5.10.248-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.10.248-rc1 review
This is the start of the stable review cycle for the 5.10.248 release. There are 451 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.248-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.248-rc1
Michal Rábek <[email protected]>
scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
Alexander Stein <[email protected]>
ASoC: fsl_sai: Add missing registers to cache default
Tetsuo Handa <[email protected]>
can: j1939: make j1939_session_activate() fail if device is no longer registered
Sumeet Pawnikar <[email protected]>
powercap: fix sscanf() error return value handling
Sumeet Pawnikar <[email protected]>
powercap: fix race condition in register_control_type()
NeilBrown <[email protected]>
nfsd: provide locking for v4_end_grace
Laibin Qiu <[email protected]>
blk-throttle: Set BIO_THROTTLED when bio has been throttled
Eric Dumazet <[email protected]>
arp: do not assume dev_hard_header() does not change skb->head
Petko Manolov <[email protected]>
net: usb: pegasus: fix memory leak in update_eth_regs_async()
Xiang Mei <[email protected]>
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
René Rebe <[email protected]>
HID: quirks: work around VID/PID conflict for appledisplay
Srijit Bose <[email protected]>
bnxt_en: Fix potential data corruption with HW GRO/LRO
Jakub Kicinski <[email protected]>
eth: bnxt: move and rename reset helpers
Gal Pressman <[email protected]>
net/mlx5e: Don't print error message due to invalid module
Di Zhu <[email protected]>
netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
Weiming Shi <[email protected]>
net: sock: fix hardened usercopy panic in sock_recv_errqueue
yuan.gao <[email protected]>
inet: ping: Fix icmp out counting
Alexandre Knecht <[email protected]>
bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: update last_gc only when GC has been performed
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_synproxy: avoid possible data-race on update operation
Ian Ray <[email protected]>
ARM: dts: imx6q-ba16: fix RTC interrupt level
Xingui Yang <[email protected]>
scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed"
Wen Xiong <[email protected]>
scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
Trond Myklebust <[email protected]>
NFS: Fix up the automount fs_context to use the correct cred
Scott Mayhew <[email protected]>
NFSv4: ensure the open stateid seqid doesn't go backwards
Sam James <[email protected]>
alpha: don't reference obsolete termio struct for TC* constants
Sebastian Andrzej Siewior <[email protected]>
ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
Jakub Sitnicki <[email protected]>
bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
Kuniyuki Iwashima <[email protected]>
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
Tariq Toukan <[email protected]>
net: netdevice: Add operation ndo_sk_get_lower_dev
Sharath Chandra Vurukala <[email protected]>
net: Add locking to protect skb->dev access in ip_output
Ye Bin <[email protected]>
ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
Ye Bin <[email protected]>
ext4: introduce ITAIL helper
Ilya Dryomov <[email protected]>
libceph: make calc_target() set t->paused, not just clear it
Tuo Li <[email protected]>
libceph: make free_choose_arg_map() resilient to partial allocation
Ilya Dryomov <[email protected]>
libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
Eric Dumazet <[email protected]>
wifi: avoid kernel-infoleak from struct iw_point
Miaoqian Lin <[email protected]>
drm/pl111: Fix error handling in pl111_amba_probe
Eric Biggers <[email protected]>
lib/crypto: aes: Fix missing MMU protection for AES S-box
Alexander Usyskin <[email protected]>
mei: me: add nova lake point S DID
Thomas Fourier <[email protected]>
net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
Thomas Fourier <[email protected]>
atm: Fix dma_free_coherent() size
Johan Hovold <[email protected]>
usb: gadget: lpc32xx_udc: fix clock imbalance in error path
Su Hui <[email protected]>
net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
Sanjeev Yadav <[email protected]>
scsi: core: ufs: Fix a hang in the error handler
Greg Kroah-Hartman <[email protected]>
Revert "iommu/amd: Skip enabling command/event buffers for kdump"
Sean Nyekjaer <[email protected]>
pwm: stm32: Always program polarity
Christian Hitz <[email protected]>
leds: leds-lp50xx: Enable chip before any communication
Uwe Kleine-König <[email protected]>
leds: lp50xx: Remove duplicated error reporting in .remove()
Andy Shevchenko <[email protected]>
leds: lp50xx: Get rid of redundant check in lp50xx_enable_disable()
Andy Shevchenko <[email protected]>
leds: lp50xx: Reduce level of dereferences
Shin'ichiro Kawasaki <[email protected]>
bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
Josef Bacik <[email protected]>
btrfs: do not clean up repair bio if submit fails
Kees Cook <[email protected]>
ovl: Use "buf" flexible array for memcpy() destination
Henry Martin <[email protected]>
cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
Mike Christie <[email protected]>
scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
Mike Christie <[email protected]>
scsi: iscsi: Move pool freeing
Peter Xu <[email protected]>
mm/mprotect: use long for page accountings and retval
Chuck Lever <[email protected]>
NFSD: NFSv4 file creation neglects setting ACL
Jouni Malinen <[email protected]>
wifi: mac80211: Discard Beacon frames to non-broadcast address
Thomas Zimmermann <[email protected]>
drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
NeilBrown <[email protected]>
lockd: fix vfs_test_lock() calls
Marek Szyprowski <[email protected]>
media: samsung: exynos4-is: fix potential ABBA deadlock on init
Johan Hovold <[email protected]>
media: vpif_capture: fix section mismatch
Haoxiang Li <[email protected]>
media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
David Hildenbrand <[email protected]>
mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize()
David Hildenbrand <[email protected]>
mm/balloon_compaction: we cannot have isolated pages in the balloon list
Miaohe Lin <[email protected]>
mm/balloon_compaction: make balloon page compaction callbacks static
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix clk prepare imbalance on probe failure
Christophe JAILLET <[email protected]>
ASoC: stm32: sai: Use the devm_clk_get_optional() helper
Kuninori Morimoto <[email protected]>
ASoC: stm: Use dev_err_probe() helper
Miaoqian Lin <[email protected]>
media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix disabling L0s capability
Donet Tom <[email protected]>
powerpc/64s/slb: Fix SLB multihit issue during SLB preload
Johan Hovold <[email protected]>
iommu/qcom: fix device leak on of_xlate()
Nicolas Ferre <[email protected]>
ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
Shivani Agarwal <[email protected]>
crypto: af_alg - zero initialize memory allocated via sock_kmalloc
Gui-Dong Han <[email protected]>
hwmon: (max16065) Use local variable to avoid TOCTOU
Guenter Roeck <[email protected]>
hwmon: replace snprintf in show functions with sysfs_emit
Joshua Rogers <[email protected]>
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
Chuck Lever <[email protected]>
NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
Jarkko Sakkinen <[email protected]>
tpm: Cap the number of PCR banks
Ye Bin <[email protected]>
jbd2: fix the inconsistency between checksum and data in memory for journal sb
Johan Hovold <[email protected]>
usb: ohci-nxp: fix device leak on probe failure
Zhang Zekun <[email protected]>
usb: ohci-nxp: Use helper function devm_clk_get_enabled()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ignore unknown endpoint flags
Udipto Goswami <[email protected]>
usb: dwc3: keep susphy enabled during exit to avoid controller faults
Chao Yu <[email protected]>
f2fs: fix to avoid updating zero-sized extent in extent cache
Chao Yu <[email protected]>
f2fs: fix to propagate error from f2fs_enable_checkpoint()
Chao Yu <[email protected]>
f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
Chao Yu <[email protected]>
f2fs: use global inline_xattr_slab instead of per-sb slab cache
Haoxiang Li <[email protected]>
xfs: fix a memory leak in xfs_buf_item_init()
Josef Bacik <[email protected]>
btrfs: don't rewrite ret from inode_permission
Fedor Pchelkin <[email protected]>
ext4: fix string copying in parse_apply_sb_mount_options()
Junrui Luo <[email protected]>
ALSA: wavefront: Fix integer overflow in sample size validation
Junrui Luo <[email protected]>
ALSA: wavefront: Clear substream pointers on close
Kees Cook <[email protected]>
net/mlx5e: Avoid field-overflowing memcpy()
Jimmy Hu <[email protected]>
usb: gadget: udc: fix use-after-free in usb_gadget_state_work
Łukasz Bartosik <[email protected]>
xhci: dbgtty: fix device unregister
Alan Stern <[email protected]>
HID: core: Harden s32ton() against conversion to 0 bits
Shigeru Yoshida <[email protected]>
ipv4: Fix uninit-value access in __ip_make_skb()
Shigeru Yoshida <[email protected]>
ipv6: Fix potential uninit-value access in __ip6_make_skb()
Michal Pecio <[email protected]>
usb: xhci: Apply the link chain quirk on NEC isoc endpoints
Niklas Neronin <[email protected]>
usb: xhci: move link chain bit quirk checks into one helper function.
Zack Rusin <[email protected]>
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Peilin Ye <[email protected]>
fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount
Peilin Ye <[email protected]>
parisc/sticore: Avoid hard-coding built-in font charcount
Peilin Ye <[email protected]>
Fonts: Add charcount field to font_desc
Peilin Ye <[email protected]>
console: Delete dummy con_font_set() and con_font_default() callback implementations
Peilin Ye <[email protected]>
console: Delete unused con_font_copy() callback implementations
Maximilian Immanuel Brandtner <[email protected]>
virtio_console: fix order of fields cols and rows
Zhu Yanjun <[email protected]>
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
Lyude Paul <[email protected]>
drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
Xiaolei Wang <[email protected]>
net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
Deepanshu Kartikey <[email protected]>
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
Ethan Nelson-Moore <[email protected]>
net: usb: sr9700: fix incorrect command used to write single register
Haoxiang Li <[email protected]>
nfsd: Drop the client reference in client_states_open()
Haoxiang Li <[email protected]>
fjes: Add missing iounmap in fjes_hw_init()
Guangshuo Li <[email protected]>
e1000: fix OOB in e1000_tbi_should_accept()
Jason Gunthorpe <[email protected]>
RDMA/cm: Fix leaking the multicast GID table reference
Jason Gunthorpe <[email protected]>
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
Matthew Wilcox (Oracle) <[email protected]>
idr: fix idr_alloc() returning an ID out of range
Duoming Zhou <[email protected]>
media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
Duoming Zhou <[email protected]>
media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
Duoming Zhou <[email protected]>
media: TDA1997x: Remove redundant cancel_delayed_work in probe
Ivan Abramov <[email protected]>
media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
Haotian Zhang <[email protected]>
media: cec: Fix debugfs leak on bus_register() failure
René Rebe <[email protected]>
fbdev: tcx.c fix mem_map to correct smem_start offset
Thorsten Blum <[email protected]>
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
Rene Rebe <[email protected]>
fbdev: gbefb: fix to use physical address instead of dma address
Uladzislau Rezki (Sony) <[email protected]>
dm-ebs: Mark full buffer dirty even on partial write
Ivan Abramov <[email protected]>
media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
Sven Schnelle <[email protected]>
parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
Sven Schnelle <[email protected]>
parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
Haotian Zhang <[email protected]>
media: rc: st_rc: Fix reset control resource leak
Krzysztof Kozlowski <[email protected]>
mfd: max77620: Fix potential IRQ chip conflict when probing two devices
Johan Hovold <[email protected]>
mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
Christian Hitz <[email protected]>
leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
Christian Hitz <[email protected]>
leds: leds-lp50xx: Allow LED 0 to be added to module bank
Lukas Wunner <[email protected]>
PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
Hans de Goede <[email protected]>
HID: logitech-dj: Remove duplicate error logging
Johan Hovold <[email protected]>
iommu/sun50i: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/omap: fix device leaks on probe_device()
Johan Hovold <[email protected]>
iommu/mediatek: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leak on probe_device()
Johan Hovold <[email protected]>
iommu/ipmmu-vmsa: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/exynos: fix device leak on of_xlate()
Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6adm: the the copp device only during last instance
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: perform correct state check before closing
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix device leak on probe
Yipeng Zou <[email protected]>
selftests/ftrace: traceonoff_triggers: strip off names
Thomas Fourier <[email protected]>
RDMA/bnxt_re: fix dma_free_coherent() pointer
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix to use correct page size for PDE table
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
Jang Ingyu <[email protected]>
RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
Michael Margolin <[email protected]>
RDMA/efa: Remove possible negative shift
Pwnverse <[email protected]>
net: rose: fix invalid array index in rose_kill_by_device()
Ido Schimmel <[email protected]>
ipv4: Fix reference count leak when using error routes with nexthop objects
Will Rosenberg <[email protected]>
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
Anshumali Gaur <[email protected]>
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
Bagas Sanjaya <[email protected]>
net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
Jonas Gorski <[email protected]>
net: dsa: b53: skip multicast entries for fdb_dump()
Thomas Fourier <[email protected]>
firewire: nosy: Fix dma_free_coherent() size
Christophe JAILLET <[email protected]>
firewire: nosy: switch from 'pci_' to 'dma_' API
Andrew Morton <[email protected]>
genalloc.h: fix htmldocs warning
Deepakkumar Karn <[email protected]>
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
Jiri Pirko <[email protected]>
team: fix check for port enabled in team_queue_override_port_prio_changed()
Junrui Luo <[email protected]>
platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
Thomas Fourier <[email protected]>
platform/x86: msi-laptop: add missing sysfs_remove_group()
Eric Dumazet <[email protected]>
ip6_gre: make ip6gre_header() robust
Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
Jacky Chou <[email protected]>
net: mdio: aspeed: add dummy read to avoid read-after-write issue
Potin Lai <[email protected]>
net: mdio: aspeed: move reg accessing part into separate functions
Herbert Xu <[email protected]>
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
Kohei Enju <[email protected]>
iavf: fix off-by-one issues in iavf_config_rss_reg()
Przemyslaw Korba <[email protected]>
i40e: fix scheduling in set_rx_mode
Gui-Dong Han <[email protected]>
hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
Gui-Dong Han <[email protected]>
hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
Ma Ke <[email protected]>
i2c: amd-mp2: fix reference leak in MP2 PCI device
Srinivas Kandagatla <[email protected]>
rpmsg: glink: fix rpmsg device leak
Johan Hovold <[email protected]>
soc: amlogic: canvas: fix device leak on lookup
Johan Hovold <[email protected]>
soc: qcom: ocmem: fix device leak on lookup
Johan Hovold <[email protected]>
amba: tegra-ahb: Fix device leak on SMMU enable
Alex Deucher <[email protected]>
drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
Prithvi Tambewagh <[email protected]>
io_uring: fix filename leak in __io_openat_prep()
Andy Shevchenko <[email protected]>
nfsd: Mark variable __maybe_unused to avoid W=1 build break
Amir Goldstein <[email protected]>
fsnotify: do not generate ACCESS/MODIFY events on child for special files
Rafael J. Wysocki <[email protected]>
PM: runtime: Do not clear needs_force_resume with enabled runtime PM
Steven Rostedt <[email protected]>
tracing: Do not register unsupported perf events
Sean Christopherson <[email protected]>
KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)
Yosry Ahmed <[email protected]>
KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
fuqiang wang <[email protected]>
KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
fuqiang wang <[email protected]>
KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
Sean Christopherson <[email protected]>
KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
Ilya Dryomov <[email protected]>
libceph: make decode_pool() more resilient against corrupted osdmaps
Helge Deller <[email protected]>
parisc: Do not reprogram affinitiy on ASP chip
Zhichi Lin <[email protected]>
scs: fix a wrong parameter in __scs_magic
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
Prithvi Tambewagh <[email protected]>
ocfs2: fix kernel BUG in ocfs2_find_victim_chain
Jeongjun Park <[email protected]>
media: vidtv: initialize local pointers upon transfer of memory ownership
Alison Schofield <[email protected]>
tools/testing/nvdimm: Use per-DIMM device handle
Chao Yu <[email protected]>
f2fs: fix return value of f2fs_recover_fsync_data()
Deepanshu Kartikey <[email protected]>
f2fs: invalidate dentry cache on failed whiteout creation
Andrey Vatoropin <[email protected]>
scsi: target: Reset t_task_cdb pointer in error case
Dai Ngo <[email protected]>
NFSD: use correct reservation type in nfsd4_scsi_fence_client
Junrui Luo <[email protected]>
scsi: aic94xx: fix use-after-free in device removal path
Tony Battersby <[email protected]>
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
Miaoqian Lin <[email protected]>
cpufreq: nforce2: fix reference count leak in nforce2
Ma Ke <[email protected]>
intel_th: Fix error handling in intel_th_output_open
Tianchu Chen <[email protected]>
char: applicom: fix NULL pointer dereference in ac_ioctl
Haoxiang Li <[email protected]>
usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
Miaoqian Lin <[email protected]>
usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
Duoming Zhou <[email protected]>
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
Ma Ke <[email protected]>
USB: lpc32xx_udc: Fix error handling in probe
Johan Hovold <[email protected]>
phy: broadcom: bcm63xx-usbh: fix section mismatches
Colin Ian King <[email protected]>
media: pvrusb2: Fix incorrect variable used in trace message
Jeongjun Park <[email protected]>
media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
Chen Changcheng <[email protected]>
usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
Laurent Pinchart <[email protected]>
media: v4l2-mem2mem: Fix outdated documentation
Byungchul Park <[email protected]>
jbd2: use a weaker annotation in journal handling
Yongjian Sun <[email protected]>
ext4: fix incorrect group number assertion in mb_check_buddy
Karina Yankevich <[email protected]>
ext4: xattr: fix null pointer deref in ext4_raw_inode()
Steven Rostedt <[email protected]>
ktest.pl: Fix uninitialized var in config-bisect.pl
Rene Rebe <[email protected]>
floppy: fix for PAGE_SIZE != 4KB
Eric Biggers <[email protected]>
lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
Stefano Garzarella <[email protected]>
vhost/vsock: improve RCU read sections around vhost_vsock_get()
Dan Carpenter <[email protected]>
block: rnbd-clt: Fix signedness bug in init_dev()
Daniel Wagner <[email protected]>
nvme-fc: don't hold rport lock when putting ctrl
Wenhua Lin <[email protected]>
serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
Chen Changcheng <[email protected]>
usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.
Hongyu Xie <[email protected]>
usb: xhci: limit run_graceperiod for only usb 3.0 devices
Mark Pearson <[email protected]>
usb: typec: ucsi: Handle incorrect num_connectors capability
Lizhi Xu <[email protected]>
usbip: Fix locking bug in RT-enabled kernels
Yuezhang Mo <[email protected]>
exfat: fix remount failure in different process environments
Encrow Thorne <[email protected]>
reset: fix BIT macro reference
Li Qiang <[email protected]>
via_wdt: fix critical boot hang due to unnamed resource allocation
Tony Battersby <[email protected]>
scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
Tony Battersby <[email protected]>
scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
Ben Collins <[email protected]>
powerpc/addnote: Fix overflow on 32-bit builds
Josua Mayer <[email protected]>
clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
Matthias Schiffer <[email protected]>
ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
Peng Fan <[email protected]>
firmware: imx: scu-irq: Init workqueue before request mbox channel
Jinhui Guo <[email protected]>
ipmi: Fix __scan_channels() failing to rescan channels
Jinhui Guo <[email protected]>
ipmi: Fix the race between __scan_channels() and deliver_response()
Shipei Qu <[email protected]>
ALSA: usb-mixer: us16x08: validate meter packet indices
Haotian Zhang <[email protected]>
ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
Haotian Zhang <[email protected]>
ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
Shaurya Rane <[email protected]>
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
Christophe Leroy <[email protected]>
spi: fsl-cpm: Check length parity before switching to 16 bit mode
Pengjie Zhang <[email protected]>
ACPI: CPPC: Fix missing PCC check for guaranteed_perf
Christoffer Sandberg <[email protected]>
Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
Junjie Cao <[email protected]>
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
Ping Cheng <[email protected]>
HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
Thomas Fourier <[email protected]>
block: rnbd-clt: Fix leaked ID in init_dev()
Guoqing Jiang <[email protected]>
block/rnbd-clt: fix wrong max ID in ida_alloc_max
Christophe JAILLET <[email protected]>
block/rnbd: Remove a useless mutex
Haoxiang Li <[email protected]>
MIPS: Fix a reference leak bug in ip22_check_gio()
Junrui Luo <[email protected]>
hwmon: (ibmpex) fix use-after-free in high/low store
Jian Shen <[email protected]>
net: hns3: add VLAN id validation before using
Jian Shen <[email protected]>
net: hns3: using the num_tqps in the vf driver to apply for resources
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Handle escaped percent properly
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Validate format string parameters
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Add support for unrecognized string
Gal Pressman <[email protected]>
ethtool: Avoid overflowing userspace buffer on stats query
Daniil Tatianin <[email protected]>
net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers
Daniil Tatianin <[email protected]>
net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats
Tom Rix <[email protected]>
ethtool: use phydev variable
Dan Carpenter <[email protected]>
nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
Victor Nogueira <[email protected]>
net/sched: ets: Remove drr class from the active list if it changes to strict
Junrui Luo <[email protected]>
caif: fix integer underflow in cffrml_receive()
Slavin Liu <[email protected]>
ipvs: fix ipv4 null-ptr-deref in route error path
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: fix leaked ct in error paths
Alexey Simakov <[email protected]>
broadcom: b44: prevent uninitialized value usage
Ilya Maximets <[email protected]>
net: openvswitch: fix middle attribute validation in push_nsh() action
Ido Schimmel <[email protected]>
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
Ido Schimmel <[email protected]>
mlxsw: spectrum_router: Fix neighbour use-after-free
Dmitry Skorodumov <[email protected]>
ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
Jamal Hadi Salim <[email protected]>
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
Wang Liang <[email protected]>
netrom: Fix memory leak in nr_sendmsg()
Gongwei Li <[email protected]>
Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
Qu Wenruo <[email protected]>
btrfs: scrub: always update btrfs_scrub_progress::last_physical
Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/073
Tetsuo Handa <[email protected]>
hfsplus: Verify inode mode when loading from disk
Yang Chenzhi <[email protected]>
hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/070
Song Liu <[email protected]>
livepatch: Match old_sympos 0 and 1 in klp_find_func()
Shuhao Fu <[email protected]>
cpufreq: s5pv210: fix refcount leak
Sakari Ailus <[email protected]>
ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
Cryolitia PukNgae <[email protected]>
ACPICA: Avoid walking the Namespace if start_node is NULL
Peter Zijlstra <[email protected]>
x86/ptrace: Always inline trivial accessors
Deepanshu Kartikey <[email protected]>
btrfs: fix memory leak of fs_devices in degraded seed device path
Ondrej Mosnacek <[email protected]>
bpf, arm64: Do not audit capability check in do_jit()
Pablo Neira Ayuso <[email protected]>
netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
Jamie Iles <[email protected]>
i3c: fix uninitialized variable use in i2c setup
Nicklas Bo Jensen <[email protected]>
netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
Sun Ke <[email protected]>
NFS: Fix missing unlock in nfs_unlink()
Junrui Luo <[email protected]>
ALSA: dice: fix buffer overflow in detect_stream_formats()
Diogo Ivo <[email protected]>
usb: phy: Initialize struct usb_phy list_head
Haotien Hsu <[email protected]>
usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
Dmitry Antipov <[email protected]>
ocfs2: fix memory leak in ocfs2_merge_rec_left()
Mauro Carvalho Chehab <[email protected]>
efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
Mauro Carvalho Chehab <[email protected]>
efi/cper: Adjust infopfx size to accept an extra space
Mauro Carvalho Chehab <[email protected]>
efi/cper: Add a new helper function to print bitmasks
Haotian Zhang <[email protected]>
dm log-writes: Add missing set_freezable() for freezable kthread
Alexey Simakov <[email protected]>
dm-raid: fix possible NULL dereference with undefined raid type
Liyuan Pang <[email protected]>
ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
Andres J Rosa <[email protected]>
ALSA: uapi: Fix typo in asound.h comment
Dave Kleikamp <[email protected]>
dma/pool: eliminate alloc_pages warning in atomic_pool_expand
shechenglong <[email protected]>
block: fix comment for op_is_zone_mgmt() to include RESET_ALL
Cong Zhang <[email protected]>
blk-mq: Abort suspend when wakeup events are pending
Shengjiu Wang <[email protected]>
ASoC: ak5558: Disable regulator when error happens
Shengjiu Wang <[email protected]>
ASoC: ak4458: Disable regulator when error happens
Haotian Zhang <[email protected]>
ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
Anton Khirnov <[email protected]>
platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
Armin Wolf <[email protected]>
fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
Trond Myklebust <[email protected]>
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
Ondrej Mosnacek <[email protected]>
fs_context: drop the unused lsm_flags member
Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when mounting nfs"
Trond Myklebust <[email protected]>
Revert "nfs: clear SB_RDONLY before getting superblock"
Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when remounting nfs"
Jonathan Curley <[email protected]>
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
Armin Wolf <[email protected]>
fs/nls: Fix utf16 to utf8 conversion
Trond Myklebust <[email protected]>
NFS: Avoid changing nlink when file removes and attribute updates race
NeilBrown <[email protected]>
NFS: don't unhash dentry during unlink/rename
Trond Myklebust <[email protected]>
NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()
Trond Myklebust <[email protected]>
NFS: Fix open coded versions of nfs_set_cache_invalid()
Trond Myklebust <[email protected]>
NFS: Clean up function nfs_mark_dir_for_revalidate()
Abdun Nihaal <[email protected]>
fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
Haotian Zhang <[email protected]>
pinctrl: single: Fix incorrect type for error return variable
Matthijs Kooijman <[email protected]>
pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
Namhyung Kim <[email protected]>
perf tools: Fix split kallsyms DSO counting
Xiang Mei <[email protected]>
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
Ivan Stepchenko <[email protected]>
mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_connlimit: update the count if add was skipped
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: rework API to use sk_buff directly
William Tu <[email protected]>
netfilter: nf_conncount: reduce unnecessary GC
Pablo Neira Ayuso <[email protected]>
netfilter: nft_connlimit: move stateful fields out of expression data
sparkhuang <[email protected]>
regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
Michael S. Tsirkin <[email protected]>
virtio: fix virtqueue_set_affinity() docs
Yongjian Sun <[email protected]>
ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
Kemeng Shi <[email protected]>
ext4: remove unused return value of __mb_check_buddy
René Rebe <[email protected]>
ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
Dan Carpenter <[email protected]>
drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
Stephan Gerhold <[email protected]>
iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
Randy Dunlap <[email protected]>
backlight: lp855x: Fix lp855x.h kernel-doc warnings
Luca Ceresoli <[email protected]>
backlight: led-bl: Add devlink to supplier LEDs
Mans Rullgard <[email protected]>
backlight: led_bl: Take led_access lock when required
Ria Thomas <[email protected]>
wifi: ieee80211: correct FILS status codes
Shawn Lin <[email protected]>
PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
Jianglei Nie <[email protected]>
staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
Haotian Zhang <[email protected]>
crypto: ccree - Correctly handle return of sg_nents_for_len
Matt Bobrowski <[email protected]>
selftests/bpf: Improve reliability of test_perf_branches_no_hw()
Gopi Krishna Menon <[email protected]>
usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during suspend if set as peripheral
Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during shutdown if set as peripheral
Jisheng Zhang <[email protected]>
usb: dwc2: disable platform lowlevel hw resources during shutdown
Oliver Neukum <[email protected]>
usb: chaoskey: fix locking for O_NONBLOCK
Zhao Yipeng <[email protected]>
ima: Handle error code returned by ima_filter_rule_match()
Seungjin Bae <[email protected]>
wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
Haotian Zhang <[email protected]>
mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
Haotian Zhang <[email protected]>
mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
Uwe Kleine-König <[email protected]>
pwm: bcm2835: Make sure the channel is enabled after pwm_request()
Lino Sanfilippo <[email protected]>
pwm: bcm2835: Support apply function for atomic configuration
Ritesh Harjani (IBM) <[email protected]>
powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
Abdun Nihaal <[email protected]>
wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
Sergey Bashirov <[email protected]>
NFSD/blocklayout: Fix minlength check in proc_layoutget
Haotian Zhang <[email protected]>
watchdog: wdat_wdt: Fix ACPI table leak in probe function
Liu Xinpeng <[email protected]>
watchdog: wdat_wdt: Stop watchdog when uninstalling module
Alexei Starovoitov <[email protected]>
selftests/bpf: Fix failure paths in send_signal test
Siddharth Vadapalli <[email protected]>
PCI: keystone: Exit ks_pcie_probe() for invalid mode
Haotian Zhang <[email protected]>
leds: netxbig: Fix GPIO descriptor leak in error paths
Haotian Zhang <[email protected]>
scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
Haotian Zhang <[email protected]>
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
Dmitry Antipov <[email protected]>
ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
Andy Shevchenko <[email protected]>
lib/vsprintf: Check pointer before dereferencing in time_and_date()
Haotian Zhang <[email protected]>
clk: renesas: r9a06g032: Fix memory leak in error path
Herve Codina <[email protected]>
soc: renesas: r9a06g032-sysctrl: Handle h2mode setting based on USBF presence
Miquel Raynal <[email protected]>
clk: renesas: r9a06g032: Export function to set dmamux
Zheng Qixing <[email protected]>
nbd: defer config unlock in nbd_genl_connect
Abdun Nihaal <[email protected]>
wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
Long Li <[email protected]>
macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
Ma Ke <[email protected]>
RDMA/rtrs: server: Fix error handling in get_or_create_srv
Haotian Zhang <[email protected]>
scsi: stex: Fix reboot_notifier leak in probe error path
Zheng Qixing <[email protected]>
nbd: defer config put in recv_work
Yu Kuai <[email protected]>
nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply()
Yu Kuai <[email protected]>
nbd: clean up return value checking of sock_xmit()
Gabor Juhos <[email protected]>
regulator: core: disable supply if enabling main regulator fails
Dapeng Mi <[email protected]>
perf/x86/intel: Correct large PEBS flag check
Zhang Yi <[email protected]>
ext4: correct the checking of quota files before moving extents
Eric Whitney <[email protected]>
ext4: minor defrag code improvements
Haotian Zhang <[email protected]>
mfd: da9055: Fix missing regmap_del_irq_chip() in error path
Bart Van Assche <[email protected]>
scsi: target: Do not write NUL characters into ASCII configfs output
Ahelenia Ziemiańska <[email protected]>
power: supply: apm_power: only unset own apm_get_power_status
Ivan Abramov <[email protected]>
power: supply: wm831x: Check wm831x_set_bits() return value
Frank Li <[email protected]>
i3c: fix refcount inconsistency in i3c_master_register
Jarkko Nikula <[email protected]>
i3c: master: Inherit DMA masks and parameters from parent device
Jeremy Kerr <[email protected]>
i3c: Allow OF-alias-based persistent bus numbering
Jamie Iles <[email protected]>
i3c: support dynamically added i2c devices
Jamie Iles <[email protected]>
i3c: remove i2c board info from i2c_dev_desc
Haotian Zhang <[email protected]>
pinctrl: stm32: fix hwspinlock resource leak in probe function
Tengda Wu <[email protected]>
x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
Alexander Potapenko <[email protected]>
x86: kmsan: don't instrument stack walking functions
Alexander Potapenko <[email protected]>
kmsan: introduce __no_sanitize_memory and __no_kmsan_checks
Kees Cook <[email protected]>
compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer
Hui Su <[email protected]>
x86/dumpstack: Make show_trace_log_lvl() static
Peng Fan <[email protected]>
firmware: imx: scu-irq: fix OF node leak in
Heiko Carstens <[email protected]>
s390/ap: Don't leak debug feature files if AP instructions are not available
Heiko Carstens <[email protected]>
s390/smp: Fix fallback CPU detection
Thorsten Blum <[email protected]>
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: discard samples during filters settling time
Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine
Xuanqiang Luo <[email protected]>
inet: Avoid ehash lookup race in inet_ehash_insert()
Xuanqiang Luo <[email protected]>
rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
Johan Hovold <[email protected]>
irqchip/qcom-irq-combiner: Fix section mismatch
Seungjin Bae <[email protected]>
USB: Fix descriptor count when handling invalid MBIM extended descriptor
Janusz Krzysztofik <[email protected]>
drm/vgem-fence: Fix potential deadlock on release
Guido Günther <[email protected]>
drm/panel: visionox-rm69299: Don't clear all mode flags
Konstantin Andreev <[email protected]>
smack: fix bug: unprivileged task can create labels
Navaneeth K <[email protected]>
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
Nikita Zhandarovich <[email protected]>
comedi: check device's attached status in compat ioctls
Nikita Zhandarovich <[email protected]>
comedi: multiq3: sanitize config options in multiq3_attach()
Ian Abbott <[email protected]>
comedi: c6xdigio: Fix invalid PNP driver unregistration
Linus Torvalds <[email protected]>
samples: work around glibc redefining some of our defines wrong
Jia Ston <[email protected]>
platform/x86: huawei-wmi: add keys for HONOR models
Armin Wolf <[email protected]>
platform/x86: acer-wmi: Ignore backlight event
Praveen Talari <[email protected]>
pinctrl: qcom: msm: Fix deadlock in pinmux configuration
Tetsuo Handa <[email protected]>
bfs: Reconstruct file type when loading from disk
Robin Gong <[email protected]>
spi: imx: keep dma request disabled before dma transfer setup
Alvaro Gamez Machado <[email protected]>
spi: xilinx: increase number of retries before declaring stall
Johan Hovold <[email protected]>
USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
Johan Hovold <[email protected]>
USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
Magne Bruno <[email protected]>
serial: add support of CPCI cards
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: match on interface number for jtag
Fabio Porcedda <[email protected]>
USB: serial: option: move Telit 0x10c7 composition in the right place
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE910C04 new compositions
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W760
Alexey Nepomnyashih <[email protected]>
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
Alexander Sverdlin <[email protected]>
locking/spinlock/debug: Fix data-race in do_raw_write_lock
Deepanshu Kartikey <[email protected]>
ext4: refresh inline data size before write operations
Ye Bin <[email protected]>
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
Bagas Sanjaya <[email protected]>
Documentation: process: Also mention Sasha Levin as stable tree maintainer
Sabrina Dubroca <[email protected]>
xfrm: flush all states in xfrm_state_fini
Sabrina Dubroca <[email protected]>
xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
Sabrina Dubroca <[email protected]>
Revert "xfrm: destroy xfrm_state synchronously on net exit path"
Sabrina Dubroca <[email protected]>
xfrm: delete x->tunnel as we delete x
-------------
Diffstat:
Documentation/filesystems/mount_api.rst | 1 - Documentation/process/2.Process.rst | 6 +- Makefile | 4 +- arch/alpha/include/uapi/asm/ioctls.h | 8 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/imx6q-ba16.dtsi | 2 +- arch/arm/boot/dts/sama5d2.dtsi | 10 +- arch/arm/include/asm/word-at-a-time.h | 10 +- arch/arm64/net/bpf_jit_comp.c | 2 +- arch/mips/sgi-ip22/ip22-gio.c | 3 +- arch/parisc/kernel/asm-offsets.c | 2 + arch/parisc/kernel/entry.S | 16 +- arch/powerpc/boot/addnote.c | 7 +- arch/powerpc/kernel/process.c | 5 - arch/powerpc/mm/book3s64/internal.h | 1 - arch/powerpc/mm/book3s64/mmu_context.c | 2 - arch/powerpc/mm/book3s64/slb.c | 88 --------- arch/powerpc/mm/ptdump/hashpagetable.c | 6 + arch/powerpc/platforms/pseries/cmm.c | 5 +- arch/s390/kernel/smp.c | 1 + arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/events/intel/core.c | 4 +- arch/x86/include/asm/ptrace.h | 20 +- arch/x86/include/asm/stacktrace.h | 3 - arch/x86/kernel/dumpstack.c | 29 ++- arch/x86/kernel/unwind_frame.c | 11 ++ arch/x86/kvm/lapic.c | 32 ++- arch/x86/kvm/svm/nested.c | 4 +- arch/x86/kvm/svm/svm.c | 18 +- block/blk-mq.c | 18 +- block/blk-throttle.c | 16 +- crypto/af_alg.c | 5 +- crypto/algif_hash.c | 3 +- crypto/algif_rng.c | 3 +- crypto/asymmetric_keys/asymmetric_type.c | 12 +- crypto/seqiv.c | 8 +- drivers/acpi/acpica/nswalk.c | 9 +- drivers/acpi/apei/ghes.c | 16 +- drivers/acpi/cppc_acpi.c | 3 +- drivers/acpi/processor_core.c | 2 +- drivers/acpi/property.c | 9 +- drivers/amba/tegra-ahb.c | 1 + drivers/atm/he.c | 3 +- drivers/base/power/runtime.c | 22 ++- drivers/block/floppy.c | 2 +- drivers/block/nbd.c | 96 +++++---- drivers/block/rnbd/rnbd-clt.c | 20 +- drivers/block/rnbd/rnbd-clt.h | 2 +- drivers/bluetooth/btusb.c | 2 + drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +- drivers/bus/ti-sysc.c | 11 +- drivers/char/applicom.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 20 +- drivers/char/tpm/tpm-chip.c | 1 - drivers/char/tpm/tpm1-cmd.c | 5 - drivers/char/tpm/tpm2-cmd.c | 8 +- drivers/char/virtio_console.c | 2 +- drivers/clk/mvebu/cp110-system-controller.c | 20 ++ drivers/clk/renesas/r9a06g032-clocks.c | 69 ++++++- drivers/cpufreq/cpufreq-nforce2.c | 3 + drivers/cpufreq/s5pv210-cpufreq.c | 6 +- drivers/cpufreq/scmi-cpufreq.c | 10 +- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +- drivers/firewire/nosy.c | 47 +++-- drivers/firmware/efi/cper-arm.c | 52 +++-- drivers/firmware/efi/cper.c | 60 ++++++ drivers/firmware/imx/imx-scu-irq.c | 8 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 2 +- drivers/gpu/drm/gma500/framebuffer.c | 44 ----- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 13 ++ drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +- drivers/gpu/drm/pl111/pl111_drv.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-input.c | 18 +- drivers/hid/hid-logitech-dj.c | 56 +++--- drivers/hid/hid-quirks.c | 9 + drivers/hwmon/applesmc.c | 34 ++-- drivers/hwmon/ibmpex.c | 9 +- drivers/hwmon/ina209.c | 6 +- drivers/hwmon/ina2xx.c | 2 +- drivers/hwmon/ina3221.c | 2 +- drivers/hwmon/lineage-pem.c | 8 +- drivers/hwmon/ltc2945.c | 4 +- drivers/hwmon/ltc2990.c | 2 +- drivers/hwmon/ltc4151.c | 2 +- drivers/hwmon/ltc4215.c | 8 +- drivers/hwmon/ltc4222.c | 4 +- drivers/hwmon/ltc4260.c | 4 +- drivers/hwmon/ltc4261.c | 4 +- drivers/hwmon/max16065.c | 19 +- drivers/hwmon/occ/common.c | 69 +++---- drivers/hwmon/occ/sysfs.c | 4 +- drivers/hwmon/pmbus/inspur-ipsps.c | 28 +-- drivers/hwmon/pmbus/pmbus_core.c | 8 +- drivers/hwmon/s3c-hwmon.c | 4 +- drivers/hwmon/sch5627.c | 24 +-- drivers/hwmon/sch5636.c | 20 +- drivers/hwmon/smm665.c | 4 +- drivers/hwmon/stts751.c | 20 +- drivers/hwmon/vexpress-hwmon.c | 12 +- drivers/hwmon/w83791d.c | 19 +- drivers/hwmon/w83l786ng.c | 26 ++- drivers/hwmon/xgene-hwmon.c | 14 +- drivers/hwtracing/intel_th/core.c | 20 +- drivers/i2c/busses/i2c-amd-mp2-pci.c | 5 +- drivers/i3c/master.c | 189 ++++++++++++++++-- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 24 ++- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 71 +++++-- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 32 +-- drivers/infiniband/core/addr.c | 33 +--- drivers/infiniband/core/cma.c | 3 + drivers/infiniband/core/device.c | 5 + drivers/infiniband/core/verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 8 +- drivers/infiniband/hw/efa/efa_verbs.c | 4 - drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/input/touchscreen/ti_am335x_tsc.c | 2 +- drivers/iommu/amd/init.c | 28 +-- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 ++- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 +- drivers/iommu/exynos-iommu.c | 9 +- drivers/iommu/ipmmu-vmsa.c | 2 + drivers/iommu/mtk_iommu.c | 2 + drivers/iommu/mtk_iommu_v1.c | 2 + drivers/iommu/omap-iommu.c | 2 +- drivers/iommu/omap-iommu.h | 2 - drivers/iommu/sun50i-iommu.c | 2 + drivers/irqchip/qcom-irq-combiner.c | 2 +- drivers/leds/leds-lp50xx.c | 95 +++++---- drivers/leds/leds-netxbig.c | 36 +++- drivers/macintosh/mac_hid.c | 3 +- drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-log-writes.c | 1 + drivers/md/dm-raid.c | 2 + drivers/media/cec/core/cec-core.c | 1 + drivers/media/i2c/adv7604.c | 4 +- drivers/media/i2c/adv7842.c | 11 +- drivers/media/i2c/msp3400-kthreads.c | 2 + drivers/media/i2c/tda1997x.c | 1 - drivers/media/platform/davinci/vpif_capture.c | 4 +- drivers/media/platform/exynos4-is/media-dev.c | 10 +- .../media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 4 +- drivers/media/platform/rcar_drif.c | 1 + drivers/media/rc/st_rc.c | 2 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 3 + drivers/media/usb/dvb-usb/dtv5100.c | 5 + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 +- drivers/mfd/altera-sysmgr.c | 2 + drivers/mfd/da9055-core.c | 1 + drivers/mfd/max77620.c | 15 +- drivers/mfd/mt6358-irq.c | 1 + drivers/mfd/mt6397-irq.c | 1 + drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/vmw_balloon.c | 3 +- drivers/mtd/lpddr/lpddr_cmds.c | 8 +- drivers/net/dsa/b53/b53_common.c | 3 + drivers/net/ethernet/3com/3c59x.c | 2 +- drivers/net/ethernet/broadcom/b44.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 87 ++++---- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +- drivers/net/ethernet/cadence/macb_main.c | 3 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +- .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 8 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 122 ++++++++++-- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/en.h | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 2 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 17 +- drivers/net/fjes/fjes_hw.c | 12 +- drivers/net/ipvlan/ipvlan_core.c | 3 + drivers/net/mdio/mdio-aspeed.c | 77 +++++--- drivers/net/team/team.c | 2 +- drivers/net/usb/pegasus.c | 2 + drivers/net/usb/rtl8150.c | 2 + drivers/net/usb/sr9700.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 ++- drivers/net/wireless/st/cw1200/bh.c | 6 +- drivers/nfc/pn533/usb.c | 2 +- drivers/nvme/host/fc.c | 6 +- drivers/parisc/gsc.c | 4 +- drivers/pci/controller/dwc/pci-keystone.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 +- drivers/pci/controller/pcie-brcmstb.c | 10 +- drivers/pci/pci-driver.c | 4 + drivers/phy/broadcom/phy-bcm63xx-usbh.c | 6 +- drivers/pinctrl/pinctrl-single.c | 25 ++- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/platform/chrome/cros_ec_ishtp.c | 1 + drivers/platform/x86/acer-wmi.c | 4 + drivers/platform/x86/asus-wmi.c | 8 +- drivers/platform/x86/huawei-wmi.c | 4 + drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/msi-laptop.c | 3 + drivers/power/supply/apm_power.c | 3 +- drivers/power/supply/wm831x_power.c | 10 +- drivers/powercap/powercap_sys.c | 22 ++- drivers/pwm/pwm-bcm2835.c | 95 +++------ drivers/pwm/pwm-stm32.c | 3 +- drivers/regulator/core.c | 37 ++-- drivers/rpmsg/qcom_glink_native.c | 8 + drivers/s390/crypto/ap_bus.c | 8 +- drivers/scsi/aic94xx/aic94xx_init.c | 3 + drivers/scsi/ipr.c | 28 ++- drivers/scsi/iscsi_tcp.c | 13 +- drivers/scsi/libiscsi.c | 39 +++- drivers/scsi/libsas/sas_internal.h | 14 -- drivers/scsi/qla2xxx/qla_mbx.c | 2 + drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/sg.c | 20 +- drivers/scsi/sim710.c | 2 + drivers/scsi/stex.c | 1 + drivers/scsi/ufs/ufshcd.c | 4 +- drivers/soc/amlogic/meson-canvas.c | 5 +- drivers/soc/qcom/ocmem.c | 2 +- drivers/spi/spi-fsl-spi.c | 2 +- drivers/spi/spi-imx.c | 15 +- drivers/spi/spi-xilinx.c | 2 +- drivers/staging/comedi/comedi_fops.c | 42 +++- drivers/staging/comedi/drivers/c6xdigio.c | 46 +++-- drivers/staging/comedi/drivers/multiq3.c | 9 + drivers/staging/fbtft/fbtft-core.c | 4 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 5 +- drivers/target/target_core_configfs.c | 1 - drivers/target/target_core_transport.c | 1 + drivers/tty/serial/8250/8250_pci.c | 37 ++++ drivers/tty/serial/sprd_serial.c | 6 + drivers/usb/core/message.c | 2 +- drivers/usb/dwc2/platform.c | 16 +- drivers/usb/dwc3/dwc3-of-simple.c | 7 +- drivers/usb/dwc3/gadget.c | 2 +- drivers/usb/dwc3/host.c | 2 +- drivers/usb/gadget/legacy/raw_gadget.c | 3 + drivers/usb/gadget/udc/core.c | 17 +- drivers/usb/gadget/udc/lpc32xx_udc.c | 20 +- drivers/usb/gadget/udc/tegra-xudc.c | 6 - drivers/usb/host/ohci-nxp.c | 20 +- drivers/usb/host/xhci-dbgtty.c | 6 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 10 +- drivers/usb/host/xhci-ring.c | 8 +- drivers/usb/host/xhci.h | 16 +- drivers/usb/misc/chaoskey.c | 16 +- drivers/usb/misc/sisusbvga/sisusb_con.c | 21 -- drivers/usb/phy/phy-fsl-usb.c | 1 + drivers/usb/phy/phy.c | 4 + drivers/usb/renesas_usbhs/pipe.c | 2 + drivers/usb/serial/belkin_sa.c | 28 +-- drivers/usb/serial/ftdi_sio.c | 72 +++---- drivers/usb/serial/kobil_sct.c | 18 +- drivers/usb/serial/option.c | 22 ++- drivers/usb/storage/unusual_uas.h | 2 +- drivers/usb/typec/ucsi/ucsi.c | 6 + drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/vhost/vsock.c | 15 +- drivers/video/backlight/led_bl.c | 18 +- drivers/video/console/dummycon.c | 20 -- drivers/video/console/sticore.c | 8 +- drivers/video/fbdev/core/fbcon.c | 68 ++----- drivers/video/fbdev/core/fbcon_rotate.c | 3 +- drivers/video/fbdev/core/tileblit.c | 4 +- drivers/video/fbdev/gbefb.c | 5 +- drivers/video/fbdev/pxafb.c | 12 +- drivers/video/fbdev/ssd1307fb.c | 4 +- drivers/video/fbdev/tcx.c | 2 +- drivers/virtio/virtio_balloon.c | 4 +- drivers/watchdog/via_wdt.c | 1 + drivers/watchdog/wdat_wdt.c | 65 ++++-- fs/bfs/inode.c | 19 +- fs/btrfs/extent_io.c | 15 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/scrub.c | 5 + fs/btrfs/volumes.c | 1 + fs/exfat/super.c | 19 +- fs/ext4/inline.c | 14 +- fs/ext4/inode.c | 5 + fs/ext4/mballoc.c | 58 ++++-- fs/ext4/move_extent.c | 18 +- fs/ext4/super.c | 7 +- fs/ext4/xattr.c | 38 +--- fs/ext4/xattr.h | 10 + fs/f2fs/f2fs.h | 3 - fs/f2fs/file.c | 3 +- fs/f2fs/namei.c | 6 +- fs/f2fs/recovery.c | 9 +- fs/f2fs/super.c | 53 ++--- fs/f2fs/xattr.c | 32 ++- fs/f2fs/xattr.h | 10 +- fs/hfsplus/bnode.c | 4 +- fs/hfsplus/dir.c | 7 +- fs/hfsplus/inode.c | 32 ++- fs/jbd2/journal.c | 14 ++ fs/jbd2/transaction.c | 21 +- fs/lockd/svc4proc.c | 4 +- fs/lockd/svclock.c | 21 +- fs/lockd/svcproc.c | 5 +- fs/locks.c | 13 +- fs/nfs/dir.c | 131 ++++++++---- fs/nfs/inode.c | 6 +- fs/nfs/internal.h | 5 +- fs/nfs/namespace.c | 11 ++ fs/nfs/nfs4proc.c | 13 +- fs/nfs/nfs4trace.h | 1 + fs/nfs/pnfs.c | 1 + fs/nfs/super.c | 26 --- fs/nfs/unlink.c | 6 +- fs/nfs/write.c | 8 +- fs/nfsd/blocklayout.c | 7 +- fs/nfsd/export.c | 2 +- fs/nfsd/netns.h | 2 + fs/nfsd/nfs4state.c | 46 ++++- fs/nfsd/nfs4xdr.c | 5 + fs/nfsd/nfsctl.c | 3 +- fs/nfsd/state.h | 2 +- fs/nfsd/vfs.c | 2 +- fs/nls/nls_base.c | 27 ++- fs/notify/fsnotify.c | 9 +- fs/ocfs2/alloc.c | 1 - fs/ocfs2/move_extents.c | 8 +- fs/ocfs2/suballoc.c | 10 + fs/overlayfs/export.c | 2 +- fs/overlayfs/overlayfs.h | 2 +- fs/xfs/xfs_buf_item.c | 1 + include/linux/balloon_compaction.h | 65 ++---- include/linux/blk_types.h | 5 +- include/linux/compiler-clang.h | 23 +++ include/linux/compiler-gcc.h | 14 ++ include/linux/console.h | 1 - include/linux/cper.h | 12 +- include/linux/font.h | 1 + include/linux/fs_context.h | 1 - include/linux/genalloc.h | 1 + include/linux/hugetlb.h | 4 +- include/linux/i3c/master.h | 1 - include/linux/ieee80211.h | 4 +- include/linux/mm.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/nfs_fs.h | 9 + include/linux/platform_data/lp855x.h | 4 +- include/linux/rculist_nulls.h | 59 ++++++ include/linux/reset.h | 1 + include/linux/security.h | 2 +- include/linux/soc/renesas/r9a06g032-sysctrl.h | 11 ++ include/linux/tpm.h | 9 +- include/linux/usb/gadget.h | 5 + include/linux/virtio_config.h | 2 +- include/media/v4l2-mem2mem.h | 3 +- include/net/dst.h | 12 ++ include/net/netfilter/nf_conntrack_count.h | 16 +- include/net/sock.h | 13 ++ include/net/xfrm.h | 13 +- include/scsi/libiscsi.h | 2 + include/uapi/linux/kd.h | 2 +- include/uapi/linux/mptcp.h | 1 + include/uapi/sound/asound.h | 2 +- io_uring/io_uring.c | 2 +- kernel/dma/pool.c | 2 +- kernel/livepatch/core.c | 8 +- kernel/locking/spinlock_debug.c | 4 +- kernel/scs.c | 2 +- kernel/trace/trace_events.c | 2 + lib/crypto/aes.c | 4 +- lib/fonts/font_10x18.c | 1 + lib/fonts/font_6x10.c | 1 + lib/fonts/font_6x11.c | 1 + lib/fonts/font_6x8.c | 1 + lib/fonts/font_7x14.c | 1 + lib/fonts/font_8x16.c | 1 + lib/fonts/font_8x8.c | 1 + lib/fonts/font_acorn_8x8.c | 1 + lib/fonts/font_mini_4x6.c | 1 + lib/fonts/font_pearl_8x8.c | 1 + lib/fonts/font_sun12x22.c | 1 + lib/fonts/font_sun8x16.c | 1 + lib/fonts/font_ter16x32.c | 1 + lib/idr.c | 2 + lib/vsprintf.c | 6 +- mm/balloon_compaction.c | 15 +- mm/hugetlb.c | 4 +- mm/mempolicy.c | 2 +- mm/mprotect.c | 34 ++-- net/bridge/br_private.h | 1 + net/bridge/br_vlan_tunnel.c | 11 +- net/caif/cffrml.c | 9 +- net/can/j1939/transport.c | 2 + net/ceph/osd_client.c | 11 +- net/ceph/osdmap.c | 140 +++++++------ net/core/dev.c | 33 ++++ net/core/sock.c | 7 +- net/core/sock_map.c | 53 ++--- net/ethtool/ioctl.c | 134 +++++++++---- net/hsr/hsr_forward.c | 2 + net/ipv4/arp.c | 7 +- net/ipv4/fib_trie.c | 7 +- net/ipv4/inet_hashtables.c | 8 +- net/ipv4/ip_output.c | 19 +- net/ipv4/ipcomp.c | 2 + net/ipv4/ping.c | 4 +- net/ipv4/raw.c | 3 + net/ipv6/calipso.c | 3 +- net/ipv6/ip6_gre.c | 9 +- net/ipv6/ip6_output.c | 3 +- net/ipv6/ipcomp6.c | 2 + net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/mac80211/rx.c | 5 + net/mptcp/pm_netlink.c | 3 +- net/netfilter/ipvs/ip_vs_xmit.c | 3 + net/netfilter/nf_conncount.c | 219 ++++++++++++++------- net/netfilter/nft_connlimit.c | 69 ++++--- net/netfilter/nft_synproxy.c | 6 +- net/netfilter/xt_connlimit.c | 14 +- net/netrom/nr_out.c | 4 +- net/nfc/core.c | 9 +- net/openvswitch/conntrack.c | 16 +- net/openvswitch/flow_netlink.c | 13 +- net/openvswitch/vport-netdev.c | 17 +- net/rose/af_rose.c | 2 +- net/sched/sch_cake.c | 60 +++--- net/sched/sch_ets.c | 6 +- net/sched/sch_qfq.c | 2 +- net/sunrpc/auth_gss/svcauth_gss.c | 3 +- net/tls/tls_device.c | 18 +- net/wireless/wext-core.c | 4 + net/wireless/wext-priv.c | 4 + net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 41 ++-- net/xfrm/xfrm_user.c | 2 +- samples/vfs/test-statx.c | 6 + samples/watch_queue/watch_test.c | 6 + security/integrity/ima/ima_policy.c | 2 +- security/smack/smack_lsm.c | 41 ++-- sound/firewire/dice/dice-extension.c | 4 +- sound/isa/wavefront/wavefront_midi.c | 2 + sound/isa/wavefront/wavefront_synth.c | 4 +- sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +- sound/pcmcia/vx/vxpocket.c | 8 +- sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +- sound/soc/codecs/ak4458.c | 10 +- sound/soc/codecs/ak5558.c | 10 +- sound/soc/fsl/fsl_sai.c | 3 + sound/soc/qcom/qdsp6/q6adm.c | 146 +++++++------- sound/soc/qcom/qdsp6/q6asm-dai.c | 7 +- sound/soc/stm/stm32_i2s.c | 62 ++---- sound/soc/stm/stm32_sai.c | 39 ++-- sound/soc/stm/stm32_sai_sub.c | 46 ++--- sound/soc/stm/stm32_spdifrx.c | 44 ++--- sound/usb/mixer_us16x08.c | 20 +- tools/perf/util/symbol.c | 4 +- tools/testing/ktest/config-bisect.pl | 4 +- tools/testing/nvdimm/test/nfit.c | 7 +- tools/testing/radix-tree/idr-test.c | 21 ++ .../selftests/bpf/prog_tests/perf_branches.c | 16 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 5 + .../selftests/bpf/progs/test_perf_branches.c | 3 + .../test.d/ftrace/func_traceonoff_triggers.tc | 5 +- 472 files changed, 4037 insertions(+), 2442 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/451 xfrm: delete x->tunnel as we delete x
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b441cf3f8c4b8576639d20c8eb4aa32917602ecd ]
The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete.
We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state.
Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped.
A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked.
--- include/net/xfrm.h | 1 - net/ipv4/ipcomp.c | 2 ++ net/ipv6/ipcomp6.c | 2 ++ net/ipv6/xfrm6_tunnel.c | 2 +- net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 19 ++++++++----------- 6 files changed, 13 insertions(+), 14 deletions(-)
include/net/xfrm.h +0 -1
@@ -400,7 +400,6 @@ int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);int xfrm_input_unregister_afinfo (const struct xfrm_input_afinfo *afinfo);void xfrm_flush_gc (void ); -void xfrm_state_delete_tunnel (struct xfrm_state *x);struct xfrm_type {char *description;
net/ipv4/ipcomp.c +2 -0
@@ -53,6 +53,7 @@ static int ipcomp4_err(struct sk_buff *skb, u32 info) }/* We always hold one tunnel user reference to indicate a tunnel */ +static struct lock_class_key xfrm_state_lock_key;static struct xfrm_state *ipcomp_tunnel_create (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -61,6 +62,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x) t =xfrm_state_alloc (net);if (!t) goto out; +lockdep_set_class (&t->lock, &xfrm_state_lock_key); t->id.proto =IPPROTO_IPIP ; t->id.spi = x->props.saddr.a4;
net/ipv6/ipcomp6.c +2 -0
@@ -71,6 +71,7 @@ static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,return 0 ; } +static struct lock_class_key xfrm_state_lock_key;static struct xfrm_state *ipcomp6_tunnel_create (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -79,6 +80,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x) t =xfrm_state_alloc (net);if (!t) goto out; +lockdep_set_class (&t->lock, &xfrm_state_lock_key); t->id.proto =IPPROTO_IPV6 ; t->id.spi =xfrm6_tunnel_alloc_spi (net, (xfrm_address_t *)&x->props.saddr);
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -331,8 +331,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_flush_gc ();xfrm_state_flush (net,0 , false, true); +xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)WARN_ON_ONCE (!hlist_empty (&xfrm6_tn->spi_byaddr[i]));
net/xfrm/xfrm_ipcomp.c +0 -1
@@ -327,7 +327,6 @@ void ipcomp_destroy(struct xfrm_state *x)struct ipcomp_data *ipcd = x->data;if (!ipcd)return ; -xfrm_state_delete_tunnel (x);mutex_lock (&ipcomp_resource_mutex);ipcomp_free_data (ipcd);mutex_unlock (&ipcomp_resource_mutex);
net/xfrm/xfrm_state.c +8 -11
@@ -653,6 +653,7 @@ void __xfrm_state_destroy(struct xfrm_state *x, bool sync) }EXPORT_SYMBOL (__xfrm_state_destroy); +static void xfrm_state_delete_tunnel (struct xfrm_state *x);int __xfrm_state_delete (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -674,6 +675,8 @@ int __xfrm_state_delete(struct xfrm_state *x)xfrm_dev_state_delete (x); +xfrm_state_delete_tunnel (x); +/* All xfrm_state objects are created by xfrm_state_alloc. * The xfrm_state_alloc call gives a reference, and that * is what we are dropping here.
@@ -777,10 +780,7 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync) err =xfrm_state_delete (x);xfrm_audit_state_delete (x, err ?0 :1 , task_valid); -if (sync) -xfrm_state_put_sync (x); -else -xfrm_state_put (x); +xfrm_state_put (x);if (!err) cnt++;
@@ -2535,20 +2535,17 @@ void xfrm_flush_gc(void) }EXPORT_SYMBOL (xfrm_flush_gc); -/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ -void xfrm_state_delete_tunnel (struct xfrm_state *x) +static void xfrm_state_delete_tunnel (struct xfrm_state *x) {if (x->tunnel) {struct xfrm_state *t = x->tunnel; -if (atomic_read (&t->tunnel_users) ==2 ) +if (atomic_dec_return (&t->tunnel_users) ==1 )xfrm_state_delete (t); -atomic_dec (&t->tunnel_users); -xfrm_state_put_sync (t); +xfrm_state_put (t); x->tunnel =NULL ; } } -EXPORT_SYMBOL (xfrm_state_delete_tunnel);u32 xfrm_state_mtu (struct xfrm_state *x,int mtu) {
@@ -2710,8 +2707,8 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -flush_work (&xfrm_state_gc_work);xfrm_state_flush (net,0 , false, true); +flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/451 Revert "xfrm: destroy xfrm_state synchronously on net exit path"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 2a198bbec6913ae1c90ec963750003c6213668c7 ]
This reverts commit f75a2804da391571563c4b6b29e7797787332673.
With all states (whether user or kern) removed from the hashtables during deletion, there's no need for synchronous destruction of states. xfrm6_tunnel states still need to have been destroyed (which will be the case when its last user is deleted (not destroyed)) so that xfrm6_tunnel_free_spi removes it from the per-netns hashtable before the netns is destroyed.
This has the benefit of skipping one synchronize_rcu per state (in __xfrm_state_destroy(sync=true)) when we exit a netns.
--- include/net/xfrm.h | 12 +++--------- net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/xfrm/xfrm_state.c | 23 +++++++++-------------- net/xfrm/xfrm_user.c | 2 +- 5 files changed, 15 insertions(+), 26 deletions(-)
include/net/xfrm.h +3 -9
@@ -794,7 +794,7 @@ static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)xfrm_pol_put (pols[i]); } -void __xfrm_state_destroy (struct xfrm_state *,bool ); +void __xfrm_state_destroy (struct xfrm_state *);static inline void __xfrm_state_put (struct xfrm_state *x) {
@@ -804,13 +804,7 @@ static inline void __xfrm_state_put(struct xfrm_state *x)static inline void xfrm_state_put (struct xfrm_state *x) {if (refcount_dec_and_test (&x->refcnt)) -__xfrm_state_destroy (x, false); -} - -static inline void xfrm_state_put_sync (struct xfrm_state *x) -{ -if (refcount_dec_and_test (&x->refcnt)) -__xfrm_state_destroy (x, true); +__xfrm_state_destroy (x); }static inline void xfrm_state_hold (struct xfrm_state *x)
@@ -1585,7 +1579,7 @@ struct xfrmk_spdinfo {struct xfrm_state *xfrm_find_acq_byseq (struct net *net,u32 mark,u32 seq);int xfrm_state_delete (struct xfrm_state *x); -int xfrm_state_flush (struct net *net,u8 proto,bool task_valid,bool sync); +int xfrm_state_flush (struct net *net,u8 proto,bool task_valid);int xfrm_dev_state_flush (struct net *net,struct net_device *dev,bool task_valid);void xfrm_sad_getinfo (struct net *net,struct xfrmk_sadinfo *si);void xfrm_spd_getinfo (struct net *net,struct xfrmk_spdinfo *si);
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -331,7 +331,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_state_flush (net,0 , false, true); +xfrm_state_flush (net,IPSEC_PROTO_ANY , false);xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)
net/key/af_key.c +1 -1
@@ -1770,7 +1770,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_mif (proto ==0 )return -EINVAL ; - err =xfrm_state_flush (net, proto, true, false); + err =xfrm_state_flush (net, proto, true); err2 =unicast_flush_resp (sk, hdr);if (err || err2) {if (err == -ESRCH )/* empty table - go quietly */
net/xfrm/xfrm_state.c +9 -14
@@ -476,7 +476,7 @@ void xfrm_state_free(struct xfrm_state *x) }EXPORT_SYMBOL (xfrm_state_free); -static void ___xfrm_state_destroy (struct xfrm_state *x) +static void xfrm_state_gc_destroy (struct xfrm_state *x) {hrtimer_cancel (&x->mtimer);del_timer_sync (&x->rtimer);
@@ -514,7 +514,7 @@ static void xfrm_state_gc_task(struct work_struct *work)synchronize_rcu ();hlist_for_each_entry_safe (x, tmp, &gc_list, gclist) -___xfrm_state_destroy (x); +xfrm_state_gc_destroy (x); }static enum hrtimer_restart xfrm_timer_handler (struct hrtimer *me)
@@ -637,19 +637,14 @@ struct xfrm_state *xfrm_state_alloc(struct net *net) }EXPORT_SYMBOL (xfrm_state_alloc); -void __xfrm_state_destroy (struct xfrm_state *x,bool sync) +void __xfrm_state_destroy (struct xfrm_state *x) {WARN_ON (x->km.state !=XFRM_STATE_DEAD ); -if (sync) { -synchronize_rcu (); -___xfrm_state_destroy (x); - }else { -spin_lock_bh (&xfrm_state_gc_lock); -hlist_add_head (&x->gclist, &xfrm_state_gc_list); -spin_unlock_bh (&xfrm_state_gc_lock); -schedule_work (&xfrm_state_gc_work); - } +spin_lock_bh (&xfrm_state_gc_lock); +hlist_add_head (&x->gclist, &xfrm_state_gc_list); +spin_unlock_bh (&xfrm_state_gc_lock); +schedule_work (&xfrm_state_gc_work); }EXPORT_SYMBOL (__xfrm_state_destroy);
@@ -758,7 +753,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool }#endif -int xfrm_state_flush (struct net *net,u8 proto,bool task_valid,bool sync) +int xfrm_state_flush (struct net *net,u8 proto,bool task_valid) {int i, err =0 , cnt =0 ;
@@ -2707,7 +2702,7 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -xfrm_state_flush (net,0 , false, true); +xfrm_state_flush (net,IPSEC_PROTO_ANY , false);flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
net/xfrm/xfrm_user.c +1 -1
@@ -2111,7 +2111,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,struct xfrm_usersa_flush *p =nlmsg_data (nlh);int err; - err =xfrm_state_flush (net, p->proto, true, false); + err =xfrm_state_flush (net, p->proto, true);if (err) {if (err == -ESRCH )/* empty table */ return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/451 xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 10deb69864840ccf96b00ac2ab3a2055c0c04721 ]
In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists.
In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel.
There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved.
At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).
--- net/xfrm/xfrm_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/xfrm/xfrm_state.c +2 -1
@@ -476,6 +476,7 @@ void xfrm_state_free(struct xfrm_state *x) }EXPORT_SYMBOL (xfrm_state_free); +static void xfrm_state_delete_tunnel (struct xfrm_state *x);static void xfrm_state_gc_destroy (struct xfrm_state *x) {hrtimer_cancel (&x->mtimer);
@@ -490,6 +491,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)kfree (x->preplay_esn);if (x->type_offload)xfrm_put_type_offload (x->type_offload); +xfrm_state_delete_tunnel (x);if (x->type) { x->type->destructor (x);xfrm_put_type (x->type);
@@ -648,7 +650,6 @@ void __xfrm_state_destroy(struct xfrm_state *x) }EXPORT_SYMBOL (__xfrm_state_destroy); -static void xfrm_state_delete_tunnel (struct xfrm_state *x);int __xfrm_state_delete (struct xfrm_state *x) {struct net *net =xs_net (x);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/451 xfrm: flush all states in xfrm_state_fini
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 42e42562c9cfcdacf000f1b42284a4fad24f8546 ]
While reverting commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path"), I incorrectly changed xfrm_state_flush's "proto" argument back to IPSEC_PROTO_ANY. This reverts some of the changes in commit dbb2483b2a46 ("xfrm: clean up xfrm protocol checks"), and leads to some states not being removed when we exit the netns.
Pass 0 instead of IPSEC_PROTO_ANY from both xfrm_state_fini xfrm6_tunnel_net_exit, so that xfrm_state_flush deletes all states.
--- net/ipv6/xfrm6_tunnel.c | 2 +- net/xfrm/xfrm_state.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -331,7 +331,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_state_flush (net,IPSEC_PROTO_ANY , false); +xfrm_state_flush (net,0 , false);xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)
net/xfrm/xfrm_state.c +1 -1
@@ -2703,7 +2703,7 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -xfrm_state_flush (net,IPSEC_PROTO_ANY , false); +xfrm_state_flush (net,0 , false);flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/451 Documentation: process: Also mention Sasha Levin as stable tree maintainer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
commit ba2457109d5b47a90fe565b39524f7225fc23e60 upstream.
Sasha has also maintaining stable branch in conjunction with Greg since cb5d21946d2a2f ("MAINTAINERS: Add Sasha as a stable branch maintainer"). Mention him in 2.Process.rst.
Message-ID: <[email protected]>
--- Documentation/process/2.Process.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
Documentation/process/2.Process.rst +4 -2
@@ -104,8 +104,10 @@ kernels go out with a handful of known r of them are serious. Once a stable release is made, its ongoing maintenance is passed off to the -"stable team," currently Greg Kroah-Hartman. The stable team will release -occasional updates to the stable release using the 5.x.y numbering scheme. +"stable team," currently consists of Greg Kroah-Hartman and Sasha Levin. The +stable team will release occasional updates to the stable release using the +5.x.y numbering scheme. + To be considered for an update release, a patch must (1) fix a significant bug, and (2) already be merged into the mainline for the next development kernel. Kernels will typically receive stable updates for a little more
Greg Kroah-Hartman
maintainerPATCH 6/451 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 986835bf4d11032bba4ab8414d18fce038c61bb4 upstream.
There's issue when file system corrupted:
------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0 Call Trace: <TASK> __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data.
In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue.
Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON.
Message-ID: <[email protected]>
--- fs/jbd2/transaction.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
fs/jbd2/transaction.c +14 -5
@@ -1267,14 +1267,23 @@ int jbd2_journal_get_create_access(handl* committing transaction's lists, but it HAS to be in Forget state in * that case: the transaction must have deleted the buffer for it to be * reused here. +* In the case of file system data inconsistency, for example, if the +* block bitmap of a referenced block is not set, it can lead to the +* situation where a block being committed is allocated and used again. +* As a result, the following condition will not be satisfied, so here +* we directly trigger a JBD abort instead of immediately invoking +* bugon. */ spin_lock (&jh->b_state_lock); -J_ASSERT_JH (jh, (jh->b_transaction == transaction || - jh->b_transaction ==NULL || - (jh->b_transaction == journal->j_committing_transaction && - jh->b_jlist == BJ_Forget))); +if (!(jh->b_transaction == transaction || jh->b_transaction ==NULL || + (jh->b_transaction == journal->j_committing_transaction && + jh->b_jlist == BJ_Forget)) || jh->b_next_transaction !=NULL ) { + err = -EROFS ; +spin_unlock (&jh->b_state_lock); +jbd2_journal_abort (journal, err); + goto out; + } -J_ASSERT_JH (jh, jh->b_next_transaction ==NULL );J_ASSERT_JH (jh,buffer_locked (jh2bh (jh)));if (jh->b_transaction ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 7/451 ext4: refresh inline data size before write operations
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b upstream.
The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired.
This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data():
kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);
The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers
Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications.
This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -410,7 +410,12 @@ static int ext4_prepare_inline_data(handreturn -ENOSPC ;ext4_write_lock_xattr (inode, &no_expand); - +/* +* ei->i_inline_size may have changed since the initial check +* if other xattrs were added. Recalculate to ensure +* ext4_update_inline_data() validates against current capacity. +*/ + (void )ext4_find_inline_data_nolock (inode);if (ei->i_inline_off) ret =ext4_update_inline_data (handle, inode, len);else
Greg Kroah-Hartman
maintainerPATCH 8/451 locking/spinlock/debug: Fix data-race in do_raw_write_lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit c14ecb555c3ee80eeb030a4e46d00e679537f03a upstream.
KCSAN reports:
BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock
write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
do_raw_write_lock+0x88/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
value changed: 0xffffffff -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111
Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete.
Quoted 1 line
From
do_raw_write_lock()onlydebug_write_lock_after()part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now.
--- kernel/locking/spinlock_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/locking/spinlock_debug.c +2 -2
@@ -180,8 +180,8 @@ void do_raw_read_unlock(rwlock_t *lock)static inline void debug_write_lock_before (rwlock_t *lock) {RWLOCK_BUG_ON (lock->magic !=RWLOCK_MAGIC , lock,"bad magic" ); -RWLOCK_BUG_ON (lock->owner == current, lock,"recursion" ); -RWLOCK_BUG_ON (lock->owner_cpu ==raw_smp_processor_id (), +RWLOCK_BUG_ON (READ_ONCE (lock->owner) == current, lock,"recursion" ); +RWLOCK_BUG_ON (READ_ONCE (lock->owner_cpu) ==raw_smp_processor_id (), lock,"cpu recursion" ); }
Greg Kroah-Hartman
maintainerPATCH 9/451 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Nepomnyashih <[email protected]>
commit 0cd8feea8777f8d9b9a862b89c688b049a5c8475 upstream.
Fix a race between inline data destruction and block mapping.
The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks().
Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert.
kernel BUG at fs/ext4/indirect.c:546!
EXT4-fs (loop2): unmounting filesystem.
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546 Call Trace: <TASK> ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:2271 [inline] do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10f/0x170 fs/splice.c:950 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -443,9 +443,13 @@ static int ext4_destroy_inline_data_noloif (!ei->i_inline_off)return 0 ; +down_write (&ei->i_data_sem); + error =ext4_get_inode_loc (inode, &is.iloc); -if (error) +if (error) { +up_write (&ei->i_data_sem);return error; + } error =ext4_xattr_ibody_find (inode, &i, &is);if (error)
@@ -483,6 +487,7 @@ out:brelse (is.iloc.bh);if (error == -ENODATA ) error =0 ; +up_write (&ei->i_data_sem);return error; }
Greg Kroah-Hartman
maintainerPATCH 10/451 USB: serial: option: add Foxconn T99W760
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
commit 7970b4969c4c99bcdaf105f9f39c6d2021f6d244 upstream.
T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are three serial ports to be enumerated: Modem, NMEA and Diag.
test evidence as below:
T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e123 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXBAAGHA-IDP _SN:39A8D3E4 S: SerialNumber=39a8d3e4 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2376,6 +2376,8 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe123, 0xff), /* Foxconn T99W760 MBIM */ + .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe15f, 0xff), /* Foxconn T99W709 */
Greg Kroah-Hartman
maintainerPATCH 11/451 USB: serial: option: add Telit Cinterion FE910C04 new compositions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit c908039a29aa70870871f4848125b3d743f929bf upstream.
Add the following Telit Cinterion new compositions:
0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c5 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10cb Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/serial/option.c +14 -0
@@ -1433,10 +1433,24 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c1, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c2, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c3, 0xff), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c5, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10cb, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 12/451 USB: serial: option: move Telit 0x10c7 composition in the right place
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 072f2c49572547f4b0776fe2da6b8f61e4b34699 upstream.
Move Telit 0x10c7 composition right after 0x10c6 composition and before 0x10c8 composition.
--- drivers/usb/serial/option.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/serial/option.c +3 -3
@@ -1445,6 +1445,9 @@ static const struct usb_device_id option .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */
@@ -1455,9 +1458,6 @@ static const struct usb_device_id option .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ - .driver_info = NCTRL(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ .driver_info = NCTRL(6) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 13/451 USB: serial: ftdi_sio: match on interface number for jtag
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4e31a5d0a9ee672f708fc993c1d5520643f769fd upstream.
Some FTDI devices have the first port reserved for JTAG and have been using a dedicated quirk to prevent binding to it.
As can be inferred directly or indirectly from the commit messages, almost all of these devices are dual port devices which means that the more recently added macro for matching on interface number can be used instead (and some such devices do so already).
This avoids probing interfaces that will never be bound and cleans up the match table somewhat.
Note that the JTAG quirk is kept for quad port devices, which would otherwise require three match entries.
--- drivers/usb/serial/ftdi_sio.c | 72 ++++++++++++++---------------------------- 1 file changed, 24 insertions(+), 48 deletions(-)
drivers/usb/serial/ftdi_sio.c +24 -48
@@ -606,10 +606,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) }, { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TIAO_UMPA_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_NT_ORIONLXM_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },
@@ -820,24 +818,17 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, - { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, CYBER_CORTEX_AV_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) }, - { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FIC_VID, FIC_NEO1973_DEBUG_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_OOCDLINK_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
@@ -879,17 +870,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(ATMEL_VID, STK541_PID) }, { USB_DEVICE(DE_VID, STB_PID) }, { USB_DEVICE(DE_VID, WHT_PID) }, - { USB_DEVICE(ADI_VID, ADI_GNICE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICEPLUS_PID, 1) }, { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,USB_CLASS_VENDOR_SPEC , USB_SUBCLASS_VENDOR_SPEC, 0x00) }, { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) }, { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, - { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(MARVELL_VID, MARVELL_SHEEVAPLUG_PID, 1) }, { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) }, { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) }, { USB_DEVICE(FTDI_VID, PI_C865_PID) },
@@ -912,10 +900,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(PI_VID, PI_1016_PID) }, { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) }, { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, - { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, TI_XDS100V2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, MARVELL_OPENRD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, TI_XDS100V2_PID, 1) }, { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
@@ -924,18 +910,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_ST_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID, 1) }, { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) }, { USB_DEVICE(FTDI_VID, ACCESIO_COM4SM_PID) }, - { USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(IONICS_VID, IONICS_PLUGCOMPUTER_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_24_MASTER_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_PC_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_USB_DMX_PID) },
@@ -950,15 +932,12 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, - { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ST_VID, ST_STMCLT_2232_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ST_VID, ST_STMCLT_2232_PID, 1) }, { USB_DEVICE(ST_VID, ST_STMCLT_4232_PID), .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk }, { USB_DEVICE(FTDI_VID, FTDI_RF_R106) }, - { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },/* Crucible Devices */ { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
@@ -1033,8 +1012,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, - { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(TI_VID, TI_CC3200_LAUNCHPAD_PID, 1) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
@@ -1054,10 +1032,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },/* FreeCalypso USB adapters */ - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID, 1) },/* GMC devices */ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) },/* Altera USB Blaster 3 */
Greg Kroah-Hartman
maintainerPATCH 14/451 serial: add support of CPCI cards
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magne Bruno <[email protected]>
commit 0e5a99e0e5f50353b86939ff6e424800d769c818 upstream.
Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI). Those cards are identified with different DeviceIds. Those cards integrating standard UARTs work the same way as PCI/PCIe models already supported in the serial driver.
--- drivers/tty/serial/8250/8250_pci.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
drivers/tty/serial/8250/8250_pci.c +37 -0
@@ -1926,6 +1926,11 @@ pci_moxa_setup(struct serial_private *pr#define PCI_DEVICE_ID_MOXA_CP138E_A 0x1381#define PCI_DEVICE_ID_MOXA_CP168EL_A 0x1683 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500 0x7003 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG 0x7024 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG 0x7025 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG 0x7026 +/* Unknown vendors/cards - this should not be in linux/pci_ids.h */ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584#define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -5753,6 +5758,38 @@ static const struct pci_device_id serial0 , pbn_ADDIDATA_PCIe_8_3906250 }, + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500 , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_2_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_1_115200 }, + { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,PCI_VENDOR_ID_IBM ,0x0299 , 0, 0, pbn_b0_bt_2_115200 },
Greg Kroah-Hartman
maintainerPATCH 15/451 USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b6e0b3016187446ddef9edac03cd9d544ac63f11 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing regression dating back to 2003 when the tiocmset() callback was introduced.
--- drivers/usb/serial/belkin_sa.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/usb/serial/belkin_sa.c +17 -11
@@ -448,7 +448,7 @@ static int belkin_sa_tiocmset(struct ttystruct belkin_sa_private *priv =usb_get_serial_port_data (port);unsigned long control_state;unsigned long flags; -int retval; +int retval =0 ;int rts =0 ;int dtr =0 ;
@@ -465,26 +465,32 @@ static int belkin_sa_tiocmset(struct tty }if (clear &TIOCM_RTS ) { control_state &= ~TIOCM_RTS ; - rts =0 ; + rts =1 ; }if (clear &TIOCM_DTR ) { control_state &= ~TIOCM_DTR ; - dtr =0 ; + dtr =1 ; } priv->control_state = control_state;spin_unlock_irqrestore (&priv->lock, flags); - retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , rts); -if (retval <0 ) { -dev_err (&port->dev,"Set RTS error %d\n" , retval); - goto exit; +if (rts) { + retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , + !!(control_state &TIOCM_RTS )); +if (retval <0 ) { +dev_err (&port->dev,"Set RTS error %d\n" , retval); + goto exit; + } } - retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , dtr); -if (retval <0 ) { -dev_err (&port->dev,"Set DTR error %d\n" , retval); - goto exit; +if (dtr) { + retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , + !!(control_state &TIOCM_DTR )); +if (retval <0 ) { +dev_err (&port->dev,"Set DTR error %d\n" , retval); + goto exit; + } } exit:return retval;
Greg Kroah-Hartman
maintainerPATCH 16/451 USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d432df758f92c4c28aac409bc807fd1716167577 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing issue dating back to 2003 when the support for these ioctls was added with the introduction of the tiocmset() callback.
--- drivers/usb/serial/kobil_sct.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/usb/serial/kobil_sct.c +9 -9
@@ -421,7 +421,7 @@ static int kobil_tiocmset(struct tty_strstruct usb_serial_port *port = tty->driver_data;struct device *dev = &port->dev;struct kobil_private *priv; -int result; +int result =0 ;int dtr =0 ;int rts =0 ;
@@ -438,12 +438,12 @@ static int kobil_tiocmset(struct tty_strif (set &TIOCM_DTR ) dtr =1 ;if (clear &TIOCM_RTS ) - rts =0 ; + rts =1 ;if (clear &TIOCM_DTR ) - dtr =0 ; + dtr =1 ; -if (priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { -if (dtr !=0 ) +if (dtr && priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { +if (set &TIOCM_DTR )dev_dbg (dev,"%s - Setting DTR\n" , __func__);else dev_dbg (dev,"%s - Clearing DTR\n" , __func__);
@@ -451,13 +451,13 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((dtr !=0 ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ), + ((set &TIOCM_DTR ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ),0 ,NULL ,0 , KOBIL_TIMEOUT); - }else { -if (rts !=0 ) + }else if (rts) { +if (set &TIOCM_RTS )dev_dbg (dev,"%s - Setting RTS\n" , __func__);else dev_dbg (dev,"%s - Clearing RTS\n" , __func__);
@@ -465,7 +465,7 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((rts !=0 ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ), + ((set &TIOCM_RTS ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ),0 ,NULL , 0,
Greg Kroah-Hartman
maintainerPATCH 17/451 spi: xilinx: increase number of retries before declaring stall
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvaro Gamez Machado <[email protected]>
[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
SPI devices using a (relative) slow frequency need a larger time.
For instance, microblaze running at 83.25MHz and performing a 3 bytes transaction using a 10MHz/16 = 625kHz needed this stall value increased to at least 20. The SPI device is quite slow, but also is the microblaze, so set this value to 32 to give it even more margin.
--- drivers/spi/spi-xilinx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-xilinx.c +1 -1
@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)/* Read out all the data from the Rx FIFO */ rx_words = n_words; - stalled =10 ; + stalled =32 ;while (rx_words) { if (rx_words == n_words && !(stalled--) && !(sr & XSPI_SR_TX_EMPTY_MASK) &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/451 spi: imx: keep dma request disabled before dma transfer setup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Gong <[email protected]>
[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below:
"It is thus essential for the Arm platform to program them before any DMA
request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started."
--- drivers/spi/spi-imx.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/spi/spi-imx.c +11 -4
@@ -493,9 +493,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) {u32 reg; - reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); - reg |=MX51_ECSPI_CTRL_XCH ; -writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); +if (spi_imx->usedma) { + reg =readl (spi_imx->base +MX51_ECSPI_DMA ); + reg |=MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN ; +writel (reg, spi_imx->base +MX51_ECSPI_DMA ); + }else { + reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); + reg |=MX51_ECSPI_CTRL_XCH ; +writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); + } }static void mx51_disable_dma (struct spi_imx_data *spi_imx)
@@ -650,7 +656,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)writel (MX51_ECSPI_DMA_RX_WML (spi_imx->wml -1 ) |MX51_ECSPI_DMA_TX_WML (spi_imx->wml) |MX51_ECSPI_DMA_RXT_WML (spi_imx->wml) | -MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN |MX51_ECSPI_DMA_RXTDEN , spi_imx->base +MX51_ECSPI_DMA ); }
@@ -1424,6 +1429,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,reinit_completion (&spi_imx->dma_tx_completion);dma_async_issue_pending (master->dma_tx); + spi_imx->devtype_data->trigger (spi_imx); + transfer_timeout =spi_imx_calculate_timeout (spi_imx, transfer->len);/* Wait SDMA to finish the data transfer.*/
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/451 bfs: Reconstruct file type when loading from disk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted.
A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0.
Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
--- fs/bfs/inode.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
fs/bfs/inode.c +18 -1
@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) off = (ino -BFS_ROOT_INO ) %BFS_INODES_PER_BLOCK ; di = (struct bfs_inode *)bh->b_data + off; - inode->i_mode =0x0000FFFF &le32_to_cpu (di->i_mode); +/* +* https://martin.hinner.info/fs/bfs/bfs-structure.html explains that +* BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode +* value. This means that, although bfs_write_inode() saves whole +* inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} +* bits), middle 7 bits of di->i_mode value can be garbage when these +* bits were not saved by bfs_write_inode(). +* Since we can't tell whether middle 7 bits are garbage, use only +* lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being +* garbage) and reconstruct S_IFMT bits for Linux environment from +* di->i_vtype value. +*/ + inode->i_mode =0x00000FFF &le32_to_cpu (di->i_mode);if (le32_to_cpu (di->i_vtype) ==BFS_VDIR ) { inode->i_mode |=S_IFDIR ; inode->i_op = &bfs_dir_inops;
@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) inode->i_op = &bfs_file_inops; inode->i_fop = &bfs_file_operations; inode->i_mapping->a_ops = &bfs_aops; + }else { +brelse (bh); +printf ("Unknown vtype=%u %s:%08lx\n" , +le32_to_cpu (di->i_vtype), inode->i_sb->s_id, ino); + goto error; }BFS_I (inode)->i_sblock =le32_to_cpu (di->i_sblock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/451 pinctrl: qcom: msm: Fix deadlock in pinmux configuration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <[email protected]>
[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() to prevent deadlock when wakeup IRQ is triggered on the same GPIO being reconfigured.
The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ handler attempts to reconfigure the same GPIO's pinmux. In this scenario, msm_pinmux_set_mux() calls disable_irq() which waits for the currently running IRQ handler to complete, creating a circular dependency that results in deadlock.
Using disable_irq_nosync() avoids waiting for the IRQ handler to complete, preventing the deadlock condition while still properly disabling the interrupt during pinmux reconfiguration.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-msm.c +1 -1
@@ -213,7 +213,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,*/ if (d && i != gpio_func && !test_and_set_bit (d->hwirq, pctrl->disabled_for_mux)) -disable_irq (irq); +disable_irq_nosync (irq);raw_spin_lock_irqsave (&pctrl->lock, flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/451 platform/x86: acer-wmi: Ignore backlight event
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI firmware when the backlight up/down keys are pressed. Ignore this event to avoid spamming the kernel log with error messages, as the acpi-video driver already handles brightness up/down events.
--- drivers/platform/x86/acer-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/acer-wmi.c +4 -0
@@ -81,6 +81,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");enum acer_wmi_event_ids {WMID_HOTKEY_EVENT =0x1 , +WMID_BACKLIGHT_EVENT =0x4 ,WMID_ACCEL_OR_KBD_DOCK_EVENT =0x5 , };
@@ -1890,6 +1891,9 @@ static void acer_wmi_notify(u32 value, void *context)sparse_keymap_report_event (acer_wmi_input_dev, scancode,1 , true); }break ; +case WMID_BACKLIGHT_EVENT : +/* Already handled by acpi-video */ +break ;case WMID_ACCEL_OR_KBD_DOCK_EVENT :acer_gsensor_event ();acer_kbd_dock_event (&return_value);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/451 platform/x86: huawei-wmi: add keys for HONOR models
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Ston <[email protected]>
[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print Screen and YOYO keys properly, with the system reporting them as unknown key presses (codes: 0x028b and 0x028e).
To resolve this, a key_entry is added for both the HONOR Print Screen key and the HONOR YOYO key, ensuring they function correctly on these models.
--- drivers/platform/x86/huawei-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/huawei-wmi.c +4 -0
@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = { { KE_KEY, 0x289, { KEY_WLAN } },// Huawei |M| key { KE_KEY, 0x28a, { KEY_CONFIG } }, +// HONOR YOYO key + { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, +// HONOR print screen + { KE_KEY, 0x28e, { KEY_PRINT } },// Keyboard backlit { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/451 samples: work around glibc redefining some of our defines wrong
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE and some of the other flags for renameat2() and friends in <stdio.h>.
Which would all be fine, except for inexplicable reasons glibc decided to define them _differently_ from the kernel definitions, which then makes some of our sample code that includes both kernel headers and user space headers unhappy, because the compiler will (correctly) complain about redefining things.
Now, mixing kernel headers and user space headers is always a somewhat iffy proposition due to namespacing issues, but it's kind of inevitable in our sample and selftest code. And this is just glibc being stupid.
Those defines come from the kernel, glibc is exposing the kernel interfaces, and glibc shouldn't make up some random new expressions for these values.
It's not like glibc headers changed the actual result values, but they arbitrarily just decided to use a different expression to describe those values. The kernel just does
#define AT_RENAME_NOREPLACE 0x0001
while glibc does
# define RENAME_NOREPLACE (1 << 0)
# define AT_RENAME_NOREPLACE RENAME_NOREPLACEinstead. Same value in the end, but very different macro definition.
For absolutely no reason.
This has since been fixed in the glibc development tree, so eventually we'll end up with the canonical expressions and no clashes. But in the meantime the broken headers are in the glibc-2.42 release and have made it out into distributions.
Do a minimal work-around to make the samples build cleanly by just undefining the affected macros in between the user space header include and the kernel header includes.
--- samples/vfs/test-statx.c | 6 ++++++ samples/watch_queue/watch_test.c | 6 ++++++ 2 files changed, 12 insertions(+)
samples/vfs/test-statx.c +6 -0
@@ -19,6 +19,12 @@#include <time.h> #include <sys/syscall.h> #include <sys/types.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/stat.h> #include <linux/fcntl.h> #define statx foo
samples/watch_queue/watch_test.c +6 -0
@@ -16,6 +16,12 @@#include <errno.h> #include <sys/ioctl.h> #include <limits.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/watch_queue.h> #include <linux/unistd.h> #include <linux/keyctl.h>
Signature · 1 line
2.51.0
Re: [PATCH 5.10 023/451] samples: work around glibc redefining some of our defines wrong
Quoted 10 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit
a48f822908982353c3256e35a089e9e7d0d61580]Apparently as of version 2.42, glibc headers define
AT_RENAME_NOREPLACEand some of the other flags forrenameat2()and friends in <stdio.h>.
This is not relevant to 5.10 or any branch older than 6.12, because <linux/fcntl.h> only started defining these macros in 6.12.
Ben.
Quoted 79 lines
Which would all be fine, except for inexplicable reasons glibc decided to define them _differently_ from the kernel definitions, which then makes some of our sample code that includes both kernel headers and user space headers unhappy, because the compiler will (correctly) complain about redefining things.
Now, mixing kernel headers and user space headers is always a somewhat iffy proposition due to namespacing issues, but it's kind of inevitable in our sample and selftest code. And this is just glibc being stupid.
Those defines come from the kernel, glibc is exposing the kernel interfaces, and glibc shouldn't make up some random new expressions for these values.
It's not like glibc headers changed the actual result values, but they arbitrarily just decided to use a different expression to describe those values. The kernel just does
#define AT_RENAME_NOREPLACE 0x0001while glibc does
# define RENAME_NOREPLACE (1 << 0) # define AT_RENAME_NOREPLACE RENAME_NOREPLACEinstead. Same value in the end, but very different macro definition.
For absolutely no reason.
This has since been fixed in the glibc development tree, so eventually we'll end up with the canonical expressions and no clashes. But in the meantime the broken headers are in the glibc-2.42 release and have made it out into distributions.
Do a minimal work-around to make the samples build cleanly by just undefining the affected macros in between the user space header include and the kernel header includes.
Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- samples/vfs/test-statx.c | 6 ++++++ samples/watch_queue/watch_test.c | 6 ++++++ 2 files changed, 12 insertions(+)samples/vfs/test-statx.c +6
-0@@ -19,6 +19,12 @@#include <time.h> #include <sys/syscall.h> #include <sys/types.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/stat.h> #include <linux/fcntl.h> #define statx foosamples/watch_queue/watch_test.c +6
-0@@ -16,6 +16,12 @@#include <errno.h> #include <sys/ioctl.h> #include <limits.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/watch_queue.h> #include <linux/unistd.h> #include <linux/keyctl.h>
Signature · 3 lines
Ben Hutchings
Experience is directly proportional to the value of equipment destroyed
- Carolyn ScheppnerGreg Kroah-Hartman
maintainerRe: [PATCH 5.10 023/451] samples: work around glibc redefining some of our defines wrong
Quoted 7 lines · Ben Hutchings
Quoted 6 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
Quoted 7 lines
Quoted 4 lines
[ Upstream commit
a48f822908982353c3256e35a089e9e7d0d61580]Apparently as of version 2.42, glibc headers define
AT_RENAME_NOREPLACEand some of the other flags forrenameat2()and friends in <stdio.h>.This is not relevant to 5.10 or any branch older than 6.12, because <
linux/fcntl.h> only started defining these macros in 6.12.
thanks, now dropped.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 24/451 comedi: c6xdigio: Fix invalid PNP driver unregistration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 72262330f7b3ad2130e800cecf02adcce3c32c77 upstream.
The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler c6xdigio_attach() to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with pnp_register_driver(), but ignores the return value. (The struct pnp_driver it uses has only the name and id_table members filled in.) The driver's Comedi "detach" handler c6xdigio_detach() unconditionally unregisters the PNP driver with pnp_unregister_driver().
It is possible for c6xdigio_attach() to return an error before it calls pnp_register_driver() and it is possible for the call to pnp_register_driver() to return an error (that is ignored). In both cases, the driver should not be calling pnp_unregister_driver() as it does in c6xdigio_detach(). (Note that c6xdigio_detach() will be called by the Comedi core if c6xdigio_attach() returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.)
The unconditional call to pnp_unregister_driver() without a previous successful call to pnp_register_driver() will cause driver_unregister() to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1].
Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.)
Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since c6xdigio_detach() now only calls comedi_legacy_detach(), remove the function and change the Comedi driver "detach" handler to comedi_legacy_detach.
-------------------------------------------
[1] Syzbot sample crash report:
Unexpected driver unregister!
WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline] WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Modules linked in: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:driver_unregister drivers/base/driver.c:273 [inline] RIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Code: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41 RSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8 RDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000 FS: 000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0 Call Trace: <TASK> comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207 comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215 comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011 do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc05798eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8184238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc057be5fa0 RCX: 00007fc05798eec9 RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fc057a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc057be5fa0 R14: 00007fc057be5fa0 R15: 0000000000000003 </TASK> -------------------------------------------
--- drivers/staging/comedi/drivers/c6xdigio.c | 46 ++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 11 deletions(-)
drivers/staging/comedi/drivers/c6xdigio.c +35 -11
@@ -250,9 +250,6 @@ static int c6xdigio_attach(struct comediif (ret)return ret; -/* Make sure that PnP ports get activated */ -pnp_register_driver (&c6xdigio_pnp_driver); - s = &dev->subdevices[0 ];/* pwm output subdevice */ s->type =COMEDI_SUBD_PWM ;
@@ -279,19 +276,46 @@ static int c6xdigio_attach(struct comedireturn 0 ; } -static void c6xdigio_detach (struct comedi_device *dev) -{ -comedi_legacy_detach (dev); -pnp_unregister_driver (&c6xdigio_pnp_driver); -} -static struct comedi_driver c6xdigio_driver = { .driver_name ="c6xdigio" , .module =THIS_MODULE , .attach = c6xdigio_attach, - .detach = c6xdigio_detach, + .detach = comedi_legacy_detach, }; -module_comedi_driver (c6xdigio_driver); + +static bool c6xdigio_pnp_registered = false; + +static int __init c6xdigio_module_init (void ) +{ +int ret; + + ret =comedi_driver_register (&c6xdigio_driver); +if (ret) +return ret; + +if (IS_ENABLED (CONFIG_PNP )) { +/* Try to activate the PnP ports */ + ret =pnp_register_driver (&c6xdigio_pnp_driver); +if (ret) { +pr_warn ("failed to register pnp driver - err %d\n" , + ret); + ret =0 ;/* ignore the error. */ + }else { + c6xdigio_pnp_registered = true; + } + } + +return 0 ; +} +module_init (c6xdigio_module_init); + +static void __exit c6xdigio_module_exit(void) +{ +if (c6xdigio_pnp_registered) +pnp_unregister_driver (&c6xdigio_pnp_driver); +comedi_driver_unregister (&c6xdigio_driver); +} +module_exit (c6xdigio_module_exit);MODULE_AUTHOR ("Comedi https://www.comedi.org" );MODULE_DESCRIPTION ("Comedi driver for the C6x_DIGIO DSP daughter card" );
Greg Kroah-Hartman
maintainerPATCH 25/451 comedi: multiq3: sanitize config options in multiq3_attach()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit f24c6e3a39fa355dabfb684c9ca82db579534e72 upstream.
Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specifically, in the case of multiq3 driver.
This problem arose when syzkaller managed to craft weird configuration options used to specify the number of channels in encoder subdevice. If a particularly great number is passed to s->n_chan in multiq3_attach() via it->options[2], then multiple calls to multiq3_encoder_reset() at the end of driver-specific attach() method will be running for minutes, thus blocking tasks and affected devices as well.
While this issue is most likely not too dangerous for real-life devices, it still makes sense to sanitize configuration inputs. Enable a sensible limit on the number of encoder chips (4 chips max, each with 2 channels) to stop this behaviour from manifesting.
[1] Syzbot crash:
INFO: task syz.2.19:6067 blocked for more than 143 seconds. ... Call Trace: <TASK> context_switch kernel/sched/core.c:5254 [inline] __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862 __schedule_loop kernel/sched/core.c:6944 [inline] schedule+0x165/0x360 kernel/sched/core.c:6959 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760 comedi_open+0xc0/0x590 drivers/comedi/comedi_fops.c:2868 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x953/0x13f0 fs/open.c:965 vfs_open+0x3b/0x340 fs/open.c:1097
...
--- drivers/staging/comedi/drivers/multiq3.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/staging/comedi/drivers/multiq3.c +9 -0
@@ -68,6 +68,11 @@#define MULTIQ3_TRSFRCNTR_OL 0x10/* xfer CNTR to OL (x and y) */ #define MULTIQ3_EFLAG_RESET 0x06/* reset E bit of flag reg */ +/* +* Limit on the number of optional encoder channels +*/ +#define MULTIQ3_MAX_ENC_CHANS 8 +static void multiq3_set_ctrl (struct comedi_device *dev,unsigned int bits) {/*
@@ -313,6 +318,10 @@ static int multiq3_attach(struct comedi_ s->insn_read = multiq3_encoder_insn_read; s->insn_config = multiq3_encoder_insn_config; +/* sanity check for number of encoder channels */ +if (s->n_chan >MULTIQ3_MAX_ENC_CHANS ) + s->n_chan =MULTIQ3_MAX_ENC_CHANS ; +for (i =0 ; i < s->n_chan; i++)multiq3_encoder_reset (dev, i);
Greg Kroah-Hartman
maintainerPATCH 26/451 comedi: check devices attached status in compat ioctls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 0de7d9cd07a2671fa6089173bccc0b2afe6b93ee upstream.
Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig().
As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG.
Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback.
Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions.
[1] Syzbot report:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: <TASK> get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
...
--- drivers/staging/comedi/comedi_fops.c | 42 ++++++++++++++++++++++++++++++----- 1 file changed, 36 insertions(+), 6 deletions(-)
drivers/staging/comedi/comedi_fops.c +36 -6
@@ -2961,7 +2961,12 @@ static int compat_chaninfo(struct file * chaninfo.rangelist =compat_ptr (chaninfo32.rangelist);mutex_lock (&dev->mutex); - err =do_chaninfo_ioctl (dev, &chaninfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_chaninfo_ioctl (dev, &chaninfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -2982,7 +2987,12 @@ static int compat_rangeinfo(struct file rangeinfo.range_ptr =compat_ptr (rangeinfo32.range_ptr);mutex_lock (&dev->mutex); - err =do_rangeinfo_ioctl (dev, &rangeinfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_rangeinfo_ioctl (dev, &rangeinfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -3058,7 +3068,12 @@ static int compat_cmd(struct file *file,return rc;mutex_lock (&dev->mutex); - rc =do_cmd_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmd_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) {/* Special case: copy cmd back to user. */
@@ -3083,7 +3098,12 @@ static int compat_cmdtest(struct file *freturn rc;mutex_lock (&dev->mutex); - rc =do_cmdtest_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmdtest_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) { err =put_compat_cmd (compat_ptr (arg), &cmd);
@@ -3143,7 +3163,12 @@ static int compat_insnlist(struct file * }mutex_lock (&dev->mutex); - rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); + }mutex_unlock (&dev->mutex);kfree (insns);return rc;
@@ -3162,7 +3187,12 @@ static int compat_insn(struct file *filereturn rc;mutex_lock (&dev->mutex); - rc =do_insn_ioctl (dev, &insn, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insn_ioctl (dev, &insn, file); + }mutex_unlock (&dev->mutex);return rc; }
Greg Kroah-Hartman
maintainerPATCH 27/451 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 6ef0e1c10455927867cac8f0ed6b49f328f8cf95 upstream.
The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow.
Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow.
This prevents kernel stack corruption triggered by malformed association requests.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +4 -1
@@ -1281,6 +1281,9 @@ unsigned int OnAssocReq(struct adapter * status = _STATS_FAILURE_; goto OnAssocReqFail; }else { +if (ie_len >sizeof (supportRate)) + ie_len =sizeof (supportRate); +memcpy (supportRate, p+2 , ie_len); supportRateNum = ie_len;
@@ -1288,7 +1291,7 @@ unsigned int OnAssocReq(struct adapter * pkt_len - WLAN_HDR_A3_LEN - ie_offset);if (p !=NULL ) { -if (supportRateNum <=sizeof (supportRate)) { +if (supportRateNum + ie_len <=sizeof (supportRate)) {memcpy (supportRate+supportRateNum, p+2 , ie_len); supportRateNum += ie_len; }
Greg Kroah-Hartman
maintainerPATCH 28/451 smack: fix bug: unprivileged task can create labels
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3 ]
If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty),
it can freely create new labels by writing their names into own /proc/PID/attr/smack/current
This occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.
This change ensures that the "relabel-self" list
is checked before importing the label.
--- security/smack/smack_lsm.c | 41 +++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 14 deletions(-)
security/smack/smack_lsm.c +27 -14
@@ -3552,8 +3552,8 @@ static int smack_setprocattr(const char *name, void *value, size_t size)struct task_smack *tsp =smack_cred (current_cred ());struct cred *new;struct smack_known *skp; -struct smack_known_list_elem *sklep; -int rc; +char *labelstr; +int rc =0 ;if (!smack_privileged (CAP_MAC_ADMIN ) &&list_empty (&tsp->smk_relabel))return -EPERM ;
@@ -3564,28 +3564,41 @@ static int smack_setprocattr(const char *name, void *value, size_t size)if (strcmp (name,"current" ) !=0 )return -EINVAL ; - skp =smk_import_entry (value, size); -if (IS_ERR (skp)) -return PTR_ERR (skp); + labelstr =smk_parse_smack (value, size); +if (IS_ERR (labelstr)) +return PTR_ERR (labelstr);/* * No process is ever allowed the web ("@") label * and the star ("*") label. */ -if (skp == &smack_known_web || skp == &smack_known_star) -return -EINVAL ; +if (labelstr[1 ] =='\0' /* '@', '*' */ ) { +const char c = labelstr[0 ]; + +if (c == *smack_known_web.smk_known || + c == *smack_known_star.smk_known) { + rc = -EPERM ; + goto free_labelstr; + } + }if (!smack_privileged (CAP_MAC_ADMIN )) { - rc = -EPERM ; +const struct smack_known_list_elem *sklep;list_for_each_entry (sklep, &tsp->smk_relabel, list) -if (sklep->smk_label == skp) { - rc =0 ; -break ; - } -if (rc) -return rc; +if (strcmp (sklep->smk_label->smk_known, labelstr) ==0 ) + goto free_labelstr; + rc = -EPERM ; } +free_labelstr: +kfree (labelstr); +if (rc) +return -EPERM ; + + skp =smk_import_entry (value, size); +if (IS_ERR (skp)) +return PTR_ERR (skp); + new =prepare_creds ();if (new ==NULL )return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/451 drm/panel: visionox-rm69299: Dont clear all mode flags
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guido Günther <[email protected]>
[ Upstream commit 39144b611e9cd4f5814f4098c891b545dd70c536 ]
Don't clear all mode flags. We only want to maek sure we use HS mode during unprepare.
--- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-visionox-rm69299.c +1 -1
@@ -64,7 +64,7 @@ static int visionox_rm69299_unprepare(struct drm_panel *panel)struct visionox_rm69299 *ctx =panel_to_ctx (panel);int ret; - ctx->dsi->mode_flags =0 ; + ctx->dsi->mode_flags &= ~MIPI_DSI_MODE_LPM ; ret =mipi_dsi_dcs_write (ctx->dsi,MIPI_DCS_SET_DISPLAY_OFF ,NULL ,0 );if (ret <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/451 drm/vgem-fence: Fix potential deadlock on release
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <[email protected]>
[ Upstream commit 78b4d6463e9e69e5103f98b367f8984ad12cdc6f ]
A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put(). In some scenarios, it can run in IRQ context, which is not safe unless TIMER_IRQSAFE is used. One potentially risky scenario was demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while working on new IGT subtests syncobj_timeline@stress-* as user space replacements of some problematic test cases of a dma-fence-chain selftest [1].
[117.004338] ================================
[117.004340] WARNING: inconsistent lock state
[117.004342] 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 Tainted: G S U
[117.004346] --------------------------------
[117.004347] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
[117.004349] swapper/0/0 [HC1[1]:SC1[1]:HE0:SE0] takes:
[117.004352] ffff888138f86aa8 ((&fence->timer)){?.-.}-{0:0}, at: __timer_delete_sync+0x4b/0x190
[117.004361] {HARDIRQ-ON-W} state was registered at:
[117.004363] lock_acquire+0xc4/0x2e0
[117.004366] call_timer_fn+0x80/0x2a0
[117.004368] __run_timers+0x231/0x310
[117.004370] run_timer_softirq+0x76/0xe0
[117.004372] handle_softirqs+0xd4/0x4d0
[117.004375] __irq_exit_rcu+0x13f/0x160
[117.004377] irq_exit_rcu+0xe/0x20
[117.004379] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004382] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004385] cpuidle_enter_state+0x12b/0x8a0
[117.004388] cpuidle_enter+0x2e/0x50
[117.004393] call_cpuidle+0x22/0x60
[117.004395] do_idle+0x1fd/0x260
[117.004398] cpu_startup_entry+0x29/0x30
[117.004401] start_secondary+0x12d/0x160
[117.004404] common_startup_64+0x13e/0x141
[117.004407] irq event stamp: 2282669
[117.004409] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.004414] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.004419] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.004423] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.004426]
other info that might help us debug this:
[117.004429] Possible unsafe locking scenario:
[117.004432] CPU0
[117.004433] ----
[117.004434] lock((&fence->timer));
[117.004436] <Interrupt>
[117.004438] lock((&fence->timer));
[117.004440]
*** DEADLOCK ***
[117.004443] 1 lock held by swapper/0/0:
[117.004445] #0: ffffc90000003d50 ((&fence->timer)){?.-.}-{0:0}, at: call_timer_fn+0x7a/0x2a0
[117.004450]
stack backtrace:
[117.004453] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004455] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004455] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004456] Call Trace:
[117.004456] <IRQ>
[117.004457] dump_stack_lvl+0x91/0xf0
[117.004460] dump_stack+0x10/0x20
[117.004461] print_usage_bug.part.0+0x260/0x360
[117.004463] mark_lock+0x76e/0x9c0
[117.004465] ? register_lock_class+0x48/0x4a0
[117.004467] __lock_acquire+0xbc3/0x2860
[117.004469] lock_acquire+0xc4/0x2e0
[117.004470] ? __timer_delete_sync+0x4b/0x190
[117.004472] ? __timer_delete_sync+0x4b/0x190
[117.004473] __timer_delete_sync+0x68/0x190
[117.004474] ? __timer_delete_sync+0x4b/0x190
[117.004475] timer_delete_sync+0x10/0x20
[117.004476] vgem_fence_release+0x19/0x30 [vgem]
[117.004478] dma_fence_release+0xc1/0x3b0
[117.004480] ? dma_fence_release+0xa1/0x3b0
[117.004481] dma_fence_chain_release+0xe7/0x130
[117.004483] dma_fence_release+0xc1/0x3b0
[117.004484] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004485] dma_fence_chain_irq_work+0x59/0x80
[117.004487] irq_work_single+0x75/0xa0
[117.004490] irq_work_run_list+0x33/0x60
[117.004491] irq_work_run+0x18/0x40
[117.004493] __sysvec_irq_work+0x35/0x170
[117.004494] sysvec_irq_work+0x47/0xc0
[117.004496] asm_sysvec_irq_work+0x1b/0x20
[117.004497] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004499] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004499] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004500] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004501] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004502] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004502] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004502] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004506] dma_fence_signal+0x49/0xb0
[117.004507] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004508] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004509] call_timer_fn+0xa1/0x2a0
[117.004512] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004513] __run_timers+0x231/0x310
[117.004514] ? tmigr_handle_remote+0x2ac/0x560
[117.004517] timer_expire_remote+0x46/0x70
[117.004518] tmigr_handle_remote+0x433/0x560
[117.004520] ? __run_timers+0x239/0x310
[117.004521] ? run_timer_softirq+0x21/0xe0
[117.004522] ? lock_release+0xce/0x2a0
[117.004524] run_timer_softirq+0xcf/0xe0
[117.004525] handle_softirqs+0xd4/0x4d0
[117.004526] __irq_exit_rcu+0x13f/0x160
[117.004527] irq_exit_rcu+0xe/0x20
[117.004528] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004529] </IRQ>
[117.004529] <TASK>
[117.004529] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004530] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004532] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004532] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004533] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004533] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004534] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004534] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004534] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004537] ? cpuidle_enter_state+0x125/0x8a0
[117.004538] ? sched_clock_noinstr+0x9/0x10
[117.004540] cpuidle_enter+0x2e/0x50
[117.004542] call_cpuidle+0x22/0x60
[117.004542] do_idle+0x1fd/0x260
[117.004544] cpu_startup_entry+0x29/0x30
[117.004546] rest_init+0x104/0x200
[117.004548] start_kernel+0x93d/0xbd0
[117.004550] ? load_ucode_intel_bsp+0x2a/0x90
[117.004551] ? sme_unmap_bootdata+0x14/0x80
[117.004554] x86_64_start_reservations+0x18/0x30
[117.004555] x86_64_start_kernel+0xfd/0x150
[117.004556] ? soft_restart_cpu+0x14/0x14
[117.004558] common_startup_64+0x13e/0x141
[117.004560] </TASK>
[117.004565] ------------[ cut here ]------------
[117.004692] WARNING: CPU: 0 PID: 0 at kernel/time/timer.c:1610 __timer_delete_sync+0x126/0x190
[117.004697] Modules linked in: vgem snd_hda_codec_intelhdmi snd_hda_codec_hdmi i915 prime_numbers ttm drm_buddy drm_display_helper cec rc_core i2c_algo_bit hid_sensor_custom hid_sensor_hub hid_generic intel_ishtp_hid hid intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal intel_powerclamp cmdlinepart ee1004 r8153_ecm spi_nor coretemp cdc_ether mei_pxp mei_hdcp usbnet mtd intel_rapl_msr wmi_bmof kvm_intel snd_hda_intel snd_intel_dspcfg processor_thermal_device_pci kvm snd_hda_codec processor_thermal_device irqbypass processor_thermal_wt_hint polyval_clmulni platform_temperature_control snd_hda_core ghash_clmulni_intel processor_thermal_rfim spi_pxa2xx_platform snd_hwdep aesni_intel processor_thermal_rapl dw_dmac snd_pcm dw_dmac_core intel_rapl_common r8152 rapl mii intel_cstate spi_pxa2xx_core i2c_i801 processor_thermal_wt_req snd_timer i2c_mux mei_me intel_ish_ipc processor_thermal_power_floor e1000e snd i2c_smbus spi_intel_pci processor_thermal_mbox mei soundcore intel_ishtp thunderbolt idma64
[117.004733] spi_intel int340x_thermal_zone igen6_edac binfmt_misc intel_skl_int3472_tps68470 intel_pmc_core tps68470_regulator video clk_tps68470 pmt_telemetry pmt_discovery nls_iso8859_1 pmt_class intel_pmc_ssram_telemetry intel_skl_int3472_discrete int3400_thermal intel_hid intel_skl_int3472_common acpi_thermal_rel intel_vsec wmi pinctrl_tigerlake acpi_tad sparse_keymap acpi_pad dm_multipath msr nvme_fabrics fuse efi_pstore nfnetlink autofs4
[117.004782] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004787] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004789] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004793] RIP: 0010:__timer_delete_sync+0x126/0x190
[117.004795] Code: 31 c0 45 31 c9 c3 cc cc cc cc 48 8b 75 d0 45 84 f6 74 63 49 c7 45 18 00 00 00 00 48 89 c7 e8 51 46 39 01 f3 90 e9 66 ff ff ff <0f> 0b e9 5f ff ff ff e8 ee e4 0c 00 49 8d 5d 28 45 31 c9 31 c9 4c
[117.004801] RSP: 0018:ffffc90000003a40 EFLAGS: 00010046
[117.004804] RAX: ffffffff815093fb RBX: ffff888138f86aa8 RCX: 0000000000000000
[117.004807] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004809] RBP: ffffc90000003a70 R08: 0000000000000000 R09: 0000000000000000
[117.004812] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff815093fb
[117.004814] R13: ffff888138f86a80 R14: 0000000000000000 R15: 0000000000000000
[117.004817] FS: 0000000000000000(0000) GS:ffff88890b0f7000(0000) knlGS:0000000000000000
[117.004820] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[117.004823] CR2: 00005db8131eb7f0 CR3: 0000000003448000 CR4: 0000000000f52ef0
[117.004826] PKRU: 55555554
[117.004827] Call Trace:
[117.004829] <IRQ>
[117.004831] timer_delete_sync+0x10/0x20
[117.004833] vgem_fence_release+0x19/0x30 [vgem]
[117.004836] dma_fence_release+0xc1/0x3b0
[117.004838] ? dma_fence_release+0xa1/0x3b0
[117.004841] dma_fence_chain_release+0xe7/0x130
[117.004844] dma_fence_release+0xc1/0x3b0
[117.004847] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004850] dma_fence_chain_irq_work+0x59/0x80
[117.004853] irq_work_single+0x75/0xa0
[117.004857] irq_work_run_list+0x33/0x60
[117.004860] irq_work_run+0x18/0x40
[117.004863] __sysvec_irq_work+0x35/0x170
[117.004865] sysvec_irq_work+0x47/0xc0
[117.004868] asm_sysvec_irq_work+0x1b/0x20
[117.004871] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004874] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004879] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004882] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004884] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004887] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004890] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004892] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004897] dma_fence_signal+0x49/0xb0
[117.004899] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004902] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004904] call_timer_fn+0xa1/0x2a0
[117.004908] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004910] __run_timers+0x231/0x310
[117.004913] ? tmigr_handle_remote+0x2ac/0x560
[117.004917] timer_expire_remote+0x46/0x70
[117.004919] tmigr_handle_remote+0x433/0x560
[117.004923] ? __run_timers+0x239/0x310
[117.004925] ? run_timer_softirq+0x21/0xe0
[117.004928] ? lock_release+0xce/0x2a0
[117.004931] run_timer_softirq+0xcf/0xe0
[117.004933] handle_softirqs+0xd4/0x4d0
[117.004936] __irq_exit_rcu+0x13f/0x160
[117.004938] irq_exit_rcu+0xe/0x20
[117.004940] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004943] </IRQ>
[117.004944] <TASK>
[117.004946] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004949] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004953] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004961] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004963] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004966] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004968] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004971] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004974] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004978] ? cpuidle_enter_state+0x125/0x8a0
[117.004981] ? sched_clock_noinstr+0x9/0x10
[117.004985] cpuidle_enter+0x2e/0x50
[117.004989] call_cpuidle+0x22/0x60
[117.004991] do_idle+0x1fd/0x260
[117.005001] cpu_startup_entry+0x29/0x30
[117.005004] rest_init+0x104/0x200
[117.005008] start_kernel+0x93d/0xbd0
[117.005011] ? load_ucode_intel_bsp+0x2a/0x90
[117.005014] ? sme_unmap_bootdata+0x14/0x80
[117.005017] x86_64_start_reservations+0x18/0x30
[117.005020] x86_64_start_kernel+0xfd/0x150
[117.005023] ? soft_restart_cpu+0x14/0x14
[117.005026] common_startup_64+0x13e/0x141
[117.005030] </TASK>
[117.005032] irq event stamp: 2282669
[117.005034] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.005038] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.005043] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.005047] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.005051] ---[ end trace 0000000000000000 ]---Make the timer IRQ safe.
[1] https://patchwork.freedesktop.org/series/154987/#rev2
--- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vgem/vgem_fence.c +1 -1
@@ -94,7 +94,7 @@ static struct dma_fence *vgem_fence_create(struct vgem_file *vfile,dma_fence_init (&fence->base, &vgem_fence_ops, &fence->lock,dma_fence_context_alloc (1 ),1 ); -timer_setup (&fence->timer, vgem_fence_timeout,0 ); +timer_setup (&fence->timer, vgem_fence_timeout,TIMER_IRQSAFE );/* We force the fence to expire within 10s to prevent driver hangs */ mod_timer (&fence->timer, jiffies +VGEM_FENCE_TIMEOUT );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/451 USB: Fix descriptor count when handling invalid MBIM extended descriptor
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 5570ad1423ee60f6e972dadb63fb2e5f90a54cbe ]
In cdc_parse_cdc_header(), the check for the USB_CDC_MBIM_EXTENDED_TYPE descriptor was using 'break' upon detecting an invalid length.
This was incorrect because 'break' only exits the switch statement, causing the code to fall through to cnt++, thus incorrectly incrementing the count of parsed descriptors for a descriptor that was actually invalid and being discarded.
This patch changes 'break' to 'goto next_desc;' to ensure that the logic skips the counter increment and correctly proceeds to the next descriptor in the buffer. This maintains an accurate count of only the successfully parsed descriptors.
--- drivers/usb/core/message.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/message.c +1 -1
@@ -2381,7 +2381,7 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,break ;case USB_CDC_MBIM_EXTENDED_TYPE :if (elength <sizeof (struct usb_cdc_mbim_extended_desc )) -break ; + goto next_desc; hdr->usb_cdc_mbim_extended_desc = (struct usb_cdc_mbim_extended_desc *)buffer;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/451 irqchip/qcom-irq-combiner: Fix section mismatch
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 9b685058ca936752285c5520d351b828312ac965 ]
Platform drivers can be probed after their init sections have been discarded so the probe callback must not live in init.
--- drivers/irqchip/qcom-irq-combiner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/qcom-irq-combiner.c +1 -1
@@ -226,7 +226,7 @@ static int get_registers(struct platform_device *pdev, struct combiner *comb)return 0 ; } -static int __init combiner_probe (struct platform_device *pdev) +static int combiner_probe (struct platform_device *pdev) {struct combiner *combiner;int nregs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/451 rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit 9c4609225ec1cb551006d6a03c7c4ad8cb5584c0 ]
Add two functions to atomically replace RCU-protected hlist_nulls entries.
Keep using WRITE_ONCE() to assign values to ->next and ->pprev, as mentioned in the patch below:
commit efd04f8a8b45 ("rcu: Use WRITE_ONCE() for assignments to ->next for rculist_nulls")
commit 860c8802ace1 ("rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls")
Stable-dep-of: 1532ed0d0753 ("inet: Avoid ehash lookup race in inet_ehash_insert()")
--- include/linux/rculist_nulls.h | 59 +++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+)
include/linux/rculist_nulls.h +59 -0
@@ -52,6 +52,13 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)#define hlist_nulls_next_rcu (node) \ (*((struct hlist_nulls_node __rcu __force **)&(node)->next)) +/** +* hlist_nulls_pprev_rcu - returns the dereferenced pprev of @node. +* @node: element of the list. +*/ +#define hlist_nulls_pprev_rcu (node) \ + (*((struct hlist_nulls_node __rcu __force **)(node)->pprev)) +/** * hlist_nulls_del_rcu - deletes entry from hash list without re-initialization * @n: the element to delete from the hash list.
@@ -152,6 +159,58 @@ static inline void hlist_nulls_add_fake(struct hlist_nulls_node *n) n->next = (struct hlist_nulls_node *)NULLS_MARKER (NULL ); } +/** +* hlist_nulls_replace_rcu - replace an old entry by a new one +* @old: the element to be replaced +* @new: the new element to insert +* +* Description: +* Replace the old entry with the new one in a RCU-protected hlist_nulls, while +* permitting racing traversals. +* +* The caller must take whatever precautions are necessary (such as holding +* appropriate locks) to avoid racing with another list-mutation primitive, such +* as hlist_nulls_add_head_rcu() or hlist_nulls_del_rcu(), running on this same +* list. However, it is perfectly legal to run concurrently with the _rcu +* list-traversal primitives, such as hlist_nulls_for_each_entry_rcu(). +*/ +static inline void hlist_nulls_replace_rcu (struct hlist_nulls_node *old, +struct hlist_nulls_node *new) +{ +struct hlist_nulls_node *next = old->next; + +WRITE_ONCE (new->next, next); +WRITE_ONCE (new->pprev, old->pprev); +rcu_assign_pointer (hlist_nulls_pprev_rcu (new), new); +if (!is_a_nulls (next)) +WRITE_ONCE (next->pprev, &new->next); +} + +/** +* hlist_nulls_replace_init_rcu - replace an old entry by a new one and +* initialize the old +* @old: the element to be replaced +* @new: the new element to insert +* +* Description: +* Replace the old entry with the new one in a RCU-protected hlist_nulls, while +* permitting racing traversals, and reinitialize the old entry. +* +* Note: @old must be hashed. +* +* The caller must take whatever precautions are necessary (such as holding +* appropriate locks) to avoid racing with another list-mutation primitive, such +* as hlist_nulls_add_head_rcu() or hlist_nulls_del_rcu(), running on this same +* list. However, it is perfectly legal to run concurrently with the _rcu +* list-traversal primitives, such as hlist_nulls_for_each_entry_rcu(). +*/ +static inline void hlist_nulls_replace_init_rcu (struct hlist_nulls_node *old, +struct hlist_nulls_node *new) +{ +hlist_nulls_replace_rcu (old, new); +WRITE_ONCE (old->pprev,NULL ); +} +/** * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type * @tpos: the type * to use as a loop cursor.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/451 inet: Avoid ehash lookup race in inet_ehash_insert()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit 1532ed0d0753c83e72595f785f82b48c28bbe5dc ]
Since ehash lookups are lockless, if one CPU performs a lookup while another concurrently deletes and inserts (removing reqsk and inserting sk), the lookup may fail to find the socket, an RST may be sent.
The call trace map is drawn as follows:
CPU 0 CPU 1
----- -----
inet_ehash_insert()
spin_lock()
sk_nulls_del_node_init_rcu(osk)
__inet_lookup_established()
(lookup failed)
__sk_nulls_add_node_rcu(sk, list)
spin_unlock()As both deletion and insertion operate on the same ehash chain, this patch introduces a new sk_nulls_replace_node_init_rcu() helper functions to implement atomic replacement.
--- include/net/sock.h | 13 +++++++++++++ net/ipv4/inet_hashtables.c | 8 ++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)
include/net/sock.h +13 -0
@@ -769,6 +769,19 @@ static inline bool sk_nulls_del_node_init_rcu(struct sock *sk)return rc; } +static inline bool sk_nulls_replace_node_init_rcu (struct sock *old, +struct sock *new) +{ +if (sk_hashed (old)) { +hlist_nulls_replace_init_rcu (&old->sk_nulls_node, + &new->sk_nulls_node); +__sock_put (old); +return true; + } + +return false; +} +static inline void __sk_add_node (struct sock *sk,struct hlist_head *list) {hlist_add_head (&sk->sk_node, list);
net/ipv4/inet_hashtables.c +6 -2
@@ -578,8 +578,11 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)spin_lock (lock);if (osk) {WARN_ON_ONCE (sk->sk_hash != osk->sk_hash); - ret =sk_nulls_del_node_init_rcu (osk); - }else if (found_dup_sk) { + ret =sk_nulls_replace_node_init_rcu (osk, sk); + goto unlock; + } + +if (found_dup_sk) { *found_dup_sk =inet_ehash_lookup_by_sk (sk, list);if (*found_dup_sk) ret = false;
@@ -588,6 +591,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)if (ret)__sk_nulls_add_node_rcu (sk, list); +unlock:spin_unlock (lock);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/451 iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit cd83c5c10036a2a156d725725daf3409832c8a24 ]
Introduce st_lsm6dsx_device_set_enable utility routine and remove duplicated code used to enable/disable sensors
Stable-dep-of: c6d702f2b771 ("iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member")
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 11 +++++++++++ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 14 +++----------- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 14 ++------------ 3 files changed, 16 insertions(+), 23 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +11 -0
@@ -499,6 +499,17 @@ st_lsm6dsx_get_mount_matrix(const struct iio_dev *iio_dev,return &hw->orientation; } +static inline int +st_lsm6dsx_device_set_enable (struct st_lsm6dsx_sensor *sensor,bool enable) +{ +if (sensor->id ==ST_LSM6DSX_ID_EXT0 || + sensor->id ==ST_LSM6DSX_ID_EXT1 || + sensor->id ==ST_LSM6DSX_ID_EXT2 ) +return st_lsm6dsx_shub_set_enable (sensor, enable); + +return st_lsm6dsx_sensor_set_enable (sensor, enable); +} +static const struct iio_chan_spec_ext_info __maybe_unused st_lsm6dsx_accel_ext_info[] = {IIO_MOUNT_MATRIX (IIO_SHARED_BY_ALL , st_lsm6dsx_get_mount_matrix),
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +3 -11
@@ -678,17 +678,9 @@ int st_lsm6dsx_update_fifo(struct st_lsm6dsx_sensor *sensor, bool enable) goto out; } -if (sensor->id ==ST_LSM6DSX_ID_EXT0 || - sensor->id ==ST_LSM6DSX_ID_EXT1 || - sensor->id ==ST_LSM6DSX_ID_EXT2 ) { - err =st_lsm6dsx_shub_set_enable (sensor, enable); -if (err <0 ) - goto out; - }else { - err =st_lsm6dsx_sensor_set_enable (sensor, enable); -if (err <0 ) - goto out; - } + err =st_lsm6dsx_device_set_enable (sensor, enable); +if (err <0 ) + goto out; err =st_lsm6dsx_set_fifo_odr (sensor, enable);if (err <0 )
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +2 -12
@@ -2450,12 +2450,7 @@ static int __maybe_unused st_lsm6dsx_suspend(struct device *dev)continue ; } -if (sensor->id ==ST_LSM6DSX_ID_EXT0 || - sensor->id ==ST_LSM6DSX_ID_EXT1 || - sensor->id ==ST_LSM6DSX_ID_EXT2 ) - err =st_lsm6dsx_shub_set_enable (sensor, false); -else - err =st_lsm6dsx_sensor_set_enable (sensor, false); + err =st_lsm6dsx_device_set_enable (sensor, false);if (err <0 )return err;
@@ -2486,12 +2481,7 @@ static int __maybe_unused st_lsm6dsx_resume(struct device *dev)if (!(hw->suspend_mask &BIT (sensor->id)))continue ; -if (sensor->id ==ST_LSM6DSX_ID_EXT0 || - sensor->id ==ST_LSM6DSX_ID_EXT1 || - sensor->id ==ST_LSM6DSX_ID_EXT2 ) - err =st_lsm6dsx_shub_set_enable (sensor, true); -else - err =st_lsm6dsx_sensor_set_enable (sensor, true); + err =st_lsm6dsx_device_set_enable (sensor, true);if (err <0 )return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/451 iio: imu: st_lsm6dsx: discard samples during filters settling time
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit db3c490503bee4d0611f9fc17fcd8cfe6fcdbcad ]
During digital filters settling time the driver is expected to drop samples since they can be corrupted. Introduce the capability to drop a given number of samples according to the configured ODR. Add sample_to_discard for LSM6DSM-like sensors since new generation devices (e.g. LSM6DSO) support DRDY mask where corrupted samples are masked in hw with values greather than 0x7ffd so the driver can easily discard them.
I have not added sample_to_discard support for LSM6DS3 or LSM6DS3H since I do not have any sample for testing at the moment.
Stable-dep-of: c6d702f2b771 ("iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member")
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 11 ++++ .../iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 57 ++++++++++++++++--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 18 ++++++ 3 files changed, 78 insertions(+), 8 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +11 -0
@@ -119,6 +119,13 @@ struct st_lsm6dsx_odr_table_entry {int odr_len; }; +struct st_lsm6dsx_samples_to_discard { +struct { +u32 milli_hz; +u16 samples; + } val[ST_LSM6DSX_ODR_LIST_SIZE ]; +}; +struct st_lsm6dsx_fs {u32 gain;u8 val;
@@ -282,6 +289,7 @@ struct st_lsm6dsx_ext_dev_settings {* @irq_config: interrupts related registers. * @drdy_mask: register info for data-ready mask (addr + mask). * @odr_table: Hw sensors odr table (Hz + val). +* @samples_to_discard: Number of samples to discard for filters settling time. * @fs_table: Hw sensors gain table (gain + val). * @decimator: List of decimator register info (addr + mask). * @batch: List of FIFO batching register info (addr + mask).
@@ -315,6 +323,7 @@ struct st_lsm6dsx_settings { } irq_config;struct st_lsm6dsx_reg drdy_mask;struct st_lsm6dsx_odr_table_entry odr_table[2 ]; +struct st_lsm6dsx_samples_to_discard samples_to_discard[2 ];struct st_lsm6dsx_fs_table_entry fs_table[2 ];struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX ];struct st_lsm6dsx_reg batch[2 ];
@@ -336,6 +345,7 @@ enum st_lsm6dsx_fifo_mode {* @hw: Pointer to instance of struct st_lsm6dsx_hw. * @gain: Configured sensor sensitivity. * @odr: Output data rate of the sensor [Hz]. +* @samples_to_discard: Number of samples to discard for filters settling time. * @watermark: Sensor watermark level. * @decimator: Sensor decimation factor. * @sip: Number of samples in a given pattern.
@@ -350,6 +360,7 @@ struct st_lsm6dsx_sensor {u32 gain;u32 odr; +u16 samples_to_discard;u16 watermark;u8 decimator;u8 sip;
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +49 -8
78 lines not on this page · raw message
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +18 -0
@@ -618,6 +618,24 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { .fs_len = 4, }, }, + .samples_to_discard = { + [ST_LSM6DSX_ID_ACC] = { + .val[0] = { 12500, 1 }, + .val[1] = { 26000, 1 }, + .val[2] = { 52000, 1 }, + .val[3] = { 104000, 2 }, + .val[4] = { 208000, 2 }, + .val[5] = { 416000, 2 }, + }, + [ST_LSM6DSX_ID_GYRO] = { + .val[0] = { 12500, 2 }, + .val[1] = { 26000, 5 }, + .val[2] = { 52000, 7 }, + .val[3] = { 104000, 12 }, + .val[4] = { 208000, 20 }, + .val[5] = { 416000, 36 }, + }, + }, .irq_config = { .irq1 = { .addr = 0x0d,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/451 iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
[ Upstream commit c6d702f2b77194b62fb2098c63bb7f2a87da142d ]
The odr field in struct st_lsm6dsx_sensor contains a data rate value expressed in mHz, not in Hz.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +1 -1
@@ -344,7 +344,7 @@ enum st_lsm6dsx_fifo_mode {* @id: Sensor identifier. * @hw: Pointer to instance of struct st_lsm6dsx_hw. * @gain: Configured sensor sensitivity. -* @odr: Output data rate of the sensor [Hz]. +* @odr: Output data rate of the sensor [mHz]. * @samples_to_discard: Number of samples to discard for filters settling time. * @watermark: Sensor watermark level. * @decimator: Sensor decimation factor.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/451 crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit df0845cf447ae1556c3440b8b155de0926cbaa56 ]
Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc.
--- crypto/asymmetric_keys/asymmetric_type.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
crypto/asymmetric_keys/asymmetric_type.c +10 -4
@@ -11,6 +11,7 @@#include <crypto/public_key.h> #include <linux/seq_file.h> #include <linux/module.h> +#include <linux/overflow.h> #include <linux/slab.h> #include <linux/ctype.h> #include <keys/system_keyring.h>
@@ -138,12 +139,17 @@ struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1, size_t len_2) {struct asymmetric_key_id *kid; - - kid =kmalloc (sizeof (struct asymmetric_key_id ) + len_1 + len_2, -GFP_KERNEL ); +size_t kid_sz; +size_t len; + +if (check_add_overflow (len_1, len_2, &len)) +return ERR_PTR (-EOVERFLOW ); +if (check_add_overflow (sizeof (struct asymmetric_key_id ), len, &kid_sz)) +return ERR_PTR (-EOVERFLOW ); + kid =kmalloc (kid_sz,GFP_KERNEL );if (!kid)return ERR_PTR (-ENOMEM ); - kid->len = len_1 + len_2; + kid->len = len;memcpy (kid->data, val_1, len_1);memcpy (kid->data + len_1, val_2, len_2);return kid;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/451 s390/smp: Fix fallback CPU detection
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 07a75d08cfa1b883a6e1256666e5f0617ee99231 ]
In case SCLP CPU detection does not work a fallback mechanism using SIGP is in place. Since a cleanup this does not work correctly anymore: new CPUs are only considered if their type matches the boot CPU.
Before the cleanup the information if a CPU type should be considered was also part of a structure generated by the fallback mechanism and indicated that a CPU type should not be considered when adding CPUs.
Since the rework a global SCLP state is used instead. If the global SCLP state indicates that the CPU type should be considered and the fallback mechanism is used, there may be a mismatch with CPU types if CPUs are added. This can lead to a system with only a single CPU even tough there are many more CPUs.
Address this by simply copying the boot cpu type into the generated data structure from the fallback mechanism.
--- arch/s390/kernel/smp.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/smp.c +1 -0
@@ -732,6 +732,7 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early)continue ; info->core[info->configured].core_id = address >> smp_cpu_mt_shift; + info->core[info->configured].type = boot_core_type; info->configured++; } info->combined = info->configured;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/451 s390/ap: Dont leak debug feature files if AP instructions are not available
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 020d5dc57874e58d3ebae398f3fe258f029e3d06 ]
If no AP instructions are available the AP bus module leaks registered debug feature files. Change function call order to fix this.
--- drivers/s390/crypto/ap_bus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/s390/crypto/ap_bus.c +4 -4
@@ -1648,15 +1648,15 @@ static int __init ap_module_init(void) {int rc, i; - rc =ap_debug_init (); -if (rc) -return rc; -if (!ap_instructions_available ()) {pr_warn ("The hardware system does not support AP instructions\n" );return -ENODEV ; } + rc =ap_debug_init (); +if (rc) +return rc; +/* init ap_queue hashtable */ hash_init (ap_queues);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/451 firmware: imx: scu-irq: fix OF node leak in
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit ee67247843a2b62d1473cfa4df300e69b5190ccf ]
imx_scu_enable_general_irq_channel() calls of_parse_phandle_with_args(), but does not release the OF node reference. Add a of_node_put() call to release the reference.
--- drivers/firmware/imx/imx-scu-irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/imx/imx-scu-irq.c +3 -1
@@ -160,8 +160,10 @@ int imx_scu_enable_general_irq_channel(struct device *dev)INIT_WORK (&imx_sc_irq_work, imx_scu_irq_work_handler);if (!of_parse_phandle_with_args (dev->of_node,"mboxes" , -"#mbox-cells" ,0 , &spec)) +"#mbox-cells" ,0 , &spec)) { i =of_alias_get_id (spec.np,"mu" ); +of_node_put (spec.np); + }/* use mu1 as general mu irq channel if failed */ if (i <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/451 x86/dumpstack: Make show_trace_log_lvl() static
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <[email protected]>
[ Upstream commit 09a217c10504bcaef911cf2af74e424338efe629 ]
show_trace_log_lvl() is not used by other compilation units so make it static and remove the declaration from the header file.
Stable-dep-of: ced37e9ceae5 ("x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()")
--- arch/x86/include/asm/stacktrace.h | 3 --- arch/x86/kernel/dumpstack.c | 2 +- 2 files changed, 1 insertion(+), 4 deletions(-)
arch/x86/include/asm/stacktrace.h +0 -3
@@ -88,9 +88,6 @@ get_stack_pointer(struct task_struct *task, struct pt_regs *regs)return (unsigned long *)task->thread.sp; } -void show_trace_log_lvl (struct task_struct *task,struct pt_regs *regs, -unsigned long *stack,const char *log_lvl); -/* The form of the top of the frame on the stack */ struct stack_frame {struct stack_frame *next_frame;
arch/x86/kernel/dumpstack.c +1 -1
@@ -183,7 +183,7 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs, } } -void show_trace_log_lvl (struct task_struct *task,struct pt_regs *regs, +static void show_trace_log_lvl (struct task_struct *task,struct pt_regs *regs,unsigned long *stack,const char *log_lvl) {struct unwind_state state;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/451 compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 9a48e7564ac83fb0f1d5b0eac5fe8a7af62da398 ]
When Clang is using the hwaddress sanitizer, it sets __SANITIZE_ADDRESS__ explicitly:
#if __has_feature(address_sanitizer) || __has_feature(hwaddress_sanitizer) /* Emulate GCC's __SANITIZE_ADDRESS__ flag */
#define __SANITIZE_ADDRESS__
#endif
Once hwaddress sanitizer was added to GCC, however, a separate define was created, __SANITIZE_HWADDRESS__. The kernel is expecting to find __SANITIZE_ADDRESS__ in either case, though, and the existing string macros break on supported architectures:
#if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \
!defined(__SANITIZE_ADDRESS__)where as other architectures (like arm32) have no idea about hwaddress sanitizer and just check for __SANITIZE_ADDRESS__:
#if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)
This would lead to compiler foritfy self-test warnings when building with CONFIG_KASAN_SW_TAGS=y:
warning: unsafe memmove() usage lacked '__read_overflow2' symbol in lib/test_fortify/read_overflow2-memmove.c
warning: unsafe memcpy() usage lacked '__write_overflow' symbol in lib/test_fortify/write_overflow-memcpy.c
...
Sort this out by also defining __SANITIZE_ADDRESS__ in GCC under the hwaddress sanitizer.
Stable-dep-of: ced37e9ceae5 ("x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()")
--- include/linux/compiler-gcc.h | 8 ++++++++ 1 file changed, 8 insertions(+)
include/linux/compiler-gcc.h +8 -0
@@ -140,6 +140,14 @@#define __no_sanitize_coverage#endif +/* +* Treat __SANITIZE_HWADDRESS__ the same as __SANITIZE_ADDRESS__ in the kernel, +* matching the defines used by Clang. +*/ +#ifdef __SANITIZE_HWADDRESS__ +#define __SANITIZE_ADDRESS__ +#endif +/* * Turn individual warnings and errors on and off locally, depending * on version.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/451 kmsan: introduce __no_sanitize_memory and __no_kmsan_checks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <[email protected]>
[ Upstream commit 9b448bc25b776daab3215393c3ce6953dd3bb8ad ]
__no_sanitize_memory is a function attribute that instructs KMSAN to skip a function during instrumentation. This is needed to e.g. implement the noinstr functions.
__no_kmsan_checks is a function attribute that makes KMSAN ignore the uninitialized values coming from the function's inputs, and initialize the function's outputs.
Functions marked with this attribute can't be inlined into functions not marked with it, and vice versa. This behavior is overridden by __always_inline.
__SANITIZE_MEMORY__ is a macro that's defined iff the file is instrumented with KMSAN. This is not the same as CONFIG_KMSAN, which is defined for every file.
Stable-dep-of: ced37e9ceae5 ("x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()")
--- include/linux/compiler-clang.h | 23 +++++++++++++++++++++++ include/linux/compiler-gcc.h | 6 ++++++ 2 files changed, 29 insertions(+)
include/linux/compiler-clang.h +23 -0
@@ -89,6 +89,29 @@#define __no_sanitize_undefined#endif +#if __has_feature (memory_sanitizer) +#define __SANITIZE_MEMORY__ +/* +* Unlike other sanitizers, KMSAN still inserts code into functions marked with +* no_sanitize("kernel-memory"). Using disable_sanitizer_instrumentation +* provides the behavior consistent with other __no_sanitize_ attributes, +* guaranteeing that __no_sanitize_memory functions remain uninstrumented. +*/ +#define __no_sanitize_memory __disable_sanitizer_instrumentation + +/* +* The __no_kmsan_checks attribute ensures that a function does not produce +* false positive reports by: +* - initializing all local variables and memory stores in this function; +* - skipping all shadow checks; +* - passing initialized arguments to this function's callees. +*/ +#define __no_kmsan_checks __attribute__((no_sanitize("kernel-memory"))) +#else +#define __no_sanitize_memory +#define __no_kmsan_checks +#endif +/* * Support for __has_feature(coverage_sanitizer) was added in Clang 13 together * with no_sanitize("coverage"). Prior versions of Clang support coverage
include/linux/compiler-gcc.h +6 -0
@@ -148,6 +148,12 @@#define __SANITIZE_ADDRESS__#endif +/* +* GCC does not support KMSAN. +*/ +#define __no_sanitize_memory +#define __no_kmsan_checks +/* * Turn individual warnings and errors on and off locally, depending * on version.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/451 x86: kmsan: dont instrument stack walking functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <[email protected]>
[ Upstream commit 37ad4ee8364255c73026a3c343403b5977fa7e79 ]
Upon function exit, KMSAN marks local variables as uninitialized. Further function calls may result in the compiler creating the stack frame where these local variables resided. This results in frame pointers being marked as uninitialized data, which is normally correct, because they are not stack-allocated.
However stack unwinding functions are supposed to read and dereference the frame pointers, in which case KMSAN might be reporting uses of uninitialized values.
To work around that, we mark update_stack_state(), unwind_next_frame() and show_trace_log_lvl() with __no_kmsan_checks, preventing all KMSAN reports inside those functions and making them return initialized values.
Stable-dep-of: ced37e9ceae5 ("x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()")
--- arch/x86/kernel/dumpstack.c | 6 ++++++ arch/x86/kernel/unwind_frame.c | 11 +++++++++++ 2 files changed, 17 insertions(+)
arch/x86/kernel/dumpstack.c +6 -0
@@ -183,6 +183,12 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs, } } +/* +* This function reads pointers from the stack and dereferences them. The +* pointers may not have their KMSAN shadow set up properly, which may result +* in false positive reports. Disable instrumentation to avoid those. +*/ +__no_kmsan_checks static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,unsigned long *stack,const char *log_lvl) {
arch/x86/kernel/unwind_frame.c +11 -0
@@ -183,6 +183,16 @@ static struct pt_regs *decode_frame_pointer(unsigned long *bp) }#endif +/* +* While walking the stack, KMSAN may stomp on stale locals from other +* functions that were marked as uninitialized upon function exit, and +* now hold the call frame information for the current function (e.g. the frame +* pointer). Because KMSAN does not specifically mark call frames as +* initialized, false positive reports are possible. To prevent such reports, +* we mark the functions scanning the stack (here and below) with +* __no_kmsan_checks. +*/ +__no_kmsan_checks static bool update_stack_state(struct unwind_state *state,unsigned long *next_bp) {
@@ -251,6 +261,7 @@ static bool update_stack_state(struct unwind_state *state,return true; } +__no_kmsan_checks bool unwind_next_frame(struct unwind_state *state) {struct pt_regs *regs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/451 x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit ced37e9ceae50e4cb6cd058963bd315ec9afa651 ]
When triggering a stack dump via sysrq (echo t > /proc/sysrq-trigger), KASAN may report false-positive out-of-bounds access:
BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
Call Trace:
dump_stack_lvl
print_address_description.constprop.0
print_report
__show_regs
show_trace_log_lvl
sched_show_task
show_state_filter
sysrq_handle_showstate
__handle_sysrq
write_sysrq_trigger
proc_reg_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframeThe issue occurs as follows:
Task A (walk other tasks' stacks) Task B (running)
1. echo t > /proc/sysrq-trigger
show_trace_log_lvl
regs = unwind_get_entry_regs()
show_regs_if_on_stack(regs)
2. The stack value pointed by regs keeps changing, and so are the tags in its KASAN shadow region.
__show_regs(regs)
regs->ax, regs->bx, ...
3. hit KASAN redzones, OOB
When task A walks task B's stack without suspending it, the continuous changes in task B's stack (and corresponding KASAN shadow tags) may cause task A to hit KASAN redzones when accessing obsolete values on the stack, resulting in false positive reports.
Simply stopping the task before unwinding is not a viable fix, as it would alter the state intended to inspect. This is especially true for diagnosing misbehaving tasks (e.g., in a hard lockup), where stopping might fail or hide the root cause by changing the call stack.
Therefore, fix this by disabling KASAN checks during asynchronous stack unwinding, which is identified when the unwinding task does not match the current task (task != current).
[ bp: Align arguments on function's opening brace. ]
--- arch/x86/kernel/dumpstack.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
arch/x86/kernel/dumpstack.c +21 -2
@@ -189,8 +189,8 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,* in false positive reports. Disable instrumentation to avoid those. */ __no_kmsan_checks -static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, -unsigned long *stack,const char *log_lvl) +static void __show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, +unsigned long *stack,const char *log_lvl) {struct unwind_state state;struct stack_info stack_info = {0 };
@@ -311,6 +311,25 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, } } +static void show_trace_log_lvl (struct task_struct *task,struct pt_regs *regs, +unsigned long *stack,const char *log_lvl) +{ +/* +* Disable KASAN to avoid false positives during walking another +* task's stacks, as values on these stacks may change concurrently +* with task execution. +*/ +bool disable_kasan = task && task != current; + +if (disable_kasan) +kasan_disable_current (); + +__show_trace_log_lvl (task, regs, stack, log_lvl); + +if (disable_kasan) +kasan_enable_current (); +} +void show_stack (struct task_struct *task,unsigned long *sp,const char *loglvl) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/451 pinctrl: stm32: fix hwspinlock resource leak in probe function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 002679f79ed605e543fbace465557317cd307c9a ]
In stm32_pctl_probe(), hwspin_lock_request_specific() is called to request a hwspinlock, but the acquired lock is not freed on multiple error paths after this call. This causes resource leakage when the function fails to initialize properly.
Use devm_hwspin_lock_request_specific() instead of hwspin_lock_request_specific() to automatically manage the hwspinlock resource lifecycle.
--- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/stm32/pinctrl-stm32.c +1 -1
@@ -1494,7 +1494,7 @@ int stm32_pctl_probe(struct platform_device *pdev)if (hwlock_id == -EPROBE_DEFER )return hwlock_id; }else { - pctl->hwlock =hwspin_lock_request_specific (hwlock_id); + pctl->hwlock =devm_hwspin_lock_request_specific (dev, hwlock_id); }spin_lock_init (&pctl->irqmux_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/451 i3c: remove i2c board info from i2c_dev_desc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit 31b9887c7258ca47d9c665a80f19f006c86756b1 ]
I2C board info is only required during adapter setup so there is no requirement to keeping a pointer to it once running. To support dynamic device addition we can't rely on board info - user-space creation through sysfs won't have a boardinfo.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 18 ++++++++++-------- include/linux/i3c/master.h | 1 - 2 files changed, 10 insertions(+), 9 deletions(-)
drivers/i3c/master.c +10 -8
@@ -656,7 +656,7 @@ static void i3c_master_free_i2c_dev(struct i2c_dev_desc *dev)static struct i2c_dev_desc *i3c_master_alloc_i2c_dev (struct i3c_master_controller *master, -const struct i2c_dev_boardinfo *boardinfo) +u16 addr,u8 lvr) {struct i2c_dev_desc *dev;
@@ -665,9 +665,8 @@ i3c_master_alloc_i2c_dev(struct i3c_master_controller *master,return ERR_PTR (-ENOMEM ); dev->common.master = master; - dev->boardinfo = boardinfo; - dev->addr = boardinfo->base.addr; - dev->lvr = boardinfo->lvr; + dev->addr = addr; + dev->lvr = lvr;return dev; }
@@ -741,7 +740,7 @@ i3c_master_find_i2c_dev_by_addr(const struct i3c_master_controller *master,struct i2c_dev_desc *dev;i3c_bus_for_each_i2cdev (&master->bus, dev) { -if (dev->boardinfo->base.addr == addr) +if (dev->addr == addr)return dev; }
@@ -1731,7 +1730,9 @@ static int i3c_master_bus_init(struct i3c_master_controller *master) i2cboardinfo->base.addr, I3C_ADDR_SLOT_I2C_DEV); - i2cdev =i3c_master_alloc_i2c_dev (master, i2cboardinfo); + i2cdev =i3c_master_alloc_i2c_dev (master, + i2cboardinfo->base.addr, + i2cboardinfo->lvr);if (IS_ERR (i2cdev)) { ret =PTR_ERR (i2cdev); goto err_detach_devs;
@@ -2220,6 +2221,7 @@ static int i3c_master_i2c_adapter_init(struct i3c_master_controller *master) {struct i2c_adapter *adap =i3c_master_to_i2c_adapter (master);struct i2c_dev_desc *i2cdev; +struct i2c_dev_boardinfo *i2cboardinfo;int ret; adap->dev.parent = master->dev.parent;
@@ -2239,8 +2241,8 @@ static int i3c_master_i2c_adapter_init(struct i3c_master_controller *master)* We silently ignore failures here. The bus should keep working * correctly even if one or more i2c devices are not registered. */ -i3c_bus_for_each_i2cdev (&master->bus, i2cdev) - i2cdev->dev =i2c_new_client_device (adap, &i2cdev->boardinfo->base); +list_for_each_entry (i2cboardinfo, &master->boardinfo.i2c, node) + i2cdev->dev =i2c_new_client_device (adap, &i2cboardinfo->base);return 0 ; }
include/linux/i3c/master.h +0 -1
@@ -85,7 +85,6 @@ struct i2c_dev_boardinfo {*/ struct i2c_dev_desc {struct i3c_i2c_dev_desc common; -const struct i2c_dev_boardinfo *boardinfo;struct i2c_client *dev;u16 addr;u8 lvr;
Signature · 1 line
2.51.0
Re: [PATCH 5.10 048/451] i3c: remove i2c board info from i2c_dev_desc
Quoted 13 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit
31b9887c7258ca47d9c665a80f19f006c86756b1]I2C board info is only required during adapter setup so there is no requirement to keeping a pointer to it once running. To support dynamic device addition we can't rely on board info - user-space creation through sysfs won't have a boardinfo.
Quoted 5 lines
Cc Alexandre Belloni <[email protected]>Signed-off-by Jamie Iles <[email protected]>Signed-off-by Alexandre Belloni <[email protected]>Stable-dep-of:
9d4f219807d5("i3c: fix refcount inconsistency ini3c_master_register")
[...]
Commit 9d4f219807d5 is a legitimate fix, but it does *not* depend on any of these other i3c changes.
Ben.
Signature · 4 lines
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill GatesGreg Kroah-Hartman
maintainerRe: [PATCH 5.10 048/451] i3c: remove i2c board info from i2c_dev_desc
Quoted 19 lines · Ben Hutchings
Quoted 13 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit
31b9887c7258ca47d9c665a80f19f006c86756b1]I2C board info is only required during adapter setup so there is no requirement to keeping a pointer to it once running. To support dynamic device addition we can't rely on board info - user-space creation through sysfs won't have a boardinfo.
Quoted 5 lines
Cc Alexandre Belloni <[email protected]>Signed-off-by Jamie Iles <[email protected]>Signed-off-by Alexandre Belloni <[email protected]>Stable-dep-of:
9d4f219807d5("i3c: fix refcount inconsistency ini3c_master_register")
Quoted 4 lines
[...]
Commit
9d4f219807d5is a legitimate fix, but it does *not* depend on any of these other i3c changes.
From a "does this patch apply cleanly" point of view, yes, it did need those other changes. But from a "does this patch do the same thing" point of view, you are correct, it didn't. I'll go drop the others and fix the real one up by hand here.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 49/451 i3c: support dynamically added i2c devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit 72a4501b5d089772671360a6ec74d5350acf8c2e ]
I2C devices can be added to the system dynamically through several sources other than static board info including device tree overlays and sysfs i2c new_device.
Add an I2C bus notifier to attach the clients at runtime if they were not defined in the board info. For DT devices find the LVR in the reg property, for user-space new_device additions we synthesize a conservative setting of no spike filters and fast mode only.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 128 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 127 insertions(+), 1 deletion(-)
drivers/i3c/master.c +127 -1
@@ -2212,11 +2212,122 @@ static u32 i3c_master_i2c_funcs(struct i2c_adapter *adapter)return I2C_FUNC_SMBUS_EMUL |I2C_FUNC_I2C ; } +static u8 i3c_master_i2c_get_lvr (struct i2c_client *client) +{ +/* Fall back to no spike filters and FM bus mode. */ +u8 lvr =I3C_LVR_I2C_INDEX (2 ) |I3C_LVR_I2C_FM_MODE ; + +if (client->dev.of_node) { +u32 reg[3 ]; + +if (!of_property_read_u32_array (client->dev.of_node,"reg" , + reg,ARRAY_SIZE (reg))) + lvr = reg[2 ]; + } + +return lvr; +} + +static int i3c_master_i2c_attach (struct i2c_adapter *adap,struct i2c_client *client) +{ +struct i3c_master_controller *master =i2c_adapter_to_i3c_master (adap); +enum i3c_addr_slot_status status; +struct i2c_dev_desc *i2cdev; +int ret; + +/* Already added by board info? */ +if (i3c_master_find_i2c_dev_by_addr (master, client->addr)) +return 0 ; + + status =i3c_bus_get_addr_slot_status (&master->bus, client->addr); +if (status !=I3C_ADDR_SLOT_FREE ) +return -EBUSY ; + +i3c_bus_set_addr_slot_status (&master->bus, client->addr, +I3C_ADDR_SLOT_I2C_DEV ); + + i2cdev =i3c_master_alloc_i2c_dev (master, client->addr, +i3c_master_i2c_get_lvr (client)); +if (IS_ERR (i2cdev)) { + ret =PTR_ERR (i2cdev); + goto out_clear_status; + } + + ret =i3c_master_attach_i2c_dev (master, i2cdev); +if (ret) + goto out_free_dev; + +return 0 ; + +out_free_dev: +i3c_master_free_i2c_dev (i2cdev); +out_clear_status: +i3c_bus_set_addr_slot_status (&master->bus, client->addr, +I3C_ADDR_SLOT_FREE ); + +return ret; +} + +static int i3c_master_i2c_detach (struct i2c_adapter *adap,struct i2c_client *client) +{ +struct i3c_master_controller *master =i2c_adapter_to_i3c_master (adap); +struct i2c_dev_desc *dev; + + dev =i3c_master_find_i2c_dev_by_addr (master, client->addr); +if (!dev) +return -ENODEV ; + +i3c_master_detach_i2c_dev (dev); +i3c_bus_set_addr_slot_status (&master->bus, dev->addr, +I3C_ADDR_SLOT_FREE ); +i3c_master_free_i2c_dev (dev); + +return 0 ; +} +static const struct i2c_algorithm i3c_master_i2c_algo = { .master_xfer = i3c_master_i2c_adapter_xfer, .functionality = i3c_master_i2c_funcs, }; +static int i3c_i2c_notifier_call (struct notifier_block *nb,unsigned long action, +void *data) +{ +struct i2c_adapter *adap; +struct i2c_client *client; +struct device *dev = data; +struct i3c_master_controller *master; +int ret; + +if (dev->type != &i2c_client_type) +return 0 ; + + client =to_i2c_client (dev); + adap = client->adapter; + +if (adap->algo != &i3c_master_i2c_algo) +return 0 ; + + master =i2c_adapter_to_i3c_master (adap); + +i3c_bus_maintenance_lock (&master->bus); +switch (action) { +case BUS_NOTIFY_ADD_DEVICE : + ret =i3c_master_i2c_attach (adap, client); +break ; +case BUS_NOTIFY_DEL_DEVICE : + ret =i3c_master_i2c_detach (adap, client); +break ; + } +i3c_bus_maintenance_unlock (&master->bus); + +return ret; +} + +static struct notifier_block i2cdev_notifier = { + .notifier_call = i3c_i2c_notifier_call, +}; +static int i3c_master_i2c_adapter_init (struct i3c_master_controller *master) {struct i2c_adapter *adap =i3c_master_to_i2c_adapter (master);
@@ -2747,12 +2858,27 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)static int __init i3c_init (void ) { -return bus_register (&i3c_bus_type); +int res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier); + +if (res) +return res; + + res =bus_register (&i3c_bus_type); +if (res) + goto out_unreg_notifier; + +return 0 ; + +out_unreg_notifier: +bus_unregister_notifier (&i2c_bus_type, &i2cdev_notifier); + +return res; }subsys_initcall (i3c_init); static void __exit i3c_exit(void) { +bus_unregister_notifier (&i2c_bus_type, &i2cdev_notifier);idr_destroy (&i3c_bus_idr);bus_unregister (&i3c_bus_type); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/451 i3c: Allow OF-alias-based persistent bus numbering
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Kerr <[email protected]>
[ Upstream commit 7dc2e0a875645a79f5c1c063019397e8e94008f5 ]
Parse the /aliases node to assign any fixed bus numbers, as is done with the i2c subsystem. Numbering for non-aliased busses will start after the highest fixed bus number.
This allows an alias node such as:
aliases {
i3c0 = &bus_a,
i3c4 = &bus_b,
};to set the numbering for a set of i3c controllers:
/* fixed-numbered bus, assigned "i3c-0" */
bus_a: i3c-master {
};
/* another fixed-numbered bus, assigned "i3c-4" */
bus_b: i3c-master {
};
/* dynamic-numbered bus, likely assigned "i3c-5" */
bus_c: i3c-master {
};If no i3c device aliases are present, the numbering will stay as-is, starting from 0.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-)
drivers/i3c/master.c +25 -5
@@ -21,6 +21,7 @@static DEFINE_IDR (i3c_bus_idr);static DEFINE_MUTEX (i3c_core_lock); +static int __i3c_first_dynamic_bus_num;/** * i3c_bus_maintenance_lock - Lock the bus for a maintenance operation
@@ -466,9 +467,9 @@ static void i3c_bus_cleanup(struct i3c_bus *i3cbus)mutex_unlock (&i3c_core_lock); } -static int i3c_bus_init (struct i3c_bus *i3cbus) +static int i3c_bus_init (struct i3c_bus *i3cbus,struct device_node *np) { -int ret; +int ret, start, end, id =-1 ;init_rwsem (&i3cbus->lock);INIT_LIST_HEAD (&i3cbus->devs.i2c);
@@ -476,8 +477,19 @@ static int i3c_bus_init(struct i3c_bus *i3cbus)i3c_bus_init_addrslots (i3cbus); i3cbus->mode =I3C_BUS_MODE_PURE ; +if (np) + id =of_alias_get_id (np,"i3c" ); +mutex_lock (&i3c_core_lock); - ret =idr_alloc (&i3c_bus_idr, i3cbus,0 ,0 ,GFP_KERNEL ); +if (id >=0 ) { + start = id; + end = start +1 ; + }else { + start = __i3c_first_dynamic_bus_num; + end =0 ; + } + + ret =idr_alloc (&i3c_bus_idr, i3cbus, start, end,GFP_KERNEL );mutex_unlock (&i3c_core_lock);if (ret <0 )
@@ -2649,7 +2661,7 @@ int i3c_master_register(struct i3c_master_controller *master,INIT_LIST_HEAD (&master->boardinfo.i2c);INIT_LIST_HEAD (&master->boardinfo.i3c); - ret =i3c_bus_init (i3cbus); + ret =i3c_bus_init (i3cbus, master->dev.of_node);if (ret)return ret;
@@ -2858,8 +2870,16 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)static int __init i3c_init (void ) { -int res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier); +int res; + + res =of_alias_get_highest_id ("i3c" ); +if (res >=0 ) { +mutex_lock (&i3c_core_lock); + __i3c_first_dynamic_bus_num = res +1 ; +mutex_unlock (&i3c_core_lock); + } + res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier);if (res)return res;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/451 i3c: master: Inherit DMA masks and parameters from parent device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit 0c35691551387e060e6ae7a6652b4101270c73cf ]
Copy the DMA masks and parameters for an I3C master device from parent device so that the master device has them set for the DMA buffer and mapping API.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i3c/master.c +4 -0
@@ -2668,6 +2668,10 @@ int i3c_master_register(struct i3c_master_controller *master,device_initialize (&master->dev);dev_set_name (&master->dev,"i3c-%d" , i3cbus->id); + master->dev.dma_mask = parent->dma_mask; + master->dev.coherent_dma_mask = parent->coherent_dma_mask; + master->dev.dma_parms = parent->dma_parms; + ret =of_populate_i3c_bus (master);if (ret) goto err_put_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/451 i3c: fix refcount inconsistency in i3c_master_register
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 9d4f219807d5ac11fb1d596e4ddb09336b040067 ]
In i3c_master_register, a possible refcount inconsistency has been identified, causing possible resource leak.
Function of_node_get increases the refcount of parent->of_node. If function i3c_bus_init fails, the function returns immediately without a corresponding decrease, resulting in an inconsistent refcounter.
Move call i3c_bus_init() after device_initialize() to let callback i3c_masterdev_release() release of_node.
--- drivers/i3c/master.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i3c/master.c +4 -4
@@ -2661,10 +2661,6 @@ int i3c_master_register(struct i3c_master_controller *master,INIT_LIST_HEAD (&master->boardinfo.i2c);INIT_LIST_HEAD (&master->boardinfo.i3c); - ret =i3c_bus_init (i3cbus, master->dev.of_node); -if (ret) -return ret; -device_initialize (&master->dev);dev_set_name (&master->dev,"i3c-%d" , i3cbus->id);
@@ -2672,6 +2668,10 @@ int i3c_master_register(struct i3c_master_controller *master, master->dev.coherent_dma_mask = parent->coherent_dma_mask; master->dev.dma_parms = parent->dma_parms; + ret =i3c_bus_init (i3cbus, master->dev.of_node); +if (ret) + goto err_put_dev; + ret =of_populate_i3c_bus (master);if (ret) goto err_put_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/451 power: supply: wm831x: Check wm831x_set_bits() return value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <[email protected]>
[ Upstream commit ea14bae6df18942bccb467fcf5ff33ca677b8253 ]
Since wm831x_set_bits() may return error, log failure and exit from wm831x_usb_limit_change() in such case.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/power/supply/wm831x_power.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/power/supply/wm831x_power.c +8 -2
@@ -144,6 +144,7 @@ static int wm831x_usb_limit_change(struct notifier_block *nb, struct wm831x_power, usb_notify);unsigned int i, best; +int ret;/* Find the highest supported limit */ best =0 ;
@@ -156,8 +157,13 @@ static int wm831x_usb_limit_change(struct notifier_block *nb,dev_dbg (wm831x_power->wm831x->dev,"Limiting USB current to %umA" , wm831x_usb_limits[best]); -wm831x_set_bits (wm831x_power->wm831x,WM831X_POWER_STATE , -WM831X_USB_ILIM_MASK , best); + ret =wm831x_set_bits (wm831x_power->wm831x,WM831X_POWER_STATE , +WM831X_USB_ILIM_MASK , best); +if (ret <0 ) { +dev_err (wm831x_power->wm831x->dev, +"Failed to set USB current limit: %d\n" , ret); +return ret; + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/451 power: supply: apm_power: only unset own apm_get_power_status
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahelenia Ziemiańska <[email protected]>
[ Upstream commit bd44ea12919ac4e83c9f3997240fe58266aa8799 ]
Mirroring drivers/macintosh/apm_emu.c, this means that
modprobe apm_power && modprobe $anotherdriver && modprobe -r apm_power
leaves $anotherdriver's apm_get_power_status instead of deleting it.
--- drivers/power/supply/apm_power.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/apm_power.c +2 -1
@@ -365,7 +365,8 @@ static int __init apm_battery_init(void) static void __exit apm_battery_exit(void) { - apm_get_power_status =NULL ; +if (apm_get_power_status == apm_battery_apm_get_power_status) + apm_get_power_status =NULL ; }module_init (apm_battery_init);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/451 scsi: target: Do not write NUL characters into ASCII configfs output
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit c03b55f235e283cae49c88b9602fd11096b92eba ]
NUL characters are not allowed in ASCII configfs output. Hence this patch.
--- drivers/target/target_core_configfs.c | 1 - 1 file changed, 1 deletion(-)
drivers/target/target_core_configfs.c +0 -1
@@ -2635,7 +2635,6 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page) cur_len =snprintf (buf,LU_GROUP_NAME_BUF ,"%s/%s\n" ,config_item_name (&hba->hba_group.cg_item),config_item_name (&dev->dev_group.cg_item)); - cur_len++;/* Extra byte for NULL terminator */ if ((cur_len + len) >PAGE_SIZE || cur_len >LU_GROUP_NAME_BUF ) { pr_warn("Ran out of lu_gp_show_attr"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/451 mfd: da9055: Fix missing regmap_del_irq_chip() in error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 1b58acfd067ca16116b9234cd6b2d30cc8ab7502 ]
When da9055_device_init() fails after regmap_add_irq_chip() succeeds but mfd_add_devices() fails, the error handling path only calls mfd_remove_devices() but forgets to call regmap_del_irq_chip(). This results in a resource leak.
Fix this by adding regmap_del_irq_chip() to the error path so that resources are released properly.
--- drivers/mfd/da9055-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/da9055-core.c +1 -0
@@ -410,6 +410,7 @@ int da9055_device_init(struct da9055 *da9055) err:mfd_remove_devices (da9055->dev); +regmap_del_irq_chip (da9055->chip_irq, da9055->irq_data);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/451 ext4: minor defrag code improvements
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Whitney <[email protected]>
[ Upstream commit d412df530f77d0f61c41b83f925997452fc3944c ]
Modify the error returns for two file types that can't be defragged to more clearly communicate those restrictions to a caller. When the defrag code is applied to swap files, return -ETXTBSY, and when applied to quota files, return -EOPNOTSUPP. Move an extent tree search whose results are only occasionally required to the site always requiring them for improved efficiency. Address a few typos.
Stable-dep-of: a2e5a3cea4b1 ("ext4: correct the checking of quota files before moving extents")
--- fs/ext4/move_extent.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
fs/ext4/move_extent.c +7 -9
@@ -466,19 +466,17 @@ mext_check_arguments(struct inode *orig_inode,if (IS_IMMUTABLE (donor_inode) ||IS_APPEND (donor_inode))return -EPERM ; -/* Ext4 move extent does not support swapfile */ +/* Ext4 move extent does not support swap files */ if (IS_SWAPFILE (orig_inode) ||IS_SWAPFILE (donor_inode)) { -ext4_debug ("ext4 move extent: The argument files should " -"not be swapfile [ino:orig %lu, donor %lu]\n" , +ext4_debug ("ext4 move extent: The argument files should not be swap files [ino:orig %lu, donor %lu]\n" , orig_inode->i_ino, donor_inode->i_ino); -return -EBUSY ; +return -ETXTBSY ; }if (ext4_is_quota_file (orig_inode) &&ext4_is_quota_file (donor_inode)) { -ext4_debug ("ext4 move extent: The argument files should " -"not be quota files [ino:orig %lu, donor %lu]\n" , +ext4_debug ("ext4 move extent: The argument files should not be quota files [ino:orig %lu, donor %lu]\n" , orig_inode->i_ino, donor_inode->i_ino); -return -EBUSY ; +return -EOPNOTSUPP ; }/* Ext4 move extent supports only extent based file */
@@ -626,11 +624,11 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,if (ret) goto out; ex = path[path->p_depth].p_ext; - next_blk =ext4_ext_next_allocated_block (path); cur_blk =le32_to_cpu (ex->ee_block); cur_len =ext4_ext_get_actual_len (ex);/* Check hole before the start pos */ if (cur_blk + cur_len -1 < o_start) { + next_blk =ext4_ext_next_allocated_block (path);if (next_blk ==EXT_MAX_BLOCKS ) { o_start = o_end; ret = -ENODATA ;
@@ -659,7 +657,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, donor_page_index = d_start >> (PAGE_SHIFT - donor_inode->i_blkbits); offset_in_page = o_start % blocks_per_page; -if (cur_len > blocks_per_page- offset_in_page) +if (cur_len > blocks_per_page - offset_in_page) cur_len = blocks_per_page - offset_in_page;/* * Up semaphore to avoid following problems:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/451 ext4: correct the checking of quota files before moving extents
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit a2e5a3cea4b18f6e2575acc444a5e8cce1fc8260 ]
The move extent operation should return -EOPNOTSUPP if any of the inodes is a quota inode, rather than requiring both to be quota inodes.
Message-ID: <[email protected]>
--- fs/ext4/move_extent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/move_extent.c +1 -1
@@ -473,7 +473,7 @@ mext_check_arguments(struct inode *orig_inode,return -ETXTBSY ; } -if (ext4_is_quota_file (orig_inode) &&ext4_is_quota_file (donor_inode)) { +if (ext4_is_quota_file (orig_inode) ||ext4_is_quota_file (donor_inode)) {ext4_debug ("ext4 move extent: The argument files should not be quota files [ino:orig %lu, donor %lu]\n" , orig_inode->i_ino, donor_inode->i_ino);return -EOPNOTSUPP ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/451 perf/x86/intel: Correct large PEBS flag check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
[ Upstream commit 5e4e355ae7cdeb0fef5dbe908866e1f895abfacc ]
current large PEBS flag check only checks if sample_regs_user contains unsupported GPRs but doesn't check if sample_regs_intr contains unsupported GPRs.
Of course, currently PEBS HW supports to sample all perf supported GPRs, the missed check doesn't cause real issue. But it won't be true any more after the subsequent patches support to sample SSP register. SSP sampling is not supported by adaptive PEBS HW and it would be supported until arch-PEBS HW. So correct this issue.
--- arch/x86/events/intel/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/events/intel/core.c +3 -1
@@ -3515,7 +3515,9 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)if (!event->attr.exclude_kernel) flags &= ~PERF_SAMPLE_REGS_USER ;if (event->attr.sample_regs_user & ~PEBS_GP_REGS ) - flags &= ~(PERF_SAMPLE_REGS_USER |PERF_SAMPLE_REGS_INTR ); + flags &= ~PERF_SAMPLE_REGS_USER ; +if (event->attr.sample_regs_intr & ~PEBS_GP_REGS ) + flags &= ~PERF_SAMPLE_REGS_INTR ;return flags; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/451 regulator: core: disable supply if enabling main regulator fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit fb1ebb10468da414d57153ddebaab29c38ef1a78 ]
For 'always-on' and 'boot-on' regulators, the set_machine_constraints() may enable supply before enabling the main regulator, however if the latter fails, the function returns with an error but the supply remains enabled.
When this happens, the regulator_register() function continues on the error path where it puts the supply regulator. Since enabling the supply is not balanced with a disable call, a warning similar to the following gets issued from _regulator_put():
[ 1.603889] WARNING: CPU: 2 PID: 44 at _regulator_put+0x8c/0xa0
[ 1.603908] Modules linked in:
[ 1.603926] CPU: 2 UID: 0 PID: 44 Comm: kworker/u16:3 Not tainted 6.18.0-rc4 #0 NONE
[ 1.603938] Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT)
[ 1.603945] Workqueue: async async_run_entry_fn
[ 1.603958] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1.603967] pc : _regulator_put+0x8c/0xa0
[ 1.603976] lr : _regulator_put+0x7c/0xa0
...
[ 1.604140] Call trace:
[ 1.604145] _regulator_put+0x8c/0xa0 (P)
[ 1.604156] regulator_register+0x2ec/0xbf0
[ 1.604166] devm_regulator_register+0x60/0xb0
[ 1.604178] rpm_reg_probe+0x120/0x208
[ 1.604187] platform_probe+0x64/0xa8
...In order to avoid this, change the set_machine_constraints() function to disable the supply if enabling the main regulator fails.
--- drivers/regulator/core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/regulator/core.c +5 -0
@@ -1495,6 +1495,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)* and we have control then make sure it is enabled. */ if (rdev->constraints->always_on || rdev->constraints->boot_on) { +bool supply_enabled = false; +/* If we want to enable this regulator, make sure that we know * the supplying regulator. */
@@ -1514,11 +1516,14 @@ static int set_machine_constraints(struct regulator_dev *rdev) rdev->supply =NULL ;return ret; } + supply_enabled = true; } ret =_regulator_do_enable (rdev);if (ret <0 && ret != -EINVAL ) {rdev_err (rdev,"failed to enable: %pe\n" ,ERR_PTR (ret)); +if (supply_enabled) +regulator_disable (rdev->supply);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/451 nbd: clean up return value checking of sock_xmit()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit f52c0e08237e7864a44311fc78bc9bf2e045611b ]
Check if sock_xmit() return 0 is useless because it'll never return 0, comment it and remove such checkings.
Stable-dep-of: 9517b82d8d42 ("nbd: defer config put in recv_work")
--- drivers/block/nbd.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/block/nbd.c +7 -6
@@ -468,7 +468,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req, }/* -* Send or receive packet. +* Send or receive packet. Return a positive value on success and +* negtive value on failue, and never return 0. */ static int sock_xmit (struct nbd_device *nbd,int index,int send,struct iov_iter *iter,int msg_flags,int *sent)
@@ -594,7 +595,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) result =sock_xmit (nbd, index,1 , &from, (type ==NBD_CMD_WRITE ) ?MSG_MORE :0 , &sent);trace_nbd_header_sent (req, handle); -if (result <=0 ) { +if (result <0 ) {if (was_interrupted (result)) {/* If we havne't sent anything we can just return BUSY, * however if we have sent something we need to make
@@ -638,7 +639,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) skip =0 ; } result =sock_xmit (nbd, index,1 , &from, flags, &sent); -if (result <=0 ) { +if (result <0 ) {if (was_interrupted (result)) {/* We've already sent the header, we * have no choice but to set pending and
@@ -690,7 +691,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index) reply.magic =0 ;iov_iter_kvec (&to,READ , &iov,1 ,sizeof (reply)); result =sock_xmit (nbd, index,0 , &to,MSG_WAITALL ,NULL ); -if (result <=0 ) { +if (result <0 ) {if (!nbd_disconnected (config))dev_err (disk_to_dev (nbd->disk),"Receive control failed (result %d)\n" , result);
@@ -751,7 +752,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)rq_for_each_segment (bvec, req, iter) {iov_iter_bvec (&to,READ , &bvec,1 , bvec.bv_len); result =sock_xmit (nbd, index,0 , &to,MSG_WAITALL ,NULL ); -if (result <=0 ) { +if (result <0 ) {dev_err (disk_to_dev (nbd->disk),"Receive data failed (result %d)\n" , result);/*
@@ -1194,7 +1195,7 @@ static void send_disconnects(struct nbd_device *nbd)iov_iter_kvec (&from,WRITE , &iov,1 ,sizeof (request));mutex_lock (&nsock->tx_lock); ret =sock_xmit (nbd, i,1 , &from,0 ,NULL ); -if (ret <=0 ) +if (ret <0 )dev_err (disk_to_dev (nbd->disk),"Send disconnect failed %d\n" , ret);mutex_unlock (&nsock->tx_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/451 nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 3fe1db626a56cdf259c348404f2c5429e2f065a1 ]
Prepare to fix uaf in nbd_read_stat(), no functional changes.
Stable-dep-of: 9517b82d8d42 ("nbd: defer config put in recv_work")
--- drivers/block/nbd.c | 74 +++++++++++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 30 deletions(-)
drivers/block/nbd.c +44 -30
@@ -673,38 +673,45 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)return 0 ; } -/* NULL returned = something went wrong, inform userspace */ -static struct nbd_cmd *nbd_read_stat (struct nbd_device *nbd,int index) +static int nbd_read_reply (struct nbd_device *nbd,int index, +struct nbd_reply *reply) { -struct nbd_config *config = nbd->config; -int result; -struct nbd_reply reply; -struct nbd_cmd *cmd; -struct request *req =NULL ; -u64 handle; -u16 hwq; -u32 tag; -struct kvec iov = {.iov_base = &reply, .iov_len =sizeof (reply)}; +struct kvec iov = {.iov_base = reply, .iov_len =sizeof (*reply)};struct iov_iter to; -int ret =0 ; +int result; - reply.magic =0 ; -iov_iter_kvec (&to,READ , &iov,1 ,sizeof (reply)); + reply->magic =0 ; +iov_iter_kvec (&to,READ , &iov,1 ,sizeof (*reply)); result =sock_xmit (nbd, index,0 , &to,MSG_WAITALL ,NULL );if (result <0 ) { -if (!nbd_disconnected (config)) +if (!nbd_disconnected (nbd->config))dev_err (disk_to_dev (nbd->disk),"Receive control failed (result %d)\n" , result); -return ERR_PTR (result); +return result; } -if (ntohl (reply.magic) !=NBD_REPLY_MAGIC ) { +if (ntohl (reply->magic) !=NBD_REPLY_MAGIC ) {dev_err (disk_to_dev (nbd->disk),"Wrong magic (0x%lx)\n" , - (unsigned long )ntohl (reply.magic)); -return ERR_PTR (-EPROTO ); + (unsigned long )ntohl (reply->magic)); +return -EPROTO ; } -memcpy (&handle, reply.handle,sizeof (handle)); +return 0 ; +} + +/* NULL returned = something went wrong, inform userspace */ +static struct nbd_cmd *nbd_handle_reply (struct nbd_device *nbd,int index, +struct nbd_reply *reply) +{ +int result; +struct nbd_cmd *cmd; +struct request *req =NULL ; +u64 handle; +u16 hwq; +u32 tag; +int ret =0 ; + +memcpy (&handle, reply->handle,sizeof (handle)); tag =nbd_handle_to_tag (handle); hwq =blk_mq_unique_tag_to_hwq (tag);if (hwq < nbd->tag_set.nr_hw_queues)
@@ -737,9 +744,9 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index) ret = -ENOENT ; goto out; } -if (ntohl (reply.error)) { +if (ntohl (reply->error)) {dev_err (disk_to_dev (nbd->disk),"Other side returned error (%d)\n" , -ntohl (reply.error)); +ntohl (reply->error)); cmd->status =BLK_STS_IOERR ; goto out; }
@@ -748,6 +755,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)if (rq_data_dir (req) !=WRITE ) {struct req_iterator iter;struct bio_vec bvec; +struct iov_iter to;rq_for_each_segment (bvec, req, iter) {iov_iter_bvec (&to,READ , &bvec,1 , bvec.bv_len);
@@ -761,7 +769,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)* and let the timeout stuff handle resubmitting * this request onto another connection. */ -if (nbd_disconnected (config)) { +if (nbd_disconnected (nbd->config)) { cmd->status =BLK_STS_IOERR ; goto out; }
@@ -785,24 +793,30 @@ static void recv_work(struct work_struct *work) work);struct nbd_device *nbd = args->nbd;struct nbd_config *config = nbd->config; +struct nbd_sock *nsock;struct nbd_cmd *cmd;struct request *rq;while (1 ) { - cmd =nbd_read_stat (nbd, args->index); -if (IS_ERR (cmd)) { -struct nbd_sock *nsock = config->socks[args->index]; +struct nbd_reply reply; -mutex_lock (&nsock->tx_lock); -nbd_mark_nsock_dead (nbd, nsock,1 ); -mutex_unlock (&nsock->tx_lock); +if (nbd_read_reply (nbd, args->index, &reply)) +break ; + + cmd =nbd_handle_reply (nbd, args->index, &reply); +if (IS_ERR (cmd))break ; - } rq =blk_mq_rq_from_pdu (cmd);if (likely (!blk_should_fake_timeout (rq->q)))blk_mq_complete_request (rq); } + + nsock = config->socks[args->index]; +mutex_lock (&nsock->tx_lock); +nbd_mark_nsock_dead (nbd, nsock,1 ); +mutex_unlock (&nsock->tx_lock); +nbd_config_put (nbd);atomic_dec (&config->recv_threads);wake_up (&config->recv_wq);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/451 nbd: defer config put in recv_work
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 9517b82d8d422d426a988b213fdd45c6b417b86d ]
There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE:
nbd_genl_connect // conf_ref=2 (connect and recv_work A)
nbd_open // conf_ref=3
recv_work A done // conf_ref=2
NBD_CLEAR_SOCK // conf_ref=1
nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)
close nbd // conf_ref=1
recv_work B
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Or only running NBD_CLEAR_SOCK:
nbd_genl_connect // conf_ref=2
nbd_open // conf_ref=3
NBD_CLEAR_SOCK // conf_ref=2
close nbd
nbd_release
config_put // conf_ref=1
recv_work
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared.
However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup.
Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear
+ reconfigure interleave.
In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock):
path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2
NBD_CLEAR_SOCK
close nbd
nbd_release
nbd_disconnect_and_put
flush_workqueue // recv_work done
nbd_config_put
nbd_put // nbd_refs=1
nbd_put // nbd_refs=0
queue_workpath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3
NBD_CLEAR_SOCK // conf_refs=2
close nbd
nbd_release
nbd_config_put // conf_refs=1
nbd_put // nbd_refs=2
recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0
Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
--- drivers/block/nbd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/nbd.c +1 -1
@@ -817,9 +817,9 @@ static void recv_work(struct work_struct *work)nbd_mark_nsock_dead (nbd, nsock,1 );mutex_unlock (&nsock->tx_lock); -nbd_config_put (nbd);atomic_dec (&config->recv_threads);wake_up (&config->recv_wq); +nbd_config_put (nbd);kfree (args); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/451 scsi: stex: Fix reboot_notifier leak in probe error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 20da637eb545b04753e20c675cfe97b04c7b600b ]
In stex_probe(), register_reboot_notifier() is called at the beginning, but if any subsequent initialization step fails, the function returns without unregistering the notifier, resulting in a resource leak.
Add unregister_reboot_notifier() in the out_disable error path to ensure proper cleanup on all failure paths.
--- drivers/scsi/stex.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/stex.c +1 -0
@@ -1849,6 +1849,7 @@ static int stex_probe(struct pci_dev *pdev, const struct pci_device_id *id) out_scsi_host_put:scsi_host_put (host); out_disable: +unregister_reboot_notifier (&stex_notifier);pci_disable_device (pdev);return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/451 RDMA/rtrs: server: Fix error handling in get_or_create_srv
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit a338d6e849ab31f32c08b4fcac11c0c72afbb150 ]
After device_initialize() is called, use put_device() to release the device according to kernel device management rules. While direct kfree() work in this case, using put_device() is more correct.
Found by code review.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +1 -1
@@ -1405,7 +1405,7 @@ static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,kfree (srv->chunks); err_free_srv: -kfree (srv); +put_device (&srv->dev);return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/451 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f ]
The following warning appears when running syzkaller, and this issue also exists in the mainline code.
------------[ cut here ]------------ list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100. WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130 Modules linked in: CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__list_add_valid_or_report+0xf7/0x130 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100 R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48 FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> input_register_handler+0xb3/0x210 mac_hid_start_emulation+0x1c5/0x290 mac_hid_toggle_emumouse+0x20a/0x240 proc_sys_call_handler+0x4c2/0x6e0 new_sync_write+0x1b1/0x2d0 vfs_write+0x709/0x950 ksys_write+0x12a/0x250 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2
The WARNING occurs when two processes concurrently write to the mac-hid emulation sysctl, causing a race condition in mac_hid_toggle_emumouse(). Both processes read old_val=0, then both try to register the input handler, leading to a double list_add of the same handler.
CPU0 CPU1
------------------------- -------------------------
vfs_write() //write 1 vfs_write() //write 1
proc_sys_write() proc_sys_write()
mac_hid_toggle_emumouse() mac_hid_toggle_emumouse()
old_val = *valp // old_val=0
old_val = *valp // old_val=0
mutex_lock_killable()
proc_dointvec() // *valp=1
mac_hid_start_emulation()
input_register_handler()
mutex_unlock()
mutex_lock_killable()
proc_dointvec()
mac_hid_start_emulation()
input_register_handler() //Trigger Warning
mutex_unlock()Fix this by moving the old_val read inside the mutex lock region.
--- drivers/macintosh/mac_hid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/macintosh/mac_hid.c +2 -1
@@ -186,13 +186,14 @@ static int mac_hid_toggle_emumouse(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { int *valp = table->data; -int old_val = *valp; +int old_val;int rc; rc =mutex_lock_killable (&mac_hid_emumouse_mutex);if (rc)return rc; + old_val = *valp; rc =proc_dointvec (table, write, buffer, lenp, ppos);if (rc ==0 && write && *valp != old_val) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/451 wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 5e88e864118c20e63a1571d0ff0a152e5d684959 ]
In one of the error paths, the memory allocated for skb_rx is not freed. Fix that by freeing it before returning.
--- drivers/net/wireless/st/cw1200/bh.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/st/cw1200/bh.c +4 -2
@@ -320,10 +320,12 @@ static int cw1200_bh_rx_helper(struct cw1200_common *priv,if (wsm_id &0x0400 ) {int rc =wsm_release_tx_buffer (priv,1 ); -if (WARN_ON (rc <0 )) +if (WARN_ON (rc <0 )) { +dev_kfree_skb (skb_rx);return rc; -else if (rc >0 ) + }else if (rc >0 ) { *tx =1 ; + } }/* cw1200_wsm_rx takes care on SKB livetime */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/451 nbd: defer config unlock in nbd_genl_connect
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 1649714b930f9ea6233ce0810ba885999da3b5d4 ]
There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK:
nbd_genl_connect
nbd_alloc_and_init_config // config_refs=1
nbd_start_device // config_refs=2
set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3
recv_work done // config_refs=2
NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0
refcount_inc -> uaf
------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790
The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect():
mutex_unlock(&nbd->config_lock);
if (!ret) {
set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);
+ printk("before sleep\n");
+ mdelay(5 * 1000);
+ printk("after sleep\n");
refcount_inc(&nbd->config_refs);
nbd_connect_reply(info, nbd->index);
}--- drivers/block/nbd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/nbd.c +2 -1
@@ -2052,12 +2052,13 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) } ret =nbd_start_device (nbd); out: -mutex_unlock (&nbd->config_lock);if (!ret) {set_bit (NBD_RT_HAS_CONFIG_REF , &config->runtime_flags);refcount_inc (&nbd->config_refs);nbd_connect_reply (info, nbd->index); } +mutex_unlock (&nbd->config_lock); +nbd_config_put (nbd);if (put_dev)nbd_put (nbd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/451 clk: renesas: r9a06g032: Export function to set dmamux
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 885525c1e7e27ea6207d648a8db20dfbbd9e4238 ]
The dmamux register is located within the system controller.
Without syscon, we need an extra helper in order to give write access to this register to a dmamux driver.
Stable-dep-of: f8def051bbcf ("clk: renesas: r9a06g032: Fix memory leak in error path")
--- drivers/clk/renesas/r9a06g032-clocks.c | 35 ++++++++++++++++++- include/linux/soc/renesas/r9a06g032-sysctrl.h | 11 ++++++ 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 include/linux/soc/renesas/r9a06g032-sysctrl.h
drivers/clk/renesas/r9a06g032-clocks.c +34 -1
@@ -20,9 +20,12 @@#include <linux/pm_clock.h> #include <linux/pm_domain.h> #include <linux/slab.h> +#include <linux/soc/renesas/r9a06g032-sysctrl.h> #include <linux/spinlock.h> #include <dt-bindings/clock/r9a06g032-sysctrl.h> +#define R9A06G032_SYSCTRL_DMAMUX 0xA0 +struct r9a06g032_gate {u16 gate, reset, ready, midle, scon, mirack, mistat;
@@ -315,6 +318,30 @@ struct r9a06g032_priv {void __iomem *reg; }; +static struct r9a06g032_priv *sysctrl_priv; + +/* Exported helper to access the DMAMUX register */ +int r9a06g032_sysctrl_set_dmamux (u32 mask,u32 val) +{ +unsigned long flags; +u32 dmamux; + +if (!sysctrl_priv) +return -EPROBE_DEFER ; + +spin_lock_irqsave (&sysctrl_priv->lock, flags); + + dmamux =readl (sysctrl_priv->reg +R9A06G032_SYSCTRL_DMAMUX ); + dmamux &= ~mask; + dmamux |= val & mask; +writel (dmamux, sysctrl_priv->reg +R9A06G032_SYSCTRL_DMAMUX ); + +spin_unlock_irqrestore (&sysctrl_priv->lock, flags); + +return 0 ; +} +EXPORT_SYMBOL_GPL (r9a06g032_sysctrl_set_dmamux); +/* register/bit pairs are encoded as an uint16_t */ static void clk_rdesc_set(struct r9a06g032_priv *clocks,
@@ -961,7 +988,13 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev)if (error)return error; -return r9a06g032_add_clk_domain (dev); + error =r9a06g032_add_clk_domain (dev); +if (error) +return error; + + sysctrl_priv = clocks; + +return 0 ; }static const struct of_device_id r9a06g032_match[] = {
include/linux/soc/renesas/r9a06g032-sysctrl.h new file +11 -0
@@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __LINUX_SOC_RENESAS_R9A06G032_SYSCTRL_H__ +#define __LINUX_SOC_RENESAS_R9A06G032_SYSCTRL_H__ + +#ifdef CONFIG_CLK_R9A06G032 +int r9a06g032_sysctrl_set_dmamux (u32 mask,u32 val); +#else +static inline int r9a06g032_sysctrl_set_dmamux (u32 mask,u32 val) {return -ENODEV ; } +#endif + +#endif /* __LINUX_SOC_RENESAS_R9A06G032_SYSCTRL_H__ */
Signature · 1 line
2.51.0
Re: [PATCH 5.10 069/451] clk: renesas: r9a06g032: Export function to set dmamux
Quoted 13 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit
885525c1e7e27ea6207d648a8db20dfbbd9e4238]The dmamux register is located within the system controller.
Without syscon, we need an extra helper in order to give write access to this register to a dmamux driver.
Quoted 7 lines
Signed-off-by Miquel Raynal <[email protected]>Acked-by Stephen Boyd <[email protected]>Reviewed-by Geert Uytterhoeven <[email protected]>Signed-off-by Vinod Koul <[email protected]>Stable-dep-of:
f8def051bbcf("clk: renesas: r9a06g032: Fix memory leak in error path")
[...]
Similarly, commit f8def051bbcf is a real fix but doesn't actually depend on these supposed dependencies.
Ben.
Signature · 4 lines
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill GatesGreg Kroah-Hartman
maintainerRe: [PATCH 5.10 069/451] clk: renesas: r9a06g032: Export function to set dmamux
Quoted 21 lines · Ben Hutchings
Quoted 13 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit
885525c1e7e27ea6207d648a8db20dfbbd9e4238]The dmamux register is located within the system controller.
Without syscon, we need an extra helper in order to give write access to this register to a dmamux driver.
Quoted 7 lines
Signed-off-by Miquel Raynal <[email protected]>Acked-by Stephen Boyd <[email protected]>Reviewed-by Geert Uytterhoeven <[email protected]>Signed-off-by Vinod Koul <[email protected]>Stable-dep-of:
f8def051bbcf("clk: renesas: r9a06g032: Fix memory leak in error path")
Quoted 4 lines
[...]
Similarly, commit
f8def051bbcfis a real fix but doesn't actually depend on these supposed dependencies.
To apply cleanly, yes it did. I've dropped the dependancies now and fixed this up by hand.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 70/451 soc: renesas: r9a06g032-sysctrl: Handle h2mode setting based on USBF presence
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit e9fee814b054e4f6f2faf3d9c1944869fe41c9dd ]
The CFG_USB[H2MODE] allows to switch the USB configuration. The configuration supported are:
- One host and one device
or
- Two hosts
Set CFG_USB[H2MODE] based on the USBF controller (USB device) availability.
Stable-dep-of: f8def051bbcf ("clk: renesas: r9a06g032: Fix memory leak in error path")
--- drivers/clk/renesas/r9a06g032-clocks.c | 28 ++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/clk/renesas/r9a06g032-clocks.c +28 -0
@@ -24,6 +24,8 @@#include <linux/spinlock.h> #include <dt-bindings/clock/r9a06g032-sysctrl.h> +#define R9A06G032_SYSCTRL_USB 0x00 +#define R9A06G032_SYSCTRL_USB_H2MODE (1<<1)#define R9A06G032_SYSCTRL_DMAMUX 0xA0struct r9a06g032_gate {
@@ -918,6 +920,29 @@ static void r9a06g032_clocks_del_clk_provider(void *data)of_clk_del_provider (data); } +static void __init r9a06g032_init_h2mode (struct r9a06g032_priv *clocks) +{ +struct device_node *usbf_np =NULL ; +u32 usb; + +while ((usbf_np =of_find_compatible_node (usbf_np,NULL , +"renesas,rzn1-usbf" ))) { +if (of_device_is_available (usbf_np)) +break ; + } + + usb =readl (clocks->reg +R9A06G032_SYSCTRL_USB ); +if (usbf_np) { +/* 1 host and 1 device mode */ + usb &= ~R9A06G032_SYSCTRL_USB_H2MODE ; +of_node_put (usbf_np); + }else { +/* 2 hosts mode */ + usb |=R9A06G032_SYSCTRL_USB_H2MODE ; + } +writel (usb, clocks->reg +R9A06G032_SYSCTRL_USB ); +} +static int __init r9a06g032_clocks_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -947,6 +972,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev) clocks->reg =of_iomap (np,0 );if (WARN_ON (!clocks->reg))return -ENOMEM ; + +r9a06g032_init_h2mode (clocks); +for (i =0 ; i <ARRAY_SIZE (r9a06g032_clocks); ++i) {const struct r9a06g032_clkdesc *d = &r9a06g032_clocks[i]; const char *parent_name = d->source ?
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/451 clk: renesas: r9a06g032: Fix memory leak in error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit f8def051bbcf8677f64701e9699bf6d11e2780cd ]
The current code uses of_iomap() to map registers but never calls iounmap() on any error path after the mapping. This causes a memory leak when probe fails after successful ioremap, for example when of_clk_add_provider() or r9a06g032_add_clk_domain() fails.
Replace of_iomap() with devm_of_iomap() to automatically unmap the region on probe failure. Update the error check accordingly to use IS_ERR() and PTR_ERR() since devm_of_iomap() returns ERR_PTR on error.
--- drivers/clk/renesas/r9a06g032-clocks.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/renesas/r9a06g032-clocks.c +3 -3
@@ -969,9 +969,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev)if (IS_ERR (mclk))return PTR_ERR (mclk); - clocks->reg =of_iomap (np,0 ); -if (WARN_ON (!clocks->reg)) -return -ENOMEM ; + clocks->reg =devm_of_iomap (dev, np,0 ,NULL ); +if (IS_ERR (clocks->reg)) +return PTR_ERR (clocks->reg);r9a06g032_init_h2mode (clocks);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/451 lib/vsprintf: Check pointer before dereferencing in time_and_date()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 372a12bd5df0199aa234eaf8ef31ed7ecd61d40f ]
The pointer may be invalid when gets to the printf(). In particular the time_and_date() dereferencing it in some cases without checking.
Move the check from rtc_str() to time_and_date() to cover all cases.
--- lib/vsprintf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/vsprintf.c +3 -3
@@ -1829,9 +1829,6 @@ char *rtc_str(char *buf, char *end, const struct rtc_time *tm,bool raw = false;int count =2 ; -if (check_pointer (&buf, end, tm, spec)) -return buf; -switch (fmt[count]) {case 'd' : have_t = false;
@@ -1886,6 +1883,9 @@ static noinline_for_stackchar *time_and_date (char *buf,char *end,void *ptr,struct printf_spec spec,const char *fmt) { +if (check_pointer (&buf, end, ptr, spec)) +return buf; +switch (fmt[1 ]) {case 'R' :return rtc_str (buf, end, (const struct rtc_time *)ptr, spec, fmt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/451 ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 8a7d58845fae061c62b50bc5eeb9bae4a1dedc3d ]
In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just to avoid crashing the whole kernel due to a filesystem corruption.
--- fs/ocfs2/move_extents.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/ocfs2/move_extents.c +7 -1
@@ -100,7 +100,13 @@ static int __ocfs2_move_extent(handle_t *handle, rec = &el->l_recs[index]; -BUG_ON (ext_flags != rec->e_flags); +if (ext_flags != rec->e_flags) { + ret =ocfs2_error (inode->i_sb, +"Inode %llu has corrupted extent %d with flags 0x%x at cpos %u\n" , + (unsigned long long )ino, index, rec->e_flags, cpos); + goto out; + } +/* * after moving/defraging to new location, the extent is not going * to be refcounted anymore.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/451 ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 593ee49222a0d751062fd9a5e4a963ade4ec028a ]
acpi_fwnode_graph_parse_endpoint() calls fwnode_get_parent() to obtain the parent fwnode but returns without calling fwnode_handle_put() on it. This potentially leads to a fwnode refcount leak and prevents the parent node from being released properly.
Call fwnode_handle_put() on the parent fwnode before returning to prevent the leak from occurring.
--- drivers/acpi/property.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/property.c +1 -0
@@ -1423,6 +1423,7 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,if (fwnode_property_read_u32 (fwnode,"reg" , &endpoint->id))fwnode_property_read_u32 (fwnode,"endpoint" , &endpoint->id); +fwnode_handle_put (port_fwnode);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/451 scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit acd194d9b5bac419e04968ffa44351afabb50bac ]
The driver calls ioport_map() to map I/O ports in sim710_probe_common() but never calls ioport_unmap() to release the mapping. This causes resource leaks in both the error path when request_irq() fails and in the normal device removal path via sim710_device_remove().
Add ioport_unmap() calls in the out_release error path and in sim710_device_remove().
--- drivers/scsi/sim710.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/sim710.c +2 -0
@@ -133,6 +133,7 @@ static int sim710_probe_common(struct device *dev, unsigned long base_addr, out_put_host:scsi_host_put (host); out_release: +ioport_unmap (hostdata->base);release_region (base_addr,64 ); out_free:kfree (hostdata);
@@ -148,6 +149,7 @@ static int sim710_device_remove(struct device *dev)scsi_remove_host (host);NCR_700_release (host); +ioport_unmap (hostdata->base);kfree (hostdata);free_irq (host->irq, host);release_region (host->base,64 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/451 leds: netxbig: Fix GPIO descriptor leak in error paths
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 03865dd8af52eb16c38062df2ed30a91b604780e ]
The function netxbig_gpio_ext_get() acquires GPIO descriptors but fails to release them when errors occur mid-way through initialization. The cleanup callback registered by devm_add_action_or_reset() only runs on success, leaving acquired GPIOs leaked on error paths.
Add goto-based error handling to release all acquired GPIOs before returning errors.
--- drivers/leds/leds-netxbig.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-)
drivers/leds/leds-netxbig.c +26 -10
@@ -364,6 +364,9 @@ static int netxbig_gpio_ext_get(struct device *dev,if (!addr)return -ENOMEM ; + gpio_ext->addr = addr; + gpio_ext->num_addr =0 ; +/* * We cannot use devm_ managed resources with these GPIO descriptors * since they are associated with the "GPIO extension device" which
@@ -375,45 +378,58 @@ static int netxbig_gpio_ext_get(struct device *dev, gpiod =gpiod_get_index (gpio_ext_dev,"addr" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_set_code;gpiod_set_consumer_name (gpiod,"GPIO extension addr" ); addr[i] = gpiod; + gpio_ext->num_addr++; } - gpio_ext->addr = addr; - gpio_ext->num_addr = num_addr; ret =gpiod_count (gpio_ext_dev,"data" );if (ret <0 ) {dev_err (dev,"Failed to count GPIOs in DT property data-gpios\n" ); -return ret; + goto err_free_addr; } num_data = ret; data =devm_kcalloc (dev, num_data,sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; +if (!data) { + ret = -ENOMEM ; + goto err_free_addr; + } + + gpio_ext->data = data; + gpio_ext->num_data =0 ;for (i =0 ; i < num_data; i++) { gpiod =gpiod_get_index (gpio_ext_dev,"data" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_free_data;gpiod_set_consumer_name (gpiod,"GPIO extension data" ); data[i] = gpiod; + gpio_ext->num_data++; } - gpio_ext->data = data; - gpio_ext->num_data = num_data; gpiod =gpiod_get (gpio_ext_dev,"enable" ,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) {dev_err (dev,"Failed to get GPIO from DT property enable-gpio\n" ); -return PTR_ERR (gpiod); + goto err_free_data; }gpiod_set_consumer_name (gpiod,"GPIO extension enable" ); gpio_ext->enable = gpiod;return devm_add_action_or_reset (dev, netxbig_gpio_ext_remove, gpio_ext); + +err_free_data: +for (i =0 ; i < gpio_ext->num_data; i++) +gpiod_put (gpio_ext->data[i]); +err_set_code: + ret =PTR_ERR (gpiod); +err_free_addr: +for (i =0 ; i < gpio_ext->num_addr; i++) +gpiod_put (gpio_ext->addr[i]); +return ret; } static int netxbig_leds_get_of_pdata(struct device *dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/451 PCI: keystone: Exit ks_pcie_probe() for invalid mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit 95d9c3f0e4546eaec0977f3b387549a8463cd49f ]
Commit under Fixes introduced support for PCIe EP mode on AM654x platforms. When the mode happens to be either "DW_PCIE_RC_TYPE" or "DW_PCIE_EP_TYPE", the PCIe Controller is configured accordingly. However, when the mode is neither of them, an error message is displayed, but the driver probe succeeds. Since this "invalid" mode is not associated with a functional PCIe Controller, the probe should fail.
Fix the behavior by exiting "ks_pcie_probe()" with the return value of "-EINVAL" in addition to displaying the existing error message when the mode is invalid.
--- drivers/pci/controller/dwc/pci-keystone.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/dwc/pci-keystone.c +2 -0
@@ -1382,6 +1382,8 @@ static int ks_pcie_probe(struct platform_device *pdev)break ;default :dev_err (dev,"INVALID device type %d\n" , mode); + ret = -EINVAL ; + goto err_get_sync; }ks_pcie_enable_error_irq (ks_pcie);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/451 selftests/bpf: Fix failure paths in send_signal test
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit c13339039891dbdfa6c1972f0483bd07f610b776 ]
When test_send_signal_kern__open_and_load() fails parent closes the pipe which cases ASSERT_EQ(read(pipe_p2c...)) to fail, but child continues and enters infinite loop, while parent is stuck in wait(NULL). Other error paths have similar issue, so kill the child before waiting on it.
The bug was discovered while compiling all of selftests with -O1 instead of -O2 which caused progs/test_send_signal_kern.c to fail to load.
--- tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/bpf/prog_tests/send_signal.c +5 -0
@@ -144,6 +144,11 @@ static void test_send_signal_common(struct perf_event_attr *attr, skel_open_load_failure:close (pipe_c2p[0 ]);close (pipe_p2c[1 ]); +/* +* Child is either about to exit cleanly or stuck in case of errors. +* Nudge it to exit. +*/ +kill (pid,SIGKILL );wait (NULL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/451 watchdog: wdat_wdt: Stop watchdog when uninstalling module
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Xinpeng <[email protected]>
[ Upstream commit 330415ebea81b65842e4cc6d2fd985c1b369e650 ]
Test shows that wachdog still reboots machine after the module is removed. Use watchdog_stop_on_unregister to stop the watchdog on removing.
Stable-dep-of: 25c0b472eab8 ("watchdog: wdat_wdt: Fix ACPI table leak in probe function")
--- drivers/watchdog/wdat_wdt.c | 1 + 1 file changed, 1 insertion(+)
drivers/watchdog/wdat_wdt.c +1 -0
@@ -463,6 +463,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)watchdog_set_nowayout (&wdat->wdd, nowayout);watchdog_stop_on_reboot (&wdat->wdd); +watchdog_stop_on_unregister (&wdat->wdd);return devm_watchdog_register_device (dev, &wdat->wdd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/451 watchdog: wdat_wdt: Fix ACPI table leak in probe function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 25c0b472eab8379683d4eef681185c104bed8ffd ]
wdat_wdt_probe() calls acpi_get_table() to obtain the WDAT ACPI table but never calls acpi_put_table() on any paths. This causes a permanent ACPI table memory leak.
Add a single cleanup path which calls acpi_put_table() to ensure the ACPI table is always released.
--- drivers/watchdog/wdat_wdt.c | 64 +++++++++++++++++++++++++------------ 1 file changed, 43 insertions(+), 21 deletions(-)
drivers/watchdog/wdat_wdt.c +43 -21
@@ -327,19 +327,27 @@ static int wdat_wdt_probe(struct platform_device *pdev)return -ENODEV ; wdat =devm_kzalloc (dev,sizeof (*wdat),GFP_KERNEL ); -if (!wdat) -return -ENOMEM ; +if (!wdat) { + ret = -ENOMEM ; + goto out_put_table; + } regs =devm_kcalloc (dev, pdev->num_resources,sizeof (*regs),GFP_KERNEL ); -if (!regs) -return -ENOMEM ; +if (!regs) { + ret = -ENOMEM ; + goto out_put_table; + }/* WDAT specification wants to have >= 1ms period */ -if (tbl->timer_period <1 ) -return -EINVAL ; -if (tbl->min_count > tbl->max_count) -return -EINVAL ; +if (tbl->timer_period <1 ) { + ret = -EINVAL ; + goto out_put_table; + } +if (tbl->min_count > tbl->max_count) { + ret = -EINVAL ; + goto out_put_table; + } wdat->period = tbl->timer_period; wdat->wdd.min_hw_heartbeat_ms = wdat->period * tbl->min_count;
@@ -356,15 +364,20 @@ static int wdat_wdt_probe(struct platform_device *pdev) res = &pdev->resource[i];if (resource_type (res) ==IORESOURCE_MEM ) { reg =devm_ioremap_resource (dev, res); -if (IS_ERR (reg)) -return PTR_ERR (reg); +if (IS_ERR (reg)) { + ret =PTR_ERR (reg); + goto out_put_table; + } }else if (resource_type (res) ==IORESOURCE_IO ) { reg =devm_ioport_map (dev, res->start,1 ); -if (!reg) -return -ENOMEM ; +if (!reg) { + ret = -ENOMEM ; + goto out_put_table; + } }else {dev_err (dev,"Unsupported resource\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } regs[i] = reg;
@@ -386,8 +399,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) } instr =devm_kzalloc (dev,sizeof (*instr),GFP_KERNEL ); -if (!instr) -return -ENOMEM ; +if (!instr) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (&instr->node); instr->entry = entries[i];
@@ -418,7 +433,8 @@ static int wdat_wdt_probe(struct platform_device *pdev)if (!instr->reg) {dev_err (dev,"I/O resource not found\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } instructions = wdat->instructions[action];
@@ -426,8 +442,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) instructions =devm_kzalloc (dev,sizeof (*instructions),GFP_KERNEL ); -if (!instructions) -return -ENOMEM ; +if (!instructions) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (instructions); wdat->instructions[action] = instructions;
@@ -441,7 +459,7 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_enable_reboot (wdat);if (ret) -return ret; + goto out_put_table;platform_set_drvdata (pdev, wdat);
@@ -459,12 +477,16 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_set_timeout (&wdat->wdd, timeout);if (ret) -return ret; + goto out_put_table;watchdog_set_nowayout (&wdat->wdd, nowayout);watchdog_stop_on_reboot (&wdat->wdd);watchdog_stop_on_unregister (&wdat->wdd); -return devm_watchdog_register_device (dev, &wdat->wdd); + ret =devm_watchdog_register_device (dev, &wdat->wdd); + +out_put_table: +acpi_put_table ((struct acpi_table_header *)tbl); +return ret; }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/451 NFSD/blocklayout: Fix minlength check in proc_layoutget
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <[email protected]>
[ Upstream commit 3524b021b0ec620a76c89aee78e9d4b4130fb711 ]
The extent returned by the file system may have a smaller offset than the segment offset requested by the client. In this case, the minimum segment length must be checked against the requested range. Otherwise, the client may not be able to continue the read/write operation.
--- fs/nfsd/blocklayout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfsd/blocklayout.c +3 -1
@@ -27,6 +27,7 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, {struct nfsd4_layout_seg *seg = &args->lg_seg;struct super_block *sb = inode->i_sb; +u64 length;u32 block_size =i_blocksize (inode);struct pnfs_block_extent *bex;struct iomap iomap;
@@ -57,7 +58,8 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, goto out_error; } -if (iomap.length < args->lg_minlength) { + length = iomap.offset + iomap.length - seg->offset; +if (length < args->lg_minlength) {dprintk ("pnfsd: extent smaller than minlength\n" ); goto out_layoutunavailable; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/451 wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 9b5b9c042b30befc5b37e4539ace95af70843473 ]
In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit.
Fix that by jumping to err_free_rings label on error, which calls rtl8180_free_rx_ring() to free the allocations. Remove the free of rx_ring in rtl8180_init_rx_ring() error path, and set the freed priv->rx_buf entry to null, to avoid double free.
--- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +2 -7
@@ -1023,9 +1023,6 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)dma_addr_t *mapping; entry = priv->rx_ring + priv->rx_ring_sz*i;if (!skb) { -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma);wiphy_err (dev->wiphy,"Cannot allocate RX skb\n" );return -ENOMEM ; }
@@ -1037,9 +1034,7 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)if (dma_mapping_error (&priv->pdev->dev, *mapping)) {kfree_skb (skb); -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma); + priv->rx_buf[i] =NULL ;wiphy_err (dev->wiphy,"Cannot map DMA for RX skb\n" );return -ENOMEM ; }
@@ -1130,7 +1125,7 @@ static int rtl8180_start(struct ieee80211_hw *dev) ret =rtl8180_init_rx_ring (dev);if (ret) -return ret; + goto err_free_rings;for (i =0 ; i < (dev->queues +1 ); i++)if ((ret =rtl8180_init_tx_ring (dev, i,16 )))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/451 powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
[ Upstream commit eae40a6da63faa9fb63ff61f8fa2b3b57da78a84 ]
HPTE format was changed since Power9 (ISA 3.0) onwards. While dumping kernel hash page tables, nothing gets printed on powernv P9+. This patch utilizes the helpers added in the patch tagged as fixes, to convert new format to old format and dump the hptes. This fix is only needed for native_find() (powernv), since pseries continues to work fine with the old format.
--- arch/powerpc/mm/ptdump/hashpagetable.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/mm/ptdump/hashpagetable.c +6 -0
@@ -216,6 +216,8 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64 vpn =hpt_vpn (ea, vsid, ssize); hash =hpt_hash (vpn, shift, ssize); want_v =hpte_encode_avpn (vpn, psize, ssize); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) + want_v =hpte_old_to_new_v (want_v);/* to check in the secondary hash table, we invert the hash */ if (!primary)
@@ -229,6 +231,10 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64/* HPTE matches */ *v =be64_to_cpu (hptep->v); *r =be64_to_cpu (hptep->r); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) { + *v =hpte_new_to_old_v (*v, *r); + *r =hpte_new_to_old_r (*r); + }return 0 ; } ++hpte_group;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/451 pwm: bcm2835: Support apply function for atomic configuration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lino Sanfilippo <[email protected]>
[ Upstream commit 2f81b51d0d02074502ad27424c228ca760823668 ]
Use the newer .apply function of pwm_ops instead of .config, .enable, .disable and .set_polarity. This guarantees atomic changes of the pwm controller configuration. It also reduces the size of the driver.
Since now period is a 64 bit value, add an extra check to reject periods that exceed the possible max value for the 32 bit register.
This has been tested on a Raspberry PI 4.
Stable-dep-of: cda323dbda76 ("pwm: bcm2835: Make sure the channel is enabled after pwm_request()")
--- drivers/pwm/pwm-bcm2835.c | 69 ++++++++++++++------------------------- 1 file changed, 24 insertions(+), 45 deletions(-)
drivers/pwm/pwm-bcm2835.c +24 -45
@@ -58,13 +58,15 @@ static void bcm2835_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)writel (value, pc->base +PWM_CONTROL ); } -static int bcm2835_pwm_config (struct pwm_chip *chip,struct pwm_device *pwm, -int duty_ns,int period_ns) +static int bcm2835_pwm_apply (struct pwm_chip *chip,struct pwm_device *pwm, +const struct pwm_state *state) { +struct bcm2835_pwm *pc =to_bcm2835_pwm (chip);unsigned long rate =clk_get_rate (pc->clk); +unsigned long long period;unsigned long scaler; -u32 period; +u32 val;if (!rate) {dev_err (pc->dev,"failed to get clock rate\n" );
@@ -72,54 +74,34 @@ static int bcm2835_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, } scaler =DIV_ROUND_CLOSEST (NSEC_PER_SEC , rate); - period =DIV_ROUND_CLOSEST (period_ns, scaler); +/* set period */ + period =DIV_ROUND_CLOSEST_ULL (state->period, scaler); -if (period <PERIOD_MIN ) +/* dont accept a period that is too small or has been truncated */ +if ((period <PERIOD_MIN ) || (period >U32_MAX ))return -EINVAL ; -writel (DIV_ROUND_CLOSEST (duty_ns, scaler), - pc->base +DUTY (pwm->hwpwm));writel (period, pc->base +PERIOD (pwm->hwpwm)); -return 0 ; -} - -static int bcm2835_pwm_enable (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value |=PWM_ENABLE <<PWM_CONTROL_SHIFT (pwm->hwpwm); -writel (value, pc->base +PWM_CONTROL ); +/* set duty cycle */ + val =DIV_ROUND_CLOSEST_ULL (state->duty_cycle, scaler); +writel (val, pc->base +DUTY (pwm->hwpwm)); -return 0 ; -} +/* set polarity */ + val =readl (pc->base +PWM_CONTROL ); -static void bcm2835_pwm_disable (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_ENABLE <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); -} - -static int bcm2835_set_polarity (struct pwm_chip *chip,struct pwm_device *pwm, -enum pwm_polarity polarity) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); +if (state->polarity ==PWM_POLARITY_NORMAL ) + val &= ~(PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm)); +else + val |=PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm); -if (polarity ==PWM_POLARITY_NORMAL ) - value &= ~(PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm)); +/* enable/disable */ +if (state->enabled) + val |=PWM_ENABLE <<PWM_CONTROL_SHIFT (pwm->hwpwm);else - value |=PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm); + val &= ~(PWM_ENABLE <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); +writel (val, pc->base +PWM_CONTROL );return 0 ; }
@@ -127,10 +109,7 @@ static int bcm2835_set_polarity(struct pwm_chip *chip, struct pwm_device *pwm,static const struct pwm_ops bcm2835_pwm_ops = { .request = bcm2835_pwm_request, .free = bcm2835_pwm_free, - .config = bcm2835_pwm_config, - .enable = bcm2835_pwm_enable, - .disable = bcm2835_pwm_disable, - .set_polarity = bcm2835_set_polarity, + .apply = bcm2835_pwm_apply, .owner =THIS_MODULE , };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/451 pwm: bcm2835: Make sure the channel is enabled after pwm_request()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit cda323dbda76600bf9761970d58517648f0de67d ]
The .free callback cleared among others the enable bit PWENx in the control register. When the PWM is requested later again this bit isn't restored but the core assumes the PWM is enabled and thus skips a request to configure the same state as before.
To fix that don't touch the hardware configuration in .free(). For symmetry also drop .request() and configure the mode completely in .apply().
--- drivers/pwm/pwm-bcm2835.c | 28 +++------------------------- 1 file changed, 3 insertions(+), 25 deletions(-)
drivers/pwm/pwm-bcm2835.c +3 -25
@@ -35,29 +35,6 @@ static inline struct bcm2835_pwm *to_bcm2835_pwm(struct pwm_chip *chip) return container_of(chip, struct bcm2835_pwm, chip); } -static int bcm2835_pwm_request (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); - value |= (PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); - -return 0 ; -} - -static void bcm2835_pwm_free (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); -} -static int bcm2835_pwm_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) {
@@ -90,6 +67,9 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,/* set polarity */ val =readl (pc->base +PWM_CONTROL ); + val &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); + val |=PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm); +if (state->polarity ==PWM_POLARITY_NORMAL ) val &= ~(PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm));else
@@ -107,8 +87,6 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, }static const struct pwm_ops bcm2835_pwm_ops = { - .request = bcm2835_pwm_request, - .free = bcm2835_pwm_free, .apply = bcm2835_pwm_apply, .owner =THIS_MODULE , };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/451 mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit b4b1bd1f330fdd13706382be6c90ce9f58cee3f5 ]
If devm_request_threaded_irq() fails after irq_domain_create_linear() succeeds in mt6397_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_create_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6397-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6397-irq.c +1 -0
@@ -206,6 +206,7 @@ int mt6397_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"failed to register irq=%d; err: %d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/451 mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 384bd58bf7095e4c4c8fcdbcede316ef342c630c ]
If devm_request_threaded_irq() fails after irq_domain_add_linear() succeeds in mt6358_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_add_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6358-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6358-irq.c +1 -0
@@ -227,6 +227,7 @@ int mt6358_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"Failed to register IRQ=%d, ret=%d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/451 wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit b647d2574e4583c2e3b0ab35568f60c88e910840 ]
The rtl8187_rx_cb() calculates the rx descriptor header address by subtracting its size from the skb tail pointer. However, it does not validate if the received packet (skb->len from urb->actual_length) is large enough to contain this header.
If a truncated packet is received, this will lead to a buffer underflow, reading memory before the start of the skb data area, and causing a kernel panic.
Add length checks for both rtl8187 and rtl8187b descriptor headers before attempting to access them, dropping the packet cleanly if the check fails.
--- .../wireless/realtek/rtl818x/rtl8187/dev.c | 27 +++++++++++++------ 1 file changed, 19 insertions(+), 8 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +19 -8
@@ -338,14 +338,16 @@ static void rtl8187_rx_cb(struct urb *urb)spin_unlock_irqrestore (&priv->rx_queue.lock, f);skb_put (skb, urb->actual_length); -if (unlikely (urb->status)) { -dev_kfree_skb_irq (skb); -return ; - } +if (unlikely (urb->status)) + goto free_skb;if (!priv->is_rtl8187b) { -struct rtl8187_rx_hdr *hdr = - (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); +struct rtl8187_rx_hdr *hdr; + +if (skb->len <sizeof (struct rtl8187_rx_hdr )) + goto free_skb; + + hdr = (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); flags =le32_to_cpu (hdr->flags);/* As with the RTL8187B below, the AGC is used to calculate * signal strength. In this case, the scaling
@@ -355,8 +357,12 @@ static void rtl8187_rx_cb(struct urb *urb) rx_status.antenna = (hdr->signal >>7 ) &1 ; rx_status.mactime =le64_to_cpu (hdr->mac_time); }else { -struct rtl8187b_rx_hdr *hdr = - (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); +struct rtl8187b_rx_hdr *hdr; + +if (skb->len <sizeof (struct rtl8187b_rx_hdr )) + goto free_skb; + + hdr = (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr));/* The Realtek datasheet for the RTL8187B shows that the RX * header contains the following quantities: signal quality, * RSSI, AGC, the received power in dB, and the measured SNR.
@@ -409,6 +415,11 @@ static void rtl8187_rx_cb(struct urb *urb)skb_unlink (skb, &priv->rx_queue);dev_kfree_skb_irq (skb); } +return ; + +free_skb: +dev_kfree_skb_irq (skb); +return ; }static int rtl8187_init_urbs (struct ieee80211_hw *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/451 ima: Handle error code returned by ima_filter_rule_match()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Yipeng <[email protected]>
[ Upstream commit 738c9738e690f5cea24a3ad6fd2d9a323cf614f6 ]
In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if (!rc)' check and sets 'result = true'. The LSM rule is considered a match, causing extra files to be measured by IMA.
This issue can be reproduced in the following scenario:
After unloading the SELinux policy module via 'semodule -d', if an IMA measurement is triggered before ima_lsm_rules is updated,
in ima_match_rules(), the first call to ima_filter_rule_match() returns -ESTALE. This causes the code to enter the 'if (rc == -ESTALE && !rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In ima_lsm_copy_rule(), since the SELinux module has been removed, the rule becomes NULL, and the second call to ima_filter_rule_match() returns -ENOENT. This bypasses the 'if (!rc)' check and results in a false match.
Call trace: selinux_audit_rule_match+0x310/0x3b8 security_audit_rule_match+0x60/0xa0 ima_match_rules+0x2e4/0x4a0 ima_match_policy+0x9c/0x1e8 ima_get_action+0x48/0x60 process_measurement+0xf8/0xa98 ima_bprm_check+0x98/0xd8 security_bprm_check+0x5c/0x78 search_binary_handler+0x6c/0x318 exec_binprm+0x58/0x1b8 bprm_execve+0xb8/0x130 do_execveat_common.isra.0+0x1a8/0x258 __arm64_sys_execve+0x48/0x68 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x200 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0
Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error codes like -ENOENT do not bypass the check and accidentally result in a successful match.
--- security/integrity/ima/ima_policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/ima_policy.c +1 -1
@@ -581,7 +581,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, goto retry; } } -if (!rc) { +if (rc <=0 ) { result = false; goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/451 usb: chaoskey: fix locking for O_NONBLOCK
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit a2fa8a12e6bc9d89c0505b8dd7ae38ec173d25de ]
A failure to take a lock with O_NONBLOCK needs to result in -EAGAIN. Change it.
--- drivers/usb/misc/chaoskey.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/usb/misc/chaoskey.c +13 -3
@@ -445,9 +445,19 @@ static ssize_t chaoskey_read(struct file *file, goto bail;mutex_unlock (&dev->rng_lock); - result =mutex_lock_interruptible (&dev->lock); -if (result) - goto bail; +if (file->f_flags &O_NONBLOCK ) { + result =mutex_trylock (&dev->lock); +if (result ==0 ) { + result = -EAGAIN ; + goto bail; + }else { + result =0 ; + } + }else { + result =mutex_lock_interruptible (&dev->lock); +if (result) + goto bail; + }if (dev->valid == dev->used) { result =_chaoskey_fill (dev);if (result <0 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/451 usb: dwc2: disable platform lowlevel hw resources during shutdown
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit 7481a97c5f49f10c7490bb990d0e863f23b9bb71 ]
On some SoC platforms, in shutdown stage, most components' power is cut off, but there's still power supply to the so called always-on domain, so if the dwc2's regulator is from the always-on domain, we need to explicitly disable it to save power.
Disable platform lowlevel hw resources such as phy, clock and regulators etc. in device shutdown hook to reduce non-necessary power consumption when the platform enters shutdown stage.
Stable-dep-of: b6ebcfdcac40 ("usb: dwc2: fix hang during shutdown if set as peripheral")
--- drivers/usb/dwc2/platform.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/dwc2/platform.c +3 -0
@@ -343,6 +343,9 @@ static void dwc2_driver_shutdown(struct platform_device *dev)dwc2_disable_global_interrupts (hsotg);synchronize_irq (hsotg->irq); + +if (hsotg->ll_hw_enabled) +dwc2_lowlevel_hw_disable (hsotg); }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/451 usb: dwc2: fix hang during shutdown if set as peripheral
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit b6ebcfdcac40a27953f052e4269ce75a18825ffc ]
dwc2 on most platforms needs phy controller, clock and power supply. All of them must be enabled/activated to properly operate. If dwc2 is configured as peripheral mode, then all the above three hardware resources are disabled at the end of the probe:
/* Gadget code manages lowlevel hw on its own */ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) dwc2_lowlevel_hw_disable(hsotg);
But dwc2_driver_shutdown() tries to disable the interrupts on HW IP level. This would result in hang during shutdown if dwc2 is configured as peripheral mode.
Fix this hang by only disable and sync irq when lowlevel hw is enabled.
--- drivers/usb/dwc2/platform.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/dwc2/platform.c +4 -4
@@ -341,11 +341,11 @@ static void dwc2_driver_shutdown(struct platform_device *dev) {struct dwc2_hsotg *hsotg =platform_get_drvdata (dev); -dwc2_disable_global_interrupts (hsotg); -synchronize_irq (hsotg->irq); - -if (hsotg->ll_hw_enabled) +if (hsotg->ll_hw_enabled) { +dwc2_disable_global_interrupts (hsotg); +synchronize_irq (hsotg->irq);dwc2_lowlevel_hw_disable (hsotg); + } }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/451 usb: dwc2: fix hang during suspend if set as peripheral
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit 2b94b054ac4974ad2f89f7f7461840c851933adb ]
dwc2 on most platforms needs phy controller, clock and power supply. All of them must be enabled/activated to properly operate. If dwc2 is configured as peripheral mode, then all the above three hardware resources are disabled at the end of the probe:
/* Gadget code manages lowlevel hw on its own */ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) dwc2_lowlevel_hw_disable(hsotg);
But the dwc2_suspend() tries to read the dwc2's reg to check whether is_device_mode or not, this would result in hang during suspend if dwc2 is configured as peripheral mode.
Fix this hang by bypassing suspend/resume if lowlevel hw isn't enabled.
--- drivers/usb/dwc2/platform.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/dwc2/platform.c +8 -1
@@ -626,9 +626,13 @@ static int dwc2_driver_probe(struct platform_device *dev)static int __maybe_unused dwc2_suspend (struct device *dev) {struct dwc2_hsotg *dwc2 =dev_get_drvdata (dev); -bool is_device_mode =dwc2_is_device_mode (dwc2); +bool is_device_mode;int ret =0 ; +if (!dwc2->ll_hw_enabled) +return 0 ; + + is_device_mode =dwc2_is_device_mode (dwc2);if (is_device_mode)dwc2_hsotg_suspend (dwc2);
@@ -679,6 +683,9 @@ static int __maybe_unused dwc2_resume(struct device *dev)struct dwc2_hsotg *dwc2 =dev_get_drvdata (dev);int ret =0 ; +if (!dwc2->ll_hw_enabled) +return 0 ; +if (dwc2->phy_off_for_suspend && dwc2->ll_hw_enabled) { ret =__dwc2_lowlevel_hw_enable (dwc2);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/451 usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gopi Krishna Menon <[email protected]>
[ Upstream commit a5160af78be7fcf3ade6caab0a14e349560c96d7 ]
The previous commit removed the PAGE_SIZE limit on transfer length of raw_io buffer in order to avoid any problems with emulating USB devices whose full configuration descriptor exceeds PAGE_SIZE in length. However this also removes the upperbound on user supplied length, allowing very large values to be passed to the allocator.
syzbot on fuzzing the transfer length with very large value (1.81GB) results in kmalloc() to fall back to the page allocator, which triggers a kernel warning as the page allocator cannot handle allocations more than MAX_PAGE_ORDER/KMALLOC_MAX_SIZE.
Since there is no limit imposed on the size of buffer for both control and non control transfers, cap the raw_io transfer length to KMALLOC_MAX_SIZE and return -EINVAL for larger transfer length to prevent any warnings from the page allocator.
--- drivers/usb/gadget/legacy/raw_gadget.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/legacy/raw_gadget.c +3 -0
@@ -38,6 +38,7 @@ MODULE_LICENSE("GPL");static DEFINE_IDA (driver_id_numbers);#define DRIVER_DRIVER_NAME_LENGTH_MAX 32 +#define USB_RAW_IO_LENGTH_MAX KMALLOC_MAX_SIZE#define RAW_EVENT_QUEUE_SIZE 16
@@ -619,6 +620,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,return ERR_PTR (-EINVAL );if (!usb_raw_io_flags_valid (io->flags))return ERR_PTR (-EINVAL ); +if (io->length >USB_RAW_IO_LENGTH_MAX ) +return ERR_PTR (-EINVAL );if (get_from_user) data =memdup_user (ptr +sizeof (*io), io->length);else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/451 selftests/bpf: Improve reliability of test_perf_branches_no_hw()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <[email protected]>
[ Upstream commit ae24fc8a16b0481ea8c5acbc66453c49ec0431c4 ]
Currently, test_perf_branches_no_hw() relies on the busy loop within test_perf_branches_common() being slow enough to allow at least one perf event sample tick to occur before starting to tear down the backing perf event BPF program. With a relatively small fixed iteration count of 1,000,000, this is not guaranteed on modern fast CPUs, resulting in the test run to subsequently fail with the following:
bpf_testmod.ko is already unloaded.
Loading bpf_testmod.ko...
Successfully loaded bpf_testmod.ko. test_perf_branches_common:PASS:test_perf_branches_load 0 nsec test_perf_branches_common:PASS:attach_perf_event 0 nsec test_perf_branches_common:PASS:set_affinity 0 nsec check_good_sample:PASS:output not valid 0 nsec check_good_sample:PASS:read_branches_size 0 nsec check_good_sample:PASS:read_branches_stack 0 nsec check_good_sample:PASS:read_branches_stack 0 nsec check_good_sample:PASS:read_branches_global 0 nsec check_good_sample:PASS:read_branches_global 0 nsec check_good_sample:PASS:read_branches_size 0 nsec test_perf_branches_no_hw:PASS:perf_event_open 0 nsec test_perf_branches_common:PASS:test_perf_branches_load 0 nsec test_perf_branches_common:PASS:attach_perf_event 0 nsec test_perf_branches_common:PASS:set_affinity 0 nsec check_bad_sample:FAIL:output not valid no valid sample from prog
Summary: 0/1 PASSED, 0 SKIPPED, 1 FAILED
Successfully unloaded bpf_testmod.ko.
On a modern CPU (i.e. one with a 3.5 GHz clock rate), executing 1 million increments of a volatile integer can take significantly less than 1 millisecond. If the spin loop and detachment of the perf event BPF program elapses before the first 1 ms sampling interval elapses, the perf event will never end up firing. Fix this by bumping the loop iteration counter a little within test_perf_branches_common(), along with ensuring adding another loop termination condition which is directly influenced by the backing perf event BPF program executing. Notably, a concious decision was made to not adjust the sample_freq value as that is just not a reliable way to go about fixing the problem. It effectively still leaves the race window open.
--- .../selftests/bpf/prog_tests/perf_branches.c | 16 ++++++++++++++-- .../selftests/bpf/progs/test_perf_branches.c | 3 +++ 2 files changed, 17 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/prog_tests/perf_branches.c +14 -2
@@ -15,6 +15,10 @@ static void check_good_sample(struct test_perf_branches *skel)int pbe_size =sizeof (struct perf_branch_entry );int duration =0 ; +if (CHECK (!skel->bss->run_cnt,"invalid run_cnt" , +"checked sample validity before prog run" )) +return ; +if (CHECK (!skel->bss->valid,"output not valid" ,"no valid sample from prog" ))return ;
@@ -45,6 +49,10 @@ static void check_bad_sample(struct test_perf_branches *skel)int written_stack = skel->bss->written_stack_out;int duration =0 ; +if (CHECK (!skel->bss->run_cnt,"invalid run_cnt" , +"checked sample validity before prog run" )) +return ; +if (CHECK (!skel->bss->valid,"output not valid" ,"no valid sample from prog" ))return ;
@@ -83,8 +91,12 @@ static void test_perf_branches_common(int perf_fd, err =pthread_setaffinity_np (pthread_self (),sizeof (cpu_set), &cpu_set);if (CHECK (err,"set_affinity" ,"cpu #0, err %d\n" , err)) goto out_destroy; -/* spin the loop for a while (random high number) */ -for (i =0 ; i <1000000 ; ++i) + +/* Spin the loop for a while by using a high iteration count, and by +* checking whether the specific run count marker has been explicitly +* incremented at least once by the backing perf_event BPF program. +*/ +for (i =0 ; i <100000000 && !*(volatile int *)&skel->bss->run_cnt; ++i) ++j;test_perf_branches__detach (skel);
tools/testing/selftests/bpf/progs/test_perf_branches.c +3 -0
@@ -8,6 +8,7 @@#include <bpf/bpf_tracing.h> int valid =0 ; +int run_cnt =0 ;int required_size_out =0 ;int written_stack_out =0 ;int written_global_out =0 ;
@@ -24,6 +25,8 @@ int perf_branches(void *ctx)__u64 entries[4 *3 ] = {0 };int required_size, written_stack, written_global; + ++run_cnt; +/* write to stack */ written_stack =bpf_read_branch_records (ctx, entries,sizeof (entries),0 );/* ignore spurious events */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/451 crypto: ccree - Correctly handle return of sg_nents_for_len
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 8700ce07c5c6bf27afa7b59a8d9cf58d783a7d5c ]
Fix error handling in cc_map_hash_request_update where sg_nents_for_len return value was assigned to u32, converting negative errors to large positive values before passing to sg_copy_to_buffer.
Check sg_nents_for_len return value and propagate errors before assigning to areq_ctx->in_nents.
--- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/crypto/ccree/cc_buffer_mgr.c +5 -1
@@ -1235,6 +1235,7 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,int rc =0 ;u32 dummy =0 ;u32 mapped_nents =0 ; +int sg_nents;dev_dbg (dev," update params : curr_buff=%pK curr_buff_cnt=0x%X nbytes=0x%X src=%pK curr_index=%u\n" , curr_buff, *curr_buff_cnt, nbytes, src, areq_ctx->buff_index);
@@ -1248,7 +1249,10 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,if (total_in_len < block_size) {dev_dbg (dev," less than one block: curr_buff=%pK *curr_buff_cnt=0x%X copy_to=%pK\n" , curr_buff, *curr_buff_cnt, &curr_buff[*curr_buff_cnt]); - areq_ctx->in_nents =sg_nents_for_len (src, nbytes); + sg_nents =sg_nents_for_len (src, nbytes); +if (sg_nents <0 ) +return sg_nents; + areq_ctx->in_nents = sg_nents;sg_copy_to_buffer (src, areq_ctx->in_nents, &curr_buff[*curr_buff_cnt], nbytes); *curr_buff_cnt += nbytes;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/451 staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianglei Nie <[email protected]>
[ Upstream commit 47d3949a9b04cbcb0e10abae30c2b53e98706e11 ]
fbtft_probe_common() allocates a memory chunk for "info" with fbtft_framebuffer_alloc(). When "display->buswidth == 0" is true, the function returns without releasing the "info", which will lead to a memory leak.
Fix it by calling fbtft_framebuffer_release() when "display->buswidth == 0" is true.
--- drivers/staging/fbtft/fbtft-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/fbtft/fbtft-core.c +2 -2
@@ -1229,8 +1229,8 @@ int fbtft_probe_common(struct fbtft_display *display, par->pdev = pdev;if (display->buswidth ==0 ) { -dev_err (dev,"buswidth is not set\n" ); -return -EINVAL ; + ret =dev_err_probe (dev, -EINVAL ,"buswidth is not set\n" ); + goto out_release; }/* write register functions */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/451 PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
[ Upstream commit bcc9a4a0bca3aee4303fa4a20302e57b24ac8f68 ]
As per DesignWare Cores PCI Express Controller Databook, section 5.50,
SII: Debug Signals, cxpl_debug_info[63:0]:
[5:0] smlh_ltssm_state: LTSSM current state. Encoding is same as the dedicated smlh_ltssm_state output.
The mask should be 6 bits, from 0 to 5. Hence, fix the mask definition.
--- drivers/pci/controller/dwc/pcie-designware.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-designware.h +1 -1
@@ -52,7 +52,7 @@#define PORT_LINK_MODE_8_LANES PORT_LINK_MODE(0xf)#define PCIE_PORT_DEBUG0 0x728 -#define PORT_LOGIC_LTSSM_STATE_MASK 0x1f +#define PORT_LOGIC_LTSSM_STATE_MASK 0x3f#define PORT_LOGIC_LTSSM_STATE_L0 0x11#define PCIE_PORT_DEBUG1 0x72C#define PCIE_PORT_DEBUG1_LINK_UP BIT(4)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/451 wifi: ieee80211: correct FILS status codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ria Thomas <[email protected]>
[ Upstream commit 24d4da5c2565313c2ad3c43449937a9351a64407 ]
The FILS status codes are set to 108/109, but the IEEE 802.11-2020 spec defines them as 112/113. Update the enum so it matches the specification and keeps the kernel consistent with standard values.
--- include/linux/ieee80211.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/ieee80211.h +2 -2
@@ -2627,8 +2627,8 @@ enum ieee80211_statuscode {WLAN_STATUS_DENIED_WITH_SUGGESTED_BAND_AND_CHANNEL =99 ,WLAN_STATUS_DENIED_DUE_TO_SPECTRUM_MANAGEMENT =103 ,/* 802.11ai */ -WLAN_STATUS_FILS_AUTHENTICATION_FAILURE =108 , -WLAN_STATUS_UNKNOWN_AUTHENTICATION_SERVER =109 , +WLAN_STATUS_FILS_AUTHENTICATION_FAILURE =112 , +WLAN_STATUS_UNKNOWN_AUTHENTICATION_SERVER =113 ,WLAN_STATUS_SAE_HASH_TO_ELEMENT =126 , WLAN_STATUS_SAE_PK = 127, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/451 backlight: led_bl: Take led_access lock when required
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mans Rullgard <[email protected]>
[ Upstream commit a33677b9211b6c328ad359b072043af94f7c9592 ]
The led_access lock must be held when calling led_sysfs_enable() and led_sysfs_disable(). This fixes warnings such as this:
[ 2.432495] ------------[ cut here ]------------ [ 2.437316] WARNING: CPU: 0 PID: 22 at drivers/leds/led-core.c:349 led_sysfs_disable+0x54/0x58 [ 2.446105] Modules linked in: [ 2.449218] CPU: 0 PID: 22 Comm: kworker/u2:1 Not tainted 6.3.8+ #1 [ 2.456268] Hardware name: Generic AM3517 (Flattened Device Tree) [ 2.462402] Workqueue: events_unbound deferred_probe_work_func [ 2.468353] unwind_backtrace from show_stack+0x10/0x14 [ 2.473632] show_stack from dump_stack_lvl+0x24/0x2c [ 2.478759] dump_stack_lvl from __warn+0x9c/0xc4 [ 2.483551] __warn from warn_slowpath_fmt+0x64/0xc0 [ 2.488586] warn_slowpath_fmt from led_sysfs_disable+0x54/0x58 [ 2.494567] led_sysfs_disable from led_bl_probe+0x20c/0x3b0 [ 2.500305] led_bl_probe from platform_probe+0x5c/0xb8 [ 2.505615] platform_probe from really_probe+0xc8/0x2a0 [ 2.510986] really_probe from __driver_probe_device+0x88/0x19c [ 2.516967] __driver_probe_device from driver_probe_device+0x30/0xcc [ 2.523498] driver_probe_device from __device_attach_driver+0x94/0xc4 [ 2.530090] __device_attach_driver from bus_for_each_drv+0x80/0xcc [ 2.536437] bus_for_each_drv from __device_attach+0xf8/0x19c [ 2.542236] __device_attach from bus_probe_device+0x8c/0x90 [ 2.547973] bus_probe_device from deferred_probe_work_func+0x80/0xb0 [ 2.554504] deferred_probe_work_func from process_one_work+0x228/0x4c0 [ 2.561187] process_one_work from worker_thread+0x1fc/0x4d0 [ 2.566925] worker_thread from kthread+0xb4/0xd0 [ 2.571685] kthread from ret_from_fork+0x14/0x2c [ 2.576446] Exception stack(0xd0079fb0 to 0xd0079ff8) [ 2.581573] 9fa0: 00000000 00000000 00000000 00000000 [ 2.589813] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 2.598052] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 2.604888] ---[ end trace 0000000000000000 ]---
Stable-dep-of: 9341d6698f4c ("backlight: led-bl: Add devlink to supplier LEDs")
--- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/video/backlight/led_bl.c +4 -1
@@ -209,8 +209,11 @@ static int led_bl_probe(struct platform_device *pdev)return PTR_ERR (priv->bl_dev); } -for (i =0 ; i < priv->nb_leds; i++) +for (i =0 ; i < priv->nb_leds; i++) { +mutex_lock (&priv->leds[i]->led_access);led_sysfs_disable (priv->leds[i]); +mutex_unlock (&priv->leds[i]->led_access); + }backlight_update_status (priv->bl_dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/451 backlight: led-bl: Add devlink to supplier LEDs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
[ Upstream commit 9341d6698f4cfdfc374fb6944158d111ebe16a9d ]
LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device. It creates instead a link where the supplier is the parent of the expected device.
One consequence is that removal order is not correctly enforced.
Issues happen for example with the following sections in a device tree overlay:
// An LED driver chip
pca9632@62 {
compatible = "nxp,pca9632";
reg = <0x62>;
// ...
addon_led_pwm: led-pwm@3 {
reg = <3>;
label = "addon:led:pwm";
};
};
backlight-addon {
compatible = "led-backlight";
leds = <&addon_led_pwm>;
brightness-levels = <255>;
default-brightness-level = <255>;
};In this example, the devlink should be created between the backlight-addon (consumer) and the pca9632@62 (supplier). Instead it is created between the backlight-addon (consumer) and the parent of the pca9632@62, which is typically the I2C bus adapter.
On removal of the above overlay, the LED driver can be removed before the backlight device, resulting in:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
...
Call trace:
led_put+0xe0/0x140
devm_led_release+0x6c/0x98Another way to reproduce the bug without any device tree overlays is unbinding the LED class device (pca9632@62) before unbinding the consumer (backlight-addon):
echo 11-0062 >/sys/bus/i2c/drivers/leds-pca963x/unbind echo ...backlight-dock >/sys/bus/platform/drivers/led-backlight/unbind
Fix by adding a devlink between the consuming led-backlight device and the supplying LED device, as other drivers and subsystems do as well.
--- drivers/video/backlight/led_bl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/video/backlight/led_bl.c +13 -0
@@ -209,6 +209,19 @@ static int led_bl_probe(struct platform_device *pdev)return PTR_ERR (priv->bl_dev); } +for (i =0 ; i < priv->nb_leds; i++) { +struct device_link *link; + + link =device_link_add (&pdev->dev, priv->leds[i]->dev->parent, +DL_FLAG_AUTOREMOVE_CONSUMER ); +if (!link) { +dev_err (&pdev->dev,"Failed to add devlink (consumer %s, supplier %s)\n" , +dev_name (&pdev->dev),dev_name (priv->leds[i]->dev->parent)); +backlight_device_unregister (priv->bl_dev); +return -EINVAL ; + } + } +for (i =0 ; i < priv->nb_leds; i++) {mutex_lock (&priv->leds[i]->led_access);led_sysfs_disable (priv->leds[i]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/451 backlight: lp855x: Fix lp855x.h kernel-doc warnings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 2d45db63260c6ae3cf007361e04a1c41bd265084 ]
Add a missing struct short description and a missing leading " *" to lp855x.h to avoid kernel-doc warnings:
Warning: include/linux/platform_data/lp855x.h:126 missing initial short
description on line:
* struct lp855x_platform_data
Warning: include/linux/platform_data/lp855x.h:131 bad line:
Only valid when mode is PWM_BASED.
--- include/linux/platform_data/lp855x.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/platform_data/lp855x.h +2 -2
@@ -124,12 +124,12 @@ struct lp855x_rom_data { };/** -* struct lp855x_platform_data +* struct lp855x_platform_data - lp855 platform-specific data * @name : Backlight driver name. If it is not defined, default name is set. * @device_control : value of DEVICE CONTROL register * @initial_brightness : initial value of backlight brightness * @period_ns : platform specific pwm period value. unit is nano. -Only valid when mode is PWM_BASED. +* Only valid when mode is PWM_BASED. * @size_program : total size of lp855x_rom_data * @rom_data : list of new eeprom/eprom registers */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/451 iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 5583a55e074b33ccd88ac0542fd7cd656a7e2c8c ]
Some platforms (e.g. SC8280XP and X1E) support more than 128 stream matching groups. This is more than what is defined as maximum by the ARM SMMU architecture specification. Commit 122611347326 ("iommu/arm-smmu-qcom:
Limit the SMR groups to 128") disabled use of the additional groups because they don't exhibit the same behavior as the architecture supported ones.
It seems like this is just another quirk of the hypervisor: When running bare-metal without the hypervisor, the additional groups appear to behave just like all others. The boot firmware uses some of the additional groups, so ignoring them in this situation leads to stream match conflicts whenever we allocate a new SMR group for the same SID.
The workaround exists primarily because the bypass quirk detection fails when using a S2CR register from the additional matching groups, so let's perform the test with the last reliable S2CR (127) and then limit the number of SMR groups only if we detect that we are running below the hypervisor (because of the bypass quirk).
--- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 ++++++++++++++-------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +17 -10
@@ -48,17 +48,19 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)/* * Some platforms support more than the Arm SMMU architected maximum of -* 128 stream matching groups. For unknown reasons, the additional -* groups don't exhibit the same behavior as the architected registers, -* so limit the groups to 128 until the behavior is fixed for the other -* groups. +* 128 stream matching groups. The additional registers appear to have +* the same behavior as the architected registers in the hardware. +* However, on some firmware versions, the hypervisor does not +* correctly trap and emulate accesses to the additional registers, +* resulting in unexpected behavior. +* +* If there are more than 128 groups, use the last reliable group to +* detect if we need to apply the bypass quirk. */ -if (smmu->num_mapping_groups >128 ) { -dev_notice (smmu->dev,"\tLimiting the stream matching groups to 128\n" ); - smmu->num_mapping_groups =128 ; - } - - last_s2cr =ARM_SMMU_GR0_S2CR (smmu->num_mapping_groups -1 ); +if (smmu->num_mapping_groups >128 ) + last_s2cr =ARM_SMMU_GR0_S2CR (127 ); +else + last_s2cr =ARM_SMMU_GR0_S2CR (smmu->num_mapping_groups -1 );/* * With some firmware versions writes to S2CR of type FAULT are
@@ -81,6 +83,11 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu) reg =FIELD_PREP (ARM_SMMU_CBAR_TYPE ,CBAR_TYPE_S1_TRANS_S2_BYPASS );arm_smmu_gr1_write (smmu,ARM_SMMU_GR1_CBAR (qsmmu->bypass_cbndx), reg); + +if (smmu->num_mapping_groups >128 ) { +dev_notice (smmu->dev,"\tLimiting the stream matching groups to 128\n" ); + smmu->num_mapping_groups =128 ; + } }for (i =0 ; i < smmu->num_mapping_groups; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/451 drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 1a79482699b4d1e43948d14f0c7193dc1dcad858 ]
The .H_SYNC_POLARITY and .V_SYNC_POLARITY variables are 1 bit bitfields of a u32. The ATOM_HSYNC_POLARITY define is 0x2 and the ATOM_VSYNC_POLARITY is 0x4. When we do a bitwise negate of 0, 2, or 4 then the last bit is always 1 so this code always sets .H_SYNC_POLARITY and .V_SYNC_POLARITY to true.
This code is instead intended to check if the ATOM_HSYNC_POLARITY or ATOM_VSYNC_POLARITY flags are set and reverse the result. In other words, it's supposed to be a logical negate instead of a bitwise negate.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +4 -4
@@ -961,10 +961,10 @@ static enum bp_result get_embedded_panel_info_v2_1(/* not provided by VBIOS */ info->lcd_timing.misc_info.HORIZONTAL_CUT_OFF =0 ; - info->lcd_timing.misc_info.H_SYNC_POLARITY = ~(uint32_t ) (lvds->lcd_timing.miscinfo - &ATOM_HSYNC_POLARITY ); - info->lcd_timing.misc_info.V_SYNC_POLARITY = ~(uint32_t ) (lvds->lcd_timing.miscinfo - &ATOM_VSYNC_POLARITY ); + info->lcd_timing.misc_info.H_SYNC_POLARITY = !(lvds->lcd_timing.miscinfo & +ATOM_HSYNC_POLARITY ); + info->lcd_timing.misc_info.V_SYNC_POLARITY = !(lvds->lcd_timing.miscinfo & +ATOM_VSYNC_POLARITY );/* not provided by VBIOS */ info->lcd_timing.misc_info.VERTICAL_CUT_OFF =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/451 ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: René Rebe <[email protected]>
[ Upstream commit 17e7972979e147cc51d4a165e6b6b0f93273ca68 ]
On all AMD AM4 systems I have seen, e.g ASUS X470-i, Pro WS X570 Ace and equivalent Gigabyte, amd-pstate does not initialize when the x2apic is enabled in the BIOS. Kernel debug messages include:
[ 0.315438] acpi LNXCPU:00: Failed to get CPU physical ID. [ 0.354756] ACPI CPPC: No CPC descriptor for CPU:0 [ 0.714951] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled
I tracked this down to map_x2apic_id() checking device_declaration passed in via the type argument of acpi_get_phys_id() via map_madt_entry() while map_lapic_id() does not.
It appears these BIOSes use Processor statements for declaring the CPUs in the ACPI namespace instead of processor device objects (which should have been used). CPU declarations via Processor statements were deprecated in ACPI 6.0 that was released 10 years ago. They should not be used any more in any contemporary platform firmware.
I tried to contact Asus support multiple times, but never received a reply nor did any BIOS update ever change this.
Fix amd-pstate w/ x2apic on am4 by allowing map_x2apic_id() to work with CPUs declared via Processor statements for IDs less than 255, which is consistent with ACPI 5.0 that still allowed Processor statements to be used for declaring CPUs.
--- drivers/acpi/processor_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/processor_core.c +1 -1
@@ -54,7 +54,7 @@ static int map_x2apic_id(struct acpi_subtable_header *entry,if (!(apic->lapic_flags &ACPI_MADT_ENABLED ))return -ENODEV ; -if (device_declaration && (apic->uid == acpi_id)) { +if (apic->uid == acpi_id && (device_declaration || acpi_id <255 )) { *apic_id = apic->local_apic_id;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/451 ext4: remove unused return value of __mb_check_buddy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 133de5a0d8f8e32b34feaa8beae7a189482f1856 ]
Remove unused return value of __mb_check_buddy.
Stable-dep-of: d9ee3ff810f1 ("ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation")
--- fs/ext4/mballoc.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/ext4/mballoc.c +3 -4
@@ -602,7 +602,7 @@ do { \ } \ }while (0 ) -static int __mb_check_buddy(struct ext4_buddy *e4b, char *file, +static void __mb_check_buddy(struct ext4_buddy *e4b, char *file,const char *function,int line) {struct super_block *sb = e4b->bd_sb;
@@ -621,7 +621,7 @@ static int __mb_check_buddy(struct ext4_buddy *e4b, char *file,void *buddy2;if (e4b->bd_info->bb_check_counter++ %10 ) -return 0 ; +return ;while (order >1 ) { buddy =mb_find_buddy (e4b, order, &max);
@@ -686,7 +686,7 @@ static int __mb_check_buddy(struct ext4_buddy *e4b, char *file, grp =ext4_get_group_info (sb, e4b->bd_group);if (!grp) -return NULL ; +return ;list_for_each (cur, &grp->bb_prealloc_list) {ext4_group_t groupnr;struct ext4_prealloc_space *pa;
@@ -696,7 +696,6 @@ static int __mb_check_buddy(struct ext4_buddy *e4b, char *file,for (i =0 ; i < pa->pa_len; i++)MB_CHECK_ASSERT (mb_test_bit (k + i, buddy)); } -return 0 ; }#undef MB_CHECK_ASSERT#define mb_check_buddy (e4b) __mb_check_buddy(e4b, \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/451 ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Sun <[email protected]>
[ Upstream commit d9ee3ff810f1cc0e253c9f2b17b668b973cb0e06 ]
When the MB_CHECK_ASSERT macro is enabled, we found that the current validation logic in __mb_check_buddy has a gap in detecting certain invalid buddy states, particularly related to order-0 (bitmap) bits.
The original logic consists of three steps:
1. Validates higher-order buddies: if a higher-order bit is set, at most one of the two corresponding lower-order bits may be free; if a higher-order bit is clear, both lower-order bits must be allocated (and their bitmap bits must be 0).
2. For any set bit in order-0, ensures all corresponding higher-order bits are not free.
3. Verifies that all preallocated blocks (pa) in the group have pa_pstart within bounds and their bitmap bits marked as allocated.
However, this approach fails to properly validate cases where order-0 bits are incorrectly cleared (0), allowing some invalid configurations to pass:
corrupt integral
order 3 1 1
order 2 1 1 1 1
order 1 1 1 1 1 1 1 1 1
order 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Here we get two adjacent free blocks at order-0 with inconsistent higher-order state, and the right one shows the correct scenario.
The root cause is insufficient validation of order-0 zero bits. To fix this and improve completeness without significant performance cost, we refine the logic:
1. Maintain the top-down higher-order validation, but we no longer check the cases where the higher-order bit is 0, as this case will be covered in step 2.
2. Enhance order-0 checking by examining pairs of bits:
- If either bit in a pair is set (1), all corresponding higher-order bits must not be free.
- If both bits are clear (0), then exactly one of the corresponding higher-order bits must be free
3. Keep the preallocation (pa) validation unchanged.
This change closes the validation gap, ensuring illegal buddy states involving order-0 are correctly detected, while removing redundant checks and maintaining efficiency.
Message-ID: <[email protected]>
--- fs/ext4/mballoc.c | 49 +++++++++++++++++++++++++++++++---------------- 1 file changed, 32 insertions(+), 17 deletions(-)
fs/ext4/mballoc.c +32 -17
@@ -602,6 +602,24 @@ do { \ } \ }while (0 ) +/* +* Perform buddy integrity check with the following steps: +* +* 1. Top-down validation (from highest order down to order 1, excluding order-0 bitmap): +* For each pair of adjacent orders, if a higher-order bit is set (indicating a free block), +* at most one of the two corresponding lower-order bits may be clear (free). +* +* 2. Order-0 (bitmap) validation, performed on bit pairs: +* - If either bit in a pair is set (1, allocated), then all corresponding higher-order bits +* must not be free (0). +* - If both bits in a pair are clear (0, free), then exactly one of the corresponding +* higher-order bits must be free (0). +* +* 3. Preallocation (pa) list validation: +* For each preallocated block (pa) in the group: +* - Verify that pa_pstart falls within the bounds of this block group. +* - Ensure the corresponding bit(s) in the order-0 bitmap are marked as allocated (1). +*/ static void __mb_check_buddy(struct ext4_buddy *e4b, char *file,const char *function,int line) {
@@ -646,15 +664,6 @@ static void __mb_check_buddy(struct ext4_buddy *e4b, char *file,continue ; } -/* both bits in buddy2 must be 1 */ -MB_CHECK_ASSERT (mb_test_bit (i <<1 , buddy2)); -MB_CHECK_ASSERT (mb_test_bit ((i <<1 ) +1 , buddy2)); - -for (j =0 ; j < (1 << order); j++) { - k = (i * (1 << order)) + j; -MB_CHECK_ASSERT ( - !mb_test_bit (k, e4b->bd_bitmap)); - } count++; }MB_CHECK_ASSERT (e4b->bd_info->bb_counters[order] == count);
@@ -670,15 +679,21 @@ static void __mb_check_buddy(struct ext4_buddy *e4b, char *file, fragments++; fstart = i; } -continue ; + }else { + fstart =-1 ; } - fstart =-1 ; -/* check used bits only */ -for (j =0 ; j < e4b->bd_blkbits +1 ; j++) { - buddy2 =mb_find_buddy (e4b, j, &max2); - k = i >> j; -MB_CHECK_ASSERT (k < max2); -MB_CHECK_ASSERT (mb_test_bit (k, buddy2)); +if (!(i &1 )) { +int in_use, zero_bit_count =0 ; + + in_use =mb_test_bit (i, buddy) ||mb_test_bit (i +1 , buddy); +for (j =1 ; j < e4b->bd_blkbits +2 ; j++) { + buddy2 =mb_find_buddy (e4b, j, &max2); + k = i >> j; +MB_CHECK_ASSERT (k < max2); +if (!mb_test_bit (k, buddy2)) + zero_bit_count++; + } +MB_CHECK_ASSERT (zero_bit_count == !in_use); } }MB_CHECK_ASSERT (!EXT4_MB_GRP_NEED_INIT (e4b->bd_info));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/451 virtio: fix virtqueue_set_affinity() docs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit 43236d8bbafff94b423afecc4a692dd90602d426 ]
Rewrite the comment for better grammar and clarity.
Message-Id: <e317e91bd43b070e5eaec0ebbe60c5749d02e2dd.1763026134.git.mst@redhat.com>
--- include/linux/virtio_config.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/virtio_config.h +1 -1
@@ -247,7 +247,7 @@ const char *virtio_bus_name(struct virtio_device *vdev)* @vq: the virtqueue * @cpu: the cpu no. * -* Pay attention the function are best-effort: the affinity hint may not be set +* Note that this function is best-effort: the affinity hint may not be set * due to config support, irq type and sharing. * */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/451 regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: sparkhuang <[email protected]>
[ Upstream commit 0cc15a10c3b4ab14cd71b779fd5c9ca0cb2bc30d ]
regulator_supply_alias_list was accessed without any locking in regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias(). Concurrent registration, unregistration and lookups can race, leading to:
1 use-after-free if an alias entry is removed while being read, 2 duplicate entries when two threads register the same alias, 3 inconsistent alias mappings observed by consumers.
Protect all traversals, insertions and deletions on regulator_supply_alias_list with the existing regulator_list_mutex.
--- drivers/regulator/core.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-)
drivers/regulator/core.c +20 -12
@@ -1810,6 +1810,7 @@ static void regulator_supply_alias(struct device **dev, const char **supply) {struct regulator_supply_alias *map; +mutex_lock (®ulator_list_mutex); map =regulator_find_supply_alias (*dev, *supply);if (map) { dev_dbg(*dev, "Mapping supply %s to %s,%s\n",
@@ -1818,6 +1819,7 @@ static void regulator_supply_alias(struct device **dev, const char **supply) *dev = map->alias_dev; *supply = map->alias_supply; } +mutex_unlock (®ulator_list_mutex); }static int regulator_match (struct device *dev,const void *data)
@@ -2296,22 +2298,26 @@ int regulator_register_supply_alias(struct device *dev, const char *id, const char *alias_id) {struct regulator_supply_alias *map; +struct regulator_supply_alias *new_map; - map =regulator_find_supply_alias (dev, id); -if (map) -return -EEXIST ; - - map =kzalloc (sizeof (struct regulator_supply_alias ),GFP_KERNEL ); -if (!map) + new_map =kzalloc (sizeof (struct regulator_supply_alias ),GFP_KERNEL ); +if (!new_map)return -ENOMEM ; - map->src_dev = dev; - map->src_supply = id; - map->alias_dev = alias_dev; - map->alias_supply = alias_id; - -list_add (&map->list, ®ulator_supply_alias_list); +mutex_lock (®ulator_list_mutex); + map =regulator_find_supply_alias (dev, id); +if (map) { +mutex_unlock (®ulator_list_mutex); +kfree (new_map); +return -EEXIST ; + } + new_map->src_dev = dev; + new_map->src_supply = id; + new_map->alias_dev = alias_dev; + new_map->alias_supply = alias_id; +list_add (&new_map->list, ®ulator_supply_alias_list); +mutex_unlock (®ulator_list_mutex);pr_info ("Adding alias for supply %s,%s -> %s,%s\n" , id,dev_name (dev), alias_id,dev_name (alias_dev));
@@ -2331,11 +2337,13 @@ void regulator_unregister_supply_alias(struct device *dev, const char *id) {struct regulator_supply_alias *map; +mutex_lock (®ulator_list_mutex); map =regulator_find_supply_alias (dev, id);if (map) {list_del (&map->list);kfree (map); } +mutex_unlock (®ulator_list_mutex); }EXPORT_SYMBOL_GPL (regulator_unregister_supply_alias);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/451 netfilter: nft_connlimit: move stateful fields out of expression data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 37f319f37d9005693dff085bb72852eeebc803ef ]
In preparation for the rule blob representation.
Stable-dep-of: 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped")
--- net/netfilter/nft_connlimit.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
net/netfilter/nft_connlimit.c +18 -8
@@ -14,7 +14,7 @@#include <net/netfilter/nf_conntrack_zones.h> struct nft_connlimit { -struct nf_conncount_list list; +struct nf_conncount_list *list;u32 limit;bool invert; };
@@ -43,12 +43,12 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,return ; } -if (nf_conncount_add (nft_net (pkt), &priv->list, tuple_ptr, zone)) { +if (nf_conncount_add (nft_net (pkt), priv->list, tuple_ptr, zone)) { regs->verdict.code =NF_DROP ;return ; } - count = priv->list.count; + count = priv->list->count;if ((count > priv->limit) ^ priv->invert) { regs->verdict.code =NFT_BREAK ;
@@ -76,7 +76,11 @@ static int nft_connlimit_do_init(const struct nft_ctx *ctx, invert = true; } -nf_conncount_list_init (&priv->list); + priv->list =kmalloc (sizeof (*priv->list),GFP_KERNEL ); +if (!priv->list) +return -ENOMEM ; + +nf_conncount_list_init (priv->list); priv->limit = limit; priv->invert = invert;
@@ -87,7 +91,8 @@ static void nft_connlimit_do_destroy(const struct nft_ctx *ctx, struct nft_connlimit *priv) {nf_ct_netns_put (ctx->net, ctx->family); -nf_conncount_cache_free (&priv->list); +nf_conncount_cache_free (priv->list); +kfree (priv->list); } static int nft_connlimit_do_dump(struct sk_buff *skb,
@@ -200,7 +205,11 @@ static int nft_connlimit_clone(struct nft_expr *dst, const struct nft_expr *src,struct nft_connlimit *priv_dst =nft_expr_priv (dst);struct nft_connlimit *priv_src =nft_expr_priv (src); -nf_conncount_list_init (&priv_dst->list); + priv_dst->list =kmalloc (sizeof (*priv_dst->list),GFP_ATOMIC ); +if (priv_dst->list) +return -ENOMEM ; + +nf_conncount_list_init (priv_dst->list); priv_dst->limit = priv_src->limit; priv_dst->invert = priv_src->invert;
@@ -212,7 +221,8 @@ static void nft_connlimit_destroy_clone(const struct nft_ctx *ctx, {struct nft_connlimit *priv =nft_expr_priv (expr); -nf_conncount_cache_free (&priv->list); +nf_conncount_cache_free (priv->list); +kfree (priv->list); }static bool nft_connlimit_gc (struct net *net,const struct nft_expr *expr)
@@ -221,7 +231,7 @@ static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)bool ret;local_bh_disable (); - ret =nf_conncount_gc_list (net, &priv->list); + ret =nf_conncount_gc_list (net, priv->list);local_bh_enable ();return ret;
Signature · 1 line
2.51.0
Re: [PATCH 5.10 110/451] netfilter: nft_connlimit: move stateful fields out of expression data
Quoted 9 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit
37f319f37d9005693dff085bb72852eeebc803ef]In preparation for the rule blob representation.
[...]
net/netfilter/nft_connlimit.c static int nft_connlimit_clone(struct nft_expr *dst, const struct nft_expr *src, · line 210
Quoted 8 lines
net/netfilter/nft_connlimit.c +3
-1@@ -200,7 +205,11 @@ static int nft_connlimit_clone(struct nft_expr *dst, const struct nft_expr *src,struct nft_connlimit *priv_dst =nft_expr_priv (dst);struct nft_connlimit *priv_src =nft_expr_priv (src); -nf_conncount_list_init (&priv_dst->list); + priv_dst->list =kmalloc (sizeof (*priv_dst->list),GFP_ATOMIC ); +if (priv_dst->list) +return -ENOMEM ;
[...]
This condition is inverted. Fixed upstream by:
commit 51edb2ff1c6fc27d3fa73f0773a31597ecd8e230
Author: Pablo Neira Ayuso <[email protected]> Date: Mon Jan 10 20:48:17 2022 +0100
netfilter: nf_tables: typo NULL check in _clone() function
but that won't apply directly.
Ben.
Signature · 4 lines
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill GatesGreg Kroah-Hartman
maintainerPATCH 111/451 netfilter: nf_conncount: reduce unnecessary GC
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Tu <[email protected]>
[ Upstream commit d265929930e2ffafc744c0ae05fb70acd53be1ee ]
Currently nf_conncount can trigger garbage collection (GC) at multiple places. Each GC process takes a spin_lock_bh to traverse the nf_conncount_list. We found that when testing port scanning use two parallel nmap, because the number of connection increase fast, the nf_conncount_count and its subsequent call to __nf_conncount_add take too much time, causing several CPU lockup. This happens when user set the conntrack limit to +20,000, because the larger the limit, the longer the list that GC has to traverse.
The patch mitigate the performance issue by avoiding unnecessary GC with a timestamp. Whenever nf_conncount has done a GC, a timestamp is updated, and beforce the next time GC is triggered, we make sure it's more than a jiffies.
By doin this we can greatly reduce the CPU cycles and avoid the softirq lockup.
To reproduce it in OVS,
$ ovs-appctl dpctl/ct-set-limits zone=1,limit=20000 $ ovs-appctl dpctl/ct-get-limits
At another machine, runs two nmap
$ nmap -p1- <IP> $ nmap -p1- <IP>
Stable-dep-of: 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped")
--- include/net/netfilter/nf_conntrack_count.h | 1 + net/netfilter/nf_conncount.c | 11 +++++++++++ 2 files changed, 12 insertions(+)
include/net/netfilter/nf_conntrack_count.h +1 -0
@@ -10,6 +10,7 @@ struct nf_conncount_data;struct nf_conncount_list {spinlock_t list_lock; +u32 last_gc;/* jiffies at most recent gc */ struct list_head head;/* connections with the same filtering key */ unsigned int count;/* length of list */ };
net/netfilter/nf_conncount.c +11 -0
@@ -132,6 +132,9 @@ static int __nf_conncount_add(struct net *net,struct nf_conn *found_ct;unsigned int collect =0 ; +if (time_is_after_eq_jiffies ((unsigned long )list->last_gc)) + goto add_new_node; +/* check the saved connections */ list_for_each_entry_safe (conn, conn_n, &list->head, node) {if (collect >CONNCOUNT_GC_MAX_NODES )
@@ -177,6 +180,7 @@ static int __nf_conncount_add(struct net *net,nf_ct_put (found_ct); } +add_new_node:if (WARN_ON_ONCE (list->count >INT_MAX ))return -EOVERFLOW ;
@@ -190,6 +194,7 @@ static int __nf_conncount_add(struct net *net, conn->jiffies32 = (u32 )jiffies;list_add_tail (&conn->node, &list->head); list->count++; + list->last_gc = (u32 )jiffies;return 0 ; }
@@ -214,6 +219,7 @@ void nf_conncount_list_init(struct nf_conncount_list *list)spin_lock_init (&list->list_lock);INIT_LIST_HEAD (&list->head); list->count =0 ; + list->last_gc = (u32 )jiffies; }EXPORT_SYMBOL_GPL (nf_conncount_list_init);
@@ -227,6 +233,10 @@ bool nf_conncount_gc_list(struct net *net,unsigned int collected =0 ;bool ret = false; +/* don't bother if we just did GC */ +if (time_is_after_eq_jiffies ((unsigned long )READ_ONCE (list->last_gc))) +return false; +/* don't bother if other cpu is already doing GC */ if (!spin_trylock (&list->list_lock))return false;
@@ -258,6 +268,7 @@ bool nf_conncount_gc_list(struct net *net,if (!list->count) ret = true; + list->last_gc = (u32 )jiffies;spin_unlock (&list->list_lock);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/451 netfilter: nf_conncount: rework API to use sk_buff directly
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit be102eb6a0e7c03db00e50540622f4e43b2d2844 ]
When using nf_conncount infrastructure for non-confirmed connections a duplicated track is possible due to an optimization introduced since commit d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC").
In order to fix this introduce a new conncount API that receives directly an sk_buff struct. It fetches the tuple and zone and the corresponding ct from it. It comes with both existing conncount variants nf_conncount_count_skb() and nf_conncount_add_skb(). In addition remove the old API and adjust all the users to use the new one.
This way, for each sk_buff struct it is possible to check if there is a ct present and already confirmed. If so, skip the add operation.
Stable-dep-of: 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped")
--- include/net/netfilter/nf_conntrack_count.h | 17 +- net/netfilter/nf_conncount.c | 177 ++++++++++++++------- net/netfilter/nft_connlimit.c | 21 +-- net/netfilter/xt_connlimit.c | 14 +- net/openvswitch/conntrack.c | 16 +- 5 files changed, 142 insertions(+), 103 deletions(-)
include/net/netfilter/nf_conntrack_count.h +8 -9
@@ -20,15 +20,14 @@ struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int familyvoid nf_conncount_destroy (struct net *net,unsigned int family,struct nf_conncount_data *data); -unsigned int nf_conncount_count (struct net *net, -struct nf_conncount_data *data, -const u32 *key, -const struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_zone *zone); - -int nf_conncount_add (struct net *net,struct nf_conncount_list *list, -const struct nf_conntrack_tuple *tuple, -const struct nf_conntrack_zone *zone); +unsigned int nf_conncount_count_skb (struct net *net, +const struct sk_buff *skb, +u16 l3num, +struct nf_conncount_data *data, +const u32 *key); + +int nf_conncount_add_skb (struct net *net,const struct sk_buff *skb, +u16 l3num,struct nf_conncount_list *list);void nf_conncount_list_init (struct nf_conncount_list *list);
net/netfilter/nf_conncount.c +120 -57
298 lines not on this page · raw message
net/netfilter/nft_connlimit.c +3 -18
@@ -24,26 +24,11 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,const struct nft_pktinfo *pkt, const struct nft_set_ext *ext) { - const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt; -const struct nf_conntrack_tuple *tuple_ptr; -struct nf_conntrack_tuple tuple; -enum ip_conntrack_info ctinfo; -const struct nf_conn *ct; unsigned int count; +int err; - tuple_ptr = &tuple; - - ct =nf_ct_get (pkt->skb, &ctinfo); -if (ct !=NULL ) { - tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple; - zone =nf_ct_zone (ct); - }else if (!nf_ct_get_tuplepr (pkt->skb,skb_network_offset (pkt->skb), -nft_pf (pkt),nft_net (pkt), &tuple)) { - regs->verdict.code =NF_DROP ; -return ; - } - -if (nf_conncount_add (nft_net (pkt), priv->list, tuple_ptr, zone)) { + err =nf_conncount_add_skb (nft_net (pkt), pkt->skb,nft_pf (pkt), priv->list); +if (err) { regs->verdict.code =NF_DROP ;return ; }
net/netfilter/xt_connlimit.c +3 -11
@@ -31,8 +31,6 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) {struct net *net =xt_net (par);const struct xt_connlimit_info *info = par->matchinfo; -struct nf_conntrack_tuple tuple; -const struct nf_conntrack_tuple *tuple_ptr = &tuple;const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;enum ip_conntrack_info ctinfo;const struct nf_conn *ct;
@@ -40,13 +38,8 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)u32 key[5 ]; ct =nf_ct_get (skb, &ctinfo); -if (ct !=NULL ) { - tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple; +if (ct) zone =nf_ct_zone (ct); - }else if (!nf_ct_get_tuplepr (skb,skb_network_offset (skb), -xt_family (par), net, &tuple)) { - goto hotdrop; - }if (xt_family (par) ==NFPROTO_IPV6 ) {const struct ipv6hdr *iph =ipv6_hdr (skb);
@@ -69,10 +62,9 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) key[1 ] = zone->id; } - connections =nf_conncount_count (net, info->data, key, tuple_ptr, - zone); + connections =nf_conncount_count_skb (net, skb,xt_family (par), info->data, key);if (connections ==0 ) -/* kmalloc failed, drop it entirely */ +/* kmalloc failed or tuple couldn't be found, drop it entirely */ goto hotdrop;return (connections > info->limit) ^ !!(info->flags &XT_CONNLIMIT_INVERT );
net/openvswitch/conntrack.c +8 -8
@@ -1152,8 +1152,8 @@ static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone) }static int ovs_ct_check_limit (struct net *net, -const struct ovs_conntrack_info *info, -const struct nf_conntrack_tuple *tuple) +const struct sk_buff *skb, +const struct ovs_conntrack_info *info) {struct ovs_net *ovs_net =net_generic (net, ovs_net_id);const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
@@ -1166,8 +1166,9 @@ static int ovs_ct_check_limit(struct net *net,if (per_zone_limit ==OVS_CT_LIMIT_UNLIMITED )return 0 ; - connections =nf_conncount_count (net, ct_limit_info->data, - &conncount_key, tuple, &info->zone); + connections =nf_conncount_count_skb (net, skb, info->family, + ct_limit_info->data, + &conncount_key);if (connections > per_zone_limit)return -ENOMEM ;
@@ -1196,8 +1197,7 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,#if IS_ENABLED (CONFIG_NETFILTER_CONNCOUNT )if (static_branch_unlikely (&ovs_ct_limit_enabled)) {if (!nf_ct_is_confirmed (ct)) { - err =ovs_ct_check_limit (net, info, - &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple); + err =ovs_ct_check_limit (net, skb, info);if (err) { net_warn_ratelimited("openvswitch: zone: %u " "exceeds conntrack limit\n",
@@ -2046,8 +2046,8 @@ static int __ovs_ct_limit_get_zone_limit(struct net *net, zone_limit.limit = limit;nf_ct_zone_init (&ct_zone, zone_id,NF_CT_DEFAULT_ZONE_DIR ,0 ); - zone_limit.count =nf_conncount_count (net, data, &conncount_key,NULL , - &ct_zone); + zone_limit.count =nf_conncount_count_skb (net,NULL ,0 , data, + &conncount_key);return nla_put_nohdr (reply,sizeof (zone_limit), &zone_limit); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/451 netfilter: nft_connlimit: update the count if add was skipped
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e ]
Connlimit expression can be used for all kind of packets and not only for packets with connection state new. See this ruleset as example:
table ip filter {
chain input {
type filter hook input priority filter; policy accept;
tcp dport 22 ct count over 4 counter
}
}Currently, if the connection count goes over the limit the counter will count the packets. When a connection is closed, the connection count won't decrement as it should because it is only updated for new connections due to an optimization on __nf_conncount_add() that prevents updating the list if the connection is duplicated.
To solve this problem, check whether the connection was skipped and if so, update the list. Adjust count_tree() too so the same fix is applied for xt_connlimit.
--- net/netfilter/nf_conncount.c | 12 ++++++++---- net/netfilter/nft_connlimit.c | 13 +++++++++++-- 2 files changed, 19 insertions(+), 6 deletions(-)
net/netfilter/nf_conncount.c +8 -4
@@ -179,7 +179,7 @@ static int __nf_conncount_add(struct net *net,if (ct &&nf_ct_is_confirmed (ct)) {if (refcounted)nf_ct_put (ct); -return 0 ; +return -EEXIST ; }if (time_is_after_eq_jiffies ((unsigned long )list->last_gc))
@@ -398,7 +398,7 @@ insert_tree(struct net *net,int ret; ret =nf_conncount_add_skb (net, skb, l3num, &rbconn->list); -if (ret) +if (ret && ret != -EEXIST ) count =0 ;/* hotdrop */ else count = rbconn->list.count;
@@ -501,10 +501,14 @@ count_tree(struct net *net,/* same source network -> be counted! */ ret =__nf_conncount_add (net, skb, l3num, &rbconn->list);spin_unlock_bh (&rbconn->list.list_lock); -if (ret) +if (ret && ret != -EEXIST ) {return 0 ;/* hotdrop */ -else + }else { +/* -EEXIST means add was skipped, update the list */ +if (ret == -EEXIST ) +nf_conncount_gc_list (net, &rbconn->list);return rbconn->list.count; + } } }
net/netfilter/nft_connlimit.c +11 -2
@@ -29,8 +29,17 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv, err =nf_conncount_add_skb (nft_net (pkt), pkt->skb,nft_pf (pkt), priv->list);if (err) { - regs->verdict.code =NF_DROP ; -return ; +if (err == -EEXIST ) { +/* Call gc to update the list count if any connection has +* been closed already. This is useful for softlimit +* connections like limiting bandwidth based on a number +* of open connections. +*/ +nf_conncount_gc_list (nft_net (pkt), priv->list); + }else { + regs->verdict.code =NF_DROP ; +return ; + } } count = priv->list->count;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/451 mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Stepchenko <[email protected]>
[ Upstream commit c909fec69f84b39e63876c69b9df2c178c6b76ba ]
There are several places where a value of type 'int' is shifted by lpddr->chipshift. lpddr->chipshift is derived from QINFO geometry and might reach 31 when QINFO reports a 2 GiB size - the maximum supported by LPDDR(1) compliant chips. This may cause unexpected sign-extensions when casting the integer value to the type of 'unsigned long'.
Use '1UL << lpddr->chipshift' and cast 'j' to unsigned long before shifting so the computation is performed at the destination width.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/mtd/lpddr/lpddr_cmds.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mtd/lpddr/lpddr_cmds.c +4 -4
@@ -79,7 +79,7 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)mutex_init (&shared[i].lock);for (j =0 ; j < lpddr->qinfo->HWPartsNum; j++) { *chip = lpddr->chips[i]; - chip->start += j << lpddr->chipshift; + chip->start += (unsigned long )j << lpddr->chipshift; chip->oldstate = chip->state =FL_READY ; chip->priv = &shared[i];/* those should be reset too since
@@ -562,7 +562,7 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr, size_t len,break ;if ((len + ofs -1 ) >> lpddr->chipshift) - thislen = (1 <<lpddr->chipshift) - ofs; + thislen = (1UL << lpddr->chipshift) - ofs;else thislen = len;/* get the chip */
@@ -578,7 +578,7 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr, size_t len, len -= thislen; ofs =0 ; - last_end +=1 << lpddr->chipshift; + last_end +=1UL << lpddr->chipshift; chipnum++; chip = &lpddr->chips[chipnum]; }
@@ -604,7 +604,7 @@ static int lpddr_unpoint (struct mtd_info *mtd, loff_t adr, size_t len)break ;if ((len + ofs -1 ) >> lpddr->chipshift) - thislen = (1 <<lpddr->chipshift) - ofs; + thislen = (1UL << lpddr->chipshift) - ofs;else thislen = len;
Signature · 1 line
2.51.0
Re: [PATCH 5.10 114/451] mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
Quoted 8 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Stepchenko <[email protected]>
[ Upstream commit
c909fec69f84b39e63876c69b9df2c178c6b76ba]
Quoted 8 lines
There are several places where a value of type 'int' is shifted by
lpddr->chipshift.lpddr->chipshiftis derived from QINFO geometry and might reach 31 when QINFO reports a 2 GiB size - the maximum supported by LPDDR(1) compliant chips. This may cause unexpected sign-extensions when casting the integer value to the type of 'unsigned long'.Use '1UL <<
lpddr->chipshift' and cast 'j' to unsigned long before shifting so the computation is performed at the destination width.
[...]
In lpddr_point() and lpddr_unpoint(), chipnum is also shifted left by lpddr->chipshift. Don't those expressions also need to be changed?
Ben.
Signature · 4 lines
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill GatesGreg Kroah-Hartman
maintainerPATCH 115/451 net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 9fefc78f7f02d71810776fdeb119a05a946a27cc ]
In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes that the parent qdisc will enqueue the current packet. However, this assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent qdisc stops enqueuing current packet, leaving the tree qlen/backlog accounting inconsistent. This mismatch can lead to a NULL dereference (e.g., when the parent Qdisc is qfq_qdisc).
This patch computes the qlen/backlog delta in a more robust way by observing the difference before and after the series of cake_drop() calls, and then compensates the qdisc tree accounting if cake_enqueue() returns NET_XMIT_CN.
To ensure correct compensation when ACK thinning is enabled, a new variable is introduced to keep qlen unchanged.
--- net/sched/sch_cake.c | 58 ++++++++++++++++++++++++-------------------- 1 file changed, 32 insertions(+), 26 deletions(-)
net/sched/sch_cake.c +32 -26
@@ -1608,7 +1608,6 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)__qdisc_drop (skb, to_free); sch->q.qlen--; -qdisc_tree_reduce_backlog (sch,1 , len);cake_heapify (q,0 );
@@ -1754,14 +1753,14 @@ static void cake_reconfigure(struct Qdisc *sch);static s32 cake_enqueue (struct sk_buff *skb,struct Qdisc *sch,struct sk_buff **to_free) { +u32 idx, tin, prev_qlen, prev_backlog, drop_id;struct cake_sched_data *q =qdisc_priv (sch); -int len =qdisc_pkt_len (skb); -int ret; +int len =qdisc_pkt_len (skb), ret;struct sk_buff *ack =NULL ;ktime_t now =ktime_get ();struct cake_tin_data *b;struct cake_flow *flow; -u32 idx, tin; +bool same_flow = false;/* choose flow to insert into */ idx =cake_classify (sch, &b, skb, q->flow_mode, &ret);
@@ -1834,6 +1833,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,consume_skb (skb); }else {/* not splitting */ +int ack_pkt_len =0 ; +cobalt_set_enqueue_time (skb, now);get_cobalt_cb (skb)->adjusted_len =cake_overhead (q, skb);flow_queue_add (flow, skb);
@@ -1844,13 +1845,13 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,if (ack) { b->ack_drops++; sch->qstats.drops++; - b->bytes +=qdisc_pkt_len (ack); - len -=qdisc_pkt_len (ack); + ack_pkt_len =qdisc_pkt_len (ack); + b->bytes += ack_pkt_len; q->buffer_used += skb->truesize - ack->truesize;if (q->rate_flags &CAKE_FLAG_INGRESS )cake_advance_shaper (q, b, ack, now, true); -qdisc_tree_reduce_backlog (sch,1 ,qdisc_pkt_len (ack)); +qdisc_tree_reduce_backlog (sch,1 , ack_pkt_len);consume_skb (ack); }else { sch->q.qlen++;
@@ -1859,11 +1860,11 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,/* stats */ b->packets++; - b->bytes += len; - b->backlogs[idx] += len; - b->tin_backlog += len; - sch->qstats.backlog += len; - q->avg_window_bytes += len; + b->bytes += len - ack_pkt_len; + b->backlogs[idx] += len - ack_pkt_len; + b->tin_backlog += len - ack_pkt_len; + sch->qstats.backlog += len - ack_pkt_len; + q->avg_window_bytes += len - ack_pkt_len; }if (q->overflow_timeout)
@@ -1938,24 +1939,29 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,if (q->buffer_used > q->buffer_max_used) q->buffer_max_used = q->buffer_used; -if (q->buffer_used > q->buffer_limit) { -bool same_flow = false; -u32 dropped =0 ; -u32 drop_id; +if (q->buffer_used <= q->buffer_limit) +return NET_XMIT_SUCCESS ; -while (q->buffer_used > q->buffer_limit) { - dropped++; - drop_id =cake_drop (sch, to_free); + prev_qlen = sch->q.qlen; + prev_backlog = sch->qstats.backlog; -if ((drop_id >>16 ) == tin && - (drop_id &0xFFFF ) == idx) - same_flow = true; - } - b->drop_overlimit += dropped; +while (q->buffer_used > q->buffer_limit) { + drop_id =cake_drop (sch, to_free); +if ((drop_id >>16 ) == tin && + (drop_id &0xFFFF ) == idx) + same_flow = true; + } + + prev_qlen -= sch->q.qlen; + prev_backlog -= sch->qstats.backlog; + b->drop_overlimit += prev_qlen; -if (same_flow) -return NET_XMIT_CN ; +if (same_flow) { +qdisc_tree_reduce_backlog (sch, prev_qlen -1 , + prev_backlog - len); +return NET_XMIT_CN ; } +qdisc_tree_reduce_backlog (sch, prev_qlen, prev_backlog);return NET_XMIT_SUCCESS ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/451 perf tools: Fix split kallsyms DSO counting
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit ad0b9c4865b98dc37f4d606d26b1c19808796805 ]
It's counted twice as it's increased after calling maps__insert(). I guess we want to increase it only after it's added properly.
--- tools/perf/util/symbol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/symbol.c +2 -2
@@ -893,11 +893,11 @@ static int maps__split_kallsyms(struct maps *kmaps, struct dso *dso, u64 delta,if (dso->kernel ==DSO_SPACE__KERNEL_GUEST )snprintf (dso_name,sizeof (dso_name),"[guest.kernel].%d" , - kernel_range++); + kernel_range);else snprintf (dso_name,sizeof (dso_name),"[kernel].%d" , - kernel_range++); + kernel_range); ndso =dso__new (dso_name);if (ndso ==NULL )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/451 pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthijs Kooijman <[email protected]>
[ Upstream commit b5fe46efc147516a908d2d31bf40eb858ab76d51 ]
The pinctrl-single driver handles pin_config_set by looking up the requested setting in a DT-defined lookup table, which defines what bits correspond to each setting. There is no way to add PIN_CONFIG_BIAS_DISABLE entries to the table, since there is instead code to disable the bias by applying the disable values of both the pullup and pulldown entries in the table.
However, this code is inside the table-lookup loop, so it would only execute if there is an entry for PIN_CONFIG_BIAS_DISABLE in the table, which can never exist, so this code never runs.
This commit lifts the offending code out of the loop, so it just executes directly whenever PIN_CONFIG_BIAS_DISABLE is requested, skippipng the table lookup loop.
This also introduces a new param variable to make the code slightly more readable.
This bug seems to have existed when this code was first merged in commit 9dddb4df90d13 ("pinctrl: single: support generic pinconf"). Earlier versions of this patch did have an entry for PIN_CONFIG_BIAS_DISABLE in the lookup table, but that was removed, which is probably how this bug was introduced.
Message-ID: <[email protected]>
Stable-dep-of: 61d1bb53547d ("pinctrl: single: Fix incorrect type for error return variable")
--- drivers/pinctrl/pinctrl-single.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/pinctrl/pinctrl-single.c +12 -6
@@ -556,21 +556,30 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,unsigned offset =0 , shift =0 , i, data, ret;u32 arg;int j; +enum pin_config_param param; ret =pcs_get_function (pctldev, pin, &func);if (ret)return ret;for (j =0 ; j < num_configs; j++) { + param =pinconf_to_config_param (configs[j]); + +/* BIAS_DISABLE has no entry in the func->conf table */ +if (param ==PIN_CONFIG_BIAS_DISABLE ) { +/* This just disables all bias entries */ +pcs_pinconf_clear_bias (pctldev, pin); +continue ; + } +for (i =0 ; i < func->nconfs; i++) { -if (pinconf_to_config_param (configs[j]) - != func->conf[i].param) +if (param != func->conf[i].param)continue ; offset = pin * (pcs->width /BITS_PER_BYTE ); data = pcs->read (pcs->base + offset); arg =pinconf_to_config_argument (configs[j]); -switch (func->conf[i].param) { +switch (param) {/* 2 parameters */ case PIN_CONFIG_INPUT_SCHMITT :case PIN_CONFIG_DRIVE_STRENGTH :
@@ -581,9 +590,6 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev, data |= (arg << shift) & func->conf[i].mask;break ;/* 4 parameters */ -case PIN_CONFIG_BIAS_DISABLE : -pcs_pinconf_clear_bias (pctldev, pin); -break ;case PIN_CONFIG_BIAS_PULL_DOWN :case PIN_CONFIG_BIAS_PULL_UP :if (arg) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/451 pinctrl: single: Fix incorrect type for error return variable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 61d1bb53547d42c6bdaec9da4496beb3a1a05264 ]
pcs_pinconf_get() and pcs_pinconf_set() declare ret as unsigned int, but assign it the return values of pcs_get_function() that may return negative error codes. This causes negative error codes to be converted to large positive values.
Change ret from unsigned int to int in both functions.
--- drivers/pinctrl/pinctrl-single.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-single.c +4 -3
@@ -490,7 +490,8 @@ static int pcs_pinconf_get(struct pinctrl_dev *pctldev,struct pcs_device *pcs =pinctrl_dev_get_drvdata (pctldev);struct pcs_function *func;enum pin_config_param param; -unsigned offset =0 , data =0 , i, j, ret; +unsigned offset =0 , data =0 , i, j; +int ret; ret =pcs_get_function (pctldev, pin, &func);if (ret)
@@ -553,9 +554,9 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev, {struct pcs_device *pcs =pinctrl_dev_get_drvdata (pctldev);struct pcs_function *func; -unsigned offset =0 , shift =0 , i, data, ret; +unsigned offset =0 , shift =0 , i, data;u32 arg; -int j; +int j, ret;enum pin_config_param param; ret =pcs_get_function (pctldev, pin, &func);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/451 fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 164312662ae9764b83b84d97afb25c42eb2be473 ]
The page allocated for vmem using __get_free_pages() is not freed on the error paths after it. Fix that by adding a corresponding __free_pages() call to the error path.
--- drivers/video/fbdev/ssd1307fb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/ssd1307fb.c +3 -1
@@ -676,7 +676,7 @@ static int ssd1307fb_probe(struct i2c_client *client)if (!ssd1307fb_defio) {dev_err (dev,"Couldn't allocate deferred io.\n" ); ret = -ENOMEM ; - goto fb_alloc_error; + goto fb_defio_error; } ssd1307fb_defio->delay =HZ / refreshrate;
@@ -756,6 +756,8 @@ static int ssd1307fb_probe(struct i2c_client *client)regulator_disable (par->vbat_reg); reset_oled_error:fb_deferred_io_cleanup (info); +fb_defio_error: +__free_pages (vmem,get_order (vmem_size)); fb_alloc_error:framebuffer_release (info);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/451 NFS: Clean up function nfs_mark_dir_for_revalidate()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit fd6d3feed041e96b84680d0bfc1e7abc8f65de92 ]
Stable-dep-of: bd4928ec799b ("NFS: Avoid changing nlink when file removes and attribute updates race")
--- fs/nfs/dir.c | 4 +--- fs/nfs/inode.c | 2 +- fs/nfs/internal.h | 3 ++- 3 files changed, 4 insertions(+), 5 deletions(-)
fs/nfs/dir.c +1 -3
@@ -1203,10 +1203,8 @@ int nfs_lookup_verify_inode(struct inode *inode, unsigned int flags)static void nfs_mark_dir_for_revalidate (struct inode *inode) { -struct nfs_inode *nfsi =NFS_I (inode); -spin_lock (&inode->i_lock); - nfsi->cache_validity |=NFS_INO_REVAL_PAGECACHE ; +nfs_set_cache_invalid (inode,NFS_INO_REVAL_PAGECACHE );spin_unlock (&inode->i_lock); }
fs/nfs/inode.c +1 -1
@@ -207,7 +207,7 @@ static bool nfs_has_xattr_cache(const struct nfs_inode *nfsi) }#endif -static void nfs_set_cache_invalid (struct inode *inode,unsigned long flags) +void nfs_set_cache_invalid (struct inode *inode,unsigned long flags) {struct nfs_inode *nfsi =NFS_I (inode);bool have_delegation =NFS_PROTO (inode)->have_delegation (inode,FMODE_READ );
fs/nfs/internal.h +2 -1
@@ -424,7 +424,8 @@ extern int nfs_write_inode(struct inode *, struct writeback_control *);extern int nfs_drop_inode (struct inode *);extern void nfs_clear_inode (struct inode *);extern void nfs_evict_inode (struct inode *); -void nfs_zap_acl_cache (struct inode *inode); +extern void nfs_zap_acl_cache (struct inode *inode); +extern void nfs_set_cache_invalid (struct inode *inode,unsigned long flags);extern bool nfs_check_cache_invalid (struct inode *,unsigned long );extern int nfs_wait_bit_killable (struct wait_bit_key *key,int mode);extern int nfs_wait_atomic_killable (atomic_t *p,unsigned int mode);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/451 NFS: Fix open coded versions of nfs_set_cache_invalid()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit ac46b3d768e4c2754f7b191b81e1bea582e11907 ]
nfs_set_cache_invalid() has code to handle delegations, and other optimisations, so let's use it when appropriate.
Stable-dep-of: bd4928ec799b ("NFS: Avoid changing nlink when file removes and attribute updates race")
--- fs/nfs/dir.c | 20 ++++++++++---------- fs/nfs/inode.c | 4 ++-- fs/nfs/unlink.c | 6 +++--- fs/nfs/write.c | 8 ++++---- 4 files changed, 19 insertions(+), 19 deletions(-)
fs/nfs/dir.c +10 -10
@@ -82,8 +82,9 @@ static struct nfs_open_dir_context *alloc_nfs_open_dir_context(struct inode *dirspin_lock (&dir->i_lock);if (list_empty (&nfsi->open_files) && (nfsi->cache_validity &NFS_INO_DATA_INVAL_DEFER )) - nfsi->cache_validity |=NFS_INO_INVALID_DATA | -NFS_INO_REVAL_FORCED ; +nfs_set_cache_invalid (dir, +NFS_INO_INVALID_DATA | +NFS_INO_REVAL_FORCED );list_add (&ctx->list, &nfsi->open_files);spin_unlock (&dir->i_lock);return ctx;
@@ -1500,10 +1501,9 @@ static void nfs_drop_nlink(struct inode *inode)if (inode->i_nlink >0 )drop_nlink (inode);NFS_I (inode)->attr_gencount =nfs_inc_attr_generation_counter (); -NFS_I (inode)->cache_validity |=NFS_INO_INVALID_CHANGE - |NFS_INO_INVALID_CTIME - |NFS_INO_INVALID_OTHER - |NFS_INO_REVAL_FORCED ; +nfs_set_cache_invalid ( + inode,NFS_INO_INVALID_CHANGE |NFS_INO_INVALID_CTIME | +NFS_INO_INVALID_OTHER |NFS_INO_REVAL_FORCED );spin_unlock (&inode->i_lock); }
@@ -1515,7 +1515,7 @@ static void nfs_dentry_iput(struct dentry *dentry, struct inode *inode) {if (S_ISDIR (inode->i_mode))/* drop any readdir cache as it could easily be old */ -NFS_I (inode)->cache_validity |=NFS_INO_INVALID_DATA ; +nfs_set_cache_invalid (inode,NFS_INO_INVALID_DATA );if (dentry->d_flags &DCACHE_NFSFS_RENAMED ) {nfs_complete_unlink (dentry, inode);
@@ -2290,9 +2290,9 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,if (error ==0 ) {spin_lock (&old_inode->i_lock);NFS_I (old_inode)->attr_gencount =nfs_inc_attr_generation_counter (); -NFS_I (old_inode)->cache_validity |=NFS_INO_INVALID_CHANGE - |NFS_INO_INVALID_CTIME - |NFS_INO_REVAL_FORCED ; +nfs_set_cache_invalid (old_inode,NFS_INO_INVALID_CHANGE | +NFS_INO_INVALID_CTIME | +NFS_INO_REVAL_FORCED );spin_unlock (&old_inode->i_lock); } out:
fs/nfs/inode.c +2 -2
@@ -1065,8 +1065,8 @@ void nfs_inode_attach_open_context(struct nfs_open_context *ctx)spin_lock (&inode->i_lock);if (list_empty (&nfsi->open_files) && (nfsi->cache_validity &NFS_INO_DATA_INVAL_DEFER )) - nfsi->cache_validity |=NFS_INO_INVALID_DATA | -NFS_INO_REVAL_FORCED ; +nfs_set_cache_invalid (inode,NFS_INO_INVALID_DATA | +NFS_INO_REVAL_FORCED );list_add_tail_rcu (&ctx->list, &nfsi->open_files);spin_unlock (&inode->i_lock); }
fs/nfs/unlink.c +3 -3
@@ -500,9 +500,9 @@ nfs_sillyrename(struct inode *dir, struct dentry *dentry)nfs_set_verifier (dentry,nfs_save_change_attribute (dir));spin_lock (&inode->i_lock);NFS_I (inode)->attr_gencount =nfs_inc_attr_generation_counter (); -NFS_I (inode)->cache_validity |=NFS_INO_INVALID_CHANGE - |NFS_INO_INVALID_CTIME - |NFS_INO_REVAL_FORCED ; +nfs_set_cache_invalid (inode,NFS_INO_INVALID_CHANGE | +NFS_INO_INVALID_CTIME | +NFS_INO_REVAL_FORCED );spin_unlock (&inode->i_lock);d_move (dentry, sdentry);break ;
fs/nfs/write.c +4 -4
@@ -260,9 +260,9 @@ static void nfs_set_pageerror(struct address_space *mapping)nfs_zap_mapping (mapping->host, mapping);/* Force file size revalidation */ spin_lock (&inode->i_lock); -NFS_I (inode)->cache_validity |=NFS_INO_REVAL_FORCED | -NFS_INO_REVAL_PAGECACHE | -NFS_INO_INVALID_SIZE ; +nfs_set_cache_invalid (inode,NFS_INO_REVAL_FORCED | +NFS_INO_REVAL_PAGECACHE | +NFS_INO_INVALID_SIZE );spin_unlock (&inode->i_lock); }
@@ -1614,7 +1614,7 @@ static int nfs_writeback_done(struct rpc_task *task,/* Deal with the suid/sgid bit corner case */ if (nfs_should_remove_suid (inode)) {spin_lock (&inode->i_lock); -NFS_I (inode)->cache_validity |=NFS_INO_INVALID_OTHER ; +nfs_set_cache_invalid (inode,NFS_INO_INVALID_OTHER );spin_unlock (&inode->i_lock); }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/451 NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 9019fb391de02cbff422090768b73afe9f6174df ]
After the success of an operation such as rmdir() or unlink(), we expect to add the dentry back to the dcache as an ordinary negative dentry. However in NFS, unless it is labelled with the appropriate verifier for the parent directory state, then nfs_lookup_revalidate will end up discarding that dentry and forcing a new lookup.
The fix is to ensure that we relabel the dentry appropriately on success.
Stable-dep-of: bd4928ec799b ("NFS: Avoid changing nlink when file removes and attribute updates race")
--- fs/nfs/dir.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
fs/nfs/dir.c +15 -3
@@ -1995,6 +1995,18 @@ static void nfs_dentry_handle_enoent(struct dentry *dentry)d_delete (dentry); } +static void nfs_dentry_remove_handle_error (struct inode *dir, +struct dentry *dentry,int error) +{ +switch (error) { +case -ENOENT : +d_delete (dentry); + fallthrough; +case 0 : +nfs_set_verifier (dentry,nfs_save_change_attribute (dir)); + } +} +int nfs_rmdir (struct inode *dir,struct dentry *dentry) {int error;
@@ -2017,6 +2029,7 @@ int nfs_rmdir(struct inode *dir, struct dentry *dentry)up_write (&NFS_I (d_inode (dentry))->rmdir_sem); }else error =NFS_PROTO (dir)->rmdir (dir, &dentry->d_name); +nfs_dentry_remove_handle_error (dir, dentry, error);trace_nfs_rmdir_exit (dir, dentry, error);return error;
@@ -2086,9 +2099,8 @@ int nfs_unlink(struct inode *dir, struct dentry *dentry) }spin_unlock (&dentry->d_lock); error =nfs_safe_remove (dentry); -if (!error || error == -ENOENT ) { -nfs_set_verifier (dentry,nfs_save_change_attribute (dir)); - }else if (need_rehash) +nfs_dentry_remove_handle_error (dir, dentry, error); +if (need_rehash)d_rehash (dentry); out:trace_nfs_unlink_exit (dir, dentry, error);
Signature · 1 line
2.51.0
Re: [PATCH 5.10 122/451] NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()
Quoted 8 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit
9019fb391de02cbff422090768b73afe9f6174df]
Quoted 8 lines
After the success of an operation such as
rmdir()orunlink(), we expect to add the dentry back to the dcache as an ordinary negative dentry. However in NFS, unless it is labelled with the appropriate verifier for the parent directory state, thennfs_lookup_revalidatewill end up discarding that dentry and forcing a new lookup.The fix is to ensure that we relabel the dentry appropriately on success.
[...]
It looks like we would need a further fix on top of this:
commit f16857e62bac60786104c020ad7c86e2163b2c5b
Author: NeilBrown <[email protected]> Date: Fri Aug 19 09:55:59 2022 +1000
NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT
Ben.
Signature · 4 lines
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill GatesGreg Kroah-Hartman
maintainerRe: [PATCH 5.10 122/451] NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()
Quoted 19 lines · Ben Hutchings
Quoted 16 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit
9019fb391de02cbff422090768b73afe9f6174df]After the success of an operation such as
rmdir()orunlink(), we expect to add the dentry back to the dcache as an ordinary negative dentry. However in NFS, unless it is labelled with the appropriate verifier for the parent directory state, thennfs_lookup_revalidatewill end up discarding that dentry and forcing a new lookup.The fix is to ensure that we relabel the dentry appropriately on success.
[...]
Quoted 7 lines
It looks like we would need a further fix on top of this:
commit
f16857e62bac60786104c020ad7c86e2163b2c5bAuthor: NeilBrown <[email protected]> Date: Fri Aug 19 09:55:59 2022 +1000NFS: unlink/rmdir shouldn't call
d_delete()twice on ENOENT
Yes, I had tried it, but it didn't apply properly. I've fixed it up now by hand as it should be added there, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 123/451 NFS: dont unhash dentry during unlink/rename
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 3c59366c207e4c6c6569524af606baf017a55c61 ]
NFS unlink() (and rename over existing target) must determine if the file is open, and must perform a "silly rename" instead of an unlink (or before rename) if it is. Otherwise the client might hold a file open which has been removed on the server.
Consequently if it determines that the file isn't open, it must block any subsequent opens until the unlink/rename has been completed on the server.
This is currently achieved by unhashing the dentry. This forces any open attempt to the slow-path for lookup which will block on i_rwsem on the directory until the unlink/rename completes. A future patch will change the VFS to only get a shared lock on i_rwsem for unlink, so this will no longer work.
Instead we introduce an explicit interlock. A special value is stored in dentry->d_fsdata while the unlink/rename is running and ->d_revalidate blocks while that value is present. When ->d_revalidate unblocks, the dentry will be invalid. This closes the race without requiring exclusion on i_rwsem.
d_fsdata is already used in two different ways.
1/ an IS_ROOT directory dentry might have a "devname" stored in
d_fsdata. Such a dentry doesn't have a name and so cannot be the target of unlink or rename. For safety we check if an old devname is still stored, and remove it if it is.
2/ a dentry with DCACHE_NFSFS_RENAMED set will have a 'struct
nfs_unlinkdata' stored in d_fsdata. While this is set maydelete() will fail, so an unlink or rename will never proceed on such a dentry.
Neither of these can be in effect when a dentry is the target of unlink or rename. So we can expect d_fsdata to be NULL, and store a special value ((void*)1) which is given the name NFS_FSDATA_BLOCKED to indicate that any lookup will be blocked.
The d_count() is incremented under d_lock() when a lookup finds the dentry, so we check d_count() is low, and set NFS_FSDATA_BLOCKED under the same lock to avoid any races.
Stable-dep-of: bd4928ec799b ("NFS: Avoid changing nlink when file removes and attribute updates race")
--- fs/nfs/dir.c | 72 +++++++++++++++++++++++++++++++----------- include/linux/nfs_fs.h | 9 ++++++ 2 files changed, 63 insertions(+), 18 deletions(-)
fs/nfs/dir.c +54 -18
@@ -1411,6 +1411,8 @@ __nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags,int ret;if (flags &LOOKUP_RCU ) { +if (dentry->d_fsdata ==NFS_FSDATA_BLOCKED ) +return -ECHILD ; parent =READ_ONCE (dentry->d_parent); dir =d_inode_rcu (parent);if (!dir)
@@ -1419,6 +1421,9 @@ __nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags,if (parent !=READ_ONCE (dentry->d_parent))return -ECHILD ; }else { +/* Wait for unlink to complete */ +wait_var_event (&dentry->d_fsdata, + dentry->d_fsdata !=NFS_FSDATA_BLOCKED ); parent =dget_parent (dentry); ret =reval (d_inode (parent), dentry, flags);dput (parent);
@@ -2079,7 +2084,6 @@ static int nfs_safe_remove(struct dentry *dentry)int nfs_unlink (struct inode *dir,struct dentry *dentry) {int error; -int need_rehash =0 ;dfprintk (VFS ,"NFS: unlink(%s/%lu, %pd)\n" , dir->i_sb->s_id, dir->i_ino, dentry);
@@ -2093,15 +2097,25 @@ int nfs_unlink(struct inode *dir, struct dentry *dentry) error =nfs_sillyrename (dir, dentry); goto out; } -if (!d_unhashed (dentry)) { -__d_drop (dentry); - need_rehash =1 ; - } +/* We must prevent any concurrent open until the unlink +* completes. ->d_revalidate will wait for ->d_fsdata +* to clear. We set it here to ensure no lookup succeeds until +* the unlink is complete on the server. +*/ + error = -ETXTBSY ; +if (WARN_ON (dentry->d_flags &DCACHE_NFSFS_RENAMED ) || +WARN_ON (dentry->d_fsdata ==NFS_FSDATA_BLOCKED )) + goto out; +if (dentry->d_fsdata) +/* old devname */ +kfree (dentry->d_fsdata); + dentry->d_fsdata =NFS_FSDATA_BLOCKED ; +spin_unlock (&dentry->d_lock); error =nfs_safe_remove (dentry);nfs_dentry_remove_handle_error (dir, dentry, error); -if (need_rehash) -d_rehash (dentry); + dentry->d_fsdata =NULL ; +wake_up_var (&dentry->d_fsdata); out:trace_nfs_unlink_exit (dir, dentry, error);return error;
@@ -2204,6 +2218,15 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry) }EXPORT_SYMBOL_GPL (nfs_link); +static void +nfs_unblock_rename (struct rpc_task *task,struct nfs_renamedata *data) +{ +struct dentry *new_dentry = data->new_dentry; + + new_dentry->d_fsdata =NULL ; +wake_up_var (&new_dentry->d_fsdata); +} +/* * RENAME * FIXME: Some nfsds, like the Linux user space nfsd, may generate a
@@ -2234,8 +2257,9 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry, {struct inode *old_inode =d_inode (old_dentry);struct inode *new_inode =d_inode (new_dentry); -struct dentry *dentry =NULL , *rehash =NULL ; +struct dentry *dentry =NULL ;struct rpc_task *task; +bool must_unblock = false;int error = -EBUSY ;if (flags)
@@ -2253,18 +2277,27 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,* the new target. */ if (new_inode && !S_ISDIR (new_inode->i_mode)) { -/* -* To prevent any new references to the target during the -* rename, we unhash the dentry in advance. +/* We must prevent any concurrent open until the unlink +* completes. ->d_revalidate will wait for ->d_fsdata +* to clear. We set it here to ensure no lookup succeeds until +* the unlink is complete on the server. */ -if (!d_unhashed (new_dentry)) { -d_drop (new_dentry); - rehash = new_dentry; + error = -ETXTBSY ; +if (WARN_ON (new_dentry->d_flags &DCACHE_NFSFS_RENAMED ) || +WARN_ON (new_dentry->d_fsdata ==NFS_FSDATA_BLOCKED )) + goto out; +if (new_dentry->d_fsdata) { +/* old devname */ +kfree (new_dentry->d_fsdata); + new_dentry->d_fsdata =NULL ; } +spin_lock (&new_dentry->d_lock);if (d_count (new_dentry) >2 ) {int err; +spin_unlock (&new_dentry->d_lock); +/* copy the target dentry's name */ dentry =d_alloc (new_dentry->d_parent, &new_dentry->d_name);
@@ -2277,14 +2310,19 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry, goto out; new_dentry = dentry; - rehash =NULL ; new_inode =NULL ; + }else { + new_dentry->d_fsdata =NFS_FSDATA_BLOCKED ; + must_unblock = true; +spin_unlock (&new_dentry->d_lock); } + }if (S_ISREG (old_inode->i_mode))nfs_sync_inode (old_inode); - task =nfs_async_rename (old_dir, new_dir, old_dentry, new_dentry,NULL ); + task =nfs_async_rename (old_dir, new_dir, old_dentry, new_dentry, + must_unblock ? nfs_unblock_rename :NULL );if (IS_ERR (task)) { error =PTR_ERR (task); goto out;
@@ -2308,8 +2346,6 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,spin_unlock (&old_inode->i_lock); } out: -if (rehash) -d_rehash (rehash);trace_nfs_rename_exit (old_dir, old_dentry, new_dir, new_dentry, error);if (!error) {
include/linux/nfs_fs.h +9 -0
@@ -591,6 +591,15 @@ nfs_fileid_to_ino_t(u64 fileid)#define NFS_JUKEBOX_RETRY_TIME (5 * HZ) +/* We need to block new opens while a file is being unlinked. +* If it is opened *before* we decide to unlink, we will silly-rename +* instead. If it is opened *after*, then we need to create or will fail. +* If we allow the two to race, we could end up with a file that is open +* but deleted on the server resulting in ESTALE. +* So use ->d_fsdata to record when the unlink is happening +* and block dentry revalidation while it is set. +*/ +#define NFS_FSDATA_BLOCKED ((void*)1)# undef ifdebug# ifdef NFS_DEBUG
Signature · 1 line
2.51.0
Re: [PATCH 5.10 123/451] NFS: dont unhash dentry during unlink/rename
Quoted 4 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
Quoted 8 lines
From: NeilBrown <[email protected]>
[ Upstream commit
3c59366c207e4c6c6569524af606baf017a55c61]NFS
unlink()(and rename over existing target) must determine if the file is open, and must perform a "silly rename" instead of an unlink (or before rename) if it is. Otherwise the client might hold a file open which has been removed on the server.
[...]
It looks like we need yet another fix after this:
commit 99bc9f2eb3f79a2b4296d9bf43153e1d10ca50d3
Author: NeilBrown <[email protected]> Date: Tue May 28 13:27:17 2024 +1000
NFS: add barriers when testing for NFS_FSDATA_BLOCKED
Ben.
Signature · 4 lines
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill GatesGreg Kroah-Hartman
maintainerRe: [PATCH 5.10 123/451] NFS: dont unhash dentry during unlink/rename
Quoted 15 lines · Ben Hutchings
Quoted 12 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit
3c59366c207e4c6c6569524af606baf017a55c61]NFS
unlink()(and rename over existing target) must determine if the file is open, and must perform a "silly rename" instead of an unlink (or before rename) if it is. Otherwise the client might hold a file open which has been removed on the server.[...]
Quoted 7 lines
It looks like we need yet another fix after this:
commit
99bc9f2eb3f79a2b4296d9bf43153e1d10ca50d3Author: NeilBrown <[email protected]> Date: Tue May 28 13:27:17 2024 +1000NFS: add barriers when testing for
NFS_FSDATA_BLOCKED
Yes, I had tried it, it had failed. But I fixed it up by hand now, thanks.
greg k-h