6.1.160-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.1.160-rc1 review
This is the start of the stable review cycle for the 6.1.160 release. There are 634 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 11 Jan 2026 11:19:41 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.160-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.160-rc1
Aditya Kumar Singh <[email protected]>
wifi: mac80211: fix switch count in EMA beacons
Johannes Berg <[email protected]>
wifi: nl80211: fix puncturing bitmap policy
Petr Tesarik <[email protected]>
net: stmmac: protect updates of 64-bit statistics counters
Petr Tesarik <[email protected]>
net: stmmac: fix ethtool per-queue statistics
Jisheng Zhang <[email protected]>
net: stmmac: fix incorrect rxq|txq_stats reference
Johan Hovold <[email protected]>
usb: gadget: lpc32xx_udc: fix clock imbalance in error path
David Hildenbrand <[email protected]>
mm: (un)track_pfn_copy() fix + doc improvements
David Hildenbrand <[email protected]>
kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
Su Hui <[email protected]>
net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
Greg Kroah-Hartman <[email protected]>
Revert "iommu/amd: Skip enabling command/event buffers for kdump"
Amitai Gottlieb <[email protected]>
firmware: arm_scmi: Fix unused notifier-block in unregister
Jiri Slaby (SUSE) <[email protected]>
tty: fix tty_port_tty_*hangup() kernel-doc
Ming Lei <[email protected]>
blk-mq: setup queue ->tag_set before initializing hctx
Sean Nyekjaer <[email protected]>
pwm: stm32: Always program polarity
Gabriel Krisman Bertazi <[email protected]>
ext4: fix error message when rejecting the default hash
Jason Yan <[email protected]>
ext4: factor out ext4_hash_info_init()
Lizhi Xu <[email protected]>
ext4: filesystems without casefold feature cannot be mounted with siphash
Peter Zijlstra <[email protected]>
sched/fair: Proportional newidle balance
Peter Zijlstra <[email protected]>
sched/fair: Small cleanup to update_newidle_cost()
Peter Zijlstra <[email protected]>
sched/fair: Small cleanup to sched_balance_newidle()
Michal Pecio <[email protected]>
usb: xhci: Apply the link chain quirk on NEC isoc endpoints
Niklas Neronin <[email protected]>
usb: xhci: move link chain bit quirk checks into one helper function.
Zack Rusin <[email protected]>
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Hugh Dickins <[email protected]>
mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()
Peter Xu <[email protected]>
mm/mprotect: use long for page accountings and retval
David Hildenbrand <[email protected]>
x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
Ma Wupeng <[email protected]>
x86/mm/pat: clear VM_PAT if copy_p4d_range failed
Yi Sun <[email protected]>
dmaengine: idxd: Remove improper idxd_free
Justin Stitt <[email protected]>
KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning
Maximilian Immanuel Brandtner <[email protected]>
virtio_console: fix order of fields cols and rows
Johan Hovold <[email protected]>
iommu/qcom: fix device leak on of_xlate()
AngeloGioacchino Del Regno <[email protected]>
iommu/qcom: Index contexts by asid number to allow asid 0
AngeloGioacchino Del Regno <[email protected]>
iommu/qcom: Use the asid read from device-tree if specified
Uwe Kleine-König <[email protected]>
iommu/arm-smmu: Convert to platform remove callback returning void
Uwe Kleine-König <[email protected]>
iommu/arm-smmu: Drop if with an always false condition
Chuck Lever <[email protected]>
NFSD: NFSv4 file creation neglects setting ACL
Łukasz Bartosik <[email protected]>
xhci: dbgtty: fix device unregister: fixup
Jiri Slaby (SUSE) <[email protected]>
tty: introduce and use tty_port_tty_vhangup() helper
Uwe Kleine-König <[email protected]>
serial: Make uart_remove_one_port() return void
Thadeu Lima de Souza Cascardo <[email protected]>
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
Thomas Zimmermann <[email protected]>
drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
Christian König <[email protected]>
drm/amdgpu: cleanup scheduler job initialization v2
Jouni Malinen <[email protected]>
wifi: mac80211: Discard Beacon frames to non-broadcast address
Bijan Tabatabai <[email protected]>
mm: consider non-anon swap cache folios in folio_expected_ref_count()
David Hildenbrand <[email protected]>
mm: simplify folio_expected_ref_count()
NeilBrown <[email protected]>
lockd: fix vfs_test_lock() calls
Paolo Abeni <[email protected]>
mptcp: fallback earlier on simult connection
Wentao Liang <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_probe()
Rob Herring <[email protected]>
pmdomain: Use device_get_match_data()
Haoxiang Li <[email protected]>
media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
Ming Qian <[email protected]>
media: amphion: Remove vpu_vb_is_codecconfig
Laurent Pinchart <[email protected]>
media: amphion: Make some vpu_v4l2 functions static
Ming Qian <[email protected]>
media: amphion: Add a frame flush mode for decoder
Dongli Zhang <[email protected]>
KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
David Hildenbrand <[email protected]>
mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize()
David Hildenbrand <[email protected]>
mm/balloon_compaction: we cannot have isolated pages in the balloon list
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix disabling L0s capability
Siddharth Vadapalli <[email protected]>
arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
Nicolas Dufresne <[email protected]>
media: verisilicon: Fix CPU stalls on G2 bus error
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix OF node leak on probe
Uwe Kleine-König <[email protected]>
ASoC: stm: stm32_sai_sub: Convert to platform remove callback returning void
Joanne Koong <[email protected]>
fuse: fix readahead reclaim deadlock
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix clk prepare imbalance on probe failure
Christophe JAILLET <[email protected]>
ASoC: stm32: sai: Use the devm_clk_get_optional() helper
Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leaks on probe()
Uwe Kleine-König <[email protected]>
iommu/mtk_iommu_v1: Convert to platform remove callback returning void
Johan Hovold <[email protected]>
iommu/mediatek: fix use-after-free on probe deferral
Yong Wu <[email protected]>
iommu/mediatek: Improve safety for mediatek,smi property in larb nodes
Nicolas Ferre <[email protected]>
ARM: dts: microchip: sama7g5: fix uart fifo size to 32
Nicolas Ferre <[email protected]>
ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
Shivani Agarwal <[email protected]>
crypto: af_alg - zero initialize memory allocated via sock_kmalloc
Filipe Manana <[email protected]>
btrfs: don't log conflicting inode if it's a dir moved in the current transaction
Joshua Rogers <[email protected]>
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
Chuck Lever <[email protected]>
NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
Chao Yu <[email protected]>
f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
Chao Yu <[email protected]>
f2fs: use global inline_xattr_slab instead of per-sb slab cache
Chao Yu <[email protected]>
f2fs: fix to propagate error from f2fs_enable_checkpoint()
Chao Yu <[email protected]>
f2fs: fix to avoid updating compression context during writeback
Jaegeuk Kim <[email protected]>
f2fs: drop inode from the donation list when the last file is closed
Jaegeuk Kim <[email protected]>
f2fs: keep POSIX_FADV_NOREUSE ranges
Chao Yu <[email protected]>
f2fs: remove unused GC_FAILURE_PIN
Chao Yu <[email protected]>
f2fs: fix to avoid updating zero-sized extent in extent cache
Seunghwan Baek <[email protected]>
scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
Udipto Goswami <[email protected]>
usb: dwc3: keep susphy enabled during exit to avoid controller faults
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ignore unknown endpoint flags
Johan Hovold <[email protected]>
usb: ohci-nxp: fix device leak on probe failure
Zhang Zekun <[email protected]>
usb: ohci-nxp: Use helper function devm_clk_get_enabled()
Paolo Abeni <[email protected]>
mptcp: avoid deadlock on fallback while reinjecting
Fedor Pchelkin <[email protected]>
ext4: fix string copying in parse_apply_sb_mount_options()
Ye Bin <[email protected]>
jbd2: fix the inconsistency between checksum and data in memory for journal sb
Alexey Velichayshiy <[email protected]>
gfs2: fix freeze error handling
Josef Bacik <[email protected]>
btrfs: don't rewrite ret from inode_permission
Sven Eckelmann (Plasma Cloud) <[email protected]>
wifi: mt76: Fix DTS power-limits on little endian systems
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_can_open(): fix error handling
Junrui Luo <[email protected]>
ALSA: wavefront: Fix integer overflow in sample size validation
Takashi Iwai <[email protected]>
ALSA: wavefront: Use standard print API
Junrui Luo <[email protected]>
ALSA: wavefront: Clear substream pointers on close
Takashi Iwai <[email protected]>
ALSA: wavefront: Use guard() for spin locks
Denis Arefev <[email protected]>
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
Kuniyuki Iwashima <[email protected]>
mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().
Omar Sandoval <[email protected]>
KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
Sean Christopherson <[email protected]>
KVM: x86/mmu: Use EMULTYPE flag to track write #PFs to shadow pages
Dong Chenchen <[email protected]>
page_pool: Fix use-after-free in page_pool_recycle_in_ring
Namjae Jeon <[email protected]>
ksmbd: fix out-of-bounds in parse_sec_desc()
Vladimir Oltean <[email protected]>
net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()
Baokun Li <[email protected]>
fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
Martin Nybo Andersen <[email protected]>
kbuild: Use CRC32 and a 1MiB dictionary for XZ compressed modules
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()
Zhu Yanjun <[email protected]>
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()
Hari Bathini <[email protected]>
powerpc/64s/radix/kfence: map __kfence_pool at page granularity
Jarkko Sakkinen <[email protected]>
tpm: Cap the number of PCR banks
Ming Lei <[email protected]>
blk-mq: add helper for checking if one CPU is mapped to specified hctx
Lyude Paul <[email protected]>
drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
Krzysztof Niemiec <[email protected]>
drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
René Rebe <[email protected]>
drm/mgag200: Fix big-endian support
Simon Richter <[email protected]>
drm/ttm: Avoid NULL pointer deref for evicted BOs
Miaoqian Lin <[email protected]>
drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
Xiaolei Wang <[email protected]>
net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
Deepanshu Kartikey <[email protected]>
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
Ethan Nelson-Moore <[email protected]>
net: usb: sr9700: fix incorrect command used to write single register
Haoxiang Li <[email protected]>
nfsd: Drop the client reference in client_states_open()
Hengqi Chen <[email protected]>
LoongArch: BPF: Zero-extend bpf_tail_call() index
Haoxiang Li <[email protected]>
fjes: Add missing iounmap in fjes_hw_init()
Guangshuo Li <[email protected]>
e1000: fix OOB in e1000_tbi_should_accept()
Jason Gunthorpe <[email protected]>
RDMA/cm: Fix leaking the multicast GID table reference
Jason Gunthorpe <[email protected]>
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
Matthew Wilcox (Oracle) <[email protected]>
idr: fix idr_alloc() returning an ID out of range
Maciej Wieczor-Retman <[email protected]>
kasan: refactor pcpu kasan vmalloc unpoison
H. Peter Anvin <[email protected]>
compiler_types.h: add "auto" as a macro for "__auto_type"
WangYuli <[email protected]>
LoongArch: Use __pmd()/__pte() for swap entry conversions
Qiang Ma <[email protected]>
LoongArch: Correct the calculation logic of thread_count
Huacai Chen <[email protected]>
LoongArch: Add new PCI ID for pci_fixup_vgadev()
Duoming Zhou <[email protected]>
media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
Duoming Zhou <[email protected]>
media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
Ming Qian <[email protected]>
media: amphion: Cancel message work before releasing the VPU core
Johan Hovold <[email protected]>
media: vpif_display: fix section mismatch
Johan Hovold <[email protected]>
media: vpif_capture: fix section mismatch
Haotian Zhang <[email protected]>
media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
Nicolas Dufresne <[email protected]>
media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
Duoming Zhou <[email protected]>
media: TDA1997x: Remove redundant cancel_delayed_work in probe
Marek Szyprowski <[email protected]>
media: samsung: exynos4-is: fix potential ABBA deadlock on init
Miaoqian Lin <[email protected]>
media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
Ivan Abramov <[email protected]>
media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
Haotian Zhang <[email protected]>
media: cec: Fix debugfs leak on bus_register() failure
René Rebe <[email protected]>
fbdev: tcx.c fix mem_map to correct smem_start offset
Thorsten Blum <[email protected]>
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
Rene Rebe <[email protected]>
fbdev: gbefb: fix to use physical address instead of dma address
Mikulas Patocka <[email protected]>
dm-bufio: align write boundary on physical block size
Uladzislau Rezki (Sony) <[email protected]>
dm-ebs: Mark full buffer dirty even on partial write
Mahesh Rao <[email protected]>
firmware: stratix10-svc: Add mutex in stratix10 memory management
Ivan Abramov <[email protected]>
media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
Sven Schnelle <[email protected]>
parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
Sven Schnelle <[email protected]>
parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
Haotian Zhang <[email protected]>
media: rc: st_rc: Fix reset control resource leak
Krzysztof Kozlowski <[email protected]>
mfd: max77620: Fix potential IRQ chip conflict when probing two devices
Johan Hovold <[email protected]>
mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
Christian Hitz <[email protected]>
leds: leds-lp50xx: Enable chip before any communication
Christian Hitz <[email protected]>
leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
Christian Hitz <[email protected]>
leds: leds-lp50xx: Allow LED 0 to be added to module bank
Donet Tom <[email protected]>
powerpc/64s/slb: Fix SLB multihit issue during SLB preload
Dave Vasilevsky <[email protected]>
powerpc, mm: Fix mprotect on book3s 32-bit
Lukas Wunner <[email protected]>
PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
Hans de Goede <[email protected]>
HID: logitech-dj: Remove duplicate error logging
Johan Hovold <[email protected]>
iommu/tegra: fix device leak on probe_device()
Johan Hovold <[email protected]>
iommu/sun50i: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/omap: fix device leaks on probe_device()
Johan Hovold <[email protected]>
iommu/mediatek: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leak on probe_device()
Johan Hovold <[email protected]>
iommu/ipmmu-vmsa: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/exynos: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/apple-dart: fix device leak on of_xlate()
Jinhui Guo <[email protected]>
iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6adm: the the copp device only during last instance
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: perform correct state check before closing
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix device leak on probe
Matthew Wilcox (Oracle) <[email protected]>
ntfs: Do not overwrite uptodate pages
Yipeng Zou <[email protected]>
selftests/ftrace: traceonoff_triggers: strip off names
Cong Zhang <[email protected]>
blk-mq: skip CPU offline notify on unmapped hctx
Ming Lei <[email protected]>
blk-mq: don't schedule block kworker on isolated CPUs
Frederic Weisbecker <[email protected]>
sched/isolation: add cpu_is_isolated() API
Thomas Fourier <[email protected]>
RDMA/bnxt_re: fix dma_free_coherent() pointer
Honggang LI <[email protected]>
RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix to use correct page size for PDE table
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
Jang Ingyu <[email protected]>
RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
Michael Margolin <[email protected]>
RDMA/efa: Remove possible negative shift
Michal Schmidt <[email protected]>
RDMA/irdma: avoid invalid read in irdma_net_event
Pwnverse <[email protected]>
net: rose: fix invalid array index in rose_kill_by_device()
Ido Schimmel <[email protected]>
ipv4: Fix reference count leak when using error routes with nexthop objects
Will Rosenberg <[email protected]>
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
Wei Fang <[email protected]>
net: stmmac: fix the crash issue for zero copy XDP_TX action
Jisheng Zhang <[email protected]>
net: stmmac: use per-queue 64 bit statistics where necessary
Teoh Ji Sheng <[email protected]>
net: stmmac: xgmac: add ethtool per-queue irq statistic support
Song Yoong Siang <[email protected]>
net: stmmac: introduce wrapper for struct xdp_buff
Andrew Halaney <[email protected]>
net: stmmac: dwmac4: Allow platforms to specify some DMA/MTL offsets
Andrew Halaney <[email protected]>
net: stmmac: Pass stmmac_priv in some callbacks
Andrew Halaney <[email protected]>
net: stmmac: Remove some unnecessary void pointers
Revanth Kumar Uppala <[email protected]>
net: stmmac: Power up SERDES after the PHY link
Anshumali Gaur <[email protected]>
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
Bagas Sanjaya <[email protected]>
net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
Deepanshu Kartikey <[email protected]>
net: usb: asix: validate PHY address before use
Jonas Gorski <[email protected]>
net: dsa: b53: skip multicast entries for fdb_dump()
Thomas Fourier <[email protected]>
firewire: nosy: Fix dma_free_coherent() size
Andrew Morton <[email protected]>
genalloc.h: fix htmldocs warning
Yeoreum Yun <[email protected]>
smc91x: fix broken irq-context in PREEMPT_RT
Alice C. Munduruca <[email protected]>
selftests: net: fix "buffer overflow detected" for tap.c
Deepakkumar Karn <[email protected]>
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
Jiri Pirko <[email protected]>
team: fix check for port enabled in team_queue_override_port_prio_changed()
Junrui Luo <[email protected]>
platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
Thomas Fourier <[email protected]>
platform/x86: msi-laptop: add missing sysfs_remove_group()
Eric Dumazet <[email protected]>
ip6_gre: make ip6gre_header() robust
Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
Jacky Chou <[email protected]>
net: mdio: aspeed: add dummy read to avoid read-after-write issue
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: revert use of devm_kzalloc in btusb
Herbert Xu <[email protected]>
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
Kohei Enju <[email protected]>
iavf: fix off-by-one issues in iavf_config_rss_reg()
Gregory Herrero <[email protected]>
i40e: validate ring_len parameter against hardware-specific values
Ivan Vecera <[email protected]>
i40e: Refactor argument of i40e_detect_recover_hung()
Ivan Vecera <[email protected]>
i40e: Refactor argument of several client notification functions
Przemyslaw Korba <[email protected]>
i40e: fix scheduling in set_rx_mode
Aloka Dixit <[email protected]>
wifi: mac80211: do not use old MBSSID elements
Aloka Dixit <[email protected]>
mac80211: support RNR for EMA AP
Aloka Dixit <[email protected]>
cfg80211: support RNR for EMA AP
Aloka Dixit <[email protected]>
wifi: mac80211: generate EMA beacons in AP mode
Avraham Stern <[email protected]>
wifi: nl80211: add a command to enable/disable HW timestamping
Aloka Dixit <[email protected]>
wifi: nl80211: validate and configure puncturing bitmap
Aloka Dixit <[email protected]>
wifi: cfg80211: move puncturing bitmap validation from mac80211
Johannes Berg <[email protected]>
wifi: mac80211: mlme: handle EHT channel puncturing
Vinayak Yadawad <[email protected]>
cfg80211: Update Transition Disable policy during port authorization
Dan Carpenter <[email protected]>
wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
Gui-Dong Han <[email protected]>
hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
Gui-Dong Han <[email protected]>
hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
Gui-Dong Han <[email protected]>
hwmon: (max16065) Use local variable to avoid TOCTOU
Ma Ke <[email protected]>
i2c: amd-mp2: fix reference leak in MP2 PCI device
Bartosz Golaszewski <[email protected]>
platform/x86: intel: chtwc_int33fe: don't dereference swnode args
Srinivas Kandagatla <[email protected]>
rpmsg: glink: fix rpmsg device leak
Johan Hovold <[email protected]>
soc: amlogic: canvas: fix device leak on lookup
Johan Hovold <[email protected]>
soc: qcom: ocmem: fix device leak on lookup
Johan Hovold <[email protected]>
amba: tegra-ahb: Fix device leak on SMMU enable
Alex Deucher <[email protected]>
drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
Prithvi Tambewagh <[email protected]>
io_uring: fix filename leak in __io_openat_prep()
Jens Axboe <[email protected]>
io_uring/poll: correctly handle io_poll_add() return value on update
Nysal Jan K.A. <[email protected]>
powerpc/kexec: Enable SMT before waking offline CPUs
Joshua Rogers <[email protected]>
svcrdma: return 0 on success from svc_rdma_copy_inline_range
Andy Shevchenko <[email protected]>
nfsd: Mark variable __maybe_unused to avoid W=1 build break
Amir Goldstein <[email protected]>
fsnotify: do not generate ACCESS/MODIFY events on child for special files
René Rebe <[email protected]>
r8169: fix RTL8117 Wake-on-Lan in DASH mode
Rafael J. Wysocki <[email protected]>
PM: runtime: Do not clear needs_force_resume with enabled runtime PM
Steven Rostedt <[email protected]>
tracing: Do not register unsupported perf events
Haoxiang Li <[email protected]>
xfs: fix a memory leak in xfs_buf_item_init()
Sean Christopherson <[email protected]>
KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
Sean Christopherson <[email protected]>
KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)
Jim Mattson <[email protected]>
KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
Yosry Ahmed <[email protected]>
KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
Jim Mattson <[email protected]>
KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
Yosry Ahmed <[email protected]>
KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
fuqiang wang <[email protected]>
KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
fuqiang wang <[email protected]>
KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
Sean Christopherson <[email protected]>
KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
Ilya Dryomov <[email protected]>
libceph: make decode_pool() more resilient against corrupted osdmaps
Helge Deller <[email protected]>
parisc: Do not reprogram affinitiy on ASP chip
Zhichi Lin <[email protected]>
scs: fix a wrong parameter in __scs_magic
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
Maxim Levitsky <[email protected]>
KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI)
Prithvi Tambewagh <[email protected]>
ocfs2: fix kernel BUG in ocfs2_find_victim_chain
Jeongjun Park <[email protected]>
media: vidtv: initialize local pointers upon transfer of memory ownership
Alison Schofield <[email protected]>
tools/testing/nvdimm: Use per-DIMM device handle
Chao Yu <[email protected]>
f2fs: fix return value of f2fs_recover_fsync_data()
Deepanshu Kartikey <[email protected]>
f2fs: invalidate dentry cache on failed whiteout creation
Andrey Vatoropin <[email protected]>
scsi: target: Reset t_task_cdb pointer in error case
Dai Ngo <[email protected]>
NFSD: use correct reservation type in nfsd4_scsi_fence_client
Junrui Luo <[email protected]>
scsi: aic94xx: fix use-after-free in device removal path
Tony Battersby <[email protected]>
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
Miaoqian Lin <[email protected]>
cpufreq: nforce2: fix reference count leak in nforce2
Ma Ke <[email protected]>
intel_th: Fix error handling in intel_th_output_open
Tianchu Chen <[email protected]>
char: applicom: fix NULL pointer dereference in ac_ioctl
Haoxiang Li <[email protected]>
usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
Miaoqian Lin <[email protected]>
usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
Johan Hovold <[email protected]>
usb: phy: isp1301: fix non-OF device reference imbalance
Duoming Zhou <[email protected]>
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
Ma Ke <[email protected]>
USB: lpc32xx_udc: Fix error handling in probe
Johan Hovold <[email protected]>
phy: broadcom: bcm63xx-usbh: fix section mismatches
Colin Ian King <[email protected]>
media: pvrusb2: Fix incorrect variable used in trace message
Jeongjun Park <[email protected]>
media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
Chen Changcheng <[email protected]>
usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
Laurent Pinchart <[email protected]>
media: v4l2-mem2mem: Fix outdated documentation
Byungchul Park <[email protected]>
jbd2: use a weaker annotation in journal handling
Baokun Li <[email protected]>
ext4: align max orphan file size with e2fsprogs limit
Yongjian Sun <[email protected]>
ext4: fix incorrect group number assertion in mb_check_buddy
Haibo Chen <[email protected]>
ext4: clear i_state_flags when alloc inode
Karina Yankevich <[email protected]>
ext4: xattr: fix null pointer deref in ext4_raw_inode()
Steven Rostedt <[email protected]>
ktest.pl: Fix uninitialized var in config-bisect.pl
Konstantin Komarov <[email protected]>
fs/ntfs3: fix mount failure for sparse runs in run_unpack()
Zheng Yejian <[email protected]>
kallsyms: Fix wrong "big" kernel symbol type read from procfs
Rene Rebe <[email protected]>
floppy: fix for PAGE_SIZE != 4KB
Li Chen <[email protected]>
block: rate-limit capacity change info log
Stefan Haberland <[email protected]>
s390/dasd: Fix gendisk parent after copy pair swap
Eric Biggers <[email protected]>
lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
Jarkko Sakkinen <[email protected]>
KEYS: trusted: Fix a memory leak in tpm2_load_cmd
Stefano Garzarella <[email protected]>
vhost/vsock: improve RCU read sections around vhost_vsock_get()
Dan Carpenter <[email protected]>
block: rnbd-clt: Fix signedness bug in init_dev()
Chia-Lin Kao (AceLan) <[email protected]>
platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks
Daniel Wagner <[email protected]>
nvme-fc: don't hold rport lock when putting ctrl
Wenhua Lin <[email protected]>
serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
Chen Changcheng <[email protected]>
usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.
Hongyu Xie <[email protected]>
usb: xhci: limit run_graceperiod for only usb 3.0 devices
Pei Xiao <[email protected]>
iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains
Mark Pearson <[email protected]>
usb: typec: ucsi: Handle incorrect num_connectors capability
Lizhi Xu <[email protected]>
usbip: Fix locking bug in RT-enabled kernels
Yuezhang Mo <[email protected]>
exfat: fix remount failure in different process environments
Encrow Thorne <[email protected]>
reset: fix BIT macro reference
Li Qiang <[email protected]>
via_wdt: fix critical boot hang due to unnamed resource allocation
Tony Battersby <[email protected]>
scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
Tony Battersby <[email protected]>
scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
Tony Battersby <[email protected]>
scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
Ben Collins <[email protected]>
powerpc/addnote: Fix overflow on 32-bit builds
Josua Mayer <[email protected]>
clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
Matthias Schiffer <[email protected]>
ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
Peng Fan <[email protected]>
firmware: imx: scu-irq: Init workqueue before request mbox channel
Jinhui Guo <[email protected]>
ipmi: Fix __scan_channels() failing to rescan channels
Jinhui Guo <[email protected]>
ipmi: Fix the race between __scan_channels() and deliver_response()
Shipei Qu <[email protected]>
ALSA: usb-mixer: us16x08: validate meter packet indices
Haotian Zhang <[email protected]>
ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
Haotian Zhang <[email protected]>
ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
Shaurya Rane <[email protected]>
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
Jared Kangas <[email protected]>
mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
Christophe Leroy <[email protected]>
spi: fsl-cpm: Check length parity before switching to 16 bit mode
Pengjie Zhang <[email protected]>
ACPI: CPPC: Fix missing PCC check for guaranteed_perf
Christoffer Sandberg <[email protected]>
Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
Junjie Cao <[email protected]>
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
Ping Cheng <[email protected]>
HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
Namjae Jeon <[email protected]>
ksmbd: fix buffer validation by including null terminator size in EA length
Namjae Jeon <[email protected]>
ksmbd: Fix refcount leak when invalid session is found on session lookup
Qianchang Zhao <[email protected]>
ksmbd: skip lock-range check on equal size to avoid size==0 underflow
Thomas Fourier <[email protected]>
block: rnbd-clt: Fix leaked ID in init_dev()
Anurag Dutta <[email protected]>
spi: cadence-quadspi: Fix clock disable on probe failure path
Yang Yingliang <[email protected]>
spi: cadence-quadspi: add missing clk_disable_unprepare() in cqspi_probe()
William Qiu <[email protected]>
spi: cadence-quadspi: Add clock configuration for StarFive JH7110 QSPI
Brad Larson <[email protected]>
spi: cadence-quadspi: Add compatible for AMD Pensando Elba SoC
William Qiu <[email protected]>
spi: cadence-quadspi: Add support for StarFive JH7110 QSPI
Juergen Gross <[email protected]>
x86/xen: Fix sparse warning in enlighten_pv.c
Brian Gerst <[email protected]>
x86/xen: Move Xen upcall handler
Haoxiang Li <[email protected]>
MIPS: Fix a reference leak bug in ip22_check_gio()
Alexey Simakov <[email protected]>
hwmon: (tmp401) fix overflow caused by default conversion rate value
Junrui Luo <[email protected]>
hwmon: (ibmpex) fix use-after-free in high/low store
Jian Shen <[email protected]>
net: hns3: add VLAN id validation before using
Jian Shen <[email protected]>
net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx
Jian Shen <[email protected]>
net: hns3: using the num_tqps in the vf driver to apply for resources
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Handle escaped percent properly
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Validate format string parameters
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Add support for unrecognized string
Moshe Shemesh <[email protected]>
net/mlx5: Drain firmware reset in shutdown callback
Parav Pandit <[email protected]>
net/mlx5: Create a new profile for SFs
Moshe Shemesh <[email protected]>
net/mlx5: fw reset, clear reset requested on drain_fw_reset
Gal Pressman <[email protected]>
ethtool: Avoid overflowing userspace buffer on stats query
Daniil Tatianin <[email protected]>
net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers
Daniil Tatianin <[email protected]>
net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats
Dan Carpenter <[email protected]>
nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
Victor Nogueira <[email protected]>
net/sched: ets: Remove drr class from the active list if it changes to strict
Junrui Luo <[email protected]>
caif: fix integer underflow in cffrml_receive()
Slavin Liu <[email protected]>
ipvs: fix ipv4 null-ptr-deref in route error path
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: fix leaked ct in error paths
Alexey Simakov <[email protected]>
broadcom: b44: prevent uninitialized value usage
Ilya Maximets <[email protected]>
net: openvswitch: fix middle attribute validation in push_nsh() action
Ido Schimmel <[email protected]>
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
Ido Schimmel <[email protected]>
mlxsw: spectrum_router: Fix neighbour use-after-free
Dmitry Skorodumov <[email protected]>
ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
Jamal Hadi Salim <[email protected]>
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
Wang Liang <[email protected]>
netrom: Fix memory leak in nr_sendmsg()
Andreas Gruenbacher <[email protected]>
gfs2: Fix use of bio_chain
Gongwei Li <[email protected]>
Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
ChenXiaoSong <[email protected]>
smb/server: fix return value of smb2_ioctl()
Qu Wenruo <[email protected]>
btrfs: scrub: always update btrfs_scrub_progress::last_physical
Hans de Goede <[email protected]>
wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/073
Tetsuo Handa <[email protected]>
hfsplus: Verify inode mode when loading from disk
Yang Chenzhi <[email protected]>
hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/070
Mikhail Malyshev <[email protected]>
kbuild: Use objtree for module signing key path
Konstantin Komarov <[email protected]>
fs/ntfs3: Support timestamps prior to epoch
Song Liu <[email protected]>
livepatch: Match old_sympos 0 and 1 in klp_find_func()
Shuhao Fu <[email protected]>
cpufreq: s5pv210: fix refcount leak
Sakari Ailus <[email protected]>
ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
Cryolitia PukNgae <[email protected]>
ACPICA: Avoid walking the Namespace if start_node is NULL
Peter Zijlstra <[email protected]>
x86/ptrace: Always inline trivial accessors
Peter Zijlstra <[email protected]>
sched/fair: Revert max_newidle_lb_cost bump
Doug Berger <[email protected]>
sched/deadline: only set free_cpus for online runqueues
George Kennedy <[email protected]>
perf/x86/amd: Check event before enable to avoid GPF
Deepanshu Kartikey <[email protected]>
btrfs: fix memory leak of fs_devices in degraded seed device path
Ondrej Mosnacek <[email protected]>
bpf, arm64: Do not audit capability check in do_jit()
Filipe Manana <[email protected]>
btrfs: do not skip logging new dentries when logging a new name
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: get channel status data when PHY is not exists
Junrui Luo <[email protected]>
ALSA: dice: fix buffer overflow in detect_stream_formats()
Diogo Ivo <[email protected]>
usb: phy: Initialize struct usb_phy list_head
Haotien Hsu <[email protected]>
usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
Thangaraj Samynathan <[email protected]>
net: lan743x: Allocate rings outside ZONE_DMA
Huacai Chen <[email protected]>
LoongArch: Add machine_kexec_mask_interrupts() implementation
Dmitry Antipov <[email protected]>
ocfs2: fix memory leak in ocfs2_merge_rec_left()
Dan Carpenter <[email protected]>
irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
Mauro Carvalho Chehab <[email protected]>
efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
Mauro Carvalho Chehab <[email protected]>
efi/cper: Adjust infopfx size to accept an extra space
Mauro Carvalho Chehab <[email protected]>
efi/cper: Add a new helper function to print bitmasks
Haotian Zhang <[email protected]>
dm log-writes: Add missing set_freezable() for freezable kthread
Alexey Simakov <[email protected]>
dm-raid: fix possible NULL dereference with undefined raid type
Liyuan Pang <[email protected]>
ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
Junrui Luo <[email protected]>
ALSA: firewire-motu: add bounds check in put_user loop for DSP events
Haotian Zhang <[email protected]>
rtc: gamecube: Check the return value of ioremap()
Andres J Rosa <[email protected]>
ALSA: uapi: Fix typo in asound.h comment
Dave Kleikamp <[email protected]>
dma/pool: eliminate alloc_pages warning in atomic_pool_expand
Junrui Luo <[email protected]>
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
shechenglong <[email protected]>
block: fix comment for op_is_zone_mgmt() to include RESET_ALL
Cong Zhang <[email protected]>
blk-mq: Abort suspend when wakeup events are pending
Shengjiu Wang <[email protected]>
ASoC: ak5558: Disable regulator when error happens
Shengjiu Wang <[email protected]>
ASoC: ak4458: Disable regulator when error happens
Haotian Zhang <[email protected]>
ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
Anton Khirnov <[email protected]>
platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
Armin Wolf <[email protected]>
fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
Trond Myklebust <[email protected]>
NFS: Fix inheritance of the block sizes when automounting
Trond Myklebust <[email protected]>
Expand the type of nfs_fattr->valid
Trond Myklebust <[email protected]>
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
Ondrej Mosnacek <[email protected]>
fs_context: drop the unused lsm_flags member
Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when mounting nfs"
Trond Myklebust <[email protected]>
Revert "nfs: clear SB_RDONLY before getting superblock"
Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when remounting nfs"
Jonathan Curley <[email protected]>
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
Trond Myklebust <[email protected]>
NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
Trond Myklebust <[email protected]>
NFS: Initialise verifiers for visible dentries in readdir and lookup
Armin Wolf <[email protected]>
fs/nls: Fix utf16 to utf8 conversion
Trond Myklebust <[email protected]>
NFS: Avoid changing nlink when file removes and attribute updates race
Abdun Nihaal <[email protected]>
fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
Haotian Zhang <[email protected]>
pinctrl: single: Fix incorrect type for error return variable
Matthijs Kooijman <[email protected]>
pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
Namhyung Kim <[email protected]>
perf tools: Fix split kallsyms DSO counting
Xiang Mei <[email protected]>
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
Yu Kuai <[email protected]>
md/raid5: fix IO hang when array is broken with IO inflight
Yu Kuai <[email protected]>
md: export md_is_rdwr() and is_md_suspended()
Alexandru Gagniuc <[email protected]>
remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
Ivan Stepchenko <[email protected]>
mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
Haotian Zhang <[email protected]>
mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
Alexey Kodanev <[email protected]>
net: stmmac: fix rx limit check in stmmac_rx_zc()
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_connlimit: update the count if add was skipped
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: rework API to use sk_buff directly
Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
Ilias Stamatis <[email protected]>
Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
Andy Shevchenko <[email protected]>
resource: introduce is_type_match() helper and use it
Andy Shevchenko <[email protected]>
resource: replace open coded resource_intersection()
Andy Shevchenko <[email protected]>
resource: Reuse for_each_resource() macro
Andy Shevchenko <[email protected]>
resource: Replace printk(KERN_WARNING) by pr_warn(), printk() by pr_info()
sparkhuang <[email protected]>
regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Fix error path in hw_params()
Michael S. Tsirkin <[email protected]>
virtio: fix virtqueue_set_affinity() docs
Michael S. Tsirkin <[email protected]>
virtio: fix typo in virtio_device_ready() comment
Alok Tiwari <[email protected]>
virtio_vdpa: fix misleading return in void function
Yongjian Sun <[email protected]>
ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
Kemeng Shi <[email protected]>
ext4: remove unused return value of __mb_check_buddy
René Rebe <[email protected]>
ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
Haotian Zhang <[email protected]>
hwmon: sy7636a: Fix regulator_enable resource leak on error path
Dan Carpenter <[email protected]>
drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: clear the channel status control memory
Chancel Liu <[email protected]>
ASoC: fsl_xcvr: Add support for i.MX93 platform
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Add Counter registers
Krzysztof Czurylo <[email protected]>
RDMA/irdma: Fix data race in irdma_free_pble
Krzysztof Czurylo <[email protected]>
RDMA/irdma: Fix data race in irdma_sc_ccq_arm
Stephan Gerhold <[email protected]>
iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
Randy Dunlap <[email protected]>
backlight: lp855x: Fix lp855x.h kernel-doc warnings
Luca Ceresoli <[email protected]>
backlight: led-bl: Add devlink to supplier LEDs
Mans Rullgard <[email protected]>
backlight: led_bl: Take led_access lock when required
Ria Thomas <[email protected]>
wifi: ieee80211: correct FILS status codes
Shawn Lin <[email protected]>
PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
Jianglei Nie <[email protected]>
staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
Dinh Nguyen <[email protected]>
firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
Zilin Guan <[email protected]>
mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
Fangyu Yu <[email protected]>
RISC-V: KVM: Fix guest page fault within HLV* instructions
Haotian Zhang <[email protected]>
crypto: ccree - Correctly handle return of sg_nents_for_len
Matt Bobrowski <[email protected]>
selftests/bpf: Improve reliability of test_perf_branches_no_hw()
Matt Bobrowski <[email protected]>
selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
Gopi Krishna Menon <[email protected]>
usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during suspend if set as peripheral
Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during shutdown if set as peripheral
Jisheng Zhang <[email protected]>
usb: dwc2: disable platform lowlevel hw resources during shutdown
Oliver Neukum <[email protected]>
usb: chaoskey: fix locking for O_NONBLOCK
Zhao Yipeng <[email protected]>
ima: Handle error code returned by ima_filter_rule_match()
Seungjin Bae <[email protected]>
wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
Chen Ridong <[email protected]>
cpuset: Treat cpusets in attaching as populated
Alexander Dahl <[email protected]>
net: phy: adin1100: Fix software power-down ready condition
Christophe JAILLET <[email protected]>
phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
Haotian Zhang <[email protected]>
mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
Haotian Zhang <[email protected]>
mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
Uwe Kleine-König <[email protected]>
pwm: bcm2835: Make sure the channel is enabled after pwm_request()
Jay Liu <[email protected]>
drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
Edward Adam Davis <[email protected]>
fs/ntfs3: Prevent memory leaks in add sub record
Edward Adam Davis <[email protected]>
fs/ntfs3: out1 also needs to put mi
Ritesh Harjani (IBM) <[email protected]>
powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
Pu Lehui <[email protected]>
bpf: Fix invalid prog->stats access when update_effective_progs fails
Jose Fernandez <[email protected]>
bpf: Improve program stats run-time calculation
Abdun Nihaal <[email protected]>
wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
Sergey Bashirov <[email protected]>
NFSD/blocklayout: Fix minlength check in proc_layoutget
Haotian Zhang <[email protected]>
watchdog: wdat_wdt: Fix ACPI table leak in probe function
Martin KaFai Lau <[email protected]>
bpf: Check skb->transport_header is set in bpf_skb_check_mtu
Alexei Starovoitov <[email protected]>
selftests/bpf: Fix failure paths in send_signal test
Rene Rebe <[email protected]>
ps3disk: use memcpy_{from,to}_bvec index
Siddharth Vadapalli <[email protected]>
PCI: keystone: Exit ks_pcie_probe() for invalid mode
Haotian Zhang <[email protected]>
leds: netxbig: Fix GPIO descriptor leak in error paths
Haotian Zhang <[email protected]>
scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
Haotian Zhang <[email protected]>
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
Dmitry Antipov <[email protected]>
ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
Andy Shevchenko <[email protected]>
lib/vsprintf: Check pointer before dereferencing in time_and_date()
Haotian Zhang <[email protected]>
clk: renesas: r9a06g032: Fix memory leak in error path
Herve Codina <[email protected]>
soc: renesas: r9a06g032-sysctrl: Handle h2mode setting based on USBF presence
Leo Yan <[email protected]>
coresight: etm4x: Add context synchronization before enabling trace
Leo Yan <[email protected]>
coresight: etm4x: Extract the trace unit controlling
Leo Yan <[email protected]>
coresight: etm4x: Correct polling IDLE bit
Zheng Qixing <[email protected]>
nbd: defer config unlock in nbd_genl_connect
Abdun Nihaal <[email protected]>
wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
Long Li <[email protected]>
macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
Christophe Leroy <[email protected]>
powerpc/32: Fix unpaired stwcx. on interrupt exit
Bean Huo <[email protected]>
scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
Edward Adam Davis <[email protected]>
ntfs3: init run lock for extend inode
Ma Ke <[email protected]>
RDMA/rtrs: server: Fix error handling in get_or_create_srv
Manivannan Sadhasivam <[email protected]>
dt-bindings: PCI: amlogic: Fix the register name of the DBI region
Neil Armstrong <[email protected]>
dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema
Mike McGowen <[email protected]>
scsi: smartpqi: Fix device resources accessed after device removal
Kevin Barnett <[email protected]>
scsi: smartpqi: Add abort handler
Mike McGowen <[email protected]>
scsi: smartpqi: Remove contention for raid_bypass_cnt
Don Brace <[email protected]>
scsi: smartpqi: Convert to host_tagset
Haotian Zhang <[email protected]>
scsi: stex: Fix reboot_notifier leak in probe error path
Zheng Qixing <[email protected]>
nbd: defer config put in recv_work
Gabor Juhos <[email protected]>
regulator: core: disable supply if enabling main regulator fails
Dapeng Mi <[email protected]>
perf/x86/intel: Correct large PEBS flag check
Zhang Yi <[email protected]>
ext4: correct the checking of quota files before moving extents
Haotian Zhang <[email protected]>
mfd: da9055: Fix missing regmap_del_irq_chip() in error path
Usama Arif <[email protected]>
efi/libstub: Fix page table access in 5-level to 4-level paging transition
Usama Arif <[email protected]>
x86/boot: Fix page table access in 5-level to 4-level paging transition
Vishwaroop A <[email protected]>
spi: tegra210-quad: Fix timeout handling
Bart Van Assche <[email protected]>
scsi: target: Do not write NUL characters into ASCII configfs output
Ahelenia Ziemiańska <[email protected]>
power: supply: apm_power: only unset own apm_get_power_status
Ivan Abramov <[email protected]>
power: supply: wm831x: Check wm831x_set_bits() return value
Ivan Abramov <[email protected]>
power: supply: cw2015: Check devm_delayed_work_autocancel() return code
Shuai Xue <[email protected]>
perf record: skip synthesize event when open evsel failed
Dmitry Baryshkov <[email protected]>
interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
Stanley Chu <[email protected]>
i3c: master: svc: Prevent incomplete IBI transaction
Frank Li <[email protected]>
i3c: fix refcount inconsistency in i3c_master_register
Jarkko Nikula <[email protected]>
i3c: master: Inherit DMA masks and parameters from parent device
Jeremy Kerr <[email protected]>
i3c: Allow OF-alias-based persistent bus numbering
Haotian Zhang <[email protected]>
pinctrl: stm32: fix hwspinlock resource leak in probe function
Haotian Zhang <[email protected]>
soc: qcom: smem: fix hwspinlock resource leak in probe error paths
Benjamin Berg <[email protected]>
tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
Tengda Wu <[email protected]>
x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
Kuniyuki Iwashima <[email protected]>
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
Horatiu Vultur <[email protected]>
phy: mscc: Fix PTP for VSC8574 and VSC8572
Peng Fan <[email protected]>
firmware: imx: scu-irq: fix OF node leak in
Heiko Carstens <[email protected]>
s390/ap: Don't leak debug feature files if AP instructions are not available
Heiko Carstens <[email protected]>
s390/smp: Fix fallback CPU detection
Baochen Qiang <[email protected]>
wifi: ath11k: fix peer HE MCS assignment
nieweiqiang <[email protected]>
crypto: hisilicon/qm - restore original qos values
Thorsten Blum <[email protected]>
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
Li Qiang <[email protected]>
uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
Tim Harvey <[email protected]>
arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
Xuanqiang Luo <[email protected]>
inet: Avoid ehash lookup race in inet_ehash_insert()
Xuanqiang Luo <[email protected]>
rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
Sidharth Seela <[email protected]>
ntfs3: Fix uninit buffer allocated by __getname()
Raphael Pinsonneault-Thibeault <[email protected]>
ntfs3: fix uninit memory after failed mi_read in mi_format_new
Johan Hovold <[email protected]>
irqchip/qcom-irq-combiner: Fix section mismatch
Johan Hovold <[email protected]>
irqchip/imx-mu-msi: Fix section mismatch
Johan Hovold <[email protected]>
irqchip/irq-brcmstb-l2: Fix section mismatch
Johan Hovold <[email protected]>
irqchip/irq-bcm7120-l2: Fix section mismatch
Johan Hovold <[email protected]>
irqchip/irq-bcm7038-l1: Fix section mismatch
Josh Poimboeuf <[email protected]>
objtool: Fix weak symbol detection
Peter Zijlstra <[email protected]>
objtool: Fix find_{symbol,func}_containing()
Marek Vasut <[email protected]>
clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
Seungjin Bae <[email protected]>
USB: Fix descriptor count when handling invalid MBIM extended descriptor
Janusz Krzysztofik <[email protected]>
drm/vgem-fence: Fix potential deadlock on release
Guido Günther <[email protected]>
drm/panel: visionox-rm69299: Don't clear all mode flags
Mainak Sen <[email protected]>
gpu: host1x: Fix race in syncpt alloc/free
Konstantin Andreev <[email protected]>
smack: fix bug: unprivileged task can create labels
Navaneeth K <[email protected]>
staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
Navaneeth K <[email protected]>
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
Navaneeth K <[email protected]>
staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
Nikita Zhandarovich <[email protected]>
comedi: check device's attached status in compat ioctls
Nikita Zhandarovich <[email protected]>
comedi: multiq3: sanitize config options in multiq3_attach()
Ian Abbott <[email protected]>
comedi: c6xdigio: Fix invalid PNP driver unregistration
Linus Torvalds <[email protected]>
samples: work around glibc redefining some of our defines wrong
Huacai Chen <[email protected]>
LoongArch: Mask all interrupts during kexec/kdump
Naoki Ueki <[email protected]>
HID: elecom: Add support for ELECOM M-XT3URBK (018F)
Jia Ston <[email protected]>
platform/x86: huawei-wmi: add keys for HONOR models
April Grimoire <[email protected]>
HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
Armin Wolf <[email protected]>
platform/x86: acer-wmi: Ignore backlight event
Praveen Talari <[email protected]>
pinctrl: qcom: msm: Fix deadlock in pinmux configuration
Tetsuo Handa <[email protected]>
bfs: Reconstruct file type when loading from disk
Lushih Hsieh <[email protected]>
ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
Yiqi Sun <[email protected]>
smb: fix invalid username check in smb3_fs_context_parse_param()
Ian Forbes <[email protected]>
drm/vmwgfx: Use kref in vmw_bo_dirty
Robin Gong <[email protected]>
spi: imx: keep dma request disabled before dma transfer setup
Alvaro Gamez Machado <[email protected]>
spi: xilinx: increase number of retries before declaring stall
Song Liu <[email protected]>
ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
Johan Hovold <[email protected]>
USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
Johan Hovold <[email protected]>
USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
Magne Bruno <[email protected]>
serial: add support of CPCI cards
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: match on interface number for jtag
Fabio Porcedda <[email protected]>
USB: serial: option: move Telit 0x10c7 composition in the right place
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE910C04 new compositions
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W760
Nikita Zhandarovich <[email protected]>
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
Alexey Nepomnyashih <[email protected]>
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
Alexander Sverdlin <[email protected]>
locking/spinlock/debug: Fix data-race in do_raw_write_lock
Qianchang Zhao <[email protected]>
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
Deepanshu Kartikey <[email protected]>
ext4: refresh inline data size before write operations
Ye Bin <[email protected]>
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
Bagas Sanjaya <[email protected]>
Documentation: process: Also mention Sasha Levin as stable tree maintainer
Stefan Kalscheuer <[email protected]>
leds: spi-byte: Use devm_led_classdev_register_ext()
Azeem Shaikh <[email protected]>
leds: Replace all non-returning strlcpy with strscpy
Sabrina Dubroca <[email protected]>
xfrm: flush all states in xfrm_state_fini
Sabrina Dubroca <[email protected]>
xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
Sabrina Dubroca <[email protected]>
Revert "xfrm: destroy xfrm_state synchronously on net exit path"
Sabrina Dubroca <[email protected]>
xfrm: delete x->tunnel as we delete x
-------------
Diffstat:
.../devicetree/bindings/pci/amlogic,axg-pcie.yaml | 134 +++++++++++ .../devicetree/bindings/pci/amlogic,meson-pcie.txt | 70 ------ Documentation/driver-api/tty/tty_port.rst | 5 +- Documentation/filesystems/mount_api.rst | 1 - Documentation/process/2.Process.rst | 6 +- Makefile | 4 +- arch/arm/boot/dts/sama5d2.dtsi | 10 +- arch/arm/boot/dts/sama7g5.dtsi | 4 +- arch/arm/include/asm/word-at-a-time.h | 10 +- .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 - arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 12 +- arch/arm64/kvm/Makefile | 3 + arch/arm64/net/bpf_jit_comp.c | 2 +- arch/loongarch/include/asm/pgtable.h | 4 +- arch/loongarch/kernel/machine_kexec.c | 24 ++ arch/loongarch/kernel/setup.c | 8 +- arch/loongarch/net/bpf_jit.c | 2 + arch/loongarch/pci/pci.c | 2 + arch/mips/sgi-ip22/ip22-gio.c | 3 +- arch/parisc/kernel/asm-offsets.c | 2 + arch/parisc/kernel/entry.S | 16 +- arch/powerpc/boot/addnote.c | 7 +- arch/powerpc/include/asm/book3s/32/tlbflush.h | 5 +- arch/powerpc/include/asm/book3s/64/mmu-hash.h | 1 - arch/powerpc/include/asm/kfence.h | 11 +- arch/powerpc/kernel/entry_32.S | 10 +- arch/powerpc/kernel/process.c | 5 - arch/powerpc/kexec/core_64.c | 19 ++ arch/powerpc/mm/book3s32/tlb.c | 9 + arch/powerpc/mm/book3s64/internal.h | 2 - arch/powerpc/mm/book3s64/mmu_context.c | 2 - arch/powerpc/mm/book3s64/radix_pgtable.c | 84 ++++++- arch/powerpc/mm/book3s64/slb.c | 88 ------- arch/powerpc/mm/init-common.c | 3 + arch/powerpc/mm/ptdump/hashpagetable.c | 6 + arch/powerpc/platforms/pseries/cmm.c | 5 +- arch/riscv/kvm/vcpu_insn.c | 22 ++ arch/s390/kernel/smp.c | 1 + arch/x86/boot/compressed/pgtable_64.c | 11 +- arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/entry/common.c | 72 ------ arch/x86/events/amd/core.c | 7 +- arch/x86/events/intel/core.c | 4 +- arch/x86/include/asm/kvm_host.h | 46 ++-- arch/x86/include/asm/ptrace.h | 20 +- arch/x86/kernel/dumpstack.c | 23 +- arch/x86/kvm/lapic.c | 32 ++- arch/x86/kvm/mmu/mmu.c | 5 +- arch/x86/kvm/mmu/mmu_internal.h | 12 +- arch/x86/kvm/mmu/paging_tmpl.h | 4 +- arch/x86/kvm/svm/nested.c | 6 +- arch/x86/kvm/svm/svm.c | 78 +++--- arch/x86/kvm/svm/svm.h | 7 +- arch/x86/kvm/vmx/nested.c | 2 +- arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/kvm/vmx/vmx.h | 1 + arch/x86/kvm/x86.c | 61 +++-- arch/x86/mm/pat/memtype.c | 50 ++-- arch/x86/xen/enlighten_pv.c | 69 ++++++ block/blk-mq.c | 103 ++++++-- block/genhd.c | 2 +- crypto/af_alg.c | 5 +- crypto/algif_hash.c | 3 +- crypto/algif_rng.c | 3 +- crypto/asymmetric_keys/asymmetric_type.c | 12 +- crypto/seqiv.c | 8 +- drivers/acpi/acpica/nswalk.c | 9 +- drivers/acpi/apei/ghes.c | 16 +- drivers/acpi/cppc_acpi.c | 3 +- drivers/acpi/processor_core.c | 2 +- drivers/acpi/property.c | 9 +- drivers/amba/tegra-ahb.c | 1 + drivers/base/power/runtime.c | 22 +- drivers/block/floppy.c | 2 +- drivers/block/nbd.c | 5 +- drivers/block/ps3disk.c | 4 + drivers/block/rnbd/rnbd-clt.c | 13 +- drivers/block/rnbd/rnbd-clt.h | 2 +- drivers/bluetooth/btusb.c | 14 +- drivers/bus/ti-sysc.c | 11 +- drivers/char/applicom.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 20 +- drivers/char/tpm/tpm-chip.c | 1 - drivers/char/tpm/tpm1-cmd.c | 5 - drivers/char/tpm/tpm2-cmd.c | 8 +- drivers/char/virtio_console.c | 2 +- drivers/clk/mvebu/cp110-system-controller.c | 20 ++ drivers/clk/renesas/r9a06g032-clocks.c | 34 ++- drivers/clk/renesas/renesas-cpg-mssr.c | 11 +- drivers/comedi/comedi_fops.c | 42 +++- drivers/comedi/drivers/c6xdigio.c | 46 +++- drivers/comedi/drivers/multiq3.c | 9 + drivers/comedi/drivers/pcl818.c | 5 +- drivers/cpufreq/cpufreq-nforce2.c | 3 + drivers/cpufreq/s5pv210-cpufreq.c | 6 +- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +- drivers/crypto/hisilicon/qm.c | 14 +- drivers/dma/idxd/init.c | 1 - drivers/firewire/nosy.c | 10 +- drivers/firmware/arm_scmi/notify.c | 1 + drivers/firmware/efi/cper-arm.c | 52 ++-- drivers/firmware/efi/cper.c | 60 +++++ drivers/firmware/efi/libstub/x86-5lvl.c | 4 +- drivers/firmware/imx/imx-scu-irq.c | 8 +- drivers/firmware/stratix10-svc.c | 12 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 44 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_job.h | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 58 ++--- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 22 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 61 ++--- drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 12 +- drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 12 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 17 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 2 +- drivers/gpu/drm/gma500/framebuffer.c | 42 ---- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 37 ++- drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +- drivers/gpu/drm/mediatek/mtk_dp.c | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 25 ++ drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 13 + drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +- drivers/gpu/drm/ttm/ttm_bo_vm.c | 6 + drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +- drivers/gpu/host1x/syncpt.c | 4 +- drivers/hid/hid-apple.c | 1 + drivers/hid/hid-elecom.c | 6 +- drivers/hid/hid-ids.h | 3 +- drivers/hid/hid-input.c | 18 +- drivers/hid/hid-logitech-dj.c | 56 ++--- drivers/hid/hid-quirks.c | 3 +- drivers/hwmon/ibmpex.c | 9 +- drivers/hwmon/max16065.c | 7 +- drivers/hwmon/sy7636a-hwmon.c | 7 +- drivers/hwmon/tmp401.c | 2 +- drivers/hwmon/w83791d.c | 19 +- drivers/hwmon/w83l786ng.c | 26 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 130 ++++++---- drivers/hwtracing/intel_th/core.c | 20 +- drivers/i2c/busses/i2c-amd-mp2-pci.c | 5 +- drivers/i3c/master.c | 40 +++- drivers/i3c/master/svc-i3c-master.c | 22 +- drivers/iio/adc/ti_am335x_adc.c | 2 +- drivers/infiniband/core/addr.c | 33 +-- drivers/infiniband/core/cma.c | 3 + drivers/infiniband/core/device.c | 5 + drivers/infiniband/core/verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 8 +- drivers/infiniband/hw/efa/efa_verbs.c | 4 - drivers/infiniband/hw/irdma/ctrl.c | 3 + drivers/infiniband/hw/irdma/pble.c | 6 +- drivers/infiniband/hw/irdma/utils.c | 3 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 1 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/input/touchscreen/ti_am335x_tsc.c | 2 +- drivers/interconnect/qcom/msm8996.c | 1 + drivers/iommu/amd/init.c | 43 ++-- drivers/iommu/apple-dart.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 ++- drivers/iommu/arm/arm-smmu/arm-smmu.c | 12 +- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 56 +++-- drivers/iommu/exynos-iommu.c | 9 +- drivers/iommu/ipmmu-vmsa.c | 2 + drivers/iommu/mtk_iommu.c | 78 ++++-- drivers/iommu/mtk_iommu_v1.c | 30 ++- drivers/iommu/omap-iommu.c | 2 +- drivers/iommu/omap-iommu.h | 2 - drivers/iommu/sun50i-iommu.c | 2 + drivers/iommu/tegra-smmu.c | 5 +- drivers/irqchip/irq-bcm7038-l1.c | 8 +- drivers/irqchip/irq-bcm7120-l2.c | 17 +- drivers/irqchip/irq-brcmstb-l2.c | 12 +- drivers/irqchip/irq-imx-mu-msi.c | 14 +- drivers/irqchip/irq-mchp-eic.c | 2 +- drivers/irqchip/qcom-irq-combiner.c | 2 +- drivers/isdn/capi/capi.c | 8 +- drivers/leds/flash/leds-aat1290.c | 2 +- drivers/leds/led-class.c | 2 +- drivers/leds/leds-lp50xx.c | 67 ++++-- drivers/leds/leds-netxbig.c | 36 ++- drivers/leds/leds-spi-byte.c | 11 +- drivers/macintosh/mac_hid.c | 3 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-log-writes.c | 1 + drivers/md/dm-raid.c | 2 + drivers/md/md.c | 16 -- drivers/md/md.h | 17 ++ drivers/md/raid5.c | 6 +- drivers/media/cec/core/cec-core.c | 1 + .../media/common/videobuf2/videobuf2-dma-contig.c | 1 + drivers/media/i2c/adv7604.c | 4 +- drivers/media/i2c/adv7842.c | 11 +- drivers/media/i2c/msp3400-kthreads.c | 2 + drivers/media/i2c/tda1997x.c | 1 - drivers/media/platform/amphion/vpu_malone.c | 35 ++- drivers/media/platform/amphion/vpu_v4l2.c | 28 +-- drivers/media/platform/amphion/vpu_v4l2.h | 18 -- .../platform/mediatek/vcodec/mtk_vcodec_fw_vpu.c | 4 +- drivers/media/platform/renesas/rcar_drif.c | 1 + .../media/platform/samsung/exynos4-is/media-dev.c | 10 +- drivers/media/platform/ti/davinci/vpif_capture.c | 4 +- drivers/media/platform/ti/davinci/vpif_display.c | 4 +- drivers/media/platform/verisilicon/hantro_g2.c | 84 +++++-- .../platform/verisilicon/hantro_g2_hevc_dec.c | 17 +- .../media/platform/verisilicon/hantro_g2_regs.h | 13 + .../media/platform/verisilicon/hantro_g2_vp9_dec.c | 2 - drivers/media/platform/verisilicon/hantro_hw.h | 1 + drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 + drivers/media/rc/st_rc.c | 2 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 3 + drivers/media/usb/dvb-usb/dtv5100.c | 5 + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 +- drivers/mfd/altera-sysmgr.c | 2 + drivers/mfd/da9055-core.c | 1 + drivers/mfd/max77620.c | 15 +- drivers/mfd/mt6358-irq.c | 1 + drivers/mfd/mt6397-irq.c | 1 + drivers/misc/vmw_balloon.c | 3 +- drivers/mmc/host/Kconfig | 4 +- drivers/mmc/host/sdhci-msm.c | 27 ++- drivers/mtd/lpddr/lpddr_cmds.c | 8 +- drivers/mtd/nand/raw/renesas-nand-controller.c | 5 +- drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/dsa/b53/b53_common.c | 3 + drivers/net/dsa/sja1105/sja1105_static_config.c | 6 +- drivers/net/ethernet/broadcom/b44.c | 3 + drivers/net/ethernet/cadence/macb_main.c | 3 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 4 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +- drivers/net/ethernet/intel/i40e/i40e.h | 15 +- drivers/net/ethernet/intel/i40e/i40e_client.c | 20 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 12 - drivers/net/ethernet/intel/i40e/i40e_main.c | 15 +- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 10 +- drivers/net/ethernet/intel/i40e/i40e_txrx.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +- .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 8 + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 122 ++++++++-- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 10 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 2 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 17 +- drivers/net/ethernet/microchip/lan743x_main.c | 3 +- drivers/net/ethernet/realtek/r8169_main.c | 5 +- drivers/net/ethernet/smsc/smc91x.c | 10 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 10 +- drivers/net/ethernet/stmicro/stmmac/common.h | 60 +++-- drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 47 ++-- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 +- .../net/ethernet/stmicro/stmmac/dwmac1000_dma.c | 19 +- drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c | 17 +- drivers/net/ethernet/stmicro/stmmac/dwmac4.h | 101 ++++++-- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 50 ++-- drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 16 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 201 +++++++++------- drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h | 92 ++++--- drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 119 ++++++---- drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h | 22 +- drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c | 29 ++- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 9 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_descs.c | 4 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 82 ++++--- drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 19 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 172 ++++++++------ drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 15 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 10 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 4 + .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 175 +++++++++++--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 252 +++++++++++++++----- drivers/net/fjes/fjes_hw.c | 12 +- drivers/net/ipvlan/ipvlan_core.c | 3 + drivers/net/mdio/mdio-aspeed.c | 7 + drivers/net/phy/adin1100.c | 2 +- drivers/net/phy/mscc/mscc_main.c | 6 +- drivers/net/team/team.c | 2 +- drivers/net/usb/asix_common.c | 5 + drivers/net/usb/rtl8150.c | 2 + drivers/net/usb/sr9700.c | 4 +- drivers/net/wireless/ath/ath11k/mac.c | 4 +- drivers/net/wireless/ath/ath11k/wmi.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 14 ++ drivers/net/wireless/mediatek/mt76/eeprom.c | 37 ++- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 ++- drivers/net/wireless/st/cw1200/bh.c | 6 +- drivers/nfc/pn533/usb.c | 2 +- drivers/nvme/host/fc.c | 6 +- drivers/parisc/gsc.c | 4 +- drivers/pci/controller/dwc/pci-keystone.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 +- drivers/pci/controller/pcie-brcmstb.c | 10 +- drivers/pci/pci-driver.c | 4 + drivers/phy/broadcom/phy-bcm63xx-usbh.c | 6 +- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 +- drivers/pinctrl/pinctrl-single.c | 25 +- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/platform/chrome/cros_ec_ishtp.c | 1 + drivers/platform/x86/acer-wmi.c | 4 + drivers/platform/x86/asus-wmi.c | 8 +- drivers/platform/x86/huawei-wmi.c | 4 + drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel/chtwc_int33fe.c | 29 ++- drivers/platform/x86/intel/hid.c | 12 + drivers/platform/x86/msi-laptop.c | 3 + drivers/power/supply/apm_power.c | 3 +- drivers/power/supply/cw2015_battery.c | 8 +- drivers/power/supply/wm831x_power.c | 10 +- drivers/pwm/pwm-bcm2835.c | 28 +-- drivers/pwm/pwm-stm32.c | 3 +- drivers/regulator/core.c | 37 ++- drivers/remoteproc/qcom_q6v5_wcss.c | 8 +- drivers/rpmsg/qcom_glink_native.c | 8 + drivers/rtc/rtc-gamecube.c | 4 + drivers/s390/block/dasd_eckd.c | 8 + drivers/s390/crypto/ap_bus.c | 8 +- drivers/scsi/aic94xx/aic94xx_init.c | 3 + drivers/scsi/qla2xxx/qla_def.h | 1 - drivers/scsi/qla2xxx/qla_gbl.h | 2 +- drivers/scsi/qla2xxx/qla_isr.c | 32 +-- drivers/scsi/qla2xxx/qla_mbx.c | 2 + drivers/scsi/qla2xxx/qla_mid.c | 4 +- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/sim710.c | 2 + drivers/scsi/smartpqi/smartpqi.h | 19 +- drivers/scsi/smartpqi/smartpqi_init.c | 264 ++++++++++++++++----- drivers/scsi/stex.c | 1 + drivers/soc/actions/owl-sps.c | 16 +- drivers/soc/amlogic/meson-canvas.c | 5 +- drivers/soc/imx/gpc.c | 12 +- drivers/soc/qcom/ocmem.c | 2 +- drivers/soc/qcom/smem.c | 3 +- drivers/soc/rockchip/pm_domains.c | 13 +- drivers/spi/Kconfig | 2 +- drivers/spi/spi-cadence-quadspi.c | 113 ++++++++- drivers/spi/spi-fsl-spi.c | 2 +- drivers/spi/spi-imx.c | 15 +- drivers/spi/spi-tegra210-quad.c | 22 +- drivers/spi/spi-xilinx.c | 2 +- drivers/staging/fbtft/fbtft-core.c | 4 +- drivers/staging/greybus/uart.c | 7 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 14 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 13 +- drivers/target/target_core_configfs.c | 1 - drivers/target/target_core_transport.c | 1 + drivers/tty/serial/8250/8250_pci.c | 37 +++ drivers/tty/serial/atmel_serial.c | 5 +- drivers/tty/serial/clps711x.c | 4 +- drivers/tty/serial/cpm_uart/cpm_uart_core.c | 5 +- drivers/tty/serial/imx.c | 4 +- drivers/tty/serial/lantiq.c | 4 +- drivers/tty/serial/serial_core.c | 13 +- drivers/tty/serial/sprd_serial.c | 6 + drivers/tty/serial/st-asc.c | 4 +- drivers/tty/serial/uartlite.c | 12 +- drivers/tty/serial/xilinx_uartps.c | 5 +- drivers/tty/tty_port.c | 17 +- drivers/ufs/core/ufshcd.c | 7 +- drivers/uio/uio_fsl_elbc_gpcm.c | 7 + drivers/usb/class/cdc-acm.c | 7 +- drivers/usb/core/message.c | 2 +- drivers/usb/dwc2/platform.c | 16 +- drivers/usb/dwc3/dwc3-of-simple.c | 7 +- drivers/usb/dwc3/gadget.c | 2 +- drivers/usb/dwc3/host.c | 2 +- drivers/usb/gadget/legacy/raw_gadget.c | 3 + drivers/usb/gadget/udc/lpc32xx_udc.c | 20 +- drivers/usb/gadget/udc/tegra-xudc.c | 6 - drivers/usb/host/ohci-nxp.c | 20 +- drivers/usb/host/xhci-dbgtty.c | 2 +- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 10 +- drivers/usb/host/xhci-ring.c | 8 +- drivers/usb/host/xhci.h | 16 +- drivers/usb/misc/chaoskey.c | 16 +- drivers/usb/phy/phy-fsl-usb.c | 1 + drivers/usb/phy/phy-isp1301.c | 7 +- drivers/usb/phy/phy.c | 4 + drivers/usb/renesas_usbhs/pipe.c | 2 + drivers/usb/serial/belkin_sa.c | 28 ++- drivers/usb/serial/ftdi_sio.c | 72 ++---- drivers/usb/serial/kobil_sct.c | 18 +- drivers/usb/serial/option.c | 22 +- drivers/usb/serial/usb-serial.c | 7 +- drivers/usb/storage/unusual_uas.h | 2 +- drivers/usb/typec/ucsi/ucsi.c | 6 + drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/vhost/vsock.c | 15 +- drivers/video/backlight/led_bl.c | 18 +- drivers/video/fbdev/gbefb.c | 5 +- drivers/video/fbdev/pxafb.c | 12 +- drivers/video/fbdev/ssd1307fb.c | 4 +- drivers/video/fbdev/tcx.c | 2 +- drivers/virtio/virtio_balloon.c | 4 +- drivers/virtio/virtio_vdpa.c | 2 +- drivers/watchdog/via_wdt.c | 1 + drivers/watchdog/wdat_wdt.c | 64 +++-- fs/bfs/inode.c | 19 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/scrub.c | 5 + fs/btrfs/tree-log.c | 46 +++- fs/btrfs/volumes.c | 1 + fs/exfat/super.c | 19 +- fs/ext4/ext4.h | 1 + fs/ext4/ialloc.c | 1 - fs/ext4/inline.c | 14 +- fs/ext4/inode.c | 1 - fs/ext4/mballoc.c | 58 +++-- fs/ext4/move_extent.c | 2 +- fs/ext4/orphan.c | 4 +- fs/ext4/super.c | 70 ++++-- fs/ext4/xattr.c | 6 +- fs/f2fs/data.c | 17 ++ fs/f2fs/debug.c | 3 + fs/f2fs/f2fs.h | 34 +-- fs/f2fs/file.c | 89 +++++-- fs/f2fs/inode.c | 20 +- fs/f2fs/namei.c | 6 +- fs/f2fs/recovery.c | 12 +- fs/f2fs/super.c | 56 +++-- fs/f2fs/xattr.c | 30 +-- fs/f2fs/xattr.h | 10 +- fs/fscache/main.c | 1 + fs/fuse/file.c | 26 +- fs/gfs2/lops.c | 2 +- fs/gfs2/super.c | 4 +- fs/hfsplus/bnode.c | 4 +- fs/hfsplus/dir.c | 7 +- fs/hfsplus/inode.c | 32 ++- fs/jbd2/journal.c | 14 ++ fs/jbd2/transaction.c | 21 +- fs/lockd/svc4proc.c | 4 +- fs/lockd/svclock.c | 21 +- fs/lockd/svcproc.c | 5 +- fs/locks.c | 13 +- fs/nfs/client.c | 21 +- fs/nfs/dir.c | 27 ++- fs/nfs/inode.c | 2 +- fs/nfs/internal.h | 3 +- fs/nfs/namespace.c | 11 +- fs/nfs/nfs4client.c | 18 +- fs/nfs/pnfs.c | 1 + fs/nfs/super.c | 36 +-- fs/nfsd/blocklayout.c | 7 +- fs/nfsd/export.c | 2 +- fs/nfsd/nfs4state.c | 4 +- fs/nfsd/nfs4xdr.c | 5 + fs/nfsd/vfs.c | 2 +- fs/nls/nls_base.c | 27 ++- fs/notify/fsnotify.c | 9 +- fs/ntfs3/frecord.c | 43 +++- fs/ntfs3/fsntfs.c | 9 +- fs/ntfs3/inode.c | 2 + fs/ntfs3/ntfs_fs.h | 9 +- fs/ntfs3/run.c | 6 +- fs/ocfs2/alloc.c | 1 - fs/ocfs2/move_extents.c | 8 +- fs/ocfs2/suballoc.c | 10 + fs/smb/client/fs_context.c | 2 +- fs/smb/server/mgmt/tree_connect.c | 18 +- fs/smb/server/mgmt/tree_connect.h | 1 - fs/smb/server/mgmt/user_session.c | 4 +- fs/smb/server/smb2pdu.c | 16 +- fs/smb/server/smbacl.c | 16 ++ fs/smb/server/transport_ipc.c | 7 +- fs/smb/server/vfs.c | 5 +- fs/xfs/xfs_buf_item.c | 1 + include/linux/balloon_compaction.h | 43 ++-- include/linux/blk_types.h | 5 +- include/linux/compiler_types.h | 13 + include/linux/cper.h | 12 +- include/linux/filter.h | 16 +- include/linux/fs_context.h | 1 - include/linux/genalloc.h | 1 + include/linux/hugetlb.h | 4 +- include/linux/ieee80211.h | 4 +- include/linux/if_bridge.h | 6 +- include/linux/kasan.h | 15 ++ include/linux/mlx5/driver.h | 1 + include/linux/mm.h | 12 +- include/linux/nfs_fs_sb.h | 7 +- include/linux/nfs_xdr.h | 54 ++--- include/linux/pgtable.h | 34 ++- include/linux/platform_data/lp855x.h | 4 +- include/linux/rculist_nulls.h | 59 +++++ include/linux/reset.h | 1 + include/linux/sched/isolation.h | 12 + include/linux/sched/topology.h | 3 + include/linux/security.h | 2 +- include/linux/serial_core.h | 2 +- include/linux/stmmac.h | 20 ++ include/linux/tpm.h | 8 +- include/linux/tty_port.h | 21 +- include/linux/virtio_config.h | 4 +- include/media/v4l2-mem2mem.h | 3 +- include/net/cfg80211.h | 70 +++++- include/net/mac80211.h | 73 +++++- include/net/netfilter/nf_conntrack_count.h | 15 +- include/net/sock.h | 13 + include/net/xfrm.h | 13 +- include/sound/snd_wavefront.h | 4 - include/uapi/linux/mptcp.h | 1 + include/uapi/linux/nl80211.h | 49 ++++ include/uapi/sound/asound.h | 2 +- io_uring/openclose.c | 2 +- io_uring/poll.c | 9 +- kernel/bpf/syscall.c | 3 + kernel/bpf/trampoline.c | 3 +- kernel/cgroup/cpuset.c | 35 ++- kernel/dma/pool.c | 2 +- kernel/fork.c | 5 + kernel/kallsyms.c | 5 +- kernel/livepatch/core.c | 8 +- kernel/locking/spinlock_debug.c | 4 +- kernel/resource.c | 95 ++++---- kernel/sched/core.c | 3 + kernel/sched/cpudeadline.c | 34 +-- kernel/sched/cpudeadline.h | 4 +- kernel/sched/deadline.c | 8 +- kernel/sched/fair.c | 75 ++++-- kernel/sched/features.h | 5 + kernel/sched/sched.h | 7 + kernel/sched/topology.c | 6 + kernel/scs.c | 2 +- kernel/trace/ftrace.c | 40 +++- kernel/trace/trace_events.c | 2 + lib/idr.c | 2 + lib/vsprintf.c | 6 +- mm/balloon_compaction.c | 9 +- mm/damon/core-test.h | 88 ++++++- mm/damon/vaddr-test.h | 26 +- mm/hugetlb.c | 4 +- mm/kasan/common.c | 17 ++ mm/memory.c | 10 +- mm/mempolicy.c | 2 +- mm/mprotect.c | 125 +++++----- mm/mremap.c | 2 +- mm/vmalloc.c | 4 +- net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_ioctl.c | 36 ++- net/bridge/br_private.h | 4 +- net/caif/cffrml.c | 9 +- net/ceph/osdmap.c | 116 ++++----- net/core/dev_ioctl.c | 16 -- net/core/filter.c | 9 +- net/core/page_pool.c | 27 ++- net/ethtool/ioctl.c | 134 +++++++---- net/hsr/hsr_forward.c | 2 + net/ipv4/fib_trie.c | 7 +- net/ipv4/inet_hashtables.c | 8 +- net/ipv4/ipcomp.c | 2 + net/ipv6/calipso.c | 3 +- net/ipv6/ip6_gre.c | 9 +- net/ipv6/ipcomp6.c | 2 + net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/mac80211/cfg.c | 70 +++++- net/mac80211/chan.c | 2 +- net/mac80211/ieee80211_i.h | 27 ++- net/mac80211/mlme.c | 163 ++++++++++++- net/mac80211/rx.c | 5 + net/mac80211/tx.c | 146 +++++++++++- net/mptcp/options.c | 10 + net/mptcp/pm_netlink.c | 3 +- net/mptcp/protocol.c | 16 +- net/mptcp/protocol.h | 5 +- net/mptcp/subflow.c | 9 - net/netfilter/ipvs/ip_vs_xmit.c | 3 + net/netfilter/nf_conncount.c | 208 ++++++++++------ net/netfilter/nft_connlimit.c | 34 ++- net/netfilter/nft_flow_offload.c | 9 +- net/netfilter/xt_connlimit.c | 14 +- net/netrom/nr_out.c | 4 +- net/nfc/core.c | 9 +- net/openvswitch/conntrack.c | 16 +- net/openvswitch/flow_netlink.c | 13 +- net/openvswitch/vport-netdev.c | 17 +- net/rose/af_rose.c | 2 +- net/sched/sch_cake.c | 60 ++--- net/sched/sch_ets.c | 6 +- net/sctp/socket.c | 5 +- net/socket.c | 19 +- net/sunrpc/auth_gss/svcauth_gss.c | 3 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 2 +- net/wireless/chan.c | 69 ++++++ net/wireless/core.h | 5 +- net/wireless/nl80211.c | 162 ++++++++++++- net/wireless/nl80211.h | 3 +- net/wireless/rdev-ops.h | 17 ++ net/wireless/sme.c | 14 +- net/wireless/trace.h | 25 ++ net/wireless/util.c | 4 +- net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 41 ++-- net/xfrm/xfrm_user.c | 2 +- samples/vfs/test-statx.c | 6 + samples/watch_queue/watch_test.c | 6 + scripts/Makefile.modinst | 4 +- security/integrity/ima/ima_policy.c | 2 +- security/keys/trusted-keys/trusted_tpm2.c | 6 +- security/smack/smack_lsm.c | 41 ++-- sound/firewire/dice/dice-extension.c | 4 +- sound/firewire/motu/motu-hwdep.c | 7 +- sound/isa/wavefront/wavefront.c | 61 ++--- sound/isa/wavefront/wavefront_fx.c | 36 +-- sound/isa/wavefront/wavefront_midi.c | 146 +++++------- sound/isa/wavefront/wavefront_synth.c | 216 ++++++++--------- sound/pci/hda/cs35l41_hda.c | 2 + sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +- sound/pcmcia/vx/vxpocket.c | 8 +- sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +- sound/soc/codecs/ak4458.c | 10 +- sound/soc/codecs/ak5558.c | 10 +- sound/soc/fsl/fsl_xcvr.c | 197 +++++++++++---- sound/soc/fsl/fsl_xcvr.h | 28 +++ sound/soc/intel/catpt/pcm.c | 4 +- sound/soc/qcom/qdsp6/q6adm.c | 146 ++++++------ sound/soc/qcom/qdsp6/q6apm-dai.c | 2 + sound/soc/qcom/qdsp6/q6asm-dai.c | 7 +- sound/soc/stm/stm32_sai.c | 14 +- sound/soc/stm/stm32_sai_sub.c | 58 +++-- sound/usb/mixer_us16x08.c | 20 +- sound/usb/quirks.c | 6 + tools/include/linux/interval_tree_generic.h | 187 +++++++++++++++ tools/include/nolibc/stdio.h | 4 + tools/objtool/elf.c | 101 ++++---- tools/objtool/include/objtool/elf.h | 3 +- tools/perf/builtin-record.c | 2 +- tools/perf/util/symbol.c | 4 +- tools/testing/ktest/config-bisect.pl | 4 +- tools/testing/nvdimm/test/nfit.c | 7 +- tools/testing/radix-tree/idr-test.c | 21 ++ .../selftests/bpf/prog_tests/perf_branches.c | 22 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 5 + .../selftests/bpf/progs/test_perf_branches.c | 3 + .../test.d/ftrace/func_traceonoff_triggers.tc | 5 +- tools/testing/selftests/net/tap.c | 16 +- 660 files changed, 8219 insertions(+), 4086 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/634 xfrm: delete x->tunnel as we delete x
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b441cf3f8c4b8576639d20c8eb4aa32917602ecd ]
The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete.
We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state.
Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped.
A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked.
--- include/net/xfrm.h | 1 - net/ipv4/ipcomp.c | 2 ++ net/ipv6/ipcomp6.c | 2 ++ net/ipv6/xfrm6_tunnel.c | 2 +- net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 19 ++++++++----------- 6 files changed, 13 insertions(+), 14 deletions(-)
include/net/xfrm.h +0 -1
@@ -398,7 +398,6 @@ int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);int xfrm_input_unregister_afinfo (const struct xfrm_input_afinfo *afinfo);void xfrm_flush_gc (void ); -void xfrm_state_delete_tunnel (struct xfrm_state *x);struct xfrm_type {struct module *owner;
net/ipv4/ipcomp.c +2 -0
@@ -54,6 +54,7 @@ static int ipcomp4_err(struct sk_buff *skb, u32 info) }/* We always hold one tunnel user reference to indicate a tunnel */ +static struct lock_class_key xfrm_state_lock_key;static struct xfrm_state *ipcomp_tunnel_create (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -62,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x) t =xfrm_state_alloc (net);if (!t) goto out; +lockdep_set_class (&t->lock, &xfrm_state_lock_key); t->id.proto =IPPROTO_IPIP ; t->id.spi = x->props.saddr.a4;
net/ipv6/ipcomp6.c +2 -0
@@ -71,6 +71,7 @@ static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,return 0 ; } +static struct lock_class_key xfrm_state_lock_key;static struct xfrm_state *ipcomp6_tunnel_create (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -79,6 +80,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x) t =xfrm_state_alloc (net);if (!t) goto out; +lockdep_set_class (&t->lock, &xfrm_state_lock_key); t->id.proto =IPPROTO_IPV6 ; t->id.spi =xfrm6_tunnel_alloc_spi (net, (xfrm_address_t *)&x->props.saddr);
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -334,8 +334,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_flush_gc ();xfrm_state_flush (net,0 , false, true); +xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)WARN_ON_ONCE (!hlist_empty (&xfrm6_tn->spi_byaddr[i]));
net/xfrm/xfrm_ipcomp.c +0 -1
@@ -318,7 +318,6 @@ void ipcomp_destroy(struct xfrm_state *x)struct ipcomp_data *ipcd = x->data;if (!ipcd)return ; -xfrm_state_delete_tunnel (x);mutex_lock (&ipcomp_resource_mutex);ipcomp_free_data (ipcd);mutex_unlock (&ipcomp_resource_mutex);
net/xfrm/xfrm_state.c +8 -11
@@ -676,6 +676,7 @@ void __xfrm_state_destroy(struct xfrm_state *x, bool sync) }EXPORT_SYMBOL (__xfrm_state_destroy); +static void xfrm_state_delete_tunnel (struct xfrm_state *x);int __xfrm_state_delete (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -696,6 +697,8 @@ int __xfrm_state_delete(struct xfrm_state *x)xfrm_dev_state_delete (x); +xfrm_state_delete_tunnel (x); +/* All xfrm_state objects are created by xfrm_state_alloc. * The xfrm_state_alloc call gives a reference, and that * is what we are dropping here.
@@ -799,10 +802,7 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync) err =xfrm_state_delete (x);xfrm_audit_state_delete (x, err ?0 :1 , task_valid); -if (sync) -xfrm_state_put_sync (x); -else -xfrm_state_put (x); +xfrm_state_put (x);if (!err) cnt++;
@@ -2563,20 +2563,17 @@ void xfrm_flush_gc(void) }EXPORT_SYMBOL (xfrm_flush_gc); -/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ -void xfrm_state_delete_tunnel (struct xfrm_state *x) +static void xfrm_state_delete_tunnel (struct xfrm_state *x) {if (x->tunnel) {struct xfrm_state *t = x->tunnel; -if (atomic_read (&t->tunnel_users) ==2 ) +if (atomic_dec_return (&t->tunnel_users) ==1 )xfrm_state_delete (t); -atomic_dec (&t->tunnel_users); -xfrm_state_put_sync (t); +xfrm_state_put (t); x->tunnel =NULL ; } } -EXPORT_SYMBOL (xfrm_state_delete_tunnel);u32 xfrm_state_mtu (struct xfrm_state *x,int mtu) {
@@ -2754,8 +2751,8 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -flush_work (&xfrm_state_gc_work);xfrm_state_flush (net,0 , false, true); +flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/634 Revert "xfrm: destroy xfrm_state synchronously on net exit path"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 2a198bbec6913ae1c90ec963750003c6213668c7 ]
This reverts commit f75a2804da391571563c4b6b29e7797787332673.
With all states (whether user or kern) removed from the hashtables during deletion, there's no need for synchronous destruction of states. xfrm6_tunnel states still need to have been destroyed (which will be the case when its last user is deleted (not destroyed)) so that xfrm6_tunnel_free_spi removes it from the per-netns hashtable before the netns is destroyed.
This has the benefit of skipping one synchronize_rcu per state (in __xfrm_state_destroy(sync=true)) when we exit a netns.
--- include/net/xfrm.h | 12 +++--------- net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/xfrm/xfrm_state.c | 23 +++++++++-------------- net/xfrm/xfrm_user.c | 2 +- 5 files changed, 15 insertions(+), 26 deletions(-)
include/net/xfrm.h +3 -9
@@ -791,7 +791,7 @@ static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)xfrm_pol_put (pols[i]); } -void __xfrm_state_destroy (struct xfrm_state *,bool ); +void __xfrm_state_destroy (struct xfrm_state *);static inline void __xfrm_state_put (struct xfrm_state *x) {
@@ -801,13 +801,7 @@ static inline void __xfrm_state_put(struct xfrm_state *x)static inline void xfrm_state_put (struct xfrm_state *x) {if (refcount_dec_and_test (&x->refcnt)) -__xfrm_state_destroy (x, false); -} - -static inline void xfrm_state_put_sync (struct xfrm_state *x) -{ -if (refcount_dec_and_test (&x->refcnt)) -__xfrm_state_destroy (x, true); +__xfrm_state_destroy (x); }static inline void xfrm_state_hold (struct xfrm_state *x)
@@ -1584,7 +1578,7 @@ struct xfrmk_spdinfo {struct xfrm_state *xfrm_find_acq_byseq (struct net *net,u32 mark,u32 seq);int xfrm_state_delete (struct xfrm_state *x); -int xfrm_state_flush (struct net *net,u8 proto,bool task_valid,bool sync); +int xfrm_state_flush (struct net *net,u8 proto,bool task_valid);int xfrm_dev_state_flush (struct net *net,struct net_device *dev,bool task_valid);void xfrm_sad_getinfo (struct net *net,struct xfrmk_sadinfo *si);void xfrm_spd_getinfo (struct net *net,struct xfrmk_spdinfo *si);
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -334,7 +334,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_state_flush (net,0 , false, true); +xfrm_state_flush (net,IPSEC_PROTO_ANY , false);xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)
net/key/af_key.c +1 -1
@@ -1766,7 +1766,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_mif (proto ==0 )return -EINVAL ; - err =xfrm_state_flush (net, proto, true, false); + err =xfrm_state_flush (net, proto, true); err2 =unicast_flush_resp (sk, hdr);if (err || err2) {if (err == -ESRCH )/* empty table - go quietly */
net/xfrm/xfrm_state.c +9 -14
@@ -498,7 +498,7 @@ void xfrm_state_free(struct xfrm_state *x) }EXPORT_SYMBOL (xfrm_state_free); -static void ___xfrm_state_destroy (struct xfrm_state *x) +static void xfrm_state_gc_destroy (struct xfrm_state *x) {hrtimer_cancel (&x->mtimer);del_timer_sync (&x->rtimer);
@@ -536,7 +536,7 @@ static void xfrm_state_gc_task(struct work_struct *work)synchronize_rcu ();hlist_for_each_entry_safe (x, tmp, &gc_list, gclist) -___xfrm_state_destroy (x); +xfrm_state_gc_destroy (x); }static enum hrtimer_restart xfrm_timer_handler (struct hrtimer *me)
@@ -660,19 +660,14 @@ struct xfrm_state *xfrm_state_alloc(struct net *net) }EXPORT_SYMBOL (xfrm_state_alloc); -void __xfrm_state_destroy (struct xfrm_state *x,bool sync) +void __xfrm_state_destroy (struct xfrm_state *x) {WARN_ON (x->km.state !=XFRM_STATE_DEAD ); -if (sync) { -synchronize_rcu (); -___xfrm_state_destroy (x); - }else { -spin_lock_bh (&xfrm_state_gc_lock); -hlist_add_head (&x->gclist, &xfrm_state_gc_list); -spin_unlock_bh (&xfrm_state_gc_lock); -schedule_work (&xfrm_state_gc_work); - } +spin_lock_bh (&xfrm_state_gc_lock); +hlist_add_head (&x->gclist, &xfrm_state_gc_list); +spin_unlock_bh (&xfrm_state_gc_lock); +schedule_work (&xfrm_state_gc_work); }EXPORT_SYMBOL (__xfrm_state_destroy);
@@ -780,7 +775,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool }#endif -int xfrm_state_flush (struct net *net,u8 proto,bool task_valid,bool sync) +int xfrm_state_flush (struct net *net,u8 proto,bool task_valid) {int i, err =0 , cnt =0 ;
@@ -2751,7 +2746,7 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -xfrm_state_flush (net,0 , false, true); +xfrm_state_flush (net,IPSEC_PROTO_ANY , false);flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
net/xfrm/xfrm_user.c +1 -1
@@ -2340,7 +2340,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,struct xfrm_usersa_flush *p =nlmsg_data (nlh);int err; - err =xfrm_state_flush (net, p->proto, true, false); + err =xfrm_state_flush (net, p->proto, true);if (err) {if (err == -ESRCH )/* empty table */ return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/634 xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 10deb69864840ccf96b00ac2ab3a2055c0c04721 ]
In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists.
In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel.
There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved.
At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).
--- net/xfrm/xfrm_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/xfrm/xfrm_state.c +2 -1
@@ -498,6 +498,7 @@ void xfrm_state_free(struct xfrm_state *x) }EXPORT_SYMBOL (xfrm_state_free); +static void xfrm_state_delete_tunnel (struct xfrm_state *x);static void xfrm_state_gc_destroy (struct xfrm_state *x) {hrtimer_cancel (&x->mtimer);
@@ -512,6 +513,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)kfree (x->preplay_esn);if (x->type_offload)xfrm_put_type_offload (x->type_offload); +xfrm_state_delete_tunnel (x);if (x->type) { x->type->destructor (x);xfrm_put_type (x->type);
@@ -671,7 +673,6 @@ void __xfrm_state_destroy(struct xfrm_state *x) }EXPORT_SYMBOL (__xfrm_state_destroy); -static void xfrm_state_delete_tunnel (struct xfrm_state *x);int __xfrm_state_delete (struct xfrm_state *x) {struct net *net =xs_net (x);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/634 xfrm: flush all states in xfrm_state_fini
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 42e42562c9cfcdacf000f1b42284a4fad24f8546 ]
While reverting commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path"), I incorrectly changed xfrm_state_flush's "proto" argument back to IPSEC_PROTO_ANY. This reverts some of the changes in commit dbb2483b2a46 ("xfrm: clean up xfrm protocol checks"), and leads to some states not being removed when we exit the netns.
Pass 0 instead of IPSEC_PROTO_ANY from both xfrm_state_fini xfrm6_tunnel_net_exit, so that xfrm_state_flush deletes all states.
--- net/ipv6/xfrm6_tunnel.c | 2 +- net/xfrm/xfrm_state.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -334,7 +334,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_state_flush (net,IPSEC_PROTO_ANY , false); +xfrm_state_flush (net,0 , false);xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)
net/xfrm/xfrm_state.c +1 -1
@@ -2747,7 +2747,7 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -xfrm_state_flush (net,IPSEC_PROTO_ANY , false); +xfrm_state_flush (net,0 , false);flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/634 leds: Replace all non-returning strlcpy with strscpy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azeem Shaikh <[email protected]>
[ Upstream commit bf4a35e9201d30b63a8d276797d6ecfaa596ccd3 ]
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89
Stable-dep-of: ccc35ff2fd29 ("leds: spi-byte: Use devm_led_classdev_register_ext()")
--- drivers/leds/flash/leds-aat1290.c | 2 +- drivers/leds/led-class.c | 2 +- drivers/leds/leds-spi-byte.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/leds/flash/leds-aat1290.c +1 -1
@@ -425,7 +425,7 @@ static void aat1290_init_v4l2_flash_config(struct aat1290_led *led,struct led_classdev *led_cdev = &led->fled_cdev.led_cdev;struct led_flash_setting *s; -strlcpy (v4l2_sd_cfg->dev_name, led_cdev->dev->kobj.name, +strscpy (v4l2_sd_cfg->dev_name, led_cdev->dev->kobj.name,sizeof (v4l2_sd_cfg->dev_name)); s = &v4l2_sd_cfg->intensity;
drivers/leds/led-class.c +1 -1
@@ -321,7 +321,7 @@ static int led_classdev_next_name(const char *init_name, char *name,int ret =0 ;struct device *dev; -strlcpy (name, init_name, len); +strscpy (name, init_name, len);while ((ret < len) && (dev =class_find_device_by_name (leds_class, name))) {
drivers/leds/leds-spi-byte.c +1 -1
@@ -97,7 +97,7 @@ static int spi_byte_probe(struct spi_device *spi)return -ENOMEM ;of_property_read_string (child,"label" , &name); -strlcpy (led->name, name,sizeof (led->name)); +strscpy (led->name, name,sizeof (led->name)); led->spi = spi;mutex_init (&led->mutex); led->cdef =device_get_match_data (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/634 leds: spi-byte: Use devm_led_classdev_register_ext()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kalscheuer <[email protected]>
[ Upstream commit ccc35ff2fd2911986b716a87fe65e03fac2312c9 ]
Use extended classdev registration to generate generic device names from color and function enums instead of reading only the label from the device tree.
--- drivers/leds/leds-spi-byte.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/leds/leds-spi-byte.c +6 -5
@@ -83,7 +83,7 @@ static int spi_byte_probe(struct spi_device *spi)struct device_node *child;struct device *dev = &spi->dev;struct spi_byte_led *led; -const char *name ="leds-spi-byte::" ; +struct led_init_data init_data = {};const char *state;int ret;
@@ -96,12 +96,9 @@ static int spi_byte_probe(struct spi_device *spi)if (!led)return -ENOMEM ; -of_property_read_string (child,"label" , &name); -strscpy (led->name, name,sizeof (led->name)); led->spi = spi;mutex_init (&led->mutex); led->cdef =device_get_match_data (dev); - led->ldev.name = led->name; led->ldev.brightness =LED_OFF ; led->ldev.max_brightness = led->cdef->max_value - led->cdef->off_value; led->ldev.brightness_set_blocking = spi_byte_brightness_set_blocking;
@@ -121,7 +118,11 @@ static int spi_byte_probe(struct spi_device *spi)spi_byte_brightness_set_blocking (&led->ldev, led->ldev.brightness); - ret =devm_led_classdev_register (&spi->dev, &led->ldev); + init_data.fwnode =of_fwnode_handle (child); + init_data.devicename ="leds-spi-byte" ; + init_data.default_label =":" ; + + ret =devm_led_classdev_register_ext (&spi->dev, &led->ldev, &init_data);if (ret) {of_node_put (child);mutex_destroy (&led->mutex);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/634 Documentation: process: Also mention Sasha Levin as stable tree maintainer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
commit ba2457109d5b47a90fe565b39524f7225fc23e60 upstream.
Sasha has also maintaining stable branch in conjunction with Greg since cb5d21946d2a2f ("MAINTAINERS: Add Sasha as a stable branch maintainer"). Mention him in 2.Process.rst.
Message-ID: <[email protected]>
--- Documentation/process/2.Process.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
Documentation/process/2.Process.rst +4 -2
@@ -104,8 +104,10 @@ kernels go out with a handful of known r of them are serious. Once a stable release is made, its ongoing maintenance is passed off to the -"stable team," currently Greg Kroah-Hartman. The stable team will release -occasional updates to the stable release using the 5.x.y numbering scheme. +"stable team," currently consists of Greg Kroah-Hartman and Sasha Levin. The +stable team will release occasional updates to the stable release using the +5.x.y numbering scheme. + To be considered for an update release, a patch must (1) fix a significant bug, and (2) already be merged into the mainline for the next development kernel. Kernels will typically receive stable updates for a little more
Greg Kroah-Hartman
maintainerPATCH 8/634 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 986835bf4d11032bba4ab8414d18fce038c61bb4 upstream.
There's issue when file system corrupted:
------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0 Call Trace: <TASK> __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data.
In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue.
Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON.
Message-ID: <[email protected]>
--- fs/jbd2/transaction.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
fs/jbd2/transaction.c +14 -5
@@ -1293,14 +1293,23 @@ int jbd2_journal_get_create_access(handl* committing transaction's lists, but it HAS to be in Forget state in * that case: the transaction must have deleted the buffer for it to be * reused here. +* In the case of file system data inconsistency, for example, if the +* block bitmap of a referenced block is not set, it can lead to the +* situation where a block being committed is allocated and used again. +* As a result, the following condition will not be satisfied, so here +* we directly trigger a JBD abort instead of immediately invoking +* bugon. */ spin_lock (&jh->b_state_lock); -J_ASSERT_JH (jh, (jh->b_transaction == transaction || - jh->b_transaction ==NULL || - (jh->b_transaction == journal->j_committing_transaction && - jh->b_jlist == BJ_Forget))); +if (!(jh->b_transaction == transaction || jh->b_transaction ==NULL || + (jh->b_transaction == journal->j_committing_transaction && + jh->b_jlist == BJ_Forget)) || jh->b_next_transaction !=NULL ) { + err = -EROFS ; +spin_unlock (&jh->b_state_lock); +jbd2_journal_abort (journal, err); + goto out; + } -J_ASSERT_JH (jh, jh->b_next_transaction ==NULL );J_ASSERT_JH (jh,buffer_locked (jh2bh (jh)));if (jh->b_transaction ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 9/634 ext4: refresh inline data size before write operations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b upstream.
The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired.
This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data():
kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);
The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers
Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications.
This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -414,7 +414,12 @@ static int ext4_prepare_inline_data(handreturn -ENOSPC ;ext4_write_lock_xattr (inode, &no_expand); - +/* +* ei->i_inline_size may have changed since the initial check +* if other xattrs were added. Recalculate to ensure +* ext4_update_inline_data() validates against current capacity. +*/ + (void )ext4_find_inline_data_nolock (inode);if (ei->i_inline_off) ret =ext4_update_inline_data (handle, inode, len);else
Greg Kroah-Hartman
maintainerPATCH 10/634 ksmbd: ipc: fix use-after-free in ipc_msg_send_request
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianchang Zhao <[email protected]>
commit 1fab1fa091f5aa97265648b53ea031deedd26235 upstream.
ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock.
Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event():
BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]
Write of size 12 at addr ffff888198ee6e20 by task pool/109349
...
Freed by task:
kvfree
ipc_msg_send_request [ksmbd]
ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]Fix by:
- Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table.
- Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock.
- Returning NULL in the error path, preserving the original API semantics.
This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.
--- fs/smb/server/transport_ipc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/smb/server/transport_ipc.c +5 -2
@@ -517,12 +517,16 @@ static void *ipc_msg_send_request(structup_write (&ipc_msg_table_lock); ret =ipc_msg_send (msg); -if (ret) +if (ret) { +down_write (&ipc_msg_table_lock); goto out; + } ret =wait_event_interruptible_timeout (entry.wait, entry.response !=NULL ,IPC_WAIT_TIMEOUT ); + +down_write (&ipc_msg_table_lock);if (entry.response) { ret =ipc_validate_msg (&entry);if (ret) {
@@ -531,7 +535,6 @@ static void *ipc_msg_send_request(struct } } out: -down_write (&ipc_msg_table_lock);hash_del (&entry.ipc_table_hlist);up_write (&ipc_msg_table_lock);return entry.response;
Greg Kroah-Hartman
maintainerPATCH 11/634 locking/spinlock/debug: Fix data-race in do_raw_write_lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit c14ecb555c3ee80eeb030a4e46d00e679537f03a upstream.
KCSAN reports:
BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock
write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
do_raw_write_lock+0x88/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
value changed: 0xffffffff -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111
Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete.
Quoted 1 line
From
do_raw_write_lock()onlydebug_write_lock_after()part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now.
--- kernel/locking/spinlock_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/locking/spinlock_debug.c +2 -2
@@ -183,8 +183,8 @@ void do_raw_read_unlock(rwlock_t *lock)static inline void debug_write_lock_before (rwlock_t *lock) {RWLOCK_BUG_ON (lock->magic !=RWLOCK_MAGIC , lock,"bad magic" ); -RWLOCK_BUG_ON (lock->owner == current, lock,"recursion" ); -RWLOCK_BUG_ON (lock->owner_cpu ==raw_smp_processor_id (), +RWLOCK_BUG_ON (READ_ONCE (lock->owner) == current, lock,"recursion" ); +RWLOCK_BUG_ON (READ_ONCE (lock->owner_cpu) ==raw_smp_processor_id (), lock,"cpu recursion" ); }
Greg Kroah-Hartman
maintainerPATCH 12/634 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Nepomnyashih <[email protected]>
commit 0cd8feea8777f8d9b9a862b89c688b049a5c8475 upstream.
Fix a race between inline data destruction and block mapping.
The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks().
Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert.
kernel BUG at fs/ext4/indirect.c:546!
EXT4-fs (loop2): unmounting filesystem.
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546 Call Trace: <TASK> ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:2271 [inline] do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10f/0x170 fs/splice.c:950 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -447,9 +447,13 @@ static int ext4_destroy_inline_data_noloif (!ei->i_inline_off)return 0 ; +down_write (&ei->i_data_sem); + error =ext4_get_inode_loc (inode, &is.iloc); -if (error) +if (error) { +up_write (&ei->i_data_sem);return error; + } error =ext4_xattr_ibody_find (inode, &i, &is);if (error)
@@ -488,6 +492,7 @@ out:brelse (is.iloc.bh);if (error == -ENODATA ) error =0 ; +up_write (&ei->i_data_sem);return error; }
Greg Kroah-Hartman
maintainerPATCH 13/634 comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit a51f025b5038abd3d22eed2ede4cd46793d89565 upstream.
Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its pointer to &struct comedi_async as intended. Thus, any such dereferencing of &s->async->cmd will lead to general protection fault and kernel crash.
Mitigate this problem by removing a call to pcl818_ai_cancel() from pcl818_detach() altogether. This way, if the subdevice setups its support for async commands, everything async-related will be handled via subdevice's own ->cancel() function in comedi_device_detach_locked() even before pcl818_detach(). If no support for asynchronous commands is provided, there is no need to cancel anything either.
[1] Syzbot crash:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762 ... Call Trace: <TASK> pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline] comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline]
...
--- drivers/comedi/drivers/pcl818.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/comedi/drivers/pcl818.c +2 -3
@@ -1111,10 +1111,9 @@ static void pcl818_detach(struct comedi_ {struct pcl818_private *devpriv = dev->private; -if (devpriv) { -pcl818_ai_cancel (dev, dev->read_subdev); +if (devpriv)pcl818_reset (dev); - } +pcl818_free_dma (dev);comedi_legacy_detach (dev); }
Greg Kroah-Hartman
maintainerPATCH 14/634 USB: serial: option: add Foxconn T99W760
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
commit 7970b4969c4c99bcdaf105f9f39c6d2021f6d244 upstream.
T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are three serial ports to be enumerated: Modem, NMEA and Diag.
test evidence as below:
T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e123 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXBAAGHA-IDP _SN:39A8D3E4 S: SerialNumber=39a8d3e4 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2376,6 +2376,8 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe123, 0xff), /* Foxconn T99W760 MBIM */ + .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe15f, 0xff), /* Foxconn T99W709 */
Greg Kroah-Hartman
maintainerPATCH 15/634 USB: serial: option: add Telit Cinterion FE910C04 new compositions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit c908039a29aa70870871f4848125b3d743f929bf upstream.
Add the following Telit Cinterion new compositions:
0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c5 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10cb Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/serial/option.c +14 -0
@@ -1433,10 +1433,24 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c1, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c2, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c3, 0xff), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c5, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10cb, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 16/634 USB: serial: option: move Telit 0x10c7 composition in the right place
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 072f2c49572547f4b0776fe2da6b8f61e4b34699 upstream.
Move Telit 0x10c7 composition right after 0x10c6 composition and before 0x10c8 composition.
--- drivers/usb/serial/option.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/serial/option.c +3 -3
@@ -1445,6 +1445,9 @@ static const struct usb_device_id option .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */
@@ -1455,9 +1458,6 @@ static const struct usb_device_id option .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ - .driver_info = NCTRL(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ .driver_info = NCTRL(6) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 17/634 USB: serial: ftdi_sio: match on interface number for jtag
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4e31a5d0a9ee672f708fc993c1d5520643f769fd upstream.
Some FTDI devices have the first port reserved for JTAG and have been using a dedicated quirk to prevent binding to it.
As can be inferred directly or indirectly from the commit messages, almost all of these devices are dual port devices which means that the more recently added macro for matching on interface number can be used instead (and some such devices do so already).
This avoids probing interfaces that will never be bound and cleans up the match table somewhat.
Note that the JTAG quirk is kept for quad port devices, which would otherwise require three match entries.
--- drivers/usb/serial/ftdi_sio.c | 72 ++++++++++++++---------------------------- 1 file changed, 24 insertions(+), 48 deletions(-)
drivers/usb/serial/ftdi_sio.c +24 -48
@@ -628,10 +628,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) }, { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TIAO_UMPA_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_NT_ORIONLXM_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },
@@ -842,24 +840,17 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, - { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, CYBER_CORTEX_AV_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) }, - { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FIC_VID, FIC_NEO1973_DEBUG_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_OOCDLINK_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
@@ -901,17 +892,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(ATMEL_VID, STK541_PID) }, { USB_DEVICE(DE_VID, STB_PID) }, { USB_DEVICE(DE_VID, WHT_PID) }, - { USB_DEVICE(ADI_VID, ADI_GNICE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICEPLUS_PID, 1) }, { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,USB_CLASS_VENDOR_SPEC , USB_SUBCLASS_VENDOR_SPEC, 0x00) }, { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) }, { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, - { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(MARVELL_VID, MARVELL_SHEEVAPLUG_PID, 1) }, { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) }, { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) }, { USB_DEVICE(FTDI_VID, PI_C865_PID) },
@@ -934,10 +922,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(PI_VID, PI_1016_PID) }, { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) }, { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, - { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, TI_XDS100V2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, MARVELL_OPENRD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, TI_XDS100V2_PID, 1) }, { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
@@ -946,18 +932,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_ST_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID, 1) }, { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) }, { USB_DEVICE(FTDI_VID, ACCESIO_COM4SM_PID) }, - { USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(IONICS_VID, IONICS_PLUGCOMPUTER_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_24_MASTER_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_PC_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_USB_DMX_PID) },
@@ -972,15 +954,12 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, - { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ST_VID, ST_STMCLT_2232_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ST_VID, ST_STMCLT_2232_PID, 1) }, { USB_DEVICE(ST_VID, ST_STMCLT_4232_PID), .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk }, { USB_DEVICE(FTDI_VID, FTDI_RF_R106) }, - { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },/* Crucible Devices */ { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
@@ -1055,8 +1034,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, - { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(TI_VID, TI_CC3200_LAUNCHPAD_PID, 1) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
@@ -1076,10 +1054,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },/* FreeCalypso USB adapters */ - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID, 1) },/* GMC devices */ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) },/* Altera USB Blaster 3 */
Greg Kroah-Hartman
maintainerPATCH 18/634 serial: add support of CPCI cards
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magne Bruno <[email protected]>
commit 0e5a99e0e5f50353b86939ff6e424800d769c818 upstream.
Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI). Those cards are identified with different DeviceIds. Those cards integrating standard UARTs work the same way as PCI/PCIe models already supported in the serial driver.
--- drivers/tty/serial/8250/8250_pci.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
drivers/tty/serial/8250/8250_pci.c +37 -0
@@ -1991,6 +1991,11 @@ pci_moxa_setup(struct serial_private *pr#define PCI_DEVICE_ID_MOXA_CP138E_A 0x1381#define PCI_DEVICE_ID_MOXA_CP168EL_A 0x1683 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500 0x7003 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG 0x7024 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG 0x7025 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG 0x7026 +/* Unknown vendors/cards - this should not be in linux/pci_ids.h */ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584#define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -5888,6 +5893,38 @@ static const struct pci_device_id serial0 , pbn_ADDIDATA_PCIe_8_3906250 }, + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500 , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_2_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_1_115200 }, + { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,PCI_VENDOR_ID_IBM ,0x0299 , 0, 0, pbn_b0_bt_2_115200 },
Greg Kroah-Hartman
maintainerPATCH 19/634 USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b6e0b3016187446ddef9edac03cd9d544ac63f11 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing regression dating back to 2003 when the tiocmset() callback was introduced.
--- drivers/usb/serial/belkin_sa.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/usb/serial/belkin_sa.c +17 -11
@@ -430,7 +430,7 @@ static int belkin_sa_tiocmset(struct ttystruct belkin_sa_private *priv =usb_get_serial_port_data (port);unsigned long control_state;unsigned long flags; -int retval; +int retval =0 ;int rts =0 ;int dtr =0 ;
@@ -447,26 +447,32 @@ static int belkin_sa_tiocmset(struct tty }if (clear &TIOCM_RTS ) { control_state &= ~TIOCM_RTS ; - rts =0 ; + rts =1 ; }if (clear &TIOCM_DTR ) { control_state &= ~TIOCM_DTR ; - dtr =0 ; + dtr =1 ; } priv->control_state = control_state;spin_unlock_irqrestore (&priv->lock, flags); - retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , rts); -if (retval <0 ) { -dev_err (&port->dev,"Set RTS error %d\n" , retval); - goto exit; +if (rts) { + retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , + !!(control_state &TIOCM_RTS )); +if (retval <0 ) { +dev_err (&port->dev,"Set RTS error %d\n" , retval); + goto exit; + } } - retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , dtr); -if (retval <0 ) { -dev_err (&port->dev,"Set DTR error %d\n" , retval); - goto exit; +if (dtr) { + retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , + !!(control_state &TIOCM_DTR )); +if (retval <0 ) { +dev_err (&port->dev,"Set DTR error %d\n" , retval); + goto exit; + } } exit:return retval;
Greg Kroah-Hartman
maintainerPATCH 20/634 USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d432df758f92c4c28aac409bc807fd1716167577 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing issue dating back to 2003 when the support for these ioctls was added with the introduction of the tiocmset() callback.
--- drivers/usb/serial/kobil_sct.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/usb/serial/kobil_sct.c +9 -9
@@ -420,7 +420,7 @@ static int kobil_tiocmset(struct tty_strstruct usb_serial_port *port = tty->driver_data;struct device *dev = &port->dev;struct kobil_private *priv; -int result; +int result =0 ;int dtr =0 ;int rts =0 ;
@@ -437,12 +437,12 @@ static int kobil_tiocmset(struct tty_strif (set &TIOCM_DTR ) dtr =1 ;if (clear &TIOCM_RTS ) - rts =0 ; + rts =1 ;if (clear &TIOCM_DTR ) - dtr =0 ; + dtr =1 ; -if (priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { -if (dtr !=0 ) +if (dtr && priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { +if (set &TIOCM_DTR )dev_dbg (dev,"%s - Setting DTR\n" , __func__);else dev_dbg (dev,"%s - Clearing DTR\n" , __func__);
@@ -450,13 +450,13 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((dtr !=0 ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ), + ((set &TIOCM_DTR ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ),0 ,NULL ,0 , KOBIL_TIMEOUT); - }else { -if (rts !=0 ) + }else if (rts) { +if (set &TIOCM_RTS )dev_dbg (dev,"%s - Setting RTS\n" , __func__);else dev_dbg (dev,"%s - Clearing RTS\n" , __func__);
@@ -464,7 +464,7 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((rts !=0 ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ), + ((set &TIOCM_RTS ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ),0 ,NULL , 0,
Greg Kroah-Hartman
maintainerPATCH 21/634 ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Liu <[email protected]>
[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ]
ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on the same kernel function. When needed, ftrace_hash_ipmodify_enable() calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to share the same function as the IPMODIFY ftrace (livepatch).
ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, but not called in modify_ftrace_direct() path. As a result, the following operations will break livepatch:
1. Load livepatch to a kernel function;
2. Attach fentry program to the kernel function;
3. Attach fexit program to the kernel function.
After 3, the kernel function being used will not be the livepatched version, but the original version.
Fix this by adding __ftrace_hash_update_ipmodify() to __modify_ftrace_direct() and adjust some logic around the call.
--- kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-)
kernel/trace/ftrace.c +31 -9
@@ -1895,7 +1895,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops,*/ static int __ftrace_hash_update_ipmodify (struct ftrace_ops *ops,struct ftrace_hash *old_hash, -struct ftrace_hash *new_hash) +struct ftrace_hash *new_hash, +bool update_target) {struct ftrace_page *pg;struct dyn_ftrace *rec, *end =NULL ;
@@ -1930,10 +1931,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,if (rec->flags &FTRACE_FL_DISABLED )continue ; -/* We need to update only differences of filter_hash */ +/* +* Unless we are updating the target of a direct function, +* we only need to update differences of filter_hash +*/ in_old = !!ftrace_lookup_ip (old_hash, rec->ip); in_new = !!ftrace_lookup_ip (new_hash, rec->ip); -if (in_old == in_new) +if (!update_target && (in_old == in_new))continue ;if (in_new) {
@@ -1944,7 +1948,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,if (is_ipmodify) goto rollback; -FTRACE_WARN_ON (rec->flags &FTRACE_FL_DIRECT ); +/* +* If this is called by __modify_ftrace_direct() +* then it is only changing where the direct +* pointer is jumping to, and the record already +* points to a direct trampoline. If it isn't, +* then it is a bug to update ipmodify on a direct +* caller. +*/ +FTRACE_WARN_ON (!update_target && + (rec->flags &FTRACE_FL_DIRECT ));/* * Another ops with IPMODIFY is already
@@ -2001,7 +2014,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops)if (ftrace_hash_empty (hash)) hash =NULL ; -return __ftrace_hash_update_ipmodify (ops,EMPTY_HASH , hash); +return __ftrace_hash_update_ipmodify (ops,EMPTY_HASH , hash, false); }/* Disabling always succeeds */
@@ -2012,7 +2025,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops)if (ftrace_hash_empty (hash)) hash =NULL ; -__ftrace_hash_update_ipmodify (ops, hash,EMPTY_HASH ); +__ftrace_hash_update_ipmodify (ops, hash,EMPTY_HASH , false); } static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
@@ -2026,7 +2039,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,if (ftrace_hash_empty (new_hash)) new_hash =NULL ; -return __ftrace_hash_update_ipmodify (ops, old_hash, new_hash); +return __ftrace_hash_update_ipmodify (ops, old_hash, new_hash, false); }static void print_ip_ins (const char *fmt,const unsigned char *p)
@@ -5736,7 +5749,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct_multi);static int __modify_ftrace_direct_multi (struct ftrace_ops *ops,unsigned long addr) { -struct ftrace_hash *hash; +struct ftrace_hash *hash = ops->func_hash->filter_hash;struct ftrace_func_entry *entry, *iter;static struct ftrace_ops tmp_ops = { .func = ftrace_stub,
@@ -5755,13 +5768,21 @@ __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr)if (err)return err; +/* +* Call __ftrace_hash_update_ipmodify() here, so that we can call +* ops->ops_func for the ops. This is needed because the above +* register_ftrace_function_nolock() worked on tmp_ops. +*/ + err =__ftrace_hash_update_ipmodify (ops, hash, hash, true); +if (err) + goto out; +/* * Now the ftrace_ops_list_func() is called to do the direct callers. * We can safely change the direct functions attached to each entry. */ mutex_lock (&ftrace_lock); - hash = ops->func_hash->filter_hash; size =1 << hash->size_bits;for (i =0 ; i < size; i++) {hlist_for_each_entry (iter, &hash->buckets[i], hlist) {
@@ -5774,6 +5795,7 @@ __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr)mutex_unlock (&ftrace_lock); +out:/* Removing the tmp_ops will add the updated direct callers to the functions */ unregister_ftrace_function (&tmp_ops);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/634 spi: xilinx: increase number of retries before declaring stall
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvaro Gamez Machado <[email protected]>
[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
SPI devices using a (relative) slow frequency need a larger time.
For instance, microblaze running at 83.25MHz and performing a 3 bytes transaction using a 10MHz/16 = 625kHz needed this stall value increased to at least 20. The SPI device is quite slow, but also is the microblaze, so set this value to 32 to give it even more margin.
--- drivers/spi/spi-xilinx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-xilinx.c +1 -1
@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)/* Read out all the data from the Rx FIFO */ rx_words = n_words; - stalled =10 ; + stalled =32 ;while (rx_words) { if (rx_words == n_words && !(stalled--) && !(sr & XSPI_SR_TX_EMPTY_MASK) &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/634 spi: imx: keep dma request disabled before dma transfer setup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Gong <[email protected]>
[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below:
"It is thus essential for the Arm platform to program them before any DMA
request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started."
--- drivers/spi/spi-imx.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/spi/spi-imx.c +11 -4
@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) {u32 reg; - reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); - reg |=MX51_ECSPI_CTRL_XCH ; -writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); +if (spi_imx->usedma) { + reg =readl (spi_imx->base +MX51_ECSPI_DMA ); + reg |=MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN ; +writel (reg, spi_imx->base +MX51_ECSPI_DMA ); + }else { + reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); + reg |=MX51_ECSPI_CTRL_XCH ; +writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); + } }static void mx51_disable_dma (struct spi_imx_data *spi_imx)
@@ -689,7 +695,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)writel (MX51_ECSPI_DMA_RX_WML (spi_imx->wml -1 ) |MX51_ECSPI_DMA_TX_WML (tx_wml) |MX51_ECSPI_DMA_RXT_WML (spi_imx->wml) | -MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN |MX51_ECSPI_DMA_RXTDEN , spi_imx->base +MX51_ECSPI_DMA ); }
@@ -1449,6 +1454,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,reinit_completion (&spi_imx->dma_tx_completion);dma_async_issue_pending (controller->dma_tx); + spi_imx->devtype_data->trigger (spi_imx); + transfer_timeout =spi_imx_calculate_timeout (spi_imx, transfer->len);/* Wait SDMA to finish the data transfer.*/
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/634 drm/vmwgfx: Use kref in vmw_bo_dirty
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ]
Rather than using an ad hoc reference count use kref which is atomic and has underflow warnings.
--- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +5 -7
@@ -50,22 +50,22 @@ enum vmw_bo_dirty_method {/** * struct vmw_bo_dirty - Dirty information for buffer objects +* @ref_count: Reference count for this structure. Must be first member! * @start: First currently dirty bit * @end: Last currently dirty bit + 1 * @method: The currently used dirty method * @change_count: Number of consecutive method change triggers -* @ref_count: Reference count for this structure * @bitmap_size: The size of the bitmap in bits. Typically equal to the * nuber of pages in the bo. * @bitmap: A bitmap where each bit represents a page. A set bit means a * dirty page. */ struct vmw_bo_dirty { +struct kref ref_count;unsigned long start;unsigned long end;enum vmw_bo_dirty_method method;unsigned int change_count; -unsigned int ref_count;unsigned long bitmap_size;unsigned long bitmap[]; };
@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_buffer_object *vbo)int ret;if (dirty) { - dirty->ref_count++; +kref_get (&dirty->ref_count);return 0 ; }
@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_buffer_object *vbo) dirty->bitmap_size = num_pages; dirty->start = dirty->bitmap_size; dirty->end =0 ; - dirty->ref_count =1 ; +kref_init (&dirty->ref_count);if (num_pages <PAGE_SIZE /sizeof (pte_t)) { dirty->method =VMW_BO_DIRTY_PAGETABLE ; }else {
@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_buffer_object *vbo) {struct vmw_bo_dirty *dirty = vbo->dirty; -if (dirty && --dirty->ref_count ==0 ) { -kvfree (dirty); +if (dirty &&kref_put (&dirty->ref_count, (void *)kvfree)) vbo->dirty =NULL ; - } }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/634 smb: fix invalid username check in smb3_fs_context_parse_param()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiqi Sun <[email protected]>
[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ]
Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() is always FALSE and invalid.
Fix the comparison in if statement.
--- fs/smb/client/fs_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/fs_context.c +1 -1
@@ -1183,7 +1183,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,break ; } -if (strnlen (param->string,CIFS_MAX_USERNAME_LEN ) > +if (strnlen (param->string,CIFS_MAX_USERNAME_LEN ) ==CIFS_MAX_USERNAME_LEN ) {pr_warn ("username too long\n" ); goto cifs_parse_mount_err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/634 ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lushih Hsieh <[email protected]>
[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ]
The PureAudio APA DAC and Lotus DAC5 series are USB Audio 2.0 Class devices that support native Direct Stream Digital (DSD) playback via specific vendor protocols.
Without these quirks, the devices may only function in standard PCM mode, or fail to correctly report their DSD format capabilities to the ALSA framework, preventing native DSD playback under Linux.
This commit adds new quirk entries for the mentioned DAC models based on their respective Vendor/Product IDs (VID:PID), for example:
0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc.
The quirk ensures correct DSD format handling by setting the required SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA DSD API to correctly address the device for high-bitrate DSD streams, bypassing the need for DoP (DSD over PCM).
Test on APA DAC and Lotus DAC5 SE under Arch Linux.
--- sound/usb/quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/usb/quirks.c +6 -0
@@ -1920,6 +1920,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,case USB_ID (0x16d0 ,0x09d8 ):/* NuPrime IDA-8 */ case USB_ID (0x16d0 ,0x09db ):/* NuPrime Audio DAC-9 */ case USB_ID (0x16d0 ,0x09dd ):/* Encore mDSD */ +case USB_ID (0x16d0 ,0x0ab1 ):/* PureAudio APA DAC */ +case USB_ID (0x16d0 ,0xeca1 ):/* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */ case USB_ID (0x1db5 ,0x0003 ):/* Bryston BDA3 */ case USB_ID (0x20a0 ,0x4143 ):/* WaveIO USB Audio 2.0 */ case USB_ID (0x22e1 ,0xca01 ):/* HDTA Serenade DSD */
@@ -2187,6 +2189,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_IGNORE_CLOCK_SOURCE),DEVICE_FLG (0x1686 ,0x00dd ,/* Zoom R16/24 */ QUIRK_FLAG_TX_LENGTH |QUIRK_FLAG_CTL_MSG_DELAY_1M ), +DEVICE_FLG (0x16d0 ,0x0ab1 ,/* PureAudio APA DAC */ +QUIRK_FLAG_DSD_RAW ), +DEVICE_FLG (0x16d0 ,0xeca1 ,/* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */ +QUIRK_FLAG_DSD_RAW ),DEVICE_FLG (0x17aa ,0x1046 ,/* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */ QUIRK_FLAG_DISABLE_AUTOSUSPEND ), DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/634 bfs: Reconstruct file type when loading from disk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted.
A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0.
Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
--- fs/bfs/inode.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
fs/bfs/inode.c +18 -1
@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) off = (ino -BFS_ROOT_INO ) %BFS_INODES_PER_BLOCK ; di = (struct bfs_inode *)bh->b_data + off; - inode->i_mode =0x0000FFFF &le32_to_cpu (di->i_mode); +/* +* https://martin.hinner.info/fs/bfs/bfs-structure.html explains that +* BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode +* value. This means that, although bfs_write_inode() saves whole +* inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} +* bits), middle 7 bits of di->i_mode value can be garbage when these +* bits were not saved by bfs_write_inode(). +* Since we can't tell whether middle 7 bits are garbage, use only +* lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being +* garbage) and reconstruct S_IFMT bits for Linux environment from +* di->i_vtype value. +*/ + inode->i_mode =0x00000FFF &le32_to_cpu (di->i_mode);if (le32_to_cpu (di->i_vtype) ==BFS_VDIR ) { inode->i_mode |=S_IFDIR ; inode->i_op = &bfs_dir_inops;
@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) inode->i_op = &bfs_file_inops; inode->i_fop = &bfs_file_operations; inode->i_mapping->a_ops = &bfs_aops; + }else { +brelse (bh); +printf ("Unknown vtype=%u %s:%08lx\n" , +le32_to_cpu (di->i_vtype), inode->i_sb->s_id, ino); + goto error; }BFS_I (inode)->i_sblock =le32_to_cpu (di->i_sblock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/634 pinctrl: qcom: msm: Fix deadlock in pinmux configuration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <[email protected]>
[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() to prevent deadlock when wakeup IRQ is triggered on the same GPIO being reconfigured.
The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ handler attempts to reconfigure the same GPIO's pinmux. In this scenario, msm_pinmux_set_mux() calls disable_irq() which waits for the currently running IRQ handler to complete, creating a circular dependency that results in deadlock.
Using disable_irq_nosync() avoids waiting for the IRQ handler to complete, preventing the deadlock condition while still properly disabling the interrupt during pinmux reconfiguration.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-msm.c +1 -1
@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,*/ if (d && i != gpio_func && !test_and_set_bit (d->hwirq, pctrl->disabled_for_mux)) -disable_irq (irq); +disable_irq_nosync (irq);raw_spin_lock_irqsave (&pctrl->lock, flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/634 platform/x86: acer-wmi: Ignore backlight event
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI firmware when the backlight up/down keys are pressed. Ignore this event to avoid spamming the kernel log with error messages, as the acpi-video driver already handles brightness up/down events.
--- drivers/platform/x86/acer-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/acer-wmi.c +4 -0
@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");enum acer_wmi_event_ids {WMID_HOTKEY_EVENT =0x1 , +WMID_BACKLIGHT_EVENT =0x4 ,WMID_ACCEL_OR_KBD_DOCK_EVENT =0x5 ,WMID_GAMING_TURBO_KEY_EVENT =0x7 ,WMID_AC_EVENT =0x8 ,
@@ -1992,6 +1993,9 @@ static void acer_wmi_notify(u32 value, void *context)sparse_keymap_report_event (acer_wmi_input_dev, scancode,1 , true); }break ; +case WMID_BACKLIGHT_EVENT : +/* Already handled by acpi-video */ +break ;case WMID_ACCEL_OR_KBD_DOCK_EVENT :acer_gsensor_event ();acer_kbd_dock_event (&return_value);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/634 HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: April Grimoire <[email protected]>
[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ]
SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, rendering function keys not treated properly. Despite being a SONiX USB DEVICE, it uses a different name, so adding it to the list.
--- drivers/hid/hid-apple.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/hid-apple.c +1 -0
@@ -320,6 +320,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {static const struct apple_non_apple_keyboard non_apple_keyboards[] = { {"SONiX USB DEVICE" }, + {"SONiX AK870 PRO" }, {"Keychron" }, {"AONE" }, {"GANSS" }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/634 platform/x86: huawei-wmi: add keys for HONOR models
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Ston <[email protected]>
[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print Screen and YOYO keys properly, with the system reporting them as unknown key presses (codes: 0x028b and 0x028e).
To resolve this, a key_entry is added for both the HONOR Print Screen key and the HONOR YOYO key, ensuring they function correctly on these models.
--- drivers/platform/x86/huawei-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/huawei-wmi.c +4 -0
@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = { { KE_KEY, 0x289, { KEY_WLAN } },// Huawei |M| key { KE_KEY, 0x28a, { KEY_CONFIG } }, +// HONOR YOYO key + { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, +// HONOR print screen + { KE_KEY, 0x28e, { KEY_PRINT } },// Keyboard backlit { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/634 HID: elecom: Add support for ELECOM M-XT3URBK (018F)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoki Ueki <[email protected]>
[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which shares the same report descriptor as the existing device (0x00FB). However, the driver does not currently recognize this new ID, resulting in only five buttons being functional.
This patch adds the new device ID so that all six buttons work properly.
--- drivers/hid/hid-elecom.c | 6 ++++-- drivers/hid/hid-ids.h | 3 ++- drivers/hid/hid-quirks.c | 3 ++- 3 files changed, 8 insertions(+), 4 deletions(-)
drivers/hid/hid-elecom.c +4 -2
@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ mouse_button_fixup (hdev, rdesc, *rsize,20 ,28 ,22 ,14 ,8 );break ; -case USB_DEVICE_ID_ELECOM_M_XT3URBK : +case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB : +case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F :case USB_DEVICE_ID_ELECOM_M_XT3DRBK :case USB_DEVICE_ID_ELECOM_M_XT4DRBK :/*
@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,static const struct hid_device_id elecom_devices[] = { {HID_BLUETOOTH_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_BM084 ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XGL20DLBK ) }, - {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK_018F ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3DRBK ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT4DRBK ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_DT1URBK ) },
drivers/hid/hid-ids.h +2 -1
@@ -439,7 +439,8 @@#define USB_VENDOR_ID_ELECOM 0x056e#define USB_DEVICE_ID_ELECOM_BM084 0x0061#define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 -#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb +#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb +#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f#define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc#define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd#define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
drivers/hid/hid-quirks.c +2 -1
@@ -393,7 +393,8 @@ static const struct hid_device_id hid_have_special_driver[] = { #if IS_ENABLED(CONFIG_HID_ELECOM) { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/634 LoongArch: Mask all interrupts during kexec/kdump
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ]
If the default state of the interrupt controllers in the first kernel don't mask any interrupts, it may cause the second kernel to potentially receive interrupts (which were previously allocated by the first kernel) immediately after a CPU becomes online during its boot process. These interrupts cannot be properly routed, leading to bad IRQ issues.
This patch calls machine_kexec_mask_interrupts() to mask all interrupts during the kexec/kdump process.
--- arch/loongarch/kernel/machine_kexec.c | 2 ++ 1 file changed, 2 insertions(+)
arch/loongarch/kernel/machine_kexec.c +2 -0
@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs)#ifdef CONFIG_SMP crash_smp_send_stop ();#endif +machine_kexec_mask_interrupts ();cpumask_set_cpu (crashing_cpu, &cpus_in_crash);pr_info ("Starting crashdump kernel...\n" );
@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image)/* We do not want to be bothered. */ local_irq_disable (); +machine_kexec_mask_interrupts ();pr_notice ("EFI boot flag 0x%lx\n" , efi_boot);pr_notice ("Command line at 0x%lx\n" , cmdline_ptr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/634 samples: work around glibc redefining some of our defines wrong
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE and some of the other flags for renameat2() and friends in <stdio.h>.
Which would all be fine, except for inexplicable reasons glibc decided to define them _differently_ from the kernel definitions, which then makes some of our sample code that includes both kernel headers and user space headers unhappy, because the compiler will (correctly) complain about redefining things.
Now, mixing kernel headers and user space headers is always a somewhat iffy proposition due to namespacing issues, but it's kind of inevitable in our sample and selftest code. And this is just glibc being stupid.
Those defines come from the kernel, glibc is exposing the kernel interfaces, and glibc shouldn't make up some random new expressions for these values.
It's not like glibc headers changed the actual result values, but they arbitrarily just decided to use a different expression to describe those values. The kernel just does
#define AT_RENAME_NOREPLACE 0x0001
while glibc does
# define RENAME_NOREPLACE (1 << 0)
# define AT_RENAME_NOREPLACE RENAME_NOREPLACEinstead. Same value in the end, but very different macro definition.
For absolutely no reason.
This has since been fixed in the glibc development tree, so eventually we'll end up with the canonical expressions and no clashes. But in the meantime the broken headers are in the glibc-2.42 release and have made it out into distributions.
Do a minimal work-around to make the samples build cleanly by just undefining the affected macros in between the user space header include and the kernel header includes.
--- samples/vfs/test-statx.c | 6 ++++++ samples/watch_queue/watch_test.c | 6 ++++++ 2 files changed, 12 insertions(+)
samples/vfs/test-statx.c +6 -0
@@ -19,6 +19,12 @@#include <time.h> #include <sys/syscall.h> #include <sys/types.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/stat.h> #include <linux/fcntl.h> #define statx foo
samples/watch_queue/watch_test.c +6 -0
@@ -16,6 +16,12 @@#include <errno.h> #include <sys/ioctl.h> #include <limits.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/watch_queue.h> #include <linux/unistd.h> #include <linux/keyctl.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/634 comedi: c6xdigio: Fix invalid PNP driver unregistration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 72262330f7b3ad2130e800cecf02adcce3c32c77 upstream.
The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler c6xdigio_attach() to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with pnp_register_driver(), but ignores the return value. (The struct pnp_driver it uses has only the name and id_table members filled in.) The driver's Comedi "detach" handler c6xdigio_detach() unconditionally unregisters the PNP driver with pnp_unregister_driver().
It is possible for c6xdigio_attach() to return an error before it calls pnp_register_driver() and it is possible for the call to pnp_register_driver() to return an error (that is ignored). In both cases, the driver should not be calling pnp_unregister_driver() as it does in c6xdigio_detach(). (Note that c6xdigio_detach() will be called by the Comedi core if c6xdigio_attach() returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.)
The unconditional call to pnp_unregister_driver() without a previous successful call to pnp_register_driver() will cause driver_unregister() to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1].
Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.)
Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since c6xdigio_detach() now only calls comedi_legacy_detach(), remove the function and change the Comedi driver "detach" handler to comedi_legacy_detach.
-------------------------------------------
[1] Syzbot sample crash report:
Unexpected driver unregister!
WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline] WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Modules linked in: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:driver_unregister drivers/base/driver.c:273 [inline] RIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Code: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41 RSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8 RDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000 FS: 000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0 Call Trace: <TASK> comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207 comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215 comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011 do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc05798eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8184238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc057be5fa0 RCX: 00007fc05798eec9 RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fc057a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc057be5fa0 R14: 00007fc057be5fa0 R15: 0000000000000003 </TASK> -------------------------------------------
--- drivers/comedi/drivers/c6xdigio.c | 46 ++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-)
drivers/comedi/drivers/c6xdigio.c +35 -11
@@ -249,9 +249,6 @@ static int c6xdigio_attach(struct comediif (ret)return ret; -/* Make sure that PnP ports get activated */ -pnp_register_driver (&c6xdigio_pnp_driver); - s = &dev->subdevices[0 ];/* pwm output subdevice */ s->type =COMEDI_SUBD_PWM ;
@@ -278,19 +275,46 @@ static int c6xdigio_attach(struct comedireturn 0 ; } -static void c6xdigio_detach (struct comedi_device *dev) -{ -comedi_legacy_detach (dev); -pnp_unregister_driver (&c6xdigio_pnp_driver); -} -static struct comedi_driver c6xdigio_driver = { .driver_name ="c6xdigio" , .module =THIS_MODULE , .attach = c6xdigio_attach, - .detach = c6xdigio_detach, + .detach = comedi_legacy_detach, }; -module_comedi_driver (c6xdigio_driver); + +static bool c6xdigio_pnp_registered = false; + +static int __init c6xdigio_module_init (void ) +{ +int ret; + + ret =comedi_driver_register (&c6xdigio_driver); +if (ret) +return ret; + +if (IS_ENABLED (CONFIG_PNP )) { +/* Try to activate the PnP ports */ + ret =pnp_register_driver (&c6xdigio_pnp_driver); +if (ret) { +pr_warn ("failed to register pnp driver - err %d\n" , + ret); + ret =0 ;/* ignore the error. */ + }else { + c6xdigio_pnp_registered = true; + } + } + +return 0 ; +} +module_init (c6xdigio_module_init); + +static void __exit c6xdigio_module_exit(void) +{ +if (c6xdigio_pnp_registered) +pnp_unregister_driver (&c6xdigio_pnp_driver); +comedi_driver_unregister (&c6xdigio_driver); +} +module_exit (c6xdigio_module_exit);MODULE_AUTHOR ("Comedi https://www.comedi.org" );MODULE_DESCRIPTION ("Comedi driver for the C6x_DIGIO DSP daughter card" );
Greg Kroah-Hartman
maintainerPATCH 36/634 comedi: multiq3: sanitize config options in multiq3_attach()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit f24c6e3a39fa355dabfb684c9ca82db579534e72 upstream.
Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specifically, in the case of multiq3 driver.
This problem arose when syzkaller managed to craft weird configuration options used to specify the number of channels in encoder subdevice. If a particularly great number is passed to s->n_chan in multiq3_attach() via it->options[2], then multiple calls to multiq3_encoder_reset() at the end of driver-specific attach() method will be running for minutes, thus blocking tasks and affected devices as well.
While this issue is most likely not too dangerous for real-life devices, it still makes sense to sanitize configuration inputs. Enable a sensible limit on the number of encoder chips (4 chips max, each with 2 channels) to stop this behaviour from manifesting.
[1] Syzbot crash:
INFO: task syz.2.19:6067 blocked for more than 143 seconds. ... Call Trace: <TASK> context_switch kernel/sched/core.c:5254 [inline] __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862 __schedule_loop kernel/sched/core.c:6944 [inline] schedule+0x165/0x360 kernel/sched/core.c:6959 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760 comedi_open+0xc0/0x590 drivers/comedi/comedi_fops.c:2868 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x953/0x13f0 fs/open.c:965 vfs_open+0x3b/0x340 fs/open.c:1097
...
--- drivers/comedi/drivers/multiq3.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/comedi/drivers/multiq3.c +9 -0
@@ -67,6 +67,11 @@#define MULTIQ3_TRSFRCNTR_OL 0x10/* xfer CNTR to OL (x and y) */ #define MULTIQ3_EFLAG_RESET 0x06/* reset E bit of flag reg */ +/* +* Limit on the number of optional encoder channels +*/ +#define MULTIQ3_MAX_ENC_CHANS 8 +static void multiq3_set_ctrl (struct comedi_device *dev,unsigned int bits) {/*
@@ -312,6 +317,10 @@ static int multiq3_attach(struct comedi_ s->insn_read = multiq3_encoder_insn_read; s->insn_config = multiq3_encoder_insn_config; +/* sanity check for number of encoder channels */ +if (s->n_chan >MULTIQ3_MAX_ENC_CHANS ) + s->n_chan =MULTIQ3_MAX_ENC_CHANS ; +for (i =0 ; i < s->n_chan; i++)multiq3_encoder_reset (dev, i);
Greg Kroah-Hartman
maintainerPATCH 37/634 comedi: check devices attached status in compat ioctls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 0de7d9cd07a2671fa6089173bccc0b2afe6b93ee upstream.
Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig().
As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG.
Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback.
Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions.
[1] Syzbot report:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: <TASK> get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
...
--- drivers/comedi/comedi_fops.c | 42 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-)
drivers/comedi/comedi_fops.c +36 -6
@@ -2966,7 +2966,12 @@ static int compat_chaninfo(struct file * chaninfo.rangelist =compat_ptr (chaninfo32.rangelist);mutex_lock (&dev->mutex); - err =do_chaninfo_ioctl (dev, &chaninfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_chaninfo_ioctl (dev, &chaninfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -2987,7 +2992,12 @@ static int compat_rangeinfo(struct file rangeinfo.range_ptr =compat_ptr (rangeinfo32.range_ptr);mutex_lock (&dev->mutex); - err =do_rangeinfo_ioctl (dev, &rangeinfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_rangeinfo_ioctl (dev, &rangeinfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -3063,7 +3073,12 @@ static int compat_cmd(struct file *file,return rc;mutex_lock (&dev->mutex); - rc =do_cmd_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmd_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) {/* Special case: copy cmd back to user. */
@@ -3088,7 +3103,12 @@ static int compat_cmdtest(struct file *freturn rc;mutex_lock (&dev->mutex); - rc =do_cmdtest_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmdtest_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) { err =put_compat_cmd (compat_ptr (arg), &cmd);
@@ -3148,7 +3168,12 @@ static int compat_insnlist(struct file * }mutex_lock (&dev->mutex); - rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); + }mutex_unlock (&dev->mutex);kfree (insns);return rc;
@@ -3167,7 +3192,12 @@ static int compat_insn(struct file *filereturn rc;mutex_lock (&dev->mutex); - rc =do_insn_ioctl (dev, &insn, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insn_ioctl (dev, &insn, file); + }mutex_unlock (&dev->mutex);return rc; }
Greg Kroah-Hartman
maintainerPATCH 38/634 staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 154828bf9559b9c8421fc2f0d7f7f76b3683aaed upstream.
The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop.
Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element.
This prevents OOB reads and ensures the parser terminates safely on malformed frames.
--- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/staging/rtl8723bs/core/rtw_ieee80211.c +8 -6
@@ -139,22 +139,24 @@ u8 *rtw_get_ie(u8 *pbuf, signed int indesigned int tmp, i;u8 *p; -if (limit <1 ) +if (limit <2 )return NULL ; p = pbuf; i =0 ; *len =0 ; -while (1 ) { +while (i +2 <= limit) { + tmp = *(p +1 ); +if (i +2 + tmp > limit) +break ; +if (*p == index) { - *len = *(p +1 ); + *len = tmp;return p; } - tmp = *(p +1 ); + p += (tmp +2 ); i += (tmp +2 ); -if (i >= limit) -break ; }return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 39/634 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 6ef0e1c10455927867cac8f0ed6b49f328f8cf95 upstream.
The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow.
Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow.
This prevents kernel stack corruption triggered by malformed association requests.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +4 -1
@@ -1036,6 +1036,9 @@ unsigned int OnAssocReq(struct adapter * status =WLAN_STATUS_CHALLENGE_FAIL ; goto OnAssocReqFail; }else { +if (ie_len >sizeof (supportRate)) + ie_len =sizeof (supportRate); +memcpy (supportRate, p+2 , ie_len); supportRateNum = ie_len;
@@ -1043,7 +1046,7 @@ unsigned int OnAssocReq(struct adapter * pkt_len - WLAN_HDR_A3_LEN - ie_offset);if (p) { -if (supportRateNum <=sizeof (supportRate)) { +if (supportRateNum + ie_len <=sizeof (supportRate)) {memcpy (supportRate+supportRateNum, p+2 , ie_len); supportRateNum += ie_len; }
Greg Kroah-Hartman
maintainerPATCH 40/634 staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 502ddcc405b69fa92e0add6c1714d654504f6fd7 upstream.
The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could cause an out-of-bounds read, potentially triggering a kernel panic.
Add a boundary check to ensure that the ESR IE body and the subsequent bytes are within the limits of the frame before attempting to access them.
This prevents OOB reads caused by malformed beacon frames.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +5 -3
@@ -582,9 +582,11 @@ unsigned int OnBeacon(struct adapter *pa p =rtw_get_ie (pframe +sizeof (struct ieee80211_hdr_3addr ) + _BEACON_IE_OFFSET_,WLAN_EID_EXT_SUPP_RATES , &ielen, precv_frame->u.hdr.len -sizeof (struct ieee80211_hdr_3addr ) - _BEACON_IE_OFFSET_);if (p && ielen >0 ) { -if ((*(p +1 + ielen) ==0x2D ) && (*(p +2 + ielen) !=0x2D )) -/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ - *(p +1 ) = ielen -1 ; +if (p +2 + ielen < pframe + len) { +if ((*(p +1 + ielen) ==0x2D ) && (*(p +2 + ielen) !=0x2D )) +/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ + *(p +1 ) = ielen -1 ; + } }if (pmlmeext->sitesurvey_res.state ==SCAN_PROCESS ) {
Greg Kroah-Hartman
maintainerPATCH 41/634 smack: fix bug: unprivileged task can create labels
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3 ]
If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty),
it can freely create new labels by writing their names into own /proc/PID/attr/smack/current
This occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.
This change ensures that the "relabel-self" list
is checked before importing the label.
--- security/smack/smack_lsm.c | 41 +++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 14 deletions(-)
security/smack/smack_lsm.c +27 -14
@@ -3624,8 +3624,8 @@ static int smack_setprocattr(const char *name, void *value, size_t size)struct task_smack *tsp =smack_cred (current_cred ());struct cred *new;struct smack_known *skp; -struct smack_known_list_elem *sklep; -int rc; +char *labelstr; +int rc =0 ;if (!smack_privileged (CAP_MAC_ADMIN ) &&list_empty (&tsp->smk_relabel))return -EPERM ;
@@ -3636,28 +3636,41 @@ static int smack_setprocattr(const char *name, void *value, size_t size)if (strcmp (name,"current" ) !=0 )return -EINVAL ; - skp =smk_import_entry (value, size); -if (IS_ERR (skp)) -return PTR_ERR (skp); + labelstr =smk_parse_smack (value, size); +if (IS_ERR (labelstr)) +return PTR_ERR (labelstr);/* * No process is ever allowed the web ("@") label * and the star ("*") label. */ -if (skp == &smack_known_web || skp == &smack_known_star) -return -EINVAL ; +if (labelstr[1 ] =='\0' /* '@', '*' */ ) { +const char c = labelstr[0 ]; + +if (c == *smack_known_web.smk_known || + c == *smack_known_star.smk_known) { + rc = -EPERM ; + goto free_labelstr; + } + }if (!smack_privileged (CAP_MAC_ADMIN )) { - rc = -EPERM ; +const struct smack_known_list_elem *sklep;list_for_each_entry (sklep, &tsp->smk_relabel, list) -if (sklep->smk_label == skp) { - rc =0 ; -break ; - } -if (rc) -return rc; +if (strcmp (sklep->smk_label->smk_known, labelstr) ==0 ) + goto free_labelstr; + rc = -EPERM ; } +free_labelstr: +kfree (labelstr); +if (rc) +return -EPERM ; + + skp =smk_import_entry (value, size); +if (IS_ERR (skp)) +return PTR_ERR (skp); + new =prepare_creds ();if (new ==NULL )return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/634 gpu: host1x: Fix race in syncpt alloc/free
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mainak Sen <[email protected]>
[ Upstream commit c7d393267c497502fa737607f435f05dfe6e3d9b ]
Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking.
This ensures no thread can acquire the syncpt_mutex after the refcount drops to zero but before syncpt_release acquires it.
This prevents races where syncpoints could
be allocated while still being cleaned up from a previous release.
Remove explicit mutex locking in syncpt_release as kref_put_mutex() handles this atomically.
--- drivers/gpu/host1x/syncpt.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/host1x/syncpt.c +1 -3
@@ -393,8 +393,6 @@ static void syncpt_release(struct kref *ref) sp->locked = false; -mutex_lock (&sp->host->syncpt_mutex); -host1x_syncpt_base_free (sp->base);kfree (sp->name); sp->base =NULL ;
@@ -417,7 +415,7 @@ void host1x_syncpt_put(struct host1x_syncpt *sp)if (!sp)return ; -kref_put (&sp->ref, syncpt_release); +kref_put_mutex (&sp->ref, syncpt_release, &sp->host->syncpt_mutex); }EXPORT_SYMBOL (host1x_syncpt_put);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/634 drm/panel: visionox-rm69299: Dont clear all mode flags
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guido Günther <[email protected]>
[ Upstream commit 39144b611e9cd4f5814f4098c891b545dd70c536 ]
Don't clear all mode flags. We only want to maek sure we use HS mode during unprepare.
--- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-visionox-rm69299.c +1 -1
@@ -64,7 +64,7 @@ static int visionox_rm69299_unprepare(struct drm_panel *panel)struct visionox_rm69299 *ctx =panel_to_ctx (panel);int ret; - ctx->dsi->mode_flags =0 ; + ctx->dsi->mode_flags &= ~MIPI_DSI_MODE_LPM ; ret =mipi_dsi_dcs_write (ctx->dsi,MIPI_DCS_SET_DISPLAY_OFF ,NULL ,0 );if (ret <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/634 drm/vgem-fence: Fix potential deadlock on release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <[email protected]>
[ Upstream commit 78b4d6463e9e69e5103f98b367f8984ad12cdc6f ]
A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put(). In some scenarios, it can run in IRQ context, which is not safe unless TIMER_IRQSAFE is used. One potentially risky scenario was demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while working on new IGT subtests syncobj_timeline@stress-* as user space replacements of some problematic test cases of a dma-fence-chain selftest [1].
[117.004338] ================================
[117.004340] WARNING: inconsistent lock state
[117.004342] 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 Tainted: G S U
[117.004346] --------------------------------
[117.004347] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
[117.004349] swapper/0/0 [HC1[1]:SC1[1]:HE0:SE0] takes:
[117.004352] ffff888138f86aa8 ((&fence->timer)){?.-.}-{0:0}, at: __timer_delete_sync+0x4b/0x190
[117.004361] {HARDIRQ-ON-W} state was registered at:
[117.004363] lock_acquire+0xc4/0x2e0
[117.004366] call_timer_fn+0x80/0x2a0
[117.004368] __run_timers+0x231/0x310
[117.004370] run_timer_softirq+0x76/0xe0
[117.004372] handle_softirqs+0xd4/0x4d0
[117.004375] __irq_exit_rcu+0x13f/0x160
[117.004377] irq_exit_rcu+0xe/0x20
[117.004379] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004382] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004385] cpuidle_enter_state+0x12b/0x8a0
[117.004388] cpuidle_enter+0x2e/0x50
[117.004393] call_cpuidle+0x22/0x60
[117.004395] do_idle+0x1fd/0x260
[117.004398] cpu_startup_entry+0x29/0x30
[117.004401] start_secondary+0x12d/0x160
[117.004404] common_startup_64+0x13e/0x141
[117.004407] irq event stamp: 2282669
[117.004409] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.004414] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.004419] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.004423] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.004426]
other info that might help us debug this:
[117.004429] Possible unsafe locking scenario:
[117.004432] CPU0
[117.004433] ----
[117.004434] lock((&fence->timer));
[117.004436] <Interrupt>
[117.004438] lock((&fence->timer));
[117.004440]
*** DEADLOCK ***
[117.004443] 1 lock held by swapper/0/0:
[117.004445] #0: ffffc90000003d50 ((&fence->timer)){?.-.}-{0:0}, at: call_timer_fn+0x7a/0x2a0
[117.004450]
stack backtrace:
[117.004453] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004455] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004455] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004456] Call Trace:
[117.004456] <IRQ>
[117.004457] dump_stack_lvl+0x91/0xf0
[117.004460] dump_stack+0x10/0x20
[117.004461] print_usage_bug.part.0+0x260/0x360
[117.004463] mark_lock+0x76e/0x9c0
[117.004465] ? register_lock_class+0x48/0x4a0
[117.004467] __lock_acquire+0xbc3/0x2860
[117.004469] lock_acquire+0xc4/0x2e0
[117.004470] ? __timer_delete_sync+0x4b/0x190
[117.004472] ? __timer_delete_sync+0x4b/0x190
[117.004473] __timer_delete_sync+0x68/0x190
[117.004474] ? __timer_delete_sync+0x4b/0x190
[117.004475] timer_delete_sync+0x10/0x20
[117.004476] vgem_fence_release+0x19/0x30 [vgem]
[117.004478] dma_fence_release+0xc1/0x3b0
[117.004480] ? dma_fence_release+0xa1/0x3b0
[117.004481] dma_fence_chain_release+0xe7/0x130
[117.004483] dma_fence_release+0xc1/0x3b0
[117.004484] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004485] dma_fence_chain_irq_work+0x59/0x80
[117.004487] irq_work_single+0x75/0xa0
[117.004490] irq_work_run_list+0x33/0x60
[117.004491] irq_work_run+0x18/0x40
[117.004493] __sysvec_irq_work+0x35/0x170
[117.004494] sysvec_irq_work+0x47/0xc0
[117.004496] asm_sysvec_irq_work+0x1b/0x20
[117.004497] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004499] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004499] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004500] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004501] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004502] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004502] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004502] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004506] dma_fence_signal+0x49/0xb0
[117.004507] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004508] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004509] call_timer_fn+0xa1/0x2a0
[117.004512] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004513] __run_timers+0x231/0x310
[117.004514] ? tmigr_handle_remote+0x2ac/0x560
[117.004517] timer_expire_remote+0x46/0x70
[117.004518] tmigr_handle_remote+0x433/0x560
[117.004520] ? __run_timers+0x239/0x310
[117.004521] ? run_timer_softirq+0x21/0xe0
[117.004522] ? lock_release+0xce/0x2a0
[117.004524] run_timer_softirq+0xcf/0xe0
[117.004525] handle_softirqs+0xd4/0x4d0
[117.004526] __irq_exit_rcu+0x13f/0x160
[117.004527] irq_exit_rcu+0xe/0x20
[117.004528] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004529] </IRQ>
[117.004529] <TASK>
[117.004529] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004530] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004532] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004532] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004533] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004533] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004534] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004534] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004534] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004537] ? cpuidle_enter_state+0x125/0x8a0
[117.004538] ? sched_clock_noinstr+0x9/0x10
[117.004540] cpuidle_enter+0x2e/0x50
[117.004542] call_cpuidle+0x22/0x60
[117.004542] do_idle+0x1fd/0x260
[117.004544] cpu_startup_entry+0x29/0x30
[117.004546] rest_init+0x104/0x200
[117.004548] start_kernel+0x93d/0xbd0
[117.004550] ? load_ucode_intel_bsp+0x2a/0x90
[117.004551] ? sme_unmap_bootdata+0x14/0x80
[117.004554] x86_64_start_reservations+0x18/0x30
[117.004555] x86_64_start_kernel+0xfd/0x150
[117.004556] ? soft_restart_cpu+0x14/0x14
[117.004558] common_startup_64+0x13e/0x141
[117.004560] </TASK>
[117.004565] ------------[ cut here ]------------
[117.004692] WARNING: CPU: 0 PID: 0 at kernel/time/timer.c:1610 __timer_delete_sync+0x126/0x190
[117.004697] Modules linked in: vgem snd_hda_codec_intelhdmi snd_hda_codec_hdmi i915 prime_numbers ttm drm_buddy drm_display_helper cec rc_core i2c_algo_bit hid_sensor_custom hid_sensor_hub hid_generic intel_ishtp_hid hid intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal intel_powerclamp cmdlinepart ee1004 r8153_ecm spi_nor coretemp cdc_ether mei_pxp mei_hdcp usbnet mtd intel_rapl_msr wmi_bmof kvm_intel snd_hda_intel snd_intel_dspcfg processor_thermal_device_pci kvm snd_hda_codec processor_thermal_device irqbypass processor_thermal_wt_hint polyval_clmulni platform_temperature_control snd_hda_core ghash_clmulni_intel processor_thermal_rfim spi_pxa2xx_platform snd_hwdep aesni_intel processor_thermal_rapl dw_dmac snd_pcm dw_dmac_core intel_rapl_common r8152 rapl mii intel_cstate spi_pxa2xx_core i2c_i801 processor_thermal_wt_req snd_timer i2c_mux mei_me intel_ish_ipc processor_thermal_power_floor e1000e snd i2c_smbus spi_intel_pci processor_thermal_mbox mei soundcore intel_ishtp thunderbolt idma64
[117.004733] spi_intel int340x_thermal_zone igen6_edac binfmt_misc intel_skl_int3472_tps68470 intel_pmc_core tps68470_regulator video clk_tps68470 pmt_telemetry pmt_discovery nls_iso8859_1 pmt_class intel_pmc_ssram_telemetry intel_skl_int3472_discrete int3400_thermal intel_hid intel_skl_int3472_common acpi_thermal_rel intel_vsec wmi pinctrl_tigerlake acpi_tad sparse_keymap acpi_pad dm_multipath msr nvme_fabrics fuse efi_pstore nfnetlink autofs4
[117.004782] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004787] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004789] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004793] RIP: 0010:__timer_delete_sync+0x126/0x190
[117.004795] Code: 31 c0 45 31 c9 c3 cc cc cc cc 48 8b 75 d0 45 84 f6 74 63 49 c7 45 18 00 00 00 00 48 89 c7 e8 51 46 39 01 f3 90 e9 66 ff ff ff <0f> 0b e9 5f ff ff ff e8 ee e4 0c 00 49 8d 5d 28 45 31 c9 31 c9 4c
[117.004801] RSP: 0018:ffffc90000003a40 EFLAGS: 00010046
[117.004804] RAX: ffffffff815093fb RBX: ffff888138f86aa8 RCX: 0000000000000000
[117.004807] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004809] RBP: ffffc90000003a70 R08: 0000000000000000 R09: 0000000000000000
[117.004812] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff815093fb
[117.004814] R13: ffff888138f86a80 R14: 0000000000000000 R15: 0000000000000000
[117.004817] FS: 0000000000000000(0000) GS:ffff88890b0f7000(0000) knlGS:0000000000000000
[117.004820] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[117.004823] CR2: 00005db8131eb7f0 CR3: 0000000003448000 CR4: 0000000000f52ef0
[117.004826] PKRU: 55555554
[117.004827] Call Trace:
[117.004829] <IRQ>
[117.004831] timer_delete_sync+0x10/0x20
[117.004833] vgem_fence_release+0x19/0x30 [vgem]
[117.004836] dma_fence_release+0xc1/0x3b0
[117.004838] ? dma_fence_release+0xa1/0x3b0
[117.004841] dma_fence_chain_release+0xe7/0x130
[117.004844] dma_fence_release+0xc1/0x3b0
[117.004847] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004850] dma_fence_chain_irq_work+0x59/0x80
[117.004853] irq_work_single+0x75/0xa0
[117.004857] irq_work_run_list+0x33/0x60
[117.004860] irq_work_run+0x18/0x40
[117.004863] __sysvec_irq_work+0x35/0x170
[117.004865] sysvec_irq_work+0x47/0xc0
[117.004868] asm_sysvec_irq_work+0x1b/0x20
[117.004871] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004874] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004879] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004882] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004884] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004887] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004890] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004892] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004897] dma_fence_signal+0x49/0xb0
[117.004899] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004902] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004904] call_timer_fn+0xa1/0x2a0
[117.004908] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004910] __run_timers+0x231/0x310
[117.004913] ? tmigr_handle_remote+0x2ac/0x560
[117.004917] timer_expire_remote+0x46/0x70
[117.004919] tmigr_handle_remote+0x433/0x560
[117.004923] ? __run_timers+0x239/0x310
[117.004925] ? run_timer_softirq+0x21/0xe0
[117.004928] ? lock_release+0xce/0x2a0
[117.004931] run_timer_softirq+0xcf/0xe0
[117.004933] handle_softirqs+0xd4/0x4d0
[117.004936] __irq_exit_rcu+0x13f/0x160
[117.004938] irq_exit_rcu+0xe/0x20
[117.004940] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004943] </IRQ>
[117.004944] <TASK>
[117.004946] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004949] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004953] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004961] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004963] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004966] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004968] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004971] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004974] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004978] ? cpuidle_enter_state+0x125/0x8a0
[117.004981] ? sched_clock_noinstr+0x9/0x10
[117.004985] cpuidle_enter+0x2e/0x50
[117.004989] call_cpuidle+0x22/0x60
[117.004991] do_idle+0x1fd/0x260
[117.005001] cpu_startup_entry+0x29/0x30
[117.005004] rest_init+0x104/0x200
[117.005008] start_kernel+0x93d/0xbd0
[117.005011] ? load_ucode_intel_bsp+0x2a/0x90
[117.005014] ? sme_unmap_bootdata+0x14/0x80
[117.005017] x86_64_start_reservations+0x18/0x30
[117.005020] x86_64_start_kernel+0xfd/0x150
[117.005023] ? soft_restart_cpu+0x14/0x14
[117.005026] common_startup_64+0x13e/0x141
[117.005030] </TASK>
[117.005032] irq event stamp: 2282669
[117.005034] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.005038] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.005043] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.005047] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.005051] ---[ end trace 0000000000000000 ]---Make the timer IRQ safe.
[1] https://patchwork.freedesktop.org/series/154987/#rev2
--- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vgem/vgem_fence.c +1 -1
@@ -94,7 +94,7 @@ static struct dma_fence *vgem_fence_create(struct vgem_file *vfile,dma_fence_init (&fence->base, &vgem_fence_ops, &fence->lock,dma_fence_context_alloc (1 ),1 ); -timer_setup (&fence->timer, vgem_fence_timeout,0 ); +timer_setup (&fence->timer, vgem_fence_timeout,TIMER_IRQSAFE );/* We force the fence to expire within 10s to prevent driver hangs */ mod_timer (&fence->timer, jiffies +VGEM_FENCE_TIMEOUT );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/634 USB: Fix descriptor count when handling invalid MBIM extended descriptor
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 5570ad1423ee60f6e972dadb63fb2e5f90a54cbe ]
In cdc_parse_cdc_header(), the check for the USB_CDC_MBIM_EXTENDED_TYPE descriptor was using 'break' upon detecting an invalid length.
This was incorrect because 'break' only exits the switch statement, causing the code to fall through to cnt++, thus incorrectly incrementing the count of parsed descriptors for a descriptor that was actually invalid and being discarded.
This patch changes 'break' to 'goto next_desc;' to ensure that the logic skips the counter increment and correctly proceeds to the next descriptor in the buffer. This maintains an accurate count of only the successfully parsed descriptors.
--- drivers/usb/core/message.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/message.c +1 -1
@@ -2386,7 +2386,7 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,break ;case USB_CDC_MBIM_EXTENDED_TYPE :if (elength <sizeof (struct usb_cdc_mbim_extended_desc )) -break ; + goto next_desc; hdr->usb_cdc_mbim_extended_desc = (struct usb_cdc_mbim_extended_desc *)buffer;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/634 clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 62abfd7bedc2b3d86d4209a4146f9d2b5ae21fab ]
R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 583 Figure 9.3.1(a) Software Reset flow (A) as well as flow (B) / (C) indicate after reset has been asserted by writing a matching reset bit into register SRCR, it is mandatory to wait 1ms.
This 1ms delay is documented on R-Car V4H and V4M, it is currently unclear whether S4 is affected as well. This patch does apply the extra delay on R-Car S4 as well.
Fix the reset driver to respect the additional delay when toggling resets. Drivers which use separate reset_control_(de)assert() must assure matching delay in their driver code.
--- drivers/clk/renesas/renesas-cpg-mssr.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/clk/renesas/renesas-cpg-mssr.c +9 -2
@@ -618,8 +618,15 @@ static int cpg_mssr_reset(struct reset_controller_dev *rcdev,/* Reset module */ writel (bitmask, priv->base + priv->reset_regs[reg]); -/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -udelay (35 ); +/* +* On R-Car Gen4, delay after SRCR has been written is 1ms. +* On older SoCs, delay after SRCR has been written is 35us +* (one cycle of the RCLK clock @ ca. 32 kHz). +*/ +if (priv->reg_layout ==CLK_REG_LAYOUT_RCAR_GEN4 ) +usleep_range (1000 ,2000 ); +else +usleep_range (35 ,1000 );/* Release module from reset state */ writel (bitmask, priv->base + priv->reset_clear_regs[reg]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/634 objtool: Fix find_{symbol,func}_containing()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 5da6aea375cde499fdfac3cde4f26df4a840eb9f ]
The current find_{symbol,func}_containing() functions are broken in the face of overlapping symbols, exactly the case that is needed for a new ibt/endbr supression.
Import interval_tree_generic.h into the tools tree and convert the symbol tree to an interval tree to support proper range stabs.
Stable-dep-of: 72567c630d32 ("objtool: Fix weak symbol detection")
--- tools/include/linux/interval_tree_generic.h | 187 ++++++++++++++++++++ tools/objtool/elf.c | 93 +++++----- tools/objtool/include/objtool/elf.h | 3 +- 3 files changed, 229 insertions(+), 54 deletions(-) create mode 100644 tools/include/linux/interval_tree_generic.h
tools/include/linux/interval_tree_generic.h new file +187 -0
@@ -0,0 +1,187 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* +Interval Trees +(C) 2012 Michel Lespinasse <[email protected]> + + +include/linux/interval_tree_generic.h +*/ + +#include <linux/rbtree_augmented.h> + +/* +* Template for implementing interval trees +* +* ITSTRUCT: struct type of the interval tree nodes +* ITRB: name of struct rb_node field within ITSTRUCT +* ITTYPE: type of the interval endpoints +* ITSUBTREE: name of ITTYPE field within ITSTRUCT holding last-in-subtree +* ITSTART(n): start endpoint of ITSTRUCT node n +* ITLAST(n): last endpoint of ITSTRUCT node n +* ITSTATIC: 'static' or empty +* ITPREFIX: prefix to use for the inline tree definitions +* +* Note - before using this, please consider if generic version +* (interval_tree.h) would work for you... +*/ + +#define INTERVAL_TREE_DEFINE (ITSTRUCT ,ITRB ,ITTYPE ,ITSUBTREE , \ +ITSTART ,ITLAST ,ITSTATIC ,ITPREFIX ) \ + \ +/* Callbacks for augmented rbtree insert and remove */ \ + \ +RB_DECLARE_CALLBACKS_MAX(static, ITPREFIX ## _augment, \ + ITSTRUCT, ITRB, ITTYPE, ITSUBTREE, ITLAST) \ + \ +/* Insert / remove interval nodes from the tree */ \ + \ +ITSTATIC void ITPREFIX ## _insert(ITSTRUCT *node, \ +struct rb_root_cached *root) \ +{ \ +struct rb_node **link = &root->rb_root.rb_node, *rb_parent =NULL ; \ +ITTYPE start =ITSTART (node), last =ITLAST (node); \ +ITSTRUCT *parent; \ +bool leftmost = true; \ + \ +while (*link) { \ + rb_parent = *link; \ + parent =rb_entry (rb_parent,ITSTRUCT ,ITRB ); \ +if (parent->ITSUBTREE < last) \ + parent->ITSUBTREE = last; \ +if (start <ITSTART (parent)) \ + link = &parent->ITRB.rb_left; \ +else { \ + link = &parent->ITRB.rb_right; \ + leftmost = false; \ + } \ + } \ + \ + node->ITSUBTREE = last; \ +rb_link_node (&node->ITRB, rb_parent, link); \ +rb_insert_augmented_cached (&node->ITRB, root, \ + leftmost, &ITPREFIX ## _augment); \ +} \ + \ +ITSTATIC void ITPREFIX ## _remove(ITSTRUCT *node, \ +struct rb_root_cached *root) \ +{ \ + rb_erase_augmented_cached(&node->ITRB, root, &ITPREFIX ## _augment); \ +} \ + \ +/* \ +* Iterate over intervals intersecting [start;last] \ +* \ +* Note that a node's interval intersects [start;last] iff: \ +* Cond1: ITSTART(node) <= last \ +* and \ +* Cond2: start <= ITLAST(node) \ +*/ \ + \ +static ITSTRUCT * \ +ITPREFIX ## _subtree_search(ITSTRUCT *node, ITTYPE start, ITTYPE last) \ +{ \ +while (true) { \ +/* \ +* Loop invariant: start <= node->ITSUBTREE \ +* (Cond2 is satisfied by one of the subtree nodes) \ +*/ \ +if (node->ITRB.rb_left) { \ +ITSTRUCT *left =rb_entry (node->ITRB.rb_left, \ +ITSTRUCT ,ITRB ); \ +if (start <= left->ITSUBTREE) { \ +/* \ +* Some nodes in left subtree satisfy Cond2. \ +* Iterate to find the leftmost such node N. \ +* If it also satisfies Cond1, that's the \ +* match we are looking for. Otherwise, there \ +* is no matching interval as nodes to the \ +* right of N can't satisfy Cond1 either. \ +*/ \ + node = left; \ +continue ; \ + } \ + } \ +if (ITSTART (node) <= last) {/* Cond1 */ \ +if (start <=ITLAST (node))/* Cond2 */ \ +return node;/* node is leftmost match */ \ +if (node->ITRB.rb_right) { \ + node =rb_entry (node->ITRB.rb_right, \ +ITSTRUCT ,ITRB ); \ +if (start <= node->ITSUBTREE) \ +continue ; \ + } \ + } \ +return NULL ;/* No match */ \ + } \ +} \ + \ +ITSTATIC ITSTRUCT * \ +ITPREFIX ## _iter_first(struct rb_root_cached *root, \ +ITTYPE start,ITTYPE last) \ +{ \ +ITSTRUCT *node, *leftmost; \ + \ +if (!root->rb_root.rb_node) \ +return NULL ; \ + \ +/* \ +* Fastpath range intersection/overlap between A: [a0, a1] and \ +* B: [b0, b1] is given by: \ +* \ +* a0 <= b1 && b0 <= a1 \ +* \ +* ... where A holds the lock range and B holds the smallest \ +* 'start' and largest 'last' in the tree. For the later, we \ +* rely on the root node, which by augmented interval tree \ +* property, holds the largest value in its last-in-subtree. \ +* This allows mitigating some of the tree walk overhead for \ +* for non-intersecting ranges, maintained and consulted in O(1). \ +*/ \ + node =rb_entry (root->rb_root.rb_node,ITSTRUCT ,ITRB ); \ +if (node->ITSUBTREE < start) \ +return NULL ; \ + \ + leftmost =rb_entry (root->rb_leftmost,ITSTRUCT ,ITRB ); \ +if (ITSTART (leftmost) > last) \ +return NULL ; \ + \ + return ITPREFIX ## _subtree_search(node, start, last); \ +} \ + \ +ITSTATIC ITSTRUCT * \ +ITPREFIX ## _iter_next(ITSTRUCT *node, ITTYPE start, ITTYPE last) \ +{ \ +struct rb_node *rb = node->ITRB.rb_right, *prev; \ + \ +while (true) { \ +/* \ +* Loop invariants: \ +* Cond1: ITSTART(node) <= last \ +* rb == node->ITRB.rb_right \ +* \ +* First, search right subtree if suitable \ +*/ \ +if (rb) { \ +ITSTRUCT *right =rb_entry (rb,ITSTRUCT ,ITRB ); \ +if (start <= right->ITSUBTREE) \ + return ITPREFIX ## _subtree_search(right, \ + start, last); \ + } \ + \ +/* Move up the tree until we come from a node's left child */ \ +do { \ + rb =rb_parent (&node->ITRB); \ +if (!rb) \ +return NULL ; \ + prev = &node->ITRB; \ + node =rb_entry (rb,ITSTRUCT ,ITRB ); \ + rb = node->ITRB.rb_right; \ + }while (prev == rb); \ + \ +/* Check if the node intersects [start;last] */ \ +if (last <ITSTART (node))/* !Cond1 */ \ +return NULL ; \ +else if (start <=ITLAST (node))/* Cond2 */ \ +return node; \ + } \ +}
tools/objtool/elf.c +40 -53
163 lines not on this page · raw message
tools/objtool/include/objtool/elf.h +2 -1
@@ -30,7 +30,7 @@ struct section {struct hlist_node hash;struct hlist_node name_hash;GElf_Shdr sh; -struct rb_root symbol_tree; +struct rb_root_cached symbol_tree;struct list_head symbol_list;struct list_head reloc_list;struct section *base, *reloc;
@@ -53,6 +53,7 @@ struct symbol {unsigned char bind, type;unsigned long offset;unsigned int len; +unsigned long __subtree_last;struct symbol *pfunc, *cfunc, *alias; u8 uaccess_safe : 1; u8 static_call_tramp : 1;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/634 objtool: Fix weak symbol detection
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 72567c630d32bc31f671977f78228c80937ed80e ]
find_symbol_hole_containing() fails to find a symbol hole (aka stripped weak symbol) if its section has no symbols before the hole. This breaks weak symbol detection if -ffunction-sections is enabled.
Fix that by allowing the interval tree to contain section symbols, which are always at offset zero for a given section.
Fixes a bunch of (-ffunction-sections) warnings like:
vmlinux.o: warning: objtool: .text.__x64_sys_io_setup+0x10: unreachable instruction
--- tools/objtool/elf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/objtool/elf.c +4 -4
@@ -74,7 +74,7 @@ struct symbol_hole { };/* -* Find !section symbol where @offset is after it. +* Find the last symbol before @offset. */ static int symbol_hole_by_offset (const void *key,const struct rb_node *node) {
@@ -85,8 +85,7 @@ static int symbol_hole_by_offset(const void *key, const struct rb_node *node)return -1 ;if (sh->key >= s->offset + s->len) { -if (s->type !=STT_SECTION ) - sh->sym = s; + sh->sym = s;return 1 ; }
@@ -369,7 +368,8 @@ static void elf_add_symbol(struct elf *elf, struct symbol *sym) sym->len = sym->sym.st_size;__sym_for_each (iter, &sym->sec->symbol_tree, sym->offset, sym->offset) { -if (iter->offset == sym->offset && iter->type == sym->type) +if (iter->offset == sym->offset && iter->type == sym->type && + iter->len == sym->len) iter->alias = sym; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/634 irqchip/irq-bcm7038-l1: Fix section mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit e9db5332caaf4789ae3bafe72f61ad8e6e0c2d81 ]
Platform drivers can be probed after their init sections have been discarded so the irqchip init callback must not live in init.
--- drivers/irqchip/irq-bcm7038-l1.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/irqchip/irq-bcm7038-l1.c +3 -5
@@ -220,9 +220,8 @@ static int bcm7038_l1_set_affinity(struct irq_data *d, }#endif -static int __init bcm7038_l1_init_one (struct device_node *dn, -unsigned int idx, -struct bcm7038_l1_chip *intc) +static int bcm7038_l1_init_one (struct device_node *dn,unsigned int idx, +struct bcm7038_l1_chip *intc) {struct resource res;resource_size_t sz;
@@ -396,8 +395,7 @@ static const struct irq_domain_ops bcm7038_l1_domain_ops = { .map = bcm7038_l1_map, }; -static int __init bcm7038_l1_of_init (struct device_node *dn, -struct device_node *parent) +static int bcm7038_l1_of_init (struct device_node *dn,struct device_node *parent) {struct bcm7038_l1_chip *intc;int idx, ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/634 irqchip/irq-bcm7120-l2: Fix section mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit bfc0c5beab1fde843677923cf008f41d583c980a ]
Platform drivers can be probed after their init sections have been discarded so the irqchip init callbacks must not live in init.
--- drivers/irqchip/irq-bcm7120-l2.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
drivers/irqchip/irq-bcm7120-l2.c +6 -11
@@ -147,8 +147,7 @@ static int bcm7120_l2_intc_init_one(struct device_node *dn,return 0 ; } -static int __init bcm7120_l2_intc_iomap_7120 (struct device_node *dn, -struct bcm7120_l2_intc_data *data) +static int bcm7120_l2_intc_iomap_7120 (struct device_node *dn,struct bcm7120_l2_intc_data *data) {int ret;
@@ -181,8 +180,7 @@ static int __init bcm7120_l2_intc_iomap_7120(struct device_node *dn,return 0 ; } -static int __init bcm7120_l2_intc_iomap_3380 (struct device_node *dn, -struct bcm7120_l2_intc_data *data) +static int bcm7120_l2_intc_iomap_3380 (struct device_node *dn,struct bcm7120_l2_intc_data *data) {unsigned int gc_idx;
@@ -212,10 +210,9 @@ static int __init bcm7120_l2_intc_iomap_3380(struct device_node *dn,return 0 ; } -static int __init bcm7120_l2_intc_probe (struct device_node *dn, -struct device_node *parent, +static int bcm7120_l2_intc_probe (struct device_node *dn,struct device_node *parent,int (*iomap_regs_fn)(struct device_node *, -struct bcm7120_l2_intc_data *), +struct bcm7120_l2_intc_data *),const char *intc_name) {unsigned int clr =IRQ_NOREQUEST |IRQ_NOPROBE |IRQ_NOAUTOEN ;
@@ -343,15 +340,13 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,return ret; } -static int __init bcm7120_l2_intc_probe_7120 (struct device_node *dn, -struct device_node *parent) +static int bcm7120_l2_intc_probe_7120 (struct device_node *dn,struct device_node *parent) {return bcm7120_l2_intc_probe (dn, parent, bcm7120_l2_intc_iomap_7120,"BCM7120 L2" ); } -static int __init bcm7120_l2_intc_probe_3380 (struct device_node *dn, -struct device_node *parent) +static int bcm7120_l2_intc_probe_3380 (struct device_node *dn,struct device_node *parent) {return bcm7120_l2_intc_probe (dn, parent, bcm7120_l2_intc_iomap_3380,"BCM3380 L2" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/634 irqchip/irq-brcmstb-l2: Fix section mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit bbe1775924478e95372c2f896064ab6446000713 ]
Platform drivers can be probed after their init sections have been discarded so the irqchip init callbacks must not live in init.
--- drivers/irqchip/irq-brcmstb-l2.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/irqchip/irq-brcmstb-l2.c +4 -8
@@ -158,10 +158,8 @@ static void brcmstb_l2_intc_resume(struct irq_data *d)irq_gc_unlock_irqrestore (gc, flags); } -static int __init brcmstb_l2_intc_of_init (struct device_node *np, -struct device_node *parent, -const struct brcmstb_intc_init_params - *init_params) +static int brcmstb_l2_intc_of_init (struct device_node *np,struct device_node *parent, +const struct brcmstb_intc_init_params *init_params) {unsigned int clr =IRQ_NOREQUEST |IRQ_NOPROBE |IRQ_NOAUTOEN ;unsigned int set =0 ;
@@ -277,14 +275,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,return ret; } -static int __init brcmstb_l2_edge_intc_of_init (struct device_node *np, -struct device_node *parent) +static int brcmstb_l2_edge_intc_of_init (struct device_node *np,struct device_node *parent) {return brcmstb_l2_intc_of_init (np, parent, &l2_edge_intc_init); } -static int __init brcmstb_l2_lvl_intc_of_init (struct device_node *np, -struct device_node *parent) +static int brcmstb_l2_lvl_intc_of_init (struct device_node *np,struct device_node *parent) {return brcmstb_l2_intc_of_init (np, parent, &l2_lvl_intc_init); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/634 irqchip/imx-mu-msi: Fix section mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 64acfd8e680ff8992c101fe19aadb112ce551072 ]
Platform drivers can be probed after their init sections have been discarded so the irqchip init callbacks must not live in init.
--- drivers/irqchip/irq-imx-mu-msi.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/irqchip/irq-imx-mu-msi.c +5 -9
@@ -303,9 +303,8 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = { }, }; -static int __init imx_mu_of_init (struct device_node *dn, -struct device_node *parent, -const struct imx_mu_dcfg *cfg) +static int imx_mu_of_init (struct device_node *dn,struct device_node *parent, +const struct imx_mu_dcfg *cfg) {struct platform_device *pdev =of_find_device_by_node (dn);struct device_link *pd_link_a;
@@ -423,20 +422,17 @@ static const struct dev_pm_ops imx_mu_pm_ops = { imx_mu_runtime_resume, NULL) }; -static int __init imx_mu_imx7ulp_of_init (struct device_node *dn, -struct device_node *parent) +static int imx_mu_imx7ulp_of_init (struct device_node *dn,struct device_node *parent) {return imx_mu_of_init (dn, parent, &imx_mu_cfg_imx7ulp); } -static int __init imx_mu_imx6sx_of_init (struct device_node *dn, -struct device_node *parent) +static int imx_mu_imx6sx_of_init (struct device_node *dn,struct device_node *parent) {return imx_mu_of_init (dn, parent, &imx_mu_cfg_imx6sx); } -static int __init imx_mu_imx8ulp_of_init (struct device_node *dn, -struct device_node *parent) +static int imx_mu_imx8ulp_of_init (struct device_node *dn,struct device_node *parent) {return imx_mu_of_init (dn, parent, &imx_mu_cfg_imx8ulp); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/634 irqchip/qcom-irq-combiner: Fix section mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 9b685058ca936752285c5520d351b828312ac965 ]
Platform drivers can be probed after their init sections have been discarded so the probe callback must not live in init.
--- drivers/irqchip/qcom-irq-combiner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/qcom-irq-combiner.c +1 -1
@@ -222,7 +222,7 @@ static int get_registers(struct platform_device *pdev, struct combiner *comb)return 0 ; } -static int __init combiner_probe (struct platform_device *pdev) +static int combiner_probe (struct platform_device *pdev) {struct combiner *combiner;int nregs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/634 ntfs3: fix uninit memory after failed mi_read in mi_format_new
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <[email protected]>
[ Upstream commit 73e6b9dacf72a1e7a4265eacca46f8f33e0997d6 ]
Fix a KMSAN un-init bug found by syzkaller.
ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be uptodate. We do not bring the buffer uptodate before setting it as uptodate. If the buffer were to not be uptodate, it could mean adding a buffer with un-init data to the mi record. Attempting to load that record will trigger KMSAN.
Avoid this by setting the buffer as uptodate, if it’s not already, by overwriting it.
--- fs/ntfs3/fsntfs.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/ntfs3/fsntfs.c +8 -1
@@ -1338,7 +1338,14 @@ int ntfs_get_bh(struct ntfs_sb_info *sbi, const struct runs_tree *run, u64 vbo, }if (buffer_locked (bh))__wait_on_buffer (bh); -set_buffer_uptodate (bh); + +lock_buffer (bh); +if (!buffer_uptodate (bh)) + { +memset (bh->b_data,0 , blocksize); +set_buffer_uptodate (bh); + } +unlock_buffer (bh); }else { bh =ntfs_bread (sb, block);if (!bh) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/634 ntfs3: Fix uninit buffer allocated by __getname()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidharth Seela <[email protected]>
[ Upstream commit 9948dcb2f7b5a1bf8e8710eafaf6016e00be3ad6 ]
Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.
--- fs/ntfs3/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/inode.c +1 -0
@@ -1700,6 +1700,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) de =__getname ();if (!de)return -ENOMEM ; +memset (de,0 ,PATH_MAX );/* Mark rw ntfs as dirty. It will be cleared at umount. */ ntfs_set_state (sbi,NTFS_DIRTY_DIRTY );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/634 rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit 9c4609225ec1cb551006d6a03c7c4ad8cb5584c0 ]
Add two functions to atomically replace RCU-protected hlist_nulls entries.
Keep using WRITE_ONCE() to assign values to ->next and ->pprev, as mentioned in the patch below:
commit efd04f8a8b45 ("rcu: Use WRITE_ONCE() for assignments to ->next for rculist_nulls")
commit 860c8802ace1 ("rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls")
Stable-dep-of: 1532ed0d0753 ("inet: Avoid ehash lookup race in inet_ehash_insert()")
--- include/linux/rculist_nulls.h | 59 +++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+)
include/linux/rculist_nulls.h +59 -0
@@ -52,6 +52,13 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)#define hlist_nulls_next_rcu (node) \ (*((struct hlist_nulls_node __rcu __force **)&(node)->next)) +/** +* hlist_nulls_pprev_rcu - returns the dereferenced pprev of @node. +* @node: element of the list. +*/ +#define hlist_nulls_pprev_rcu (node) \ + (*((struct hlist_nulls_node __rcu __force **)(node)->pprev)) +/** * hlist_nulls_del_rcu - deletes entry from hash list without re-initialization * @n: the element to delete from the hash list.
@@ -152,6 +159,58 @@ static inline void hlist_nulls_add_fake(struct hlist_nulls_node *n) n->next = (struct hlist_nulls_node *)NULLS_MARKER (NULL ); } +/** +* hlist_nulls_replace_rcu - replace an old entry by a new one +* @old: the element to be replaced +* @new: the new element to insert +* +* Description: +* Replace the old entry with the new one in a RCU-protected hlist_nulls, while +* permitting racing traversals. +* +* The caller must take whatever precautions are necessary (such as holding +* appropriate locks) to avoid racing with another list-mutation primitive, such +* as hlist_nulls_add_head_rcu() or hlist_nulls_del_rcu(), running on this same +* list. However, it is perfectly legal to run concurrently with the _rcu +* list-traversal primitives, such as hlist_nulls_for_each_entry_rcu(). +*/ +static inline void hlist_nulls_replace_rcu (struct hlist_nulls_node *old, +struct hlist_nulls_node *new) +{ +struct hlist_nulls_node *next = old->next; + +WRITE_ONCE (new->next, next); +WRITE_ONCE (new->pprev, old->pprev); +rcu_assign_pointer (hlist_nulls_pprev_rcu (new), new); +if (!is_a_nulls (next)) +WRITE_ONCE (next->pprev, &new->next); +} + +/** +* hlist_nulls_replace_init_rcu - replace an old entry by a new one and +* initialize the old +* @old: the element to be replaced +* @new: the new element to insert +* +* Description: +* Replace the old entry with the new one in a RCU-protected hlist_nulls, while +* permitting racing traversals, and reinitialize the old entry. +* +* Note: @old must be hashed. +* +* The caller must take whatever precautions are necessary (such as holding +* appropriate locks) to avoid racing with another list-mutation primitive, such +* as hlist_nulls_add_head_rcu() or hlist_nulls_del_rcu(), running on this same +* list. However, it is perfectly legal to run concurrently with the _rcu +* list-traversal primitives, such as hlist_nulls_for_each_entry_rcu(). +*/ +static inline void hlist_nulls_replace_init_rcu (struct hlist_nulls_node *old, +struct hlist_nulls_node *new) +{ +hlist_nulls_replace_rcu (old, new); +WRITE_ONCE (old->pprev,NULL ); +} +/** * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type * @tpos: the type * to use as a loop cursor.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/634 inet: Avoid ehash lookup race in inet_ehash_insert()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit 1532ed0d0753c83e72595f785f82b48c28bbe5dc ]
Since ehash lookups are lockless, if one CPU performs a lookup while another concurrently deletes and inserts (removing reqsk and inserting sk), the lookup may fail to find the socket, an RST may be sent.
The call trace map is drawn as follows:
CPU 0 CPU 1
----- -----
inet_ehash_insert()
spin_lock()
sk_nulls_del_node_init_rcu(osk)
__inet_lookup_established()
(lookup failed)
__sk_nulls_add_node_rcu(sk, list)
spin_unlock()As both deletion and insertion operate on the same ehash chain, this patch introduces a new sk_nulls_replace_node_init_rcu() helper functions to implement atomic replacement.
--- include/net/sock.h | 13 +++++++++++++ net/ipv4/inet_hashtables.c | 8 ++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)
include/net/sock.h +13 -0
@@ -821,6 +821,19 @@ static inline bool sk_nulls_del_node_init_rcu(struct sock *sk)return rc; } +static inline bool sk_nulls_replace_node_init_rcu (struct sock *old, +struct sock *new) +{ +if (sk_hashed (old)) { +hlist_nulls_replace_init_rcu (&old->sk_nulls_node, + &new->sk_nulls_node); +__sock_put (old); +return true; + } + +return false; +} +static inline void __sk_add_node (struct sock *sk,struct hlist_head *list) {hlist_add_head (&sk->sk_node, list);
net/ipv4/inet_hashtables.c +6 -2
@@ -663,8 +663,11 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)spin_lock (lock);if (osk) {WARN_ON_ONCE (sk->sk_hash != osk->sk_hash); - ret =sk_nulls_del_node_init_rcu (osk); - }else if (found_dup_sk) { + ret =sk_nulls_replace_node_init_rcu (osk, sk); + goto unlock; + } + +if (found_dup_sk) { *found_dup_sk =inet_ehash_lookup_by_sk (sk, list);if (*found_dup_sk) ret = false;
@@ -673,6 +676,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)if (ret)__sk_nulls_add_node_rcu (sk, list); +unlock:spin_unlock (lock);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/634 arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
[ Upstream commit d949b8d12d6e8fa119bca10d3157cd42e810f6f7 ]
The SDHC1 interface is not used on the imx8mm-venice-gw72xx. Remove the unused pinctrl_usdhc1 iomux node.
--- .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 ----------- 1 file changed, 11 deletions(-)
arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi +0 -11
@@ -338,17 +338,6 @@ MX8MM_IOMUXC_UART4_TXD_UART4_DCE_TX 0x140 >; }; - pinctrl_usdhc1: usdhc1grp { - fsl,pins = < - MX8MM_IOMUXC_SD1_CLK_USDHC1_CLK 0x190 - MX8MM_IOMUXC_SD1_CMD_USDHC1_CMD 0x1d0 - MX8MM_IOMUXC_SD1_DATA0_USDHC1_DATA0 0x1d0 - MX8MM_IOMUXC_SD1_DATA1_USDHC1_DATA1 0x1d0 - MX8MM_IOMUXC_SD1_DATA2_USDHC1_DATA2 0x1d0 - MX8MM_IOMUXC_SD1_DATA3_USDHC1_DATA3 0x1d0 - >; - }; - pinctrl_usdhc2: usdhc2grp { fsl,pins = < MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x190
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/634 uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <[email protected]>
[ Upstream commit d48fb15e6ad142e0577428a8c5028136e10c7b3d ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- drivers/uio/uio_fsl_elbc_gpcm.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/uio/uio_fsl_elbc_gpcm.c +7 -0
@@ -384,6 +384,11 @@ static int uio_fsl_elbc_gpcm_probe(struct platform_device *pdev)/* set all UIO data */ info->mem[0 ].name =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%pOFn" , node); +if (!info->mem[0 ].name) { + ret = -ENODEV ; + goto out_err3; + } + info->mem[0 ].addr = res.start; info->mem[0 ].size =resource_size (&res); info->mem[0 ].memtype =UIO_MEM_PHYS ;
@@ -423,6 +428,8 @@ static int uio_fsl_elbc_gpcm_probe(struct platform_device *pdev) out_err2:if (priv->shutdown) priv->shutdown (info, true); + +out_err3:iounmap (info->mem[0 ].internal_addr);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/634 crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit df0845cf447ae1556c3440b8b155de0926cbaa56 ]
Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc.
--- crypto/asymmetric_keys/asymmetric_type.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
crypto/asymmetric_keys/asymmetric_type.c +10 -4
@@ -11,6 +11,7 @@#include <crypto/public_key.h> #include <linux/seq_file.h> #include <linux/module.h> +#include <linux/overflow.h> #include <linux/slab.h> #include <linux/ctype.h> #include <keys/system_keyring.h>
@@ -152,12 +153,17 @@ struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1, size_t len_2) {struct asymmetric_key_id *kid; - - kid =kmalloc (sizeof (struct asymmetric_key_id ) + len_1 + len_2, -GFP_KERNEL ); +size_t kid_sz; +size_t len; + +if (check_add_overflow (len_1, len_2, &len)) +return ERR_PTR (-EOVERFLOW ); +if (check_add_overflow (sizeof (struct asymmetric_key_id ), len, &kid_sz)) +return ERR_PTR (-EOVERFLOW ); + kid =kmalloc (kid_sz,GFP_KERNEL );if (!kid)return ERR_PTR (-ENOMEM ); - kid->len = len_1 + len_2; + kid->len = len;memcpy (kid->data, val_1, len_1);memcpy (kid->data + len_1, val_2, len_2);return kid;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/634 crypto: hisilicon/qm - restore original qos values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: nieweiqiang <[email protected]>
[ Upstream commit e7066160f5b4187ad9869b712fa7a35d3d5be6b9 ]
When the new qos valus setting fails, restore to the original qos values.
--- drivers/crypto/hisilicon/qm.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/crypto/hisilicon/qm.c +13 -1
@@ -3450,6 +3450,7 @@ static int qm_clear_vft_config(struct hisi_qm *qm)static int qm_func_shaper_enable (struct hisi_qm *qm,u32 fun_index,u32 qos) {struct device *dev = &qm->pdev->dev; +struct qm_shaper_factor t_factor;u32 ir = qos *QM_QOS_RATE ;int ret, total_vfs, i;
@@ -3457,6 +3458,7 @@ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos)if (fun_index > total_vfs)return -EINVAL ; +memcpy (&t_factor, &qm->factor[fun_index],sizeof (t_factor)); qm->factor[fun_index].func_qos = qos; ret =qm_get_shaper_para (ir, &qm->factor[fun_index]);
@@ -3470,11 +3472,21 @@ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos) ret =qm_set_vft_common (qm,SHAPER_VFT , fun_index, i,1 );if (ret) {dev_err (dev,"type: %d, failed to set shaper vft!\n" , i); -return -EINVAL ; + goto back_func_qos; } }return 0 ; + +back_func_qos: +memcpy (&qm->factor[fun_index], &t_factor,sizeof (t_factor)); +for (i--; i >=ALG_TYPE_0 ; i--) { + ret =qm_set_vft_common (qm,SHAPER_VFT , fun_index, i,1 ); +if (ret) +dev_err (dev,"failed to restore shaper vft during rollback!\n" ); + } + +return -EINVAL ; }static u32 qm_get_shaper_vft_qos (struct hisi_qm *qm,u32 fun_index)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/634 wifi: ath11k: fix peer HE MCS assignment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 4a013ca2d490c73c40588d62712ffaa432046a04 ]
In ath11k_wmi_send_peer_assoc_cmd(), peer's transmit MCS is sent to firmware as receive MCS while peer's receive MCS sent as transmit MCS, which goes against firmwire's definition.
While connecting to a misbehaved AP that advertises 0xffff (meaning not supported) for 160 MHz transmit MCS map, firmware crashes due to 0xffff is assigned to he_mcs->rx_mcs_set field.
Ext Tag: HE Capabilities [...] Supported HE-MCS and NSS Set [...] Rx and Tx MCS Maps 160 MHz [...] Tx HE-MCS Map 160 MHz: 0xffff
Swap the assignment to fix this issue.
As the HE rate control mask is meant to limit our own transmit MCS, it needs to go via he_mcs->rx_mcs_set field. With the aforementioned swapping done, change is needed as well to apply it to the peer's receive MCS.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/mac.c | 4 ++-- drivers/net/wireless/ath/ath11k/wmi.c | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +2 -2
@@ -2243,10 +2243,10 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, he_tx_mcs = v; } v =le16_to_cpu (he_cap->he_mcs_nss_supp.rx_mcs_160); + v =ath11k_peer_assoc_h_he_limit (v, he_mcs_mask); arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160 ] = v; v =le16_to_cpu (he_cap->he_mcs_nss_supp.tx_mcs_160); - v =ath11k_peer_assoc_h_he_limit (v, he_mcs_mask); arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160 ] = v; arg->peer_he_mcs_count++;
@@ -2256,10 +2256,10 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar,default : v =le16_to_cpu (he_cap->he_mcs_nss_supp.rx_mcs_80); + v =ath11k_peer_assoc_h_he_limit (v, he_mcs_mask); arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80 ] = v; v =le16_to_cpu (he_cap->he_mcs_nss_supp.tx_mcs_80); - v =ath11k_peer_assoc_h_he_limit (v, he_mcs_mask); arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80 ] = v; arg->peer_he_mcs_count++;
drivers/net/wireless/ath/ath11k/wmi.c +5 -2
@@ -2013,8 +2013,11 @@ int ath11k_wmi_send_peer_assoc_cmd(struct ath11k *ar,FIELD_PREP (WMI_TLV_LEN ,sizeof (*he_mcs) -TLV_HDR_SIZE ); - he_mcs->rx_mcs_set = param->peer_he_tx_mcs_set[i]; - he_mcs->tx_mcs_set = param->peer_he_rx_mcs_set[i]; +/* firmware interprets mcs->rx_mcs_set field as peer's +* RX capability +*/ + he_mcs->rx_mcs_set = param->peer_he_rx_mcs_set[i]; + he_mcs->tx_mcs_set = param->peer_he_tx_mcs_set[i]; ptr +=sizeof (*he_mcs); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/634 s390/smp: Fix fallback CPU detection
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 07a75d08cfa1b883a6e1256666e5f0617ee99231 ]
In case SCLP CPU detection does not work a fallback mechanism using SIGP is in place. Since a cleanup this does not work correctly anymore: new CPUs are only considered if their type matches the boot CPU.
Before the cleanup the information if a CPU type should be considered was also part of a structure generated by the fallback mechanism and indicated that a CPU type should not be considered when adding CPUs.
Since the rework a global SCLP state is used instead. If the global SCLP state indicates that the CPU type should be considered and the fallback mechanism is used, there may be a mismatch with CPU types if CPUs are added. This can lead to a system with only a single CPU even tough there are many more CPUs.
Address this by simply copying the boot cpu type into the generated data structure from the fallback mechanism.
--- arch/s390/kernel/smp.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/smp.c +1 -0
@@ -758,6 +758,7 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early)continue ; info->core[info->configured].core_id = address >> smp_cpu_mt_shift; + info->core[info->configured].type = boot_core_type; info->configured++; } info->combined = info->configured;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/634 s390/ap: Dont leak debug feature files if AP instructions are not available
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 020d5dc57874e58d3ebae398f3fe258f029e3d06 ]
If no AP instructions are available the AP bus module leaks registered debug feature files. Change function call order to fix this.
--- drivers/s390/crypto/ap_bus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/s390/crypto/ap_bus.c +4 -4
@@ -2196,15 +2196,15 @@ static int __init ap_module_init(void) {int rc; - rc =ap_debug_init (); -if (rc) -return rc; -if (!ap_instructions_available ()) {pr_warn ("The hardware system does not support AP instructions\n" );return -ENODEV ; } + rc =ap_debug_init (); +if (rc) +return rc; +/* init ap_queue hashtable */ hash_init (ap_queues);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/634 firmware: imx: scu-irq: fix OF node leak in
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit ee67247843a2b62d1473cfa4df300e69b5190ccf ]
imx_scu_enable_general_irq_channel() calls of_parse_phandle_with_args(), but does not release the OF node reference. Add a of_node_put() call to release the reference.
--- drivers/firmware/imx/imx-scu-irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/imx/imx-scu-irq.c +3 -1
@@ -160,8 +160,10 @@ int imx_scu_enable_general_irq_channel(struct device *dev)INIT_WORK (&imx_sc_irq_work, imx_scu_irq_work_handler);if (!of_parse_phandle_with_args (dev->of_node,"mboxes" , -"#mbox-cells" ,0 , &spec)) +"#mbox-cells" ,0 , &spec)) { i =of_alias_get_id (spec.np,"mu" ); +of_node_put (spec.np); + }/* use mu1 as general mu irq channel if failed */ if (i <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/634 phy: mscc: Fix PTP for VSC8574 and VSC8572
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit ea5df88aeca112aac69e6c32e3dd1433a113b0c9 ]
The PTP initialization is two-step. First part are the function vsc8584_ptp_probe_once() and vsc8584_ptp_probe() at probe time which initialize the locks, queues, creates the PTP device. The second part is the function vsc8584_ptp_init() at config_init() time which initialize PTP in the HW.
For VSC8574 and VSC8572, the PTP initialization is incomplete. It is missing the first part but it makes the second part. Meaning that the ptp_clock_register() is never called.
There is no crash without the first part when enabling PTP but this is unexpected because some PHys have PTP functionality exposed by the driver and some don't even though they share the same PTP clock PTP.
--- drivers/net/phy/mscc/mscc_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/phy/mscc/mscc_main.c +3 -3
@@ -2560,7 +2560,7 @@ static struct phy_driver vsc85xx_driver[] = { .suspend = &genphy_suspend, .resume = &genphy_resume, .remove = &vsc85xx_remove, - .probe = &vsc8574_probe, + .probe = &vsc8584_probe, .set_wol = &vsc85xx_wol_set, .get_wol = &vsc85xx_wol_get, .get_tunable = &vsc85xx_get_tunable,
@@ -2581,12 +2581,12 @@ static struct phy_driver vsc85xx_driver[] = { .config_aneg = &vsc85xx_config_aneg, .aneg_done = &genphy_aneg_done, .read_status = &vsc85xx_read_status, - .handle_interrupt = vsc85xx_handle_interrupt, + .handle_interrupt = vsc8584_handle_interrupt, .config_intr = &vsc85xx_config_intr, .suspend = &genphy_suspend, .resume = &genphy_resume, .remove = &vsc85xx_remove, - .probe = &vsc8574_probe, + .probe = &vsc8584_probe, .set_wol = &vsc85xx_wol_set, .get_wol = &vsc85xx_wol_get, .get_tunable = &vsc85xx_get_tunable,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/634 sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 622e8838a29845316668ec2e7648428878df7f9a ]
SCTP_DBG_OBJCNT_INC() is called only when sctp_init_sock() returns 0 after successfully allocating sctp_sk(sk)->ep.
OTOH, SCTP_DBG_OBJCNT_DEC() is called in sctp_close().
The code seems to expect that the socket is always exposed to userspace once SCTP_DBG_OBJCNT_INC() is incremented, but there is a path where the assumption is not true.
In sctp_accept(), sctp_sock_migrate() could fail after sctp_init_sock().
Then, sk_common_release() does not call inet_release() nor sctp_close(). Instead, it calls sk->sk_prot->destroy().
Let's move SCTP_DBG_OBJCNT_DEC() from sctp_close() to sctp_destroy_sock().
--- net/sctp/socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sctp/socket.c +3 -2
@@ -1552,8 +1552,6 @@ static void sctp_close(struct sock *sk, long timeout)spin_unlock_bh (&net->sctp.addr_wq_lock);sock_put (sk); - -SCTP_DBG_OBJCNT_DEC (sock); }/* Handle EPIPE error. */
@@ -5105,9 +5103,12 @@ static void sctp_destroy_sock(struct sock *sk) sp->do_auto_asconf =0 ;list_del (&sp->auto_asconf_list); } +sctp_endpoint_free (sp->ep); +sk_sockets_allocated_dec (sk);sock_prot_inuse_add (sock_net (sk), sk->sk_prot,-1 ); +SCTP_DBG_OBJCNT_DEC (sock); }/* Triggered when there are no references on the socket anymore */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/634 x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit ced37e9ceae50e4cb6cd058963bd315ec9afa651 ]
When triggering a stack dump via sysrq (echo t > /proc/sysrq-trigger), KASAN may report false-positive out-of-bounds access:
BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
Call Trace:
dump_stack_lvl
print_address_description.constprop.0
print_report
__show_regs
show_trace_log_lvl
sched_show_task
show_state_filter
sysrq_handle_showstate
__handle_sysrq
write_sysrq_trigger
proc_reg_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframeThe issue occurs as follows:
Task A (walk other tasks' stacks) Task B (running)
1. echo t > /proc/sysrq-trigger
show_trace_log_lvl
regs = unwind_get_entry_regs()
show_regs_if_on_stack(regs)
2. The stack value pointed by regs keeps changing, and so are the tags in its KASAN shadow region.
__show_regs(regs)
regs->ax, regs->bx, ...
3. hit KASAN redzones, OOB
When task A walks task B's stack without suspending it, the continuous changes in task B's stack (and corresponding KASAN shadow tags) may cause task A to hit KASAN redzones when accessing obsolete values on the stack, resulting in false positive reports.
Simply stopping the task before unwinding is not a viable fix, as it would alter the state intended to inspect. This is especially true for diagnosing misbehaving tasks (e.g., in a hard lockup), where stopping might fail or hide the root cause by changing the call stack.
Therefore, fix this by disabling KASAN checks during asynchronous stack unwinding, which is identified when the unwinding task does not match the current task (task != current).
[ bp: Align arguments on function's opening brace. ]
--- arch/x86/kernel/dumpstack.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
arch/x86/kernel/dumpstack.c +21 -2
@@ -183,8 +183,8 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,* in false positive reports. Disable instrumentation to avoid those. */ __no_kmsan_checks -static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, -unsigned long *stack,const char *log_lvl) +static void __show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, +unsigned long *stack,const char *log_lvl) {struct unwind_state state;struct stack_info stack_info = {0 };
@@ -305,6 +305,25 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, } } +static void show_trace_log_lvl (struct task_struct *task,struct pt_regs *regs, +unsigned long *stack,const char *log_lvl) +{ +/* +* Disable KASAN to avoid false positives during walking another +* task's stacks, as values on these stacks may change concurrently +* with task execution. +*/ +bool disable_kasan = task && task != current; + +if (disable_kasan) +kasan_disable_current (); + +__show_trace_log_lvl (task, regs, stack, log_lvl); + +if (disable_kasan) +kasan_enable_current (); +} +void show_stack (struct task_struct *task,unsigned long *sp,const char *loglvl) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/634 tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit c485ca3aff2442adea4c08ceb5183e671ebed22a ]
There is no errno variable when NOLIBC_IGNORE_ERRNO is defined. As such, simply print the message with "unknown error" rather than the integer value of errno.
--- tools/include/nolibc/stdio.h | 4 ++++ 1 file changed, 4 insertions(+)
tools/include/nolibc/stdio.h +4 -0
@@ -300,7 +300,11 @@ int printf(const char *fmt, ...)static __attribute__((unused))void perror (const char *msg) { +#ifdef NOLIBC_IGNORE_ERRNO +fprintf (stderr,"%s%sunknown error\n" , (msg && *msg) ? msg :"" , (msg && *msg) ?": " :"" ); +#else fprintf (stderr,"%s%serrno=%d\n" , (msg && *msg) ? msg :"" , (msg && *msg) ?": " :"" , errno); +#endif }/* make sure to include all global symbols */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/634 soc: qcom: smem: fix hwspinlock resource leak in probe error paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit dc5db35073a19f6d3c30bea367b551c1a784ef8f ]
The hwspinlock acquired via hwspin_lock_request_specific() is not released on several error paths. This results in resource leakage when probe fails.
Switch to devm_hwspin_lock_request_specific() to automatically handle cleanup on probe failure. Remove the manual hwspin_lock_free() in qcom_smem_remove() as devm handles it automatically.
--- drivers/soc/qcom/smem.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/soc/qcom/smem.c +1 -2
@@ -1105,7 +1105,7 @@ static int qcom_smem_probe(struct platform_device *pdev)return hwlock_id; } - smem->hwlock =hwspin_lock_request_specific (hwlock_id); + smem->hwlock =devm_hwspin_lock_request_specific (&pdev->dev, hwlock_id);if (!smem->hwlock)return -ENXIO ;
@@ -1158,7 +1158,6 @@ static int qcom_smem_remove(struct platform_device *pdev) {platform_device_unregister (__smem->socinfo); -hwspin_lock_free (__smem->hwlock); __smem =NULL ;return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/634 pinctrl: stm32: fix hwspinlock resource leak in probe function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 002679f79ed605e543fbace465557317cd307c9a ]
In stm32_pctl_probe(), hwspin_lock_request_specific() is called to request a hwspinlock, but the acquired lock is not freed on multiple error paths after this call. This causes resource leakage when the function fails to initialize properly.
Use devm_hwspin_lock_request_specific() instead of hwspin_lock_request_specific() to automatically manage the hwspinlock resource lifecycle.
--- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/stm32/pinctrl-stm32.c +1 -1
@@ -1554,7 +1554,7 @@ int stm32_pctl_probe(struct platform_device *pdev)if (hwlock_id == -EPROBE_DEFER )return hwlock_id; }else { - pctl->hwlock =hwspin_lock_request_specific (hwlock_id); + pctl->hwlock =devm_hwspin_lock_request_specific (dev, hwlock_id); }spin_lock_init (&pctl->irqmux_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/634 i3c: Allow OF-alias-based persistent bus numbering
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Kerr <[email protected]>
[ Upstream commit 7dc2e0a875645a79f5c1c063019397e8e94008f5 ]
Parse the /aliases node to assign any fixed bus numbers, as is done with the i2c subsystem. Numbering for non-aliased busses will start after the highest fixed bus number.
This allows an alias node such as:
aliases {
i3c0 = &bus_a,
i3c4 = &bus_b,
};to set the numbering for a set of i3c controllers:
/* fixed-numbered bus, assigned "i3c-0" */
bus_a: i3c-master {
};
/* another fixed-numbered bus, assigned "i3c-4" */
bus_b: i3c-master {
};
/* dynamic-numbered bus, likely assigned "i3c-5" */
bus_c: i3c-master {
};If no i3c device aliases are present, the numbering will stay as-is, starting from 0.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-)
drivers/i3c/master.c +25 -5
@@ -21,6 +21,7 @@static DEFINE_IDR (i3c_bus_idr);static DEFINE_MUTEX (i3c_core_lock); +static int __i3c_first_dynamic_bus_num;/** * i3c_bus_maintenance_lock - Lock the bus for a maintenance operation
@@ -462,9 +463,9 @@ static void i3c_bus_cleanup(struct i3c_bus *i3cbus)mutex_unlock (&i3c_core_lock); } -static int i3c_bus_init (struct i3c_bus *i3cbus) +static int i3c_bus_init (struct i3c_bus *i3cbus,struct device_node *np) { -int ret; +int ret, start, end, id =-1 ;init_rwsem (&i3cbus->lock);INIT_LIST_HEAD (&i3cbus->devs.i2c);
@@ -472,8 +473,19 @@ static int i3c_bus_init(struct i3c_bus *i3cbus)i3c_bus_init_addrslots (i3cbus); i3cbus->mode =I3C_BUS_MODE_PURE ; +if (np) + id =of_alias_get_id (np,"i3c" ); +mutex_lock (&i3c_core_lock); - ret =idr_alloc (&i3c_bus_idr, i3cbus,0 ,0 ,GFP_KERNEL ); +if (id >=0 ) { + start = id; + end = start +1 ; + }else { + start = __i3c_first_dynamic_bus_num; + end =0 ; + } + + ret =idr_alloc (&i3c_bus_idr, i3cbus, start, end,GFP_KERNEL );mutex_unlock (&i3c_core_lock);if (ret <0 )
@@ -2751,7 +2763,7 @@ int i3c_master_register(struct i3c_master_controller *master,INIT_LIST_HEAD (&master->boardinfo.i2c);INIT_LIST_HEAD (&master->boardinfo.i3c); - ret =i3c_bus_init (i3cbus); + ret =i3c_bus_init (i3cbus, master->dev.of_node);if (ret)return ret;
@@ -2956,8 +2968,16 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)static int __init i3c_init (void ) { -int res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier); +int res; + + res =of_alias_get_highest_id ("i3c" ); +if (res >=0 ) { +mutex_lock (&i3c_core_lock); + __i3c_first_dynamic_bus_num = res +1 ; +mutex_unlock (&i3c_core_lock); + } + res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier);if (res)return res;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/634 i3c: master: Inherit DMA masks and parameters from parent device
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit 0c35691551387e060e6ae7a6652b4101270c73cf ]
Copy the DMA masks and parameters for an I3C master device from parent device so that the master device has them set for the DMA buffer and mapping API.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i3c/master.c +4 -0
@@ -2770,6 +2770,10 @@ int i3c_master_register(struct i3c_master_controller *master,device_initialize (&master->dev);dev_set_name (&master->dev,"i3c-%d" , i3cbus->id); + master->dev.dma_mask = parent->dma_mask; + master->dev.coherent_dma_mask = parent->coherent_dma_mask; + master->dev.dma_parms = parent->dma_parms; + ret =of_populate_i3c_bus (master);if (ret) goto err_put_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/634 i3c: fix refcount inconsistency in i3c_master_register
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 9d4f219807d5ac11fb1d596e4ddb09336b040067 ]
In i3c_master_register, a possible refcount inconsistency has been identified, causing possible resource leak.
Function of_node_get increases the refcount of parent->of_node. If function i3c_bus_init fails, the function returns immediately without a corresponding decrease, resulting in an inconsistent refcounter.
Move call i3c_bus_init() after device_initialize() to let callback i3c_masterdev_release() release of_node.
--- drivers/i3c/master.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i3c/master.c +4 -4
@@ -2763,10 +2763,6 @@ int i3c_master_register(struct i3c_master_controller *master,INIT_LIST_HEAD (&master->boardinfo.i2c);INIT_LIST_HEAD (&master->boardinfo.i3c); - ret =i3c_bus_init (i3cbus, master->dev.of_node); -if (ret) -return ret; -device_initialize (&master->dev);dev_set_name (&master->dev,"i3c-%d" , i3cbus->id);
@@ -2774,6 +2770,10 @@ int i3c_master_register(struct i3c_master_controller *master, master->dev.coherent_dma_mask = parent->coherent_dma_mask; master->dev.dma_parms = parent->dma_parms; + ret =i3c_bus_init (i3cbus, master->dev.of_node); +if (ret) + goto err_put_dev; + ret =of_populate_i3c_bus (master);if (ret) goto err_put_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/634 i3c: master: svc: Prevent incomplete IBI transaction
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <[email protected]>
[ Upstream commit 3a36273e5a07dda0ccec193800f3b78c3c0380af ]
If no free IBI slot is available, svc_i3c_master_handle_ibi returns immediately. This causes the STOP condition to be missed because the EmitStop request is sent when the transfer is not complete. To resolve this, svc_i3c_master_handle_ibi must wait for the transfer to complete before returning.
--- drivers/i3c/master/svc-i3c-master.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/i3c/master/svc-i3c-master.c +14 -8
@@ -350,21 +350,27 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,int ret, val;u8 *buf; - slot =i3c_generic_ibi_get_free_slot (data->ibi_pool); -if (!slot) -return -ENOSPC ; - - slot->len =0 ; - buf = slot->data; - +/* +* Wait for transfer to complete before returning. Otherwise, the EmitStop +* request might be sent when the transfer is not complete. +*/ ret =readl_relaxed_poll_timeout (master->regs +SVC_I3C_MSTATUS , val,SVC_I3C_MSTATUS_COMPLETE (val),0 ,1000 );if (ret) {dev_err (master->dev,"Timeout when polling for COMPLETE\n" ); -i3c_generic_ibi_recycle_slot (data->ibi_pool, slot);return ret; } + slot =i3c_generic_ibi_get_free_slot (data->ibi_pool); +if (!slot) { +dev_dbg (master->dev,"No free ibi slot, drop the data\n" ); +writel (SVC_I3C_MDATACTRL_FLUSHRB , master->regs +SVC_I3C_MDATACTRL ); +return -ENOSPC ; + } + + slot->len =0 ; + buf = slot->data; +while (SVC_I3C_MSTATUS_RXPEND (readl (master->regs +SVC_I3C_MSTATUS )) && slot->len <SVC_I3C_FIFO_SIZE ) { mdatactrl =readl (master->regs +SVC_I3C_MDATACTRL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/634 interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 8cf9b43f6b4d90e19a9341edefdd46842d4adb55 ]
Quoted 1 line
From the initial submission the interconnect driver missed the link from
SNOC_PNOC to the USB 2 configuration space. Add missing link in order to let the platform configure and utilize this path.
--- drivers/interconnect/qcom/msm8996.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/msm8996.c +1 -0
@@ -557,6 +557,7 @@ static struct qcom_icc_node mas_venus_vmem = {static const u16 mas_snoc_pnoc_links[] = {MSM8996_SLAVE_BLSP_1 ,MSM8996_SLAVE_BLSP_2 , +MSM8996_SLAVE_USB_HS ,MSM8996_SLAVE_SDCC_1 ,MSM8996_SLAVE_SDCC_2 ,MSM8996_SLAVE_SDCC_4 ,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/634 perf record: skip synthesize event when open evsel failed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit 163e5f2b96632b7fb2eaa965562aca0dbdf9f996 ]
When using perf record with the --overwrite option, a segmentation fault occurs if an event fails to open. For example:
perf record -e cycles-ct -F 1000 -a --overwrite
Error:
cycles-ct:H: PMU Hardware doesn't support sampling/overflow-interrupts. Try 'perf stat'
perf: Segmentation fault
#0 0x6466b6 in dump_stack debug.c:366
#1 0x646729 in sighandler_dump_stack debug.c:378
#2 0x453fd1 in sigsegv_handler builtin-record.c:722
#3 0x7f8454e65090 in __restore_rt libc-2.32.so[54090]
#4 0x6c5671 in __perf_event__synthesize_id_index synthetic-events.c:1862
#5 0x6c5ac0 in perf_event__synthesize_id_index synthetic-events.c:1943
#6 0x458090 in record__synthesize builtin-record.c:2075
#7 0x45a85a in __cmd_record builtin-record.c:2888
#8 0x45deb6 in cmd_record builtin-record.c:4374
#9 0x4e5e33 in run_builtin perf.c:349
#10 0x4e60bf in handle_internal_command perf.c:401
#11 0x4e6215 in run_argv perf.c:448
#12 0x4e653a in main perf.c:555
#13 0x7f8454e4fa72 in __libc_start_main libc-2.32.so[3ea72]
#14 0x43a3ee in _start ??:0The --overwrite option implies --tail-synthesize, which collects non-sample events reflecting the system status when recording finishes. However, when evsel opening fails (e.g., unsupported event 'cycles-ct'), session->evlist is not initialized and remains NULL. The code unconditionally calls record__synthesize() in the error path, which iterates through the NULL evlist pointer and causes a segfault.
To fix it, move the record__synthesize() call inside the error check block, so it's only called when there was no error during recording, ensuring that evlist is properly initialized.
--- tools/perf/builtin-record.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-record.c +1 -1
@@ -2793,11 +2793,11 @@ static int __cmd_record(struct record *rec, int argc, const char **argv) rec->bytes_written +=off_cpu_write (rec->session);record__read_lost_samples (rec); -record__synthesize (rec, true);/* this will be recalculated during process_buildids() */ rec->samples =0 ;if (!err) { +record__synthesize (rec, true);if (!rec->timestamp_filename) {record__finish_output (rec); }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/634 power: supply: cw2015: Check devm_delayed_work_autocancel() return code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <[email protected]>
[ Upstream commit 92ec7e7b86ec0aff9cd7db64d9dce50a0ea7c542 ]
Since devm_delayed_work_autocancel() may fail, add return code check and exit cw_bat_probe() on error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/power/supply/cw2015_battery.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/power/supply/cw2015_battery.c +7 -1
@@ -702,7 +702,13 @@ static int cw_bat_probe(struct i2c_client *client)if (!cw_bat->battery_workqueue)return -ENOMEM ; -devm_delayed_work_autocancel (&client->dev, &cw_bat->battery_delay_work, cw_bat_work); + ret =devm_delayed_work_autocancel (&client->dev, &cw_bat->battery_delay_work, cw_bat_work); +if (ret) { +dev_err_probe (&client->dev, ret, +"Failed to register delayed work\n" ); +return ret; + } +queue_delayed_work (cw_bat->battery_workqueue, &cw_bat->battery_delay_work,msecs_to_jiffies (10 ));return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/634 power: supply: wm831x: Check wm831x_set_bits() return value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <[email protected]>
[ Upstream commit ea14bae6df18942bccb467fcf5ff33ca677b8253 ]
Since wm831x_set_bits() may return error, log failure and exit from wm831x_usb_limit_change() in such case.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/power/supply/wm831x_power.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/power/supply/wm831x_power.c +8 -2
@@ -144,6 +144,7 @@ static int wm831x_usb_limit_change(struct notifier_block *nb, struct wm831x_power, usb_notify);unsigned int i, best; +int ret;/* Find the highest supported limit */ best =0 ;
@@ -156,8 +157,13 @@ static int wm831x_usb_limit_change(struct notifier_block *nb,dev_dbg (wm831x_power->wm831x->dev,"Limiting USB current to %umA" , wm831x_usb_limits[best]); -wm831x_set_bits (wm831x_power->wm831x,WM831X_POWER_STATE , -WM831X_USB_ILIM_MASK , best); + ret =wm831x_set_bits (wm831x_power->wm831x,WM831X_POWER_STATE , +WM831X_USB_ILIM_MASK , best); +if (ret <0 ) { +dev_err (wm831x_power->wm831x->dev, +"Failed to set USB current limit: %d\n" , ret); +return ret; + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/634 power: supply: apm_power: only unset own apm_get_power_status
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahelenia Ziemiańska <[email protected]>
[ Upstream commit bd44ea12919ac4e83c9f3997240fe58266aa8799 ]
Mirroring drivers/macintosh/apm_emu.c, this means that
modprobe apm_power && modprobe $anotherdriver && modprobe -r apm_power
leaves $anotherdriver's apm_get_power_status instead of deleting it.
--- drivers/power/supply/apm_power.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/apm_power.c +2 -1
@@ -365,7 +365,8 @@ static int __init apm_battery_init(void) static void __exit apm_battery_exit(void) { - apm_get_power_status =NULL ; +if (apm_get_power_status == apm_battery_apm_get_power_status) + apm_get_power_status =NULL ; }module_init (apm_battery_init);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/634 scsi: target: Do not write NUL characters into ASCII configfs output
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit c03b55f235e283cae49c88b9602fd11096b92eba ]
NUL characters are not allowed in ASCII configfs output. Hence this patch.
--- drivers/target/target_core_configfs.c | 1 - 1 file changed, 1 deletion(-)
drivers/target/target_core_configfs.c +0 -1
@@ -2689,7 +2689,6 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page) cur_len =snprintf (buf,LU_GROUP_NAME_BUF ,"%s/%s\n" ,config_item_name (&hba->hba_group.cg_item),config_item_name (&dev->dev_group.cg_item)); - cur_len++;/* Extra byte for NULL terminator */ if ((cur_len + len) >PAGE_SIZE || cur_len >LU_GROUP_NAME_BUF ) { pr_warn("Ran out of lu_gp_show_attr"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/634 spi: tegra210-quad: Fix timeout handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishwaroop A <[email protected]>
[ Upstream commit b4e002d8a7cee3b1d70efad0e222567f92a73000 ]
When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running before the transfer timeout is reached.
While handling the timeouts, any pending transfers are cleaned up and the message that they correspond to is marked as failed, which leaves the curr_xfer field pointing at stale memory.
To avoid this, clear curr_xfer to NULL upon timeout and check for this condition when the IRQ thread is finally run.
While at it, also make sure to clear interrupts on failure so that new interrupts can be run.
A better, more involved, fix would move the interrupt clearing into a hard IRQ handler. Ideally we would also want to signal that the IRQ thread no longer needs to be run after the timeout is hit to avoid the extra check for a valid transfer.
--- drivers/spi/spi-tegra210-quad.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
drivers/spi/spi-tegra210-quad.c +20 -2
@@ -998,8 +998,10 @@ static void tegra_qspi_handle_error(struct tegra_qspi *tqspi)dev_err (tqspi->dev,"error in transfer, fifo status 0x%08x\n" , tqspi->status_reg);tegra_qspi_dump_regs (tqspi);tegra_qspi_flush_fifos (tqspi, true); -if (device_reset (tqspi->dev) <0 ) +if (device_reset (tqspi->dev) <0 ) {dev_warn_once (tqspi->dev,"device reset failed\n" ); +tegra_qspi_mask_clear_irq (tqspi); + } }static void tegra_qspi_transfer_end (struct spi_device *spi)
@@ -1138,9 +1140,11 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, }/* Reset controller if timeout happens */ -if (device_reset (tqspi->dev) <0 ) +if (device_reset (tqspi->dev) <0 ) {dev_warn_once (tqspi->dev,"device reset failed\n" ); +tegra_qspi_mask_clear_irq (tqspi); + } ret = -EIO ; goto exit; }
@@ -1162,11 +1166,13 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi,tegra_qspi_transfer_end (spi);spi_transfer_delay_exec (xfer); } + tqspi->curr_xfer =NULL ; transfer_phase++; } ret =0 ; exit: + tqspi->curr_xfer =NULL ; msg->status = ret;return ret;
@@ -1248,6 +1254,8 @@ static int tegra_qspi_non_combined_seq_xfer(struct tegra_qspi *tqspi, msg->actual_length += xfer->len + dummy_bytes; complete_xfer: + tqspi->curr_xfer =NULL ; +if (ret <0 ) {tegra_qspi_transfer_end (spi);spi_transfer_delay_exec (xfer);
@@ -1344,6 +1352,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_qspi *tqspi)tegra_qspi_calculate_curr_xfer_param (tqspi, t);tegra_qspi_start_cpu_based_transfer (tqspi, t); exit: + tqspi->curr_xfer =NULL ;spin_unlock_irqrestore (&tqspi->lock, flags);return IRQ_HANDLED ; }
@@ -1427,6 +1436,15 @@ static irqreturn_t tegra_qspi_isr_thread(int irq, void *context_data) {struct tegra_qspi *tqspi = context_data; +/* +* Occasionally the IRQ thread takes a long time to wake up (usually +* when the CPU that it's running on is excessively busy) and we have +* already reached the timeout before and cleaned up the timed out +* transfer. Avoid any processing in that case and bail out early. +*/ +if (!tqspi->curr_xfer) +return IRQ_NONE ; + tqspi->status_reg =tegra_qspi_readl (tqspi,QSPI_FIFO_STATUS );if (tqspi->cur_direction &DATA_DIR_TX )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/634 x86/boot: Fix page table access in 5-level to 4-level paging transition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <[email protected]>
[ Upstream commit eb2266312507d7b757859e2227aa5c4ba6280ebe ]
When transitioning from 5-level to 4-level paging, the existing code incorrectly accesses page table entries by directly dereferencing CR3 and applying PAGE_MASK. This approach has several issues:
- __native_read_cr3() returns the raw CR3 register value, which on x86_64 includes not just the physical address but also flags. Bits above the physical address width of the system i.e. above __PHYSICAL_MASK_SHIFT) are also not masked.
- The PGD entry is masked by PAGE_SIZE which doesn't take into account the higher bits such as _PAGE_BIT_NOPTISHADOW.
Replace this with proper accessor functions:
- native_read_cr3_pa(): Uses CR3_ADDR_MASK to additionally mask metadata out of CR3 (like SME or LAM bits). All remaining bits are real address bits or reserved and must be 0.
- mask pgd value with PTE_PFN_MASK instead of PAGE_MASK, accounting for flags above bit 51 (_PAGE_BIT_NOPTISHADOW in particular). Bits below 51, but above the max physical address are reserved and must be 0.
--- arch/x86/boot/compressed/pgtable_64.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/x86/boot/compressed/pgtable_64.c +7 -4
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0 #include "misc.h" #include <asm/e820/types.h> +#include <asm/pgtable.h> #include <asm/processor.h> #include "pgtable.h" #include "../string.h"
@@ -173,9 +174,10 @@ asmlinkage void configure_5level_paging(struct boot_params *bp, void *pgtable)* For 4- to 5-level paging transition, set up current CR3 as * the first and the only entry in a new top-level page table. */ - *trampoline_32bit =__native_read_cr3 () | _PAGE_TABLE_NOENC; + *trampoline_32bit =native_read_cr3_pa () | _PAGE_TABLE_NOENC; }else { -unsigned long src; +u64 *new_cr3; +pgd_t *pgdp;/* * For 5- to 4-level paging transition, copy page table pointed
@@ -185,8 +187,9 @@ asmlinkage void configure_5level_paging(struct boot_params *bp, void *pgtable)* We cannot just point to the page table from trampoline as it * may be above 4G. */ - src = *(unsigned long *)__native_read_cr3 () &PAGE_MASK ; -memcpy (trampoline_32bit, (void *)src,PAGE_SIZE ); + pgdp = (pgd_t *)native_read_cr3_pa (); + new_cr3 = (u64 *)(native_pgd_val (pgdp[0 ]) &PTE_PFN_MASK ); +memcpy (trampoline_32bit, new_cr3,PAGE_SIZE ); }toggle_la57 (trampoline_32bit);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/634 efi/libstub: Fix page table access in 5-level to 4-level paging transition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <[email protected]>
[ Upstream commit 84361123413efc84b06f3441c6c827b95d902732 ]
When transitioning from 5-level to 4-level paging, the existing code incorrectly accesses page table entries by directly dereferencing CR3 and applying PAGE_MASK. This approach has several issues:
- __native_read_cr3() returns the raw CR3 register value, which on x86_64 includes not just the physical address but also flags Bits above the physical address width of the system (i.e. above __PHYSICAL_MASK_SHIFT) are also not masked.
- The pgd value is masked by PAGE_SIZE which doesn't take into account the higher bits such as _PAGE_BIT_NOPTISHADOW.
Replace this with proper accessor functions:
- native_read_cr3_pa(): Uses CR3_ADDR_MASK to additionally mask metadata out of CR3 (like SME or LAM bits). All remaining bits are real address bits or reserved and must be 0.
- mask pgd value with PTE_PFN_MASK instead of PAGE_MASK, accounting for flags above bit 51 (_PAGE_BIT_NOPTISHADOW in particular). Bits below 51, but above the max physical address are reserved and must be 0.
--- drivers/firmware/efi/libstub/x86-5lvl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/firmware/efi/libstub/x86-5lvl.c +2 -2
@@ -66,7 +66,7 @@ void efi_5level_switch(void)bool have_la57 =native_read_cr4 () &X86_CR4_LA57 ;bool need_toggle = want_la57 ^ have_la57;u64 *pgt = (void *)la57_toggle +PAGE_SIZE ; -u64 *cr3 = (u64 *)__native_read_cr3 (); +pgd_t *cr3 = (pgd_t *)native_read_cr3_pa ();u64 *new_cr3;if (!la57_toggle || !need_toggle)
@@ -82,7 +82,7 @@ void efi_5level_switch(void) new_cr3[0 ] = (u64 )cr3 | _PAGE_TABLE_NOENC; }else {/* take the new root table pointer from the current entry #0 */ - new_cr3 = (u64 *)(cr3[0 ] &PAGE_MASK ); + new_cr3 = (u64 *)(native_pgd_val (cr3[0 ]) &PTE_PFN_MASK );/* copy the new root table if it is not 32-bit addressable */ if ((u64 )new_cr3 >U32_MAX )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/634 mfd: da9055: Fix missing regmap_del_irq_chip() in error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 1b58acfd067ca16116b9234cd6b2d30cc8ab7502 ]
When da9055_device_init() fails after regmap_add_irq_chip() succeeds but mfd_add_devices() fails, the error handling path only calls mfd_remove_devices() but forgets to call regmap_del_irq_chip(). This results in a resource leak.
Fix this by adding regmap_del_irq_chip() to the error path so that resources are released properly.
--- drivers/mfd/da9055-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/da9055-core.c +1 -0
@@ -388,6 +388,7 @@ int da9055_device_init(struct da9055 *da9055) err:mfd_remove_devices (da9055->dev); +regmap_del_irq_chip (da9055->chip_irq, da9055->irq_data);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/634 ext4: correct the checking of quota files before moving extents
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit a2e5a3cea4b18f6e2575acc444a5e8cce1fc8260 ]
The move extent operation should return -EOPNOTSUPP if any of the inodes is a quota inode, rather than requiring both to be quota inodes.
Message-ID: <[email protected]>
--- fs/ext4/move_extent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/move_extent.c +1 -1
@@ -481,7 +481,7 @@ mext_check_arguments(struct inode *orig_inode,return -ETXTBSY ; } -if (ext4_is_quota_file (orig_inode) &&ext4_is_quota_file (donor_inode)) { +if (ext4_is_quota_file (orig_inode) ||ext4_is_quota_file (donor_inode)) {ext4_debug ("ext4 move extent: The argument files should not be quota files [ino:orig %lu, donor %lu]\n" , orig_inode->i_ino, donor_inode->i_ino);return -EOPNOTSUPP ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/634 perf/x86/intel: Correct large PEBS flag check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
[ Upstream commit 5e4e355ae7cdeb0fef5dbe908866e1f895abfacc ]
current large PEBS flag check only checks if sample_regs_user contains unsupported GPRs but doesn't check if sample_regs_intr contains unsupported GPRs.
Of course, currently PEBS HW supports to sample all perf supported GPRs, the missed check doesn't cause real issue. But it won't be true any more after the subsequent patches support to sample SSP register. SSP sampling is not supported by adaptive PEBS HW and it would be supported until arch-PEBS HW. So correct this issue.
--- arch/x86/events/intel/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/events/intel/core.c +3 -1
@@ -3779,7 +3779,9 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)if (!event->attr.exclude_kernel) flags &= ~PERF_SAMPLE_REGS_USER ;if (event->attr.sample_regs_user & ~PEBS_GP_REGS ) - flags &= ~(PERF_SAMPLE_REGS_USER |PERF_SAMPLE_REGS_INTR ); + flags &= ~PERF_SAMPLE_REGS_USER ; +if (event->attr.sample_regs_intr & ~PEBS_GP_REGS ) + flags &= ~PERF_SAMPLE_REGS_INTR ;return flags; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/634 regulator: core: disable supply if enabling main regulator fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit fb1ebb10468da414d57153ddebaab29c38ef1a78 ]
For 'always-on' and 'boot-on' regulators, the set_machine_constraints() may enable supply before enabling the main regulator, however if the latter fails, the function returns with an error but the supply remains enabled.
When this happens, the regulator_register() function continues on the error path where it puts the supply regulator. Since enabling the supply is not balanced with a disable call, a warning similar to the following gets issued from _regulator_put():
[ 1.603889] WARNING: CPU: 2 PID: 44 at _regulator_put+0x8c/0xa0
[ 1.603908] Modules linked in:
[ 1.603926] CPU: 2 UID: 0 PID: 44 Comm: kworker/u16:3 Not tainted 6.18.0-rc4 #0 NONE
[ 1.603938] Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT)
[ 1.603945] Workqueue: async async_run_entry_fn
[ 1.603958] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1.603967] pc : _regulator_put+0x8c/0xa0
[ 1.603976] lr : _regulator_put+0x7c/0xa0
...
[ 1.604140] Call trace:
[ 1.604145] _regulator_put+0x8c/0xa0 (P)
[ 1.604156] regulator_register+0x2ec/0xbf0
[ 1.604166] devm_regulator_register+0x60/0xb0
[ 1.604178] rpm_reg_probe+0x120/0x208
[ 1.604187] platform_probe+0x64/0xa8
...In order to avoid this, change the set_machine_constraints() function to disable the supply if enabling the main regulator fails.
--- drivers/regulator/core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/regulator/core.c +5 -0
@@ -1660,6 +1660,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)* and we have control then make sure it is enabled. */ if (rdev->constraints->always_on || rdev->constraints->boot_on) { +bool supply_enabled = false; +/* If we want to enable this regulator, make sure that we know * the supplying regulator. */
@@ -1679,11 +1681,14 @@ static int set_machine_constraints(struct regulator_dev *rdev) rdev->supply =NULL ;return ret; } + supply_enabled = true; } ret =_regulator_do_enable (rdev);if (ret <0 && ret != -EINVAL ) {rdev_err (rdev,"failed to enable: %pe\n" ,ERR_PTR (ret)); +if (supply_enabled) +regulator_disable (rdev->supply);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/634 nbd: defer config put in recv_work
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 9517b82d8d422d426a988b213fdd45c6b417b86d ]
There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE:
nbd_genl_connect // conf_ref=2 (connect and recv_work A)
nbd_open // conf_ref=3
recv_work A done // conf_ref=2
NBD_CLEAR_SOCK // conf_ref=1
nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)
close nbd // conf_ref=1
recv_work B
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Or only running NBD_CLEAR_SOCK:
nbd_genl_connect // conf_ref=2
nbd_open // conf_ref=3
NBD_CLEAR_SOCK // conf_ref=2
close nbd
nbd_release
config_put // conf_ref=1
recv_work
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared.
However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup.
Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear
+ reconfigure interleave.
In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock):
path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2
NBD_CLEAR_SOCK
close nbd
nbd_release
nbd_disconnect_and_put
flush_workqueue // recv_work done
nbd_config_put
nbd_put // nbd_refs=1
nbd_put // nbd_refs=0
queue_workpath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3
NBD_CLEAR_SOCK // conf_refs=2
close nbd
nbd_release
nbd_config_put // conf_refs=1
nbd_put // nbd_refs=2
recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0
Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
--- drivers/block/nbd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/nbd.c +1 -1
@@ -889,9 +889,9 @@ static void recv_work(struct work_struct *work)nbd_mark_nsock_dead (nbd, nsock,1 );mutex_unlock (&nsock->tx_lock); -nbd_config_put (nbd);atomic_dec (&config->recv_threads);wake_up (&config->recv_wq); +nbd_config_put (nbd);kfree (args); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/634 scsi: stex: Fix reboot_notifier leak in probe error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 20da637eb545b04753e20c675cfe97b04c7b600b ]
In stex_probe(), register_reboot_notifier() is called at the beginning, but if any subsequent initialization step fails, the function returns without unregistering the notifier, resulting in a resource leak.
Add unregister_reboot_notifier() in the out_disable error path to ensure proper cleanup on all failure paths.
--- drivers/scsi/stex.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/stex.c +1 -0
@@ -1846,6 +1846,7 @@ static int stex_probe(struct pci_dev *pdev, const struct pci_device_id *id) out_scsi_host_put:scsi_host_put (host); out_disable: +unregister_reboot_notifier (&stex_notifier);pci_disable_device (pdev);return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/634 scsi: smartpqi: Convert to host_tagset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Don Brace <[email protected]>
[ Upstream commit b27ac2faa2fc0b2677cf1cbd270af734a1f5fd95 ]
Add support for host_tagset.
Also move the reserved command slots to the end of the pool to eliminate an addition operation for every SCSI request.
This patch was originally authored by Hannes Reinecke here:
But we NAKed this patch because we wanted to fully test multipath failover operations.
Stable-dep-of: b518e86d1a70 ("scsi: smartpqi: Fix device resources accessed after device removal")
--- drivers/scsi/smartpqi/smartpqi.h | 3 -- drivers/scsi/smartpqi/smartpqi_init.c | 68 +++++++++++++++++---------- 2 files changed, 43 insertions(+), 28 deletions(-)
drivers/scsi/smartpqi/smartpqi.h +0 -3
@@ -1307,7 +1307,6 @@ struct pqi_ctrl_info {dma_addr_t error_buffer_dma_handle;size_t sg_chain_buffer_length;unsigned int num_queue_groups; -u16 max_hw_queue_index;u16 num_elements_per_iq;u16 num_elements_per_oq;u16 max_inbound_iu_length_per_firmware;
@@ -1369,8 +1368,6 @@ struct pqi_ctrl_info {u64 sas_address;struct pqi_io_request *io_request_pool; -u16 next_io_request_slot; -struct pqi_event events[PQI_NUM_SUPPORTED_EVENTS ];struct work_struct event_work;
drivers/scsi/smartpqi/smartpqi_init.c +43 -25
128 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/634 scsi: smartpqi: Remove contention for raid_bypass_cnt
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike McGowen <[email protected]>
[ Upstream commit 80d560d94fa9b28069c62e1a64ae4a03d5f43fbc ]
Reduce CPU contention when incrementing variable raid_bypass_cnt.
Remove the atomic operations for this variable by changing the atomic to an unsigned int and replace atomic operations with standard operations. The value is only checked that it is increasing and accuracy is not required.
Stable-dep-of: b518e86d1a70 ("scsi: smartpqi: Fix device resources accessed after device removal")
--- drivers/scsi/smartpqi/smartpqi.h | 2 +- drivers/scsi/smartpqi/smartpqi_init.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/smartpqi/smartpqi.h +1 -1
@@ -1147,7 +1147,7 @@ struct pqi_scsi_dev {struct pqi_stream_data stream_data[NUM_STREAMS_PER_LUN ];atomic_t scsi_cmds_outstanding[PQI_MAX_LUNS_PER_DEVICE ]; -atomic_t raid_bypass_cnt; +unsigned int raid_bypass_cnt; };/* VPD inquiry pages */
drivers/scsi/smartpqi/smartpqi_init.c +3 -3
@@ -6035,7 +6035,7 @@ static int pqi_scsi_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scm rc =pqi_raid_bypass_submit_scsi_cmd (ctrl_info, device, scmd, queue_group);if (rc ==0 || rc ==SCSI_MLQUEUE_HOST_BUSY ) { raid_bypassed = true; -atomic_inc (&device->raid_bypass_cnt); + device->raid_bypass_cnt++; } }if (!raid_bypassed)
@@ -7274,7 +7274,7 @@ static ssize_t pqi_raid_bypass_cnt_show(struct device *dev,struct scsi_device *sdev;struct pqi_scsi_dev *device;unsigned long flags; -int raid_bypass_cnt; +unsigned int raid_bypass_cnt; sdev =to_scsi_device (dev); ctrl_info =shost_to_hba (sdev->host);
@@ -7290,7 +7290,7 @@ static ssize_t pqi_raid_bypass_cnt_show(struct device *dev,return -ENODEV ; } - raid_bypass_cnt =atomic_read (&device->raid_bypass_cnt); + raid_bypass_cnt = device->raid_bypass_cnt;spin_unlock_irqrestore (&ctrl_info->scsi_device_list_lock, flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/634 scsi: smartpqi: Add abort handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Barnett <[email protected]>
[ Upstream commit 153c45dd63ef33ffb3d78307db5aa6131b2fdefc ]
Implement aborts as resets.
Avoid I/O stalls across all devices attached to a controller when device I/O requests time out.
Stable-dep-of: b518e86d1a70 ("scsi: smartpqi: Fix device resources accessed after device removal")
--- drivers/scsi/smartpqi/smartpqi.h | 14 ++- drivers/scsi/smartpqi/smartpqi_init.c | 171 ++++++++++++++++++++------ 2 files changed, 149 insertions(+), 36 deletions(-)
drivers/scsi/smartpqi/smartpqi.h +13 -1
@@ -1085,7 +1085,16 @@ struct pqi_stream_data {u32 last_accessed; }; -#define PQI_MAX_LUNS_PER_DEVICE 256 +#define PQI_MAX_LUNS_PER_DEVICE 256 + +struct pqi_tmf_work { +struct work_struct work_struct; +struct scsi_cmnd *scmd; +struct pqi_ctrl_info *ctrl_info; +struct pqi_scsi_dev *device; +u8 lun; +u8 scsi_opcode; +};struct pqi_scsi_dev {int devtype;/* as reported by INQUIRY command */
@@ -1110,6 +1119,7 @@ struct pqi_scsi_dev { u8 ignore_device : 1;bool aio_enabled;/* only valid for physical disks */ bool in_remove; +bool in_reset[PQI_MAX_LUNS_PER_DEVICE ];bool device_offline;u8 vendor[8 ];/* bytes 8-15 of inquiry data */ u8 model[16 ];/* bytes 16-31 of inquiry data */
@@ -1148,6 +1158,8 @@ struct pqi_scsi_dev {struct pqi_stream_data stream_data[NUM_STREAMS_PER_LUN ];atomic_t scsi_cmds_outstanding[PQI_MAX_LUNS_PER_DEVICE ];unsigned int raid_bypass_cnt; + +struct pqi_tmf_work tmf_work[PQI_MAX_LUNS_PER_DEVICE ]; };/* VPD inquiry pages */
drivers/scsi/smartpqi/smartpqi_init.c +136 -35
338 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/634 scsi: smartpqi: Fix device resources accessed after device removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike McGowen <[email protected]>
[ Upstream commit b518e86d1a70a88f6592a7c396cf1b93493d1aab ]
Correct possible race conditions during device removal.
Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues.
This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources.
- Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped.
- Cancel any pending TMF work that has not started in sdev_destroy().
- Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
--- drivers/scsi/smartpqi/smartpqi_init.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/scsi/smartpqi/smartpqi_init.c +19 -0
@@ -6401,10 +6401,22 @@ static int pqi_device_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_devstatic int pqi_device_reset_handler (struct pqi_ctrl_info *ctrl_info,struct pqi_scsi_dev *device,u8 lun,struct scsi_cmnd *scmd,u8 scsi_opcode) { +unsigned long flags;int rc;mutex_lock (&ctrl_info->lun_reset_mutex); +spin_lock_irqsave (&ctrl_info->scsi_device_list_lock, flags); +if (pqi_find_scsi_dev (ctrl_info, device->bus, device->target, device->lun) ==NULL ) { +dev_warn (&ctrl_info->pci_dev->dev, +"skipping reset of scsi %d:%d:%d:%u, device has been removed\n" , + ctrl_info->scsi_host->host_no, device->bus, device->target, device->lun); +spin_unlock_irqrestore (&ctrl_info->scsi_device_list_lock, flags); +mutex_unlock (&ctrl_info->lun_reset_mutex); +return 0 ; + } +spin_unlock_irqrestore (&ctrl_info->scsi_device_list_lock, flags); + dev_err(&ctrl_info->pci_dev->dev, "resetting scsi %d:%d:%d:%d due to cmd 0x%02x\n", ctrl_info->scsi_host->host_no,
@@ -6583,7 +6595,9 @@ static void pqi_slave_destroy(struct scsi_device *sdev) {struct pqi_ctrl_info *ctrl_info;struct pqi_scsi_dev *device; +struct pqi_tmf_work *tmf_work;int mutex_acquired; +unsigned int lun;unsigned long flags; ctrl_info =shost_to_hba (sdev->host);
@@ -6610,8 +6624,13 @@ static void pqi_slave_destroy(struct scsi_device *sdev)mutex_unlock (&ctrl_info->scan_mutex); +for (lun =0 , tmf_work = device->tmf_work; lun <PQI_MAX_LUNS_PER_DEVICE ; lun++, tmf_work++) +cancel_work_sync (&tmf_work->work_struct); + +mutex_lock (&ctrl_info->lun_reset_mutex);pqi_dev_info (ctrl_info,"removed" , device);pqi_free_device (device); +mutex_unlock (&ctrl_info->lun_reset_mutex); }static int pqi_getpciinfo_ioctl (struct pqi_ctrl_info *ctrl_info,void __user *arg)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/634 dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit b80b848bdf56bd402b7a91aea5b77cec93dfe4c2 ]
Convert the Amlogic Meson AXG DWC PCIe SoC controller bindings to dt-schema.
Stable-dep-of: 4813dea9e272 ("dt-bindings: PCI: amlogic: Fix the register name of the DBI region")
--- .../bindings/pci/amlogic,axg-pcie.yaml | 134 ++++++++++++++++++ .../bindings/pci/amlogic,meson-pcie.txt | 70 --------- 2 files changed, 134 insertions(+), 70 deletions(-) create mode 100644 Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml delete mode 100644 Documentation/devicetree/bindings/pci/amlogic,meson-pcie.txt
Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml new file +134 -0
@@ -0,0 +1,134 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/pci/amlogic,axg-pcie.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Amlogic Meson AXG DWC PCIe SoC controller + +maintainers: + - Neil Armstrong <[email protected]> + +description: + Amlogic Meson PCIe host controller is based on the Synopsys DesignWare PCI core. + +allOf: + - $ref: /schemas/pci/pci-bus.yaml# + - $ref: /schemas/pci/snps,dw-pcie-common.yaml# + +# We need a select here so we don't match all nodes with 'snps,dw-pcie' +select: + properties: + compatible: + enum: + - amlogic,axg-pcie + - amlogic,g12a-pcie + required: + - compatible + +properties: + compatible: + items: + - enum: + - amlogic,axg-pcie + - amlogic,g12a-pcie + - const: snps,dw-pcie + + reg: + items: + - description: External local bus interface registers + - description: Meson designed configuration registers + - description: PCIe configuration space + + reg-names: + items: + - const: elbi + - const: cfg + - const: config + + interrupts: + maxItems: 1 + + clocks: + items: + - description: PCIe GEN 100M PLL clock + - description: PCIe RC clock gate + - description: PCIe PHY clock + + clock-names: + items: + - const: pclk + - const: port + - const: general + + phys: + maxItems: 1 + + phy-names: + const: pcie + + resets: + items: + - description: Port Reset + - description: Shared APB reset + + reset-names: + items: + - const: port + - const: apb + + num-lanes: + const: 1 + + power-domains: + maxItems: 1 + +required: + - compatible + - reg + - reg-names + - interrupts + - clock + - clock-names + - "#address-cells" + - "#size-cells" + - "#interrupt-cells" + - interrupt-map + - interrupt-map-mask + - ranges + - bus-range + - device_type + - num-lanes + - phys + - phy-names + - resets + - reset-names + +unevaluatedProperties: false + +examples: + - | + #include <dt-bindings/interrupt-controller/irq.h> + #include <dt-bindings/interrupt-controller/arm-gic.h> + pcie: pcie@f9800000 { + compatible = "amlogic,axg-pcie", "snps,dw-pcie"; + reg = <0xf9800000 0x400000>, <0xff646000 0x2000>, <0xf9f00000 0x100000>; + reg-names = "elbi", "cfg", "config"; + interrupts = <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>; + clocks = <&pclk>, <&clk_port>, <&clk_phy>; + clock-names = "pclk", "port", "general"; + resets = <&reset_pcie_port>, <&reset_pcie_apb>; + reset-names = "port", "apb"; + phys = <&pcie_phy>; + phy-names = "pcie"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 179 IRQ_TYPE_EDGE_RISING>; + bus-range = <0x0 0xff>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + ranges = <0x82000000 0 0 0xf9c00000 0 0x00300000>; + }; +...
Documentation/devicetree/bindings/pci/amlogic,meson-pcie.txt deleted +0 -70
70 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/634 dt-bindings: PCI: amlogic: Fix the register name of the DBI region
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 4813dea9e272ba0a57c50b8d51d440dd8e3ccdd7 ]
Binding incorrectly specifies the 'DBI' region as 'ELBI'. DBI is a must have region for DWC controllers as it has the Root Port and controller specific registers, while ELBI has optional registers.
Hence, fix the binding. Though this is an ABI break, this change is needed to accurately describe the PCI memory map.
--- Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml +3 -3
@@ -36,13 +36,13 @@ properties: reg: items: - - description: External local bus interface registers + - description: Data Bus Interface registers - description: Meson designed configuration registers - description: PCIe configuration space reg-names: items: - - const: elbi + - const: dbi - const: cfg - const: config
@@ -113,7 +113,7 @@ examples: pcie: pcie@f9800000 { compatible = "amlogic,axg-pcie", "snps,dw-pcie"; reg = <0xf9800000 0x400000>, <0xff646000 0x2000>, <0xf9f00000 0x100000>; - reg-names = "elbi", "cfg", "config"; + reg-names = "dbi", "cfg", "config"; interrupts = <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>; clocks = <&pclk>, <&clk_port>, <&clk_phy>; clock-names = "pclk", "port", "general";
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/634 RDMA/rtrs: server: Fix error handling in get_or_create_srv
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit a338d6e849ab31f32c08b4fcac11c0c72afbb150 ]
After device_initialize() is called, use put_device() to release the device according to kernel device management rules. While direct kfree() work in this case, using put_device() is more correct.
Found by code review.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +1 -1
@@ -1448,7 +1448,7 @@ static struct rtrs_srv_sess *get_or_create_srv(struct rtrs_srv_ctx *ctx,kfree (srv->chunks); err_free_srv: -kfree (srv); +put_device (&srv->dev);return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/634 ntfs3: init run lock for extend inode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit be99c62ac7e7af514e4b13f83c891a3cccefaa48 ]
After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock uninitialized error reported by syzbot.
Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a regular file, the do_truncate() routine would not be entered.
Add the run_lock initialization when loading $Extend.
syzbot reported:
INFO: trying to register non-static key.
Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984 register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299 __lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590 ntfs_set_size+0x140/0x200 fs/ntfs3/inode.c:860 ntfs_extend+0x1d9/0x970 fs/ntfs3/file.c:387 ntfs_setattr+0x2e8/0xbe0 fs/ntfs3/file.c:808
--- fs/ntfs3/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/inode.c +1 -0
@@ -457,6 +457,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,/* Records in $Extend are not a files or general directories. */ inode->i_op = &ntfs_file_inode_operations; mode =S_IFREG ; +init_rwsem (&ni->file.run_lock); }else { err = -EINVAL ; goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/634 scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bean Huo <[email protected]>
[ Upstream commit d794b499f948801f54d67ddbc34a6eac5a6d150a ]
The function ufshcd_read_string_desc() was duplicating memory starting from the beginning of struct uc_string_id, which included the length and type fields. As a result, the allocated buffer contained unwanted metadata in addition to the string itself.
The correct behavior is to duplicate only the Unicode character array in the structure. Update the code so that only the actual string content is copied into the new buffer.
--- drivers/ufs/core/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +1 -1
@@ -3586,7 +3586,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index, str[ret++] ='\0' ; }else { - str =kmemdup (uc_str, uc_str->len,GFP_KERNEL ); + str =kmemdup (uc_str->uc, uc_str->len,GFP_KERNEL );if (!str) { ret = -ENOMEM ; goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/634 powerpc/32: Fix unpaired stwcx. on interrupt exit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 10e1c77c3636d815db802ceef588522c2d2d947c ]
Commit b96bae3ae2cb ("powerpc/32: Replace ASM exception exit by C exception exit from ppc64") erroneouly copied to powerpc/32 the logic from powerpc/64 based on feature CPU_FTR_STCX_CHECKS_ADDRESS which is always 0 on powerpc/32.
Re-instate the logic implemented by commit b64f87c16f3c ("[POWERPC] Avoid unpaired stwcx. on some processors") which is based on CPU_FTR_NEED_PAIRED_STWCX feature.
--- arch/powerpc/kernel/entry_32.S | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
arch/powerpc/kernel/entry_32.S +4 -6
@@ -310,10 +310,9 @@ interrupt_return: mtspr SPRN_SRR1,r12 BEGIN_FTR_SECTION + lwarx r0,0,r1 +END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) stwcx. r0,0,r1 /* to clear the reservation */ -FTR_SECTION_ELSE - lwarx r0,0,r1 -ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) lwz r3,_CCR(r1) lwz r4,_LINK(r1)
@@ -356,10 +355,9 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) mtspr SPRN_SRR1,r12 BEGIN_FTR_SECTION + lwarx r0,0,r1 +END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) stwcx. r0,0,r1 /* to clear the reservation */ -FTR_SECTION_ELSE - lwarx r0,0,r1 -ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) lwz r3,_LINK(r1) lwz r4,_CTR(r1)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/634 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f ]
The following warning appears when running syzkaller, and this issue also exists in the mainline code.
------------[ cut here ]------------ list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100. WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130 Modules linked in: CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__list_add_valid_or_report+0xf7/0x130 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100 R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48 FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> input_register_handler+0xb3/0x210 mac_hid_start_emulation+0x1c5/0x290 mac_hid_toggle_emumouse+0x20a/0x240 proc_sys_call_handler+0x4c2/0x6e0 new_sync_write+0x1b1/0x2d0 vfs_write+0x709/0x950 ksys_write+0x12a/0x250 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2
The WARNING occurs when two processes concurrently write to the mac-hid emulation sysctl, causing a race condition in mac_hid_toggle_emumouse(). Both processes read old_val=0, then both try to register the input handler, leading to a double list_add of the same handler.
CPU0 CPU1
------------------------- -------------------------
vfs_write() //write 1 vfs_write() //write 1
proc_sys_write() proc_sys_write()
mac_hid_toggle_emumouse() mac_hid_toggle_emumouse()
old_val = *valp // old_val=0
old_val = *valp // old_val=0
mutex_lock_killable()
proc_dointvec() // *valp=1
mac_hid_start_emulation()
input_register_handler()
mutex_unlock()
mutex_lock_killable()
proc_dointvec()
mac_hid_start_emulation()
input_register_handler() //Trigger Warning
mutex_unlock()Fix this by moving the old_val read inside the mutex lock region.
--- drivers/macintosh/mac_hid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/macintosh/mac_hid.c +2 -1
@@ -186,13 +186,14 @@ static int mac_hid_toggle_emumouse(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { int *valp = table->data; -int old_val = *valp; +int old_val;int rc; rc =mutex_lock_killable (&mac_hid_emumouse_mutex);if (rc)return rc; + old_val = *valp; rc =proc_dointvec (table, write, buffer, lenp, ppos);if (rc ==0 && write && *valp != old_val) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/634 wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 5e88e864118c20e63a1571d0ff0a152e5d684959 ]
In one of the error paths, the memory allocated for skb_rx is not freed. Fix that by freeing it before returning.
--- drivers/net/wireless/st/cw1200/bh.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/st/cw1200/bh.c +4 -2
@@ -317,10 +317,12 @@ static int cw1200_bh_rx_helper(struct cw1200_common *priv,if (wsm_id &0x0400 ) {int rc =wsm_release_tx_buffer (priv,1 ); -if (WARN_ON (rc <0 )) +if (WARN_ON (rc <0 )) { +dev_kfree_skb (skb_rx);return rc; -else if (rc >0 ) + }else if (rc >0 ) { *tx =1 ; + } }/* cw1200_wsm_rx takes care on SKB livetime */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/634 nbd: defer config unlock in nbd_genl_connect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 1649714b930f9ea6233ce0810ba885999da3b5d4 ]
There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK:
nbd_genl_connect
nbd_alloc_and_init_config // config_refs=1
nbd_start_device // config_refs=2
set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3
recv_work done // config_refs=2
NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0
refcount_inc -> uaf
------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790
The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect():
mutex_unlock(&nbd->config_lock);
if (!ret) {
set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);
+ printk("before sleep\n");
+ mdelay(5 * 1000);
+ printk("after sleep\n");
refcount_inc(&nbd->config_refs);
nbd_connect_reply(info, nbd->index);
}--- drivers/block/nbd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/nbd.c +2 -1
@@ -2116,12 +2116,13 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) ret =nbd_start_device (nbd); out: -mutex_unlock (&nbd->config_lock);if (!ret) {set_bit (NBD_RT_HAS_CONFIG_REF , &config->runtime_flags);refcount_inc (&nbd->config_refs);nbd_connect_reply (info, nbd->index); } +mutex_unlock (&nbd->config_lock); +nbd_config_put (nbd);if (put_dev)nbd_put (nbd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/634 coresight: etm4x: Correct polling IDLE bit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 4dc4e22f9536341255f5de6047977a80ff47eaef ]
Since commit 4ff6039ffb79 ("coresight-etm4x: add isb() before reading the TRCSTATR"), the code has incorrectly been polling the PMSTABLE bit instead of the IDLE bit.
This commit corrects the typo.
--- drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +1 -1
@@ -1726,7 +1726,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) state->trcpdcr =etm4x_read32 (csa,TRCPDCR );/* wait for TRCSTATR.IDLE to go up */ -if (etm4x_wait_status (csa,TRCSTATR_PMSTABLE_BIT ,1 )) { +if (etm4x_wait_status (csa,TRCSTATR_IDLE_BIT ,1 )) {dev_err (etm_dev,"timeout while waiting for Idle Trace Status\n" );etm4_os_unlock (drvdata);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/634 coresight: etm4x: Extract the trace unit controlling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 40f682ae5086366d51e29e66eb8a344501245d0d ]
The trace unit is controlled in the ETM hardware enabling and disabling. The sequential changes for support AUX pause and resume will reuse the same operations.
Extract the operations in the etm4_{enable|disable}_trace_unit() functions. A minor improvement in etm4_enable_trace_unit() is for returning the timeout error to callers.
Stable-dep-of: 64eb04ae5452 ("coresight: etm4x: Add context synchronization before enabling trace")
--- .../coresight/coresight-etm4x-core.c | 103 +++++++++++------- 1 file changed, 62 insertions(+), 41 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +62 -41
@@ -392,6 +392,44 @@ static int etm4x_wait_status(struct csdev_access *csa, int pos, int val)return coresight_timeout (csa,TRCSTATR , pos, val); } +static int etm4_enable_trace_unit (struct etmv4_drvdata *drvdata) +{ +struct coresight_device *csdev = drvdata->csdev; +struct device *etm_dev = &csdev->dev; +struct csdev_access *csa = &csdev->access; + +/* +* ETE mandates that the TRCRSR is written to before +* enabling it. +*/ +if (etm4x_is_ete (drvdata)) +etm4x_relaxed_write32 (csa,TRCRSR_TA ,TRCRSR ); + +etm4x_allow_trace (drvdata); +/* Enable the trace unit */ +etm4x_relaxed_write32 (csa,1 ,TRCPRGCTLR ); + +/* Synchronize the register updates for sysreg access */ +if (!csa->io_mem) +isb (); + +/* wait for TRCSTATR.IDLE to go back down to '0' */ +if (etm4x_wait_status (csa,TRCSTATR_IDLE_BIT ,0 )) { +dev_err (etm_dev, +"timeout while waiting for Idle Trace Status\n" ); +return -ETIME ; + } + +/* +* As recommended by section 4.3.7 ("Synchronization when using the +* memory-mapped interface") of ARM IHI 0064D +*/ +dsb (sy); +isb (); + +return 0 ; +} +static int etm4_enable_hw (struct etmv4_drvdata *drvdata) {int i, rc;
@@ -501,33 +539,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)etm4x_relaxed_write32 (csa, trcpdcr |TRCPDCR_PU ,TRCPDCR ); } -/* -* ETE mandates that the TRCRSR is written to before -* enabling it. -*/ -if (etm4x_is_ete (drvdata)) -etm4x_relaxed_write32 (csa,TRCRSR_TA ,TRCRSR ); - -etm4x_allow_trace (drvdata); -/* Enable the trace unit */ -etm4x_relaxed_write32 (csa,1 ,TRCPRGCTLR ); - -/* Synchronize the register updates for sysreg access */ -if (!csa->io_mem) -isb (); - -/* wait for TRCSTATR.IDLE to go back down to '0' */ -if (etm4x_wait_status (csa,TRCSTATR_IDLE_BIT ,0 )) -dev_err (etm_dev, -"timeout while waiting for Idle Trace Status\n" ); - -/* -* As recommended by section 4.3.7 ("Synchronization when using the -* memory-mapped interface") of ARM IHI 0064D -*/ -dsb (sy); -isb (); - + rc =etm4_enable_trace_unit (drvdata); done:etm4_cs_lock (drvdata, csa);
@@ -828,25 +840,12 @@ static int etm4_enable(struct coresight_device *csdev,return ret; } -static void etm4_disable_hw (void *info) +static void etm4_disable_trace_unit (struct etmv4_drvdata *drvdata) {u32 control; -struct etmv4_drvdata *drvdata = info; -struct etmv4_config *config = &drvdata->config;struct coresight_device *csdev = drvdata->csdev;struct device *etm_dev = &csdev->dev;struct csdev_access *csa = &csdev->access; -int i; - -etm4_cs_unlock (drvdata, csa); -etm4_disable_arch_specific (drvdata); - -if (!drvdata->skip_power_up) { -/* power can be removed from the trace unit now */ - control =etm4x_relaxed_read32 (csa,TRCPDCR ); - control &= ~TRCPDCR_PU ; -etm4x_relaxed_write32 (csa, control,TRCPDCR ); - } control =etm4x_relaxed_read32 (csa,TRCPRGCTLR );
@@ -887,6 +886,28 @@ static void etm4_disable_hw(void *info)* of ARM IHI 0064H.b. */ isb (); +} + +static void etm4_disable_hw (void *info) +{ +u32 control; +struct etmv4_drvdata *drvdata = info; +struct etmv4_config *config = &drvdata->config; +struct coresight_device *csdev = drvdata->csdev; +struct csdev_access *csa = &csdev->access; +int i; + +etm4_cs_unlock (drvdata, csa); +etm4_disable_arch_specific (drvdata); + +if (!drvdata->skip_power_up) { +/* power can be removed from the trace unit now */ + control =etm4x_relaxed_read32 (csa,TRCPDCR ); + control &= ~TRCPDCR_PU ; +etm4x_relaxed_write32 (csa, control,TRCPDCR ); + } + +etm4_disable_trace_unit (drvdata);/* read the status of the single shot comparators */ for (i =0 ; i < drvdata->nr_ss_cmp; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/634 coresight: etm4x: Add context synchronization before enabling trace
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 64eb04ae545294e105ad91714dc3167a0b660731 ]
According to the software usage PKLXF in Arm ARM (ARM DDI 0487 L.a), a Context synchronization event is required before enabling the trace unit.
An ISB is added to meet this requirement, particularly for guarding the operations in the flow:
etm4x_allow_trace()
`> kvm_tracing_set_el1_configuration()
`> write_sysreg_s(trfcr_while_in_guest, SYS_TRFCR_EL12)
Improved the barrier comments to provide more accurate information.
--- .../coresight/coresight-etm4x-core.c | 27 ++++++++++++++++--- 1 file changed, 23 insertions(+), 4 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +23 -4
@@ -406,10 +406,24 @@ static int etm4_enable_trace_unit(struct etmv4_drvdata *drvdata)etm4x_relaxed_write32 (csa,TRCRSR_TA ,TRCRSR );etm4x_allow_trace (drvdata); + +/* +* According to software usage PKLXF in Arm ARM (ARM DDI 0487 L.a), +* execute a Context synchronization event to guarantee the trace unit +* will observe the new values of the System registers. +*/ +if (!csa->io_mem) +isb (); +/* Enable the trace unit */ etm4x_relaxed_write32 (csa,1 ,TRCPRGCTLR ); -/* Synchronize the register updates for sysreg access */ +/* +* As recommended by section 4.3.7 ("Synchronization when using system +* instructions to progrom the trace unit") of ARM IHI 0064H.b, the +* self-hosted trace analyzer must perform a Context synchronization +* event between writing to the TRCPRGCTLR and reading the TRCSTATR. +*/ if (!csa->io_mem)isb ();
@@ -858,11 +872,16 @@ static void etm4_disable_trace_unit(struct etmv4_drvdata *drvdata)*/ etm4x_prohibit_trace (drvdata);/* -* Make sure everything completes before disabling, as recommended -* by section 7.3.77 ("TRCVICTLR, ViewInst Main Control Register, -* SSTATUS") of ARM IHI 0064D +* Prevent being speculative at the point of disabling the trace unit, +* as recommended by section 7.3.77 ("TRCVICTLR, ViewInst Main Control +* Register, SSTATUS") of ARM IHI 0064D */ dsb (sy); +/* +* According to software usage VKHHY in Arm ARM (ARM DDI 0487 L.a), +* execute a Context synchronization event to guarantee no new +* program-flow trace is generated. +*/ isb ();/* Trace synchronization barrier, is a nop if not supported */ tsb_csync ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/634 soc: renesas: r9a06g032-sysctrl: Handle h2mode setting based on USBF presence
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit e9fee814b054e4f6f2faf3d9c1944869fe41c9dd ]
The CFG_USB[H2MODE] allows to switch the USB configuration. The configuration supported are:
- One host and one device
or
- Two hosts
Set CFG_USB[H2MODE] based on the USBF controller (USB device) availability.
Stable-dep-of: f8def051bbcf ("clk: renesas: r9a06g032: Fix memory leak in error path")
--- drivers/clk/renesas/r9a06g032-clocks.c | 28 ++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/clk/renesas/r9a06g032-clocks.c +28 -0
@@ -25,6 +25,8 @@#include <linux/spinlock.h> #include <dt-bindings/clock/r9a06g032-sysctrl.h> +#define R9A06G032_SYSCTRL_USB 0x00 +#define R9A06G032_SYSCTRL_USB_H2MODE (1<<1)#define R9A06G032_SYSCTRL_DMAMUX 0xA0struct r9a06g032_gate {
@@ -918,6 +920,29 @@ static void r9a06g032_clocks_del_clk_provider(void *data)of_clk_del_provider (data); } +static void __init r9a06g032_init_h2mode (struct r9a06g032_priv *clocks) +{ +struct device_node *usbf_np =NULL ; +u32 usb; + +while ((usbf_np =of_find_compatible_node (usbf_np,NULL , +"renesas,rzn1-usbf" ))) { +if (of_device_is_available (usbf_np)) +break ; + } + + usb =readl (clocks->reg +R9A06G032_SYSCTRL_USB ); +if (usbf_np) { +/* 1 host and 1 device mode */ + usb &= ~R9A06G032_SYSCTRL_USB_H2MODE ; +of_node_put (usbf_np); + }else { +/* 2 hosts mode */ + usb |=R9A06G032_SYSCTRL_USB_H2MODE ; + } +writel (usb, clocks->reg +R9A06G032_SYSCTRL_USB ); +} +static int __init r9a06g032_clocks_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -947,6 +972,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev) clocks->reg =of_iomap (np,0 );if (WARN_ON (!clocks->reg))return -ENOMEM ; + +r9a06g032_init_h2mode (clocks); +for (i =0 ; i <ARRAY_SIZE (r9a06g032_clocks); ++i) {const struct r9a06g032_clkdesc *d = &r9a06g032_clocks[i]; const char *parent_name = d->source ?
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/634 clk: renesas: r9a06g032: Fix memory leak in error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit f8def051bbcf8677f64701e9699bf6d11e2780cd ]
The current code uses of_iomap() to map registers but never calls iounmap() on any error path after the mapping. This causes a memory leak when probe fails after successful ioremap, for example when of_clk_add_provider() or r9a06g032_add_clk_domain() fails.
Replace of_iomap() with devm_of_iomap() to automatically unmap the region on probe failure. Update the error check accordingly to use IS_ERR() and PTR_ERR() since devm_of_iomap() returns ERR_PTR on error.
--- drivers/clk/renesas/r9a06g032-clocks.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/renesas/r9a06g032-clocks.c +3 -3
@@ -969,9 +969,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev)if (IS_ERR (mclk))return PTR_ERR (mclk); - clocks->reg =of_iomap (np,0 ); -if (WARN_ON (!clocks->reg)) -return -ENOMEM ; + clocks->reg =devm_of_iomap (dev, np,0 ,NULL ); +if (IS_ERR (clocks->reg)) +return PTR_ERR (clocks->reg);r9a06g032_init_h2mode (clocks);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/634 lib/vsprintf: Check pointer before dereferencing in time_and_date()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 372a12bd5df0199aa234eaf8ef31ed7ecd61d40f ]
The pointer may be invalid when gets to the printf(). In particular the time_and_date() dereferencing it in some cases without checking.
Move the check from rtc_str() to time_and_date() to cover all cases.
--- lib/vsprintf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/vsprintf.c +3 -3
@@ -1862,9 +1862,6 @@ char *rtc_str(char *buf, char *end, const struct rtc_time *tm,bool found = true;int count =2 ; -if (check_pointer (&buf, end, tm, spec)) -return buf; -switch (fmt[count]) {case 'd' : have_t = false;
@@ -1930,6 +1927,9 @@ static noinline_for_stackchar *time_and_date (char *buf,char *end,void *ptr,struct printf_spec spec,const char *fmt) { +if (check_pointer (&buf, end, ptr, spec)) +return buf; +switch (fmt[1 ]) {case 'R' :return rtc_str (buf, end, (const struct rtc_time *)ptr, spec, fmt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/634 ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 8a7d58845fae061c62b50bc5eeb9bae4a1dedc3d ]
In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just to avoid crashing the whole kernel due to a filesystem corruption.
--- fs/ocfs2/move_extents.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/ocfs2/move_extents.c +7 -1
@@ -98,7 +98,13 @@ static int __ocfs2_move_extent(handle_t *handle, rec = &el->l_recs[index]; -BUG_ON (ext_flags != rec->e_flags); +if (ext_flags != rec->e_flags) { + ret =ocfs2_error (inode->i_sb, +"Inode %llu has corrupted extent %d with flags 0x%x at cpos %u\n" , + (unsigned long long )ino, index, rec->e_flags, cpos); + goto out; + } +/* * after moving/defraging to new location, the extent is not going * to be refcounted anymore.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/634 ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 593ee49222a0d751062fd9a5e4a963ade4ec028a ]
acpi_fwnode_graph_parse_endpoint() calls fwnode_get_parent() to obtain the parent fwnode but returns without calling fwnode_handle_put() on it. This potentially leads to a fwnode refcount leak and prevents the parent node from being released properly.
Call fwnode_handle_put() on the parent fwnode before returning to prevent the leak from occurring.
--- drivers/acpi/property.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/property.c +1 -0
@@ -1634,6 +1634,7 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,if (fwnode_property_read_u32 (fwnode,"reg" , &endpoint->id))fwnode_property_read_u32 (fwnode,"endpoint" , &endpoint->id); +fwnode_handle_put (port_fwnode);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/634 scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit acd194d9b5bac419e04968ffa44351afabb50bac ]
The driver calls ioport_map() to map I/O ports in sim710_probe_common() but never calls ioport_unmap() to release the mapping. This causes resource leaks in both the error path when request_irq() fails and in the normal device removal path via sim710_device_remove().
Add ioport_unmap() calls in the out_release error path and in sim710_device_remove().
--- drivers/scsi/sim710.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/sim710.c +2 -0
@@ -133,6 +133,7 @@ static int sim710_probe_common(struct device *dev, unsigned long base_addr, out_put_host:scsi_host_put (host); out_release: +ioport_unmap (hostdata->base);release_region (base_addr,64 ); out_free:kfree (hostdata);
@@ -148,6 +149,7 @@ static int sim710_device_remove(struct device *dev)scsi_remove_host (host);NCR_700_release (host); +ioport_unmap (hostdata->base);kfree (hostdata);free_irq (host->irq, host);release_region (host->base,64 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/634 leds: netxbig: Fix GPIO descriptor leak in error paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 03865dd8af52eb16c38062df2ed30a91b604780e ]
The function netxbig_gpio_ext_get() acquires GPIO descriptors but fails to release them when errors occur mid-way through initialization. The cleanup callback registered by devm_add_action_or_reset() only runs on success, leaving acquired GPIOs leaked on error paths.
Add goto-based error handling to release all acquired GPIOs before returning errors.
--- drivers/leds/leds-netxbig.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-)
drivers/leds/leds-netxbig.c +26 -10
@@ -364,6 +364,9 @@ static int netxbig_gpio_ext_get(struct device *dev,if (!addr)return -ENOMEM ; + gpio_ext->addr = addr; + gpio_ext->num_addr =0 ; +/* * We cannot use devm_ managed resources with these GPIO descriptors * since they are associated with the "GPIO extension device" which
@@ -375,45 +378,58 @@ static int netxbig_gpio_ext_get(struct device *dev, gpiod =gpiod_get_index (gpio_ext_dev,"addr" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_set_code;gpiod_set_consumer_name (gpiod,"GPIO extension addr" ); addr[i] = gpiod; + gpio_ext->num_addr++; } - gpio_ext->addr = addr; - gpio_ext->num_addr = num_addr; ret =gpiod_count (gpio_ext_dev,"data" );if (ret <0 ) {dev_err (dev,"Failed to count GPIOs in DT property data-gpios\n" ); -return ret; + goto err_free_addr; } num_data = ret; data =devm_kcalloc (dev, num_data,sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; +if (!data) { + ret = -ENOMEM ; + goto err_free_addr; + } + + gpio_ext->data = data; + gpio_ext->num_data =0 ;for (i =0 ; i < num_data; i++) { gpiod =gpiod_get_index (gpio_ext_dev,"data" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_free_data;gpiod_set_consumer_name (gpiod,"GPIO extension data" ); data[i] = gpiod; + gpio_ext->num_data++; } - gpio_ext->data = data; - gpio_ext->num_data = num_data; gpiod =gpiod_get (gpio_ext_dev,"enable" ,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) {dev_err (dev,"Failed to get GPIO from DT property enable-gpio\n" ); -return PTR_ERR (gpiod); + goto err_free_data; }gpiod_set_consumer_name (gpiod,"GPIO extension enable" ); gpio_ext->enable = gpiod;return devm_add_action_or_reset (dev, netxbig_gpio_ext_remove, gpio_ext); + +err_free_data: +for (i =0 ; i < gpio_ext->num_data; i++) +gpiod_put (gpio_ext->data[i]); +err_set_code: + ret =PTR_ERR (gpiod); +err_free_addr: +for (i =0 ; i < gpio_ext->num_addr; i++) +gpiod_put (gpio_ext->addr[i]); +return ret; } static int netxbig_leds_get_of_pdata(struct device *dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/634 PCI: keystone: Exit ks_pcie_probe() for invalid mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit 95d9c3f0e4546eaec0977f3b387549a8463cd49f ]
Commit under Fixes introduced support for PCIe EP mode on AM654x platforms. When the mode happens to be either "DW_PCIE_RC_TYPE" or "DW_PCIE_EP_TYPE", the PCIe Controller is configured accordingly. However, when the mode is neither of them, an error message is displayed, but the driver probe succeeds. Since this "invalid" mode is not associated with a functional PCIe Controller, the probe should fail.
Fix the behavior by exiting "ks_pcie_probe()" with the return value of "-EINVAL" in addition to displaying the existing error message when the mode is invalid.
--- drivers/pci/controller/dwc/pci-keystone.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/dwc/pci-keystone.c +2 -0
@@ -1342,6 +1342,8 @@ static int ks_pcie_probe(struct platform_device *pdev)break ;default :dev_err (dev,"INVALID device type %d\n" , mode); + ret = -EINVAL ; + goto err_get_sync; }ks_pcie_enable_error_irq (ks_pcie);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/634 ps3disk: use memcpy_{from,to}_bvec index
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rene Rebe <[email protected]>
[ Upstream commit 79bd8c9814a273fa7ba43399e1c07adec3fc95db ]
With 6e0a48552b8c (ps3disk: use memcpy_{from,to}_bvec) converting ps3disk to new bvec helpers, incrementing the offset was accidently lost, corrupting consecutive buffers. Restore index for non-corrupted data transfers.
--- drivers/block/ps3disk.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/block/ps3disk.c +4 -0
@@ -85,10 +85,14 @@ static void ps3disk_scatter_gather(struct ps3_storage_device *dev,struct bio_vec bvec;rq_for_each_segment (bvec, req, iter) { +dev_dbg (&dev->sbd.core,"%s:%u: %u sectors from %llu\n" , + __func__, __LINE__,bio_sectors (iter.bio), + iter.bio->bi_iter.bi_sector);if (gather)memcpy_from_bvec (dev->bounce_buf + offset, &bvec);else memcpy_to_bvec (&bvec, dev->bounce_buf + offset); + offset += bvec.bv_len; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/634 selftests/bpf: Fix failure paths in send_signal test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit c13339039891dbdfa6c1972f0483bd07f610b776 ]
When test_send_signal_kern__open_and_load() fails parent closes the pipe which cases ASSERT_EQ(read(pipe_p2c...)) to fail, but child continues and enters infinite loop, while parent is stuck in wait(NULL). Other error paths have similar issue, so kill the child before waiting on it.
The bug was discovered while compiling all of selftests with -O1 instead of -O2 which caused progs/test_send_signal_kern.c to fail to load.
--- tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/bpf/prog_tests/send_signal.c +5 -0
@@ -141,6 +141,11 @@ static void test_send_signal_common(struct perf_event_attr *attr, skel_open_load_failure:close (pipe_c2p[0 ]);close (pipe_p2c[1 ]); +/* +* Child is either about to exit cleanly or stuck in case of errors. +* Nudge it to exit. +*/ +kill (pid,SIGKILL );wait (NULL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/634 bpf: Check skb->transport_header is set in bpf_skb_check_mtu
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit d946f3c98328171fa50ddb908593cf833587f725 ]
The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used:
bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)
The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used:
WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb
For a normal ingress skb (not test_run), skb_reset_transport_header
is performed but there is plan to avoid setting it as described in
commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()").
This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.
--- net/core/filter.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/core/filter.c +6 -3
@@ -6206,9 +6206,12 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb,*/ if (skb_is_gso (skb)) { ret =BPF_MTU_CHK_RET_SUCCESS ; -if (flags &BPF_MTU_CHK_SEGS && - !skb_gso_validate_network_len (skb, mtu)) - ret =BPF_MTU_CHK_RET_SEGS_TOOBIG ; +if (flags &BPF_MTU_CHK_SEGS ) { +if (!skb_transport_header_was_set (skb)) +return -EINVAL ; +if (!skb_gso_validate_network_len (skb, mtu)) + ret =BPF_MTU_CHK_RET_SEGS_TOOBIG ; + } } out: *mtu_len = mtu;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/634 watchdog: wdat_wdt: Fix ACPI table leak in probe function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 25c0b472eab8379683d4eef681185c104bed8ffd ]
wdat_wdt_probe() calls acpi_get_table() to obtain the WDAT ACPI table but never calls acpi_put_table() on any paths. This causes a permanent ACPI table memory leak.
Add a single cleanup path which calls acpi_put_table() to ensure the ACPI table is always released.
--- drivers/watchdog/wdat_wdt.c | 64 +++++++++++++++++++++++++------------ 1 file changed, 43 insertions(+), 21 deletions(-)
drivers/watchdog/wdat_wdt.c +43 -21
@@ -327,19 +327,27 @@ static int wdat_wdt_probe(struct platform_device *pdev)return -ENODEV ; wdat =devm_kzalloc (dev,sizeof (*wdat),GFP_KERNEL ); -if (!wdat) -return -ENOMEM ; +if (!wdat) { + ret = -ENOMEM ; + goto out_put_table; + } regs =devm_kcalloc (dev, pdev->num_resources,sizeof (*regs),GFP_KERNEL ); -if (!regs) -return -ENOMEM ; +if (!regs) { + ret = -ENOMEM ; + goto out_put_table; + }/* WDAT specification wants to have >= 1ms period */ -if (tbl->timer_period <1 ) -return -EINVAL ; -if (tbl->min_count > tbl->max_count) -return -EINVAL ; +if (tbl->timer_period <1 ) { + ret = -EINVAL ; + goto out_put_table; + } +if (tbl->min_count > tbl->max_count) { + ret = -EINVAL ; + goto out_put_table; + } wdat->period = tbl->timer_period; wdat->wdd.min_timeout =DIV_ROUND_UP (wdat->period * tbl->min_count,1000 );
@@ -356,15 +364,20 @@ static int wdat_wdt_probe(struct platform_device *pdev) res = &pdev->resource[i];if (resource_type (res) ==IORESOURCE_MEM ) { reg =devm_ioremap_resource (dev, res); -if (IS_ERR (reg)) -return PTR_ERR (reg); +if (IS_ERR (reg)) { + ret =PTR_ERR (reg); + goto out_put_table; + } }else if (resource_type (res) ==IORESOURCE_IO ) { reg =devm_ioport_map (dev, res->start,1 ); -if (!reg) -return -ENOMEM ; +if (!reg) { + ret = -ENOMEM ; + goto out_put_table; + } }else {dev_err (dev,"Unsupported resource\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } regs[i] = reg;
@@ -386,8 +399,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) } instr =devm_kzalloc (dev,sizeof (*instr),GFP_KERNEL ); -if (!instr) -return -ENOMEM ; +if (!instr) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (&instr->node); instr->entry = entries[i];
@@ -418,7 +433,8 @@ static int wdat_wdt_probe(struct platform_device *pdev)if (!instr->reg) {dev_err (dev,"I/O resource not found\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } instructions = wdat->instructions[action];
@@ -426,8 +442,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) instructions =devm_kzalloc (dev,sizeof (*instructions),GFP_KERNEL ); -if (!instructions) -return -ENOMEM ; +if (!instructions) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (instructions); wdat->instructions[action] = instructions;
@@ -441,7 +459,7 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_enable_reboot (wdat);if (ret) -return ret; + goto out_put_table;platform_set_drvdata (pdev, wdat);
@@ -458,12 +476,16 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_set_timeout (&wdat->wdd, timeout);if (ret) -return ret; + goto out_put_table;watchdog_set_nowayout (&wdat->wdd, nowayout);watchdog_stop_on_reboot (&wdat->wdd);watchdog_stop_on_unregister (&wdat->wdd); -return devm_watchdog_register_device (dev, &wdat->wdd); + ret =devm_watchdog_register_device (dev, &wdat->wdd); + +out_put_table: +acpi_put_table ((struct acpi_table_header *)tbl); +return ret; }static int wdat_wdt_suspend_noirq (struct device *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/634 NFSD/blocklayout: Fix minlength check in proc_layoutget
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <[email protected]>
[ Upstream commit 3524b021b0ec620a76c89aee78e9d4b4130fb711 ]
The extent returned by the file system may have a smaller offset than the segment offset requested by the client. In this case, the minimum segment length must be checked against the requested range. Otherwise, the client may not be able to continue the read/write operation.
--- fs/nfsd/blocklayout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfsd/blocklayout.c +3 -1
@@ -23,6 +23,7 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, {struct nfsd4_layout_seg *seg = &args->lg_seg;struct super_block *sb = inode->i_sb; +u64 length;u32 block_size =i_blocksize (inode);struct pnfs_block_extent *bex;struct iomap iomap;
@@ -53,7 +54,8 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, goto out_error; } -if (iomap.length < args->lg_minlength) { + length = iomap.offset + iomap.length - seg->offset; +if (length < args->lg_minlength) {dprintk ("pnfsd: extent smaller than minlength\n" ); goto out_layoutunavailable; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/634 wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 9b5b9c042b30befc5b37e4539ace95af70843473 ]
In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit.
Fix that by jumping to err_free_rings label on error, which calls rtl8180_free_rx_ring() to free the allocations. Remove the free of rx_ring in rtl8180_init_rx_ring() error path, and set the freed priv->rx_buf entry to null, to avoid double free.
--- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +2 -7
@@ -1023,9 +1023,6 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)dma_addr_t *mapping; entry = priv->rx_ring + priv->rx_ring_sz*i;if (!skb) { -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma);wiphy_err (dev->wiphy,"Cannot allocate RX skb\n" );return -ENOMEM ; }
@@ -1037,9 +1034,7 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)if (dma_mapping_error (&priv->pdev->dev, *mapping)) {kfree_skb (skb); -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma); + priv->rx_buf[i] =NULL ;wiphy_err (dev->wiphy,"Cannot map DMA for RX skb\n" );return -ENOMEM ; }
@@ -1130,7 +1125,7 @@ static int rtl8180_start(struct ieee80211_hw *dev) ret =rtl8180_init_rx_ring (dev);if (ret) -return ret; + goto err_free_rings;for (i =0 ; i < (dev->queues +1 ); i++)if ((ret =rtl8180_init_tx_ring (dev, i,16 )))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/634 bpf: Improve program stats run-time calculation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Fernandez <[email protected]>
[ Upstream commit ce09cbdd988887662546a1175bcfdfc6c8fdd150 ]
This patch improves the run-time calculation for program stats by capturing the duration as soon as possible after the program returns.
Previously, the duration included u64_stats_t operations. While the instrumentation overhead is part of the total time spent when stats are enabled, distinguishing between the program's native execution time and the time spent due to instrumentation is crucial for accurate performance analysis.
By making this change, the patch facilitates more precise optimization of BPF programs, enabling users to understand their performance in environments without stats enabled.
I used a virtualized environment to measure the run-time over one minute for a basic raw_tracepoint/sys_enter program, which just increments a local counter. Although the virtualization introduced some performance degradation that could affect the results, I observed approximately a 16% decrease in average run-time reported by stats with this change (310 -> 260 nsec).
Stable-dep-of: 7dc211c1159d ("bpf: Fix invalid prog->stats access when update_effective_progs fails")
--- include/linux/filter.h | 6 ++++-- kernel/bpf/trampoline.c | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-)
include/linux/filter.h +4 -2
@@ -590,14 +590,16 @@ static __always_inline u32 __bpf_prog_run(const struct bpf_prog *prog,cant_migrate ();if (static_branch_unlikely (&bpf_stats_enabled_key)) {struct bpf_prog_stats *stats; -u64 start =sched_clock (); +u64 duration, start =sched_clock ();unsigned long flags; ret =dfunc (ctx, prog->insnsi, prog->bpf_func); + + duration =sched_clock () - start; stats =this_cpu_ptr (prog->stats); flags =u64_stats_update_begin_irqsave (&stats->syncp);u64_stats_inc (&stats->cnt); -u64_stats_add (&stats->nsecs,sched_clock () - start); +u64_stats_add (&stats->nsecs, duration);u64_stats_update_end_irqrestore (&stats->syncp, flags); }else { ret =dfunc (ctx, prog->insnsi, prog->bpf_func);
kernel/bpf/trampoline.c +2 -1
@@ -901,12 +901,13 @@ static void notrace update_prog_stats(struct bpf_prog *prog,* Hence check that 'start' is valid. */ start > NO_START_TIME) { +u64 duration =sched_clock () - start;unsigned long flags; stats =this_cpu_ptr (prog->stats); flags =u64_stats_update_begin_irqsave (&stats->syncp);u64_stats_inc (&stats->cnt); -u64_stats_add (&stats->nsecs,sched_clock () - start); +u64_stats_add (&stats->nsecs, duration);u64_stats_update_end_irqrestore (&stats->syncp, flags); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/634 bpf: Fix invalid prog->stats access when update_effective_progs fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <[email protected]>
[ Upstream commit 7dc211c1159d991db609bdf4b0fb9033c04adcbc ]
Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows:
__cgroup_bpf_detach
update_effective_progs
compute_effective_progs
bpf_prog_array_alloc <-- fault inject
purge_effective_progs
/* change to dummy_bpf_prog */
array->items[index] = &dummy_bpf_prog.prog---softirq start---__do_softirq
...
__cgroup_bpf_run_filter_skb
__bpf_prog_run_save_cb
bpf_prog_run
stats = this_cpu_ptr(prog->stats)
/* invalid memory access */
flags = u64_stats_update_begin_irqsave(&stats->syncp)---softirq end---
static_branch_dec(&cgroup_bpf_enabled_key[atype])
The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access.
To fix it, skip updating stats when stats is NULL.
--- include/linux/filter.h | 12 +++++++----- kernel/bpf/syscall.c | 3 +++ 2 files changed, 10 insertions(+), 5 deletions(-)
include/linux/filter.h +7 -5
@@ -596,11 +596,13 @@ static __always_inline u32 __bpf_prog_run(const struct bpf_prog *prog, ret =dfunc (ctx, prog->insnsi, prog->bpf_func); duration =sched_clock () - start; - stats =this_cpu_ptr (prog->stats); - flags =u64_stats_update_begin_irqsave (&stats->syncp); -u64_stats_inc (&stats->cnt); -u64_stats_add (&stats->nsecs, duration); -u64_stats_update_end_irqrestore (&stats->syncp, flags); +if (likely (prog->stats)) { + stats =this_cpu_ptr (prog->stats); + flags =u64_stats_update_begin_irqsave (&stats->syncp); +u64_stats_inc (&stats->cnt); +u64_stats_add (&stats->nsecs, duration); +u64_stats_update_end_irqrestore (&stats->syncp, flags); + } }else { ret =dfunc (ctx, prog->insnsi, prog->bpf_func); }
kernel/bpf/syscall.c +3 -0
@@ -2141,6 +2141,9 @@ void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog)struct bpf_prog_stats *stats;unsigned int flags; +if (unlikely (!prog->stats)) +return ; + stats =this_cpu_ptr (prog->stats); flags =u64_stats_update_begin_irqsave (&stats->syncp);u64_stats_inc (&stats->misses);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/634 powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
[ Upstream commit eae40a6da63faa9fb63ff61f8fa2b3b57da78a84 ]
HPTE format was changed since Power9 (ISA 3.0) onwards. While dumping kernel hash page tables, nothing gets printed on powernv P9+. This patch utilizes the helpers added in the patch tagged as fixes, to convert new format to old format and dump the hptes. This fix is only needed for native_find() (powernv), since pseries continues to work fine with the old format.
--- arch/powerpc/mm/ptdump/hashpagetable.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/mm/ptdump/hashpagetable.c +6 -0
@@ -216,6 +216,8 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64 vpn =hpt_vpn (ea, vsid, ssize); hash =hpt_hash (vpn, shift, ssize); want_v =hpte_encode_avpn (vpn, psize, ssize); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) + want_v =hpte_old_to_new_v (want_v);/* to check in the secondary hash table, we invert the hash */ if (!primary)
@@ -229,6 +231,10 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64/* HPTE matches */ *v =be64_to_cpu (hptep->v); *r =be64_to_cpu (hptep->r); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) { + *v =hpte_new_to_old_v (*v, *r); + *r =hpte_new_to_old_r (*r); + }return 0 ; } ++hpte_group;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/634 fs/ntfs3: out1 also needs to put mi
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 4d78d1173a653acdaf7500a32b8dc530ca4ad075 ]
After ntfs_look_free_mft() executes successfully, all subsequent code that fails to execute must put mi.
--- fs/ntfs3/frecord.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/frecord.c +1 -1
@@ -1067,9 +1067,9 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, out2:ni_remove_mi (ni, mi); -mi_put (mi); out1: +mi_put (mi);ntfs_mark_rec_free (sbi, rno, is_mft); out:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/634 fs/ntfs3: Prevent memory leaks in add sub record
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit ccc4e86d1c24260c18ae94541198c3711c140da6 ]
If a rb node with the same ino already exists in the rb tree, the newly alloced mft_inode in ni_add_subrecord() will not have its memory cleaned up, which leads to the memory leak issue reported by syzbot.
The best option to avoid this issue is to put the newly alloced mft node when a rb node with the same ino already exists in the rb tree and return the rb node found in the rb tree to the parent layer.
syzbot reported:
BUG: memory leak
unreferenced object 0xffff888110bef280 (size 128):
backtrace (crc 126a088f):
ni_add_subrecord+0x31/0x180 fs/ntfs3/frecord.c:317
ntfs_look_free_mft+0xf0/0x790 fs/ntfs3/fsntfs.c:715
BUG: memory leak
unreferenced object 0xffff888109093400 (size 1024):
backtrace (crc 7197c55e):
mi_init+0x2b/0x50 fs/ntfs3/record.c:105
mi_format_new+0x40/0x220 fs/ntfs3/record.c:422--- fs/ntfs3/frecord.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ntfs3/frecord.c +4 -2
@@ -377,8 +377,10 @@ bool ni_add_subrecord(struct ntfs_inode *ni, CLST rno, struct mft_inode **mi)mi_get_ref (&ni->mi, &m->mrec->parent_ref); -ni_add_mi (ni, m); - *mi = m; + *mi =ni_ins_mi (ni, &ni->mi_tree, m->rno, &m->node); +if (*mi != m) +mi_put (m); +return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/634 drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Liu <[email protected]>
[ Upstream commit 20ac36b71c53b8c36c6903b5ca87c75226700a97 ]
if matrixbit is 11,
The range of color matrix is from 0 to (BIT(12) - 1). Values from 0 to (BIT(11) - 1) represent positive numbers, values from BIT(11) to (BIT(12) - 1) represent negative numbers. For example, -1 need converted to 8191.
so convert S31.32 to HW Q2.11 format by drm_color_ctm_s31_32_to_qm_n, and set int_bits to 2.
--- drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +---------------------- 1 file changed, 1 insertion(+), 22 deletions(-)
drivers/gpu/drm/mediatek/mtk_disp_ccorr.c +1 -22
@@ -85,27 +85,6 @@ void mtk_ccorr_stop(struct device *dev)writel_relaxed (0x0 , ccorr->regs +DISP_CCORR_EN ); } -/* Converts a DRM S31.32 value to the HW S1.n format. */ -static u16 mtk_ctm_s31_32_to_s1_n (u64 in,u32 n) -{ -u16 r; - -/* Sign bit. */ - r = in &BIT_ULL (63 ) ?BIT (n +1 ) :0 ; - -if ((in &GENMASK_ULL (62 ,33 )) >0 ) { -/* identity value 0x100000000 -> 0x400(mt8183), */ -/* identity value 0x100000000 -> 0x800(mt8192), */ -/* if bigger this, set it to max 0x7ff. */ - r |=GENMASK (n,0 ); - }else { -/* take the n+1 most important bits. */ - r |= (in >> (32 - n)) &GENMASK (n,0 ); - } - -return r; -} -void mtk_ccorr_ctm_set (struct device *dev,struct drm_crtc_state *state) {struct mtk_disp_ccorr *ccorr =dev_get_drvdata (dev);
@@ -124,7 +103,7 @@ void mtk_ccorr_ctm_set(struct device *dev, struct drm_crtc_state *state) input = ctm->matrix;for (i =0 ; i <ARRAY_SIZE (coeffs); i++) - coeffs[i] =mtk_ctm_s31_32_to_s1_n (input[i], matrix_bits); + coeffs[i] =drm_color_ctm_s31_32_to_qm_n (input[i],2 , matrix_bits);mtk_ddp_write (cmdq_pkt, coeffs[0 ] <<16 | coeffs[1 ], &ccorr->cmdq_reg, ccorr->regs,DISP_CCORR_COEF_0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/634 pwm: bcm2835: Make sure the channel is enabled after pwm_request()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit cda323dbda76600bf9761970d58517648f0de67d ]
The .free callback cleared among others the enable bit PWENx in the control register. When the PWM is requested later again this bit isn't restored but the core assumes the PWM is enabled and thus skips a request to configure the same state as before.
To fix that don't touch the hardware configuration in .free(). For symmetry also drop .request() and configure the mode completely in .apply().
--- drivers/pwm/pwm-bcm2835.c | 28 +++------------------------- 1 file changed, 3 insertions(+), 25 deletions(-)
drivers/pwm/pwm-bcm2835.c +3 -25
@@ -35,29 +35,6 @@ static inline struct bcm2835_pwm *to_bcm2835_pwm(struct pwm_chip *chip) return container_of(chip, struct bcm2835_pwm, chip); } -static int bcm2835_pwm_request (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); - value |= (PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); - -return 0 ; -} - -static void bcm2835_pwm_free (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); -} -static int bcm2835_pwm_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) {
@@ -109,6 +86,9 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,/* set polarity */ val =readl (pc->base +PWM_CONTROL ); + val &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); + val |=PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm); +if (state->polarity ==PWM_POLARITY_NORMAL ) val &= ~(PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm));else
@@ -126,8 +106,6 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, }static const struct pwm_ops bcm2835_pwm_ops = { - .request = bcm2835_pwm_request, - .free = bcm2835_pwm_free, .apply = bcm2835_pwm_apply, .owner =THIS_MODULE , };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/634 mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit b4b1bd1f330fdd13706382be6c90ce9f58cee3f5 ]
If devm_request_threaded_irq() fails after irq_domain_create_linear() succeeds in mt6397_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_create_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6397-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6397-irq.c +1 -0
@@ -213,6 +213,7 @@ int mt6397_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"failed to register irq=%d; err: %d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/634 mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 384bd58bf7095e4c4c8fcdbcede316ef342c630c ]
If devm_request_threaded_irq() fails after irq_domain_add_linear() succeeds in mt6358_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_add_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6358-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6358-irq.c +1 -0
@@ -287,6 +287,7 @@ int mt6358_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"Failed to register IRQ=%d, ret=%d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/634 phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 662bb179d3381c7c069e44bb177396bcaee31cc8 ]
If an error occurs after the reset_control_deassert(), reset_control_assert() must be called, as already done in the remove function.
Use devm_add_action_or_reset() to add the missing call and simplify the .remove() function accordingly.
While at it, drop struct rcar_gen3_chan::rstc as it is not used aymore.
[claudiu.beznea: removed "struct reset_control *rstc = data;" from
rcar_gen3_reset_assert(), dropped struct rcar_gen3_chan::rstc]
--- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/phy/renesas/phy-rcar-gen3-usb2.c +14 -6
@@ -119,7 +119,6 @@ struct rcar_gen3_chan {struct extcon_dev *extcon;struct rcar_gen3_phy rphys[NUM_OF_PHYS ];struct regulator *vbus; -struct reset_control *rstc;struct work_struct work;spinlock_t lock;/* protects access to hardware and driver data structure. */ enum usb_dr_mode dr_mode;
@@ -660,21 +659,31 @@ static enum usb_dr_mode rcar_gen3_get_dr_mode(struct device_node *np)return candidate; } +static void rcar_gen3_reset_assert (void *data) +{ +reset_control_assert (data); +} +static int rcar_gen3_phy_usb2_init_bus (struct rcar_gen3_chan *channel) {struct device *dev = channel->dev; +struct reset_control *rstc;int ret;u32 val; - channel->rstc =devm_reset_control_array_get_shared (dev); -if (IS_ERR (channel->rstc)) -return PTR_ERR (channel->rstc); + rstc =devm_reset_control_array_get_shared (dev); +if (IS_ERR (rstc)) +return PTR_ERR (rstc); ret =pm_runtime_resume_and_get (dev);if (ret)return ret; - ret =reset_control_deassert (channel->rstc); + ret =reset_control_deassert (rstc); +if (ret) + goto rpm_put; + + ret =devm_add_action_or_reset (dev, rcar_gen3_reset_assert, rstc);if (ret) goto rpm_put;
@@ -816,7 +825,6 @@ static int rcar_gen3_phy_usb2_remove(struct platform_device *pdev)if (channel->is_otg_channel)device_remove_file (&pdev->dev, &dev_attr_role); -reset_control_assert (channel->rstc);pm_runtime_disable (&pdev->dev);return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/634 net: phy: adin1100: Fix software power-down ready condition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Dahl <[email protected]>
[ Upstream commit bccaf1fe08f2c9f96f6bc38391d41e67f6bf38e3 ]
Value CRSM_SFT_PD written to Software Power-Down Control Register (CRSM_SFT_PD_CNTRL) is 0x01 and therefor different to value CRSM_SFT_PD_RDY (0x02) read from System Status Register (CRSM_STAT) for confirmation powerdown has been reached.
The condition could have only worked when disabling powerdown (both 0x00), but never when enabling it (0x01 != 0x02).
Result is a timeout, like so:
$ ifdown eth0
macb f802c000.ethernet eth0: Link is Down
ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110
ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110--- drivers/net/phy/adin1100.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/adin1100.c +1 -1
@@ -148,7 +148,7 @@ static int adin_set_powerdown_mode(struct phy_device *phydev, bool en)return ret;return phy_read_mmd_poll_timeout (phydev,MDIO_MMD_VEND1 ,ADIN_CRSM_STAT , ret, - (ret &ADIN_CRSM_SFT_PD_RDY ) == val, + !!(ret &ADIN_CRSM_SFT_PD_RDY ) == en,1000 ,30000 , true); }
Signature · 1 line
2.51.0