6.18.4-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.18.4-rc1 review
This is the start of the stable review cycle for the 6.18.4 release. There are 312 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 08 Jan 2026 17:04:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.4-rc1
Charles Keepax <[email protected]>
Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup"
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()
Kevin Tian <[email protected]>
vfio/pci: Disable qword access to the PCI ROM bar
Chenghao Duan <[email protected]>
LoongArch: BPF: Enhance the bpf_arch_text_poke() function
Kaushlendra Kumar <[email protected]>
powercap: intel_rapl: Add support for Nova Lake processors
Srinivas Pandruvada <[email protected]>
powercap: intel_rapl: Add support for Wildcat Lake platform
Damien Le Moal <[email protected]>
block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
Junbeom Yeom <[email protected]>
erofs: fix unexpected EIO under memory pressure
Alessio Belle <[email protected]>
drm/imagination: Disallow exporting of PM/FW protected objects
Lyude Paul <[email protected]>
drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
Thomas Hellström <[email protected]>
drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use
Thomas Hellström <[email protected]>
drm/xe/svm: Fix a debug printout
Krzysztof Niemiec <[email protected]>
drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
Anna Maniscalco <[email protected]>
drm/msm: add PERFCTR_CNTL to ifpc_reglist
Nikolay Kuratov <[email protected]>
drm/msm/dpu: Add missing NULL pointer check for pingpong interface
Thomas Hellström <[email protected]>
drm/xe: Drop preempt-fences when destroying imported dma-bufs.
Matthew Brost <[email protected]>
drm/xe: Use usleep_range for accurate long-running workload timeslicing
Matthew Brost <[email protected]>
drm/xe: Adjust long-running workload timeslices to reasonable values
Ashutosh Dixit <[email protected]>
drm/xe/eustall: Disallow 0 EU stall property values
Ashutosh Dixit <[email protected]>
drm/xe/oa: Disallow 0 OA property values
Thomas Hellström <[email protected]>
drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
Karol Wachowski <[email protected]>
drm: Fix object leak in DRM_IOCTL_GEM_CHANGE_HANDLE
René Rebe <[email protected]>
drm/mgag200: Fix big-endian support
Simon Richter <[email protected]>
drm/ttm: Avoid NULL pointer deref for evicted BOs
Kory Maincent (TI.com) <[email protected]>
drm/tilcdc: Fix removal actions in case of failed probe
Ard Biesheuvel <[email protected]>
drm/i915: Fix format string truncation warning
Jay Cornwall <[email protected]>
drm/amdkfd: Trap handler support for expert scheduling mode
Jonathan Kim <[email protected]>
drm/amdkfd: bump minimum vgpr size for gfx1151
Mario Limonciello <[email protected]>
drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
Lyude Paul <[email protected]>
drm/nouveau/gsp: Allocate fwsec-sb at boot
Luca Ceresoli <[email protected]>
drm/bridge: ti-sn65dsi83: ignore PLL_UNLOCK errors
Andy Yan <[email protected]>
drm/rockchip: vop2: Use OVL_LAYER_SEL configuration instead of use win_mask calculate used layers
Mario Limonciello (AMD) <[email protected]>
drm/amd: Fix unbind/rebind for VCN 4.0.5
Johan Hovold <[email protected]>
drm/mediatek: ovl_adaptor: Fix probe device leaks
Johan Hovold <[email protected]>
drm/mediatek: mtk_hdmi: Fix probe device leaks
Johan Hovold <[email protected]>
drm/mediatek: Fix probe device leaks
Johan Hovold <[email protected]>
drm/mediatek: Fix probe memory leak
Johan Hovold <[email protected]>
drm/mediatek: Fix probe resource leaks
Miaoqian Lin <[email protected]>
drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
Dmitry Osipenko <[email protected]>
drm/rockchip: Set VOP for the DRM DMA device
Sanjay Yadav <[email protected]>
drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
Thomas Zimmermann <[email protected]>
drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
Arunpravin Paneer Selvam <[email protected]>
drm/buddy: Separate clear and dirty free block trees
Arunpravin Paneer Selvam <[email protected]>
drm/buddy: Optimize free block management with RB tree
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
Alex Deucher <[email protected]>
drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
Srinivasan Shanmugam <[email protected]>
drm/amdgpu/sdma6: Update SDMA 6.0.3 FW version to include UMQ protected-fence fix
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
Natalie Vock <[email protected]>
drm/amdgpu: Forward VMID reservation errors
Alex Deucher <[email protected]>
drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
Mario Limonciello (AMD) <[email protected]>
Revert "drm/amd: Skip power ungate during suspend for VPE"
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Add AWCC support for Alienware x16
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Add support for new Area-51 laptops
Armin Wolf <[email protected]>
platform/x86: samsung-galaxybook: Fix problematic pointer cast
Xiaolei Wang <[email protected]>
net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
Deepanshu Kartikey <[email protected]>
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
Miaoqian Lin <[email protected]>
net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration
Ethan Nelson-Moore <[email protected]>
net: usb: sr9700: fix incorrect command used to write single register
Haoxiang Li <[email protected]>
nfsd: Drop the client reference in client_states_open()
Jeff Layton <[email protected]>
nfsd: use ATTR_DELEG in nfsd4_finalize_deleg_timestamps()
Chuck Lever <[email protected]>
nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()
Chenghao Duan <[email protected]>
LoongArch: BPF: Adjust the jump offset of tail calls
Chenghao Duan <[email protected]>
LoongArch: BPF: Enable trampoline-based tracing for module functions
Chenghao Duan <[email protected]>
LoongArch: BPF: Save return address register ra to t0 before trampoline
Hengqi Chen <[email protected]>
LoongArch: BPF: Sign extend kfunc call arguments
Hengqi Chen <[email protected]>
LoongArch: BPF: Zero-extend bpf_tail_call() index
Chenghao Duan <[email protected]>
LoongArch: Refactor register restoration in ftrace_common_return
Ankit Garg <[email protected]>
gve: defer interrupt enabling until NAPI registration
Haoxiang Li <[email protected]>
fjes: Add missing iounmap in fjes_hw_init()
Frode Nordahl <[email protected]>
erspan: Initialize options_len before referencing options.
Guangshuo Li <[email protected]>
e1000: fix OOB in e1000_tbi_should_accept()
Jouni Malinen <[email protected]>
wifi: mac80211: Discard Beacon frames to non-broadcast address
Ville Syrjälä <[email protected]>
wifi: iwlwifi: Fix firmware version handling
Jason Gunthorpe <[email protected]>
RDMA/cm: Fix leaking the multicast GID table reference
Jason Gunthorpe <[email protected]>
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
Alice Ryhl <[email protected]>
rust: maple_tree: rcu_read_lock() in destructor to silence lockdep
Chenghao Duan <[email protected]>
samples/ftrace: Adjust LoongArch register restore order in direct calls
Wake Liu <[email protected]>
selftests/mm: fix thread state check in uffd-unit-tests
Kaushlendra Kumar <[email protected]>
tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
Rong Zhang <[email protected]>
x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo
Bijan Tabatabai <[email protected]>
mm: consider non-anon swap cache folios in folio_expected_ref_count()
Ran Xiaokai <[email protected]>
mm/page_owner: fix memory leak in page_owner_stack_fops->release()
Alexander Gordeev <[email protected]>
mm/page_alloc: change all pageblocks migrate type on coalescing
Matthew Wilcox (Oracle) <[email protected]>
idr: fix idr_alloc() returning an ID out of range
NeilBrown <[email protected]>
lockd: fix vfs_test_lock() calls
Pingfan Liu <[email protected]>
kernel/kexec: fix IMA when allocation happens in CMA area
Pingfan Liu <[email protected]>
kernel/kexec: change the prototype of kimage_map_segment()
Maciej Wieczor-Retman <[email protected]>
kasan: unpoison vms[area] addresses with a common tag
Maciej Wieczor-Retman <[email protected]>
kasan: refactor pcpu kasan vmalloc unpoison
Jiayuan Chen <[email protected]>
mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN
Paolo Abeni <[email protected]>
mptcp: fallback earlier on simult connection
H. Peter Anvin <[email protected]>
compiler_types.h: add "auto" as a macro for "__auto_type"
Jens Axboe <[email protected]>
af_unix: don't post cmsg for SO_INQ unless explicitly asked for
Wentao Liang <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_probe()
Macpaul Lin <[email protected]>
pmdomain: mtk-pm-domains: Fix spinlock recursion fix in probe
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failure on damos_test_commit_filter()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_set_filters_default_reject()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: fix memory leak in damon_test_set_filters_default_reject()
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()
SeongJae Park <[email protected]>
mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets()
Tiezhu Yang <[email protected]>
LoongArch: Use unsigned long for _end and _text
WangYuli <[email protected]>
LoongArch: Use __pmd()/__pte() for swap entry conversions
Huacai Chen <[email protected]>
LoongArch: Fix build errors for CONFIG_RANDSTRUCT
Huacai Chen <[email protected]>
LoongArch: Fix arch_dup_task_struct() for CONFIG_RANDSTRUCT
Qiang Ma <[email protected]>
LoongArch: Correct the calculation logic of thread_count
Huacai Chen <[email protected]>
LoongArch: Add new PCI ID for pci_fixup_vgadev()
Haoxiang Li <[email protected]>
media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
Chen-Yu Tsai <[email protected]>
media: mediatek: vcodec: Use spinlock for context list protection lock
Dave Stevenson <[email protected]>
media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
Duoming Zhou <[email protected]>
media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
Duoming Zhou <[email protected]>
media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
Ming Qian <[email protected]>
media: amphion: Cancel message work before releasing the VPU core
Ming Qian <[email protected]>
media: amphion: Remove vpu_vb_is_codecconfig
Johan Hovold <[email protected]>
media: vpif_display: fix section mismatch
Johan Hovold <[email protected]>
media: vpif_capture: fix section mismatch
Haotian Zhang <[email protected]>
media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
Nicolas Dufresne <[email protected]>
media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
Duoming Zhou <[email protected]>
media: TDA1997x: Remove redundant cancel_delayed_work in probe
Marek Szyprowski <[email protected]>
media: samsung: exynos4-is: fix potential ABBA deadlock on init
Miaoqian Lin <[email protected]>
media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
Johan Hovold <[email protected]>
media: platform: mtk-mdp3: fix device leaks at probe
Ivan Abramov <[email protected]>
media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
Dikshita Agarwal <[email protected]>
media: iris: Refine internal buffer reconfiguration logic for resolution change
Haotian Zhang <[email protected]>
media: cec: Fix debugfs leak on bus_register() failure
René Rebe <[email protected]>
fbdev: tcx.c fix mem_map to correct smem_start offset
Thorsten Blum <[email protected]>
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
Rene Rebe <[email protected]>
fbdev: gbefb: fix to use physical address instead of dma address
Li Chen <[email protected]>
dm pcache: fix segment info indexing
Li Chen <[email protected]>
dm pcache: fix cache info indexing
Mikulas Patocka <[email protected]>
dm-bufio: align write boundary on physical block size
Uladzislau Rezki (Sony) <[email protected]>
dm-ebs: Mark full buffer dirty even on partial write
Mahesh Rao <[email protected]>
firmware: stratix10-svc: Add mutex in stratix10 memory management
Ivan Abramov <[email protected]>
media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
Krzysztof Kozlowski <[email protected]>
power: supply: max77705: Fix potential IRQ chip conflict when probing two devices
Sandipan Das <[email protected]>
perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
Manivannan Sadhasivam <[email protected]>
PCI: meson: Fix parsing the DBI register region
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix disabling L0s capability
Sven Schnelle <[email protected]>
parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
Sven Schnelle <[email protected]>
parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
Shin'ichiro Kawasaki <[email protected]>
nvmet: pci-epf: move DMA initialization to EPC init callback
Chuck Lever <[email protected]>
NFSD: Make FILE_SYNC WRITEs comply with spec
Miquel Raynal <[email protected]>
mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
Miquel Raynal <[email protected]>
mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
Miquel Raynal <[email protected]>
mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
Miquel Raynal <[email protected]>
mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
Miquel Raynal <[email protected]>
mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
Miquel Raynal <[email protected]>
mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
Christian Marangi <[email protected]>
mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
Luca Weiss <[email protected]>
arm64: dts: qcom: sm6350: Fix wrong order of freq-table-hz for UFS
Patrice Chotard <[email protected]>
arm64: dts: st: Add memory-region-names property for stm32mp257f-ev1
Paresh Bhagat <[email protected]>
arm64: dts: ti: k3-am62d2-evm: Fix PMIC padconfig
Paresh Bhagat <[email protected]>
arm64: dts: ti: k3-am62d2-evm: Fix regulator properties
Nicolas Dufresne <[email protected]>
media: verisilicon: Fix CPU stalls on G2 bus error
Haotian Zhang <[email protected]>
media: rc: st_rc: Fix reset control resource leak
Krzysztof Kozlowski <[email protected]>
mfd: max77620: Fix potential IRQ chip conflict when probing two devices
Johan Hovold <[email protected]>
mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
Nathan Chancellor <[email protected]>
clk: qcom: Fix dependencies of QCS_{DISP,GPU,VIDEO}CC_615
Nathan Chancellor <[email protected]>
clk: qcom: Fix SM_VIDEOCC_6350 dependencies
Alexey Minnekhanov <[email protected]>
clk: qcom: mmcc-sdm660: Add missing MDSS reset
Nathan Chancellor <[email protected]>
clk: samsung: exynos-clkout: Assign .num before accessing .hws
Damien Le Moal <[email protected]>
block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
Christian Hitz <[email protected]>
leds: leds-lp50xx: Enable chip before any communication
Christian Hitz <[email protected]>
leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
Christian Hitz <[email protected]>
leds: leds-lp50xx: Allow LED 0 to be added to module bank
Thomas Weißschuh <[email protected]>
leds: leds-cros_ec: Skip LEDs without color components
Kairui Song <[email protected]>
mm, swap: do not perform synchronous discard during allocation
Donet Tom <[email protected]>
powerpc/64s/slb: Fix SLB multihit issue during SLB preload
Dave Vasilevsky <[email protected]>
powerpc, mm: Fix mprotect on book3s 32-bit
Siddharth Vadapalli <[email protected]>
arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
Lukas Wunner <[email protected]>
PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
Shengming Hu <[email protected]>
fgraph: Check ftrace_pids_enabled on registration for early filtering
Shengming Hu <[email protected]>
fgraph: Initialize ftrace_ops->private for function graph ops
Raghavendra Rao Ananta <[email protected]>
hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops
Hans de Goede <[email protected]>
HID: logitech-dj: Remove duplicate error logging
Armin Wolf <[email protected]>
hwmon: (dell-smm) Fix off-by-one error in dell_smm_is_visible()
Lu Baolu <[email protected]>
iommu: disable SVA when CONFIG_X86 is set
Johan Hovold <[email protected]>
iommu/tegra: fix device leak on probe_device()
Johan Hovold <[email protected]>
iommu/sun50i: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/qcom: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/omap: fix device leaks on probe_device()
Johan Hovold <[email protected]>
iommu/mediatek: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leaks on probe()
Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leak on probe_device()
Johan Hovold <[email protected]>
iommu/ipmmu-vmsa: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/exynos: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/apple-dart: fix device leak on of_xlate()
Jinhui Guo <[email protected]>
iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga()
Jinhui Guo <[email protected]>
iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6adm: the the copp device only during last instance
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: perform correct state check before closing
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
Ma Ke <[email protected]>
ASoC: codecs: Fix error handling in pm4125 audio codec driver
Eric Naim <[email protected]>
ASoC: cs35l41: Always return 0 when a subsystem ID is found
Srinivas Kandagatla <[email protected]>
ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
Srinivas Kandagatla <[email protected]>
ASoC: codecs: lpass-tx-macro: fix SM6115 support
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: pm4125: Remove irq_chip on component unbind
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: pm4125: Fix potential conflict when probing two devices
Ma Ke <[email protected]>
ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver
Biju Das <[email protected]>
ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width
Biju Das <[email protected]>
ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix OF node leak on probe
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix clk prepare imbalance on probe failure
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix device leak on probe
Johan Hovold <[email protected]>
ASoC: codecs: wcd939x: fix regmap leak on probe failure
Matthew Wilcox (Oracle) <[email protected]>
ntfs: Do not overwrite uptodate pages
Damien Le Moal <[email protected]>
block: handle zone management operations completions
Yipeng Zou <[email protected]>
selftests/ftrace: traceonoff_triggers: strip off names
Cong Zhang <[email protected]>
blk-mq: skip CPU offline notify on unmapped hctx
Thomas Fourier <[email protected]>
RDMA/bnxt_re: fix dma_free_coherent() pointer
Honggang LI <[email protected]>
RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
Li Zhijian <[email protected]>
IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path
Zilin Guan <[email protected]>
ksmbd: Fix memory leak in get_file_all_info()
Jonathan Cavitt <[email protected]>
drm/xe/guc: READ/WRITE_ONCE g2h_fence->done
Ming Lei <[email protected]>
ublk: scan partition in async way
Ming Lei <[email protected]>
ublk: implement NUMA-aware memory allocation
Tuo Li <[email protected]>
md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()
Li Nan <[email protected]>
md: Fix static checker warning in analyze_sbs
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix to use correct page size for PDE table
David Gow <[email protected]>
kunit: Enforce task execution in {soft,hard}irq contexts
Ding Hui <[email protected]>
RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
Thomas Zimmermann <[email protected]>
drm/gem-shmem: Fix the MODULE_LICENSE() string
Tetsuo Handa <[email protected]>
RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
Jang Ingyu <[email protected]>
RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
Michael Margolin <[email protected]>
RDMA/efa: Remove possible negative shift
Michal Schmidt <[email protected]>
RDMA/irdma: avoid invalid read in irdma_net_event
Konstantin Taranov <[email protected]>
RDMA/mana_ib: check cqe length for kernel CQs
Arnd Bergmann <[email protected]>
RDMA/irdma: Fix irdma_alloc_ucontext_resp padding
Arnd Bergmann <[email protected]>
RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding
Jiayuan Chen <[email protected]>
ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
Pwnverse <[email protected]>
net: rose: fix invalid array index in rose_kill_by_device()
Vadim Fedorenko <[email protected]>
net: fib: restore ECMP balance from loopback
Ido Schimmel <[email protected]>
ipv4: Fix reference count leak when using error routes with nexthop objects
Will Rosenberg <[email protected]>
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
Wei Fang <[email protected]>
net: stmmac: fix the crash issue for zero copy XDP_TX action
Anshumali Gaur <[email protected]>
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
Alok Tiwari <[email protected]>
platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
Junrui Luo <[email protected]>
platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
Zilin Guan <[email protected]>
vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
Kohei Enju <[email protected]>
tools/sched_ext: fix scx_show_state.py for scx_root change
Bagas Sanjaya <[email protected]>
net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
Deepanshu Kartikey <[email protected]>
net: usb: asix: validate PHY address before use
Rosen Penev <[email protected]>
net: mdio: rtl9300: use scoped for loops
Jose Javier Rodriguez Barbarin <[email protected]>
mcb: Add missing modpost build support
Thomas De Schampheleire <[email protected]>
kbuild: fix compilation of dtb specified on command-line without make rule
Jonas Gorski <[email protected]>
net: dsa: b53: skip multicast entries for fdb_dump()
Rajashekar Hudumula <[email protected]>
bng_en: update module description
Thomas Fourier <[email protected]>
firewire: nosy: Fix dma_free_coherent() size
Andrew Morton <[email protected]>
genalloc.h: fix htmldocs warning
Yeoreum Yun <[email protected]>
smc91x: fix broken irq-context in PREEMPT_RT
Kaushlendra Kumar <[email protected]>
platform/x86/intel/pmt: Fix kobject memory leak on init failure
Arnd Bergmann <[email protected]>
net: wangxun: move PHYLINK dependency
Alice C. Munduruca <[email protected]>
selftests: net: fix "buffer overflow detected" for tap.c
Deepakkumar Karn <[email protected]>
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
Daniel Zahka <[email protected]>
selftests: drv-net: psp: fix test names in ipver_test_builder()
Daniel Zahka <[email protected]>
selftests: drv-net: psp: fix templated test names in psp_ip_ver_test_builder()
Raju Rangoju <[email protected]>
amd-xgbe: reset retries and mode on RX adapt failures
Vladimir Oltean <[email protected]>
net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
Vladimir Oltean <[email protected]>
net: dsa: properly keep track of conduit reference
Lorenzo Bianconi <[email protected]>
net: airoha: Move net_devs registration in a dedicated routine
Jiri Pirko <[email protected]>
team: fix check for port enabled in team_queue_override_port_prio_changed()
Junrui Luo <[email protected]>
platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
Thomas Fourier <[email protected]>
platform/x86: msi-laptop: add missing sysfs_remove_group()
Shravan Kumar Ramani <[email protected]>
platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names
Jan Stancek <[email protected]>
powerpc/tools: drop -o pipefail in gcc check scripts
Eric Dumazet <[email protected]>
ip6_gre: make ip6gre_header() robust
Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
Jacky Chou <[email protected]>
net: mdio: aspeed: add dummy read to avoid read-after-write issue
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: revert use of devm_kzalloc in btusb
Pauli Virtanen <[email protected]>
Bluetooth: MGMT: report BIS capability flags in supported settings
Herbert Xu <[email protected]>
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
Chen Ridong <[email protected]>
cpuset: fix warning when disabling remote partition
Brian Vazquez <[email protected]>
idpf: reduce mbx_task schedule delay to 300us
Larysa Zaremba <[email protected]>
idpf: fix LAN memory regions command on some NVMs
Kohei Enju <[email protected]>
iavf: fix off-by-one issues in iavf_config_rss_reg()
Gregory Herrero <[email protected]>
i40e: validate ring_len parameter against hardware-specific values
Przemyslaw Korba <[email protected]>
i40e: fix scheduling in set_rx_mode
Liang Jie <[email protected]>
sched_ext: fix uninitialized ret on alloc_percpu() failure
Aloka Dixit <[email protected]>
wifi: mac80211: do not use old MBSSID elements
Dan Carpenter <[email protected]>
wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
Morning Star <[email protected]>
wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
Ping-Ke Shih <[email protected]>
wifi: rtw88: limit indirect IO under powered off for RTL8822CS
Alex Deucher <[email protected]>
drm/amdgpu: don't attach the tlb fence for SI
Jani Nikula <[email protected]>
drm/displayid: add quirk to ignore DisplayID checksum errors
Jani Nikula <[email protected]>
drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
Claudio Imbrenda <[email protected]>
KVM: s390: Fix gmap_helper_zap_one_page() again
Wei Yang <[email protected]>
mm/huge_memory: merge uniform_split_supported() and non_uniform_split_supported()
Zqiang <[email protected]>
sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
Peter Zijlstra <[email protected]>
sched/eevdf: Fix min_vruntime vs avg_vruntime
Peter Zijlstra <[email protected]>
sched/core: Add comment explaining force-idle vruntime snapshots
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Select which microcode patch to load
Danilo Krummrich <[email protected]>
drm: nova: depend on CONFIG_64BIT
Fernand Sieber <[email protected]>
sched/proxy: Yield the donor task
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 4 +- arch/arm64/boot/dts/st/stm32mp257f-ev1.dts | 1 + arch/arm64/boot/dts/ti/k3-am62d2-evm.dts | 9 +- arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 12 +- arch/loongarch/include/asm/pgtable.h | 4 +- arch/loongarch/kernel/mcount_dyn.S | 14 +- arch/loongarch/kernel/process.c | 5 + arch/loongarch/kernel/relocate.c | 4 +- arch/loongarch/kernel/setup.c | 8 +- arch/loongarch/kernel/switch.S | 4 +- arch/loongarch/net/bpf_jit.c | 58 ++- arch/loongarch/net/bpf_jit.h | 26 ++ arch/loongarch/pci/pci.c | 2 + arch/parisc/kernel/asm-offsets.c | 2 + arch/parisc/kernel/entry.S | 16 +- arch/powerpc/include/asm/book3s/32/tlbflush.h | 5 +- arch/powerpc/include/asm/book3s/64/mmu-hash.h | 1 - arch/powerpc/kernel/process.c | 5 - arch/powerpc/mm/book3s32/tlb.c | 9 + arch/powerpc/mm/book3s64/internal.h | 2 - arch/powerpc/mm/book3s64/mmu_context.c | 2 - arch/powerpc/mm/book3s64/slb.c | 88 ----- arch/powerpc/platforms/pseries/cmm.c | 3 +- .../tools/gcc-check-fpatchable-function-entry.sh | 1 - arch/powerpc/tools/gcc-check-mprofile-kernel.sh | 1 - arch/s390/mm/gmap_helpers.c | 9 +- arch/x86/events/amd/uncore.c | 5 +- arch/x86/kernel/cpu/microcode/amd.c | 115 +++--- block/blk-mq.c | 2 +- block/blk-zoned.c | 152 +++++--- block/blk.h | 14 + crypto/seqiv.c | 8 +- drivers/block/ublk_drv.c | 119 +++++-- drivers/bluetooth/btusb.c | 12 +- drivers/clk/qcom/Kconfig | 4 + drivers/clk/qcom/mmcc-sdm660.c | 1 + drivers/clk/samsung/clk-exynos-clkout.c | 2 +- drivers/firewire/nosy.c | 10 +- drivers/firmware/stratix10-svc.c | 11 + drivers/gpio/gpiolib-swnode.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 27 ++ drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 27 ++ drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 2 + drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h | 62 ++-- .../gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx12.asm | 37 ++ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 1 + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 4 + drivers/gpu/drm/bridge/ti-sn65dsi83.c | 11 +- drivers/gpu/drm/drm_buddy.c | 390 +++++++++++++-------- drivers/gpu/drm/drm_displayid.c | 41 ++- drivers/gpu/drm/drm_displayid_internal.h | 2 + drivers/gpu/drm/drm_gem.c | 8 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- drivers/gpu/drm/drm_pagemap.c | 17 +- drivers/gpu/drm/gma500/fbdev.c | 43 --- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 37 +- drivers/gpu/drm/i915/intel_memory_region.h | 2 +- drivers/gpu/drm/imagination/pvr_gem.c | 11 + drivers/gpu/drm/mediatek/mtk_ddp_comp.c | 33 +- drivers/gpu/drm/mediatek/mtk_ddp_comp.h | 2 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 12 + drivers/gpu/drm/mediatek/mtk_dp.c | 1 + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 15 + drivers/gpu/drm/mgag200/mgag200_mode.c | 25 ++ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 1 + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 10 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 13 + drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +- drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 4 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 61 +++- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h | 3 + .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 10 +- drivers/gpu/drm/nova/Kconfig | 1 + drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 3 + drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 49 ++- drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 2 +- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 53 ++- drivers/gpu/drm/tilcdc/tilcdc_drv.h | 2 +- drivers/gpu/drm/ttm/ttm_bo_vm.c | 6 + drivers/gpu/drm/xe/xe_bo.c | 15 +- drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- drivers/gpu/drm/xe/xe_eu_stall.c | 2 +- drivers/gpu/drm/xe/xe_guc_ct.c | 14 +- drivers/gpu/drm/xe/xe_guc_submit.c | 20 +- drivers/gpu/drm/xe/xe_migrate.c | 25 +- drivers/gpu/drm/xe/xe_migrate.h | 6 +- drivers/gpu/drm/xe/xe_oa.c | 10 +- drivers/gpu/drm/xe/xe_svm.c | 51 ++- drivers/gpu/drm/xe/xe_vm.c | 5 +- drivers/gpu/drm/xe/xe_vm_types.h | 2 +- drivers/hid/hid-logitech-dj.c | 56 ++- drivers/hwmon/dell-smm-hwmon.c | 4 +- drivers/infiniband/core/addr.c | 33 +- drivers/infiniband/core/cma.c | 3 + drivers/infiniband/core/device.c | 4 +- drivers/infiniband/core/verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/hw_counters.h | 6 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 8 +- drivers/infiniband/hw/efa/efa_verbs.c | 4 - drivers/infiniband/hw/irdma/utils.c | 3 +- drivers/infiniband/hw/mana/cq.c | 4 + drivers/infiniband/sw/rxe/rxe_odp.c | 4 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 1 + drivers/iommu/amd/init.c | 15 +- drivers/iommu/amd/iommu.c | 2 +- drivers/iommu/apple-dart.c | 2 + drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 +- drivers/iommu/exynos-iommu.c | 9 +- drivers/iommu/iommu-sva.c | 3 + drivers/iommu/ipmmu-vmsa.c | 2 + drivers/iommu/mtk_iommu.c | 2 + drivers/iommu/mtk_iommu_v1.c | 25 +- drivers/iommu/omap-iommu.c | 2 +- drivers/iommu/omap-iommu.h | 2 - drivers/iommu/sun50i-iommu.c | 2 + drivers/iommu/tegra-smmu.c | 5 +- drivers/leds/leds-cros_ec.c | 5 +- drivers/leds/leds-lp50xx.c | 67 ++-- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-pcache/cache.c | 5 +- drivers/md/dm-pcache/cache_segment.c | 5 +- drivers/md/md.c | 5 +- drivers/md/raid5.c | 10 +- drivers/media/cec/core/cec-core.c | 1 + .../media/common/videobuf2/videobuf2-dma-contig.c | 1 + drivers/media/i2c/adv7604.c | 4 +- drivers/media/i2c/adv7842.c | 11 +- drivers/media/i2c/imx219.c | 9 +- drivers/media/i2c/msp3400-kthreads.c | 2 + drivers/media/i2c/tda1997x.c | 1 - drivers/media/platform/amphion/vpu_malone.c | 23 +- drivers/media/platform/amphion/vpu_v4l2.c | 16 +- drivers/media/platform/amphion/vpu_v4l2.h | 10 - .../media/platform/mediatek/mdp3/mtk-mdp3-core.c | 14 + .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 14 +- .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 12 +- .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 +- .../platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 5 +- .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 12 +- .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 +- .../platform/mediatek/vcodec/encoder/venc_vpu_if.c | 5 +- drivers/media/platform/qcom/iris/iris_common.c | 7 +- drivers/media/platform/renesas/rcar_drif.c | 1 + .../media/platform/samsung/exynos4-is/media-dev.c | 10 +- drivers/media/platform/ti/davinci/vpif_capture.c | 4 +- drivers/media/platform/ti/davinci/vpif_display.c | 4 +- drivers/media/platform/verisilicon/hantro_g2.c | 84 ++++- .../platform/verisilicon/hantro_g2_hevc_dec.c | 17 +- .../media/platform/verisilicon/hantro_g2_regs.h | 13 + .../media/platform/verisilicon/hantro_g2_vp9_dec.c | 2 - drivers/media/platform/verisilicon/hantro_hw.h | 1 + drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 + drivers/media/rc/st_rc.c | 2 +- drivers/mfd/altera-sysmgr.c | 2 + drivers/mfd/max77620.c | 15 +- drivers/mtd/mtdpart.c | 7 +- drivers/mtd/spi-nor/winbond.c | 24 ++ drivers/net/dsa/b53/b53_common.c | 3 + drivers/net/ethernet/airoha/airoha_eth.c | 39 ++- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 2 + drivers/net/ethernet/broadcom/Kconfig | 8 +- drivers/net/ethernet/broadcom/bnge/bnge.h | 2 +- drivers/net/ethernet/broadcom/bnge/bnge_core.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 3 +- drivers/net/ethernet/google/gve/gve_main.c | 2 +- drivers/net/ethernet/google/gve/gve_utils.c | 2 + drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +- drivers/net/ethernet/intel/i40e/i40e.h | 11 + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 12 - drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +- drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 8 + drivers/net/ethernet/smsc/smc91x.c | 10 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 17 +- drivers/net/ethernet/wangxun/Kconfig | 4 +- drivers/net/fjes/fjes_hw.c | 12 +- drivers/net/mdio/mdio-aspeed.c | 7 + drivers/net/mdio/mdio-realtek-rtl9300.c | 6 +- drivers/net/phy/mediatek/mtk-ge-soc.c | 2 +- drivers/net/team/team_core.c | 2 +- drivers/net/usb/asix_common.c | 5 + drivers/net/usb/ax88172a.c | 6 +- drivers/net/usb/rtl8150.c | 2 + drivers/net/usb/sr9700.c | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/sdio.c | 4 +- drivers/nvme/target/pci-epf.c | 4 +- drivers/pci/controller/dwc/pci-meson.c | 18 +- drivers/pci/controller/dwc/pcie-designware.c | 12 +- drivers/pci/controller/pcie-brcmstb.c | 10 +- drivers/pci/pci-driver.c | 4 + drivers/platform/mellanox/mlxbf-pmc.c | 14 +- drivers/platform/x86/dell/alienware-wmi-wmax.c | 32 ++ .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 2 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 5 + .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 5 + .../platform/x86/hp/hp-bioscfg/string-attributes.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel/pmt/discovery.c | 8 +- drivers/platform/x86/msi-laptop.c | 3 + drivers/platform/x86/samsung-galaxybook.c | 9 +- drivers/pmdomain/imx/gpc.c | 5 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 21 +- drivers/power/supply/max77705_charger.c | 14 +- drivers/powercap/intel_rapl_common.c | 3 + drivers/powercap/intel_rapl_msr.c | 3 + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 + drivers/vfio/pci/nvgrace-gpu/main.c | 4 +- drivers/vfio/pci/pds/dirty.c | 7 +- drivers/vfio/pci/vfio_pci_rdwr.c | 25 +- drivers/video/fbdev/gbefb.c | 5 +- drivers/video/fbdev/pxafb.c | 12 +- drivers/video/fbdev/tcx.c | 2 +- fs/erofs/zdata.c | 10 +- fs/lockd/svc4proc.c | 4 +- fs/lockd/svclock.c | 21 +- fs/lockd/svcproc.c | 5 +- fs/locks.c | 12 +- fs/nfsd/nfs4state.c | 20 +- fs/nfsd/vfs.c | 14 +- fs/ntfs3/frecord.c | 35 +- fs/smb/server/smb2pdu.c | 4 +- include/drm/drm_buddy.h | 11 +- include/drm/drm_edid.h | 6 + include/drm/drm_pagemap.h | 17 +- include/kunit/run-in-irq-context.h | 53 +-- include/linux/compiler_types.h | 13 + include/linux/genalloc.h | 1 + include/linux/huge_mm.h | 8 +- include/linux/kasan.h | 16 + include/linux/kexec.h | 4 +- include/linux/mm.h | 8 +- include/linux/vfio_pci_core.h | 10 +- include/net/dsa.h | 1 + include/uapi/rdma/irdma-abi.h | 2 +- include/uapi/rdma/rdma_user_cm.h | 4 +- kernel/cgroup/cpuset.c | 21 +- kernel/kexec_core.c | 16 +- kernel/sched/deadline.c | 2 +- kernel/sched/debug.c | 8 +- kernel/sched/ext.c | 22 +- kernel/sched/fair.c | 249 +++++++++---- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 4 +- kernel/sched/syscalls.c | 5 +- kernel/trace/fgraph.c | 10 +- lib/idr.c | 2 + mm/damon/tests/core-kunit.h | 132 ++++++- mm/damon/tests/sysfs-kunit.h | 25 ++ mm/damon/tests/vaddr-kunit.h | 26 +- mm/huge_memory.c | 71 ++-- mm/kasan/common.c | 32 ++ mm/kasan/hw_tags.c | 2 +- mm/kasan/shadow.c | 4 +- mm/page_alloc.c | 24 +- mm/page_owner.c | 2 +- mm/swapfile.c | 40 ++- mm/vmalloc.c | 8 +- net/bluetooth/mgmt.c | 6 + net/bridge/br_private.h | 1 + net/dsa/dsa.c | 67 ++-- net/ipv4/fib_semantics.c | 26 +- net/ipv4/fib_trie.c | 7 +- net/ipv4/ip_gre.c | 6 +- net/ipv6/calipso.c | 3 +- net/ipv6/ip6_gre.c | 15 +- net/ipv6/route.c | 13 +- net/mac80211/cfg.c | 10 - net/mac80211/rx.c | 5 + net/mptcp/options.c | 10 + net/mptcp/protocol.h | 6 +- net/mptcp/subflow.c | 6 - net/nfc/core.c | 9 +- net/openvswitch/vport-netdev.c | 17 +- net/rose/af_rose.c | 2 +- net/unix/af_unix.c | 11 +- net/wireless/sme.c | 2 +- rust/kernel/maple_tree.rs | 11 +- samples/ftrace/ftrace-direct-modify.c | 8 +- samples/ftrace/ftrace-direct-multi-modify.c | 8 +- samples/ftrace/ftrace-direct-multi.c | 4 +- samples/ftrace/ftrace-direct-too.c | 4 +- samples/ftrace/ftrace-direct.c | 4 +- scripts/Makefile.build | 26 +- scripts/mod/devicetable-offsets.c | 3 + scripts/mod/file2alias.c | 9 + security/integrity/ima/ima_kexec.c | 4 +- sound/soc/codecs/cs35l41.c | 7 +- sound/soc/codecs/lpass-tx-macro.c | 3 +- sound/soc/codecs/pm4125.c | 40 ++- sound/soc/codecs/wcd937x.c | 43 ++- sound/soc/codecs/wcd939x-sdw.c | 8 +- sound/soc/qcom/qdsp6/q6adm.c | 146 ++++---- sound/soc/qcom/qdsp6/q6apm-dai.c | 2 + sound/soc/qcom/qdsp6/q6asm-dai.c | 7 +- sound/soc/qcom/sc7280.c | 2 +- sound/soc/qcom/sc8280xp.c | 2 +- sound/soc/qcom/sdw.c | 105 +++--- sound/soc/qcom/sdw.h | 1 + sound/soc/qcom/sm8250.c | 2 +- sound/soc/qcom/x1e80100.c | 2 +- sound/soc/renesas/rz-ssi.c | 64 +++- sound/soc/stm/stm32_sai.c | 14 +- sound/soc/stm/stm32_sai_sub.c | 51 ++- tools/mm/page_owner_sort.c | 6 +- tools/sched_ext/scx_show_state.py | 7 +- tools/testing/radix-tree/idr-test.c | 21 ++ tools/testing/selftests/drivers/net/psp.py | 6 +- .../test.d/ftrace/func_traceonoff_triggers.tc | 5 +- tools/testing/selftests/mm/uffd-unit-tests.c | 2 +- tools/testing/selftests/net/tap.c | 16 +- 326 files changed, 3276 insertions(+), 1649 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/312 sched/proxy: Yield the donor task
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernand Sieber <[email protected]>
commit 127b90315ca07ccad2618db7ba950a63e3b32d22 upstream.
When executing a task in proxy context, handle yields as if they were requested by the donor task. This matches the traditional PI semantics of yield() as well.
This avoids scenario like proxy task yielding, pick next task selecting the same previous blocked donor, running the proxy task again, etc.
--- kernel/sched/deadline.c | 2 +- kernel/sched/ext.c | 4 ++-- kernel/sched/fair.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/syscalls.c | 5 +++-- 5 files changed, 8 insertions(+), 7 deletions(-)
kernel/sched/deadline.c +1 -1
@@ -2143,7 +2143,7 @@ static void yield_task_dl(struct rq *rq)* it and the bandwidth timer will wake it up and will give it * new scheduling parameters (thanks to dl_yielded=1). */ - rq->curr->dl.dl_yielded =1 ; + rq->donor->dl.dl_yielded =1 ;update_rq_clock (rq);update_curr_dl (rq);
kernel/sched/ext.c +2 -2
@@ -1493,7 +1493,7 @@ static bool dequeue_task_scx(struct rq *static void yield_task_scx (struct rq *rq) {struct scx_sched *sch = scx_root; -struct task_struct *p = rq->curr; +struct task_struct *p = rq->donor;if (SCX_HAS_OP (sch, yield))SCX_CALL_OP_2TASKS_RET (sch,SCX_KF_REST , yield, rq, p,NULL );
@@ -1504,7 +1504,7 @@ static void yield_task_scx(struct rq *rqstatic bool yield_to_task_scx (struct rq *rq,struct task_struct *to) {struct scx_sched *sch = scx_root; -struct task_struct *from = rq->curr; +struct task_struct *from = rq->donor;if (SCX_HAS_OP (sch, yield)) return SCX_CALL_OP_2TASKS_RET(sch, SCX_KF_REST, yield, rq,
kernel/sched/fair.c +1 -1
@@ -8993,7 +8993,7 @@ static void put_prev_task_fair(struct rq*/ static void yield_task_fair (struct rq *rq) { -struct task_struct *curr = rq->curr; +struct task_struct *curr = rq->donor;struct cfs_rq *cfs_rq =task_cfs_rq (curr);struct sched_entity *se = &curr->se;
kernel/sched/rt.c +1 -1
@@ -1490,7 +1490,7 @@ static void requeue_task_rt(struct rq *rstatic void yield_task_rt (struct rq *rq) { -requeue_task_rt (rq, rq->curr,0 ); +requeue_task_rt (rq, rq->donor,0 ); }static int find_lowest_rq (struct task_struct *task);
kernel/sched/syscalls.c +3 -2
@@ -1351,7 +1351,7 @@ static void do_sched_yield(void) rq =this_rq_lock_irq (&rf);schedstat_inc (rq->yld_count); - current->sched_class->yield_task (rq); + rq->donor->sched_class->yield_task (rq);preempt_disable ();rq_unlock_irq (rq, &rf);
@@ -1420,12 +1420,13 @@ EXPORT_SYMBOL(yield);*/ int __sched yield_to(struct task_struct *p, bool preempt) { -struct task_struct *curr = current; +struct task_struct *curr;struct rq *rq, *p_rq;int yielded =0 ; scoped_guard (raw_spinlock_irqsave, &p->pi_lock) { rq =this_rq (); + curr = rq->donor; again: p_rq =task_rq (p);
Greg Kroah-Hartman
maintainerPATCH 2/312 drm: nova: depend on CONFIG_64BIT
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
commit ba1b40ed0e34bab597fd90d4c4e9f7397f878c8f upstream.
nova-core already depends on CONFIG_64BIT, hence also depend on CONFIG_64BIT for nova-drm.
--- drivers/gpu/drm/nova/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nova/Kconfig +1 -0
@@ -1,5 +1,6 @@ config DRM_NOVA tristate "Nova DRM driver" + depends on 64BIT depends on DRM=y depends on PCI depends on RUST
Greg Kroah-Hartman
maintainerPATCH 3/312 x86/microcode/AMD: Select which microcode patch to load
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 8d171045069c804e5ffaa18be590c42c6af0cf3f upstream.
All microcode patches up to the proper BIOS Entrysign fix are loaded only after the sha256 signature carried in the driver has been verified.
Microcode patches after the Entrysign fix has been applied, do not need that signature verification anymore.
In order to not abandon machines which haven't received the BIOS update yet, add the capability to select which microcode patch to load.
The corresponding microcode container supplied through firmware-linux has been modified to carry two patches per CPU type (family/model/stepping) so that the proper one gets selected.
---
--- arch/x86/kernel/cpu/microcode/amd.c | 113 ++++++++++++++++++++++-------------- 1 file changed, 72 insertions(+), 41 deletions(-)
arch/x86/kernel/cpu/microcode/amd.c +72 -41
@@ -186,50 +186,61 @@ static u32 cpuid_to_ucode_rev(unsigned ireturn p.ucode_rev; } +static u32 get_cutoff_revision (u32 rev) +{ +switch (rev >>8 ) { +case 0x80012 :return 0x8001277 ;break ; +case 0x80082 :return 0x800820f ;break ; +case 0x83010 :return 0x830107c ;break ; +case 0x86001 :return 0x860010e ;break ; +case 0x86081 :return 0x8608108 ;break ; +case 0x87010 :return 0x8701034 ;break ; +case 0x8a000 :return 0x8a0000a ;break ; +case 0xa0010 :return 0xa00107a ;break ; +case 0xa0011 :return 0xa0011da ;break ; +case 0xa0012 :return 0xa001243 ;break ; +case 0xa0082 :return 0xa00820e ;break ; +case 0xa1011 :return 0xa101153 ;break ; +case 0xa1012 :return 0xa10124e ;break ; +case 0xa1081 :return 0xa108109 ;break ; +case 0xa2010 :return 0xa20102f ;break ; +case 0xa2012 :return 0xa201212 ;break ; +case 0xa4041 :return 0xa404109 ;break ; +case 0xa5000 :return 0xa500013 ;break ; +case 0xa6012 :return 0xa60120a ;break ; +case 0xa7041 :return 0xa704109 ;break ; +case 0xa7052 :return 0xa705208 ;break ; +case 0xa7080 :return 0xa708009 ;break ; +case 0xa70c0 :return 0xa70C009 ;break ; +case 0xaa001 :return 0xaa00116 ;break ; +case 0xaa002 :return 0xaa00218 ;break ; +case 0xb0021 :return 0xb002146 ;break ; +case 0xb0081 :return 0xb008111 ;break ; +case 0xb1010 :return 0xb101046 ;break ; +case 0xb2040 :return 0xb204031 ;break ; +case 0xb4040 :return 0xb404031 ;break ; +case 0xb4041 :return 0xb404101 ;break ; +case 0xb6000 :return 0xb600031 ;break ; +case 0xb6080 :return 0xb608031 ;break ; +case 0xb7000 :return 0xb700031 ;break ; +default :break ; + + } +return 0 ; +} +static bool need_sha_check (u32 cur_rev) { +u32 cutoff; +if (!cur_rev) { cur_rev =cpuid_to_ucode_rev (bsp_cpuid_1_eax);pr_info_once ("No current revision, generating the lowest one: 0x%x\n" , cur_rev); } -switch (cur_rev >>8 ) { -case 0x80012 :return cur_rev <=0x8001277 ;break ; -case 0x80082 :return cur_rev <=0x800820f ;break ; -case 0x83010 :return cur_rev <=0x830107c ;break ; -case 0x86001 :return cur_rev <=0x860010e ;break ; -case 0x86081 :return cur_rev <=0x8608108 ;break ; -case 0x87010 :return cur_rev <=0x8701034 ;break ; -case 0x8a000 :return cur_rev <=0x8a0000a ;break ; -case 0xa0010 :return cur_rev <=0xa00107a ;break ; -case 0xa0011 :return cur_rev <=0xa0011da ;break ; -case 0xa0012 :return cur_rev <=0xa001243 ;break ; -case 0xa0082 :return cur_rev <=0xa00820e ;break ; -case 0xa1011 :return cur_rev <=0xa101153 ;break ; -case 0xa1012 :return cur_rev <=0xa10124e ;break ; -case 0xa1081 :return cur_rev <=0xa108109 ;break ; -case 0xa2010 :return cur_rev <=0xa20102f ;break ; -case 0xa2012 :return cur_rev <=0xa201212 ;break ; -case 0xa4041 :return cur_rev <=0xa404109 ;break ; -case 0xa5000 :return cur_rev <=0xa500013 ;break ; -case 0xa6012 :return cur_rev <=0xa60120a ;break ; -case 0xa7041 :return cur_rev <=0xa704109 ;break ; -case 0xa7052 :return cur_rev <=0xa705208 ;break ; -case 0xa7080 :return cur_rev <=0xa708009 ;break ; -case 0xa70c0 :return cur_rev <=0xa70C009 ;break ; -case 0xaa001 :return cur_rev <=0xaa00116 ;break ; -case 0xaa002 :return cur_rev <=0xaa00218 ;break ; -case 0xb0021 :return cur_rev <=0xb002146 ;break ; -case 0xb0081 :return cur_rev <=0xb008111 ;break ; -case 0xb1010 :return cur_rev <=0xb101046 ;break ; -case 0xb2040 :return cur_rev <=0xb204031 ;break ; -case 0xb4040 :return cur_rev <=0xb404031 ;break ; -case 0xb4041 :return cur_rev <=0xb404101 ;break ; -case 0xb6000 :return cur_rev <=0xb600031 ;break ; -case 0xb6080 :return cur_rev <=0xb608031 ;break ; -case 0xb7000 :return cur_rev <=0xb700031 ;break ; -default :break ; - } + cutoff =get_cutoff_revision (cur_rev); +if (cutoff) +return cur_rev <= cutoff;pr_info ("You should not be seeing this. Please send the following couple of lines to x86-<at>-kernel.org\n" );pr_info ("CPUID(1).EAX: 0x%x, current revision: 0x%x\n" , bsp_cpuid_1_eax, cur_rev);
@@ -494,6 +505,7 @@ static int verify_patch(const u8 *buf, s {u8 family =x86_family (bsp_cpuid_1_eax);struct microcode_header_amd *mc_hdr; +u32 cur_rev, cutoff, patch_rev;u32 sh_psize;u16 proc_id;u8 patch_fam;
@@ -533,11 +545,32 @@ static int verify_patch(const u8 *buf, s proc_id = mc_hdr->processor_rev_id; patch_fam =0xf + (proc_id >>12 ); -ucode_dbg ("Patch-ID 0x%08x: family: 0x%x\n" , mc_hdr->patch_id, patch_fam); -if (patch_fam != family)return 1 ; + cur_rev =get_patch_level (); + +/* No cutoff revision means old/unaffected by signing algorithm weakness => matches */ + cutoff =get_cutoff_revision (cur_rev); +if (!cutoff) + goto ok; + + patch_rev = mc_hdr->patch_id; + +ucode_dbg ("cur_rev: 0x%x, cutoff: 0x%x, patch_rev: 0x%x\n" , + cur_rev, cutoff, patch_rev); + +if (cur_rev <= cutoff && patch_rev <= cutoff) + goto ok; + +if (cur_rev > cutoff && patch_rev > cutoff) + goto ok; + +return 1 ; + +ok: +ucode_dbg ("Patch-ID 0x%08x: family: 0x%x\n" , mc_hdr->patch_id, patch_fam); +return 0 ; }
@@ -606,8 +639,6 @@ static size_t parse_container(u8 *ucode, mc = (struct microcode_amd *)(buf +SECTION_HDR_SIZE ); -ucode_dbg ("patch_id: 0x%x\n" , mc->hdr.patch_id); -if (mc_patch_matches (mc, eq_id)) { desc->psize = patch_size; desc->mc = mc;
Greg Kroah-Hartman
maintainerPATCH 4/312 sched/core: Add comment explaining force-idle vruntime snapshots
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 9359d9785d85bb53f1ff1738a59aeeec4b878906 ]
I always end up having to re-read these emails every time I look at this code. And a future patch is going to change this story a little. This means it is past time to stick them in a comment so it can be modified and stay current.
Stable-dep-of: 79f3f9bedd14 ("sched/eevdf: Fix min_vruntime vs avg_vruntime")
--- kernel/sched/fair.c | 181 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 181 insertions(+)
kernel/sched/fair.c +181 -0
@@ -13014,6 +13014,187 @@ static inline void task_tick_core(struct }/* +* Consider any infeasible weight scenario. Take for instance two tasks, +* each bound to their respective sibling, one with weight 1 and one with +* weight 2. Then the lower weight task will run ahead of the higher weight +* task without bound. +* +* This utterly destroys the concept of a shared time base. +* +* Remember; all this is about a proportionally fair scheduling, where each +* tasks receives: +* +* w_i +* dt_i = ---------- dt (1) +* \Sum_j w_j +* +* which we do by tracking a virtual time, s_i: +* +* 1 +* s_i = --- d[t]_i (2) +* w_i +* +* Where d[t] is a delta of discrete time, while dt is an infinitesimal. +* The immediate corollary is that the ideal schedule S, where (2) to use +* an infinitesimal delta, is: +* +* 1 +* S = ---------- dt (3) +* \Sum_i w_i +* +* From which we can define the lag, or deviation from the ideal, as: +* +* lag(i) = S - s_i (4) +* +* And since the one and only purpose is to approximate S, we get that: +* +* \Sum_i w_i lag(i) := 0 (5) +* +* If this were not so, we no longer converge to S, and we can no longer +* claim our scheduler has any of the properties we derive from S. This is +* exactly what you did above, you broke it! +* +* +* Let's continue for a while though; to see if there is anything useful to +* be learned. We can combine (1)-(3) or (4)-(5) and express S in s_i: +* +* \Sum_i w_i s_i +* S = -------------- (6) +* \Sum_i w_i +* +* Which gives us a way to compute S, given our s_i. Now, if you've read +* our code, you know that we do not in fact do this, the reason for this +* is two-fold. Firstly, computing S in that way requires a 64bit division +* for every time we'd use it (see 12), and secondly, this only describes +* the steady-state, it doesn't handle dynamics. +* +* Anyway, in (6): s_i -> x + (s_i - x), to get: +* +* \Sum_i w_i (s_i - x) +* S - x = -------------------- (7) +* \Sum_i w_i +* +* Which shows that S and s_i transform alike (which makes perfect sense +* given that S is basically the (weighted) average of s_i). +* +* Then: +* +* x -> s_min := min{s_i} (8) +* +* to obtain: +* +* \Sum_i w_i (s_i - s_min) +* S = s_min + ------------------------ (9) +* \Sum_i w_i +* +* Which already looks familiar, and is the basis for our current +* approximation: +* +* S ~= s_min (10) +* +* Now, obviously, (10) is absolute crap :-), but it sorta works. +* +* So the thing to remember is that the above is strictly UP. It is +* possible to generalize to multiple runqueues -- however it gets really +* yuck when you have to add affinity support, as illustrated by our very +* first counter-example. +* +* Luckily I think we can avoid needing a full multi-queue variant for +* core-scheduling (or load-balancing). The crucial observation is that we +* only actually need this comparison in the presence of forced-idle; only +* then do we need to tell if the stalled rq has higher priority over the +* other. +* +* [XXX assumes SMT2; better consider the more general case, I suspect +* it'll work out because our comparison is always between 2 rqs and the +* answer is only interesting if one of them is forced-idle] +* +* And (under assumption of SMT2) when there is forced-idle, there is only +* a single queue, so everything works like normal. +* +* Let, for our runqueue 'k': +* +* T_k = \Sum_i w_i s_i +* W_k = \Sum_i w_i ; for all i of k (11) +* +* Then we can write (6) like: +* +* T_k +* S_k = --- (12) +* W_k +* +* From which immediately follows that: +* +* T_k + T_l +* S_k+l = --------- (13) +* W_k + W_l +* +* On which we can define a combined lag: +* +* lag_k+l(i) := S_k+l - s_i (14) +* +* And that gives us the tools to compare tasks across a combined runqueue. +* +* +* Combined this gives the following: +* +* a) when a runqueue enters force-idle, sync it against it's sibling rq(s) +* using (7); this only requires storing single 'time'-stamps. +* +* b) when comparing tasks between 2 runqueues of which one is forced-idle, +* compare the combined lag, per (14). +* +* Now, of course cgroups (I so hate them) make this more interesting in +* that a) seems to suggest we need to iterate all cgroup on a CPU at such +* boundaries, but I think we can avoid that. The force-idle is for the +* whole CPU, all it's rqs. So we can mark it in the root and lazily +* propagate downward on demand. +*/ + +/* +* So this sync is basically a relative reset of S to 0. +* +* So with 2 queues, when one goes idle, we drop them both to 0 and one +* then increases due to not being idle, and the idle one builds up lag to +* get re-elected. So far so simple, right? +* +* When there's 3, we can have the situation where 2 run and one is idle, +* we sync to 0 and let the idle one build up lag to get re-election. Now +* suppose another one also drops idle. At this point dropping all to 0 +* again would destroy the built-up lag from the queue that was already +* idle, not good. +* +* So instead of syncing everything, we can: +* +* less := !((s64)(s_a - s_b) <= 0) +* +* (v_a - S_a) - (v_b - S_b) == v_a - v_b - S_a + S_b +* == v_a - (v_b - S_a + S_b) +* +* IOW, we can recast the (lag) comparison to a one-sided difference. +* So if then, instead of syncing the whole queue, sync the idle queue +* against the active queue with S_a + S_b at the point where we sync. +* +* (XXX consider the implication of living in a cyclic group: N / 2^n N) +* +* This gives us means of syncing single queues against the active queue, +* and for already idle queues to preserve their build-up lag. +* +* Of course, then we get the situation where there's 2 active and one +* going idle, who do we pick to sync against? Theory would have us sync +* against the combined S, but as we've already demonstrated, there is no +* such thing in infeasible weight scenarios. +* +* One thing I've considered; and this is where that core_active rudiment +* came from, is having active queues sync up between themselves after +* every tick. This limits the observed divergence due to the work +* conservancy. +* +* On top of that, we can improve upon things by moving away from our +* horrible (10) hack and moving to (9) and employing (13) here. +*/ + +/* * se_fi_update - Update the cfs_rq->min_vruntime_fi in a CFS hierarchy if needed. */ static void se_fi_update(const struct sched_entity *se, unsigned int fi_seq,
Greg Kroah-Hartman
maintainerPATCH 5/312 sched/eevdf: Fix min_vruntime vs avg_vruntime
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 79f3f9bedd149ea438aaeb0fb6a083637affe205 ]
Basically, from the constraint that the sum of lag is zero, you can infer that the 0-lag point is the weighted average of the individual vruntime, which is what we're trying to compute:
\Sum w_i * v_i
avg = --------------
\Sum w_i
Now, since vruntime takes the whole u64 (worse, it wraps), this multiplication term in the numerator is not something we can compute; instead we do the min_vruntime (v0 henceforth) thing like:
v_i = (v_i - v0) + v0
This does two things:
- it keeps the key: (v_i - v0) 'small';
- it creates a relative 0-point in the modular space.
If you do that subtitution and work it all out, you end up with:
\Sum w_i * (v_i - v0)
avg = --------------------- + v0
\Sum w_i
Since you cannot very well track a ratio like that (and not suffer terrible numerical problems) we simpy track the numerator and denominator individually and only perform the division when strictly needed.
Notably, the numerator lives in cfs_rq->avg_vruntime and the denominator lives in cfs_rq->avg_load.
The one extra 'funny' is that these numbers track the entities in the tree, and current is typically outside of the tree, so avg_vruntime() adds current when needed before doing the division.
(vruntime_eligible() elides the division by cross-wise multiplication)
Anyway, as mentioned above, we currently use the CFS era min_vruntime for this purpose. However, this thing can only move forward, while the above avg can in fact move backward (when a non-eligible task leaves, the average becomes smaller), this can cause trouble when through happenstance (or construction) these values drift far enough apart to wreck the game.
Replace cfs_rq::min_vruntime with cfs_rq::zero_vruntime which is kept near/at avg_vruntime, following its motion.
The down-side is that this requires computing the avg more often.
--- kernel/sched/debug.c | 8 +-- kernel/sched/fair.c | 114 +++++++++++---------------------------------------- kernel/sched/sched.h | 4 - 3 files changed, 31 insertions(+), 95 deletions(-)
kernel/sched/debug.c +4 -4
@@ -796,7 +796,7 @@ static void print_rq(struct seq_file *m,void print_cfs_rq (struct seq_file *m,int cpu,struct cfs_rq *cfs_rq) { -s64 left_vruntime =-1 , min_vruntime, right_vruntime =-1 , left_deadline =-1 , spread; +s64 left_vruntime =-1 , zero_vruntime, right_vruntime =-1 , left_deadline =-1 , spread;struct sched_entity *last, *first, *root;struct rq *rq =cpu_rq (cpu);unsigned long flags;
@@ -819,15 +819,15 @@ void print_cfs_rq(struct seq_file *m, in last =__pick_last_entity (cfs_rq);if (last) right_vruntime = last->vruntime; - min_vruntime = cfs_rq->min_vruntime; + zero_vruntime = cfs_rq->zero_vruntime;raw_spin_rq_unlock_irqrestore (rq, flags);SEQ_printf (m," .%-30s: %Ld.%06ld\n" ,"left_deadline" ,SPLIT_NS (left_deadline));SEQ_printf (m," .%-30s: %Ld.%06ld\n" ,"left_vruntime" ,SPLIT_NS (left_vruntime)); -SEQ_printf (m," .%-30s: %Ld.%06ld\n" ,"min_vruntime" , -SPLIT_NS (min_vruntime)); +SEQ_printf (m," .%-30s: %Ld.%06ld\n" ,"zero_vruntime" , +SPLIT_NS (zero_vruntime));SEQ_printf (m," .%-30s: %Ld.%06ld\n" ,"avg_vruntime" ,SPLIT_NS (avg_vruntime (cfs_rq))); SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "right_vruntime",
kernel/sched/fair.c +25 -89
247 lines not on this page · raw message
kernel/sched/sched.h +2 -2
@@ -682,10 +682,10 @@ struct cfs_rq {s64 avg_vruntime;u64 avg_load; -u64 min_vruntime; +u64 zero_vruntime;#ifdef CONFIG_SCHED_CORE unsigned int forceidle_seq; -u64 min_vruntime_fi; +u64 zero_vruntime_fi;#endif struct rb_root_cached tasks_timeline;
Greg Kroah-Hartman
maintainerPATCH 6/312 sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 1dd6c84f1c544e552848a8968599220bd464e338 ]
When loading the ebpf scheduler, the tasks in the scx_tasks list will be traversed and invoke __setscheduler_class() to get new sched_class. however, this would also incorrectly set the per-cpu migration task's->sched_class to rt_sched_class, even after unload, the per-cpu migration task's->sched_class remains sched_rt_class.
The log for this issue is as follows:
./scx_rustland --stats 1
[ 199.245639][ T630] sched_ext: "rustland" does not implement cgroup cpu.weight [ 199.269213][ T630] sched_ext: BPF scheduler "rustland" enabled
04:25:09 [INFO] RustLand scheduler attached
bpftrace -e 'iter:task /strcontains(ctx->task->comm, "migration")/
{ printf("%s:%d->%pS\n", ctx->task->comm, ctx->task->pid, ctx->task->sched_class); }' Attaching 1 probe...
migration/0:24->rt_sched_class+0x0/0xe0 migration/1:27->rt_sched_class+0x0/0xe0 migration/2:33->rt_sched_class+0x0/0xe0 migration/3:39->rt_sched_class+0x0/0xe0 migration/4:45->rt_sched_class+0x0/0xe0 migration/5:52->rt_sched_class+0x0/0xe0 migration/6:58->rt_sched_class+0x0/0xe0 migration/7:64->rt_sched_class+0x0/0xe0
sched_ext: BPF scheduler "rustland" disabled (unregistered from user space)
EXIT: unregistered from user space
04:25:21 [INFO] Unregister RustLand scheduler
bpftrace -e 'iter:task /strcontains(ctx->task->comm, "migration")/
{ printf("%s:%d->%pS\n", ctx->task->comm, ctx->task->pid, ctx->task->sched_class); }' Attaching 1 probe...
migration/0:24->rt_sched_class+0x0/0xe0 migration/1:27->rt_sched_class+0x0/0xe0 migration/2:33->rt_sched_class+0x0/0xe0 migration/3:39->rt_sched_class+0x0/0xe0 migration/4:45->rt_sched_class+0x0/0xe0 migration/5:52->rt_sched_class+0x0/0xe0 migration/6:58->rt_sched_class+0x0/0xe0 migration/7:64->rt_sched_class+0x0/0xe0
This commit therefore generate a new scx_setscheduler_class() and add check for stop_sched_class to replace __setscheduler_class().
--- kernel/sched/ext.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
kernel/sched/ext.c +10 -4
@@ -210,6 +210,14 @@ static struct scx_dispatch_q *find_user_return rhashtable_lookup_fast (&sch->dsq_hash, &dsq_id, dsq_hash_params); } +static const struct sched_class *scx_setscheduler_class (struct task_struct *p) +{ +if (p->sched_class == &stop_sched_class) +return &stop_sched_class; + +return __setscheduler_class (p->policy, p->prio); +} +/* * scx_kf_mask enforcement. Some kfuncs can only be called from specific SCX * ops. When invoking SCX ops, SCX_CALL_OP[_RET]() should be used to indicate
@@ -3994,8 +4002,7 @@ static void scx_disable_workfn(struct ktscx_task_iter_start (&sti);while ((p =scx_task_iter_next_locked (&sti))) {const struct sched_class *old_class = p->sched_class; -const struct sched_class *new_class = -__setscheduler_class (p->policy, p->prio); +const struct sched_class *new_class =scx_setscheduler_class (p);struct sched_enq_and_set_ctx ctx;if (old_class != new_class && p->se.sched_delayed)
@@ -4779,8 +4786,7 @@ static int scx_enable(struct sched_ext_oscx_task_iter_start (&sti);while ((p =scx_task_iter_next_locked (&sti))) {const struct sched_class *old_class = p->sched_class; -const struct sched_class *new_class = -__setscheduler_class (p->policy, p->prio); +const struct sched_class *new_class =scx_setscheduler_class (p);struct sched_enq_and_set_ctx ctx;if (!tryget_task_struct (p))
Greg Kroah-Hartman
maintainerPATCH 7/312 mm/huge_memory: merge uniform_split_supported() and non_uniform_split_supported()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
[ Upstream commit 8a0e4bdddd1c998b894d879a1d22f1e745606215 ]
uniform_split_supported() and non_uniform_split_supported() share significantly similar logic.
The only functional difference is that uniform_split_supported() includes an additional check on the requested @new_order.
The reason for this check comes from the following two aspects:
* some file system or swap cache just supports order-0 folio
* the behavioral difference between uniform/non-uniform split
The behavioral difference between uniform split and non-uniform:
* uniform split splits folio directly to @new_order
* non-uniform split creates after-split folios with orders from folio_order(folio) - 1 to new_order.
This means for non-uniform split or !new_order split we should check the file system and swap cache respectively.
This commit unifies the logic and merge the two functions into a single combined helper, removing redundant code and simplifying the split support checking mechanism.
--- include/linux/huge_mm.h | 8 ++--- mm/huge_memory.c | 71 ++++++++++++++++++++---------------------------- 2 files changed, 33 insertions(+), 46 deletions(-)
include/linux/huge_mm.h +3 -5
@@ -369,10 +369,8 @@ int split_huge_page_to_list_to_order(str unsigned int new_order);int min_order_for_split (struct folio *folio);int split_folio_to_list (struct folio *folio,struct list_head *list); -bool uniform_split_supported (struct folio *folio,unsigned int new_order, -bool warns); -bool non_uniform_split_supported (struct folio *folio,unsigned int new_order, -bool warns); +bool folio_split_supported (struct folio *folio,unsigned int new_order, +bool uniform_split,bool warns);int folio_split (struct folio *folio,unsigned int new_order,struct page *page,struct list_head *list);/*
@@ -392,7 +390,7 @@ int folio_split(struct folio *folio, unsstatic inline int try_folio_split_to_order (struct folio *folio,struct page *page,unsigned int new_order) { -if (!non_uniform_split_supported (folio, new_order,/* warns= */ false)) +if (!folio_split_supported (folio, new_order, false,/* warns= */ false))return split_huge_page_to_list_to_order (&folio->page,NULL , new_order);return folio_split (folio, new_order, page,NULL );
mm/huge_memory.c +30 -41
97 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 8/312 KVM: s390: Fix gmap_helper_zap_one_page() again
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 2f393c228cc519ddf19b8c6c05bf15723241aa96 ]
A few checks were missing in gmap_helper_zap_one_page(), which can lead to memory corruption in the guest under specific circumstances.
Add the missing checks.
--- arch/s390/mm/gmap_helpers.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/s390/mm/gmap_helpers.c +7 -2
@@ -47,6 +47,7 @@ static void ptep_zap_swap_entry(struct mvoid gmap_helper_zap_one_page (struct mm_struct *mm,unsigned long vmaddr) {struct vm_area_struct *vma; +unsigned long pgstev;spinlock_t *ptl;pgste_t pgste;pte_t *ptep;
@@ -65,9 +66,13 @@ void gmap_helper_zap_one_page(struct mm_if (pte_swap (*ptep)) {preempt_disable (); pgste =pgste_get_lock (ptep); + pgstev =pgste_val (pgste); -ptep_zap_swap_entry (mm,pte_to_swp_entry (*ptep)); -pte_clear (mm, vmaddr, ptep); +if ((pgstev & _PGSTE_GPS_USAGE_MASK) == _PGSTE_GPS_USAGE_UNUSED || + (pgstev & _PGSTE_GPS_ZERO)) { +ptep_zap_swap_entry (mm,pte_to_swp_entry (*ptep)); +pte_clear (mm, vmaddr, ptep); + }pgste_set_unlock (ptep, pgste);preempt_enable ();
Greg Kroah-Hartman
maintainerPATCH 9/312 drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit 8b61583f993589a64c061aa91b44f5bd350d90a5 ]
Add a convenience helper for initializing struct drm_edid_ident.
Stable-dep-of: 83cbb4d33dc2 ("drm/displayid: add quirk to ignore DisplayID checksum errors")
--- include/drm/drm_edid.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/drm/drm_edid.h +6 -0
@@ -340,6 +340,12 @@ struct drm_edid_ident {const char *name; }; +#define DRM_EDID_IDENT_INIT (_vend_chr_0, _vend_chr_1, _vend_chr_2, _product_id, _name) \ +{ \ + .panel_id = drm_edid_encode_panel_id(_vend_chr_0, _vend_chr_1, _vend_chr_2, _product_id), \ + .name = _name, \ +} +#define EDID_PRODUCT_ID (e) ((e)->prod_code[0] | ((e)->prod_code[1] << 8))/* Short Audio Descriptor */
Greg Kroah-Hartman
maintainerPATCH 10/312 drm/displayid: add quirk to ignore DisplayID checksum errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit 83cbb4d33dc22b0ca1a4e85c6e892c9b729e28d4 ]
Add a mechanism for DisplayID specific quirks, and add the first quirk to ignore DisplayID section checksum errors.
It would be quite inconvenient to pass existing EDID quirks from drm_edid.c for DisplayID parsing. Not all places doing DisplayID iteration have the quirks readily available, and would have to pass it in all places. Simply add a separate array of DisplayID specific EDID quirks. We do end up checking it every time we iterate DisplayID blocks, but hopefully the number of quirks remains small.
There are a few laptop models with DisplayID checksum failures, leading to higher refresh rates only present in the DisplayID blocks being ignored. Add a quirk for the panel in the machines.
--- drivers/gpu/drm/drm_displayid.c | 41 +++++++++++++++++++++++++++---- drivers/gpu/drm/drm_displayid_internal.h | 2 + 2 files changed, 39 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_displayid.c +37 -4
@@ -9,6 +9,34 @@#include "drm_crtc_internal.h" #include "drm_displayid_internal.h" +enum { +QUIRK_IGNORE_CHECKSUM , +}; + +struct displayid_quirk { +const struct drm_edid_ident ident; +u8 quirks; +}; + +static const struct displayid_quirk quirks[] = { + { + .ident =DRM_EDID_IDENT_INIT ('C' ,'S' ,'O' ,5142 ,"MNE007ZA1-5" ), + .quirks =BIT (QUIRK_IGNORE_CHECKSUM ), + }, +}; + +static u8 get_quirks (const struct drm_edid *drm_edid) +{ +int i; + +for (i =0 ; i <ARRAY_SIZE (quirks); i++) { +if (drm_edid_match (drm_edid, &quirks[i].ident)) +return quirks[i].quirks; + } + +return 0 ; +} +static const struct displayid_header *displayid_get_header (const u8 *displayid,int length,int index) {
@@ -23,7 +51,7 @@ displayid_get_header(const u8 *displayid }static const struct displayid_header * -validate_displayid (const u8 *displayid,int length,int idx) +validate_displayid (const u8 *displayid,int length,int idx,bool ignore_checksum) {int i, dispid_length;u8 csum =0 ;
@@ -41,8 +69,11 @@ validate_displayid(const u8 *displayid,for (i =0 ; i < dispid_length; i++) csum += displayid[idx + i];if (csum) { -DRM_NOTE ("DisplayID checksum invalid, remainder is %d\n" , csum); -return ERR_PTR (-EINVAL ); +DRM_NOTE ("DisplayID checksum invalid, remainder is %d%s\n" , csum, + ignore_checksum ?" (ignoring)" :"" ); + +if (!ignore_checksum) +return ERR_PTR (-EINVAL ); }return base;
@@ -52,6 +83,7 @@ static const u8 *find_next_displayid_ext {const struct displayid_header *base;const u8 *displayid; +bool ignore_checksum = iter->quirks &BIT (QUIRK_IGNORE_CHECKSUM ); displayid =drm_edid_find_extension (iter->drm_edid,DISPLAYID_EXT , &iter->ext_index);if (!displayid)
@@ -61,7 +93,7 @@ static const u8 *find_next_displayid_ext iter->length =EDID_LENGTH -1 ; iter->idx =1 ; - base =validate_displayid (displayid, iter->length, iter->idx); + base =validate_displayid (displayid, iter->length, iter->idx, ignore_checksum);if (IS_ERR (base))return NULL ;
@@ -76,6 +108,7 @@ void displayid_iter_edid_begin(const strmemset (iter,0 ,sizeof (*iter)); iter->drm_edid = drm_edid; + iter->quirks =get_quirks (drm_edid); } static const struct displayid_block *
drivers/gpu/drm/drm_displayid_internal.h +2 -0
@@ -167,6 +167,8 @@ struct displayid_iter {u8 version;u8 primary_use; + +u8 quirks; }; void displayid_iter_edid_begin(const struct drm_edid *drm_edid,
Greg Kroah-Hartman
maintainerPATCH 11/312 drm/amdgpu: dont attach the tlb fence for SI
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit eb296c09805ee37dd4ea520a7fb3ec157c31090f upstream.
SI hardware doesn't support pasids, user mode queues, or KIQ/MES so there is no need for this. Doing so results in a segfault as these callbacks are non-existent for SI.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +3 -1
@@ -1066,7 +1066,9 @@ amdgpu_vm_tlb_flush(struct amdgpu_vm_upd }/* Prepare a TLB flush fence to be attached to PTs */ -if (!params->unlocked) { +if (!params->unlocked && +/* SI doesn't support pasid or KIQ/MES */ + params->adev->family >AMDGPU_FAMILY_SI ) {amdgpu_vm_tlb_fence_create (params->adev, vm, fence);/* Makes sure no PD/PT is freed before the flush */
Greg Kroah-Hartman
maintainerPATCH 12/312 wifi: rtw88: limit indirect IO under powered off for RTL8822CS
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit f3ccdfda345ca9a624ea425840a926b8338c1e25 ]
The indirect IO is necessary for RTL8822CS, but not necessary for other chips. Otherwiese, it throws errors and becomes unusable.
rtw88_8723cs mmc1:0001:1: WOW Firmware version 11.0.0, H2C version 0 rtw88_8723cs mmc1:0001:1: Firmware version 11.0.0, H2C version 0 rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110 rtw88_8723cs mmc1:0001:1: sdio write8 failed (0x1c): -110 rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110
By vendor driver, only RTL8822CS and RTL8822ES need indirect IO, but RTL8822ES isn't supported yet. Therefore, limit it to RTL8822CS only.
--- drivers/net/wireless/realtek/rtw88/sdio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/sdio.c +3 -1
@@ -144,8 +144,10 @@ static u32 rtw_sdio_to_io_address(struct rtw_dev *rtwdev, u32 addr,static bool rtw_sdio_use_direct_io (struct rtw_dev *rtwdev,u32 addr) { +bool might_indirect_under_power_off = rtwdev->chip->id ==RTW_CHIP_TYPE_8822C ; +if (!test_bit (RTW_FLAG_POWERON , rtwdev->flags) && - !rtw_sdio_is_bus_addr (addr)) + !rtw_sdio_is_bus_addr (addr) && might_indirect_under_power_off)return false; return !rtw_sdio_is_sdio30_supported(rtwdev) ||
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/312 wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Morning Star <[email protected]>
[ Upstream commit dd39edb445f07400e748da967a07d5dca5c5f96e ]
TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise, UBSAN warn:
UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtl_tid_data [9]'
--- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c +2 -1
@@ -511,7 +511,8 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,if (sta) { sta_entry = (struct rtl_sta_info *)sta->drv_priv; tid =ieee80211_get_tid (hdr); - agg_state = sta_entry->tids[tid].agg.agg_state; +if (tid <MAX_TID_COUNT ) + agg_state = sta_entry->tids[tid].agg.agg_state; ampdu_density = sta->deflink.ht_cap.ampdu_density; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/312 wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 2b77b9551d1184cb5af8271ff350e6e2c1b3db0d ]
The QGenie AI code review tool says we should store the capped length to wdev->u.client.ssid_len. The AI is correct.
--- net/wireless/sme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/sme.c +1 -1
@@ -910,7 +910,7 @@ void __cfg80211_connect_result(struct net_device *dev, ssid_len =min (ssid->datalen,IEEE80211_MAX_SSID_LEN );memcpy (wdev->u.client.ssid, ssid->data, ssid_len); - wdev->u.client.ssid_len = ssid->datalen; + wdev->u.client.ssid_len = ssid_len;break ; }rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/312 wifi: mac80211: do not use old MBSSID elements
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aloka Dixit <[email protected]>
[ Upstream commit a519be2f5d958c5804f2cfd68f1f384291271fab ]
When userspace brings down and deletes a non-transmitted profile, it is expected to send a new updated Beacon template for the transmitted profile of that multiple BSSID (MBSSID) group which does not include the removed profile in MBSSID element. This update comes via NL80211_CMD_SET_BEACON.
Such updates work well as long as the group continues to have at least one non-transmitted profile as NL80211_ATTR_MBSSID_ELEMS is included in the new Beacon template.
But when the last non-trasmitted profile is removed, it still gets included in Beacon templates sent to driver. This happens because when no MBSSID elements are sent by the userspace, ieee80211_assign_beacon() ends up using the element stored from earlier Beacon template.
Do not copy old MBSSID elements, instead userspace should always include these when applicable.
--- net/mac80211/cfg.c | 10 ---------- 1 file changed, 10 deletions(-)
net/mac80211/cfg.c +0 -10
@@ -1328,7 +1328,6 @@ ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata, size =sizeof (*new) + new_head_len + new_tail_len; -/* new or old multiple BSSID elements? */ if (params->mbssid_ies) { mbssid = params->mbssid_ies; size +=struct_size (new->mbssid_ies, elem, mbssid->cnt);
@@ -1338,15 +1337,6 @@ ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata, } size +=ieee80211_get_mbssid_beacon_len (mbssid, rnr, mbssid->cnt); - }else if (old && old->mbssid_ies) { - mbssid = old->mbssid_ies; - size +=struct_size (new->mbssid_ies, elem, mbssid->cnt); -if (old && old->rnr_ies) { - rnr = old->rnr_ies; - size +=struct_size (new->rnr_ies, elem, rnr->cnt); - } - size +=ieee80211_get_mbssid_beacon_len (mbssid, rnr, - mbssid->cnt); } new =kzalloc (size,GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/312 sched_ext: fix uninitialized ret on alloc_percpu() failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liang Jie <[email protected]>
[ Upstream commit b0101ccb5b4641885f30fecc352ef891ed06e083 ]
Smatch reported:
kernel/sched/ext.c:5332 scx_alloc_and_add_sched() warn: passing zero to 'ERR_PTR'
In scx_alloc_and_add_sched(), the alloc_percpu() failure path jumps to err_free_gdsqs without initializing @ret. That can lead to returning ERR_PTR(0), which violates the ERR_PTR() convention and confuses callers.
Set @ret to -ENOMEM before jumping to the error path when alloc_percpu() fails.
--- kernel/sched/ext.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/sched/ext.c +3 -1
@@ -4508,8 +4508,10 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops) } sch->pcpu = alloc_percpu(struct scx_sched_pcpu); -if (!sch->pcpu) +if (!sch->pcpu) { + ret = -ENOMEM ; goto err_free_gdsqs; + } sch->helper =kthread_run_worker (0 ,"sched_ext_helper" );if (IS_ERR (sch->helper)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/312 i40e: fix scheduling in set_rx_mode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemyslaw Korba <[email protected]>
[ Upstream commit be43abc5514167cc129a8d8e9727b89b8e1d9719 ]
Add service task schedule to set_rx_mode.
In some cases there are error messages printed out in PTP application (ptp4l):
ptp4l[13848.762]: port 1 (ens2f3np3): received SYNC without timestamp ptp4l[13848.825]: port 1 (ens2f3np3): received SYNC without timestamp ptp4l[13848.887]: port 1 (ens2f3np3): received SYNC without timestamp
This happens when service task would not run immediately after set_rx_mode, and we need it for setup tasks. This service task checks, if PTP RX packets are hung in firmware, and propagate correct settings such as multicast address for IEEE 1588 Precision Time Protocol. RX timestamping depends on some of these filters set. Bug happens only with high PTP packets frequency incoming, and not every run since sometimes service task is being ran from a different place immediately after starting ptp4l.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -0
@@ -2234,6 +2234,7 @@ static void i40e_set_rx_mode(struct net_device *netdev) vsi->flags |=I40E_VSI_FLAG_FILTER_CHANGED ;set_bit (__I40E_MACVLAN_SYNC_PENDING, vsi->back->state); } +i40e_service_event_schedule (vsi->back); }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/312 i40e: validate ring_len parameter against hardware-specific values
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Herrero <[email protected]>
[ Upstream commit 69942834215323cd9131db557091b4dec43f19c5 ]
The maximum number of descriptors supported by the hardware is hardware-dependent and can be retrieved using i40e_get_max_num_descriptors(). Move this function to a shared header and use it when checking for valid ring_len parameter rather than using hardcoded value.
By fixing an over-acceptance issue, behavior change could be seen where ring_len could now be rejected while configuring rx and tx queues if its size is larger than the hardware-dependent maximum number of descriptors.
--- drivers/net/ethernet/intel/i40e/i40e.h | 11 +++++++++++ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 12 ------------ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++-- 3 files changed, 13 insertions(+), 14 deletions(-)
drivers/net/ethernet/intel/i40e/i40e.h +11 -0
@@ -1418,4 +1418,15 @@ static inline struct i40e_veb *i40e_pf_get_main_veb(struct i40e_pf *pf) return (pf->lan_veb != I40E_NO_VEB) ? pf->veb[pf->lan_veb] : NULL; } +static inline u32 i40e_get_max_num_descriptors (const struct i40e_pf *pf) +{ +const struct i40e_hw *hw = &pf->hw; + +switch (hw->mac.type) { +case I40E_MAC_XL710 : +return I40E_MAX_NUM_DESCRIPTORS_XL710 ; +default : +return I40E_MAX_NUM_DESCRIPTORS ; + } +}#endif /* _I40E_H_ */
drivers/net/ethernet/intel/i40e/i40e_ethtool.c +0 -12
@@ -2013,18 +2013,6 @@ static void i40e_get_drvinfo(struct net_device *netdev, drvinfo->n_priv_flags +=I40E_GL_PRIV_FLAGS_STR_LEN ; } -static u32 i40e_get_max_num_descriptors (struct i40e_pf *pf) -{ -struct i40e_hw *hw = &pf->hw; - -switch (hw->mac.type) { -case I40E_MAC_XL710 : -return I40E_MAX_NUM_DESCRIPTORS_XL710 ; -default : -return I40E_MAX_NUM_DESCRIPTORS ; - } -} - static void i40e_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, struct kernel_ethtool_ringparam *kernel_ring,
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +2 -2
@@ -656,7 +656,7 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_id,/* ring_len has to be multiple of 8 */ if (!IS_ALIGNED (info->ring_len,8 ) || - info->ring_len >I40E_MAX_NUM_DESCRIPTORS_XL710 ) { + info->ring_len >i40e_get_max_num_descriptors (pf)) { ret = -EINVAL ; goto error_context; }
@@ -726,7 +726,7 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,/* ring_len has to be multiple of 32 */ if (!IS_ALIGNED (info->ring_len,32 ) || - info->ring_len >I40E_MAX_NUM_DESCRIPTORS_XL710 ) { + info->ring_len >i40e_get_max_num_descriptors (pf)) { ret = -EINVAL ; goto error_param; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/312 iavf: fix off-by-one issues in iavf_config_rss_reg()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit 6daa2893f323981c7894c68440823326e93a7d61 ]
There are off-by-one bugs when configuring RSS hash key and lookup table, causing out-of-bounds reads to memory [1] and out-of-bounds writes to device registers.
Before commit 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS"), the loop upper bounds were:
i <= I40E_VFQF_{HKEY,HLUT}_MAX_INDEXwhich is safe since the value is the last valid index.
That commit changed the bounds to:
i <= adapter->rss_{key,lut}_size / 4where rss_{key,lut}_size / 4 is the number of dwords, so the last valid index is (rss_{key,lut}_size / 4) - 1. Therefore, using <= accesses one element past the end.
Fix the issues by using < instead of <=, ensuring we do not exceed the bounds.
[1] KASAN splat about rss_key_size off-by-one
BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800
Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63
CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: iavf iavf_watchdog_task
Call Trace:
<TASK>
dump_stack_lvl+0x6f/0xb0
print_report+0x170/0x4f3
kasan_report+0xe1/0x1a0
iavf_config_rss+0x619/0x800
iavf_watchdog_task+0x2be7/0x3230
process_one_work+0x7fd/0x1420
worker_thread+0x4d1/0xd40
kthread+0x344/0x660
ret_from_fork+0x249/0x320
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 63:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x7f/0x90
__kmalloc_noprof+0x246/0x6f0
iavf_watchdog_task+0x28fc/0x3230
process_one_work+0x7fd/0x1420
worker_thread+0x4d1/0xd40
kthread+0x344/0x660
ret_from_fork+0x249/0x320
ret_from_fork_asm+0x1a/0x30
The buggy address belongs to the object at ffff888102c50100
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes to the right of
allocated 52-byte region [ffff888102c50100, ffff888102c50134)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50
flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
>ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
^
ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc--- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +2 -2
@@ -1726,11 +1726,11 @@ static int iavf_config_rss_reg(struct iavf_adapter *adapter)u16 i; dw = (u32 *)adapter->rss_key; -for (i =0 ; i <= adapter->rss_key_size /4 ; i++) +for (i =0 ; i < adapter->rss_key_size /4 ; i++)wr32 (hw,IAVF_VFQF_HKEY (i), dw[i]); dw = (u32 *)adapter->rss_lut; -for (i =0 ; i <= adapter->rss_lut_size /4 ; i++) +for (i =0 ; i < adapter->rss_lut_size /4 ; i++)wr32 (hw,IAVF_VFQF_HLUT (i), dw[i]);iavf_flush (hw);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/312 idpf: fix LAN memory regions command on some NVMs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larysa Zaremba <[email protected]>
[ Upstream commit 4af1f9a47291f7d446398065e0d6eb4943f7e184 ]
IPU SDK versions 1.9 through 2.0.5 require send buffer to contain a single empty memory region. Set number of regions to 1 and use appropriate send buffer size to satisfy this requirement.
--- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +5 -0
@@ -1016,6 +1016,9 @@ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)struct idpf_vc_xn_params xn_params = { .vc_op =VIRTCHNL2_OP_GET_LAN_MEMORY_REGIONS , .recv_buf.iov_len =IDPF_CTLQ_MAX_BUF_LEN , + .send_buf.iov_len = +sizeof (struct virtchnl2_get_lan_memory_regions ) + +sizeof (struct virtchnl2_mem_region ), .timeout_ms =IDPF_VC_XN_DEFAULT_TIMEOUT_MSEC , };int num_regions, size;
@@ -1028,6 +1031,8 @@ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)return -ENOMEM ; xn_params.recv_buf.iov_base = rcvd_regions; + rcvd_regions->num_memory_regions =cpu_to_le16 (1 ); + xn_params.send_buf.iov_base = rcvd_regions; reply_sz =idpf_vc_xn_exec (adapter, &xn_params);if (reply_sz <0 )return reply_sz;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/312 idpf: reduce mbx_task schedule delay to 300us
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Vazquez <[email protected]>
[ Upstream commit b3d6bbae1d6d5638a4ab702ab195476787cde857 ]
During the IDPF init phase, the mailbox runs in poll mode until it is configured to properly handle interrupts. The previous delay of 300ms is excessively long for the mailbox polling mechanism, which causes a slow initialization of ~2s:
echo 0000:06:12.4 > /sys/bus/pci/drivers/idpf/bind
[ 52.444239] idpf 0000:06:12.4: enabling device (0000 -> 0002) [ 52.485005] idpf 0000:06:12.4: Device HW Reset initiated [ 54.177181] idpf 0000:06:12.4: PTP init failed, err=-EOPNOTSUPP [ 54.206177] idpf 0000:06:12.4: Minimum RX descriptor support not provided, using the default [ 54.206182] idpf 0000:06:12.4: Minimum TX descriptor support not provided, using the default
Changing the delay to 300us avoids the delays during the initial mailbox transactions, making the init phase much faster:
[ 83.342590] idpf 0000:06:12.4: enabling device (0000 -> 0002) [ 83.384402] idpf 0000:06:12.4: Device HW Reset initiated [ 83.518323] idpf 0000:06:12.4: PTP init failed, err=-EOPNOTSUPP [ 83.547430] idpf 0000:06:12.4: Minimum RX descriptor support not provided, using the default [ 83.547435] idpf 0000:06:12.4: Minimum TX descriptor support not provided, using the default
--- drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/idpf/idpf_lib.c +1 -1
@@ -1271,7 +1271,7 @@ void idpf_mbx_task(struct work_struct *work)idpf_mb_irq_enable (adapter); else queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, - msecs_to_jiffies(300)); + usecs_to_jiffies(300));idpf_recv_mb_msg (adapter); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/312 cpuset: fix warning when disabling remote partition
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit aa7d3a56a20f07978d9f401e13637a6479b13bd0 ]
A warning was triggered as follows:
WARNING: kernel/cgroup/cpuset.c:1651 at remote_partition_disable+0xf7/0x110 RIP: 0010:remote_partition_disable+0xf7/0x110 RSP: 0018:ffffc90001947d88 EFLAGS: 00000206 RAX: 0000000000007fff RBX: ffff888103b6e000 RCX: 0000000000006f40 RDX: 0000000000006f00 RSI: ffffc90001947da8 RDI: ffff888103b6e000 RBP: ffff888103b6e000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: ffff88810b2e2728 R12: ffffc90001947da8 R13: 0000000000000000 R14: ffffc90001947da8 R15: ffff8881081f1c00 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f55c8bbe0b2 CR3: 000000010b14c000 CR4: 00000000000006f0 Call Trace: <TASK> update_prstate+0x2d3/0x580 cpuset_partition_write+0x94/0xf0 kernfs_fop_write_iter+0x147/0x200 vfs_write+0x35d/0x500 ksys_write+0x66/0xe0 do_syscall_64+0x6b/0x390 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f55c8cd4887
Reproduction steps (on a 16-CPU machine):
# cd /sys/fs/cgroup/
# mkdir A1
# echo +cpuset > A1/cgroup.subtree_control
# echo "0-14" > A1/cpuset.cpus.exclusive
# mkdir A1/A2
# echo "0-14" > A1/A2/cpuset.cpus.exclusive
# echo "root" > A1/A2/cpuset.cpus.partition
# echo 0 > /sys/devices/system/cpu/cpu15/online
# echo member > A1/A2/cpuset.cpus.partitionWhen CPU 15 is offlined, subpartitions_cpus gets cleared because no CPUs remain available for the top_cpuset, forcing partitions to share CPUs with the top_cpuset. In this scenario, disabling the remote partition triggers a warning stating that effective_xcpus is not a subset of subpartitions_cpus. Partitions should be invalidated in this case to inform users that the partition is now invalid(cpus are shared with top_cpuset).
To fix this issue:
1. Only emit the warning only if subpartitions_cpus is not empty and the effective_xcpus is not a subset of subpartitions_cpus.
2. During the CPU hotplug process, invalidate partitions if subpartitions_cpus is empty.
--- kernel/cgroup/cpuset.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
kernel/cgroup/cpuset.c +16 -5
@@ -1600,7 +1600,14 @@ static void remote_partition_disable(struct cpuset *cs, struct tmpmasks *tmp)bool isolcpus_updated;WARN_ON_ONCE (!is_remote_partition (cs)); -WARN_ON_ONCE (!cpumask_subset (cs->effective_xcpus, subpartitions_cpus)); +/* +* When a CPU is offlined, top_cpuset may end up with no available CPUs, +* which should clear subpartitions_cpus. We should not emit a warning for this +* scenario: the hierarchy is updated from top to bottom, so subpartitions_cpus +* may already be cleared when disabling the partition. +*/ +WARN_ON_ONCE (!cpumask_subset (cs->effective_xcpus, subpartitions_cpus) && + !cpumask_empty (subpartitions_cpus));spin_lock_irq (&callback_lock);list_del_init (&cs->remote_sibling);
@@ -3927,8 +3934,9 @@ static void cpuset_hotplug_update_tasks(struct cpuset *cs, struct tmpmasks *tmp)if (remote || (is_partition_valid (cs) &&is_partition_valid (parent)))compute_partition_effective_cpumask (cs, &new_cpus); -if (remote &&cpumask_empty (&new_cpus) && -partition_is_populated (cs,NULL )) { +if (remote && (cpumask_empty (subpartitions_cpus) || + (cpumask_empty (&new_cpus) && +partition_is_populated (cs,NULL )))) { cs->prs_err =PERR_HOTPLUG ;remote_partition_disable (cs, tmp);compute_effective_cpumask (&new_cpus, cs, parent);
@@ -3941,9 +3949,12 @@ static void cpuset_hotplug_update_tasks(struct cpuset *cs, struct tmpmasks *tmp)* 1) empty effective cpus but not valid empty partition. * 2) parent is invalid or doesn't grant any cpus to child * partitions. +* 3) subpartitions_cpus is empty. */ -if (is_local_partition (cs) && (!is_partition_valid (parent) || -tasks_nocpu_error (parent, cs, &new_cpus))) +if (is_local_partition (cs) && + (!is_partition_valid (parent) || +tasks_nocpu_error (parent, cs, &new_cpus) || +cpumask_empty (subpartitions_cpus))) partcmd = partcmd_invalidate;/* * On the other hand, an invalid partition root may be transitioned
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/312 crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 50fdb78b7c0bcc550910ef69c0984e751cac72fa ]
As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid.
Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.
--- crypto/seqiv.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
crypto/seqiv.c +5 -3
@@ -50,6 +50,7 @@ static int seqiv_aead_encrypt(struct aead_request *req)struct aead_geniv_ctx *ctx =crypto_aead_ctx (geniv);struct aead_request *subreq =aead_request_ctx (req);crypto_completion_t compl; +bool unaligned_info;void *data;u8 *info;unsigned int ivsize =8 ;
@@ -68,8 +69,9 @@ static int seqiv_aead_encrypt(struct aead_request *req)memcpy_sglist (req->dst, req->src, req->assoclen + req->cryptlen); -if (unlikely (!IS_ALIGNED ((unsigned long )info, -crypto_aead_alignmask (geniv) +1 ))) { + unaligned_info = !IS_ALIGNED ((unsigned long )info, +crypto_aead_alignmask (geniv) +1 ); +if (unlikely (unaligned_info)) { info =kmemdup (req->iv, ivsize, req->base.flags &CRYPTO_TFM_REQ_MAY_SLEEP ?GFP_KERNEL :GFP_ATOMIC );
@@ -89,7 +91,7 @@ static int seqiv_aead_encrypt(struct aead_request *req)scatterwalk_map_and_copy (info, req->dst, req->assoclen, ivsize,1 ); err =crypto_aead_encrypt (subreq); -if (unlikely (info != req->iv)) +if (unlikely (unaligned_info))seqiv_aead_encrypt_complete2 (req, err);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/312 Bluetooth: MGMT: report BIS capability flags in supported settings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 348240e5fa901d3d4ba8dffa0e2ba9fc7aba93ab ]
MGMT_SETTING_ISO_BROADCASTER and MGMT_SETTING_ISO_RECEIVER flags are missing from supported_settings although they are in current_settings.
Report them also in supported_settings to be consistent.
--- net/bluetooth/mgmt.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/mgmt.c +6 -0
@@ -849,6 +849,12 @@ static u32 get_supported_settings(struct hci_dev *hdev)if (cis_peripheral_capable (hdev)) settings |=MGMT_SETTING_CIS_PERIPHERAL ; +if (bis_capable (hdev)) + settings |=MGMT_SETTING_ISO_BROADCASTER ; + +if (sync_recv_capable (hdev)) + settings |=MGMT_SETTING_ISO_SYNC_RECEIVER ; +if (ll_privacy_capable (hdev)) settings |=MGMT_SETTING_LL_PRIVACY ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/312 Bluetooth: btusb: revert use of devm_kzalloc in btusb
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <[email protected]>
[ Upstream commit 252714f1e8bdd542025b16321c790458014d6880 ]
This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file").
In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen.
The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet.
To fix this, revert the use of devm and go back to freeing memory explicitly.
--- drivers/bluetooth/btusb.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/bluetooth/btusb.c +9 -3
@@ -4017,7 +4017,7 @@ static int btusb_probe(struct usb_interface *intf,return -ENODEV ; } - data =devm_kzalloc (&intf->dev,sizeof (*data),GFP_KERNEL ); + data =kzalloc (sizeof (*data),GFP_KERNEL );if (!data)return -ENOMEM ;
@@ -4040,8 +4040,10 @@ static int btusb_probe(struct usb_interface *intf, } } -if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) +if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) { +kfree (data);return -ENODEV ; + }if (id->driver_info &BTUSB_AMP ) { data->cmdreq_type =USB_TYPE_CLASS |0x01 ;
@@ -4096,8 +4098,10 @@ static int btusb_probe(struct usb_interface *intf, data->recv_acl = hci_recv_frame; hdev =hci_alloc_dev_priv (priv_size); -if (!hdev) +if (!hdev) { +kfree (data);return -ENOMEM ; + } hdev->bus =HCI_USB ;hci_set_drvdata (hdev, data);
@@ -4370,6 +4374,7 @@ static int btusb_probe(struct usb_interface *intf,if (data->reset_gpio)gpiod_put (data->reset_gpio);hci_free_dev (hdev); +kfree (data);return err; }
@@ -4418,6 +4423,7 @@ static void btusb_disconnect(struct usb_interface *intf) }hci_free_dev (hdev); +kfree (data); }#ifdef CONFIG_PM
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/312 net: mdio: aspeed: add dummy read to avoid read-after-write issue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Chou <[email protected]>
[ Upstream commit d1a1a4bade4b20c0858d0b2f81d2611de055f675 ]
The Aspeed MDIO controller may return incorrect data when a read operation follows immediately after a write. Due to a controller bug, the subsequent read can latch stale data, causing the polling logic to terminate earlier than expected.
To work around this hardware issue, insert a dummy read after each write operation. This ensures that the next actual read returns the correct data and prevents premature polling exit.
This workaround has been verified to stabilize MDIO transactions on affected Aspeed platforms.
--- drivers/net/mdio/mdio-aspeed.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/mdio/mdio-aspeed.c +7 -0
@@ -63,6 +63,13 @@ static int aspeed_mdio_op(struct mii_bus *bus, u8 st, u8 op, u8 phyad, u8 regad,iowrite32 (ctrl, ctx->base +ASPEED_MDIO_CTRL ); +/* Workaround for read-after-write issue. +* The controller may return stale data if a read follows immediately +* after a write. A dummy read forces the hardware to update its +* internal state, ensuring that the next real read returns correct data. +*/ +ioread32 (ctx->base +ASPEED_MDIO_CTRL ); + return readl_poll_timeout(ctx->base + ASPEED_MDIO_CTRL, ctrl, !(ctrl & ASPEED_MDIO_CTRL_FIRE), ASPEED_MDIO_INTERVAL_US,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/312 net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 5498227676303e3ffa9a3a46214af96bc3e81314 ]
The openvswitch teardown code will immediately call ovs_netdev_detach_dev() in response to a NETDEV_UNREGISTER notification. It will then start the dp_notify_work workqueue, which will later end up calling the vport destroy() callback. This callback takes the RTNL to do another ovs_netdev_detach_port(), which in this case is unnecessary. This causes extra pressure on the RTNL, in some cases leading to "unregister_netdevice: waiting for XX to become free" warnings on teardown.
We can straight-forwardly avoid the extra RTNL lock acquisition by checking the device flags before taking the lock, and skip the locking altogether if the IFF_OVS_DATAPATH flag has already been unset.
--- net/openvswitch/vport-netdev.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
net/openvswitch/vport-netdev.c +13 -4
@@ -160,10 +160,19 @@ void ovs_netdev_detach_dev(struct vport *vport)static void netdev_destroy (struct vport *vport) { -rtnl_lock (); -if (netif_is_ovs_port (vport->dev)) -ovs_netdev_detach_dev (vport); -rtnl_unlock (); +/* When called from ovs_db_notify_wq() after a dp_device_event(), the +* port has already been detached, so we can avoid taking the RTNL by +* checking this first. +*/ +if (netif_is_ovs_port (vport->dev)) { +rtnl_lock (); +/* Check again while holding the lock to ensure we don't race +* with the netdev notifier and detach twice. +*/ +if (netif_is_ovs_port (vport->dev)) +ovs_netdev_detach_dev (vport); +rtnl_unlock (); + }call_rcu (&vport->rcu, vport_netdev_free); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/312 ip6_gre: make ip6gre_header() robust
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit db5b4e39c4e63700c68a7e65fc4e1f1375273476 ]
Over the years, syzbot found many ways to crash the kernel in ip6gre_header() [1].
This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len
In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ip6gre device.
[1]
skbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0
------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:213 ! <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
--- net/ipv6/ip6_gre.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/ipv6/ip6_gre.c +8 -1
@@ -1366,9 +1366,16 @@ static int ip6gre_header(struct sk_buff *skb, struct net_device *dev, {struct ip6_tnl *t =netdev_priv (dev);struct ipv6hdr *ipv6h; +int needed;__be16 *p; - ipv6h =skb_push (skb, t->hlen +sizeof (*ipv6h)); + needed = t->hlen +sizeof (*ipv6h); +if (skb_headroom (skb) < needed && +pskb_expand_head (skb,HH_DATA_ALIGN (needed -skb_headroom (skb)), +0 ,GFP_ATOMIC )) +return -needed; + + ipv6h =skb_push (skb, needed);ip6_flow_hdr (ipv6h,0 ,ip6_make_flowlabel (dev_net (dev), skb, t->fl.u.ip6.flowlabel, true, &t->fl.u.ip6));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/312 powerpc/tools: drop `-o pipefail` in gcc check scripts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Stancek <[email protected]>
[ Upstream commit f1164534ad62f0cc247d99650b07bd59ad2a49fd ]
--- arch/powerpc/tools/gcc-check-fpatchable-function-entry.sh | 1 - arch/powerpc/tools/gcc-check-mprofile-kernel.sh | 1 - 2 files changed, 2 deletions(-)
arch/powerpc/tools/gcc-check-fpatchable-function-entry.sh +0 -1
@@ -2,7 +2,6 @@ # SPDX-License-Identifier: GPL-2.0 set -e -set -o pipefail # To debug, uncomment the following line # set -x
arch/powerpc/tools/gcc-check-mprofile-kernel.sh +0 -1
@@ -2,7 +2,6 @@ # SPDX-License-Identifier: GPL-2.0 set -e -set -o pipefail # To debug, uncomment the following line # set -x
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/312 platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shravan Kumar Ramani <[email protected]>
[ Upstream commit f13bce715d1600698310a4a7832f6a52499d5395 ]
Some event names have trailing whitespaces at the end which causes programming of counters using the name for these specific events to fail and hence need to be removed.
--- drivers/platform/mellanox/mlxbf-pmc.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/platform/mellanox/mlxbf-pmc.c +7 -7
@@ -801,18 +801,18 @@ static const struct mlxbf_pmc_events mlxbf_pmc_llt_miss_events[] = { {11, "GDC_MISS_MACHINE_CHI_TXDAT"}, {12, "GDC_MISS_MACHINE_CHI_RXDAT"}, {13, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC0_0"}, - {14, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC0_1 "}, + {14, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC0_1"}, {15, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC0_2"}, - {16, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC0_3 "}, - {17, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_0 "}, - {18, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_1 "}, - {19, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_2 "}, - {20, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_3 "}, + {16, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC0_3"}, + {17, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_0"}, + {18, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_1"}, + {19, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_2"}, + {20, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC1_3"}, {21, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE0_0"}, {22, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE0_1"}, {23, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE0_2"}, {24, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE0_3"}, - {25, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE1_0 "}, + {25, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE1_0"}, {26, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE1_1"}, {27, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE1_2"}, {28, "GDC_MISS_MACHINE_G_FIFO_FF_EXEC_DONE1_3"},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/312 platform/x86: msi-laptop: add missing sysfs_remove_group()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 1461209cf813b6ee6d40f29b96b544587df6d2b1 ]
A sysfs group is created in msi_init() when old_ec_model is enabled, but never removed. Remove the msipf_old_attribute_group in that case.
--- drivers/platform/x86/msi-laptop.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/msi-laptop.c +3 -0
@@ -1130,6 +1130,9 @@ static void __exit msi_cleanup(void)sysfs_remove_group (&msipf_device->dev.kobj, &msipf_attribute_group);if (!quirks->old_ec_model && threeg_exists)device_remove_file (&msipf_device->dev, &dev_attr_threeg); +if (quirks->old_ec_model) +sysfs_remove_group (&msipf_device->dev.kobj, + &msipf_old_attribute_group);platform_device_unregister (msipf_device);platform_driver_unregister (&msipf_driver);backlight_device_unregister (msibl_device);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/312 platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 15dd100349b8526cbdf2de0ce3e72e700eb6c208 ]
The ibm_rtl_init() function searches for the signature but has a pointer arithmetic error. The loop counter suggests searching at 4-byte intervals but the implementation only advances by 1 byte per iteration.
Fix by properly advancing the pointer by sizeof(unsigned int) bytes each iteration.
--- drivers/platform/x86/ibm_rtl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/ibm_rtl.c +1 -1
@@ -273,7 +273,7 @@ static int __init ibm_rtl_init(void) {/* search for the _RTL_ signature at the start of the table */ for (i =0 ; i < ebda_size/sizeof (unsigned int ); i++) {struct ibm_rtl_table __iomem * tmp; - tmp = (struct ibm_rtl_table __iomem *) (ebda_map+i); + tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof (unsigned int ));if ((readq (&tmp->signature) &RTL_MASK ) ==RTL_SIGNATURE ) {phys_addr_t addr;unsigned int plen;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/312 team: fix check for port enabled in team_queue_override_port_prio_changed()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Pirko <[email protected]>
[ Upstream commit 932ac51d9953eaf77a1252f79b656d4ca86163c6 ]
There has been a syzkaller bug reported recently with the following trace:
list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122)
------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59 Code: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d49f370 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000 RDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005 RBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230 R13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480 FS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_rcu include/linux/rculist.h:178 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline] team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline] team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534 team_option_set drivers/net/team/team_core.c:376 [inline] team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684 __sys_sendmsg+0x16d/0x220 net/socket.c:2716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The problem is in this flow:
1) Port is enabled, queue_id != 0, in qom_list
2) Port gets disabled
-> team_port_disable()
-> team_queue_override_port_del()
-> del (removed from list)
3) Port is disabled, queue_id != 0, not in any list
4) Priority changes
-> team_queue_override_port_prio_changed()
-> checks: port disabled && queue_id != 0
-> calls del - hits the BUG as it is removed alreadyTo fix this, change the check in team_queue_override_port_prio_changed() so it returns early if port is not enabled.
--- drivers/net/team/team_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/team/team_core.c +1 -1
@@ -878,7 +878,7 @@ static void __team_queue_override_enabled_check(struct team *team)static void team_queue_override_port_prio_changed (struct team *team,struct team_port *port) { -if (!port->queue_id ||team_port_enabled (port)) +if (!port->queue_id || !team_port_enabled (port))return ;__team_queue_override_port_del (team, port);__team_queue_override_port_add (team, port);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/312 net: airoha: Move net_devs registration in a dedicated routine
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 5e7365b5a1ac8f517a7a84442289d7de242deb76 ]
Since airoha_probe() is not executed under rtnl lock, there is small race where a given device is configured by user-space while the remaining ones are not completely loaded from the dts yet. This condition will allow a hw device misconfiguration since there are some conditions (e.g. GDM2 check in airoha_dev_init()) that require all device are properly loaded from the device tree. Fix the issue moving net_devices registration at the end of the airoha_probe routine.
--- drivers/net/ethernet/airoha/airoha_eth.c | 39 ++++++++++++++++-------- 1 file changed, 26 insertions(+), 13 deletions(-)
drivers/net/ethernet/airoha/airoha_eth.c +26 -13
@@ -2900,19 +2900,26 @@ static int airoha_alloc_gdm_port(struct airoha_eth *eth, port->id = id; eth->ports[p] = port; - err =airoha_metadata_dst_alloc (port); -if (err) -return err; +return airoha_metadata_dst_alloc (port); +} - err =register_netdev (dev); -if (err) - goto free_metadata_dst; +static int airoha_register_gdm_devices (struct airoha_eth *eth) +{ +int i; -return 0 ; +for (i =0 ; i <ARRAY_SIZE (eth->ports); i++) { +struct airoha_gdm_port *port = eth->ports[i]; +int err; -free_metadata_dst: -airoha_metadata_dst_free (port); -return err; +if (!port) +continue ; + + err =register_netdev (port->dev); +if (err) +return err; + } + +return 0 ; }static int airoha_probe (struct platform_device *pdev)
@@ -2993,6 +3000,10 @@ static int airoha_probe(struct platform_device *pdev) } } + err =airoha_register_gdm_devices (eth); +if (err) + goto error_napi_stop; +return 0 ; error_napi_stop:
@@ -3006,10 +3017,12 @@ static int airoha_probe(struct platform_device *pdev)for (i =0 ; i <ARRAY_SIZE (eth->ports); i++) {struct airoha_gdm_port *port = eth->ports[i]; -if (port && port->dev->reg_state ==NETREG_REGISTERED ) { +if (!port) +continue ; + +if (port->dev->reg_state ==NETREG_REGISTERED )unregister_netdev (port->dev); -airoha_metadata_dst_free (port); - } +airoha_metadata_dst_free (port); }free_netdev (eth->napi_dev);platform_set_drvdata (pdev,NULL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/312 net: dsa: properly keep track of conduit reference
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 06e219f6a706c367c93051f408ac61417643d2f9 ]
Problem description
-------------------
DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense.
There are two distinct problems.
1. The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch:
(unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind
we see these lines in the output diff which appear only with the patch applied:
kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)
kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)
2. After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()).
Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time between the initial of_find_net_device_by_node() code and the user port creation time, time during which the conduit could unregister itself and DSA wouldn't know about it.
So we have to run of_find_net_device_by_node() under rtnl_lock() to prevent that from happening, and release the lock only with the netdev tracker having acquired the reference.
Do we need to keep the reference until dsa_unregister_switch() / dsa_switch_shutdown()?
1: Maybe yes. A switch device will still be registered even if all user
ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal"), and the cpu_dp->conduit pointers remain valid. I haven't audited all call paths to see whether they will actually use the conduit in lack of any user port, but if they do, it seems safer to not rely on user ports for that reference.
2. Definitely yes. We support changing the conduit which a user port is associated to, and we can get into a situation where we've moved all user ports away from a conduit, thus no longer hold any reference to it via the net device tracker. But we shouldn't let it go nonetheless
- see the next change in relation to dsa_tree_find_first_conduit() and LAG conduits which disappear.
We have to be prepared to return to the physical conduit, so the CPU port must explicitly keep another reference to it. This is also to
say: the user ports and their CPU ports may not always keep a reference to the same conduit net device, and both are needed.
As for the conduit's kobject for the /sys/class/net/ entry, we don't care about it, we can release it as soon as we hold the net device object itself.
History and blame attribution
-----------------------------
The code has been refactored so many times, it is very difficult to follow and properly attribute a blame, but I'll try to make a short history which I hope to be correct.
We have two distinct probing paths:
- one for OF, introduced in 2016 in commit 83c0afaec7b7 ("net: dsa: Add new binding implementation")
- one for non-OF, introduced in 2017 in commit 71e0bbde0d88 ("net: dsa:
Add support for platform data")
These are both complete rewrites of the original probing paths (which used struct dsa_switch_driver and other weird stuff, instead of regular devices on their respective buses for register access, like MDIO, SPI, I2C etc):
- one for OF, introduced in 2013 in commit 5e95329b701c ("dsa: add device tree bindings to register DSA switches")
- one for non-OF, introduced in 2008 in commit 91da11f870f0 ("net:
Distributed Switch Architecture protocol support")
except for tiny bits and pieces like dsa_dev_to_net_device() which were seemingly carried over since the original commit, and used to this day.
The point is that the original probing paths received a fix in 2015 in the form of commit 679fb46c5785 ("net: dsa: Add missing master netdev dev_put() calls"), but the fix never made it into the "new" (dsa2) probing paths that can still be traced to today, and the fixed probing path was later deleted in 2019 in commit 93e86b3bc842 ("net: dsa: Remove legacy probing support").
That is to say, the new probing paths were never quite correct in this area.
The existence of the legacy probing support which was deleted in 2019 explains why dsa_dev_to_net_device() returns a conduit with elevated refcount (because it was supposed to be released during dsa_remove_dst()). After the removal of the legacy code, the only user of dsa_dev_to_net_device() calls dev_put(conduit) immediately after this function returns. This pattern makes no sense today, and can only be interpreted historically to understand why dev_hold() was there in the first place.
Change details
--------------
Today we have a better netdev tracking infrastructure which we should use. Logically netdev_hold() belongs in common code (dsa_port_parse_cpu(), where dp->conduit is assigned), but there is a tradeoff to be made with the rtnl_lock() section which would become a bit too long if we did that - dsa_port_parse_cpu() also calls request_module(). So we duplicate a bit of logic in order for the callers of dsa_port_parse_cpu() to be the ones responsible of holding the conduit reference and releasing it on error. This shortens the rtnl_lock() section significantly.
In the dsa_switch_probe() error path, dsa_switch_release_ports() will be called in a number of situations, one being where dsa_port_parse_cpu() maybe didn't get the chance to run at all (a different port failed earlier, etc). So we have to test for the conduit being NULL prior to calling netdev_put().
There have still been so many transformations to the code since the blamed commits (rename master -> conduit, commit 0650bf52b31f ("net:
dsa: be compatible with masters which unregister on shutdown")), that it only makes sense to fix the code using the best methods available today and see how it can be backported to stable later. I suspect the fix cannot even be backported to kernels which lack dsa_switch_shutdown(), and I suspect this is also maybe why the long-lived conduit reference didn't make it into the new DSA probing paths at the time (problems during shutdown).
Because dsa_dev_to_net_device() has a single call site and has to be changed anyway, the logic was just absorbed into the non-OF dsa_port_parse().
Tested on the ocelot/felix switch and on dsa_loop, both on the NXP LS1028A with CONFIG_DEBUG_KOBJECT_RELEASE=y.
--- include/net/dsa.h | 1 + net/dsa/dsa.c | 59 +++++++++++++++++++++++++++-------------------- 2 files changed, 35 insertions(+), 25 deletions(-)
include/net/dsa.h +1 -0
@@ -298,6 +298,7 @@ struct dsa_port {struct devlink_port devlink_port;struct phylink *pl;struct phylink_config pl_config; +netdevice_tracker conduit_tracker;struct dsa_lag *lag;struct net_device *hsr_dev;
net/dsa/dsa.c +34 -25
99 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/312 net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit a9f96dc59b4a50ffbf86158f315e115969172d48 ]
of_find_net_device_by_node() searches net devices by their /sys/class/net/, entry. It is documented in its kernel-doc that:
* If successful, returns a pointer to the net_device with the embedded
* struct device refcount incremented by one, or NULL on failure. The
* refcount must be dropped when done with the net_device.
We are missing a put_device(&conduit->dev) which we could place at the end of dsa_tree_find_first_conduit(). But to explain why calling put_device() right away is safe is the same as to explain why the chosen solution is different.
The code is very poorly split: dsa_tree_find_first_conduit() was first introduced in commit 95f510d0b792 ("net: dsa: allow the DSA master to be seen and changed through rtnetlink") but was first used several commits later, in commit acc43b7bf52a ("net: dsa: allow masters to join a LAG").
Assume there is a switch with 2 CPU ports and 2 conduits, eno2 and eno3. When we create a LAG (bonding or team device) and place eno2 and eno3 beneath it, we create a 3rd conduit (the LAG device itself), but this is slightly different than the first two.
Namely, the cpu_dp->conduit pointer of the CPU ports does not change, and remains pointing towards the physical Ethernet controllers which are now LAG ports. Only 2 things change:
- the LAG device has a dev->dsa_ptr which marks it as a DSA conduit
- dsa_port_to_conduit(user port) finds the LAG and not the physical conduit, because of the dp->cpu_port_in_lag bit being set.
When the LAG device is destroyed, dsa_tree_migrate_ports_from_lag_conduit() is called and this is where dsa_tree_find_first_conduit() kicks in.
This is the logical mistake and the reason why introducing code in one patch and using it from another is bad practice. I didn't realize that I don't have to call of_find_net_device_by_node() again; the cpu_dp->conduit association was never undone, and is still available for direct (re)use. There's only one concern - maybe the conduit disappeared in the meantime, but the netdev_hold() call we made during dsa_port_parse_cpu() (see previous change) ensures that this was not the case.
Therefore, fixing the code means reimplementing it in the simplest way.
I am blaming the time of use, since this is what "git blame" would show if we were to monitor for the conduit's kobject's refcount remaining elevated instead of being freed.
Tested on the NXP LS1028A, using the steps from Documentation/networking/dsa/configuration.rst section "Affinity of user ports to CPU ports", followed by (extra prints added by me):
$ ip link del bond0 mscc_felix 0000:00:00.5 swp3: Link is Down bond0 (unregistering): (slave eno2): Releasing backup interface fsl_enetc 0000:00:00.2 eno2: Link is Down mscc_felix 0000:00:00.5 swp0: bond0 disappeared, migrating to eno2 mscc_felix 0000:00:00.5 swp1: bond0 disappeared, migrating to eno2 mscc_felix 0000:00:00.5 swp2: bond0 disappeared, migrating to eno2 mscc_felix 0000:00:00.5 swp3: bond0 disappeared, migrating to eno2
--- net/dsa/dsa.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
net/dsa/dsa.c +1 -7
@@ -366,16 +366,10 @@ static struct dsa_port *dsa_tree_find_first_cpu(struct dsa_switch_tree *dst)struct net_device *dsa_tree_find_first_conduit (struct dsa_switch_tree *dst) { -struct device_node *ethernet; -struct net_device *conduit;struct dsa_port *cpu_dp; cpu_dp =dsa_tree_find_first_cpu (dst); - ethernet =of_parse_phandle (cpu_dp->dn,"ethernet" ,0 ); - conduit =of_find_net_device_by_node (ethernet); -of_node_put (ethernet); - -return conduit; +return cpu_dp->conduit; }/* Assign the default CPU port (the first one in the tree) to all ports of the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/312 amd-xgbe: reset retries and mode on RX adapt failures
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit df60c332caf95d70f967aeace826e7e2f0847361 ]
During the stress tests, early RX adaptation handshakes can fail, such as missing the RX_ADAPT ACK or not receiving a coefficient update before block lock is established. Continuing to retry RX adaptation in this state is often ineffective if the current mode selection is not viable.
Resetting the RX adaptation retry counter when an RX_ADAPT request fails to receive ACK or a coefficient update prior to block lock, and clearing mode_set so the next bring-up performs a fresh mode selection rather than looping on a likely invalid configuration.
--- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +2 -0
@@ -1927,6 +1927,7 @@ static void xgbe_set_rx_adap_mode(struct xgbe_prv_data *pdata, {if (pdata->rx_adapt_retries++ >=MAX_RX_ADAPT_RETRIES ) { pdata->rx_adapt_retries =0 ; + pdata->mode_set = false;return ; }
@@ -1973,6 +1974,7 @@ static void xgbe_rx_adaptation(struct xgbe_prv_data *pdata)*/ netif_dbg (pdata, link, pdata->netdev,"Block_lock done" ); pdata->rx_adapt_done = true; + pdata->rx_adapt_retries =0 ; pdata->mode_set = false;return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/312 selftests: drv-net: psp: fix templated test names in psp_ip_ver_test_builder()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Zahka <[email protected]>
[ Upstream commit d52668cac3f98f86aa1fb238dec1320c80fbefea ]
test_case will only take on its formatted name after it is called by the test runner. Move the assignment to test_case.__name__ to when the test_case is constructed, not called.
--- tools/testing/selftests/drivers/net/psp.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/drivers/net/psp.py +2 -1
@@ -560,8 +560,9 @@ def psp_ip_ver_test_builder(name, test_func, psp_ver, ipver): """Build test cases for each combo of PSP version and IP version""" def test_case(cfg): cfg.require_ipver(ipver) - test_case.__name__ = f"{name}_v{psp_ver}_ip{ipver}" test_func(cfg, psp_ver, ipver) + + test_case.__name__ = f"{name}_v{psp_ver}_ip{ipver}" return test_case
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/312 selftests: drv-net: psp: fix test names in ipver_test_builder()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Zahka <[email protected]>
[ Upstream commit f0e5126f5e55d4939784ff61b0b7e9f9636d787d ]
test_case will only take on the formatted name after being called. This does not work with the way ksft_run() currently works. Assign the name after the test_case is created.
--- tools/testing/selftests/drivers/net/psp.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/drivers/net/psp.py +2 -1
@@ -570,8 +570,9 @@ def ipver_test_builder(name, test_func, ipver): """Build test cases for each IP version""" def test_case(cfg): cfg.require_ipver(ipver) - test_case.__name__ = f"{name}_ip{ipver}" test_func(cfg, ipver) + + test_case.__name__ = f"{name}_ip{ipver}" return test_case
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/312 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepakkumar Karn <[email protected]>
[ Upstream commit 12cab1191d9890097171156d06bfa8d31f1e39c8 ]
In async_set_registers(), when usb_submit_urb() fails, the allocated
async_req structure and URB are not freed, causing a memory leak.
The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked.
Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails.
--- drivers/net/usb/rtl8150.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/rtl8150.c +2 -0
@@ -211,6 +211,8 @@ static int async_set_registers(rtl8150_t *dev, u16 indx, u16 size, u16 reg)if (res == -ENODEV )netif_device_detach (dev->netdev);dev_err (&dev->udev->dev,"%s failed with %d\n" , __func__, res); +kfree (req); +usb_free_urb (async_urb); }return res; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/312 selftests: net: fix "buffer overflow detected" for tap.c
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice C. Munduruca <[email protected]>
[ Upstream commit 472c5dd6b95c02b3e5d7395acf542150e91165e7 ]
When the selftest 'tap.c' is compiled with '-D_FORTIFY_SOURCE=3', the strcpy() in rtattr_add_strsz() is replaced with a checked version which causes the test to consistently fail when compiled with toolchains for which this option is enabled by default.
TAP version 13
1..3
# Starting 3 tests from 1 test cases.
# RUN tap.test_packet_valid_udp_gso ...
*** buffer overflow detected ***: terminated
# test_packet_valid_udp_gso: Test terminated by assertion
# FAIL tap.test_packet_valid_udp_gso
not ok 1 tap.test_packet_valid_udp_gso
# RUN tap.test_packet_valid_udp_csum ...
*** buffer overflow detected ***: terminated
# test_packet_valid_udp_csum: Test terminated by assertion
# FAIL tap.test_packet_valid_udp_csum
not ok 2 tap.test_packet_valid_udp_csum
# RUN tap.test_packet_crash_tap_invalid_eth_proto ...
*** buffer overflow detected ***: terminated
# test_packet_crash_tap_invalid_eth_proto: Test terminated by assertion
# FAIL tap.test_packet_crash_tap_invalid_eth_proto
not ok 3 tap.test_packet_crash_tap_invalid_eth_proto
# FAILED: 0 / 3 tests passed.
# Totals: pass:0 fail:3 xfail:0 xpass:0 skip:0 error:0
A buffer overflow is detected by the fortified glibc __strcpy_chk() since the __builtin_object_size() of RTA_DATA(rta) is incorrectly reported as 1, even though there is ample space in its bounding buffer req.
Additionally, given that IFLA_IFNAME also expects a null-terminated string, callers of rtaddr_add_str{,sz}() could simply use the rtaddr_add_strsz() variant. (which has been renamed to remove the trailing sz) memset() has been used for this function since it is unchecked and thus circumvents the issue discussed in the previous paragraph.
--- tools/testing/selftests/net/tap.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
tools/testing/selftests/net/tap.c +5 -11
@@ -56,18 +56,12 @@ static void rtattr_end(struct nlmsghdr *nh, struct rtattr *attr)static struct rtattr *rtattr_add_str (struct nlmsghdr *nh,unsigned short type,const char *s) { -struct rtattr *rta =rtattr_add (nh, type,strlen (s)); +unsigned int strsz =strlen (s) +1 ; +struct rtattr *rta; -memcpy (RTA_DATA (rta), s,strlen (s)); -return rta; -} - -static struct rtattr *rtattr_add_strsz (struct nlmsghdr *nh,unsigned short type, -const char *s) -{ -struct rtattr *rta =rtattr_add (nh, type,strlen (s) +1 ); + rta =rtattr_add (nh, type, strsz); -strcpy (RTA_DATA (rta), s); +memcpy (RTA_DATA (rta), s, strsz);return rta; }
@@ -119,7 +113,7 @@ static int dev_create(const char *dev, const char *link_type, link_info =rtattr_begin (&req.nh,IFLA_LINKINFO ); -rtattr_add_strsz (&req.nh,IFLA_INFO_KIND , link_type); +rtattr_add_str (&req.nh,IFLA_INFO_KIND , link_type);if (fill_info_data) { info_data =rtattr_begin (&req.nh,IFLA_INFO_DATA );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/312 net: wangxun: move PHYLINK dependency
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b94f11af9d9201426f4d6c8a753493fd58d6ac16 ]
The LIBWX library code is what calls into phylink, so any user of it has to select CONFIG_PHYLINK at the moment, with NGBEVF missing this:
x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_nway_reset':
wx_ethtool.c:(.text+0x613): undefined reference to `phylink_ethtool_nway_reset'
x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_get_link_ksettings':
wx_ethtool.c:(.text+0x62b): undefined reference to `phylink_ethtool_ksettings_get'
x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_set_link_ksettings':
wx_ethtool.c:(.text+0x643): undefined reference to `phylink_ethtool_ksettings_set'
x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_get_pauseparam':
wx_ethtool.c:(.text+0x65b): undefined reference to `phylink_ethtool_get_pauseparam'
x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_set_pauseparam':
wx_ethtool.c:(.text+0x677): undefined reference to `phylink_ethtool_set_pauseparam'
Add the 'select PHYLINK' line in the libwx option directly so this will always be enabled for all current and future wangxun drivers, and remove the now duplicate lines.
--- drivers/net/ethernet/wangxun/Kconfig | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/wangxun/Kconfig +1 -3
@@ -21,6 +21,7 @@ config LIBWX depends on PTP_1588_CLOCK_OPTIONAL select PAGE_POOL select DIMLIB + select PHYLINK help Common library for Wangxun(R) Ethernet drivers.
@@ -29,7 +30,6 @@ config NGBE depends on PCI depends on PTP_1588_CLOCK_OPTIONAL select LIBWX - select PHYLINK help This driver supports Wangxun(R) GbE PCI Express family of adapters.
@@ -48,7 +48,6 @@ config TXGBE depends on PTP_1588_CLOCK_OPTIONAL select MARVELL_10G_PHY select REGMAP - select PHYLINK select HWMON if TXGBE=y select SFP select GPIOLIB
@@ -71,7 +70,6 @@ config TXGBEVF depends on PCI_MSI depends on PTP_1588_CLOCK_OPTIONAL select LIBWX - select PHYLINK help This driver supports virtual functions for SP1000A, WX1820AL, WX5XXX, WX5XXXAL.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/312 platform/x86/intel/pmt: Fix kobject memory leak on init failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 00c22b1e84288bf0e17ab1e7e59d75237cf0d0dc ]
When kobject_init_and_add() fails in pmt_features_discovery(), the function returns without calling kobject_put(). This violates the kobject API contract where kobject_put() must be called even on initialization failure to properly release allocated resources.
--- drivers/platform/x86/intel/pmt/discovery.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/pmt/discovery.c +3 -1
@@ -503,8 +503,10 @@ static int pmt_features_discovery(struct pmt_features_priv *priv, ret =kobject_init_and_add (&feature->kobj, ktype, &priv->dev->kobj,"%s" , pmt_feature_names[feature->id]); -if (ret) +if (ret) { +kobject_put (&feature->kobj);return ret; + }kobject_uevent (&feature->kobj,KOBJ_ADD );pmt_features_add_feat (feature);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/312 smc91x: fix broken irq-context in PREEMPT_RT
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeoreum Yun <[email protected]>
[ Upstream commit 6402078bd9d1ed46e79465e1faaa42e3458f8a33 ]
When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC:
[ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000
[ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106]
[ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work
[ 13.062266] C
** replaying previous printk message **
[ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)}
[ 13.062353] Hardware name: , BIOS
[ 13.062382] Workqueue: mld mld_ifc_work
[ 13.062469] Call trace:
[ 13.062494] show_stack+0x24/0x40 (C)
[ 13.062602] __dump_stack+0x28/0x48
[ 13.062710] dump_stack_lvl+0x7c/0xb0
[ 13.062818] dump_stack+0x18/0x34
[ 13.062926] process_scheduled_works+0x294/0x450
[ 13.063043] worker_thread+0x260/0x3d8
[ 13.063124] kthread+0x1c4/0x228
[ 13.063235] ret_from_fork+0x10/0x20This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT,
but smc_special_unlock() does not restore IRQs on PREEMPT_RT.
The reason is that smc_special_unlock() calls spin_unlock_irqrestore(),
and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invokercu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero.
To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().
--- drivers/net/ethernet/smsc/smc91x.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
drivers/net/ethernet/smsc/smc91x.c +1 -9
@@ -516,15 +516,7 @@ static inline void smc_rcv(struct net_device *dev)* any other concurrent access and C would always interrupt B. But life * isn't that easy in a SMP world... */ -#define smc_special_trylock (lock, flags) \ -({ \ - int __ret; \ - local_irq_save(flags); \ - __ret = spin_trylock(lock); \ - if (!__ret) \ - local_irq_restore(flags); \ - __ret; \ -}) +#define smc_special_trylock (lock, flags) spin_trylock_irqsave(lock, flags)#define smc_special_lock (lock, flags) spin_lock_irqsave(lock, flags)#define smc_special_unlock (lock, flags) spin_unlock_irqrestore(lock, flags)#else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/312 genalloc.h: fix htmldocs warning
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Morton <[email protected]>
[ Upstream commit 5393802c94e0ab1295c04c94c57bcb00222d4674 ]
WARNING: include/linux/genalloc.h:52 function parameter 'start_addr' not described in 'genpool_algo_t'
--- include/linux/genalloc.h | 1 + 1 file changed, 1 insertion(+)
include/linux/genalloc.h +1 -0
@@ -44,6 +44,7 @@ struct gen_pool;* @nr: The number of zeroed bits we're looking for * @data: optional additional data used by the callback * @pool: the pool being allocated from +* @start_addr: start address of memory chunk */ typedef unsigned long (*genpool_algo_t)(unsigned long *map, unsigned long size,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/312 firewire: nosy: Fix dma_free_coherent() size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit c48c0fd0e19684b6ecdb4108a429e3a4e73f5e21 ]
It looks like the buffer allocated and mapped in add_card() is done with size RCV_BUFFER_SIZE which is 16 KB and 4KB.
--- drivers/firewire/nosy.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/firewire/nosy.c +5 -5
@@ -36,6 +36,8 @@static char driver_name[] =KBUILD_MODNAME ; +#define RCV_BUFFER_SIZE (16 * 1024) +/* this is the physical layout of a PCL, its size is 128 bytes */ struct pcl {__le32 next;
@@ -517,16 +519,14 @@ remove_card(struct pci_dev *dev) lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus);dma_free_coherent (&lynx->pci_device->dev,sizeof (struct pcl ), lynx->rcv_pcl, lynx->rcv_pcl_bus); -dma_free_coherent (&lynx->pci_device->dev,PAGE_SIZE , lynx->rcv_buffer, - lynx->rcv_buffer_bus); +dma_free_coherent (&lynx->pci_device->dev,RCV_BUFFER_SIZE , + lynx->rcv_buffer, lynx->rcv_buffer_bus);iounmap (lynx->registers);pci_disable_device (dev);lynx_put (lynx); } -#define RCV_BUFFER_SIZE (16 * 1024) -static int add_card (struct pci_dev *dev,const struct pci_device_id *unused) {
@@ -680,7 +680,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)dma_free_coherent (&lynx->pci_device->dev,sizeof (struct pcl ), lynx->rcv_pcl, lynx->rcv_pcl_bus);if (lynx->rcv_buffer) -dma_free_coherent (&lynx->pci_device->dev,PAGE_SIZE , +dma_free_coherent (&lynx->pci_device->dev,RCV_BUFFER_SIZE , lynx->rcv_buffer, lynx->rcv_buffer_bus);iounmap (lynx->registers);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/312 bng_en: update module description
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajashekar Hudumula <[email protected]>
[ Upstream commit d5dc28305143f126dc3d8da21e1ad75865b194e2 ]
The Broadcom BCM57708/800G NIC family is branded as ThorUltra. Update the driver description accordingly.
--- drivers/net/ethernet/broadcom/Kconfig | 8 ++++---- drivers/net/ethernet/broadcom/bnge/bnge.h | 2 +- drivers/net/ethernet/broadcom/bnge/bnge_core.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/ethernet/broadcom/Kconfig +4 -4
@@ -254,14 +254,14 @@ config BNXT_HWMON devices, via the hwmon sysfs interface. config BNGE - tristate "Broadcom Ethernet device support" + tristate "Broadcom ThorUltra Ethernet device support" depends on PCI select NET_DEVLINK select PAGE_POOL help - This driver supports Broadcom 50/100/200/400/800 gigabit Ethernet cards. - The module will be called bng_en. To compile this driver as a module, - choose M here. + This driver supports Broadcom ThorUltra 50/100/200/400/800 gigabit + Ethernet cards. The module will be called bng_en. To compile this + driver as a module, choose M here. config BCMASP tristate "Broadcom ASP 2.0 Ethernet support"
drivers/net/ethernet/broadcom/bnge/bnge.h +1 -1
@@ -5,7 +5,7 @@#define _BNGE_H_#define DRV_NAME "bng_en" -#define DRV_SUMMARY "Broadcom 800G Ethernet Linux Driver" +#define DRV_SUMMARY "Broadcom ThorUltra NIC Ethernet Driver"#include <linux/etherdevice.h> #include <linux/bnxt/hsi.h>
drivers/net/ethernet/broadcom/bnge/bnge_core.c +1 -1
@@ -19,7 +19,7 @@ char bnge_driver_name[] = DRV_NAME;static const struct {char *name; } board_info[] = { - [BCM57708 ] = {"Broadcom BCM57708 50Gb/100Gb/200Gb/400Gb/800Gb Ethernet" }, + [BCM57708 ] = {"Broadcom BCM57708 ThorUltra 50Gb/100Gb/200Gb/400Gb/800Gb Ethernet" }, };static const struct pci_device_id bnge_pci_tbl[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/312 net: dsa: b53: skip multicast entries for fdb_dump()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit d42bce414d1c5c0b536758466a1f63ac358e613c ]
port_fdb_dump() is supposed to only add fdb entries, but we iterate over the full ARL table, which also includes multicast entries.
So check if the entry is a multicast entry before passing it on to the callback().
Additionally, the port of those entries is a bitmask, not a port number, so any included entries would have even be for the wrong port.
--- drivers/net/dsa/b53/b53_common.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/dsa/b53/b53_common.c +3 -0
@@ -2155,6 +2155,9 @@ static int b53_fdb_copy(int port, const struct b53_arl_entry *ent,if (!ent->is_valid)return 0 ; +if (is_multicast_ether_addr (ent->mac)) +return 0 ; +if (port != ent->port)return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/312 kbuild: fix compilation of dtb specified on command-line without make rule
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas De Schampheleire <[email protected]>
[ Upstream commit b08fc4d0ec2466558f6d5511434efdfabbddf2a6 ]
Since commit e7e2941300d2 ("kbuild: split device tree build rules into scripts/Makefile.dtbs"), it is no longer possible to compile a device tree blob that is not specified in a make rule
like:
dtb-$(CONFIG_FOO) += foo.dtb
Before the mentioned commit, one could copy a dts file to e.g. arch/arm64/boot/dts/ (or a new subdirectory) and then convert it to a dtb file using:
make ARCH=arm64 foo.dtb
In this scenario, both 'dtb-y' and 'dtb-' are empty, and the inclusion of scripts/Makefile.dtbs relies on 'targets' to contain the MAKECMDGOALS. The value of 'targets', however, is only final later in the code.
Move the conditional include of scripts/Makefile.dtbs down to where the value of 'targets' is final. Since Makefile.dtbs updates 'always-y' which is used as a prerequisite in the build rule, the build rule also needs to move down.
--- scripts/Makefile.build | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
scripts/Makefile.build +14 -12
@@ -527,18 +527,6 @@ ifneq ($(userprogs),) include $(srctree)/scripts/Makefile.userprogs endif -ifneq ($(need-dtbslist)$(dtb-y)$(dtb-)$(filter %.dtb %.dtb.o %.dtbo.o,$(targets)),) -include $(srctree)/scripts/Makefile.dtbs -endif - -# Build -# --------------------------------------------------------------------------- - -$(obj)/: $(if $(KBUILD_BUILTIN), $(targets-for-builtin)) \ - $(if $(KBUILD_MODULES), $(targets-for-modules)) \ - $(subdir-ym) $(always-y) - @: - # Single targets # ---------------------------------------------------------------------------
@@ -568,6 +556,20 @@ FORCE: targets += $(filter-out $(single-subdir-goals), $(MAKECMDGOALS)) targets := $(filter-out $(PHONY), $(targets)) +# Now that targets is fully known, include dtb rules if needed +ifneq ($(need-dtbslist)$(dtb-y)$(dtb-)$(filter %.dtb %.dtb.o %.dtbo.o,$(targets)),) +include $(srctree)/scripts/Makefile.dtbs +endif + +# Build +# Needs to be after the include of Makefile.dtbs, which updates always-y +# --------------------------------------------------------------------------- + +$(obj)/: $(if $(KBUILD_BUILTIN), $(targets-for-builtin)) \ + $(if $(KBUILD_MODULES), $(targets-for-modules)) \ + $(subdir-ym) $(always-y) + @: + # Read all saved command lines and dependencies for the $(targets) we # may be building above, using $(if_changed{,_dep}). As an # optimization, we don't need to read them if the target does not
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/312 mcb: Add missing modpost build support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Javier Rodriguez Barbarin <[email protected]>
[ Upstream commit 1f4ea4838b13c3b2278436a8dcb148e3c23f4b64 ]
mcb bus is not prepared to autoload client drivers with the data defined on the drivers' MODULE_DEVICE_TABLE. modpost cannot access to mcb_table_id inside MODULE_DEVICE_TABLE so the data declared inside is ignored.
Add modpost build support for accessing to the mcb_table_id coded on device drivers' MODULE_DEVICE_TABLE.
--- scripts/mod/devicetable-offsets.c | 3 +++ scripts/mod/file2alias.c | 9 +++++++++ 2 files changed, 12 insertions(+)
scripts/mod/devicetable-offsets.c +3 -0
@@ -198,6 +198,9 @@ int main(void)DEVID (cpu_feature);DEVID_FIELD (cpu_feature, feature); +DEVID (mcb_device_id); +DEVID_FIELD (mcb_device_id, device); +DEVID (mei_cl_device_id);DEVID_FIELD (mei_cl_device_id, name);DEVID_FIELD (mei_cl_device_id, uuid);
scripts/mod/file2alias.c +9 -0
@@ -1110,6 +1110,14 @@ static void do_cpu_entry(struct module *mod, void *symval)module_alias_printf (mod, false,"cpu:type:*:feature:*%04X*" , feature); } +/* Looks like: mcb:16zN */ +static void do_mcb_entry (struct module *mod,void *symval) +{ +DEF_FIELD (symval, mcb_device_id, device); + +module_alias_printf (mod, false,"mcb:16z%03d" , device); +} +/* Looks like: mei:S:uuid:N:* */ static void do_mei_entry (struct module *mod,void *symval) {
@@ -1444,6 +1452,7 @@ static const struct devtable devtable[] = { {"mipscdmm", SIZE_mips_cdmm_device_id, do_mips_cdmm_entry}, {"x86cpu", SIZE_x86_cpu_id, do_x86cpu_entry}, {"cpu", SIZE_cpu_feature, do_cpu_entry}, + {"mcb", SIZE_mcb_device_id, do_mcb_entry}, {"mei", SIZE_mei_cl_device_id, do_mei_entry}, {"rapidio", SIZE_rio_device_id, do_rio_entry}, {"ulpi", SIZE_ulpi_device_id, do_ulpi_entry},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/312 net: mdio: rtl9300: use scoped for loops
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit a4f800c4487dc5d6fcc28da89c7cc3c187ccc731 ]
Currently in the return path, fwnode_handle_put calls are missing. Just use _scoped to avoid the issue.
--- drivers/net/mdio/mdio-realtek-rtl9300.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/mdio/mdio-realtek-rtl9300.c +2 -4
@@ -354,7 +354,6 @@ static int rtl9300_mdiobus_probe_one(struct device *dev, struct rtl9300_mdio_pri struct fwnode_handle *node) {struct rtl9300_mdio_chan *chan; -struct fwnode_handle *child;struct mii_bus *bus;u32 mdio_bus;int err;
@@ -371,7 +370,7 @@ static int rtl9300_mdiobus_probe_one(struct device *dev, struct rtl9300_mdio_pri* compatible = "ethernet-phy-ieee802.3-c45". This does mean we can't * support both c45 and c22 on the same MDIO bus. */ -fwnode_for_each_child_node (node, child) +fwnode_for_each_child_node_scoped (node, child)if (fwnode_device_is_compatible (child,"ethernet-phy-ieee802.3-c45" )) priv->smi_bus_is_c45[mdio_bus] = true;
@@ -409,7 +408,6 @@ static int rtl9300_mdiobus_map_ports(struct device *dev) {struct rtl9300_mdio_priv *priv =dev_get_drvdata (dev);struct device *parent = dev->parent; -struct fwnode_handle *port;int err; struct fwnode_handle *ports __free(fwnode_handle) =
@@ -418,7 +416,7 @@ static int rtl9300_mdiobus_map_ports(struct device *dev)return dev_err_probe (dev, -EINVAL ,"%pfwP missing ethernet-ports\n" ,dev_fwnode (parent)); -fwnode_for_each_child_node (ports, port) { +fwnode_for_each_child_node_scoped (ports, port) {struct device_node *mdio_dn;u32 addr;u32 bus;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/312 net: usb: asix: validate PHY address before use
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit a1e077a3f76eea0dc671ed6792e7d543946227e8 ]
The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy():
addr 207 out of range
WARNING: drivers/net/phy/mdio_bus.c:76
Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c.
--- drivers/net/usb/asix_common.c | 5 +++++ drivers/net/usb/ax88172a.c | 6 +----- 2 files changed, 6 insertions(+), 5 deletions(-)
drivers/net/usb/asix_common.c +5 -0
@@ -335,6 +335,11 @@ int asix_read_phy_addr(struct usbnet *dev, bool internal) offset = (internal ?1 :0 ); ret = buf[offset]; +if (ret >=PHY_MAX_ADDR ) { +netdev_err (dev->net,"invalid PHY address: %d\n" , ret); +return -ENODEV ; + } +netdev_dbg (dev->net,"%s PHY address 0x%x\n" , internal ?"internal" :"external" , ret);
drivers/net/usb/ax88172a.c +1 -5
@@ -210,11 +210,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) ret =asix_read_phy_addr (dev, priv->use_embdphy);if (ret <0 ) goto free; -if (ret >=PHY_MAX_ADDR ) { -netdev_err (dev->net,"Invalid PHY address %#x\n" , ret); - ret = -ENODEV ; - goto free; - } + priv->phy_addr = ret;ax88172a_reset_phy (dev, priv->use_embdphy);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/312 net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit f79f9b7ace1713e4b83888c385f5f55519dfb687 ]
Sphinx reports kernel-doc warning:
WARNING: ./net/bridge/br_private.h:267 struct member 'tunnel_hash' not described in 'net_bridge_vlan_group'
Fix it by describing @tunnel_hash member.
--- net/bridge/br_private.h | 1 + 1 file changed, 1 insertion(+)
net/bridge/br_private.h +1 -0
@@ -247,6 +247,7 @@ struct net_bridge_vlan {* struct net_bridge_vlan_group * * @vlan_hash: VLAN entry rhashtable +* @tunnel_hash: Hash table to map from tunnel key ID (e.g. VXLAN VNI) to VLAN * @vlan_list: sorted VLAN entry list * @num_vlans: number of total VLAN entries * @pvid: PVID VLAN id
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/312 tools/sched_ext: fix scx_show_state.py for scx_root change
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit f92ff79ba2640fc482bf2bfb5b42e33957f90caf ]
Commit 48e126777386 ("sched_ext: Introduce scx_sched") introduced scx_root and removed scx_ops, causing scx_show_state.py to fail when searching for the 'scx_ops' object. [1]
Fix by using 'scx_root' instead, with NULL pointer handling.
[1]
# drgn -s vmlinux ./tools/sched_ext/scx_show_state.py
Traceback (most recent call last):
File "/root/.venv/bin/drgn", line 8, in <module>
sys.exit(_main())
~~~~~^^
File "/root/.venv/lib64/python3.14/site-packages/drgn/cli.py", line 625, in _main
runpy.run_path(
~~~~~~~~~~~~~~^
script_path, init_globals={"prog": prog}, run_name="__main__"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "<frozen runpy>", line 287, in run_path
File "<frozen runpy>", line 98, in _run_module_code
File "<frozen runpy>", line 88, in _run_code
File "./tools/sched_ext/scx_show_state.py", line 30, in <module>
ops = prog['scx_ops']
~~~~^^^^^^^^^^^
_drgn.ObjectNotFoundError: could not find 'scx_ops'--- tools/sched_ext/scx_show_state.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/sched_ext/scx_show_state.py +5 -2
@@ -27,10 +27,13 @@ def read_static_key(name): def state_str(state): return prog['scx_enable_state_str'][state].string_().decode() -ops = prog['scx_ops'] +root = prog['scx_root'] enable_state = read_atomic("scx_enable_state_var") -print(f'ops : {ops.name.string_().decode()}') +if root: + print(f'ops : {root.ops.name.string_().decode()}') +else: + print('ops : ') print(f'enabled : {read_static_key("__scx_enabled")}') print(f'switching_all : {read_int("scx_switching_all")}') print(f'switched_all : {read_static_key("__scx_switched_all")}')
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/312 vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 665077d78dc7941ce6a330c02023a2b469cc8cc7 ]
pds_vfio_dirty_enable() allocates memory for region_info. If interval_tree_iter_first() returns NULL, the function returns -EINVAL immediately without freeing the allocated memory, causing a memory leak.
Fix this by jumping to the out_free_region_info label to ensure region_info is freed.
--- drivers/vfio/pci/pds/dirty.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/vfio/pci/pds/dirty.c +5 -2
@@ -292,8 +292,11 @@ static int pds_vfio_dirty_enable(struct pds_vfio_pci_device *pds_vfio, len = num_ranges *sizeof (*region_info); node =interval_tree_iter_first (ranges,0 ,ULONG_MAX ); -if (!node) -return -EINVAL ; +if (!node) { + err = -EINVAL ; + goto out_free_region_info; + } +for (int i =0 ; i < num_ranges; i++) {struct pds_lm_dirty_region_info *ri = ®ion_info[i];u64 region_size = node->last - node->start +1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/312 platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit e44c42c830b7ab36e3a3a86321c619f24def5206 ]
The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities.
These functions parse ACPI packages into internal data structures using a for loop with index variable 'elem' that iterates through enum_obj/integer_obj/order_obj/password_obj/string_obj arrays.
When processing multi-element fields like PREREQUISITES and ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array elements using expressions like 'enum_obj[elem + reqs]' and 'enum_obj[elem + pos_values]' within nested loops.
The bug is that the bounds check only validated elem, but did not consider the additional offset when accessing elem + reqs or elem + pos_values.
The fix changes the bounds check to validate the actual accessed index.
--- drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c | 4 ++-- drivers/platform/x86/hp/hp-bioscfg/int-attributes.c | 2 +- drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c | 5 +++++ drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 5 +++++ drivers/platform/x86/hp/hp-bioscfg/string-attributes.c | 2 +- 5 files changed, 14 insertions(+), 4 deletions(-)
drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c +2 -2
@@ -207,7 +207,7 @@ static int hp_populate_enumeration_elements_from_package(union acpi_object *enumcase PREREQUISITES : size =min_t (u32, enum_data->common.prerequisites_size,MAX_PREREQUISITES_SIZE );for (reqs =0 ; reqs < size; reqs++) { -if (elem >= enum_obj_count) { +if (elem + reqs >= enum_obj_count) {pr_err ("Error enum-objects package is too small\n" );return -EINVAL ; }
@@ -255,7 +255,7 @@ static int hp_populate_enumeration_elements_from_package(union acpi_object *enumfor (pos_values =0 ; pos_values < size && pos_values <MAX_VALUES_SIZE ; pos_values++) { -if (elem >= enum_obj_count) { +if (elem + pos_values >= enum_obj_count) {pr_err ("Error enum-objects package is too small\n" );return -EINVAL ; }
drivers/platform/x86/hp/hp-bioscfg/int-attributes.c +1 -1
@@ -227,7 +227,7 @@ static int hp_populate_integer_elements_from_package(union acpi_object *integer_ size =min_t (u32, integer_data->common.prerequisites_size,MAX_PREREQUISITES_SIZE );for (reqs =0 ; reqs < size; reqs++) { -if (elem >= integer_obj_count) { +if (elem + reqs >= integer_obj_count) {pr_err ("Error elem-objects package is too small\n" );return -EINVAL ; }
drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c +5 -0
@@ -216,6 +216,11 @@ static int hp_populate_ordered_list_elements_from_package(union acpi_object *ord size =min_t (u32, ordered_list_data->common.prerequisites_size,MAX_PREREQUISITES_SIZE );for (reqs =0 ; reqs < size; reqs++) { +if (elem + reqs >= order_obj_count) { +pr_err ("Error elem-objects package is too small\n" ); +return -EINVAL ; + } + ret =hp_convert_hexstr_to_str (order_obj[elem + reqs].string.pointer, order_obj[elem + reqs].string.length, &str_value, &value_len);
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c +5 -0
@@ -303,6 +303,11 @@ static int hp_populate_password_elements_from_package(union acpi_object *passwor MAX_PREREQUISITES_SIZE);for (reqs =0 ; reqs < size; reqs++) { +if (elem + reqs >= password_obj_count) { +pr_err ("Error elem-objects package is too small\n" ); +return -EINVAL ; + } + ret =hp_convert_hexstr_to_str (password_obj[elem + reqs].string.pointer, password_obj[elem + reqs].string.length, &str_value, &value_len);
drivers/platform/x86/hp/hp-bioscfg/string-attributes.c +1 -1
@@ -217,7 +217,7 @@ static int hp_populate_string_elements_from_package(union acpi_object *string_ob MAX_PREREQUISITES_SIZE);for (reqs =0 ; reqs < size; reqs++) { -if (elem >= string_obj_count) { +if (elem + reqs >= string_obj_count) {pr_err ("Error elem-objects package is too small\n" );return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/312 platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 66e245db16f0175af656cd812b6dc1a5e1f7b80a ]
The PMT feature probe creates a child device with device_create(). If device creation fail, the code pass priv->dev (which is an ERR_PTR) to dev_err_probe(), which is not a valid device pointer.
This patch change the dev_err_probe() call to use the parent auxiliary device (&auxdev->dev) and update the error message to reference the parent device name. It ensure correct error reporting and avoid passing an invalid device pointer.
--- drivers/platform/x86/intel/pmt/discovery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/intel/pmt/discovery.c +2 -2
@@ -548,9 +548,9 @@ static int pmt_features_probe(struct auxiliary_device *auxdev, const struct auxi priv->dev =device_create (&intel_pmt_class, &auxdev->dev,MKDEV (0 ,0 ), priv,"%s-%s" ,"features" ,dev_name (priv->parent));if (IS_ERR (priv->dev)) -return dev_err_probe (priv->dev,PTR_ERR (priv->dev), +return dev_err_probe (&auxdev->dev,PTR_ERR (priv->dev),"Could not create %s-%s device node\n" , -"features" ,dev_name (priv->dev)); +"features" ,dev_name (priv->parent));/* Initialize each feature */ for (i =0 ; i < ivdev->num_resources; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/312 octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anshumali Gaur <[email protected]>
[ Upstream commit 85f4b0c650d9f9db10bda8d3acfa1af83bf78cf7 ]
This patch ensures that the RX ring size (rx_pending) is not set below the permitted length. This avoids UBSAN shift-out-of-bounds errors when users passes small or zero ring sizes via ethtool -G.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +8 -0
@@ -418,6 +418,14 @@ static int otx2_set_ringparam(struct net_device *netdev,*/ if (rx_count < pfvf->hw.rq_skid) rx_count = pfvf->hw.rq_skid; + +if (ring->rx_pending <16 ) { +netdev_err (netdev, +"rx ring size %u invalid, min is 16\n" , + ring->rx_pending); +return -EINVAL ; + } + rx_count =Q_COUNT (Q_SIZE (rx_count,3 ));/* Due pipelining impact minimum 2000 unused SQ CQE's
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/312 net: stmmac: fix the crash issue for zero copy XDP_TX action
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit a48e232210009be50591fdea8ba7c07b0f566a13 ]
There is a crash issue when running zero copy XDP_TX action, the crash log is shown below.
[ 216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000 [ 216.187524] Internal error: Oops: 0000000096000144 [#1] SMP [ 216.301694] Call trace: [ 216.304130] dcache_clean_poc+0x20/0x38 (P) [ 216.308308] __dma_sync_single_for_device+0x1bc/0x1e0 [ 216.313351] stmmac_xdp_xmit_xdpf+0x354/0x400 [ 216.317701] __stmmac_xdp_run_prog+0x164/0x368 [ 216.322139] stmmac_napi_poll_rxtx+0xba8/0xf00 [ 216.326576] __napi_poll+0x40/0x218 [ 216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt
For XDP_TX action, the xdp_buff is converted to xdp_frame by xdp_convert_buff_to_frame(). The memory type of the resulting xdp_frame depends on the memory type of the xdp_buff. For page pool based xdp_buff it produces xdp_frame with memory type MEM_TYPE_PAGE_POOL. For zero copy XSK pool based xdp_buff it produces xdp_frame with memory type MEM_TYPE_PAGE_ORDER0. However, stmmac_xdp_xmit_back() does not check the memory type and always uses the page pool type, this leads to invalid mappings and causes the crash. Therefore, check the xdp_buff memory type in stmmac_xdp_xmit_back() to fix this issue.
--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +15 -2
@@ -88,6 +88,7 @@ MODULE_PARM_DESC(phyaddr, "Physical device address");#define STMMAC_XDP_CONSUMED BIT(0)#define STMMAC_XDP_TX BIT(1)#define STMMAC_XDP_REDIRECT BIT(2) +#define STMMAC_XSK_CONSUMED BIT(3)static int flow_ctrl =0xdead ;module_param (flow_ctrl, int,0644 );
@@ -4988,6 +4989,7 @@ static int stmmac_xdp_get_tx_queue(struct stmmac_priv *priv,static int stmmac_xdp_xmit_back (struct stmmac_priv *priv,struct xdp_buff *xdp) { +bool zc = !!(xdp->rxq->mem.type ==MEM_TYPE_XSK_BUFF_POOL );struct xdp_frame *xdpf =xdp_convert_buff_to_frame (xdp);int cpu =smp_processor_id ();struct netdev_queue *nq;
@@ -5004,9 +5006,18 @@ static int stmmac_xdp_xmit_back(struct stmmac_priv *priv,/* Avoids TX time-out as we are sharing with slow path */ txq_trans_cond_update (nq); - res =stmmac_xdp_xmit_xdpf (priv, queue, xdpf, false); -if (res ==STMMAC_XDP_TX ) +/* For zero copy XDP_TX action, dma_map is true */ + res =stmmac_xdp_xmit_xdpf (priv, queue, xdpf, zc); +if (res ==STMMAC_XDP_TX ) {stmmac_flush_tx_descriptors (priv, queue); + }else if (res ==STMMAC_XDP_CONSUMED && zc) { +/* xdp has been freed by xdp_convert_buff_to_frame(), +* no need to call xsk_buff_free() again, so return +* STMMAC_XSK_CONSUMED. +*/ + res =STMMAC_XSK_CONSUMED ; +xdp_return_frame (xdpf); + }__netif_tx_unlock (nq);
@@ -5356,6 +5367,8 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)break ;case STMMAC_XDP_CONSUMED :xsk_buff_free (buf->xdp); + fallthrough; +case STMMAC_XSK_CONSUMED : rx_dropped++;break ;case STMMAC_XDP_TX :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/312 ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Rosenberg <[email protected]>
[ Upstream commit 58fc7342b529803d3c221101102fe913df7adb83 ]
There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head().
This bug is triggered as part of the calipso_skbuff_setattr() routine when skb_cow() is passed headroom > INT_MAX (i.e. (int)(skb_headroom(skb) + len_delta) < 0).
The root cause of the bug is due to an implicit integer cast in __skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure that delta = headroom - skb_headroom(skb) is never negative, otherwise we will trigger a BUG_ON in pskb_expand_head(). However, if headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta becomes negative, and pskb_expand_head() is passed a negative value for nhead.
Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing "negative" headroom sizes to skb_cow() within calipso_skbuff_setattr() by only using skb_cow() to grow headroom.
PoC:
Using `netlabelctl` tool:
netlabelctl map del default
netlabelctl calipso add pass doi:7
netlabelctl map add default address:0::1/128 protocol:calipso,7
Then run the following PoC:
int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
// setup msghdr
int cmsg_size = 2;
int cmsg_len = 0x60;
struct msghdr msg;
struct sockaddr_in6 dest_addr;
struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1,
sizeof(struct cmsghdr) + cmsg_len);
msg.msg_name = &dest_addr;
msg.msg_namelen = sizeof(dest_addr);
msg.msg_iov = NULL;
msg.msg_iovlen = 0;
msg.msg_control = cmsg;
msg.msg_controllen = cmsg_len;
msg.msg_flags = 0;
// setup sockaddr
dest_addr.sin6_family = AF_INET6;
dest_addr.sin6_port = htons(31337);
dest_addr.sin6_flowinfo = htonl(31337);
dest_addr.sin6_addr = in6addr_loopback;
dest_addr.sin6_scope_id = 31337;
// setup cmsghdr
cmsg->cmsg_len = cmsg_len;
cmsg->cmsg_level = IPPROTO_IPV6;
cmsg->cmsg_type = IPV6_HOPOPTS;
char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80
sendmsg(fd, &msg, 0);--- net/ipv6/calipso.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/calipso.c +2 -1
@@ -1342,7 +1342,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,/* At this point new_end aligns to 4n, so (new_end & 4) pads to 8n */ pad = ((new_end &4 ) + (end &7 )) &7 ; len_delta = new_end - (int )end + pad; - ret_val =skb_cow (skb,skb_headroom (skb) + len_delta); + ret_val =skb_cow (skb, +skb_headroom (skb) + (len_delta >0 ? len_delta :0 ));if (ret_val <0 )return ret_val;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/312 ipv4: Fix reference count leak when using error routes with nexthop objects
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit ac782f4e3bfcde145b8a7f8af31d9422d94d172a ]
When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes that are using the dead nexthop.
The current logic in fib_table_flush() is to only flush error routes (e.g., blackhole) when it is called as part of network namespace dismantle (i.e., with flush_all=true). Therefore, error routes are not flushed when their nexthop object is deleted:
# ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip route add 198.51.100.1/32 nhid 1 # ip route add blackhole 198.51.100.2/32 nhid 1 # ip nexthop del id 1 # ip route show blackhole 198.51.100.2 nhid 1 dev dummy1
As such, they keep holding a reference on the nexthop object which in turn holds a reference on the nexthop device, resulting in a reference count leak:
# ip link del dev dummy1 [ 70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2
Fix by flushing error routes when their nexthop is marked as dead.
IPv6 does not suffer from this problem.
--- net/ipv4/fib_trie.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/ipv4/fib_trie.c +4 -3
@@ -2053,10 +2053,11 @@ int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)continue ; } -/* Do not flush error routes if network namespace is -* not being dismantled +/* When not flushing the entire table, skip error +* routes that are not marked for deletion. */ -if (!flush_all && fib_props[fa->fa_type].error) { +if (!flush_all && fib_props[fa->fa_type].error && + !(fi->fib_flags &RTNH_F_DEAD )) { slen = fa->fa_slen;continue ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/312 net: fib: restore ECMP balance from loopback
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Fedorenko <[email protected]>
[ Upstream commit 6e17474aa9fe15015c9921a5081c7ca71783aac6 ]
Preference of nexthop with source address broke ECMP for packets with source addresses which are not in the broadcast domain, but rather added to loopback/dummy interfaces. Original behaviour was to balance over nexthops while now it uses the latest nexthop from the group. To fix the issue introduce next hop scoring system where next hops with source address equal to requested will always have higher priority.
For the case with 198.51.100.1/32 assigned to dummy0 and routed using 192.0.2.0/24 and 203.0.113.0/24 networks:
2: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether d6:54:8a:ff:78:f5 brd ff:ff:ff:ff:ff:ff
inet 198.51.100.1/32 scope global dummy0
valid_lft forever preferred_lft forever
7: veth1@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 06:ed:98:87:6d:8a brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 192.0.2.2/24 scope global veth1
valid_lft forever preferred_lft forever
inet6 fe80::4ed:98ff:fe87:6d8a/64 scope link proto kernel_ll
valid_lft forever preferred_lft forever
9: veth3@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether ae:75:23:38:a0:d2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 203.0.113.2/24 scope global veth3
valid_lft forever preferred_lft forever
inet6 fe80::ac75:23ff:fe38:a0d2/64 scope link proto kernel_ll
valid_lft forever preferred_lft forever~ ip ro list:
default
nexthop via 192.0.2.1 dev veth1 weight 1 nexthop via 203.0.113.1 dev veth3 weight 1
192.0.2.0/24 dev veth1 proto kernel scope link src 192.0.2.2 203.0.113.0/24 dev veth3 proto kernel scope link src 203.0.113.2
before:
for i in {1..255} ; do ip ro get 10.0.0.$i; done | grep veth | awk ' {print $(NF-2)}' | sort | uniq -c:
255 veth3
after:
for i in {1..255} ; do ip ro get 10.0.0.$i; done | grep veth | awk ' {print $(NF-2)}' | sort | uniq -c:
122 veth1
133 veth3--- net/ipv4/fib_semantics.c | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-)
net/ipv4/fib_semantics.c +10 -16
@@ -2167,8 +2167,8 @@ void fib_select_multipath(struct fib_result *res, int hash, {struct fib_info *fi = res->fi;struct net *net = fi->fib_net; -bool found = false;bool use_neigh; +int score =-1 ;__be32 saddr;if (unlikely (res->fi->nh)) {
@@ -2180,7 +2180,7 @@ void fib_select_multipath(struct fib_result *res, int hash, saddr = fl4 ? fl4->saddr :0 ;change_nexthops (fi) { -int nh_upper_bound; +int nh_upper_bound, nh_score =0 ;/* Nexthops without a carrier are assigned an upper bound of * minus one when "ignore_routes_with_linkdown" is set.
@@ -2190,24 +2190,18 @@ void fib_select_multipath(struct fib_result *res, int hash, (use_neigh && !fib_good_nh(nexthop_nh)))continue ; -if (!found) { +if (saddr && nexthop_nh->nh_saddr == saddr) + nh_score +=2 ; +if (hash <= nh_upper_bound) + nh_score++; +if (score < nh_score) { res->nh_sel = nhsel; res->nhc = &nexthop_nh->nh_common; - found = !saddr || nexthop_nh->nh_saddr == saddr; +if (nh_score ==3 || (!saddr && nh_score ==1 )) +return ; + score = nh_score; } -if (hash > nh_upper_bound) -continue ; - -if (!saddr || nexthop_nh->nh_saddr == saddr) { - res->nh_sel = nhsel; - res->nhc = &nexthop_nh->nh_common; -return ; - } - -if (found) - return; - }endfor_nexthops (fi); }#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/312 net: rose: fix invalid array index in rose_kill_by_device()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pwnverse <[email protected]>
[ Upstream commit 6595beb40fb0ec47223d3f6058ee40354694c8e4 ]
rose_kill_by_device() collects sockets into a local array[] and then iterates over them to disconnect sockets bound to a device being brought down.
The loop mistakenly indexes array[cnt] instead of array[i]. For cnt < ARRAY_SIZE(array), this reads an uninitialized entry; for cnt == ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to an invalid socket pointer dereference and also leaks references taken via sock_hold().
Fix the index to use i.
--- net/rose/af_rose.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rose/af_rose.c +1 -1
@@ -205,7 +205,7 @@ static void rose_kill_by_device(struct net_device *dev)spin_unlock_bh (&rose_list_lock);for (i =0 ; i < cnt; i++) { - sk = array[cnt]; + sk = array[i]; rose =rose_sk (sk);lock_sock (sk);spin_lock_bh (&rose_list_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/312 ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 1adaea51c61b52e24e7ab38f7d3eba023b2d050d ]
On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes execution, its cmpxchg() in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding mdelay() after rt6_get_pcpu_route().
Using preempt_disable/enable is not appropriate here because ip6_rt_pcpu_alloc() may sleep.
Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT:
free our allocation and return the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels where such races should not occur.
--- net/ipv6/route.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
net/ipv6/route.c +12 -1
@@ -1470,7 +1470,18 @@ static struct rt6_info *rt6_make_pcpu_route(struct net *net, p =this_cpu_ptr (res->nh->rt6i_pcpu); prev =cmpxchg (p,NULL , pcpu_rt); -BUG_ON (prev); +if (unlikely (prev)) { +/* +* Another task on this CPU already installed a pcpu_rt. +* This can happen on PREEMPT_RT where preemption is possible. +* Free our allocation and return the existing one. +*/ +WARN_ON_ONCE (!IS_ENABLED (CONFIG_PREEMPT_RT )); + +dst_dev_put (&pcpu_rt->dst); +dst_release (&pcpu_rt->dst); +return prev; + }if (res->f6i->fib6_destroying) {struct fib6_info *from;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/312 RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 2dc675f614850b80deab7cf6d12902636ed8a7f4 ]
On a few 32-bit architectures, the newly added ib_user_service_rec structure is not 64-bit aligned the way it is on most regular ones.
Add explicit padding into the rdma_ucm_query_ib_service_resp and rdma_ucm_resolve_ib_service structures that embed it, so that the layout is compatible across all of them.
This is an ABI change on i386, aligning it with x86_64 and the other 64-bit architectures to avoid having to use a compat ioctl handler.
--- include/uapi/rdma/rdma_user_cm.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/uapi/rdma/rdma_user_cm.h +3 -1
@@ -192,6 +192,7 @@ struct rdma_ucm_query_path_resp {struct rdma_ucm_query_ib_service_resp {__u32 num_service_recs; +__u32 reserved;struct ib_user_service_rec recs[]; };
@@ -354,7 +355,7 @@ enum {#define RDMA_USER_CM_IB_SERVICE_NAME_SIZE 64struct rdma_ucm_ib_service { -__u64 service_id; +__aligned_u64 service_id;__u8 service_name[RDMA_USER_CM_IB_SERVICE_NAME_SIZE ];__u32 flags;__u32 reserved;
@@ -362,6 +363,7 @@ struct rdma_ucm_ib_service {struct rdma_ucm_resolve_ib_service {__u32 id; +__u32 reserved;struct rdma_ucm_ib_service ibs; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/312 RDMA/irdma: Fix irdma_alloc_ucontext_resp padding
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit d95e99a74eaf35c070f5939295331e5d7857c723 ]
A recent commit modified struct irdma_alloc_ucontext_resp by adding a member with implicit padding in front of it, though this does not change the offset of the data members other than m68k. Reported by scripts/check-uapi.sh:
==== ABI differences detected in include/rdma/irdma-abi.h from 1dd7bde2e91c -> HEAD ====
[C] 'struct irdma_alloc_ucontext_resp' changed:
type size changed from 704 to 640 (in bits)
1 data member deletion:
'__u8 rsvd3[2]', at offset 640 (in bits) at irdma-abi.h:61:1
1 data member insertion:
'__u8 revd3[2]', at offset 592 (in bits) at irdma-abi.h:60:1
Change the size back to the previous version, and remove the implicit padding by making it explicit and matching what x86-64 would do by placing max_hw_srq_quanta member into a naturally aligned location.
--- include/uapi/rdma/irdma-abi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/rdma/irdma-abi.h +1 -1
@@ -57,8 +57,8 @@ struct irdma_alloc_ucontext_resp {__u8 rsvd2;__aligned_u64 comp_mask;__u16 min_hw_wq_size; +__u8 revd3[2 ];__u32 max_hw_srq_quanta; -__u8 rsvd3[2 ]; };struct irdma_alloc_pd_resp {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/312 RDMA/mana_ib: check cqe length for kernel CQs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Taranov <[email protected]>
[ Upstream commit 887bfe5986396aca908b7afd2d214471ba7d5544 ]
Check queue size during kernel CQ creation to prevent overflow of u32.
--- drivers/infiniband/hw/mana/cq.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/infiniband/hw/mana/cq.c +4 -0
@@ -56,6 +56,10 @@ int mana_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, doorbell = mana_ucontext->doorbell; }else { is_rnic_cq = true; +if (attr->cqe >U32_MAX /COMP_ENTRY_SIZE /2 +1 ) { +ibdev_dbg (ibdev,"CQE %d exceeding limit\n" , attr->cqe); +return -EINVAL ; + } buf_size =MANA_PAGE_ALIGN (roundup_pow_of_two (attr->cqe *COMP_ENTRY_SIZE )); cq->cqe = buf_size /COMP_ENTRY_SIZE ; err =mana_ib_create_kernel_queue (mdev, buf_size,GDMA_CQ , &cq->queue);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/312 RDMA/irdma: avoid invalid read in irdma_net_event
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <[email protected]>
[ Upstream commit 6f05611728e9d0ab024832a4f1abb74a5f5d0bb0 ]
irdma_net_event() should not dereference anything from "neigh" (alias "ptr") until it has checked that the event is NETEVENT_NEIGH_UPDATE. Other events come with different structures pointed to by "ptr" and they may be smaller than struct neighbour.
Move the read of neigh->dev under the NETEVENT_NEIGH_UPDATE case.
The bug is mostly harmless, but it triggers KASAN on debug kernels:
BUG: KASAN: stack-out-of-bounds in irdma_net_event+0x32e/0x3b0 [irdma] Read of size 8 at addr ffffc900075e07f0 by task kworker/27:2/542554 CPU: 27 PID: 542554 Comm: kworker/27:2 Kdump: loaded Not tainted 5.14.0-630.el9.x86_64+debug #1 Hardware name: [...] Workqueue: events rt6_probe_deferred Call Trace: <IRQ> dump_stack_lvl+0x60/0xb0 print_address_description.constprop.0+0x2c/0x3f0 print_report+0xb4/0x270 kasan_report+0x92/0xc0 irdma_net_event+0x32e/0x3b0 [irdma] notifier_call_chain+0x9e/0x180 atomic_notifier_call_chain+0x5c/0x110 rt6_do_redirect+0xb91/0x1080 tcp_v6_err+0xe9b/0x13e0 icmpv6_notify+0x2b2/0x630 ndisc_redirect_rcv+0x328/0x530 icmpv6_rcv+0xc16/0x1360 ip6_protocol_deliver_rcu+0xb84/0x12e0 ip6_input_finish+0x117/0x240 ip6_input+0xc4/0x370 ipv6_rcv+0x420/0x7d0 __netif_receive_skb_one_core+0x118/0x1b0 process_backlog+0xd1/0x5d0 __napi_poll.constprop.0+0xa3/0x440 net_rx_action+0x78a/0xba0 handle_softirqs+0x2d4/0x9c0 do_softirq+0xad/0xe0 </IRQ>
--- drivers/infiniband/hw/irdma/utils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/irdma/utils.c +2 -1
@@ -251,7 +251,7 @@ int irdma_net_event(struct notifier_block *notifier, unsigned long event, void *ptr) {struct neighbour *neigh = ptr; -struct net_device *real_dev, *netdev = (struct net_device *)neigh->dev; +struct net_device *real_dev, *netdev;struct irdma_device *iwdev;struct ib_device *ibdev;__be32 *p;
@@ -260,6 +260,7 @@ int irdma_net_event(struct notifier_block *notifier, unsigned long event,switch (event) {case NETEVENT_NEIGH_UPDATE : + netdev = neigh->dev; real_dev =rdma_vlan_dev_real_dev (netdev);if (!real_dev) real_dev = netdev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/312 RDMA/efa: Remove possible negative shift
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Margolin <[email protected]>
[ Upstream commit 85463eb6a46caf2f1e0e1a6d0731f2f3bab17780 ]
The page size used for device might in some cases be smaller than PAGE_SIZE what results in a negative shift when calculating the number of host pages in PAGE_SIZE for a debug log. Remove the debug line together with the calculation.
--- drivers/infiniband/hw/efa/efa_verbs.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/infiniband/hw/efa/efa_verbs.c +0 -4
@@ -1320,13 +1320,9 @@ static int umem_to_page_list(struct efa_dev *dev, u32 hp_cnt, u8 hp_shift) { -u32 pages_in_hp =BIT (hp_shift -PAGE_SHIFT );struct ib_block_iter biter;unsigned int hp_idx =0 ; -ibdev_dbg (&dev->ibdev,"hp_cnt[%u], pages_in_hp[%u]\n" , - hp_cnt, pages_in_hp); -rdma_umem_for_each_dma_block (umem, &biter,BIT (hp_shift)) page_list[hp_idx++] =rdma_block_iter_dma_address (&biter);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/312 RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jang Ingyu <[email protected]>
[ Upstream commit 8aaa848eaddd9ef8680fc6aafbd3a0646da5df40 ]
Fix missing comparison operator for RDMA_NETWORK_ROCE_V1 in the conditional statement. The constant was used directly instead of being compared with net_type, causing the condition to always evaluate to true.
--- drivers/infiniband/core/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/verbs.c +1 -1
@@ -735,7 +735,7 @@ int ib_get_gids_from_rdma_hdr(const union rdma_network_hdr *hdr, (struct in6_addr *)dgid);return 0 ; }else if (net_type ==RDMA_NETWORK_IPV6 || - net_type ==RDMA_NETWORK_IB ||RDMA_NETWORK_ROCE_V1 ) { + net_type ==RDMA_NETWORK_IB || net_type ==RDMA_NETWORK_ROCE_V1 ) { *dgid = hdr->ibgrh.dgid; *sgid = hdr->ibgrh.sgid;return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/312 RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 145a417a39d7efbc881f52e829817376972b278c ]
RCFW_COMM_CONS_PCI_BAR_REGION is defined as BAR 2, so checking !creq_db->reg.bar_id is incorrect and always false.
pci_resource_start() returns the BAR base address, and a value of 0 indicates that the BAR is unassigned. Update the condition to test bar_base == 0 instead.
This ensures the driver detects and logs an error for an unassigned RCFW communication BAR.
--- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +1 -1
@@ -1112,7 +1112,7 @@ static int bnxt_qplib_map_creq_db(struct bnxt_qplib_rcfw *rcfw, u32 reg_offt) creq_db->dbinfo.flags =0 ; creq_db->reg.bar_id =RCFW_COMM_CONS_PCI_BAR_REGION ; creq_db->reg.bar_base =pci_resource_start (pdev, creq_db->reg.bar_id); -if (!creq_db->reg.bar_id) +if (!creq_db->reg.bar_base)dev_err (&pdev->dev,"QPLIB: CREQ BAR region %d resc start is 0!" , creq_db->reg.bar_id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/312 RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit fa3c411d21ebc26ffd175c7256c37cefa35020aa ]
Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add support to add/delete a sub IB device through netlink") grabs a reference using ib_device_get_by_index() before calling ib_del_sub_device_and_put(), we need to drop that reference before returning -EOPNOTSUPP error.
--- drivers/infiniband/core/device.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/core/device.c +3 -1
@@ -2881,8 +2881,10 @@ int ib_del_sub_device_and_put(struct ib_device *sub) {struct ib_device *parent = sub->parent; -if (!parent) +if (!parent) { +ib_device_put (sub);return -EOPNOTSUPP ; + }mutex_lock (&parent->subdev_lock);list_del (&sub->subdev_list);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/312 drm/gem-shmem: Fix the MODULE_LICENSE() string
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 3fbd97618f49e07e05aad96510e5f2ed22d68809 ]
Replace the bogus "GPL v2" with "GPL" as MODULE_LICNSE() string. The value does not declare the module's exact license, but only lets the module loader test whether the module is Free Software or not.
See commit bf7fbeeae6db ("module: Cure the MODULE_LICENSE "GPL" vs. "GPL v2" bogosity") in the details of the issue. The fix is to use "GPL" for all modules under any variant of the GPL.
--- drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_gem_shmem_helper.c +1 -1
@@ -863,4 +863,4 @@ EXPORT_SYMBOL_GPL(drm_gem_shmem_prime_import_no_map);MODULE_DESCRIPTION ("DRM SHMEM memory-management helpers" );MODULE_IMPORT_NS ("DMA_BUF" ); -MODULE_LICENSE ("GPL v2" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/312 RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit f01765a2361323e78e3d91b1cb1d5527a83c5cf7 ]
The bnxt_re SEND path checks wr->send_flags to enable features such as IP checksum offload. However, send_flags is a bitmask and may contain multiple flags (e.g. IB_SEND_SIGNALED | IB_SEND_IP_CSUM), while the existing code uses a switch() statement that only matches when send_flags is exactly IB_SEND_IP_CSUM.
As a result, checksum offload is not enabled when additional SEND flags are present.
Replace the switch() with a bitmask test:
if (wr->send_flags & IB_SEND_IP_CSUM)
This ensures IP checksum offload is enabled correctly when multiple SEND flags are used.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +1 -6
@@ -2919,14 +2919,9 @@ int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr, wqe.rawqp1.lflags |=SQ_SEND_RAWETH_QP1_LFLAGS_ROCE_CRC ; } -switch (wr->send_flags) { -case IB_SEND_IP_CSUM : +if (wr->send_flags &IB_SEND_IP_CSUM ) wqe.rawqp1.lflags |=SQ_SEND_RAWETH_QP1_LFLAGS_IP_CHKSUM ; -break ; -default : -break ; - } fallthrough;case IB_WR_SEND_WITH_INV : rc =bnxt_re_build_send_wqe (qp, wr, &wqe);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/312 RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ding Hui <[email protected]>
[ Upstream commit 9b68a1cc966bc947d00e4c0df7722d118125aa37 ]
Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_OF_SEQ_ERR.
BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware statistics with different num_counters values on chip_gen_p5_p7 devices.
As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating hw_stats, which leads to an out-of-bounds write in bnxt_re_copy_err_stats().
The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not only p5/p7 devices.
Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they are included in the generic counter set.
--- drivers/infiniband/hw/bnxt_re/hw_counters.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/hw_counters.h +3 -3
@@ -89,6 +89,9 @@ enum bnxt_re_hw_stats {BNXT_RE_RES_SRQ_LOAD_ERR ,BNXT_RE_RES_TX_PCI_ERR ,BNXT_RE_RES_RX_PCI_ERR , +BNXT_RE_REQ_CQE_ERROR , +BNXT_RE_RESP_CQE_ERROR , +BNXT_RE_RESP_REMOTE_ACCESS_ERRS ,BNXT_RE_OUT_OF_SEQ_ERR ,BNXT_RE_TX_ATOMIC_REQ , BNXT_RE_TX_READ_REQ,
@@ -110,9 +113,6 @@ enum bnxt_re_hw_stats {BNXT_RE_TX_CNP ,BNXT_RE_RX_CNP ,BNXT_RE_RX_ECN , -BNXT_RE_REQ_CQE_ERROR , -BNXT_RE_RESP_CQE_ERROR , -BNXT_RE_RESP_REMOTE_ACCESS_ERRS , BNXT_RE_NUM_EXT_COUNTERS };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/312 kunit: Enforce task execution in {soft,hard}irq contexts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gow <[email protected]>
[ Upstream commit c31f4aa8fed048fa70e742c4bb49bb48dc489ab3 ]
The kunit_run_irq_test() helper allows a function to be run in hardirq and softirq contexts (in addition to the task context). It does this by running the user-provided function concurrently in the three contexts, until either a timeout has expired or a number of iterations have completed in the normal task context.
However, on setups where the initialisation of the hardirq and softirq contexts (or, indeed, the scheduling of those tasks) is significantly slower than the function execution, it's possible for that number of iterations to be exceeded before any runs in irq contexts actually occur. This occurs with the polyval.test_polyval_preparekey_in_irqs test, which runs 20000 iterations of the relatively fast preparekey function, and therefore fails often under many UML, 32-bit arm, m68k and other environments.
Instead, ensure that the max_iterations limit counts executions in all three contexts, and requires at least one of each. This will cause the test to continue iterating until at least the irq contexts have been tested, or the 1s wall-clock limit has been exceeded. This causes the test to pass in all of my environments.
In so doing, we also update the task counters to atomic ints, to better match both the 'int' max_iterations input, and to ensure they are correctly updated across contexts.
Finally, we also fix a few potential assertion messages to be less-specific to the original crypto usecases.
--- include/kunit/run-in-irq-context.h | 53 +++++++++++++++++++----------- 1 file changed, 33 insertions(+), 20 deletions(-)
include/kunit/run-in-irq-context.h +33 -20
@@ -20,8 +20,8 @@ struct kunit_irq_test_state {bool task_func_reported_failure;bool hardirq_func_reported_failure;bool softirq_func_reported_failure; -unsigned long hardirq_func_calls; -unsigned long softirq_func_calls; +atomic_t hardirq_func_calls; +atomic_t softirq_func_calls;struct hrtimer timer;struct work_struct bh_work; };
@@ -32,7 +32,7 @@ static enum hrtimer_restart kunit_irq_test_timer_func(struct hrtimer *timer)container_of (timer,typeof (*state), timer);WARN_ON_ONCE (!in_hardirq ()); - state->hardirq_func_calls++; +atomic_inc (&state->hardirq_func_calls);if (!state->func (state->test_specific_state)) state->hardirq_func_reported_failure = true;
@@ -48,7 +48,7 @@ static void kunit_irq_test_bh_work_func(struct work_struct *work)container_of (work,typeof (*state), bh_work);WARN_ON_ONCE (!in_serving_softirq ()); - state->softirq_func_calls++; +atomic_inc (&state->softirq_func_calls);if (!state->func (state->test_specific_state)) state->softirq_func_reported_failure = true;
@@ -59,7 +59,10 @@ static void kunit_irq_test_bh_work_func(struct work_struct *work)* hardirq context concurrently, and reports a failure to KUnit if any * invocation of @func in any context returns false. @func is passed * @test_specific_state as its argument. At most 3 invocations of @func will -* run concurrently: one in each of task, softirq, and hardirq context. +* run concurrently: one in each of task, softirq, and hardirq context. @func +* will continue running until either @max_iterations calls have been made (so +* long as at least one each runs in task, softirq, and hardirq contexts), or +* one second has passed. * * The main purpose of this interrupt context testing is to validate fallback * code paths that run in contexts where the normal code path cannot be used,
@@ -85,6 +88,8 @@ static inline void kunit_run_irq_test(struct kunit *test, bool (*func)(void *), .test_specific_state = test_specific_state, };unsigned long end_jiffies; +int hardirq_calls, softirq_calls; +bool allctx = false;/* * Set up a hrtimer (the way we access hardirq context) and a work
@@ -94,14 +99,25 @@ static inline void kunit_run_irq_test(struct kunit *test, bool (*func)(void *), CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);INIT_WORK_ONSTACK (&state.bh_work, kunit_irq_test_bh_work_func); -/* Run for up to max_iterations or 1 second, whichever comes first. */ +/* +* Run for up to max_iterations (including at least one task, softirq, +* and hardirq), or 1 second, whichever comes first. +*/ end_jiffies = jiffies +HZ ;hrtimer_start (&state.timer,KUNIT_IRQ_TEST_HRTIMER_INTERVAL ,HRTIMER_MODE_REL_HARD ); -for (int i =0 ; i < max_iterations && !time_after (jiffies, end_jiffies); - i++) { +for (int task_calls =0 , calls =0 ; + ((calls < max_iterations) || !allctx) && + !time_after (jiffies, end_jiffies); + task_calls++) {if (!func (test_specific_state)) state.task_func_reported_failure = true; + + hardirq_calls =atomic_read (&state.hardirq_func_calls); + softirq_calls =atomic_read (&state.softirq_func_calls); + calls = task_calls + hardirq_calls + softirq_calls; + allctx = (task_calls >0 ) && (hardirq_calls >0 ) && + (softirq_calls >0 ); }/* Cancel the timer and work. */
@@ -109,21 +125,18 @@ static inline void kunit_run_irq_test(struct kunit *test, bool (*func)(void *),flush_work (&state.bh_work);/* Sanity check: the timer and BH functions should have been run. */ -KUNIT_EXPECT_GT_MSG (test, state.hardirq_func_calls,0 , +KUNIT_EXPECT_GT_MSG (test,atomic_read (&state.hardirq_func_calls),0 ,"Timer function was not called" ); -KUNIT_EXPECT_GT_MSG (test, state.softirq_func_calls,0 , +KUNIT_EXPECT_GT_MSG (test,atomic_read (&state.softirq_func_calls),0 ,"BH work function was not called" ); -/* Check for incorrect hash values reported from any context. */ -KUNIT_EXPECT_FALSE_MSG ( - test, state.task_func_reported_failure, -"Incorrect hash values reported from task context" ); -KUNIT_EXPECT_FALSE_MSG ( - test, state.hardirq_func_reported_failure, -"Incorrect hash values reported from hardirq context" ); -KUNIT_EXPECT_FALSE_MSG ( - test, state.softirq_func_reported_failure, - "Incorrect hash values reported from softirq context"); +/* Check for failure reported from any context. */ +KUNIT_EXPECT_FALSE_MSG (test, state.task_func_reported_failure, +"Failure reported from task context" ); +KUNIT_EXPECT_FALSE_MSG (test, state.hardirq_func_reported_failure, +"Failure reported from hardirq context" ); +KUNIT_EXPECT_FALSE_MSG (test, state.softirq_func_reported_failure, + "Failure reported from softirq context"); }#endif /* _KUNIT_RUN_IN_IRQ_CONTEXT_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/312 RDMA/bnxt_re: Fix to use correct page size for PDE table
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 3d70e0fb0f289b0c778041c5bb04d099e1aa7c1c ]
In bnxt_qplib_alloc_init_hwq(), while allocating memory for PDE table driver incorrectly is using the "pg_size" value passed to the function. Fixed to use the right value 4K. Also, fixed the allocation size for PBL table.
--- drivers/infiniband/hw/bnxt_re/qplib_res.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_res.c +2 -2
@@ -237,7 +237,7 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq,if (npbl %BIT (MAX_PDL_LVL_SHIFT )) npde++;/* Alloc PDE pages */ - sginfo.pgsize = npde * pg_size; + sginfo.pgsize = npde *ROCE_PG_SIZE_4K ; sginfo.npages =1 ; rc =__alloc_pbl (res, &hwq->pbl[PBL_LVL_0 ], &sginfo);if (rc)
@@ -245,7 +245,7 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq,/* Alloc PBL pages */ sginfo.npages = npbl; - sginfo.pgsize =PAGE_SIZE ; + sginfo.pgsize =ROCE_PG_SIZE_4K ; rc =__alloc_pbl (res, &hwq->pbl[PBL_LVL_1 ], &sginfo);if (rc) goto fail;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/312 md: Fix static checker warning in analyze_sbs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 00f6c1b4d15d35fadb7f34768a1831c81aaa8936 ]
The following warn is reported:
drivers/md/md.c:3912 analyze_sbs()
warn: iterator 'i' not incremented
--- drivers/md/md.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/md/md.c +1 -4
@@ -3874,7 +3874,6 @@ static struct md_rdev *md_import_device(dev_t newdev, int super_format, int supestatic int analyze_sbs (struct mddev *mddev) { -int i;struct md_rdev *rdev, *freshest, *tmp; freshest =NULL ;
@@ -3901,11 +3900,9 @@ static int analyze_sbs(struct mddev *mddev) super_types[mddev->major_version].validate_super (mddev,NULL /*freshest*/ , freshest); - i =0 ;rdev_for_each_safe (rdev, tmp, mddev) {if (mddev->max_disks && - (rdev->desc_nr >= mddev->max_disks || - i > mddev->max_disks)) { + rdev->desc_nr >= mddev->max_disks) {pr_warn ("md: %s: %pg: only %d devices permitted\n" ,mdname (mddev), rdev->bdev, mddev->max_disks);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/312 md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuo Li <[email protected]>
[ Upstream commit 7ad6ef91d8745d04aff9cce7bdbc6320d8e05fe9 ]
The variable mddev->private is first assigned to conf and then checked:
conf = mddev->private; if (!conf) ...
If conf is NULL, then mddev->private is also NULL. In this case, null-pointer dereferences can occur when calling raid5_quiesce():
raid5_quiesce(mddev, true); raid5_quiesce(mddev, false);
since mddev->private is assigned to conf again in raid5_quiesce(), and conf is dereferenced in several places, for example:
conf->quiesce = 0; wake_up(&conf->wait_for_quiescent);
To fix this issue, the function should unlock mddev and return before invoking raid5_quiesce() when conf is NULL, following the existing pattern in raid5_change_consistency_policy().
--- drivers/md/raid5.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/md/raid5.c +6 -4
@@ -7187,12 +7187,14 @@ raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len) err =mddev_suspend_and_lock (mddev);if (err)return err; + conf = mddev->private; +if (!conf) { +mddev_unlock_and_resume (mddev); +return -ENODEV ; + }raid5_quiesce (mddev, true); - conf = mddev->private; -if (!conf) - err = -ENODEV ; -else if (new != conf->worker_cnt_per_group) { +if (new != conf->worker_cnt_per_group) { old_groups = conf->worker_groups;if (old_groups)flush_workqueue (raid5_wq);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/312 ublk: implement NUMA-aware memory allocation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 529d4d6327880e5c60f4e0def39b3faaa7954e54 ]
Implement NUMA-friendly memory allocation for ublk driver to improve performance on multi-socket systems.
This commit includes the following changes:
1. Rename __queues to queues, dropping the __ prefix since the field is now accessed directly throughout the codebase rather than only through the ublk_get_queue() helper.
2. Remove the queue_size field from struct ublk_device as it is no longer needed.
3. Move queue allocation and deallocation into ublk_init_queue() and ublk_deinit_queue() respectively, improving encapsulation. This simplifies ublk_init_queues() and ublk_deinit_queues() to just iterate and call the per-queue functions.
4. Add ublk_get_queue_numa_node() helper function to determine the appropriate NUMA node for a queue by finding the first CPU mapped to that queue via tag_set.map[HCTX_TYPE_DEFAULT].mq_map[] and converting it to a NUMA node using cpu_to_node(). This function is called internally by ublk_init_queue() to determine the allocation node.
5. Allocate each queue structure on its local NUMA node using kvzalloc_node() in ublk_init_queue().
6. Allocate the I/O command buffer on the same NUMA node using alloc_pages_node().
This reduces memory access latency on multi-socket NUMA systems by ensuring each queue's data structures are local to the CPUs that access them.
Stable-dep-of: 7fc4da6a304b ("ublk: scan partition in async way")
--- drivers/block/ublk_drv.c | 84 +++++++++++++++++++++++++--------------- 1 file changed, 53 insertions(+), 31 deletions(-)
drivers/block/ublk_drv.c +53 -31
@@ -210,9 +210,6 @@ struct ublk_queue {struct ublk_device {struct gendisk *ub_disk; -char *__queues; - -unsigned int queue_size;struct ublksrv_ctrl_dev_info dev_info;struct blk_mq_tag_set tag_set;
@@ -240,6 +237,8 @@ struct ublk_device {bool canceling;pid_t ublksrv_tgid;struct delayed_work exit_work; + +struct ublk_queue *queues[]; };/* header of ublk_params */
@@ -782,7 +781,7 @@ static noinline void ublk_put_device(struct ublk_device *ub)static inline struct ublk_queue *ublk_get_queue (struct ublk_device *dev,int qid) { -return (struct ublk_queue *)&(dev->__queues[qid * dev->queue_size]); +return dev->queues[qid]; }static inline bool ublk_rq_has_data (const struct request *rq)
@@ -2713,9 +2712,13 @@ static const struct file_operations ublk_ch_fops = {static void ublk_deinit_queue (struct ublk_device *ub,int q_id) { -int size =ublk_queue_cmd_buf_size (ub); -struct ublk_queue *ubq =ublk_get_queue (ub, q_id); -int i; +struct ublk_queue *ubq = ub->queues[q_id]; +int size, i; + +if (!ubq) +return ; + + size =ublk_queue_cmd_buf_size (ub);for (i =0 ; i < ubq->q_depth; i++) {struct ublk_io *io = &ubq->ios[i];
@@ -2727,57 +2730,76 @@ static void ublk_deinit_queue(struct ublk_device *ub, int q_id)if (ubq->io_cmd_buf)free_pages ((unsigned long )ubq->io_cmd_buf,get_order (size)); + +kvfree (ubq); + ub->queues[q_id] =NULL ; +} + +static int ublk_get_queue_numa_node (struct ublk_device *ub,int q_id) +{ +unsigned int cpu; + +/* Find first CPU mapped to this queue */ +for_each_possible_cpu (cpu) { +if (ub->tag_set.map[HCTX_TYPE_DEFAULT ].mq_map[cpu] == q_id) +return cpu_to_node (cpu); + } + +return NUMA_NO_NODE ; }static int ublk_init_queue (struct ublk_device *ub,int q_id) { -struct ublk_queue *ubq =ublk_get_queue (ub, q_id); +int depth = ub->dev_info.queue_depth; +int ubq_size =sizeof (struct ublk_queue ) + depth *sizeof (struct ublk_io );gfp_t gfp_flags =GFP_KERNEL | __GFP_ZERO; -void *ptr; +struct ublk_queue *ubq; +struct page *page; +int numa_node;int size; +/* Determine NUMA node based on queue's CPU affinity */ + numa_node =ublk_get_queue_numa_node (ub, q_id); + +/* Allocate queue structure on local NUMA node */ + ubq =kvzalloc_node (ubq_size,GFP_KERNEL , numa_node); +if (!ubq) +return -ENOMEM ; +spin_lock_init (&ubq->cancel_lock); ubq->flags = ub->dev_info.flags; ubq->q_id = q_id; - ubq->q_depth = ub->dev_info.queue_depth; + ubq->q_depth = depth; size =ublk_queue_cmd_buf_size (ub); - ptr = (void *)__get_free_pages (gfp_flags,get_order (size)); -if (!ptr) +/* Allocate I/O command buffer on local NUMA node */ + page =alloc_pages_node (numa_node, gfp_flags,get_order (size)); +if (!page) { +kvfree (ubq);return -ENOMEM ; + } + ubq->io_cmd_buf =page_address (page); - ubq->io_cmd_buf = ptr; + ub->queues[q_id] = ubq; ubq->dev = ub;return 0 ; }static void ublk_deinit_queues (struct ublk_device *ub) { -int nr_queues = ub->dev_info.nr_hw_queues;int i; -if (!ub->__queues) -return ; - -for (i =0 ; i < nr_queues; i++) +for (i =0 ; i < ub->dev_info.nr_hw_queues; i++)ublk_deinit_queue (ub, i); -kvfree (ub->__queues); }static int ublk_init_queues (struct ublk_device *ub) { -int nr_queues = ub->dev_info.nr_hw_queues; -int depth = ub->dev_info.queue_depth; -int ubq_size =sizeof (struct ublk_queue ) + depth *sizeof (struct ublk_io ); -int i, ret = -ENOMEM ; +int i, ret; - ub->queue_size = ubq_size; - ub->__queues =kvcalloc (nr_queues, ubq_size,GFP_KERNEL ); -if (!ub->__queues) -return ret; - -for (i =0 ; i < nr_queues; i++) { -if (ublk_init_queue (ub, i)) +for (i =0 ; i < ub->dev_info.nr_hw_queues; i++) { + ret =ublk_init_queue (ub, i); +if (ret) goto fail; }
@@ -3179,7 +3201,7 @@ static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header) goto out_unlock; ret = -ENOMEM ; - ub =kzalloc (sizeof (*ub),GFP_KERNEL ); + ub =kzalloc (struct_size (ub, queues, info.nr_hw_queues),GFP_KERNEL );if (!ub) goto out_unlock;mutex_init (&ub->mutex);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/312 ublk: scan partition in async way
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a ]
Implement async partition scan to avoid IO hang when reading partition tables. Similar to nvme_partition_scan_work(), partition scanning is deferred to a work queue to prevent deadlocks.
When partition scan happens synchronously during add_disk(), IO errors can cause the partition scan to wait while holding ub->mutex, which can deadlock with other operations that need the mutex.
Changes:
- Add partition_scan_work to ublk_device structure
- Implement ublk_partition_scan_work() to perform async scan
- Always suppress sync partition scan during add_disk()
- Schedule async work after add_disk() for trusted daemons
- Add flush_work() in ublk_stop_dev() before grabbing ub->mutex
--- drivers/block/ublk_drv.c | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-)
drivers/block/ublk_drv.c +32 -3
@@ -237,6 +237,7 @@ struct ublk_device {bool canceling;pid_t ublksrv_tgid;struct delayed_work exit_work; +struct work_struct partition_scan_work;struct ublk_queue *queues[]; };
@@ -254,6 +255,20 @@ static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub, u16 q_id, u16 tag, struct ublk_io *io, size_t offset);static inline unsigned int ublk_req_build_flags (struct request *req); +static void ublk_partition_scan_work (struct work_struct *work) +{ +struct ublk_device *ub = + container_of(work, struct ublk_device, partition_scan_work); + +if (WARN_ON_ONCE (!test_and_clear_bit (GD_SUPPRESS_PART_SCAN , + &ub->ub_disk->state))) +return ; + +mutex_lock (&ub->ub_disk->open_mutex); +bdev_disk_changed (ub->ub_disk, false); +mutex_unlock (&ub->ub_disk->open_mutex); +} +static inline struct ublksrv_io_desc *ublk_get_iod (const struct ublk_queue *ubq,unsigned tag) {
@@ -2092,6 +2107,7 @@ static void ublk_stop_dev(struct ublk_device *ub)mutex_lock (&ub->mutex);ublk_stop_dev_unlocked (ub);mutex_unlock (&ub->mutex); +flush_work (&ub->partition_scan_work);ublk_cancel_dev (ub); }
@@ -3023,9 +3039,17 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub,ublk_apply_params (ub); -/* don't probe partitions if any daemon task is un-trusted */ -if (ub->unprivileged_daemons) -set_bit (GD_SUPPRESS_PART_SCAN , &disk->state); +/* +* Suppress partition scan to avoid potential IO hang. +* +* If ublk server error occurs during partition scan, the IO may +* wait while holding ub->mutex, which can deadlock with other +* operations that need the mutex. Defer partition scan to async +* work. +* For unprivileged daemons, keep GD_SUPPRESS_PART_SCAN set +* permanently. +*/ +set_bit (GD_SUPPRESS_PART_SCAN , &disk->state);ublk_get_device (ub); ub->dev_info.state =UBLK_S_DEV_LIVE ;
@@ -3042,6 +3066,10 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub,set_bit (UB_STATE_USED , &ub->state); +/* Schedule async partition scan for trusted daemons */ +if (!ub->unprivileged_daemons) +schedule_work (&ub->partition_scan_work); + out_put_cdev:if (ret) {ublk_detach_disk (ub);
@@ -3207,6 +3235,7 @@ static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header)mutex_init (&ub->mutex);spin_lock_init (&ub->lock);mutex_init (&ub->cancel_mutex); +INIT_WORK (&ub->partition_scan_work, ublk_partition_scan_work); ret =ublk_alloc_dev_number (ub, header->dev_id);if (ret <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/312 drm/xe/guc: READ/WRITE_ONCE g2h_fence->done
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cavitt <[email protected]>
[ Upstream commit bed2a6bd20681aacfb063015c1edfab6f58a333e ]
Use READ_ONCE and WRITE_ONCE when operating on g2h_fence->done to prevent the compiler from ignoring important modifications to its value.
--- drivers/gpu/drm/xe/xe_guc_ct.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/gpu/drm/xe/xe_guc_ct.c +10 -4
@@ -106,7 +106,9 @@ static void g2h_fence_cancel(struct g2h_fence *g2h_fence) { g2h_fence->cancel = true; g2h_fence->fail = true; - g2h_fence->done = true; + +/* WRITE_ONCE pairs with READ_ONCEs in guc_ct_send_recv. */ +WRITE_ONCE (g2h_fence->done, true); }static bool g2h_fence_needs_alloc (struct g2h_fence *g2h_fence)
@@ -1128,10 +1130,13 @@ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len,return ret; } - ret =wait_event_timeout (ct->g2h_fence_wq, g2h_fence.done,HZ ); +/* READ_ONCEs pairs with WRITE_ONCEs in parse_g2h_response +* and g2h_fence_cancel. +*/ + ret =wait_event_timeout (ct->g2h_fence_wq,READ_ONCE (g2h_fence.done),HZ );if (!ret) {LNL_FLUSH_WORK (&ct->g2h_worker); -if (g2h_fence.done) { +if (READ_ONCE (g2h_fence.done)) {xe_gt_warn (gt,"G2H fence %u, action %04x, done\n" , g2h_fence.seqno, action[0 ]); ret =1 ;
@@ -1375,7 +1380,8 @@ static int parse_g2h_response(struct xe_guc_ct *ct, u32 *msg, u32 len)g2h_release_space (ct,GUC_CTB_HXG_MSG_MAX_LEN ); - g2h_fence->done = true; +/* WRITE_ONCE pairs with READ_ONCEs in guc_ct_send_recv. */ +WRITE_ONCE (g2h_fence->done, true);smp_mb ();wake_up_all (&ct->g2h_fence_wq);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/312 ksmbd: Fix memory leak in get_file_all_info()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 0c56693b06a68476ba113db6347e7897475f9e4c ]
In get_file_all_info(), if vfs_getattr() fails, the function returns immediately without freeing the allocated filename, leading to a memory leak.
Fix this by freeing the filename before returning in this error case.
--- fs/smb/server/smb2pdu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +3 -1
@@ -4933,8 +4933,10 @@ static int get_file_all_info(struct ksmbd_work *work, ret =vfs_getattr (&fp->filp->f_path, &stat,STATX_BASIC_STATS ,AT_STATX_SYNC_AS_STAT ); -if (ret) +if (ret) { +kfree (filename);return ret; + }ksmbd_debug (SMB ,"filename = %s\n" , filename); delete_pending =ksmbd_inode_pending_delete (fp);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/312 IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit 3c68cf68233e556e0102f45b69f7448908dc1f44 ]
rxe_odp_map_range_and_lock() must release umem_odp->umem_mutex when an error occurs, including cases where rxe_check_pagefault() fails.
--- drivers/infiniband/sw/rxe/rxe_odp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_odp.c +3 -1
@@ -179,8 +179,10 @@ static int rxe_odp_map_range_and_lock(struct rxe_mr *mr, u64 iova, int length, ureturn err; need_fault =rxe_check_pagefault (umem_odp, iova, length); -if (need_fault) +if (need_fault) { +mutex_unlock (&umem_odp->umem_mutex);return -EFAULT ; + } }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/312 RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang LI <[email protected]>
[ Upstream commit 43bd09d5b750f700499ae8ec45fd41a4c48673e6 ]
If device max_mr_size bits in the range [mr_page_shift+31:mr_page_shift] are zero, the min3 function will set clt_path::max_pages_per_mr to zero.
alloc_path_reqs will pass zero, which is invalid, as the third parameter to ib_alloc_mr.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -0
@@ -1464,6 +1464,7 @@ static void query_fast_reg_mode(struct rtrs_clt_path *clt_path) mr_page_shift =max (12 ,ffs (ib_dev->attrs.page_size_cap) -1 ); max_pages_per_mr = ib_dev->attrs.max_mr_size;do_div (max_pages_per_mr, (1ull << mr_page_shift)); + max_pages_per_mr =min_not_zero ((u32 )max_pages_per_mr,U32_MAX ); clt_path->max_pages_per_mr =min3 (clt_path->max_pages_per_mr, (u32 )max_pages_per_mr, ib_dev->attrs.max_fast_reg_page_list_len);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/312 RDMA/bnxt_re: fix dma_free_coherent() pointer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit fcd431a9627f272b4c0bec445eba365fe2232a94 ]
The dma_alloc_coherent() allocates a dma-mapped buffer, pbl->pg_arr[i]. The dma_free_coherent() should pass the same buffer to dma_free_coherent() and not page-aligned.
--- drivers/infiniband/hw/bnxt_re/qplib_res.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_res.c +1 -3
@@ -64,9 +64,7 @@ static void __free_pbl(struct bnxt_qplib_res *res, struct bnxt_qplib_pbl *pbl,for (i =0 ; i < pbl->pg_count; i++) {if (pbl->pg_arr[i])dma_free_coherent (&pdev->dev, pbl->pg_size, - (void *)((unsigned long ) - pbl->pg_arr[i] & -PAGE_MASK ), + pbl->pg_arr[i], pbl->pg_map_arr[i]);else dev_warn(&pdev->dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/312 blk-mq: skip CPU offline notify on unmapped hctx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Zhang <[email protected]>
[ Upstream commit 10845a105bbcb030647a729f1716c2309da71d33 ]
If an hctx has no software ctx mapped, blk_mq_map_swqueue() never allocates tags and leaves hctx->tags NULL. The CPU hotplug offline notifier can still run for that hctx, return early since hctx cannot hold any requests.
--- block/blk-mq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-mq.c +1 -1
@@ -3710,7 +3710,7 @@ static int blk_mq_hctx_notify_offline(unsigned int cpu, struct hlist_node *node) struct blk_mq_hw_ctx, cpuhp_online);int ret =0 ; -if (blk_mq_hctx_has_online_cpu (hctx, cpu)) +if (!hctx->nr_ctx ||blk_mq_hctx_has_online_cpu (hctx, cpu))return 0 ;/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/312 selftests/ftrace: traceonoff_triggers: strip off names
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yipeng Zou <[email protected]>
[ Upstream commit b889b4fb4cbea3ca7eb9814075d6a51936394bd9 ]
The func_traceonoff_triggers.tc sometimes goes to fail on my board, Kunpeng-920.
[root@localhost]# ./ftracetest ./test.d/ftrace/func_traceonoff_triggers.tc -l fail.log === Ftrace unit tests === [1] ftrace - test for function traceon/off triggers [FAIL] [2] (instance) ftrace - test for function traceon/off triggers [UNSUPPORTED]
I look up the log, and it shows that the md5sum is different between csum1 and csum2.
++ cnt=611
++ sleep .1
+++ cnt_trace
+++ grep -v '^#' trace
+++ wc -l
++ cnt2=611
++ '[' 611 -ne 611 ']'
+++ cat tracing_on
++ on=0
++ '[' 0 '!=' 0 ']'
+++ md5sum trace
++ csum1='76896aa74362fff66a6a5f3cf8a8a500 trace'
++ sleep .1
+++ md5sum trace
++ csum2='ee8625a21c058818fc26e45c1ed3f6de trace'
++ '[' '76896aa74362fff66a6a5f3cf8a8a500 trace' '!=' 'ee8625a21c058818fc26e45c1ed3f6de trace' ']' ++ fail 'Tracing file is still changing'
++ echo Tracing file is still changing
Tracing file is still changing
++ exit_fail
++ exit 1
So I directly dump the trace file before md5sum, the diff shows that:
[root@localhost]# diff trace_1.log trace_2.log -y --suppress-common-lines dockerd-12285 [036] d.... 18385.510290: sched_stat | <...>-12285 [036] d.... 18385.510290: sched_stat dockerd-12285 [036] d.... 18385.510291: sched_swit | <...>-12285 [036] d.... 18385.510291: sched_swit <...>-740 [044] d.... 18385.602859: sched_stat | kworker/44:1-740 [044] d.... 18385.602859: sched_stat <...>-740 [044] d.... 18385.602860: sched_swit | kworker/44:1-740 [044] d.... 18385.602860: sched_swit
And we can see that <...> filed be filled with names.
We can strip off the names there to fix that.
After strip off the names:
kworker/u257:0-12 [019] d..2. 2528.758910: sched_stat | -12 [019] d..2. 2528.758910: sched_stat_runtime: comm=k kworker/u257:0-12 [019] d..2. 2528.758912: sched_swit | -12 [019] d..2. 2528.758912: sched_switch: prev_comm=kw <idle>-0 [000] d.s5. 2528.762318: sched_waki | -0 [000] d.s5. 2528.762318: sched_waking: comm=sshd pi <idle>-0 [037] dNh2. 2528.762326: sched_wake | -0 [037] dNh2. 2528.762326: sched_wakeup: comm=sshd pi <idle>-0 [037] d..2. 2528.762334: sched_swit | -0 [037] d..2. 2528.762334: sched_switch: prev_comm=sw
--- .../ftrace/test.d/ftrace/func_traceonoff_triggers.tc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/testing/selftests/ftrace/test.d/ftrace/func_traceonoff_triggers.tc +3 -2
@@ -90,9 +90,10 @@ if [ $on != "0" ]; then fail "Tracing is not off" fi -csum1=`md5sum trace` +# Cannot rely on names being around as they are only cached, strip them +csum1=`cat trace | sed -e 's/^ *[^ ]*\(-[0-9][0-9]*\)/\1/' | md5sum` sleep $SLEEP_TIME -csum2=`md5sum trace` +csum2=`cat trace | sed -e 's/^ *[^ ]*\(-[0-9][0-9]*\)/\1/' | md5sum` if [ "$csum1" != "$csum2" ]; then fail "Tracing file is still changing"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/312 block: handle zone management operations completions
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit efae226c2ef19528ffd81d29ba0eecf1b0896ca2 upstream.
The functions blk_zone_wplug_handle_reset_or_finish() and blk_zone_wplug_handle_reset_all() both modify the zone write pointer offset of zone write plugs that are the target of a reset, reset all or finish zone management operation. However, these functions do this modification before the BIO is executed. So if the zone operation fails, the modified zone write pointer offsets become invalid.
Avoid this by modifying the zone write pointer offset of a zone write plug that is the target of a zone management operation when the operation completes. To do so, modify blk_zone_bio_endio() to call the new function blk_zone_mgmt_bio_endio() which in turn calls the functions blk_zone_reset_all_bio_endio(), blk_zone_reset_bio_endio() or blk_zone_finish_bio_endio() depending on the operation of the completed BIO, to modify a zone write plug write pointer offset accordingly. These functions are called only if the BIO execution was successful.
--- block/blk-zoned.c | 139 ++++++++++++++++++++++++++++++++++-------------------- block/blk.h | 14 +++++ 2 files changed, 104 insertions(+), 49 deletions(-)
block/blk-zoned.c +90 -49
@@ -71,6 +71,11 @@ struct blk_zone_wplug {struct gendisk *disk; }; +static inline unsigned int disk_zone_wplugs_hash_size (struct gendisk *disk) +{ +return 1U << disk->zone_wplugs_hash_bits; +} +/* * Zone write plug flags bits: * - BLK_ZONE_WPLUG_PLUGGED: Indicates that the zone write plug is plugged,
@@ -698,71 +703,91 @@ static int disk_zone_sync_wp_offset(stru disk_report_zones_cb, &args); } -static bool blk_zone_wplug_handle_reset_or_finish (struct bio *bio, -unsigned int wp_offset) +static void blk_zone_reset_bio_endio (struct bio *bio) {struct gendisk *disk = bio->bi_bdev->bd_disk; -sector_t sector = bio->bi_iter.bi_sector;struct blk_zone_wplug *zwplug; -unsigned long flags; - -/* Conventional zones cannot be reset nor finished. */ -if (!bdev_zone_is_seq (bio->bi_bdev, sector)) { -bio_io_error (bio); -return true; - } - -/* -* No-wait reset or finish BIOs do not make much sense as the callers -* issue these as blocking operations in most cases. To avoid issues -* the BIO execution potentially failing with BLK_STS_AGAIN, warn about -* REQ_NOWAIT being set and ignore that flag. -*/ -if (WARN_ON_ONCE (bio->bi_opf &REQ_NOWAIT )) - bio->bi_opf &= ~REQ_NOWAIT ;/* -* If we have a zone write plug, set its write pointer offset to 0 -* (reset case) or to the zone size (finish case). This will abort all -* BIOs plugged for the target zone. It is fine as resetting or -* finishing zones while writes are still in-flight will result in the +* If we have a zone write plug, set its write pointer offset to 0. +* This will abort all BIOs plugged for the target zone. It is fine as +* resetting zones while writes are still in-flight will result in the * writes failing anyway. */ - zwplug =disk_get_zone_wplug (disk, sector); + zwplug =disk_get_zone_wplug (disk, bio->bi_iter.bi_sector);if (zwplug) { +unsigned long flags; +spin_lock_irqsave (&zwplug->lock, flags); -disk_zone_wplug_set_wp_offset (disk, zwplug, wp_offset); +disk_zone_wplug_set_wp_offset (disk, zwplug,0 );spin_unlock_irqrestore (&zwplug->lock, flags);disk_put_zone_wplug (zwplug); } - -return false; } -static bool blk_zone_wplug_handle_reset_all (struct bio *bio) +static void blk_zone_reset_all_bio_endio (struct bio *bio) {struct gendisk *disk = bio->bi_bdev->bd_disk;struct blk_zone_wplug *zwplug;unsigned long flags; -sector_t sector; +unsigned int i; -/* -* Set the write pointer offset of all zone write plugs to 0. This will -* abort all plugged BIOs. It is fine as resetting zones while writes -* are still in-flight will result in the writes failing anyway. -*/ -for (sector =0 ; sector <get_capacity (disk); - sector += disk->queue->limits.chunk_sectors) { - zwplug =disk_get_zone_wplug (disk, sector); -if (zwplug) { +/* Update the condition of all zone write plugs. */ +rcu_read_lock (); +for (i =0 ; i <disk_zone_wplugs_hash_size (disk); i++) { +hlist_for_each_entry_rcu (zwplug, &disk->zone_wplugs_hash[i], + node) {spin_lock_irqsave (&zwplug->lock, flags);disk_zone_wplug_set_wp_offset (disk, zwplug,0 );spin_unlock_irqrestore (&zwplug->lock, flags); -disk_put_zone_wplug (zwplug); } } +rcu_read_unlock (); +} -return false; +static void blk_zone_finish_bio_endio (struct bio *bio) +{ +struct block_device *bdev = bio->bi_bdev; +struct gendisk *disk = bdev->bd_disk; +struct blk_zone_wplug *zwplug; + +/* +* If we have a zone write plug, set its write pointer offset to the +* zone size. This will abort all BIOs plugged for the target zone. It +* is fine as resetting zones while writes are still in-flight will +* result in the writes failing anyway. +*/ + zwplug =disk_get_zone_wplug (disk, bio->bi_iter.bi_sector); +if (zwplug) { +unsigned long flags; + +spin_lock_irqsave (&zwplug->lock, flags); +disk_zone_wplug_set_wp_offset (disk, zwplug, +bdev_zone_sectors (bdev)); +spin_unlock_irqrestore (&zwplug->lock, flags); +disk_put_zone_wplug (zwplug); + } +} + +void blk_zone_mgmt_bio_endio (struct bio *bio) +{ +/* If the BIO failed, we have nothing to do. */ +if (bio->bi_status !=BLK_STS_OK ) +return ; + +switch (bio_op (bio)) { +case REQ_OP_ZONE_RESET : +blk_zone_reset_bio_endio (bio); +return ; +case REQ_OP_ZONE_RESET_ALL : +blk_zone_reset_all_bio_endio (bio); +return ; +case REQ_OP_ZONE_FINISH : +blk_zone_finish_bio_endio (bio); +return ; +default : +return ; + } } static void disk_zone_wplug_schedule_bio_work(struct gendisk *disk,
@@ -1106,6 +1131,30 @@ static void blk_zone_wplug_handle_nativedisk_put_zone_wplug (zwplug); } +static bool blk_zone_wplug_handle_zone_mgmt (struct bio *bio) +{ +if (bio_op (bio) !=REQ_OP_ZONE_RESET_ALL && + !bdev_zone_is_seq (bio->bi_bdev, bio->bi_iter.bi_sector)) { +/* +* Zone reset and zone finish operations do not apply to +* conventional zones. +*/ +bio_io_error (bio); +return true; + } + +/* +* No-wait zone management BIOs do not make much sense as the callers +* issue these as blocking operations in most cases. To avoid issues +* with the BIO execution potentially failing with BLK_STS_AGAIN, warn +* about REQ_NOWAIT being set and ignore that flag. +*/ +if (WARN_ON_ONCE (bio->bi_opf &REQ_NOWAIT )) + bio->bi_opf &= ~REQ_NOWAIT ; + +return false; +} +/** * blk_zone_plug_bio - Handle a zone write BIO with zone write plugging * @bio: The BIO being submitted
@@ -1153,12 +1202,9 @@ bool blk_zone_plug_bio(struct bio *bio,case REQ_OP_WRITE_ZEROES :return blk_zone_wplug_handle_write (bio, nr_segs);case REQ_OP_ZONE_RESET : -return blk_zone_wplug_handle_reset_or_finish (bio,0 );case REQ_OP_ZONE_FINISH : -return blk_zone_wplug_handle_reset_or_finish (bio, -bdev_zone_sectors (bdev));case REQ_OP_ZONE_RESET_ALL : -return blk_zone_wplug_handle_reset_all (bio); +return blk_zone_wplug_handle_zone_mgmt (bio);default :return false; }
@@ -1332,11 +1378,6 @@ put_zwplug:disk_put_zone_wplug (zwplug); } -static inline unsigned int disk_zone_wplugs_hash_size (struct gendisk *disk) -{ -return 1U << disk->zone_wplugs_hash_bits; -} -void disk_init_zone_resources (struct gendisk *disk) {spin_lock_init (&disk->zone_wplugs_lock);
block/blk.h +14 -0
@@ -488,10 +488,24 @@ static inline bool blk_req_bio_is_zone_avoid blk_zone_write_plug_bio_merged (struct bio *bio);void blk_zone_write_plug_init_request (struct request *rq);void blk_zone_append_update_request_bio (struct request *rq,struct bio *bio); +void blk_zone_mgmt_bio_endio (struct bio *bio);void blk_zone_write_plug_bio_endio (struct bio *bio);static inline void blk_zone_bio_endio (struct bio *bio) {/* +* Zone management BIOs may impact zone write plugs (e.g. a zone reset +* changes a zone write plug zone write pointer offset), but these +* operation do not go through zone write plugging as they may operate +* on zones that do not have a zone write +* plug. blk_zone_mgmt_bio_endio() handles the potential changes to zone +* write plugs that are present. +*/ +if (op_is_zone_mgmt (bio_op (bio))) { +blk_zone_mgmt_bio_endio (bio); +return ; + } + +/* * For write BIOs to zoned devices, signal the completion of the BIO so * that the next write BIO can be submitted by zone write plugging. */
Greg Kroah-Hartman
maintainerPATCH 90/312 ntfs: Do not overwrite uptodate pages
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
commit 68f6bd128e75a032432eda9d16676ed2969a1096 upstream.
When reading a compressed file, we may read several pages in addition to the one requested. The current code will overwrite pages in the page cache with the data from disc which can definitely result in changes that have been made being lost.
For example if we have four consecutie pages ABCD in the file compressed into a single extent, on first access, we'll bring in ABCD. Then we write to page B. Memory pressure results in the eviction of ACD. When we attempt to write to page C, we will overwrite the data in page B with the data currently on disk.
I haven't investigated the decompression code to check whether it's OK to overwrite a clean page or whether it might be possible to see corrupt data. Out of an abundance of caution, decline to overwrite uptodate pages, not just dirty pages.
--- fs/ntfs3/frecord.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-)
fs/ntfs3/frecord.c +29 -6
@@ -2022,6 +2022,29 @@ out:return err; } +static struct page *ntfs_lock_new_page (struct address_space *mapping, +pgoff_t index,gfp_t gfp) +{ +struct folio *folio =__filemap_get_folio (mapping, index, +FGP_LOCK |FGP_ACCESSED |FGP_CREAT , gfp); +struct page *page; + +if (IS_ERR (folio)) +return ERR_CAST (folio); + +if (!folio_test_uptodate (folio)) +return folio_file_page (folio, index); + +/* Use a temporary page to avoid data corruption */ +folio_unlock (folio); +folio_put (folio); + page =alloc_page (gfp); +if (!page) +return ERR_PTR (-ENOMEM ); +__SetPageLocked (page); +return page; +} +/* * ni_readpage_cmpr *
@@ -2076,9 +2099,9 @@ int ni_readpage_cmpr(struct ntfs_inode *if (i == idx)continue ; - pg =find_or_create_page (mapping, index, gfp_mask); -if (!pg) { - err = -ENOMEM ; + pg =ntfs_lock_new_page (mapping, index, gfp_mask); +if (IS_ERR (pg)) { + err =PTR_ERR (pg); goto out1; } pages[i] = pg;
@@ -2177,13 +2200,13 @@ int ni_decompress_file(struct ntfs_inodefor (i =0 ; i < pages_per_frame; i++, index++) {struct page *pg; - pg =find_or_create_page (mapping, index, gfp_mask); -if (!pg) { + pg =ntfs_lock_new_page (mapping, index, gfp_mask); +if (IS_ERR (pg)) {while (i--) {unlock_page (pages[i]);put_page (pages[i]); } - err = -ENOMEM ; + err =PTR_ERR (pg); goto out; } pages[i] = pg;
Greg Kroah-Hartman
maintainerPATCH 91/312 ASoC: codecs: wcd939x: fix regmap leak on probe failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 86dc090f737953f16f8dc60c546ae7854690d4f6 upstream.
The soundwire regmap that may be allocated during probe is not freed on late probe failures.
Add the missing error handling.
--- sound/soc/codecs/wcd939x-sdw.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/codecs/wcd939x-sdw.c +7 -1
@@ -1400,12 +1400,18 @@ static int wcd9390_probe(struct sdw_slav ret =component_add (dev, &wcd_sdw_component_ops);if (ret) -return ret; + goto err_free_regmap;/* Set suspended until aggregate device is bind */ pm_runtime_set_suspended (dev);return 0 ; + +err_free_regmap: +if (wcd->regmap) +regmap_exit (wcd->regmap); + +return ret; }static int wcd9390_remove (struct sdw_slave *pdev)
Greg Kroah-Hartman
maintainerPATCH 92/312 ASoC: stm32: sai: fix device leak on probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e26ff429eaf10c4ef1bc3dabd9bf27eb54b7e1f4 upstream.
Make sure to drop the reference taken when looking up the sync provider device and its driver data during DAI probe on probe failures and on unbind.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- sound/soc/stm/stm32_sai.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/stm/stm32_sai.c +1 -1
@@ -143,6 +143,7 @@ static int stm32_sai_set_sync(struct stm } sai_provider =platform_get_drvdata (pdev); +put_device (&pdev->dev);if (!sai_provider) {dev_err (&sai_client->pdev->dev,"SAI sync provider data not found\n" );
@@ -159,7 +160,6 @@ static int stm32_sai_set_sync(struct stm ret =stm32_sai_sync_conf_provider (sai_provider, synco); error: -put_device (&pdev->dev);of_node_put (np_provider);return ret; }
Greg Kroah-Hartman
maintainerPATCH 93/312 ASoC: stm32: sai: fix clk prepare imbalance on probe failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 312ec2f0d9d1a5656f76d770bbf1d967e9289aa7 upstream.
Make sure to unprepare the parent clock also on probe failures (e.g. probe deferral).
--- sound/soc/stm/stm32_sai_sub.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
sound/soc/stm/stm32_sai_sub.c +21 -7
@@ -1634,14 +1634,21 @@ static int stm32_sai_sub_parse_of(structif (of_property_present (np,"#clock-cells" )) { ret =stm32_sai_add_mclk_provider (sai);if (ret <0 ) -return ret; + goto err_unprepare_pclk; }else { sai->sai_mclk =devm_clk_get_optional (&pdev->dev,"MCLK" ); -if (IS_ERR (sai->sai_mclk)) -return PTR_ERR (sai->sai_mclk); +if (IS_ERR (sai->sai_mclk)) { + ret =PTR_ERR (sai->sai_mclk); + goto err_unprepare_pclk; + } }return 0 ; + +err_unprepare_pclk: +clk_unprepare (sai->pdata->pclk); + +return ret; }static int stm32_sai_sub_probe (struct platform_device *pdev)
@@ -1688,26 +1695,33 @@ static int stm32_sai_sub_probe(struct pl IRQF_SHARED, dev_name(&pdev->dev), sai);if (ret) {dev_err (&pdev->dev,"IRQ request returned %d\n" , ret); -return ret; + goto err_unprepare_pclk; }if (STM_SAI_PROTOCOL_IS_SPDIF (sai)) conf = &stm32_sai_pcm_config_spdif; ret =snd_dmaengine_pcm_register (&pdev->dev, conf,0 ); -if (ret) -return dev_err_probe (&pdev->dev, ret,"Could not register pcm dma\n" ); +if (ret) { + ret =dev_err_probe (&pdev->dev, ret,"Could not register pcm dma\n" ); + goto err_unprepare_pclk; + } ret =snd_soc_register_component (&pdev->dev, &stm32_component, &sai->cpu_dai_drv,1 );if (ret) {snd_dmaengine_pcm_unregister (&pdev->dev); -return ret; + goto err_unprepare_pclk; }pm_runtime_enable (&pdev->dev);return 0 ; + +err_unprepare_pclk: +clk_unprepare (sai->pdata->pclk); + +return ret; }static void stm32_sai_sub_remove (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 94/312 ASoC: stm32: sai: fix OF node leak on probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 23261f0de09427367e99f39f588e31e2856a690e upstream.
The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe.
Make sure to drop the reference on platform probe failures (e.g. probe deferral) and on driver unbind.
This also avoids a potential use-after-free in case the DAI is ever reprobed without first rebinding the platform driver.
--- sound/soc/stm/stm32_sai.c | 12 +++--------- sound/soc/stm/stm32_sai_sub.c | 23 ++++++++++++++++------- 2 files changed, 19 insertions(+), 16 deletions(-)
sound/soc/stm/stm32_sai.c +3 -9
@@ -138,7 +138,6 @@ static int stm32_sai_set_sync(struct stmif (!pdev) {dev_err (&sai_client->pdev->dev,"Device not found for node %pOFn\n" , np_provider); -of_node_put (np_provider);return -ENODEV ; }
@@ -147,21 +146,16 @@ static int stm32_sai_set_sync(struct stmif (!sai_provider) {dev_err (&sai_client->pdev->dev,"SAI sync provider data not found\n" ); - ret = -EINVAL ; - goto error; +return -EINVAL ; }/* Configure sync client */ ret =stm32_sai_sync_conf_client (sai_client, synci);if (ret <0 ) - goto error; +return ret;/* Configure sync provider */ - ret =stm32_sai_sync_conf_provider (sai_provider, synco); - -error: -of_node_put (np_provider); -return ret; +return stm32_sai_sync_conf_provider (sai_provider, synco); }static int stm32_sai_get_parent_clk (struct stm32_sai_data *sai)
sound/soc/stm/stm32_sai_sub.c +16 -7
@@ -1586,7 +1586,8 @@ static int stm32_sai_sub_parse_of(structdev_err (&pdev->dev,"External synchro not supported\n" );of_node_put (args.np); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_sync_provider; } sai->sync =SAI_SYNC_EXTERNAL ;
@@ -1595,7 +1596,8 @@ static int stm32_sai_sub_parse_of(struct (sai->synci > (SAI_GCR_SYNCIN_MAX + 1))) {dev_err (&pdev->dev,"Wrong SAI index\n" );of_node_put (args.np); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_sync_provider; } if (of_property_match_string(args.np, "compatible",
@@ -1609,7 +1611,8 @@ static int stm32_sai_sub_parse_of(structif (!sai->synco) {dev_err (&pdev->dev,"Unknown SAI sub-block\n" );of_node_put (args.np); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_sync_provider; } }
@@ -1619,13 +1622,15 @@ static int stm32_sai_sub_parse_of(structof_node_put (args.np); sai->sai_ck =devm_clk_get (&pdev->dev,"sai_ck" ); -if (IS_ERR (sai->sai_ck)) -return dev_err_probe (&pdev->dev,PTR_ERR (sai->sai_ck), -"Missing kernel clock sai_ck\n" ); +if (IS_ERR (sai->sai_ck)) { + ret =dev_err_probe (&pdev->dev,PTR_ERR (sai->sai_ck), +"Missing kernel clock sai_ck\n" ); + goto err_put_sync_provider; + } ret =clk_prepare (sai->pdata->pclk);if (ret <0 ) -return ret; + goto err_put_sync_provider;if (STM_SAI_IS_F4 (sai->pdata))return 0 ;
@@ -1647,6 +1652,8 @@ static int stm32_sai_sub_parse_of(struct err_unprepare_pclk:clk_unprepare (sai->pdata->pclk); +err_put_sync_provider: +of_node_put (sai->np_sync_provider);return ret; }
@@ -1720,6 +1727,7 @@ static int stm32_sai_sub_probe(struct pl err_unprepare_pclk:clk_unprepare (sai->pdata->pclk); +of_node_put (sai->np_sync_provider);return ret; }
@@ -1732,6 +1740,7 @@ static void stm32_sai_sub_remove(structsnd_dmaengine_pcm_unregister (&pdev->dev);snd_soc_unregister_component (&pdev->dev);pm_runtime_disable (&pdev->dev); +of_node_put (sai->np_sync_provider); }static int stm32_sai_sub_suspend (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 95/312 ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 52a525011cb8e293799a085436f026f2958403f9 upstream.
The full duplex audio starts with half duplex mode and then switch to full duplex mode (another FIFO reset) when both playback/capture streams available leading to random audio left/right channel swap issue. Fix this channel swap issue by detecting the full duplex condition by populating struct dup variable in startup() callback and synchronize starting both the play and capture at the same time in rz_ssi_start().
--- sound/soc/renesas/rz-ssi.c | 51 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 43 insertions(+), 8 deletions(-)
sound/soc/renesas/rz-ssi.c +43 -8
@@ -133,6 +133,12 @@ struct rz_ssi_priv {bool bckp_rise;/* Bit clock polarity (SSICR.BCKP) */ bool dma_rt; +struct { +bool tx_active; +bool rx_active; +bool one_stream_triggered; + } dup; +/* Full duplex communication support */ struct {unsigned int rate;
@@ -332,13 +338,12 @@ static int rz_ssi_start(struct rz_ssi_prbool is_full_duplex;u32 ssicr, ssifcr; - is_full_duplex =rz_ssi_is_stream_running (&ssi->playback) || -rz_ssi_is_stream_running (&ssi->capture); + is_full_duplex = ssi->dup.tx_active && ssi->dup.rx_active; ssicr =rz_ssi_reg_readl (ssi,SSICR ); ssifcr =rz_ssi_reg_readl (ssi,SSIFCR );if (!is_full_duplex) { ssifcr &= ~0xF ; - }else { + }else if (ssi->dup.one_stream_triggered) {rz_ssi_reg_mask_setl (ssi,SSICR ,SSICR_TEN |SSICR_REN ,0 );rz_ssi_set_idle (ssi); ssifcr &= ~SSIFCR_FIFO_RST ;
@@ -374,12 +379,16 @@ static int rz_ssi_start(struct rz_ssi_pr SSISR_RUIRQ), 0); strm->running =1 ; -if (is_full_duplex) - ssicr |=SSICR_TEN |SSICR_REN ; -else +if (!is_full_duplex) { ssicr |= is_play ?SSICR_TEN :SSICR_REN ; - -rz_ssi_reg_writel (ssi,SSICR , ssicr); +rz_ssi_reg_writel (ssi,SSICR , ssicr); + }else if (ssi->dup.one_stream_triggered) { + ssicr |=SSICR_TEN |SSICR_REN ; +rz_ssi_reg_writel (ssi,SSICR , ssicr); + ssi->dup.one_stream_triggered = false; + }else { + ssi->dup.one_stream_triggered = true; + }return 0 ; }
@@ -915,6 +924,30 @@ static int rz_ssi_dai_set_fmt(struct sndreturn 0 ; } +static int rz_ssi_startup (struct snd_pcm_substream *substream, +struct snd_soc_dai *dai) +{ +struct rz_ssi_priv *ssi =snd_soc_dai_get_drvdata (dai); + +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) + ssi->dup.tx_active = true; +else + ssi->dup.rx_active = true; + +return 0 ; +} + +static void rz_ssi_shutdown (struct snd_pcm_substream *substream, +struct snd_soc_dai *dai) +{ +struct rz_ssi_priv *ssi =snd_soc_dai_get_drvdata (dai); + +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) + ssi->dup.tx_active = false; +else + ssi->dup.rx_active = false; +} + static bool rz_ssi_is_valid_hw_params(struct rz_ssi_priv *ssi, unsigned int rate, unsigned int channels, unsigned int sample_width,
@@ -985,6 +1018,8 @@ static int rz_ssi_dai_hw_params(struct s }static const struct snd_soc_dai_ops rz_ssi_dai_ops = { + .startup = rz_ssi_startup, + .shutdown = rz_ssi_shutdown, .trigger = rz_ssi_dai_trigger, .set_fmt = rz_ssi_dai_set_fmt, .hw_params = rz_ssi_dai_hw_params,
Greg Kroah-Hartman
maintainerPATCH 96/312 ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 2bae7beda19f3b2dc6ab2062c94df19c27923712 upstream.
The strm->sample_width is not filled during rz_ssi_dai_hw_params(). This wrong value is used for caching sample_width in struct hw_params_cache. Fix this issue by replacing 'strm->sample_width'->'params_width(params)' in rz_ssi_dai_hw_params(). After this drop the variable sample_width from struct rz_ssi_stream as it is unused.
--- sound/soc/renesas/rz-ssi.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
sound/soc/renesas/rz-ssi.c +4 -9
@@ -13,6 +13,7 @@#include <linux/module.h> #include <linux/pm_runtime.h> #include <linux/reset.h> +#include <sound/pcm_params.h> #include <sound/soc.h> /* REGISTER OFFSET */
@@ -87,7 +88,6 @@ struct rz_ssi_stream {int dma_buffer_pos;/* The address for the next DMA descriptor */ int completed_dma_buf_pos;/* The address of the last completed DMA descriptor. */ int period_counter;/* for keeping track of periods transferred */ -int sample_width;int buffer_pos;/* current frame position in the buffer */ int running;/* 0=stopped, 1=running */
@@ -217,10 +217,7 @@ static inline bool rz_ssi_is_stream_runnstatic void rz_ssi_stream_init (struct rz_ssi_stream *strm,struct snd_pcm_substream *substream) { -struct snd_pcm_runtime *runtime = substream->runtime; -rz_ssi_set_substream (strm, substream); - strm->sample_width =samples_to_bytes (runtime,1 ); strm->dma_buffer_pos =0 ; strm->completed_dma_buf_pos =0 ; strm->period_counter =0 ;
@@ -978,9 +975,9 @@ static int rz_ssi_dai_hw_params(struct s struct snd_soc_dai *dai) {struct rz_ssi_priv *ssi =snd_soc_dai_get_drvdata (dai); -struct rz_ssi_stream *strm =rz_ssi_stream_get (ssi, substream);unsigned int sample_bits =hw_param_interval (params,SNDRV_PCM_HW_PARAM_SAMPLE_BITS )->min; +unsigned int sample_width =params_width (params);unsigned int channels =params_channels (params);unsigned int rate =params_rate (params);int ret;
@@ -999,16 +996,14 @@ static int rz_ssi_dai_hw_params(struct sif (rz_ssi_is_stream_running (&ssi->playback) ||rz_ssi_is_stream_running (&ssi->capture)) { -if (rz_ssi_is_valid_hw_params (ssi, rate, channels, - strm->sample_width, sample_bits)) +if (rz_ssi_is_valid_hw_params (ssi, rate, channels, sample_width, sample_bits))return 0 ;dev_err (ssi->dev,"Full duplex needs same HW params\n" );return -EINVAL ; } -rz_ssi_cache_hw_params (ssi, rate, channels, strm->sample_width, - sample_bits); +rz_ssi_cache_hw_params (ssi, rate, channels, sample_width, sample_bits); ret =rz_ssi_swreset (ssi);if (ret)
Greg Kroah-Hartman
maintainerPATCH 97/312 ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 578ccfe344c5f421c2c6343b872995b397ffd3ff upstream.
In wcd937x_bind(), the driver calls of_sdw_find_device_by_node() to obtain references to RX and TX SoundWire devices, which increment the device reference counts. However, the corresponding put_device() are missing in both the error paths and the normal unbind path in wcd937x_unbind().
Add proper error handling with put_device() calls in all error paths of wcd937x_bind() and ensure devices are released in wcd937x_unbind().
Found by code review.
--- sound/soc/codecs/wcd937x.c | 43 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 9 deletions(-)
sound/soc/codecs/wcd937x.c +34 -9
@@ -2748,7 +2748,8 @@ static int wcd937x_bind(struct device *d wcd937x->rxdev =of_sdw_find_device_by_node (wcd937x->rxnode);if (!wcd937x->rxdev) {dev_err (dev,"could not find slave with matching of node\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_component_unbind; } wcd937x->sdw_priv[AIF1_PB ] =dev_get_drvdata (wcd937x->rxdev);
@@ -2757,7 +2758,8 @@ static int wcd937x_bind(struct device *d wcd937x->txdev =of_sdw_find_device_by_node (wcd937x->txnode);if (!wcd937x->txdev) {dev_err (dev,"could not find txslave with matching of node\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_rxdev; } wcd937x->sdw_priv[AIF1_CAP ] =dev_get_drvdata (wcd937x->txdev);
@@ -2765,7 +2767,8 @@ static int wcd937x_bind(struct device *d wcd937x->tx_sdw_dev =dev_to_sdw_dev (wcd937x->txdev);if (!wcd937x->tx_sdw_dev) {dev_err (dev,"could not get txslave with matching of dev\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_txdev; }/*
@@ -2775,31 +2778,35 @@ static int wcd937x_bind(struct device *dif (!device_link_add (wcd937x->rxdev, wcd937x->txdev,DL_FLAG_STATELESS |DL_FLAG_PM_RUNTIME )) {dev_err (dev,"Could not devlink TX and RX\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_txdev; }if (!device_link_add (dev, wcd937x->txdev,DL_FLAG_STATELESS |DL_FLAG_PM_RUNTIME )) {dev_err (dev,"Could not devlink WCD and TX\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_remove_link1; }if (!device_link_add (dev, wcd937x->rxdev,DL_FLAG_STATELESS |DL_FLAG_PM_RUNTIME )) {dev_err (dev,"Could not devlink WCD and RX\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_remove_link2; } wcd937x->regmap = wcd937x->sdw_priv[AIF1_CAP ]->regmap;if (!wcd937x->regmap) {dev_err (dev,"could not get TX device regmap\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_remove_link3; } ret =wcd937x_irq_init (wcd937x, dev);if (ret) {dev_err (dev,"IRQ init failed: %d\n" , ret); -return ret; + goto err_remove_link3; } wcd937x->sdw_priv[AIF1_PB ]->slave_irq = wcd937x->virq;
@@ -2809,9 +2816,25 @@ static int wcd937x_bind(struct device *d ret =snd_soc_register_component (dev, &soc_codec_dev_wcd937x, wcd937x_dais,ARRAY_SIZE (wcd937x_dais)); -if (ret) +if (ret) {dev_err (dev,"Codec registration failed\n" ); + goto err_remove_link3; + } + +return ret; +err_remove_link3: +device_link_remove (dev, wcd937x->rxdev); +err_remove_link2: +device_link_remove (dev, wcd937x->txdev); +err_remove_link1: +device_link_remove (wcd937x->rxdev, wcd937x->txdev); +err_put_txdev: +put_device (wcd937x->txdev); +err_put_rxdev: +put_device (wcd937x->rxdev); +err_component_unbind: +component_unbind_all (dev, wcd937x);return ret; }
@@ -2825,6 +2848,8 @@ static void wcd937x_unbind(struct devicedevice_link_remove (wcd937x->rxdev, wcd937x->txdev);component_unbind_all (dev, wcd937x);mutex_destroy (&wcd937x->micb_lock); +put_device (wcd937x->txdev); +put_device (wcd937x->rxdev); }static const struct component_master_ops wcd937x_comp_ops = {
Greg Kroah-Hartman
maintainerPATCH 98/312 ASoC: codecs: pm4125: Fix potential conflict when probing two devices
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit fd94857a934cbe613353810a024c84d54826ead3 upstream.
Qualcomm PM4125 codec is always a single device on the board, however nothing stops board designers to have two of them, thus same device driver could probe twice.
Device driver is not ready for that case, because it allocates statically 'struct regmap_irq_chip' as non-const and stores during component bind in 'irq_drv_data' member a pointer to per-probe state container ('struct pm4125_priv').
Second component bind would overwrite the 'irq_drv_data' from previous device probe, so interrupts would be executed in wrong context.
The fix makes use of currently unused 'struct pm4125_priv' member 'pm4125_regmap_irq_chip', but renames it to a shorter name.
--- sound/soc/codecs/pm4125.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
sound/soc/codecs/pm4125.c +12 -5
@@ -70,7 +70,7 @@ struct pm4125_priv {struct wcd_mbhc_config mbhc_cfg;struct wcd_mbhc_intr intr_ids;struct irq_domain *virq; -const struct regmap_irq_chip *pm4125_regmap_irq_chip; +const struct regmap_irq_chip *chip_desc;struct regmap_irq_chip_data *irq_chip;struct snd_soc_jack *jack;unsigned long status_mask;
@@ -179,7 +179,7 @@ static const u32 pm4125_config_regs[] = PM4125_DIG_SWR_INTR_LEVEL_0, }; -static struct regmap_irq_chip pm4125_regmap_irq_chip = { +static const struct regmap_irq_chip pm4125_regmap_irq_chip = { .name ="pm4125" , .irqs = pm4125_irqs, .num_irqs =ARRAY_SIZE (pm4125_irqs),
@@ -1320,10 +1320,8 @@ static int pm4125_irq_init(struct pm4125return -EINVAL ; } - pm4125_regmap_irq_chip.irq_drv_data = pm4125; -return devm_regmap_add_irq_chip (dev, pm4125->regmap,irq_create_mapping (pm4125->virq,0 ), -IRQF_ONESHOT ,0 , &pm4125_regmap_irq_chip, +IRQF_ONESHOT ,0 , pm4125->chip_desc, &pm4125->irq_chip); }
@@ -1695,6 +1693,7 @@ static int pm4125_probe(struct platform_ {struct component_match *match =NULL ;struct device *dev = &pdev->dev; +struct regmap_irq_chip *chip_desc;struct pm4125_priv *pm4125;struct wcd_mbhc_config *cfg;int ret;
@@ -1705,6 +1704,14 @@ static int pm4125_probe(struct platform_dev_set_drvdata (dev, pm4125); + chip_desc =devm_kmemdup (dev, &pm4125_regmap_irq_chip, +sizeof (pm4125_regmap_irq_chip), +GFP_KERNEL ); +if (!chip_desc) +return -ENOMEM ; + chip_desc->irq_drv_data = pm4125; + pm4125->chip_desc = chip_desc; + ret =devm_regulator_bulk_get_enable (dev,ARRAY_SIZE (pm4125_power_supplies), pm4125_power_supplies);if (ret)
Greg Kroah-Hartman
maintainerPATCH 99/312 ASoC: codecs: pm4125: Remove irq_chip on component unbind
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit e65b871c9b5af9265aefc5b8cd34993586d93aab upstream.
Component bind uses devm_regmap_add_irq_chip() to add IRQ chip, so it will be removed only during driver unbind, not component unbind. A component unbind-bind cycle for the same Linux device lifetime would result in two chips added. Fix this by manually removing the IRQ chip during component unbind.
--- sound/soc/codecs/pm4125.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/pm4125.c +2 -0
@@ -1658,6 +1658,8 @@ static void pm4125_unbind(struct devicestruct pm4125_priv *pm4125 =dev_get_drvdata (dev);snd_soc_unregister_component (dev); +devm_regmap_del_irq_chip (dev,irq_find_mapping (pm4125->virq,0 ), + pm4125->irq_chip);device_link_remove (dev, pm4125->txdev);device_link_remove (dev, pm4125->rxdev);device_link_remove (pm4125->rxdev, pm4125->txdev);
Greg Kroah-Hartman
maintainerPATCH 100/312 ASoC: codecs: lpass-tx-macro: fix SM6115 support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit 7c63b5a8ed972a2c8c03d984f6a43349007cea93 upstream.
SM6115 does have soundwire controller in tx. For some reason we ended up with this incorrect patch.
Fix this by adding the flag to reflect this in SoC data.
--- sound/soc/codecs/lpass-tx-macro.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/codecs/lpass-tx-macro.c +2 -1
@@ -2473,7 +2473,8 @@ static const struct tx_macro_data lpass_ };static const struct tx_macro_data lpass_ver_10_sm6115 = { - .flags =LPASS_MACRO_FLAG_HAS_NPL_CLOCK , + .flags =LPASS_MACRO_FLAG_HAS_NPL_CLOCK | +LPASS_MACRO_FLAG_RESET_SWR , .ver =LPASS_VER_10_0_0 , .extra_widgets = tx_macro_dapm_widgets_v9_2, .extra_widgets_num =ARRAY_SIZE (tx_macro_dapm_widgets_v9_2),
Greg Kroah-Hartman
maintainerPATCH 101/312 ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit bcba17279327c6e85dee6a97014dc642e2dc93cc upstream.
For some reason we endedup allocating sdw_stream_runtime for every cpu dai, this has two issues.
1. we never set snd_soc_dai_set_stream for non soundwire dai, which means there is no way that we can free this, resulting in memory leak
2. startup and shutdown callbacks can be called without hw_params callback called. This combination results in memory leak
because machine driver sruntime array pointer is only set in hw_params callback.
Fix this by
1. adding a helper function to get sdw_runtime for substream
which can be used by shutdown callback to get hold of sruntime to free.
2. only allocate sdw_runtime for soundwire dais.
--- sound/soc/qcom/sc7280.c | 2 sound/soc/qcom/sc8280xp.c | 2 sound/soc/qcom/sdw.c | 105 +++++++++++++++++++++++++--------------------- sound/soc/qcom/sdw.h | 1 sound/soc/qcom/sm8250.c | 2 sound/soc/qcom/x1e80100.c | 2 6 files changed, 64 insertions(+), 50 deletions(-)
sound/soc/qcom/sc7280.c +1 -1
@@ -317,7 +317,7 @@ static void sc7280_snd_shutdown(struct sstruct snd_soc_card *card = rtd->card;struct sc7280_snd_data *data =snd_soc_card_get_drvdata (card);struct snd_soc_dai *cpu_dai =snd_soc_rtd_to_cpu (rtd,0 ); -struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id]; +struct sdw_stream_runtime *sruntime =qcom_snd_sdw_get_stream (substream);switch (cpu_dai->id) {case MI2S_PRIMARY :
sound/soc/qcom/sc8280xp.c +1 -1
@@ -73,7 +73,7 @@ static void sc8280xp_snd_shutdown(structstruct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct snd_soc_dai *cpu_dai =snd_soc_rtd_to_cpu (rtd,0 );struct sc8280xp_snd_data *pdata =snd_soc_card_get_drvdata (rtd->card); -struct sdw_stream_runtime *sruntime = pdata->sruntime[cpu_dai->id]; +struct sdw_stream_runtime *sruntime =qcom_snd_sdw_get_stream (substream); pdata->sruntime[cpu_dai->id] =NULL ;sdw_release_stream (sruntime);
sound/soc/qcom/sdw.c +59 -46
143 lines not on this page · raw message
sound/soc/qcom/sdw.h +1 -0
@@ -10,6 +10,7 @@ int qcom_snd_sdw_startup(struct snd_pcm_int qcom_snd_sdw_prepare (struct snd_pcm_substream *substream,struct sdw_stream_runtime *runtime,bool *stream_prepared); +struct sdw_stream_runtime *qcom_snd_sdw_get_stream (struct snd_pcm_substream *stream);int qcom_snd_sdw_hw_params (struct snd_pcm_substream *substream,struct snd_pcm_hw_params *params,struct sdw_stream_runtime **psruntime);
sound/soc/qcom/sm8250.c +1 -1
@@ -117,7 +117,7 @@ static void sm8250_snd_shutdown(struct sstruct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct snd_soc_dai *cpu_dai =snd_soc_rtd_to_cpu (rtd,0 );struct sm8250_snd_data *data =snd_soc_card_get_drvdata (rtd->card); -struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id]; +struct sdw_stream_runtime *sruntime =qcom_snd_sdw_get_stream (substream); data->sruntime[cpu_dai->id] =NULL ;sdw_release_stream (sruntime);
sound/soc/qcom/x1e80100.c +1 -1
@@ -55,7 +55,7 @@ static void x1e80100_snd_shutdown(structstruct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct snd_soc_dai *cpu_dai =snd_soc_rtd_to_cpu (rtd,0 );struct x1e80100_snd_data *data =snd_soc_card_get_drvdata (rtd->card); -struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id]; +struct sdw_stream_runtime *sruntime =qcom_snd_sdw_get_stream (substream); data->sruntime[cpu_dai->id] =NULL ;sdw_release_stream (sruntime);
Greg Kroah-Hartman
maintainerPATCH 102/312 ASoC: cs35l41: Always return 0 when a subsystem ID is found
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Naim <[email protected]>
commit b0ff70e9d4fe46cece25eb97b9b9b0166624af95 upstream.
When trying to get the system name in the _HID path, after successfully retrieving the subsystem ID the return value isn't set to 0 but instead still kept at -ENODATA, leading to a false negative:
[ 12.382507] cs35l41 spi-VLV1776:00: Subsystem ID: VLV1776 [ 12.382521] cs35l41 spi-VLV1776:00: probe with driver cs35l41 failed with error -61
Always return 0 when a subsystem ID is found to mitigate these false negatives.
--- sound/soc/codecs/cs35l41.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/codecs/cs35l41.c +4 -3
@@ -1188,13 +1188,14 @@ static int cs35l41_get_system_name(struct cs35l41_private *cs35l41) } } -err:if (sub) { cs35l41->dsp.system_name = sub;dev_info (cs35l41->dev,"Subsystem ID: %s\n" , cs35l41->dsp.system_name); - }else -dev_warn (cs35l41->dev,"Subsystem ID not found\n" ); +return 0 ; + } +err: +dev_warn (cs35l41->dev,"Subsystem ID not found\n" );return ret; }
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 103/312 ASoC: codecs: Fix error handling in pm4125 audio codec driver
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 2196e8172bee2002e9baaa0d02b2f9f2dd213949 upstream.
pm4125_bind() acquires references through pm4125_sdw_device_get() but fails to release them in error paths and during normal unbind operations. This could result in reference count leaks, preventing proper cleanup and potentially causing resource exhaustion over multiple bind/unbind cycles.
Calling path: pm4125_sdw_device_get() -> bus_find_device_by_of_node() -> bus_find_device() -> get_device.
Found by code review.
--- sound/soc/codecs/pm4125.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
sound/soc/codecs/pm4125.c +18 -3
@@ -1549,6 +1549,10 @@ static int pm4125_bind(struct device *destruct device_link *devlink;int ret; +/* Initialize device pointers to NULL for safe cleanup */ + pm4125->rxdev =NULL ; + pm4125->txdev =NULL ; +/* Give the soundwire subdevices some more time to settle */ usleep_range (15000 ,15010 );
@@ -1572,7 +1576,7 @@ static int pm4125_bind(struct device *deif (!pm4125->txdev) {dev_err (dev,"could not find txslave with matching of node\n" ); ret = -EINVAL ; - goto error_unbind_all; + goto error_put_rx; } pm4125->sdw_priv[AIF1_CAP ] =dev_get_drvdata (pm4125->txdev);
@@ -1582,7 +1586,7 @@ static int pm4125_bind(struct device *deif (!pm4125->tx_sdw_dev) {dev_err (dev,"could not get txslave with matching of dev\n" ); ret = -EINVAL ; - goto error_unbind_all; + goto error_put_tx; }/*
@@ -1594,7 +1598,7 @@ static int pm4125_bind(struct device *deif (!devlink) {dev_err (dev,"Could not devlink TX and RX\n" ); ret = -EINVAL ; - goto error_unbind_all; + goto error_put_tx; } devlink = device_link_add(dev, pm4125->txdev,
@@ -1648,6 +1652,10 @@ link_remove_dev_tx:device_link_remove (dev, pm4125->txdev); link_remove_rx_tx:device_link_remove (pm4125->rxdev, pm4125->txdev); +error_put_tx: +put_device (pm4125->txdev); +error_put_rx: +put_device (pm4125->rxdev); error_unbind_all:component_unbind_all (dev, pm4125);return ret;
@@ -1663,6 +1671,13 @@ static void pm4125_unbind(struct devicedevice_link_remove (dev, pm4125->txdev);device_link_remove (dev, pm4125->rxdev);device_link_remove (pm4125->rxdev, pm4125->txdev); + +/* Release device references acquired in bind */ +if (pm4125->txdev) +put_device (pm4125->txdev); +if (pm4125->rxdev) +put_device (pm4125->rxdev); +component_unbind_all (dev, pm4125); }
Greg Kroah-Hartman
maintainerPATCH 104/312 ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit 950a4e5788fc7dc6e8e93614a7d4d0449c39fb8d upstream.
Driver does not expect the appl_ptr to move backward and requires explict sync. Make sure that the userspace does not do appl_ptr rewinds by specifying the correct flags in pcm_info.
Without this patch, the result could be a forever loop as current logic assumes that appl_ptr can only move forward.
--- sound/soc/qcom/qdsp6/q6apm-dai.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/qcom/qdsp6/q6apm-dai.c +2 -0
@@ -86,6 +86,7 @@ static const struct snd_pcm_hardware q6a .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER |SNDRV_PCM_INFO_MMAP_VALID |SNDRV_PCM_INFO_INTERLEAVED |SNDRV_PCM_INFO_PAUSE |SNDRV_PCM_INFO_RESUME | +SNDRV_PCM_INFO_NO_REWINDS |SNDRV_PCM_INFO_SYNC_APPLPTR | SNDRV_PCM_INFO_BATCH), .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE), .rates = SNDRV_PCM_RATE_8000_48000,
@@ -105,6 +106,7 @@ static const struct snd_pcm_hardware q6a .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER |SNDRV_PCM_INFO_MMAP_VALID |SNDRV_PCM_INFO_INTERLEAVED |SNDRV_PCM_INFO_PAUSE |SNDRV_PCM_INFO_RESUME | +SNDRV_PCM_INFO_NO_REWINDS |SNDRV_PCM_INFO_SYNC_APPLPTR | SNDRV_PCM_INFO_BATCH), .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE), .rates = SNDRV_PCM_RATE_8000_192000,
Greg Kroah-Hartman
maintainerPATCH 105/312 ASoC: qcom: q6asm-dai: perform correct state check before closing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit bfbb12dfa144d45575bcfe139a71360b3ce80237 upstream.
Do not stop a q6asm stream if its not started, this can result in unnecessary dsp command which will timeout anyway something like below:
q6asm-dai ab00000.remoteproc:glink-edge:apr:service@7:dais: CMD 10bcd timeout
Fix this by correctly checking the state.
--- sound/soc/qcom/qdsp6/q6asm-dai.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/qcom/qdsp6/q6asm-dai.c +2 -1
@@ -233,13 +233,14 @@ static int q6asm_dai_prepare(struct snd_ prtd->pcm_count =snd_pcm_lib_period_bytes (substream); prtd->pcm_irq_pos =0 ;/* rate and channels are sent to audio driver */ -if (prtd->state) { +if (prtd->state ==Q6ASM_STREAM_RUNNING ) {/* clear the previous setup if any */ q6asm_cmd (prtd->audio_client, prtd->stream_id,CMD_CLOSE );q6asm_unmap_memory_regions (substream->stream, prtd->audio_client);q6routing_stream_close (soc_prtd->dai_link->id, substream->stream); + prtd->state =Q6ASM_STREAM_STOPPED ; } ret = q6asm_map_memory_regions(substream->stream, prtd->audio_client,
Greg Kroah-Hartman
maintainerPATCH 106/312 ASoC: qcom: q6adm: the the copp device only during last instance
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit 74cc4f3ea4e99262ba0d619c6a4ee33e2cd47f65 upstream.
A matching Common object post processing instance is normally resused across multiple streams. However currently we close this on DSP even though there is a refcount on this copp object, this can result in below error.
q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0 qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2 q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2] q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0 qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2 q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2] qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2 qcom-q6adm aprsvc:service:4:8: DSP returned error[2]
qcom-q6adm aprsvc:service:4:8: Failed to close copp -22
qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2 qcom-q6adm aprsvc:service:4:8: DSP returned error[2]
qcom-q6adm aprsvc:service:4:8: Failed to close copp -22
Fix this by addressing moving the adm_close to copp_kref destructor callback.
--- sound/soc/qcom/qdsp6/q6adm.c | 146 ++++++++++++++++++++----------------------- 1 file changed, 71 insertions(+), 75 deletions(-)
sound/soc/qcom/qdsp6/q6adm.c +71 -75
@@ -109,11 +109,75 @@ static struct q6copp *q6adm_find_copp(st } +static int q6adm_apr_send_copp_pkt (struct q6adm *adm,struct q6copp *copp, +struct apr_pkt *pkt,uint32_t rsp_opcode) +{ +struct device *dev = adm->dev; +uint32_t opcode = pkt->hdr.opcode; +int ret; + +mutex_lock (&adm->lock); + copp->result.opcode =0 ; + copp->result.status =0 ; + ret =apr_send_pkt (adm->apr, pkt); +if (ret <0 ) { +dev_err (dev,"Failed to send APR packet\n" ); + ret = -EINVAL ; + goto err; + } + +/* Wait for the callback with copp id */ +if (rsp_opcode) + ret =wait_event_timeout (copp->wait, + (copp->result.opcode == opcode) || + (copp->result.opcode == rsp_opcode), +msecs_to_jiffies (TIMEOUT_MS )); +else + ret =wait_event_timeout (copp->wait, + (copp->result.opcode == opcode), +msecs_to_jiffies (TIMEOUT_MS )); + +if (!ret) { +dev_err (dev,"ADM copp cmd timedout\n" ); + ret = -ETIMEDOUT ; + }else if (copp->result.status >0 ) { +dev_err (dev,"DSP returned error[%d]\n" , + copp->result.status); + ret = -EINVAL ; + } + +err: +mutex_unlock (&adm->lock); +return ret; +} + +static int q6adm_device_close (struct q6adm *adm,struct q6copp *copp, +int port_id,int copp_idx) +{ +struct apr_pkt close; + + close.hdr.hdr_field =APR_HDR_FIELD (APR_MSG_TYPE_SEQ_CMD , +APR_HDR_LEN (APR_HDR_SIZE ), +APR_PKT_VER ); + close.hdr.pkt_size =sizeof (close); + close.hdr.src_port = port_id; + close.hdr.dest_port = copp->id; + close.hdr.token = port_id <<16 | copp_idx; + close.hdr.opcode =ADM_CMD_DEVICE_CLOSE_V5 ; + +return q6adm_apr_send_copp_pkt (adm, copp, &close,0 ); +} +static void q6adm_free_copp (struct kref *ref) { struct q6copp *c = container_of(ref, struct q6copp, refcount);struct q6adm *adm = c->adm;unsigned long flags; +int ret; + + ret =q6adm_device_close (adm, c, c->afe_port, c->copp_idx); +if (ret <0 ) +dev_err (adm->dev,"Failed to close copp %d\n" , ret);spin_lock_irqsave (&adm->copps_list_lock, flags);clear_bit (c->copp_idx, &adm->copp_bitmap[c->afe_port]);
@@ -155,13 +219,13 @@ static int q6adm_callback(struct apr_devswitch (result->opcode) {case ADM_CMD_DEVICE_OPEN_V5 :case ADM_CMD_DEVICE_CLOSE_V5 : - copp =q6adm_find_copp (adm, port_idx, copp_idx); -if (!copp) -return 0 ; - - copp->result = *result; -wake_up (&copp->wait); -kref_put (&copp->refcount, q6adm_free_copp); +list_for_each_entry (copp, &adm->copps_list, node) { +if ((port_idx == copp->afe_port) && (copp_idx == copp->copp_idx)) { + copp->result = *result; +wake_up (&copp->wait); +break ; + } + }break ;case ADM_CMD_MATRIX_MAP_ROUTINGS_V5 : adm->result = *result;
@@ -234,65 +298,6 @@ static struct q6copp *q6adm_alloc_copp(sreturn c; } -static int q6adm_apr_send_copp_pkt (struct q6adm *adm,struct q6copp *copp, -struct apr_pkt *pkt,uint32_t rsp_opcode) -{ -struct device *dev = adm->dev; -uint32_t opcode = pkt->hdr.opcode; -int ret; - -mutex_lock (&adm->lock); - copp->result.opcode =0 ; - copp->result.status =0 ; - ret =apr_send_pkt (adm->apr, pkt); -if (ret <0 ) { -dev_err (dev,"Failed to send APR packet\n" ); - ret = -EINVAL ; - goto err; - } - -/* Wait for the callback with copp id */ -if (rsp_opcode) - ret =wait_event_timeout (copp->wait, - (copp->result.opcode == opcode) || - (copp->result.opcode == rsp_opcode), -msecs_to_jiffies (TIMEOUT_MS )); -else - ret =wait_event_timeout (copp->wait, - (copp->result.opcode == opcode), -msecs_to_jiffies (TIMEOUT_MS )); - -if (!ret) { -dev_err (dev,"ADM copp cmd timedout\n" ); - ret = -ETIMEDOUT ; - }else if (copp->result.status >0 ) { -dev_err (dev,"DSP returned error[%d]\n" , - copp->result.status); - ret = -EINVAL ; - } - -err: -mutex_unlock (&adm->lock); -return ret; -} - -static int q6adm_device_close (struct q6adm *adm,struct q6copp *copp, -int port_id,int copp_idx) -{ -struct apr_pkt close; - - close.hdr.hdr_field =APR_HDR_FIELD (APR_MSG_TYPE_SEQ_CMD , -APR_HDR_LEN (APR_HDR_SIZE ), -APR_PKT_VER ); - close.hdr.pkt_size =sizeof (close); - close.hdr.src_port = port_id; - close.hdr.dest_port = copp->id; - close.hdr.token = port_id <<16 | copp_idx; - close.hdr.opcode =ADM_CMD_DEVICE_CLOSE_V5 ; - -return q6adm_apr_send_copp_pkt (adm, copp, &close,0 ); -} - static struct q6copp *q6adm_find_matching_copp(struct q6adm *adm, int port_id, int topology, int mode, int rate,
@@ -567,15 +572,6 @@ EXPORT_SYMBOL_GPL(q6adm_matrix_map);*/ int q6adm_close (struct device *dev,struct q6copp *copp) { -struct q6adm *adm =dev_get_drvdata (dev->parent); -int ret =0 ; - - ret =q6adm_device_close (adm, copp, copp->afe_port, copp->copp_idx); -if (ret <0 ) { -dev_err (adm->dev,"Failed to close copp %d\n" , ret); -return ret; - } -kref_put (&copp->refcount, q6adm_free_copp);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 107/312 ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit 81c53b52de21b8d5a3de55ebd06b6bf188bf7efd upstream.
DSP expects the periods to be aligned to fragment sizes, currently setting up to hw constriants on periods bytes is not going to work correctly as we can endup with periods sizes aligned to 32 bytes however not aligned to fragment size.
Update the constriants to use fragment size, and also set at step of 10ms for period size to accommodate DSP requirements of 10ms latency.
--- sound/soc/qcom/qdsp6/q6asm-dai.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/qcom/qdsp6/q6asm-dai.c +2 -2
@@ -404,13 +404,13 @@ static int q6asm_dai_open(struct snd_soc } ret =snd_pcm_hw_constraint_step (runtime,0 , -SNDRV_PCM_HW_PARAM_PERIOD_BYTES ,32 ); +SNDRV_PCM_HW_PARAM_PERIOD_SIZE ,480 );if (ret <0 ) {dev_err (dev,"constraint for period bytes step ret = %d\n" , ret); } ret =snd_pcm_hw_constraint_step (runtime,0 , -SNDRV_PCM_HW_PARAM_BUFFER_BYTES ,32 ); +SNDRV_PCM_HW_PARAM_BUFFER_SIZE ,480 );if (ret <0 ) {dev_err (dev,"constraint for buffer bytes step ret = %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 108/312 iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinhui Guo <[email protected]>
commit 75ba146c2674ba49ed8a222c67f9abfb4a4f2a4f upstream.
Fix a memory leak of struct amd_iommu_pci_segment in alloc_pci_segment() when system memory (or contiguous memory) is insufficient.
--- drivers/iommu/amd/init.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/iommu/amd/init.c +12 -3
@@ -1731,13 +1731,22 @@ static struct amd_iommu_pci_seg *__initlist_add_tail (&pci_seg->list, &amd_iommu_pci_seg_list);if (alloc_dev_table (pci_seg)) -return NULL ; + goto err_free_pci_seg;if (alloc_alias_table (pci_seg)) -return NULL ; + goto err_free_dev_table;if (alloc_rlookup_table (pci_seg)) -return NULL ; + goto err_free_alias_table;return pci_seg; + +err_free_alias_table: +free_alias_table (pci_seg); +err_free_dev_table: +free_dev_table (pci_seg); +err_free_pci_seg: +list_del (&pci_seg->list); +kfree (pci_seg); +return NULL ; } static struct amd_iommu_pci_seg *__init get_pci_segment(u16 id,
Greg Kroah-Hartman
maintainerPATCH 109/312 iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinhui Guo <[email protected]>
commit 2381a1b40be4b286062fb3cf67dd7f005692aa2a upstream.
The return type of __modify_irte_ga() is int, but modify_irte_ga() treats it as a bool. Casting the int to bool discards the error code.
To fix the issue, change the type of ret to int in modify_irte_ga().
--- drivers/iommu/amd/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd/iommu.c +1 -1
@@ -3354,7 +3354,7 @@ static int __modify_irte_ga(struct amd_istatic int modify_irte_ga (struct amd_iommu *iommu,u16 devid,int index,struct irte_ga *irte) { -bool ret; +int ret; ret =__modify_irte_ga (iommu, devid, index, irte);if (ret)
Greg Kroah-Hartman
maintainerPATCH 110/312 iommu/apple-dart: fix device leak on of_xlate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit a6eaa872c52a181ae9a290fd4e40c9df91166d7a upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
--- drivers/iommu/apple-dart.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iommu/apple-dart.c +2 -0
@@ -802,6 +802,8 @@ static int apple_dart_of_xlate(struct destruct apple_dart *cfg_dart;int i, sid; +put_device (&iommu_pdev->dev); +if (args->args_count !=1 )return -EINVAL ; sid = args->args[0 ];
Greg Kroah-Hartman
maintainerPATCH 111/312 iommu/exynos: fix device leak on of_xlate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 05913cc43cb122f9afecdbe775115c058b906e1b upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
Note that commit 1a26044954a6 ("iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success.
--- drivers/iommu/exynos-iommu.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/iommu/exynos-iommu.c +3 -6
@@ -1446,17 +1446,14 @@ static int exynos_iommu_of_xlate(structreturn -ENODEV ; data =platform_get_drvdata (sysmmu); -if (!data) { -put_device (&sysmmu->dev); +put_device (&sysmmu->dev); +if (!data)return -ENODEV ; - }if (!owner) { owner =kzalloc (sizeof (*owner),GFP_KERNEL ); -if (!owner) { -put_device (&sysmmu->dev); +if (!owner)return -ENOMEM ; - }INIT_LIST_HEAD (&owner->controllers);mutex_init (&owner->rpm_lock);
Greg Kroah-Hartman
maintainerPATCH 112/312 iommu/ipmmu-vmsa: fix device leak on of_xlate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 80aa518452c4aceb9459f9a8e3184db657d1b441 upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
--- drivers/iommu/ipmmu-vmsa.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iommu/ipmmu-vmsa.c +2 -0
@@ -720,6 +720,8 @@ static int ipmmu_init_platform_device(stdev_iommu_priv_set (dev,platform_get_drvdata (ipmmu_pdev)); +put_device (&ipmmu_pdev->dev); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 113/312 iommu/mediatek-v1: fix device leak on probe_device()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c77ad28bfee0df9cbc719eb5adc9864462cfb65b upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device().
--- drivers/iommu/mtk_iommu_v1.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iommu/mtk_iommu_v1.c +2 -0
@@ -435,6 +435,8 @@ static int mtk_iommu_v1_create_mapping(sreturn -EINVAL ;dev_iommu_priv_set (dev,platform_get_drvdata (m4updev)); + +put_device (&m4updev->dev); } ret =iommu_fwspec_add_ids (dev, args->args,1 );
Greg Kroah-Hartman
maintainerPATCH 114/312 iommu/mediatek-v1: fix device leaks on probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 46207625c9f33da0e43bb4ae1e91f0791b6ed633 upstream.
Make sure to drop the references taken to the larb devices during probe on probe failure (e.g. probe deferral) and on driver unbind.
--- drivers/iommu/mtk_iommu_v1.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/iommu/mtk_iommu_v1.c +18 -5
@@ -648,8 +648,10 @@ static int mtk_iommu_v1_probe(struct plastruct platform_device *plarbdev; larbnode =of_parse_phandle (dev->of_node,"mediatek,larbs" , i); -if (!larbnode) -return -EINVAL ; +if (!larbnode) { + ret = -EINVAL ; + goto out_put_larbs; + }if (!of_device_is_available (larbnode)) {of_node_put (larbnode);
@@ -659,11 +661,14 @@ static int mtk_iommu_v1_probe(struct pla plarbdev =of_find_device_by_node (larbnode);if (!plarbdev) {of_node_put (larbnode); -return -ENODEV ; + ret = -ENODEV ; + goto out_put_larbs; }if (!plarbdev->dev.driver) {of_node_put (larbnode); -return -EPROBE_DEFER ; +put_device (&plarbdev->dev); + ret = -EPROBE_DEFER ; + goto out_put_larbs; } data->larb_imu[i].dev = &plarbdev->dev;
@@ -675,7 +680,7 @@ static int mtk_iommu_v1_probe(struct pla ret =mtk_iommu_v1_hw_init (data);if (ret) -return ret; + goto out_put_larbs; ret =iommu_device_sysfs_add (&data->iommu, &pdev->dev,NULL ,dev_name (&pdev->dev));
@@ -697,12 +702,17 @@ out_sysfs_remove:iommu_device_sysfs_remove (&data->iommu); out_clk_unprepare:clk_disable_unprepare (data->bclk); +out_put_larbs: +for (i =0 ; i <MTK_LARB_NR_MAX ; i++) +put_device (data->larb_imu[i].dev); +return ret; }static void mtk_iommu_v1_remove (struct platform_device *pdev) {struct mtk_iommu_v1_data *data =platform_get_drvdata (pdev); +int i;iommu_device_sysfs_remove (&data->iommu);iommu_device_unregister (&data->iommu);
@@ -710,6 +720,9 @@ static void mtk_iommu_v1_remove(struct pclk_disable_unprepare (data->bclk);devm_free_irq (&pdev->dev, data->irq, data);component_master_del (&pdev->dev, &mtk_iommu_v1_com_ops); + +for (i =0 ; i <MTK_LARB_NR_MAX ; i++) +put_device (data->larb_imu[i].dev); }static int __maybe_unused mtk_iommu_v1_suspend (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 115/312 iommu/mediatek: fix device leak on of_xlate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b3f1ee18280363ef17f82b564fc379ceba9ec86f upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
--- drivers/iommu/mtk_iommu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iommu/mtk_iommu.c +2 -0
@@ -974,6 +974,8 @@ static int mtk_iommu_of_xlate(struct devreturn -EINVAL ;dev_iommu_priv_set (dev,platform_get_drvdata (m4updev)); + +put_device (&m4updev->dev); }return iommu_fwspec_add_ids (dev, args->args,1 );
Greg Kroah-Hartman
maintainerPATCH 116/312 iommu/omap: fix device leaks on probe_device()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b5870691065e6bbe6ba0650c0412636c6a239c5a upstream.
Make sure to drop the references taken to the iommu platform devices when looking up their driver data during probe_device().
Note that the arch data device pointer added by commit 604629bcb505 ("iommu/omap: add support for late attachment of iommu devices") has never been used. Remove it to underline that the references are not needed.
--- drivers/iommu/omap-iommu.c | 2 +- drivers/iommu/omap-iommu.h | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-)
drivers/iommu/omap-iommu.c +1 -1
@@ -1675,6 +1675,7 @@ static struct iommu_device *omap_iommu_p } oiommu =platform_get_drvdata (pdev); +put_device (&pdev->dev);if (!oiommu) {of_node_put (np);kfree (arch_data);
@@ -1682,7 +1683,6 @@ static struct iommu_device *omap_iommu_p } tmp->iommu_dev = oiommu; - tmp->dev = &pdev->dev;of_node_put (np); }
drivers/iommu/omap-iommu.h +0 -2
@@ -88,7 +88,6 @@ struct omap_iommu {/** * struct omap_iommu_arch_data - omap iommu private data * @iommu_dev: handle of the OMAP iommu device -* @dev: handle of the iommu device * * This is an omap iommu private data object, which binds an iommu user * to its iommu device. This object should be placed at the iommu user's
@@ -97,7 +96,6 @@ struct omap_iommu {*/ struct omap_iommu_arch_data {struct omap_iommu *iommu_dev; -struct device *dev; };struct cr_regs {
Greg Kroah-Hartman
maintainerPATCH 117/312 iommu/qcom: fix device leak on of_xlate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6a3908ce56e6879920b44ef136252b2f0c954194 upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
Note that commit e2eae09939a8 ("iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success and late failures.
--- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/iommu/arm/arm-smmu/qcom_iommu.c +4 -6
@@ -565,14 +565,14 @@ static int qcom_iommu_of_xlate(struct de qcom_iommu =platform_get_drvdata (iommu_pdev); +put_device (&iommu_pdev->dev); +/* make sure the asid specified in dt is valid, so we don't have * to sanity check this elsewhere: */ if (WARN_ON (asid > qcom_iommu->max_asid) || -WARN_ON (qcom_iommu->ctxs[asid] ==NULL )) { -put_device (&iommu_pdev->dev); +WARN_ON (qcom_iommu->ctxs[asid] ==NULL ))return -EINVAL ; - }if (!dev_iommu_priv_get (dev)) {dev_iommu_priv_set (dev, qcom_iommu);
@@ -581,10 +581,8 @@ static int qcom_iommu_of_xlate(struct de* multiple different iommu devices. Multiple context * banks are ok, but multiple devices are not: */ -if (WARN_ON (qcom_iommu !=dev_iommu_priv_get (dev))) { -put_device (&iommu_pdev->dev); +if (WARN_ON (qcom_iommu !=dev_iommu_priv_get (dev)))return -EINVAL ; - } }return iommu_fwspec_add_ids (dev, &asid,1 );
Greg Kroah-Hartman
maintainerPATCH 118/312 iommu/sun50i: fix device leak on of_xlate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit f916109bf53864605d10bf6f4215afa023a80406 upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
--- drivers/iommu/sun50i-iommu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iommu/sun50i-iommu.c +2 -0
@@ -839,6 +839,8 @@ static int sun50i_iommu_of_xlate(structdev_iommu_priv_set (dev,platform_get_drvdata (iommu_pdev)); +put_device (&iommu_pdev->dev); +return iommu_fwspec_add_ids (dev, &id,1 ); }
Greg Kroah-Hartman
maintainerPATCH 119/312 iommu/tegra: fix device leak on probe_device()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c08934a61201db8f1d1c66fcc63fb2eb526b656d upstream.
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device().
Note that commit 9826e393e4a8 ("iommu/tegra-smmu: Fix missing put_device() call in tegra_smmu_find") fixed the leak in an error path, but the reference is still leaking on success.
--- drivers/iommu/tegra-smmu.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/iommu/tegra-smmu.c +2 -3
@@ -830,10 +830,9 @@ static struct tegra_smmu *tegra_smmu_finreturn NULL ; mc =platform_get_drvdata (pdev); -if (!mc) { -put_device (&pdev->dev); +put_device (&pdev->dev); +if (!mc)return NULL ; - }return mc->smmu; }
Greg Kroah-Hartman
maintainerPATCH 120/312 iommu: disable SVA when CONFIG_X86 is set
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 72f98ef9a4be30d2a60136dd6faee376f780d06c upstream.
Patch series "Fix stale IOTLB entries for kernel address space", v7.
This proposes a fix for a security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel page table entries. When a kernel page table page is freed and reallocated for another purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-free or write-after-free condition, potentially leading to privilege escalation or data corruption.
This solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window to notify the IOMMU to invalidate its caches before the page is reused.
This patch (of 8):
In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The x86 architecture maps the kernel's virtual address space into the upper portion of every process's page table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries.
The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA.
Use-After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables.
Currently, SVA contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and errors out. This means the IOMMU still caches these intermediate page table entries, making the described vulnerability a real concern.
Disable SVA on x86 architecture until the IOMMU can receive notification to flush the paging cache before freeing the CPU kernel page table pages.
--- drivers/iommu/iommu-sva.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iommu/iommu-sva.c +3 -0
@@ -77,6 +77,9 @@ struct iommu_sva *iommu_sva_bind_device(if (!group)return ERR_PTR (-ENODEV ); +if (IS_ENABLED (CONFIG_X86 )) +return ERR_PTR (-EOPNOTSUPP ); +mutex_lock (&iommu_sva_lock);/* Allocate mm->pasid if necessary. */
Greg Kroah-Hartman
maintainerPATCH 121/312 hwmon: (dell-smm) Fix off-by-one error in dell_smm_is_visible()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
commit fae00a7186cecf90a57757a63b97a0cbcf384fe9 upstream.
The documentation states that on machines supporting only global fan mode control, the pwmX_enable attributes should only be created for the first fan channel (pwm1_enable, aka channel 0).
Fix the off-by-one error caused by the fact that fan channels have a zero-based index.
--- drivers/hwmon/dell-smm-hwmon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/dell-smm-hwmon.c +2 -2
@@ -864,9 +864,9 @@ static umode_t dell_smm_is_visible(constif (auto_fan) {/* * The setting affects all fans, so only create a -* single attribute. +* single attribute for the first fan channel. */ -if (channel !=1 ) +if (channel !=0 )return 0 ;/*
Greg Kroah-Hartman
maintainerPATCH 122/312 HID: logitech-dj: Remove duplicate error logging
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit ca389a55d8b2d86a817433bf82e0602b68c4d541 upstream.
logi_dj_recv_query_paired_devices() and logi_dj_recv_switch_to_dj_mode() both have 2 callers which all log an error if the function fails. Move the error logging to inside these 2 functions to remove the duplicated error logging in the callers.
While at it also move the logi_dj_recv_send_report() call error handling in logi_dj_recv_switch_to_dj_mode() to directly after the call. That call only fails if the report cannot be found and in that case it does nothing, so the msleep() is not necessary on failures.
--- drivers/hid/hid-logitech-dj.c | 56 +++++++++++++++++------------------------- 1 file changed, 23 insertions(+), 33 deletions(-)
drivers/hid/hid-logitech-dj.c +23 -33
@@ -805,7 +805,6 @@ static void delayedwork_callback(structstruct dj_workitem workitem;unsigned long flags;int count; -int retval;dbg_hid ("%s\n" , __func__);
@@ -842,11 +841,7 @@ static void delayedwork_callback(structlogi_dj_recv_destroy_djhid_device (djrcv_dev, &workitem);break ;case WORKITEM_TYPE_UNKNOWN : - retval =logi_dj_recv_query_paired_devices (djrcv_dev); -if (retval) { -hid_err (djrcv_dev->hidpp,"%s: logi_dj_recv_query_paired_devices error: %d\n" , - __func__, retval); - } +logi_dj_recv_query_paired_devices (djrcv_dev);break ;case WORKITEM_TYPE_EMPTY :dbg_hid ("%s: device list is empty\n" , __func__);
@@ -1239,8 +1234,10 @@ static int logi_dj_recv_query_paired_dev djrcv_dev->last_query = jiffies; -if (djrcv_dev->type != recvr_type_dj) -return logi_dj_recv_query_hidpp_devices (djrcv_dev); +if (djrcv_dev->type != recvr_type_dj) { + retval =logi_dj_recv_query_hidpp_devices (djrcv_dev); + goto out; + } dj_report =kzalloc (sizeof (struct dj_report ),GFP_KERNEL );if (!dj_report)
@@ -1250,6 +1247,10 @@ static int logi_dj_recv_query_paired_dev dj_report->report_type =REPORT_TYPE_CMD_GET_PAIRED_DEVICES ; retval =logi_dj_recv_send_report (djrcv_dev, dj_report);kfree (dj_report); +out: +if (retval <0 ) +hid_err (djrcv_dev->hidpp,"%s error:%d\n" , __func__, retval); +return retval; }
@@ -1275,6 +1276,8 @@ static int logi_dj_recv_switch_to_dj_mod (u8 )timeout; retval =logi_dj_recv_send_report (djrcv_dev, dj_report); +if (retval) + goto out;/* * Ugly sleep to work around a USB 3.0 bug when the receiver is
@@ -1283,11 +1286,6 @@ static int logi_dj_recv_switch_to_dj_mod* 50 msec should gives enough time to the receiver to be ready. */ msleep (50 ); - -if (retval) { -kfree (dj_report); -return retval; - } }/*
@@ -1313,7 +1311,12 @@ static int logi_dj_recv_switch_to_dj_modHIDPP_REPORT_SHORT_LENGTH ,HID_OUTPUT_REPORT , HID_REQ_SET_REPORT); +out:kfree (dj_report); + +if (retval <0 ) +hid_err (hdev,"%s error:%d\n" , __func__, retval); +return retval; }
@@ -1835,11 +1838,8 @@ static int logi_dj_probe(struct hid_deviif (has_hidpp) { retval =logi_dj_recv_switch_to_dj_mode (djrcv_dev,0 ); -if (retval <0 ) { -hid_err (hdev,"%s: logi_dj_recv_switch_to_dj_mode returned error:%d\n" , - __func__, retval); +if (retval <0 ) goto switch_to_dj_mode_fail; - } }/* This is enabling the polling urb on the IN endpoint */
@@ -1857,15 +1857,11 @@ static int logi_dj_probe(struct hid_devispin_lock_irqsave (&djrcv_dev->lock, flags); djrcv_dev->ready = true;spin_unlock_irqrestore (&djrcv_dev->lock, flags); - retval =logi_dj_recv_query_paired_devices (djrcv_dev); -if (retval <0 ) { -hid_err (hdev,"%s: logi_dj_recv_query_paired_devices error:%d\n" , - __func__, retval); -/* -* This can happen with a KVM, let the probe succeed, -* logi_dj_recv_queue_unknown_work will retry later. -*/ - } +/* +* This can fail with a KVM. Ignore errors to let the probe +* succeed, logi_dj_recv_queue_unknown_work will retry later. +*/ +logi_dj_recv_query_paired_devices (djrcv_dev); }return 0 ;
@@ -1882,18 +1878,12 @@ hid_hw_start_fail:#ifdef CONFIG_PM static int logi_dj_reset_resume (struct hid_device *hdev) { -int retval;struct dj_receiver_dev *djrcv_dev =hid_get_drvdata (hdev);if (!djrcv_dev || djrcv_dev->hidpp != hdev)return 0 ; - retval =logi_dj_recv_switch_to_dj_mode (djrcv_dev,0 ); -if (retval <0 ) { -hid_err (hdev,"%s: logi_dj_recv_switch_to_dj_mode returned error:%d\n" , - __func__, retval); - } - +logi_dj_recv_switch_to_dj_mode (djrcv_dev,0 );return 0 ; }#endif
Greg Kroah-Hartman
maintainerPATCH 123/312 hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghavendra Rao Ananta <[email protected]>
commit 0ed3a30fd996cb0cac872432cf25185fda7e5316 upstream.
The commit, <86624ba3b522> ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD") accidentally ignored including the .match_token_uuid callback in the hisi_acc_vfio_pci_migrn_ops struct. Introduce the missed callback here.
--- drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +1 -0
@@ -1564,6 +1564,7 @@ static const struct vfio_device_ops hisi .mmap = hisi_acc_vfio_pci_mmap, .request = vfio_pci_core_request, .match = vfio_pci_core_match, + .match_token_uuid = vfio_pci_core_match_token_uuid, .bind_iommufd = vfio_iommufd_physical_bind, .unbind_iommufd = vfio_iommufd_physical_unbind, .attach_ioas = vfio_iommufd_physical_attach_ioas,
Greg Kroah-Hartman
maintainerPATCH 124/312 fgraph: Initialize ftrace_ops->private for function graph ops
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengming Hu <[email protected]>
commit b5d6d3f73d0bac4a7e3a061372f6da166fc6ee5c upstream.
The ftrace_pids_enabled(op) check relies on op->private being properly initialized, but fgraph_ops's underlying ftrace_ops->private was left uninitialized. This caused ftrace_pids_enabled() to always return false, effectively disabling PID filtering for function graph tracing.
Fix this by copying src_ops->private to dst_ops->private in fgraph_init_ops(), ensuring PID filter state is correctly propagated.
--- kernel/trace/fgraph.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/fgraph.c +1 -0
@@ -1019,6 +1019,7 @@ void fgraph_init_ops(struct ftrace_ops *mutex_init (&dst_ops->local_hash.regex_lock);INIT_LIST_HEAD (&dst_ops->subop_list); dst_ops->flags |=FTRACE_OPS_FL_INITIALIZED ; + dst_ops->private = src_ops->private; }#endif }
Greg Kroah-Hartman
maintainerPATCH 125/312 fgraph: Check ftrace_pids_enabled on registration for early filtering
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengming Hu <[email protected]>
commit 1650a1b6cb1ae6cb99bb4fce21b30ebdf9fc238e upstream.
When registering ftrace_graph, check if ftrace_pids_enabled is active. If enabled, assign entryfunc to fgraph_pid_func to ensure filtering is performed before executing the saved original entry function.
--- kernel/trace/fgraph.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
kernel/trace/fgraph.c +7 -2
@@ -1377,6 +1377,13 @@ int register_ftrace_graph(struct fgraph_ ftrace_graph_active++; +/* Always save the function, and reset at unregistering */ + gops->saved_func = gops->entryfunc; +#ifdef CONFIG_DYNAMIC_FTRACE +if (ftrace_pids_enabled (&gops->ops)) + gops->entryfunc = fgraph_pid_func; +#endif +if (ftrace_graph_active ==2 )ftrace_graph_disable_direct (true);
@@ -1396,8 +1403,6 @@ int register_ftrace_graph(struct fgraph_ }else {init_task_vars (gops->idx); } -/* Always save the function, and reset at unregistering */ - gops->saved_func = gops->entryfunc; gops->ops.flags |=FTRACE_OPS_FL_GRAPH ;
Greg Kroah-Hartman
maintainerPATCH 126/312 PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 894f475f88e06c0f352c829849560790dbdedbe5 upstream.
When a PCI device is suspended, it is normally the PCI core's job to save Config Space and put the device into a low power state. However drivers are allowed to assume these responsibilities. When they do, the PCI core can tell by looking at the state_saved flag in struct pci_dev: The flag is cleared before commencing the suspend sequence and it is set when pci_save_state() is called. If the PCI core finds the flag set late in the suspend sequence, it refrains from calling pci_save_state() itself.
But there are two corner cases where the PCI core neglects to clear the flag before commencing the suspend sequence:
* If a driver has legacy PCI PM callbacks, pci_legacy_suspend() neglects to clear the flag. The (stale) flag is subsequently queried by pci_legacy_suspend() itself and pci_legacy_suspend_late().
* If a device has no driver or its driver has no PCI PM callbacks, pci_pm_freeze() neglects to clear the flag. The (stale) flag is subsequently queried by pci_pm_freeze_noirq().
The flag may be set prior to suspend if the device went through error
recovery: Drivers commonly invoke pci_restore_state() + pci_save_state() to restore Config Space after reset.
The flag may also be set if drivers call pci_save_state() on probe to allow for recovery from subsequent errors.
The result is that pci_legacy_suspend_late() and pci_pm_freeze_noirq() don't call pci_save_state() and so the state that will be restored on resume is the one recorded on last error recovery or on probe, not the one that the device had on suspend. If the two states happen to be identical, there's no problem.
Reinstate clearing the flag in pci_legacy_suspend() and pci_pm_freeze(). The two functions used to do that until commit 4b77b0a2ba27 ("PCI: Clear saved_state after the state has been restored") deemed it unnecessary because it assumed that it's sufficient to clear the flag on resume in pci_restore_state(). The commit seemingly did not take into account that pci_save_state() and pci_restore_state() are not only used by power management code, but also for error recovery.
Devices without driver or whose driver has no PCI PM callbacks may be in runtime suspend when pci_pm_freeze() is called. Their state has already been saved, so don't clear the flag to skip a pointless pci_save_state() in pci_pm_freeze_noirq().
None of the drivers with legacy PCI PM callbacks seem to use runtime PM, so clear the flag unconditionally in their case.
--- drivers/pci/pci-driver.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/pci-driver.c +4 -0
@@ -629,6 +629,8 @@ static int pci_legacy_suspend(struct devstruct pci_dev *pci_dev =to_pci_dev (dev);struct pci_driver *drv = pci_dev->driver; + pci_dev->state_saved = false; +if (drv && drv->suspend) {pci_power_t prev = pci_dev->current_state;int error;
@@ -1036,6 +1038,8 @@ static int pci_pm_freeze(struct device *if (!pm) {pci_pm_default_suspend (pci_dev); +if (!pm_runtime_suspended (dev)) + pci_dev->state_saved = false;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 127/312 arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit 51f89c488f2ecc020f82bfedd77482584ce8027a upstream.
The SoC pin Y1 is incorrectly defined in the WKUP Pinmux device-tree node (pinctrl@4301c000) leading to the following silent failure:
pinctrl-single 4301c000.pinctrl: mux offset out of range: 0x1dc (0x178)
According to the datasheet for the J721E SoC [0], the pin Y1 belongs to the MAIN Pinmux device-tree node (pinctrl@11c000). This is confirmed by the address of the pinmux register for it on page 142 of the datasheet which is 0x00011C1DC.
Hence fix it.
[0]: https://www.ti.com/lit/ds/symlink/tda4vm.pdf
--- arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/ti/k3-j721e-sk.dts +6 -6
@@ -474,6 +474,12 @@ J721E_IOPAD(0x234, PIN_INPUT, 7) /* (U3) EXT_REFCLK1.GPIO1_12 */ >; }; + + vdd_sd_dv_pins_default: vdd-sd-dv-default-pins { + pinctrl-single,pins = < + J721E_IOPAD(0x1dc, PIN_OUTPUT, 7) /* (Y1) SPI1_CLK.GPIO0_118 */ + >; + }; }; &wkup_pmx0 {
@@ -536,12 +542,6 @@ >; }; - vdd_sd_dv_pins_default: vdd-sd-dv-default-pins { - pinctrl-single,pins = < - J721E_IOPAD(0x1dc, PIN_OUTPUT, 7) /* (Y1) SPI1_CLK.GPIO0_118 */ - >; - }; - wkup_uart0_pins_default: wkup-uart0-default-pins { pinctrl-single,pins = < J721E_WKUP_IOPAD(0xa0, PIN_INPUT, 0) /* (J29) WKUP_UART0_RXD */
Greg Kroah-Hartman
maintainerPATCH 128/312 powerpc, mm: Fix mprotect on book3s 32-bit
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Vasilevsky <[email protected]>
commit 78fc63ffa7813e33681839bb33826c24195f0eb7 upstream.
On 32-bit book3s with hash-MMUs, tlb_flush() was a no-op. This was unnoticed because all uses until recently were for unmaps, and thus handled by __tlb_remove_tlb_entry().
After commit 4a18419f71cd ("mm/mprotect: use mmu_gather") in kernel 5.19, tlb_gather_mmu() started being used for mprotect as well. This caused mprotect to simply not work on these machines:
int *ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
*ptr = 1; // force HPTE to be created
mprotect(ptr, 4096, PROT_READ);
*ptr = 2; // should segfault, but succeeds
Fixed by making tlb_flush() actually flush TLB pages. This finally agrees with the behaviour of boot3s64's tlb_flush().
--- arch/powerpc/include/asm/book3s/32/tlbflush.h | 5 ++++- arch/powerpc/mm/book3s32/tlb.c | 9 +++++++++ 2 files changed, 13 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/book3s/32/tlbflush.h +4 -1
@@ -11,6 +11,7 @@void hash__flush_tlb_mm (struct mm_struct *mm);void hash__flush_tlb_page (struct vm_area_struct *vma,unsigned long vmaddr);void hash__flush_range (struct mm_struct *mm,unsigned long start,unsigned long end); +void hash__flush_gather (struct mmu_gather *tlb);#ifdef CONFIG_SMP void _tlbie (unsigned long address);
@@ -29,7 +30,9 @@ void _tlbia(void);static inline void tlb_flush (struct mmu_gather *tlb) {/* 603 needs to flush the whole TLB here since it doesn't use a hash table. */ -if (!mmu_has_feature (MMU_FTR_HPTE_TABLE )) +if (mmu_has_feature (MMU_FTR_HPTE_TABLE )) +hash__flush_gather (tlb); +else _tlbia (); }
arch/powerpc/mm/book3s32/tlb.c +9 -0
@@ -105,3 +105,12 @@ void hash__flush_tlb_page(struct vm_areaflush_hash_pages (mm->context.id, vmaddr,pmd_val (*pmd),1 ); }EXPORT_SYMBOL (hash__flush_tlb_page); + +void hash__flush_gather (struct mmu_gather *tlb) +{ +if (tlb->fullmm || tlb->need_flush_all) +hash__flush_tlb_mm (tlb->mm); +else +hash__flush_range (tlb->mm, tlb->start, tlb->end); +} +EXPORT_SYMBOL (hash__flush_gather);
Greg Kroah-Hartman
maintainerPATCH 129/312 powerpc/64s/slb: Fix SLB multihit issue during SLB preload
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
commit 00312419f0863964625d6dcda8183f96849412c6 upstream.
On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache is subject to periodic eviction — typically after every 256 context switches — to remove old entry.
To optimize performance, the kernel skips switch_mmu_context() in switch_mm_irqs_off() when the prev and next mm_struct are the same. However, on hash MMU systems, this can lead to inconsistencies between the hardware SLB and the software preload cache.
If an SLB entry for a process is evicted from the software cache on one CPU, and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. If the kernel then attempts to reload that entry, it can trigger an SLB multi-hit error.
The following timeline shows how stale SLB entries are created and can cause a multi-hit error when a process moves between CPUs without a MMU context switch.
CPU 0 CPU 1
----- -----
Process P
exec swapper/1
load_elf_binary
begin_new_exc
activate_mm
switch_mm_irqs_off
switch_mmu_context
switch_slb
/*
* This invalidates all
* the entries in the HW
* and setup the new HW
* SLB entries as per the
* preload cache.
*/context_switchsched_migrate_task migrates process P to cpu-1
Process swapper/0 context switch (to process P)
(uses mm_struct of Process P) switch_mm_irqs_off()
switch_slb
load_slb++
/*
* load_slb becomes 0 here
* and we evict an entry from
* the preload cache with
* preload_age(). We still
* keep HW SLB and preload
* cache in sync, that is
* because all HW SLB entries
* anyways gets evicted in
* switch_slb during SLBIA.
* We then only add those
* entries back in HW SLB,
* which are currently
* present in preload_cache
* (after eviction). */
load_elf_binary continues...
setup_new_exec()
slb_setup_new_exec()
sched_switch event sched_migrate_task migrates process P to cpu-0
context_switch from swapper/0 to Process P
switch_mm_irqs_off()
/*
* Since both prev and next mm struct are same we don't call
* switch_mmu_context(). This will cause the HW SLB and SW preload
* cache to go out of sync in preload_new_slb_context. Because there
* was an SLB entry which was evicted from both HW and preload cache
* on cpu-1. Now later in preload_new_slb_context(), when we will try
* to add the same preload entry again, we will add this to the SW
* preload cache and then will add it to the HW SLB. Since on cpu-0
* this entry was never invalidated, hence adding this entry to the HW
* SLB will cause a SLB multi-hit error.
*/load_elf_binary continues...
START_THREAD
start_thread
preload_new_slb_context
/*
* This tries to add a new EA to preload cache which was earlier
* evicted from both cpu-1 HW SLB and preload cache. This caused the
* HW SLB of cpu-0 to go out of sync with the SW preload cache. The
* reason for this was, that when we context switched back on CPU-0,
* we should have ideally called switch_mmu_context() which will
* bring the HW SLB entries on CPU-0 in sync with SW preload cache
* entries by setting up the mmu context properly. But we didn't do
* that since the prev mm_struct running on cpu-0 was same as the
* next mm_struct (which is true for swapper / kernel threads). So
* now when we try to add this new entry into the HW SLB of cpu-0,
* we hit a SLB multi-hit error.
*/
WARNING: CPU: 0 PID: 1810970 at arch/powerpc/mm/book3s64/slb.c:62 assert_slb_presence+0x2c/0x50(48 results) 02:47:29 [20157/42149] Modules linked in: CPU: 0 UID: 0 PID: 1810970 Comm: dd Not tainted 6.16.0-rc3-dirty #12 VOLUNTARY Hardware name: IBM pSeries (emulated by qemu) POWER8 (architected) 0x4d0200 0xf000004 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c00000000015426c LR: c0000000001543b4 CTR: 0000000000000000 REGS: c0000000497c77e0 TRAP: 0700 Not tainted (6.16.0-rc3-dirty) MSR: 8000000002823033 <SF,VEC,VSX,FP,ME,IR,DR,RI,LE> CR: 28888482 XER: 00000000 CFAR: c0000000001543b0 IRQMASK: 3 <...> NIP [c00000000015426c] assert_slb_presence+0x2c/0x50 LR [c0000000001543b4] slb_insert_entry+0x124/0x390 Call Trace: 0x7fffceb5ffff (unreliable) preload_new_slb_context+0x100/0x1a0 start_thread+0x26c/0x420 load_elf_binary+0x1b04/0x1c40 bprm_execve+0x358/0x680 do_execveat_common+0x1f8/0x240 sys_execve+0x58/0x70 system_call_exception+0x114/0x300 system_call_common+0x160/0x2c4
Quoted 1 line
From the above analysis, during early exec the hardware SLB is cleared,
and entries from the software preload cache are reloaded into hardware by switch_slb. However, preload_new_slb_context and slb_setup_new_exec also attempt to load some of the same entries, which can trigger a multi-hit. In most cases, these additional preloads simply hit existing entries and add nothing new. Removing these functions avoids redundant preloads and eliminates the multi-hit issue. This patch removes these two functions.
We tested process switching performance using the context_switch benchmark on POWER9/hash, and observed no regression.
Without this patch: 129041 ops/sec With this patch: 129341 ops/sec
We also measured SLB faults during boot, and the counts are essentially the same with and without this patch.
SLB faults without this patch: 19727 SLB faults with this patch: 19786
--- arch/powerpc/include/asm/book3s/64/mmu-hash.h | 1 arch/powerpc/kernel/process.c | 5 - arch/powerpc/mm/book3s64/internal.h | 2 arch/powerpc/mm/book3s64/mmu_context.c | 2 arch/powerpc/mm/book3s64/slb.c | 88 -------------------------- 5 files changed, 98 deletions(-)
arch/powerpc/include/asm/book3s/64/mmu-hash.h +0 -1
@@ -524,7 +524,6 @@ void slb_save_contents(struct slb_entryvoid slb_dump_contents (struct slb_entry *slb_ptr);extern void slb_vmalloc_update (void ); -void preload_new_slb_context (unsigned long start,unsigned long sp);#ifdef CONFIG_PPC_64S_HASH_MMU void slb_set_size (u16 size);
arch/powerpc/kernel/process.c +0 -5
@@ -1897,8 +1897,6 @@ int copy_thread(struct task_struct *p, creturn 0 ; } -void preload_new_slb_context (unsigned long start,unsigned long sp); -/* * Set up a thread for executing a new program */
@@ -1906,9 +1904,6 @@ void start_thread(struct pt_regs *regs, {#ifdef CONFIG_PPC64 unsigned long load_addr = regs->gpr[2 ];/* saved by ELF_PLAT_INIT */ - -if (IS_ENABLED (CONFIG_PPC_BOOK3S_64 ) && !radix_enabled ()) -preload_new_slb_context (start, sp);#endif #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
arch/powerpc/mm/book3s64/internal.h +0 -2
@@ -24,8 +24,6 @@ static inline bool stress_hpt(void)void hpt_do_stress (unsigned long ea,unsigned long hpte_group); -void slb_setup_new_exec (void ); -void exit_lazy_flush_tlb (struct mm_struct *mm,bool always_flush);#endif /* ARCH_POWERPC_MM_BOOK3S64_INTERNAL_H */
arch/powerpc/mm/book3s64/mmu_context.c +0 -2
@@ -150,8 +150,6 @@ static int hash__init_new_context(structvoid hash__setup_new_exec (void ) {slice_setup_new_exec (); - -slb_setup_new_exec (); }#else static inline int hash__init_new_context (struct mm_struct *mm)
arch/powerpc/mm/book3s64/slb.c +0 -88
94 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 130/312 mm, swap: do not perform synchronous discard during allocation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kairui Song <[email protected]>
commit 9fb749cd15078c7bdc46e5d45c37493f83323e33 upstream.
Patch series "mm, swap: misc cleanup and bugfix", v2.
A few cleanups and a bugfix that are either suitable after the swap table phase I or found during code review.
Patch 1 is a bugfix and needs to be included in the stable branch, the rest have no behavioral change.
This patch (of 5):
Since commit 1b7e90020eb77 ("mm, swap: use percpu cluster as allocation fast path"), swap allocation is protected by a local lock, which means we can't do any sleeping calls during allocation.
However, the discard routine is not taken well care of. When the swap allocator failed to find any usable cluster, it would look at the pending discard cluster and try to issue some blocking discards. It may not necessarily sleep, but the cond_resched at the bio layer indicates this is wrong when combined with a local lock. And the bio GFP flag used for discard bio is also wrong (not atomic).
It's arguable whether this synchronous discard is helpful at all. In most cases, the async discard is good enough. And the swap allocator is doing very differently at organizing the clusters since the recent change, so it is very rare to see discard clusters piling up.
So far, no issues have been observed or reported with typical SSD setups under months of high pressure. This issue was found during my code review. But by hacking the kernel a bit: adding a mdelay(500) in the async discard path, this issue will be observable with WARNING triggered by the wrong GFP and cond_resched in the bio layer for debug builds.
So now let's apply a hotfix for this issue: remove the synchronous discard in the swap allocation path. And when order 0 is failing with all cluster list drained on all swap devices, try to do a discard following the swap device priority list. If any discards released some cluster, try the allocation again. This way, we can still avoid OOM due to swap failure if the hardware is very slow and memory pressure is extremely high.
This may cause more fragmentation issues if the discarding hardware is really slow. Ideally, we want to discard pending clusters before continuing to iterate the fragment cluster lists. This can be implemented in a cleaner way if we clean up the device list iteration part first.
--- mm/swapfile.c | 40 +++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-)
mm/swapfile.c +33 -7
@@ -1101,13 +1101,6 @@ new_cluster: goto done; } -/* -* We don't have free cluster but have some clusters in discarding, -* do discard now and reclaim them. -*/ -if ((si->flags &SWP_PAGE_DISCARD ) &&swap_do_scheduled_discard (si)) - goto new_cluster; -if (order) goto done;
@@ -1394,6 +1387,33 @@ start_over:return false; } +/* +* Discard pending clusters in a synchronized way when under high pressure. +* Return: true if any cluster is discarded. +*/ +static bool swap_sync_discard (void ) +{ +bool ret = false; +int nid =numa_node_id (); +struct swap_info_struct *si, *next; + +spin_lock (&swap_avail_lock); +plist_for_each_entry_safe (si, next, &swap_avail_heads[nid], avail_lists[nid]) { +spin_unlock (&swap_avail_lock); +if (get_swap_device_info (si)) { +if (si->flags &SWP_PAGE_DISCARD ) + ret =swap_do_scheduled_discard (si); +put_swap_device (si); + } +if (ret) +return true; +spin_lock (&swap_avail_lock); + } +spin_unlock (&swap_avail_lock); + +return false; +} +/** * folio_alloc_swap - allocate swap space for a folio * @folio: folio we want to move to swap
@@ -1432,11 +1452,17 @@ int folio_alloc_swap(struct folio *folio } } +again:local_lock (&percpu_swap_cluster.lock);if (!swap_alloc_fast (&entry, order))swap_alloc_slow (&entry, order);local_unlock (&percpu_swap_cluster.lock); +if (unlikely (!order && !entry.val)) { +if (swap_sync_discard ()) + goto again; + } +/* Need to call this even if allocation failed, for MEMCG_SWAP_FAIL. */ if (mem_cgroup_try_charge_swap (folio, entry)) goto out_free;
Greg Kroah-Hartman
maintainerPATCH 131/312 leds: leds-cros_ec: Skip LEDs without color components
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 4dbf066d965cd3299fb396f1375d10423c9c625c upstream.
A user reports that on their Lenovo Corsola Magneton with EC firmware steelix-15194.270.0 the driver probe fails with EINVAL. It turns out that the power LED does not contain any color components as indicated by the following "ectool led power query" output:
Brightness range for LED 1:
red : 0x0
green : 0x0
blue : 0x0
yellow : 0x0
white : 0x0
amber : 0x0The LED also does not react to commands sent manually through ectool and is generally non-functional.
Instead of failing the probe for all LEDs managed by the EC when one without color components is encountered, silently skip those.
--- drivers/leds/leds-cros_ec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/leds/leds-cros_ec.c +2 -3
@@ -142,9 +142,6 @@ static int cros_ec_led_count_subleds(str } } -if (!num_subleds) -return -EINVAL ; - *max_brightness = common_range;return num_subleds; }
@@ -189,6 +186,8 @@ static int cros_ec_led_probe_one(struct &priv->led_mc_cdev.led_cdev.max_brightness);if (num_subleds <0 )return num_subleds; +if (num_subleds ==0 ) +return 0 ;/* LED without any colors, skip */ priv->cros_ec = cros_ec; priv->led_id = id;
Greg Kroah-Hartman
maintainerPATCH 132/312 leds: leds-lp50xx: Allow LED 0 to be added to module bank
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Hitz <[email protected]>
commit 26fe74d598c32e7bc6f150edfc4aa43e1bee55db upstream.
led_banks contains LED module number(s) that should be grouped into the module bank. led_banks is 0-initialized.
By checking the led_banks entries for 0, un-set entries are detected. But a 0-entry also indicates that LED module 0 should be grouped into the module bank.
By only iterating over the available entries no check for unused entries is required and LED module 0 can be added to bank.
--- drivers/leds/leds-lp50xx.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/leds/leds-lp50xx.c +4 -6
@@ -341,17 +341,15 @@ out:return ret; } -static int lp50xx_set_banks (struct lp50xx *priv,u32 led_banks[]) +static int lp50xx_set_banks (struct lp50xx *priv,u32 led_banks[],int num_leds) {u8 led_config_lo, led_config_hi;u32 bank_enable_mask =0 ;int ret;int i; -for (i =0 ; i < priv->chip_info->max_modules; i++) { -if (led_banks[i]) - bank_enable_mask |= (1 << led_banks[i]); - } +for (i =0 ; i < num_leds; i++) + bank_enable_mask |= (1 << led_banks[i]); led_config_lo = bank_enable_mask; led_config_hi = bank_enable_mask >>8 ;
@@ -405,7 +403,7 @@ static int lp50xx_probe_leds(struct fwnoreturn ret; } - ret =lp50xx_set_banks (priv, led_banks); + ret =lp50xx_set_banks (priv, led_banks, num_leds);if (ret) {dev_err (priv->dev,"Cannot setup banked LEDs\n" );return ret;
Greg Kroah-Hartman
maintainerPATCH 133/312 leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Hitz <[email protected]>
commit 5246e3673eeeccb4f5bf4f42375dd495d465ac15 upstream.
LP5009 supports 9 LED outputs that are grouped into 3 modules.
--- drivers/leds/leds-lp50xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/leds/leds-lp50xx.c +1 -1
@@ -54,7 +54,7 @@/* There are 3 LED outputs per bank */ #define LP50XX_LEDS_PER_MODULE 3 -#define LP5009_MAX_LED_MODULES 2 +#define LP5009_MAX_LED_MODULES 3#define LP5012_MAX_LED_MODULES 4#define LP5018_MAX_LED_MODULES 6#define LP5024_MAX_LED_MODULES 8
Greg Kroah-Hartman
maintainerPATCH 134/312 leds: leds-lp50xx: Enable chip before any communication
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Hitz <[email protected]>
commit 434959618c47efe9e5f2e20f4a850caac4f6b823 upstream.
If a GPIO is used to control the chip's enable pin, it needs to be pulled high before any i2c communication is attempted.
Currently, the enable GPIO handling is not correct.
Assume the enable GPIO is low when the probe function is entered. In this case the device is in SHUTDOWN mode and does not react to i2c commands.
During probe the following sequence happens:
1. The call to lp50xx_reset() on line 548 has no effect as i2c is not possible yet.
2. Then - on line 552 - lp50xx_enable_disable() is called. As "priv->enable_gpio“ has not yet been initialized, setting the GPIO has no effect. Also the i2c enable command is not executed as the device is still in SHUTDOWN.
3. On line 556 the call to lp50xx_probe_dt() finally parses the rest of
the DT and the configured priv->enable_gpio is set up.
As a result the device is still in SHUTDOWN mode and not ready for operation.
Split lp50xx_enable_disable() into distinct enable and disable functions to enforce correct ordering between enable_gpio manipulations and i2c commands.
Read enable_gpio configuration from DT before attempting to manipulate enable_gpio.
Add delays to observe correct wait timing after manipulating enable_gpio and before any i2c communication.
--- drivers/leds/leds-lp50xx.c | 55 ++++++++++++++++++++++++++++++++------------- 1 file changed, 40 insertions(+), 15 deletions(-)
drivers/leds/leds-lp50xx.c +40 -15
@@ -50,6 +50,12 @@#define LP50XX_SW_RESET 0xff#define LP50XX_CHIP_EN BIT(6) +#define LP50XX_CHIP_DISABLE 0x00 +#define LP50XX_START_TIME_US 500 +#define LP50XX_RESET_TIME_US 3 + +#define LP50XX_EN_GPIO_LOW 0 +#define LP50XX_EN_GPIO_HIGH 1/* There are 3 LED outputs per bank */ #define LP50XX_LEDS_PER_MODULE 3
@@ -369,19 +375,42 @@ static int lp50xx_reset(struct lp50xx *preturn regmap_write (priv->regmap, priv->chip_info->reset_reg,LP50XX_SW_RESET ); } -static int lp50xx_enable_disable (struct lp50xx *priv,int enable_disable) +static int lp50xx_enable (struct lp50xx *priv) {int ret; - ret =gpiod_direction_output (priv->enable_gpio, enable_disable); +if (priv->enable_gpio) { + ret =gpiod_direction_output (priv->enable_gpio,LP50XX_EN_GPIO_HIGH ); +if (ret) +return ret; + +udelay (LP50XX_START_TIME_US ); + } + + ret =lp50xx_reset (priv);if (ret)return ret; -if (enable_disable) -return regmap_write (priv->regmap,LP50XX_DEV_CFG0 ,LP50XX_CHIP_EN ); -else -return regmap_write (priv->regmap,LP50XX_DEV_CFG0 ,0 ); +return regmap_write (priv->regmap,LP50XX_DEV_CFG0 ,LP50XX_CHIP_EN ); +} +static int lp50xx_disable (struct lp50xx *priv) +{ +int ret; + + ret =regmap_write (priv->regmap,LP50XX_DEV_CFG0 ,LP50XX_CHIP_DISABLE ); +if (ret) +return ret; + +if (priv->enable_gpio) { + ret =gpiod_direction_output (priv->enable_gpio,LP50XX_EN_GPIO_LOW ); +if (ret) +return ret; + +udelay (LP50XX_RESET_TIME_US ); + } + +return 0 ; } static int lp50xx_probe_leds(struct fwnode_handle *child, struct lp50xx *priv,
@@ -445,6 +474,10 @@ static int lp50xx_probe_dt(struct lp50xxreturn dev_err_probe (priv->dev,PTR_ERR (priv->enable_gpio),"Failed to get enable GPIO\n" ); + ret =lp50xx_enable (priv); +if (ret) +return ret; + priv->regulator =devm_regulator_get (priv->dev,"vled" );if (IS_ERR (priv->regulator)) priv->regulator =NULL ;
@@ -545,14 +578,6 @@ static int lp50xx_probe(struct i2c_clienreturn ret; } - ret =lp50xx_reset (led); -if (ret) -return ret; - - ret =lp50xx_enable_disable (led,1 ); -if (ret) -return ret; -return lp50xx_probe_dt (led); }
@@ -561,7 +586,7 @@ static void lp50xx_remove(struct i2c_clistruct lp50xx *led =i2c_get_clientdata (client);int ret; - ret =lp50xx_enable_disable (led,0 ); + ret =lp50xx_disable (led);if (ret)dev_err (led->dev,"Failed to disable chip\n" );
Greg Kroah-Hartman
maintainerPATCH 135/312 block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 552c1149af7ac0cffab6fccd13feeaf816dd1f53 upstream.
Commit fe0418eb9bd6 ("block: Prevent potential deadlocks in zone write plug error recovery") added a WARN check in disk_put_zone_wplug() to verify that when the last reference to a zone write plug is dropped, this zone write plug does not have the BLK_ZONE_WPLUG_PLUGGED flag set, that is, that it is not plugged.
However, the function disk_zone_wplug_abort(), which is called for zone reset and zone finish operations, does not clear this flag after emptying a zone write plug BIO list. This can result in the disk_put_zone_wplug() warning to trigger if the user (erroneously as that is bad pratcice) issues zone reset or zone finish operations while the target zone still has plugged BIOs.
Modify disk_put_zone_wplug() to clear the BLK_ZONE_WPLUG_PLUGGED flag. And while at it, also add a lockdep annotation to ensure that this function is called with the zone write plug spinlock held.
--- block/blk-zoned.c | 4 ++++ 1 file changed, 4 insertions(+)
block/blk-zoned.c +4 -0
@@ -616,6 +616,8 @@ static void disk_zone_wplug_abort(struct {struct bio *bio; +lockdep_assert_held (&zwplug->lock); +if (bio_list_empty (&zwplug->bio_list))return ;
@@ -623,6 +625,8 @@ static void disk_zone_wplug_abort(struct zwplug->disk->disk_name, zwplug->zone_no);while ((bio =bio_list_pop (&zwplug->bio_list)))blk_zone_wplug_bio_io_error (zwplug, bio); + + zwplug->flags &= ~BLK_ZONE_WPLUG_PLUGGED ; }/*
Greg Kroah-Hartman
maintainerPATCH 136/312 clk: samsung: exynos-clkout: Assign .num before accessing .hws
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit cf33f0b7df13685234ccea7be7bfe316b60db4db upstream.
Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS) about the number of elements in .hws[], so that it can warn when .hws[] is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in exynos_clkout_probe() due to .num being assigned after .hws[] has been accessed:
UBSAN: array-index-out-of-bounds in drivers/clk/samsung/clk-exynos-clkout.c:178:18 index 0 is out of range for type 'clk_hw *[*]'
Move the .num initialization to before the first access of .hws[], clearing up the warning.
--- drivers/clk/samsung/clk-exynos-clkout.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk-exynos-clkout.c +1 -1
@@ -175,6 +175,7 @@ static int exynos_clkout_probe(struct pl clkout->mux.shift =EXYNOS_CLKOUT_MUX_SHIFT ; clkout->mux.lock = &clkout->slock; + clkout->data.num =EXYNOS_CLKOUT_NR_CLKS ; clkout->data.hws[0] = clk_hw_register_composite(NULL, "clkout", parent_names, parent_count, &clkout->mux.hw, &clk_mux_ops, NULL, NULL, &clkout->gate.hw,
@@ -185,7 +186,6 @@ static int exynos_clkout_probe(struct pl goto err_unmap; } - clkout->data.num =EXYNOS_CLKOUT_NR_CLKS ; ret =of_clk_add_hw_provider (clkout->np, of_clk_hw_onecell_get, &clkout->data);if (ret) goto err_clk_unreg;
Greg Kroah-Hartman
maintainerPATCH 137/312 clk: qcom: mmcc-sdm660: Add missing MDSS reset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Minnekhanov <[email protected]>
commit 0a0ea5541d30c0fbb3dac975bd1983f299cd6948 upstream.
Add offset for display subsystem reset in multimedia clock controller block, which is necessary to reset display when there is some configuration in display controller left by previous stock (Android) bootloader to provide continuous splash functionaluty.
Before 6.17 power domains were turned off for long enough to clear registers, now this is not the case and a proper reset is needed to have functioning display.
--- drivers/clk/qcom/mmcc-sdm660.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/mmcc-sdm660.c +1 -0
@@ -2781,6 +2781,7 @@ static struct gdsc *mmcc_sdm660_gdscs[] = { };static const struct qcom_reset_map mmcc_660_resets[] = { + [MDSS_BCR ] = {0x2300 }, [CAMSS_MICRO_BCR ] = {0x3490 }, };
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 138/312 clk: qcom: Fix SM_VIDEOCC_6350 dependencies
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit f0691a3f7558d33b5b4a900e8312613fbe4afb9d upstream.
It is possible to select CONFIG_SM_GCC_6350 when targeting ARCH=arm, causing a Kconfig warning when selecting CONFIG_SM_GCC_6350 without its dependencies, CONFIG_ARM64 or CONFIG_COMPILE_TEST.
WARNING: unmet direct dependencies detected for SM_GCC_6350
Depends on [n]: COMMON_CLK [=y] && COMMON_CLK_QCOM [=m] && (ARM64 || COMPILE_TEST [=n]) Selected by [m]:
- SM_VIDEOCC_6350 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
Add the same dependency to clear up the warning.
--- drivers/clk/qcom/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/Kconfig +1 -0
@@ -1448,6 +1448,7 @@ config SA_VIDEOCC_8775P config SM_VIDEOCC_6350 tristate "SM6350 Video Clock Controller" + depends on ARM64 || COMPILE_TEST select SM_GCC_6350 select QCOM_GDSC help
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 139/312 clk: qcom: Fix dependencies of QCS_{DISP,GPU,VIDEO}CC_615
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 7ec1ba01ae37897f0ecf6ab0c980378cb8a2f388 upstream.
It is possible to select CONFIG_QCS_{DISP,GPU,VIDEO}CC_615 when targeting ARCH=arm, causing a Kconfig warning when selecting CONFIG_QCS_GCC_615 without its dependencies, CONFIG_ARM64 or CONFIG_COMPILE_TEST.
WARNING: unmet direct dependencies detected for QCS_GCC_615
Depends on [n]: COMMON_CLK [=y] && COMMON_CLK_QCOM [=m] && (ARM64 || COMPILE_TEST [=n]) Selected by [m]:
- QCS_DISPCC_615 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
- QCS_GPUCC_615 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
- QCS_VIDEOCC_615 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
Add the same dependency to these configurations to clear up the warnings.
--- drivers/clk/qcom/Kconfig | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/qcom/Kconfig +3 -0
@@ -531,6 +531,7 @@ config QCM_DISPCC_2290 config QCS_DISPCC_615 tristate "QCS615 Display Clock Controller" + depends on ARM64 || COMPILE_TEST select QCS_GCC_615 help Support for the display clock controller on Qualcomm Technologies, Inc
@@ -586,6 +587,7 @@ config QCS_GCC_615 config QCS_GPUCC_615 tristate "QCS615 Graphics clock controller" + depends on ARM64 || COMPILE_TEST select QCS_GCC_615 help Support for the graphics clock controller on QCS615 devices.
@@ -594,6 +596,7 @@ config QCS_GPUCC_615 config QCS_VIDEOCC_615 tristate "QCS615 Video Clock Controller" + depends on ARM64 || COMPILE_TEST select QCS_GCC_615 help Support for the video clock controller on QCS615 devices.
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 140/312 mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ccb7cd3218e48665f3c7e19eede0da5f069c323d upstream.
Make sure to drop the reference taken to the sysmgr platform device when retrieving its driver data.
Note that holding a reference to a device does not prevent its driver data from going away.
--- drivers/mfd/altera-sysmgr.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mfd/altera-sysmgr.c +2 -0
@@ -117,6 +117,8 @@ struct regmap *altr_sysmgr_regmap_lookup sysmgr =dev_get_drvdata (dev); +put_device (dev); +return sysmgr->regmap; }EXPORT_SYMBOL_GPL (altr_sysmgr_regmap_lookup_by_phandle);
Greg Kroah-Hartman
maintainerPATCH 141/312 mfd: max77620: Fix potential IRQ chip conflict when probing two devices
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 2bac49bad1f3553cc3b3bfb22cc194e9bd9e8427 upstream.
MAX77620 is most likely always a single device on the board, however nothing stops board designers to have two of them, thus same device driver could probe twice. Or user could manually try to probing second time.
Device driver is not ready for that case, because it allocates statically 'struct regmap_irq_chip' as non-const and stores during probe in 'irq_drv_data' member a pointer to per-probe state container ('struct max77620_chip'). devm_regmap_add_irq_chip() does not make a copy of 'struct regmap_irq_chip' but store the pointer.
Second probe - either successful or failure - would overwrite the 'irq_drv_data' from previous device probe, so interrupts would be executed in a wrong context.
--- drivers/mfd/max77620.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/mfd/max77620.c +11 -4
@@ -254,7 +254,7 @@ static int max77620_irq_global_unmask(voreturn ret; } -static struct regmap_irq_chip max77620_top_irq_chip = { +static const struct regmap_irq_chip max77620_top_irq_chip = { .name ="max77620-top" , .irqs = max77620_top_irqs, .num_irqs =ARRAY_SIZE (max77620_top_irqs),
@@ -498,6 +498,7 @@ static int max77620_probe(struct i2c_cliconst struct i2c_device_id *id =i2c_client_get_device_id (client);const struct regmap_config *rmap_config;struct max77620_chip *chip; +struct regmap_irq_chip *chip_desc;const struct mfd_cell *mfd_cells;int n_mfd_cells;bool pm_off;
@@ -508,6 +509,14 @@ static int max77620_probe(struct i2c_clireturn -ENOMEM ;i2c_set_clientdata (client, chip); + + chip_desc =devm_kmemdup (&client->dev, &max77620_top_irq_chip, +sizeof (max77620_top_irq_chip), +GFP_KERNEL ); +if (!chip_desc) +return -ENOMEM ; + chip_desc->irq_drv_data = chip; + chip->dev = &client->dev; chip->chip_irq = client->irq; chip->chip_id = (enum max77620_chip_id )id->driver_data;
@@ -544,11 +553,9 @@ static int max77620_probe(struct i2c_cliif (ret <0 )return ret; - max77620_top_irq_chip.irq_drv_data = chip; ret =devm_regmap_add_irq_chip (chip->dev, chip->rmap, client->irq,IRQF_ONESHOT |IRQF_SHARED ,0 , - &max77620_top_irq_chip, - &chip->top_irq_data); + chip_desc, &chip->top_irq_data);if (ret <0 ) {dev_err (chip->dev,"Failed to add regmap irq: %d\n" , ret);return ret;
Greg Kroah-Hartman
maintainerPATCH 142/312 media: rc: st_rc: Fix reset control resource leak
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
commit 1240abf4b71f632f0117b056e22488e4d9808938 upstream.
The driver calls reset_control_get_optional_exclusive() but never calls reset_control_put() in error paths or in the remove function. This causes a resource leak when probe fails after successfully acquiring the reset control, or when the driver is unloaded.
Switch to devm_reset_control_get_optional_exclusive() to automatically manage the reset control resource.
--- drivers/media/rc/st_rc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/st_rc.c +1 -1
@@ -284,7 +284,7 @@ static int st_rc_probe(struct platform_delse rc_dev->rx_base = rc_dev->base; - rc_dev->rstc =reset_control_get_optional_exclusive (dev,NULL ); + rc_dev->rstc =devm_reset_control_get_optional_exclusive (dev,NULL );if (IS_ERR (rc_dev->rstc)) { ret =PTR_ERR (rc_dev->rstc); goto err;