076e292fc4b20 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00006267f6306063
R13: 000000000000000b R14: 00006267e6859c00 R15: 000076e29322a000
</TASK>xe 0000:03:00.0: [drm] Xe device coredump has been deleted.
--- drivers/base/devcoredump.c | 138 +++++++++++++++++++++++++++------------------ 1 file changed, 84 insertions(+), 54 deletions(-)
drivers/base/devcoredump.c +84 -54
@@ -30,50 +30,46 @@ struct devcd_entry {void *data;size_t datalen;/* -* Here, mutex is required to serialize the calls to del_wk work between -* user/kernel space which happens when devcd is added with device_add() -* and that sends uevent to user space. User space reads the uevents, -* and calls to devcd_data_write() which try to modify the work which is -* not even initialized/queued from devcoredump. +* There are 2 races for which mutex is required. * +* The first race is between device creation and userspace writing to +* schedule immediately destruction. * +* This race is handled by arming the timer before device creation, but +* when device creation fails the timer still exists. * -* cpu0(X) cpu1(Y) +* To solve this, hold the mutex during device_add(), and set +* init_completed on success before releasing the mutex. * -* dev_coredump() uevent sent to user space -* device_add() ======================> user space process Y reads the -* uevents writes to devcd fd -* which results into writes to +* That way the timer will never fire until device_add() is called, +* it will do nothing if init_completed is not set. The timer is also +* cancelled in that case. * -* devcd_data_write() -* mod_delayed_work() -* try_to_grab_pending() -* del_timer() -* debug_assert_init() -* INIT_DELAYED_WORK() -* schedule_delayed_work() -* -* -* Also, mutex alone would not be enough to avoid scheduling of -* del_wk work after it get flush from a call to devcd_free() -* mentioned as below. -* -* disabled_store() -* devcd_free() -* mutex_lock() devcd_data_write() -* flush_delayed_work() -* mutex_unlock() -* mutex_lock() -* mod_delayed_work() -* mutex_unlock() -* So, delete_work flag is required. +* The second race involves multiple parallel invocations of devcd_free(), +* add a deleted flag so only 1 can call the destructor. */ struct mutex mutex; -bool delete_work; +bool init_completed, deleted;struct module *owner;ssize_t (*read)(char *buffer,loff_t offset,size_t count,void *data,size_t datalen);void (*free)(void *data); +/* +* If nothing interferes and device_add() was returns success, +* del_wk will destroy the device after the timer fires. +* +* Multiple userspace processes can interfere in the working of the timer: +* - Writing to the coredump will reschedule the timer to run immediately, +* if still armed. +* +* This is handled by using "if (cancel_delayed_work()) { +* schedule_delayed_work() }", to prevent re-arming after having +* been previously fired. +* - Writing to /sys/class/devcoredump/disabled will destroy the +* coredump synchronously. +* This is handled by using disable_delayed_work_sync(), and then +* checking if deleted flag is set with &devcd->mutex held. +*/ struct delayed_work del_wk;struct device *failing_dev; };
@@ -102,14 +98,27 @@ static void devcd_dev_release(struct devkfree (devcd); } +static void __devcd_del (struct devcd_entry *devcd) +{ + devcd->deleted = true; +device_del (&devcd->devcd_dev); +put_device (&devcd->devcd_dev); +} +static void devcd_del (struct work_struct *wk) {struct devcd_entry *devcd; +bool init_completed; devcd = container_of(wk, struct devcd_entry, del_wk.work); -device_del (&devcd->devcd_dev); -put_device (&devcd->devcd_dev); +/* devcd->mutex serializes against dev_coredumpm_timeout */ +mutex_lock (&devcd->mutex); + init_completed = devcd->init_completed; +mutex_unlock (&devcd->mutex); + +if (init_completed) +__devcd_del (devcd); } static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj,
@@ -129,12 +138,12 @@ static ssize_t devcd_data_write(struct fstruct device *dev =kobj_to_dev (kobj);struct devcd_entry *devcd =dev_to_devcd (dev); -mutex_lock (&devcd->mutex); -if (!devcd->delete_work) { - devcd->delete_work = true; -mod_delayed_work (system_wq, &devcd->del_wk,0 ); - } -mutex_unlock (&devcd->mutex); +/* +* Although it's tempting to use mod_delayed work here, +* that will cause a reschedule if the timer already fired. +*/ +if (cancel_delayed_work (&devcd->del_wk)) +schedule_delayed_work (&devcd->del_wk,0 );return count; }
@@ -162,11 +171,21 @@ static int devcd_free(struct device *dev {struct devcd_entry *devcd =dev_to_devcd (dev); +/* +* To prevent a race with devcd_data_write(), cancel work and +* complete manually instead. +* +* We cannot rely on the return value of +* cancel_delayed_work_sync() here, because it might be in the +* middle of a cancel_delayed_work + schedule_delayed_work pair. +* +* devcd->mutex here guards against multiple parallel invocations +* of devcd_free(). +*/ +cancel_delayed_work_sync (&devcd->del_wk);mutex_lock (&devcd->mutex); -if (!devcd->delete_work) - devcd->delete_work = true; - -flush_delayed_work (&devcd->del_wk); +if (!devcd->deleted) +__devcd_del (devcd);mutex_unlock (&devcd->mutex);return 0 ; }
@@ -190,12 +209,10 @@ static ssize_t disabled_show(struct clas* put_device() <- last reference * error = fn(dev, data) devcd_dev_release() * devcd_free(dev, data) kfree(devcd) -* mutex_lock(&devcd->mutex); * * -* In the above diagram, It looks like disabled_store() would be racing with parallely -* running devcd_del() and result in memory abort while acquiring devcd->mutex which -* is called after kfree of devcd memory after dropping its last reference with +* In the above diagram, it looks like disabled_store() would be racing with parallelly +* running devcd_del() and result in memory abort after dropping its last reference with * put_device(). However, this will not happens as fn(dev, data) runs * with its own reference to device via klist_node so it is not its last reference. * so, above situation would not occur.
@@ -357,7 +374,7 @@ void dev_coredumpm(struct device *dev, s devcd->read = read; devcd->free = free; devcd->failing_dev =get_device (dev); - devcd->delete_work = false; + devcd->deleted = false;mutex_init (&devcd->mutex);device_initialize (&devcd->devcd_dev);
@@ -366,8 +383,14 @@ void dev_coredumpm(struct device *dev, s atomic_inc_return(&devcd_count)); devcd->devcd_dev.class = &devcd_class; -mutex_lock (&devcd->mutex);dev_set_uevent_suppress (&devcd->devcd_dev, true); + +/* devcd->mutex prevents devcd_del() completing until init finishes */ +mutex_lock (&devcd->mutex); + devcd->init_completed = false; +INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); +schedule_delayed_work (&devcd->del_wk,DEVCD_TIMEOUT ); +if (device_add (&devcd->devcd_dev)) goto put_device;
@@ -381,13 +404,20 @@ void dev_coredumpm(struct device *dev, sdev_set_uevent_suppress (&devcd->devcd_dev, false);kobject_uevent (&devcd->devcd_dev.kobj,KOBJ_ADD ); -INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); -schedule_delayed_work (&devcd->del_wk,DEVCD_TIMEOUT ); + +/* +* Safe to run devcd_del() now that we are done with devcd_dev. +* Alternatively we could have taken a ref on devcd_dev before +* dropping the lock. +*/ + devcd->init_completed = true;mutex_unlock (&devcd->mutex);return ; put_device: -put_device (&devcd->devcd_dev);mutex_unlock (&devcd->mutex); +cancel_delayed_work_sync (&devcd->del_wk); +put_device (&devcd->devcd_dev); + put_module:module_put (owner); free:
Greg Kroah-Hartman
maintainerPATCH 20/187 can: gs_usb: increase max interface to U8_MAX
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Celeste Liu <[email protected]>
commit 2a27f6a8fb5722223d526843040f747e9b0e8060 upstream
This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD converter[1]. The original developers may have only 3 interfaces device to test so they write 3 here and wait for future change.
During the HSCanT development, we actually used 4 interfaces, so the limitation of 3 is not enough now. But just increase one is not future-proofed. Since the channel index type in gs_host_frame is u8, just make canch[] become a flexible array with a u8 index, so it naturally constraint by U8_MAX and avoid statically allocate 256 pointer for every gs_usb device.
[1]: https://github.com/cherry-embedded/HSCanT-hardware
--- drivers/net/can/usb/gs_usb.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
drivers/net/can/usb/gs_usb.c +11 -12
@@ -156,10 +156,6 @@ struct gs_host_frame {#define GS_MAX_TX_URBS 10/* Only launch a max of GS_MAX_RX_URBS usb requests at a time. */ #define GS_MAX_RX_URBS 30 -/* Maximum number of interfaces the driver supports per device. -* Current hardware only supports 2 interfaces. The future may vary. -*/ -#define GS_MAX_INTF 2struct gs_tx_context {struct gs_can *dev;
@@ -190,10 +186,11 @@ struct gs_can {/* usb interface struct */ struct gs_usb { -struct gs_can *canch[GS_MAX_INTF ];struct usb_anchor rx_submitted;struct usb_device *udev;u8 active_channels; +u8 channel_cnt; +struct gs_can *canch[]; };/* 'allocate' a tx context.
@@ -321,7 +318,7 @@ static void gs_usb_receive_bulk_callback }/* device reports out of range channel id */ -if (hf->channel >=GS_MAX_INTF ) +if (hf->channel >= usbcan->channel_cnt) goto device_detach; dev = usbcan->canch[hf->channel];
@@ -409,7 +406,7 @@ static void gs_usb_receive_bulk_callback/* USB failure take down all interfaces */ if (rc == -ENODEV ) { device_detach: -for (rc =0 ; rc <GS_MAX_INTF ; rc++) { +for (rc =0 ; rc < usbcan->channel_cnt; rc++) {if (usbcan->canch[rc])netif_device_detach (usbcan->canch[rc]->netdev); }
@@ -991,20 +988,22 @@ static int gs_usb_probe(struct usb_inter icount = dconf->icount +1 ;dev_info (&intf->dev,"Configuring for %d interfaces\n" , icount); -if (icount >GS_MAX_INTF ) { +if (icount >type_max (typeof (dev->channel_cnt))) {dev_err (&intf->dev, -"Driver cannot handle more that %d CAN interfaces\n" , -GS_MAX_INTF ); +"Driver cannot handle more that %u CAN interfaces\n" , +type_max (typeof (dev->channel_cnt)));kfree (dconf);return -EINVAL ; } - dev =kzalloc (sizeof (*dev),GFP_KERNEL ); + dev =kzalloc (struct_size (dev, canch, icount),GFP_KERNEL );if (!dev) {kfree (dconf);return -ENOMEM ; } + dev->channel_cnt = icount; +init_usb_anchor (&dev->rx_submitted);usb_set_intfdata (intf, dev);
@@ -1045,7 +1044,7 @@ static void gs_usb_disconnect(struct usbreturn ; } -for (i =0 ; i <GS_MAX_INTF ; i++) +for (i =0 ; i < dev->channel_cnt; i++)if (dev->canch[i])gs_destroy_candev (dev->canch[i]);
Greg Kroah-Hartman
maintainerPATCH 21/187 serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit a8afc193558a42d5df724c84436ae3b2446d8a30 ]
Simplify the code which fetches the input clock by using devm_clk_get_optional(). This comes with a small functional change: previously all errors were ignored except deferred probe. Now all errors are treated as errors. If no input clock is present devm_clk_get_optional() will return NULL instead of an error which matches the behavior of the old code.
Stable-dep-of: daeb4037adf7 ("serial: 8250_dw: handle reset control deassert error")
--- drivers/tty/serial/8250/8250_dw.c | 75 ++++++++++++++++---------------------- 1 file changed, 32 insertions(+), 43 deletions(-)
drivers/tty/serial/8250/8250_dw.c +32 -43
@@ -283,9 +283,6 @@ static void dw8250_set_termios(struct ualong rate;int ret; -if (IS_ERR (d->clk)) - goto out; -clk_disable_unprepare (d->clk); rate =clk_round_rate (d->clk, baud *16 );if (rate <0 )
@@ -296,8 +293,10 @@ static void dw8250_set_termios(struct ua ret =clk_set_rate (d->clk, rate);clk_prepare_enable (d->clk); -if (!ret) - p->uartclk = rate; +if (ret) + goto out; + + p->uartclk = rate; out: p->status &= ~UPSTAT_AUTOCTS ;
@@ -473,19 +472,18 @@ static int dw8250_probe(struct platform_device_property_read_u32 (dev,"clock-frequency" , &p->uartclk);/* If there is separate baudclk, get the rate from it. */ - data->clk =devm_clk_get (dev,"baudclk" ); -if (IS_ERR (data->clk) &&PTR_ERR (data->clk) != -EPROBE_DEFER ) - data->clk =devm_clk_get (dev,NULL ); -if (IS_ERR (data->clk) &&PTR_ERR (data->clk) == -EPROBE_DEFER ) -return -EPROBE_DEFER ; -if (!IS_ERR_OR_NULL (data->clk)) { - err =clk_prepare_enable (data->clk); -if (err) -dev_warn (dev,"could not enable optional baudclk: %d\n" , - err); -else - p->uartclk =clk_get_rate (data->clk); - } + data->clk =devm_clk_get_optional (dev,"baudclk" ); +if (data->clk ==NULL ) + data->clk =devm_clk_get_optional (dev,NULL ); +if (IS_ERR (data->clk)) +return PTR_ERR (data->clk); + + err =clk_prepare_enable (data->clk); +if (err) +dev_warn (dev,"could not enable optional baudclk: %d\n" , err); + +if (data->clk) + p->uartclk =clk_get_rate (data->clk);/* If no clock rate is defined, fail. */ if (!p->uartclk) {
@@ -494,17 +492,16 @@ static int dw8250_probe(struct platform_ goto err_clk; } - data->pclk =devm_clk_get (dev,"apb_pclk" ); -if (IS_ERR (data->pclk) &&PTR_ERR (data->pclk) == -EPROBE_DEFER ) { - err = -EPROBE_DEFER ; + data->pclk =devm_clk_get_optional (dev,"apb_pclk" ); +if (IS_ERR (data->pclk)) { + err =PTR_ERR (data->pclk); goto err_clk; } -if (!IS_ERR (data->pclk)) { - err =clk_prepare_enable (data->pclk); -if (err) { -dev_err (dev,"could not enable apb_pclk\n" ); - goto err_clk; - } + + err =clk_prepare_enable (data->pclk); +if (err) { +dev_err (dev,"could not enable apb_pclk\n" ); + goto err_clk; } data->rst =devm_reset_control_get_optional_exclusive (dev,NULL );
@@ -547,12 +544,10 @@ err_reset:reset_control_assert (data->rst); err_pclk: -if (!IS_ERR (data->pclk)) -clk_disable_unprepare (data->pclk); +clk_disable_unprepare (data->pclk); err_clk: -if (!IS_ERR (data->clk)) -clk_disable_unprepare (data->clk); +clk_disable_unprepare (data->clk);return err; }
@@ -568,11 +563,9 @@ static int dw8250_remove(struct platformreset_control_assert (data->rst); -if (!IS_ERR (data->pclk)) -clk_disable_unprepare (data->pclk); +clk_disable_unprepare (data->pclk); -if (!IS_ERR (data->clk)) -clk_disable_unprepare (data->clk); +clk_disable_unprepare (data->clk);pm_runtime_disable (dev);pm_runtime_put_noidle (dev);
@@ -605,11 +598,9 @@ static int dw8250_runtime_suspend(struct {struct dw8250_data *data =dev_get_drvdata (dev); -if (!IS_ERR (data->clk)) -clk_disable_unprepare (data->clk); +clk_disable_unprepare (data->clk); -if (!IS_ERR (data->pclk)) -clk_disable_unprepare (data->pclk); +clk_disable_unprepare (data->pclk);return 0 ; }
@@ -618,11 +609,9 @@ static int dw8250_runtime_resume(struct {struct dw8250_data *data =dev_get_drvdata (dev); -if (!IS_ERR (data->pclk)) -clk_prepare_enable (data->pclk); +clk_prepare_enable (data->pclk); -if (!IS_ERR (data->clk)) -clk_prepare_enable (data->clk); +clk_prepare_enable (data->clk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 22/187 serial: 8250_dw: Use devm_add_action_or_reset()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 295b09128d12fb1a7a67f771cc0ae0df869eafaf ]
Slightly simplify ->probe() and drop a few goto labels by using devm_add_action_or_reset() for clock and reset cleanup.
Stable-dep-of: daeb4037adf7 ("serial: 8250_dw: handle reset control deassert error")
--- drivers/tty/serial/8250/8250_dw.c | 63 ++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 32 deletions(-)
drivers/tty/serial/8250/8250_dw.c +31 -32
@@ -384,6 +384,16 @@ static void dw8250_quirks(struct uart_po } } +static void dw8250_clk_disable_unprepare (void *data) +{ +clk_disable_unprepare (data); +} + +static void dw8250_reset_control_assert (void *data) +{ +reset_control_assert (data); +} +static int dw8250_probe (struct platform_device *pdev) {struct uart_8250_port uart = {}, *up = &uart;
@@ -482,35 +492,43 @@ static int dw8250_probe(struct platform_if (err)dev_warn (dev,"could not enable optional baudclk: %d\n" , err); + err =devm_add_action_or_reset (dev, dw8250_clk_disable_unprepare, data->clk); +if (err) +return err; +if (data->clk) p->uartclk =clk_get_rate (data->clk);/* If no clock rate is defined, fail. */ if (!p->uartclk) {dev_err (dev,"clock rate not defined\n" ); - err = -EINVAL ; - goto err_clk; +return -EINVAL ; } data->pclk =devm_clk_get_optional (dev,"apb_pclk" ); -if (IS_ERR (data->pclk)) { - err =PTR_ERR (data->pclk); - goto err_clk; - } +if (IS_ERR (data->pclk)) +return PTR_ERR (data->pclk); err =clk_prepare_enable (data->pclk);if (err) {dev_err (dev,"could not enable apb_pclk\n" ); - goto err_clk; +return err; } + err =devm_add_action_or_reset (dev, dw8250_clk_disable_unprepare, data->pclk); +if (err) +return err; + data->rst =devm_reset_control_get_optional_exclusive (dev,NULL ); -if (IS_ERR (data->rst)) { - err =PTR_ERR (data->rst); - goto err_pclk; - } +if (IS_ERR (data->rst)) +return PTR_ERR (data->rst); +reset_control_deassert (data->rst); + err =devm_add_action_or_reset (dev, dw8250_reset_control_assert, data->rst); +if (err) +return err; +dw8250_quirks (p, data);/* If the Busy Functionality is not implemented, don't handle it */
@@ -528,10 +546,8 @@ static int dw8250_probe(struct platform_ } data->data.line =serial8250_register_8250_port (up); -if (data->data.line <0 ) { - err = data->data.line; - goto err_reset; - } +if (data->data.line <0 ) +return data->data.line;platform_set_drvdata (pdev, data);
@@ -539,17 +555,6 @@ static int dw8250_probe(struct platform_pm_runtime_enable (dev);return 0 ; - -err_reset: -reset_control_assert (data->rst); - -err_pclk: -clk_disable_unprepare (data->pclk); - -err_clk: -clk_disable_unprepare (data->clk); - -return err; }static int dw8250_remove (struct platform_device *pdev)
@@ -561,12 +566,6 @@ static int dw8250_remove(struct platformserial8250_unregister_port (data->data.line); -reset_control_assert (data->rst); - -clk_disable_unprepare (data->pclk); - -clk_disable_unprepare (data->clk); -pm_runtime_disable (dev);pm_runtime_put_noidle (dev);
Greg Kroah-Hartman
maintainerPATCH 23/187 serial: 8250_dw: handle reset control deassert error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Shimko <[email protected]>
[ Upstream commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b ]
Check the return value of reset_control_deassert() in the probe function to prevent continuing probe when reset deassertion fails.
Previously, reset_control_deassert() was called without checking its return value, which could lead to probe continuing even when the device reset wasn't properly deasserted.
The fix checks the return value and returns an error with dev_err_probe() if reset deassertion fails, providing better error handling and diagnostics.
--- drivers/tty/serial/8250/8250_dw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_dw.c +3 -1
@@ -523,7 +523,9 @@ static int dw8250_probe(struct platform_if (IS_ERR (data->rst))return PTR_ERR (data->rst); -reset_control_deassert (data->rst); + err =reset_control_deassert (data->rst); +if (err) +return dev_err_probe (dev, err,"failed to deassert resets\n" ); err =devm_add_action_or_reset (dev, dw8250_reset_control_assert, data->rst);if (err)
Greg Kroah-Hartman
maintainerPATCH 24/187 usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <[email protected]>
commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.
A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues
--- drivers/usb/gadget/function/f_fs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +7 -1
@@ -2012,7 +2012,12 @@ static int ffs_func_eps_enable(struct ff ep = func->eps; epfile = ffs->epfiles; count = ffs->eps_count; -while (count--) { +if (!epfile) { + ret = -ENOMEM ; + goto done; + } + +while (count--) { ep->ep->driver_data = ep; ret =config_ep_by_speed (func->gadget, &func->function, ep->ep);
@@ -2036,6 +2041,7 @@ static int ffs_func_eps_enable(struct ff }wake_up_interruptible (&ffs->wait); +done:spin_unlock_irqrestore (&func->ffs->eps_lock, flags);return ret;
Greg Kroah-Hartman
maintainerPATCH 25/187 soc: qcom: smem: Fix endian-unaware access of num_entries
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Reidel <[email protected]>
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
Add a missing le32_to_cpu when accessing num_entries, which is always a little endian integer.
Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
--- drivers/soc/qcom/smem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/smem.c +1 -1
@@ -709,7 +709,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)if (IS_ERR_OR_NULL (ptable))return SMEM_ITEM_COUNT ; - info = (struct smem_info *)&ptable->entry[ptable->num_entries]; + info = (struct smem_info *)&ptable->entry[le32_to_cpu (ptable->num_entries)];if (memcmp (info->magic,SMEM_INFO_MAGIC ,sizeof (info->magic)))return SMEM_ITEM_COUNT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/187 spi: loopback-test: Dont use %pK through printk
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe.
--- drivers/spi/spi-loopback-test.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/spi/spi-loopback-test.c +6 -6
@@ -403,7 +403,7 @@ static void spi_test_dump_message(struct spi_device *spi,int i;u8 b; -dev_info (&spi->dev," spi_msg@%pK\n" , msg); +dev_info (&spi->dev," spi_msg@%p\n" , msg);if (msg->status)dev_info (&spi->dev," status: %i\n" , msg->status);
@@ -413,15 +413,15 @@ static void spi_test_dump_message(struct spi_device *spi, msg->actual_length);list_for_each_entry (xfer, &msg->transfers, transfer_list) { -dev_info (&spi->dev," spi_transfer@%pK\n" , xfer); +dev_info (&spi->dev," spi_transfer@%p\n" , xfer);dev_info (&spi->dev," len: %i\n" , xfer->len); -dev_info (&spi->dev," tx_buf: %pK\n" , xfer->tx_buf); +dev_info (&spi->dev," tx_buf: %p\n" , xfer->tx_buf);if (dump_data && xfer->tx_buf)spi_test_print_hex_dump (" TX: " , xfer->tx_buf, xfer->len); -dev_info (&spi->dev," rx_buf: %pK\n" , xfer->rx_buf); +dev_info (&spi->dev," rx_buf: %p\n" , xfer->rx_buf);if (dump_data && xfer->rx_buf) spi_test_print_hex_dump(" RX: ", xfer->rx_buf,
@@ -514,7 +514,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,/* if still not found then something has modified too much */ /* we could list the "closest" transfer here... */ dev_err (&spi->dev, -"loopback strangeness - rx changed outside of allowed range at: %pK\n" , +"loopback strangeness - rx changed outside of allowed range at: %p\n" , addr);/* do not return, only set ret, * so that we list all addresses
@@ -652,7 +652,7 @@ static int spi_test_translate(struct spi_device *spi, }dev_err (&spi->dev, -"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n" , +"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n" , *ptr, *ptr + len,RX (0 ),RX (SPI_TEST_MAX_SIZE ),TX (0 ),TX (SPI_TEST_MAX_SIZE ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/187 bpf: Dont use %pK through printk
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- include/linux/filter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/filter.h +1 -1
@@ -980,7 +980,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);static inline void bpf_jit_dump (unsigned int flen,unsigned int proglen,u32 pass,void *image) { -pr_err ("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" , flen, +pr_err ("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n" , flen, proglen, pass, image, current->comm,task_pid_nr (current));if (image)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/187 mmc: host: renesas_sdhi: Fix the actual clock
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
Wrong actual clock reported, if the SD clock division ratio is other than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
On high speed mode, cat /sys/kernel/debug/mmc1/ios Without the patch:
clock: 50000000 Hz actual clock: 200000000 Hz
After the fix:
clock: 50000000 Hz actual clock: 50000000 Hz
--- drivers/mmc/host/renesas_sdhi_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/host/renesas_sdhi_core.c +5 -1
@@ -185,7 +185,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, clk &= ~0xff ; } -sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clk &CLK_CTL_DIV_MASK ); + clock = clk &CLK_CTL_DIV_MASK ; +if (clock !=0xff ) + host->mmc->actual_clock /= (1 << (ffs (clock) +1 )); + +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clock);if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 ))usleep_range (10000 ,11000 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/187 memstick: Add timeout to prevent indefinite waiting
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures.
--- drivers/memstick/core/memstick.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/memstick/core/memstick.c +6 -2
@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card) { card->next_request = h_memstick_set_rw_addr;memstick_new_req (card->host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;return card->current_mrq.error; }
@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host) card->next_request = h_memstick_read_dev_id;memstick_new_req (host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;if (card->current_mrq.error) goto err_out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/187 ACPI: video: force native for Lenovo 82K8
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec. Add a quirk to prevent using it.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -556,6 +556,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"), }, }, +/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */ + { + .callback = video_detect_force_native, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "82K8"), + }, + }, { }, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/187 selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt the usage in test_lirc_mode2_user.c.
--- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_lirc_mode2_user.c +1 -1
@@ -73,7 +73,7 @@ int main(int argc, char **argv)/* Let's try detach it before it was ever attached */ ret =bpf_prog_detach2 (progfd, lircfd,BPF_LIRC_MODE2 ); -if (ret !=-1 || errno !=ENOENT ) { +if (ret != -ENOENT ) {printf ("bpf_prog_detach2 not attached should fail: %m\n" );return 1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/187 cpufreq/longhaul: handle NULL policy in longhaul_exit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Beier <[email protected]>
[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic.
This patch adds a check using unlikely() and returns early if the policy is NULL.
Bugzilla: #219962
--- drivers/cpufreq/longhaul.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cpufreq/longhaul.c +3 -0
@@ -956,6 +956,9 @@ static void __exit longhaul_exit(void)struct cpufreq_policy *policy =cpufreq_cpu_get (0 );int i; +if (unlikely (!policy)) +return ; +for (i =0 ; i < numscales; i++) {if (mults[i] == maxmult) {struct cpufreq_freqs freqs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/187 arc: Fix __fls() const-foldability via __builtin_clzl()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results).
For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function uses __builtin_arc_fls() which lacks GCC's const attribute, preventing compile-time constant folding, and KUnit testing of ffs/fls fails on arc[3]. A patch[2] to GCC to solve this has been sent.
Add a fix for this by handling compile-time constants with the standard __builtin_clzl() builtin (which has const attribute) while preserving the optimized arc-specific builtin for runtime cases. This has the added benefit of skipping runtime calculation of compile-time constant values. Even with the GCC bug fixed (which is about "attribute const") this is a good change to avoid needless runtime costs, and should be done regardless of the state of GCC's bug.
Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
--- arch/arc/include/asm/bitops.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arc/include/asm/bitops.h +2 -0
@@ -371,6 +371,8 @@ static inline __attribute__ ((const)) int fls(unsigned long x)*/ static inline __attribute__ ((const))int __fls (unsigned long x) { +if (__builtin_constant_p (x)) +return x ?BITS_PER_LONG -1 -__builtin_clzl (x) :0 ;/* FLS insn has exactly same semantics as the API */ return __builtin_arc_fls (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/187 irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <[email protected]>
[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the low-order bits of the MSI Message DATA register to encode nr_irqs interrupt numbers in the log2(nr_irqs) bits for the domain.
The problem arises if the base vector (GICV2m base spi) is not aligned with nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base vector conflict with the nr_irqs masking, causing the wrong MSI interrupt to be identified.
To fix this, use bitmap_find_next_zero_area_off() instead of bitmap_find_free_region() to align the initial base vector with nr_irqs.
--- drivers/irqchip/irq-gic-v2m.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v2m.c +9 -4
@@ -178,14 +178,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, {msi_alloc_info_t *info = args;struct v2m_data *v2m =NULL , *tmp; -int hwirq, offset, i, err =0 ; +int hwirq, i, err =0 ; +unsigned long offset; +unsigned long align_mask = nr_irqs -1 ;spin_lock (&v2m_lock);list_for_each_entry (tmp, &v2m_nodes, entry) { - offset =bitmap_find_free_region (tmp->bm, tmp->nr_spis, -get_count_order (nr_irqs)); -if (offset >=0 ) { +unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask); + + offset =bitmap_find_next_zero_area_off (tmp->bm, tmp->nr_spis,0 , + nr_irqs, align_mask, align_off); +if (offset < tmp->nr_spis) { v2m = tmp; +bitmap_set (v2m->bm, offset, nr_irqs);break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/187 mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
For Qualcomm SoCs which needs level shifter for SD card, extra delay is seen on receiver data path.
To compensate this delay enable tuning for SDR50 mode for targets which has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets with level shifter on Qualcomm SOC's.
--- drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/mmc/host/sdhci-msm.c +15 -0
@@ -63,6 +63,7 @@#define CORE_IO_PAD_PWR_SWITCH_EN (1 << 15)#define CORE_IO_PAD_PWR_SWITCH (1 << 16)#define CORE_HC_SELECT_IN_EN BIT(18) +#define CORE_HC_SELECT_IN_SDR50 (4 << 19)#define CORE_HC_SELECT_IN_HS400 (6 << 19)#define CORE_HC_SELECT_IN_MASK (7 << 19)
@@ -1034,6 +1035,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host) {struct mmc_ios *ios = &host->mmc->ios; +if (ios->timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) +return true; +/* * Tuning is required for SDR104, HS200 and HS400 cards and * if clock frequency is greater than 100MHz in these modes.
@@ -1102,6 +1107,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)struct mmc_ios ios = host->mmc->ios;struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +const struct sdhci_msm_offset *msm_offset = msm_host->offset; +u32 config;if (!sdhci_msm_is_tuning_needed (host)) { msm_host->use_cdr = false;
@@ -1118,6 +1125,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)*/ msm_host->tuning_done =0 ; +if (ios.timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) { + config =readl_relaxed (host->ioaddr + msm_offset->core_vendor_spec); + config &= ~CORE_HC_SELECT_IN_MASK ; + config |=CORE_HC_SELECT_IN_EN |CORE_HC_SELECT_IN_SDR50 ; +writel_relaxed (config, host->ioaddr + msm_offset->core_vendor_spec); + } +/* * For HS400 tuning in HS200 timing requires: * - select MCLK/2 in VENDOR_SPEC
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/187 ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
When deleting the previous walkstate operand stack acpi_ds_call_control_method() was deleting obj_desc->Method.param_count operands. But Method.param_count does not necessarily match this_walk_state->num_operands, it may be either less or more.
After correcting the for loop to check i < this_walk_state->num_operands the code is identical to acpi_ds_clear_operands(), so just outright replace the code with acpi_ds_clear_operands() to fix this.
--- drivers/acpi/acpica/dsmethod.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/acpi/acpica/dsmethod.c +1 -8
@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,* Delete the operands on the previous walkstate operand stack * (they were copied to new objects) */ -for (i =0 ; i < obj_desc->method.param_count; i++) { -acpi_ut_remove_reference (this_walk_state->operands[i]); - this_walk_state->operands[i] =NULL ; - } - -/* Clear the operand stack */ - - this_walk_state->num_operands =0 ; +acpi_ds_clear_operands (this_walk_state); ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/187 tee: allow a driver to allocate a tee_device without a pool
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amirreza Zarrabi <[email protected]>
[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
A TEE driver doesn't always need to provide a pool if it doesn't support memory sharing ioctls and can allocate memory for TEE messages in another way. Although this is mentioned in the documentation for tee_device_alloc(), it is not handled correctly.
--- drivers/tee/tee_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tee/tee_core.c +1 -1
@@ -722,7 +722,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,if (!teedesc || !teedesc->name || !teedesc->ops || !teedesc->ops->get_version || !teedesc->ops->open || - !teedesc->ops->release || !pool) + !teedesc->ops->release)return ERR_PTR (-EINVAL ); teedev =kzalloc (sizeof (*teedev),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/187 video: backlight: lp855x_bl: Set correct EPROM start for LP8556
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
According to LP8556 datasheet EPROM region starts at 0x98 so adjust value in the driver accordingly.
--- drivers/video/backlight/lp855x_bl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/backlight/lp855x_bl.c +1 -1
@@ -21,7 +21,7 @@#define LP855X_DEVICE_CTRL 0x01#define LP855X_EEPROM_START 0xA0#define LP855X_EEPROM_END 0xA7 -#define LP8556_EPROM_START 0xA0 +#define LP8556_EPROM_START 0x98#define LP8556_EPROM_END 0xAF/* LP8555/7 Registers */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/187 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
The driver uses the raw_readl() and raw_writel() functions. Those are not for MMIO devices. Replace them with readl() and writel()
[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
--- drivers/clocksource/timer-vf-pit.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/clocksource/timer-vf-pit.c +11 -11
@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;static inline void pit_timer_enable (void ) { -__raw_writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); +writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); }static inline void pit_timer_disable (void ) { -__raw_writel (0 , clkevt_base +PITTCTRL ); +writel (0 , clkevt_base +PITTCTRL ); }static inline void pit_irq_acknowledge (void ) { -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG ); } static u64 notrace pit_read_sched_clock(void) { -return ~__raw_readl (clksrc_base +PITCVAL ); +return ~readl (clksrc_base +PITCVAL ); }static int __init pit_clocksource_init (unsigned long rate) {/* set the max load value and start the clock source counter */ -__raw_writel (0 , clksrc_base +PITTCTRL ); -__raw_writel (~0UL , clksrc_base +PITLDVAL ); -__raw_writel (PITTCTRL_TEN , clksrc_base +PITTCTRL ); +writel (0 , clksrc_base +PITTCTRL ); +writel (~0UL , clksrc_base +PITLDVAL ); +writel (PITTCTRL_TEN , clksrc_base +PITTCTRL );sched_clock_register (pit_read_sched_clock,32 , rate); return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,* hardware requirement. */ pit_timer_disable (); -__raw_writel (delta -1 , clkevt_base +PITLDVAL ); +writel (delta -1 , clkevt_base +PITLDVAL );pit_timer_enable ();return 0 ;
@@ -132,8 +132,8 @@ static struct irqaction pit_timer_irq = {static int __init pit_clockevent_init (unsigned long rate,int irq) { -__raw_writel (0 , clkevt_base +PITTCTRL ); -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (0 , clkevt_base +PITTCTRL ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG );BUG_ON (setup_irq (irq, &pit_timer_irq));
@@ -189,7 +189,7 @@ static int __init pit_timer_init(struct device_node *np) cycle_per_jiffy = clk_rate / (HZ );/* enable the pit module */ -__raw_writel (~PITMCR_MDIS , timer_base +PITMCR ); +writel (~PITMCR_MDIS , timer_base +PITMCR ); ret =pit_clocksource_init (clk_rate);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/187 uprobe: Do not emulate/sstep original instruction when ip is changed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
If uprobe handler changes instruction pointer we still execute single step) or emulate the original instruction and increment the (new) ip with its length.
This makes the new instruction pointer bogus and application will likely crash on illegal instruction execution.
If user decided to take execution elsewhere, it makes little sense to execute the original instruction, so let's skip it.
--- kernel/events/uprobes.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/events/uprobes.c +7 -0
@@ -2248,6 +2248,13 @@ static void handle_swbp(struct pt_regs *regs)handler_chain (uprobe, regs); +/* +* If user decided to take execution elsewhere, it makes little sense +* to execute the original instruction, so let's skip it. +*/ +if (instruction_pointer (regs) != bp_vaddr) + goto out; +if (arch_uprobe_skip_sstep (&uprobe->arch, regs)) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/187 hwmon: (dell-smm) Add support for Dell OptiPlex 7040
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
The Dell OptiPlex 7040 supports the legacy SMM interface for reading sensors and performing fan control. Whitelist this machine so that this driver loads automatically.
--- drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/hwmon/dell-smm-hwmon.c +7 -0
@@ -1016,6 +1016,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { }, .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490], }, + { + .ident = "Dell OptiPlex 7040", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"), + }, + }, { .ident ="Dell Precision" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/187 tools/cpupower: Fix incorrect size in cpuidle_state_disable()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
Fix incorrect size parameter passed to cpuidle_state_write_file() in cpuidle_state_disable().
The function was incorrectly using sizeof(disable) which returns the size of the unsigned int variable (4 bytes) instead of the actual length of the string stored in the 'value' buffer.
Since 'value' is populated with snprintf() to contain the string representation of the disable value, we should use the length returned by snprintf() to get the correct string length for writing to the sysfs file.
This ensures the correct number of bytes is written to the cpuidle state disable file in sysfs.
--- tools/power/cpupower/lib/cpuidle.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/power/cpupower/lib/cpuidle.c +3 -2
@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu, {char value[SYSFS_PATH_MAX ];int bytes_written; +int len;if (cpuidle_state_count (cpu) <= idlestate)return -1 ;
@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu, idlestate_value_files[IDLESTATE_DISABLE]))return -2 ; -snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); + len =snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); bytes_written =cpuidle_state_write_file (cpu, idlestate,"disable" , - value,sizeof (disable)); + value, len);if (bytes_written)return 0 ;return -3 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/187 tools/power x86_energy_perf_policy: Enhance HWP enable
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -1024,13 +1024,18 @@ int update_hwp_request_pkg(int pkg)int enable_hwp_on_cpu (int cpu) { -unsigned long long msr; +unsigned long long old_msr, new_msr; + +get_msr (cpu,MSR_PM_ENABLE , &old_msr); + +if (old_msr &1 ) +return 0 ;/* already enabled */ -get_msr (cpu,MSR_PM_ENABLE , &msr); -put_msr (cpu,MSR_PM_ENABLE ,1 ); + new_msr = old_msr |1 ; +put_msr (cpu,MSR_PM_ENABLE , new_msr);if (verbose) -printf ("cpu%d: MSR_PM_ENABLE old: %d new: %d\n" , cpu, (unsigned int ) msr,1 ); +printf ("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n" , cpu, old_msr, new_msr);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/187 tools/power x86_energy_perf_policy: Prefer driver HWP limits
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
When we are successful in using cpufreq min/max limits, skip setting the raw MSR limits entirely.
This is necessary to avoid undoing any modification that the cpufreq driver makes to our sysfs request.
eg. intel_pstate may take our request for a limit that is valid according to HWP.CAP.MIN/MAX and clip it to be within the range available in PLATFORM_INFO.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -62,6 +62,7 @@ unsigned char turbo_update_value;unsigned char update_hwp_epp;unsigned char update_hwp_min;unsigned char update_hwp_max; +unsigned char hwp_limits_done_via_sysfs;unsigned char update_hwp_desired;unsigned char update_hwp_window;unsigned char update_hwp_use_pkg;
@@ -809,8 +810,10 @@ int ratio_2_sysfs_khz(int ratio) }/* * If HWP is enabled and cpufreq sysfs attribtes are present, -* then update sysfs, so that it will not become -* stale when we write to MSRs. +* then update via sysfs. The intel_pstate driver may modify (clip) +* this request, say, when HWP_CAP is outside of PLATFORM_INFO limits, +* and the driver-chosen value takes precidence. +* * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq, * so we don't have to touch that.) */
@@ -865,6 +868,8 @@ int update_sysfs(int cpu)if (update_hwp_max)update_cpufreq_scaling_freq (1 , cpu, req_update.hwp_max); + hwp_limits_done_via_sysfs =1 ; +return 0 ; }
@@ -943,10 +948,10 @@ int update_hwp_request(int cpu)if (debug)print_hwp_request (cpu, &req,"old: " ); -if (update_hwp_min) +if (update_hwp_min && !hwp_limits_done_via_sysfs) req.hwp_min = req_update.hwp_min; -if (update_hwp_max) +if (update_hwp_max && !hwp_limits_done_via_sysfs) req.hwp_max = req_update.hwp_max;if (update_hwp_desired)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/187 mfd: stmpe: Remove IRQ domain upon removal
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
The IRQ domain is (optionally) added during stmpe_probe, but never removed. Add the call to stmpe_remove.
--- drivers/mfd/stmpe.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mfd/stmpe.c +3 -0
@@ -1494,6 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)int stmpe_remove (struct stmpe *stmpe) { +if (stmpe->domain) +irq_domain_remove (stmpe->domain); +if (!IS_ERR (stmpe->vio) &®ulator_is_enabled (stmpe->vio))regulator_disable (stmpe->vio);if (!IS_ERR (stmpe->vcc) &®ulator_is_enabled (stmpe->vcc))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/187 mfd: stmpe-i2c: Add missing MODULE_LICENSE
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
This driver is licensed GPL-2.0-only, so add the corresponding module flag.
--- drivers/mfd/stmpe-i2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/stmpe-i2c.c +1 -0
@@ -139,3 +139,4 @@ module_exit(stmpe_exit);MODULE_LICENSE ("GPL v2" );MODULE_DESCRIPTION ("STMPE MFD I2C Interface Driver" );MODULE_AUTHOR ("Rabin Vincent <[email protected]>" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/187 mfd: madera: Work around false-positive -Wininitialized warning
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
clang-21 warns about one uninitialized variable getting dereferenced in madera_dev_init:
drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
739 | mfd_devs, n_devs,
| ^~~~~~~~
drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
459 | const struct mfd_cell *mfd_devs;
| ^
| = NULLThe code is actually correct here because n_devs is only nonzero when mfd_devs is a valid pointer, but this is impossible for the compiler to see reliably.
Change the logic to check for the pointer as well, to make this easier for the compiler to follow.
--- drivers/mfd/madera-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/madera-core.c +2 -2
@@ -431,7 +431,7 @@ int madera_dev_init(struct madera *madera)struct device *dev = madera->dev;unsigned int hwid;int (*patch_fn)(struct madera *) =NULL ; -const struct mfd_cell *mfd_devs; +const struct mfd_cell *mfd_devs =NULL ;int n_devs =0 ;int i, ret;
@@ -616,7 +616,7 @@ int madera_dev_init(struct madera *madera) goto err_reset; } -if (!n_devs) { +if (!n_devs || !mfd_devs) {dev_err (madera->dev,"Device ID 0x%x not a %s\n" , hwid, madera->type_name); ret = -ENODEV ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/187 drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <[email protected]>
[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
snprintf() returns the number of characters that *would* have been written, which can overestimate how much you actually wrote to the buffer in case of truncation. That leads to 'data += this' advancing the pointer past the end of the buffer and size going negative.
Switching to scnprintf() prevents potential buffer overflows and ensures consistent behavior when building the output string.
--- drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/core/enum.c +1 -1
@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)bool space = false;while (size >=1 && bf->name) {if (value & bf->mask) { -int this =snprintf (data, size,"%s%s" , +int this =scnprintf (data, size,"%s%s" , space ?" " :"" , bf->name); size -= this; data += this;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/187 PCI: Disable MSI on RDC PCI to PCIe bridges
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcos Del Sol Vives <[email protected]>
[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do not support MSIs. If enabled, interrupts generated by PCIe devices never reach the processor.
I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs need to be disabled for them.
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -2541,6 +2541,7 @@ static void quirk_disable_msi(struct pci_dev *dev)DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_AMD ,PCI_DEVICE_ID_AMD_8131_BRIDGE , quirk_disable_msi);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_VIA ,0xa238 , quirk_disable_msi);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x5a3f , quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_RDC ,0x1031 , quirk_disable_msi);/* * The APC bridge device in AMD 780 family northbridges has some random
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/187 selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <[email protected]>
[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
The __WORDSIZE macro, defined in the non-standard <bits/wordsize.h> header, is a GNU extension and not universally available with all toolchains, such as Clang when used with musl libc.
This can lead to build failures in environments where this header is missing.
The intention of the code is to determine the bit width of a C long. Replace the non-portable __WORDSIZE with the standard and portable sizeof(long) * 8 expression to achieve the same result.
This change also removes the inclusion of the now-unused <bits/wordsize.h> header.
--- tools/testing/selftests/net/psock_tpacket.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
tools/testing/selftests/net/psock_tpacket.c +1 -2
@@ -33,7 +33,6 @@#include <ctype.h> #include <fcntl.h> #include <unistd.h> -#include <bits/wordsize.h> #include <net/ethernet.h> #include <netinet/ip.h> #include <arpa/inet.h>
@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)static int test_user_bit_width (void ) { -return __WORDSIZE; +return sizeof (long ) *8 ; }static const char *tpacket_str[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/187 selftests/net: Ensure assert() triggers in psock_tpacket.c
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <[email protected]>
[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
The get_next_frame() function in psock_tpacket.c was missing a return statement in its default switch case, leading to a compiler warning.
This was caused by a bug_on(1) call, which is defined as an assert(), being compiled out because NDEBUG is defined during the build.
Instead of adding a return NULL; which would silently hide the error and could lead to crashes later, this change restores the original author's intent. By adding #undef NDEBUG before including <assert.h>, we ensure the assertion is active and will cause the test to abort if this unreachable code is ever executed.
--- tools/testing/selftests/net/psock_tpacket.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/psock_tpacket.c +1 -0
@@ -22,6 +22,7 @@* - TPACKET_V3: RX_RING */ +#undef NDEBUG#include <stdio.h> #include <stdlib.h> #include <sys/types.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/187 drm/amdkfd: return -ENOTTY for unsupported IOCTLs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey McRae <[email protected]>
[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
Some kfd ioctls may not be available depending on the kernel version the user is running, as such we need to report -ENOTTY so userland can determine the cause of the ioctl failure.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +6 -2
@@ -1796,8 +1796,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)unsigned int usize, asize;int retcode = -EINVAL ; -if (nr >=AMDKFD_CORE_IOCTL_COUNT ) +if (nr >=AMDKFD_CORE_IOCTL_COUNT ) { + retcode = -ENOTTY ; goto err_i1; + }if ((nr >=AMDKFD_COMMAND_START ) && (nr <AMDKFD_COMMAND_END )) {u32 amdkfd_size;
@@ -1810,8 +1812,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) asize = amdkfd_size; cmd = ioctl->cmd; - }else + }else { + retcode = -ENOTTY ; goto err_i1; + }dev_dbg (kfd_device,"ioctl cmd 0x%x (#%d), arg 0x%lx\n" , cmd, nr, arg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/187 media: pci: ivtv: Dont create fake v4l2_fh
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
The ivtv driver has a structure named ivtv_open_id that models an open file handle for the device. It embeds a v4l2_fh instance for file handles that correspond to a V4L2 video device, and stores a pointer to that v4l2_fh in struct ivtv_stream to identify which open file handle owns a particular stream.
In addition to video devices, streams can be owned by ALSA PCM devices. Those devices do not make use of the v4l2_fh instance for obvious reasons, but the snd_ivtv_pcm_capture_open() function still initializes a "fake" v4l2_fh for the sole purpose of using it as an open file handle identifier. The v4l2_fh is not properly destroyed when the ALSA PCM device is closed, leading to possible resource leaks.
Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not accessed, only the pointer value is used for comparison. Replace it with a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and don't initialize the v4l2_fh for ALSA PCM devices.
--- drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 -- drivers/media/pci/ivtv/ivtv-driver.h | 3 ++- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +++++++++--------- drivers/media/pci/ivtv/ivtv-irq.c | 4 ++-- 4 files changed, 13 insertions(+), 14 deletions(-)
drivers/media/pci/ivtv/ivtv-alsa-pcm.c +0 -2
@@ -150,14 +150,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream) s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM ]; -v4l2_fh_init (&item.fh, &s->vdev); item.itv = itv; item.type = s->type;/* See if the stream is available */ if (ivtv_claim_stream (&item, item.type)) {/* No, it's already in use */ -v4l2_fh_exit (&item.fh);snd_ivtv_unlock (itvsc);return -EBUSY ; }
drivers/media/pci/ivtv/ivtv-driver.h +2 -1
@@ -325,6 +325,7 @@ struct ivtv_queue { };struct ivtv ;/* forward reference */ +struct ivtv_open_id ;struct ivtv_stream {/* These first four fields are always set, even if the stream
@@ -334,7 +335,7 @@ struct ivtv_stream {const char *name;/* name of the stream */ int type;/* stream type */ -struct v4l2_fh *fh;/* pointer to the streaming filehandle */ +struct ivtv_open_id *id;/* pointer to the streaming ivtv_open_id */ spinlock_t qlock;/* locks access to the queues */ unsigned long s_flags;/* status flags, see above */ int dma;/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
drivers/media/pci/ivtv/ivtv-fileops.c +9 -9
@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)if (test_and_set_bit (IVTV_F_S_CLAIMED , &s->s_flags)) {/* someone already claimed this stream */ -if (s->fh == &id->fh) { +if (s->id == id) {/* yes, this file descriptor did. So that's OK. */ return 0 ; } -if (s->fh ==NULL && (type ==IVTV_DEC_STREAM_TYPE_VBI || +if (s->id ==NULL && (type ==IVTV_DEC_STREAM_TYPE_VBI || type ==IVTV_ENC_STREAM_TYPE_VBI )) {/* VBI is handled already internally, now also assign the file descriptor to this stream for external reading of the stream. */ - s->fh = &id->fh; + s->id = id;IVTV_DEBUG_INFO ("Start Read VBI\n" );return 0 ; }
@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)IVTV_DEBUG_INFO ("Stream %d is busy\n" , type);return -EBUSY ; } - s->fh = &id->fh; + s->id = id;if (type ==IVTV_DEC_STREAM_TYPE_VBI ) {/* Enable reinsertion interrupt */ ivtv_clear_irq_mask (itv,IVTV_IRQ_DEC_VBI_RE_INSERT );
@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)struct ivtv *itv = s->itv;struct ivtv_stream *s_vbi; - s->fh =NULL ; + s->id =NULL ;if ((s->type ==IVTV_DEC_STREAM_TYPE_VBI || s->type ==IVTV_ENC_STREAM_TYPE_VBI ) &&test_bit (IVTV_F_S_INTERNAL_USE , &s->s_flags)) {/* this stream is still in use internally */
@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)/* was already cleared */ return ; } -if (s_vbi->fh) { +if (s_vbi->id) {/* VBI stream still claimed by a file descriptor */ return ; }
@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_cosize_t tot_written =0 ;int single_frame =0 ; -if (atomic_read (&itv->capturing) ==0 && s->fh ==NULL ) { +if (atomic_read (&itv->capturing) ==0 && s->id ==NULL ) {/* shouldn't happen */ IVTV_DEBUG_WARN ("Stream %s not initialized before read\n" , s->name);return -EIO ;
@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end) id->type == IVTV_ENC_STREAM_TYPE_VBI) && test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) { /* Also used internally, don't stop capturing */ - s->fh = NULL; + s->id = NULL; } else {ivtv_stop_v4l2_encode_stream (s, gop_end);
@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)v4l2_fh_exit (fh);/* Easy case first: this stream was never claimed by us */ -if (s->fh != &id->fh) +if (s->id != id) goto close_done;/* 'Unclaim' this stream */
drivers/media/pci/ivtv/ivtv-irq.c +2 -2
@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)ivtv_process_vbi_data (itv, buf,0 , s->type); s->q_dma.bytesused += buf->bytesused; } -if (s->fh ==NULL ) { +if (s->id ==NULL ) {ivtv_queue_move (s, &s->q_dma,NULL , &s->q_free,0 );return ; }
@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)set_bit (IVTV_F_I_HAVE_WORK , &itv->i_flags); } -if (s->fh) +if (s->id)wake_up (&s->waitq); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/187 x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall page fault, but the CPU does not report X86_PF_INSTR if neither X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for early P4 processors that did not support this feature.
Instead of explicitly checking for X86_PF_INSTR, compare the fault address to RIP.
On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal to fault address but X86_PF_INSTR is absent.
[ dhansen: flesh out code comments ]
--- arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
arch/x86/entry/vsyscall/vsyscall_64.c +14 -3
@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,if ((error_code & (X86_PF_WRITE |X86_PF_USER )) !=X86_PF_USER )return false; -if (!(error_code &X86_PF_INSTR )) { +/* +* Assume that faults at regs->ip are because of an +* instruction fetch. Return early and avoid +* emulation for faults during data accesses: +*/ +if (address != regs->ip) {/* Failed vsyscall read */ if (vsyscall_mode ==EMULATE )return false;
@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,return false; } +/* +* X86_PF_INSTR is only set when NX is supported. When +* available, use it to double-check that the emulation code +* is only being used for instruction fetches: +*/ +if (cpu_feature_enabled (X86_FEATURE_NX )) +WARN_ON_ONCE (!(error_code &X86_PF_INSTR )); +/* * No point in checking CS -- the only way to get here is a user mode * trap to a high address, which means that we're in 64-bit user code. */ -WARN_ON_ONCE (address != regs->ip); -if (vsyscall_mode ==NONE ) {warn_bad_vsyscall (KERN_INFO , regs,"vsyscall attempted with vsyscall=none" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/187 powerpc/eeh: Use result of error_detected() in uevent
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
Ever since uevent support was added for AER and EEH with commit 856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") subsequently amended AER to report the actual return value of error_detected().
Make the same change to EEH to align it with AER and s390.
--- arch/powerpc/kernel/eeh_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/eeh_driver.c +1 -1
@@ -351,7 +351,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev, rc = driver->err_handler->error_detected (pdev, pci_channel_io_frozen); edev->in_error = true; -pci_uevent_ers (pdev,PCI_ERS_RESULT_NONE ); +pci_uevent_ers (pdev, rc);return rc; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/187 bridge: Redirect to backup port when port is administratively down
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
If a backup port is configured for a bridge port, the bridge will redirect known unicast traffic towards the backup port when the primary port is administratively up but without a carrier. This is useful, for example, in MLAG configurations where a system is connected to two switches and there is a peer link between both switches. The peer link serves as the backup port in case one of the switches loses its connection to the multi-homed system.
In order to avoid flooding when the primary port loses its carrier, the bridge does not flush dynamic FDB entries pointing to the port upon STP disablement, if the port has a backup port.
The above means that known unicast traffic destined to the primary port will be blackholed when the port is put administratively down, until the FDB entries pointing to it are aged-out.
Given that the current behavior is quite weird and unlikely to be depended on by anyone, amend the bridge to redirect to the backup port also when the primary port is administratively down and not only when it does not have a carrier.
The change is motivated by a report from a user who expected traffic to be redirected to the backup port when the primary port was put administratively down while debugging a network issue.
--- net/bridge/br_forward.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bridge/br_forward.c +2 -1
@@ -142,7 +142,8 @@ void br_forward(const struct net_bridge_port *to, goto out;/* redirect to backup link if the destination port is down */ -if (rcu_access_pointer (to->backup_port) && !netif_carrier_ok (to->dev)) { +if (rcu_access_pointer (to->backup_port) && + (!netif_carrier_ok (to->dev) || !netif_running (to->dev))) {struct net_bridge_port *backup_port; backup_port =rcu_dereference (to->backup_port);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/187 net: ipv6: fix field-spanning memcpy warning in AH output
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <[email protected]>
[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
Fix field-spanning memcpy warnings in ah6_output() and ah6_output_done() where extension headers are copied to/from IPv6 address fields, triggering fortify-string warnings about writes beyond the 16-byte address fields.
memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
The warnings are false positives as the extension headers are intentionally placed after the IPv6 header in memory. Fix by properly copying addresses and extension headers separately, and introduce helper functions to avoid code duplication.
--- net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 19 deletions(-)
net/ipv6/ah6.c +31 -19
@@ -46,6 +46,34 @@ struct ah_skb_cb {#define AH_SKB_CB (__skb) ((struct ah_skb_cb *)&((__skb)->cb[0])) +/* Helper to save IPv6 addresses and extension headers to temporary storage */ +static inline void ah6_save_hdrs (struct tmp_ext *iph_ext, +struct ipv6hdr *top_iph,int extlen) +{ +if (!extlen) +return ; + +#if IS_ENABLED (CONFIG_IPV6_MIP6 ) + iph_ext->saddr = top_iph->saddr; +#endif + iph_ext->daddr = top_iph->daddr; +memcpy (&iph_ext->hdrs, top_iph +1 , extlen -sizeof (*iph_ext)); +} + +/* Helper to restore IPv6 addresses and extension headers from temporary storage */ +static inline void ah6_restore_hdrs (struct ipv6hdr *top_iph, +struct tmp_ext *iph_ext,int extlen) +{ +if (!extlen) +return ; + +#if IS_ENABLED (CONFIG_IPV6_MIP6 ) + top_iph->saddr = iph_ext->saddr; +#endif + top_iph->daddr = iph_ext->daddr; +memcpy (top_iph +1 , &iph_ext->hdrs, extlen -sizeof (*iph_ext)); +} +static void *ah_alloc_tmp (struct crypto_ahash *ahash,int nfrags,unsigned int size) {
@@ -307,13 +335,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)memcpy (ah->auth_data, icv, ahp->icv_trunc_len);memcpy (top_iph, iph_base,IPV6HDR_BASELEN ); -if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (&top_iph->saddr, iph_ext, extlen); -#else -memcpy (&top_iph->daddr, iph_ext, extlen); -#endif - } +ah6_restore_hdrs (top_iph, iph_ext, extlen);kfree (AH_SKB_CB (skb)->tmp);xfrm_output_resume (skb, err);
@@ -384,12 +406,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)*/ memcpy (iph_base, top_iph,IPV6HDR_BASELEN ); +ah6_save_hdrs (iph_ext, top_iph, extlen);if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (iph_ext, &top_iph->saddr, extlen); -#else -memcpy (iph_ext, &top_iph->daddr, extlen); -#endif err = ipv6_clear_mutable_options(top_iph, extlen - sizeof(*iph_ext) + sizeof(*top_iph),
@@ -440,13 +458,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)memcpy (ah->auth_data, icv, ahp->icv_trunc_len);memcpy (top_iph, iph_base,IPV6HDR_BASELEN ); -if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (&top_iph->saddr, iph_ext, extlen); -#else -memcpy (&top_iph->daddr, iph_ext, extlen); -#endif - } +ah6_restore_hdrs (top_iph, iph_ext, extlen); out_free:kfree (iph_base);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/187 media: imon: make send_packet() more robust
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1].
First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls).
Alan Stern commented [2] that
In theory it's okay to resubmit _if_ the driver has a robust error-recovery scheme (such as giving up after some fixed limit on the number of errors or after some fixed time has elapsed, perhaps with a time delay to prevent a flood of errors). Most drivers don't bother to do this; they simply give up right away. This makes them more vulnerable to short-term noise interference during USB transfers, but in reality such interference is quite rare. There's nothing really wrong with giving up right away.
but imon has a poor error-recovery scheme which just retries forever; this behavior should be fixed.
Since I'm not sure whether it is safe for imon users to give up upon any error code, this patch takes care of only union of error codes chosen from modules in drivers/media/rc/ directory which handle -EPROTO error (i.e. ir_toy, mceusb and igorplugusb).
Second problem is that when usb_rx_callback_intf0() once got -EPROTO error before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge hardware after early callbacks"). Move the ictx->dev_present_intf0 test introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes until intf configured") to immediately before imon_incoming_packet(), or the first problem explained above happens without printk() flooding (i.e. hung task).
Third problem is that when usb_rx_callback_intf0() is not called for some reason (e.g. flaky hardware; the reproducer for this problem sometimes prevents usb_rx_callback_intf0() from being called), wait_for_completion_interruptible() in send_packet() never returns (i.e. hung task). As a workaround for such situation, change send_packet() to wait for completion with timeout of 10 seconds.
--- drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 24 deletions(-)
drivers/media/rc/imon.c +37 -24
@@ -652,12 +652,15 @@ static int send_packet(struct imon_context *ictx)smp_rmb ();/* ensure later readers know we're not busy */ pr_err_ratelimited ("error submitting urb(%d)\n" , retval); }else { -/* Wait for transmission to complete (or abort) */ - retval =wait_for_completion_interruptible ( - &ictx->tx.finished); -if (retval) { +/* Wait for transmission to complete (or abort or timeout) */ + retval =wait_for_completion_interruptible_timeout (&ictx->tx.finished,10 *HZ ); +if (retval <=0 ) {usb_kill_urb (ictx->tx_urb);pr_err_ratelimited ("task interrupted\n" ); +if (retval <0 ) + ictx->tx.status = retval; +else + ictx->tx.status = -ETIMEDOUT ; } ictx->tx.busy = false;
@@ -1759,14 +1762,6 @@ static void usb_rx_callback_intf0(struct urb *urb)if (!ictx)return ; -/* -* if we get a callback before we're done configuring the hardware, we -* can't yet process the data, as there's nowhere to send it, but we -* still need to submit a new rx URB to avoid wedging the hardware -*/ -if (!ictx->dev_present_intf0) - goto out; -switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1775,16 +1770,29 @@ static void usb_rx_callback_intf0(struct urb *urb)break ;case 0 : -imon_incoming_packet (ictx, urb, intfnum); +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (ictx->dev_present_intf0) +imon_incoming_packet (ictx, urb, intfnum);break ; +case -ECONNRESET : +case -EILSEQ : +case -EPROTO : +case -EPIPE : +dev_warn (ictx->dev,"imon %s: status(%d)\n" , + __func__, urb->status); +return ; +default :dev_warn (ictx->dev,"imon %s: status(%d): ignored\n" , __func__, urb->status);break ; } -out:usb_submit_urb (ictx->rx_urb_intf0,GFP_ATOMIC ); }
@@ -1800,14 +1808,6 @@ static void usb_rx_callback_intf1(struct urb *urb)if (!ictx)return ; -/* -* if we get a callback before we're done configuring the hardware, we -* can't yet process the data, as there's nowhere to send it, but we -* still need to submit a new rx URB to avoid wedging the hardware -*/ -if (!ictx->dev_present_intf1) - goto out; -switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1816,16 +1816,29 @@ static void usb_rx_callback_intf1(struct urb *urb)break ;case 0 : -imon_incoming_packet (ictx, urb, intfnum); +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (ictx->dev_present_intf1) +imon_incoming_packet (ictx, urb, intfnum);break ; +case -ECONNRESET : +case -EILSEQ : +case -EPROTO : +case -EPIPE : +dev_warn (ictx->dev,"imon %s: status(%d)\n" , + __func__, urb->status); +return ; +default :dev_warn (ictx->dev,"imon %s: status(%d): ignored\n" , __func__, urb->status);break ; } -out:usb_submit_urb (ictx->rx_urb_intf1,GFP_ATOMIC ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/187 iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Gobbi <[email protected]>
[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
avg sample info is a bit field coded inside the following
bits: 5,6,7 and 8 of a device status register.
Channel num info the same, but over bits: 1, 2 and 3.
Mask both values in order to avoid touching other register bits, since the first info (avg sample), came from DT.
--- drivers/iio/adc/spear_adc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/iio/adc/spear_adc.c +5 -4
@@ -12,6 +12,7 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/io.h> +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/err.h> #include <linux/completion.h>
@@ -29,9 +30,9 @@/* Bit definitions for SPEAR_ADC_STATUS */ #define SPEAR_ADC_STATUS_START_CONVERSION BIT(0) -#define SPEAR_ADC_STATUS_CHANNEL_NUM (x) ((x) << 1) +#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK GENMASK(3, 1)#define SPEAR_ADC_STATUS_ADC_ENABLE BIT(4) -#define SPEAR_ADC_STATUS_AVG_SAMPLE (x) ((x) << 5) +#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK GENMASK(8, 5)#define SPEAR_ADC_STATUS_VREF_INTERNAL BIT(9)#define SPEAR_ADC_DATA_MASK 0x03ff
@@ -148,8 +149,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,case IIO_CHAN_INFO_RAW :mutex_lock (&indio_dev->mlock); - status =SPEAR_ADC_STATUS_CHANNEL_NUM (chan->channel) | -SPEAR_ADC_STATUS_AVG_SAMPLE (st->avg_samples) | + status =FIELD_PREP (SPEAR_ADC_STATUS_CHANNEL_NUM_MASK , chan->channel) | +FIELD_PREP (SPEAR_ADC_STATUS_AVG_SAMPLE_MASK , st->avg_samples) |SPEAR_ADC_STATUS_START_CONVERSION |SPEAR_ADC_STATUS_ADC_ENABLE ;if (st->vref_external ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/187 usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: raub camaioni <[email protected]>
[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
This fix is already present in f_ecm.c and was never propagated to f_ncm.c
When creating multiple NCM ethernet devices
on a composite usb gadget device
each MAC address on the HOST side will be identical. Having the same MAC on different network interfaces is bad.
This fix updates the MAC address inside the ncm_strings_defs global during the ncm_bind call. This ensures each device has a unique MAC.
In f_ecm.c ecm_string_defs is updated in the same way.
The defunct MAC assignment in ncm_alloc has been removed.
--- drivers/usb/gadget/function/f_ncm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +2 -1
@@ -1472,6 +1472,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) ncm_opts->bound = true; + ncm_string_defs[1 ].s = ncm->ethaddr; + us =usb_gstrings_attach (cdev, ncm_strings,ARRAY_SIZE (ncm_string_defs));if (IS_ERR (us)) {
@@ -1735,7 +1737,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)mutex_unlock (&opts->lock);return ERR_PTR (-EINVAL ); } - ncm_string_defs[STRING_MAC_IDX ].s = ncm->ethaddr;spin_lock_init (&ncm->lock);ncm_reset_values (ncm);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/187 char: misc: Does not request module for miscdevice with dynamic minor
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
misc_open() may request module for miscdevice with dynamic minor, which is meaningless since:
- The dynamic minor allocated is unknown in advance without registering miscdevice firstly.
- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
Fix by only requesting module for miscdevice with fixed minor.
--- drivers/char/misc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/char/misc.c +5 -3
@@ -113,7 +113,8 @@ static int misc_open(struct inode *inode, struct file *file) } } -if (!new_fops) { +/* Only request module for fixed minor code */ +if (!new_fops && minor <MISC_DYNAMIC_MINOR ) {mutex_unlock (&misc_mtx);request_module ("char-major-%d-%d" ,MISC_MAJOR , minor);mutex_lock (&misc_mtx);
@@ -124,10 +125,11 @@ static int misc_open(struct inode *inode, struct file *file)break ; } } -if (!new_fops) - goto fail; } +if (!new_fops) + goto fail; +/* * Place the miscdevice in the file's * private_data so it can be used by the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/187 net: When removing nexthops, dont call synchronize_net if it is not necessary
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <[email protected]>
[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
When removing a nexthop, commit90f33bffa382 ("nexthops: don't modify published nexthop groups") added a call to synchronize_rcu() (later changed to _net()) to make sure everyone sees the new nexthop-group before the rtnl-lock is released.
When one wants to delete a large number of groups and nexthops, it is fastest to first flush the groups (ip nexthop flush groups) and then flush the nexthops themselves (ip -6 nexthop flush). As that way the groups don't need to be rebalanced.
However, ip -6 nexthop flush will still take a long time if there is a very large number of nexthops because of the call to synchronize_net(). Now, if there are no more groups, there is no point in calling synchronize_net(). So, let's skip that entirely by checking if nh->grp_list is empty.
This gives us a nice speedup:
BEFORE:
=======
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops
real 1m45.345s
user 0m0.001s
sys 0m0.005s
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops
real 3m10.430s
user 0m0.002s
sys 0m0.004s
AFTER:
======
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops
real 0m17.545s
user 0m0.003s
sys 0m0.003s
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops
real 0m35.823s
user 0m0.002s
sys 0m0.004s
--- net/ipv4/nexthop.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/ipv4/nexthop.c +6 -0
@@ -760,6 +760,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh, {struct nh_grp_entry *nhge, *tmp; +/* If there is nothing to do, let's avoid the costly call to +* synchronize_net() +*/ +if (list_empty (&nh->grp_list)) +return ; +list_for_each_entry_safe (nhge, tmp, &nh->grp_list, nh_list)remove_nh_grp_entry (net, nhge, nlinfo);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/187 net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
Initially, trace_sock_exceed_buf_limit() was invoked when __sk_mem_raise_allocated() failed due to the memcg limit or the global limit.
However, commit d6f19938eb031 ("net: expose sk wmem in sock_exceed_buf_limit tracepoint") somehow suppressed the event only when memcg failed to charge for SK_MEM_RECV, although the memcg failure for SK_MEM_SEND still triggers the event.
Let's restore the event for SK_MEM_RECV.
--- net/core/sock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/core/sock.c +1 -2
@@ -2590,8 +2590,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)return 1 ; } -if (kind ==SK_MEM_SEND || (kind ==SK_MEM_RECV && charged)) -trace_sock_exceed_buf_limit (sk, prot, allocated, kind); +trace_sock_exceed_buf_limit (sk, prot, allocated, kind);sk_memory_allocated_sub (sk, amt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/187 PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungho Kim <[email protected]>
[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
The error handling path in pci_p2pdma_add_resource() contains a bug in its pgmap_free label.
Memory is allocated for the p2p_pgmap struct, and the pointer is stored in p2p_pgmap. However, the error path calls devm_kfree() with pgmap, which is a pointer to a member field within the p2p_pgmap struct, not the base pointer of the allocation.
Correct the bug by passing the correct base pointer, p2p_pgmap, to devm_kfree().
--- drivers/pci/p2pdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/p2pdma.c +1 -1
@@ -215,7 +215,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size, pages_free:devm_memunmap_pages (&pdev->dev, pgmap); pgmap_free: -devm_kfree (&pdev->dev, pgmap); +devm_kfree (&pdev->dev, p2p_pgmap);return error; }EXPORT_SYMBOL_GPL (pci_p2pdma_add_resource);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/187 rds: Fix endianness annotation for RDS_MPATH_HASH
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ujwal Kundur <[email protected]>
[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
jhash_1word accepts host endian inputs while rs_bound_port is a be16 value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
Flagged by Sparse.
--- net/rds/rds.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/rds.h +1 -1
@@ -94,7 +94,7 @@ enum {/* Max number of multipaths per RDS connection. Must be a power of 2 */ #define RDS_MPATH_WORKERS 8 -#define RDS_MPATH_HASH (rs, n) (jhash_1word((rs)->rs_bound_port, \ +#define RDS_MPATH_HASH (rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \ (rs)->rs_hash_initval) & ((n) - 1))#define IS_CANONICAL (laddr, faddr) (htonl(laddr) < htonl(faddr))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/187 extcon: adc-jack: Fix wakeup source leaks on device unbind
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
Device can be unbound, so driver must also release memory for the wakeup source. Do not use devm interface, because it would change the order of cleanup.
--- drivers/extcon/extcon-adc-jack.c | 1 + 1 file changed, 1 insertion(+)
drivers/extcon/extcon-adc-jack.c +1 -0
@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev) {struct adc_jack_data *data =platform_get_drvdata (pdev); +device_init_wakeup (&pdev->dev, false);free_irq (data->irq, data);cancel_work_sync (&data->handler.work);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/187 drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amber Lin <[email protected]>
[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
When KFD asks CP to preempt queues, other than preempt CP queues, CP also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout. Currently queue_preemption_timeout_ms is 9000 ms by default but can be configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as 4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to queue_preemption_timeout_ms so in a slow system such as emulator, both CP and SDMA slowness are taken into account.
--- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +8 -1
@@ -105,7 +105,14 @@#define KFD_KERNEL_QUEUE_SIZE 2048 -#define KFD_UNMAP_LATENCY_MS (4000) +/* KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC +* can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time +* driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is +* queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload +* The format here makes CP workload 10% of total timeout +*/ +#define KFD_UNMAP_LATENCY_MS \ + ((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)/* * 512 = 0x200
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/187 media: fix uninitialized symbol warnings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chelsy Ratnawat <[email protected]>
[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
Initialize variables to fix these smatch warnings drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'protocol'.drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'scancode'.drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'toggle'.drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized symbol 'adc_envelope'.drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized symbol 'lock_status'.drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized symbol 'frame_lines'.drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized symbol 'quality'.drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized symbol 'adc_envelope'.drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized symbol 'lock_status'.drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized symbol 'frame_lines'.drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized symbol 'quality'.drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized symbol 'snr'.drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized symbol 'totalgain'.
--- drivers/media/i2c/ir-kbd-i2c.c | 6 +++--- drivers/media/tuners/xc4000.c | 8 ++++---- drivers/media/tuners/xc5000.c | 12 ++++++------ 3 files changed, 13 insertions(+), 13 deletions(-)
drivers/media/i2c/ir-kbd-i2c.c +3 -3
@@ -284,9 +284,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,static int ir_key_poll (struct IR_i2c *ir) { -enum rc_proto protocol; -u32 scancode; -u8 toggle; +enum rc_proto protocol =0 ; +u32 scancode =0 ; +u8 toggle =0 ;int rc;dev_dbg (&ir->rc->dev,"%s\n" , __func__);
drivers/media/tuners/xc4000.c +4 -4
@@ -1089,12 +1089,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,static void xc_debug_dump (struct xc4000_priv *priv) { -u16 adc_envelope; +u16 adc_envelope =0 ;u32 freq_error_hz =0 ; -u16 lock_status; +u16 lock_status =0 ;u32 hsync_freq_hz =0 ; -u16 frame_lines; -u16 quality; +u16 frame_lines =0 ; +u16 quality =0 ;u16 signal =0 ;u16 noise =0 ;u8 hw_majorversion =0 , hw_minorversion =0 ;
drivers/media/tuners/xc5000.c +6 -6
@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,static void xc_debug_dump (struct xc5000_priv *priv) { -u16 adc_envelope; +u16 adc_envelope =0 ;u32 freq_error_hz =0 ; -u16 lock_status; +u16 lock_status =0 ;u32 hsync_freq_hz =0 ; -u16 frame_lines; -u16 quality; -u16 snr; -u16 totalgain; +u16 frame_lines =0 ; +u16 quality =0 ; +u16 snr =0 ; +u16 totalgain =0 ;u8 hw_majorversion =0 , hw_minorversion =0 ;u8 fw_majorversion =0 , fw_minorversion =0 ;u16 fw_buildversion =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/187 mips: lantiq: danube: add missing properties to cpu node
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
This fixes the following warnings:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
--- arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/boot/dts/lantiq/danube.dtsi +4 -0
@@ -5,8 +5,12 @@ compatible = "lantiq,xway", "lantiq,danube"; cpus { + #address-cells = <1>; + #size-cells = <0>; + cpu@0 { compatible = "mips,mips24Kc"; + reg = <0>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/187 mips: lantiq: danube: add missing device_type in pci node
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
--- arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/boot/dts/lantiq/danube.dtsi +2 -0
@@ -105,6 +105,8 @@ 0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */ reg = <0x7000000 0x8000 /* config space */ 0xe105400 0x400>; /* pci bridge */ + + device_type = "pci"; }; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/187 mips: lantiq: xway: sysctrl: rename stp clock
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch changes the clock name from “stp” to “gpio”.
--- arch/mips/lantiq/xway/sysctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/lantiq/xway/sysctrl.c +1 -1
@@ -459,7 +459,7 @@ void __init ltq_soc_init(void)/* add our generic xway clocks */ clkdev_add_pmu ("10000000.fpi" ,NULL ,0 ,0 ,PMU_FPI );clkdev_add_pmu ("1e100a00.gptu" ,NULL ,1 ,0 ,PMU_GPT ); -clkdev_add_pmu ("1e100bb0.stp" ,NULL ,1 ,0 ,PMU_STP ); +clkdev_add_pmu ("1e100bb0.gpio" ,NULL ,1 ,0 ,PMU_STP );clkdev_add_pmu ("1e100c00.serial" ,NULL ,0 ,0 ,PMU_ASC1 );clkdev_add_pmu ("1e104100.dma" ,NULL ,1 ,0 ,PMU_DMA );clkdev_add_pmu ("1e100800.spi" ,NULL ,1 ,0 ,PMU_SPI );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/187 scsi: pm8001: Use int instead of u32 to store error codes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
Use int instead of u32 for 'ret' variable to store negative error codes returned by PM8001_CHIP_DISP->set_nvmd_req().
--- drivers/scsi/pm8001/pm8001_ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_ctl.c +1 -1
@@ -596,7 +596,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)struct pm8001_ioctl_payload *payload;DECLARE_COMPLETION_ONSTACK (completion);u8 *ioctlbuffer; -u32 ret; +int ret;u32 length =1024 *5 +sizeof (*payload) -1 ;if (pm8001_ha->fw_image->size >4096 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/187 dmaengine: sh: setup_xref error handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Andreatta <[email protected]>
[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
This patch modifies the type of setup_xref from void to int and handles errors since the function can fail.
setup_xref now returns the (eventual) error from dmae_set_dmars|dmae_set_chcr, while shdma_tx_submit handles the result, removing the chunks from the queue and marking PM as idle in case of an error.
--- drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------ drivers/dma/sh/shdmac.c | 17 +++++++++++++---- include/linux/shdma-base.h | 2 +- 3 files changed, 33 insertions(+), 11 deletions(-)
drivers/dma/sh/shdma-base.c +19 -6
@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)const struct shdma_ops *ops = sdev->ops;dev_dbg (schan->dev,"Bring up channel %d\n" , schan->id); -/* -* TODO: .xfer_setup() might fail on some platforms. -* Make it int then, on error remove chunks from the -* queue again -*/ - ops->setup_xfer (schan, schan->slave_id); + + ret = ops->setup_xfer (schan, schan->slave_id); +if (ret <0 ) { +dev_err (schan->dev,"setup_xfer failed: %d\n" , ret); + +/* Remove chunks from the queue and mark them as idle */ +list_for_each_entry_safe (chunk, c, &schan->ld_queue, node) { +if (chunk->cookie == cookie) { + chunk->mark =DESC_IDLE ; +list_move (&chunk->node, &schan->ld_free); + } + } + + schan->pm_state =SHDMA_PM_ESTABLISHED ; + ret =pm_runtime_put (schan->dev); + +spin_unlock_irq (&schan->chan_lock); +return ret; + }if (schan->pm_state ==SHDMA_PM_PENDING )shdma_chan_xfer_ld_queue (schan);
drivers/dma/sh/shdmac.c +13 -4
@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)return dmae_is_busy (sh_chan); } -static void sh_dmae_setup_xfer (struct shdma_chan *schan, -int slave_id) +static int sh_dmae_setup_xfer (struct shdma_chan *schan,int slave_id) { struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan, shdma_chan); +int ret =0 ;if (slave_id >=0 ) {const struct sh_dmae_slave_config *cfg = sh_chan->config; -dmae_set_dmars (sh_chan, cfg->mid_rid); -dmae_set_chcr (sh_chan, cfg->chcr); + ret =dmae_set_dmars (sh_chan, cfg->mid_rid); +if (ret <0 ) + goto END; + + ret =dmae_set_chcr (sh_chan, cfg->chcr); +if (ret <0 ) + goto END; + }else {dmae_init (sh_chan); } + +END: +return ret; }/*
include/linux/shdma-base.h +1 -1
@@ -96,7 +96,7 @@ struct shdma_ops {int (*desc_setup)(struct shdma_chan *,struct shdma_desc *,dma_addr_t ,dma_addr_t ,size_t *);int (*set_slave)(struct shdma_chan *,int ,dma_addr_t ,bool ); -void (*setup_xfer)(struct shdma_chan *,int ); +int (*setup_xfer)(struct shdma_chan *,int );void (*start_xfer)(struct shdma_chan *,struct shdma_desc *);struct shdma_desc *(*embedded_desc)(void *,int );bool (*chan_irq)(struct shdma_chan *,int );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/187 dmaengine: mv_xor: match alloc_wc and free_wc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
dma_alloc_wc is used but not dma_free_wc.
--- drivers/dma/mv_xor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/mv_xor.c +2 -2
@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)dma_async_device_unregister (&mv_chan->dmadev); -dma_free_coherent (dev,MV_XOR_POOL_SIZE , +dma_free_wc (dev,MV_XOR_POOL_SIZE , mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);dma_unmap_single (dev, mv_chan->dummy_src_addr,MV_XOR_MIN_BYTE_COUNT ,DMA_FROM_DEVICE );
@@ -1164,7 +1164,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev, err_free_irq:free_irq (mv_chan->irq, mv_chan); err_free_dma: -dma_free_coherent (&pdev->dev,MV_XOR_POOL_SIZE , +dma_free_wc (&pdev->dev,MV_XOR_POOL_SIZE , mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool); err_unmap_dst: dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/187 dmaengine: dw-edma: Set status for callback_result
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra K Verma <[email protected]>
[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
DMA Engine has support for the callback_result which provides the status of the request and the residue. This helps in determining the correct status of the request and in efficient resource management of the request.
The 'callback_result' method is preferred over the deprecated 'callback' method.
--- drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/dma/dw-edma/dw-edma-core.c +22 -0
@@ -474,6 +474,25 @@ dw_edma_device_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t paddr,return dw_edma_device_transfer (&xfer); } +static void dw_hdma_set_callback_result (struct virt_dma_desc *vd, +enum dmaengine_tx_result result) +{ +u32 residue =0 ; +struct dw_edma_desc *desc; +struct dmaengine_result *res; + +if (!vd->tx.callback_result) +return ; + + desc =vd2dw_edma_desc (vd); +if (desc) + residue = desc->alloc_sz - desc->xfer_sz; + + res = &vd->tx_result; + res->result = result; + res->residue = residue; +} +static void dw_edma_done_interrupt (struct dw_edma_chan *chan) {struct dw_edma_desc *desc;
@@ -489,6 +508,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)case EDMA_REQ_NONE : desc =vd2dw_edma_desc (vd);if (!desc->chunks_alloc) { +dw_hdma_set_callback_result (vd, +DMA_TRANS_NOERROR );list_del (&vd->node);vchan_cookie_complete (vd); }
@@ -527,6 +548,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)spin_lock_irqsave (&chan->vc.lock, flags); vd =vchan_next_desc (&chan->vc);if (vd) { +dw_hdma_set_callback_result (vd,DMA_TRANS_ABORTED );list_del (&vd->node);vchan_cookie_complete (vd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/187 net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juraj Šarinay <[email protected]>
[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
An exchange with a NFC target must complete within NCI_DATA_TIMEOUT. A delay of 700 ms is not sufficient for cryptographic operations on smart cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH or 3072-bit RSA. To prevent brute-force attacks, passports and similar documents introduce even longer delays into access control protocols (BAC/PACE).
The timeout should be higher, but not too much. The expiration allows us to detect that a NFC target has disappeared.
--- include/net/nfc/nci_core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/nfc/nci_core.h +1 -1
@@ -52,7 +52,7 @@ enum nci_state {#define NCI_RF_DISC_SELECT_TIMEOUT 5000#define NCI_RF_DEACTIVATE_TIMEOUT 30000#define NCI_CMD_TIMEOUT 5000 -#define NCI_DATA_TIMEOUT 700 +#define NCI_DATA_TIMEOUT 3000struct nci_dev ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/187 ALSA: usb-audio: apply quirk for MOONDROP Quark2
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cryolitia PukNgae <[email protected]>
[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
It reports a MIN value -15360 for volume control, but will mute when setting it less than -14208
--- sound/usb/mixer.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/usb/mixer.c +7 -0
@@ -1181,6 +1181,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, cval->res =1 ; }break ; +case USB_ID (0x3302 ,0x12db ):/* MOONDROP Quark2 */ +if (!strcmp (kctl->id.name,"PCM Playback Volume" )) { +usb_audio_info (chip, +"set volume quirk for MOONDROP Quark2\n" ); + cval->min =-14208 ;/* Mute under it */ + } +break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/187 net: call cond_resched() less often in __release_sock()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
While stress testing TCP I had unexpected retransmits and sack packets when a single cpu receives data from multiple high-throughput flows.
super_netperf 4 -H srv -T,10 -l 3000 &
Tcpdump extract:
00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
After analysis, it appears this is because of the cond_resched() call from __release_sock().
When current thread is yielding, while still holding the TCP socket lock, it might regain the cpu after a very long time.
Other peer TLP/RTO is firing (multiple times) and packets are retransmit, while the initial copy is waiting in the socket backlog or receive queue.
In this patch, I call cond_resched() only once every 16 packets.
Modern TCP stack now spends less time per packet in the backlog, especially because ACK are no longer sent (commit 133c4c0d3717 "tcp: defer regular ACK while processing socket backlog")
Before:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19046186 0.0 TcpRetransSegs 1471 0.0 TcpExtTCPTimeouts 1397 0.0 TcpExtTCPLossProbes 1356 0.0 TcpExtTCPDSACKRecv 1352 0.0 TcpExtTCPSpuriousRTOs 114 0.0 TcpExtTCPDSACKRecvSegs 1352 0.0
After:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19218936 0.0
--- net/core/sock.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/core/sock.c +8 -4
@@ -2456,23 +2456,27 @@ void __release_sock(struct sock *sk) __acquires(&sk->sk_lock.slock) {struct sk_buff *skb, *next; +int nb =0 ;while ((skb = sk->sk_backlog.head) !=NULL ) { sk->sk_backlog.head = sk->sk_backlog.tail =NULL ;spin_unlock_bh (&sk->sk_lock.slock); -do { +while (1 ) { next = skb->next;prefetch (next);WARN_ON_ONCE (skb_dst_is_noref (skb));skb_mark_not_on_list (skb);sk_backlog_rcv (sk, skb); -cond_resched (); - skb = next; - }while (skb !=NULL ); +if (!skb) +break ; + +if (!(++nb &15 )) +cond_resched (); + }spin_lock_bh (&sk->sk_lock.slock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/187 usb: gadget: f_hid: Fix zero length packet transfer
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <[email protected]>
[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
Set the hid req->zero flag of ep0/in_ep to true by default, then the UDC drivers can transfer a zero length packet at the end if the hid transfer with size divisible to EPs max packet size according to the USB 2.0 spec.
--- drivers/usb/gadget/function/f_hid.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_hid.c +2 -2
@@ -496,7 +496,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, } req->status =0 ; - req->zero =0 ; + req->zero =1 ; req->length = count; req->complete = f_hidg_req_complete; req->context = hidg;
@@ -767,7 +767,7 @@ static int hidg_setup(struct usb_function *f,return -EOPNOTSUPP ; respond: - req->zero =0 ; + req->zero =1 ; req->length = length; status =usb_ep_queue (cdev->gadget->ep0, req,GFP_ATOMIC );if (status <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/187 phy: cadence: cdns-dphy: Enable lower resolutions in dphy
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harikrishna Shenoy <[email protected]>
[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
Enable support for data lane rates between 80-160 Mbps cdns dphy as mentioned in TRM [0] by setting the pll_opdiv field to 16. This change enables lower resolutions like 640x480 at 60Hz.
[0]: https://www.ti.com/lit/zip/spruil1
(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
--- drivers/phy/cadence/cdns-dphy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/phy/cadence/cdns-dphy.c +3 -1
@@ -115,7 +115,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, dlane_bps = opts->hs_clk_rate; -if (dlane_bps >2500000000UL || dlane_bps <160000000UL ) +if (dlane_bps >2500000000UL || dlane_bps <80000000UL )return -EINVAL ;else if (dlane_bps >=1250000000 ) cfg->pll_opdiv =1 ;
@@ -125,6 +125,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, cfg->pll_opdiv =4 ; else if (dlane_bps >= 160000000) cfg->pll_opdiv = 8; + else if (dlane_bps >= 80000000) + cfg->pll_opdiv = 16; cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv * cfg->pll_ipdiv,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/187 net: sh_eth: Disable WoL if system can not suspend
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
The MAC can't facilitate WoL if the system can't go to sleep. Gate the WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
--- drivers/net/ethernet/renesas/sh_eth.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/renesas/sh_eth.c +4 -0
@@ -2397,6 +2397,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,return 0 ; } +#ifdef CONFIG_PM_SLEEP static void sh_eth_get_wol (struct net_device *ndev,struct ethtool_wolinfo *wol) {struct sh_eth_private *mdp =netdev_priv (ndev);
@@ -2423,6 +2424,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)return 0 ; } +#endif static const struct ethtool_ops sh_eth_ethtool_ops = { .get_regs_len = sh_eth_get_regs_len,
@@ -2438,8 +2440,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = { .set_ringparam = sh_eth_set_ringparam, .get_link_ksettings = phy_ethtool_get_link_ksettings, .set_link_ksettings = phy_ethtool_set_link_ksettings, +#ifdef CONFIG_PM_SLEEP .get_wol = sh_eth_get_wol, .set_wol = sh_eth_set_wol, +#endif };/* network device open function */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/187 media: redrat3: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
Change "ret" from u8 to int type in redrat3_enable_detector() to store negative error codes or zero returned by redrat3_send_cmd() and usb_submit_urb() - this better aligns with the coding standards and maintains code consistency.
No effect on runtime.
--- drivers/media/rc/redrat3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/redrat3.c +1 -1
@@ -423,7 +423,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)static int redrat3_enable_detector (struct redrat3_dev *rr3) {struct device *dev = rr3->dev; -u8 ret; +int ret; ret =redrat3_send_cmd (RR3_RC_DET_ENABLE , rr3);if (ret !=0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/187 selftests: Disable dad for ipv6 in fcnal-test.sh
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
Constrained test environment; duplicate address detection is not needed and causes races so disable it.
--- tools/testing/selftests/net/fcnal-test.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/fcnal-test.sh +2 -0
@@ -376,6 +376,8 @@ create_ns() ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1 + ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0 + ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0 } # create veth pair to connect namespaces and apply addresses.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/187 selftests: Replace sleep with slowwait
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
Replace the sleep in kill_procs with slowwait.
--- tools/testing/selftests/net/fcnal-test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/fcnal-test.sh +1 -1
@@ -164,7 +164,7 @@ show_hint() kill_procs() { killall nettest ping ping6 >/dev/null 2>&1 - sleep 1 + slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"' } do_run_cmd()
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/187 net/cls_cgroup: Fix task_get_classid() during qdisc run
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
During recent testing with the netem qdisc to inject delays into TCP traffic, we observed that our CLS BPF program failed to function correctly due to incorrect classid retrieval from task_get_classid(). The issue manifests in the following call stack:
bpf_get_cgroup_classid+5
cls_bpf_classify+507
__tcf_classify+90
tcf_classify+217
__dev_queue_xmit+798
bond_dev_queue_xmit+43
__bond_start_xmit+211
bond_start_xmit+70
dev_hard_start_xmit+142
sch_direct_xmit+161
__qdisc_run+102 <<<<< Issue location
__dev_xmit_skb+1015
__dev_queue_xmit+637
neigh_hh_output+159
ip_finish_output2+461
__ip_finish_output+183
ip_finish_output+41
ip_output+120
ip_local_out+94
__ip_queue_xmit+394
ip_queue_xmit+21
__tcp_transmit_skb+2169
tcp_write_xmit+959
__tcp_push_pending_frames+55
tcp_push+264
tcp_sendmsg_locked+661
tcp_sendmsg+45
inet_sendmsg+67
sock_sendmsg+98
sock_write_iter+147
vfs_write+786
ksys_write+181
__x64_sys_write+25
do_syscall_64+56
entry_SYSCALL_64_after_hwframe+100The problem occurs when multiple tasks share a single qdisc. In such cases, __qdisc_run() may transmit skbs created by different tasks. Consequently, task_get_classid() retrieves an incorrect classid since it references the current task's context rather than the skb's originating task.
Given that dev_queue_xmit() always executes with bh disabled, we can use softirq_count() instead to obtain the correct classid.
The simple steps to reproduce this issue:
1. Add network delay to the network interface:
such as: tc qdisc add dev bond0 root netem delay 1.5ms
2. Build two distinct net_cls cgroups, each with a network-intensive task
3. Initiate parallel TCP streams from both tasks to external servers.
Under this specific condition, the issue reliably occurs. The kernel eventually dequeues an SKB that originated from Task-A while executing in the context of Task-B.
It is worth noting that it will change the established behavior for a slightly different scenario:
<sock S is created by task A>
<class ID for task A is changed>
<skb is created by sock S xmit and classified>
prior to this patch the skb will be classified with the 'new' task A classid, now with the old/original one. The bpf_get_cgroup_classid_curr() function is a more appropriate choice for this case.
--- include/net/cls_cgroup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/cls_cgroup.h +1 -1
@@ -58,7 +58,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)* calls by looking at the number of nested bh disable calls because * softirqs always disables bh. */ -if (in_serving_softirq ()) { +if (softirq_count ()) {struct sock *sk =skb_to_full_sk (skb);/* If there is an sock_cgroup_classid we'll use that. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/187 selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nai-Chen Cheng <[email protected]>
[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
The selftests 'make clean' does not clean the net/lib because it only processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves compiled objects in net/lib after cleaning, requiring manual cleanup.
Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib dependency is properly cleaned.
--- tools/testing/selftests/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/Makefile +1 -1
@@ -237,7 +237,7 @@ else endif clean: - @for TARGET in $(TARGETS); do \ + @for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \ BUILD_TARGET=$$BUILD/$$TARGET; \ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\ done;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/187 scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
If lpfc_reset_flush_io_context fails to execute, then the wrong return status code may be passed back to upper layers when issuing a target reset TMF command. Fix by checking the return status from lpfc_reset_flush_io_context() first in order to properly return FAILED or FAST_IO_FAIL.
Message-ID: <[email protected]>
--- drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_scsi.c +10 -4
@@ -5153,7 +5153,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct scsi_cmnd *cmnd)/** * lpfc_reset_flush_io_context - * @vport: The virtual port (scsi_host) for the flush context -* @tgt_id: If aborting by Target contect - specifies the target id +* @tgt_id: If aborting by Target context - specifies the target id * @lun_id: If aborting by Lun context - specifies the lun id * @context: specifies the context level to flush at. *
@@ -5312,8 +5312,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd) pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE ;spin_unlock_irq (shost->host_lock); } -lpfc_reset_flush_io_context (vport, tgt_id, lun_id, -LPFC_CTX_TGT ); + status =lpfc_reset_flush_io_context (vport, tgt_id, lun_id, +LPFC_CTX_TGT ); +if (status !=SUCCESS ) { +lpfc_printf_vlog (vport,KERN_ERR ,LOG_FCP , +"0726 Target Reset flush status x%x\n" , + status); +return status; + }return FAST_IO_FAIL ; }
@@ -5457,7 +5463,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)int rc, ret =SUCCESS ;lpfc_printf_vlog (vport,KERN_ERR ,LOG_FCP , -"3172 SCSI layer issued Host Reset Data:\n" ); +"3172 SCSI layer issued Host Reset\n" );lpfc_offline_prep (phba,LPFC_MBX_WAIT );lpfc_offline (phba);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/187 scsi: lpfc: Define size of debugfs entry for xri rebalancing
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs entry is used. The debugfs file operations for xri rebalancing have been previously implemented, but lack definition for its information buffer size. Similar to other pre-existing debugfs entry buffers, define LPFC_HDWQINFO_SIZE as 8192 bytes.
Message-ID: <[email protected]>
--- drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/lpfc/lpfc_debugfs.h +3 -0
@@ -44,6 +44,9 @@/* hbqinfo output buffer size */ #define LPFC_HBQINFO_SIZE 8192 +/* hdwqinfo output buffer size */ +#define LPFC_HDWQINFO_SIZE 8192 +/* nvmestat output buffer size */ #define LPFC_NVMESTAT_SIZE 8192#define LPFC_NVMEKTIME_SIZE 8192
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/187 allow finish_no_open(file, ERR_PTR(-E...))
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
... allowing any ->lookup() return value to be passed to it.
--- fs/open.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/open.c +6 -4
@@ -886,18 +886,20 @@ EXPORT_SYMBOL(finish_open);* finish_no_open - finish ->atomic_open() without opening the file * * @file: file pointer -* @dentry: dentry or NULL (as returned from ->lookup()) +* @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup()) * -* This can be used to set the result of a successful lookup in ->atomic_open(). +* This can be used to set the result of a lookup in ->atomic_open(). * * NB: unlike finish_open() this function does consume the dentry reference and * the caller need not dput() it. * -* Returns "0" which must be the return value of ->atomic_open() after having -* called this function. +* Returns 0 or -E..., which must be the return value of ->atomic_open() after +* having called this function. */ int finish_no_open (struct file *file,struct dentry *dentry) { +if (IS_ERR (dentry)) +return PTR_ERR (dentry); file->f_path.dentry = dentry;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/187 usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Forest Crossman <[email protected]>
[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
The usbmon binary interface currently truncates captures of large transfers from higher-speed USB devices. Because a single event capture is limited to one-fifth of the total buffer size, the current maximum size of a captured URB is around 240 KiB. This is insufficient when capturing traffic from modern devices that use transfers of several hundred kilobytes or more, as truncated URBs can make it impossible for user-space USB analysis tools like Wireshark to properly defragment and reassemble higher-level protocol packets in the captured data.
The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has not been changed since the binary interface was introduced in 2006.
To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The original comment for BUFF_MAX based the limit's calculation on a saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2 Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the buffer should be at least 50 MB. The new limit of 64 MiB covers that, plus a little extra for any overhead.
With this change, both users and developers should now be able to debug and reverse engineer modern USB devices even when running unmodified distro kernels.
Please note that this change does not affect the default buffer size. A larger buffer is only allocated when a user explicitly requests it via the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size should not unduly increase memory usage for users that don't deliberately request a larger buffer.
--- drivers/usb/mon/mon_bin.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/mon/mon_bin.c +8 -6
@@ -68,18 +68,20 @@* The magic limit was calculated so that it allows the monitoring * application to pick data once in two ticks. This way, another application, * which presumably drives the bus, gets to hog CPU, yet we collect our data. -* If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an -* enormous overhead built into the bus protocol, so we need about 1000 KB. +* +* Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For +* modern 20 Gbps buses, this value increases to over 50 MB. The maximum +* buffer size is set to 64 MiB to accommodate this. * * This is still too much for most cases, where we just snoop a few * descriptor fetches for enumeration. So, the default is a "reasonable" -* amount for systems with HZ=250 and incomplete bus saturation. +* amount for typical, low-throughput use cases. * * XXX What about multi-megabyte URBs which take minutes to transfer? */ -#define BUFF_MAX CHUNK_ALIGN(1200*1024) -#define BUFF_DFL CHUNK_ALIGN(300*1024) -#define BUFF_MIN CHUNK_ALIGN(8*1024) +#define BUFF_MAX CHUNK_ALIGN(64*1024*1024) +#define BUFF_DFL CHUNK_ALIGN(300*1024) +#define BUFF_MIN CHUNK_ALIGN(8*1024)/* * The per-event API header (2 per URB).
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/187 usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <[email protected]>
[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs, when in host mode, it is intended that the controller goes to suspend state to save power and wait for interrupts from connected peripheral to wake it up. This is particularly used in cases where a HID or Audio device is connected. In such scenarios, the usb controller can enter auto suspend and resume action after getting interrupts from the connected device.
--- drivers/usb/host/xhci-plat.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-plat.c +1 -0
@@ -222,6 +222,7 @@ static int xhci_plat_probe(struct platform_device *pdev) }pm_runtime_set_active (&pdev->dev); +pm_runtime_use_autosuspend (&pdev->dev);pm_runtime_enable (&pdev->dev);pm_runtime_get_noresume (&pdev->dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/187 ipv6: np->rxpmtu race annotation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
Add READ_ONCE() annotations because np->rxpmtu can be changed while udpv6_recvmsg() and rawv6_recvmsg() read it.
Since this is a very rarely used feature, and that udpv6_recvmsg() and rawv6_recvmsg() read np->rxopt anyway, change the test order so that np->rxpmtu does not need to be in a hot cache line.
--- net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv6/raw.c +1 -1
@@ -474,7 +474,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len); -if (np->rxpmtu && np->rxopt.bits.rxpmtu) +if (np->rxopt.bits.rxpmtu &&READ_ONCE (np->rxpmtu))return ipv6_recv_rxpmtu (sk, msg, len, addr_len); skb =skb_recv_datagram (sk, flags, noblock, &err);
net/ipv6/udp.c +1 -1
@@ -297,7 +297,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len); -if (np->rxpmtu && np->rxopt.bits.rxpmtu) +if (np->rxopt.bits.rxpmtu &&READ_ONCE (np->rxpmtu))return ipv6_recv_rxpmtu (sk, msg, len, addr_len); try_again:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/187 jfs: Verify inode mode when loading from disk
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does.
--- fs/jfs/inode.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/jfs/inode.c +7 -1
@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)*/ inode->i_link[inode->i_size] ='\0' ; } - }else { + }else if (S_ISCHR (inode->i_mode) ||S_ISBLK (inode->i_mode) || +S_ISFIFO (inode->i_mode) ||S_ISSOCK (inode->i_mode)) { inode->i_op = &jfs_file_inode_operations;init_special_inode (inode, inode->i_mode, inode->i_rdev); + }else { +printk (KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n" , + inode->i_mode, inode->i_ino); +iget_failed (inode); +return ERR_PTR (-EIO ); }unlock_new_inode (inode);return inode;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/187 jfs: fix uninitialized waitqueue in transaction manager
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <[email protected]>
[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
The transaction manager initialization in txInit() was not properly initializing TxBlock[0].waitor waitqueue, causing a crash when txEnd(0) is called on read-only filesystems.
When a filesystem is mounted read-only, txBegin() returns tid=0 to indicate no transaction. However, txEnd(0) still gets called and tries to access TxBlock[0].waitor via tid_to_tblock(0), but this waitqueue was never initialized because the initialization loop started at index 1 instead of 0.
This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEnd
Fix by ensuring all transaction blocks including TxBlock[0] have their waitqueues properly initialized during txInit().
--- fs/jfs/jfs_txnmgr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/jfs/jfs_txnmgr.c +5 -4
@@ -272,14 +272,15 @@ int txInit(void)if (TxBlock ==NULL )return -ENOMEM ; -for (k =1 ; k < nTxBlock -1 ; k++) { - TxBlock[k].next = k +1 ; +for (k =0 ; k < nTxBlock; k++) {init_waitqueue_head (&TxBlock[k].gcwait);init_waitqueue_head (&TxBlock[k].waitor); } + +for (k =1 ; k < nTxBlock -1 ; k++) { + TxBlock[k].next = k +1 ; + } TxBlock[k].next =0 ; -init_waitqueue_head (&TxBlock[k].gcwait); -init_waitqueue_head (&TxBlock[k].waitor); TxAnchor.freetid =1 ;init_waitqueue_head (&TxAnchor.freewait);
Signature · 1 line
2.51.0
syzbot
syzbotRe: [PATCH 5.4 094/187] jfs: fix uninitialized waitqueue in transaction manager
I see the command but can't find the corresponding bug. The email is sent to [email protected] address but the HASH does not correspond to any known bug. Please double check the…
Quoted 62 lines
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <[email protected]>
[ Upstream commit
300b072df72694ea330c4c673c035253e07827b8]The transaction manager initialization in
txInit()was not properly initializing TxBlock[0].waitor waitqueue, causing a crash when txEnd(0) is called on read-only filesystems.When a filesystem is mounted read-only,
txBegin()returns tid=0 to indicate no transaction. However, txEnd(0) still gets called and tries to access TxBlock[0].waitor viatid_to_tblock(0), but this waitqueue was never initialized because the initialization loop started at index 1 instead of 0.This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEndFix by ensuring all transaction blocks including TxBlock[0] have their waitqueues properly initialized during
txInit().Reported-by [email protected]Signed-off-by Shaurya Rane <[email protected]>Signed-off-by Dave Kleikamp <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- fs/jfs/jfs_txnmgr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)fs/jfs/jfs_txnmgr.c +5
-4@@ -272,14 +272,15 @@ int txInit(void)if (TxBlock ==NULL )return -ENOMEM ; -for (k =1 ; k < nTxBlock -1 ; k++) { - TxBlock[k].next = k +1 ; +for (k =0 ; k < nTxBlock; k++) {init_waitqueue_head (&TxBlock[k].gcwait);init_waitqueue_head (&TxBlock[k].waitor); } + +for (k =1 ; k < nTxBlock -1 ; k++) { + TxBlock[k].next = k +1 ; + } TxBlock[k].next =0 ; -init_waitqueue_head (&TxBlock[k].gcwait); -init_waitqueue_head (&TxBlock[k].waitor); TxAnchor.freetid =1 ;init_waitqueue_head (&TxAnchor.freewait);Signature · 1 line
2.51.0
I see the command but can't find the corresponding bug. The email is sent to [email protected] address but the HASH does not correspond to any known bug. Please double check the address.
Greg Kroah-Hartman
maintainerPATCH 95/187 net: intel: fm10k: Fix parameter idx set but not used
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
Variable idx is set in the loop, but is never used resulting in dead code. Building with GCC 16, which enables -Werror=unused-but-set-parameter= by default results in build error. This patch removes the idx parameter, since all the callers of the fm10k_unbind_hw_stats_q as 0 as idx anyways.
--- drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++--- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- 4 files changed, 5 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/fm10k/fm10k_common.c +2 -3
@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,/** * fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues * @q: pointer to the ring of hardware statistics queue -* @idx: index pointing to the start of the ring iteration * @count: number of queues to iterate over * * Function invalidates the index values for the queues so any updates that * may have happened are ignored and the base for the queue stats is reset. **/ -void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 idx,u32 count) +void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 count) {u32 i; -for (i =0 ; i < count; i++, idx++, q++) { +for (i =0 ; i < count; i++, q++) { q->rx_stats_idx =0 ; q->tx_stats_idx =0 ; }
drivers/net/ethernet/intel/fm10k/fm10k_common.h +1 -1
@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,void fm10k_update_hw_stats_q (struct fm10k_hw *hw,struct fm10k_hw_stats_q *q,u32 idx,u32 count);#define fm10k_unbind_hw_stats_32b (s) ((s)->base_h = 0) -void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 idx,u32 count); +void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 count);s32 fm10k_get_host_state_generic (struct fm10k_hw *hw,bool *host_ready);#endif /* _FM10K_COMMON_H_ */
drivers/net/ethernet/intel/fm10k/fm10k_pf.c +1 -1
@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,fm10k_unbind_hw_stats_32b (&stats->nodesc_drop);/* Unbind Queue Statistics */ -fm10k_unbind_hw_stats_q (stats->q,0 , hw->mac.max_queues); +fm10k_unbind_hw_stats_q (stats->q, hw->mac.max_queues);/* Reinitialize bases for all stats */ fm10k_update_hw_stats_pf (hw, stats);
drivers/net/ethernet/intel/fm10k/fm10k_vf.c +1 -1
@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw, struct fm10k_hw_stats *stats) {/* Unbind Queue Statistics */ -fm10k_unbind_hw_stats_q (stats->q,0 , hw->mac.max_queues); +fm10k_unbind_hw_stats_q (stats->q, hw->mac.max_queues);/* Reinitialize bases for all stats */ fm10k_update_hw_stats_vf (hw, stats);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/187 sparc/module: Add R_SPARC_UA64 relocation handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koakuma <[email protected]>
[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
This is needed so that the kernel can handle R_SPARC_UA64 relocations, which is emitted by LLVM's IAS.
--- arch/sparc/include/asm/elf_64.h | 1 + arch/sparc/kernel/module.c | 1 + 2 files changed, 2 insertions(+)
arch/sparc/include/asm/elf_64.h +1 -0
@@ -59,6 +59,7 @@#define R_SPARC_7 43#define R_SPARC_5 44#define R_SPARC_6 45 +#define R_SPARC_UA64 54/* Bits present in AT_HWCAP, primarily for Sparc32. */ #define HWCAP_SPARC_FLUSH 0x00000001
arch/sparc/kernel/module.c +1 -0
@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,break ;#ifdef CONFIG_SPARC64 case R_SPARC_64 : +case R_SPARC_UA64 : location[0 ] = v >>56 ; location[1 ] = v >>48 ; location[2 ] = v >>40 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/187 remoteproc: qcom: q6v5: Avoid handling handover twice
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
A remoteproc could theoretically signal handover twice. This is unexpected and would break the reference counting for the handover resources (power domains, clocks, regulators, etc), so add a check to prevent that from happening.
--- drivers/remoteproc/qcom_q6v5.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/remoteproc/qcom_q6v5.c +5 -0
@@ -121,6 +121,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data) {struct qcom_q6v5 *q6v5 = data; +if (q6v5->handover_issued) { +dev_err (q6v5->dev,"Handover signaled, but it already happened\n" ); +return IRQ_HANDLED ; + } +if (q6v5->handover) q6v5->handover (q6v5);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/187 NFSv4: handle ERR_GRACE on delegation recalls
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
RFC7530 states that clients should be prepared for the return of NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
--- fs/nfs/nfs4proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/nfs4proc.c +2 -2
@@ -7315,10 +7315,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,return err;do { err =_nfs4_do_setlk (state,F_SETLK , fl,NFS_LOCK_NEW ); -if (err != -NFS4ERR_DELAY ) +if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE )break ;ssleep (1 ); - }while (err == -NFS4ERR_DELAY ); + }while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE );return nfs4_handle_delegation_recall_error (server, state, stateid, fl, err); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/187 NFSv4.1: fix mount hang after CREATE_SESSION failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
When client initialization goes through server trunking discovery, it schedules the state manager and then sleeps waiting for nfs_client initialization completion.
The state manager can fail during state recovery, and specifically in lease establishment as nfs41_init_clientid() will bail out in case of errors returned from nfs4_proc_create_session(), without ever marking the client ready. The session creation can fail for a variety of reasons e.g. during backchannel parameter negotiation, with status -EINVAL.
The error status will propagate all the way to the nfs4_state_manager but the client status will not be marked, and thus the mount process will remain blocked waiting.
Fix it by adding -EINVAL error handling to nfs4_state_manager().
--- fs/nfs/nfs4state.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4state.c +3 -0
@@ -2660,6 +2660,9 @@ static void nfs4_state_manager(struct nfs_client *clp)case -ENETUNREACH :nfs_mark_client_ready (clp, -EIO );break ; +case -EINVAL : +nfs_mark_client_ready (clp, status); +break ;default :ssleep (1 );break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/187 nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack.
Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that.
--- fs/nfs/nfs4proc.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/nfs4proc.c +2 -0
@@ -355,7 +355,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent *p++ =htonl (attrs);/* bitmap */ *p++ =htonl (12 );/* attribute buffer length */ *p++ =htonl (NF4DIR ); +spin_lock (&dentry->d_lock); p =xdr_encode_hyper (p,NFS_FILEID (d_inode (dentry->d_parent))); +spin_unlock (&dentry->d_lock); readdir->pgbase = (char *)p - (char *)start; readdir->count -= readdir->pgbase;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/187 net: macb: avoid dealing with endianness in macb_set_hwaddr()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <[email protected]>
[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
bp->dev->dev_addr is of type unsigned char *. Casting it to a u32 pointer and dereferencing implies dealing manually with endianness, which is error-prone.
Replace by calls to get_unaligned_le32|le16() helpers.
This was found using sparse:
⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
warning: incorrect type in assignment (different base types)
expected unsigned int [usertype] bottom
got restricted __le32 [usertype]
warning: incorrect type in assignment (different base types)
expected unsigned short [usertype] top
got restricted __le16 [usertype]
...
--- drivers/net/ethernet/cadence/macb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +2 -2
@@ -277,9 +277,9 @@ static void macb_set_hwaddr(struct macb *bp)u32 bottom;u16 top; - bottom =cpu_to_le32 (*((u32 *)bp->dev->dev_addr)); + bottom =get_unaligned_le32 (bp->dev->dev_addr);macb_or_gem_writel (bp,SA1B , bottom); - top =cpu_to_le16 (*((u16 *)(bp->dev->dev_addr +4 ))); + top =get_unaligned_le16 (bp->dev->dev_addr +4 );macb_or_gem_writel (bp,SA1T , top);/* Clear unused address register sets */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/187 Bluetooth: SCO: Fix UAF on sco_conn_free
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline] BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352 CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted 6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci13 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x191/0x550 mm/kasan/report.c:482 kasan_report+0xc4/0x100 mm/kasan/report.c:595 sco_conn_free net/bluetooth/sco.c:87 [inline] kref_put include/linux/kref.h:65 [inline] sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441 hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline] hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313 hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121 hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147 hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319 worker_thread+0xbee/0x1200 kernel/workqueue.c:3400 kthread+0x3c7/0x870 kernel/kthread.c:463 ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 31370: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4382 [inline] __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xae/0x220 net/core/sock.c:2239 sk_alloc+0x34/0x5a0 net/core/sock.c:2295 bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151 sco_sock_alloc net/bluetooth/sco.c:562 [inline] sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593 bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135 __sock_create+0x3ad/0x780 net/socket.c:1589 sock_create net/socket.c:1647 [inline] __sys_socket_create net/socket.c:1684 [inline] __sys_socket+0xd5/0x330 net/socket.c:1731 __do_sys_socket net/socket.c:1745 [inline] __se_sys_socket net/socket.c:1743 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1743 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 31374: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2428 [inline] slab_free mm/slub.c:4701 [inline] kfree+0x199/0x3b0 mm/slub.c:4900 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x4aa/0x630 net/core/sock.c:2373 sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x230 net/socket.c:1439 __fput+0x3d1/0x9e0 fs/file_table.c:468 task_work_run+0x206/0x2a0 kernel/task_work.c:227 get_signal+0x1201/0x1410 kernel/signal.c:2807 arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/bluetooth/sco.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/bluetooth/sco.c +7 -0
@@ -399,6 +399,13 @@ static void sco_sock_kill(struct sock *sk)BT_DBG ("sk %p state %d" , sk, sk->sk_state); +/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ +if (sco_pi (sk)->conn) { +sco_conn_lock (sco_pi (sk)->conn); +sco_pi (sk)->conn->sk =NULL ; +sco_conn_unlock (sco_pi (sk)->conn); + } +/* Kill poor orphan */ bt_sock_unlink (&sco_sk_list, sk);sock_set_flag (sk,SOCK_DEAD );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/187 Bluetooth: bcsp: receive data only if registered
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Pravdin <[email protected]>
[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace:
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
Call Trace:
<TASK>
hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7fTo prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH.
--- drivers/bluetooth/hci_bcsp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/hci_bcsp.c +3 -0
@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)struct bcsp_struct *bcsp = hu->priv;const unsigned char *ptr; +if (!test_bit (HCI_UART_REGISTERED , &hu->flags)) +return -EUNATCH ; +BT_DBG ("hu %p count %d rx_state %d rx_count %ld" , hu, count, bcsp->rx_state, bcsp->rx_count);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/187 page_pool: Clamp pool size to max 16K pages
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
page_pool_init() returns E2BIG when the page_pool size goes above 32K pages. As some drivers are configuring the page_pool size according to the MTU and ring size, there are cases where this limit is exceeded and the queue creation fails.
The page_pool size doesn't have to cover a full queue, especially for larger ring size. So clamp the size instead of returning an error. Do this in the core to avoid having each driver do the clamping.
The current limit was deemed to high [1] so it was reduced to 16K to avoid page waste.
[1] https://lore.kernel.org/all/[email protected]/
--- net/core/page_pool.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/core/page_pool.c +1 -5
@@ -33,11 +33,7 @@ static int page_pool_init(struct page_pool *pool,return -EINVAL ;if (pool->p.pool_size) - ring_qsize = pool->p.pool_size; - -/* Sanity limit mem that can be pinned down */ -if (ring_qsize >32768 ) -return -E2BIG ; + ring_qsize =min (pool->p.pool_size,16384 );/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL. * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/187 orangefs: fix xattr related buffer overflow...
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <[email protected]>
[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
Willy Tarreau <[email protected]> forwarded me a message from Disclosure <[email protected]> with the following warning:
Quoted 5 lines
The helper
xattr_key()uses the pointer variable in the loop condition rather than dereferencing it. Askeyis incremented, it remains non-NULL (until it runs into unmapped memory), so the loop does not terminate on valid C strings and will walk memory indefinitely, consuming CPU or hanging the thread.
I easily reproduced this with setfattr and getfattr, causing a kernel oops, hung user processes and corrupted orangefs files. Disclosure sent along a diff (not a patch) with a suggested fix, which I based this patch on.
After xattr_key started working right, xfstest generic/069 exposed an xattr related memory leak that lead to OOM. xattr_key returns a hashed key. When adding xattrs to the orangefs xattr cache, orangefs used hash_add, a kernel hashing macro. hash_add also hashes the key using hash_log which resulted in additions to the xattr cache going to the wrong hash bucket. generic/069 tortures a single file and orangefs does a getattr for the xattr "security.capability" every time. Orangefs negative caches on xattrs which includes a kmalloc. Since adds to the xattr cache were going to the wrong bucket, every getattr for "security.capability" resulted in another kmalloc, none of which were ever freed.
I changed the two uses of hash_add to hlist_add_head instead and the memory leak ceased and generic/069 quit throwing furniture.
--- fs/orangefs/xattr.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/orangefs/xattr.c +7 -5
@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)static unsigned int xattr_key (const char *key) {unsigned int i =0 ; -while (key) +if (!key) +return 0 ; +while (*key) i += *key++;return i %16 ; }
@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, cx->length =-1 ; cx->timeout = jiffies + orangefs_getattr_timeout_msecs*HZ /1000 ; -hash_add (orangefs_inode->xattr_cache, &cx->node, -xattr_key (cx->key)); +hlist_add_head ( &cx->node, + &orangefs_inode->xattr_cache[xattr_key (cx->key)]); } } goto out_release_op;
@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,memcpy (cx->val, buffer, length); cx->length = length; cx->timeout = jiffies +HZ ; -hash_add (orangefs_inode->xattr_cache, &cx->node, -xattr_key (cx->key)); +hlist_add_head (&cx->node, + &orangefs_inode->xattr_cache[xattr_key (cx->key)]); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/187 ACPICA: Update dsmethod.c to get rid of unused variable warning
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Dumbre <[email protected]>
[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about the unused variable i after the removal of its usage by PR #1031 addressing Issue #1027
--- drivers/acpi/acpica/dsmethod.c | 1 - 1 file changed, 1 deletion(-)
drivers/acpi/acpica/dsmethod.c +0 -1
@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,struct acpi_walk_state *next_walk_state =NULL ;union acpi_operand_object *obj_desc;struct acpi_evaluate_info *info; -u32 i;ACPI_FUNCTION_TRACE_PTR (ds_call_control_method, this_walk_state);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/187 fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yikang Yue <[email protected]>
[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
The function call new_inode() is a primitive for allocating an inode in memory, rather than planning disk space for it. Therefore, -ENOMEM should be returned as the error code rather than -ENOSPC.
To be specific, new_inode()'s call path looks like this:new_inode
new_inode_pseudo
alloc_inode
ops->alloc_inode (hpfs_alloc_inode)
alloc_inode_sb
kmem_cache_alloc_lruTherefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), not a lack of disk space. However, the current implementation of hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. This patch fix this by set err to -ENOMEM before the goto statement.
BTW, we also noticed that other nested calls within these four functions, like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. But similarly, only -ENOSPC is returned. Addressing these will involve code modifications in other functions, and we plan to submit dedicated patches for these issues in the future. For this patch, we focus on new_inode().
--- fs/hpfs/namei.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
fs/hpfs/namei.c +12 -6
@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) dee.fnode =cpu_to_le32 (fno); dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail2; + }hpfs_init_inode (result); result->i_ino = fno;hpfs_i (result)->i_parent_dir = dir->i_ino;
@@ -154,9 +156,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail1; - + }hpfs_init_inode (result); result->i_ino = fno; result->i_mode |=S_IFREG ;
@@ -241,9 +244,10 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail1; - + }hpfs_init_inode (result); result->i_ino = fno;hpfs_i (result)->i_parent_dir = dir->i_ino;
@@ -317,8 +321,10 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail1; + } result->i_ino = fno;hpfs_init_inode (result);hpfs_i (result)->i_parent_dir = dir->i_ino;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/187 9p: fix /sys/fs/9p/caches overwriting itself
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <[email protected]>
[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
caches_show() overwrote its buffer on each iteration, so only the last cache tag was visible in sysfs output.
Properly append with snprintf(buf + count, …).
Message-ID: <[email protected]>
--- fs/9p/v9fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/9p/v9fs.c +1 -1
@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj,spin_lock (&v9fs_sessionlist_lock);list_for_each_entry (v9ses, &v9fs_sessionlist, slist) {if (v9ses->cachetag) { - n =snprintf (buf, limit,"%s\n" , v9ses->cachetag); + n =snprintf (buf + count, limit,"%s\n" , v9ses->cachetag);if (n <0 ) { count = n;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/187 9p: sysfs_init: dont hardcode error to ENOMEM
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <[email protected]>
[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
v9fs_sysfs_init() always returned -ENOMEM on failure; return the actual sysfs_create_group() error instead.
Message-ID: <[email protected]>
--- fs/9p/v9fs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/9p/v9fs.c +5 -2
@@ -594,13 +594,16 @@ static struct attribute_group v9fs_attr_group = {static int __init v9fs_sysfs_init (void ) { +int ret; + v9fs_kobj =kobject_create_and_add ("9p" , fs_kobj);if (!v9fs_kobj)return -ENOMEM ; -if (sysfs_create_group (v9fs_kobj, &v9fs_attr_group)) { + ret =sysfs_create_group (v9fs_kobj, &v9fs_attr_group); +if (ret) {kobject_put (v9fs_kobj); -return -ENOMEM ; +return ret; }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/187 ACPI: property: Return present device nodes only on fwnode interface
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
fwnode_graph_get_next_subnode() may return fwnode backed by ACPI device nodes and there has been no check these devices are present in the system, unlike there has been on fwnode OF backend.
In order to provide consistent behaviour towards callers, add a check for device presence by introducing
a new function acpi_get_next_present_subnode(), used as the get_next_child_node() fwnode operation that also checks device node presence.
--- drivers/acpi/property.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/acpi/property.c +23 -1
@@ -1114,6 +1114,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,return NULL ; } +/* +* acpi_get_next_present_subnode - Return the next present child node handle +* @fwnode: Firmware node to find the next child node for. +* @child: Handle to one of the device's child nodes or a null handle. +* +* Like acpi_get_next_subnode(), but the device nodes returned by +* acpi_get_next_present_subnode() are guaranteed to be present. +* +* Returns: The fwnode handle of the next present sub-node. +*/ +static struct fwnode_handle * +acpi_get_next_present_subnode (const struct fwnode_handle *fwnode, +struct fwnode_handle *child) +{ +do { + child =acpi_get_next_subnode (fwnode, child); + }while (is_acpi_device_node (child) && + !acpi_device_is_present (to_acpi_device_node (child))); + +return child; +} +/** * acpi_node_get_parent - Return parent fwnode of this fwnode * @fwnode: Firmware node whose parent to get
@@ -1387,7 +1409,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode, .property_read_string_array = \ acpi_fwnode_property_read_string_array, \ .get_parent = acpi_node_get_parent, \ - .get_next_child_node = acpi_get_next_subnode, \ + .get_next_child_node = acpi_get_next_present_subnode, \ .get_named_child_node = acpi_fwnode_get_named_child_node, \ .get_reference_args = acpi_fwnode_get_reference_args, \ .graph_get_next_endpoint = \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/187 tools bitmap: Add missing asm-generic/bitsperlong.h include
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
small_const_nbits is defined in asm-generic/bitsperlong.h which bitmap.h uses but doesn't include causing build failures in some build systems. Add the missing #include.
Note the bitmap.h in tools has diverged from that of the kernel, so no changes are made there.
--- tools/include/linux/bitmap.h | 1 + 1 file changed, 1 insertion(+)
tools/include/linux/bitmap.h +1 -0
@@ -3,6 +3,7 @@#define _PERF_BITOPS_H#include <string.h> +#include <asm-generic/bitsperlong.h> #include <linux/align.h> #include <linux/bitops.h> #include <stdlib.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/187 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Albin Babu Varghese <[email protected]>
[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches.
Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.
--- drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/video/fbdev/core/bitblit.c +17 -0
@@ -169,6 +169,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, image.height = vc->vc_font.height; image.depth =1 ; +if (image.dy >= info->var.yres) +return ; + + image.height =min (image.height, info->var.yres - image.dy); +if (attribute) { buf =kmalloc (cellsize,GFP_ATOMIC );if (!buf)
@@ -182,6 +187,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, cnt = count; image.width = vc->vc_font.width * cnt; + +if (image.dx >= info->var.xres) +break ; + +if (image.dx + image.width > info->var.xres) { + image.width = info->var.xres - image.dx; + cnt = image.width / vc->vc_font.width; +if (cnt ==0 ) +break ; + image.width = cnt * vc->vc_font.width; + } + pitch =DIV_ROUND_UP (image.width,8 ) + scan_align; pitch &= ~scan_align; size = pitch * image.height + buf_align;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/187 ceph: add checking of wait_for_completion_killable() return value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
The Coverity Scan service has detected the calling of wait_for_completion_killable() without checking the return value in ceph_lock_wait_for_completion() [1]. The CID 1636232 defect contains explanation: "If the function returns an error value, the error value may be mistaken for a normal value. In ceph_lock_wait_for_completion(): Value returned from a function is not checked for errors before being used. (CWE-252)".
The patch adds the checking of wait_for_completion_killable() return value and return the error code from ceph_lock_wait_for_completion().
[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
--- fs/ceph/locks.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ceph/locks.c +4 -1
@@ -206,7 +206,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,if (err && err != -ERESTARTSYS )return err; -wait_for_completion_killable (&req->r_safe_completion); + err =wait_for_completion_killable (&req->r_safe_completion); +if (err) +return err; +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/187 net: vlan: sync VLAN features with lower device
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit c211f5d7cbd5cb34489d526648bb9c8ecc907dee ]
After registering a VLAN device and setting its feature flags, we need to synchronize the VLAN features with the lower device. For example, the VLAN device does not have the NETIF_F_LRO flag, it should be synchronized with the lower device based on the NETIF_F_UPPER_DISABLES definition.
As the dev->vlan_features has changed, we need to call netdev_update_features(). The caller must run after netdev_upper_dev_link() links the lower devices, so this patch adds the netdev_update_features() call in register_vlan_dev().
--- net/8021q/vlan.c | 2 ++ 1 file changed, 2 insertions(+)
net/8021q/vlan.c +2 -0
@@ -187,6 +187,8 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)vlan_group_set_device (grp, vlan->vlan_proto, vlan_id, dev); grp->nr_vlan_devs++; +netdev_update_features (dev); +return 0 ; out_unregister_netdev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/187 net: dsa/b53: change b53_force_port_config() pause argument
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
[ Upstream commit 3cad1c8b49e93c62f27f4eb34e0ccfde92f4cdc0 ]
Replace the b53_force_port_config() pause argument, which is based on phylink's MLO_PAUSE_* definitions, to use a pair of booleans. This will allow us to move b53_force_port_config() from b53_phylink_mac_config() to b53_phylink_mac_link_up().
Stable-dep-of: b6a8a5477fe9 ("net: dsa: b53: fix resetting speed and pause on forced link")
--- drivers/net/dsa/b53/b53_common.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
drivers/net/dsa/b53/b53_common.c +15 -10
@@ -1041,7 +1041,8 @@ static void b53_force_link(struct b53_device *dev, int port, int link) }static void b53_force_port_config (struct b53_device *dev,int port, -int speed,int duplex,int pause) +int speed,int duplex, +bool tx_pause,bool rx_pause) {u8 reg, val, off;
@@ -1079,9 +1080,9 @@ static void b53_force_port_config(struct b53_device *dev, int port,return ; } -if (pause &MLO_PAUSE_RX ) +if (rx_pause) reg |=PORT_OVERRIDE_RX_FLOW ; -if (pause &MLO_PAUSE_TX ) +if (tx_pause) reg |=PORT_OVERRIDE_TX_FLOW ;b53_write8 (dev,B53_CTRL_PAGE , off, reg);
@@ -1093,22 +1094,24 @@ static void b53_adjust_link(struct dsa_switch *ds, int port,struct b53_device *dev = ds->priv;struct ethtool_eee *p = &dev->ports[port].eee;u8 rgmii_ctrl =0 , reg =0 , off; -int pause =0 ; +bool tx_pause = false; +bool rx_pause = false;if (!phy_is_pseudo_fixed_link (phydev))return ;/* Enable flow control on BCM5301x's CPU port */ if (is5301x (dev) && port == dev->cpu_port) - pause =MLO_PAUSE_TXRX_MASK ; + tx_pause = rx_pause = true;if (phydev->pause) {if (phydev->asym_pause) - pause |=MLO_PAUSE_TX ; - pause |=MLO_PAUSE_RX ; + tx_pause = true; + rx_pause = true; } -b53_force_port_config (dev, port, phydev->speed, phydev->duplex, pause); +b53_force_port_config (dev, port, phydev->speed, phydev->duplex, + tx_pause, rx_pause);b53_force_link (dev, port, phydev->link);if (is531x5 (dev) &&phy_interface_is_rgmii (phydev)) {
@@ -1170,7 +1173,7 @@ static void b53_adjust_link(struct dsa_switch *ds, int port, }else if (is5301x (dev)) {if (port != dev->cpu_port) {b53_force_port_config (dev, dev->cpu_port,2000 , -DUPLEX_FULL ,MLO_PAUSE_TXRX_MASK ); +DUPLEX_FULL , true, true);b53_force_link (dev, dev->cpu_port,1 ); } }
@@ -1260,7 +1263,9 @@ void b53_phylink_mac_config(struct dsa_switch *ds, int port,if (mode ==MLO_AN_FIXED ) {b53_force_port_config (dev, port, state->speed, - state->duplex, state->pause); + state->duplex, + !!(state->pause &MLO_PAUSE_TX ), + !!(state->pause &MLO_PAUSE_RX ));return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/187 net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 37883bbc45a8555d6eca88d3a9730504d2dac86c ]
BCM5325 doesn't implement GMII_PORT_OVERRIDE_CTRL register so we should avoid reading or writing it.PORT_OVERRIDE_RX_FLOW and PORT_OVERRIDE_TX_FLOW aren't defined on BCM5325 and we should use PORT_OVERRIDE_LP_FLOW_25 instead.
Stable-dep-of: b6a8a5477fe9 ("net: dsa: b53: fix resetting speed and pause on forced link")
--- drivers/net/dsa/b53/b53_common.c | 21 +++++++++++++++++---- drivers/net/dsa/b53/b53_regs.h | 1 + 2 files changed, 18 insertions(+), 4 deletions(-)
drivers/net/dsa/b53/b53_common.c +17 -4
@@ -1026,6 +1026,8 @@ static void b53_force_link(struct b53_device *dev, int port, int link)if (port == dev->cpu_port) { off =B53_PORT_OVERRIDE_CTRL ; val =PORT_OVERRIDE_EN ; + }else if (is5325 (dev)) { +return ; }else { off =B53_GMII_PORT_OVERRIDE_CTRL (port); val =GMII_PO_EN ;
@@ -1050,6 +1052,8 @@ static void b53_force_port_config(struct b53_device *dev, int port,if (port == dev->cpu_port) { off =B53_PORT_OVERRIDE_CTRL ; val =PORT_OVERRIDE_EN ; + }else if (is5325 (dev)) { +return ; }else { off =B53_GMII_PORT_OVERRIDE_CTRL (port); val =GMII_PO_EN ;
@@ -1080,10 +1084,19 @@ static void b53_force_port_config(struct b53_device *dev, int port,return ; } -if (rx_pause) - reg |=PORT_OVERRIDE_RX_FLOW ; -if (tx_pause) - reg |=PORT_OVERRIDE_TX_FLOW ; +if (rx_pause) { +if (is5325 (dev)) + reg |=PORT_OVERRIDE_LP_FLOW_25 ; +else + reg |=PORT_OVERRIDE_RX_FLOW ; + } + +if (tx_pause) { +if (is5325 (dev)) + reg |=PORT_OVERRIDE_LP_FLOW_25 ; +else + reg |=PORT_OVERRIDE_TX_FLOW ; + }b53_write8 (dev,B53_CTRL_PAGE , off, reg); }
drivers/net/dsa/b53/b53_regs.h +1 -0
@@ -92,6 +92,7 @@#define PORT_OVERRIDE_SPEED_10M (0 << PORT_OVERRIDE_SPEED_S)#define PORT_OVERRIDE_SPEED_100M (1 << PORT_OVERRIDE_SPEED_S)#define PORT_OVERRIDE_SPEED_1000M (2 << PORT_OVERRIDE_SPEED_S) +#define PORT_OVERRIDE_LP_FLOW_25 BIT(3)/* BCM5325 only */ #define PORT_OVERRIDE_RV_MII_25 BIT(4)/* BCM5325 only */ #define PORT_OVERRIDE_RX_FLOW BIT(4)#define PORT_OVERRIDE_TX_FLOW BIT(5)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/187 net: dsa: b53: fix resetting speed and pause on forced link
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit b6a8a5477fe9bd6be2b594a88f82f8bba41e6d54 ]
There is no guarantee that the port state override registers have their default values, as not all switches support being reset via register or have a reset GPIO.
So when forcing port config, we need to make sure to clear all fields, which we currently do not do for the speed and flow control configuration. This can cause flow control stay enabled, or in the case of speed becoming an illegal value, e.g. configured for 1G (0x2), then setting 100M (0x1), results in 0x3 which is invalid.
For PORT_OVERRIDE_SPEED_2000M we need to make sure to only clear it on supported chips, as the bit can have different meanings on other chips, e.g. for BCM5389 this controls scanning PHYs for link/speed configuration.
--- drivers/net/dsa/b53/b53_common.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/dsa/b53/b53_common.c +9 -0
@@ -1066,6 +1066,10 @@ static void b53_force_port_config(struct b53_device *dev, int port,else reg &= ~PORT_OVERRIDE_FULL_DUPLEX ; + reg &= ~(0x3 <<GMII_PO_SPEED_S ); +if (is5301x (dev) ||is58xx (dev)) + reg &= ~PORT_OVERRIDE_SPEED_2000M ; +switch (speed) {case 2000 : reg |=PORT_OVERRIDE_SPEED_2000M ;
@@ -1084,6 +1088,11 @@ static void b53_force_port_config(struct b53_device *dev, int port,return ; } +if (is5325 (dev)) + reg &= ~PORT_OVERRIDE_LP_FLOW_25 ; +else + reg &= ~(PORT_OVERRIDE_RX_FLOW |PORT_OVERRIDE_TX_FLOW ); +if (rx_pause) {if (is5325 (dev)) reg |=PORT_OVERRIDE_LP_FLOW_25 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/187 net: dsa: b53: fix enabling ip multicast
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit c264294624e956a967a9e2e5fa41e3273340b089 ]
In the New Control register bit 1 is either reserved, or has a different function:
Out of Range Error Discard
When enabled, the ingress port discards any frames if the Length field is between 1500 and 1536 (excluding 1500 and 1536) and with good CRC.
The actual bit for enabling IP multicast is bit 0, which was only explicitly enabled for BCM5325 so far.
For older switch chips, this bit defaults to 0, so we want to enable it as well, while newer switch chips default to 1, and their documentation says "It is illegal to set this bit to zero."
So drop the wrong B53_IPMC_FWD_EN define, enable the IP multicast bit also for other switch chips. While at it, rename it to (B53_)IP_MC as that is how it is called in Broadcom code.
--- drivers/net/dsa/b53/b53_common.c | 4 ++-- drivers/net/dsa/b53/b53_regs.h | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/net/dsa/b53/b53_common.c +2 -2
@@ -347,11 +347,11 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)* frames should be flooded or not. */ b53_read8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , &mgmt); - mgmt |=B53_UC_FWD_EN |B53_MC_FWD_EN |B53_IPMC_FWD_EN ; + mgmt |=B53_UC_FWD_EN |B53_MC_FWD_EN |B53_IP_MC ;b53_write8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , mgmt); }else {b53_read8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , &mgmt); - mgmt |=B53_IP_MCAST_25 ; + mgmt |=B53_IP_MC ;b53_write8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , mgmt); } }
drivers/net/dsa/b53/b53_regs.h +1 -2
@@ -104,8 +104,7 @@/* IP Multicast control (8 bit) */ #define B53_IP_MULTICAST_CTRL 0x21 -#define B53_IP_MCAST_25 BIT(0) -#define B53_IPMC_FWD_EN BIT(1) +#define B53_IP_MC BIT(0)#define B53_UC_FWD_EN BIT(6)#define B53_MC_FWD_EN BIT(7)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/187 net: dsa: b53: stop reading ARL entries if search is done
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 0be04b5fa62a82a9929ca261f6c9f64a3d0a28da ]
The switch clears the ARL_SRCH_STDN bit when the search is done, i.e. it finished traversing the ARL table.
This means that there will be no valid result, so we should not attempt to read and process any further entries.
We only ever check the validity of the entries for 4 ARL bin chips, and only after having passed the first entry to the b53_fdb_copy().
This means that we always pass an invalid entry at the end to the b53_fdb_copy(). b53_fdb_copy() does check the validity though before passing on the entry, so it never gets passed on.
On < 4 ARL bin chips, we will even continue reading invalid entries until we reach the result limit.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -1643,7 +1643,7 @@ static int b53_arl_search_wait(struct b53_device *dev) do { b53_read8(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_CTL, ®); if (!(reg & ARL_SRCH_STDN)) - return 0; + return -ENOENT; if (reg & ARL_SRCH_VLID) return 0;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/187 sctp: Hold RCU read lock while iterating over address list
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <[email protected]>
[ Upstream commit 38f50242bf0f237cdc262308d624d333286ec3c5 ]
With CONFIG_PROVE_RCU_LIST=y and by executing
$ netcat -l --sctp & $ netcat --sctp localhost & $ ss --sctp
one can trigger the following Lockdep-RCU splat(s):
WARNING: suspicious RCU usage 6.18.0-rc1-00093-g7f864458e9a6 #5 Not tainted
-----------------------------
net/sctp/diag.c:76 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by ss/215:
#0: ffff9c740828bec0 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{4:4}, at: __netlink_dump_start+0x84/0x2b0 #1: ffff9c7401d72cd0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_sock_dump+0x38/0x200
stack backtrace: CPU: 0 UID: 0 PID: 215 Comm: ss Not tainted 6.18.0-rc1-00093-g7f864458e9a6 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x90 lockdep_rcu_suspicious.cold+0x4e/0xa3 inet_sctp_diag_fill.isra.0+0x4b1/0x5d0 sctp_sock_dump+0x131/0x200 sctp_transport_traverse_process+0x170/0x1b0 ? __pfx_sctp_sock_filter+0x10/0x10 ? __pfx_sctp_sock_dump+0x10/0x10 sctp_diag_dump+0x103/0x140 __inet_diag_dump+0x70/0xb0 netlink_dump+0x148/0x490 __netlink_dump_start+0x1f3/0x2b0 inet_diag_handler_cmd+0xcd/0x100 ? __pfx_inet_diag_dump_start+0x10/0x10 ? __pfx_inet_diag_dump+0x10/0x10 ? __pfx_inet_diag_dump_done+0x10/0x10 sock_diag_rcv_msg+0x18e/0x320 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x4d/0x100 netlink_unicast+0x1d7/0x2b0 netlink_sendmsg+0x203/0x450 ____sys_sendmsg+0x30c/0x340 ___sys_sendmsg+0x94/0xf0 __sys_sendmsg+0x83/0xf0 do_syscall_64+0xbb/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK>
--- net/sctp/diag.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sctp/diag.c +4 -0
@@ -73,19 +73,23 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,struct nlattr *attr;void *info =NULL ; +rcu_read_lock ();list_for_each_entry_rcu (laddr, address_list, list) addrcnt++; +rcu_read_unlock (); attr =nla_reserve (skb,INET_DIAG_LOCALS , addrlen * addrcnt);if (!attr)return -EMSGSIZE ; info =nla_data (attr); +rcu_read_lock ();list_for_each_entry_rcu (laddr, address_list, list) {memcpy (info, &laddr->a,sizeof (laddr->a));memset (info +sizeof (laddr->a),0 , addrlen -sizeof (laddr->a)); info += addrlen; } +rcu_read_unlock ();return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/187 sctp: Prevent TOCTOU out-of-bounds write
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <[email protected]>
[ Upstream commit 95aef86ab231f047bb8085c70666059b58f53c09 ]
For the following path not holding the sock lock,
sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()
make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use).
--- net/sctp/diag.c | 3 +++ 1 file changed, 3 insertions(+)
net/sctp/diag.c +3 -0
@@ -88,6 +88,9 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,memcpy (info, &laddr->a,sizeof (laddr->a));memset (info +sizeof (laddr->a),0 , addrlen -sizeof (laddr->a)); info += addrlen; + +if (!--addrcnt) +break ; }rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/187 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qendrim Maxhuni <[email protected]>
[ Upstream commit e120f46768d98151ece8756ebd688b0e43dc8b29 ]
Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignment checks.
Initialize the MAC header to prevent such crashes.
This can trigger kernel panics on ARM when running IPsec over the qmimux0 interface.
Example trace:
Internal error: Oops: 000000009600004f [#1] SMP
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1
Hardware name: LS1028A RDB Board (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : xfrm_input+0xde8/0x1318
lr : xfrm_input+0x61c/0x1318
sp : ffff800080003b20
Call trace:
xfrm_input+0xde8/0x1318
xfrm6_rcv+0x38/0x44
xfrm6_esp_rcv+0x48/0xa8
ip6_protocol_deliver_rcu+0x94/0x4b0
ip6_input_finish+0x44/0x70
ip6_input+0x44/0xc0
ipv6_rcv+0x6c/0x114
__netif_receive_skb_one_core+0x5c/0x8c
__netif_receive_skb+0x18/0x60
process_backlog+0x78/0x17c
__napi_poll+0x38/0x180
net_rx_action+0x168/0x2f0--- drivers/net/usb/qmi_wwan.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/usb/qmi_wwan.c +6 -0
@@ -229,6 +229,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)return 0 ; skbn->dev = net; +/* Raw IP packets don't have a MAC header, but other subsystems +* (like xfrm) may still access MAC header offsets, so they must +* be initialized. +*/ +skb_reset_mac_header (skbn); +switch (skb->data[offset + qmimux_hdr_sz] &0xf0 ) {case 0x40 : skbn->protocol =htons (ETH_P_IP );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/187 tracing: Fix memory leaks in create_field_var()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 80f0d631dcc76ee1b7755bfca1d8417d91d71414 ]
The function create_field_var() allocates memory for 'val' through create_hist_field() inside parse_atom(), and for 'var' through create_var(), which in turn allocates var->type and var->var.name internally. Simply calling kfree() to release these structures will result in memory leaks.
Use destroy_hist_field() to properly free 'val', and explicitly release the memory of var->type and var->var.name before freeing 'var' itself.
--- kernel/trace/trace_events_hist.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/trace/trace_events_hist.c +4 -2
@@ -3634,14 +3634,16 @@ static struct field_var *create_field_var(struct hist_trigger_data *hist_data, var =create_var (hist_data, file, field_name, val->size, val->type);if (IS_ERR (var)) {hist_err (tr,HIST_ERR_VAR_CREATE_FIND_FAIL ,errpos (field_name)); -kfree (val); +destroy_hist_field (val,0 ); ret =PTR_ERR (var); goto err; } field_var =kzalloc (sizeof (struct field_var ),GFP_KERNEL );if (!field_var) { -kfree (val); +destroy_hist_field (val,0 ); +kfree_const (var->type); +kfree (var->var.name);kfree (var); ret = -ENOMEM ; goto err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/187 extcon: adc-jack: Cleanup wakeup source only if it was enabled
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 92bac7d4de9c07933f6b76d8f1c7f8240f911f4f upstream.
Driver in the probe enables wakeup source conditionally, so the cleanup path should do the same - do not release the wakeup source memory if it was not allocated.
--- drivers/extcon/extcon-adc-jack.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/extcon/extcon-adc-jack.c +2 -1
@@ -162,7 +162,8 @@ static int adc_jack_remove(struct platfo {struct adc_jack_data *data =platform_get_drvdata (pdev); -device_init_wakeup (&pdev->dev, false); +if (data->wakeup_source) +device_init_wakeup (&pdev->dev, false);free_irq (data->irq, data);cancel_work_sync (&data->handler.work);
Greg Kroah-Hartman
maintainerPATCH 125/187 compiler_types: Move unused static inline functions warning to W=2
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
Per Nathan, clang catches unused "static inline" functions in C files since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build").
Quoted 8 lines · Linus
So I entirely ignore W=1 issues, because I think so many of the extra warnings are bogus.
But if this one in particular is causing more problems than most - some teams do seem to use W=1 as part of their test builds - it's fine to send me a patch that just moves bad warnings to W=2.
And if anybody uses W=2 for their test builds, that's THEIR problem..
Here is the change to bump the warning from W=1 to W=2.
--- include/linux/compiler_types.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/compiler_types.h +2 -3
@@ -165,10 +165,9 @@ struct ftrace_likely_data {/* * GCC does not warn about unused static inline functions for -Wunused-function. * Suppress the warning in clang as well by using __maybe_unused, but enable it -* for W=1 build. This will allow clang to find unused functions. Remove the -* __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. +* for W=2 build. This will allow clang to find unused functions. */ -#ifdef KBUILD_EXTRA_WARN1 +#ifdef KBUILD_EXTRA_WARN2 #define __inline_maybe_unused#else #define __inline_maybe_unused __maybe_unused
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/187 NFS4: Fix state renewals missing after boot
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <[email protected]>
[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
Since the last renewal time was initialized to 0 and jiffies start counting at -5 minutes, any clients connected in the first 5 minutes after a reboot would have their renewal timer set to a very long interval. If the connection was idle, this would result in the client state timing out on the server and the next call to the server would return NFS4ERR_BADSESSION.
Fix this by initializing the last renewal time to the current jiffies instead of 0.
--- fs/nfs/nfs4client.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/nfs4client.c +1 -0
@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) clp->cl_state =1 <<NFS4CLNT_LEASE_EXPIRED ; clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; clp->cl_mig_gen =1 ; + clp->cl_last_renewal = jiffies;#if IS_ENABLED (CONFIG_NFS_V4_1 )init_waitqueue_head (&clp->cl_lock_waitq);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/187 HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Lobb <[email protected]>
[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
The Cooler Master Mice Dongle includes a vendor defined HID interface alongside its mouse interface. Not polling it will cause the mouse to stop responding to polls on any interface once woken up again after going into power saving mode.
Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and the Dongle's PID.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -303,6 +303,9 @@#define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500#define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff +#define USB_VENDOR_ID_COOLER_MASTER 0x2516 +#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 +#define USB_VENDOR_ID_CORSAIR 0x1b1c#define USB_DEVICE_ID_CORSAIR_K90 0x1b02
drivers/hid/hid-quirks.c +1 -0
@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/187 ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sharique Mohammad <[email protected]>
[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they are turned on or off, the required startup or shutdown sequences must be taken care by the max98090_shdn_event.
--- sound/soc/codecs/max98090.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/codecs/max98090.c +4 -2
@@ -1231,9 +1231,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {SND_SOC_DAPM_INPUT ("DMIC4" ),SND_SOC_DAPM_SUPPLY ("DMIC3_ENA" ,M98090_REG_DIGITAL_MIC_ENABLE , -M98090_DIGMIC3_SHIFT ,0 ,NULL ,0 ), +M98090_DIGMIC3_SHIFT ,0 , max98090_shdn_event, +SND_SOC_DAPM_POST_PMU ),SND_SOC_DAPM_SUPPLY ("DMIC4_ENA" ,M98090_REG_DIGITAL_MIC_ENABLE , - M98090_DIGMIC4_SHIFT, 0, NULL, 0), +M98090_DIGMIC4_SHIFT ,0 , max98090_shdn_event, + SND_SOC_DAPM_POST_PMU), }; static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/187 net: fec: correct rx_bytes statistic for the case SHIFT16 is set
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit ad17e7e92a7c52ce70bb764813fcf99464f96903 ]
Two additional bytes in front of each frame received into the RX FIFO if SHIFT16 is set, so we need to subtract the extra two bytes from pkt_len to correct the statistic of rx_bytes.
--- drivers/net/ethernet/freescale/fec_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +2 -0
@@ -1530,6 +1530,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id) ndev->stats.rx_packets++; pkt_len =fec16_to_cpu (bdp->cbd_datlen); ndev->stats.rx_bytes += pkt_len; +if (fep->quirks &FEC_QUIRK_HAS_RACC ) + ndev->stats.rx_bytes -=2 ; index =fec_enet_get_bd_index (bdp, &rxq->bd); skb = rxq->rx_skbuff[index];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/187 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <[email protected]>
[ Upstream commit 23d22f2f71768034d6ef86168213843fc49bf550 ]
There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF.
Fix by moving the accesses to btusb data to before the data is free'd.
--- drivers/bluetooth/btusb.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/bluetooth/btusb.c +6 -7
@@ -4004,6 +4004,11 @@ static void btusb_disconnect(struct usb_interface *intf)hci_unregister_dev (hdev); +if (data->oob_wake_irq) +device_init_wakeup (&data->udev->dev, false); +if (data->reset_gpio) +gpiod_put (data->reset_gpio); +if (intf == data->intf) {if (data->isoc)usb_driver_release_interface (&btusb_driver, data->isoc);
@@ -4014,17 +4019,11 @@ static void btusb_disconnect(struct usb_interface *intf)usb_driver_release_interface (&btusb_driver, data->diag);usb_driver_release_interface (&btusb_driver, data->intf); }else if (intf == data->diag) { -usb_driver_release_interface (&btusb_driver, data->intf);if (data->isoc)usb_driver_release_interface (&btusb_driver, data->isoc); +usb_driver_release_interface (&btusb_driver, data->intf); } -if (data->oob_wake_irq) -device_init_wakeup (&data->udev->dev, false); - -if (data->reset_gpio) -gpiod_put (data->reset_gpio); -hci_free_dev (hdev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/187 Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 3b78f50918276ab28fb22eac9aa49401ac436a3b ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace: <IRQ> ... packet_rcv (net/packet/af_packet.c:2152) ... <TASK>
__local_bh_enable_ip (kernel/softirq.c:407)netif_rx (net/core/dev.c:5648)chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
--- net/bluetooth/6lowpan.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/6lowpan.c +1 -0
@@ -317,6 +317,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev, local_skb->pkt_type =PACKET_HOST ; local_skb->dev = dev; +skb_reset_mac_header (local_skb);skb_set_transport_header (local_skb,sizeof (struct ipv6hdr ));if (give_skb_to_upper (local_skb, dev) !=NET_RX_SUCCESS ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/187 Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit b454505bf57a2e4f5d49951d4deb03730a9348d9 ]
Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types, e.g. debugfs "connect" command takes the former, and "disconnect" and "connect" to already connected device take the latter. This is due to using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le which take different dst_type values.
Fix address type passed to hci_conn_hash_lookup_le().
Retain the debugfs API difference between "connect" and "disconnect" commands since it's been like this since 2015 and nobody apparently complained.
--- net/bluetooth/6lowpan.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
net/bluetooth/6lowpan.c +24 -4
@@ -986,10 +986,11 @@ static struct l2cap_chan *bt_6lowpan_listen(void) }static int get_l2cap_conn (char *buf,bdaddr_t *addr,u8 *addr_type, -struct l2cap_conn **conn) +struct l2cap_conn **conn,bool disconnect) {struct hci_conn *hcon;struct hci_dev *hdev; +int le_addr_type;int n; n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
@@ -1000,13 +1001,32 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,if (n <7 )return -EINVAL ; +if (disconnect) { +/* The "disconnect" debugfs command has used different address +* type constants than "connect" since 2015. Let's retain that +* for now even though it's obviously buggy... +*/ + *addr_type +=1 ; + } + +switch (*addr_type) { +case BDADDR_LE_PUBLIC : + le_addr_type =ADDR_LE_DEV_PUBLIC ; +break ; +case BDADDR_LE_RANDOM : + le_addr_type =ADDR_LE_DEV_RANDOM ; +break ; +default : +return -EINVAL ; + } +/* The LE_PUBLIC address type is ignored because of BDADDR_ANY */ hdev =hci_get_route (addr,BDADDR_ANY ,BDADDR_LE_PUBLIC );if (!hdev)return -ENOENT ;hci_dev_lock (hdev); - hcon =hci_conn_hash_lookup_le (hdev, addr, *addr_type); + hcon =hci_conn_hash_lookup_le (hdev, addr, le_addr_type);hci_dev_unlock (hdev);hci_dev_put (hdev);
@@ -1133,7 +1153,7 @@ static ssize_t lowpan_control_write(struct file *fp, buf[buf_size] ='\0' ;if (memcmp (buf,"connect " ,8 ) ==0 ) { - ret =get_l2cap_conn (&buf[8 ], &addr, &addr_type, &conn); + ret =get_l2cap_conn (&buf[8 ], &addr, &addr_type, &conn, false);if (ret == -EINVAL )return ret;
@@ -1170,7 +1190,7 @@ static ssize_t lowpan_control_write(struct file *fp, }if (memcmp (buf,"disconnect " ,11 ) ==0 ) { - ret =get_l2cap_conn (&buf[11 ], &addr, &addr_type, &conn); + ret =get_l2cap_conn (&buf[11 ], &addr, &addr_type, &conn, true);if (ret <0 )return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/187 Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 98454bc812f3611551e4b1f81732da4aa7b9597e ]
disconnect_all_peers() calls sleeping function (l2cap_chan_close) under spinlock. Holding the lock doesn't actually do any good -- we work on a local copy of the list, and the lock doesn't protect against peer->chan having already been freed.
Fix by taking refcounts of peer->chan instead. Clean up the code and old comments a bit.
Take devices_lock instead of RCU, because the kfree_rcu(); l2cap_chan_put(); construct in chan_close_cb() does not guarantee peer->chan is necessarily valid in RCU.
Also take l2cap_chan_lock() which is required for l2cap_chan_close().
Log: (bluez 6lowpan-tester Client Connect - Disable)
------
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 ... <TASK>
...l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495)
...
? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809)do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068)
------
--- net/bluetooth/6lowpan.c | 68 ++++++++++++++++++++++++++--------------- 1 file changed, 43 insertions(+), 25 deletions(-)
net/bluetooth/6lowpan.c +43 -25
@@ -52,6 +52,11 @@ static bool enable_6lowpan;static struct l2cap_chan *listen_chan;static DEFINE_MUTEX (set_lock); +enum { +LOWPAN_PEER_CLOSING , +LOWPAN_PEER_MAXBITS +}; +struct lowpan_peer {struct list_head list;struct rcu_head rcu;
@@ -60,6 +65,8 @@ struct lowpan_peer {/* peer addresses in various formats */ unsigned char lladdr[ETH_ALEN ];struct in6_addr peer_addr; + +DECLARE_BITMAP (flags,LOWPAN_PEER_MAXBITS ); };struct lowpan_btle_dev {
@@ -1043,41 +1050,52 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,static void disconnect_all_peers (void ) {struct lowpan_btle_dev *entry; -struct lowpan_peer *peer, *tmp_peer, *new_peer; -struct list_head peers; - -INIT_LIST_HEAD (&peers); +struct lowpan_peer *peer; +int nchans; -/* We make a separate list of peers as the close_cb() will -* modify the device peers list so it is better not to mess -* with the same list at the same time. +/* l2cap_chan_close() cannot be called from RCU, and lock ordering +* chan->lock > devices_lock prevents taking write side lock, so copy +* then close. */ rcu_read_lock (); +list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) +list_for_each_entry_rcu (peer, &entry->peers, list) +clear_bit (LOWPAN_PEER_CLOSING , peer->flags); +rcu_read_unlock (); -list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) { -list_for_each_entry_rcu (peer, &entry->peers, list) { - new_peer =kmalloc (sizeof (*new_peer),GFP_ATOMIC ); -if (!new_peer) -break ; +do { +struct l2cap_chan *chans[32 ]; +int i; - new_peer->chan = peer->chan; -INIT_LIST_HEAD (&new_peer->list); + nchans =0 ; -list_add (&new_peer->list, &peers); - } - } +spin_lock (&devices_lock); -rcu_read_unlock (); +list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) { +list_for_each_entry_rcu (peer, &entry->peers, list) { +if (test_and_set_bit (LOWPAN_PEER_CLOSING , + peer->flags)) +continue ; -spin_lock (&devices_lock); -list_for_each_entry_safe (peer, tmp_peer, &peers, list) { -l2cap_chan_close (peer->chan,ENOENT ); +l2cap_chan_hold (peer->chan); + chans[nchans++] = peer->chan; -list_del_rcu (&peer->list); -kfree_rcu (peer, rcu); - } -spin_unlock (&devices_lock); +if (nchans >=ARRAY_SIZE (chans)) + goto done; + } + } + +done: +spin_unlock (&devices_lock); + +for (i =0 ; i < nchans; ++i) { +l2cap_chan_lock (chans[i]); +l2cap_chan_close (chans[i],ENOENT ); +l2cap_chan_unlock (chans[i]); +l2cap_chan_put (chans[i]); + } + }while (nchans); }struct set_enable {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/187 sctp: get netns from asoc and ep base
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 4e7696d90b51a1a73ce0e8174f3aff58b914619c ]
Commit 312434617cb1 ("sctp: cache netns in sctp_ep_common") set netns in asoc and ep base since they're created, and it will never change. It's a better way to get netns from asoc and ep base, comparing to calling sock_net().
This patch is to replace them.
v1->v2:
- no change.
Stable-dep-of: 1534ff77757e ("sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto")
--- net/sctp/associola.c | 10 +++++----- net/sctp/chunk.c | 2 +- net/sctp/endpointola.c | 6 +++--- net/sctp/input.c | 5 ++--- net/sctp/output.c | 2 +- net/sctp/outqueue.c | 6 +++--- net/sctp/sm_make_chunk.c | 7 +++---- net/sctp/sm_sideeffect.c | 16 ++++++---------- net/sctp/sm_statefuns.c | 2 +- net/sctp/socket.c | 12 +++++------- net/sctp/stream.c | 3 +-- net/sctp/stream_interleave.c | 23 ++++++++++------------- net/sctp/transport.c | 2 +- net/sctp/ulpqueue.c | 15 +++++++-------- 14 files changed, 49 insertions(+), 62 deletions(-)
net/sctp/associola.c +5 -5
@@ -579,7 +579,6 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,const gfp_t gfp, const int peer_state) { - struct net *net = sock_net(asoc->base.sk); struct sctp_transport *peer;struct sctp_sock *sp;unsigned short port;
@@ -609,7 +608,7 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,return peer; } - peer =sctp_transport_new (net, addr, gfp); + peer =sctp_transport_new (asoc->base.net, addr, gfp);if (!peer)return NULL ;
@@ -978,7 +977,7 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)struct sctp_association *asoc = container_of(work, struct sctp_association, base.inqueue.immediate); -struct net *net =sock_net (asoc->base.sk); +struct net *net = asoc->base.net;union sctp_subtype subtype;struct sctp_endpoint *ep;struct sctp_chunk *chunk;
@@ -1445,7 +1444,8 @@ void sctp_assoc_sync_pmtu(struct sctp_association *asoc)/* Should we send a SACK to update our peer? */ static inline bool sctp_peer_needs_update (struct sctp_association *asoc) { -struct net *net =sock_net (asoc->base.sk); +struct net *net = asoc->base.net; +switch (asoc->state) {case SCTP_STATE_ESTABLISHED :case SCTP_STATE_SHUTDOWN_PENDING :
@@ -1582,7 +1582,7 @@ int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,if (asoc->peer.ipv6_address) flags |=SCTP_ADDR6_PEERSUPP ; -return sctp_bind_addr_copy (sock_net (asoc->base.sk), +return sctp_bind_addr_copy (asoc->base.net, &asoc->base.bind_addr, &asoc->ep->base.bind_addr, scope, gfp, flags);
net/sctp/chunk.c +1 -1
@@ -227,7 +227,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,if (msg_len >= first_len) { msg->can_delay =0 ;if (msg_len > first_len) -SCTP_INC_STATS (sock_net (asoc->base.sk), +SCTP_INC_STATS (asoc->base.net,SCTP_MIB_FRAGUSRMSGS ); }else {/* Which may be the only one... */
net/sctp/endpointola.c +3 -3
@@ -251,7 +251,7 @@ struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *ep,struct sctp_endpoint *retval =NULL ;if ((htons (ep->base.bind_addr.port) == laddr->v4.sin_port) && -net_eq (sock_net (ep->base.sk), net)) { +net_eq (ep->base.net, net)) {if (sctp_bind_addr_match (&ep->base.bind_addr, laddr,sctp_sk (ep->base.sk))) retval = ep;
@@ -299,8 +299,8 @@ bool sctp_endpoint_is_peeled_off(struct sctp_endpoint *ep, const union sctp_addr *paddr) {struct sctp_sockaddr_entry *addr; +struct net *net = ep->base.net;struct sctp_bind_addr *bp; -struct net *net =sock_net (ep->base.sk); bp = &ep->base.bind_addr;/* This function is called with the socket lock held,
@@ -391,7 +391,7 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)if (asoc &&sctp_chunk_is_data (chunk)) asoc->peer.last_data_from = chunk->transport;else { -SCTP_INC_STATS (sock_net (ep->base.sk),SCTP_MIB_INCTRLCHUNKS ); +SCTP_INC_STATS (ep->base.net,SCTP_MIB_INCTRLCHUNKS );if (asoc) asoc->stats.ictrlchunks++; }
net/sctp/input.c +2 -3
@@ -935,7 +935,7 @@ int sctp_hash_transport(struct sctp_transport *t)if (t->asoc->temp)return 0 ; - arg.net =sock_net (t->asoc->base.sk); + arg.net = t->asoc->base.net; arg.paddr = &t->ipaddr; arg.lport =htons (t->asoc->base.bind_addr.port);
@@ -1002,12 +1002,11 @@ struct sctp_transport *sctp_epaddr_lookup_transport(const struct sctp_endpoint *ep, const union sctp_addr *paddr) { - struct net *net = sock_net(ep->base.sk); struct rhlist_head *tmp, *list;struct sctp_transport *t;struct sctp_hash_cmp_arg arg = { .paddr = paddr, - .net = net, + .net = ep->base.net, .lport =htons (ep->base.bind_addr.port), };
net/sctp/output.c +1 -1
@@ -282,7 +282,7 @@ static enum sctp_xmit sctp_packet_bundle_sack(struct sctp_packet *pkt,sctp_chunk_free (sack); goto out; } -SCTP_INC_STATS (sock_net (asoc->base.sk), +SCTP_INC_STATS (asoc->base.net,SCTP_MIB_OUTCTRLCHUNKS ); asoc->stats.octrlchunks++; asoc->peer.sack_needed =0 ;
net/sctp/outqueue.c +3 -3
@@ -280,7 +280,7 @@ void sctp_outq_free(struct sctp_outq *q)/* Put a new chunk in an sctp_outq. */ void sctp_outq_tail (struct sctp_outq *q,struct sctp_chunk *chunk,gfp_t gfp) { -struct net *net =sock_net (q->asoc->base.sk); +struct net *net = q->asoc->base.net; pr_debug("%s: outq:%p, chunk:%p[%s]\n", __func__, q, chunk, chunk && chunk->chunk_hdr ?
@@ -534,7 +534,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,void sctp_retransmit (struct sctp_outq *q,struct sctp_transport *transport,enum sctp_retransmit_reason reason) { -struct net *net =sock_net (q->asoc->base.sk); +struct net *net = q->asoc->base.net;switch (reason) {case SCTP_RTXR_T3_RTX :
@@ -1890,6 +1890,6 @@ void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 ctsn)if (ftsn_chunk) {list_add_tail (&ftsn_chunk->list, &q->control_chunk_list); -SCTP_INC_STATS (sock_net (asoc->base.sk),SCTP_MIB_OUTCTRLCHUNKS ); +SCTP_INC_STATS (asoc->base.net,SCTP_MIB_OUTCTRLCHUNKS ); } }
net/sctp/sm_make_chunk.c +3 -4
@@ -2319,7 +2319,6 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,const union sctp_addr *peer_addr, struct sctp_init_chunk *peer_init, gfp_t gfp) { - struct net *net = sock_net(asoc->base.sk); struct sctp_transport *transport;struct list_head *pos, *temp;union sctp_params param;
@@ -2377,8 +2376,8 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,* also give us an option to silently ignore the packet, which * is what we'll do here. */ -if (!net->sctp.addip_noauth && - (asoc->peer.asconf_capable && !asoc->peer.auth_capable)) { +if (!asoc->base.net->sctp.addip_noauth && + (asoc->peer.asconf_capable && !asoc->peer.auth_capable)) { asoc->peer.addip_disabled_mask |= (SCTP_PARAM_ADD_IP |SCTP_PARAM_DEL_IP |SCTP_PARAM_SET_PRIMARY );
@@ -2505,9 +2504,9 @@ static int sctp_process_param(struct sctp_association *asoc, const union sctp_addr *peer_addr, gfp_t gfp) { - struct net *net = sock_net(asoc->base.sk);struct sctp_endpoint *ep = asoc->ep;union sctp_addr_param *addr_param; +struct net *net = asoc->base.net;struct sctp_transport *t;enum sctp_scope scope;union sctp_addr addr;
net/sctp/sm_sideeffect.c +6 -10
@@ -520,8 +520,6 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,struct sctp_transport *transport, int is_hb) { -struct net *net =sock_net (asoc->base.sk); -/* The check for association's overall error counter exceeding the * threshold is done in the state function. */
@@ -548,10 +546,10 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,* is SCTP_ACTIVE, then mark this transport as Partially Failed, * see SCTP Quick Failover Draft, section 5.1 */ -if (net->sctp.pf_enable && - (transport->state ==SCTP_ACTIVE ) && - (transport->error_count < transport->pathmaxrxt) && - (transport->error_count > transport->pf_retrans)) { +if (asoc->base.net->sctp.pf_enable && + transport->state ==SCTP_ACTIVE && + transport->error_count < transport->pathmaxrxt && + transport->error_count > transport->pf_retrans) { sctp_assoc_control_transport(asoc, transport, SCTP_TRANSPORT_PF,
@@ -797,10 +795,8 @@ static int sctp_cmd_process_sack(struct sctp_cmd_seq *cmds,int err =0 ;if (sctp_outq_sack (&asoc->outqueue, chunk)) { -struct net *net =sock_net (asoc->base.sk); -/* There are no more TSNs awaiting SACK. */ - err =sctp_do_sm (net,SCTP_EVENT_T_OTHER , + err =sctp_do_sm (asoc->base.net,SCTP_EVENT_T_OTHER ,SCTP_ST_OTHER (SCTP_EVENT_NO_PENDING_TSN ), asoc->state, asoc->ep, asoc,NULL ,GFP_ATOMIC );
@@ -833,7 +829,7 @@ static void sctp_cmd_assoc_update(struct sctp_cmd_seq *cmds,struct sctp_association *asoc, struct sctp_association *new) { - struct net *net = sock_net(asoc->base.sk); + struct net *net = asoc->base.net;struct sctp_chunk *abort;if (!sctp_assoc_update (asoc, new))
net/sctp/sm_statefuns.c +1 -1
@@ -1342,7 +1342,7 @@ static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,struct sctp_chunk *init, struct sctp_cmd_seq *commands) { - struct net *net = sock_net(new_asoc->base.sk); + struct net *net = new_asoc->base.net;struct sctp_transport *new_addr;int ret =1 ;
net/sctp/socket.c +5 -7
@@ -466,8 +466,7 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)static int sctp_send_asconf (struct sctp_association *asoc,struct sctp_chunk *chunk) { -struct net *net =sock_net (asoc->base.sk); -int retval =0 ; +int retval =0 ;/* If there is an outstanding ASCONF chunk, queue it for later * transmission.
@@ -479,7 +478,7 @@ static int sctp_send_asconf(struct sctp_association *asoc,/* Hold the chunk until an ASCONF_ACK is received. */ sctp_chunk_hold (chunk); - retval =sctp_primitive_ASCONF (net, asoc, chunk); + retval =sctp_primitive_ASCONF (asoc->base.net, asoc, chunk);if (retval)sctp_chunk_free (chunk);else
@@ -2462,9 +2461,8 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,int error;if (params->spp_flags &SPP_HB_DEMAND && trans) { -struct net *net =sock_net (trans->asoc->base.sk); - - error =sctp_primitive_REQUESTHEARTBEAT (net, trans->asoc, trans); + error =sctp_primitive_REQUESTHEARTBEAT (trans->asoc->base.net, + trans->asoc, trans);if (error)return error; }
@@ -5334,7 +5332,7 @@ struct sctp_transport *sctp_transport_get_next(struct net *net,if (!sctp_transport_hold (t))continue ; -if (net_eq (sock_net (t->asoc->base.sk), net) && +if (net_eq (t->asoc->base.net, net) && t->asoc->peer.primary_path == t)break ;
net/sctp/stream.c +1 -2
@@ -229,10 +229,9 @@ void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)static int sctp_send_reconf (struct sctp_association *asoc,struct sctp_chunk *chunk) { -struct net *net =sock_net (asoc->base.sk);int retval =0 ; - retval =sctp_primitive_RECONF (net, asoc, chunk); + retval =sctp_primitive_RECONF (asoc->base.net, asoc, chunk);if (retval)sctp_chunk_free (chunk);
net/sctp/stream_interleave.c +10 -13
@@ -241,9 +241,8 @@ static struct sctp_ulpevent *sctp_intl_retrieve_partial(if (!first_frag)return NULL ; - retval =sctp_make_reassembled_event (sock_net (ulpq->asoc->base.sk), - &ulpq->reasm, first_frag, - last_frag); + retval =sctp_make_reassembled_event (ulpq->asoc->base.net, &ulpq->reasm, + first_frag, last_frag);if (retval) { sin->fsn = next_fsn;if (is_last) {
@@ -326,7 +325,7 @@ static struct sctp_ulpevent *sctp_intl_retrieve_reassembled( pd_point =sctp_sk (asoc->base.sk)->pd_point;if (pd_point && pd_point <= pd_len) { - retval =sctp_make_reassembled_event (sock_net (asoc->base.sk), + retval =sctp_make_reassembled_event (asoc->base.net, &ulpq->reasm, pd_first, pd_last);if (retval) {
@@ -337,8 +336,7 @@ static struct sctp_ulpevent *sctp_intl_retrieve_reassembled( goto out; found: - retval =sctp_make_reassembled_event (sock_net (asoc->base.sk), - &ulpq->reasm, + retval =sctp_make_reassembled_event (asoc->base.net, &ulpq->reasm, first_frag, pos);if (retval) retval->msg_flags |=MSG_EOR ;
@@ -630,7 +628,7 @@ static struct sctp_ulpevent *sctp_intl_retrieve_partial_uo(if (!first_frag)return NULL ; - retval =sctp_make_reassembled_event (sock_net (ulpq->asoc->base.sk), + retval =sctp_make_reassembled_event (ulpq->asoc->base.net, &ulpq->reasm_uo, first_frag, last_frag);if (retval) {
@@ -716,7 +714,7 @@ static struct sctp_ulpevent *sctp_intl_retrieve_reassembled_uo( pd_point =sctp_sk (asoc->base.sk)->pd_point;if (pd_point && pd_point <= pd_len) { - retval =sctp_make_reassembled_event (sock_net (asoc->base.sk), + retval =sctp_make_reassembled_event (asoc->base.net, &ulpq->reasm_uo, pd_first, pd_last);if (retval) {
@@ -727,8 +725,7 @@ static struct sctp_ulpevent *sctp_intl_retrieve_reassembled_uo( goto out; found: - retval =sctp_make_reassembled_event (sock_net (asoc->base.sk), - &ulpq->reasm_uo, + retval =sctp_make_reassembled_event (asoc->base.net, &ulpq->reasm_uo, first_frag, pos);if (retval) retval->msg_flags |=MSG_EOR ;
@@ -814,7 +811,7 @@ static struct sctp_ulpevent *sctp_intl_retrieve_first_uo(struct sctp_ulpq *ulpq)return NULL ; out: - retval =sctp_make_reassembled_event (sock_net (ulpq->asoc->base.sk), + retval =sctp_make_reassembled_event (ulpq->asoc->base.net, &ulpq->reasm_uo, first_frag, last_frag);if (retval) {
@@ -921,7 +918,7 @@ static struct sctp_ulpevent *sctp_intl_retrieve_first(struct sctp_ulpq *ulpq)return NULL ; out: - retval =sctp_make_reassembled_event (sock_net (ulpq->asoc->base.sk), + retval =sctp_make_reassembled_event (ulpq->asoc->base.net, &ulpq->reasm, first_frag, last_frag);if (retval) {
@@ -1159,7 +1156,7 @@ static void sctp_generate_iftsn(struct sctp_outq *q, __u32 ctsn)if (ftsn_chunk) {list_add_tail (&ftsn_chunk->list, &q->control_chunk_list); -SCTP_INC_STATS (sock_net (asoc->base.sk),SCTP_MIB_OUTCTRLCHUNKS ); +SCTP_INC_STATS (asoc->base.net,SCTP_MIB_OUTCTRLCHUNKS ); } }
net/sctp/transport.c +1 -1
@@ -336,7 +336,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)pr_debug ("%s: rto_pending not set on transport %p!\n" , __func__, tp);if (tp->rttvar || tp->srtt) { -struct net *net =sock_net (tp->asoc->base.sk); +struct net *net = tp->asoc->base.net;/* 6.3.1 C3) When a new RTT measurement R' is made, set * RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'| * SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
net/sctp/ulpqueue.c +7 -8
@@ -486,10 +486,9 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_reassembled(struct sctp_ulpq *ul cevent =sctp_skb2event (pd_first); pd_point =sctp_sk (asoc->base.sk)->pd_point;if (pd_point && pd_point <= pd_len) { - retval =sctp_make_reassembled_event (sock_net (asoc->base.sk), + retval =sctp_make_reassembled_event (asoc->base.net, &ulpq->reasm, - pd_first, - pd_last); + pd_first, pd_last);if (retval)sctp_ulpq_set_pd (ulpq); }
@@ -497,7 +496,7 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_reassembled(struct sctp_ulpq *ul done:return retval; found: - retval =sctp_make_reassembled_event (sock_net (ulpq->asoc->base.sk), + retval =sctp_make_reassembled_event (ulpq->asoc->base.net, &ulpq->reasm, first_frag, pos);if (retval) retval->msg_flags |=MSG_EOR ;
@@ -563,8 +562,8 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_partial(struct sctp_ulpq *ulpq)* further. */ done: - retval =sctp_make_reassembled_event (sock_net (ulpq->asoc->base.sk), - &ulpq->reasm, first_frag, last_frag); + retval =sctp_make_reassembled_event (ulpq->asoc->base.net, &ulpq->reasm, + first_frag, last_frag);if (retval && is_last) retval->msg_flags |=MSG_EOR ;
@@ -664,8 +663,8 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_first(struct sctp_ulpq *ulpq)* further. */ done: - retval =sctp_make_reassembled_event (sock_net (ulpq->asoc->base.sk), - &ulpq->reasm, first_frag, last_frag); + retval =sctp_make_reassembled_event (ulpq->asoc->base.net, &ulpq->reasm, + first_frag, last_frag);return retval; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/187 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 1534ff77757e44bcc4b98d0196bc5c0052fce5fa ]
syzbot reported a possible shift-out-of-bounds [1]
Blamed commit added rto_alpha_max and rto_beta_max set to 1000.
It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta.
In order to prevent user regression, perform the test at run time.
Also add READ_ONCE() annotations as sysctl values can change under us.
[1]
UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]
--- net/sctp/transport.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/sctp/transport.c +9 -4
@@ -337,6 +337,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)if (tp->rttvar || tp->srtt) {struct net *net = tp->asoc->base.net; +unsigned int rto_beta, rto_alpha;/* 6.3.1 C3) When a new RTT measurement R' is made, set * RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'| * SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
@@ -348,10 +349,14 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)* For example, assuming the default value of RTO.Alpha of * 1/8, rto_alpha would be expressed as 3. */ - tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta) - + (((__u32 )abs ((__s64 )tp->srtt - (__s64 )rtt)) >> net->sctp.rto_beta); - tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha) - + (rtt >> net->sctp.rto_alpha); + rto_beta =READ_ONCE (net->sctp.rto_beta); +if (rto_beta <32 ) + tp->rttvar = tp->rttvar - (tp->rttvar >> rto_beta) + + (((__u32 )abs ((__s64 )tp->srtt - (__s64 )rtt)) >> rto_beta); + rto_alpha =READ_ONCE (net->sctp.rto_alpha); +if (rto_alpha <32 ) + tp->srtt = tp->srtt - (tp->srtt >> rto_alpha) + + (rtt >> rto_alpha); }else {/* 6.3.1 C2) When the first RTT measurement R is made, set * SRTT <- R, RTTVAR <- R/2.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/187 tipc: simplify the finalize work queue
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit be07f056396d6bb40963c45a02951c566ddeef8e ]
This patch is to use "struct work_struct" for the finalize work queue instead of "struct tipc_net_work", as it can get the "net" and "addr" from tipc_net's other members and there is no need to add extra net and addr in tipc_net by defining "struct tipc_net_work".
Note that it's safe to get net from tn->bcl as bcl is always released after the finalize work queue is done.
Stable-dep-of: 0725e6afb551 ("tipc: Fix use-after-free in tipc_mon_reinit_self().")
--- net/tipc/core.c | 4 ++-- net/tipc/core.h | 8 +------- net/tipc/discover.c | 4 ++-- net/tipc/link.c | 5 +++++ net/tipc/link.h | 1 + net/tipc/net.c | 15 +++------------ 6 files changed, 14 insertions(+), 23 deletions(-)
net/tipc/core.c +2 -2
@@ -59,7 +59,7 @@ static int __net_init tipc_init_net(struct net *net) tn->trial_addr =0 ; tn->addr_trial_end =0 ; tn->capabilities =TIPC_NODE_CAPABILITIES ; -INIT_WORK (&tn->final_work.work, tipc_net_finalize_work); +INIT_WORK (&tn->work, tipc_net_finalize_work);memset (tn->node_id,0 ,sizeof (tn->node_id));memset (tn->node_id_string,0 ,sizeof (tn->node_id_string)); tn->mon_threshold =TIPC_DEF_MON_THRESHOLD ;
@@ -101,7 +101,7 @@ static void __net_exit tipc_exit_net(struct net *net)tipc_detach_loopback (net);/* Make sure the tipc_net_finalize_work() finished */ -cancel_work_sync (&tn->final_work.work); +cancel_work_sync (&tn->work);tipc_net_stop (net);tipc_bcast_stop (net);
net/tipc/core.h +1 -7
@@ -87,12 +87,6 @@ extern unsigned int tipc_net_id __read_mostly;extern int sysctl_tipc_rmem[3 ]__read_mostly ;extern int sysctl_tipc_named_timeout__read_mostly ; -struct tipc_net_work { -struct work_struct work; -struct net *net; -u32 addr; -}; -struct tipc_net {u8 node_id[NODE_ID_LEN ];u32 node_addr;
@@ -143,7 +137,7 @@ struct tipc_net {struct packet_type loopback_pt;/* Work item for net finalize */ -struct tipc_net_work final_work; +struct work_struct work;/* The numbers of work queues in schedule */ atomic_t wq_count; };
net/tipc/discover.c +2 -2
@@ -167,7 +167,7 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,/* Apply trial address if we just left trial period */ if (!trial && !self) { -tipc_sched_net_finalize (net, tn->trial_addr); +schedule_work (&tn->work);msg_set_prevnode (buf_msg (d->skb), tn->trial_addr);msg_set_type (buf_msg (d->skb),DSC_REQ_MSG ); }
@@ -310,7 +310,7 @@ static void tipc_disc_timeout(struct timer_list *t)if (!time_before (jiffies, tn->addr_trial_end) && !tipc_own_addr (net)) {mod_timer (&d->timer, jiffies +TIPC_DISC_INIT );spin_unlock_bh (&d->lock); -tipc_sched_net_finalize (net, tn->trial_addr); +schedule_work (&tn->work);return ; }
net/tipc/link.c +5 -0
@@ -332,6 +332,11 @@ char tipc_link_plane(struct tipc_link *l)return l->net_plane; } +struct net *tipc_link_net (struct tipc_link *l) +{ +return l->net; +} +void tipc_link_update_caps (struct tipc_link *l,u16 capabilities) { l->peer_caps = capabilities;
net/tipc/link.h +1 -0
@@ -151,4 +151,5 @@ int tipc_link_bc_sync_rcv(struct tipc_link *l, struct tipc_msg *hdr,int tipc_link_bc_nack_rcv (struct tipc_link *l,struct sk_buff *skb,struct sk_buff_head *xmitq);bool tipc_link_too_silent (struct tipc_link *l); +struct net *tipc_link_net (struct tipc_link *l);#endif
net/tipc/net.c +3 -12
@@ -41,6 +41,7 @@#include "socket.h" #include "node.h" #include "bcast.h" +#include "link.h" #include "netlink.h" #include "monitor.h"
@@ -138,19 +139,9 @@ static void tipc_net_finalize(struct net *net, u32 addr)void tipc_net_finalize_work (struct work_struct *work) { -struct tipc_net_work *fwork; + struct tipc_net *tn = container_of(work, struct tipc_net, work); - fwork = container_of(work, struct tipc_net_work, work); -tipc_net_finalize (fwork->net, fwork->addr); -} - -void tipc_sched_net_finalize (struct net *net,u32 addr) -{ -struct tipc_net *tn =tipc_net (net); - - tn->final_work.net = net; - tn->final_work.addr = addr; -schedule_work (&tn->final_work.work); +tipc_net_finalize (tipc_link_net (tn->bcl), tn->trial_addr); }void tipc_net_stop (struct net *net)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/187 tipc: Fix use-after-free in tipc_mon_reinit_self().
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 0725e6afb55128be21a2ca36e9674f573ccec173 ]
syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0]
The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL.
tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work().
Let's hold RTNL in tipc_net_finalize_work().
[0]:
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989
CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events tipc_net_finalize_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]
rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]
rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244
rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243
write_lock_bh include/linux/rwlock_rt.h:99 [inline]
tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718
tipc_net_finalize+0x115/0x190 net/tipc/net.c:140
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6089:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657
tipc_enable_bearer net/tipc/bearer.c:357 [inline]
__tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047
__tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]
tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393
tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]
tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:729
____sys_sendmsg+0x508/0x820 net/socket.c:2614
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6088:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x195/0x550 mm/slub.c:4894
tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166
unregister_netdevice_many net/core/dev.c:12229 [inline]
unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073
unregister_netdevice include/linux/netdevice.h:3385 [inline]
__tun_detach+0xe4d/0x1620 drivers/net/tun.c:621
tun_detach drivers/net/tun.c:637 [inline]
tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433
__fput+0x458/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/tipc/net.c | 2 ++ 1 file changed, 2 insertions(+)
net/tipc/net.c +2 -0
@@ -141,7 +141,9 @@ void tipc_net_finalize_work(struct work_struct *work) { struct tipc_net *tn = container_of(work, struct tipc_net, work); +rtnl_lock ();tipc_net_finalize (tipc_link_net (tn->bcl), tn->trial_addr); +rtnl_unlock (); }void tipc_net_stop (struct net *net)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/187 net: mdio: fix resource leak in mdiobus_register_device()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Buday Csaba <[email protected]>
[ Upstream commit e6ca8f533ed41129fcf052297718f417f021cc7d ]
Fix a possible leak in mdiobus_register_device() when both a reset-gpio and a reset-controller are present.
Clean up the already claimed reset-gpio, when the registration of the reset-controller fails, so when an error code is returned, the device retains its state before the registration attempt.
--- drivers/net/phy/mdio_bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/phy/mdio_bus.c +4 -1
@@ -89,8 +89,11 @@ int mdiobus_register_device(struct mdio_device *mdiodev)return err; err =mdiobus_register_reset (mdiodev); -if (err) +if (err) { +gpiod_put (mdiodev->reset_gpio); + mdiodev->reset_gpio =NULL ;return err; + }/* Assert the reset signal */ mdio_device_reset (mdiodev,1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/187 wifi: mac80211: skip rate verification for not captured PSDUs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 7fe0d21f5633af8c3fab9f0ef0706c6156623484 ]
If for example the sniffer did not follow any AIDs in an MU frame, then some of the information may not be filled in or is even expected to be invalid. As an example, in that case it is expected that Nss is zero.
--- net/mac80211/rx.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/mac80211/rx.c +7 -3
@@ -4669,10 +4669,14 @@ void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,if (WARN_ON (!local->started)) goto drop; -if (likely (!(status->flag &RX_FLAG_FAILED_PLCP_CRC ))) { +if (likely (!(status->flag &RX_FLAG_FAILED_PLCP_CRC ) && + !(status->flag &RX_FLAG_NO_PSDU && + status->zero_length_psdu_type == +IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED ))) {/* -* Validate the rate, unless a PLCP error means that -* we probably can't have a valid rate here anyway. +* Validate the rate, unless there was a PLCP error which may +* have an invalid rate or the PSDU was not capture and may be +* missing rate information. */ switch (status->encoding) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 140/187 net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <[email protected]>
[ Upstream commit ce50039be49eea9b4cd8873ca6eccded1b4a130a ]
Fix a KMSAN kernel-infoleak detected by the syzbot .
[net?] KMSAN: kernel-infoleak in __skb_datagram_iter
In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied.
This change silences the KMSAN report and prevents potential information leaks from the kernel memory.
This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak.
--- net/sched/act_ife.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/sched/act_ife.c +7 -5
@@ -642,13 +642,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind,unsigned char *b =skb_tail_pointer (skb);struct tcf_ife_info *ife =to_ife (a);struct tcf_ife_params *p; -struct tc_ife opt = { - .index = ife->tcf_index, - .refcnt =refcount_read (&ife->tcf_refcnt) - ref, - .bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, - }; +struct tc_ife opt;struct tcf_t t; +memset (&opt,0 ,sizeof (opt)); + + opt.index = ife->tcf_index, + opt.refcnt =refcount_read (&ife->tcf_refcnt) - ref, + opt.bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, +spin_lock_bh (&ife->tcf_lock); opt.action = ife->tcf_action; p = rcu_dereference_protected(ife->params,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 141/187 net/mlx5e: Fix maxrate wraparound in threshold between units
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit a7bf4d5063c7837096aab2853224eb23628514d9 ]
The previous calculation used roundup() which caused an overflow for rates between 25.5Gbps and 26Gbps.
For example, a rate of 25.6Gbps would result in using 100Mbps units with value of 256, which would overflow the 8 bits field.
Simplify the upper_limit_mbps calculation by removing the unnecessary roundup, and adjust the comparison to use <= to correctly handle the boundary condition.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +3 -2
@@ -579,18 +579,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,struct mlx5_core_dev *mdev = priv->mdev;u8 max_bw_value[IEEE_8021QAZ_MAX_TCS ];u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS ]; -__u64 upper_limit_mbps =roundup (255 *MLX5E_100MB ,MLX5E_1GB ); +__u64 upper_limit_mbps;int i;memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit)); + upper_limit_mbps =255 *MLX5E_100MB ;for (i =0 ; i <=mlx5_max_tc (mdev); i++) {if (!maxrate->tc_maxrate[i]) { max_bw_unit[i] =MLX5_BW_NO_LIMIT ;continue ; } -if (maxrate->tc_maxrate[i] < upper_limit_mbps) { +if (maxrate->tc_maxrate[i] <= upper_limit_mbps) { max_bw_value[i] =div_u64 (maxrate->tc_maxrate[i],MLX5E_100MB ); max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] :1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 142/187 net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e ]
Add validation to reject rates exceeding 255 Gbps that would overflow the 8 bits max bandwidth field.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +9 -1
@@ -580,11 +580,13 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,u8 max_bw_value[IEEE_8021QAZ_MAX_TCS ];u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS ];__u64 upper_limit_mbps; +__u64 upper_limit_gbps;int i;memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit)); upper_limit_mbps =255 *MLX5E_100MB ; + upper_limit_gbps =255 *MLX5E_1GB ;for (i =0 ; i <=mlx5_max_tc (mdev); i++) {if (!maxrate->tc_maxrate[i]) {
@@ -596,10 +598,16 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, MLX5E_100MB); max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] :1 ; max_bw_unit[i] =MLX5_100_MBPS_UNIT ; - }else { + }else if (max_bw_value[i] <= upper_limit_gbps) { max_bw_value[i] =div_u64 (maxrate->tc_maxrate[i],MLX5E_1GB ); max_bw_unit[i] =MLX5_GBPS_UNIT ; + }else { +netdev_err (netdev, +"tc_%d maxrate %llu Kbps exceeds limit %llu\n" , + i, maxrate->tc_maxrate[i], + upper_limit_gbps); +return -EINVAL ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 143/187 net_sched: remove need_resched() from qdisc_run()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b60fa1c5d01a10e358c509b904d4bead6114d593 ]
The introduction of this schedule point was done in commit 2ba2506ca7ca ("[NET]: Add preemption point in qdisc_run") at a time the loop was not bounded.
Then later in commit d5b8aa1d246f ("net_sched: fix dequeuer fairness") we added a limit on the number of packets.
Now is the time to remove the schedule point, since the default limit of 64 packets matches the number of packets a typical NAPI poll can process in a row.
This solves a latency problem for most TCP receivers under moderate load :
1) host receives a packet.
NET_RX_SOFTIRQ is raised by NIC hard IRQ handler
2) __do_softirq() does its first loop, handling NET_RX_SOFTIRQ and calling the driver napi->loop() function
3) TCP stores the skb in socket receive queue:
4) TCP calls sk->sk_data_ready() and wakeups a user thread waiting for EPOLLIN (as a result, need_resched() might now be true)
5) TCP cooks an ACK and sends it.
6) qdisc_run() processes one packet from qdisc, and sees need_resched(), this raises NET_TX_SOFTIRQ (even if there are no more packets in the qdisc)
Then we go back to the __do_softirq() in 2), and we see that new softirqs were raised. Since need_resched() is true, we end up waking ksoftirqd in this path :
if (pending) {
if (time_before(jiffies, end) && !need_resched() &&
--max_restart)
goto restart;
wakeup_softirqd();
}So we have many wakeups of ksoftirqd kernel threads, and more calls to qdisc_run() with associated lock overhead.
Note that another way to solve the issue would be to change TCP to first send the ACK packet, then signal the EPOLLIN, but this changes P99 latencies, as sending the ACK packet can add a long delay.
Stable-dep-of: 0345552a653c ("net_sched: limit try_bulk_dequeue_skb() batches")
--- net/sched/sch_generic.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
net/sched/sch_generic.c +1 -6
@@ -407,13 +407,8 @@ void __qdisc_run(struct Qdisc *q)int packets;while (qdisc_restart (q, &packets)) { -/* -* Ordered by possible occurrence: Postpone processing if -* 1. we've exceeded packet quota -* 2. another process needs the CPU; -*/ quota -= packets; -if (quota <=0 ||need_resched ()) { +if (quota <=0 ) {__netif_schedule (q);break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 144/187 net_sched: limit try_bulk_dequeue_skb() batches
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0345552a653ce5542affeb69ac5aa52177a5199b ]
After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption") I started seeing many qdisc requeues on IDPF under high TX workload.
$ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1: qdisc mq 1: root Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114) backlog 1056Kb 6675p requeues 3532840114 qdisc mq 1: root Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653) backlog 781164b 4822p requeues 3537737653
This is caused by try_bulk_dequeue_skb() being only limited by BQL budget.
perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script
...
netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200 netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500 netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100 netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00 netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300 netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00 netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000
...
This is bad because :
1) Large batches hold one victim cpu for a very long time.
2) Driver often hit their own TX ring limit (all slots are used).
3) We call dev_requeue_skb()
4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to implement FQ or priority scheduling.
5) dequeue_skb() gets packets from q->gso_skb one skb at a time with no xmit_more support. This is causing many spinlock games between the qdisc and the device driver.
Requeues were supposed to be very rare, lets keep them this way.
Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as __qdisc_run() was designed to use.
--- net/sched/sch_generic.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
net/sched/sch_generic.c +10 -7
@@ -172,9 +172,10 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)static void try_bulk_dequeue_skb (struct Qdisc *q,struct sk_buff *skb,const struct netdev_queue *txq, -int *packets) +int *packets,int budget) {int bytelimit =qdisc_avail_bulklimit (txq) - skb->len; +int cnt =0 ;while (bytelimit >0 ) {struct sk_buff *nskb = q->dequeue (q);
@@ -185,8 +186,10 @@ static void try_bulk_dequeue_skb(struct Qdisc *q, bytelimit -= nskb->len;/* covers GSO len */ skb->next = nskb; skb = nskb; - (*packets)++;/* GSO counts as one pkt */ +if (++cnt >= budget) +break ; } + (*packets) += cnt;skb_mark_not_on_list (skb); }
@@ -220,7 +223,7 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,* A requeued skb (via q->gso_skb) can also be a SKB list. */ static struct sk_buff *dequeue_skb (struct Qdisc *q,bool *validate, -int *packets) +int *packets,int budget) {const struct netdev_queue *txq = q->dev_queue;struct sk_buff *skb =NULL ;
@@ -287,7 +290,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,if (skb) { bulk:if (qdisc_may_bulk (q)) -try_bulk_dequeue_skb (q, skb, txq, packets); +try_bulk_dequeue_skb (q, skb, txq, packets, budget);else try_bulk_dequeue_skb_slow (q, skb, packets); }
@@ -379,7 +382,7 @@ bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,* >0 - queue is not empty. * */ -static inline bool qdisc_restart (struct Qdisc *q,int *packets) +static inline bool qdisc_restart (struct Qdisc *q,int *packets,int budget) {spinlock_t *root_lock =NULL ;struct netdev_queue *txq;
@@ -388,7 +391,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets)bool validate;/* Dequeue packet */ - skb =dequeue_skb (q, &validate, packets); + skb =dequeue_skb (q, &validate, packets, budget);if (unlikely (!skb))return false;
@@ -406,7 +409,7 @@ void __qdisc_run(struct Qdisc *q)int quota =READ_ONCE (dev_tx_weight);int packets; -while (qdisc_restart (q, &packets)) { +while (qdisc_restart (q, &packets, quota)) { quota -= packets;if (quota <=0 ) {__netif_schedule (q);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/187 Bluetooth: L2CAP: export l2cap_chan_hold for modules
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c ]
l2cap_chan_put() is exported, so export also l2cap_chan_hold() for modules.
l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c
--- net/bluetooth/l2cap_core.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/l2cap_core.c +1 -0
@@ -517,6 +517,7 @@ void l2cap_chan_hold(struct l2cap_chan *c)kref_get (&c->kref); } +EXPORT_SYMBOL_GPL (l2cap_chan_hold);struct l2cap_chan *l2cap_chan_hold_unless_zero (struct l2cap_chan *c) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 146/187 regulator: fixed: use dev_err_probe for register
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit d0f95e6496a974a890df5eda65ffaee66ab0dc73 ]
Instead of returning error directly, use dev_err_probe. This avoids messages in the dmesg log for devices which will be probed again later.
Stable-dep-of: 636f4618b1cd ("regulator: fixed: fix GPIO descriptor leak on register failure")
--- drivers/regulator/fixed.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/regulator/fixed.c +3 -2
@@ -244,8 +244,9 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) drvdata->dev =devm_regulator_register (&pdev->dev, &drvdata->desc, &cfg);if (IS_ERR (drvdata->dev)) { - ret =PTR_ERR (drvdata->dev); -dev_err (&pdev->dev,"Failed to register regulator: %d\n" , ret); + ret =dev_err_probe (&pdev->dev,PTR_ERR (drvdata->dev), +"Failed to register regulator: %ld\n" , +PTR_ERR (drvdata->dev));return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 147/187 regulator: fixed: fix GPIO descriptor leak on register failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 636f4618b1cd96f6b5a2b8c7c4f665c8533ecf13 ]
In the commit referenced by the Fixes tag, devm_gpiod_get_optional() was replaced by manual
GPIO management, relying on the regulator core to release the GPIO descriptor. However, this approach does not account for the error path: when regulator registration fails, the core never takes over the GPIO, resulting in a resource leak.
Add gpiod_put() before returning on regulator registration failure.
--- drivers/regulator/fixed.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/fixed.c +1 -0
@@ -247,6 +247,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) ret =dev_err_probe (&pdev->dev,PTR_ERR (drvdata->dev),"Failed to register regulator: %ld\n" ,PTR_ERR (drvdata->dev)); +gpiod_put (cfg.ena_gpiod);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 148/187 ASoC: cs4271: Fix regulator leak on probe failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 6b6eddc63ce871897d3a5bc4f8f593e698aef104 ]
The probe function enables regulators at the beginning but fails to disable them in its error handling path. If any operation after enabling the regulators fails, the probe will exit with an error, leaving the regulators permanently enabled, which could lead to a resource leak.
Add a proper error handling path to call regulator_bulk_disable() before returning an error.
--- sound/soc/codecs/cs4271.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/cs4271.c +7 -3
@@ -594,17 +594,17 @@ static int cs4271_component_probe(struct snd_soc_component *component) ret =regcache_sync (cs4271->regmap);if (ret <0 ) -return ret; + goto err_disable_regulator; ret =regmap_update_bits (cs4271->regmap,CS4271_MODE2 ,CS4271_MODE2_PDN |CS4271_MODE2_CPEN ,CS4271_MODE2_PDN |CS4271_MODE2_CPEN );if (ret <0 ) -return ret; + goto err_disable_regulator; ret =regmap_update_bits (cs4271->regmap,CS4271_MODE2 ,CS4271_MODE2_PDN ,0 );if (ret <0 ) -return ret; + goto err_disable_regulator;/* Power-up sequence requires 85 uS */ udelay (85 );
@@ -614,6 +614,10 @@ static int cs4271_component_probe(struct snd_soc_component *component) CS4271_MODE2_MUTECAEQUB);return 0 ; + +err_disable_regulator: +regulator_bulk_disable (ARRAY_SIZE (cs4271->supplies), cs4271->supplies); +return ret; }static void cs4271_component_remove (struct snd_soc_component *component)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 149/187 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af ]
This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +5 -0
@@ -3216,6 +3216,11 @@ static int vmw_cmd_check(struct vmw_private *dev_priv, cmd_id = header->id; +if (header->size >SVGA_CMD_MAX_DATASIZE ) { +VMW_DEBUG_USER ("SVGA3D command: %d is too big.\n" , + cmd_id +SVGA_3D_CMD_BASE ); +return -E2BIG ; + } *size = header->size +sizeof (SVGA3dCmdHeader); cmd_id -=SVGA_3D_CMD_BASE ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 150/187 ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haein Lee <[email protected]>
[ Upstream commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 ]
In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.
--- sound/usb/mixer.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/mixer.c +2 -0
@@ -2967,6 +2967,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,int i; assoc =usb_ifnum_to_if (dev, ctrlif)->intf_assoc; +if (!assoc) +return -EINVAL ;/* Detect BADD capture/playback channels from AS EP descriptors */ for (i =0 ; i < assoc->bInterfaceCount; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 151/187 mm/ksm: fix flag-dropping behavior in ksm_madvise
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Acs <[email protected]>
[ Upstream commit f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 ]
syzkaller discovered the following crash: (kernel BUG)
[ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460
<snip other registers, drop unreliable trace>
[ 44.617726] Call Trace: [ 44.617926] <TASK> [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP: 0033:0x7f365bb3f227
Kernel panics because it detects UFFD inconsistency during
userfaultfd_release_all(). Specifically, a VMA which has a valid pointer to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.
The inconsistency is caused in ksm_madvise(): when user calls madvise() with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode, it accidentally clears all flags stored in the upper 32 bits of vma->vm_flags.
Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and int are 32-bit wide. This setup causes the following mishap during the &= ~VM_MERGEABLE assignment.
VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then promoted to unsigned long before the & operation. This promotion fills upper 32 bits with leading 0s, as we're doing unsigned conversion (and even for a signed conversion, this wouldn't help as the leading bit is 0). & operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears the upper 32-bits of its value.
Fix it by changing VM_MERGEABLE constant to unsigned long, using the BIT() macro.
Note: other VM_* flags are not affected: This only happens to the VM_MERGEABLE flag, as the other VM_* flags are all constants of type int and after ~ operation, they end up with leading 1 and are thus converted to unsigned long with leading 1s.
Note 2:
After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is no longer a kernel BUG, but a WARNING at the same place:
[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067
but the root-cause (flag-drop) remains the same.
--- include/linux/mm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/mm.h +1 -1
@@ -293,7 +293,7 @@ extern unsigned int kobjsize(const void *objp);#define VM_MIXEDMAP 0x10000000/* Can contain "struct page" and pure PFN pages */ #define VM_HUGEPAGE 0x20000000/* MADV_HUGEPAGE marked this vma */ #define VM_NOHUGEPAGE 0x40000000/* MADV_NOHUGEPAGE marked this vma */ -#define VM_MERGEABLE 0x80000000/* KSM may merge identical pages */ +#define VM_MERGEABLE BIT(31)/* KSM may merge identical pages */ #ifdef CONFIG_ARCH_USES_HIGH_VMA_FLAGS #define VM_HIGH_ARCH_BIT_0 32/* bit only usable on 64-bit architectures */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 152/187 gcov: add support for GCC 15
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
commit ec4d11fc4b2dd4a2fa8c9d801ee9753b74623554 upstream.
Using gcov on kernels compiled with GCC 15 results in truncated 16-byte long .gcda files with no usable data. To fix this, update GCOV_COUNTERS to match the value defined by GCC 15.
Tested with GCC 14.3.0 and GCC 15.2.0.
--- kernel/gcov/gcc_4_7.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/gcov/gcc_4_7.c +3 -1
@@ -19,7 +19,9 @@#include <linux/vmalloc.h> #include "gcov.h" -#if (__GNUC__ >=14 ) +#if (__GNUC__ >=15 ) +#define GCOV_COUNTERS 10 +#elif (__GNUC__ >=14 )#define GCOV_COUNTERS 9#elif (__GNUC__ >=10 )#define GCOV_COUNTERS 8
Greg Kroah-Hartman
maintainerPATCH 153/187 strparser: Fix signed/unsigned mismatch bug
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nate Karstens <[email protected]>
commit 4da4e4bde1c453ac5cc2dce5def81d504ae257ee upstream.
The len member of the sk_buff is an unsigned int. This is cast to ssize_t (a signed type) for the first sk_buff in the comparison, but not the second sk_buff. On 32-bit systems, this can result in an integer underflow for certain values because unsigned arithmetic is being used.
This appears to be an oversight: if the intention was to use unsigned arithmetic, then the first cast would have been omitted. The change ensures both len values are cast to ssize_t.
The underflow causes an issue with ktls when multiple TLS PDUs are included in a single TCP segment. The mainline kernel does not use strparser for ktls anymore, but this is still useful for other features that still use strparser, and for backporting.
--- net/strparser/strparser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/strparser/strparser.c +1 -1
@@ -238,7 +238,7 @@ static int __strp_recv(read_descriptor_tstrp_parser_err (strp, -EMSGSIZE , desc);break ; }else if (len <= (ssize_t )head->len - - skb->len - stm->strp.offset) { + (ssize_t )skb->len - stm->strp.offset) {/* Length must be into new skb (and also * greater than zero) */
Greg Kroah-Hartman
maintainerPATCH 154/187 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuang Wang <[email protected]>
commit ac1499fcd40fe06479e9b933347b837ccabc2a40 upstream.
The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called to delete entries exceeding FNHE_RECLAIM_DEPTH+random.
The race window is between fnhe_remove_oldest() selecting fnheX for deletion and the subsequent kfree_rcu(). During this time, the concurrent path's __mkroute_output() -> find_exception() can fetch the soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a new dst using a dst_hold(). When the original fnheX is freed via RCU, the dst reference remains permanently leaked.
CPU 0 CPU 1__mkroute_output()
find_exception() [fnheX]
update_or_create_fnhe()
fnhe_remove_oldest() [fnheX]
rt_bind_exception() [bind dst]
RCU callback [fnheX freed, dst leak]
This issue manifests as a device reference count leak and a warning in dmesg when unregistering the net device:
unregister_netdevice: waiting for sitX to become free. Usage count = N
Ido Schimmel provided the simple test validation method [1].
The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes(). Since rt_bind_exception() checks this field, setting it to zero prevents the stale fnhe from being reused and bound to a new dst just before it is freed.
[1]
ip netns add ns1
ip -n ns1 link set dev lo up
ip -n ns1 address add 192.0.2.1/32 dev lo
ip -n ns1 link add name dummy1 up type dummy
ip -n ns1 route add 192.0.2.2/32 dev dummy1
ip -n ns1 link add name gretap1 up arp off type gretap \
local 192.0.2.1 remote 192.0.2.2
ip -n ns1 route add 198.51.0.0/16 dev gretap1
taskset -c 0 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
taskset -c 2 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &sleep 10
ip netns pids ns1 | xargs kill
ip netns del ns1
--- net/ipv4/route.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ipv4/route.c +5 -0
@@ -637,6 +637,11 @@ static void fnhe_remove_oldest(struct fn oldest_p = fnhe_p; } } + +/* Clear oldest->fnhe_daddr to prevent this fnhe from being +* rebound with new dsts in rt_bind_exception(). +*/ + oldest->fnhe_daddr =0 ;fnhe_flush_routes (oldest); *oldest_p = oldest->fnhe_next;kfree_rcu (oldest, rcu);
Greg Kroah-Hartman
maintainerPATCH 155/187 spi: Try to get ACPI GPIO IRQ earlier
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 3cd2018e15b3d66d2187d92867e265f45ad79e6f upstream.
Since commit d24cfee7f63d ("spi: Fix acpi deferred irq probe"), the acpi_dev_gpio_irq_get() call gets delayed till spi_probe() is called on the SPI device.
If there is no driver for the SPI device then the move to spi_probe() results in acpi_dev_gpio_irq_get() never getting called. This may cause problems by leaving the GPIO pin floating because this call is responsible for setting up the GPIO pin direction and/or bias according to the values from the ACPI tables.
Re-add the removed acpi_dev_gpio_irq_get() in acpi_register_spi_device() to ensure the GPIO pin is always correctly setup, while keeping the acpi_dev_gpio_irq_get() call added to spi_probe() to deal with -EPROBE_DEFER returns caused by the GPIO controller not having a driver yet.
--- drivers/spi/spi.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/spi/spi.c +10 -0
@@ -2055,6 +2055,16 @@ static acpi_status acpi_register_spi_devacpi_set_modalias (adev,acpi_device_hid (adev), spi->modalias,sizeof (spi->modalias)); +/* +* This gets re-tried in spi_probe() for -EPROBE_DEFER handling in case +* the GPIO controller does not have a driver yet. This needs to be done +* here too, because this call sets the GPIO direction and/or bias. +* Setting these needs to be done even if there is no driver, in which +* case spi_probe() will never get called. +*/ +if (spi->irq <0 ) + spi->irq =acpi_dev_gpio_irq_get (adev,0 ); +acpi_device_set_enumerated (adev); adev->power.flags.ignore_parent = true;
Greg Kroah-Hartman
maintainerPATCH 156/187 EDAC/altera: Handle OCRAM ECC enable after warm reset
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 upstream.
The OCRAM ECC is always enabled either by the BootROM or by the Secure Device Manager (SDM) during a power-on reset on SoCFPGA.
However, during a warm reset, the OCRAM content is retained to preserve data, while the control and status registers are reset to their default values. As a result, ECC must be explicitly re-enabled after a warm reset.
--- drivers/edac/altera_edac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/edac/altera_edac.c +15 -3
@@ -1247,10 +1247,22 @@ altr_check_ocram_deps_init(struct altr_eif (ret)return ret; -/* Verify OCRAM has been initialized */ +/* +* Verify that OCRAM has been initialized. +* During a warm reset, OCRAM contents are retained, but the control +* and status registers are reset to their default values. Therefore, +* ECC must be explicitly re-enabled in the control register. +* Error condition: if INITCOMPLETEA is clear and ECC_EN is already set. +*/ if (!ecc_test_bits (ALTR_A10_ECC_INITCOMPLETEA , - (base +ALTR_A10_ECC_INITSTAT_OFST ))) -return -ENODEV ; + (base +ALTR_A10_ECC_INITSTAT_OFST ))) { +if (!ecc_test_bits (ALTR_A10_ECC_EN , + (base +ALTR_A10_ECC_CTRL_OFST ))) +ecc_set_bits (ALTR_A10_ECC_EN , + (base +ALTR_A10_ECC_CTRL_OFST )); +else +return -ENODEV ; + }/* Enable IRQ on Single Bit Error */ writel (ALTR_A10_ECC_SERRINTEN , (base +ALTR_A10_ECC_ERRINTENS_OFST ));
Greg Kroah-Hartman
maintainerPATCH 157/187 EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
commit 281326be67252ac5794d1383f67526606b1d6b13 upstream.
The current single-bit error injection mechanism flips bits directly in ECC RAM by performing write and read operations. When the ECC RAM is actively used by the Ethernet or USB controller, this approach sometimes trigger a false double-bit error.
Switch both Ethernet and USB EDAC devices to use the INTTEST register (altr_edac_a10_device_inject_fops) for single-bit error injection, similar to the existing double-bit error injection method.
--- drivers/edac/altera_edac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/edac/altera_edac.c +2 -2
@@ -1432,7 +1432,7 @@ static const struct edac_device_prv_data .ue_set_mask = ALTR_A10_ECC_TDERRA, .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, .ecc_irq_handler = altr_edac_a10_ecc_irq, - .inject_fops = &altr_edac_a10_device_inject2_fops, + .inject_fops = &altr_edac_a10_device_inject_fops, };#endif /* CONFIG_EDAC_ALTERA_ETHERNET */
@@ -1522,7 +1522,7 @@ static const struct edac_device_prv_data .ue_set_mask = ALTR_A10_ECC_TDERRA, .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, .ecc_irq_handler = altr_edac_a10_ecc_irq, - .inject_fops = &altr_edac_a10_device_inject2_fops, + .inject_fops = &altr_edac_a10_device_inject_fops, };#endif /* CONFIG_EDAC_ALTERA_USB */
Greg Kroah-Hartman
maintainerPATCH 158/187 isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
commit 3f978e3f1570155a1327ffa25f60968bc7b9398f upstream.
In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when setup_instance() fails with an error code. Fix that by freeing the urb before freeing the hw structure. Also change the error paths to use the goto ladder style.
Compile tested only. Issue found using a prototype static analysis tool.
--- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/isdn/hardware/mISDN/hfcsusb.c +13 -5
@@ -1904,13 +1904,13 @@ out:mISDN_freebchannel (&hw->bch[1 ]);mISDN_freebchannel (&hw->bch[0 ]);mISDN_freedchannel (&hw->dch); -kfree (hw);return err; }static int hfcsusb_probe (struct usb_interface *intf,const struct usb_device_id *id) { +int err;struct hfcsusb *hw;struct usb_device *dev =interface_to_usbdev (intf);struct usb_host_interface *iface = intf->cur_altsetting;
@@ -2101,20 +2101,28 @@ hfcsusb_probe(struct usb_interface *intfif (!hw->ctrl_urb) {pr_warn ("%s: No memory for control urb\n" , driver_info->vend_name); -kfree (hw); -return -ENOMEM ; + err = -ENOMEM ; + goto err_free_hw; }pr_info ("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n" , hw->name, __func__, driver_info->vend_name, conf_str[small_match], ifnum, alt_used); -if (setup_instance (hw, dev->dev.parent)) -return -EIO ; +if (setup_instance (hw, dev->dev.parent)) { + err = -EIO ; + goto err_free_urb; + } hw->intf = intf;usb_set_intfdata (hw->intf, hw);return 0 ; + +err_free_urb: +usb_free_urb (hw->ctrl_urb); +err_free_hw: +kfree (hw); +return err; }/* function called when an active device is removed */
Greg Kroah-Hartman
maintainerPATCH 159/187 HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
commit beab067dbcff642243291fd528355d64c41dc3b2 upstream.
Based on available evidence, the USB ID 4c4a:4155 used by multiple devices has been attributed to Jieli. The commit 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") affected touchscreen functionality. Added checks for manufacturer and serial number to maintain microphone compatibility, enabling both devices to function properly.
--- drivers/hid/hid-ids.h | 4 ++-- drivers/hid/hid-quirks.c | 13 ++++++++++++- 2 files changed, 14 insertions(+), 3 deletions(-)
drivers/hid/hid-ids.h +2 -2
@@ -1352,7 +1352,7 @@#define USB_VENDOR_ID_SIGNOTEC 0x2133#define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 -#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a -#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155 +#define USB_VENDOR_ID_JIELI_SDK_DEFAULT 0x4c4a +#define USB_DEVICE_ID_JIELI_SDK_4155 0x4155#endif
drivers/hid/hid-quirks.c +12 -1
@@ -882,7 +882,6 @@ static const struct hid_device_id hid_ig#endif { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, - { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) }, { } };
@@ -1031,6 +1030,18 @@ bool hid_ignore(struct hid_device *hdev) strlen(elan_acpi_id[i].id)))return true;break ; +case USB_VENDOR_ID_JIELI_SDK_DEFAULT : +/* +* Multiple USB devices with identical IDs (mic & touchscreen). +* The touch screen requires hid core processing, but the +* microphone does not. They can be distinguished by manufacturer +* and serial number. +*/ +if (hdev->product ==USB_DEVICE_ID_JIELI_SDK_4155 && +strncmp (hdev->name,"SmartlinkTechnology" ,19 ) ==0 && +strncmp (hdev->uniq,"20201111000001" ,14 ) ==0 ) +return true; +break ; } if (hdev->type == HID_TYPE_USBMOUSE &&
Greg Kroah-Hartman
maintainerPATCH 160/187 be2net: pass wrb_params in case of OS2BMC
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <[email protected]>
commit 7d277a7a58578dd62fd546ddaef459ec24ccae36 upstream.
be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states.
The correct way would be to pass the wrb_params from be_xmit().
--- drivers/net/ethernet/emulex/benet/be_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +4 -3
@@ -1298,7 +1298,8 @@ static void be_xmit_flush(struct be_adap (adapter->bmc_filt_mask & BMC_FILT_MULTICAST)static bool be_send_pkt_to_bmc (struct be_adapter *adapter, -struct sk_buff **skb) +struct sk_buff **skb, +struct be_wrb_params *wrb_params) {struct ethhdr *eh = (struct ethhdr *)(*skb)->data;bool os2bmc = false;
@@ -1362,7 +1363,7 @@ done:* to BMC, asic expects the vlan to be inline in the packet. */ if (os2bmc) - *skb =be_insert_vlan_in_pkt (adapter, *skb,NULL ); + *skb =be_insert_vlan_in_pkt (adapter, *skb, wrb_params);return os2bmc; }
@@ -1389,7 +1390,7 @@ static netdev_tx_t be_xmit(struct sk_buf/* if os2bmc is enabled and if the pkt is destined to bmc, * enqueue the pkt a 2nd time with mgmt bit set. */ -if (be_send_pkt_to_bmc (adapter, &skb)) { +if (be_send_pkt_to_bmc (adapter, &skb, &wrb_params)) {BE_WRB_F_SET (wrb_params.features,OS2BMC ,1 ); wrb_cnt =be_xmit_enqueue (adapter, txo, skb, &wrb_params);if (unlikely (!wrb_cnt))