6.6.119-rc1 review
Greg Kroah-Hartman
maintainercover 6.6.119-rc1 review
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.119-rc1
Alan Stern <[email protected]>
HID: core: Harden s32ton() against conversion to 0 bits
Bastien Curutchet (Schneider Electric) <[email protected]>
net: dsa: microchip: Free previously initialized ports on init failures
Bastien Curutchet (Schneider Electric) <[email protected]>
net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()
Sean Heelan <[email protected]>
ksmbd: fix use-after-free in session logoff
Paolo Abeni <[email protected]>
mptcp: fix duplicate reset on fastclose
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: properly kill background tasks
Philipp Hortmann <[email protected]>
staging: rtl8712: Remove driver using deprecated API wext
luoguangfei <[email protected]>
net: macb: fix unregister_netdev call order in macb_remove()
ChiYuan Huang <[email protected]>
iio: adc: rtq6056: Correct the sign bit index
Biju Das <[email protected]>
can: rcar_canfd: Fix CAN-FD mode as default
Jameson Thies <[email protected]>
usb: typec: ucsi: psy: Set max current to zero when disconnected
Jimmy Hu <[email protected]>
usb: gadget: udc: fix use-after-free in usb_gadget_state_work
Kuen-Han Tsai <[email protected]>
usb: udc: Add trace event for usb_gadget_set_state
NeilBrown <[email protected]>
nfsd: Replace clamp_t in nfsd4_get_drc_mem()
Wang Liang <[email protected]>
bonding: check xdp prog when set bond mode
Hangbin Liu <[email protected]>
bonding: return detailed error when loading native XDP fails
ziming zhang <[email protected]>
libceph: replace BUG_ON with bounds check for map->max_osd
ziming zhang <[email protected]>
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
Ilya Dryomov <[email protected]>
libceph: fix potential use-after-free in have_mon_and_osd_map()
Bastien Curutchet (Schneider Electric) <[email protected]>
net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
Bastien Curutchet (Schneider Electric) <[email protected]>
net: dsa: microchip: common: Fix checks on irq_find_mapping()
Alex Hung <[email protected]>
drm/amd/display: Check NULL before accessing
Johan Hovold <[email protected]>
drm: sti: fix device leaks at component probe
Vanillan Wang <[email protected]>
USB: serial: option: add support for Rolling RW101R-GL
Oleksandr Suvorov <[email protected]>
USB: serial: ftdi_sio: add support for u-blox EVK-M101
Łukasz Bartosik <[email protected]>
xhci: dbgtty: fix device unregister
Mathias Nyman <[email protected]>
xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
Manish Nagar <[email protected]>
usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
Heikki Krogerus <[email protected]>
usb: dwc3: pci: Sort out the Intel device IDs
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Nova Lake -S
Owen Gu <[email protected]>
usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
Tianchu Chen <[email protected]>
usb: storage: sddr55: Reject out-of-bound new_pba
Alan Stern <[email protected]>
USB: storage: Remove subclass and protocol overrides from Novatek quirk
Desnes Nunes <[email protected]>
usb: storage: Fix memory leak in USB bulk transport
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Fix synchronous external abort on unbind
Kuen-Han Tsai <[email protected]>
usb: gadget: f_eem: Fix memory leak in eem_unwrap
Miaoqian Lin <[email protected]>
usb: cdns3: Fix double resource release in cdns3_pci_probe
Johan Hovold <[email protected]>
most: usb: fix double free on late probe failure
Miaoqian Lin <[email protected]>
serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
Paolo Abeni <[email protected]>
mptcp: clear scheduled subflows on retransmit
Khairul Anuar Romli <[email protected]>
firmware: stratix10-svc: fix bug in saving controller data
Miaoqian Lin <[email protected]>
slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
Alan Borzeszkowski <[email protected]>
thunderbolt: Add support for Intel Wildcat Lake
Paulo Alcantara <[email protected]>
smb: client: fix memory leak in cifs_construct_tcon()
Jamie Iles <[email protected]>
drivers/usb/dwc3: fix PCI parent check
Mikulas Patocka <[email protected]>
dm-verity: fix unreliable memory allocation
Viacheslav Dubeyko <[email protected]>
ceph: fix crash in process_v2_sparse_read() for encrypted directories
Marc Kleine-Budde <[email protected]>
can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
Thomas Mühlbacher <[email protected]>
can: sja1000: fix max irq loop handling
Gui-Dong Han <[email protected]>
atm/fore200e: Fix possible data race in fore200e_open()
Maarten Zanders <[email protected]>
ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
Ivan Zhaldak <[email protected]>
ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
Thomas Bogendoerfer <[email protected]>
MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
Maciej W. Rozycki <[email protected]>
MIPS: mm: Prevent a TLB shutdown on initial uniquification
David Lechner <[email protected]>
iio: adc: ad7280a: fix ad7280_store_balance_timer()
Valek Andrej <[email protected]>
iio: accel: fix ADXL355 startup race condition
Linus Walleij <[email protected]>
iio: accel: bmc150: Fix irq assumption regression
Christophe JAILLET <[email protected]>
iio:common:ssp_sensors: Fix an error handling path ssp_probe()
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
Jiri Olsa <[email protected]>
Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
Hang Zhou <[email protected]>
spi: bcm63xx: fix premature CS deassertion on RX-only transactions
Andy Shevchenko <[email protected]>
spi: nxp-fspi: Propagate fwnode in ACPI case as well
Miquel Raynal <[email protected]>
spi: nxp-fspi: Support per spi-mem operation frequency switches
Miquel Raynal <[email protected]>
spi: spi-mem: Add a new controller capability
Miquel Raynal <[email protected]>
spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency
Tudor Ambarus <[email protected]>
spi: spi-mem: Allow specifying the byte order in Octal DTR mode
Haotian Zhang <[email protected]>
spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
Francesco Lavra <[email protected]>
spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA
Jamie Iles <[email protected]>
mailbox: pcc: don't zero error register
Sudeep Holla <[email protected]>
mailbox: pcc: Refactor error handling in irq handler into separate function
Haotian Zhang <[email protected]>
mailbox: mailbox-test: Fix debugfs_create_dir error checking
Haotian Zhang <[email protected]>
usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
Mario Tesi <[email protected]>
iio: st_lsm6dsx: Fixed calibrated timestamp calculation
Wei Fang <[email protected]>
net: fec: do not register PPS event for PEROUT
Wei Fang <[email protected]>
net: fec: do not allow enabling PPS and PEROUT simultaneously
Wei Fang <[email protected]>
net: fec: do not update PEROUT if it is enabled
Wei Fang <[email protected]>
net: fec: cancel perout_timer when PEROUT is disabled
Jiefeng Zhang <[email protected]>
net: atlantic: fix fragment overflow handling in RX path
Vladimir Oltean <[email protected]>
net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
Russell King (Oracle) <[email protected]>
net: dsa: sja1105: simplify static configuration reload
Alex Deucher <[email protected]>
drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
Alexey Kodanev <[email protected]>
net: sxgbe: fix potential NULL dereference in sxgbe_rx()
Danielle Costantino <[email protected]>
net/mlx5e: Fix validation logic in rate limiting
Horatiu Vultur <[email protected]>
net: lan966x: Fix the initialization of taprio
Kai-Heng Feng <[email protected]>
net: aquantia: Add missing descriptor cache invalidation on ATL2
Dan Carpenter <[email protected]>
platform/x86: intel: punit_ipc: fix memory corruption
Daniel Golle <[email protected]>
net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SMP: Fix not generating mackey and ltk when repairing
Edward Adam Davis <[email protected]>
Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
Seungjin Bae <[email protected]>
can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
-------------
Diffstat:
MAINTAINERS | 6 - Makefile | 4 +- arch/arm/boot/dts/nxp/imx/imx6ul.dtsi | 2 +- arch/mips/mm/tlb-r4k.c | 118 +- arch/x86/events/core.c | 10 +- drivers/atm/fore200e.c | 2 + drivers/firmware/stratix10-svc.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 +- drivers/gpu/drm/sti/sti_vtg.c | 7 +- drivers/hid/hid-core.c | 7 +- drivers/iio/accel/adxl355_core.c | 44 +- drivers/iio/accel/bmc150-accel-core.c | 5 + drivers/iio/accel/bmc150-accel.h | 1 + drivers/iio/adc/ad7280a.c | 2 +- drivers/iio/adc/rtq6056.c | 2 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 40 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 19 +- drivers/mailbox/mailbox-test.c | 2 +- drivers/mailbox/pcc.c | 32 +- drivers/md/dm-verity-fec.c | 6 +- drivers/most/most_usb.c | 14 +- drivers/mtd/nand/spi/core.c | 2 + drivers/net/bonding/bond_main.c | 11 +- drivers/net/bonding/bond_options.c | 3 + drivers/net/can/rcar/rcar_canfd.c | 53 +- drivers/net/can/sja1000/sja1000.c | 4 +- drivers/net/can/sun4i_can.c | 4 +- drivers/net/can/usb/gs_usb.c | 102 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 +- drivers/net/dsa/microchip/ksz_common.c | 30 +- drivers/net/dsa/microchip/ksz_ptp.c | 22 +- drivers/net/dsa/sja1105/sja1105_main.c | 66 +- .../net/ethernet/aquantia/atlantic/aq_hw_utils.c | 22 + .../net/ethernet/aquantia/atlantic/aq_hw_utils.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 + .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 19 +- .../ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 2 +- drivers/net/ethernet/freescale/fec.h | 1 + drivers/net/ethernet/freescale/fec_ptp.c | 64 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +- .../net/ethernet/microchip/lan966x/lan966x_ptp.c | 5 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +- drivers/net/phy/mxl-gpy.c | 2 +- drivers/platform/x86/intel/punit_ipc.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 1 + drivers/spi/Kconfig | 4 +- drivers/spi/spi-amlogic-spifc-a1.c | 4 +- drivers/spi/spi-bcm63xx.c | 14 + drivers/spi/spi-mem.c | 37 + drivers/spi/spi-nxp-fspi.c | 22 +- drivers/staging/Kconfig | 2 - drivers/staging/Makefile | 1 - drivers/staging/rtl8712/Kconfig | 21 - drivers/staging/rtl8712/Makefile | 35 - drivers/staging/rtl8712/TODO | 13 - drivers/staging/rtl8712/basic_types.h | 28 - drivers/staging/rtl8712/drv_types.h | 175 -- drivers/staging/rtl8712/ethernet.h | 21 - drivers/staging/rtl8712/hal_init.c | 401 ---- drivers/staging/rtl8712/ieee80211.c | 415 ---- drivers/staging/rtl8712/ieee80211.h | 165 -- drivers/staging/rtl8712/mlme_linux.c | 160 -- drivers/staging/rtl8712/mlme_osdep.h | 31 - drivers/staging/rtl8712/mp_custom_oid.h | 287 --- drivers/staging/rtl8712/os_intfs.c | 482 ---- drivers/staging/rtl8712/osdep_intf.h | 32 - drivers/staging/rtl8712/osdep_service.h | 60 - drivers/staging/rtl8712/recv_linux.c | 139 -- drivers/staging/rtl8712/recv_osdep.h | 39 - drivers/staging/rtl8712/rtl8712_bitdef.h | 26 - drivers/staging/rtl8712/rtl8712_cmd.c | 409 ---- drivers/staging/rtl8712/rtl8712_cmd.h | 231 -- drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h | 95 - drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h | 19 - drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h | 41 - drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h | 32 - .../staging/rtl8712/rtl8712_edcasetting_bitdef.h | 65 - .../staging/rtl8712/rtl8712_edcasetting_regdef.h | 24 - drivers/staging/rtl8712/rtl8712_efuse.c | 564 ----- drivers/staging/rtl8712/rtl8712_efuse.h | 44 - drivers/staging/rtl8712/rtl8712_event.h | 86 - drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h | 131 -- drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h | 61 - drivers/staging/rtl8712/rtl8712_gp_bitdef.h | 68 - drivers/staging/rtl8712/rtl8712_gp_regdef.h | 29 - drivers/staging/rtl8712/rtl8712_hal.h | 142 -- drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h | 44 - drivers/staging/rtl8712/rtl8712_io.c | 99 - drivers/staging/rtl8712/rtl8712_led.c | 1830 --------------- .../staging/rtl8712/rtl8712_macsetting_bitdef.h | 31 - .../staging/rtl8712/rtl8712_macsetting_regdef.h | 20 - drivers/staging/rtl8712/rtl8712_powersave_bitdef.h | 39 - drivers/staging/rtl8712/rtl8712_powersave_regdef.h | 26 - drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h | 36 - drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h | 43 - drivers/staging/rtl8712/rtl8712_recv.c | 1080 --------- drivers/staging/rtl8712/rtl8712_recv.h | 145 -- drivers/staging/rtl8712/rtl8712_regdef.h | 32 - drivers/staging/rtl8712/rtl8712_security_bitdef.h | 34 - drivers/staging/rtl8712/rtl8712_spec.h | 121 - drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h | 163 -- drivers/staging/rtl8712/rtl8712_syscfg_regdef.h | 42 - drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h | 49 - drivers/staging/rtl8712/rtl8712_timectrl_regdef.h | 26 - drivers/staging/rtl8712/rtl8712_wmac_bitdef.h | 49 - drivers/staging/rtl8712/rtl8712_wmac_regdef.h | 36 - drivers/staging/rtl8712/rtl8712_xmit.c | 744 ------- drivers/staging/rtl8712/rtl8712_xmit.h | 108 - drivers/staging/rtl8712/rtl871x_cmd.c | 796 ------- drivers/staging/rtl8712/rtl871x_cmd.h | 761 ------- drivers/staging/rtl8712/rtl871x_debug.h | 130 -- drivers/staging/rtl8712/rtl871x_eeprom.c | 220 -- drivers/staging/rtl8712/rtl871x_eeprom.h | 88 - drivers/staging/rtl8712/rtl871x_event.h | 109 - drivers/staging/rtl8712/rtl871x_ht.h | 33 - drivers/staging/rtl8712/rtl871x_io.c | 147 -- drivers/staging/rtl8712/rtl871x_io.h | 236 -- drivers/staging/rtl8712/rtl871x_ioctl.h | 94 - drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2330 -------------------- drivers/staging/rtl8712/rtl871x_ioctl_rtl.c | 519 ----- drivers/staging/rtl8712/rtl871x_ioctl_rtl.h | 109 - drivers/staging/rtl8712/rtl871x_ioctl_set.c | 354 --- drivers/staging/rtl8712/rtl871x_ioctl_set.h | 45 - drivers/staging/rtl8712/rtl871x_led.h | 118 - drivers/staging/rtl8712/rtl871x_mlme.c | 1710 -------------- drivers/staging/rtl8712/rtl871x_mlme.h | 205 -- drivers/staging/rtl8712/rtl871x_mp.c | 724 ------ drivers/staging/rtl8712/rtl871x_mp.h | 275 --- drivers/staging/rtl8712/rtl871x_mp_ioctl.c | 883 -------- drivers/staging/rtl8712/rtl871x_mp_ioctl.h | 328 --- drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h | 1034 --------- drivers/staging/rtl8712/rtl871x_pwrctrl.c | 234 -- drivers/staging/rtl8712/rtl871x_pwrctrl.h | 113 - drivers/staging/rtl8712/rtl871x_recv.c | 671 ------ drivers/staging/rtl8712/rtl871x_recv.h | 208 -- drivers/staging/rtl8712/rtl871x_rf.h | 55 - drivers/staging/rtl8712/rtl871x_security.c | 1386 ------------ drivers/staging/rtl8712/rtl871x_security.h | 218 -- drivers/staging/rtl8712/rtl871x_sta_mgt.c | 263 --- drivers/staging/rtl8712/rtl871x_wlan_sme.h | 35 - drivers/staging/rtl8712/rtl871x_xmit.c | 1059 --------- drivers/staging/rtl8712/rtl871x_xmit.h | 288 --- drivers/staging/rtl8712/sta_info.h | 132 -- drivers/staging/rtl8712/usb_halinit.c | 307 --- drivers/staging/rtl8712/usb_intf.c | 638 ------ drivers/staging/rtl8712/usb_ops.c | 195 -- drivers/staging/rtl8712/usb_ops.h | 38 - drivers/staging/rtl8712/usb_ops_linux.c | 515 ----- drivers/staging/rtl8712/usb_osintf.h | 35 - drivers/staging/rtl8712/wifi.h | 196 -- drivers/staging/rtl8712/wlan_bssdef.h | 223 -- drivers/staging/rtl8712/xmit_linux.c | 181 -- drivers/staging/rtl8712/xmit_osdep.h | 52 - drivers/thunderbolt/nhi.c | 2 + drivers/thunderbolt/nhi.h | 1 + drivers/tty/serial/amba-pl011.c | 2 +- drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +- drivers/usb/dwc3/core.c | 3 +- drivers/usb/dwc3/dwc3-pci.c | 82 +- drivers/usb/dwc3/ep0.c | 1 + drivers/usb/dwc3/gadget.c | 7 + drivers/usb/gadget/function/f_eem.c | 7 +- drivers/usb/gadget/udc/core.c | 18 +- drivers/usb/gadget/udc/renesas_usbf.c | 4 +- drivers/usb/gadget/udc/trace.h | 5 + drivers/usb/host/xhci-dbgcap.h | 1 + drivers/usb/host/xhci-dbgtty.c | 23 +- drivers/usb/renesas_usbhs/common.c | 14 +- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/option.c | 10 +- drivers/usb/storage/sddr55.c | 6 + drivers/usb/storage/transport.c | 16 + drivers/usb/storage/uas.c | 5 + drivers/usb/storage/unusual_devs.h | 2 +- drivers/usb/typec/ucsi/psy.c | 5 + fs/nfsd/nfs4state.c | 6 +- fs/smb/client/connect.c | 1 + fs/smb/server/smb2pdu.c | 4 - include/linux/spi/spi-mem.h | 22 +- include/linux/usb/gadget.h | 5 + include/net/bonding.h | 1 + net/bluetooth/hci_sock.c | 2 + net/bluetooth/smp.c | 31 +- net/ceph/auth_x.c | 2 + net/ceph/ceph_common.c | 53 +- net/ceph/debugfs.c | 16 +- net/ceph/messenger_v2.c | 11 +- net/ceph/osdmap.c | 18 +- net/mptcp/protocol.c | 48 +- sound/usb/quirks.c | 3 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 21 + 196 files changed, 914 insertions(+), 28087 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/93 can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 0c73772cd2b8cc108d5f5334de89ad648d89b9ec ]
The kvaser_usb_leaf_wait_cmd() and kvaser_usb_leaf_read_bulk_callback functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary.
The driver attempts to skip these placeholders by aligning the buffer position pos to the next packet boundary using round_up() function.
However, if zero-length command is found exactly on a packet boundary (i.e., pos is a multiple of wMaxPacketSize, including 0), round_up function will return the unchanged value of pos. This prevents pos to be increased, causing an infinite loop in the parsing logic.
This patch fixes this in the function by using pos + 1 instead. This ensures that even if pos is on a boundary, the calculation is based on pos + 1, forcing round_up() to always return the next aligned boundary.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +2 -2
@@ -611,7 +611,7 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id,* for further details. */ if (tmp->len ==0 ) { - pos =round_up (pos, + pos =round_up (pos +1 ,le16_to_cpu (dev->bulk_in->wMaxPacketSize));continue ;
@@ -1590,7 +1590,7 @@ static void kvaser_usb_leaf_read_bulk_callback(struct kvaser_usb *dev,* number of events in case of a heavy rx load on the bus. */ if (cmd->len ==0 ) { - pos =round_up (pos,le16_to_cpu + pos =round_up (pos +1 ,le16_to_cpu (dev->bulk_in->wMaxPacketSize));continue ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/93 can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 516a0cd1c03fa266bb67dd87940a209fd4e53ce7 ]
The driver lacks the cleanup of failed transfers of URBs. This reduces the number of available URBs per error by 1. This leads to reduced performance and ultimately to a complete stop of the transmission.
If the sending of a bulk URB fails do proper cleanup:
- increase netdev stats
- mark the echo_sbk as free
- free the driver's context and do accounting
- wake the send queue
--- drivers/net/can/usb/gs_usb.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/net/can/usb/gs_usb.c +15 -2
@@ -747,8 +747,21 @@ static void gs_usb_xmit_callback(struct urb *urb)struct gs_can *dev = txc->dev;struct net_device *netdev = dev->netdev; -if (urb->status) -netdev_info (netdev,"usb xmit fail %u\n" , txc->echo_id); +if (!urb->status) +return ; + +if (urb->status != -ESHUTDOWN &&net_ratelimit ()) +netdev_info (netdev,"failed to xmit URB %u: %pe\n" , + txc->echo_id,ERR_PTR (urb->status)); + + netdev->stats.tx_dropped++; + netdev->stats.tx_errors++; + +can_free_echo_skb (netdev, txc->echo_id,NULL ); +gs_free_tx_context (txc); +atomic_dec (&dev->active_tx_urbs); + +netif_wake_queue (netdev); } static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/93 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 6fe9f3279f7d2518439a7962c5870c6e9ecbadcf ]
The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback().
Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it.
To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short.
--- drivers/net/can/usb/gs_usb.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
drivers/net/can/usb/gs_usb.c +19 -7
@@ -259,13 +259,15 @@ struct canfd_quirk { } __packed;struct gs_host_frame { -u32 echo_id; -__le32 can_id; + struct_group(header, + u32 echo_id; +__le32 can_id; -u8 can_dlc; -u8 channel; -u8 flags; -u8 reserved; +u8 can_dlc; +u8 channel; +u8 flags; +u8 reserved; + );union { DECLARE_FLEX_ARRAY(struct classic_can, classic_can);
@@ -573,6 +575,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)int rc;struct net_device_stats *stats;struct gs_host_frame *hf = urb->transfer_buffer; +unsigned int minimum_length;struct gs_tx_context *txc;struct can_frame *cf;struct canfd_frame *cfd;
@@ -591,6 +594,15 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)return ; } + minimum_length =sizeof (hf->header); +if (urb->actual_length < minimum_length) { +dev_err_ratelimited (&parent->udev->dev, +"short read (actual_length=%u, minimum_length=%u)\n" , + urb->actual_length, minimum_length); + + goto resubmit_urb; + } +/* device reports out of range channel id */ if (hf->channel >= parent->channel_cnt) goto device_detach;
@@ -684,7 +696,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) resubmit_urb:usb_fill_bulk_urb (urb, parent->udev, parent->pipe_in, - hf, dev->parent->hf_size_rx, + hf, parent->hf_size_rx, gs_usb_receive_bulk_callback, parent); rc =usb_submit_urb (urb,GFP_ATOMIC );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/93 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 395d988f93861101ec89d0dd9e3b876ae9392a5b ]
The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the data after the header depends on the gs_host_frame hf::flags and the active device features (e.g. time stamping).
Introduce a new function gs_usb_get_minimum_length() and check that we have at least received the required amount of data before accessing it. Only copy the data to that skb that has actually been received.
--- drivers/net/can/usb/gs_usb.c | 59 +++++++++++++++++++++++++++++++++--- 1 file changed, 54 insertions(+), 5 deletions(-)
drivers/net/can/usb/gs_usb.c +54 -5
@@ -258,6 +258,11 @@ struct canfd_quirk {u8 quirk; } __packed; +/* struct gs_host_frame::echo_id == GS_HOST_FRAME_ECHO_ID_RX indicates +* a regular RX'ed CAN frame +*/ +#define GS_HOST_FRAME_ECHO_ID_RX 0xffffffff +struct gs_host_frame { struct_group(header, u32 echo_id;
@@ -567,6 +572,37 @@ gs_usb_get_echo_skb(struct gs_can *dev, struct sk_buff *skb,return len; } +static unsigned int +gs_usb_get_minimum_rx_length (const struct gs_can *dev,const struct gs_host_frame *hf, +unsigned int *data_length_p) +{ +unsigned int minimum_length, data_length =0 ; + +if (hf->flags &GS_CAN_FLAG_FD ) { +if (hf->echo_id ==GS_HOST_FRAME_ECHO_ID_RX ) + data_length =can_fd_dlc2len (hf->can_dlc); + +if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) +/* timestamp follows data field of max size */ + minimum_length =struct_size (hf, canfd_ts,1 ); +else + minimum_length =sizeof (hf->header) + data_length; + }else { +if (hf->echo_id ==GS_HOST_FRAME_ECHO_ID_RX && + !(hf->can_id &cpu_to_le32 (CAN_RTR_FLAG ))) + data_length =can_cc_dlc2len (hf->can_dlc); + +if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) +/* timestamp follows data field of max size */ + minimum_length =struct_size (hf, classic_can_ts,1 ); +else + minimum_length =sizeof (hf->header) + data_length; + } + + *data_length_p = data_length; +return minimum_length; +} +static void gs_usb_receive_bulk_callback (struct urb *urb) {struct gs_usb *parent = urb->context;
@@ -575,7 +611,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)int rc;struct net_device_stats *stats;struct gs_host_frame *hf = urb->transfer_buffer; -unsigned int minimum_length; +unsigned int minimum_length, data_length;struct gs_tx_context *txc;struct can_frame *cf;struct canfd_frame *cfd;
@@ -618,20 +654,33 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)if (!netif_running (netdev)) goto resubmit_urb; -if (hf->echo_id ==-1 ) {/* normal rx */ + minimum_length =gs_usb_get_minimum_rx_length (dev, hf, &data_length); +if (urb->actual_length < minimum_length) { + stats->rx_errors++; + stats->rx_length_errors++; + +if (net_ratelimit ()) +netdev_err (netdev, +"short read (actual_length=%u, minimum_length=%u)\n" , + urb->actual_length, minimum_length); + + goto resubmit_urb; + } + +if (hf->echo_id ==GS_HOST_FRAME_ECHO_ID_RX ) {/* normal rx */ if (hf->flags &GS_CAN_FLAG_FD ) { skb =alloc_canfd_skb (netdev, &cfd);if (!skb)return ; cfd->can_id =le32_to_cpu (hf->can_id); - cfd->len =can_fd_dlc2len (hf->can_dlc); + cfd->len = data_length;if (hf->flags &GS_CAN_FLAG_BRS ) cfd->flags |=CANFD_BRS ;if (hf->flags &GS_CAN_FLAG_ESI ) cfd->flags |=CANFD_ESI ; -memcpy (cfd->data, hf->canfd->data, cfd->len); +memcpy (cfd->data, hf->canfd->data, data_length); }else { skb =alloc_can_skb (netdev, &cf);if (!skb)
@@ -640,7 +689,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) cf->can_id =le32_to_cpu (hf->can_id);can_frame_set_cc_len (cf, hf->can_dlc, dev->can.ctrlmode); -memcpy (cf->data, hf->classic_can->data,8 ); +memcpy (cf->data, hf->classic_can->data, data_length);/* ERROR frames tell us information about the controller */ if (le32_to_cpu (hf->can_id) &CAN_ERR_FLAG )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/93 Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 89bb613511cc21ed5ba6bddc1c9b9ae9c0dad392 ]
There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1].
Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1].
[1]
syzbot reported:
BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314
--- net/bluetooth/hci_sock.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_sock.c +2 -0
@@ -1304,7 +1304,9 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, goto done; } +hci_dev_lock (hdev);mgmt_index_removed (hdev); +hci_dev_unlock (hdev); err =hci_dev_open (hdev->id);if (err) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/93 Bluetooth: SMP: Fix not generating mackey and ltk when repairing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 545d7827b2cd5de5eb85580cebeda6b35b3ff443 ]
The change eed467b517e8 ("Bluetooth: fix passkey uninitialized when used") introduced a goto that bypasses the creation of temporary mackey and ltk which are later used by the likes of DHKey Check step.
Later ffee202a78c2 ("Bluetooth: Always request for user confirmation for Just Works (LE SC)") which means confirm_hint is always set in case JUST_WORKS so the branch checking for an existing LTK becomes pointless as confirm_hint will always be set, so this just merge both cases of malicious or legitimate devices to be confirmed before continuing with the pairing procedure.
--- net/bluetooth/smp.c | 31 +++++++------------------------ 1 file changed, 7 insertions(+), 24 deletions(-)
net/bluetooth/smp.c +7 -24
@@ -2137,7 +2137,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)struct smp_chan *smp = chan->data;struct hci_conn *hcon = conn->hcon;u8 *pkax, *pkbx, *na, *nb, confirm_hint; -u32 passkey; +u32 passkey =0 ;int err;bt_dev_dbg (hcon->hdev,"conn %p" , conn);
@@ -2189,24 +2189,6 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)smp_send_cmd (conn,SMP_CMD_PAIRING_RANDOM ,sizeof (smp->prnd), smp->prnd);SMP_ALLOW_CMD (smp,SMP_CMD_DHKEY_CHECK ); - -/* Only Just-Works pairing requires extra checks */ -if (smp->method !=JUST_WORKS ) - goto mackey_and_ltk; - -/* If there already exists long term key in local host, leave -* the decision to user space since the remote device could -* be legitimate or malicious. -*/ -if (hci_find_ltk (hcon->hdev, &hcon->dst, hcon->dst_type, - hcon->role)) { -/* Set passkey to 0. The value can be any number since -* it'll be ignored anyway. -*/ - passkey =0 ; - confirm_hint =1 ; - goto confirm; - } } mackey_and_ltk:
@@ -2227,11 +2209,12 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)if (err)return SMP_UNSPECIFIED ; - confirm_hint =0 ; - -confirm: -if (smp->method ==JUST_WORKS ) - confirm_hint =1 ; +/* Always require user confirmation for Just-Works pairing to prevent +* impersonation attacks, or in case of a legitimate device that is +* repairing use the confirmation as acknowledgment to proceed with the +* creation of new keys. +*/ + confirm_hint = smp->method ==JUST_WORKS ?1 :0 ; err =mgmt_user_confirm_request (hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type, passkey, confirm_hint);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/93 net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
[ Upstream commit ec3803b5917b6ff2f86ea965d0985c95d8a85119 ]
As the interface mode doesn't need to be updated on PHYs connected with USXGMII and integrated PHYs, gpy_update_interface() should just return 0 in these cases rather than -EINVAL which has wrongly been introduced by commit 7a495dde27ebc ("net: phy: mxl-gpy: Change gpy_update_interface() function return type"), as this breaks support for those PHYs.
--- drivers/net/phy/mxl-gpy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/mxl-gpy.c +1 -1
@@ -515,7 +515,7 @@ static int gpy_update_interface(struct phy_device *phydev)/* Interface mode is fixed for USXGMII and integrated PHY */ if (phydev->interface ==PHY_INTERFACE_MODE_USXGMII || phydev->interface ==PHY_INTERFACE_MODE_INTERNAL ) -return -EINVAL ; +return 0 ;/* Automatically switch SERDES interface between SGMII and 2500-BaseX * according to speed. Disable ANEG in 2500-BaseX mode.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/93 platform/x86: intel: punit_ipc: fix memory corruption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 9b9c0adbc3f8a524d291baccc9d0c04097fb4869 ]
This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersand). This means that the:
complete(&ipcdev->cmd_complete);
in intel_punit_ioc() will write to a wrong memory address corrupting it.
--- drivers/platform/x86/intel/punit_ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/intel/punit_ipc.c +1 -1
@@ -283,7 +283,7 @@ static int intel_punit_ipc_probe(struct platform_device *pdev) }else { ret =devm_request_irq (&pdev->dev, irq, intel_punit_ioc,IRQF_NO_SUSPEND ,"intel_punit_ipc" , - &punit_ipcdev); + punit_ipcdev);if (ret) {dev_err (&pdev->dev,"Failed to request irq: %d\n" , irq);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/93 net: aquantia: Add missing descriptor cache invalidation on ATL2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit 7526183cfdbe352c51c285762f0e15b7c428ea06 ]
ATL2 hardware was missing descriptor cache invalidation in hw_stop(), causing SMMU translation faults during device shutdown and module removal:
[ 70.355743] arm-smmu-v3 arm-smmu-v3.5.auto: event 0x10 received: [ 70.361893] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0002060000000010 [ 70.367948] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000020000000000 [ 70.374002] arm-smmu-v3 arm-smmu-v3.5.auto: 0x00000000ff9bc000 [ 70.380055] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000000000000000 [ 70.386109] arm-smmu-v3 arm-smmu-v3.5.auto: event: F_TRANSLATION client: 0001:06:00.0 sid: 0x20600 ssid: 0x0 iova: 0xff9bc000 ipa: 0x0 [ 70.398531] arm-smmu-v3 arm-smmu-v3.5.auto: unpriv data write s1 "Input address caused fault" stag: 0x0
Commit 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after driver unbind") and commit ed4d81c4b3f2 ("net: aquantia: when cleaning hw cache it should be toggled") fixed cache invalidation for ATL B0, but ATL2 was left with only interrupt disabling. This allowed hardware to write to cached descriptors after DMA memory was unmapped, triggering SMMU faults. Once cache invalidation is applied to ATL2, the translation fault can't be observed anymore.
Add shared aq_hw_invalidate_descriptor_cache() helper and use it in both ATL B0 and ATL2 hw_stop() implementations for consistent behavior.
--- .../ethernet/aquantia/atlantic/aq_hw_utils.c | 22 +++++++++++++++++++ .../ethernet/aquantia/atlantic/aq_hw_utils.h | 1 + .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 19 +--------------- .../aquantia/atlantic/hw_atl2/hw_atl2.c | 2 +- 4 files changed, 25 insertions(+), 19 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c +22 -0
@@ -15,6 +15,7 @@#include "aq_hw.h" #include "aq_nic.h" +#include "hw_atl/hw_atl_llh.h" void aq_hw_write_reg_bit (struct aq_hw_s *aq_hw,u32 addr,u32 msk,u32 shift,u32 val)
@@ -81,6 +82,27 @@ void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value)lo_hi_writeq (value, hw->mmio + reg); } +int aq_hw_invalidate_descriptor_cache (struct aq_hw_s *hw) +{ +int err; +u32 val; + +/* Invalidate Descriptor Cache to prevent writing to the cached +* descriptors and to the data pointer of those descriptors +*/ +hw_atl_rdm_rx_dma_desc_cache_init_tgl (hw); + + err =aq_hw_err_from_flags (hw); +if (err) + goto err_exit; + +readx_poll_timeout_atomic (hw_atl_rdm_rx_dma_desc_cache_init_done_get, + hw, val, val ==1 ,1000U ,10000U ); + +err_exit: +return err; +} +int aq_hw_err_from_flags (struct aq_hw_s *hw) {int err =0 ;
drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h +1 -0
@@ -35,6 +35,7 @@ u32 aq_hw_read_reg(struct aq_hw_s *hw, u32 reg);void aq_hw_write_reg (struct aq_hw_s *hw,u32 reg,u32 value);u64 aq_hw_read_reg64 (struct aq_hw_s *hw,u32 reg);void aq_hw_write_reg64 (struct aq_hw_s *hw,u32 reg,u64 value); +int aq_hw_invalidate_descriptor_cache (struct aq_hw_s *hw);int aq_hw_err_from_flags (struct aq_hw_s *hw);int aq_hw_num_tcs (struct aq_hw_s *hw);int aq_hw_q_per_tc (struct aq_hw_s *hw);
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +1 -18
@@ -1198,26 +1198,9 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)static int hw_atl_b0_hw_stop (struct aq_hw_s *self) { -int err; -u32 val; -hw_atl_b0_hw_irq_disable (self,HW_ATL_B0_INT_MASK ); -/* Invalidate Descriptor Cache to prevent writing to the cached -* descriptors and to the data pointer of those descriptors -*/ -hw_atl_rdm_rx_dma_desc_cache_init_tgl (self); - - err =aq_hw_err_from_flags (self); - -if (err) - goto err_exit; - -readx_poll_timeout_atomic (hw_atl_rdm_rx_dma_desc_cache_init_done_get, - self, val, val ==1 ,1000U ,10000U ); - -err_exit: -return err; +return aq_hw_invalidate_descriptor_cache (self); }int hw_atl_b0_hw_ring_tx_stop (struct aq_hw_s *self,struct aq_ring_s *ring)
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c +1 -1
@@ -759,7 +759,7 @@ static int hw_atl2_hw_stop(struct aq_hw_s *self) {hw_atl_b0_hw_irq_disable (self,HW_ATL2_INT_MASK ); -return 0 ; +return aq_hw_invalidate_descriptor_cache (self); }static struct aq_stats_s *hw_atl2_utils_get_hw_stats (struct aq_hw_s *self)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/93 net: lan966x: Fix the initialization of taprio
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 9780f535f8e0f20b4632b5a173ead71aa8f095d2 ]
To initialize the taprio block in lan966x, it is required to configure the register REVISIT_DLY. The purpose of this register is to set the delay before revisit the next gate and the value of this register depends on the system clock. The problem is that the we calculated wrong the value of the system clock period in picoseconds. The actual system clock is ~165.617754MHZ and this correspond to a period of 6038 pico seconds and not 15125 as currently set.
--- drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c +4 -1
@@ -1,11 +1,14 @@// SPDX-License-Identifier: GPL-2.0+ #include <linux/ptp_classify.h> +#include <linux/units.h> #include "lan966x_main.h" #include "vcap_api.h" #include "vcap_api_client.h" +#define LAN9X66_CLOCK_RATE 165617754 +#define LAN966X_MAX_PTP_ID 512/* Represents 1ppm adjustment in 2^59 format with 6.037735849ns as reference
@@ -1132,5 +1135,5 @@ void lan966x_ptp_rxtstamp(struct lan966x *lan966x, struct sk_buff *skb,u32 lan966x_ptp_get_period_ps (void ) {/* This represents the system clock period in picoseconds */ -return 15125 ; +return PICO /LAN9X66_CLOCK_RATE ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/93 net/mlx5e: Fix validation logic in rate limiting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danielle Costantino <[email protected]>
[ Upstream commit d2099d9f16dbfa1c5266d4230ff7860047bb0b68 ]
The rate limiting validation condition currently checks the output variable max_bw_value[i] instead of the input value maxrate->tc_maxrate[i]. This causes the validation to compare an uninitialized or stale value rather than the actual requested rate.
The condition should check the input rate to properly validate against the upper limit:
} else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) {This aligns with the pattern used in the first branch, which correctly checks maxrate->tc_maxrate[i] against upper_limit_mbps.
The current implementation can lead to unreliable validation behavior:
- For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0 from initialization, the GBPS path may be taken regardless of whether the actual rate is within bounds
- When processing multiple TCs (i > 0), max_bw_value[i] contains the value computed for the previous TC, affecting the validation logic
- The overflow check for rates exceeding 255 Gbps may not trigger consistently depending on previous array values
This patch ensures the validation correctly examines the requested rate value for proper bounds checking.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +1 -1
@@ -619,7 +619,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, MLX5E_100MB); max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] :1 ; max_bw_unit[i] =MLX5_100_MBPS_UNIT ; - }else if (max_bw_value[i] <= upper_limit_gbps) { + }else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) { max_bw_value[i] =div_u64 (maxrate->tc_maxrate[i],MLX5E_1GB ); max_bw_unit[i] =MLX5_GBPS_UNIT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/93 net: sxgbe: fix potential NULL dereference in sxgbe_rx()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <[email protected]>
[ Upstream commit f5bce28f6b9125502abec4a67d68eabcd24b3b17 ]
Currently, when skb is null, the driver prints an error and then dereferences skb on the next line.
To fix this, let's add a 'break' after the error message to switch to sxgbe_rx_refill(), which is similar to the approach taken by the other drivers in this particular case, e.g. calxeda with xgmac_rx().
Found during a code review.
--- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c +3 -1
@@ -1521,8 +1521,10 @@ static int sxgbe_rx(struct sxgbe_priv_data *priv, int limit) skb = priv->rxq[qnum]->rx_skbuff[entry]; -if (unlikely (!skb)) +if (unlikely (!skb)) {netdev_err (priv->dev,"rx descriptor is not consistent\n" ); +break ; + }prefetch (skb->data -NET_IP_ALIGN ); priv->rxq[qnum]->rx_skbuff[entry] =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/93 drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 7fa666ab07ba9e08f52f357cb8e1aad753e83ac6 ]
If the board supports IP discovery, we don't need to parse the gpu info firmware.
Backport to 6.18.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -0
@@ -1941,6 +1941,8 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev) chip_name ="navi12" ;break ;case CHIP_CYAN_SKILLFISH : +if (adev->mman.discovery_bin) +return 0 ; chip_name ="cyan_skillfish" ;break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/93 net: dsa: sja1105: simplify static configuration reload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <[email protected]>
[ Upstream commit a18891b55703a45b700618ef40edd5e9aaecc345 ]
The static configuration reload saves the port speed in the static configuration tables by first converting it from the internal respresentation to the SPEED_xxx ethtool representation, and then converts it back to restore the setting. This is because sja1105_adjust_port_config() takes the speed as SPEED_xxx.
However, this is unnecessarily complex. If we split sja1105_adjust_port_config() up, we can simply save and restore the mac[port].speed member in the static configuration tables.
Stable-dep-of: da62abaaa268 ("net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic")
--- drivers/net/dsa/sja1105/sja1105_main.c | 65 ++++++++++++++------------ 1 file changed, 34 insertions(+), 31 deletions(-)
drivers/net/dsa/sja1105/sja1105_main.c +34 -31
@@ -1261,29 +1261,11 @@ static int sja1105_parse_dt(struct sja1105_private *priv)return rc; } -/* Convert link speed from SJA1105 to ethtool encoding */ -static int sja1105_port_speed_to_ethtool (struct sja1105_private *priv, -u64 speed) -{ -if (speed == priv->info->port_speed[SJA1105_SPEED_10MBPS ]) -return SPEED_10 ; -if (speed == priv->info->port_speed[SJA1105_SPEED_100MBPS ]) -return SPEED_100 ; -if (speed == priv->info->port_speed[SJA1105_SPEED_1000MBPS ]) -return SPEED_1000 ; -if (speed == priv->info->port_speed[SJA1105_SPEED_2500MBPS ]) -return SPEED_2500 ; -return SPEED_UNKNOWN ; -} - -/* Set link speed in the MAC configuration for a specific port. */ -static int sja1105_adjust_port_config (struct sja1105_private *priv,int port, -int speed_mbps) +static int sja1105_set_port_speed (struct sja1105_private *priv,int port, +int speed_mbps) {struct sja1105_mac_config_entry *mac; -struct device *dev = priv->ds->dev;u64 speed; -int rc;/* On P/Q/R/S, one can read from the device via the MAC reconfiguration * tables. On E/T, MAC reconfig tables are not readable, only writable.
@@ -1317,7 +1299,7 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port, speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS ];break ;default : -dev_err (dev,"Invalid speed %iMbps\n" , speed_mbps); +dev_err (priv->ds->dev,"Invalid speed %iMbps\n" , speed_mbps);return -EINVAL ; }
@@ -1329,11 +1311,31 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port,* we need to configure the PCS only (if even that). */ if (priv->phy_mode[port] ==PHY_INTERFACE_MODE_SGMII ) - mac[port].speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS ]; + speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS ];else if (priv->phy_mode[port] ==PHY_INTERFACE_MODE_2500BASEX ) - mac[port].speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS ]; -else - mac[port].speed = speed; + speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS ]; + + mac[port].speed = speed; + +return 0 ; +} + +/* Write the MAC Configuration Table entry and, if necessary, the CGU settings, +* after a link speedchange for this port. +*/ +static int sja1105_set_port_config (struct sja1105_private *priv,int port) +{ +struct sja1105_mac_config_entry *mac; +struct device *dev = priv->ds->dev; +int rc; + +/* On P/Q/R/S, one can read from the device via the MAC reconfiguration +* tables. On E/T, MAC reconfig tables are not readable, only writable. +* We have to *know* what the MAC looks like. For the sake of keeping +* the code common, we'll use the static configuration tables as a +* reasonable approximation for both E/T and P/Q/R/S. +*/ + mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG ].entries;/* Write to the dynamic reconfiguration tables */ rc = sja1105_dynamic_config_write(priv, BLK_IDX_MAC_CONFIG, port,
@@ -1383,7 +1385,8 @@ static void sja1105_mac_link_up(struct dsa_switch *ds, int port, {struct sja1105_private *priv = ds->priv; -sja1105_adjust_port_config (priv, port, speed); +if (!sja1105_set_port_speed (priv, port, speed)) +sja1105_set_port_config (priv, port);sja1105_inhibit_tx (priv,BIT (port), false); }
@@ -2284,8 +2287,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv, {struct ptp_system_timestamp ptp_sts_before;struct ptp_system_timestamp ptp_sts_after; -int speed_mbps[SJA1105_MAX_NUM_PORTS ];u16 bmcr[SJA1105_MAX_NUM_PORTS ] = {0 }; +u64 mac_speed[SJA1105_MAX_NUM_PORTS ];struct sja1105_mac_config_entry *mac;struct dsa_switch *ds = priv->ds;s64 t1, t2, t3, t4;
@@ -2298,14 +2301,13 @@ int sja1105_static_config_reload(struct sja1105_private *priv, mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG ].entries; -/* Back up the dynamic link speed changed by sja1105_adjust_port_config +/* Back up the dynamic link speed changed by sja1105_set_port_speed() * in order to temporarily restore it to SJA1105_SPEED_AUTO - which the * switch wants to see in the static config in order to allow us to * change it through the dynamic interface later. */ for (i =0 ; i < ds->num_ports; i++) { - speed_mbps[i] =sja1105_port_speed_to_ethtool (priv, - mac[i].speed); + mac_speed[i] = mac[i].speed; mac[i].speed = priv->info->port_speed[SJA1105_SPEED_AUTO ];if (priv->xpcs[i])
@@ -2368,7 +2370,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv,struct dw_xpcs *xpcs = priv->xpcs[i];unsigned int neg_mode; - rc =sja1105_adjust_port_config (priv, i, speed_mbps[i]); + mac[i].speed = mac_speed[i]; + rc =sja1105_set_port_config (priv, i);if (rc <0 ) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/93 net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit da62abaaa268357b1aa66b372ace562189a05df1 ]
When using the SGMII PCS as a fixed-link chip-to-chip connection, it is easy to miss the fact that traffic passes only at 1G, since that's what any normal such connection would use.
When using the SGMII PCS connected towards an on-board PHY or an SFP module, it is immediately noticeable that when the link resolves to a speed other than 1G, traffic from the MAC fails to pass: TX counters increase, but nothing gets decoded by the other end, and no local RX counters increase either.
Artificially lowering a fixed-link rate to speed = <100> makes us able to see the same issue as in the case of having an SGMII PHY.
Some debugging shows that the XPCS configuration is A-OK, but that the MAC Configuration Table entry for the port has the SPEED bits still set to 1000Mbps, due to a special condition in the driver. Deleting that condition, and letting the resolved link speed be programmed directly into the MAC speed field, results in a functional link at all 3 speeds.
This piece of evidence, based on testing on both generations with SGMII support (SJA1105S and SJA1110A) directly contradicts the statement from the blamed commit that "the MAC is fixed at 1 Gbps and we need to configure the PCS only (if even that)". Worse, that statement is not backed by any documentation, and no one from NXP knows what it might refer to.
I am unable to recall sufficient context regarding my testing from March 2020 to understand what led me to draw such a braindead and factually incorrect conclusion. Yet, there is nothing of value regarding forcing the MAC speed, either for SGMII or 2500Base-X (introduced at a later stage), so remove all such logic.
--- drivers/net/dsa/sja1105/sja1105_main.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/net/dsa/sja1105/sja1105_main.c +0 -7
@@ -1307,14 +1307,7 @@ static int sja1105_set_port_speed(struct sja1105_private *priv, int port,* table, since this will be used for the clocking setup, and we no * longer need to store it in the static config (already told hardware * we want auto during upload phase). -* Actually for the SGMII port, the MAC is fixed at 1 Gbps and -* we need to configure the PCS only (if even that). */ -if (priv->phy_mode[port] ==PHY_INTERFACE_MODE_SGMII ) - speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS ]; -else if (priv->phy_mode[port] ==PHY_INTERFACE_MODE_2500BASEX ) - speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS ]; - mac[port].speed = speed;return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/93 net: atlantic: fix fragment overflow handling in RX path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiefeng Zhang <[email protected]>
[ Upstream commit 5ffcb7b890f61541201461580bb6622ace405aec ]
The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.
The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.
Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path.
This crash occurred in production with an Aquantia AQC113 10G NIC.
Stack trace from production environment:
``` RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: <IRQ> aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ? __napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ```
Changes in v4:
- Add Fixes: tag to satisfy patch validation requirements.
Changes in v3:
- Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for.
--- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/aquantia/atlantic/aq_ring.c +5 -0
@@ -547,6 +547,11 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi,if (!buff->is_eop) {unsigned int frag_cnt =0U ; + +/* There will be an extra fragment */ +if (buff->len >AQ_CFG_RX_HDR_SIZE ) + frag_cnt++; + buff_ = buff; do { bool is_rsc_completed = true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/93 net: fec: cancel perout_timer when PEROUT is disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 50caa744689e505414673c20359b04aa918439e3 ]
The PEROUT allows the user to set a specified future time to output the periodic signal. If the future time is far from the current time, the FEC driver will use hrtimer to configure PEROUT one second before the future time. However, the hrtimer will not be canceled if the PEROUT is disabled before the hrtimer expires. So the PEROUT will be configured when the hrtimer expires, which is not as expected. Therefore, cancel the hrtimer in fec_ptp_pps_disable() to fix this issue.
--- drivers/net/ethernet/freescale/fec_ptp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fec_ptp.c +2 -0
@@ -498,6 +498,8 @@ static int fec_ptp_pps_disable(struct fec_enet_private *fep, uint channel) {unsigned long flags; +hrtimer_cancel (&fep->perout_timer); +spin_lock_irqsave (&fep->tmreg_lock, flags);writel (0 , fep->hwp +FEC_TCSR (channel));spin_unlock_irqrestore (&fep->tmreg_lock, flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/93 net: fec: do not update PEROUT if it is enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit e97faa0c20ea8840f45569ba434e30538fff8fc9 ]
If the previously set PEROUT is already active, updating it will cause the new PEROUT to start immediately instead of at the specified time. This is because fep->reload_period is updated whithout check whether the PEROUT is enabled, and the old PEROUT is not disabled. Therefore, the pulse period will be updated immediately in the pulse interrupt handler fec_pps_interrupt().
Currently, the driver does not support directly updating PEROUT and it will make the logic be more complicated. To fix the current issue, add a check before enabling the PEROUT, the driver will return an error if PEROUT is enabled. If users wants to update a new PEROUT, they should disable the old PEROUT first.
--- drivers/net/ethernet/freescale/fec.h | 1 + drivers/net/ethernet/freescale/fec_ptp.c | 43 ++++++++++++++++++------ 2 files changed, 34 insertions(+), 10 deletions(-)
drivers/net/ethernet/freescale/fec.h +1 -0
@@ -683,6 +683,7 @@ struct fec_enet_private {unsigned int reload_period;int pps_enable;unsigned int next_counter; +bool perout_enable;struct hrtimer perout_timer;u64 perout_stime;
drivers/net/ethernet/freescale/fec_ptp.c +33 -10
81 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/93 net: fec: do not allow enabling PPS and PEROUT simultaneously
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit c0a1f3d7e128e8d1b6c0fe09c68eac5ebcf677c8 ]
In the current driver, PPS and PEROUT use the same channel to generate the events, so they cannot be enabled at the same time. Otherwise, the later configuration will overwrite the earlier configuration. Therefore, when configuring PPS, the driver will check whether PEROUT is enabled. Similarly, when configuring PEROUT, the driver will check whether PPS is enabled.
--- drivers/net/ethernet/freescale/fec_ptp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/ethernet/freescale/fec_ptp.c +12 -0
@@ -129,6 +129,12 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable)spin_lock_irqsave (&fep->tmreg_lock, flags); +if (fep->perout_enable) { +spin_unlock_irqrestore (&fep->tmreg_lock, flags); +dev_err (&fep->pdev->dev,"PEROUT is running" ); +return -EBUSY ; + } +if (fep->pps_enable == enable) {spin_unlock_irqrestore (&fep->tmreg_lock, flags);return 0 ;
@@ -572,6 +578,12 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp, }spin_lock_irqsave (&fep->tmreg_lock, flags); +if (fep->pps_enable) { +dev_err (&fep->pdev->dev,"PPS is running" ); + ret = -EBUSY ; + goto unlock; + } +if (fep->perout_enable) {dev_err (&fep->pdev->dev,"PEROUT has been enabled\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/93 net: fec: do not register PPS event for PEROUT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 9a060d0fac9e75524f72864adec6d8cdb70a5bca ]
There are currently two situations that can trigger the PTP interrupt, one is the PPS event, the other is the PEROUT event. However, the irq handler fec_pps_interrupt() does not check the irq event type and directly registers a PPS event into the system, but the event may be a PEROUT event. This is incorrect because PEROUT is an output signal, while PPS is the input of the kernel PPS system. Therefore, add a check for the event type, if pps_enable is true, it means that the current event is a PPS event, and then the PPS event is registered.
--- drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_ptp.c +5 -2
@@ -719,8 +719,11 @@ static irqreturn_t fec_pps_interrupt(int irq, void *dev_id) fep->next_counter = (fep->next_counter + fep->reload_period) & fep->cc.mask; - event.type =PTP_CLOCK_PPS ; -ptp_clock_event (fep->ptp_clock, &event); +if (fep->pps_enable) { + event.type =PTP_CLOCK_PPS ; +ptp_clock_event (fep->ptp_clock, &event); + } +return IRQ_HANDLED ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/93 iio: st_lsm6dsx: Fixed calibrated timestamp calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Tesi <[email protected]>
[ Upstream commit 8abbf45fcda028c2c05ba38eb14ede9fa9e7341b ]
The calibrated timestamp is calculated from the nominal value using the formula:
ts_gain[ns] ≈ ts_sensitivity - (ts_trim_coeff * val) / 1000.
The values of ts_sensitivity and ts_trim_coeff are not the same for all devices, so it is necessary to differentiate them based on the part name. For the correct values please consult the relevant AN.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 18 ++++++++++++++++++ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 19 ++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +18 -0
@@ -190,6 +190,22 @@ struct st_lsm6dsx_fifo_ops {* @fifo_en: Hw timer FIFO enable register info (addr + mask). * @decimator: Hw timer FIFO decimator register info (addr + mask). * @freq_fine: Difference in % of ODR with respect to the typical. +* @ts_sensitivity: Nominal timestamp sensitivity. +* @ts_trim_coeff: Coefficient for calculating the calibrated timestamp gain. +* This coefficient comes into play when linearizing the formula +* used to calculate the calibrated timestamp (please see the +* relevant formula in the AN for the specific IMU). +* For example, in the case of LSM6DSO we have: +* +* 1 / (1 + x) ~= 1 - x (Taylor’s Series) +* ttrim[s] = 1 / (40000 * (1 + 0.0015 * val)) (from AN5192) +* ttrim[ns] ~= 25000 - 37.5 * val +* ttrim[ns] ~= 25000 - (37500 * val) / 1000 +* +* so, replacing ts_sensitivity = 25000 and +* ts_trim_coeff = 37500 +* +* ttrim[ns] ~= ts_sensitivity - (ts_trim_coeff * val) / 1000 */ struct st_lsm6dsx_hw_ts_settings {struct st_lsm6dsx_reg timer_en;
@@ -197,6 +213,8 @@ struct st_lsm6dsx_hw_ts_settings {struct st_lsm6dsx_reg fifo_en;struct st_lsm6dsx_reg decimator;u8 freq_fine; +u16 ts_sensitivity; +u16 ts_trim_coeff; };/**
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +8 -11
@@ -77,8 +77,6 @@#define ST_LSM6DSX_REG_WHOAMI_ADDR 0x0f -#define ST_LSM6DSX_TS_SENSITIVITY 25000UL/* 25us */ -static const struct iio_chan_spec st_lsm6dsx_acc_channels[] = {ST_LSM6DSX_CHANNEL_ACC (IIO_ACCEL ,0x28 ,IIO_MOD_X ,0 ),ST_LSM6DSX_CHANNEL_ACC (IIO_ACCEL ,0x2a ,IIO_MOD_Y ,1 ),
@@ -962,6 +960,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { .mask = GENMASK(7, 6), }, .freq_fine = 0x63, + .ts_sensitivity = 25000, + .ts_trim_coeff = 37500, }, .shub_settings = { .page_mux = {
@@ -1175,6 +1175,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { .mask = GENMASK(7, 6), }, .freq_fine = 0x63, + .ts_sensitivity = 25000, + .ts_trim_coeff = 37500, }, .event_settings = { .enable_reg = {
@@ -1350,6 +1352,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { .mask = GENMASK(7, 6), }, .freq_fine = 0x4f, + .ts_sensitivity = 21701, + .ts_trim_coeff = 28212, }, .shub_settings = { .page_mux = {
@@ -2243,20 +2247,13 @@ static int st_lsm6dsx_init_hw_timer(struct st_lsm6dsx_hw *hw) }/* calibrate timestamp sensitivity */ - hw->ts_gain =ST_LSM6DSX_TS_SENSITIVITY ; + hw->ts_gain = ts_settings->ts_sensitivity;if (ts_settings->freq_fine) { err =regmap_read (hw->regmap, ts_settings->freq_fine, &val);if (err <0 )return err; -/* -* linearize the AN5192 formula: -* 1 / (1 + x) ~= 1 - x (Taylor’s Series) -* ttrim[s] = 1 / (40000 * (1 + 0.0015 * val)) -* ttrim[ns] ~= 25000 - 37.5 * val -* ttrim[ns] ~= 25000 - (37500 * val) / 1000 -*/ - hw->ts_gain -= ((s8 )val *37500 ) /1000 ; + hw->ts_gain -= ((s8 )val * ts_settings->ts_trim_coeff) /1000 ; }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/93 usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 74851fbb6d647304f8a7dc491434d3a335ef4b8d ]
devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value, potentially causing pm_runtime_resume_and_get() to operate on uninitialized runtime PM state.
Check the return value of devm_pm_runtime_enable() and return on failure.
--- drivers/usb/gadget/udc/renesas_usbf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/renesas_usbf.c +3 -1
@@ -3262,7 +3262,9 @@ static int usbf_probe(struct platform_device *pdev)if (IS_ERR (udc->regs))return PTR_ERR (udc->regs); -devm_pm_runtime_enable (&pdev->dev); + ret =devm_pm_runtime_enable (&pdev->dev); +if (ret) +return ret; ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/93 mailbox: mailbox-test: Fix debugfs_create_dir error checking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 3acf1028f5003731977f750a7070f3321a9cb740 ]
The debugfs_create_dir() function returns ERR_PTR() on error, not NULL. The current null-check fails to catch errors.
Use IS_ERR() to correctly check for errors.
--- drivers/mailbox/mailbox-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/mailbox-test.c +1 -1
@@ -268,7 +268,7 @@ static int mbox_test_add_debugfs(struct platform_device *pdev,return 0 ; tdev->root_debugfs_dir =debugfs_create_dir (dev_name (&pdev->dev),NULL ); -if (!tdev->root_debugfs_dir) { +if (IS_ERR (tdev->root_debugfs_dir)) {dev_err (&pdev->dev,"Failed to create Mailbox debugfs\n" );return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/93 mailbox: pcc: Refactor error handling in irq handler into separate function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 3a675f50415b95f2ae10bfd932e2154ba1a08ee7 ]
The existing error handling logic in pcc_mbox_irq() is intermixed with the main flow of the function. The command complete check and the complete complete update/acknowledgment are nicely factored into separate functions.
Moves error detection and clearing logic into a separate function called:pcc_mbox_error_check_and_clear() by extracting error-handling logic from pcc_mbox_irq().
This ensures error checking and clearing are handled separately and it improves maintainability by keeping the IRQ handler focused on processing events.
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
--- drivers/mailbox/pcc.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-)
drivers/mailbox/pcc.c +20 -10
@@ -269,6 +269,25 @@ static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)return !!val; } +static int pcc_mbox_error_check_and_clear (struct pcc_chan_info *pchan) +{ +u64 val; +int ret; + + ret =pcc_chan_reg_read (&pchan->error, &val); +if (ret) +return ret; + + val &= pchan->error.status_mask; +if (val) { + val &= ~pchan->error.status_mask; +pcc_chan_reg_write (&pchan->error, val); +return -EIO ; + } + +return 0 ; +} +static void check_and_ack (struct pcc_chan_info *pchan,struct mbox_chan *chan) {struct acpi_pcct_ext_pcc_shared_memory pcc_hdr;
@@ -309,8 +328,6 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) {struct pcc_chan_info *pchan;struct mbox_chan *chan = p; -u64 val; -int ret; pchan = chan->con_priv;
@@ -324,15 +341,8 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)if (!pcc_mbox_cmd_complete_check (pchan))return IRQ_NONE ; - ret =pcc_chan_reg_read (&pchan->error, &val); -if (ret) +if (pcc_mbox_error_check_and_clear (pchan))return IRQ_NONE ; - val &= pchan->error.status_mask; -if (val) { - val &= ~pchan->error.status_mask; -pcc_chan_reg_write (&pchan->error, val); -return IRQ_NONE ; - }/* * Clear this flag after updating interrupt ack register and just
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/93 mailbox: pcc: dont zero error register
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit ff0e4d4c97c94af34cc9cad37b5a5cdbe597a3b0 ]
The error status mask for a type 3/4 subspace is used for reading the error status, and the bitwise inverse is used for clearing the error with the intent being to preserve any of the non-error bits. However, we were previously applying the mask to extract the status and then applying the inverse to the result which ended up clearing all bits.
Instead, store the inverse mask in the preserve mask and then use that on the original value read from the error status so that only the error is cleared.
--- drivers/mailbox/pcc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mailbox/pcc.c +4 -4
@@ -278,9 +278,8 @@ static int pcc_mbox_error_check_and_clear(struct pcc_chan_info *pchan)if (ret)return ret; - val &= pchan->error.status_mask; -if (val) { - val &= ~pchan->error.status_mask; +if (val & pchan->error.status_mask) { + val &= pchan->error.preserve_mask;pcc_chan_reg_write (&pchan->error, val);return -EIO ; }
@@ -673,7 +672,8 @@ static int pcc_parse_subspace_db_reg(struct pcc_chan_info *pchan, ret =pcc_chan_reg_init (&pchan->error, &pcct_ext->error_status_register, -0 ,0 , pcct_ext->error_status_mask, + ~pcct_ext->error_status_mask,0 , + pcct_ext->error_status_mask,"Error Status" ); }return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/93 spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
[ Upstream commit 3dcf44ab56e1d3ca3532083c0d5390b758e45b45 ]
This driver runs also on Tegra SoCs without a Tegra20 APB DMA controller (e.g. Tegra234).
Remove the Kconfig dependency on TEGRA20_APB_DMA; in addition, amend the help text to reflect the fact that this driver works on SoCs different from Tegra114.
--- drivers/spi/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/Kconfig +2 -2
@@ -1059,10 +1059,10 @@ config SPI_TEGRA210_QUAD config SPI_TEGRA114 tristate "NVIDIA Tegra114 SPI Controller" - depends on (ARCH_TEGRA && TEGRA20_APB_DMA) || COMPILE_TEST + depends on ARCH_TEGRA || COMPILE_TEST depends on RESET_CONTROLLER help - SPI driver for NVIDIA Tegra114 SPI Controller interface. This controller + SPI controller driver for NVIDIA Tegra114 and later SoCs. This controller is different than the older SoCs SPI controller and also register interface get changed with this controller.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/93 spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit a90903c2a3c38bce475f46ea3f93dbf6a9971553 ]
devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value, potentially causing runtime PM operations to fail silently after autosuspend configuration.
Check the return value of devm_pm_runtime_enable() and return on failure.
--- drivers/spi/spi-amlogic-spifc-a1.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/spi/spi-amlogic-spifc-a1.c +3 -1
@@ -349,7 +349,9 @@ static int amlogic_spifc_a1_probe(struct platform_device *pdev)pm_runtime_set_autosuspend_delay (spifc->dev,500 );pm_runtime_use_autosuspend (spifc->dev); -devm_pm_runtime_enable (spifc->dev); + ret =devm_pm_runtime_enable (spifc->dev); +if (ret) +return ret; ctrl->num_chipselect =1 ; ctrl->dev.of_node = pdev->dev.of_node;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/93 spi: spi-mem: Allow specifying the byte order in Octal DTR mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tudor Ambarus <[email protected]>
[ Upstream commit 030ace430afcf847f537227afceb22dfe8fb8fc8 ]
There are NOR flashes (Macronix) that swap the bytes on a 16-bit boundary when configured in Octal DTR mode. The byte order of 16-bit words is swapped when read or written in Octal Double Transfer Rate (DTR) mode compared to Single Transfer Rate (STR) modes. If one writes D0 D1 D2 D3 bytes using 1-1-1 mode, and uses 8D-8D-8D SPI mode for reading, it will read back D1 D0 D3 D2. Swapping the bytes may introduce some endianness problems. It can affect the boot sequence if the entire boot sequence is not handled in either 8D-8D-8D mode or 1-1-1 mode. Therefore, it is necessary to swap the bytes back to ensure the same byte order as in STR modes. Fortunately there are controllers that could swap the bytes back at runtime, addressing the flash's endianness requirements. Provide a way for the upper layers to specify the byte order in Octal DTR mode.
Merge Tudor's patch and add modifications for suiting newer version of Linux kernel.
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
--- drivers/spi/spi-mem.c | 3 +++ include/linux/spi/spi-mem.h | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-)
drivers/spi/spi-mem.c +3 -0
@@ -172,6 +172,9 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,if (!spi_mem_controller_is_capable (ctlr, dtr))return false; +if (op->data.swap16 && !spi_mem_controller_is_capable (ctlr, swap16)) +return false; +if (op->cmd.nbytes !=2 )return false; }else {
include/linux/spi/spi-mem.h +7 -1
@@ -90,6 +90,8 @@ enum spi_mem_data_dir {* @data.buswidth: number of IO lanes used to send/receive the data * @data.dtr: whether the data should be sent in DTR mode or not * @data.ecc: whether error correction is required or not +* @data.swap16: whether the byte order of 16-bit words is swapped when read +* or written in Octal DTR mode compared to STR mode. * @data.dir: direction of the transfer * @data.nbytes: number of data bytes to send/receive. Can be zero if the * operation does not involve transferring data
@@ -124,7 +126,8 @@ struct spi_mem_op {u8 buswidth; u8 dtr : 1; u8 ecc : 1; - u8 __pad : 6; + u8 swap16 : 1; + u8 __pad : 5;enum spi_mem_data_dir dir;unsigned int nbytes;union {
@@ -295,10 +298,13 @@ struct spi_controller_mem_ops {* struct spi_controller_mem_caps - SPI memory controller capabilities * @dtr: Supports DTR operations * @ecc: Supports operations with error correction +* @swap16: Supports swapping bytes on a 16 bit boundary when configured in +* Octal DTR */ struct spi_controller_mem_caps {bool dtr;bool ecc; +bool swap16; };#define spi_mem_controller_is_capable (ctlr, cap) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/93 spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 0fefeade90e74bc8f40ab0e460f483565c492e28 ]
In the spi subsystem, the bus frequency is derived as follows:
- the controller may expose a minimum and maximum operating frequency
- the hardware description, through the spi peripheral properties, advise what is the maximum acceptable frequency from a device/wiring point of view.
Transfers must be observed at a frequency which fits both (so in practice, the lowest maximum).
Actually, this second point mixes two information and already takes the lowest frequency among:
- what the spi device is capable of (what is written in the component datasheet)
- what the wiring allows (electromagnetic sensibility, crossovers, terminations, antenna effect, etc).
This logic works until spi devices are no longer capable of sustaining their highest frequency regardless of the operation. Spi memories are typically subject to such variation. Some devices are capable of spitting their internally stored data (essentially in read mode) at a very fast rate, typically up to 166MHz on Winbond SPI-NAND chips, using "fast" commands. However, some of the low-end operations, such as regular page read-from-cache commands, are more limited and can only be executed at 54MHz at most. This is currently a problem in the SPI-NAND subsystem. Another situation, even if not yet supported, will be with DTR commands, when the data is latched on both edges of the clock. The same chips as mentioned previously are in this case limited to 80MHz. Yet another example might be continuous reads, which, under certain circumstances, can also run at most at 104 or 120MHz.
As a matter of fact, the "one frequency per chip" policy is outdated and more fine grain configuration is needed: we need to allow per-operation frequency limitations. So far, all datasheets I encountered advertise a maximum default frequency, which need to be lowered for certain specific operations. So based on the current infrastructure, we can still expect firmware (device trees in general) to continued advertising the same maximum speed which is a mix between the PCB limitations and the chip maximum capability, and expect per-operation lower frequencies when this is relevant.
Add a struct spi_mem_op member to carry this information. Not providing this field explicitly from upper layers means that there is no further constraint and the default spi device maximum speed will be carried instead. The SPI_MEM_OP() macro is also expanded with an optional frequency argument, because virtually all operations can be subject to such a limitation, and this will allow for a smooth and discrete transition.
For controller drivers which do not implement the spi-mem interface, the per-transfer speed is also set acordingly to a lower (than the maximum default) speed when relevant.
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
--- drivers/mtd/nand/spi/core.c | 2 ++ drivers/spi/spi-mem.c | 28 ++++++++++++++++++++++++++++ include/linux/spi/spi-mem.h | 12 +++++++++++- 3 files changed, 41 insertions(+), 1 deletion(-)
drivers/mtd/nand/spi/core.c +2 -0
@@ -1044,6 +1044,8 @@ spinand_select_op_variant(struct spinand_device *spinand,if (ret)break ; +spi_mem_adjust_op_freq (spinand->spimem, &op); +if (!spi_mem_supports_op (spinand->spimem, &op))break ;
drivers/spi/spi-mem.c +28 -0
@@ -187,6 +187,10 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,return false; } +if (op->max_freq && mem->spi->controller->min_speed_hz && + op->max_freq < mem->spi->controller->min_speed_hz) +return false; +return spi_mem_check_buswidth (mem, op); }EXPORT_SYMBOL_GPL (spi_mem_default_supports_op);
@@ -321,6 +325,9 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)u8 *tmpbuf;int ret; +/* Make sure the operation frequency is correct before going futher */ +spi_mem_adjust_op_freq (mem, (struct spi_mem_op *)op); + ret =spi_mem_check_op (op);if (ret)return ret;
@@ -363,6 +370,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) xfers[xferpos].tx_buf = tmpbuf; xfers[xferpos].len = op->cmd.nbytes; xfers[xferpos].tx_nbits = op->cmd.buswidth; + xfers[xferpos].speed_hz = op->max_freq;spi_message_add_tail (&xfers[xferpos], &msg); xferpos++; totalxferlen++;
@@ -377,6 +385,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) xfers[xferpos].tx_buf = tmpbuf +1 ; xfers[xferpos].len = op->addr.nbytes; xfers[xferpos].tx_nbits = op->addr.buswidth; + xfers[xferpos].speed_hz = op->max_freq;spi_message_add_tail (&xfers[xferpos], &msg); xferpos++; totalxferlen += op->addr.nbytes;
@@ -388,6 +397,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) xfers[xferpos].len = op->dummy.nbytes; xfers[xferpos].tx_nbits = op->dummy.buswidth; xfers[xferpos].dummy_data =1 ; + xfers[xferpos].speed_hz = op->max_freq;spi_message_add_tail (&xfers[xferpos], &msg); xferpos++; totalxferlen += op->dummy.nbytes;
@@ -403,6 +413,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) } xfers[xferpos].len = op->data.nbytes; + xfers[xferpos].speed_hz = op->max_freq;spi_message_add_tail (&xfers[xferpos], &msg); xferpos++; totalxferlen += op->data.nbytes;
@@ -481,6 +492,23 @@ int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op) }EXPORT_SYMBOL_GPL (spi_mem_adjust_op_size); +/** +* spi_mem_adjust_op_freq() - Adjust the frequency of a SPI mem operation to +* match controller, PCB and chip limitations +* @mem: the SPI memory +* @op: the operation to adjust +* +* Some chips have per-op frequency limitations and must adapt the maximum +* speed. This function allows SPI mem drivers to set @op->max_freq to the +* maximum supported value. +*/ +void spi_mem_adjust_op_freq (struct spi_mem *mem,struct spi_mem_op *op) +{ +if (!op->max_freq || op->max_freq > mem->spi->max_speed_hz) + op->max_freq = mem->spi->max_speed_hz; +} +EXPORT_SYMBOL_GPL (spi_mem_adjust_op_freq); +static ssize_t spi_mem_no_dirmap_read (struct spi_mem_dirmap_desc *desc,u64 offs,size_t len,void *buf) {
include/linux/spi/spi-mem.h +11 -1
@@ -68,6 +68,9 @@ enum spi_mem_data_dir { SPI_MEM_DATA_OUT, }; +#define SPI_MEM_OP_MAX_FREQ (__freq) \ + .max_freq = __freq +/** * struct spi_mem_op - describes a SPI memory operation * @cmd.nbytes: number of opcode bytes (only 1 or 2 are valid). The opcode is
@@ -97,6 +100,9 @@ enum spi_mem_data_dir {* operation does not involve transferring data * @data.buf.in: input buffer (must be DMA-able) * @data.buf.out: output buffer (must be DMA-able) +* @max_freq: frequency limitation wrt this operation. 0 means there is no +* specific constraint and the highest achievable frequency can be +* attempted. */ struct spi_mem_op { struct {
@@ -135,14 +141,17 @@ struct spi_mem_op {const void *out; } buf; } data; + +unsigned int max_freq; }; -#define SPI_MEM_OP (__cmd, __addr, __dummy, __data) \ +#define SPI_MEM_OP (__cmd, __addr, __dummy, __data, ...) \ { \ .cmd = __cmd, \ .addr = __addr, \ .dummy = __dummy, \ .data = __data, \ + __VA_ARGS__ \ }/**
@@ -369,6 +378,7 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,#endif /* CONFIG_SPI_MEM */ int spi_mem_adjust_op_size (struct spi_mem *mem,struct spi_mem_op *op); +void spi_mem_adjust_op_freq (struct spi_mem *mem,struct spi_mem_op *op);bool spi_mem_supports_op (struct spi_mem *mem,const struct spi_mem_op *op);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/93 spi: spi-mem: Add a new controller capability
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 1248c9b8d54120950fda10fbeb98fb8932b4d45c ]
There are spi devices with multiple frequency limitations depending on the invoked command. We probably do not want to afford running at the lowest supported frequency all the time, so if we want to get the most of our hardware, we need to allow per-operation frequency limitations.
Among all the SPI memory controllers, I believe all are capable of changing the spi frequency on the fly. Some of the drivers do not make any frequency setup though. And some others will derive a per chip prescaler value which will be used forever.
Actually changing the frequency on the fly is something new in Linux, so we need to carefully flag the drivers which do and do not support it. A controller capability is created for that, and the presence for this capability will always be checked before accepting such pattern.
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
--- drivers/spi/spi-mem.c | 6 ++++++ include/linux/spi/spi-mem.h | 2 ++ 2 files changed, 8 insertions(+)
drivers/spi/spi-mem.c +6 -0
@@ -191,6 +191,12 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, op->max_freq < mem->spi->controller->min_speed_hz)return false; +if (op->max_freq && + op->max_freq < mem->spi->max_speed_hz) { +if (!spi_mem_controller_is_capable (ctlr, per_op_freq)) +return false; + } +return spi_mem_check_buswidth (mem, op); }EXPORT_SYMBOL_GPL (spi_mem_default_supports_op);
include/linux/spi/spi-mem.h +2 -0
@@ -309,11 +309,13 @@ struct spi_controller_mem_ops {* @ecc: Supports operations with error correction * @swap16: Supports swapping bytes on a 16 bit boundary when configured in * Octal DTR +* @per_op_freq: Supports per operation frequency switching */ struct spi_controller_mem_caps {bool dtr;bool ecc;bool swap16; +bool per_op_freq; };#define spi_mem_controller_is_capable (ctlr, cap) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/93 spi: nxp-fspi: Support per spi-mem operation frequency switches
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 26851cf65ffca2d3a8d529a125e54cf0084d69e7 ]
Every ->exec_op() call correctly configures the spi bus speed to the maximum allowed frequency for the memory using the constant spi default parameter. Since we can now have per-operation constraints, let's use the value that comes from the spi-mem operation structure instead. In case there is no specific limitation for this operation, the default spi device value will be given anyway.
The per-operation frequency capability is thus advertised to the spi-mem core.
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
--- drivers/spi/spi-nxp-fspi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/spi/spi-nxp-fspi.c +9 -3
@@ -711,9 +711,10 @@ static void nxp_fspi_dll_calibration(struct nxp_fspi *f)* Value for rest of the CS FLSHxxCR0 register would be zero. * */ -static void nxp_fspi_select_mem (struct nxp_fspi *f,struct spi_device *spi) +static void nxp_fspi_select_mem (struct nxp_fspi *f,struct spi_device *spi, +const struct spi_mem_op *op) { -unsigned long rate = spi->max_speed_hz; +unsigned long rate = op->max_freq;int ret;uint64_t size_kb;
@@ -938,7 +939,7 @@ static int nxp_fspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) FSPI_STS0_ARB_IDLE, 1, POLL_TOUT, true);WARN_ON (err); -nxp_fspi_select_mem (f, mem->spi); +nxp_fspi_select_mem (f, mem->spi, op);nxp_fspi_prepare_lut (f, op);/*
@@ -1156,6 +1157,10 @@ static const struct spi_controller_mem_ops nxp_fspi_mem_ops = { .get_name = nxp_fspi_get_name, }; +static const struct spi_controller_mem_caps nxp_fspi_mem_caps = { + .per_op_freq = true, +}; +static int nxp_fspi_probe (struct platform_device *pdev) {struct spi_controller *ctlr;
@@ -1253,6 +1258,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) ctlr->bus_num =-1 ; ctlr->num_chipselect =NXP_FSPI_MAX_CHIPSELECT ; ctlr->mem_ops = &nxp_fspi_mem_ops; + ctlr->mem_caps = &nxp_fspi_mem_caps;nxp_fspi_default_setup (f);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/93 spi: nxp-fspi: Propagate fwnode in ACPI case as well
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 40ad64ac25bb736740f895d99a4aebbda9b80991 ]
Propagate fwnode of the ACPI device to the SPI controller Linux device. Currently only OF case propagates fwnode to the controller.
While at it, replace several calls to dev_fwnode() with a single one cached in a local variable, and unify checks for fwnode type by using is_*_node() APIs.
--- drivers/spi/spi-nxp-fspi.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/spi/spi-nxp-fspi.c +5 -5
@@ -1165,7 +1165,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) {struct spi_controller *ctlr;struct device *dev = &pdev->dev; -struct device_node *np = dev->of_node; +struct fwnode_handle *fwnode =dev_fwnode (dev);struct resource *res;struct nxp_fspi *f;int ret;
@@ -1189,7 +1189,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)platform_set_drvdata (pdev, f);/* find the resources - configuration register address space */ -if (is_acpi_node (dev_fwnode (f->dev))) +if (is_acpi_node (fwnode)) f->iobase =devm_platform_ioremap_resource (pdev,0 );else f->iobase =devm_platform_ioremap_resource_byname (pdev,"fspi_base" );
@@ -1200,7 +1200,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) }/* find the resources - controller memory mapped space */ -if (is_acpi_node (dev_fwnode (f->dev))) +if (is_acpi_node (fwnode)) res =platform_get_resource (pdev,IORESOURCE_MEM ,1 );else res = platform_get_resource_byname(pdev,
@@ -1216,7 +1216,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) f->memmap_phy_size =resource_size (res);/* find the clocks */ -if (dev_of_node (&pdev->dev)) { +if (is_of_node (fwnode)) { f->clk_en =devm_clk_get (dev,"fspi_en" );if (IS_ERR (f->clk_en)) { ret =PTR_ERR (f->clk_en);
@@ -1262,7 +1262,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)nxp_fspi_default_setup (f); - ctlr->dev.of_node = np; +device_set_node (&ctlr->dev, fwnode); ret =devm_spi_register_controller (&pdev->dev, ctlr);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/93 spi: bcm63xx: fix premature CS deassertion on RX-only transactions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hang Zhou <[email protected]>
[ Upstream commit fd9862f726aedbc2f29a29916cabed7bcf5cadb6 ]
On BCM6358 (and also observed on BCM6368) the controller appears to only generate as many SPI clocks as bytes that have been written into the TX FIFO. For RX-only transfers the driver programs the transfer length in SPI_MSG_CTL but does not write anything into the FIFO, so chip select is deasserted early and the RX transfer segment is never fully clocked in.
A concrete failing case is a three-transfer MAC address read from SPI-NOR:
- TX 0x03 (read command)
- TX 3-byte address
- RX 6 bytes (MAC)
In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works because the driver uses prepend_len and writes dummy bytes into the TX FIFO for the RX part.
Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only segments so that the number of bytes written to the FIFO matches the total message length seen by the controller.
--- drivers/spi/spi-bcm63xx.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/spi/spi-bcm63xx.c +14 -0
@@ -247,6 +247,20 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *first,if (t->rx_buf) { do_rx = true; + +/* +* In certain hardware implementations, there appears to be a +* hidden accumulator that tracks the number of bytes written into +* the hardware FIFO, and this accumulator overrides the length in +* the SPI_MSG_CTL register. +* +* Therefore, for read-only transfers, we need to write some dummy +* value into the FIFO to keep the accumulator tracking the correct +* length. +*/ +if (!t->tx_buf) +memset_io (bs->tx_io + len,0xFF , t->len); +/* prepend is half-duplex write only */ if (t == first) prepend_len =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/93 Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed upstream.
This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3.
Currently we store initial stacktrace entry twice for non-HW ot_regs, which means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel.
It's easy to reproduce this bpftrace:
# bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }'
Attaching 1 probe... bprm_execve+1767
bprm_execve+1767
do_execveat_common.isra.0+425
__x64_sys_execve+56
do_syscall_64+133
entry_SYSCALL_64_after_hwframe+118When perf_callchain_kernel calls unwind_start with first_frame, AFAICS we do not skip regs->ip, but it's added as part of the unwind process. Hence reverting the extra perf_callchain_store for non-hw regs leg.
I was not able to bisect this, so I'm not really sure why this was needed in v5.2 and why it's not working anymore, but I could see double entries as far as v5.10.
I did the test for both ORC and framepointer unwind with and without the this fix and except for the initial entry the stacktraces are the same.
--- arch/x86/events/core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/x86/events/core.c +5 -5
@@ -2769,13 +2769,13 @@ perf_callchain_kernel(struct perf_callchreturn ; } -if (perf_callchain_store (entry, regs->ip)) -return ; - -if (perf_hw_regs (regs)) +if (perf_hw_regs (regs)) { +if (perf_callchain_store (entry, regs->ip)) +return ;unwind_start (&state, current, regs,NULL ); -else + }else {unwind_start (&state, current,NULL , (void *)regs->sp); + }for (; !unwind_done (&state);unwind_next_frame (&state)) { addr =unwind_get_return_address (&state);
Greg Kroah-Hartman
maintainerPATCH 35/93 iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a upstream.
The decimator and batch fields of struct st_lsm6dsx_settings are arrays indexed by sensor type, not by sensor hardware identifier; moreover, the batch field is only used for the accelerometer and gyroscope.
Change the array size for decimator from ST_LSM6DSX_MAX_ID to ST_LSM6DSX_ID_MAX, and change the array size for batch from ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id definition so that the ST_LSM6DSX_ID_MAX value is usable within the struct st_lsm6dsx_settings definition.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +11 -11
@@ -268,6 +268,15 @@ struct st_lsm6dsx_event_settings {u8 wakeup_src_x_mask; }; +enum st_lsm6dsx_sensor_id { +ST_LSM6DSX_ID_GYRO , +ST_LSM6DSX_ID_ACC , +ST_LSM6DSX_ID_EXT0 , +ST_LSM6DSX_ID_EXT1 , +ST_LSM6DSX_ID_EXT2 , +ST_LSM6DSX_ID_MAX +}; +enum st_lsm6dsx_ext_sensor_id {ST_LSM6DSX_ID_MAGN , };
@@ -353,23 +362,14 @@ struct st_lsm6dsx_settings {struct st_lsm6dsx_odr_table_entry odr_table[2 ];struct st_lsm6dsx_samples_to_discard samples_to_discard[2 ];struct st_lsm6dsx_fs_table_entry fs_table[2 ]; -struct st_lsm6dsx_reg decimator[ST_LSM6DSX_MAX_ID ]; -struct st_lsm6dsx_reg batch[ST_LSM6DSX_MAX_ID ]; +struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX ]; +struct st_lsm6dsx_reg batch[2 ];struct st_lsm6dsx_fifo_ops fifo_ops;struct st_lsm6dsx_hw_ts_settings ts_settings;struct st_lsm6dsx_shub_settings shub_settings;struct st_lsm6dsx_event_settings event_settings; }; -enum st_lsm6dsx_sensor_id { -ST_LSM6DSX_ID_GYRO , -ST_LSM6DSX_ID_ACC , -ST_LSM6DSX_ID_EXT0 , -ST_LSM6DSX_ID_EXT1 , -ST_LSM6DSX_ID_EXT2 , -ST_LSM6DSX_ID_MAX , -}; -enum st_lsm6dsx_fifo_mode {ST_LSM6DSX_FIFO_BYPASS =0x0 ,ST_LSM6DSX_FIFO_CONT =0x6 ,
Greg Kroah-Hartman
maintainerPATCH 36/93 iio:common:ssp_sensors: Fix an error handling path ssp_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit 21553258b94861a73d7f2cf15469d69240e1170d upstream.
If an error occurs after a successful mfd_add_devices() call, it should be undone by a corresponding mfd_remove_devices() call, as already done in the remove function.
--- drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/common/ssp_sensors/ssp_dev.c +3 -1
@@ -503,7 +503,7 @@ static int ssp_probe(struct spi_device * ret =spi_setup (spi);if (ret <0 ) {dev_err (&spi->dev,"Failed to setup spi\n" ); -return ret; + goto err_setup_spi; } data->fw_dl_state =SSP_FW_DL_STATE_NONE ;
@@ -568,6 +568,8 @@ err_read_reg: err_setup_irq:mutex_destroy (&data->pending_lock);mutex_destroy (&data->comm_lock); +err_setup_spi: +mfd_remove_devices (&spi->dev);dev_err (&spi->dev,"Probe failed!\n" );
Greg Kroah-Hartman
maintainerPATCH 37/93 iio: accel: bmc150: Fix irq assumption regression
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 3aa385a9c75c09b59dcab2ff76423439d23673ab upstream.
The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts:
Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read
PC is at bmc150_accel_set_interrupt+0x98/0x194
LR is at __pm_runtime_resume+0x5c/0x64
(...)
Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4
This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why.
Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not.
--- drivers/iio/accel/bmc150-accel-core.c | 5 +++++ drivers/iio/accel/bmc150-accel.h | 1 + 2 files changed, 6 insertions(+)
drivers/iio/accel/bmc150-accel-core.c +5 -0
@@ -569,6 +569,10 @@ static int bmc150_accel_set_interrupt(stconst struct bmc150_accel_interrupt_info *info = intr->info;int ret; +/* We do not always have an IRQ */ +if (data->irq <=0 ) +return 0 ; +if (state) {if (atomic_inc_return (&intr->users) >1 )return 0 ;
@@ -1743,6 +1747,7 @@ int bmc150_accel_core_probe(struct devic }if (irq >0 ) { + data->irq = irq; ret = devm_request_threaded_irq(dev, irq, bmc150_accel_irq_handler, bmc150_accel_irq_thread_handler,
drivers/iio/accel/bmc150-accel.h +1 -0
@@ -57,6 +57,7 @@ enum bmc150_accel_trigger_id {struct bmc150_accel_data {struct regmap *regmap; +int irq;struct regulator_bulk_data regulators[2 ];struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS ];struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS ];
Greg Kroah-Hartman
maintainerPATCH 38/93 iio: accel: fix ADXL355 startup race condition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valek Andrej <[email protected]>
commit c92c1bc408e9e11ae3c7011b062fdd74c09283a3 upstream.
There is an race-condition where device is not full working after SW reset. Therefore it's necessary to wait some time after reset and verify shadow registers values by reading and comparing the values before/after reset. This mechanism is described in datasheet at least from revision D.
--- drivers/iio/accel/adxl355_core.c | 44 ++++++++++++++++++++++++++++++++++----- 1 file changed, 39 insertions(+), 5 deletions(-)
drivers/iio/accel/adxl355_core.c +39 -5
@@ -56,6 +56,8 @@#define ADXL355_POWER_CTL_DRDY_MSK BIT(2)#define ADXL355_SELF_TEST_REG 0x2E#define ADXL355_RESET_REG 0x2F +#define ADXL355_BASE_ADDR_SHADOW_REG 0x50 +#define ADXL355_SHADOW_REG_COUNT 5#define ADXL355_DEVID_AD_VAL 0xAD#define ADXL355_DEVID_MST_VAL 0x1D
@@ -294,7 +296,12 @@ static void adxl355_fill_3db_frequency_tstatic int adxl355_setup (struct adxl355_data *data) {unsigned int regval; +int retries =5 ;/* the number is chosen based on empirical reasons */ int ret; + u8 *shadow_regs __free(kfree) = kzalloc(ADXL355_SHADOW_REG_COUNT, GFP_KERNEL); + +if (!shadow_regs) +return -ENOMEM ; ret =regmap_read (data->regmap,ADXL355_DEVID_AD_REG , ®val);if (ret)
@@ -321,14 +328,41 @@ static int adxl355_setup(struct adxl355_if (regval !=ADXL355_PARTID_VAL )dev_warn (data->dev,"Invalid DEV ID 0x%02x\n" , regval); -/* -* Perform a software reset to make sure the device is in a consistent -* state after start-up. -*/ - ret =regmap_write (data->regmap,ADXL355_RESET_REG ,ADXL355_RESET_CODE ); +/* Read shadow registers to be compared after reset */ + ret =regmap_bulk_read (data->regmap, +ADXL355_BASE_ADDR_SHADOW_REG , + shadow_regs,ADXL355_SHADOW_REG_COUNT );if (ret)return ret; +do { +if (--retries ==0 ) { +dev_err (data->dev,"Shadow registers mismatch\n" ); +return -EIO ; + } + +/* +* Perform a software reset to make sure the device is in a consistent +* state after start-up. +*/ + ret =regmap_write (data->regmap,ADXL355_RESET_REG , +ADXL355_RESET_CODE ); +if (ret) +return ret; + +/* Wait at least 5ms after software reset */ +usleep_range (5000 ,10000 ); + +/* Read shadow registers for comparison */ + ret =regmap_bulk_read (data->regmap, +ADXL355_BASE_ADDR_SHADOW_REG , + data->buffer.buf, +ADXL355_SHADOW_REG_COUNT ); +if (ret) +return ret; + }while (memcmp (shadow_regs, data->buffer.buf, +ADXL355_SHADOW_REG_COUNT )); + ret =regmap_update_bits (data->regmap,ADXL355_POWER_CTL_REG ,ADXL355_POWER_CTL_DRDY_MSK ,FIELD_PREP (ADXL355_POWER_CTL_DRDY_MSK ,1 ));
Greg Kroah-Hartman
maintainerPATCH 39/93 iio: adc: ad7280a: fix ad7280_store_balance_timer()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit bd886cdcbf9e746f61c74035a3acd42e9108e115 upstream.
Use correct argument to iio_str_to_fixpoint() to parse 3 decimal places.
iio_str_to_fixpoint() has a bit of an unintuitive API where the fract_mult parameter is the multiplier of the first decimal place as if it was already an integer. So to get 3 decimal places, fract_mult must be 100 rather than 1000.
--- drivers/iio/adc/ad7280a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7280a.c +1 -1
@@ -540,7 +540,7 @@ static ssize_t ad7280_store_balance_timeint val, val2;int ret; - ret =iio_str_to_fixpoint (buf,1000 , &val, &val2); + ret =iio_str_to_fixpoint (buf,100 , &val, &val2);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 40/93 MIPS: mm: Prevent a TLB shutdown on initial uniquification
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 upstream.
Depending on the particular CPU implementation a TLB shutdown may occur if multiple matching entries are detected upon the execution of a TLBP or the TLBWI/TLBWR instructions. Given that we don't know what entries we have been handed we need to be very careful with the initial TLB setup and avoid all these instructions.
Therefore read all the TLB entries one by one with the TLBR instruction, bypassing the content addressing logic, and truncate any large pages in place so as to avoid a case in the second step where an incoming entry for a large page at a lower address overlaps with a replacement entry chosen at another index. Then preinitialize the TLB using addresses outside our usual unique range and avoiding clashes with any entries received, before making the usual call to local_flush_tlb_all().
This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual address).
--- arch/mips/mm/tlb-r4k.c | 102 ++++++++++++++++++++++++++++++------------------- 1 file changed, 64 insertions(+), 38 deletions(-)
arch/mips/mm/tlb-r4k.c +64 -38
@@ -15,6 +15,7 @@#include <linux/mm.h> #include <linux/hugetlb.h> #include <linux/export.h> +#include <linux/sort.h> #include <asm/cpu.h> #include <asm/cpu-type.h>
@@ -506,55 +507,79 @@ static int __init set_ntlb(char *str)__setup ("ntlb=" , set_ntlb); -/* Initialise all TLB entries with unique values */ + +/* Comparison function for EntryHi VPN fields. */ +static int r4k_vpn_cmp (const void *a,const void *b) +{ +long v = *(unsigned long *)a - *(unsigned long *)b; +int s =sizeof (long ) >sizeof (int ) ?sizeof (long ) *8 -1 :0 ; +return s ? (v !=0 ) | v >> s : v; +} + +/* +* Initialise all TLB entries with unique values that do not clash with +* what we have been handed over and what we'll be using ourselves. +*/ static void r4k_tlb_uniquify (void ) { -int entry =num_wired_entries (); +unsigned long tlb_vpns[1 <<MIPS_CONF1_TLBS_SIZE ]; +int tlbsize = current_cpu_data.tlbsize; +int start =num_wired_entries (); +unsigned long vpn_mask; +int cnt, ent, idx, i; + + vpn_mask =GENMASK (cpu_vmbits -1 ,13 ); + vpn_mask |=IS_ENABLED (CONFIG_64BIT ) ?3ULL <<62 :1 <<31 ;htw_stop (); -write_c0_entrylo0 (0 ); -write_c0_entrylo1 (0 ); -while (entry < current_cpu_data.tlbsize) { -unsigned long asid_mask =cpu_asid_mask (¤t_cpu_data); -unsigned long asid =0 ; -int idx; +for (i = start, cnt =0 ; i < tlbsize; i++, cnt++) { +unsigned long vpn; -/* Skip wired MMID to make ginvt_mmid work */ -if (cpu_has_mmid) - asid =MMID_KERNEL_WIRED +1 ; +write_c0_index (i); +mtc0_tlbr_hazard (); +tlb_read (); +tlb_read_hazard (); + vpn =read_c0_entryhi (); + vpn &= vpn_mask &PAGE_MASK ; + tlb_vpns[cnt] = vpn; -/* Check for match before using UNIQUE_ENTRYHI */ -do { -if (cpu_has_mmid) { -write_c0_memorymapid (asid); -write_c0_entryhi (UNIQUE_ENTRYHI (entry)); - }else { -write_c0_entryhi (UNIQUE_ENTRYHI (entry) | asid); - } -mtc0_tlbw_hazard (); -tlb_probe (); -tlb_probe_hazard (); - idx =read_c0_index (); -/* No match or match is on current entry */ -if (idx <0 || idx == entry) -break ; -/* -* If we hit a match, we need to try again with -* a different ASID. -*/ - asid++; - }while (asid < asid_mask); - -if (idx >=0 && idx != entry) -panic ("Unable to uniquify TLB entry %d" , idx); - -write_c0_index (entry); +/* Prevent any large pages from overlapping regular ones. */ +write_c0_pagemask (read_c0_pagemask () &PM_DEFAULT_MASK );mtc0_tlbw_hazard ();tlb_write_indexed (); - entry++; +tlbw_use_hazard (); } +sort (tlb_vpns, cnt,sizeof (tlb_vpns[0 ]), r4k_vpn_cmp,NULL ); + +write_c0_pagemask (PM_DEFAULT_MASK ); +write_c0_entrylo0 (0 ); +write_c0_entrylo1 (0 ); + + idx =0 ; + ent = tlbsize; +for (i = start; i < tlbsize; i++) +while (1 ) { +unsigned long entryhi, vpn; + + entryhi =UNIQUE_ENTRYHI (ent); + vpn = entryhi & vpn_mask &PAGE_MASK ; + +if (idx >= cnt || vpn < tlb_vpns[idx]) { +write_c0_entryhi (entryhi); +write_c0_index (i); +mtc0_tlbw_hazard (); +tlb_write_indexed (); + ent++; +break ; + }else if (vpn == tlb_vpns[idx]) { + ent++; + }else { + idx++; + } + } +tlbw_use_hazard ();htw_start ();flush_micro_tlb ();
@@ -600,6 +625,7 @@ static void r4k_tlb_configure(void)/* From this point on the ARC firmware is dead. */ r4k_tlb_uniquify (); +local_flush_tlb_all ();/* Did I tell you that ARC SUCKS? */ }
Greg Kroah-Hartman
maintainerPATCH 41/93 MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <[email protected]>
commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 upstream.
Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+ cores can have more than 64 TLB entries. Therefore allocate an array for uniquification instead of placing too an small array on the stack.
--- arch/mips/mm/tlb-r4k.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
arch/mips/mm/tlb-r4k.c +16 -2
@@ -12,6 +12,7 @@#include <linux/init.h> #include <linux/sched.h> #include <linux/smp.h> +#include <linux/memblock.h> #include <linux/mm.h> #include <linux/hugetlb.h> #include <linux/export.h>
@@ -520,17 +521,26 @@ static int r4k_vpn_cmp(const void *a, co* Initialise all TLB entries with unique values that do not clash with * what we have been handed over and what we'll be using ourselves. */ -static void r4k_tlb_uniquify (void ) +static void __ref r4k_tlb_uniquify (void ) { -unsigned long tlb_vpns[1 <<MIPS_CONF1_TLBS_SIZE ];int tlbsize = current_cpu_data.tlbsize; +bool use_slab =slab_is_available ();int start =num_wired_entries (); +phys_addr_t tlb_vpn_size; +unsigned long *tlb_vpns;unsigned long vpn_mask;int cnt, ent, idx, i; vpn_mask =GENMASK (cpu_vmbits -1 ,13 ); vpn_mask |=IS_ENABLED (CONFIG_64BIT ) ?3ULL <<62 :1 <<31 ; + tlb_vpn_size = tlbsize *sizeof (*tlb_vpns); + tlb_vpns = (use_slab ? +kmalloc (tlb_vpn_size,GFP_KERNEL ) : +memblock_alloc_raw (tlb_vpn_size,sizeof (*tlb_vpns))); +if (WARN_ON (!tlb_vpns)) +return ;/* Pray local_flush_tlb_all() is good enough. */ +htw_stop ();for (i = start, cnt =0 ; i < tlbsize; i++, cnt++) {
@@ -583,6 +593,10 @@ static void r4k_tlb_uniquify(void)tlbw_use_hazard ();htw_start ();flush_micro_tlb (); +if (use_slab) +kfree (tlb_vpns); +else +memblock_free (tlb_vpns, tlb_vpn_size); }/*
Greg Kroah-Hartman
maintainerPATCH 42/93 ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Zhaldak <[email protected]>
commit c83fc13960643c4429cd9dfef1321e6430a81b47 upstream.
Integrated amplifier LEAK Stereo 230 by IAG Limited has built-in ESS9038Q2M DAC served by XMOS controller. It supports both DSD Native and DSD-over-PCM (DoP) operational modes. But it doesn't work properly by default and tries DSD-to-PCM conversion. USB quirks below allow it to operate as designed.
Add DSD_RAW quirk flag for IAG Limited devices (vendor ID 0x2622) Add DSD format quirk for LEAK Stereo 230 (USB ID 0x2622:0x0061)
--- sound/usb/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
sound/usb/quirks.c +3 -0
@@ -1928,6 +1928,7 @@ u64 snd_usb_interface_dsd_format_quirks(case USB_ID (0x249c ,0x9326 ):/* M2Tech Young MkIII */ case USB_ID (0x2616 ,0x0106 ):/* PS Audio NuWave DAC */ case USB_ID (0x2622 ,0x0041 ):/* Audiolab M-DAC+ */ +case USB_ID (0x2622 ,0x0061 ):/* LEAK Stereo 230 */ case USB_ID (0x278b ,0x5100 ):/* Rotel RC-1590 */ case USB_ID (0x27f7 ,0x3002 ):/* W4S DAC-2v2SE */ case USB_ID (0x29a2 ,0x0086 ):/* Mutec MC3+ USB */
@@ -2311,6 +2312,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_DSD_RAW),VENDOR_FLG (0x25ce ,/* Mytek devices */ QUIRK_FLAG_DSD_RAW ), +VENDOR_FLG (0x2622 ,/* IAG Limited devices */ +QUIRK_FLAG_DSD_RAW ),VENDOR_FLG (0x278b ,/* Rotel? */ QUIRK_FLAG_DSD_RAW ), VENDOR_FLG(0x292b, /* Gustard/Ess based devices */
Greg Kroah-Hartman
maintainerPATCH 43/93 ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Zanders <[email protected]>
commit 1b03346314b791ad966d3c6d59253328226a2b2d upstream.
The i.MX6UL reference manual lists two possible interrupt lines for SAI3 (56 and 57, offset +32). The current device tree entry uses the first one (24), which prevents IRQs from being handled properly.
Use the second interrupt line (25), which does allow interrupts to work as expected.
--- arch/arm/boot/dts/nxp/imx/imx6ul.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx6ul.dtsi +1 -1
@@ -333,7 +333,7 @@ #sound-dai-cells = <0>; compatible = "fsl,imx6ul-sai", "fsl,imx6sx-sai"; reg = <0x02030000 0x4000>; - interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX6UL_CLK_SAI3_IPG>, <&clks IMX6UL_CLK_SAI3>, <&clks IMX6UL_CLK_DUMMY>, <&clks IMX6UL_CLK_DUMMY>;
Greg Kroah-Hartman
maintainerPATCH 44/93 atm/fore200e: Fix possible data race in fore200e_open()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
commit 82fca3d8a4a34667f01ec2351a607135249c9cff upstream.
Protect access to fore200e->available_cell_rate with rate_mtx lock in the error handling path of fore200e_open() to prevent a data race.
The field fore200e->available_cell_rate is a shared resource used to track available bandwidth. It is concurrently accessed by fore200e_open(), fore200e_close(), and fore200e_change_qos().
In fore200e_open(), the lock rate_mtx is correctly held when subtracting vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth. However, if the subsequent call to fore200e_activate_vcin() fails, the function restores the reserved bandwidth by adding back to available_cell_rate without holding the lock.
This introduces a race condition because available_cell_rate is a global device resource shared across all VCCs. If the error path in fore200e_open() executes concurrently with operations like fore200e_close() or fore200e_change_qos() on other VCCs, a read-modify-write race occurs.
Specifically, the error path reads the rate without the lock. If another CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in fore200e_close()) between this read and the subsequent write, the error path will overwrite the concurrent update with a stale value. This results in incorrect bandwidth accounting.
--- drivers/atm/fore200e.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/atm/fore200e.c +2 -0
@@ -1377,7 +1377,9 @@ fore200e_open(struct atm_vcc *vcc) vcc->dev_data =NULL ; +mutex_lock (&fore200e->rate_mtx); fore200e->available_cell_rate += vcc->qos.txtp.max_pcr; +mutex_unlock (&fore200e->rate_mtx);kfree (fore200e_vcc);return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 45/93 can: sja1000: fix max irq loop handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Mühlbacher <[email protected]>
commit 30db4451c7f6aabcada029b15859a76962ec0cf8 upstream.
Reading the interrupt register SJA1000_IR causes all of its bits to be reset. If we ever reach the condition of handling more than SJA1000_MAX_IRQ IRQs, we will have read the register and reset all its bits but without actually handling the interrupt inside of the loop body.
This may, among other issues, cause us to never netif_wake_queue() again after a transmission interrupt.
--- drivers/net/can/sja1000/sja1000.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/sja1000/sja1000.c +2 -2
@@ -548,8 +548,8 @@ irqreturn_t sja1000_interrupt(int irq, vif (priv->read_reg (priv,SJA1000_IER ) ==IRQ_OFF ) goto out; -while ((isrc = priv->read_reg (priv,SJA1000_IR )) && - (n <SJA1000_MAX_IRQ )) { +while ((n <SJA1000_MAX_IRQ ) && + (isrc = priv->read_reg (priv,SJA1000_IR ))) { status = priv->read_reg (priv,SJA1000_SR );/* check for absent controller due to hw unplug */
Greg Kroah-Hartman
maintainerPATCH 46/93 can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 76544beea7cfe5bcce6d60f53811657b88ec8be1 upstream.
Reading the interrupt register SUN4I_REG_INT_ADDR causes all of its bits to be reset. If we ever reach the condition of handling more than SUN4I_CAN_MAX_IRQ IRQs, we will have read the register and reset all its bits but without actually handling the interrupt inside of the loop body.
This may, among other issues, cause us to never netif_wake_queue() again after a transmission interrupt.
--- drivers/net/can/sun4i_can.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/sun4i_can.c +2 -2
@@ -657,8 +657,8 @@ static irqreturn_t sun4i_can_interrupt(iu8 isrc, status;int n =0 ; -while ((isrc =readl (priv->base +SUN4I_REG_INT_ADDR )) && - (n <SUN4I_CAN_MAX_IRQ )) { +while ((n <SUN4I_CAN_MAX_IRQ ) && + (isrc =readl (priv->base +SUN4I_REG_INT_ADDR ))) { n++; status =readl (priv->base +SUN4I_REG_STA_ADDR );
Greg Kroah-Hartman
maintainerPATCH 47/93 ceph: fix crash in process_v2_sparse_read() for encrypted directories
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
commit 43962db4a6f593903340c85591056a0cef812dfd upstream.
The crash in process_v2_sparse_read() for fscrypt-encrypted directories has been reported. Issue takes place for Ceph msgr2 protocol in secure mode. It can be reproduced by the steps:
sudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure
(1) mkdir /mnt/cephfs/fscrypt-test-3
(2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3
(3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3
(4) fscrypt lock /mnt/cephfs/fscrypt-test-3
(5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3
(6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar
(7) Issue has been triggered
[ 408.072247] ------------[ cut here ]------------ [ 408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865 ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072267] Modules linked in: intel_rapl_msr intel_rapl_common
intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore
[ 408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+ [ 408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 408.072310] Workqueue: ceph-msgr ceph_con_workfn [ 408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8 8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff <0f> 0b e9 06 fe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85 [ 408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246 [ 408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38 [ 408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8 [ 408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8 [ 408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000 [ 408.072329] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.072331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.072336] PKRU: 55555554 [ 408.072337] Call Trace: [ 408.072338] <TASK> [ 408.072340] ? sched_clock_noinstr+0x9/0x10 [ 408.072344] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [ 408.072347] ? _raw_spin_unlock+0xe/0x40 [ 408.072349] ? finish_task_switch.isra.0+0x15d/0x830 [ 408.072353] ? __kasan_check_write+0x14/0x30 [ 408.072357] ? mutex_lock+0x84/0xe0 [ 408.072359] ? __pfx_mutex_lock+0x10/0x10 [ 408.072361] ceph_con_workfn+0x27e/0x10e0 [ 408.072364] ? metric_delayed_work+0x311/0x2c50 [ 408.072367] process_one_work+0x611/0xe20 [ 408.072371] ? __kasan_check_write+0x14/0x30 [ 408.072373] worker_thread+0x7e3/0x1580 [ 408.072375] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 408.072378] ? __pfx_worker_thread+0x10/0x10 [ 408.072381] kthread+0x381/0x7a0 [ 408.072383] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 408.072385] ? __pfx_kthread+0x10/0x10 [ 408.072387] ? __kasan_check_write+0x14/0x30 [ 408.072389] ? recalc_sigpending+0x160/0x220 [ 408.072392] ? _raw_spin_unlock_irq+0xe/0x50 [ 408.072394] ? calculate_sigpending+0x78/0xb0 [ 408.072395] ? __pfx_kthread+0x10/0x10 [ 408.072397] ret_from_fork+0x2b6/0x380 [ 408.072400] ? __pfx_kthread+0x10/0x10 [ 408.072402] ret_from_fork_asm+0x1a/0x30 [ 408.072406] </TASK> [ 408.072407] ---[ end trace 0000000000000000 ]--- [ 408.072418] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 408.072984] KASAN: null-ptr-deref in range [0x0000000000000000- 0x0000000000000007] [ 408.073350] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Tainted: G W 6.17.0-rc7+ #1 PREEMPT(voluntary) [ 408.073886] Tainted: [W]=WARN [ 408.074042] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 408.074468] Workqueue: ceph-msgr ceph_con_workfn [ 408.074694] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80 [ 408.074976] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16 84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03 [ 408.075884] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246 [ 408.076305] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000 [ 408.076909] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378 [ 408.077466] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8 [ 408.078034] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71 [ 408.078575] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378 [ 408.079159] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.079736] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.080039] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.080376] PKRU: 55555554 [ 408.080513] Call Trace: [ 408.080630] <TASK> [ 408.080729] ceph_con_v2_try_read+0x49b9/0x72f0 [ 408.081115] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [ 408.081348] ? _raw_spin_unlock+0xe/0x40 [ 408.081538] ? finish_task_switch.isra.0+0x15d/0x830 [ 408.081768] ? __kasan_check_write+0x14/0x30 [ 408.081986] ? mutex_lock+0x84/0xe0 [ 408.082160] ? __pfx_mutex_lock+0x10/0x10 [ 408.082343] ceph_con_workfn+0x27e/0x10e0 [ 408.082529] ? metric_delayed_work+0x311/0x2c50 [ 408.082737] process_one_work+0x611/0xe20 [ 408.082948] ? __kasan_check_write+0x14/0x30 [ 408.083156] worker_thread+0x7e3/0x1580 [ 408.083331] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 408.083557] ? __pfx_worker_thread+0x10/0x10 [ 408.083751] kthread+0x381/0x7a0 [ 408.083922] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 408.084139] ? __pfx_kthread+0x10/0x10 [ 408.084310] ? __kasan_check_write+0x14/0x30 [ 408.084510] ? recalc_sigpending+0x160/0x220 [ 408.084708] ? _raw_spin_unlock_irq+0xe/0x50 [ 408.084917] ? calculate_sigpending+0x78/0xb0 [ 408.085138] ? __pfx_kthread+0x10/0x10 [ 408.085335] ret_from_fork+0x2b6/0x380 [ 408.085525] ? __pfx_kthread+0x10/0x10 [ 408.085720] ret_from_fork_asm+0x1a/0x30 [ 408.085922] </TASK> [ 408.086036] Modules linked in: intel_rapl_msr intel_rapl_common
intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore
[ 408.087778] ---[ end trace 0000000000000000 ]--- [ 408.088007] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80 [ 408.088260] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16 84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03 [ 408.089118] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246 [ 408.089357] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000 [ 408.089678] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378 [ 408.090020] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8 [ 408.090360] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71 [ 408.090687] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378 [ 408.091035] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.091452] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.092015] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.092530] PKRU: 55555554 [ 417.112915] ================================================================== [ 417.113491] BUG: KASAN: slab-use-after-free in __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114014] Read of size 4 at addr ffff888124870034 by task kworker/2:0/4951
[ 417.114587] CPU: 2 UID: 0 PID: 4951 Comm: kworker/2:0 Tainted: G D W 6.17.0-rc7+ #1 PREEMPT(voluntary) [ 417.114592] Tainted: [D]=DIE, [W]=WARN [ 417.114593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 417.114596] Workqueue: events handle_timeout [ 417.114601] Call Trace: [ 417.114602] <TASK> [ 417.114604] dump_stack_lvl+0x5c/0x90 [ 417.114610] print_report+0x171/0x4dc [ 417.114613] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 417.114617] ? kasan_complete_mode_report_info+0x80/0x220 [ 417.114621] kasan_report+0xbd/0x100 [ 417.114625] ? __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114628] ? __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114630] __asan_report_load4_noabort+0x14/0x30 [ 417.114633] __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114635] ? queue_con_delay+0x8d/0x200 [ 417.114638] ? __pfx___mutex_lock.constprop.0+0x10/0x10 [ 417.114641] ? __send_subscribe+0x529/0xb20 [ 417.114644] __mutex_lock_slowpath+0x13/0x20 [ 417.114646] mutex_lock+0xd4/0xe0 [ 417.114649] ? __pfx_mutex_lock+0x10/0x10 [ 417.114652] ? ceph_monc_renew_subs+0x2a/0x40 [ 417.114654] ceph_con_keepalive+0x22/0x110 [ 417.114656] handle_timeout+0x6b3/0x11d0 [ 417.114659] ? _raw_spin_unlock_irq+0xe/0x50 [ 417.114662] ? __pfx_handle_timeout+0x10/0x10 [ 417.114664] ? queue_delayed_work_on+0x8e/0xa0 [ 417.114669] process_one_work+0x611/0xe20 [ 417.114672] ? __kasan_check_write+0x14/0x30 [ 417.114676] worker_thread+0x7e3/0x1580 [ 417.114678] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 417.114682] ? __pfx_sched_setscheduler_nocheck+0x10/0x10 [ 417.114687] ? __pfx_worker_thread+0x10/0x10 [ 417.114689] kthread+0x381/0x7a0 [ 417.114692] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 417.114694] ? __pfx_kthread+0x10/0x10 [ 417.114697] ? __kasan_check_write+0x14/0x30 [ 417.114699] ? recalc_sigpending+0x160/0x220 [ 417.114703] ? _raw_spin_unlock_irq+0xe/0x50 [ 417.114705] ? calculate_sigpending+0x78/0xb0 [ 417.114707] ? __pfx_kthread+0x10/0x10 [ 417.114710] ret_from_fork+0x2b6/0x380 [ 417.114713] ? __pfx_kthread+0x10/0x10 [ 417.114715] ret_from_fork_asm+0x1a/0x30 [ 417.114720] </TASK>
[ 417.125171] Allocated by task 2: [ 417.125333] kasan_save_stack+0x26/0x60 [ 417.125522] kasan_save_track+0x14/0x40 [ 417.125742] kasan_save_alloc_info+0x39/0x60 [ 417.125945] __kasan_slab_alloc+0x8b/0xb0 [ 417.126133] kmem_cache_alloc_node_noprof+0x13b/0x460 [ 417.126381] copy_process+0x320/0x6250 [ 417.126595] kernel_clone+0xb7/0x840 [ 417.126792] kernel_thread+0xd6/0x120 [ 417.126995] kthreadd+0x85c/0xbe0 [ 417.127176] ret_from_fork+0x2b6/0x380 [ 417.127378] ret_from_fork_asm+0x1a/0x30
[ 417.127692] Freed by task 0: [ 417.127851] kasan_save_stack+0x26/0x60 [ 417.128057] kasan_save_track+0x14/0x40 [ 417.128267] kasan_save_free_info+0x3b/0x60 [ 417.128491] __kasan_slab_free+0x6c/0xa0 [ 417.128708] kmem_cache_free+0x182/0x550 [ 417.128906] free_task+0xeb/0x140 [ 417.129070] __put_task_struct+0x1d2/0x4f0 [ 417.129259] __put_task_struct_rcu_cb+0x15/0x20 [ 417.129480] rcu_do_batch+0x3d3/0xe70 [ 417.129681] rcu_core+0x549/0xb30 [ 417.129839] rcu_core_si+0xe/0x20 [ 417.130005] handle_softirqs+0x160/0x570 [ 417.130190] __irq_exit_rcu+0x189/0x1e0 [ 417.130369] irq_exit_rcu+0xe/0x20 [ 417.130531] sysvec_apic_timer_interrupt+0x9f/0xd0 [ 417.130768] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 417.131082] Last potentially related work creation: [ 417.131305] kasan_save_stack+0x26/0x60 [ 417.131484] kasan_record_aux_stack+0xae/0xd0 [ 417.131695] __call_rcu_common+0xcd/0x14b0 [ 417.131909] call_rcu+0x31/0x50 [ 417.132071] delayed_put_task_struct+0x128/0x190 [ 417.132295] rcu_do_batch+0x3d3/0xe70 [ 417.132478] rcu_core+0x549/0xb30 [ 417.132658] rcu_core_si+0xe/0x20 [ 417.132808] handle_softirqs+0x160/0x570 [ 417.132993] __irq_exit_rcu+0x189/0x1e0 [ 417.133181] irq_exit_rcu+0xe/0x20 [ 417.133353] sysvec_apic_timer_interrupt+0x9f/0xd0 [ 417.133584] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 417.133921] Second to last potentially related work creation: [ 417.134183] kasan_save_stack+0x26/0x60 [ 417.134362] kasan_record_aux_stack+0xae/0xd0 [ 417.134566] __call_rcu_common+0xcd/0x14b0 [ 417.134782] call_rcu+0x31/0x50 [ 417.134929] put_task_struct_rcu_user+0x58/0xb0 [ 417.135143] finish_task_switch.isra.0+0x5d3/0x830 [ 417.135366] __schedule+0xd30/0x5100 [ 417.135534] schedule_idle+0x5a/0x90 [ 417.135712] do_idle+0x25f/0x410 [ 417.135871] cpu_startup_entry+0x53/0x70 [ 417.136053] start_secondary+0x216/0x2c0 [ 417.136233] common_startup_64+0x13e/0x141
[ 417.136894] The buggy address belongs to the object at ffff888124870000
which belongs to the cache task_struct of size 10504
[ 417.138122] The buggy address is located 52 bytes inside of
freed 10504-byte region [ffff888124870000, ffff888124872908)[ 417.139465] The buggy address belongs to the physical page: [ 417.140016] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x124870 [ 417.140789] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 417.141519] memcg:ffff88811aa20e01 [ 417.141874] anon flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ 417.142600] page_type: f5(slab) [ 417.142922] raw: 0017ffffc0000040 ffff88810094f040 0000000000000000 dead000000000001 [ 417.143554] raw: 0000000000000000 0000000000030003 00000000f5000000 ffff88811aa20e01 [ 417.143954] head: 0017ffffc0000040 ffff88810094f040 0000000000000000 dead000000000001 [ 417.144329] head: 0000000000000000 0000000000030003 00000000f5000000 ffff88811aa20e01 [ 417.144710] head: 0017ffffc0000003 ffffea0004921c01 00000000ffffffff 00000000ffffffff [ 417.145106] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 417.145485] page dumped because: kasan: bad access detected
[ 417.145859] Memory state around the buggy address: [ 417.146094] ffff88812486ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 417.146439] ffff88812486ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 417.146791] >ffff888124870000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.147145] ^ [ 417.147387] ffff888124870080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.147751] ffff888124870100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.148123]
==================================================================
First of all, we have warning in get_bvec_at() because cursor->total_resid contains zero value. And, finally, we have crash in ceph_msg_data_advance() because cursor->data is NULL. It means that get_bvec_at() receives not initialized ceph_msg_data_cursor structure because data is NULL and total_resid contains zero.
Moreover, we don't have likewise issue for the case of Ceph msgr1 protocol because ceph_msg_data_cursor_init() has been called before reading sparse data.
This patch adds calling of ceph_msg_data_cursor_init() in the beginning of process_v2_sparse_read() with the goal to guarantee that logic of reading sparse data works correctly for the case of Ceph msgr2 protocol.
--- net/ceph/messenger_v2.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/ceph/messenger_v2.c +7 -4
@@ -1091,13 +1091,16 @@ static int decrypt_control_remainder(strstatic int process_v2_sparse_read (struct ceph_connection *con,struct page **pages,int spos) { -struct ceph_msg_data_cursor *cursor = &con->v2.in_cursor; +struct ceph_msg_data_cursor cursor;int ret; +ceph_msg_data_cursor_init (&cursor, con->in_msg, + con->in_msg->sparse_read_total); +for (;;) {char *buf =NULL ; - ret = con->ops->sparse_read (con, cursor, &buf); + ret = con->ops->sparse_read (con, &cursor, &buf);if (ret <=0 )return ret;
@@ -1115,11 +1118,11 @@ static int process_v2_sparse_read(struct }else {struct bio_vec bv; -get_bvec_at (cursor, &bv); +get_bvec_at (&cursor, &bv); len =min_t (int, len, bv.bv_len);memcpy_page (bv.bv_page, bv.bv_offset, spage, soff, len); -ceph_msg_data_advance (cursor, len); +ceph_msg_data_advance (&cursor, len); } spos += len; ret -= len;
Greg Kroah-Hartman
maintainerPATCH 48/93 dm-verity: fix unreliable memory allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit fe680d8c747f4e676ac835c8c7fb0f287cd98758 upstream.
GFP_NOWAIT allocation may fail anytime. It needs to be changed to GFP_NOIO. There's no need to handle an error because mempool_alloc with GFP_NOIO can't fail.
--- drivers/md/dm-verity-fec.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/md/dm-verity-fec.c +1 -5
@@ -330,11 +330,7 @@ static int fec_alloc_bufs(struct dm_veriif (fio->bufs[n])continue ; - fio->bufs[n] =mempool_alloc (&v->fec->prealloc_pool,GFP_NOWAIT ); -if (unlikely (!fio->bufs[n])) { -DMERR ("failed to allocate FEC buffer" ); -return -ENOMEM ; - } + fio->bufs[n] =mempool_alloc (&v->fec->prealloc_pool,GFP_NOIO ); }/* try to allocate the maximum number of buffers */
Greg Kroah-Hartman
maintainerPATCH 49/93 drivers/usb/dwc3: fix PCI parent check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
commit 40f8d17eed7533ed2bbb5e3cc680049b19411b2e upstream.
The sysdev_is_parent check was being used to infer PCI devices that have the DMA mask set from the PCI capabilities, but sysdev_is_parent is also used for non-PCI ACPI devices in which case the DMA mask would be the bus default or as set by the _DMA method.
Without this fix the DMA mask would default to 32-bits and so allocation would fail if there was no DRAM below 4GB.
--- drivers/usb/dwc3/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/dwc3/core.c +2 -1
@@ -25,6 +25,7 @@#include <linux/of.h> #include <linux/of_graph.h> #include <linux/acpi.h> +#include <linux/pci.h> #include <linux/pinctrl/consumer.h> #include <linux/reset.h> #include <linux/bitfield.h>
@@ -1990,7 +1991,7 @@ static int dwc3_probe(struct platform_deplatform_set_drvdata (pdev, dwc);dwc3_cache_hwparams (dwc); -if (!dwc->sysdev_is_parent && +if (!dev_is_pci (dwc->sysdev) &&DWC3_GHWPARAMS0_AWIDTH (dwc->hwparams.hwparams0) ==64 ) { ret =dma_set_mask_and_coherent (dwc->sysdev,DMA_BIT_MASK (64 ));if (ret)
Greg Kroah-Hartman
maintainerPATCH 50/93 smb: client: fix memory leak in cifs_construct_tcon()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
commit 3184b6a5a24ec9ee74087b2a550476f386df7dc2 upstream.
When having a multiuser mount with domain= specified and using cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname, so it needs to be freed before leaving cifs_construct_tcon().
This fixes the following memory leak reported by kmemleak:
mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,... su - testuser
cifscreds add -d ZELDA -u testuser
...
ls /mnt/1
...
umount /mnt
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff8881203c3f08 (size 8):
comm "ls", pid 5060, jiffies 4307222943
hex dump (first 8 bytes):
5a 45 4c 44 41 00 cc cc ZELDA...
backtrace (crc d109a8cf):
__kmalloc_node_track_caller_noprof+0x572/0x710
kstrdup+0x3a/0x70
cifs_sb_tlink+0x1209/0x1770 [cifs]
cifs_get_fattr+0xe1/0xf50 [cifs]
cifs_get_inode_info+0xb5/0x240 [cifs]
cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]
cifs_getattr+0x28e/0x450 [cifs]
vfs_getattr_nosec+0x126/0x180
vfs_statx+0xf6/0x220
do_statx+0xab/0x110
__x64_sys_statx+0xd5/0x130
do_syscall_64+0xbb/0x380
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- fs/smb/client/connect.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/client/connect.c +1 -0
@@ -4224,6 +4224,7 @@ cifs_construct_tcon(struct cifs_sb_info out:kfree (ctx->username); +kfree (ctx->domainname);kfree_sensitive (ctx->password);kfree (origin_fullpath);kfree (ctx);
Greg Kroah-Hartman
maintainerPATCH 51/93 thunderbolt: Add support for Intel Wildcat Lake
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Borzeszkowski <[email protected]>
commit 3575254546a27210a4b661ea37fbbfb836c0815d upstream.
Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar Lake platform. Add Wildcat Lake PCI ID to the driver list of supported devices.
--- drivers/thunderbolt/nhi.c | 2 ++ drivers/thunderbolt/nhi.h | 1 + 2 files changed, 3 insertions(+)
drivers/thunderbolt/nhi.c +2 -0
@@ -1536,6 +1536,8 @@ static struct pci_device_id nhi_ids[] = .driver_data = (kernel_ulong_t)&icl_nhi_ops }, { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1), .driver_data = (kernel_ulong_t)&icl_nhi_ops }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_WCL_NHI0), + .driver_data = (kernel_ulong_t)&icl_nhi_ops }, { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) }, { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
drivers/thunderbolt/nhi.h +1 -0
@@ -75,6 +75,7 @@ extern const struct tb_nhi_ops icl_nhi_o#define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef#define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e#define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d +#define PCI_DEVICE_ID_INTEL_WCL_NHI0 0x4d33#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786
Greg Kroah-Hartman
maintainerPATCH 52/93 slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e upstream.
The function qcom_slim_ngd_notify_slaves() calls of_slim_get_device() which internally uses device_find_child() to obtain a device reference. According to the device_find_child() documentation,
the caller must drop the reference with put_device() after use.
Found via static analysis and this is similar to commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
--- drivers/slimbus/qcom-ngd-ctrl.c | 1 + 1 file changed, 1 insertion(+)
drivers/slimbus/qcom-ngd-ctrl.c +1 -0
@@ -1239,6 +1239,7 @@ static void qcom_slim_ngd_notify_slaves(if (slim_get_logical_addr (sbdev))dev_err (ctrl->dev,"Failed to get logical address\n" ); +put_device (&sbdev->dev); } }
Greg Kroah-Hartman
maintainerPATCH 53/93 firmware: stratix10-svc: fix bug in saving controller data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khairul Anuar Romli <[email protected]>
commit d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 upstream.
Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They both are of the same data and overrides each other. This resulted in the rmmod of the svc driver to fail and throw a kernel panic for kthread_stop and fifo free.
--- drivers/firmware/stratix10-svc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/firmware/stratix10-svc.c +4 -3
@@ -134,6 +134,7 @@ struct stratix10_svc_data {* @complete_status: state for completion * @svc_fifo_lock: protect access to service message data queue * @invoke_fn: function to issue secure monitor call or hypervisor call +* @svc: manages the list of client svc drivers * * This struct is used to create communication channels for service clients, to * handle secure monitor or hypervisor call.
@@ -150,6 +151,7 @@ struct stratix10_svc_controller {struct completion complete_status;spinlock_t svc_fifo_lock;svc_invoke_fn *invoke_fn; +struct stratix10_svc *svc; };/**
@@ -1209,6 +1211,7 @@ static int stratix10_svc_drv_probe(struc ret = -ENOMEM ; goto err_free_kfifo; } + controller->svc = svc; svc->stratix10_svc_rsu =platform_device_alloc (STRATIX10_RSU ,0 );if (!svc->stratix10_svc_rsu) {
@@ -1236,8 +1239,6 @@ static int stratix10_svc_drv_probe(struc goto err_unregister_dev; } -dev_set_drvdata (dev, svc); -pr_info ("Intel Service Layer Driver Initialized\n" );return 0 ;
@@ -1253,8 +1254,8 @@ err_destroy_pool:static int stratix10_svc_drv_remove (struct platform_device *pdev) { -struct stratix10_svc *svc =dev_get_drvdata (&pdev->dev);struct stratix10_svc_controller *ctrl =platform_get_drvdata (pdev); +struct stratix10_svc *svc = ctrl->svc;platform_device_unregister (svc->intel_svc_fcs);platform_device_unregister (svc->stratix10_svc_rsu);
Greg Kroah-Hartman
maintainerPATCH 54/93 mptcp: clear scheduled subflows on retransmit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 27fd02860164bfa78cec2640dfad630d832e302c upstream.
When __mptcp_retrans() kicks-in, it schedules one or more subflows for retransmission, but such subflows could be actually left alone if there is no more data to retransmit and/or in case of concurrent fallback.
Scheduled subflows could be processed much later in time, i.e. when new data will be transmitted, leading to bad subflow selection.
Explicitly clear all scheduled subflows before leaving the retransmission function.
--- net/mptcp/protocol.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
net/mptcp/protocol.c +11 -2
@@ -2691,7 +2691,7 @@ static void __mptcp_retrans(struct sock }if (!mptcp_send_head (sk)) -return ; + goto clear_scheduled; goto reset_timer; }
@@ -2722,7 +2722,7 @@ static void __mptcp_retrans(struct sockif (__mptcp_check_fallback (msk)) {spin_unlock_bh (&msk->fallback_lock);release_sock (ssk); -return ; + goto clear_scheduled; }while (info.sent < info.limit) {
@@ -2754,6 +2754,15 @@ reset_timer:if (!mptcp_rtx_timer_pending (sk))mptcp_reset_rtx_timer (sk); + +clear_scheduled: +/* If no rtx data was available or in case of fallback, there +* could be left-over scheduled subflows; clear them all +* or later xmit could use bad ones +*/ +mptcp_for_each_subflow (msk, subflow) +if (READ_ONCE (subflow->scheduled)) +mptcp_subflow_set_scheduled (subflow, false); }/* schedule the timeout timer for the relevant event: either close timeout
Greg Kroah-Hartman
maintainerPATCH 55/93 serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit eb4917f557d43c7a1c805dd73ffcdfddb2aba39a upstream.
Check for returned DMA addresses using specialized dma_mapping_error() helper which is generally recommended for this purpose by Documentation/core-api/dma-api.rst:
"In some circumstances dma_map_single(), ...
will fail to create a mapping. A driver can check for these errors by testing the returned DMA address with dma_mapping_error()."
Found via static analysis and this is similar to commit fa0308134d26 ("ALSA: memalloc: prefer dma_mapping_error() over explicit address checking")
--- drivers/tty/serial/amba-pl011.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/amba-pl011.c +1 -1
@@ -636,7 +636,7 @@ static int pl011_dma_tx_refill(struct ua dmatx->len = count; dmatx->dma =dma_map_single (dma_dev->dev, dmatx->buf, count,DMA_TO_DEVICE ); -if (dmatx->dma ==DMA_MAPPING_ERROR ) { +if (dma_mapping_error (dma_dev->dev, dmatx->dma)) { uap->dmatx.queued = false;dev_dbg (uap->port.dev,"unable to map TX DMA\n" );return -EBUSY ;
Greg Kroah-Hartman
maintainerPATCH 56/93 most: usb: fix double free on late probe failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit baadf2a5c26e802a46573eaad331b427b49aaa36 upstream.
The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration.
This unsurprisingly leads to bugs in the MOST drivers, and a couple of recent changes turned a reference underflow and use-after-free in the USB driver into several double free and a use-after-free on late probe failures.
--- drivers/most/most_usb.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/most/most_usb.c +5 -9
@@ -1058,7 +1058,7 @@ hdm_probe(struct usb_interface *interfac ret =most_register_interface (&mdev->iface);if (ret) - goto err_free_busy_urbs; +return ret;mutex_lock (&mdev->io_mutex); if (le16_to_cpu(usb_dev->descriptor.idProduct) == USB_DEV_ID_OS81118 ||
@@ -1068,8 +1068,7 @@ hdm_probe(struct usb_interface *interfacif (!mdev->dci) {mutex_unlock (&mdev->io_mutex);most_deregister_interface (&mdev->iface); - ret = -ENOMEM ; - goto err_free_busy_urbs; +return -ENOMEM ; } mdev->dci->dev.init_name ="dci" ;
@@ -1078,18 +1077,15 @@ hdm_probe(struct usb_interface *interfac mdev->dci->dev.release = release_dci;if (device_register (&mdev->dci->dev)) {mutex_unlock (&mdev->io_mutex); +put_device (&mdev->dci->dev);most_deregister_interface (&mdev->iface); - ret = -ENOMEM ; - goto err_free_dci; +return -ENOMEM ; } mdev->dci->usb_device = mdev->usb_device; }mutex_unlock (&mdev->io_mutex);return 0 ; -err_free_dci: -put_device (&mdev->dci->dev); -err_free_busy_urbs: -kfree (mdev->busy_urbs); + err_free_ep_address:kfree (mdev->ep_address); err_free_cap:
Greg Kroah-Hartman
maintainerPATCH 57/93 usb: cdns3: Fix double resource release in cdns3_pci_probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 1ec39d2cd88dac2e7cdbac248762f1f057971c5d upstream.
The driver uses pcim_enable_device() to enable the PCI device, the device will be automatically disabled on driver detach through the managed device framework. The manual pci_disable_device() calls in the error paths are therefore redundant and should be removed.
Found via static anlaysis and this is similar to commit 99ca0b57e49f ("thermal: intel: int340x: processor: Fix warning during module unload").
--- drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/usb/cdns3/cdns3-pci-wrap.c +1 -4
@@ -101,10 +101,8 @@ static int cdns3_pci_probe(struct pci_de wrap =pci_get_drvdata (func); }else { wrap =kzalloc (sizeof (*wrap),GFP_KERNEL ); -if (!wrap) { -pci_disable_device (pdev); +if (!wrap)return -ENOMEM ; - } } res = wrap->dev_res;
@@ -163,7 +161,6 @@ static int cdns3_pci_probe(struct pci_de/* register platform device */ wrap->plat_dev =platform_device_register_full (&plat_info);if (IS_ERR (wrap->plat_dev)) { -pci_disable_device (pdev); err =PTR_ERR (wrap->plat_dev);kfree (wrap);return err;
Greg Kroah-Hartman
maintainerPATCH 58/93 usb: gadget: f_eem: Fix memory leak in eem_unwrap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
commit e4f5ce990818d37930cd9fb0be29eee0553c59d9 upstream.
The existing code did not handle the failure case of usb_ep_queue in the command path, potentially leading to memory leaks.
Improve error handling to free all allocated resources on usb_ep_queue failure. This patch continues to use goto logic for error handling, as the existing error handling is complex and not easily adaptable to auto-cleanup helpers.
kmemleak results:
unreferenced object 0xffffff895a512300 (size 240):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
kmem_cache_alloc+0x1b4/0x358
skb_clone+0x90/0xd8
eem_unwrap+0x1cc/0x36c
unreferenced object 0xffffff8a157f4000 (size 256):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
kmalloc_trace+0x48/0x140
dwc3_gadget_ep_alloc_request+0x58/0x11c
usb_ep_alloc_request+0x40/0xe4
eem_unwrap+0x204/0x36c
unreferenced object 0xffffff8aadbaac00 (size 128):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
__kmalloc+0x64/0x1a8
eem_unwrap+0x218/0x36c
unreferenced object 0xffffff89ccef3500 (size 64):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
kmalloc_trace+0x48/0x140
eem_unwrap+0x238/0x36c--- drivers/usb/gadget/function/f_eem.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_eem.c +6 -1
@@ -477,8 +477,13 @@ static int eem_unwrap(struct gether *por req->complete = eem_cmd_complete; req->zero =1 ; req->context = ctx; -if (usb_ep_queue (port->in_ep, req,GFP_ATOMIC )) +if (usb_ep_queue (port->in_ep, req,GFP_ATOMIC )) {DBG (cdev,"echo response queue fail\n" ); +kfree (ctx); +kfree (req->buf); +usb_ep_free_request (ep, req); +dev_kfree_skb_any (skb2); + }break ;case 1 :/* echo response */
Greg Kroah-Hartman
maintainerPATCH 59/93 usb: renesas_usbhs: Fix synchronous external abort on unbind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit eb9ac779830b2235847b72cb15cf07c7e3333c5e upstream.
A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is executed after the configuration sequence described above:
modprobe usb_f_ecm
modprobe libcomposite
modprobe configfs
cd /sys/kernel/config/usb_gadget
mkdir -p g1
cd g1
echo "0x1d6b" > idVendor
echo "0x0104" > idProduct
mkdir -p strings/0x409
echo "0123456789" > strings/0x409/serialnumber echo "Renesas." > strings/0x409/manufacturer echo "Ethernet Gadget" > strings/0x409/product mkdir -p functions/ecm.usb0
mkdir -p configs/c.1
mkdir -p configs/c.1/strings/0x409
echo "ECM" > configs/c.1/strings/0x409/configuration
if [ ! -L configs/c.1/ecm.usb0 ]; then
ln -s functions/ecm.usb0 configs/c.1
fi
echo 11e20000.usb > UDC
echo 11e20000.usb > /sys/bus/platform/drivers/renesas_usbhs/unbind
The displayed trace is as follows:
Internal error: synchronous external abort: 0000000096000010 [#1] SMP CPU: 0 UID: 0 PID: 188 Comm: sh Tainted: G M 6.17.0-rc7-next-20250922-00010-g41050493b2bd #55 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT) pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] lr : usbhsg_update_pullup+0x3c/0x68 [renesas_usbhs] sp : ffff8000838b3920 x29: ffff8000838b3920 x28: ffff00000d585780 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: ffff00000c3e3810 x23: ffff00000d5e5c80 x22: ffff00000d5e5d40 x21: 0000000000000000 x20: 0000000000000000 x19: ffff00000d5e5c80 x18: 0000000000000020 x17: 2e30303230316531 x16: 312d7968703a7968 x15: 3d454d414e5f4344 x14: 000000000000002c x13: 0000000000000000 x12: 0000000000000000 x11: ffff00000f358f38 x10: ffff00000f358db0 x9 : ffff00000b41f418 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d x5 : 8080808000000000 x4 : 000000004b5ccb9d x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffff800083790000 x0 : ffff00000d5e5c80 Call trace: usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] (P) usbhsg_pullup+0x4c/0x7c [renesas_usbhs] usb_gadget_disconnect_locked+0x48/0xd4 gadget_unbind_driver+0x44/0x114 device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 device_release_driver+0x18/0x24 bus_remove_device+0xcc/0x10c device_del+0x14c/0x404 usb_del_gadget+0x88/0xc0 usb_del_gadget_udc+0x18/0x30 usbhs_mod_gadget_remove+0x24/0x44 [renesas_usbhs] usbhs_mod_remove+0x20/0x30 [renesas_usbhs] usbhs_remove+0x98/0xdc [renesas_usbhs] platform_remove+0x20/0x30 device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 device_driver_detach+0x18/0x24 unbind_store+0xb4/0xb8 drv_attr_store+0x24/0x38 sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x128/0x1b8 vfs_write+0x2ac/0x350 ksys_write+0x68/0xfc __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 7100003f 1a9f07e1 531c6c22 f9400001 (79400021) ---[ end trace 0000000000000000 ]--- note: sh[188] exited with irqs disabled note: sh[188] exited with preempt_count 1
The issue occurs because usbhs_sys_function_pullup(), which accesses the IP registers, is executed after the USBHS clocks have been disabled. The problem is reproducible on the Renesas RZ/G3S SoC starting with the addition of module stop in the clock enable/disable APIs. With module stop functionality enabled, a bus error is expected if a master accesses a module whose clock has been stopped and module stop activated.
Disable the IP clocks at the end of remove.
--- drivers/usb/renesas_usbhs/common.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/usb/renesas_usbhs/common.c +7 -7
@@ -798,18 +798,18 @@ static void usbhs_remove(struct platformflush_delayed_work (&priv->notify_hotplug_work); -/* power off */ -if (!usbhs_get_dparam (priv, runtime_pwctrl)) -usbhsc_power_ctrl (priv,0 ); - -pm_runtime_disable (&pdev->dev); -usbhs_platform_call (priv, hardware_exit, pdev); -usbhsc_clk_put (priv);reset_control_assert (priv->rsts);usbhs_mod_remove (priv);usbhs_fifo_remove (priv);usbhs_pipe_remove (priv); + +/* power off */ +if (!usbhs_get_dparam (priv, runtime_pwctrl)) +usbhsc_power_ctrl (priv,0 ); + +usbhsc_clk_put (priv); +pm_runtime_disable (&pdev->dev); }static __maybe_unused int usbhsc_suspend (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 60/93 usb: storage: Fix memory leak in USB bulk transport
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Desnes Nunes <[email protected]>
commit 41e99fe2005182139b1058db71f0d241f8f0078c upstream.
A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355.
When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates the CSW from the sg buffer, but fails to clear it afterwards. This leaves status protocol data in srb's transfer buffer, such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can lead to USB protocols leaks to user space through SCSI generic (/dev/sg*) interfaces, such as the one seen here when the LTP test requested 512 KiB.
Fix the leak by zeroing the CSW data in srb's transfer buffer immediately after the validation of devices that skip data phase.
Note: Differently from CVE-2018-1000204, which fixed a big leak by zero- ing pages at allocation time, this leak occurs after allocation, when USB protocol data is written to already-allocated sg pages.
--- drivers/usb/storage/transport.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/storage/transport.c +16 -0
@@ -1204,7 +1204,23 @@ int usb_stor_Bulk_transport(struct scsi_ US_BULK_CS_WRAP_LEN && bcs->Signature == cpu_to_le32(US_BULK_CS_SIGN)) { +unsigned char buf[US_BULK_CS_WRAP_LEN ]; +usb_stor_dbg (us,"Device skipped data phase\n" ); + +/* +* Devices skipping data phase might leave CSW data in srb's +* transfer buffer. Zero it to prevent USB protocol leakage. +*/ + sg =NULL ; + offset =0 ; +memset (buf,0 ,sizeof (buf)); +if (usb_stor_access_xfer_buf (buf, +US_BULK_CS_WRAP_LEN , srb, &sg, + &offset,TO_XFER_BUF ) != +US_BULK_CS_WRAP_LEN ) +usb_stor_dbg (us,"Failed to clear CSW data\n" ); +scsi_set_resid (srb, transfer_length); goto skipped_data_phase; }
Greg Kroah-Hartman
maintainerPATCH 61/93 USB: storage: Remove subclass and protocol overrides from Novatek quirk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit df5fde297e617041449f603ed5f646861c80000b upstream.
A report from Oleg Smirnov indicates that the unusual_devs quirks entry for the Novatek camera does not need to override the subclass and protocol parameters:
[3266355.209532] usb 1-3: new high-speed USB device number 10 using xhci_hcd
[3266355.333031] usb 1-3: New USB device found, idVendor=0603, idProduct=8611, bcdDevice= 1.00
[3266355.333040] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[3266355.333043] usb 1-3: Product: YICARCAM
[3266355.333045] usb 1-3: Manufacturer: XIAO-YI
[3266355.333047] usb 1-3: SerialNumber: 966110000000100
[3266355.338621] usb-storage 1-3:1.0: USB Mass Storage device detected
[3266355.338817] usb-storage 1-3:1.0: Quirks match for vid 0603 pid 8611: 4000
[3266355.338821] usb-storage 1-3:1.0: This device (0603,8611,0100 S 06 P 50) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel 6.16.10-arch1-1)
Please send a copy of this message to<[email protected]> and <[email protected]>
The overrides are harmless but they do provoke the driver into logging this annoying message. Update the entry to remove the unneeded entries.
--- drivers/usb/storage/unusual_devs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/storage/unusual_devs.h +1 -1
@@ -938,7 +938,7 @@ UNUSUAL_DEV( 0x05e3, 0x0723, 0x9451, 0xUNUSUAL_DEV (0x0603 ,0x8611 ,0x0000 ,0xffff ,"Novatek" ,"NTK96550-based camera" , -USB_SC_SCSI ,USB_PR_BULK ,NULL , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , US_FL_BULK_IGNORE_TAG ),/*
Greg Kroah-Hartman
maintainerPATCH 62/93 usb: storage: sddr55: Reject out-of-bound new_pba
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <[email protected]>
commit b59d4fda7e7d0aff1043a7f742487cb829f5aac1 upstream.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory.
Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries.
--- drivers/usb/storage/sddr55.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/sddr55.c +6 -0
@@ -469,6 +469,12 @@ static int sddr55_write_data(struct us_d new_pba = (status[3 ] + (status[4 ] <<8 ) + (status[5 ] <<16 )) >> info->blockshift; +/* check if device-reported new_pba is out of range */ +if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) { + result =USB_STOR_TRANSPORT_FAILED ; + goto leave; + } +/* check status for error */ if (status[0 ] ==0xff && status[1 ] ==0x4 ) { info->pba_to_lba[new_pba] =BAD_BLOCK ;
Greg Kroah-Hartman
maintainerPATCH 63/93 usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <[email protected]>
commit 26d56a9fcb2014b99e654127960aa0a48a391e3c upstream.
When a UAS device is unplugged during data transfer, there is a probability of a system panic occurring. The root cause is an access to an invalid memory address during URB callback handling. Specifically, this happens when the dma_direct_unmap_sg() function is called within the usb_hcd_unmap_urb_for_dma() interface, but the sg->dma_address field is 0 and the sg data structure has already been freed.
The SCSI driver sends transfer commands by invoking uas_queuecommand_lck() in uas.c, using the uas_submit_urbs() function to submit requests to USB. Within the uas_submit_urbs() implementation, three URBs (sense_urb, data_urb, and cmd_urb) are sequentially submitted. Device removal may occur at any point during uas_submit_urbs execution, which may result in URB submission failure. However, some URBs might have been successfully submitted before the failure, and uas_submit_urbs will return the -ENODEV error code in this case. The current error handling directly calls scsi_done(). In the SCSI driver, this eventually triggers scsi_complete() to invoke scsi_end_request() for releasing the sgtable. The successfully submitted URBs, when being unlinked to giveback, call usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg unmapping operations since the sg data structure has already been freed.
This patch modifies the error condition check in the uas_submit_urbs() function. When a UAS device is removed but one or more URBs have already been successfully submitted to USB, it avoids immediately invoking scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully submitted URBs is completed before devinfo->resetting being set, then the scsi_done() function will be called within uas_try_complete() after all pending URB operations are finalized. Otherwise, the scsi_done() function will be called within uas_zap_pending(), which is executed after usb_kill_anchored_urbs().
The error handling only takes effect when uas_queuecommand_lck() calls uas_submit_urbs() and returns the error value -ENODEV . In this case, the device is disconnected, and the flow proceeds to uas_disconnect(), where uas_zap_pending() is invoked to call uas_try_complete().
--- drivers/usb/storage/uas.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/storage/uas.c +5 -0
@@ -697,6 +697,10 @@ static int uas_queuecommand_lck(struct s* of queueing, no matter how fatal the error */ if (err == -ENODEV ) { +if (cmdinfo->state & (COMMAND_INFLIGHT |DATA_IN_URB_INFLIGHT | +DATA_OUT_URB_INFLIGHT )) + goto out; +set_host_byte (cmnd,DID_NO_CONNECT );scsi_done (cmnd); goto zombie;
@@ -710,6 +714,7 @@ static int uas_queuecommand_lck(struct suas_add_work (cmnd); } +out: devinfo->cmnd[idx] = cmnd; zombie:spin_unlock_irqrestore (&devinfo->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 64/93 usb: dwc3: pci: add support for the Intel Nova Lake -S
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
commit c57ce99ec6cb55b53910b6b3d7437f80159ff9d8 upstream.
This patch adds the necessary PCI ID for Intel Nova Lake -S devices.
--- drivers/usb/dwc3/dwc3-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc3/dwc3-pci.c +2 -0
@@ -53,6 +53,7 @@#define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1#define PCI_DEVICE_ID_INTEL_MTLS 0x7f6f#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e +#define PCI_DEVICE_ID_INTEL_NVLS_PCH 0x6e6f#define PCI_DEVICE_ID_INTEL_ARLH_PCH 0x777e#define PCI_DEVICE_ID_INTEL_TGL 0x9a15#define PCI_DEVICE_ID_INTEL_PTLH 0xe332
@@ -443,6 +444,7 @@ static const struct pci_device_id dwc3_p { PCI_DEVICE_DATA(INTEL, MTLM, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, MTLP, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, MTL, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, NVLS_PCH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, MTLS, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, TGL, &dwc3_pci_intel_swnode) },
Greg Kroah-Hartman
maintainerPATCH 65/93 usb: dwc3: pci: Sort out the Intel device IDs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
commit 46b28d2fbd13148981d91246bc0e13f4fc055987 upstream.
The PCI device IDs were organised based on the Intel architecture generation in most cases, but not with every ID. That left the device ID table with no real order. Sorting the table based on the device ID.
--- drivers/usb/dwc3/dwc3-pci.c | 82 ++++++++++++++++++++++---------------------- 1 file changed, 41 insertions(+), 41 deletions(-)
drivers/usb/dwc3/dwc3-pci.c +41 -41
@@ -21,41 +21,41 @@#include <linux/acpi.h> #include <linux/delay.h> +#define PCI_DEVICE_ID_INTEL_CMLLP 0x02ee +#define PCI_DEVICE_ID_INTEL_CMLH 0x06ee +#define PCI_DEVICE_ID_INTEL_BXT 0x0aaa#define PCI_DEVICE_ID_INTEL_BYT 0x0f37#define PCI_DEVICE_ID_INTEL_MRFLD 0x119e -#define PCI_DEVICE_ID_INTEL_BSW 0x22b7 -#define PCI_DEVICE_ID_INTEL_SPTLP 0x9d30 -#define PCI_DEVICE_ID_INTEL_SPTH 0xa130 -#define PCI_DEVICE_ID_INTEL_BXT 0x0aaa#define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa -#define PCI_DEVICE_ID_INTEL_APL 0x5aaa -#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 -#define PCI_DEVICE_ID_INTEL_CMLLP 0x02ee -#define PCI_DEVICE_ID_INTEL_CMLH 0x06ee +#define PCI_DEVICE_ID_INTEL_BSW 0x22b7#define PCI_DEVICE_ID_INTEL_GLK 0x31aa -#define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee -#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e -#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0#define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee -#define PCI_DEVICE_ID_INTEL_EHL 0x4b7e -#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee -#define PCI_DEVICE_ID_INTEL_JSP 0x4dee -#define PCI_DEVICE_ID_INTEL_WCL 0x4d7e#define PCI_DEVICE_ID_INTEL_ADL 0x460e -#define PCI_DEVICE_ID_INTEL_ADL_PCH 0x51ee#define PCI_DEVICE_ID_INTEL_ADLN 0x465e +#define PCI_DEVICE_ID_INTEL_EHL 0x4b7e +#define PCI_DEVICE_ID_INTEL_WCL 0x4d7e +#define PCI_DEVICE_ID_INTEL_JSP 0x4dee +#define PCI_DEVICE_ID_INTEL_ADL_PCH 0x51ee#define PCI_DEVICE_ID_INTEL_ADLN_PCH 0x54ee -#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 -#define PCI_DEVICE_ID_INTEL_RPL 0xa70e +#define PCI_DEVICE_ID_INTEL_APL 0x5aaa +#define PCI_DEVICE_ID_INTEL_NVLS_PCH 0x6e6f +#define PCI_DEVICE_ID_INTEL_ARLH_PCH 0x777e#define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 +#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e +#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1#define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1#define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1#define PCI_DEVICE_ID_INTEL_MTLS 0x7f6f -#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e -#define PCI_DEVICE_ID_INTEL_NVLS_PCH 0x6e6f -#define PCI_DEVICE_ID_INTEL_ARLH_PCH 0x777e#define PCI_DEVICE_ID_INTEL_TGL 0x9a15 +#define PCI_DEVICE_ID_INTEL_SPTLP 0x9d30 +#define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee +#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee +#define PCI_DEVICE_ID_INTEL_SPTH 0xa130 +#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 +#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e +#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0 +#define PCI_DEVICE_ID_INTEL_RPL 0xa70e#define PCI_DEVICE_ID_INTEL_PTLH 0xe332#define PCI_DEVICE_ID_INTEL_PTLH_PCH 0xe37e#define PCI_DEVICE_ID_INTEL_PTLU 0xe432
@@ -413,41 +413,41 @@ static void dwc3_pci_remove(struct pci_d }static const struct pci_device_id dwc3_pci_id_table[] = { - {PCI_DEVICE_DATA (INTEL ,BSW , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,BYT , &dwc3_pci_intel_byt_swnode) }, - {PCI_DEVICE_DATA (INTEL ,MRFLD , &dwc3_pci_intel_mrfld_swnode) }, {PCI_DEVICE_DATA (INTEL ,CMLLP , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,CMLH , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,SPTLP , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,SPTH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,BXT , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,BYT , &dwc3_pci_intel_byt_swnode) }, + {PCI_DEVICE_DATA (INTEL ,MRFLD , &dwc3_pci_intel_mrfld_swnode) }, {PCI_DEVICE_DATA (INTEL ,BXT_M , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,APL , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,KBP , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,BSW , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,GLK , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,CNPLP , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,CNPH , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,CNPV , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,ICLLP , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,EHL , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,TGPLP , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,TGPH , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,JSP , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,WCL , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,ADL , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,ADL_PCH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,ADLN , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,EHL , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,WCL , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,JSP , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,ADL_PCH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,ADLN_PCH , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,ADLS , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,RPL , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,APL , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,NVLS_PCH , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,ARLH_PCH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,RPLS , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,MTL , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,ADLS , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,MTLM , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,MTLP , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,MTL , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,NVLS_PCH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,MTLS , &dwc3_pci_intel_swnode) }, - {PCI_DEVICE_DATA (INTEL ,ARLH_PCH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,TGL , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,SPTLP , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,CNPLP , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,TGPLP , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,SPTH , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,KBP , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,CNPH , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,CNPV , &dwc3_pci_intel_swnode) }, + {PCI_DEVICE_DATA (INTEL ,RPL , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,PTLH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,PTLH_PCH , &dwc3_pci_intel_swnode) }, {PCI_DEVICE_DATA (INTEL ,PTLU , &dwc3_pci_intel_swnode) },
Greg Kroah-Hartman
maintainerPATCH 66/93 usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Nagar <[email protected]>
commit e4037689a366743c4233966f0e74bc455820d316 upstream.
This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking dwc3_remove_requests(), leading to premature freeing of USB requests and subsequent crashes.
Three distinct execution paths interact with dwc3_remove_requests():
Path 1:
Triggered via dwc3_gadget_reset_interrupt() during USB reset handling. The call stack includes:
- dwc3_ep0_reset_state()
- dwc3_ep0_stall_and_restart()
- dwc3_ep0_out_start()
- dwc3_remove_requests()
- dwc3_gadget_del_and_unmap_request()
Path 2:
Also initiated from dwc3_gadget_reset_interrupt(), but through dwc3_stop_active_transfers(). The call stack includes:
- dwc3_stop_active_transfers()
- dwc3_remove_requests()
- dwc3_gadget_del_and_unmap_request()
Path 3:
Occurs independently during adb root execution, which triggers USB function unbind and bind operations. The sequence includes:
- gserial_disconnect()
- usb_ep_disable()
- dwc3_gadget_ep_disable()
- dwc3_remove_requests() with -ESHUTDOWN status
Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions.
To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue.
--- drivers/usb/dwc3/ep0.c | 1 + drivers/usb/dwc3/gadget.c | 7 +++++++ 2 files changed, 8 insertions(+)
drivers/usb/dwc3/ep0.c +1 -0
@@ -94,6 +94,7 @@ static int __dwc3_gadget_ep0_queue(struc req->request.actual =0 ; req->request.status = -EINPROGRESS ; req->epnum = dep->number; + req->status =DWC3_REQUEST_STATUS_QUEUED ;list_add_tail (&req->list, &dep->pending_list);
drivers/usb/dwc3/gadget.c +7 -0
@@ -229,6 +229,13 @@ void dwc3_gadget_giveback(struct dwc3_ep {struct dwc3 *dwc = dep->dwc; +/* +* The request might have been processed and completed while the +* spinlock was released. Skip processing if already completed. +*/ +if (req->status ==DWC3_REQUEST_STATUS_COMPLETED ) +return ; +dwc3_gadget_del_and_unmap_request (dep, req, status); req->status =DWC3_REQUEST_STATUS_COMPLETED ;
Greg Kroah-Hartman
maintainerPATCH 67/93 xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit f6bb3b67be9af0cfb90075c60850b6af5338a508 upstream.
Data read from a DbC device may be corrupted due to a race between ongoing write and write request completion handler both queuing new transfer blocks (TRBs) if there are remining data in the kfifo.
TRBs may be in incorrct order compared to the data in the kfifo.
Driver fails to keep lock between reading data from kfifo into a dbc request buffer, and queuing the request to the transfer ring.
This allows completed request to re-queue itself in the middle of an ongoing transfer loop, forcing itself between a kfifo read and request TRB write of another request
cpu0 cpu1 (re-queue completed req2)
lock(port_lock)dbc_start_tx()kfifo_out(fifo, req1->buffer)unlock(port_lock)
lock(port_lock)
dbc_write_complete(req2)
dbc_start_tx()
kfifo_out(fifo, req2->buffer)
unlock(port_lock)
lock(port_lock)
req2->trb = ring->enqueue;
ring->enqueue++
unlock(port_lock)lock(port_lock)req1->trb = ring->enqueue;
ring->enqueue++unlock(port_lock)
In the above scenario a kfifo containing "12345678" would read "1234" to req1 and "5678" to req2, but req2 is queued before req1 leading to data being transmitted as "56781234"
Solve this by adding a flag that prevents starting a new tx if we are already mid dbc_start_tx() during the unlocked part.
The already running dbc_do_start_tx() will make sure the newly completed request gets re-queued as it is added to the request write_pool while holding the lock.
--- drivers/usb/host/xhci-dbgcap.h | 1 + drivers/usb/host/xhci-dbgtty.c | 17 ++++++++++++++++- 2 files changed, 17 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-dbgcap.h +1 -0
@@ -113,6 +113,7 @@ struct dbc_port {unsigned int tx_boundary;bool registered; +bool tx_running; };struct dbc_driver {
drivers/usb/host/xhci-dbgtty.c +16 -1
@@ -47,7 +47,7 @@ dbc_kfifo_to_req(struct dbc_port *port,return len; } -static int dbc_start_tx (struct dbc_port *port) +static int dbc_do_start_tx (struct dbc_port *port) __releases(&port->port_lock) __acquires(&port->port_lock) {
@@ -57,6 +57,8 @@ static int dbc_start_tx(struct dbc_portbool do_tty_wake = false;struct list_head *pool = &port->write_pool; + port->tx_running = true; +while (!list_empty (pool)) { req = list_entry(pool->next, struct dbc_request, list_pool); len =dbc_kfifo_to_req (port, req->buf);
@@ -77,12 +79,25 @@ static int dbc_start_tx(struct dbc_port } } + port->tx_running = false; +if (do_tty_wake && port->port.tty)tty_wakeup (port->port.tty);return status; } +/* must be called with port->port_lock held */ +static int dbc_start_tx (struct dbc_port *port) +{ +lockdep_assert_held (&port->port_lock); + +if (port->tx_running) +return -EBUSY ; + +return dbc_do_start_tx (port); +} + static void dbc_start_rx(struct dbc_port *port) __releases(&port->port_lock) __acquires(&port->port_lock)
Greg Kroah-Hartman
maintainerPATCH 68/93 xhci: dbgtty: fix device unregister
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Łukasz Bartosik <[email protected]>
commit 1f73b8b56cf35de29a433aee7bfff26cea98be3f upstream.
When DbC is disconnected then xhci_dbc_tty_unregister_device() is called. However if there is any user space process blocked on write to DbC terminal device then it will never be signalled and thus stay blocked indifinitely.
This fix adds a tty_vhangup() call in xhci_dbc_tty_unregister_device(). The tty_vhangup() wakes up any blocked writers and causes subsequent write attempts to DbC terminal device to fail.
--- drivers/usb/host/xhci-dbgtty.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/host/xhci-dbgtty.c +6 -0
@@ -518,6 +518,12 @@ static void xhci_dbc_tty_unregister_deviif (!port->registered)return ; +/* +* Hang up the TTY. This wakes up any blocked +* writers and causes subsequent writes to fail. +*/ +tty_vhangup (port->port.tty); +tty_unregister_device (dbc_tty_driver, port->minor);xhci_dbc_tty_exit_port (port); port->registered = false;
Greg Kroah-Hartman
maintainerPATCH 69/93 USB: serial: ftdi_sio: add support for u-blox EVK-M101
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Suvorov <[email protected]>
commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b upstream.
The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces:
- EVK-M101 current sensors
- EVK-M101 I2C
- EVK-M101 UART
- EVK-M101 port D
Only the third USB interface is a UART. This change lets ftdi_sio probe the VID/PID and registers only interface #3 as a TTY, leaving the rest available for other drivers.
[1]
usb 5-1.3: new high-speed USB device number 11 using xhci_hcd
usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00 usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 5-1.3: Product: EVK-M101
usb 5-1.3: Manufacturer: u-blox AG
Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -1074,6 +1074,7 @@ static const struct usb_device_id id_tab/* U-Blox devices */ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, + { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },/* FreeCalypso USB adapters */ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
drivers/usb/serial/ftdi_sio_ids.h +1 -0
@@ -1614,6 +1614,7 @@#define UBLOX_VID 0x1546#define UBLOX_C099F9P_ZED_PID 0x0502#define UBLOX_C099F9P_ODIN_PID 0x0503 +#define UBLOX_EVK_M101_PID 0x0506/* * GMC devices
Greg Kroah-Hartman
maintainerPATCH 70/93 USB: serial: option: add support for Rolling RW101R-GL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <[email protected]>
commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 upstream.
- VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS)
0x0301: mbim, pipe
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0301 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS)
0x01a8: mbim, diag, AT, ADB, pipe1, pipe2
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=01a8 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS)
0x0302: mbim, pipe
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=0302 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS)
0x01a9: mbim, diag, AT, ADB, pipe1, pipe2
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a9 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/usb/serial/option.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/usb/serial/option.c +8 -2
@@ -2424,12 +2424,18 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */ .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */ .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ - .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a8, 0xff), /* Rolling RW101R-GL (laptop MBIM) */ + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a9, 0xff), /* Rolling RW101R-GL (laptop MBIM) */ + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0301, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */ .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
Greg Kroah-Hartman
maintainerPATCH 71/93 drm: sti: fix device leaks at component probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 620a8f131154250f6a64a07d049a4f235d6451a5 upstream.
Make sure to drop the references taken to the vtg devices by of_find_device_by_node() when looking up their driver data during component probe.
Note that holding a reference to a platform device does not prevent its driver data from going away so there is no point in keeping the reference after the lookup helper returns.
--- drivers/gpu/drm/sti/sti_vtg.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/sti/sti_vtg.c +6 -1
@@ -143,12 +143,17 @@ struct sti_vtg {struct sti_vtg *of_vtg_find (struct device_node *np) {struct platform_device *pdev; +struct sti_vtg *vtg; pdev =of_find_device_by_node (np);if (!pdev)return NULL ; -return (struct sti_vtg *)platform_get_drvdata (pdev); + vtg =platform_get_drvdata (pdev); + +put_device (&pdev->dev); + +return vtg; }static void vtg_reset (struct sti_vtg *vtg)
Greg Kroah-Hartman
maintainerPATCH 72/93 drm/amd/display: Check NULL before accessing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 upstream.
[WHAT]
IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic fails with NULL pointer dereference. This can be reproduced with both an eDP panel and a DP monitors connected.
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted 6.16.0-99-custom #8 PREEMPT(voluntary) Hardware name: AMD ........ RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu] Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30 c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02 RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668 RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000 RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760 R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000 R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0
PKRU: 55555554
Call Trace: <TASK> dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu] amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu] ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu] amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu] drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400 drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30 drm_crtc_get_last_vbltimestamp+0x55/0x90 drm_crtc_next_vblank_start+0x45/0xa0 drm_atomic_helper_wait_for_fences+0x81/0x1f0 ...
--- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_stream.c +8 -3
@@ -634,9 +634,14 @@ bool dc_stream_get_scanoutpos(const stru {uint8_t i;bool ret = false; -struct dc *dc = stream->ctx->dc; -struct resource_context *res_ctx = - &dc->current_state->res_ctx; +struct dc *dc; +struct resource_context *res_ctx; + +if (!stream->ctx) +return false; + + dc = stream->ctx->dc; + res_ctx = &dc->current_state->res_ctx;for (i =0 ; i <MAX_PIPES ; i++) {struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
Greg Kroah-Hartman
maintainerPATCH 73/93 net: dsa: microchip: common: Fix checks on irq_find_mapping()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Curutchet (Schneider Electric) <[email protected]>
commit 7b3c09e1667977edee11de94a85e2593a7c15e87 upstream.
irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found but it never returns a negative value. However, on each irq_find_mapping() call, we verify that the returned value isn't negative.
Fix the irq_find_mapping() checks to enter error paths when 0 is returned. Return -EINVAL in such cases.
--- drivers/net/dsa/microchip/ksz_common.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/dsa/microchip/ksz_common.c +4 -4
@@ -1870,8 +1870,8 @@ static int ksz_irq_phy_setup(struct ksz_if (BIT (phy) & ds->phys_mii_mask) { irq =irq_find_mapping (dev->ports[phy].pirq.domain,PORT_SRC_PHY_INT ); -if (irq <0 ) { - ret = irq; +if (!irq) { + ret = -EINVAL ; goto out; } ds->slave_mii_bus->irq[phy] = irq;
@@ -2095,8 +2095,8 @@ static int ksz_pirq_setup(struct ksz_devsnprintf (pirq->name,sizeof (pirq->name),"port_irq-%d" , p); pirq->irq_num =irq_find_mapping (dev->girq.domain, p); -if (pirq->irq_num <0 ) -return pirq->irq_num; +if (!pirq->irq_num) +return -EINVAL ;return ksz_irq_common_setup (dev, pirq); }
Greg Kroah-Hartman
maintainerPATCH 74/93 net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Curutchet (Schneider Electric) <[email protected]>
commit 9e059305be41a5bd27e03458d8333cf30d70be34 upstream.
irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found but it never returns a negative value. However, during the PTP IRQ setup, we verify that its returned value isn't negative.
Fix the irq_find_mapping() check to enter the error path when 0 is returned. Return -EINVAL in such case.
--- drivers/net/dsa/microchip/ksz_ptp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/microchip/ksz_ptp.c +2 -2
@@ -1145,8 +1145,8 @@ int ksz_ptp_irq_setup(struct dsa_switchirq_create_mapping (ptpirq->domain, irq); ptpirq->irq_num =irq_find_mapping (port->pirq.domain,PORT_SRC_PTP_INT ); -if (ptpirq->irq_num <0 ) { - ret = ptpirq->irq_num; +if (!ptpirq->irq_num) { + ret = -EINVAL ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 75/93 libceph: fix potential use-after-free in have_mon_and_osd_map()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 076381c261374c587700b3accf410bdd2dba334e upstream.
The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one
kfree(monc->monmap);
monc->monmap = monmap;
ceph_osdmap_destroy(osdc->osdmap);
osdc->osdmap = newmap;under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in
client->monc.monmap && client->monc.monmap->epoch &&
client->osdc.osdmap && client->osdc.osdmap->epoch;condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled:
BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70
Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305
CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266
...
Call Trace:
<TASK>
have_mon_and_osd_map+0x56/0x70
ceph_open_session+0x182/0x290
ceph_get_tree+0x333/0x680
vfs_get_tree+0x49/0x180
do_new_mount+0x1a3/0x2d0
path_mount+0x6dd/0x730
do_mount+0x99/0xe0
__do_sys_mount+0x141/0x180
do_syscall_64+0x9f/0x100
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Allocated by task 13305:
ceph_osdmap_alloc+0x16/0x130
ceph_osdc_init+0x27a/0x4c0
ceph_create_client+0x153/0x190
create_fs_client+0x50/0x2a0
ceph_get_tree+0xff/0x680
vfs_get_tree+0x49/0x180
do_new_mount+0x1a3/0x2d0
path_mount+0x6dd/0x730
do_mount+0x99/0xe0
__do_sys_mount+0x141/0x180
do_syscall_64+0x9f/0x100
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 9475:
kfree+0x212/0x290
handle_one_map+0x23c/0x3b0
ceph_osdc_handle_map+0x3c9/0x590
mon_dispatch+0x655/0x6f0
ceph_con_process_message+0xc3/0xe0
ceph_con_v1_try_read+0x614/0x760
ceph_con_workfn+0x2de/0x650
process_one_work+0x486/0x7c0
process_scheduled_works+0x73/0x90
worker_thread+0x1c8/0x2a0
kthread+0x2ec/0x300
ret_from_fork+0x24/0x40
ret_from_fork_asm+0x1a/0x30Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth().
monmap_show() and osdmap_show() now take the respective lock before accessing the map as well.
--- net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++++++-------------------- net/ceph/debugfs.c | 14 +++++++++--- 2 files changed, 42 insertions(+), 25 deletions(-)
net/ceph/ceph_common.c +32 -21
@@ -786,41 +786,52 @@ void ceph_reset_client_addr(struct ceph_EXPORT_SYMBOL (ceph_reset_client_addr);/* -* true if we have the mon map (and have thus joined the cluster) -*/ -static bool have_mon_and_osd_map (struct ceph_client *client) -{ -return client->monc.monmap && client->monc.monmap->epoch && - client->osdc.osdmap && client->osdc.osdmap->epoch; -} - -/* * mount: join the ceph cluster, and open root directory. */ int __ceph_open_session (struct ceph_client *client,unsigned long started) { -unsigned long timeout = client->options->mount_timeout; -long err; +DEFINE_WAIT_FUNC (wait, woken_wake_function); +long timeout =ceph_timeout_jiffies (client->options->mount_timeout); +bool have_monmap, have_osdmap; +int err;/* open session, and wait for mon and osd maps */ err =ceph_monc_open_session (&client->monc);if (err <0 )return err; -while (!have_mon_and_osd_map (client)) { -if (timeout &&time_after_eq (jiffies, started + timeout)) -return -ETIMEDOUT ; +add_wait_queue (&client->auth_wq, &wait); +for (;;) { +mutex_lock (&client->monc.mutex); + err = client->auth_err; + have_monmap = client->monc.monmap && client->monc.monmap->epoch; +mutex_unlock (&client->monc.mutex); + +down_read (&client->osdc.lock); + have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch; +up_read (&client->osdc.lock); + +if (err || (have_monmap && have_osdmap)) +break ; + +if (signal_pending (current)) { + err = -ERESTARTSYS ; +break ; + } + +if (!timeout) { + err = -ETIMEDOUT ; +break ; + }/* wait */ dout ("mount waiting for mon_map\n" ); - err =wait_event_interruptible_timeout (client->auth_wq, -have_mon_and_osd_map (client) || (client->auth_err <0 ), -ceph_timeout_jiffies (timeout)); -if (err <0 ) -return err; -if (client->auth_err <0 ) -return client->auth_err; + timeout =wait_woken (&wait,TASK_INTERRUPTIBLE , timeout); } +remove_wait_queue (&client->auth_wq, &wait); + +if (err) +return err;pr_info ("client%llu fsid %pU\n" ,ceph_client_gid (client), &client->fsid);
net/ceph/debugfs.c +10 -4
@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *int i;struct ceph_client *client = s->private; +mutex_lock (&client->monc.mutex);if (client->monc.monmap ==NULL ) -return 0 ; + goto out_unlock;seq_printf (s,"epoch %d\n" , client->monc.monmap->epoch);for (i =0 ; i < client->monc.monmap->num_mon; i++) {
@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *ENTITY_NAME (inst->name), ceph_pr_addr(&inst->addr)); } + +out_unlock: +mutex_unlock (&client->monc.mutex);return 0 ; }
@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *int i;struct ceph_client *client = s->private;struct ceph_osd_client *osdc = &client->osdc; -struct ceph_osdmap *map = osdc->osdmap; +struct ceph_osdmap *map;struct rb_node *n; +down_read (&osdc->lock); + map = osdc->osdmap;if (map ==NULL ) -return 0 ; + goto out_unlock; -down_read (&osdc->lock);seq_printf (s,"epoch %u barrier %u flags 0x%x\n" , map->epoch, osdc->epoch_barrier, map->flags);
@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *seq_printf (s,"]\n" ); } +out_unlock:up_read (&osdc->lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 76/93 libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ziming zhang <[email protected]>
commit 7fce830ecd0a0256590ee37eb65a39cbad3d64fc upstream.
The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection secret or processing service tickets.
[ idryomov: changelog ]
--- net/ceph/auth_x.c | 2 ++ 1 file changed, 2 insertions(+)
net/ceph/auth_x.c +2 -0
@@ -631,6 +631,7 @@ static int handle_auth_session_key(struc/* connection secret */ ceph_decode_32_safe (p, end, len, e_inval); +ceph_decode_need (p, end, len, e_inval);dout ("%s connection secret blob len %d\n" , __func__, len);if (len >0 ) { dp = *p +ceph_x_encrypt_offset ();
@@ -648,6 +649,7 @@ static int handle_auth_session_key(struc/* service tickets */ ceph_decode_32_safe (p, end, len, e_inval); +ceph_decode_need (p, end, len, e_inval);dout ("%s service tickets blob len %d\n" , __func__, len);if (len >0 ) { ret = ceph_x_proc_ticket_reply(ac, &th->session_key,
Greg Kroah-Hartman
maintainerPATCH 77/93 libceph: replace BUG_ON with bounds check for map->max_osd
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ziming zhang <[email protected]>
commit ec3797f043756a94ea2d0f106022e14ac4946c02 upstream.
OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd.
[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic
edits ]
--- net/ceph/osdmap.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
net/ceph/osdmap.c +11 -7
@@ -1504,8 +1504,6 @@ static int decode_new_primary_temp(voidu32 ceph_get_primary_affinity (struct ceph_osdmap *map,int osd) { -BUG_ON (osd >= map->max_osd); -if (!map->osd_primary_affinity)return CEPH_OSD_DEFAULT_PRIMARY_AFFINITY ;
@@ -1514,8 +1512,6 @@ u32 ceph_get_primary_affinity(struct cepstatic int set_primary_affinity (struct ceph_osdmap *map,int osd,u32 aff) { -BUG_ON (osd >= map->max_osd); -if (!map->osd_primary_affinity) {int i;
@@ -1577,6 +1573,8 @@ static int decode_new_primary_affinity(vceph_decode_32_safe (p, end, osd, e_inval);ceph_decode_32_safe (p, end, aff, e_inval); +if (osd >= map->max_osd) + goto e_inval; ret =set_primary_affinity (map, osd, aff);if (ret)
@@ -1879,7 +1877,9 @@ static int decode_new_up_state_weight(voceph_decode_need (p, end,2 *sizeof (u32), e_inval); osd =ceph_decode_32 (p); w =ceph_decode_32 (p); -BUG_ON (osd >= map->max_osd); +if (osd >= map->max_osd) + goto e_inval; +osdmap_info (map,"osd%d weight 0x%x %s\n" , osd, w, w ==CEPH_OSD_IN ?"(in)" : (w ==CEPH_OSD_OUT ?"(out)" :"" ));
@@ -1905,13 +1905,15 @@ static int decode_new_up_state_weight(vou32 xorstate; osd =ceph_decode_32 (p); +if (osd >= map->max_osd) + goto e_inval; +if (struct_v >=5 ) xorstate =ceph_decode_32 (p);else xorstate =ceph_decode_8 (p);if (xorstate ==0 ) xorstate =CEPH_OSD_UP ; -BUG_ON (osd >= map->max_osd);if ((map->osd_state[osd] &CEPH_OSD_UP ) && (xorstate &CEPH_OSD_UP ))osdmap_info (map,"osd%d down\n" , osd);
@@ -1937,7 +1939,9 @@ static int decode_new_up_state_weight(vostruct ceph_entity_addr addr; osd =ceph_decode_32 (p); -BUG_ON (osd >= map->max_osd); +if (osd >= map->max_osd) + goto e_inval; +if (struct_v >=7 ) ret =ceph_decode_entity_addrvec (p, end, msgr2, &addr);else
Greg Kroah-Hartman
maintainerPATCH 78/93 bonding: return detailed error when loading native XDP fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 22ccb684c1cae37411450e6e86a379cd3c29cb8f ]
Bonding only supports native XDP for specific modes, which can lead to confusion for users regarding why XDP loads successfully at times and fails at others. This patch enhances error handling by returning detailed error messages, providing users with clearer insights into the specific reasons for the failure when loading native XDP.
--- drivers/net/bonding/bond_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +4 -1
@@ -5622,8 +5622,11 @@ static int bond_xdp_set(struct net_devicASSERT_RTNL (); -if (!bond_xdp_check (bond)) +if (!bond_xdp_check (bond)) { +BOND_NL_ERR (dev, extack, +"No native XDP support for the current bonding mode" );return -EOPNOTSUPP ; + } old_prog = bond->xdp_prog; bond->xdp_prog = prog;
Greg Kroah-Hartman
maintainerPATCH 79/93 bonding: check xdp prog when set bond mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit 094ee6017ea09c11d6af187935a949df32803ce0 ]
Following operations can trigger a warning[1]:
ip netns add ns1
ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1
When delete the namespace, dev_xdp_uninstall() is called to remove xdp program on bond dev, and bond_xdp_set() will check the bond mode. If bond mode is changed after attaching xdp program, the warning may occur.
Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode with xdp program attached is not good. Add check for xdp program when set bond mode.
[1]
------------[ cut here ]------------
WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930
Modules linked in:
CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930
Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ...
RSP: 0018:ffffc90000063d80 EFLAGS: 00000282
RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff
RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48
RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb
R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8
R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000
FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0
Call Trace:
<TASK>
? __warn+0x83/0x130
? unregister_netdevice_many_notify+0x8d9/0x930
? report_bug+0x18e/0x1a0
? handle_bug+0x54/0x90
? exc_invalid_op+0x18/0x70
? asm_exc_invalid_op+0x1a/0x20
? unregister_netdevice_many_notify+0x8d9/0x930
? bond_net_exit_batch_rtnl+0x5c/0x90
cleanup_net+0x237/0x3d0
process_one_work+0x163/0x390
worker_thread+0x293/0x3b0
? __pfx_worker_thread+0x10/0x10
kthread+0xec/0x1e0
? __pfx_kthread+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x2f/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
---[ end trace 0000000000000000 ]------ drivers/net/bonding/bond_main.c | 8 ++++---- drivers/net/bonding/bond_options.c | 3 +++ include/net/bonding.h | 1 + 3 files changed, 8 insertions(+), 4 deletions(-)
drivers/net/bonding/bond_main.c +4 -4
@@ -322,9 +322,9 @@ static bool bond_sk_check(struct bonding } } -static bool bond_xdp_check (struct bonding *bond) +bool bond_xdp_check (struct bonding *bond,int mode) { -switch (BOND_MODE (bond)) { +switch (mode) {case BOND_MODE_ROUNDROBIN :case BOND_MODE_ACTIVEBACKUP :return true;
@@ -1855,7 +1855,7 @@ void bond_xdp_set_features(struct net_deASSERT_RTNL (); -if (!bond_xdp_check (bond) || !bond_has_slaves (bond)) { +if (!bond_xdp_check (bond,BOND_MODE (bond)) || !bond_has_slaves (bond)) {xdp_clear_features_flag (bond_dev);return ; }
@@ -5622,7 +5622,7 @@ static int bond_xdp_set(struct net_devicASSERT_RTNL (); -if (!bond_xdp_check (bond)) { +if (!bond_xdp_check (bond,BOND_MODE (bond))) {BOND_NL_ERR (dev, extack,"No native XDP support for the current bonding mode" );return -EOPNOTSUPP ;
drivers/net/bonding/bond_options.c +3 -0
@@ -868,6 +868,9 @@ static bool bond_set_xfrm_features(strucstatic int bond_option_mode_set (struct bonding *bond,const struct bond_opt_value *newval) { +if (bond->xdp_prog && !bond_xdp_check (bond, newval->value)) +return -EOPNOTSUPP ; +if (!bond_mode_uses_arp (newval->value)) {if (bond->params.arp_interval) { netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n",
include/net/bonding.h +1 -0
@@ -695,6 +695,7 @@ void bond_debug_register(struct bondingvoid bond_debug_unregister (struct bonding *bond);void bond_debug_reregister (struct bonding *bond);const char *bond_mode_name (int mode); +bool bond_xdp_check (struct bonding *bond,int mode);void bond_setup (struct net_device *bond_dev);unsigned int bond_get_num_tx_queues (void );int bond_netlink_init (void );
Greg Kroah-Hartman
maintainerPATCH 80/93 nfsd: Replace clamp_t in nfsd4_get_drc_mem()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
A recent change to clamp_t() in 6.1.y caused fs/nfsd/nfs4state.c to fail to compile with gcc-9. The code in nfsd4_get_drc_mem() was written with the assumption that when "max < min",
clamp(val, min, max)
would return max. This assumption is not documented as an API promise and the change caused a compile failure if it could be statically determined that "max < min".
The relevant code was no longer present upstream when commit 1519fbc8832b ("minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()") landed there, so there is no upstream change to nfsd4_get_drc_mem() to backport.
There is no clear case that the existing code in nfsd4_get_drc_mem() is functioning incorrectly. The goal of this patch is to permit the clean application of commit 1519fbc8832b ("minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()"), and any commits that depend on it, to LTS kernels without affecting the ability to compile those kernels. This is done by open-coding the __clamp() macro sans the built-in type checking.
Stable-dep-of: 1519fbc8832b ("minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()")
Reviewed_by: David Laight <[email protected]>
--- fs/nfsd/nfs4state.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
Changes since Neil's post:
* Editorial changes to the commit message
* Attempt to address David's review comments
* Applied to linux-6.12.y, passed NFSD upstream CI suite
This patch is intended to be applied to linux-6.12.y, and should apply cleanly to other LTS kernels since nfsd4_get_drc_mem hasn't changed since v5.4.
fs/nfsd/nfs4state.c +4 -2
@@ -1820,8 +1820,10 @@ static u32 nfsd4_get_drc_mem(struct nfsd*/ scale_factor = max_t(unsigned int, 8, nn->nfsd_serv->sv_nrthreads); - avail = clamp_t(unsigned long, avail, slotsize, - total_avail/scale_factor); +if (avail > total_avail / scale_factor) + avail = total_avail / scale_factor; +else if (avail < slotsize) + avail = slotsize; num =min_t (int, num, avail / slotsize); num =max_t (int, num,1 ); nfsd_drc_mem_used += num * slotsize;
Greg Kroah-Hartman
maintainerPATCH 81/93 usb: udc: Add trace event for usb_gadget_set_state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 7bf1158514e410310aec975e630cec99d4e4092f ]
While the userspace program can be notified of gadget state changes, timing issue can lead to missed transitions when reading the state value.
Introduce a trace event for usb_gadget_set_state to reliably track state transitions.
Stable-dep-of: baeb66fbd420 ("usb: gadget: udc: fix use-after-free in usb_gadget_state_work")
--- drivers/usb/gadget/udc/core.c | 1 + drivers/usb/gadget/udc/trace.h | 5 +++++ 2 files changed, 6 insertions(+)
drivers/usb/gadget/udc/core.c +1 -0
@@ -1123,6 +1123,7 @@ void usb_gadget_set_state(struct usb_gad { gadget->state = state;schedule_work (&gadget->work); +trace_usb_gadget_set_state (gadget,0 ); }EXPORT_SYMBOL_GPL (usb_gadget_set_state);
drivers/usb/gadget/udc/trace.h +5 -0
@@ -81,6 +81,11 @@ DECLARE_EVENT_CLASS(udc_log_gadget, __entry->ret) ); +DEFINE_EVENT (udc_log_gadget, usb_gadget_set_state, + TP_PROTO(struct usb_gadget *g, int ret), +TP_ARGS (g, ret) +); +DEFINE_EVENT (udc_log_gadget, usb_gadget_frame_number, TP_PROTO(struct usb_gadget *g, int ret), TP_ARGS(g, ret)
Greg Kroah-Hartman
maintainerPATCH 82/93 usb: gadget: udc: fix use-after-free in usb_gadget_state_work
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Hu <[email protected]>
[ Upstream commit baeb66fbd4201d1c4325074e78b1f557dff89b5b ]
A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN:
BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work
The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget().
Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free.
This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window.
--- drivers/usb/gadget/udc/core.c | 17 ++++++++++++++++- include/linux/usb/gadget.h | 5 +++++ 2 files changed, 21 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/core.c +16 -1
@@ -1121,8 +1121,13 @@ static void usb_gadget_state_work(structvoid usb_gadget_set_state (struct usb_gadget *gadget,enum usb_device_state state) { +unsigned long flags; + +spin_lock_irqsave (&gadget->state_lock, flags); gadget->state = state; -schedule_work (&gadget->work); +if (!gadget->teardown) +schedule_work (&gadget->work); +spin_unlock_irqrestore (&gadget->state_lock, flags);trace_usb_gadget_set_state (gadget,0 ); }EXPORT_SYMBOL_GPL (usb_gadget_set_state);
@@ -1356,6 +1361,8 @@ static void usb_udc_nop_release(struct dvoid usb_initialize_gadget (struct device *parent,struct usb_gadget *gadget,void (*release)(struct device *dev)) { +spin_lock_init (&gadget->state_lock); + gadget->teardown = false;INIT_WORK (&gadget->work, usb_gadget_state_work); gadget->dev.parent = parent;
@@ -1530,6 +1537,7 @@ EXPORT_SYMBOL_GPL(usb_add_gadget_udc);void usb_del_gadget (struct usb_gadget *gadget) {struct usb_udc *udc = gadget->udc; +unsigned long flags;if (!udc)return ;
@@ -1543,6 +1551,13 @@ void usb_del_gadget(struct usb_gadget *gkobject_uevent (&udc->dev.kobj,KOBJ_REMOVE );sysfs_remove_link (&udc->dev.kobj,"gadget" );device_del (&gadget->dev); +/* +* Set the teardown flag before flushing the work to prevent new work +* from being scheduled while we are cleaning up. +*/ +spin_lock_irqsave (&gadget->state_lock, flags); + gadget->teardown = true; +spin_unlock_irqrestore (&gadget->state_lock, flags);flush_work (&gadget->work);ida_free (&gadget_id_numbers, gadget->id_number);cancel_work_sync (&udc->vbus_work);
include/linux/usb/gadget.h +5 -0
@@ -374,6 +374,9 @@ struct usb_gadget_ops {* can handle. The UDC must support this and all slower speeds and lower * number of lanes. * @state: the state we are now (attached, suspended, configured, etc) +* @state_lock: Spinlock protecting the `state` and `teardown` members. +* @teardown: True if the device is undergoing teardown, used to prevent +* new work from being scheduled during cleanup. * @name: Identifies the controller hardware type. Used in diagnostics * and sometimes configuration. * @dev: Driver model state for this abstract device.
@@ -449,6 +452,8 @@ struct usb_gadget {enum usb_ssp_rate max_ssp_rate;enum usb_device_state state; +spinlock_t state_lock; +bool teardown;const char *name;struct device dev;unsigned isoch_delay;
Greg Kroah-Hartman
maintainerPATCH 83/93 usb: typec: ucsi: psy: Set max current to zero when disconnected
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jameson Thies <[email protected]>
[ Upstream commit 23379a17334fc24c4a9cbd9967d33dcd9323cc7c ]
The ucsi_psy_get_current_max function defaults to 0.1A when it is not clear how much current the partner device can support. But this does not check the port is connected, and will report 0.1A max current when nothing is connected. Update ucsi_psy_get_current_max to report 0A when there is no connection.
Rule: add
--- drivers/usb/typec/ucsi/psy.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/typec/ucsi/psy.c +5 -0
@@ -144,6 +144,11 @@ static int ucsi_psy_get_current_max(stru {u32 pdo; +if (!(con->status.flags &UCSI_CONSTAT_CONNECTED )) { + val->intval =0 ; +return 0 ; + } +switch (UCSI_CONSTAT_PWR_OPMODE (con->status.flags)) {case UCSI_CONSTAT_PWR_OPMODE_PD :if (con->num_pdos >0 ) {
Greg Kroah-Hartman
maintainerPATCH 84/93 can: rcar_canfd: Fix CAN-FD mode as default
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 6d849ff573722afcf5508d2800017bdd40f27eb9 ]
The commit 5cff263606a1 ("can: rcar_canfd: Fix controller mode setting") has aligned with the flow mentioned in the hardware manual for all SoCs except R-Car Gen3 and RZ/G2L SoCs. On R-Car Gen4 and RZ/G3E SoCs, due to the wrong logic in the commit[1] sets the default mode to FD-Only mode instead of CAN-FD mode.
This patch sets the CAN-FD mode as the default for all SoCs by dropping the rcar_canfd_set_mode() as some SoC requires mode setting in global reset mode, and the rest of the SoCs in channel reset mode and update the rcar_canfd_reset_controller() to take care of these constraints. Moreover, the RZ/G3E and R-Car Gen4 SoCs support 3 modes compared to 2 modes on the R-Car Gen3. Use inverted logic in rcar_canfd_reset_controller() to simplify the code later to support FD-only mode.
[1]
commit 45721c406dcf ("can: rcar_canfd: Add support for r8a779a0 SoC")
--- drivers/net/can/rcar/rcar_canfd.c | 53 +++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 23 deletions(-)
drivers/net/can/rcar/rcar_canfd.c +30 -23
@@ -687,26 +687,6 @@ static void rcar_canfd_tx_failure_cleanucan_free_echo_skb (ndev, i,NULL ); } -static void rcar_canfd_set_mode (struct rcar_canfd_global *gpriv) -{ -if (is_gen4 (gpriv)) { -u32 ch, val = gpriv->fdmode ?RCANFD_GEN4_FDCFG_FDOE - :RCANFD_GEN4_FDCFG_CLOE ; - -for_each_set_bit (ch, &gpriv->channels_mask, - gpriv->info->max_channels) -rcar_canfd_set_bit (gpriv->base,RCANFD_GEN4_FDCFG (ch), - val); - }else { -if (gpriv->fdmode) -rcar_canfd_set_bit (gpriv->base,RCANFD_GRMCFG , -RCANFD_GRMCFG_RCMC ); -else -rcar_canfd_clear_bit (gpriv->base,RCANFD_GRMCFG , -RCANFD_GRMCFG_RCMC ); - } -} -static int rcar_canfd_reset_controller (struct rcar_canfd_global *gpriv) {u32 sts, ch;
@@ -738,6 +718,16 @@ static int rcar_canfd_reset_controller(s/* Reset Global error flags */ rcar_canfd_write (gpriv->base,RCANFD_GERFL ,0x0 ); +/* Set the controller into appropriate mode */ +if (!is_gen4 (gpriv)) { +if (gpriv->fdmode) +rcar_canfd_set_bit (gpriv->base,RCANFD_GRMCFG , +RCANFD_GRMCFG_RCMC ); +else +rcar_canfd_clear_bit (gpriv->base,RCANFD_GRMCFG , +RCANFD_GRMCFG_RCMC ); + } +/* Transition all Channels to reset mode */ for_each_set_bit (ch, &gpriv->channels_mask, gpriv->info->max_channels) { rcar_canfd_clear_bit(gpriv->base,
@@ -756,10 +746,27 @@ static int rcar_canfd_reset_controller(s "channel %u reset failed\n", ch);return err; } - } -/* Set the controller into appropriate mode */ -rcar_canfd_set_mode (gpriv); +/* Set the controller into appropriate mode */ +if (is_gen4 (gpriv)) { +/* Do not set CLOE and FDOE simultaneously */ +if (!gpriv->fdmode) { +rcar_canfd_clear_bit (gpriv->base, +RCANFD_GEN4_FDCFG (ch), +RCANFD_GEN4_FDCFG_FDOE ); +rcar_canfd_set_bit (gpriv->base, +RCANFD_GEN4_FDCFG (ch), +RCANFD_GEN4_FDCFG_CLOE ); + }else { +rcar_canfd_clear_bit (gpriv->base, +RCANFD_GEN4_FDCFG (ch), +RCANFD_GEN4_FDCFG_FDOE ); +rcar_canfd_clear_bit (gpriv->base, +RCANFD_GEN4_FDCFG (ch), +RCANFD_GEN4_FDCFG_CLOE ); + } + } + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 85/93 iio: adc: rtq6056: Correct the sign bit index
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChiYuan Huang <[email protected]>
[ Upstream commit 9b45744bf09fc2a3287e05287141d6e123c125a7 ]
The vshunt/current reported register is a signed 16bit integer. The sign bit index should be '15', not '16'.
--- drivers/iio/adc/rtq6056.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/rtq6056.c +1 -1
@@ -171,7 +171,7 @@ static int rtq6056_adc_read_channel(struif (addr ==RTQ6056_REG_BUSVOLT || addr ==RTQ6056_REG_POWER ) *val = regval;else - *val =sign_extend32 (regval,16 ); + *val =sign_extend32 (regval,15 );return IIO_VAL_INT ; }
Greg Kroah-Hartman
maintainerPATCH 86/93 net: macb: fix unregister_netdev call order in macb_remove()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: luoguangfei <[email protected]>
[ Upstream commit 01b9128c5db1b470575d07b05b67ffa3cb02ebf1 ]
When removing a macb device, the driver calls phy_exit() before unregister_netdev(). This leads to a WARN from kernfs:
------------[ cut here ]------------
kernfs: can not remove 'attached_dev', no directory
WARNING: CPU: 1 PID: 27146 at fs/kernfs/dir.c:1683
Call trace:
kernfs_remove_by_name_ns+0xd8/0xf0
sysfs_remove_link+0x24/0x58
phy_detach+0x5c/0x168
phy_disconnect+0x4c/0x70
phylink_disconnect_phy+0x6c/0xc0 [phylink]
macb_close+0x6c/0x170 [macb]
...
macb_remove+0x60/0x168 [macb]
platform_remove+0x5c/0x80
...The warning happens because the PHY is being exited while the netdev is still registered. The correct order is to unregister the netdev before shutting down the PHY and cleaning up the MDIO bus.
Fix this by moving unregister_netdev() ahead of phy_exit() in macb_remove().
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -5182,11 +5182,11 @@ static int macb_remove(struct platform_dif (dev) { bp =netdev_priv (dev); +unregister_netdev (dev);phy_exit (bp->sgmii_phy);mdiobus_unregister (bp->mii_bus);mdiobus_free (bp->mii_bus); -unregister_netdev (dev);tasklet_kill (&bp->hresp_err_tasklet);pm_runtime_disable (&pdev->dev);pm_runtime_dont_use_autosuspend (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 87/93 staging: rtl8712: Remove driver using deprecated API wext
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Hortmann <[email protected]>
commit e8785404de06a69d89dcdd1e9a0b6ea42dc6d327 upstream.
This driver is in the staging area since 2010.
The following reasons lead to the removal:
- This driver generates maintenance workload for itself and for API wext
- A MAC80211 driver was available in 2016 time frame; This driver does not compile anymore but would be a better starting point than the current driver. Here the note from the TODO file:
A replacement for this driver with MAC80211 support is available at https://github.com/chunkeey/rtl8192su
- no progress changing to mac80211
- Using this hardware is security wise not state of the art as WPA3 is not supported.
Find further discussions in the Link below.
--- MAINTAINERS | 6 drivers/staging/Kconfig | 2 drivers/staging/Makefile | 1 drivers/staging/rtl8712/Kconfig | 21 drivers/staging/rtl8712/Makefile | 35 drivers/staging/rtl8712/TODO | 13 drivers/staging/rtl8712/basic_types.h | 28 drivers/staging/rtl8712/drv_types.h | 175 - drivers/staging/rtl8712/ethernet.h | 21 drivers/staging/rtl8712/hal_init.c | 401 --- drivers/staging/rtl8712/ieee80211.c | 415 --- drivers/staging/rtl8712/ieee80211.h | 165 - drivers/staging/rtl8712/mlme_linux.c | 160 - drivers/staging/rtl8712/mlme_osdep.h | 31 drivers/staging/rtl8712/mp_custom_oid.h | 287 -- drivers/staging/rtl8712/os_intfs.c | 482 --- drivers/staging/rtl8712/osdep_intf.h | 32 drivers/staging/rtl8712/osdep_service.h | 60 drivers/staging/rtl8712/recv_linux.c | 139 - drivers/staging/rtl8712/recv_osdep.h | 39 drivers/staging/rtl8712/rtl8712_bitdef.h | 26 drivers/staging/rtl8712/rtl8712_cmd.c | 409 --- drivers/staging/rtl8712/rtl8712_cmd.h | 231 - drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h | 95 drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h | 19 drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h | 41 drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h | 32 drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h | 65 drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h | 24 drivers/staging/rtl8712/rtl8712_efuse.c | 564 ---- drivers/staging/rtl8712/rtl8712_efuse.h | 44 drivers/staging/rtl8712/rtl8712_event.h | 86 drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h | 131 - drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h | 61 drivers/staging/rtl8712/rtl8712_gp_bitdef.h | 68 drivers/staging/rtl8712/rtl8712_gp_regdef.h | 29 drivers/staging/rtl8712/rtl8712_hal.h | 142 - drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h | 44 drivers/staging/rtl8712/rtl8712_io.c | 99 drivers/staging/rtl8712/rtl8712_led.c | 1830 -------------- drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h | 31 drivers/staging/rtl8712/rtl8712_macsetting_regdef.h | 20 drivers/staging/rtl8712/rtl8712_powersave_bitdef.h | 39 drivers/staging/rtl8712/rtl8712_powersave_regdef.h | 26 drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h | 36 drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h | 43 drivers/staging/rtl8712/rtl8712_recv.c | 1080 -------- drivers/staging/rtl8712/rtl8712_recv.h | 145 - drivers/staging/rtl8712/rtl8712_regdef.h | 32 drivers/staging/rtl8712/rtl8712_security_bitdef.h | 34 drivers/staging/rtl8712/rtl8712_spec.h | 121 drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h | 163 - drivers/staging/rtl8712/rtl8712_syscfg_regdef.h | 42 drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h | 49 drivers/staging/rtl8712/rtl8712_timectrl_regdef.h | 26 drivers/staging/rtl8712/rtl8712_wmac_bitdef.h | 49 drivers/staging/rtl8712/rtl8712_wmac_regdef.h | 36 drivers/staging/rtl8712/rtl8712_xmit.c | 744 ------ drivers/staging/rtl8712/rtl8712_xmit.h | 108 drivers/staging/rtl8712/rtl871x_cmd.c | 796 ------ drivers/staging/rtl8712/rtl871x_cmd.h | 761 ------ drivers/staging/rtl8712/rtl871x_debug.h | 130 - drivers/staging/rtl8712/rtl871x_eeprom.c | 220 - drivers/staging/rtl8712/rtl871x_eeprom.h | 88 drivers/staging/rtl8712/rtl871x_event.h | 109 drivers/staging/rtl8712/rtl871x_ht.h | 33 drivers/staging/rtl8712/rtl871x_io.c | 147 - drivers/staging/rtl8712/rtl871x_io.h | 236 - drivers/staging/rtl8712/rtl871x_ioctl.h | 94 drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2330 ------------------- drivers/staging/rtl8712/rtl871x_ioctl_rtl.c | 519 ---- drivers/staging/rtl8712/rtl871x_ioctl_rtl.h | 109 drivers/staging/rtl8712/rtl871x_ioctl_set.c | 354 -- drivers/staging/rtl8712/rtl871x_ioctl_set.h | 45 drivers/staging/rtl8712/rtl871x_led.h | 118 drivers/staging/rtl8712/rtl871x_mlme.c | 1710 ------------- drivers/staging/rtl8712/rtl871x_mlme.h | 205 - drivers/staging/rtl8712/rtl871x_mp.c | 724 ----- drivers/staging/rtl8712/rtl871x_mp.h | 275 -- drivers/staging/rtl8712/rtl871x_mp_ioctl.c | 883 ------- drivers/staging/rtl8712/rtl871x_mp_ioctl.h | 328 -- drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h | 1034 -------- drivers/staging/rtl8712/rtl871x_pwrctrl.c | 234 - drivers/staging/rtl8712/rtl871x_pwrctrl.h | 113 drivers/staging/rtl8712/rtl871x_recv.c | 671 ----- drivers/staging/rtl8712/rtl871x_recv.h | 208 - drivers/staging/rtl8712/rtl871x_rf.h | 55 drivers/staging/rtl8712/rtl871x_security.c | 1386 ----------- drivers/staging/rtl8712/rtl871x_security.h | 218 - drivers/staging/rtl8712/rtl871x_sta_mgt.c | 263 -- drivers/staging/rtl8712/rtl871x_wlan_sme.h | 35 drivers/staging/rtl8712/rtl871x_xmit.c | 1059 -------- drivers/staging/rtl8712/rtl871x_xmit.h | 288 -- drivers/staging/rtl8712/sta_info.h | 132 - drivers/staging/rtl8712/usb_halinit.c | 307 -- drivers/staging/rtl8712/usb_intf.c | 638 ----- drivers/staging/rtl8712/usb_ops.c | 195 - drivers/staging/rtl8712/usb_ops.h | 38 drivers/staging/rtl8712/usb_ops_linux.c | 515 ---- drivers/staging/rtl8712/usb_osintf.h | 35 drivers/staging/rtl8712/wifi.h | 196 - drivers/staging/rtl8712/wlan_bssdef.h | 223 - drivers/staging/rtl8712/xmit_linux.c | 181 - drivers/staging/rtl8712/xmit_osdep.h | 52 104 files changed, 27667 deletions(-) delete mode 100644 drivers/staging/rtl8712/Kconfig delete mode 100644 drivers/staging/rtl8712/Makefile delete mode 100644 drivers/staging/rtl8712/TODO delete mode 100644 drivers/staging/rtl8712/basic_types.h delete mode 100644 drivers/staging/rtl8712/drv_types.h delete mode 100644 drivers/staging/rtl8712/ethernet.h delete mode 100644 drivers/staging/rtl8712/hal_init.c delete mode 100644 drivers/staging/rtl8712/ieee80211.c delete mode 100644 drivers/staging/rtl8712/ieee80211.h delete mode 100644 drivers/staging/rtl8712/mlme_linux.c delete mode 100644 drivers/staging/rtl8712/mlme_osdep.h delete mode 100644 drivers/staging/rtl8712/mp_custom_oid.h delete mode 100644 drivers/staging/rtl8712/os_intfs.c delete mode 100644 drivers/staging/rtl8712/osdep_intf.h delete mode 100644 drivers/staging/rtl8712/osdep_service.h delete mode 100644 drivers/staging/rtl8712/recv_linux.c delete mode 100644 drivers/staging/rtl8712/recv_osdep.h delete mode 100644 drivers/staging/rtl8712/rtl8712_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_cmd.c delete mode 100644 drivers/staging/rtl8712/rtl8712_cmd.h delete mode 100644 drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_efuse.c delete mode 100644 drivers/staging/rtl8712/rtl8712_efuse.h delete mode 100644 drivers/staging/rtl8712/rtl8712_event.h delete mode 100644 drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_gp_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_gp_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_hal.h delete mode 100644 drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_io.c delete mode 100644 drivers/staging/rtl8712/rtl8712_led.c delete mode 100644 drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_macsetting_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_powersave_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_powersave_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_recv.c delete mode 100644 drivers/staging/rtl8712/rtl8712_recv.h delete mode 100644 drivers/staging/rtl8712/rtl8712_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_security_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_spec.h delete mode 100644 drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_syscfg_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_timectrl_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_wmac_bitdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_wmac_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl8712_xmit.c delete mode 100644 drivers/staging/rtl8712/rtl8712_xmit.h delete mode 100644 drivers/staging/rtl8712/rtl871x_cmd.c delete mode 100644 drivers/staging/rtl8712/rtl871x_cmd.h delete mode 100644 drivers/staging/rtl8712/rtl871x_debug.h delete mode 100644 drivers/staging/rtl8712/rtl871x_eeprom.c delete mode 100644 drivers/staging/rtl8712/rtl871x_eeprom.h delete mode 100644 drivers/staging/rtl8712/rtl871x_event.h delete mode 100644 drivers/staging/rtl8712/rtl871x_ht.h delete mode 100644 drivers/staging/rtl8712/rtl871x_io.c delete mode 100644 drivers/staging/rtl8712/rtl871x_io.h delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl.h delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_linux.c delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_rtl.c delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_rtl.h delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_set.c delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_set.h delete mode 100644 drivers/staging/rtl8712/rtl871x_led.h delete mode 100644 drivers/staging/rtl8712/rtl871x_mlme.c delete mode 100644 drivers/staging/rtl8712/rtl871x_mlme.h delete mode 100644 drivers/staging/rtl8712/rtl871x_mp.c delete mode 100644 drivers/staging/rtl8712/rtl871x_mp.h delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_ioctl.c delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_ioctl.h delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h delete mode 100644 drivers/staging/rtl8712/rtl871x_pwrctrl.c delete mode 100644 drivers/staging/rtl8712/rtl871x_pwrctrl.h delete mode 100644 drivers/staging/rtl8712/rtl871x_recv.c delete mode 100644 drivers/staging/rtl8712/rtl871x_recv.h delete mode 100644 drivers/staging/rtl8712/rtl871x_rf.h delete mode 100644 drivers/staging/rtl8712/rtl871x_security.c delete mode 100644 drivers/staging/rtl8712/rtl871x_security.h delete mode 100644 drivers/staging/rtl8712/rtl871x_sta_mgt.c delete mode 100644 drivers/staging/rtl8712/rtl871x_wlan_sme.h delete mode 100644 drivers/staging/rtl8712/rtl871x_xmit.c delete mode 100644 drivers/staging/rtl8712/rtl871x_xmit.h delete mode 100644 drivers/staging/rtl8712/sta_info.h delete mode 100644 drivers/staging/rtl8712/usb_halinit.c delete mode 100644 drivers/staging/rtl8712/usb_intf.c delete mode 100644 drivers/staging/rtl8712/usb_ops.c delete mode 100644 drivers/staging/rtl8712/usb_ops.h delete mode 100644 drivers/staging/rtl8712/usb_ops_linux.c delete mode 100644 drivers/staging/rtl8712/usb_osintf.h delete mode 100644 drivers/staging/rtl8712/wifi.h delete mode 100644 drivers/staging/rtl8712/wlan_bssdef.h delete mode 100644 drivers/staging/rtl8712/xmit_linux.c delete mode 100644 drivers/staging/rtl8712/xmit_osdep.h
MAINTAINERS +0 -6
@@ -20390,12 +20390,6 @@ S: Maintained W: http://wiki.laptop.org/go/DCON F: drivers/staging/olpc_dcon/ -STAGING - REALTEK RTL8712U DRIVERS -M: Larry Finger <[email protected]> -M: Florian Schilhabel <[email protected]>. -S: Odd Fixes -F: drivers/staging/rtl8712/ - STAGING - SEPS525 LCD CONTROLLER DRIVERS M: Michael Hennerich <[email protected]> L: [email protected]
drivers/staging/Kconfig +0 -2
@@ -34,8 +34,6 @@ source "drivers/staging/rtl8192e/Kconfig source "drivers/staging/rtl8723bs/Kconfig" -source "drivers/staging/rtl8712/Kconfig" - source "drivers/staging/rts5208/Kconfig" source "drivers/staging/octeon/Kconfig"
drivers/staging/Makefile +0 -1
@@ -7,7 +7,6 @@ obj-$(CONFIG_FB_OLPC_DCON) += olpc_dcon/ obj-$(CONFIG_RTL8192U) += rtl8192u/ obj-$(CONFIG_RTL8192E) += rtl8192e/ obj-$(CONFIG_RTL8723BS) += rtl8723bs/ -obj-$(CONFIG_R8712U) += rtl8712/ obj-$(CONFIG_RTS5208) += rts5208/ obj-$(CONFIG_OCTEON_ETHERNET) += octeon/ obj-$(CONFIG_VT6655) += vt6655/
drivers/staging/rtl8712/Kconfig deleted +0 -21
@@ -1,21 +0,0 @@ -# SPDX-License-Identifier: GPL-2.0 -config R8712U - tristate "RealTek RTL8712U (RTL8192SU) Wireless LAN NIC driver" - depends on WLAN && USB && CFG80211 - select WIRELESS_EXT - select WEXT_PRIV - select FW_LOADER - help - This option adds the Realtek RTL8712 USB device such as the - D-Link DWA-130. - - If built as a module, it will be called r8712u. - -config R8712_TX_AGGR - bool "Realtek RTL8712U Transmit Aggregation code" - depends on R8712U && BROKEN - help - This option provides transmit aggregation for the Realtek - RTL8712 USB device. - -
drivers/staging/rtl8712/Makefile deleted +0 -35
@@ -1,35 +0,0 @@ -# SPDX-License-Identifier: GPL-2.0 -r8712u-y := \ - rtl871x_cmd.o \ - rtl8712_cmd.o \ - rtl871x_security.o \ - rtl871x_eeprom.o \ - rtl8712_efuse.o \ - hal_init.o \ - usb_halinit.o \ - usb_ops.o \ - usb_ops_linux.o \ - rtl871x_io.o \ - rtl8712_io.o \ - rtl871x_ioctl_linux.o \ - rtl871x_ioctl_rtl.o \ - rtl871x_ioctl_set.o \ - rtl8712_led.o \ - rtl871x_mlme.o \ - ieee80211.o \ - rtl871x_mp_ioctl.o \ - rtl871x_mp.o \ - mlme_linux.o \ - recv_linux.o \ - xmit_linux.o \ - usb_intf.o \ - os_intfs.o \ - rtl871x_pwrctrl.o \ - rtl8712_recv.o \ - rtl871x_recv.o \ - rtl871x_sta_mgt.o \ - rtl871x_xmit.o \ - rtl8712_xmit.o - -obj-$(CONFIG_R8712U) := r8712u.o -
drivers/staging/rtl8712/TODO deleted +0 -13
@@ -1,13 +0,0 @@ -TODO: -- merge Realtek's bugfixes and new features into the driver -- switch to use LIB80211 -- switch to use MAC80211 -- checkpatch.pl fixes - only a few remain - -A replacement for this driver with MAC80211 support is available -at https://github.com/chunkeey/rtl8192su - -Please send any patches to Greg Kroah-Hartman <[email protected]>, -Larry Finger <[email protected]>, -Florian Schilhabel <[email protected]> and -Linux Driver Project Developer List <[email protected]>.
drivers/staging/rtl8712/basic_types.h deleted +0 -28
@@ -1,28 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/****************************************************************************** -* -* Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -* -* Modifications for inclusion into the Linux staging tree are -* Copyright(c) 2010 Larry Finger. All rights reserved. -* -* Contact information: -* WLAN FAE <[email protected]> -* Larry Finger <[email protected]> -* -******************************************************************************/ -#ifndef __BASIC_TYPES_H__ -#define __BASIC_TYPES_H__ - -#include <linux/types.h> - -#define sint signed int - -/* Should we extend this to be host_addr_t and target_addr_t for case: -* host : x86_64 -* target : mips64 -*/ -#define addr_t unsigned long - -#endif /*__BASIC_TYPES_H__*/ -
drivers/staging/rtl8712/drv_types.h deleted +0 -175
175 lines not on this page · raw message
drivers/staging/rtl8712/ethernet.h deleted +0 -21
@@ -1,21 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/****************************************************************************** -* -* Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -* -* Modifications for inclusion into the Linux staging tree are -* Copyright(c) 2010 Larry Finger. All rights reserved. -* -* Contact information: -* WLAN FAE <[email protected]> -* Larry Finger <[email protected]> -* -******************************************************************************/ -#ifndef __INC_ETHERNET_H -#define __INC_ETHERNET_H - -#define ETHERNET_HEADER_SIZE 14/*!< Ethernet Header Length*/ -#define LLC_HEADER_SIZE 6/*!< LLC Header Length*/ - -#endif /* #ifndef __INC_ETHERNET_H */ -
drivers/staging/rtl8712/hal_init.c deleted +0 -401
401 lines not on this page · raw message
drivers/staging/rtl8712/ieee80211.c deleted +0 -415
415 lines not on this page · raw message
drivers/staging/rtl8712/ieee80211.h deleted +0 -165
165 lines not on this page · raw message
drivers/staging/rtl8712/mlme_linux.c deleted +0 -160
160 lines not on this page · raw message
drivers/staging/rtl8712/mlme_osdep.h deleted +0 -31
@@ -1,31 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/****************************************************************************** -* -* Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -* -* Modifications for inclusion into the Linux staging tree are -* Copyright(c) 2010 Larry Finger. All rights reserved. -* -* Contact information: -* WLAN FAE <[email protected]> -* Larry Finger <[email protected]> -* -******************************************************************************/ -#ifndef __MLME_OSDEP_H_ -#define __MLME_OSDEP_H_ - -#include "osdep_service.h" -#include "drv_types.h" - -void r8712_init_mlme_timer (struct _adapter *padapter); -void r8712_os_indicate_disconnect (struct _adapter *adapter); -void r8712_os_indicate_connect (struct _adapter *adapter); -void r8712_report_sec_ie (struct _adapter *adapter,u8 authmode,u8 *sec_ie); -int r8712_recv_indicatepkts_in_order (struct _adapter *adapter, -struct recv_reorder_ctrl *precvreorder_ctrl, -int bforced); -void r8712_indicate_wx_assoc_event (struct _adapter *padapter); -void r8712_indicate_wx_disassoc_event (struct _adapter *padapter); - -#endif /*_MLME_OSDEP_H_*/ -
drivers/staging/rtl8712/mp_custom_oid.h deleted +0 -287
287 lines not on this page · raw message
drivers/staging/rtl8712/os_intfs.c deleted +0 -482
482 lines not on this page · raw message
drivers/staging/rtl8712/osdep_intf.h deleted +0 -32
@@ -1,32 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/****************************************************************************** -* -* Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -* -* Modifications for inclusion into the Linux staging tree are -* Copyright(c) 2010 Larry Finger. All rights reserved. -* -* Contact information: -* WLAN FAE <[email protected]> -* Larry Finger <[email protected]> -* -******************************************************************************/ -#ifndef __OSDEP_INTF_H_ -#define __OSDEP_INTF_H_ - -#include "osdep_service.h" -#include "drv_types.h" - -#define RND4 (x) (((x >> 2) + ((x & 3) != 0)) << 2) - -struct intf_priv { -u8 *intf_dev; -/* when in USB, IO is through interrupt in/out endpoints */ -struct usb_device *udev; -struct urb *piorw_urb; -struct completion io_retevt_comp; -}; - -int r871x_ioctl (struct net_device *dev,struct ifreq *rq,int cmd); - -#endif /*_OSDEP_INTF_H_*/
drivers/staging/rtl8712/osdep_service.h deleted +0 -60
60 lines not on this page · raw message
drivers/staging/rtl8712/recv_linux.c deleted +0 -139
139 lines not on this page · raw message
drivers/staging/rtl8712/recv_osdep.h deleted +0 -39
@@ -1,39 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/****************************************************************************** -* -* Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -* -* Modifications for inclusion into the Linux staging tree are -* Copyright(c) 2010 Larry Finger. All rights reserved. -* -* Contact information: -* WLAN FAE <[email protected]> -* Larry Finger <[email protected]> -* -******************************************************************************/ -#ifndef __RECV_OSDEP_H_ -#define __RECV_OSDEP_H_ - -#include "osdep_service.h" -#include "drv_types.h" -#include <linux/skbuff.h> - -int _r8712_init_recv_priv (struct recv_priv *precvpriv, -struct _adapter *padapter); -void _r8712_free_recv_priv (struct recv_priv *precvpriv); -void r8712_recv_entry (union recv_frame *precv_frame); -void r8712_recv_indicatepkt (struct _adapter *adapter, -union recv_frame *precv_frame); -void r8712_handle_tkip_mic_err (struct _adapter *padapter,u8 bgroup); -int r8712_init_recv_priv (struct recv_priv *precvpriv, -struct _adapter *padapter); -void r8712_free_recv_priv (struct recv_priv *precvpriv); -void r8712_os_recv_resource_alloc (struct _adapter *padapter, -union recv_frame *precvframe); -int r8712_os_recvbuf_resource_alloc (struct _adapter *padapter, -struct recv_buf *precvbuf); -void r8712_os_recvbuf_resource_free (struct _adapter *padapter, -struct recv_buf *precvbuf); -void r8712_init_recv_timer (struct recv_reorder_ctrl *preorder_ctrl); - -#endif
drivers/staging/rtl8712/rtl8712_bitdef.h deleted +0 -26
@@ -1,26 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/****************************************************************************** -* -* Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -* -******************************************************************************/ - -#ifndef __RTL8712_BITDEF_H__ -#define __RTL8712_BITDEF_H__ - -#include "rtl8712_cmdctrl_bitdef.h" -#include "rtl8712_syscfg_bitdef.h" -#include "rtl8712_macsetting_bitdef.h" -#include "rtl8712_timectrl_bitdef.h" -#include "rtl8712_fifoctrl_bitdef.h" -#include "rtl8712_ratectrl_bitdef.h" -#include "rtl8712_edcasetting_bitdef.h" -#include "rtl8712_wmac_bitdef.h" -#include "rtl8712_security_bitdef.h" -#include "rtl8712_powersave_bitdef.h" -#include "rtl8712_gp_bitdef.h" -#include "rtl8712_interrupt_bitdef.h" -#include "rtl8712_debugctrl_bitdef.h" - -#endif /* __RTL8712_BITDEF_H__ */ -
drivers/staging/rtl8712/rtl8712_cmd.c deleted +0 -409
409 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_cmd.h deleted +0 -231
34 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h deleted +0 -95
95 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h deleted +0 -19
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h deleted +0 -41
41 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h deleted +0 -32
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h deleted +0 -65
65 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h deleted +0 -24
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_efuse.c deleted +0 -564
564 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_efuse.h deleted +0 -44
44 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_event.h deleted +0 -86
86 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h deleted +0 -131
131 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h deleted +0 -61
61 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_gp_bitdef.h deleted +0 -68
68 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_gp_regdef.h deleted +0 -29
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_hal.h deleted +0 -142
142 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h deleted +0 -44
44 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_io.c deleted +0 -99
99 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_led.c deleted +0 -1830
1,830 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h deleted +0 -31
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_macsetting_regdef.h deleted +0 -20
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_powersave_bitdef.h deleted +0 -39
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_powersave_regdef.h deleted +0 -26
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h deleted +0 -36
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h deleted +0 -43
43 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_recv.c deleted +0 -1080
1,080 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_recv.h deleted +0 -145
145 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_regdef.h deleted +0 -32
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_security_bitdef.h deleted +0 -34
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_spec.h deleted +0 -121
121 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h deleted +0 -163
163 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_syscfg_regdef.h deleted +0 -42
42 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h deleted +0 -49
49 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_timectrl_regdef.h deleted +0 -26
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_wmac_bitdef.h deleted +0 -49
49 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_wmac_regdef.h deleted +0 -36
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl8712_xmit.c deleted +0 -744
744 lines not on this page · raw message
drivers/staging/rtl8712/rtl8712_xmit.h deleted +0 -108
108 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_cmd.c deleted +0 -796
796 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_cmd.h deleted +0 -761
761 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_debug.h deleted +0 -130
130 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_eeprom.c deleted +0 -220
220 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_eeprom.h deleted +0 -88
88 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_event.h deleted +0 -109
109 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_ht.h deleted +0 -33
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl871x_io.c deleted +0 -147
147 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_io.h deleted +0 -236
236 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_ioctl.h deleted +0 -94
94 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_ioctl_linux.c deleted +0 -2330
2,330 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_ioctl_rtl.c deleted +0 -519
519 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_ioctl_rtl.h deleted +0 -109
109 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_ioctl_set.c deleted +0 -354
354 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_ioctl_set.h deleted +0 -45
45 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_led.h deleted +0 -118
118 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_mlme.c deleted +0 -1710
1,710 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_mlme.h deleted +0 -205
205 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_mp.c deleted +0 -724
724 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_mp.h deleted +0 -275
275 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_mp_ioctl.c deleted +0 -883
883 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_mp_ioctl.h deleted +0 -328
328 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h deleted +0 -1034
1,034 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_pwrctrl.c deleted +0 -234
234 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_pwrctrl.h deleted +0 -113
113 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_recv.c deleted +0 -671
671 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_recv.h deleted +0 -208
208 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_rf.h deleted +0 -55
55 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_security.c deleted +0 -1386
1,386 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_security.h deleted +0 -218
218 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_sta_mgt.c deleted +0 -263
263 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_wlan_sme.h deleted +0 -35
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/rtl871x_xmit.c deleted +0 -1059
1,059 lines not on this page · raw message
drivers/staging/rtl8712/rtl871x_xmit.h deleted +0 -288
288 lines not on this page · raw message
drivers/staging/rtl8712/sta_info.h deleted +0 -132
132 lines not on this page · raw message
drivers/staging/rtl8712/usb_halinit.c deleted +0 -307
307 lines not on this page · raw message
drivers/staging/rtl8712/usb_intf.c deleted +0 -638
638 lines not on this page · raw message
drivers/staging/rtl8712/usb_ops.c deleted +0 -195
195 lines not on this page · raw message
drivers/staging/rtl8712/usb_ops.h deleted +0 -38
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/usb_ops_linux.c deleted +0 -515
515 lines not on this page · raw message
drivers/staging/rtl8712/usb_osintf.h deleted +0 -35
Lines of this file are not shown. View the raw message.
drivers/staging/rtl8712/wifi.h deleted +0 -196
196 lines not on this page · raw message
drivers/staging/rtl8712/wlan_bssdef.h deleted +0 -223
223 lines not on this page · raw message
drivers/staging/rtl8712/xmit_linux.c deleted +0 -181
181 lines not on this page · raw message
drivers/staging/rtl8712/xmit_osdep.h deleted +0 -52
52 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 88/93 selftests: mptcp: join: properly kill background tasks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
commit 852b644acbce1529307a4bb283752c4e77b5cda7 upstream.
The 'run_tests' function is executed in the background, but killing its associated PID would not kill the children tasks running in the background.
To properly kill all background tasks, 'kill -- -PID' could be used, but this requires kill from procps-ng. Instead, all children tasks are listed using 'ps', and 'kill' is called with all PIDs of this group.
[ Conflicts in mptcp_join.sh, because commit e3b47e460b4b ("selftests:
mptcp: userspace pm remove initial subflow") and commit b9fb176081fb ("selftests: mptcp: userspace pm send RM_ADDR for ID 0") are not in this version. They introduced new subtests that got modified by this patch. That's OK, no need to modify them if they are not there: the conflicts can be dropped. ]
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 +++++++------- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 21 +++++++++++++++++++++ 2 files changed, 28 insertions(+), 7 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +7 -7
@@ -3679,7 +3679,7 @@ userspace_tests() chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1 kill_events_pids - mptcp_lib_kill_wait $tests_pid + mptcp_lib_kill_group_wait $tests_pid fi # userspace pm create destroy subflow
@@ -3707,7 +3707,7 @@ userspace_tests() chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1 kill_events_pids - mptcp_lib_kill_wait $tests_pid + mptcp_lib_kill_group_wait $tests_pid fi # userspace pm create id 0 subflow
@@ -3728,7 +3728,7 @@ userspace_tests() chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2 kill_events_pids - mptcp_lib_kill_wait $tests_pid + mptcp_lib_kill_group_wait $tests_pid fi }
@@ -3758,7 +3758,7 @@ endpoint_tests() pm_nl_add_endpoint $ns2 10.0.2.2 flags signal pm_nl_check_endpoint "modif is allowed" \ $ns2 10.0.2.2 id 1 flags signal - mptcp_lib_kill_wait $tests_pid + mptcp_lib_kill_group_wait $tests_pid fi if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT &&
@@ -3813,7 +3813,7 @@ endpoint_tests() chk_mptcp_info subflows 3 subflows 3 done - mptcp_lib_kill_wait $tests_pid + mptcp_lib_kill_group_wait $tests_pid kill_events_pids chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
@@ -3886,7 +3886,7 @@ endpoint_tests() wait_mpj $ns2 chk_subflow_nr "after re-re-add ID 0" 3 chk_mptcp_info subflows 3 subflows 3 - mptcp_lib_kill_wait $tests_pid + mptcp_lib_kill_group_wait $tests_pid kill_events_pids chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
@@ -3933,7 +3933,7 @@ endpoint_tests() wait_mpj $ns2 pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal wait_mpj $ns2 - mptcp_lib_kill_wait $tests_pid + mptcp_lib_kill_group_wait $tests_pid chk_join_nr 2 2 2 chk_add_nr 2 2
tools/testing/selftests/net/mptcp/mptcp_lib.sh +21 -0
@@ -242,6 +242,27 @@ mptcp_lib_kill_wait() { wait "${1}" 2>/dev/null } +# $1: PID +mptcp_lib_pid_list_children() { + local curr="${1}" + # evoke 'ps' only once + local pids="${2:-"$(ps o pid,ppid)"}" + + echo "${curr}" + + local pid + for pid in $(echo "${pids}" | awk "\$2 == ${curr} { print \$1 }"); do + mptcp_lib_pid_list_children "${pid}" "${pids}" + done +} + +# $1: PID +mptcp_lib_kill_group_wait() { + # Some users might not have procps-ng: cannot use "kill -- -PID" + mptcp_lib_pid_list_children "${1}" | xargs -r kill &>/dev/null + wait "${1}" 2>/dev/null +} + # $1: IP address mptcp_lib_is_v6() { [ -z "${1##*:*}" ]
Greg Kroah-Hartman
maintainerPATCH 89/93 mptcp: fix duplicate reset on fastclose
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit ae155060247be8dcae3802a95bd1bdf93ab3215d upstream.
The CI reports sporadic failures of the fastclose self-tests. The root cause is a duplicate reset, not carrying the relevant MPTCP option. In the failing scenario the bad reset is received by the peer before the fastclose one, preventing the reception of the latter.
Indeed there is window of opportunity at fastclose time for the following race:
mptcp_do_fastclose
__mptcp_close_ssk
__tcp_close()
tcp_set_state() [1]
tcp_send_active_reset() [2]After [1] the stack will send reset to in-flight data reaching the now closed port. Such reset may race with [2].
Address the issue explicitly sending a single reset on fastclose before explicitly moving the subflow to close status.
[ No conflicts, but tcp_send_active_reset() doesn't take a 3rd argument
(sk_rst_reason) in this version, see commit 5691276b39da ("rstreason:
prepare for active reset"). This argument is only helpful for tracing, it is fine to drop it. ]
--- net/mptcp/protocol.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-)
net/mptcp/protocol.c +22 -13
@@ -2431,7 +2431,6 @@ bool __mptcp_retransmit_pending_data(str/* flags for __mptcp_close_ssk() */ #define MPTCP_CF_PUSH BIT(1) -#define MPTCP_CF_FASTCLOSE BIT(2)/* be sure to send a reset only if the caller asked for it, also * clean completely the subflow status when the subflow reaches
@@ -2442,7 +2441,7 @@ static void __mptcp_subflow_disconnect(s unsigned int flags) {if (((1 << ssk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN )) || - (flags &MPTCP_CF_FASTCLOSE )) { + subflow->send_fastclose) {/* The MPTCP code never wait on the subflow sockets, TCP-level * disconnect should never fail */
@@ -2489,14 +2488,8 @@ static void __mptcp_close_ssk(struct soclock_sock_nested (ssk,SINGLE_DEPTH_NESTING ); -if ((flags &MPTCP_CF_FASTCLOSE ) && !__mptcp_check_fallback (msk)) { -/* be sure to force the tcp_close path -* to generate the egress reset -*/ - ssk->sk_lingertime =0 ; -sock_set_flag (ssk,SOCK_LINGER ); - subflow->send_fastclose =1 ; - } +if (subflow->send_fastclose && ssk->sk_state !=TCP_CLOSE ) +tcp_set_state (ssk,TCP_CLOSE ); need_push = (flags &MPTCP_CF_PUSH ) &&__mptcp_retransmit_pending_data (sk);if (!dispose_it) {
@@ -2809,9 +2802,25 @@ static void mptcp_do_fastclose(struct sostruct mptcp_sock *msk =mptcp_sk (sk);mptcp_set_state (sk,TCP_CLOSE ); -mptcp_for_each_subflow_safe (msk, subflow, tmp) -__mptcp_close_ssk (sk,mptcp_subflow_tcp_sock (subflow), - subflow,MPTCP_CF_FASTCLOSE ); + +/* Explicitly send the fastclose reset as need */ +if (__mptcp_check_fallback (msk)) +return ; + +mptcp_for_each_subflow_safe (msk, subflow, tmp) { +struct sock *ssk =mptcp_subflow_tcp_sock (subflow); + +lock_sock (ssk); + +/* Some subflow socket states don't allow/need a reset.*/ +if ((1 << ssk->sk_state) & (TCPF_LISTEN |TCPF_CLOSE )) + goto unlock; + + subflow->send_fastclose =1 ; +tcp_send_active_reset (ssk, ssk->sk_allocation); +unlock: +release_sock (ssk); + } }static void mptcp_worker (struct work_struct *work)
Greg Kroah-Hartman
maintainerPATCH 90/93 ksmbd: fix use-after-free in session logoff
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Heelan <[email protected]>
commit 2fc9feff45d92a92cd5f96487655d5be23fb7e2b upstream.
The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the session being free'd. The handler for that connection could be in the smb2_sess_setup function which makes use of sess->user.
---
v2: Fix duplicate From: header
Backport fix for CVE-2025-37899
fs/smb/server/smb2pdu.c | 4 ---- 1 file changed, 4 deletions(-)
fs/smb/server/smb2pdu.c +0 -4
@@ -2255,10 +2255,6 @@ int smb2_session_logoff(struct ksmbd_wor sess->state =SMB2_SESSION_EXPIRED ;up_write (&conn->session_lock); -if (sess->user) { -ksmbd_free_user (sess->user); - sess->user =NULL ; - }ksmbd_all_conn_set_status (sess_id,KSMBD_SESS_NEED_SETUP ); rsp->StructureSize =cpu_to_le16 (4 );
Greg Kroah-Hartman
maintainerPATCH 91/93 net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Bastien Curutchet (Schneider Electric)" <[email protected]>
[ Upstream commit d0b8fec8ae50525b57139393d0bb1f446e82ff7e ]
The IRQ numbers created through irq_create_mapping() are only assigned to ptpmsg_irq[n].num at the end of the IRQ setup. So if an error occurs between their creation and their assignment (for instance during the request_threaded_irq() step), we enter the error path and fail to release the newly created virtual IRQs because they aren't yet assigned to ptpmsg_irq[n].num.
Move the mapping creation to ksz_ptp_msg_irq_setup() to ensure symetry with what's released by ksz_ptp_msg_irq_free().
In the error path, move the irq_dispose_mapping to the out_ptp_msg label so it will be called only on created IRQs.
--- drivers/net/dsa/microchip/ksz_ptp.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-)
drivers/net/dsa/microchip/ksz_ptp.c +7 -11
@@ -1099,19 +1099,19 @@ static int ksz_ptp_msg_irq_setup(structstatic const char *const name[] = {"pdresp-msg" ,"xdreq-msg" ,"sync-msg" };const struct ksz_dev_ops *ops = port->ksz_dev->dev_ops; +struct ksz_irq *ptpirq = &port->ptpirq;struct ksz_ptp_irq *ptpmsg_irq; ptpmsg_irq = &port->ptpmsg_irq[n]; + ptpmsg_irq->num =irq_create_mapping (ptpirq->domain, n); +if (!ptpmsg_irq->num) +return -EINVAL ; ptpmsg_irq->port = port; ptpmsg_irq->ts_reg = ops->get_port_addr (port->num, ts_reg[n]);snprintf (ptpmsg_irq->name,sizeof (ptpmsg_irq->name), name[n]); - ptpmsg_irq->num =irq_find_mapping (port->ptpirq.domain, n); -if (ptpmsg_irq->num <0 ) -return ptpmsg_irq->num; -return request_threaded_irq (ptpmsg_irq->num,NULL , ksz_ptp_msg_thread_fn,IRQF_ONESHOT , ptpmsg_irq->name, ptpmsg_irq);
@@ -1141,9 +1141,6 @@ int ksz_ptp_irq_setup(struct dsa_switchif (!ptpirq->domain)return -ENOMEM ; -for (irq =0 ; irq < ptpirq->nirqs; irq++) -irq_create_mapping (ptpirq->domain, irq); - ptpirq->irq_num =irq_find_mapping (port->pirq.domain,PORT_SRC_PTP_INT );if (!ptpirq->irq_num) { ret = -EINVAL ;
@@ -1165,12 +1162,11 @@ int ksz_ptp_irq_setup(struct dsa_switch out_ptp_msg:free_irq (ptpirq->irq_num, ptpirq); -while (irq--) +while (irq--) {free_irq (port->ptpmsg_irq[irq].num, &port->ptpmsg_irq[irq]); -out: -for (irq =0 ; irq < ptpirq->nirqs; irq++)irq_dispose_mapping (port->ptpmsg_irq[irq].num); - + } +out:irq_domain_remove (ptpirq->domain);return ret;
Greg Kroah-Hartman
maintainerPATCH 92/93 net: dsa: microchip: Free previously initialized ports on init failures
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Bastien Curutchet (Schneider Electric)" <[email protected]>
[ Upstream commit 0f80e21bf6229637e193248fbd284c0ec44bc0fd ]
If a port interrupt setup fails after at least one port has already been successfully initialized, the gotos miss some resource releasing:
- the already initialized PTP IRQs aren't released
- the already initialized port IRQs aren't released if the failure occurs in ksz_pirq_setup().
Merge 'out_girq' and 'out_ptpirq' into a single 'port_release' label. Behind this label, use the reverse loop to release all IRQ resources for all initialized ports.
Jump in the middle of the reverse loop if an error occurs in ksz_ptp_irq_setup() to only release the port IRQ of the current iteration.
--- drivers/net/dsa/microchip/ksz_common.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/net/dsa/microchip/ksz_common.c +11 -11
@@ -2163,18 +2163,18 @@ static int ksz_setup(struct dsa_switch *dsa_switch_for_each_user_port (dp, dev->ds) { ret =ksz_pirq_setup (dev, dp->index);if (ret) - goto out_girq; + goto port_release; ret =ksz_ptp_irq_setup (ds, dp->index);if (ret) - goto out_pirq; + goto pirq_release; } } ret =ksz_ptp_clock_register (ds);if (ret) {dev_err (dev->dev,"Failed to register PTP clock: %d\n" , ret); - goto out_ptpirq; + goto port_release; } ret =ksz_mdio_register (dev);
@@ -2191,17 +2191,17 @@ static int ksz_setup(struct dsa_switch * out_ptp_clock_unregister:ksz_ptp_clock_unregister (ds); -out_ptpirq: -if (dev->irq >0 ) -dsa_switch_for_each_user_port (dp, dev->ds) +port_release: +if (dev->irq >0 ) { +dsa_switch_for_each_port_continue_reverse (dp, dev->ds) { +if (!dsa_port_is_user (dp)) +continue ;ksz_ptp_irq_free (ds, dp->index); -out_pirq: -if (dev->irq >0 ) -dsa_switch_for_each_user_port (dp, dev->ds) +pirq_release:ksz_irq_free (&dev->ports[dp->index].pirq); -out_girq: -if (dev->irq >0 ) + }ksz_irq_free (&dev->girq); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 93/93 HID: core: Harden s32ton() against conversion to 0 bits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
[ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ]
Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.
Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
[ s32ton() was moved by c653ffc28340 ("HID: stop exporting hid_snto32()").
Minor context change fixed. ]
--- drivers/hid/hid-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/hid/hid-core.c +6 -1
@@ -1351,7 +1351,12 @@ EXPORT_SYMBOL_GPL(hid_snto32);static u32 s32ton (__s32 value,unsigned n) { -s32 a = value >> (n -1 ); +s32 a; + +if (!value || !n) +return 0 ; + + a = value >> (n -1 );if (a && a !=-1 )return value <0 ?1 << (n -1 ) : (1 << (n -1 )) -1 ;return value & ((1 << n) -1 );
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
The kernel, bpf tool, perf tool, and kselftest builds fine for v6.6.119-rc1 on x86 and arm64 Azure VM.
Thanks,
Hardik
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Am 03.12.2025 um 16:28 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.6:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
120 tests: 120 pass, 0 failLinux version: 6.6.119-rc1-gcca93798e4cd
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
NOTE:
allyesconfig build errors:
drivers/leds/leds-spi-byte.c:99:26: error: variable 'child' is
uninitialized when used here [-Werror,-Wuninitialized]
allyesconfig build failures can be resolved by a recent proposed patch,
- https://lore.kernel.org/all/20251204000025.GA468348@ax162/
## Build
* kernel: 6.6.119-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: cca93798e4cd9365a29b85a0d56a0332912fdcb8
* git describe: v6.6.118-94-gcca93798e4cd
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.118-94-gcca93798e4cd
## Test Regressions (compared to v6.6.117-87-gdd9a47301c80)
## Metric Regressions (compared to v6.6.117-87-gdd9a47301c80)
## Test Fixes (compared to v6.6.117-87-gdd9a47301c80)
## Metric Fixes (compared to v6.6.117-87-gdd9a47301c80)
## Test result summary
total: 111140, pass: 93968, fail: 3457, skip: 13425, xfail: 290
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 129 total, 128 passed, 1 failed
* arm64: 44 total, 40 passed, 4 failed
* i386: 23 total, 23 passed, 0 failed
* mips: 26 total, 25 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 15 total, 14 passed, 1 failed
* s390: 14 total, 13 passed, 1 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 7 passed, 0 failed
* x86_64: 37 total, 34 passed, 3 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · On Wed, 03 Dec 2025 16:28:53 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.119 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64:
Thanks!
Cheers,
Miguel
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.6.119-rc1-gcca93798e4cd #5 SMP PREEMPT_DYNAMIC Fri Dec 5 10:58:19 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux