5.15.198-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.15.198-rc1 review
This is the start of the stable review cycle for the 5.15.198 release. There are 554 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.198-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.198-rc1
Michal Rábek <[email protected]>
scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
Alexander Stein <[email protected]>
ASoC: fsl_sai: Add missing registers to cache default
Tetsuo Handa <[email protected]>
can: j1939: make j1939_session_activate() fail if device is no longer registered
Sumeet Pawnikar <[email protected]>
powercap: fix sscanf() error return value handling
Sumeet Pawnikar <[email protected]>
powercap: fix race condition in register_control_type()
Laibin Qiu <[email protected]>
blk-throttle: Set BIO_THROTTLED when bio has been throttled
Bartosz Golaszewski <[email protected]>
pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
Andy Shevchenko <[email protected]>
pinctrl: qcom: lpass-lpi: Remove duplicate assignment of of_gpio_n_cells
Alexander Sverdlin <[email protected]>
counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
NeilBrown <[email protected]>
nfsd: provide locking for v4_end_grace
Chuck Lever <[email protected]>
NFSD: Remove NFSERR_EAGAIN
Mike Snitzer <[email protected]>
nfs_common: factor out nfs_errtbl and nfs_stat_to_errno
Chen Hanxiao <[email protected]>
NFS: trace: show TIMEDOUT instead of 0x6e
Eric Dumazet <[email protected]>
arp: do not assume dev_hard_header() does not change skb->head
Wei Fang <[email protected]>
net: enetc: fix build warning when PAGE_SIZE is greater than 128K
Petko Manolov <[email protected]>
net: usb: pegasus: fix memory leak in update_eth_regs_async()
Xiang Mei <[email protected]>
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
René Rebe <[email protected]>
HID: quirks: work around VID/PID conflict for appledisplay
Srijit Bose <[email protected]>
bnxt_en: Fix potential data corruption with HW GRO/LRO
Jakub Kicinski <[email protected]>
eth: bnxt: move and rename reset helpers
Gal Pressman <[email protected]>
net/mlx5e: Don't print error message due to invalid module
Di Zhu <[email protected]>
netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
Weiming Shi <[email protected]>
net: sock: fix hardened usercopy panic in sock_recv_errqueue
yuan.gao <[email protected]>
inet: ping: Fix icmp out counting
Jerry Wu <[email protected]>
net: mscc: ocelot: Fix crash when adding interface under a lag
Alexandre Knecht <[email protected]>
bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
Alok Tiwari <[email protected]>
net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: update last_gc only when GC has been performed
Zilin Guan <[email protected]>
netfilter: nf_tables: fix memory leak in nf_tables_newrule()
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_synproxy: avoid possible data-race on update operation
Ian Ray <[email protected]>
ARM: dts: imx6q-ba16: fix RTC interrupt level
Haibo Chen <[email protected]>
arm64: dts: add off-on-delay-us for usdhc2 regulator
Xingui Yang <[email protected]>
scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed"
Wen Xiong <[email protected]>
scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
Trond Myklebust <[email protected]>
NFS: Fix up the automount fs_context to use the correct cred
Scott Mayhew <[email protected]>
NFSv4: ensure the open stateid seqid doesn't go backwards
Sam James <[email protected]>
alpha: don't reference obsolete termio struct for TC* constants
Sebastian Andrzej Siewior <[email protected]>
ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
Yang Li <[email protected]>
csky: fix csky_cmpxchg_fixup not working
Kuniyuki Iwashima <[email protected]>
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
Sharath Chandra Vurukala <[email protected]>
net: Add locking to protect skb->dev access in ip_output
Ye Bin <[email protected]>
ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
Ye Bin <[email protected]>
ext4: introduce ITAIL helper
Ilya Dryomov <[email protected]>
libceph: make calc_target() set t->paused, not just clear it
Ilya Dryomov <[email protected]>
libceph: return the handler error from mon_handle_auth_done()
Tuo Li <[email protected]>
libceph: make free_choose_arg_map() resilient to partial allocation
Ilya Dryomov <[email protected]>
libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
ziming zhang <[email protected]>
libceph: prevent potential out-of-bounds reads in handle_auth_done()
Eric Dumazet <[email protected]>
wifi: avoid kernel-infoleak from struct iw_point
Miaoqian Lin <[email protected]>
drm/pl111: Fix error handling in pl111_amba_probe
Eric Biggers <[email protected]>
lib/crypto: aes: Fix missing MMU protection for AES S-box
Alexander Usyskin <[email protected]>
mei: me: add nova lake point S DID
Thomas Fourier <[email protected]>
net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
Thomas Fourier <[email protected]>
atm: Fix dma_free_coherent() size
Johan Hovold <[email protected]>
usb: gadget: lpc32xx_udc: fix clock imbalance in error path
Su Hui <[email protected]>
net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
Greg Kroah-Hartman <[email protected]>
Revert "iommu/amd: Skip enabling command/event buffers for kdump"
Amitai Gottlieb <[email protected]>
firmware: arm_scmi: Fix unused notifier-block in unregister
Gabriel Krisman Bertazi <[email protected]>
ext4: fix error message when rejecting the default hash
Jason Yan <[email protected]>
ext4: factor out ext4_hash_info_init()
Lizhi Xu <[email protected]>
ext4: filesystems without casefold feature cannot be mounted with siphash
Sean Nyekjaer <[email protected]>
pwm: stm32: Always program polarity
Arnd Bergmann <[email protected]>
x86: remove __range_not_ok()
Andrea Righi <[email protected]>
selftests: net: test_vxlan_under_vrf: fix HV connectivity test
Shigeru Yoshida <[email protected]>
ipv4: Fix uninit-value access in __ip_make_skb()
Shigeru Yoshida <[email protected]>
ipv6: Fix potential uninit-value access in __ip6_make_skb()
Justin Stitt <[email protected]>
KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning
Peter Xu <[email protected]>
mm/mprotect: use long for page accountings and retval
Alan Stern <[email protected]>
HID: core: Harden s32ton() against conversion to 0 bits
Sean Christopherson <[email protected]>
KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
Dong Chenchen <[email protected]>
page_pool: Fix use-after-free in page_pool_recycle_in_ring
Andrzej Hajda <[email protected]>
drm/i915/selftests: fix subtraction overflow bug
Sergey Shtylyov <[email protected]>
mmc: core: use sysfs_emit() instead of sprintf()
Thadeu Lima de Souza Cascardo <[email protected]>
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
Thomas Zimmermann <[email protected]>
drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
Jouni Malinen <[email protected]>
wifi: mac80211: Discard Beacon frames to non-broadcast address
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix OF node leak on probe
Uwe Kleine-König <[email protected]>
ASoC: stm: stm32_sai_sub: Convert to platform remove callback returning void
NeilBrown <[email protected]>
lockd: fix vfs_test_lock() calls
Wentao Liang <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_probe()
Rob Herring <[email protected]>
pmdomain: Use device_get_match_data()
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
David Hildenbrand <[email protected]>
mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize()
David Hildenbrand <[email protected]>
mm/balloon_compaction: we cannot have isolated pages in the balloon list
Miaohe Lin <[email protected]>
mm/balloon_compaction: make balloon page compaction callbacks static
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix clk prepare imbalance on probe failure
Christophe JAILLET <[email protected]>
ASoC: stm32: sai: Use the devm_clk_get_optional() helper
Kuninori Morimoto <[email protected]>
ASoC: stm: Use dev_err_probe() helper
René Rebe <[email protected]>
r8169: fix RTL8117 Wake-on-Lan in DASH mode
Johan Hovold <[email protected]>
iommu/qcom: fix device leak on of_xlate()
Donet Tom <[email protected]>
powerpc/64s/slb: Fix SLB multihit issue during SLB preload
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix disabling L0s capability
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
Miaoqian Lin <[email protected]>
media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
Marek Szyprowski <[email protected]>
media: samsung: exynos4-is: fix potential ABBA deadlock on init
Chuck Lever <[email protected]>
NFSD: NFSv4 file creation neglects setting ACL
Nicolas Dufresne <[email protected]>
media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
Johan Hovold <[email protected]>
media: vpif_capture: fix section mismatch
Haoxiang Li <[email protected]>
media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
Joshua Rogers <[email protected]>
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
Jim Mattson <[email protected]>
KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
Shivani Agarwal <[email protected]>
crypto: af_alg - zero initialize memory allocated via sock_kmalloc
Nicolas Ferre <[email protected]>
ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
Joshua Rogers <[email protected]>
svcrdma: bound check rq_pages index in inline path
Nicolas Ferre <[email protected]>
ARM: dts: microchip: sama7g5: fix uart fifo size to 32
Joanne Koong <[email protected]>
fuse: fix readahead reclaim deadlock
Johan Hovold <[email protected]>
usb: ohci-nxp: fix device leak on probe failure
Zhang Zekun <[email protected]>
usb: ohci-nxp: Use helper function devm_clk_get_enabled()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ignore unknown endpoint flags
Udipto Goswami <[email protected]>
usb: dwc3: keep susphy enabled during exit to avoid controller faults
Chao Yu <[email protected]>
f2fs: fix to avoid updating zero-sized extent in extent cache
Chao Yu <[email protected]>
f2fs: fix to propagate error from f2fs_enable_checkpoint()
Chao Yu <[email protected]>
f2fs: use global inline_xattr_slab instead of per-sb slab cache
Chao Yu <[email protected]>
f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
Haoxiang Li <[email protected]>
xfs: fix a memory leak in xfs_buf_item_init()
Dongli Zhang <[email protected]>
KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
Chuck Lever <[email protected]>
NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
Junrui Luo <[email protected]>
ALSA: wavefront: Fix integer overflow in sample size validation
Takashi Iwai <[email protected]>
ALSA: wavefront: Use standard print API
Junrui Luo <[email protected]>
ALSA: wavefront: Clear substream pointers on close
Sven Eckelmann (Plasma Cloud) <[email protected]>
wifi: mt76: Fix DTS power-limits on little endian systems
Josef Bacik <[email protected]>
btrfs: don't rewrite ret from inode_permission
Jarkko Sakkinen <[email protected]>
tpm: Cap the number of PCR banks
Ye Bin <[email protected]>
jbd2: fix the inconsistency between checksum and data in memory for journal sb
Łukasz Bartosik <[email protected]>
xhci: dbgtty: fix device unregister
Mathias Nyman <[email protected]>
xhci: dbgtty: use IDR to support several dbc instances.
Jimmy Hu <[email protected]>
usb: gadget: udc: fix use-after-free in usb_gadget_state_work
Michal Pecio <[email protected]>
usb: xhci: Apply the link chain quirk on NEC isoc endpoints
Niklas Neronin <[email protected]>
usb: xhci: move link chain bit quirk checks into one helper function.
Zack Rusin <[email protected]>
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Maximilian Immanuel Brandtner <[email protected]>
virtio_console: fix order of fields cols and rows
Martin Nybo Andersen <[email protected]>
kbuild: Use CRC32 and a 1MiB dictionary for XZ compressed modules
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()
Zhu Yanjun <[email protected]>
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()
SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()
Lyude Paul <[email protected]>
drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
Simon Richter <[email protected]>
drm/ttm: Avoid NULL pointer deref for evicted BOs
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
Xiaolei Wang <[email protected]>
net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
Deepanshu Kartikey <[email protected]>
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
Ethan Nelson-Moore <[email protected]>
net: usb: sr9700: fix incorrect command used to write single register
Haoxiang Li <[email protected]>
nfsd: Drop the client reference in client_states_open()
Haoxiang Li <[email protected]>
fjes: Add missing iounmap in fjes_hw_init()
Guangshuo Li <[email protected]>
e1000: fix OOB in e1000_tbi_should_accept()
Jason Gunthorpe <[email protected]>
RDMA/cm: Fix leaking the multicast GID table reference
Jason Gunthorpe <[email protected]>
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
Matthew Wilcox (Oracle) <[email protected]>
idr: fix idr_alloc() returning an ID out of range
Duoming Zhou <[email protected]>
media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
Duoming Zhou <[email protected]>
media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
Duoming Zhou <[email protected]>
media: TDA1997x: Remove redundant cancel_delayed_work in probe
Ivan Abramov <[email protected]>
media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
Haotian Zhang <[email protected]>
media: cec: Fix debugfs leak on bus_register() failure
René Rebe <[email protected]>
fbdev: tcx.c fix mem_map to correct smem_start offset
Thorsten Blum <[email protected]>
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
Rene Rebe <[email protected]>
fbdev: gbefb: fix to use physical address instead of dma address
Uladzislau Rezki (Sony) <[email protected]>
dm-ebs: Mark full buffer dirty even on partial write
Ivan Abramov <[email protected]>
media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
Sven Schnelle <[email protected]>
parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
Sven Schnelle <[email protected]>
parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
Haotian Zhang <[email protected]>
media: rc: st_rc: Fix reset control resource leak
Krzysztof Kozlowski <[email protected]>
mfd: max77620: Fix potential IRQ chip conflict when probing two devices
Johan Hovold <[email protected]>
mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
Christian Hitz <[email protected]>
leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
Christian Hitz <[email protected]>
leds: leds-lp50xx: Allow LED 0 to be added to module bank
Lukas Wunner <[email protected]>
PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
Hans de Goede <[email protected]>
HID: logitech-dj: Remove duplicate error logging
Johan Hovold <[email protected]>
iommu/tegra: fix device leak on probe_device()
Johan Hovold <[email protected]>
iommu/sun50i: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/omap: fix device leaks on probe_device()
Johan Hovold <[email protected]>
iommu/mediatek: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leak on probe_device()
Johan Hovold <[email protected]>
iommu/ipmmu-vmsa: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/exynos: fix device leak on of_xlate()
Johan Hovold <[email protected]>
iommu/apple-dart: fix device leak on of_xlate()
Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6adm: the the copp device only during last instance
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: perform correct state check before closing
Johan Hovold <[email protected]>
ASoC: stm32: sai: fix device leak on probe
Yipeng Zou <[email protected]>
selftests/ftrace: traceonoff_triggers: strip off names
Thomas Fourier <[email protected]>
RDMA/bnxt_re: fix dma_free_coherent() pointer
Honggang LI <[email protected]>
RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix to use correct page size for PDE table
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
Jang Ingyu <[email protected]>
RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
Michael Margolin <[email protected]>
RDMA/efa: Remove possible negative shift
Michal Schmidt <[email protected]>
RDMA/irdma: avoid invalid read in irdma_net_event
Pwnverse <[email protected]>
net: rose: fix invalid array index in rose_kill_by_device()
Ido Schimmel <[email protected]>
ipv4: Fix reference count leak when using error routes with nexthop objects
Will Rosenberg <[email protected]>
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
Anshumali Gaur <[email protected]>
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
Bagas Sanjaya <[email protected]>
net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
Deepanshu Kartikey <[email protected]>
net: usb: asix: validate PHY address before use
Jonas Gorski <[email protected]>
net: dsa: b53: skip multicast entries for fdb_dump()
Thomas Fourier <[email protected]>
firewire: nosy: Fix dma_free_coherent() size
Andrew Morton <[email protected]>
genalloc.h: fix htmldocs warning
Yeoreum Yun <[email protected]>
smc91x: fix broken irq-context in PREEMPT_RT
Deepakkumar Karn <[email protected]>
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
Jiri Pirko <[email protected]>
team: fix check for port enabled in team_queue_override_port_prio_changed()
Junrui Luo <[email protected]>
platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
Thomas Fourier <[email protected]>
platform/x86: msi-laptop: add missing sysfs_remove_group()
Eric Dumazet <[email protected]>
ip6_gre: make ip6gre_header() robust
Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
Jacky Chou <[email protected]>
net: mdio: aspeed: add dummy read to avoid read-after-write issue
Potin Lai <[email protected]>
net: mdio: aspeed: move reg accessing part into separate functions
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: revert use of devm_kzalloc in btusb
Herbert Xu <[email protected]>
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
Kohei Enju <[email protected]>
iavf: fix off-by-one issues in iavf_config_rss_reg()
Gregory Herrero <[email protected]>
i40e: validate ring_len parameter against hardware-specific values
Ivan Vecera <[email protected]>
i40e: Refactor argument of i40e_detect_recover_hung()
Ivan Vecera <[email protected]>
i40e: Refactor argument of several client notification functions
Przemyslaw Korba <[email protected]>
i40e: fix scheduling in set_rx_mode
Gui-Dong Han <[email protected]>
hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
Gui-Dong Han <[email protected]>
hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
Gui-Dong Han <[email protected]>
hwmon: (max16065) Use local variable to avoid TOCTOU
Ma Ke <[email protected]>
i2c: amd-mp2: fix reference leak in MP2 PCI device
Srinivas Kandagatla <[email protected]>
rpmsg: glink: fix rpmsg device leak
Johan Hovold <[email protected]>
soc: amlogic: canvas: fix device leak on lookup
Johan Hovold <[email protected]>
soc: qcom: ocmem: fix device leak on lookup
Johan Hovold <[email protected]>
amba: tegra-ahb: Fix device leak on SMMU enable
Alex Deucher <[email protected]>
drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
Prithvi Tambewagh <[email protected]>
io_uring: fix filename leak in __io_openat_prep()
Joshua Rogers <[email protected]>
svcrdma: return 0 on success from svc_rdma_copy_inline_range
Andy Shevchenko <[email protected]>
nfsd: Mark variable __maybe_unused to avoid W=1 build break
Amir Goldstein <[email protected]>
fsnotify: do not generate ACCESS/MODIFY events on child for special files
Rafael J. Wysocki <[email protected]>
PM: runtime: Do not clear needs_force_resume with enabled runtime PM
Steven Rostedt <[email protected]>
tracing: Do not register unsupported perf events
Sean Christopherson <[email protected]>
KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
Sean Christopherson <[email protected]>
KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)
Yosry Ahmed <[email protected]>
KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
fuqiang wang <[email protected]>
KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
fuqiang wang <[email protected]>
KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
Sean Christopherson <[email protected]>
KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
Ilya Dryomov <[email protected]>
libceph: make decode_pool() more resilient against corrupted osdmaps
Helge Deller <[email protected]>
parisc: Do not reprogram affinitiy on ASP chip
Zhichi Lin <[email protected]>
scs: fix a wrong parameter in __scs_magic
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
Prithvi Tambewagh <[email protected]>
ocfs2: fix kernel BUG in ocfs2_find_victim_chain
Jeongjun Park <[email protected]>
media: vidtv: initialize local pointers upon transfer of memory ownership
Alison Schofield <[email protected]>
tools/testing/nvdimm: Use per-DIMM device handle
Chao Yu <[email protected]>
f2fs: fix return value of f2fs_recover_fsync_data()
Deepanshu Kartikey <[email protected]>
f2fs: invalidate dentry cache on failed whiteout creation
Andrey Vatoropin <[email protected]>
scsi: target: Reset t_task_cdb pointer in error case
Dai Ngo <[email protected]>
NFSD: use correct reservation type in nfsd4_scsi_fence_client
Junrui Luo <[email protected]>
scsi: aic94xx: fix use-after-free in device removal path
Tony Battersby <[email protected]>
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
Miaoqian Lin <[email protected]>
cpufreq: nforce2: fix reference count leak in nforce2
Ma Ke <[email protected]>
intel_th: Fix error handling in intel_th_output_open
Tianchu Chen <[email protected]>
char: applicom: fix NULL pointer dereference in ac_ioctl
Haoxiang Li <[email protected]>
usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
Miaoqian Lin <[email protected]>
usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
Johan Hovold <[email protected]>
usb: phy: isp1301: fix non-OF device reference imbalance
Duoming Zhou <[email protected]>
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
Ma Ke <[email protected]>
USB: lpc32xx_udc: Fix error handling in probe
Johan Hovold <[email protected]>
phy: broadcom: bcm63xx-usbh: fix section mismatches
Colin Ian King <[email protected]>
media: pvrusb2: Fix incorrect variable used in trace message
Jeongjun Park <[email protected]>
media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
Chen Changcheng <[email protected]>
usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
Laurent Pinchart <[email protected]>
media: v4l2-mem2mem: Fix outdated documentation
Byungchul Park <[email protected]>
jbd2: use a weaker annotation in journal handling
Baokun Li <[email protected]>
ext4: align max orphan file size with e2fsprogs limit
Yongjian Sun <[email protected]>
ext4: fix incorrect group number assertion in mb_check_buddy
Haibo Chen <[email protected]>
ext4: clear i_state_flags when alloc inode
Karina Yankevich <[email protected]>
ext4: xattr: fix null pointer deref in ext4_raw_inode()
Steven Rostedt <[email protected]>
ktest.pl: Fix uninitialized var in config-bisect.pl
Konstantin Komarov <[email protected]>
fs/ntfs3: fix mount failure for sparse runs in run_unpack()
Rene Rebe <[email protected]>
floppy: fix for PAGE_SIZE != 4KB
Li Chen <[email protected]>
block: rate-limit capacity change info log
Eric Biggers <[email protected]>
lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
Jarkko Sakkinen <[email protected]>
KEYS: trusted: Fix a memory leak in tpm2_load_cmd
Stefano Garzarella <[email protected]>
vhost/vsock: improve RCU read sections around vhost_vsock_get()
Chia-Lin Kao (AceLan) <[email protected]>
platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks
Daniel Wagner <[email protected]>
nvme-fc: don't hold rport lock when putting ctrl
Wenhua Lin <[email protected]>
serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
Chen Changcheng <[email protected]>
usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.
Hongyu Xie <[email protected]>
usb: xhci: limit run_graceperiod for only usb 3.0 devices
Mark Pearson <[email protected]>
usb: typec: ucsi: Handle incorrect num_connectors capability
Lizhi Xu <[email protected]>
usbip: Fix locking bug in RT-enabled kernels
Yuezhang Mo <[email protected]>
exfat: fix remount failure in different process environments
Encrow Thorne <[email protected]>
reset: fix BIT macro reference
Li Qiang <[email protected]>
via_wdt: fix critical boot hang due to unnamed resource allocation
Tony Battersby <[email protected]>
scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
Tony Battersby <[email protected]>
scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
Tony Battersby <[email protected]>
scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
Ben Collins <[email protected]>
powerpc/addnote: Fix overflow on 32-bit builds
Josua Mayer <[email protected]>
clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
Matthias Schiffer <[email protected]>
ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
Peng Fan <[email protected]>
firmware: imx: scu-irq: Init workqueue before request mbox channel
Jinhui Guo <[email protected]>
ipmi: Fix __scan_channels() failing to rescan channels
Jinhui Guo <[email protected]>
ipmi: Fix the race between __scan_channels() and deliver_response()
Shipei Qu <[email protected]>
ALSA: usb-mixer: us16x08: validate meter packet indices
Haotian Zhang <[email protected]>
ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
Haotian Zhang <[email protected]>
ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
Shaurya Rane <[email protected]>
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
Jared Kangas <[email protected]>
mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
Christophe Leroy <[email protected]>
spi: fsl-cpm: Check length parity before switching to 16 bit mode
Pengjie Zhang <[email protected]>
ACPI: CPPC: Fix missing PCC check for guaranteed_perf
Christoffer Sandberg <[email protected]>
Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
Junjie Cao <[email protected]>
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
Ping Cheng <[email protected]>
HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
Jian Shen <[email protected]>
net: hns3: add VLAN id validation before using
Jian Shen <[email protected]>
net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx
Hao Chen <[email protected]>
net: hns3: Align type of some variables with their print type
Jian Shen <[email protected]>
net: hns3: using the num_tqps in the vf driver to apply for resources
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Handle escaped percent properly
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Validate format string parameters
Shay Drory <[email protected]>
net/mlx5: fw_tracer, Add support for unrecognized string
Gal Pressman <[email protected]>
ethtool: Avoid overflowing userspace buffer on stats query
Daniil Tatianin <[email protected]>
net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers
Daniil Tatianin <[email protected]>
net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats
Tom Rix <[email protected]>
ethtool: use phydev variable
Dan Carpenter <[email protected]>
nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
Victor Nogueira <[email protected]>
net/sched: ets: Remove drr class from the active list if it changes to strict
Junrui Luo <[email protected]>
caif: fix integer underflow in cffrml_receive()
Slavin Liu <[email protected]>
ipvs: fix ipv4 null-ptr-deref in route error path
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: fix leaked ct in error paths
Alexey Simakov <[email protected]>
broadcom: b44: prevent uninitialized value usage
Ilya Maximets <[email protected]>
net: openvswitch: fix middle attribute validation in push_nsh() action
Ido Schimmel <[email protected]>
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
Ido Schimmel <[email protected]>
mlxsw: spectrum_router: Fix neighbour use-after-free
Dmitry Skorodumov <[email protected]>
ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
Jamal Hadi Salim <[email protected]>
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
Wang Liang <[email protected]>
netrom: Fix memory leak in nr_sendmsg()
Gongwei Li <[email protected]>
Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
Qu Wenruo <[email protected]>
btrfs: scrub: always update btrfs_scrub_progress::last_physical
Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/073
Tetsuo Handa <[email protected]>
hfsplus: Verify inode mode when loading from disk
Yang Chenzhi <[email protected]>
hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/070
Konstantin Komarov <[email protected]>
fs/ntfs3: Support timestamps prior to epoch
Song Liu <[email protected]>
livepatch: Match old_sympos 0 and 1 in klp_find_func()
Shuhao Fu <[email protected]>
cpufreq: s5pv210: fix refcount leak
Sakari Ailus <[email protected]>
ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
Cryolitia PukNgae <[email protected]>
ACPICA: Avoid walking the Namespace if start_node is NULL
Peter Zijlstra <[email protected]>
x86/ptrace: Always inline trivial accessors
Doug Berger <[email protected]>
sched/deadline: only set free_cpus for online runqueues
Deepanshu Kartikey <[email protected]>
btrfs: fix memory leak of fs_devices in degraded seed device path
Ondrej Mosnacek <[email protected]>
bpf, arm64: Do not audit capability check in do_jit()
Jamie Iles <[email protected]>
i3c: fix uninitialized variable use in i2c setup
Vishwaroop A <[email protected]>
spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
Krishna Yarlagadda <[email protected]>
spi: tegra210-quad: Fix validate combined sequence
Leo Yan <[email protected]>
coresight: etm4x: Correct polling IDLE bit
Nicklas Bo Jensen <[email protected]>
netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
Sun Ke <[email protected]>
NFS: Fix missing unlock in nfs_unlink()
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: get channel status data when PHY is not exists
Junrui Luo <[email protected]>
ALSA: dice: fix buffer overflow in detect_stream_formats()
Diogo Ivo <[email protected]>
usb: phy: Initialize struct usb_phy list_head
Haotien Hsu <[email protected]>
usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
Dmitry Antipov <[email protected]>
ocfs2: fix memory leak in ocfs2_merge_rec_left()
Mauro Carvalho Chehab <[email protected]>
efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
Mauro Carvalho Chehab <[email protected]>
efi/cper: Adjust infopfx size to accept an extra space
Mauro Carvalho Chehab <[email protected]>
efi/cper: Add a new helper function to print bitmasks
Haotian Zhang <[email protected]>
dm log-writes: Add missing set_freezable() for freezable kthread
Alexey Simakov <[email protected]>
dm-raid: fix possible NULL dereference with undefined raid type
Liyuan Pang <[email protected]>
ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
Andres J Rosa <[email protected]>
ALSA: uapi: Fix typo in asound.h comment
Dave Kleikamp <[email protected]>
dma/pool: eliminate alloc_pages warning in atomic_pool_expand
shechenglong <[email protected]>
block: fix comment for op_is_zone_mgmt() to include RESET_ALL
Cong Zhang <[email protected]>
blk-mq: Abort suspend when wakeup events are pending
Shengjiu Wang <[email protected]>
ASoC: ak5558: Disable regulator when error happens
Shengjiu Wang <[email protected]>
ASoC: ak4458: Disable regulator when error happens
Haotian Zhang <[email protected]>
ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
Anton Khirnov <[email protected]>
platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
Armin Wolf <[email protected]>
fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
Trond Myklebust <[email protected]>
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
Ondrej Mosnacek <[email protected]>
fs_context: drop the unused lsm_flags member
Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when mounting nfs"
Trond Myklebust <[email protected]>
Revert "nfs: clear SB_RDONLY before getting superblock"
Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when remounting nfs"
Jonathan Curley <[email protected]>
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
Trond Myklebust <[email protected]>
NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
Trond Myklebust <[email protected]>
NFS: Fix the verifier for case sensitive filesystem in nfs_atomic_open()
Trond Myklebust <[email protected]>
NFSv4: Add some support for case insensitive filesystems
Armin Wolf <[email protected]>
fs/nls: Fix utf16 to utf8 conversion
Trond Myklebust <[email protected]>
NFS: Avoid changing nlink when file removes and attribute updates race
NeilBrown <[email protected]>
NFS: don't unhash dentry during unlink/rename
Trond Myklebust <[email protected]>
NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()
Abdun Nihaal <[email protected]>
fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
Haotian Zhang <[email protected]>
pinctrl: single: Fix incorrect type for error return variable
Matthijs Kooijman <[email protected]>
pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
Namhyung Kim <[email protected]>
perf tools: Fix split kallsyms DSO counting
Xiang Mei <[email protected]>
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
Alexandru Gagniuc <[email protected]>
remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
Ivan Stepchenko <[email protected]>
mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
Alexey Kodanev <[email protected]>
net: stmmac: fix rx limit check in stmmac_rx_zc()
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_connlimit: update the count if add was skipped
Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: rework API to use sk_buff directly
William Tu <[email protected]>
netfilter: nf_conncount: reduce unnecessary GC
Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
sparkhuang <[email protected]>
regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Fix error path in hw_params()
Michael S. Tsirkin <[email protected]>
virtio: fix virtqueue_set_affinity() docs
Alok Tiwari <[email protected]>
virtio_vdpa: fix misleading return in void function
Eli Cohen <[email protected]>
vdpa: Sync calls set/get config/status with cf_mutex
Parav Pandit <[email protected]>
vdpa: Introduce query of device config layout
Parav Pandit <[email protected]>
vdpa: Introduce and use vdpa device get, set config helpers
Yongjian Sun <[email protected]>
ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
Kemeng Shi <[email protected]>
ext4: remove unused return value of __mb_check_buddy
René Rebe <[email protected]>
ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
Dan Carpenter <[email protected]>
drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: clear the channel status control memory
Chancel Liu <[email protected]>
ASoC: fsl_xcvr: Add support for i.MX93 platform
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Add Counter registers
Krzysztof Czurylo <[email protected]>
RDMA/irdma: Fix data race in irdma_free_pble
Krzysztof Czurylo <[email protected]>
RDMA/irdma: Fix data race in irdma_sc_ccq_arm
Stephan Gerhold <[email protected]>
iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
Randy Dunlap <[email protected]>
backlight: lp855x: Fix lp855x.h kernel-doc warnings
Luca Ceresoli <[email protected]>
backlight: led-bl: Add devlink to supplier LEDs
Mans Rullgard <[email protected]>
backlight: led_bl: Take led_access lock when required
Ria Thomas <[email protected]>
wifi: ieee80211: correct FILS status codes
Shawn Lin <[email protected]>
PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
Jianglei Nie <[email protected]>
staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
Zilin Guan <[email protected]>
mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
Haotian Zhang <[email protected]>
crypto: ccree - Correctly handle return of sg_nents_for_len
Matt Bobrowski <[email protected]>
selftests/bpf: Improve reliability of test_perf_branches_no_hw()
Matt Bobrowski <[email protected]>
selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
Gopi Krishna Menon <[email protected]>
usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during suspend if set as peripheral
Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during shutdown if set as peripheral
Jisheng Zhang <[email protected]>
usb: dwc2: disable platform lowlevel hw resources during shutdown
Oliver Neukum <[email protected]>
usb: chaoskey: fix locking for O_NONBLOCK
Zhao Yipeng <[email protected]>
ima: Handle error code returned by ima_filter_rule_match()
Seungjin Bae <[email protected]>
wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
Haotian Zhang <[email protected]>
mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
Haotian Zhang <[email protected]>
mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
Uwe Kleine-König <[email protected]>
pwm: bcm2835: Make sure the channel is enabled after pwm_request()
Jay Liu <[email protected]>
drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
Edward Adam Davis <[email protected]>
fs/ntfs3: Prevent memory leaks in add sub record
Edward Adam Davis <[email protected]>
fs/ntfs3: out1 also needs to put mi
Konstantin Komarov <[email protected]>
fs/ntfs3: Make ni_ins_new_attr return error
Konstantin Komarov <[email protected]>
fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free
Konstantin Komarov <[email protected]>
fs/ntfs3: Remove unused mi_mark_free
Ritesh Harjani (IBM) <[email protected]>
powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
Abdun Nihaal <[email protected]>
wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
Sergey Bashirov <[email protected]>
NFSD/blocklayout: Fix minlength check in proc_layoutget
Haotian Zhang <[email protected]>
watchdog: wdat_wdt: Fix ACPI table leak in probe function
Liu Xinpeng <[email protected]>
watchdog: wdat_wdt: Stop watchdog when uninstalling module
Alexei Starovoitov <[email protected]>
selftests/bpf: Fix failure paths in send_signal test
Rene Rebe <[email protected]>
ps3disk: use memcpy_{from,to}_bvec index
Siddharth Vadapalli <[email protected]>
PCI: keystone: Exit ks_pcie_probe() for invalid mode
Haotian Zhang <[email protected]>
leds: netxbig: Fix GPIO descriptor leak in error paths
Haotian Zhang <[email protected]>
scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
Haotian Zhang <[email protected]>
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
Dmitry Antipov <[email protected]>
ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
Andy Shevchenko <[email protected]>
lib/vsprintf: Check pointer before dereferencing in time_and_date()
Haotian Zhang <[email protected]>
clk: renesas: r9a06g032: Fix memory leak in error path
Herve Codina <[email protected]>
soc: renesas: r9a06g032-sysctrl: Handle h2mode setting based on USBF presence
Miquel Raynal <[email protected]>
clk: renesas: r9a06g032: Export function to set dmamux
Leo Yan <[email protected]>
coresight: etm4x: Add context synchronization before enabling trace
Leo Yan <[email protected]>
coresight: etm4x: Extract the trace unit controlling
Yuanfang Zhang <[email protected]>
coresight-etm4x: add isb() before reading the TRCSTATR
Suzuki K Poulose <[email protected]>
coresight: etm4x: Use Trace Filtering controls dynamically
Suzuki K Poulose <[email protected]>
coresight: etm4x: Save restore TRFCR_EL1
Zheng Qixing <[email protected]>
nbd: defer config unlock in nbd_genl_connect
Abdun Nihaal <[email protected]>
wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
Long Li <[email protected]>
macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
Christophe Leroy <[email protected]>
powerpc/32: Fix unpaired stwcx. on interrupt exit
Edward Adam Davis <[email protected]>
ntfs3: init run lock for extend inode
Ma Ke <[email protected]>
RDMA/rtrs: server: Fix error handling in get_or_create_srv
Manivannan Sadhasivam <[email protected]>
dt-bindings: PCI: amlogic: Fix the register name of the DBI region
Neil Armstrong <[email protected]>
dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema
Haotian Zhang <[email protected]>
scsi: stex: Fix reboot_notifier leak in probe error path
Zheng Qixing <[email protected]>
nbd: defer config put in recv_work
Yu Kuai <[email protected]>
nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply()
Yu Kuai <[email protected]>
nbd: clean up return value checking of sock_xmit()
Gabor Juhos <[email protected]>
regulator: core: disable supply if enabling main regulator fails
Dapeng Mi <[email protected]>
perf/x86/intel: Correct large PEBS flag check
Zhang Yi <[email protected]>
ext4: correct the checking of quota files before moving extents
Eric Whitney <[email protected]>
ext4: minor defrag code improvements
Haotian Zhang <[email protected]>
mfd: da9055: Fix missing regmap_del_irq_chip() in error path
Vishwaroop A <[email protected]>
spi: tegra210-quad: Fix timeout handling
Vishwaroop A <[email protected]>
spi: tegra210-quad: modify chip select (CS) deactivation
Krishna Yarlagadda <[email protected]>
spi: tegra210-quad: combined sequence mode
Krishna Yarlagadda <[email protected]>
spi: tegra210-quad: add new chips to compatible
Krishna Yarlagadda <[email protected]>
spi: tegra210-quad: use device_reset method
Bart Van Assche <[email protected]>
scsi: target: Do not write NUL characters into ASCII configfs output
Ahelenia Ziemiańska <[email protected]>
power: supply: apm_power: only unset own apm_get_power_status
Ivan Abramov <[email protected]>
power: supply: wm831x: Check wm831x_set_bits() return value
Stanley Chu <[email protected]>
i3c: master: svc: Prevent incomplete IBI transaction
Frank Li <[email protected]>
i3c: fix refcount inconsistency in i3c_master_register
Jarkko Nikula <[email protected]>
i3c: master: Inherit DMA masks and parameters from parent device
Jeremy Kerr <[email protected]>
i3c: Allow OF-alias-based persistent bus numbering
Jamie Iles <[email protected]>
i3c: support dynamically added i2c devices
Jamie Iles <[email protected]>
i3c: remove i2c board info from i2c_dev_desc
Haotian Zhang <[email protected]>
pinctrl: stm32: fix hwspinlock resource leak in probe function
Tengda Wu <[email protected]>
x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
Alexander Potapenko <[email protected]>
x86: kmsan: don't instrument stack walking functions
Alexander Potapenko <[email protected]>
kmsan: introduce __no_sanitize_memory and __no_kmsan_checks
Kees Cook <[email protected]>
compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer
Kuniyuki Iwashima <[email protected]>
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
Horatiu Vultur <[email protected]>
phy: mscc: Fix PTP for VSC8574 and VSC8572
Peng Fan <[email protected]>
firmware: imx: scu-irq: fix OF node leak in
Heiko Carstens <[email protected]>
s390/ap: Don't leak debug feature files if AP instructions are not available
Heiko Carstens <[email protected]>
s390/smp: Fix fallback CPU detection
nieweiqiang <[email protected]>
crypto: hisilicon/qm - restore original qos values
Thorsten Blum <[email protected]>
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
Li Qiang <[email protected]>
uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
Tim Harvey <[email protected]>
arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: discard samples during filters settling time
Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine
Xuanqiang Luo <[email protected]>
inet: Avoid ehash lookup race in inet_ehash_insert()
Xuanqiang Luo <[email protected]>
rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
Sidharth Seela <[email protected]>
ntfs3: Fix uninit buffer allocated by __getname()
Raphael Pinsonneault-Thibeault <[email protected]>
ntfs3: fix uninit memory after failed mi_read in mi_format_new
Johan Hovold <[email protected]>
irqchip/qcom-irq-combiner: Fix section mismatch
Seungjin Bae <[email protected]>
USB: Fix descriptor count when handling invalid MBIM extended descriptor
Janusz Krzysztofik <[email protected]>
drm/vgem-fence: Fix potential deadlock on release
Guido Günther <[email protected]>
drm/panel: visionox-rm69299: Don't clear all mode flags
Mainak Sen <[email protected]>
gpu: host1x: Fix race in syncpt alloc/free
Konstantin Andreev <[email protected]>
smack: fix bug: unprivileged task can create labels
Navaneeth K <[email protected]>
staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
Navaneeth K <[email protected]>
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
Nikita Zhandarovich <[email protected]>
comedi: check device's attached status in compat ioctls
Nikita Zhandarovich <[email protected]>
comedi: multiq3: sanitize config options in multiq3_attach()
Ian Abbott <[email protected]>
comedi: c6xdigio: Fix invalid PNP driver unregistration
Linus Torvalds <[email protected]>
samples: work around glibc redefining some of our defines wrong
Naoki Ueki <[email protected]>
HID: elecom: Add support for ELECOM M-XT3URBK (018F)
Jia Ston <[email protected]>
platform/x86: huawei-wmi: add keys for HONOR models
Armin Wolf <[email protected]>
platform/x86: acer-wmi: Ignore backlight event
Praveen Talari <[email protected]>
pinctrl: qcom: msm: Fix deadlock in pinmux configuration
Tetsuo Handa <[email protected]>
bfs: Reconstruct file type when loading from disk
Robin Gong <[email protected]>
spi: imx: keep dma request disabled before dma transfer setup
Alvaro Gamez Machado <[email protected]>
spi: xilinx: increase number of retries before declaring stall
Johan Hovold <[email protected]>
USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
Johan Hovold <[email protected]>
USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
Magne Bruno <[email protected]>
serial: add support of CPCI cards
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: match on interface number for jtag
Fabio Porcedda <[email protected]>
USB: serial: option: move Telit 0x10c7 composition in the right place
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE910C04 new compositions
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W760
Nikita Zhandarovich <[email protected]>
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
Alexey Nepomnyashih <[email protected]>
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
Alexander Sverdlin <[email protected]>
locking/spinlock/debug: Fix data-race in do_raw_write_lock
Deepanshu Kartikey <[email protected]>
ext4: refresh inline data size before write operations
Ye Bin <[email protected]>
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
Bagas Sanjaya <[email protected]>
Documentation: process: Also mention Sasha Levin as stable tree maintainer
Stefan Kalscheuer <[email protected]>
leds: spi-byte: Use devm_led_classdev_register_ext()
Azeem Shaikh <[email protected]>
leds: Replace all non-returning strlcpy with strscpy
Kai Song <[email protected]>
drm/i915/selftests: Fix inconsistent IS_ERR and PTR_ERR
Robert-Ionut Alexa <[email protected]>
dpaa2-mac: bail if the dpmacs fwnode is not found
Sabrina Dubroca <[email protected]>
xfrm: flush all states in xfrm_state_fini
Sabrina Dubroca <[email protected]>
xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
Sabrina Dubroca <[email protected]>
Revert "xfrm: destroy xfrm_state synchronously on net exit path"
Sabrina Dubroca <[email protected]>
xfrm: delete x->tunnel as we delete x
-------------
Diffstat:
.../devicetree/bindings/pci/amlogic,axg-pcie.yaml | 134 +++++++++ .../devicetree/bindings/pci/amlogic,meson-pcie.txt | 70 ----- Documentation/filesystems/mount_api.rst | 1 - Documentation/process/2.Process.rst | 6 +- Makefile | 4 +- arch/alpha/include/uapi/asm/ioctls.h | 8 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/imx6q-ba16.dtsi | 2 +- arch/arm/boot/dts/sama5d2.dtsi | 10 +- arch/arm/boot/dts/sama7g5.dtsi | 4 +- arch/arm/include/asm/word-at-a-time.h | 10 +- .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 - arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 + arch/arm64/kvm/Makefile | 3 + arch/arm64/net/bpf_jit_comp.c | 2 +- arch/csky/mm/fault.c | 4 +- arch/parisc/kernel/asm-offsets.c | 2 + arch/parisc/kernel/entry.S | 16 +- arch/powerpc/boot/addnote.c | 7 +- arch/powerpc/include/asm/book3s/64/mmu-hash.h | 1 - arch/powerpc/kernel/entry_32.S | 10 +- arch/powerpc/kernel/process.c | 5 - arch/powerpc/mm/book3s64/internal.h | 1 - arch/powerpc/mm/book3s64/mmu_context.c | 2 - arch/powerpc/mm/book3s64/slb.c | 88 ------ arch/powerpc/mm/ptdump/hashpagetable.c | 6 + arch/powerpc/platforms/pseries/cmm.c | 5 +- arch/s390/kernel/smp.c | 1 + arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/events/core.c | 2 +- arch/x86/events/intel/core.c | 4 +- arch/x86/include/asm/ptrace.h | 20 +- arch/x86/include/asm/uaccess.h | 10 +- arch/x86/kernel/dumpstack.c | 35 ++- arch/x86/kernel/stacktrace.c | 2 +- arch/x86/kernel/unwind_frame.c | 11 + arch/x86/kvm/lapic.c | 32 ++- arch/x86/kvm/svm/nested.c | 5 +- arch/x86/kvm/svm/svm.c | 20 +- arch/x86/kvm/svm/svm.h | 7 +- arch/x86/kvm/vmx/nested.c | 2 +- arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/kvm/vmx/vmx.h | 1 + arch/x86/kvm/x86.c | 2 + arch/x86/lib/usercopy.c | 2 +- block/blk-mq.c | 18 +- block/blk-throttle.c | 16 +- block/genhd.c | 2 +- crypto/af_alg.c | 5 +- crypto/algif_hash.c | 3 +- crypto/algif_rng.c | 3 +- crypto/asymmetric_keys/asymmetric_type.c | 12 +- crypto/seqiv.c | 8 +- drivers/acpi/acpica/nswalk.c | 9 +- drivers/acpi/apei/ghes.c | 16 +- drivers/acpi/cppc_acpi.c | 3 +- drivers/acpi/processor_core.c | 2 +- drivers/acpi/property.c | 9 +- drivers/amba/tegra-ahb.c | 1 + drivers/atm/he.c | 3 +- drivers/base/power/runtime.c | 22 +- drivers/block/floppy.c | 2 +- drivers/block/nbd.c | 96 ++++--- drivers/block/ps3disk.c | 4 + drivers/bluetooth/btusb.c | 14 +- drivers/bus/ti-sysc.c | 11 +- drivers/char/applicom.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 20 +- drivers/char/tpm/tpm-chip.c | 1 - drivers/char/tpm/tpm1-cmd.c | 5 - drivers/char/tpm/tpm2-cmd.c | 8 +- drivers/char/virtio_console.c | 2 +- drivers/clk/mvebu/cp110-system-controller.c | 20 ++ drivers/clk/renesas/r9a06g032-clocks.c | 69 ++++- drivers/comedi/comedi_fops.c | 42 ++- drivers/comedi/drivers/c6xdigio.c | 46 ++- drivers/comedi/drivers/multiq3.c | 9 + drivers/comedi/drivers/pcl818.c | 5 +- drivers/counter/interrupt-cnt.c | 3 +- drivers/cpufreq/cpufreq-nforce2.c | 3 + drivers/cpufreq/s5pv210-cpufreq.c | 6 +- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +- drivers/crypto/hisilicon/qm.c | 14 +- drivers/firewire/nosy.c | 10 +- drivers/firmware/arm_scmi/notify.c | 1 + drivers/firmware/efi/cper-arm.c | 52 ++-- drivers/firmware/efi/cper.c | 60 ++++ drivers/firmware/imx/imx-scu-irq.c | 8 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 2 +- drivers/gpu/drm/gma500/framebuffer.c | 42 --- .../gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c | 4 +- drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 2 +- drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 13 + drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +- drivers/gpu/drm/pl111/pl111_drv.c | 2 +- drivers/gpu/drm/ttm/ttm_bo_vm.c | 6 + drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 +- drivers/gpu/host1x/syncpt.c | 4 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-elecom.c | 6 +- drivers/hid/hid-ids.h | 3 +- drivers/hid/hid-input.c | 18 +- drivers/hid/hid-logitech-dj.c | 56 ++-- drivers/hid/hid-quirks.c | 12 +- drivers/hwmon/max16065.c | 7 +- drivers/hwmon/w83791d.c | 19 +- drivers/hwmon/w83l786ng.c | 26 +- drivers/hwtracing/coresight/coresight-core.c | 20 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 284 +++++++++++++------ drivers/hwtracing/coresight/coresight-etm4x.h | 9 +- .../coresight/coresight-self-hosted-trace.h | 31 +++ drivers/hwtracing/intel_th/core.c | 20 +- drivers/i2c/busses/i2c-amd-mp2-pci.c | 5 +- drivers/i3c/master.c | 189 +++++++++++-- drivers/i3c/master/svc-i3c-master.c | 22 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 24 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 71 +++-- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 32 ++- drivers/infiniband/core/addr.c | 33 +-- drivers/infiniband/core/cma.c | 3 + drivers/infiniband/core/device.c | 5 + drivers/infiniband/core/verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 8 +- drivers/infiniband/hw/efa/efa_verbs.c | 4 - drivers/infiniband/hw/irdma/ctrl.c | 3 + drivers/infiniband/hw/irdma/pble.c | 6 +- drivers/infiniband/hw/irdma/utils.c | 3 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 1 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/input/touchscreen/ti_am335x_tsc.c | 2 +- drivers/iommu/amd/init.c | 28 +- drivers/iommu/apple-dart.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 +- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 +- drivers/iommu/exynos-iommu.c | 9 +- drivers/iommu/ipmmu-vmsa.c | 2 + drivers/iommu/mtk_iommu.c | 2 + drivers/iommu/mtk_iommu_v1.c | 2 + drivers/iommu/omap-iommu.c | 2 +- drivers/iommu/omap-iommu.h | 2 - drivers/iommu/sun50i-iommu.c | 2 + drivers/iommu/tegra-smmu.c | 5 +- drivers/irqchip/qcom-irq-combiner.c | 2 +- drivers/leds/flash/leds-aat1290.c | 2 +- drivers/leds/led-class.c | 2 +- drivers/leds/leds-lp50xx.c | 12 +- drivers/leds/leds-netxbig.c | 36 ++- drivers/leds/leds-spi-byte.c | 11 +- drivers/macintosh/mac_hid.c | 3 +- drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-log-writes.c | 1 + drivers/md/dm-raid.c | 2 + drivers/media/cec/core/cec-core.c | 1 + drivers/media/i2c/adv7604.c | 4 +- drivers/media/i2c/adv7842.c | 11 +- drivers/media/i2c/msp3400-kthreads.c | 2 + drivers/media/i2c/tda1997x.c | 1 - drivers/media/platform/davinci/vpif_capture.c | 4 +- drivers/media/platform/exynos4-is/media-dev.c | 10 +- .../media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 4 +- drivers/media/platform/rcar_drif.c | 1 + drivers/media/rc/st_rc.c | 2 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 3 + drivers/media/usb/dvb-usb/dtv5100.c | 5 + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 +- drivers/mfd/altera-sysmgr.c | 2 + drivers/mfd/da9055-core.c | 1 + drivers/mfd/max77620.c | 15 +- drivers/mfd/mt6358-irq.c | 1 + drivers/mfd/mt6397-irq.c | 1 + drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/vmw_balloon.c | 3 +- drivers/mmc/core/bus.c | 9 +- drivers/mmc/core/bus.h | 3 +- drivers/mmc/core/mmc.c | 16 +- drivers/mmc/core/sd.c | 23 +- drivers/mmc/core/sdio.c | 5 +- drivers/mmc/core/sdio_bus.c | 7 +- drivers/mmc/host/Kconfig | 4 +- drivers/mmc/host/sdhci-msm.c | 27 +- drivers/mtd/lpddr/lpddr_cmds.c | 8 +- drivers/net/dsa/b53/b53_common.c | 3 + drivers/net/ethernet/3com/3c59x.c | 2 +- drivers/net/ethernet/broadcom/b44.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 87 +++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +- drivers/net/ethernet/cadence/macb_main.c | 3 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c | 5 +- drivers/net/ethernet/freescale/enetc/enetc.h | 4 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 4 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +- drivers/net/ethernet/intel/i40e/i40e.h | 15 +- drivers/net/ethernet/intel/i40e/i40e_client.c | 20 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 12 - drivers/net/ethernet/intel/i40e/i40e_main.c | 15 +- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 10 +- drivers/net/ethernet/intel/i40e/i40e_txrx.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +- .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 8 + .../ethernet/marvell/prestera/prestera_devlink.c | 2 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 122 +++++++- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 2 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 17 +- drivers/net/ethernet/mscc/ocelot.c | 6 +- drivers/net/ethernet/realtek/r8169_main.c | 5 +- drivers/net/ethernet/smsc/smc91x.c | 10 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/fjes/fjes_hw.c | 12 +- drivers/net/ipvlan/ipvlan_core.c | 3 + drivers/net/mdio/mdio-aspeed.c | 77 +++--- drivers/net/phy/mscc/mscc_main.c | 6 +- drivers/net/team/team.c | 2 +- drivers/net/usb/asix_common.c | 5 + drivers/net/usb/pegasus.c | 2 + drivers/net/usb/rtl8150.c | 2 + drivers/net/usb/sr9700.c | 4 +- drivers/net/wireless/mediatek/mt76/eeprom.c | 37 ++- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 +- drivers/net/wireless/st/cw1200/bh.c | 6 +- drivers/nfc/pn533/usb.c | 2 +- drivers/nvme/host/fc.c | 6 +- drivers/parisc/gsc.c | 4 +- drivers/pci/controller/dwc/pci-keystone.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 +- drivers/pci/controller/pcie-brcmstb.c | 10 +- drivers/pci/pci-driver.c | 4 + drivers/phy/broadcom/phy-bcm63xx-usbh.c | 6 +- drivers/pinctrl/pinctrl-single.c | 25 +- drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/platform/chrome/cros_ec_ishtp.c | 1 + drivers/platform/x86/acer-wmi.c | 4 + drivers/platform/x86/asus-wmi.c | 8 +- drivers/platform/x86/huawei-wmi.c | 4 + drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel/hid.c | 12 + drivers/platform/x86/msi-laptop.c | 3 + drivers/power/supply/apm_power.c | 3 +- drivers/power/supply/wm831x_power.c | 10 +- drivers/powercap/powercap_sys.c | 22 +- drivers/pwm/pwm-bcm2835.c | 28 +- drivers/pwm/pwm-stm32.c | 3 +- drivers/regulator/core.c | 37 ++- drivers/remoteproc/qcom_q6v5_wcss.c | 8 +- drivers/rpmsg/qcom_glink_native.c | 8 + drivers/s390/crypto/ap_bus.c | 8 +- drivers/scsi/aic94xx/aic94xx_init.c | 3 + drivers/scsi/ipr.c | 28 +- drivers/scsi/libsas/sas_internal.h | 14 - drivers/scsi/qla2xxx/qla_def.h | 1 - drivers/scsi/qla2xxx/qla_gbl.h | 2 +- drivers/scsi/qla2xxx/qla_isr.c | 32 +-- drivers/scsi/qla2xxx/qla_mbx.c | 2 + drivers/scsi/qla2xxx/qla_mid.c | 4 +- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/sg.c | 20 +- drivers/scsi/sim710.c | 2 + drivers/scsi/stex.c | 1 + drivers/soc/actions/owl-sps.c | 16 +- drivers/soc/amlogic/meson-canvas.c | 5 +- drivers/soc/imx/gpc.c | 12 +- drivers/soc/qcom/ocmem.c | 2 +- drivers/soc/rockchip/pm_domains.c | 13 +- drivers/spi/spi-fsl-spi.c | 2 +- drivers/spi/spi-imx.c | 15 +- drivers/spi/spi-tegra210-quad.c | 307 +++++++++++++++++++-- drivers/spi/spi-xilinx.c | 2 +- drivers/staging/fbtft/fbtft-core.c | 4 +- drivers/staging/media/hantro/hantro_g2_hevc_dec.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 13 +- drivers/target/target_core_configfs.c | 1 - drivers/target/target_core_transport.c | 1 + drivers/tty/serial/8250/8250_pci.c | 37 +++ drivers/tty/serial/sprd_serial.c | 6 + drivers/uio/uio_fsl_elbc_gpcm.c | 7 + drivers/usb/core/message.c | 2 +- drivers/usb/dwc2/platform.c | 16 +- drivers/usb/dwc3/dwc3-of-simple.c | 7 +- drivers/usb/dwc3/gadget.c | 2 +- drivers/usb/dwc3/host.c | 2 +- drivers/usb/gadget/legacy/raw_gadget.c | 3 + drivers/usb/gadget/udc/core.c | 17 +- drivers/usb/gadget/udc/lpc32xx_udc.c | 20 +- drivers/usb/gadget/udc/tegra-xudc.c | 6 - drivers/usb/host/ohci-nxp.c | 20 +- drivers/usb/host/xhci-dbgcap.h | 1 + drivers/usb/host/xhci-dbgtty.c | 52 +++- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 10 +- drivers/usb/host/xhci-ring.c | 8 +- drivers/usb/host/xhci.h | 16 +- drivers/usb/misc/chaoskey.c | 16 +- drivers/usb/phy/phy-fsl-usb.c | 1 + drivers/usb/phy/phy-isp1301.c | 7 +- drivers/usb/phy/phy.c | 4 + drivers/usb/renesas_usbhs/pipe.c | 2 + drivers/usb/serial/belkin_sa.c | 28 +- drivers/usb/serial/ftdi_sio.c | 72 ++--- drivers/usb/serial/kobil_sct.c | 18 +- drivers/usb/serial/option.c | 22 +- drivers/usb/storage/unusual_uas.h | 2 +- drivers/usb/typec/ucsi/ucsi.c | 6 + drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/vdpa/vdpa.c | 231 ++++++++++++++++ drivers/vhost/vdpa.c | 10 +- drivers/vhost/vsock.c | 15 +- drivers/video/backlight/led_bl.c | 18 +- drivers/video/fbdev/gbefb.c | 5 +- drivers/video/fbdev/pxafb.c | 12 +- drivers/video/fbdev/ssd1307fb.c | 4 +- drivers/video/fbdev/tcx.c | 2 +- drivers/virtio/virtio_balloon.c | 4 +- drivers/virtio/virtio_vdpa.c | 6 +- drivers/watchdog/via_wdt.c | 1 + drivers/watchdog/wdat_wdt.c | 65 +++-- fs/bfs/inode.c | 19 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/scrub.c | 5 + fs/btrfs/volumes.c | 1 + fs/exfat/super.c | 19 +- fs/ext4/ext4.h | 1 + fs/ext4/ialloc.c | 1 - fs/ext4/inline.c | 14 +- fs/ext4/inode.c | 6 +- fs/ext4/mballoc.c | 58 ++-- fs/ext4/move_extent.c | 18 +- fs/ext4/orphan.c | 4 +- fs/ext4/super.c | 65 +++-- fs/ext4/xattr.c | 38 +-- fs/ext4/xattr.h | 10 + fs/f2fs/f2fs.h | 3 - fs/f2fs/file.c | 3 +- fs/f2fs/namei.c | 6 +- fs/f2fs/recovery.c | 9 +- fs/f2fs/super.c | 53 ++-- fs/f2fs/xattr.c | 32 +-- fs/f2fs/xattr.h | 10 +- fs/fuse/file.c | 26 +- fs/hfsplus/bnode.c | 4 +- fs/hfsplus/dir.c | 7 +- fs/hfsplus/inode.c | 32 ++- fs/jbd2/journal.c | 14 + fs/jbd2/transaction.c | 21 +- fs/lockd/svc4proc.c | 4 +- fs/lockd/svclock.c | 21 +- fs/lockd/svcproc.c | 5 +- fs/locks.c | 13 +- fs/nfs/Kconfig | 1 + fs/nfs/dir.c | 114 ++++++-- fs/nfs/internal.h | 2 +- fs/nfs/namespace.c | 11 + fs/nfs/nfs2xdr.c | 70 +---- fs/nfs/nfs3xdr.c | 108 ++------ fs/nfs/nfs4proc.c | 21 +- fs/nfs/nfs4trace.h | 1 + fs/nfs/nfs4xdr.c | 44 ++- fs/nfs/pnfs.c | 1 + fs/nfs/super.c | 26 -- fs/nfs_common/Makefile | 2 + fs/nfs_common/common.c | 66 +++++ fs/nfsd/Kconfig | 1 + fs/nfsd/blocklayout.c | 7 +- fs/nfsd/export.c | 2 +- fs/nfsd/netns.h | 2 + fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4state.c | 46 ++- fs/nfsd/nfs4xdr.c | 5 + fs/nfsd/nfsctl.c | 3 +- fs/nfsd/nfsd.h | 1 - fs/nfsd/state.h | 2 +- fs/nfsd/vfs.c | 2 +- fs/nls/nls_base.c | 27 +- fs/notify/fsnotify.c | 9 +- fs/ntfs3/frecord.c | 49 +++- fs/ntfs3/fsntfs.c | 18 +- fs/ntfs3/inode.c | 4 +- fs/ntfs3/namei.c | 2 +- fs/ntfs3/ntfs_fs.h | 12 +- fs/ntfs3/record.c | 22 -- fs/ntfs3/run.c | 6 +- fs/ntfs3/super.c | 2 +- fs/ocfs2/alloc.c | 1 - fs/ocfs2/move_extents.c | 8 +- fs/ocfs2/suballoc.c | 10 + fs/xfs/xfs_buf_item.c | 1 + include/linux/balloon_compaction.h | 65 ++--- include/linux/blk_types.h | 5 +- include/linux/compiler-clang.h | 23 ++ include/linux/compiler-gcc.h | 14 + include/linux/coresight.h | 4 + include/linux/cper.h | 12 +- include/linux/fs_context.h | 1 - include/linux/genalloc.h | 1 + include/linux/hugetlb.h | 4 +- include/linux/i3c/master.h | 1 - include/linux/ieee80211.h | 4 +- include/linux/if_bridge.h | 6 +- include/linux/mm.h | 2 +- include/linux/netdevice.h | 3 +- include/linux/nfs_common.h | 16 ++ include/linux/nfs_fs.h | 9 + include/linux/nfs_fs_sb.h | 2 + include/linux/nfs_xdr.h | 2 + include/linux/platform_data/lp855x.h | 4 +- include/linux/rculist_nulls.h | 59 ++++ include/linux/reset.h | 1 + include/linux/security.h | 2 +- include/linux/soc/renesas/r9a06g032-sysctrl.h | 11 + include/linux/tpm.h | 9 +- include/linux/usb/gadget.h | 5 + include/linux/vdpa.h | 22 +- include/linux/virtio_config.h | 2 +- include/media/v4l2-mem2mem.h | 3 +- include/net/dst.h | 12 + include/net/netfilter/nf_conntrack_count.h | 16 +- include/net/sock.h | 13 + include/net/xfrm.h | 13 +- include/sound/snd_wavefront.h | 4 - include/trace/misc/nfs.h | 3 +- include/uapi/linux/mptcp.h | 1 + include/uapi/linux/nfs.h | 1 - include/uapi/linux/vdpa.h | 6 + include/uapi/sound/asound.h | 2 +- io_uring/io_uring.c | 2 +- kernel/dma/pool.c | 2 +- kernel/livepatch/core.c | 8 +- kernel/locking/spinlock_debug.c | 4 +- kernel/sched/cpudeadline.c | 34 +-- kernel/sched/cpudeadline.h | 4 +- kernel/sched/deadline.c | 8 +- kernel/scs.c | 2 +- kernel/trace/trace_events.c | 2 + lib/crypto/aes.c | 4 +- lib/idr.c | 2 + lib/vsprintf.c | 6 +- mm/balloon_compaction.c | 15 +- mm/damon/core-test.h | 73 ++++- mm/damon/vaddr-test.h | 26 +- mm/hugetlb.c | 4 +- mm/mempolicy.c | 2 +- mm/mprotect.c | 26 +- net/bridge/br_ioctl.c | 36 ++- net/bridge/br_private.h | 4 +- net/bridge/br_vlan_tunnel.c | 11 +- net/caif/cffrml.c | 9 +- net/can/j1939/transport.c | 2 + net/ceph/messenger_v2.c | 2 + net/ceph/mon_client.c | 2 +- net/ceph/osd_client.c | 11 +- net/ceph/osdmap.c | 140 +++++----- net/core/dev_ioctl.c | 15 - net/core/page_pool.c | 18 +- net/core/sock.c | 7 +- net/ethtool/ioctl.c | 134 ++++++--- net/hsr/hsr_forward.c | 2 + net/ipv4/arp.c | 7 +- net/ipv4/fib_trie.c | 7 +- net/ipv4/inet_hashtables.c | 8 +- net/ipv4/ip_output.c | 19 +- net/ipv4/ipcomp.c | 2 + net/ipv4/ping.c | 4 +- net/ipv4/raw.c | 3 + net/ipv6/calipso.c | 3 +- net/ipv6/ip6_gre.c | 9 +- net/ipv6/ip6_output.c | 3 +- net/ipv6/ipcomp6.c | 2 + net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/mac80211/rx.c | 5 + net/mptcp/pm_netlink.c | 3 +- net/netfilter/ipvs/ip_vs_xmit.c | 3 + net/netfilter/nf_conncount.c | 219 ++++++++++----- net/netfilter/nf_tables_api.c | 3 +- net/netfilter/nft_connlimit.c | 34 +-- net/netfilter/nft_flow_offload.c | 9 +- net/netfilter/nft_synproxy.c | 6 +- net/netfilter/xt_connlimit.c | 14 +- net/netrom/nr_out.c | 4 +- net/nfc/core.c | 9 +- net/openvswitch/conntrack.c | 16 +- net/openvswitch/flow_netlink.c | 13 +- net/openvswitch/vport-netdev.c | 17 +- net/rose/af_rose.c | 2 +- net/sched/sch_cake.c | 60 ++-- net/sched/sch_ets.c | 6 +- net/sched/sch_qfq.c | 2 +- net/sctp/socket.c | 5 +- net/socket.c | 19 +- net/sunrpc/auth_gss/svcauth_gss.c | 3 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 5 +- net/tls/tls_device.c | 18 +- net/wireless/wext-core.c | 4 + net/wireless/wext-priv.c | 4 + net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 41 ++- net/xfrm/xfrm_user.c | 2 +- samples/vfs/test-statx.c | 6 + samples/watch_queue/watch_test.c | 6 + scripts/Makefile.modinst | 2 +- security/integrity/ima/ima_policy.c | 2 +- security/keys/trusted-keys/trusted_tpm2.c | 6 +- security/smack/smack_lsm.c | 41 ++- sound/firewire/dice/dice-extension.c | 4 +- sound/isa/wavefront/wavefront.c | 61 ++-- sound/isa/wavefront/wavefront_fx.c | 36 +-- sound/isa/wavefront/wavefront_midi.c | 17 +- sound/isa/wavefront/wavefront_synth.c | 198 ++++++------- sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +- sound/pcmcia/vx/vxpocket.c | 8 +- sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +- sound/soc/codecs/ak4458.c | 10 +- sound/soc/codecs/ak5558.c | 10 +- sound/soc/fsl/fsl_sai.c | 3 + sound/soc/fsl/fsl_xcvr.c | 197 ++++++++++--- sound/soc/fsl/fsl_xcvr.h | 28 ++ sound/soc/intel/catpt/pcm.c | 4 +- sound/soc/qcom/qdsp6/q6adm.c | 146 +++++----- sound/soc/qcom/qdsp6/q6asm-dai.c | 7 +- sound/soc/stm/stm32_i2s.c | 62 ++--- sound/soc/stm/stm32_sai.c | 51 ++-- sound/soc/stm/stm32_sai_sub.c | 65 +++-- sound/soc/stm/stm32_spdifrx.c | 44 +-- sound/usb/mixer_us16x08.c | 20 +- tools/perf/util/symbol.c | 4 +- tools/testing/ktest/config-bisect.pl | 4 +- tools/testing/nvdimm/test/nfit.c | 7 +- tools/testing/radix-tree/idr-test.c | 21 ++ .../selftests/bpf/prog_tests/perf_branches.c | 22 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 5 + .../selftests/bpf/progs/test_perf_branches.c | 3 + .../test.d/ftrace/func_traceonoff_triggers.tc | 5 +- .../testing/selftests/net/test_vxlan_under_vrf.sh | 2 + 550 files changed, 5691 insertions(+), 3045 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/554 xfrm: delete x->tunnel as we delete x
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b441cf3f8c4b8576639d20c8eb4aa32917602ecd ]
The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete.
We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state.
Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped.
A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked.
--- include/net/xfrm.h | 1 - net/ipv4/ipcomp.c | 2 ++ net/ipv6/ipcomp6.c | 2 ++ net/ipv6/xfrm6_tunnel.c | 2 +- net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 19 ++++++++----------- 6 files changed, 13 insertions(+), 14 deletions(-)
include/net/xfrm.h +0 -1
@@ -394,7 +394,6 @@ int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);int xfrm_input_unregister_afinfo (const struct xfrm_input_afinfo *afinfo);void xfrm_flush_gc (void ); -void xfrm_state_delete_tunnel (struct xfrm_state *x);struct xfrm_type {struct module *owner;
net/ipv4/ipcomp.c +2 -0
@@ -54,6 +54,7 @@ static int ipcomp4_err(struct sk_buff *skb, u32 info) }/* We always hold one tunnel user reference to indicate a tunnel */ +static struct lock_class_key xfrm_state_lock_key;static struct xfrm_state *ipcomp_tunnel_create (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -62,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x) t =xfrm_state_alloc (net);if (!t) goto out; +lockdep_set_class (&t->lock, &xfrm_state_lock_key); t->id.proto =IPPROTO_IPIP ; t->id.spi = x->props.saddr.a4;
net/ipv6/ipcomp6.c +2 -0
@@ -71,6 +71,7 @@ static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,return 0 ; } +static struct lock_class_key xfrm_state_lock_key;static struct xfrm_state *ipcomp6_tunnel_create (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -79,6 +80,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x) t =xfrm_state_alloc (net);if (!t) goto out; +lockdep_set_class (&t->lock, &xfrm_state_lock_key); t->id.proto =IPPROTO_IPV6 ; t->id.spi =xfrm6_tunnel_alloc_spi (net, (xfrm_address_t *)&x->props.saddr);
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -330,8 +330,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_flush_gc ();xfrm_state_flush (net,0 , false, true); +xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)WARN_ON_ONCE (!hlist_empty (&xfrm6_tn->spi_byaddr[i]));
net/xfrm/xfrm_ipcomp.c +0 -1
@@ -318,7 +318,6 @@ void ipcomp_destroy(struct xfrm_state *x)struct ipcomp_data *ipcd = x->data;if (!ipcd)return ; -xfrm_state_delete_tunnel (x);mutex_lock (&ipcomp_resource_mutex);ipcomp_free_data (ipcd);mutex_unlock (&ipcomp_resource_mutex);
net/xfrm/xfrm_state.c +8 -11
@@ -675,6 +675,7 @@ void __xfrm_state_destroy(struct xfrm_state *x, bool sync) }EXPORT_SYMBOL (__xfrm_state_destroy); +static void xfrm_state_delete_tunnel (struct xfrm_state *x);int __xfrm_state_delete (struct xfrm_state *x) {struct net *net =xs_net (x);
@@ -698,6 +699,8 @@ int __xfrm_state_delete(struct xfrm_state *x)xfrm_dev_state_delete (x); +xfrm_state_delete_tunnel (x); +/* All xfrm_state objects are created by xfrm_state_alloc. * The xfrm_state_alloc call gives a reference, and that * is what we are dropping here.
@@ -801,10 +804,7 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync) err =xfrm_state_delete (x);xfrm_audit_state_delete (x, err ?0 :1 , task_valid); -if (sync) -xfrm_state_put_sync (x); -else -xfrm_state_put (x); +xfrm_state_put (x);if (!err) cnt++;
@@ -2567,20 +2567,17 @@ void xfrm_flush_gc(void) }EXPORT_SYMBOL (xfrm_flush_gc); -/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ -void xfrm_state_delete_tunnel (struct xfrm_state *x) +static void xfrm_state_delete_tunnel (struct xfrm_state *x) {if (x->tunnel) {struct xfrm_state *t = x->tunnel; -if (atomic_read (&t->tunnel_users) ==2 ) +if (atomic_dec_return (&t->tunnel_users) ==1 )xfrm_state_delete (t); -atomic_dec (&t->tunnel_users); -xfrm_state_put_sync (t); +xfrm_state_put (t); x->tunnel =NULL ; } } -EXPORT_SYMBOL (xfrm_state_delete_tunnel);u32 xfrm_state_mtu (struct xfrm_state *x,int mtu) {
@@ -2748,8 +2745,8 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -flush_work (&xfrm_state_gc_work);xfrm_state_flush (net,0 , false, true); +flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/554 Revert "xfrm: destroy xfrm_state synchronously on net exit path"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 2a198bbec6913ae1c90ec963750003c6213668c7 ]
This reverts commit f75a2804da391571563c4b6b29e7797787332673.
With all states (whether user or kern) removed from the hashtables during deletion, there's no need for synchronous destruction of states. xfrm6_tunnel states still need to have been destroyed (which will be the case when its last user is deleted (not destroyed)) so that xfrm6_tunnel_free_spi removes it from the per-netns hashtable before the netns is destroyed.
This has the benefit of skipping one synchronize_rcu per state (in __xfrm_state_destroy(sync=true)) when we exit a netns.
--- include/net/xfrm.h | 12 +++--------- net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/xfrm/xfrm_state.c | 23 +++++++++-------------- net/xfrm/xfrm_user.c | 2 +- 5 files changed, 15 insertions(+), 26 deletions(-)
include/net/xfrm.h +3 -9
@@ -785,7 +785,7 @@ static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)xfrm_pol_put (pols[i]); } -void __xfrm_state_destroy (struct xfrm_state *,bool ); +void __xfrm_state_destroy (struct xfrm_state *);static inline void __xfrm_state_put (struct xfrm_state *x) {
@@ -795,13 +795,7 @@ static inline void __xfrm_state_put(struct xfrm_state *x)static inline void xfrm_state_put (struct xfrm_state *x) {if (refcount_dec_and_test (&x->refcnt)) -__xfrm_state_destroy (x, false); -} - -static inline void xfrm_state_put_sync (struct xfrm_state *x) -{ -if (refcount_dec_and_test (&x->refcnt)) -__xfrm_state_destroy (x, true); +__xfrm_state_destroy (x); }static inline void xfrm_state_hold (struct xfrm_state *x)
@@ -1577,7 +1571,7 @@ struct xfrmk_spdinfo {struct xfrm_state *xfrm_find_acq_byseq (struct net *net,u32 mark,u32 seq);int xfrm_state_delete (struct xfrm_state *x); -int xfrm_state_flush (struct net *net,u8 proto,bool task_valid,bool sync); +int xfrm_state_flush (struct net *net,u8 proto,bool task_valid);int xfrm_dev_state_flush (struct net *net,struct net_device *dev,bool task_valid);void xfrm_sad_getinfo (struct net *net,struct xfrmk_sadinfo *si);void xfrm_spd_getinfo (struct net *net,struct xfrmk_spdinfo *si);
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -330,7 +330,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_state_flush (net,0 , false, true); +xfrm_state_flush (net,IPSEC_PROTO_ANY , false);xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)
net/key/af_key.c +1 -1
@@ -1766,7 +1766,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_mif (proto ==0 )return -EINVAL ; - err =xfrm_state_flush (net, proto, true, false); + err =xfrm_state_flush (net, proto, true); err2 =unicast_flush_resp (sk, hdr);if (err || err2) {if (err == -ESRCH )/* empty table - go quietly */
net/xfrm/xfrm_state.c +9 -14
@@ -497,7 +497,7 @@ void xfrm_state_free(struct xfrm_state *x) }EXPORT_SYMBOL (xfrm_state_free); -static void ___xfrm_state_destroy (struct xfrm_state *x) +static void xfrm_state_gc_destroy (struct xfrm_state *x) {hrtimer_cancel (&x->mtimer);del_timer_sync (&x->rtimer);
@@ -535,7 +535,7 @@ static void xfrm_state_gc_task(struct work_struct *work)synchronize_rcu ();hlist_for_each_entry_safe (x, tmp, &gc_list, gclist) -___xfrm_state_destroy (x); +xfrm_state_gc_destroy (x); }static enum hrtimer_restart xfrm_timer_handler (struct hrtimer *me)
@@ -659,19 +659,14 @@ struct xfrm_state *xfrm_state_alloc(struct net *net) }EXPORT_SYMBOL (xfrm_state_alloc); -void __xfrm_state_destroy (struct xfrm_state *x,bool sync) +void __xfrm_state_destroy (struct xfrm_state *x) {WARN_ON (x->km.state !=XFRM_STATE_DEAD ); -if (sync) { -synchronize_rcu (); -___xfrm_state_destroy (x); - }else { -spin_lock_bh (&xfrm_state_gc_lock); -hlist_add_head (&x->gclist, &xfrm_state_gc_list); -spin_unlock_bh (&xfrm_state_gc_lock); -schedule_work (&xfrm_state_gc_work); - } +spin_lock_bh (&xfrm_state_gc_lock); +hlist_add_head (&x->gclist, &xfrm_state_gc_list); +spin_unlock_bh (&xfrm_state_gc_lock); +schedule_work (&xfrm_state_gc_work); }EXPORT_SYMBOL (__xfrm_state_destroy);
@@ -782,7 +777,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool }#endif -int xfrm_state_flush (struct net *net,u8 proto,bool task_valid,bool sync) +int xfrm_state_flush (struct net *net,u8 proto,bool task_valid) {int i, err =0 , cnt =0 ;
@@ -2745,7 +2740,7 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -xfrm_state_flush (net,0 , false, true); +xfrm_state_flush (net,IPSEC_PROTO_ANY , false);flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
net/xfrm/xfrm_user.c +1 -1
@@ -2210,7 +2210,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,struct xfrm_usersa_flush *p =nlmsg_data (nlh);int err; - err =xfrm_state_flush (net, p->proto, true, false); + err =xfrm_state_flush (net, p->proto, true);if (err) {if (err == -ESRCH )/* empty table */ return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/554 xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 10deb69864840ccf96b00ac2ab3a2055c0c04721 ]
In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists.
In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel.
There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved.
At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).
--- net/xfrm/xfrm_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/xfrm/xfrm_state.c +2 -1
@@ -497,6 +497,7 @@ void xfrm_state_free(struct xfrm_state *x) }EXPORT_SYMBOL (xfrm_state_free); +static void xfrm_state_delete_tunnel (struct xfrm_state *x);static void xfrm_state_gc_destroy (struct xfrm_state *x) {hrtimer_cancel (&x->mtimer);
@@ -511,6 +512,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)kfree (x->preplay_esn);if (x->type_offload)xfrm_put_type_offload (x->type_offload); +xfrm_state_delete_tunnel (x);if (x->type) { x->type->destructor (x);xfrm_put_type (x->type);
@@ -670,7 +672,6 @@ void __xfrm_state_destroy(struct xfrm_state *x) }EXPORT_SYMBOL (__xfrm_state_destroy); -static void xfrm_state_delete_tunnel (struct xfrm_state *x);int __xfrm_state_delete (struct xfrm_state *x) {struct net *net =xs_net (x);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/554 xfrm: flush all states in xfrm_state_fini
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 42e42562c9cfcdacf000f1b42284a4fad24f8546 ]
While reverting commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path"), I incorrectly changed xfrm_state_flush's "proto" argument back to IPSEC_PROTO_ANY. This reverts some of the changes in commit dbb2483b2a46 ("xfrm: clean up xfrm protocol checks"), and leads to some states not being removed when we exit the netns.
Pass 0 instead of IPSEC_PROTO_ANY from both xfrm_state_fini xfrm6_tunnel_net_exit, so that xfrm_state_flush deletes all states.
--- net/ipv6/xfrm6_tunnel.c | 2 +- net/xfrm/xfrm_state.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -330,7 +330,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)struct xfrm6_tunnel_net *xfrm6_tn =xfrm6_tunnel_pernet (net);unsigned int i; -xfrm_state_flush (net,IPSEC_PROTO_ANY , false); +xfrm_state_flush (net,0 , false);xfrm_flush_gc ();for (i =0 ; i <XFRM6_TUNNEL_SPI_BYADDR_HSIZE ; i++)
net/xfrm/xfrm_state.c +1 -1
@@ -2741,7 +2741,7 @@ void xfrm_state_fini(struct net *net)unsigned int sz;flush_work (&net->xfrm.state_hash_work); -xfrm_state_flush (net,IPSEC_PROTO_ANY , false); +xfrm_state_flush (net,0 , false);flush_work (&xfrm_state_gc_work);WARN_ON (!list_empty (&net->xfrm.state_all));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/554 dpaa2-mac: bail if the dpmacs fwnode is not found
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert-Ionut Alexa <[email protected]>
[ Upstream commit 5b1e38c0792cc7a44997328de37d393f81b2501a ]
The parent pointer node handler must be declared with a NULL initializer. Before using it, a check must be performed to make sure that a valid address has been assigned to it.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c +4 -1
@@ -40,7 +40,7 @@ static int phy_mode(enum dpmac_eth_if eth_if, phy_interface_t *if_mode)static struct fwnode_handle *dpaa2_mac_get_node (struct device *dev,u16 dpmac_id) { -struct fwnode_handle *fwnode, *parent, *child =NULL ; +struct fwnode_handle *fwnode, *parent =NULL , *child =NULL ;struct device_node *dpmacs =NULL ;int err;u32 id;
@@ -55,6 +55,9 @@ static struct fwnode_handle *dpaa2_mac_get_node(struct device *dev, parent = fwnode; } +if (!parent) +return NULL ; +fwnode_for_each_child_node (parent, child) { err = -EINVAL ;if (is_acpi_device_node (child))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/554 drm/i915/selftests: Fix inconsistent IS_ERR and PTR_ERR
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Song <[email protected]>
[ Upstream commit fc7bf4c0d65a342b29fe38c332db3fe900b481b9 ]
Fix inconsistent IS_ERR and PTR_ERR in i915_gem_dmabuf.c
--- drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c +2 -2
@@ -102,7 +102,7 @@ static int igt_dmabuf_import_same_driver_lmem(void *arg) obj =__i915_gem_object_create_user (i915,PAGE_SIZE , &lmem,1 );if (IS_ERR (obj)) {pr_err ("__i915_gem_object_create_user failed with err=%ld\n" , -PTR_ERR (dmabuf)); +PTR_ERR (obj)); err =PTR_ERR (obj); goto out_ret; }
@@ -158,7 +158,7 @@ static int igt_dmabuf_import_same_driver(struct drm_i915_private *i915, regions, num_regions);if (IS_ERR (obj)) {pr_err ("__i915_gem_object_create_user failed with err=%ld\n" , -PTR_ERR (dmabuf)); +PTR_ERR (obj)); err =PTR_ERR (obj); goto out_ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/554 leds: Replace all non-returning strlcpy with strscpy
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azeem Shaikh <[email protected]>
[ Upstream commit bf4a35e9201d30b63a8d276797d6ecfaa596ccd3 ]
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89
Stable-dep-of: ccc35ff2fd29 ("leds: spi-byte: Use devm_led_classdev_register_ext()")
--- drivers/leds/flash/leds-aat1290.c | 2 +- drivers/leds/led-class.c | 2 +- drivers/leds/leds-spi-byte.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/leds/flash/leds-aat1290.c +1 -1
@@ -425,7 +425,7 @@ static void aat1290_init_v4l2_flash_config(struct aat1290_led *led,struct led_classdev *led_cdev = &led->fled_cdev.led_cdev;struct led_flash_setting *s; -strlcpy (v4l2_sd_cfg->dev_name, led_cdev->dev->kobj.name, +strscpy (v4l2_sd_cfg->dev_name, led_cdev->dev->kobj.name,sizeof (v4l2_sd_cfg->dev_name)); s = &v4l2_sd_cfg->intensity;
drivers/leds/led-class.c +1 -1
@@ -321,7 +321,7 @@ static int led_classdev_next_name(const char *init_name, char *name,int ret =0 ;struct device *dev; -strlcpy (name, init_name, len); +strscpy (name, init_name, len);while ((ret < len) && (dev =class_find_device_by_name (leds_class, name))) {
drivers/leds/leds-spi-byte.c +1 -1
@@ -97,7 +97,7 @@ static int spi_byte_probe(struct spi_device *spi)return -ENOMEM ;of_property_read_string (child,"label" , &name); -strlcpy (led->name, name,sizeof (led->name)); +strscpy (led->name, name,sizeof (led->name)); led->spi = spi;mutex_init (&led->mutex); led->cdef =device_get_match_data (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/554 leds: spi-byte: Use devm_led_classdev_register_ext()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kalscheuer <[email protected]>
[ Upstream commit ccc35ff2fd2911986b716a87fe65e03fac2312c9 ]
Use extended classdev registration to generate generic device names from color and function enums instead of reading only the label from the device tree.
--- drivers/leds/leds-spi-byte.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/leds/leds-spi-byte.c +6 -5
@@ -83,7 +83,7 @@ static int spi_byte_probe(struct spi_device *spi)struct device_node *child;struct device *dev = &spi->dev;struct spi_byte_led *led; -const char *name ="leds-spi-byte::" ; +struct led_init_data init_data = {};const char *state;int ret;
@@ -96,12 +96,9 @@ static int spi_byte_probe(struct spi_device *spi)if (!led)return -ENOMEM ; -of_property_read_string (child,"label" , &name); -strscpy (led->name, name,sizeof (led->name)); led->spi = spi;mutex_init (&led->mutex); led->cdef =device_get_match_data (dev); - led->ldev.name = led->name; led->ldev.brightness =LED_OFF ; led->ldev.max_brightness = led->cdef->max_value - led->cdef->off_value; led->ldev.brightness_set_blocking = spi_byte_brightness_set_blocking;
@@ -121,7 +118,11 @@ static int spi_byte_probe(struct spi_device *spi)spi_byte_brightness_set_blocking (&led->ldev, led->ldev.brightness); - ret =devm_led_classdev_register (&spi->dev, &led->ldev); + init_data.fwnode =of_fwnode_handle (child); + init_data.devicename ="leds-spi-byte" ; + init_data.default_label =":" ; + + ret =devm_led_classdev_register_ext (&spi->dev, &led->ldev, &init_data);if (ret) {of_node_put (child);mutex_destroy (&led->mutex);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/554 Documentation: process: Also mention Sasha Levin as stable tree maintainer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
commit ba2457109d5b47a90fe565b39524f7225fc23e60 upstream.
Sasha has also maintaining stable branch in conjunction with Greg since cb5d21946d2a2f ("MAINTAINERS: Add Sasha as a stable branch maintainer"). Mention him in 2.Process.rst.
Message-ID: <[email protected]>
--- Documentation/process/2.Process.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
Documentation/process/2.Process.rst +4 -2
@@ -104,8 +104,10 @@ kernels go out with a handful of known r of them are serious. Once a stable release is made, its ongoing maintenance is passed off to the -"stable team," currently Greg Kroah-Hartman. The stable team will release -occasional updates to the stable release using the 5.x.y numbering scheme. +"stable team," currently consists of Greg Kroah-Hartman and Sasha Levin. The +stable team will release occasional updates to the stable release using the +5.x.y numbering scheme. + To be considered for an update release, a patch must (1) fix a significant bug, and (2) already be merged into the mainline for the next development kernel. Kernels will typically receive stable updates for a little more
Greg Kroah-Hartman
maintainerPATCH 10/554 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 986835bf4d11032bba4ab8414d18fce038c61bb4 upstream.
There's issue when file system corrupted:
------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0 Call Trace: <TASK> __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data.
In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue.
Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON.
Message-ID: <[email protected]>
--- fs/jbd2/transaction.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
fs/jbd2/transaction.c +14 -5
@@ -1294,14 +1294,23 @@ int jbd2_journal_get_create_access(handl* committing transaction's lists, but it HAS to be in Forget state in * that case: the transaction must have deleted the buffer for it to be * reused here. +* In the case of file system data inconsistency, for example, if the +* block bitmap of a referenced block is not set, it can lead to the +* situation where a block being committed is allocated and used again. +* As a result, the following condition will not be satisfied, so here +* we directly trigger a JBD abort instead of immediately invoking +* bugon. */ spin_lock (&jh->b_state_lock); -J_ASSERT_JH (jh, (jh->b_transaction == transaction || - jh->b_transaction ==NULL || - (jh->b_transaction == journal->j_committing_transaction && - jh->b_jlist == BJ_Forget))); +if (!(jh->b_transaction == transaction || jh->b_transaction ==NULL || + (jh->b_transaction == journal->j_committing_transaction && + jh->b_jlist == BJ_Forget)) || jh->b_next_transaction !=NULL ) { + err = -EROFS ; +spin_unlock (&jh->b_state_lock); +jbd2_journal_abort (journal, err); + goto out; + } -J_ASSERT_JH (jh, jh->b_next_transaction ==NULL );J_ASSERT_JH (jh,buffer_locked (jh2bh (jh)));if (jh->b_transaction ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 11/554 ext4: refresh inline data size before write operations
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b upstream.
The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired.
This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data():
kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);
The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers
Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications.
This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -413,7 +413,12 @@ static int ext4_prepare_inline_data(handreturn -ENOSPC ;ext4_write_lock_xattr (inode, &no_expand); - +/* +* ei->i_inline_size may have changed since the initial check +* if other xattrs were added. Recalculate to ensure +* ext4_update_inline_data() validates against current capacity. +*/ + (void )ext4_find_inline_data_nolock (inode);if (ei->i_inline_off) ret =ext4_update_inline_data (handle, inode, len);else
Greg Kroah-Hartman
maintainerPATCH 12/554 locking/spinlock/debug: Fix data-race in do_raw_write_lock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit c14ecb555c3ee80eeb030a4e46d00e679537f03a upstream.
KCSAN reports:
BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock
write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
do_raw_write_lock+0x88/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
value changed: 0xffffffff -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111
Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete.
Quoted 1 line
From
do_raw_write_lock()onlydebug_write_lock_after()part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now.
--- kernel/locking/spinlock_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/locking/spinlock_debug.c +2 -2
@@ -183,8 +183,8 @@ void do_raw_read_unlock(rwlock_t *lock)static inline void debug_write_lock_before (rwlock_t *lock) {RWLOCK_BUG_ON (lock->magic !=RWLOCK_MAGIC , lock,"bad magic" ); -RWLOCK_BUG_ON (lock->owner == current, lock,"recursion" ); -RWLOCK_BUG_ON (lock->owner_cpu ==raw_smp_processor_id (), +RWLOCK_BUG_ON (READ_ONCE (lock->owner) == current, lock,"recursion" ); +RWLOCK_BUG_ON (READ_ONCE (lock->owner_cpu) ==raw_smp_processor_id (), lock,"cpu recursion" ); }
Greg Kroah-Hartman
maintainerPATCH 13/554 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Nepomnyashih <[email protected]>
commit 0cd8feea8777f8d9b9a862b89c688b049a5c8475 upstream.
Fix a race between inline data destruction and block mapping.
The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks().
Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert.
kernel BUG at fs/ext4/indirect.c:546!
EXT4-fs (loop2): unmounting filesystem.
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546 Call Trace: <TASK> ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:2271 [inline] do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10f/0x170 fs/splice.c:950 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -446,9 +446,13 @@ static int ext4_destroy_inline_data_noloif (!ei->i_inline_off)return 0 ; +down_write (&ei->i_data_sem); + error =ext4_get_inode_loc (inode, &is.iloc); -if (error) +if (error) { +up_write (&ei->i_data_sem);return error; + } error =ext4_xattr_ibody_find (inode, &i, &is);if (error)
@@ -487,6 +491,7 @@ out:brelse (is.iloc.bh);if (error == -ENODATA ) error =0 ; +up_write (&ei->i_data_sem);return error; }
Greg Kroah-Hartman
maintainerPATCH 14/554 comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit a51f025b5038abd3d22eed2ede4cd46793d89565 upstream.
Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its pointer to &struct comedi_async as intended. Thus, any such dereferencing of &s->async->cmd will lead to general protection fault and kernel crash.
Mitigate this problem by removing a call to pcl818_ai_cancel() from pcl818_detach() altogether. This way, if the subdevice setups its support for async commands, everything async-related will be handled via subdevice's own ->cancel() function in comedi_device_detach_locked() even before pcl818_detach(). If no support for asynchronous commands is provided, there is no need to cancel anything either.
[1] Syzbot crash:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762 ... Call Trace: <TASK> pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline] comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline]
...
--- drivers/comedi/drivers/pcl818.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/comedi/drivers/pcl818.c +2 -3
@@ -1113,10 +1113,9 @@ static void pcl818_detach(struct comedi_ {struct pcl818_private *devpriv = dev->private; -if (devpriv) { -pcl818_ai_cancel (dev, dev->read_subdev); +if (devpriv)pcl818_reset (dev); - } +pcl818_free_dma (dev);comedi_legacy_detach (dev); }
Greg Kroah-Hartman
maintainerPATCH 15/554 USB: serial: option: add Foxconn T99W760
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
commit 7970b4969c4c99bcdaf105f9f39c6d2021f6d244 upstream.
T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are three serial ports to be enumerated: Modem, NMEA and Diag.
test evidence as below:
T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e123 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXBAAGHA-IDP _SN:39A8D3E4 S: SerialNumber=39a8d3e4 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2376,6 +2376,8 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe123, 0xff), /* Foxconn T99W760 MBIM */ + .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe15f, 0xff), /* Foxconn T99W709 */
Greg Kroah-Hartman
maintainerPATCH 16/554 USB: serial: option: add Telit Cinterion FE910C04 new compositions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit c908039a29aa70870871f4848125b3d743f929bf upstream.
Add the following Telit Cinterion new compositions:
0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c5 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10cb Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/serial/option.c +14 -0
@@ -1433,10 +1433,24 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c1, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c2, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c3, 0xff), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c5, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10cb, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 17/554 USB: serial: option: move Telit 0x10c7 composition in the right place
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 072f2c49572547f4b0776fe2da6b8f61e4b34699 upstream.
Move Telit 0x10c7 composition right after 0x10c6 composition and before 0x10c8 composition.
--- drivers/usb/serial/option.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/serial/option.c +3 -3
@@ -1445,6 +1445,9 @@ static const struct usb_device_id option .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */
@@ -1455,9 +1458,6 @@ static const struct usb_device_id option .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ - .driver_info = NCTRL(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ .driver_info = NCTRL(6) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 18/554 USB: serial: ftdi_sio: match on interface number for jtag
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4e31a5d0a9ee672f708fc993c1d5520643f769fd upstream.
Some FTDI devices have the first port reserved for JTAG and have been using a dedicated quirk to prevent binding to it.
As can be inferred directly or indirectly from the commit messages, almost all of these devices are dual port devices which means that the more recently added macro for matching on interface number can be used instead (and some such devices do so already).
This avoids probing interfaces that will never be bound and cleans up the match table somewhat.
Note that the JTAG quirk is kept for quad port devices, which would otherwise require three match entries.
--- drivers/usb/serial/ftdi_sio.c | 72 ++++++++++++++---------------------------- 1 file changed, 24 insertions(+), 48 deletions(-)
drivers/usb/serial/ftdi_sio.c +24 -48
@@ -606,10 +606,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) }, { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TIAO_UMPA_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_NT_ORIONLXM_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },
@@ -820,24 +818,17 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, - { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, CYBER_CORTEX_AV_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) }, - { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FIC_VID, FIC_NEO1973_DEBUG_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_OOCDLINK_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
@@ -879,17 +870,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(ATMEL_VID, STK541_PID) }, { USB_DEVICE(DE_VID, STB_PID) }, { USB_DEVICE(DE_VID, WHT_PID) }, - { USB_DEVICE(ADI_VID, ADI_GNICE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICEPLUS_PID, 1) }, { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,USB_CLASS_VENDOR_SPEC , USB_SUBCLASS_VENDOR_SPEC, 0x00) }, { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) }, { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, - { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(MARVELL_VID, MARVELL_SHEEVAPLUG_PID, 1) }, { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) }, { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) }, { USB_DEVICE(FTDI_VID, PI_C865_PID) },
@@ -912,10 +900,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(PI_VID, PI_1016_PID) }, { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) }, { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, - { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, TI_XDS100V2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, MARVELL_OPENRD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, TI_XDS100V2_PID, 1) }, { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
@@ -924,18 +910,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_ST_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID, 1) }, { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) }, { USB_DEVICE(FTDI_VID, ACCESIO_COM4SM_PID) }, - { USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(IONICS_VID, IONICS_PLUGCOMPUTER_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_24_MASTER_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_PC_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_USB_DMX_PID) },
@@ -950,15 +932,12 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, - { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ST_VID, ST_STMCLT_2232_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ST_VID, ST_STMCLT_2232_PID, 1) }, { USB_DEVICE(ST_VID, ST_STMCLT_4232_PID), .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk }, { USB_DEVICE(FTDI_VID, FTDI_RF_R106) }, - { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },/* Crucible Devices */ { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
@@ -1033,8 +1012,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, - { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(TI_VID, TI_CC3200_LAUNCHPAD_PID, 1) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
@@ -1054,10 +1032,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },/* FreeCalypso USB adapters */ - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID, 1) },/* GMC devices */ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) },/* Altera USB Blaster 3 */
Greg Kroah-Hartman
maintainerPATCH 19/554 serial: add support of CPCI cards
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magne Bruno <[email protected]>
commit 0e5a99e0e5f50353b86939ff6e424800d769c818 upstream.
Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI). Those cards are identified with different DeviceIds. Those cards integrating standard UARTs work the same way as PCI/PCIe models already supported in the serial driver.
--- drivers/tty/serial/8250/8250_pci.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
drivers/tty/serial/8250/8250_pci.c +37 -0
@@ -2134,6 +2134,11 @@ pci_moxa_setup(struct serial_private *pr#define PCI_DEVICE_ID_MOXA_CP138E_A 0x1381#define PCI_DEVICE_ID_MOXA_CP168EL_A 0x1683 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500 0x7003 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG 0x7024 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG 0x7025 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG 0x7026 +/* Unknown vendors/cards - this should not be in linux/pci_ids.h */ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584#define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -6297,6 +6302,38 @@ static const struct pci_device_id serial0 , pbn_ADDIDATA_PCIe_8_3906250 }, + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500 , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_2_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_1_115200 }, + { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,PCI_VENDOR_ID_IBM ,0x0299 , 0, 0, pbn_b0_bt_2_115200 },
Greg Kroah-Hartman
maintainerPATCH 20/554 USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b6e0b3016187446ddef9edac03cd9d544ac63f11 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing regression dating back to 2003 when the tiocmset() callback was introduced.
--- drivers/usb/serial/belkin_sa.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/usb/serial/belkin_sa.c +17 -11
@@ -428,7 +428,7 @@ static int belkin_sa_tiocmset(struct ttystruct belkin_sa_private *priv =usb_get_serial_port_data (port);unsigned long control_state;unsigned long flags; -int retval; +int retval =0 ;int rts =0 ;int dtr =0 ;
@@ -445,26 +445,32 @@ static int belkin_sa_tiocmset(struct tty }if (clear &TIOCM_RTS ) { control_state &= ~TIOCM_RTS ; - rts =0 ; + rts =1 ; }if (clear &TIOCM_DTR ) { control_state &= ~TIOCM_DTR ; - dtr =0 ; + dtr =1 ; } priv->control_state = control_state;spin_unlock_irqrestore (&priv->lock, flags); - retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , rts); -if (retval <0 ) { -dev_err (&port->dev,"Set RTS error %d\n" , retval); - goto exit; +if (rts) { + retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , + !!(control_state &TIOCM_RTS )); +if (retval <0 ) { +dev_err (&port->dev,"Set RTS error %d\n" , retval); + goto exit; + } } - retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , dtr); -if (retval <0 ) { -dev_err (&port->dev,"Set DTR error %d\n" , retval); - goto exit; +if (dtr) { + retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , + !!(control_state &TIOCM_DTR )); +if (retval <0 ) { +dev_err (&port->dev,"Set DTR error %d\n" , retval); + goto exit; + } } exit:return retval;
Greg Kroah-Hartman
maintainerPATCH 21/554 USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d432df758f92c4c28aac409bc807fd1716167577 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing issue dating back to 2003 when the support for these ioctls was added with the introduction of the tiocmset() callback.
--- drivers/usb/serial/kobil_sct.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/usb/serial/kobil_sct.c +9 -9
@@ -419,7 +419,7 @@ static int kobil_tiocmset(struct tty_strstruct usb_serial_port *port = tty->driver_data;struct device *dev = &port->dev;struct kobil_private *priv; -int result; +int result =0 ;int dtr =0 ;int rts =0 ;
@@ -436,12 +436,12 @@ static int kobil_tiocmset(struct tty_strif (set &TIOCM_DTR ) dtr =1 ;if (clear &TIOCM_RTS ) - rts =0 ; + rts =1 ;if (clear &TIOCM_DTR ) - dtr =0 ; + dtr =1 ; -if (priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { -if (dtr !=0 ) +if (dtr && priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { +if (set &TIOCM_DTR )dev_dbg (dev,"%s - Setting DTR\n" , __func__);else dev_dbg (dev,"%s - Clearing DTR\n" , __func__);
@@ -449,13 +449,13 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((dtr !=0 ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ), + ((set &TIOCM_DTR ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ),0 ,NULL ,0 , KOBIL_TIMEOUT); - }else { -if (rts !=0 ) + }else if (rts) { +if (set &TIOCM_RTS )dev_dbg (dev,"%s - Setting RTS\n" , __func__);else dev_dbg (dev,"%s - Clearing RTS\n" , __func__);
@@ -463,7 +463,7 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((rts !=0 ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ), + ((set &TIOCM_RTS ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ),0 ,NULL , 0,
Greg Kroah-Hartman
maintainerPATCH 22/554 spi: xilinx: increase number of retries before declaring stall
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvaro Gamez Machado <[email protected]>
[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
SPI devices using a (relative) slow frequency need a larger time.
For instance, microblaze running at 83.25MHz and performing a 3 bytes transaction using a 10MHz/16 = 625kHz needed this stall value increased to at least 20. The SPI device is quite slow, but also is the microblaze, so set this value to 32 to give it even more margin.
--- drivers/spi/spi-xilinx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-xilinx.c +1 -1
@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)/* Read out all the data from the Rx FIFO */ rx_words = n_words; - stalled =10 ; + stalled =32 ;while (rx_words) { if (rx_words == n_words && !(stalled--) && !(sr & XSPI_SR_TX_EMPTY_MASK) &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/554 spi: imx: keep dma request disabled before dma transfer setup
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Gong <[email protected]>
[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below:
"It is thus essential for the Arm platform to program them before any DMA
request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started."
--- drivers/spi/spi-imx.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/spi/spi-imx.c +11 -4
@@ -498,9 +498,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) {u32 reg; - reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); - reg |=MX51_ECSPI_CTRL_XCH ; -writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); +if (spi_imx->usedma) { + reg =readl (spi_imx->base +MX51_ECSPI_DMA ); + reg |=MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN ; +writel (reg, spi_imx->base +MX51_ECSPI_DMA ); + }else { + reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); + reg |=MX51_ECSPI_CTRL_XCH ; +writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); + } }static void mx51_disable_dma (struct spi_imx_data *spi_imx)
@@ -665,7 +671,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)writel (MX51_ECSPI_DMA_RX_WML (spi_imx->wml -1 ) |MX51_ECSPI_DMA_TX_WML (tx_wml) |MX51_ECSPI_DMA_RXT_WML (spi_imx->wml) | -MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN |MX51_ECSPI_DMA_RXTDEN , spi_imx->base +MX51_ECSPI_DMA ); }
@@ -1422,6 +1427,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,reinit_completion (&spi_imx->dma_tx_completion);dma_async_issue_pending (master->dma_tx); + spi_imx->devtype_data->trigger (spi_imx); + transfer_timeout =spi_imx_calculate_timeout (spi_imx, transfer->len);/* Wait SDMA to finish the data transfer.*/
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/554 bfs: Reconstruct file type when loading from disk
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted.
A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0.
Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
--- fs/bfs/inode.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
fs/bfs/inode.c +18 -1
@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) off = (ino -BFS_ROOT_INO ) %BFS_INODES_PER_BLOCK ; di = (struct bfs_inode *)bh->b_data + off; - inode->i_mode =0x0000FFFF &le32_to_cpu (di->i_mode); +/* +* https://martin.hinner.info/fs/bfs/bfs-structure.html explains that +* BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode +* value. This means that, although bfs_write_inode() saves whole +* inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} +* bits), middle 7 bits of di->i_mode value can be garbage when these +* bits were not saved by bfs_write_inode(). +* Since we can't tell whether middle 7 bits are garbage, use only +* lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being +* garbage) and reconstruct S_IFMT bits for Linux environment from +* di->i_vtype value. +*/ + inode->i_mode =0x00000FFF &le32_to_cpu (di->i_mode);if (le32_to_cpu (di->i_vtype) ==BFS_VDIR ) { inode->i_mode |=S_IFDIR ; inode->i_op = &bfs_dir_inops;
@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) inode->i_op = &bfs_file_inops; inode->i_fop = &bfs_file_operations; inode->i_mapping->a_ops = &bfs_aops; + }else { +brelse (bh); +printf ("Unknown vtype=%u %s:%08lx\n" , +le32_to_cpu (di->i_vtype), inode->i_sb->s_id, ino); + goto error; }BFS_I (inode)->i_sblock =le32_to_cpu (di->i_sblock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/554 pinctrl: qcom: msm: Fix deadlock in pinmux configuration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <[email protected]>
[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() to prevent deadlock when wakeup IRQ is triggered on the same GPIO being reconfigured.
The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ handler attempts to reconfigure the same GPIO's pinmux. In this scenario, msm_pinmux_set_mux() calls disable_irq() which waits for the currently running IRQ handler to complete, creating a circular dependency that results in deadlock.
Using disable_irq_nosync() avoids waiting for the IRQ handler to complete, preventing the deadlock condition while still properly disabling the interrupt during pinmux reconfiguration.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-msm.c +1 -1
@@ -213,7 +213,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,*/ if (d && i != gpio_func && !test_and_set_bit (d->hwirq, pctrl->disabled_for_mux)) -disable_irq (irq); +disable_irq_nosync (irq);raw_spin_lock_irqsave (&pctrl->lock, flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/554 platform/x86: acer-wmi: Ignore backlight event
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI firmware when the backlight up/down keys are pressed. Ignore this event to avoid spamming the kernel log with error messages, as the acpi-video driver already handles brightness up/down events.
--- drivers/platform/x86/acer-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/acer-wmi.c +4 -0
@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");enum acer_wmi_event_ids {WMID_HOTKEY_EVENT =0x1 , +WMID_BACKLIGHT_EVENT =0x4 ,WMID_ACCEL_OR_KBD_DOCK_EVENT =0x5 ,WMID_GAMING_TURBO_KEY_EVENT =0x7 ,WMID_AC_EVENT =0x8 ,
@@ -2060,6 +2061,9 @@ static void acer_wmi_notify(u32 value, void *context)sparse_keymap_report_event (acer_wmi_input_dev, scancode,1 , true); }break ; +case WMID_BACKLIGHT_EVENT : +/* Already handled by acpi-video */ +break ;case WMID_ACCEL_OR_KBD_DOCK_EVENT :acer_gsensor_event ();acer_kbd_dock_event (&return_value);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/554 platform/x86: huawei-wmi: add keys for HONOR models
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Ston <[email protected]>
[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print Screen and YOYO keys properly, with the system reporting them as unknown key presses (codes: 0x028b and 0x028e).
To resolve this, a key_entry is added for both the HONOR Print Screen key and the HONOR YOYO key, ensuring they function correctly on these models.
--- drivers/platform/x86/huawei-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/huawei-wmi.c +4 -0
@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = { { KE_KEY, 0x289, { KEY_WLAN } },// Huawei |M| key { KE_KEY, 0x28a, { KEY_CONFIG } }, +// HONOR YOYO key + { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, +// HONOR print screen + { KE_KEY, 0x28e, { KEY_PRINT } },// Keyboard backlit { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/554 HID: elecom: Add support for ELECOM M-XT3URBK (018F)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoki Ueki <[email protected]>
[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which shares the same report descriptor as the existing device (0x00FB). However, the driver does not currently recognize this new ID, resulting in only five buttons being functional.
This patch adds the new device ID so that all six buttons work properly.
--- drivers/hid/hid-elecom.c | 6 ++++-- drivers/hid/hid-ids.h | 3 ++- drivers/hid/hid-quirks.c | 3 ++- 3 files changed, 8 insertions(+), 4 deletions(-)
drivers/hid/hid-elecom.c +4 -2
@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ mouse_button_fixup (hdev, rdesc, *rsize,20 ,28 ,22 ,14 ,8 );break ; -case USB_DEVICE_ID_ELECOM_M_XT3URBK : +case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB : +case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F :case USB_DEVICE_ID_ELECOM_M_XT3DRBK :case USB_DEVICE_ID_ELECOM_M_XT4DRBK :/*
@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,static const struct hid_device_id elecom_devices[] = { {HID_BLUETOOTH_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_BM084 ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XGL20DLBK ) }, - {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK_018F ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3DRBK ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT4DRBK ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_DT1URBK ) },
drivers/hid/hid-ids.h +2 -1
@@ -415,7 +415,8 @@#define USB_VENDOR_ID_ELECOM 0x056e#define USB_DEVICE_ID_ELECOM_BM084 0x0061#define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 -#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb +#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb +#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f#define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc#define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd#define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
drivers/hid/hid-quirks.c +2 -1
@@ -382,7 +382,8 @@ static const struct hid_device_id hid_have_special_driver[] = { #if IS_ENABLED(CONFIG_HID_ELECOM) { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/554 samples: work around glibc redefining some of our defines wrong
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE and some of the other flags for renameat2() and friends in <stdio.h>.
Which would all be fine, except for inexplicable reasons glibc decided to define them _differently_ from the kernel definitions, which then makes some of our sample code that includes both kernel headers and user space headers unhappy, because the compiler will (correctly) complain about redefining things.
Now, mixing kernel headers and user space headers is always a somewhat iffy proposition due to namespacing issues, but it's kind of inevitable in our sample and selftest code. And this is just glibc being stupid.
Those defines come from the kernel, glibc is exposing the kernel interfaces, and glibc shouldn't make up some random new expressions for these values.
It's not like glibc headers changed the actual result values, but they arbitrarily just decided to use a different expression to describe those values. The kernel just does
#define AT_RENAME_NOREPLACE 0x0001
while glibc does
# define RENAME_NOREPLACE (1 << 0)
# define AT_RENAME_NOREPLACE RENAME_NOREPLACEinstead. Same value in the end, but very different macro definition.
For absolutely no reason.
This has since been fixed in the glibc development tree, so eventually we'll end up with the canonical expressions and no clashes. But in the meantime the broken headers are in the glibc-2.42 release and have made it out into distributions.
Do a minimal work-around to make the samples build cleanly by just undefining the affected macros in between the user space header include and the kernel header includes.
--- samples/vfs/test-statx.c | 6 ++++++ samples/watch_queue/watch_test.c | 6 ++++++ 2 files changed, 12 insertions(+)
samples/vfs/test-statx.c +6 -0
@@ -19,6 +19,12 @@#include <time.h> #include <sys/syscall.h> #include <sys/types.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/stat.h> #include <linux/fcntl.h> #define statx foo
samples/watch_queue/watch_test.c +6 -0
@@ -16,6 +16,12 @@#include <errno.h> #include <sys/ioctl.h> #include <limits.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/watch_queue.h> #include <linux/unistd.h> #include <linux/keyctl.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/554 comedi: c6xdigio: Fix invalid PNP driver unregistration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 72262330f7b3ad2130e800cecf02adcce3c32c77 upstream.
The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler c6xdigio_attach() to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with pnp_register_driver(), but ignores the return value. (The struct pnp_driver it uses has only the name and id_table members filled in.) The driver's Comedi "detach" handler c6xdigio_detach() unconditionally unregisters the PNP driver with pnp_unregister_driver().
It is possible for c6xdigio_attach() to return an error before it calls pnp_register_driver() and it is possible for the call to pnp_register_driver() to return an error (that is ignored). In both cases, the driver should not be calling pnp_unregister_driver() as it does in c6xdigio_detach(). (Note that c6xdigio_detach() will be called by the Comedi core if c6xdigio_attach() returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.)
The unconditional call to pnp_unregister_driver() without a previous successful call to pnp_register_driver() will cause driver_unregister() to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1].
Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.)
Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since c6xdigio_detach() now only calls comedi_legacy_detach(), remove the function and change the Comedi driver "detach" handler to comedi_legacy_detach.
-------------------------------------------
[1] Syzbot sample crash report:
Unexpected driver unregister!
WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline] WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Modules linked in: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:driver_unregister drivers/base/driver.c:273 [inline] RIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Code: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41 RSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8 RDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000 FS: 000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0 Call Trace: <TASK> comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207 comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215 comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011 do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc05798eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8184238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc057be5fa0 RCX: 00007fc05798eec9 RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fc057a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc057be5fa0 R14: 00007fc057be5fa0 R15: 0000000000000003 </TASK> -------------------------------------------
--- drivers/comedi/drivers/c6xdigio.c | 46 ++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-)
drivers/comedi/drivers/c6xdigio.c +35 -11
@@ -250,9 +250,6 @@ static int c6xdigio_attach(struct comediif (ret)return ret; -/* Make sure that PnP ports get activated */ -pnp_register_driver (&c6xdigio_pnp_driver); - s = &dev->subdevices[0 ];/* pwm output subdevice */ s->type =COMEDI_SUBD_PWM ;
@@ -279,19 +276,46 @@ static int c6xdigio_attach(struct comedireturn 0 ; } -static void c6xdigio_detach (struct comedi_device *dev) -{ -comedi_legacy_detach (dev); -pnp_unregister_driver (&c6xdigio_pnp_driver); -} -static struct comedi_driver c6xdigio_driver = { .driver_name ="c6xdigio" , .module =THIS_MODULE , .attach = c6xdigio_attach, - .detach = c6xdigio_detach, + .detach = comedi_legacy_detach, }; -module_comedi_driver (c6xdigio_driver); + +static bool c6xdigio_pnp_registered = false; + +static int __init c6xdigio_module_init (void ) +{ +int ret; + + ret =comedi_driver_register (&c6xdigio_driver); +if (ret) +return ret; + +if (IS_ENABLED (CONFIG_PNP )) { +/* Try to activate the PnP ports */ + ret =pnp_register_driver (&c6xdigio_pnp_driver); +if (ret) { +pr_warn ("failed to register pnp driver - err %d\n" , + ret); + ret =0 ;/* ignore the error. */ + }else { + c6xdigio_pnp_registered = true; + } + } + +return 0 ; +} +module_init (c6xdigio_module_init); + +static void __exit c6xdigio_module_exit(void) +{ +if (c6xdigio_pnp_registered) +pnp_unregister_driver (&c6xdigio_pnp_driver); +comedi_driver_unregister (&c6xdigio_driver); +} +module_exit (c6xdigio_module_exit);MODULE_AUTHOR ("Comedi https://www.comedi.org" );MODULE_DESCRIPTION ("Comedi driver for the C6x_DIGIO DSP daughter card" );
Greg Kroah-Hartman
maintainerPATCH 31/554 comedi: multiq3: sanitize config options in multiq3_attach()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit f24c6e3a39fa355dabfb684c9ca82db579534e72 upstream.
Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specifically, in the case of multiq3 driver.
This problem arose when syzkaller managed to craft weird configuration options used to specify the number of channels in encoder subdevice. If a particularly great number is passed to s->n_chan in multiq3_attach() via it->options[2], then multiple calls to multiq3_encoder_reset() at the end of driver-specific attach() method will be running for minutes, thus blocking tasks and affected devices as well.
While this issue is most likely not too dangerous for real-life devices, it still makes sense to sanitize configuration inputs. Enable a sensible limit on the number of encoder chips (4 chips max, each with 2 channels) to stop this behaviour from manifesting.
[1] Syzbot crash:
INFO: task syz.2.19:6067 blocked for more than 143 seconds. ... Call Trace: <TASK> context_switch kernel/sched/core.c:5254 [inline] __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862 __schedule_loop kernel/sched/core.c:6944 [inline] schedule+0x165/0x360 kernel/sched/core.c:6959 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760 comedi_open+0xc0/0x590 drivers/comedi/comedi_fops.c:2868 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x953/0x13f0 fs/open.c:965 vfs_open+0x3b/0x340 fs/open.c:1097
...
--- drivers/comedi/drivers/multiq3.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/comedi/drivers/multiq3.c +9 -0
@@ -68,6 +68,11 @@#define MULTIQ3_TRSFRCNTR_OL 0x10/* xfer CNTR to OL (x and y) */ #define MULTIQ3_EFLAG_RESET 0x06/* reset E bit of flag reg */ +/* +* Limit on the number of optional encoder channels +*/ +#define MULTIQ3_MAX_ENC_CHANS 8 +static void multiq3_set_ctrl (struct comedi_device *dev,unsigned int bits) {/*
@@ -313,6 +318,10 @@ static int multiq3_attach(struct comedi_ s->insn_read = multiq3_encoder_insn_read; s->insn_config = multiq3_encoder_insn_config; +/* sanity check for number of encoder channels */ +if (s->n_chan >MULTIQ3_MAX_ENC_CHANS ) + s->n_chan =MULTIQ3_MAX_ENC_CHANS ; +for (i =0 ; i < s->n_chan; i++)multiq3_encoder_reset (dev, i);
Greg Kroah-Hartman
maintainerPATCH 32/554 comedi: check devices attached status in compat ioctls
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 0de7d9cd07a2671fa6089173bccc0b2afe6b93ee upstream.
Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig().
As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG.
Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback.
Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions.
[1] Syzbot report:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: <TASK> get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
...
--- drivers/comedi/comedi_fops.c | 42 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-)
drivers/comedi/comedi_fops.c +36 -6
@@ -2966,7 +2966,12 @@ static int compat_chaninfo(struct file * chaninfo.rangelist =compat_ptr (chaninfo32.rangelist);mutex_lock (&dev->mutex); - err =do_chaninfo_ioctl (dev, &chaninfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_chaninfo_ioctl (dev, &chaninfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -2987,7 +2992,12 @@ static int compat_rangeinfo(struct file rangeinfo.range_ptr =compat_ptr (rangeinfo32.range_ptr);mutex_lock (&dev->mutex); - err =do_rangeinfo_ioctl (dev, &rangeinfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_rangeinfo_ioctl (dev, &rangeinfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -3063,7 +3073,12 @@ static int compat_cmd(struct file *file,return rc;mutex_lock (&dev->mutex); - rc =do_cmd_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmd_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) {/* Special case: copy cmd back to user. */
@@ -3088,7 +3103,12 @@ static int compat_cmdtest(struct file *freturn rc;mutex_lock (&dev->mutex); - rc =do_cmdtest_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmdtest_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) { err =put_compat_cmd (compat_ptr (arg), &cmd);
@@ -3148,7 +3168,12 @@ static int compat_insnlist(struct file * }mutex_lock (&dev->mutex); - rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); + }mutex_unlock (&dev->mutex);kfree (insns);return rc;
@@ -3167,7 +3192,12 @@ static int compat_insn(struct file *filereturn rc;mutex_lock (&dev->mutex); - rc =do_insn_ioctl (dev, &insn, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insn_ioctl (dev, &insn, file); + }mutex_unlock (&dev->mutex);return rc; }
Greg Kroah-Hartman
maintainerPATCH 33/554 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 6ef0e1c10455927867cac8f0ed6b49f328f8cf95 upstream.
The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow.
Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow.
This prevents kernel stack corruption triggered by malformed association requests.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +4 -1
@@ -1042,6 +1042,9 @@ unsigned int OnAssocReq(struct adapter * status =WLAN_STATUS_CHALLENGE_FAIL ; goto OnAssocReqFail; }else { +if (ie_len >sizeof (supportRate)) + ie_len =sizeof (supportRate); +memcpy (supportRate, p+2 , ie_len); supportRateNum = ie_len;
@@ -1049,7 +1052,7 @@ unsigned int OnAssocReq(struct adapter * pkt_len - WLAN_HDR_A3_LEN - ie_offset);if (p) { -if (supportRateNum <=sizeof (supportRate)) { +if (supportRateNum + ie_len <=sizeof (supportRate)) {memcpy (supportRate+supportRateNum, p+2 , ie_len); supportRateNum += ie_len; }
Greg Kroah-Hartman
maintainerPATCH 34/554 staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 502ddcc405b69fa92e0add6c1714d654504f6fd7 upstream.
The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could cause an out-of-bounds read, potentially triggering a kernel panic.
Add a boundary check to ensure that the ESR IE body and the subsequent bytes are within the limits of the frame before attempting to access them.
This prevents OOB reads caused by malformed beacon frames.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +5 -3
@@ -584,9 +584,11 @@ unsigned int OnBeacon(struct adapter *pa p =rtw_get_ie (pframe +sizeof (struct ieee80211_hdr_3addr ) + _BEACON_IE_OFFSET_,WLAN_EID_EXT_SUPP_RATES , &ielen, precv_frame->u.hdr.len -sizeof (struct ieee80211_hdr_3addr ) - _BEACON_IE_OFFSET_);if (p && ielen >0 ) { -if ((*(p +1 + ielen) ==0x2D ) && (*(p +2 + ielen) !=0x2D )) -/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ - *(p +1 ) = ielen -1 ; +if (p +2 + ielen < pframe + len) { +if ((*(p +1 + ielen) ==0x2D ) && (*(p +2 + ielen) !=0x2D )) +/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ + *(p +1 ) = ielen -1 ; + } }if (pmlmeext->sitesurvey_res.state ==SCAN_PROCESS ) {
Greg Kroah-Hartman
maintainerPATCH 35/554 smack: fix bug: unprivileged task can create labels
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3 ]
If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty),
it can freely create new labels by writing their names into own /proc/PID/attr/smack/current
This occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.
This change ensures that the "relabel-self" list
is checked before importing the label.
--- security/smack/smack_lsm.c | 41 +++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 14 deletions(-)
security/smack/smack_lsm.c +27 -14
@@ -3551,8 +3551,8 @@ static int smack_setprocattr(const char *name, void *value, size_t size)struct task_smack *tsp =smack_cred (current_cred ());struct cred *new;struct smack_known *skp; -struct smack_known_list_elem *sklep; -int rc; +char *labelstr; +int rc =0 ;if (!smack_privileged (CAP_MAC_ADMIN ) &&list_empty (&tsp->smk_relabel))return -EPERM ;
@@ -3563,28 +3563,41 @@ static int smack_setprocattr(const char *name, void *value, size_t size)if (strcmp (name,"current" ) !=0 )return -EINVAL ; - skp =smk_import_entry (value, size); -if (IS_ERR (skp)) -return PTR_ERR (skp); + labelstr =smk_parse_smack (value, size); +if (IS_ERR (labelstr)) +return PTR_ERR (labelstr);/* * No process is ever allowed the web ("@") label * and the star ("*") label. */ -if (skp == &smack_known_web || skp == &smack_known_star) -return -EINVAL ; +if (labelstr[1 ] =='\0' /* '@', '*' */ ) { +const char c = labelstr[0 ]; + +if (c == *smack_known_web.smk_known || + c == *smack_known_star.smk_known) { + rc = -EPERM ; + goto free_labelstr; + } + }if (!smack_privileged (CAP_MAC_ADMIN )) { - rc = -EPERM ; +const struct smack_known_list_elem *sklep;list_for_each_entry (sklep, &tsp->smk_relabel, list) -if (sklep->smk_label == skp) { - rc =0 ; -break ; - } -if (rc) -return rc; +if (strcmp (sklep->smk_label->smk_known, labelstr) ==0 ) + goto free_labelstr; + rc = -EPERM ; } +free_labelstr: +kfree (labelstr); +if (rc) +return -EPERM ; + + skp =smk_import_entry (value, size); +if (IS_ERR (skp)) +return PTR_ERR (skp); + new =prepare_creds ();if (new ==NULL )return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/554 gpu: host1x: Fix race in syncpt alloc/free
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mainak Sen <[email protected]>
[ Upstream commit c7d393267c497502fa737607f435f05dfe6e3d9b ]
Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking.
This ensures no thread can acquire the syncpt_mutex after the refcount drops to zero but before syncpt_release acquires it.
This prevents races where syncpoints could
be allocated while still being cleaned up from a previous release.
Remove explicit mutex locking in syncpt_release as kref_put_mutex() handles this atomically.
--- drivers/gpu/host1x/syncpt.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/host1x/syncpt.c +1 -3
@@ -394,8 +394,6 @@ static void syncpt_release(struct kref *ref) sp->locked = false; -mutex_lock (&sp->host->syncpt_mutex); -host1x_syncpt_base_free (sp->base);kfree (sp->name); sp->base =NULL ;
@@ -418,7 +416,7 @@ void host1x_syncpt_put(struct host1x_syncpt *sp)if (!sp)return ; -kref_put (&sp->ref, syncpt_release); +kref_put_mutex (&sp->ref, syncpt_release, &sp->host->syncpt_mutex); }EXPORT_SYMBOL (host1x_syncpt_put);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/554 drm/panel: visionox-rm69299: Dont clear all mode flags
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guido Günther <[email protected]>
[ Upstream commit 39144b611e9cd4f5814f4098c891b545dd70c536 ]
Don't clear all mode flags. We only want to maek sure we use HS mode during unprepare.
--- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-visionox-rm69299.c +1 -1
@@ -64,7 +64,7 @@ static int visionox_rm69299_unprepare(struct drm_panel *panel)struct visionox_rm69299 *ctx =panel_to_ctx (panel);int ret; - ctx->dsi->mode_flags =0 ; + ctx->dsi->mode_flags &= ~MIPI_DSI_MODE_LPM ; ret =mipi_dsi_dcs_write (ctx->dsi,MIPI_DCS_SET_DISPLAY_OFF ,NULL ,0 );if (ret <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/554 drm/vgem-fence: Fix potential deadlock on release
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <[email protected]>
[ Upstream commit 78b4d6463e9e69e5103f98b367f8984ad12cdc6f ]
A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put(). In some scenarios, it can run in IRQ context, which is not safe unless TIMER_IRQSAFE is used. One potentially risky scenario was demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while working on new IGT subtests syncobj_timeline@stress-* as user space replacements of some problematic test cases of a dma-fence-chain selftest [1].
[117.004338] ================================
[117.004340] WARNING: inconsistent lock state
[117.004342] 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 Tainted: G S U
[117.004346] --------------------------------
[117.004347] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
[117.004349] swapper/0/0 [HC1[1]:SC1[1]:HE0:SE0] takes:
[117.004352] ffff888138f86aa8 ((&fence->timer)){?.-.}-{0:0}, at: __timer_delete_sync+0x4b/0x190
[117.004361] {HARDIRQ-ON-W} state was registered at:
[117.004363] lock_acquire+0xc4/0x2e0
[117.004366] call_timer_fn+0x80/0x2a0
[117.004368] __run_timers+0x231/0x310
[117.004370] run_timer_softirq+0x76/0xe0
[117.004372] handle_softirqs+0xd4/0x4d0
[117.004375] __irq_exit_rcu+0x13f/0x160
[117.004377] irq_exit_rcu+0xe/0x20
[117.004379] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004382] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004385] cpuidle_enter_state+0x12b/0x8a0
[117.004388] cpuidle_enter+0x2e/0x50
[117.004393] call_cpuidle+0x22/0x60
[117.004395] do_idle+0x1fd/0x260
[117.004398] cpu_startup_entry+0x29/0x30
[117.004401] start_secondary+0x12d/0x160
[117.004404] common_startup_64+0x13e/0x141
[117.004407] irq event stamp: 2282669
[117.004409] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.004414] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.004419] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.004423] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.004426]
other info that might help us debug this:
[117.004429] Possible unsafe locking scenario:
[117.004432] CPU0
[117.004433] ----
[117.004434] lock((&fence->timer));
[117.004436] <Interrupt>
[117.004438] lock((&fence->timer));
[117.004440]
*** DEADLOCK ***
[117.004443] 1 lock held by swapper/0/0:
[117.004445] #0: ffffc90000003d50 ((&fence->timer)){?.-.}-{0:0}, at: call_timer_fn+0x7a/0x2a0
[117.004450]
stack backtrace:
[117.004453] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004455] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004455] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004456] Call Trace:
[117.004456] <IRQ>
[117.004457] dump_stack_lvl+0x91/0xf0
[117.004460] dump_stack+0x10/0x20
[117.004461] print_usage_bug.part.0+0x260/0x360
[117.004463] mark_lock+0x76e/0x9c0
[117.004465] ? register_lock_class+0x48/0x4a0
[117.004467] __lock_acquire+0xbc3/0x2860
[117.004469] lock_acquire+0xc4/0x2e0
[117.004470] ? __timer_delete_sync+0x4b/0x190
[117.004472] ? __timer_delete_sync+0x4b/0x190
[117.004473] __timer_delete_sync+0x68/0x190
[117.004474] ? __timer_delete_sync+0x4b/0x190
[117.004475] timer_delete_sync+0x10/0x20
[117.004476] vgem_fence_release+0x19/0x30 [vgem]
[117.004478] dma_fence_release+0xc1/0x3b0
[117.004480] ? dma_fence_release+0xa1/0x3b0
[117.004481] dma_fence_chain_release+0xe7/0x130
[117.004483] dma_fence_release+0xc1/0x3b0
[117.004484] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004485] dma_fence_chain_irq_work+0x59/0x80
[117.004487] irq_work_single+0x75/0xa0
[117.004490] irq_work_run_list+0x33/0x60
[117.004491] irq_work_run+0x18/0x40
[117.004493] __sysvec_irq_work+0x35/0x170
[117.004494] sysvec_irq_work+0x47/0xc0
[117.004496] asm_sysvec_irq_work+0x1b/0x20
[117.004497] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004499] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004499] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004500] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004501] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004502] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004502] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004502] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004506] dma_fence_signal+0x49/0xb0
[117.004507] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004508] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004509] call_timer_fn+0xa1/0x2a0
[117.004512] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004513] __run_timers+0x231/0x310
[117.004514] ? tmigr_handle_remote+0x2ac/0x560
[117.004517] timer_expire_remote+0x46/0x70
[117.004518] tmigr_handle_remote+0x433/0x560
[117.004520] ? __run_timers+0x239/0x310
[117.004521] ? run_timer_softirq+0x21/0xe0
[117.004522] ? lock_release+0xce/0x2a0
[117.004524] run_timer_softirq+0xcf/0xe0
[117.004525] handle_softirqs+0xd4/0x4d0
[117.004526] __irq_exit_rcu+0x13f/0x160
[117.004527] irq_exit_rcu+0xe/0x20
[117.004528] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004529] </IRQ>
[117.004529] <TASK>
[117.004529] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004530] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004532] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004532] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004533] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004533] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004534] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004534] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004534] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004537] ? cpuidle_enter_state+0x125/0x8a0
[117.004538] ? sched_clock_noinstr+0x9/0x10
[117.004540] cpuidle_enter+0x2e/0x50
[117.004542] call_cpuidle+0x22/0x60
[117.004542] do_idle+0x1fd/0x260
[117.004544] cpu_startup_entry+0x29/0x30
[117.004546] rest_init+0x104/0x200
[117.004548] start_kernel+0x93d/0xbd0
[117.004550] ? load_ucode_intel_bsp+0x2a/0x90
[117.004551] ? sme_unmap_bootdata+0x14/0x80
[117.004554] x86_64_start_reservations+0x18/0x30
[117.004555] x86_64_start_kernel+0xfd/0x150
[117.004556] ? soft_restart_cpu+0x14/0x14
[117.004558] common_startup_64+0x13e/0x141
[117.004560] </TASK>
[117.004565] ------------[ cut here ]------------
[117.004692] WARNING: CPU: 0 PID: 0 at kernel/time/timer.c:1610 __timer_delete_sync+0x126/0x190
[117.004697] Modules linked in: vgem snd_hda_codec_intelhdmi snd_hda_codec_hdmi i915 prime_numbers ttm drm_buddy drm_display_helper cec rc_core i2c_algo_bit hid_sensor_custom hid_sensor_hub hid_generic intel_ishtp_hid hid intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal intel_powerclamp cmdlinepart ee1004 r8153_ecm spi_nor coretemp cdc_ether mei_pxp mei_hdcp usbnet mtd intel_rapl_msr wmi_bmof kvm_intel snd_hda_intel snd_intel_dspcfg processor_thermal_device_pci kvm snd_hda_codec processor_thermal_device irqbypass processor_thermal_wt_hint polyval_clmulni platform_temperature_control snd_hda_core ghash_clmulni_intel processor_thermal_rfim spi_pxa2xx_platform snd_hwdep aesni_intel processor_thermal_rapl dw_dmac snd_pcm dw_dmac_core intel_rapl_common r8152 rapl mii intel_cstate spi_pxa2xx_core i2c_i801 processor_thermal_wt_req snd_timer i2c_mux mei_me intel_ish_ipc processor_thermal_power_floor e1000e snd i2c_smbus spi_intel_pci processor_thermal_mbox mei soundcore intel_ishtp thunderbolt idma64
[117.004733] spi_intel int340x_thermal_zone igen6_edac binfmt_misc intel_skl_int3472_tps68470 intel_pmc_core tps68470_regulator video clk_tps68470 pmt_telemetry pmt_discovery nls_iso8859_1 pmt_class intel_pmc_ssram_telemetry intel_skl_int3472_discrete int3400_thermal intel_hid intel_skl_int3472_common acpi_thermal_rel intel_vsec wmi pinctrl_tigerlake acpi_tad sparse_keymap acpi_pad dm_multipath msr nvme_fabrics fuse efi_pstore nfnetlink autofs4
[117.004782] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004787] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004789] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004793] RIP: 0010:__timer_delete_sync+0x126/0x190
[117.004795] Code: 31 c0 45 31 c9 c3 cc cc cc cc 48 8b 75 d0 45 84 f6 74 63 49 c7 45 18 00 00 00 00 48 89 c7 e8 51 46 39 01 f3 90 e9 66 ff ff ff <0f> 0b e9 5f ff ff ff e8 ee e4 0c 00 49 8d 5d 28 45 31 c9 31 c9 4c
[117.004801] RSP: 0018:ffffc90000003a40 EFLAGS: 00010046
[117.004804] RAX: ffffffff815093fb RBX: ffff888138f86aa8 RCX: 0000000000000000
[117.004807] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004809] RBP: ffffc90000003a70 R08: 0000000000000000 R09: 0000000000000000
[117.004812] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff815093fb
[117.004814] R13: ffff888138f86a80 R14: 0000000000000000 R15: 0000000000000000
[117.004817] FS: 0000000000000000(0000) GS:ffff88890b0f7000(0000) knlGS:0000000000000000
[117.004820] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[117.004823] CR2: 00005db8131eb7f0 CR3: 0000000003448000 CR4: 0000000000f52ef0
[117.004826] PKRU: 55555554
[117.004827] Call Trace:
[117.004829] <IRQ>
[117.004831] timer_delete_sync+0x10/0x20
[117.004833] vgem_fence_release+0x19/0x30 [vgem]
[117.004836] dma_fence_release+0xc1/0x3b0
[117.004838] ? dma_fence_release+0xa1/0x3b0
[117.004841] dma_fence_chain_release+0xe7/0x130
[117.004844] dma_fence_release+0xc1/0x3b0
[117.004847] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004850] dma_fence_chain_irq_work+0x59/0x80
[117.004853] irq_work_single+0x75/0xa0
[117.004857] irq_work_run_list+0x33/0x60
[117.004860] irq_work_run+0x18/0x40
[117.004863] __sysvec_irq_work+0x35/0x170
[117.004865] sysvec_irq_work+0x47/0xc0
[117.004868] asm_sysvec_irq_work+0x1b/0x20
[117.004871] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004874] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004879] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004882] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004884] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004887] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004890] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004892] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004897] dma_fence_signal+0x49/0xb0
[117.004899] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004902] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004904] call_timer_fn+0xa1/0x2a0
[117.004908] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004910] __run_timers+0x231/0x310
[117.004913] ? tmigr_handle_remote+0x2ac/0x560
[117.004917] timer_expire_remote+0x46/0x70
[117.004919] tmigr_handle_remote+0x433/0x560
[117.004923] ? __run_timers+0x239/0x310
[117.004925] ? run_timer_softirq+0x21/0xe0
[117.004928] ? lock_release+0xce/0x2a0
[117.004931] run_timer_softirq+0xcf/0xe0
[117.004933] handle_softirqs+0xd4/0x4d0
[117.004936] __irq_exit_rcu+0x13f/0x160
[117.004938] irq_exit_rcu+0xe/0x20
[117.004940] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004943] </IRQ>
[117.004944] <TASK>
[117.004946] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004949] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004953] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004961] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004963] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004966] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004968] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004971] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004974] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004978] ? cpuidle_enter_state+0x125/0x8a0
[117.004981] ? sched_clock_noinstr+0x9/0x10
[117.004985] cpuidle_enter+0x2e/0x50
[117.004989] call_cpuidle+0x22/0x60
[117.004991] do_idle+0x1fd/0x260
[117.005001] cpu_startup_entry+0x29/0x30
[117.005004] rest_init+0x104/0x200
[117.005008] start_kernel+0x93d/0xbd0
[117.005011] ? load_ucode_intel_bsp+0x2a/0x90
[117.005014] ? sme_unmap_bootdata+0x14/0x80
[117.005017] x86_64_start_reservations+0x18/0x30
[117.005020] x86_64_start_kernel+0xfd/0x150
[117.005023] ? soft_restart_cpu+0x14/0x14
[117.005026] common_startup_64+0x13e/0x141
[117.005030] </TASK>
[117.005032] irq event stamp: 2282669
[117.005034] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.005038] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.005043] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.005047] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.005051] ---[ end trace 0000000000000000 ]---Make the timer IRQ safe.
[1] https://patchwork.freedesktop.org/series/154987/#rev2
--- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vgem/vgem_fence.c +1 -1
@@ -94,7 +94,7 @@ static struct dma_fence *vgem_fence_create(struct vgem_file *vfile,dma_fence_init (&fence->base, &vgem_fence_ops, &fence->lock,dma_fence_context_alloc (1 ),1 ); -timer_setup (&fence->timer, vgem_fence_timeout,0 ); +timer_setup (&fence->timer, vgem_fence_timeout,TIMER_IRQSAFE );/* We force the fence to expire within 10s to prevent driver hangs */ mod_timer (&fence->timer, jiffies +VGEM_FENCE_TIMEOUT );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/554 USB: Fix descriptor count when handling invalid MBIM extended descriptor
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 5570ad1423ee60f6e972dadb63fb2e5f90a54cbe ]
In cdc_parse_cdc_header(), the check for the USB_CDC_MBIM_EXTENDED_TYPE descriptor was using 'break' upon detecting an invalid length.
This was incorrect because 'break' only exits the switch statement, causing the code to fall through to cnt++, thus incorrectly incrementing the count of parsed descriptors for a descriptor that was actually invalid and being discarded.
This patch changes 'break' to 'goto next_desc;' to ensure that the logic skips the counter increment and correctly proceeds to the next descriptor in the buffer. This maintains an accurate count of only the successfully parsed descriptors.
--- drivers/usb/core/message.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/message.c +1 -1
@@ -2386,7 +2386,7 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,break ;case USB_CDC_MBIM_EXTENDED_TYPE :if (elength <sizeof (struct usb_cdc_mbim_extended_desc )) -break ; + goto next_desc; hdr->usb_cdc_mbim_extended_desc = (struct usb_cdc_mbim_extended_desc *)buffer;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/554 irqchip/qcom-irq-combiner: Fix section mismatch
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 9b685058ca936752285c5520d351b828312ac965 ]
Platform drivers can be probed after their init sections have been discarded so the probe callback must not live in init.
--- drivers/irqchip/qcom-irq-combiner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/qcom-irq-combiner.c +1 -1
@@ -222,7 +222,7 @@ static int get_registers(struct platform_device *pdev, struct combiner *comb)return 0 ; } -static int __init combiner_probe (struct platform_device *pdev) +static int combiner_probe (struct platform_device *pdev) {struct combiner *combiner;int nregs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/554 ntfs3: fix uninit memory after failed mi_read in mi_format_new
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <[email protected]>
[ Upstream commit 73e6b9dacf72a1e7a4265eacca46f8f33e0997d6 ]
Fix a KMSAN un-init bug found by syzkaller.
ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be uptodate. We do not bring the buffer uptodate before setting it as uptodate. If the buffer were to not be uptodate, it could mean adding a buffer with un-init data to the mi record. Attempting to load that record will trigger KMSAN.
Avoid this by setting the buffer as uptodate, if it’s not already, by overwriting it.
--- fs/ntfs3/fsntfs.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/ntfs3/fsntfs.c +8 -1
@@ -1343,7 +1343,14 @@ int ntfs_get_bh(struct ntfs_sb_info *sbi, const struct runs_tree *run, u64 vbo, }if (buffer_locked (bh))__wait_on_buffer (bh); -set_buffer_uptodate (bh); + +lock_buffer (bh); +if (!buffer_uptodate (bh)) + { +memset (bh->b_data,0 , blocksize); +set_buffer_uptodate (bh); + } +unlock_buffer (bh); }else { bh =ntfs_bread (sb, block);if (!bh) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/554 ntfs3: Fix uninit buffer allocated by __getname()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidharth Seela <[email protected]>
[ Upstream commit 9948dcb2f7b5a1bf8e8710eafaf6016e00be3ad6 ]
Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.
--- fs/ntfs3/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/inode.c +1 -0
@@ -1696,6 +1696,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) de =__getname ();if (!de)return -ENOMEM ; +memset (de,0 ,PATH_MAX );/* Mark rw ntfs as dirty. It will be cleared at umount. */ ntfs_set_state (sbi,NTFS_DIRTY_DIRTY );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/554 rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit 9c4609225ec1cb551006d6a03c7c4ad8cb5584c0 ]
Add two functions to atomically replace RCU-protected hlist_nulls entries.
Keep using WRITE_ONCE() to assign values to ->next and ->pprev, as mentioned in the patch below:
commit efd04f8a8b45 ("rcu: Use WRITE_ONCE() for assignments to ->next for rculist_nulls")
commit 860c8802ace1 ("rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls")
Stable-dep-of: 1532ed0d0753 ("inet: Avoid ehash lookup race in inet_ehash_insert()")
--- include/linux/rculist_nulls.h | 59 +++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+)
include/linux/rculist_nulls.h +59 -0
@@ -52,6 +52,13 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)#define hlist_nulls_next_rcu (node) \ (*((struct hlist_nulls_node __rcu __force **)&(node)->next)) +/** +* hlist_nulls_pprev_rcu - returns the dereferenced pprev of @node. +* @node: element of the list. +*/ +#define hlist_nulls_pprev_rcu (node) \ + (*((struct hlist_nulls_node __rcu __force **)(node)->pprev)) +/** * hlist_nulls_del_rcu - deletes entry from hash list without re-initialization * @n: the element to delete from the hash list.
@@ -152,6 +159,58 @@ static inline void hlist_nulls_add_fake(struct hlist_nulls_node *n) n->next = (struct hlist_nulls_node *)NULLS_MARKER (NULL ); } +/** +* hlist_nulls_replace_rcu - replace an old entry by a new one +* @old: the element to be replaced +* @new: the new element to insert +* +* Description: +* Replace the old entry with the new one in a RCU-protected hlist_nulls, while +* permitting racing traversals. +* +* The caller must take whatever precautions are necessary (such as holding +* appropriate locks) to avoid racing with another list-mutation primitive, such +* as hlist_nulls_add_head_rcu() or hlist_nulls_del_rcu(), running on this same +* list. However, it is perfectly legal to run concurrently with the _rcu +* list-traversal primitives, such as hlist_nulls_for_each_entry_rcu(). +*/ +static inline void hlist_nulls_replace_rcu (struct hlist_nulls_node *old, +struct hlist_nulls_node *new) +{ +struct hlist_nulls_node *next = old->next; + +WRITE_ONCE (new->next, next); +WRITE_ONCE (new->pprev, old->pprev); +rcu_assign_pointer (hlist_nulls_pprev_rcu (new), new); +if (!is_a_nulls (next)) +WRITE_ONCE (next->pprev, &new->next); +} + +/** +* hlist_nulls_replace_init_rcu - replace an old entry by a new one and +* initialize the old +* @old: the element to be replaced +* @new: the new element to insert +* +* Description: +* Replace the old entry with the new one in a RCU-protected hlist_nulls, while +* permitting racing traversals, and reinitialize the old entry. +* +* Note: @old must be hashed. +* +* The caller must take whatever precautions are necessary (such as holding +* appropriate locks) to avoid racing with another list-mutation primitive, such +* as hlist_nulls_add_head_rcu() or hlist_nulls_del_rcu(), running on this same +* list. However, it is perfectly legal to run concurrently with the _rcu +* list-traversal primitives, such as hlist_nulls_for_each_entry_rcu(). +*/ +static inline void hlist_nulls_replace_init_rcu (struct hlist_nulls_node *old, +struct hlist_nulls_node *new) +{ +hlist_nulls_replace_rcu (old, new); +WRITE_ONCE (old->pprev,NULL ); +} +/** * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type * @tpos: the type * to use as a loop cursor.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/554 inet: Avoid ehash lookup race in inet_ehash_insert()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit 1532ed0d0753c83e72595f785f82b48c28bbe5dc ]
Since ehash lookups are lockless, if one CPU performs a lookup while another concurrently deletes and inserts (removing reqsk and inserting sk), the lookup may fail to find the socket, an RST may be sent.
The call trace map is drawn as follows:
CPU 0 CPU 1
----- -----
inet_ehash_insert()
spin_lock()
sk_nulls_del_node_init_rcu(osk)
__inet_lookup_established()
(lookup failed)
__sk_nulls_add_node_rcu(sk, list)
spin_unlock()As both deletion and insertion operate on the same ehash chain, this patch introduces a new sk_nulls_replace_node_init_rcu() helper functions to implement atomic replacement.
--- include/net/sock.h | 13 +++++++++++++ net/ipv4/inet_hashtables.c | 8 ++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)
include/net/sock.h +13 -0
@@ -785,6 +785,19 @@ static inline bool sk_nulls_del_node_init_rcu(struct sock *sk)return rc; } +static inline bool sk_nulls_replace_node_init_rcu (struct sock *old, +struct sock *new) +{ +if (sk_hashed (old)) { +hlist_nulls_replace_init_rcu (&old->sk_nulls_node, + &new->sk_nulls_node); +__sock_put (old); +return true; + } + +return false; +} +static inline void __sk_add_node (struct sock *sk,struct hlist_head *list) {hlist_add_head (&sk->sk_node, list);
net/ipv4/inet_hashtables.c +6 -2
@@ -541,8 +541,11 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)spin_lock (lock);if (osk) {WARN_ON_ONCE (sk->sk_hash != osk->sk_hash); - ret =sk_nulls_del_node_init_rcu (osk); - }else if (found_dup_sk) { + ret =sk_nulls_replace_node_init_rcu (osk, sk); + goto unlock; + } + +if (found_dup_sk) { *found_dup_sk =inet_ehash_lookup_by_sk (sk, list);if (*found_dup_sk) ret = false;
@@ -551,6 +554,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)if (ret)__sk_nulls_add_node_rcu (sk, list); +unlock:spin_unlock (lock);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/554 iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit cd83c5c10036a2a156d725725daf3409832c8a24 ]
Introduce st_lsm6dsx_device_set_enable utility routine and remove duplicated code used to enable/disable sensors
Stable-dep-of: c6d702f2b771 ("iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member")
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 11 +++++++++++ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 14 +++----------- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 14 ++------------ 3 files changed, 16 insertions(+), 23 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +11 -0
@@ -505,6 +505,17 @@ st_lsm6dsx_get_mount_matrix(const struct iio_dev *iio_dev,return &hw->orientation; } +static inline int +st_lsm6dsx_device_set_enable (struct st_lsm6dsx_sensor *sensor,bool enable) +{ +if (sensor->id ==ST_LSM6DSX_ID_EXT0 || + sensor->id ==ST_LSM6DSX_ID_EXT1 || + sensor->id ==ST_LSM6DSX_ID_EXT2 ) +return st_lsm6dsx_shub_set_enable (sensor, enable); + +return st_lsm6dsx_sensor_set_enable (sensor, enable); +} +static const struct iio_chan_spec_ext_info __maybe_unused st_lsm6dsx_accel_ext_info[] = {IIO_MOUNT_MATRIX (IIO_SHARED_BY_ALL , st_lsm6dsx_get_mount_matrix),
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +3 -11
@@ -678,17 +678,9 @@ int st_lsm6dsx_update_fifo(struct st_lsm6dsx_sensor *sensor, bool enable) goto out; } -if (sensor->id ==ST_LSM6DSX_ID_EXT0 || - sensor->id ==ST_LSM6DSX_ID_EXT1 || - sensor->id ==ST_LSM6DSX_ID_EXT2 ) { - err =st_lsm6dsx_shub_set_enable (sensor, enable); -if (err <0 ) - goto out; - }else { - err =st_lsm6dsx_sensor_set_enable (sensor, enable); -if (err <0 ) - goto out; - } + err =st_lsm6dsx_device_set_enable (sensor, enable); +if (err <0 ) + goto out; err =st_lsm6dsx_set_fifo_odr (sensor, enable);if (err <0 )
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +2 -12
@@ -2304,12 +2304,7 @@ static int __maybe_unused st_lsm6dsx_suspend(struct device *dev)continue ; } -if (sensor->id ==ST_LSM6DSX_ID_EXT0 || - sensor->id ==ST_LSM6DSX_ID_EXT1 || - sensor->id ==ST_LSM6DSX_ID_EXT2 ) - err =st_lsm6dsx_shub_set_enable (sensor, false); -else - err =st_lsm6dsx_sensor_set_enable (sensor, false); + err =st_lsm6dsx_device_set_enable (sensor, false);if (err <0 )return err;
@@ -2340,12 +2335,7 @@ static int __maybe_unused st_lsm6dsx_resume(struct device *dev)if (!(hw->suspend_mask &BIT (sensor->id)))continue ; -if (sensor->id ==ST_LSM6DSX_ID_EXT0 || - sensor->id ==ST_LSM6DSX_ID_EXT1 || - sensor->id ==ST_LSM6DSX_ID_EXT2 ) - err =st_lsm6dsx_shub_set_enable (sensor, true); -else - err =st_lsm6dsx_sensor_set_enable (sensor, true); + err =st_lsm6dsx_device_set_enable (sensor, true);if (err <0 )return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/554 iio: imu: st_lsm6dsx: discard samples during filters settling time
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit db3c490503bee4d0611f9fc17fcd8cfe6fcdbcad ]
During digital filters settling time the driver is expected to drop samples since they can be corrupted. Introduce the capability to drop a given number of samples according to the configured ODR. Add sample_to_discard for LSM6DSM-like sensors since new generation devices (e.g. LSM6DSO) support DRDY mask where corrupted samples are masked in hw with values greather than 0x7ffd so the driver can easily discard them.
I have not added sample_to_discard support for LSM6DS3 or LSM6DS3H since I do not have any sample for testing at the moment.
Stable-dep-of: c6d702f2b771 ("iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member")
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 11 ++++ .../iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 57 ++++++++++++++++--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 18 ++++++ 3 files changed, 78 insertions(+), 8 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +11 -0
@@ -124,6 +124,13 @@ struct st_lsm6dsx_odr_table_entry {int odr_len; }; +struct st_lsm6dsx_samples_to_discard { +struct { +u32 milli_hz; +u16 samples; + } val[ST_LSM6DSX_ODR_LIST_SIZE ]; +}; +struct st_lsm6dsx_fs {u32 gain;u8 val;
@@ -286,6 +293,7 @@ struct st_lsm6dsx_ext_dev_settings {* @irq_config: interrupts related registers. * @drdy_mask: register info for data-ready mask (addr + mask). * @odr_table: Hw sensors odr table (Hz + val). +* @samples_to_discard: Number of samples to discard for filters settling time. * @fs_table: Hw sensors gain table (gain + val). * @decimator: List of decimator register info (addr + mask). * @batch: List of FIFO batching register info (addr + mask).
@@ -319,6 +327,7 @@ struct st_lsm6dsx_settings { } irq_config;struct st_lsm6dsx_reg drdy_mask;struct st_lsm6dsx_odr_table_entry odr_table[2 ]; +struct st_lsm6dsx_samples_to_discard samples_to_discard[2 ];struct st_lsm6dsx_fs_table_entry fs_table[2 ];struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX ];struct st_lsm6dsx_reg batch[2 ];
@@ -340,6 +349,7 @@ enum st_lsm6dsx_fifo_mode {* @hw: Pointer to instance of struct st_lsm6dsx_hw. * @gain: Configured sensor sensitivity. * @odr: Output data rate of the sensor [Hz]. +* @samples_to_discard: Number of samples to discard for filters settling time. * @watermark: Sensor watermark level. * @decimator: Sensor decimation factor. * @sip: Number of samples in a given pattern.
@@ -354,6 +364,7 @@ struct st_lsm6dsx_sensor {u32 gain;u32 odr; +u16 samples_to_discard;u16 watermark;u8 decimator;u8 sip;
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +49 -8
78 lines not on this page · raw message
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +18 -0
@@ -622,6 +622,24 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { .fs_len = 4, }, }, + .samples_to_discard = { + [ST_LSM6DSX_ID_ACC] = { + .val[0] = { 12500, 1 }, + .val[1] = { 26000, 1 }, + .val[2] = { 52000, 1 }, + .val[3] = { 104000, 2 }, + .val[4] = { 208000, 2 }, + .val[5] = { 416000, 2 }, + }, + [ST_LSM6DSX_ID_GYRO] = { + .val[0] = { 12500, 2 }, + .val[1] = { 26000, 5 }, + .val[2] = { 52000, 7 }, + .val[3] = { 104000, 12 }, + .val[4] = { 208000, 20 }, + .val[5] = { 416000, 36 }, + }, + }, .irq_config = { .irq1 = { .addr = 0x0d,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/554 iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
[ Upstream commit c6d702f2b77194b62fb2098c63bb7f2a87da142d ]
The odr field in struct st_lsm6dsx_sensor contains a data rate value expressed in mHz, not in Hz.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +1 -1
@@ -348,7 +348,7 @@ enum st_lsm6dsx_fifo_mode {* @id: Sensor identifier. * @hw: Pointer to instance of struct st_lsm6dsx_hw. * @gain: Configured sensor sensitivity. -* @odr: Output data rate of the sensor [Hz]. +* @odr: Output data rate of the sensor [mHz]. * @samples_to_discard: Number of samples to discard for filters settling time. * @watermark: Sensor watermark level. * @decimator: Sensor decimation factor.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/554 arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
[ Upstream commit d949b8d12d6e8fa119bca10d3157cd42e810f6f7 ]
The SDHC1 interface is not used on the imx8mm-venice-gw72xx. Remove the unused pinctrl_usdhc1 iomux node.
--- .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 ----------- 1 file changed, 11 deletions(-)
arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi +0 -11
@@ -259,17 +259,6 @@ MX8MM_IOMUXC_UART4_TXD_UART4_DCE_TX 0x140 >; }; - pinctrl_usdhc1: usdhc1grp { - fsl,pins = < - MX8MM_IOMUXC_SD1_CLK_USDHC1_CLK 0x190 - MX8MM_IOMUXC_SD1_CMD_USDHC1_CMD 0x1d0 - MX8MM_IOMUXC_SD1_DATA0_USDHC1_DATA0 0x1d0 - MX8MM_IOMUXC_SD1_DATA1_USDHC1_DATA1 0x1d0 - MX8MM_IOMUXC_SD1_DATA2_USDHC1_DATA2 0x1d0 - MX8MM_IOMUXC_SD1_DATA3_USDHC1_DATA3 0x1d0 - >; - }; - pinctrl_usdhc2: usdhc2grp { fsl,pins = < MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x190
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/554 uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <[email protected]>
[ Upstream commit d48fb15e6ad142e0577428a8c5028136e10c7b3d ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- drivers/uio/uio_fsl_elbc_gpcm.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/uio/uio_fsl_elbc_gpcm.c +7 -0
@@ -384,6 +384,11 @@ static int uio_fsl_elbc_gpcm_probe(struct platform_device *pdev)/* set all UIO data */ info->mem[0 ].name =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%pOFn" , node); +if (!info->mem[0 ].name) { + ret = -ENODEV ; + goto out_err3; + } + info->mem[0 ].addr = res.start; info->mem[0 ].size =resource_size (&res); info->mem[0 ].memtype =UIO_MEM_PHYS ;
@@ -423,6 +428,8 @@ static int uio_fsl_elbc_gpcm_probe(struct platform_device *pdev) out_err2:if (priv->shutdown) priv->shutdown (info, true); + +out_err3:iounmap (info->mem[0 ].internal_addr);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/554 crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit df0845cf447ae1556c3440b8b155de0926cbaa56 ]
Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc.
--- crypto/asymmetric_keys/asymmetric_type.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
crypto/asymmetric_keys/asymmetric_type.c +10 -4
@@ -11,6 +11,7 @@#include <crypto/public_key.h> #include <linux/seq_file.h> #include <linux/module.h> +#include <linux/overflow.h> #include <linux/slab.h> #include <linux/ctype.h> #include <keys/system_keyring.h>
@@ -138,12 +139,17 @@ struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1, size_t len_2) {struct asymmetric_key_id *kid; - - kid =kmalloc (sizeof (struct asymmetric_key_id ) + len_1 + len_2, -GFP_KERNEL ); +size_t kid_sz; +size_t len; + +if (check_add_overflow (len_1, len_2, &len)) +return ERR_PTR (-EOVERFLOW ); +if (check_add_overflow (sizeof (struct asymmetric_key_id ), len, &kid_sz)) +return ERR_PTR (-EOVERFLOW ); + kid =kmalloc (kid_sz,GFP_KERNEL );if (!kid)return ERR_PTR (-ENOMEM ); - kid->len = len_1 + len_2; + kid->len = len;memcpy (kid->data, val_1, len_1);memcpy (kid->data + len_1, val_2, len_2);return kid;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/554 crypto: hisilicon/qm - restore original qos values
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: nieweiqiang <[email protected]>
[ Upstream commit e7066160f5b4187ad9869b712fa7a35d3d5be6b9 ]
When the new qos valus setting fails, restore to the original qos values.
--- drivers/crypto/hisilicon/qm.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/crypto/hisilicon/qm.c +13 -1
@@ -4010,6 +4010,7 @@ static int qm_clear_vft_config(struct hisi_qm *qm)static int qm_func_shaper_enable (struct hisi_qm *qm,u32 fun_index,u32 qos) {struct device *dev = &qm->pdev->dev; +struct qm_shaper_factor t_factor;u32 ir = qos *QM_QOS_RATE ;int ret, total_vfs, i;
@@ -4017,6 +4018,7 @@ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos)if (fun_index > total_vfs)return -EINVAL ; +memcpy (&t_factor, &qm->factor[fun_index],sizeof (t_factor)); qm->factor[fun_index].func_qos = qos; ret =qm_get_shaper_para (ir, &qm->factor[fun_index]);
@@ -4030,11 +4032,21 @@ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos) ret =qm_set_vft_common (qm,SHAPER_VFT , fun_index, i,1 );if (ret) {dev_err (dev,"type: %d, failed to set shaper vft!\n" , i); -return -EINVAL ; + goto back_func_qos; } }return 0 ; + +back_func_qos: +memcpy (&qm->factor[fun_index], &t_factor,sizeof (t_factor)); +for (i--; i >=ALG_TYPE_0 ; i--) { + ret =qm_set_vft_common (qm,SHAPER_VFT , fun_index, i,1 ); +if (ret) +dev_err (dev,"failed to restore shaper vft during rollback!\n" ); + } + +return -EINVAL ; }static u32 qm_get_shaper_vft_qos (struct hisi_qm *qm,u32 fun_index)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/554 s390/smp: Fix fallback CPU detection
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 07a75d08cfa1b883a6e1256666e5f0617ee99231 ]
In case SCLP CPU detection does not work a fallback mechanism using SIGP is in place. Since a cleanup this does not work correctly anymore: new CPUs are only considered if their type matches the boot CPU.
Before the cleanup the information if a CPU type should be considered was also part of a structure generated by the fallback mechanism and indicated that a CPU type should not be considered when adding CPUs.
Since the rework a global SCLP state is used instead. If the global SCLP state indicates that the CPU type should be considered and the fallback mechanism is used, there may be a mismatch with CPU types if CPUs are added. This can lead to a system with only a single CPU even tough there are many more CPUs.
Address this by simply copying the boot cpu type into the generated data structure from the fallback mechanism.
--- arch/s390/kernel/smp.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/smp.c +1 -0
@@ -754,6 +754,7 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early)continue ; info->core[info->configured].core_id = address >> smp_cpu_mt_shift; + info->core[info->configured].type = boot_core_type; info->configured++; } info->combined = info->configured;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/554 s390/ap: Dont leak debug feature files if AP instructions are not available
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 020d5dc57874e58d3ebae398f3fe258f029e3d06 ]
If no AP instructions are available the AP bus module leaks registered debug feature files. Change function call order to fix this.
--- drivers/s390/crypto/ap_bus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/s390/crypto/ap_bus.c +4 -4
@@ -1873,15 +1873,15 @@ static int __init ap_module_init(void) {int rc; - rc =ap_debug_init (); -if (rc) -return rc; -if (!ap_instructions_available ()) {pr_warn ("The hardware system does not support AP instructions\n" );return -ENODEV ; } + rc =ap_debug_init (); +if (rc) +return rc; +/* init ap_queue hashtable */ hash_init (ap_queues);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/554 firmware: imx: scu-irq: fix OF node leak in
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit ee67247843a2b62d1473cfa4df300e69b5190ccf ]
imx_scu_enable_general_irq_channel() calls of_parse_phandle_with_args(), but does not release the OF node reference. Add a of_node_put() call to release the reference.
--- drivers/firmware/imx/imx-scu-irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/imx/imx-scu-irq.c +3 -1
@@ -160,8 +160,10 @@ int imx_scu_enable_general_irq_channel(struct device *dev)INIT_WORK (&imx_sc_irq_work, imx_scu_irq_work_handler);if (!of_parse_phandle_with_args (dev->of_node,"mboxes" , -"#mbox-cells" ,0 , &spec)) +"#mbox-cells" ,0 , &spec)) { i =of_alias_get_id (spec.np,"mu" ); +of_node_put (spec.np); + }/* use mu1 as general mu irq channel if failed */ if (i <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/554 phy: mscc: Fix PTP for VSC8574 and VSC8572
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit ea5df88aeca112aac69e6c32e3dd1433a113b0c9 ]
The PTP initialization is two-step. First part are the function vsc8584_ptp_probe_once() and vsc8584_ptp_probe() at probe time which initialize the locks, queues, creates the PTP device. The second part is the function vsc8584_ptp_init() at config_init() time which initialize PTP in the HW.
For VSC8574 and VSC8572, the PTP initialization is incomplete. It is missing the first part but it makes the second part. Meaning that the ptp_clock_register() is never called.
There is no crash without the first part when enabling PTP but this is unexpected because some PHys have PTP functionality exposed by the driver and some don't even though they share the same PTP clock PTP.
--- drivers/net/phy/mscc/mscc_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/phy/mscc/mscc_main.c +3 -3
@@ -2560,7 +2560,7 @@ static struct phy_driver vsc85xx_driver[] = { .suspend = &genphy_suspend, .resume = &genphy_resume, .remove = &vsc85xx_remove, - .probe = &vsc8574_probe, + .probe = &vsc8584_probe, .set_wol = &vsc85xx_wol_set, .get_wol = &vsc85xx_wol_get, .get_tunable = &vsc85xx_get_tunable,
@@ -2581,12 +2581,12 @@ static struct phy_driver vsc85xx_driver[] = { .config_aneg = &vsc85xx_config_aneg, .aneg_done = &genphy_aneg_done, .read_status = &vsc85xx_read_status, - .handle_interrupt = vsc85xx_handle_interrupt, + .handle_interrupt = vsc8584_handle_interrupt, .config_intr = &vsc85xx_config_intr, .suspend = &genphy_suspend, .resume = &genphy_resume, .remove = &vsc85xx_remove, - .probe = &vsc8574_probe, + .probe = &vsc8584_probe, .set_wol = &vsc85xx_wol_set, .get_wol = &vsc85xx_wol_get, .get_tunable = &vsc85xx_get_tunable,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/554 sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 622e8838a29845316668ec2e7648428878df7f9a ]
SCTP_DBG_OBJCNT_INC() is called only when sctp_init_sock() returns 0 after successfully allocating sctp_sk(sk)->ep.
OTOH, SCTP_DBG_OBJCNT_DEC() is called in sctp_close().
The code seems to expect that the socket is always exposed to userspace once SCTP_DBG_OBJCNT_INC() is incremented, but there is a path where the assumption is not true.
In sctp_accept(), sctp_sock_migrate() could fail after sctp_init_sock().
Then, sk_common_release() does not call inet_release() nor sctp_close(). Instead, it calls sk->sk_prot->destroy().
Let's move SCTP_DBG_OBJCNT_DEC() from sctp_close() to sctp_destroy_sock().
--- net/sctp/socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sctp/socket.c +3 -2
@@ -1551,8 +1551,6 @@ static void sctp_close(struct sock *sk, long timeout)spin_unlock_bh (&net->sctp.addr_wq_lock);sock_put (sk); - -SCTP_DBG_OBJCNT_DEC (sock); }/* Handle EPIPE error. */
@@ -5101,9 +5099,12 @@ static void sctp_destroy_sock(struct sock *sk) sp->do_auto_asconf =0 ;list_del (&sp->auto_asconf_list); } +sctp_endpoint_free (sp->ep); +sk_sockets_allocated_dec (sk);sock_prot_inuse_add (sock_net (sk), sk->sk_prot,-1 ); +SCTP_DBG_OBJCNT_DEC (sock); }/* Triggered when there are no references on the socket anymore */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/554 compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 9a48e7564ac83fb0f1d5b0eac5fe8a7af62da398 ]
When Clang is using the hwaddress sanitizer, it sets __SANITIZE_ADDRESS__ explicitly:
#if __has_feature(address_sanitizer) || __has_feature(hwaddress_sanitizer) /* Emulate GCC's __SANITIZE_ADDRESS__ flag */
#define __SANITIZE_ADDRESS__
#endif
Once hwaddress sanitizer was added to GCC, however, a separate define was created, __SANITIZE_HWADDRESS__. The kernel is expecting to find __SANITIZE_ADDRESS__ in either case, though, and the existing string macros break on supported architectures:
#if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \
!defined(__SANITIZE_ADDRESS__)where as other architectures (like arm32) have no idea about hwaddress sanitizer and just check for __SANITIZE_ADDRESS__:
#if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)
This would lead to compiler foritfy self-test warnings when building with CONFIG_KASAN_SW_TAGS=y:
warning: unsafe memmove() usage lacked '__read_overflow2' symbol in lib/test_fortify/read_overflow2-memmove.c
warning: unsafe memcpy() usage lacked '__write_overflow' symbol in lib/test_fortify/write_overflow-memcpy.c
...
Sort this out by also defining __SANITIZE_ADDRESS__ in GCC under the hwaddress sanitizer.
Stable-dep-of: ced37e9ceae5 ("x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()")
--- include/linux/compiler-gcc.h | 8 ++++++++ 1 file changed, 8 insertions(+)
include/linux/compiler-gcc.h +8 -0
@@ -123,6 +123,14 @@#define __no_sanitize_coverage#endif +/* +* Treat __SANITIZE_HWADDRESS__ the same as __SANITIZE_ADDRESS__ in the kernel, +* matching the defines used by Clang. +*/ +#ifdef __SANITIZE_HWADDRESS__ +#define __SANITIZE_ADDRESS__ +#endif +/* * Turn individual warnings and errors on and off locally, depending * on version.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/554 kmsan: introduce __no_sanitize_memory and __no_kmsan_checks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <[email protected]>
[ Upstream commit 9b448bc25b776daab3215393c3ce6953dd3bb8ad ]
__no_sanitize_memory is a function attribute that instructs KMSAN to skip a function during instrumentation. This is needed to e.g. implement the noinstr functions.
__no_kmsan_checks is a function attribute that makes KMSAN ignore the uninitialized values coming from the function's inputs, and initialize the function's outputs.
Functions marked with this attribute can't be inlined into functions not marked with it, and vice versa. This behavior is overridden by __always_inline.
__SANITIZE_MEMORY__ is a macro that's defined iff the file is instrumented with KMSAN. This is not the same as CONFIG_KMSAN, which is defined for every file.
Stable-dep-of: ced37e9ceae5 ("x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()")
--- include/linux/compiler-clang.h | 23 +++++++++++++++++++++++ include/linux/compiler-gcc.h | 6 ++++++ 2 files changed, 29 insertions(+)
include/linux/compiler-clang.h +23 -0
@@ -79,6 +79,29 @@#define __no_sanitize_undefined#endif +#if __has_feature (memory_sanitizer) +#define __SANITIZE_MEMORY__ +/* +* Unlike other sanitizers, KMSAN still inserts code into functions marked with +* no_sanitize("kernel-memory"). Using disable_sanitizer_instrumentation +* provides the behavior consistent with other __no_sanitize_ attributes, +* guaranteeing that __no_sanitize_memory functions remain uninstrumented. +*/ +#define __no_sanitize_memory __disable_sanitizer_instrumentation + +/* +* The __no_kmsan_checks attribute ensures that a function does not produce +* false positive reports by: +* - initializing all local variables and memory stores in this function; +* - skipping all shadow checks; +* - passing initialized arguments to this function's callees. +*/ +#define __no_kmsan_checks __attribute__((no_sanitize("kernel-memory"))) +#else +#define __no_sanitize_memory +#define __no_kmsan_checks +#endif +/* * Support for __has_feature(coverage_sanitizer) was added in Clang 13 together * with no_sanitize("coverage"). Prior versions of Clang support coverage
include/linux/compiler-gcc.h +6 -0
@@ -131,6 +131,12 @@#define __SANITIZE_ADDRESS__#endif +/* +* GCC does not support KMSAN. +*/ +#define __no_sanitize_memory +#define __no_kmsan_checks +/* * Turn individual warnings and errors on and off locally, depending * on version.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/554 x86: kmsan: dont instrument stack walking functions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <[email protected]>
[ Upstream commit 37ad4ee8364255c73026a3c343403b5977fa7e79 ]
Upon function exit, KMSAN marks local variables as uninitialized. Further function calls may result in the compiler creating the stack frame where these local variables resided. This results in frame pointers being marked as uninitialized data, which is normally correct, because they are not stack-allocated.
However stack unwinding functions are supposed to read and dereference the frame pointers, in which case KMSAN might be reporting uses of uninitialized values.
To work around that, we mark update_stack_state(), unwind_next_frame() and show_trace_log_lvl() with __no_kmsan_checks, preventing all KMSAN reports inside those functions and making them return initialized values.
Stable-dep-of: ced37e9ceae5 ("x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()")
--- arch/x86/kernel/dumpstack.c | 6 ++++++ arch/x86/kernel/unwind_frame.c | 11 +++++++++++ 2 files changed, 17 insertions(+)
arch/x86/kernel/dumpstack.c +6 -0
@@ -183,6 +183,12 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs, } } +/* +* This function reads pointers from the stack and dereferences them. The +* pointers may not have their KMSAN shadow set up properly, which may result +* in false positive reports. Disable instrumentation to avoid those. +*/ +__no_kmsan_checks static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,unsigned long *stack,const char *log_lvl) {
arch/x86/kernel/unwind_frame.c +11 -0
@@ -183,6 +183,16 @@ static struct pt_regs *decode_frame_pointer(unsigned long *bp) }#endif +/* +* While walking the stack, KMSAN may stomp on stale locals from other +* functions that were marked as uninitialized upon function exit, and +* now hold the call frame information for the current function (e.g. the frame +* pointer). Because KMSAN does not specifically mark call frames as +* initialized, false positive reports are possible. To prevent such reports, +* we mark the functions scanning the stack (here and below) with +* __no_kmsan_checks. +*/ +__no_kmsan_checks static bool update_stack_state(struct unwind_state *state,unsigned long *next_bp) {
@@ -251,6 +261,7 @@ static bool update_stack_state(struct unwind_state *state,return true; } +__no_kmsan_checks bool unwind_next_frame(struct unwind_state *state) {struct pt_regs *regs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/554 x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit ced37e9ceae50e4cb6cd058963bd315ec9afa651 ]
When triggering a stack dump via sysrq (echo t > /proc/sysrq-trigger), KASAN may report false-positive out-of-bounds access:
BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
Call Trace:
dump_stack_lvl
print_address_description.constprop.0
print_report
__show_regs
show_trace_log_lvl
sched_show_task
show_state_filter
sysrq_handle_showstate
__handle_sysrq
write_sysrq_trigger
proc_reg_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframeThe issue occurs as follows:
Task A (walk other tasks' stacks) Task B (running)
1. echo t > /proc/sysrq-trigger
show_trace_log_lvl
regs = unwind_get_entry_regs()
show_regs_if_on_stack(regs)
2. The stack value pointed by regs keeps changing, and so are the tags in its KASAN shadow region.
__show_regs(regs)
regs->ax, regs->bx, ...
3. hit KASAN redzones, OOB
When task A walks task B's stack without suspending it, the continuous changes in task B's stack (and corresponding KASAN shadow tags) may cause task A to hit KASAN redzones when accessing obsolete values on the stack, resulting in false positive reports.
Simply stopping the task before unwinding is not a viable fix, as it would alter the state intended to inspect. This is especially true for diagnosing misbehaving tasks (e.g., in a hard lockup), where stopping might fail or hide the root cause by changing the call stack.
Therefore, fix this by disabling KASAN checks during asynchronous stack unwinding, which is identified when the unwinding task does not match the current task (task != current).
[ bp: Align arguments on function's opening brace. ]
--- arch/x86/kernel/dumpstack.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
arch/x86/kernel/dumpstack.c +21 -2
@@ -189,8 +189,8 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,* in false positive reports. Disable instrumentation to avoid those. */ __no_kmsan_checks -static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, -unsigned long *stack,const char *log_lvl) +static void __show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, +unsigned long *stack,const char *log_lvl) {struct unwind_state state;struct stack_info stack_info = {0 };
@@ -311,6 +311,25 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, } } +static void show_trace_log_lvl (struct task_struct *task,struct pt_regs *regs, +unsigned long *stack,const char *log_lvl) +{ +/* +* Disable KASAN to avoid false positives during walking another +* task's stacks, as values on these stacks may change concurrently +* with task execution. +*/ +bool disable_kasan = task && task != current; + +if (disable_kasan) +kasan_disable_current (); + +__show_trace_log_lvl (task, regs, stack, log_lvl); + +if (disable_kasan) +kasan_enable_current (); +} +void show_stack (struct task_struct *task,unsigned long *sp,const char *loglvl) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/554 pinctrl: stm32: fix hwspinlock resource leak in probe function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 002679f79ed605e543fbace465557317cd307c9a ]
In stm32_pctl_probe(), hwspin_lock_request_specific() is called to request a hwspinlock, but the acquired lock is not freed on multiple error paths after this call. This causes resource leakage when the function fails to initialize properly.
Use devm_hwspin_lock_request_specific() instead of hwspin_lock_request_specific() to automatically manage the hwspinlock resource lifecycle.
--- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/stm32/pinctrl-stm32.c +1 -1
@@ -1490,7 +1490,7 @@ int stm32_pctl_probe(struct platform_device *pdev)if (hwlock_id == -EPROBE_DEFER )return hwlock_id; }else { - pctl->hwlock =hwspin_lock_request_specific (hwlock_id); + pctl->hwlock =devm_hwspin_lock_request_specific (dev, hwlock_id); }spin_lock_init (&pctl->irqmux_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/554 i3c: remove i2c board info from i2c_dev_desc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit 31b9887c7258ca47d9c665a80f19f006c86756b1 ]
I2C board info is only required during adapter setup so there is no requirement to keeping a pointer to it once running. To support dynamic device addition we can't rely on board info - user-space creation through sysfs won't have a boardinfo.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 18 ++++++++++-------- include/linux/i3c/master.h | 1 - 2 files changed, 10 insertions(+), 9 deletions(-)
drivers/i3c/master.c +10 -8
@@ -610,7 +610,7 @@ static void i3c_master_free_i2c_dev(struct i2c_dev_desc *dev)static struct i2c_dev_desc *i3c_master_alloc_i2c_dev (struct i3c_master_controller *master, -const struct i2c_dev_boardinfo *boardinfo) +u16 addr,u8 lvr) {struct i2c_dev_desc *dev;
@@ -619,9 +619,8 @@ i3c_master_alloc_i2c_dev(struct i3c_master_controller *master,return ERR_PTR (-ENOMEM ); dev->common.master = master; - dev->boardinfo = boardinfo; - dev->addr = boardinfo->base.addr; - dev->lvr = boardinfo->lvr; + dev->addr = addr; + dev->lvr = lvr;return dev; }
@@ -695,7 +694,7 @@ i3c_master_find_i2c_dev_by_addr(const struct i3c_master_controller *master,struct i2c_dev_desc *dev;i3c_bus_for_each_i2cdev (&master->bus, dev) { -if (dev->boardinfo->base.addr == addr) +if (dev->addr == addr)return dev; }
@@ -1692,7 +1691,9 @@ static int i3c_master_bus_init(struct i3c_master_controller *master) i2cboardinfo->base.addr, I3C_ADDR_SLOT_I2C_DEV); - i2cdev =i3c_master_alloc_i2c_dev (master, i2cboardinfo); + i2cdev =i3c_master_alloc_i2c_dev (master, + i2cboardinfo->base.addr, + i2cboardinfo->lvr);if (IS_ERR (i2cdev)) { ret =PTR_ERR (i2cdev); goto err_detach_devs;
@@ -2178,6 +2179,7 @@ static int i3c_master_i2c_adapter_init(struct i3c_master_controller *master) {struct i2c_adapter *adap =i3c_master_to_i2c_adapter (master);struct i2c_dev_desc *i2cdev; +struct i2c_dev_boardinfo *i2cboardinfo;int ret; adap->dev.parent = master->dev.parent;
@@ -2197,8 +2199,8 @@ static int i3c_master_i2c_adapter_init(struct i3c_master_controller *master)* We silently ignore failures here. The bus should keep working * correctly even if one or more i2c devices are not registered. */ -i3c_bus_for_each_i2cdev (&master->bus, i2cdev) - i2cdev->dev =i2c_new_client_device (adap, &i2cdev->boardinfo->base); +list_for_each_entry (i2cboardinfo, &master->boardinfo.i2c, node) + i2cdev->dev =i2c_new_client_device (adap, &i2cboardinfo->base);return 0 ; }
include/linux/i3c/master.h +0 -1
@@ -85,7 +85,6 @@ struct i2c_dev_boardinfo {*/ struct i2c_dev_desc {struct i3c_i2c_dev_desc common; -const struct i2c_dev_boardinfo *boardinfo;struct i2c_client *dev;u16 addr;u8 lvr;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/554 i3c: support dynamically added i2c devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit 72a4501b5d089772671360a6ec74d5350acf8c2e ]
I2C devices can be added to the system dynamically through several sources other than static board info including device tree overlays and sysfs i2c new_device.
Add an I2C bus notifier to attach the clients at runtime if they were not defined in the board info. For DT devices find the LVR in the reg property, for user-space new_device additions we synthesize a conservative setting of no spike filters and fast mode only.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 128 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 127 insertions(+), 1 deletion(-)
drivers/i3c/master.c +127 -1
@@ -2170,11 +2170,122 @@ static u32 i3c_master_i2c_funcs(struct i2c_adapter *adapter)return I2C_FUNC_SMBUS_EMUL |I2C_FUNC_I2C ; } +static u8 i3c_master_i2c_get_lvr (struct i2c_client *client) +{ +/* Fall back to no spike filters and FM bus mode. */ +u8 lvr =I3C_LVR_I2C_INDEX (2 ) |I3C_LVR_I2C_FM_MODE ; + +if (client->dev.of_node) { +u32 reg[3 ]; + +if (!of_property_read_u32_array (client->dev.of_node,"reg" , + reg,ARRAY_SIZE (reg))) + lvr = reg[2 ]; + } + +return lvr; +} + +static int i3c_master_i2c_attach (struct i2c_adapter *adap,struct i2c_client *client) +{ +struct i3c_master_controller *master =i2c_adapter_to_i3c_master (adap); +enum i3c_addr_slot_status status; +struct i2c_dev_desc *i2cdev; +int ret; + +/* Already added by board info? */ +if (i3c_master_find_i2c_dev_by_addr (master, client->addr)) +return 0 ; + + status =i3c_bus_get_addr_slot_status (&master->bus, client->addr); +if (status !=I3C_ADDR_SLOT_FREE ) +return -EBUSY ; + +i3c_bus_set_addr_slot_status (&master->bus, client->addr, +I3C_ADDR_SLOT_I2C_DEV ); + + i2cdev =i3c_master_alloc_i2c_dev (master, client->addr, +i3c_master_i2c_get_lvr (client)); +if (IS_ERR (i2cdev)) { + ret =PTR_ERR (i2cdev); + goto out_clear_status; + } + + ret =i3c_master_attach_i2c_dev (master, i2cdev); +if (ret) + goto out_free_dev; + +return 0 ; + +out_free_dev: +i3c_master_free_i2c_dev (i2cdev); +out_clear_status: +i3c_bus_set_addr_slot_status (&master->bus, client->addr, +I3C_ADDR_SLOT_FREE ); + +return ret; +} + +static int i3c_master_i2c_detach (struct i2c_adapter *adap,struct i2c_client *client) +{ +struct i3c_master_controller *master =i2c_adapter_to_i3c_master (adap); +struct i2c_dev_desc *dev; + + dev =i3c_master_find_i2c_dev_by_addr (master, client->addr); +if (!dev) +return -ENODEV ; + +i3c_master_detach_i2c_dev (dev); +i3c_bus_set_addr_slot_status (&master->bus, dev->addr, +I3C_ADDR_SLOT_FREE ); +i3c_master_free_i2c_dev (dev); + +return 0 ; +} +static const struct i2c_algorithm i3c_master_i2c_algo = { .master_xfer = i3c_master_i2c_adapter_xfer, .functionality = i3c_master_i2c_funcs, }; +static int i3c_i2c_notifier_call (struct notifier_block *nb,unsigned long action, +void *data) +{ +struct i2c_adapter *adap; +struct i2c_client *client; +struct device *dev = data; +struct i3c_master_controller *master; +int ret; + +if (dev->type != &i2c_client_type) +return 0 ; + + client =to_i2c_client (dev); + adap = client->adapter; + +if (adap->algo != &i3c_master_i2c_algo) +return 0 ; + + master =i2c_adapter_to_i3c_master (adap); + +i3c_bus_maintenance_lock (&master->bus); +switch (action) { +case BUS_NOTIFY_ADD_DEVICE : + ret =i3c_master_i2c_attach (adap, client); +break ; +case BUS_NOTIFY_DEL_DEVICE : + ret =i3c_master_i2c_detach (adap, client); +break ; + } +i3c_bus_maintenance_unlock (&master->bus); + +return ret; +} + +static struct notifier_block i2cdev_notifier = { + .notifier_call = i3c_i2c_notifier_call, +}; +static int i3c_master_i2c_adapter_init (struct i3c_master_controller *master) {struct i2c_adapter *adap =i3c_master_to_i2c_adapter (master);
@@ -2705,12 +2816,27 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)static int __init i3c_init (void ) { -return bus_register (&i3c_bus_type); +int res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier); + +if (res) +return res; + + res =bus_register (&i3c_bus_type); +if (res) + goto out_unreg_notifier; + +return 0 ; + +out_unreg_notifier: +bus_unregister_notifier (&i2c_bus_type, &i2cdev_notifier); + +return res; }subsys_initcall (i3c_init); static void __exit i3c_exit(void) { +bus_unregister_notifier (&i2c_bus_type, &i2cdev_notifier);idr_destroy (&i3c_bus_idr);bus_unregister (&i3c_bus_type); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/554 i3c: Allow OF-alias-based persistent bus numbering
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Kerr <[email protected]>
[ Upstream commit 7dc2e0a875645a79f5c1c063019397e8e94008f5 ]
Parse the /aliases node to assign any fixed bus numbers, as is done with the i2c subsystem. Numbering for non-aliased busses will start after the highest fixed bus number.
This allows an alias node such as:
aliases {
i3c0 = &bus_a,
i3c4 = &bus_b,
};to set the numbering for a set of i3c controllers:
/* fixed-numbered bus, assigned "i3c-0" */
bus_a: i3c-master {
};
/* another fixed-numbered bus, assigned "i3c-4" */
bus_b: i3c-master {
};
/* dynamic-numbered bus, likely assigned "i3c-5" */
bus_c: i3c-master {
};If no i3c device aliases are present, the numbering will stay as-is, starting from 0.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-)
drivers/i3c/master.c +25 -5
@@ -21,6 +21,7 @@static DEFINE_IDR (i3c_bus_idr);static DEFINE_MUTEX (i3c_core_lock); +static int __i3c_first_dynamic_bus_num;/** * i3c_bus_maintenance_lock - Lock the bus for a maintenance operation
@@ -420,9 +421,9 @@ static void i3c_bus_cleanup(struct i3c_bus *i3cbus)mutex_unlock (&i3c_core_lock); } -static int i3c_bus_init (struct i3c_bus *i3cbus) +static int i3c_bus_init (struct i3c_bus *i3cbus,struct device_node *np) { -int ret; +int ret, start, end, id =-1 ;init_rwsem (&i3cbus->lock);INIT_LIST_HEAD (&i3cbus->devs.i2c);
@@ -430,8 +431,19 @@ static int i3c_bus_init(struct i3c_bus *i3cbus)i3c_bus_init_addrslots (i3cbus); i3cbus->mode =I3C_BUS_MODE_PURE ; +if (np) + id =of_alias_get_id (np,"i3c" ); +mutex_lock (&i3c_core_lock); - ret =idr_alloc (&i3c_bus_idr, i3cbus,0 ,0 ,GFP_KERNEL ); +if (id >=0 ) { + start = id; + end = start +1 ; + }else { + start = __i3c_first_dynamic_bus_num; + end =0 ; + } + + ret =idr_alloc (&i3c_bus_idr, i3cbus, start, end,GFP_KERNEL );mutex_unlock (&i3c_core_lock);if (ret <0 )
@@ -2607,7 +2619,7 @@ int i3c_master_register(struct i3c_master_controller *master,INIT_LIST_HEAD (&master->boardinfo.i2c);INIT_LIST_HEAD (&master->boardinfo.i3c); - ret =i3c_bus_init (i3cbus); + ret =i3c_bus_init (i3cbus, master->dev.of_node);if (ret)return ret;
@@ -2816,8 +2828,16 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)static int __init i3c_init (void ) { -int res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier); +int res; + + res =of_alias_get_highest_id ("i3c" ); +if (res >=0 ) { +mutex_lock (&i3c_core_lock); + __i3c_first_dynamic_bus_num = res +1 ; +mutex_unlock (&i3c_core_lock); + } + res =bus_register_notifier (&i2c_bus_type, &i2cdev_notifier);if (res)return res;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/554 i3c: master: Inherit DMA masks and parameters from parent device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit 0c35691551387e060e6ae7a6652b4101270c73cf ]
Copy the DMA masks and parameters for an I3C master device from parent device so that the master device has them set for the DMA buffer and mapping API.
Stable-dep-of: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
--- drivers/i3c/master.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i3c/master.c +4 -0
@@ -2626,6 +2626,10 @@ int i3c_master_register(struct i3c_master_controller *master,device_initialize (&master->dev);dev_set_name (&master->dev,"i3c-%d" , i3cbus->id); + master->dev.dma_mask = parent->dma_mask; + master->dev.coherent_dma_mask = parent->coherent_dma_mask; + master->dev.dma_parms = parent->dma_parms; + ret =of_populate_i3c_bus (master);if (ret) goto err_put_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/554 i3c: fix refcount inconsistency in i3c_master_register
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 9d4f219807d5ac11fb1d596e4ddb09336b040067 ]
In i3c_master_register, a possible refcount inconsistency has been identified, causing possible resource leak.
Function of_node_get increases the refcount of parent->of_node. If function i3c_bus_init fails, the function returns immediately without a corresponding decrease, resulting in an inconsistent refcounter.
Move call i3c_bus_init() after device_initialize() to let callback i3c_masterdev_release() release of_node.
--- drivers/i3c/master.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i3c/master.c +4 -4
@@ -2619,10 +2619,6 @@ int i3c_master_register(struct i3c_master_controller *master,INIT_LIST_HEAD (&master->boardinfo.i2c);INIT_LIST_HEAD (&master->boardinfo.i3c); - ret =i3c_bus_init (i3cbus, master->dev.of_node); -if (ret) -return ret; -device_initialize (&master->dev);dev_set_name (&master->dev,"i3c-%d" , i3cbus->id);
@@ -2630,6 +2626,10 @@ int i3c_master_register(struct i3c_master_controller *master, master->dev.coherent_dma_mask = parent->coherent_dma_mask; master->dev.dma_parms = parent->dma_parms; + ret =i3c_bus_init (i3cbus, master->dev.of_node); +if (ret) + goto err_put_dev; + ret =of_populate_i3c_bus (master);if (ret) goto err_put_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/554 i3c: master: svc: Prevent incomplete IBI transaction
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <[email protected]>
[ Upstream commit 3a36273e5a07dda0ccec193800f3b78c3c0380af ]
If no free IBI slot is available, svc_i3c_master_handle_ibi returns immediately. This causes the STOP condition to be missed because the EmitStop request is sent when the transfer is not complete. To resolve this, svc_i3c_master_handle_ibi must wait for the transfer to complete before returning.
--- drivers/i3c/master/svc-i3c-master.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/i3c/master/svc-i3c-master.c +14 -8
@@ -297,21 +297,27 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,int ret, val;u8 *buf; - slot =i3c_generic_ibi_get_free_slot (data->ibi_pool); -if (!slot) -return -ENOSPC ; - - slot->len =0 ; - buf = slot->data; - +/* +* Wait for transfer to complete before returning. Otherwise, the EmitStop +* request might be sent when the transfer is not complete. +*/ ret =readl_relaxed_poll_timeout (master->regs +SVC_I3C_MSTATUS , val,SVC_I3C_MSTATUS_COMPLETE (val),0 ,1000 );if (ret) {dev_err (master->dev,"Timeout when polling for COMPLETE\n" ); -i3c_generic_ibi_recycle_slot (data->ibi_pool, slot);return ret; } + slot =i3c_generic_ibi_get_free_slot (data->ibi_pool); +if (!slot) { +dev_dbg (master->dev,"No free ibi slot, drop the data\n" ); +writel (SVC_I3C_MDATACTRL_FLUSHRB , master->regs +SVC_I3C_MDATACTRL ); +return -ENOSPC ; + } + + slot->len =0 ; + buf = slot->data; +while (SVC_I3C_MSTATUS_RXPEND (readl (master->regs +SVC_I3C_MSTATUS )) && slot->len <SVC_I3C_FIFO_SIZE ) { mdatactrl =readl (master->regs +SVC_I3C_MDATACTRL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/554 power: supply: wm831x: Check wm831x_set_bits() return value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <[email protected]>
[ Upstream commit ea14bae6df18942bccb467fcf5ff33ca677b8253 ]
Since wm831x_set_bits() may return error, log failure and exit from wm831x_usb_limit_change() in such case.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/power/supply/wm831x_power.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/power/supply/wm831x_power.c +8 -2
@@ -144,6 +144,7 @@ static int wm831x_usb_limit_change(struct notifier_block *nb, struct wm831x_power, usb_notify);unsigned int i, best; +int ret;/* Find the highest supported limit */ best =0 ;
@@ -156,8 +157,13 @@ static int wm831x_usb_limit_change(struct notifier_block *nb,dev_dbg (wm831x_power->wm831x->dev,"Limiting USB current to %umA" , wm831x_usb_limits[best]); -wm831x_set_bits (wm831x_power->wm831x,WM831X_POWER_STATE , -WM831X_USB_ILIM_MASK , best); + ret =wm831x_set_bits (wm831x_power->wm831x,WM831X_POWER_STATE , +WM831X_USB_ILIM_MASK , best); +if (ret <0 ) { +dev_err (wm831x_power->wm831x->dev, +"Failed to set USB current limit: %d\n" , ret); +return ret; + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/554 power: supply: apm_power: only unset own apm_get_power_status
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahelenia Ziemiańska <[email protected]>
[ Upstream commit bd44ea12919ac4e83c9f3997240fe58266aa8799 ]
Mirroring drivers/macintosh/apm_emu.c, this means that
modprobe apm_power && modprobe $anotherdriver && modprobe -r apm_power
leaves $anotherdriver's apm_get_power_status instead of deleting it.
--- drivers/power/supply/apm_power.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/apm_power.c +2 -1
@@ -365,7 +365,8 @@ static int __init apm_battery_init(void) static void __exit apm_battery_exit(void) { - apm_get_power_status =NULL ; +if (apm_get_power_status == apm_battery_apm_get_power_status) + apm_get_power_status =NULL ; }module_init (apm_battery_init);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/554 scsi: target: Do not write NUL characters into ASCII configfs output
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit c03b55f235e283cae49c88b9602fd11096b92eba ]
NUL characters are not allowed in ASCII configfs output. Hence this patch.
--- drivers/target/target_core_configfs.c | 1 - 1 file changed, 1 deletion(-)
drivers/target/target_core_configfs.c +0 -1
@@ -2677,7 +2677,6 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page) cur_len =snprintf (buf,LU_GROUP_NAME_BUF ,"%s/%s\n" ,config_item_name (&hba->hba_group.cg_item),config_item_name (&dev->dev_group.cg_item)); - cur_len++;/* Extra byte for NULL terminator */ if ((cur_len + len) >PAGE_SIZE || cur_len >LU_GROUP_NAME_BUF ) { pr_warn("Ran out of lu_gp_show_attr"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/554 spi: tegra210-quad: use device_reset method
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Yarlagadda <[email protected]>
[ Upstream commit ac982578e7d340dc4f4fd243f4a4b24787d28c3f ]
Use device_reset api to replace duplicate code in driver to call reset_control_get api with reset handle.
Stable-dep-of: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling")
--- drivers/spi/spi-tegra210-quad.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-)
drivers/spi/spi-tegra210-quad.c +4 -14
@@ -137,7 +137,6 @@ struct tegra_qspi {spinlock_t lock;struct clk *clk; -struct reset_control *rst;void __iomem *base;phys_addr_t phys;unsigned int irq;
@@ -956,9 +955,8 @@ static void tegra_qspi_handle_error(struct tegra_qspi *tqspi)dev_err (tqspi->dev,"error in transfer, fifo status 0x%08x\n" , tqspi->status_reg);tegra_qspi_dump_regs (tqspi);tegra_qspi_flush_fifos (tqspi, true); -reset_control_assert (tqspi->rst); -udelay (2 ); -reset_control_deassert (tqspi->rst); +if (device_reset (tqspi->dev) <0 ) +dev_warn_once (tqspi->dev,"device reset failed\n" ); }static void tegra_qspi_transfer_end (struct spi_device *spi)
@@ -1260,13 +1258,6 @@ static int tegra_qspi_probe(struct platform_device *pdev)return ret; } - tqspi->rst =devm_reset_control_get_exclusive (&pdev->dev,NULL ); -if (IS_ERR (tqspi->rst)) { - ret =PTR_ERR (tqspi->rst); -dev_err (&pdev->dev,"failed to get reset control: %d\n" , ret); -return ret; - } - tqspi->max_buf_size =QSPI_FIFO_DEPTH <<2 ; tqspi->dma_buf_size =DEFAULT_QSPI_DMA_BUF_LEN ;
@@ -1288,9 +1279,8 @@ static int tegra_qspi_probe(struct platform_device *pdev) goto exit_pm_disable; } -reset_control_assert (tqspi->rst); -udelay (2 ); -reset_control_deassert (tqspi->rst); +if (device_reset (tqspi->dev) <0 ) +dev_warn_once (tqspi->dev,"device reset failed\n" ); tqspi->def_command1_reg =QSPI_M_S |QSPI_CS_SW_HW |QSPI_CS_SW_VAL ;tegra_qspi_writel (tqspi, tqspi->def_command1_reg,QSPI_COMMAND1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/554 spi: tegra210-quad: add new chips to compatible
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Yarlagadda <[email protected]>
[ Upstream commit ea23f0e148b82e5bcbc6c814926f53133552f0f3 ]
Add support for Tegra234 and soc data to select capabilities.
Stable-dep-of: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling")
--- drivers/spi/spi-tegra210-quad.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-)
drivers/spi/spi-tegra210-quad.c +30 -3
@@ -125,6 +125,10 @@#define QSPI_DMA_TIMEOUT (msecs_to_jiffies(1000))#define DEFAULT_QSPI_DMA_BUF_LEN (64 * 1024) +struct tegra_qspi_soc_data { +bool has_dma; +}; +struct tegra_qspi_client_data {int tx_clk_tap_delay;int rx_clk_tap_delay;
@@ -184,6 +188,7 @@ struct tegra_qspi {u32 *tx_dma_buf;dma_addr_t tx_dma_phys;struct dma_async_tx_descriptor *tx_dma_desc; +const struct tegra_qspi_soc_data *soc_data; };static inline u32 tegra_qspi_readl (struct tegra_qspi *tqspi,unsigned long offset)
@@ -1199,10 +1204,32 @@ static irqreturn_t tegra_qspi_isr_thread(int irq, void *context_data)return handle_dma_based_xfer (tqspi); } +static struct tegra_qspi_soc_data tegra210_qspi_soc_data = { + .has_dma = true, +}; + +static struct tegra_qspi_soc_data tegra186_qspi_soc_data = { + .has_dma = true, +}; + +static struct tegra_qspi_soc_data tegra234_qspi_soc_data = { + .has_dma = false, +}; +static const struct of_device_id tegra_qspi_of_match[] = { - { .compatible ="nvidia,tegra210-qspi" , }, - { .compatible ="nvidia,tegra186-qspi" , }, - { .compatible ="nvidia,tegra194-qspi" , }, + { + .compatible ="nvidia,tegra210-qspi" , + .data = &tegra210_qspi_soc_data, + }, { + .compatible ="nvidia,tegra186-qspi" , + .data = &tegra186_qspi_soc_data, + }, { + .compatible ="nvidia,tegra194-qspi" , + .data = &tegra186_qspi_soc_data, + }, { + .compatible ="nvidia,tegra234-qspi" , + .data = &tegra234_qspi_soc_data, + }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/554 spi: tegra210-quad: combined sequence mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Yarlagadda <[email protected]>
[ Upstream commit 1b8342cc4a387933780c50f0cf51c94455be7d11 ]
Add combined sequence mode supported by Tegra QSPI controller. For commands which contain cmd, addr, data parts to it, controller can accept all 3 transfers at once and avoid interrupt for each transfer. This would improve read & write performance.
Stable-dep-of: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling")
--- drivers/spi/spi-tegra210-quad.c | 238 +++++++++++++++++++++++++++++++- 1 file changed, 233 insertions(+), 5 deletions(-)
drivers/spi/spi-tegra210-quad.c +233 -5
@@ -119,14 +119,39 @@#define QSPI_NUM_DUMMY_CYCLE (x) (((x) & 0xff) << 0)#define QSPI_DUMMY_CYCLES_MAX 0xff +#define QSPI_CMB_SEQ_CMD 0x19c +#define QSPI_COMMAND_VALUE_SET (X ) (((x) & 0xFF) << 0) + +#define QSPI_CMB_SEQ_CMD_CFG 0x1a0 +#define QSPI_COMMAND_X1_X2_X4 (x) (((x) & 0x3) << 13) +#define QSPI_COMMAND_X1_X2_X4_MASK (0x03 << 13) +#define QSPI_COMMAND_SDR_DDR BIT(12) +#define QSPI_COMMAND_SIZE_SET (x) (((x) & 0xFF) << 0) + +#define QSPI_GLOBAL_CONFIG 0X1a4 +#define QSPI_CMB_SEQ_EN BIT(0) + +#define QSPI_CMB_SEQ_ADDR 0x1a8 +#define QSPI_ADDRESS_VALUE_SET (X ) (((x) & 0xFFFF) << 0) + +#define QSPI_CMB_SEQ_ADDR_CFG 0x1ac +#define QSPI_ADDRESS_X1_X2_X4 (x) (((x) & 0x3) << 13) +#define QSPI_ADDRESS_X1_X2_X4_MASK (0x03 << 13) +#define QSPI_ADDRESS_SDR_DDR BIT(12) +#define QSPI_ADDRESS_SIZE_SET (x) (((x) & 0xFF) << 0) +#define DATA_DIR_TX BIT(0)#define DATA_DIR_RX BIT(1)#define QSPI_DMA_TIMEOUT (msecs_to_jiffies(1000))#define DEFAULT_QSPI_DMA_BUF_LEN (64 * 1024) +#define CMD_TRANSFER 0 +#define ADDR_TRANSFER 1 +#define DATA_TRANSFER 2struct tegra_qspi_soc_data {bool has_dma; +bool cmb_xfer_capable; };struct tegra_qspi_client_data {
@@ -918,7 +943,6 @@ static int tegra_qspi_setup(struct spi_device *spi) cdata =tegra_qspi_parse_cdata_dt (spi); spi->controller_data = cdata; } -spin_lock_irqsave (&tqspi->lock, flags);/* keep default cs state to inactive */
@@ -977,19 +1001,179 @@ static void tegra_qspi_transfer_end(struct spi_device *spi)tegra_qspi_writel (tqspi, tqspi->def_command1_reg,QSPI_COMMAND1 ); } -static int tegra_qspi_transfer_one_message (struct spi_master *master,struct spi_message *msg) +static u32 tegra_qspi_cmd_config (bool is_ddr,u8 bus_width,u8 len) +{ +u32 cmd_config =0 ; + +/* Extract Command configuration and value */ +if (is_ddr) + cmd_config |=QSPI_COMMAND_SDR_DDR ; +else + cmd_config &= ~QSPI_COMMAND_SDR_DDR ; + + cmd_config |=QSPI_COMMAND_X1_X2_X4 (bus_width); + cmd_config |=QSPI_COMMAND_SIZE_SET ((len *8 ) -1 ); + +return cmd_config; +} + +static u32 tegra_qspi_addr_config (bool is_ddr,u8 bus_width,u8 len) +{ +u32 addr_config =0 ; + +/* Extract Address configuration and value */ + is_ddr =0 ;//Only SDR mode supported + bus_width =0 ;//X1 mode + +if (is_ddr) + addr_config |=QSPI_ADDRESS_SDR_DDR ; +else + addr_config &= ~QSPI_ADDRESS_SDR_DDR ; + + addr_config |=QSPI_ADDRESS_X1_X2_X4 (bus_width); + addr_config |=QSPI_ADDRESS_SIZE_SET ((len *8 ) -1 ); + +return addr_config; +} + +static int tegra_qspi_combined_seq_xfer (struct tegra_qspi *tqspi, +struct spi_message *msg) +{ +bool is_first_msg = true; +struct spi_transfer *xfer; +struct spi_device *spi = msg->spi; +u8 transfer_phase =0 ; +u32 cmd1 =0 , dma_ctl =0 ; +int ret =0 ; +u32 address_value =0 ; +u32 cmd_config =0 , addr_config =0 ; +u8 cmd_value =0 , val =0 ; + +/* Enable Combined sequence mode */ + val =tegra_qspi_readl (tqspi,QSPI_GLOBAL_CONFIG ); + val |=QSPI_CMB_SEQ_EN ; +tegra_qspi_writel (tqspi, val,QSPI_GLOBAL_CONFIG ); +/* Process individual transfer list */ +list_for_each_entry (xfer, &msg->transfers, transfer_list) { +switch (transfer_phase) { +case CMD_TRANSFER : +/* X1 SDR mode */ + cmd_config =tegra_qspi_cmd_config (false,0 , + xfer->len); + cmd_value = *((const u8 *)(xfer->tx_buf)); +break ; +case ADDR_TRANSFER : +/* X1 SDR mode */ + addr_config =tegra_qspi_addr_config (false,0 , + xfer->len); + address_value = *((const u32 *)(xfer->tx_buf)); +break ; +case DATA_TRANSFER : +/* Program Command, Address value in register */ +tegra_qspi_writel (tqspi, cmd_value,QSPI_CMB_SEQ_CMD ); +tegra_qspi_writel (tqspi, address_value, +QSPI_CMB_SEQ_ADDR ); +/* Program Command and Address config in register */ +tegra_qspi_writel (tqspi, cmd_config, +QSPI_CMB_SEQ_CMD_CFG ); +tegra_qspi_writel (tqspi, addr_config, +QSPI_CMB_SEQ_ADDR_CFG ); + +reinit_completion (&tqspi->xfer_completion); + cmd1 =tegra_qspi_setup_transfer_one (spi, xfer, + is_first_msg); + ret =tegra_qspi_start_transfer_one (spi, xfer, + cmd1); + +if (ret <0 ) { +dev_err (tqspi->dev,"Failed to start transfer-one: %d\n" , + ret); +return ret; + } + + is_first_msg = false; + ret =wait_for_completion_timeout + (&tqspi->xfer_completion, +QSPI_DMA_TIMEOUT ); + +if (WARN_ON (ret ==0 )) { +dev_err (tqspi->dev,"QSPI Transfer failed with timeout: %d\n" , + ret); +if (tqspi->is_curr_dma_xfer && + (tqspi->cur_direction &DATA_DIR_TX )) +dmaengine_terminate_all + (tqspi->tx_dma_chan); + +if (tqspi->is_curr_dma_xfer && + (tqspi->cur_direction &DATA_DIR_RX )) +dmaengine_terminate_all + (tqspi->rx_dma_chan); + +/* Abort transfer by resetting pio/dma bit */ +if (!tqspi->is_curr_dma_xfer) { + cmd1 =tegra_qspi_readl + (tqspi, +QSPI_COMMAND1 ); + cmd1 &= ~QSPI_PIO ; +tegra_qspi_writel + (tqspi, cmd1, +QSPI_COMMAND1 ); + }else { + dma_ctl =tegra_qspi_readl + (tqspi, +QSPI_DMA_CTL ); + dma_ctl &= ~QSPI_DMA_EN ; +tegra_qspi_writel (tqspi, dma_ctl, +QSPI_DMA_CTL ); + } + +/* Reset controller if timeout happens */ +if (device_reset (tqspi->dev) <0 ) +dev_warn_once (tqspi->dev, +"device reset failed\n" ); + ret = -EIO ; + goto exit; + } + +if (tqspi->tx_status || tqspi->rx_status) { +dev_err (tqspi->dev,"QSPI Transfer failed\n" ); + tqspi->tx_status =0 ; + tqspi->rx_status =0 ; + ret = -EIO ; + goto exit; + } +break ; +default : + ret = -EINVAL ; + goto exit; + } + msg->actual_length += xfer->len; + transfer_phase++; + } + +exit: + msg->status = ret; + +return ret; +} + +static int tegra_qspi_non_combined_seq_xfer (struct tegra_qspi *tqspi, +struct spi_message *msg) { -struct tegra_qspi *tqspi =spi_master_get_devdata (master);struct spi_device *spi = msg->spi;struct spi_transfer *transfer;bool is_first_msg = true; -int ret; +int ret =0 , val =0 ; msg->status =0 ; msg->actual_length =0 ; tqspi->tx_status =0 ; tqspi->rx_status =0 ; +/* Disable Combined sequence mode */ + val =tegra_qspi_readl (tqspi,QSPI_GLOBAL_CONFIG ); + val &= ~QSPI_CMB_SEQ_EN ; +tegra_qspi_writel (tqspi, val,QSPI_GLOBAL_CONFIG );list_for_each_entry (transfer, &msg->transfers, transfer_list) {struct spi_transfer *xfer = transfer;u8 dummy_bytes =0 ;
@@ -1027,7 +1211,6 @@ static int tegra_qspi_transfer_one_message(struct spi_master *master, struct spi goto complete_xfer; } - is_first_msg = false; ret =wait_for_completion_timeout (&tqspi->xfer_completion,QSPI_DMA_TIMEOUT );if (WARN_ON (ret ==0 )) {
@@ -1072,7 +1255,48 @@ static int tegra_qspi_transfer_one_message(struct spi_master *master, struct spi ret =0 ; exit: msg->status = ret; + +return ret; +} + +static bool tegra_qspi_validate_cmb_seq (struct tegra_qspi *tqspi, +struct spi_message *msg) +{ +int transfer_count =0 ; +struct spi_transfer *xfer; + +list_for_each_entry (xfer, &msg->transfers, transfer_list) { + transfer_count++; + } +if (!tqspi->soc_data->cmb_xfer_capable || transfer_count !=3 ) +return false; + xfer =list_first_entry (&msg->transfers,typeof (*xfer), + transfer_list); +if (xfer->len >2 ) +return false; + xfer =list_next_entry (xfer, transfer_list); +if (xfer->len >4 || xfer->len <3 ) +return false; + xfer =list_next_entry (xfer, transfer_list); +if (!tqspi->soc_data->has_dma || xfer->len > (QSPI_FIFO_DEPTH <<2 )) +return false; + +return true; +} + +static int tegra_qspi_transfer_one_message (struct spi_master *master, +struct spi_message *msg) +{ +struct tegra_qspi *tqspi =spi_master_get_devdata (master); +int ret; + +if (tegra_qspi_validate_cmb_seq (tqspi, msg)) + ret =tegra_qspi_combined_seq_xfer (tqspi, msg); +else + ret =tegra_qspi_non_combined_seq_xfer (tqspi, msg); +spi_finalize_current_message (master); +return ret; }
@@ -1206,14 +1430,17 @@ static irqreturn_t tegra_qspi_isr_thread(int irq, void *context_data)static struct tegra_qspi_soc_data tegra210_qspi_soc_data = { .has_dma = true, + .cmb_xfer_capable = false, };static struct tegra_qspi_soc_data tegra186_qspi_soc_data = { .has_dma = true, + .cmb_xfer_capable = true, };static struct tegra_qspi_soc_data tegra234_qspi_soc_data = { .has_dma = false, + .cmb_xfer_capable = true, };static const struct of_device_id tegra_qspi_of_match[] = {
@@ -1267,6 +1494,7 @@ static int tegra_qspi_probe(struct platform_device *pdev) tqspi->dev = &pdev->dev;spin_lock_init (&tqspi->lock); + tqspi->soc_data =device_get_match_data (&pdev->dev); r =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); tqspi->base =devm_ioremap_resource (&pdev->dev, r);if (IS_ERR (tqspi->base))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/554 spi: tegra210-quad: modify chip select (CS) deactivation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishwaroop A <[email protected]>
[ Upstream commit d8966b65413390d1b5b706886987caac05fbe024 ]
Modify the chip select (CS) deactivation and inter-transfer delay execution only during the DATA_TRANSFER phase when the cs_change flag is not set. This ensures proper CS handling and timing between transfers while eliminating redundant operations.
Stable-dep-of: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling")
--- drivers/spi/spi-tegra210-quad.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi-tegra210-quad.c +4 -0
@@ -1148,6 +1148,10 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, goto exit; } msg->actual_length += xfer->len; +if (!xfer->cs_change && transfer_phase ==DATA_TRANSFER ) { +tegra_qspi_transfer_end (spi); +spi_transfer_delay_exec (xfer); + } transfer_phase++; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/554 spi: tegra210-quad: Fix timeout handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishwaroop A <[email protected]>
[ Upstream commit b4e002d8a7cee3b1d70efad0e222567f92a73000 ]
When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running before the transfer timeout is reached.
While handling the timeouts, any pending transfers are cleaned up and the message that they correspond to is marked as failed, which leaves the curr_xfer field pointing at stale memory.
To avoid this, clear curr_xfer to NULL upon timeout and check for this condition when the IRQ thread is finally run.
While at it, also make sure to clear interrupts on failure so that new interrupts can be run.
A better, more involved, fix would move the interrupt clearing into a hard IRQ handler. Ideally we would also want to signal that the IRQ thread no longer needs to be run after the timeout is hit to avoid the extra check for a valid transfer.
--- drivers/spi/spi-tegra210-quad.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
drivers/spi/spi-tegra210-quad.c +20 -2
@@ -984,8 +984,10 @@ static void tegra_qspi_handle_error(struct tegra_qspi *tqspi)dev_err (tqspi->dev,"error in transfer, fifo status 0x%08x\n" , tqspi->status_reg);tegra_qspi_dump_regs (tqspi);tegra_qspi_flush_fifos (tqspi, true); -if (device_reset (tqspi->dev) <0 ) +if (device_reset (tqspi->dev) <0 ) {dev_warn_once (tqspi->dev,"device reset failed\n" ); +tegra_qspi_mask_clear_irq (tqspi); + } }static void tegra_qspi_transfer_end (struct spi_device *spi)
@@ -1128,9 +1130,11 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, }/* Reset controller if timeout happens */ -if (device_reset (tqspi->dev) <0 ) +if (device_reset (tqspi->dev) <0 ) {dev_warn_once (tqspi->dev,"device reset failed\n" ); +tegra_qspi_mask_clear_irq (tqspi); + } ret = -EIO ; goto exit; }
@@ -1152,10 +1156,12 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi,tegra_qspi_transfer_end (spi);spi_transfer_delay_exec (xfer); } + tqspi->curr_xfer =NULL ; transfer_phase++; } exit: + tqspi->curr_xfer =NULL ; msg->status = ret;return ret;
@@ -1237,6 +1243,8 @@ static int tegra_qspi_non_combined_seq_xfer(struct tegra_qspi *tqspi, msg->actual_length += xfer->len + dummy_bytes; complete_xfer: + tqspi->curr_xfer =NULL ; +if (ret <0 ) {tegra_qspi_transfer_end (spi);spi_transfer_delay_exec (xfer);
@@ -1333,6 +1341,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_qspi *tqspi)tegra_qspi_calculate_curr_xfer_param (tqspi, t);tegra_qspi_start_cpu_based_transfer (tqspi, t); exit: + tqspi->curr_xfer =NULL ;spin_unlock_irqrestore (&tqspi->lock, flags);return IRQ_HANDLED ; }
@@ -1416,6 +1425,15 @@ static irqreturn_t tegra_qspi_isr_thread(int irq, void *context_data) {struct tegra_qspi *tqspi = context_data; +/* +* Occasionally the IRQ thread takes a long time to wake up (usually +* when the CPU that it's running on is excessively busy) and we have +* already reached the timeout before and cleaned up the timed out +* transfer. Avoid any processing in that case and bail out early. +*/ +if (!tqspi->curr_xfer) +return IRQ_NONE ; + tqspi->status_reg =tegra_qspi_readl (tqspi,QSPI_FIFO_STATUS );if (tqspi->cur_direction &DATA_DIR_TX )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/554 mfd: da9055: Fix missing regmap_del_irq_chip() in error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 1b58acfd067ca16116b9234cd6b2d30cc8ab7502 ]
When da9055_device_init() fails after regmap_add_irq_chip() succeeds but mfd_add_devices() fails, the error handling path only calls mfd_remove_devices() but forgets to call regmap_del_irq_chip(). This results in a resource leak.
Fix this by adding regmap_del_irq_chip() to the error path so that resources are released properly.
--- drivers/mfd/da9055-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/da9055-core.c +1 -0
@@ -388,6 +388,7 @@ int da9055_device_init(struct da9055 *da9055) err:mfd_remove_devices (da9055->dev); +regmap_del_irq_chip (da9055->chip_irq, da9055->irq_data);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/554 ext4: minor defrag code improvements
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Whitney <[email protected]>
[ Upstream commit d412df530f77d0f61c41b83f925997452fc3944c ]
Modify the error returns for two file types that can't be defragged to more clearly communicate those restrictions to a caller. When the defrag code is applied to swap files, return -ETXTBSY, and when applied to quota files, return -EOPNOTSUPP. Move an extent tree search whose results are only occasionally required to the site always requiring them for improved efficiency. Address a few typos.
Stable-dep-of: a2e5a3cea4b1 ("ext4: correct the checking of quota files before moving extents")
--- fs/ext4/move_extent.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
fs/ext4/move_extent.c +7 -9
@@ -466,19 +466,17 @@ mext_check_arguments(struct inode *orig_inode,if (IS_IMMUTABLE (donor_inode) ||IS_APPEND (donor_inode))return -EPERM ; -/* Ext4 move extent does not support swapfile */ +/* Ext4 move extent does not support swap files */ if (IS_SWAPFILE (orig_inode) ||IS_SWAPFILE (donor_inode)) { -ext4_debug ("ext4 move extent: The argument files should " -"not be swapfile [ino:orig %lu, donor %lu]\n" , +ext4_debug ("ext4 move extent: The argument files should not be swap files [ino:orig %lu, donor %lu]\n" , orig_inode->i_ino, donor_inode->i_ino); -return -EBUSY ; +return -ETXTBSY ; }if (ext4_is_quota_file (orig_inode) &&ext4_is_quota_file (donor_inode)) { -ext4_debug ("ext4 move extent: The argument files should " -"not be quota files [ino:orig %lu, donor %lu]\n" , +ext4_debug ("ext4 move extent: The argument files should not be quota files [ino:orig %lu, donor %lu]\n" , orig_inode->i_ino, donor_inode->i_ino); -return -EBUSY ; +return -EOPNOTSUPP ; }/* Ext4 move extent supports only extent based file */
@@ -626,11 +624,11 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,if (ret) goto out; ex = path[path->p_depth].p_ext; - next_blk =ext4_ext_next_allocated_block (path); cur_blk =le32_to_cpu (ex->ee_block); cur_len =ext4_ext_get_actual_len (ex);/* Check hole before the start pos */ if (cur_blk + cur_len -1 < o_start) { + next_blk =ext4_ext_next_allocated_block (path);if (next_blk ==EXT_MAX_BLOCKS ) { o_start = o_end; ret = -ENODATA ;
@@ -659,7 +657,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, donor_page_index = d_start >> (PAGE_SHIFT - donor_inode->i_blkbits); offset_in_page = o_start % blocks_per_page; -if (cur_len > blocks_per_page- offset_in_page) +if (cur_len > blocks_per_page - offset_in_page) cur_len = blocks_per_page - offset_in_page;/* * Up semaphore to avoid following problems:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/554 ext4: correct the checking of quota files before moving extents
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit a2e5a3cea4b18f6e2575acc444a5e8cce1fc8260 ]
The move extent operation should return -EOPNOTSUPP if any of the inodes is a quota inode, rather than requiring both to be quota inodes.
Message-ID: <[email protected]>
--- fs/ext4/move_extent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/move_extent.c +1 -1
@@ -473,7 +473,7 @@ mext_check_arguments(struct inode *orig_inode,return -ETXTBSY ; } -if (ext4_is_quota_file (orig_inode) &&ext4_is_quota_file (donor_inode)) { +if (ext4_is_quota_file (orig_inode) ||ext4_is_quota_file (donor_inode)) {ext4_debug ("ext4 move extent: The argument files should not be quota files [ino:orig %lu, donor %lu]\n" , orig_inode->i_ino, donor_inode->i_ino);return -EOPNOTSUPP ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/554 perf/x86/intel: Correct large PEBS flag check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
[ Upstream commit 5e4e355ae7cdeb0fef5dbe908866e1f895abfacc ]
current large PEBS flag check only checks if sample_regs_user contains unsupported GPRs but doesn't check if sample_regs_intr contains unsupported GPRs.
Of course, currently PEBS HW supports to sample all perf supported GPRs, the missed check doesn't cause real issue. But it won't be true any more after the subsequent patches support to sample SSP register. SSP sampling is not supported by adaptive PEBS HW and it would be supported until arch-PEBS HW. So correct this issue.
--- arch/x86/events/intel/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/events/intel/core.c +3 -1
@@ -3639,7 +3639,9 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)if (!event->attr.exclude_kernel) flags &= ~PERF_SAMPLE_REGS_USER ;if (event->attr.sample_regs_user & ~PEBS_GP_REGS ) - flags &= ~(PERF_SAMPLE_REGS_USER |PERF_SAMPLE_REGS_INTR ); + flags &= ~PERF_SAMPLE_REGS_USER ; +if (event->attr.sample_regs_intr & ~PEBS_GP_REGS ) + flags &= ~PERF_SAMPLE_REGS_INTR ;return flags; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/554 regulator: core: disable supply if enabling main regulator fails
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit fb1ebb10468da414d57153ddebaab29c38ef1a78 ]
For 'always-on' and 'boot-on' regulators, the set_machine_constraints() may enable supply before enabling the main regulator, however if the latter fails, the function returns with an error but the supply remains enabled.
When this happens, the regulator_register() function continues on the error path where it puts the supply regulator. Since enabling the supply is not balanced with a disable call, a warning similar to the following gets issued from _regulator_put():
[ 1.603889] WARNING: CPU: 2 PID: 44 at _regulator_put+0x8c/0xa0
[ 1.603908] Modules linked in:
[ 1.603926] CPU: 2 UID: 0 PID: 44 Comm: kworker/u16:3 Not tainted 6.18.0-rc4 #0 NONE
[ 1.603938] Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT)
[ 1.603945] Workqueue: async async_run_entry_fn
[ 1.603958] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1.603967] pc : _regulator_put+0x8c/0xa0
[ 1.603976] lr : _regulator_put+0x7c/0xa0
...
[ 1.604140] Call trace:
[ 1.604145] _regulator_put+0x8c/0xa0 (P)
[ 1.604156] regulator_register+0x2ec/0xbf0
[ 1.604166] devm_regulator_register+0x60/0xb0
[ 1.604178] rpm_reg_probe+0x120/0x208
[ 1.604187] platform_probe+0x64/0xa8
...In order to avoid this, change the set_machine_constraints() function to disable the supply if enabling the main regulator fails.
--- drivers/regulator/core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/regulator/core.c +5 -0
@@ -1616,6 +1616,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)* and we have control then make sure it is enabled. */ if (rdev->constraints->always_on || rdev->constraints->boot_on) { +bool supply_enabled = false; +/* If we want to enable this regulator, make sure that we know * the supplying regulator. */
@@ -1635,11 +1637,14 @@ static int set_machine_constraints(struct regulator_dev *rdev) rdev->supply =NULL ;return ret; } + supply_enabled = true; } ret =_regulator_do_enable (rdev);if (ret <0 && ret != -EINVAL ) {rdev_err (rdev,"failed to enable: %pe\n" ,ERR_PTR (ret)); +if (supply_enabled) +regulator_disable (rdev->supply);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/554 nbd: clean up return value checking of sock_xmit()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit f52c0e08237e7864a44311fc78bc9bf2e045611b ]
Check if sock_xmit() return 0 is useless because it'll never return 0, comment it and remove such checkings.
Stable-dep-of: 9517b82d8d42 ("nbd: defer config put in recv_work")
--- drivers/block/nbd.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/block/nbd.c +7 -6
@@ -487,7 +487,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req, }/* -* Send or receive packet. +* Send or receive packet. Return a positive value on success and +* negtive value on failue, and never return 0. */ static int sock_xmit (struct nbd_device *nbd,int index,int send,struct iov_iter *iter,int msg_flags,int *sent)
@@ -613,7 +614,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) result =sock_xmit (nbd, index,1 , &from, (type ==NBD_CMD_WRITE ) ?MSG_MORE :0 , &sent);trace_nbd_header_sent (req, handle); -if (result <=0 ) { +if (result <0 ) {if (was_interrupted (result)) {/* If we havne't sent anything we can just return BUSY, * however if we have sent something we need to make
@@ -657,7 +658,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) skip =0 ; } result =sock_xmit (nbd, index,1 , &from, flags, &sent); -if (result <=0 ) { +if (result <0 ) {if (was_interrupted (result)) {/* We've already sent the header, we * have no choice but to set pending and
@@ -709,7 +710,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index) reply.magic =0 ;iov_iter_kvec (&to,READ , &iov,1 ,sizeof (reply)); result =sock_xmit (nbd, index,0 , &to,MSG_WAITALL ,NULL ); -if (result <=0 ) { +if (result <0 ) {if (!nbd_disconnected (config))dev_err (disk_to_dev (nbd->disk),"Receive control failed (result %d)\n" , result);
@@ -770,7 +771,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)rq_for_each_segment (bvec, req, iter) {iov_iter_bvec (&to,READ , &bvec,1 , bvec.bv_len); result =sock_xmit (nbd, index,0 , &to,MSG_WAITALL ,NULL ); -if (result <=0 ) { +if (result <0 ) {dev_err (disk_to_dev (nbd->disk),"Receive data failed (result %d)\n" , result);/*
@@ -1216,7 +1217,7 @@ static void send_disconnects(struct nbd_device *nbd)iov_iter_kvec (&from,WRITE , &iov,1 ,sizeof (request));mutex_lock (&nsock->tx_lock); ret =sock_xmit (nbd, i,1 , &from,0 ,NULL ); -if (ret <=0 ) +if (ret <0 )dev_err (disk_to_dev (nbd->disk),"Send disconnect failed %d\n" , ret);mutex_unlock (&nsock->tx_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/554 nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 3fe1db626a56cdf259c348404f2c5429e2f065a1 ]
Prepare to fix uaf in nbd_read_stat(), no functional changes.
Stable-dep-of: 9517b82d8d42 ("nbd: defer config put in recv_work")
--- drivers/block/nbd.c | 74 +++++++++++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 30 deletions(-)
drivers/block/nbd.c +44 -30
@@ -692,38 +692,45 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)return 0 ; } -/* NULL returned = something went wrong, inform userspace */ -static struct nbd_cmd *nbd_read_stat (struct nbd_device *nbd,int index) +static int nbd_read_reply (struct nbd_device *nbd,int index, +struct nbd_reply *reply) { -struct nbd_config *config = nbd->config; -int result; -struct nbd_reply reply; -struct nbd_cmd *cmd; -struct request *req =NULL ; -u64 handle; -u16 hwq; -u32 tag; -struct kvec iov = {.iov_base = &reply, .iov_len =sizeof (reply)}; +struct kvec iov = {.iov_base = reply, .iov_len =sizeof (*reply)};struct iov_iter to; -int ret =0 ; +int result; - reply.magic =0 ; -iov_iter_kvec (&to,READ , &iov,1 ,sizeof (reply)); + reply->magic =0 ; +iov_iter_kvec (&to,READ , &iov,1 ,sizeof (*reply)); result =sock_xmit (nbd, index,0 , &to,MSG_WAITALL ,NULL );if (result <0 ) { -if (!nbd_disconnected (config)) +if (!nbd_disconnected (nbd->config))dev_err (disk_to_dev (nbd->disk),"Receive control failed (result %d)\n" , result); -return ERR_PTR (result); +return result; } -if (ntohl (reply.magic) !=NBD_REPLY_MAGIC ) { +if (ntohl (reply->magic) !=NBD_REPLY_MAGIC ) {dev_err (disk_to_dev (nbd->disk),"Wrong magic (0x%lx)\n" , - (unsigned long )ntohl (reply.magic)); -return ERR_PTR (-EPROTO ); + (unsigned long )ntohl (reply->magic)); +return -EPROTO ; } -memcpy (&handle, reply.handle,sizeof (handle)); +return 0 ; +} + +/* NULL returned = something went wrong, inform userspace */ +static struct nbd_cmd *nbd_handle_reply (struct nbd_device *nbd,int index, +struct nbd_reply *reply) +{ +int result; +struct nbd_cmd *cmd; +struct request *req =NULL ; +u64 handle; +u16 hwq; +u32 tag; +int ret =0 ; + +memcpy (&handle, reply->handle,sizeof (handle)); tag =nbd_handle_to_tag (handle); hwq =blk_mq_unique_tag_to_hwq (tag);if (hwq < nbd->tag_set.nr_hw_queues)
@@ -756,9 +763,9 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index) ret = -ENOENT ; goto out; } -if (ntohl (reply.error)) { +if (ntohl (reply->error)) {dev_err (disk_to_dev (nbd->disk),"Other side returned error (%d)\n" , -ntohl (reply.error)); +ntohl (reply->error)); cmd->status =BLK_STS_IOERR ; goto out; }
@@ -767,6 +774,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)if (rq_data_dir (req) !=WRITE ) {struct req_iterator iter;struct bio_vec bvec; +struct iov_iter to;rq_for_each_segment (bvec, req, iter) {iov_iter_bvec (&to,READ , &bvec,1 , bvec.bv_len);
@@ -780,7 +788,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)* and let the timeout stuff handle resubmitting * this request onto another connection. */ -if (nbd_disconnected (config)) { +if (nbd_disconnected (nbd->config)) { cmd->status =BLK_STS_IOERR ; goto out; }
@@ -804,24 +812,30 @@ static void recv_work(struct work_struct *work) work);struct nbd_device *nbd = args->nbd;struct nbd_config *config = nbd->config; +struct nbd_sock *nsock;struct nbd_cmd *cmd;struct request *rq;while (1 ) { - cmd =nbd_read_stat (nbd, args->index); -if (IS_ERR (cmd)) { -struct nbd_sock *nsock = config->socks[args->index]; +struct nbd_reply reply; -mutex_lock (&nsock->tx_lock); -nbd_mark_nsock_dead (nbd, nsock,1 ); -mutex_unlock (&nsock->tx_lock); +if (nbd_read_reply (nbd, args->index, &reply)) +break ; + + cmd =nbd_handle_reply (nbd, args->index, &reply); +if (IS_ERR (cmd))break ; - } rq =blk_mq_rq_from_pdu (cmd);if (likely (!blk_should_fake_timeout (rq->q)))blk_mq_complete_request (rq); } + + nsock = config->socks[args->index]; +mutex_lock (&nsock->tx_lock); +nbd_mark_nsock_dead (nbd, nsock,1 ); +mutex_unlock (&nsock->tx_lock); +nbd_config_put (nbd);atomic_dec (&config->recv_threads);wake_up (&config->recv_wq);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/554 nbd: defer config put in recv_work
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 9517b82d8d422d426a988b213fdd45c6b417b86d ]
There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE:
nbd_genl_connect // conf_ref=2 (connect and recv_work A)
nbd_open // conf_ref=3
recv_work A done // conf_ref=2
NBD_CLEAR_SOCK // conf_ref=1
nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)
close nbd // conf_ref=1
recv_work B
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Or only running NBD_CLEAR_SOCK:
nbd_genl_connect // conf_ref=2
nbd_open // conf_ref=3
NBD_CLEAR_SOCK // conf_ref=2
close nbd
nbd_release
config_put // conf_ref=1
recv_work
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared.
However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup.
Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear
+ reconfigure interleave.
In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock):
path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2
NBD_CLEAR_SOCK
close nbd
nbd_release
nbd_disconnect_and_put
flush_workqueue // recv_work done
nbd_config_put
nbd_put // nbd_refs=1
nbd_put // nbd_refs=0
queue_workpath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3
NBD_CLEAR_SOCK // conf_refs=2
close nbd
nbd_release
nbd_config_put // conf_refs=1
nbd_put // nbd_refs=2
recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0
Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
--- drivers/block/nbd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/nbd.c +1 -1
@@ -836,9 +836,9 @@ static void recv_work(struct work_struct *work)nbd_mark_nsock_dead (nbd, nsock,1 );mutex_unlock (&nsock->tx_lock); -nbd_config_put (nbd);atomic_dec (&config->recv_threads);wake_up (&config->recv_wq); +nbd_config_put (nbd);kfree (args); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/554 scsi: stex: Fix reboot_notifier leak in probe error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 20da637eb545b04753e20c675cfe97b04c7b600b ]
In stex_probe(), register_reboot_notifier() is called at the beginning, but if any subsequent initialization step fails, the function returns without unregistering the notifier, resulting in a resource leak.
Add unregister_reboot_notifier() in the out_disable error path to ensure proper cleanup on all failure paths.
--- drivers/scsi/stex.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/stex.c +1 -0
@@ -1848,6 +1848,7 @@ static int stex_probe(struct pci_dev *pdev, const struct pci_device_id *id) out_scsi_host_put:scsi_host_put (host); out_disable: +unregister_reboot_notifier (&stex_notifier);pci_disable_device (pdev);return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/554 dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit b80b848bdf56bd402b7a91aea5b77cec93dfe4c2 ]
Convert the Amlogic Meson AXG DWC PCIe SoC controller bindings to dt-schema.
Stable-dep-of: 4813dea9e272 ("dt-bindings: PCI: amlogic: Fix the register name of the DBI region")
--- .../bindings/pci/amlogic,axg-pcie.yaml | 134 ++++++++++++++++++ .../bindings/pci/amlogic,meson-pcie.txt | 70 --------- 2 files changed, 134 insertions(+), 70 deletions(-) create mode 100644 Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml delete mode 100644 Documentation/devicetree/bindings/pci/amlogic,meson-pcie.txt
Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml new file +134 -0
@@ -0,0 +1,134 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/pci/amlogic,axg-pcie.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Amlogic Meson AXG DWC PCIe SoC controller + +maintainers: + - Neil Armstrong <[email protected]> + +description: + Amlogic Meson PCIe host controller is based on the Synopsys DesignWare PCI core. + +allOf: + - $ref: /schemas/pci/pci-bus.yaml# + - $ref: /schemas/pci/snps,dw-pcie-common.yaml# + +# We need a select here so we don't match all nodes with 'snps,dw-pcie' +select: + properties: + compatible: + enum: + - amlogic,axg-pcie + - amlogic,g12a-pcie + required: + - compatible + +properties: + compatible: + items: + - enum: + - amlogic,axg-pcie + - amlogic,g12a-pcie + - const: snps,dw-pcie + + reg: + items: + - description: External local bus interface registers + - description: Meson designed configuration registers + - description: PCIe configuration space + + reg-names: + items: + - const: elbi + - const: cfg + - const: config + + interrupts: + maxItems: 1 + + clocks: + items: + - description: PCIe GEN 100M PLL clock + - description: PCIe RC clock gate + - description: PCIe PHY clock + + clock-names: + items: + - const: pclk + - const: port + - const: general + + phys: + maxItems: 1 + + phy-names: + const: pcie + + resets: + items: + - description: Port Reset + - description: Shared APB reset + + reset-names: + items: + - const: port + - const: apb + + num-lanes: + const: 1 + + power-domains: + maxItems: 1 + +required: + - compatible + - reg + - reg-names + - interrupts + - clock + - clock-names + - "#address-cells" + - "#size-cells" + - "#interrupt-cells" + - interrupt-map + - interrupt-map-mask + - ranges + - bus-range + - device_type + - num-lanes + - phys + - phy-names + - resets + - reset-names + +unevaluatedProperties: false + +examples: + - | + #include <dt-bindings/interrupt-controller/irq.h> + #include <dt-bindings/interrupt-controller/arm-gic.h> + pcie: pcie@f9800000 { + compatible = "amlogic,axg-pcie", "snps,dw-pcie"; + reg = <0xf9800000 0x400000>, <0xff646000 0x2000>, <0xf9f00000 0x100000>; + reg-names = "elbi", "cfg", "config"; + interrupts = <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>; + clocks = <&pclk>, <&clk_port>, <&clk_phy>; + clock-names = "pclk", "port", "general"; + resets = <&reset_pcie_port>, <&reset_pcie_apb>; + reset-names = "port", "apb"; + phys = <&pcie_phy>; + phy-names = "pcie"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 179 IRQ_TYPE_EDGE_RISING>; + bus-range = <0x0 0xff>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + ranges = <0x82000000 0 0 0xf9c00000 0 0x00300000>; + }; +...
Documentation/devicetree/bindings/pci/amlogic,meson-pcie.txt deleted +0 -70
70 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/554 dt-bindings: PCI: amlogic: Fix the register name of the DBI region
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 4813dea9e272ba0a57c50b8d51d440dd8e3ccdd7 ]
Binding incorrectly specifies the 'DBI' region as 'ELBI'. DBI is a must have region for DWC controllers as it has the Root Port and controller specific registers, while ELBI has optional registers.
Hence, fix the binding. Though this is an ABI break, this change is needed to accurately describe the PCI memory map.
--- Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml +3 -3
@@ -36,13 +36,13 @@ properties: reg: items: - - description: External local bus interface registers + - description: Data Bus Interface registers - description: Meson designed configuration registers - description: PCIe configuration space reg-names: items: - - const: elbi + - const: dbi - const: cfg - const: config
@@ -113,7 +113,7 @@ examples: pcie: pcie@f9800000 { compatible = "amlogic,axg-pcie", "snps,dw-pcie"; reg = <0xf9800000 0x400000>, <0xff646000 0x2000>, <0xf9f00000 0x100000>; - reg-names = "elbi", "cfg", "config"; + reg-names = "dbi", "cfg", "config"; interrupts = <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>; clocks = <&pclk>, <&clk_port>, <&clk_phy>; clock-names = "pclk", "port", "general";
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/554 RDMA/rtrs: server: Fix error handling in get_or_create_srv
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit a338d6e849ab31f32c08b4fcac11c0c72afbb150 ]
After device_initialize() is called, use put_device() to release the device according to kernel device management rules. While direct kfree() work in this case, using put_device() is more correct.
Found by code review.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +1 -1
@@ -1453,7 +1453,7 @@ static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,kfree (srv->chunks); err_free_srv: -kfree (srv); +put_device (&srv->dev);return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/554 ntfs3: init run lock for extend inode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit be99c62ac7e7af514e4b13f83c891a3cccefaa48 ]
After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock uninitialized error reported by syzbot.
Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a regular file, the do_truncate() routine would not be entered.
Add the run_lock initialization when loading $Extend.
syzbot reported:
INFO: trying to register non-static key.
Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984 register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299 __lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590 ntfs_set_size+0x140/0x200 fs/ntfs3/inode.c:860 ntfs_extend+0x1d9/0x970 fs/ntfs3/file.c:387 ntfs_setattr+0x2e8/0xbe0 fs/ntfs3/file.c:808
--- fs/ntfs3/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/inode.c +1 -0
@@ -457,6 +457,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,/* Records in $Extend are not a files or general directories. */ inode->i_op = &ntfs_file_inode_operations; mode =S_IFREG ; +init_rwsem (&ni->file.run_lock); }else { err = -EINVAL ; goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/554 powerpc/32: Fix unpaired stwcx. on interrupt exit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 10e1c77c3636d815db802ceef588522c2d2d947c ]
Commit b96bae3ae2cb ("powerpc/32: Replace ASM exception exit by C exception exit from ppc64") erroneouly copied to powerpc/32 the logic from powerpc/64 based on feature CPU_FTR_STCX_CHECKS_ADDRESS which is always 0 on powerpc/32.
Re-instate the logic implemented by commit b64f87c16f3c ("[POWERPC] Avoid unpaired stwcx. on some processors") which is based on CPU_FTR_NEED_PAIRED_STWCX feature.
--- arch/powerpc/kernel/entry_32.S | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
arch/powerpc/kernel/entry_32.S +4 -6
@@ -314,10 +314,9 @@ interrupt_return: mtspr SPRN_SRR1,r12 BEGIN_FTR_SECTION + lwarx r0,0,r1 +END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) stwcx. r0,0,r1 /* to clear the reservation */ -FTR_SECTION_ELSE - lwarx r0,0,r1 -ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) lwz r3,_CCR(r1) lwz r4,_LINK(r1)
@@ -360,10 +359,9 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) mtspr SPRN_SRR1,r12 BEGIN_FTR_SECTION + lwarx r0,0,r1 +END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) stwcx. r0,0,r1 /* to clear the reservation */ -FTR_SECTION_ELSE - lwarx r0,0,r1 -ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) lwz r3,_LINK(r1) lwz r4,_CTR(r1)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/554 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f ]
The following warning appears when running syzkaller, and this issue also exists in the mainline code.
------------[ cut here ]------------ list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100. WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130 Modules linked in: CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__list_add_valid_or_report+0xf7/0x130 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100 R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48 FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> input_register_handler+0xb3/0x210 mac_hid_start_emulation+0x1c5/0x290 mac_hid_toggle_emumouse+0x20a/0x240 proc_sys_call_handler+0x4c2/0x6e0 new_sync_write+0x1b1/0x2d0 vfs_write+0x709/0x950 ksys_write+0x12a/0x250 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2
The WARNING occurs when two processes concurrently write to the mac-hid emulation sysctl, causing a race condition in mac_hid_toggle_emumouse(). Both processes read old_val=0, then both try to register the input handler, leading to a double list_add of the same handler.
CPU0 CPU1
------------------------- -------------------------
vfs_write() //write 1 vfs_write() //write 1
proc_sys_write() proc_sys_write()
mac_hid_toggle_emumouse() mac_hid_toggle_emumouse()
old_val = *valp // old_val=0
old_val = *valp // old_val=0
mutex_lock_killable()
proc_dointvec() // *valp=1
mac_hid_start_emulation()
input_register_handler()
mutex_unlock()
mutex_lock_killable()
proc_dointvec()
mac_hid_start_emulation()
input_register_handler() //Trigger Warning
mutex_unlock()Fix this by moving the old_val read inside the mutex lock region.
--- drivers/macintosh/mac_hid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/macintosh/mac_hid.c +2 -1
@@ -186,13 +186,14 @@ static int mac_hid_toggle_emumouse(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { int *valp = table->data; -int old_val = *valp; +int old_val;int rc; rc =mutex_lock_killable (&mac_hid_emumouse_mutex);if (rc)return rc; + old_val = *valp; rc =proc_dointvec (table, write, buffer, lenp, ppos);if (rc ==0 && write && *valp != old_val) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/554 wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 5e88e864118c20e63a1571d0ff0a152e5d684959 ]
In one of the error paths, the memory allocated for skb_rx is not freed. Fix that by freeing it before returning.
--- drivers/net/wireless/st/cw1200/bh.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/st/cw1200/bh.c +4 -2
@@ -317,10 +317,12 @@ static int cw1200_bh_rx_helper(struct cw1200_common *priv,if (wsm_id &0x0400 ) {int rc =wsm_release_tx_buffer (priv,1 ); -if (WARN_ON (rc <0 )) +if (WARN_ON (rc <0 )) { +dev_kfree_skb (skb_rx);return rc; -else if (rc >0 ) + }else if (rc >0 ) { *tx =1 ; + } }/* cw1200_wsm_rx takes care on SKB livetime */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/554 nbd: defer config unlock in nbd_genl_connect
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 1649714b930f9ea6233ce0810ba885999da3b5d4 ]
There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK:
nbd_genl_connect
nbd_alloc_and_init_config // config_refs=1
nbd_start_device // config_refs=2
set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3
recv_work done // config_refs=2
NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0
refcount_inc -> uaf
------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790
The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect():
mutex_unlock(&nbd->config_lock);
if (!ret) {
set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);
+ printk("before sleep\n");
+ mdelay(5 * 1000);
+ printk("after sleep\n");
refcount_inc(&nbd->config_refs);
nbd_connect_reply(info, nbd->index);
}--- drivers/block/nbd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/nbd.c +2 -1
@@ -2045,12 +2045,13 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) ret =nbd_start_device (nbd); out: -mutex_unlock (&nbd->config_lock);if (!ret) {set_bit (NBD_RT_HAS_CONFIG_REF , &config->runtime_flags);refcount_inc (&nbd->config_refs);nbd_connect_reply (info, nbd->index); } +mutex_unlock (&nbd->config_lock); +nbd_config_put (nbd);if (put_dev)nbd_put (nbd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/554 coresight: etm4x: Save restore TRFCR_EL1
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit 937d3f58cacf377cab7c32e475e1ffa91d611dce ]
When the CPU enters a low power mode, the TRFCR_EL1 contents could be reset. Thus we need to save/restore the TRFCR_EL1 along with the ETM4x registers to allow the tracing.
The TRFCR related helpers are in a new header file, as we need to use them for TRBE in the later patches.
Stable-dep-of: 64eb04ae5452 ("coresight: etm4x: Add context synchronization before enabling trace")
--- .../coresight/coresight-etm4x-core.c | 43 +++++++++++++------ drivers/hwtracing/coresight/coresight-etm4x.h | 2 + .../coresight/coresight-self-hosted-trace.h | 24 +++++++++++ 3 files changed, 57 insertions(+), 12 deletions(-) create mode 100644 drivers/hwtracing/coresight/coresight-self-hosted-trace.h
drivers/hwtracing/coresight/coresight-etm4x-core.c +31 -12
@@ -40,6 +40,7 @@#include "coresight-etm4x.h" #include "coresight-etm-perf.h" #include "coresight-etm4x-cfg.h" +#include "coresight-self-hosted-trace.h" #include "coresight-syscfg.h" static int boot_enable;
@@ -1009,7 +1010,7 @@ static void cpu_enable_tracing(struct etmv4_drvdata *drvdata)if (is_kernel_in_hyp_mode ()) trfcr |=TRFCR_EL2_CX ; -write_sysreg_s (trfcr,SYS_TRFCR_EL1 ); +write_trfcr (trfcr); }static void etm4_init_arch_data (void *info)
@@ -1534,7 +1535,7 @@ static void etm4_init_trace_id(struct etmv4_drvdata *drvdata) drvdata->trcid =coresight_get_trace_id (drvdata->cpu); } -static int etm4_cpu_save (struct etmv4_drvdata *drvdata) +static int __etm4_cpu_save (struct etmv4_drvdata *drvdata) {int i, ret =0 ;struct etmv4_save_state *state;
@@ -1674,7 +1675,23 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)return ret; } -static void etm4_cpu_restore (struct etmv4_drvdata *drvdata) +static int etm4_cpu_save (struct etmv4_drvdata *drvdata) +{ +int ret =0 ; + +/* Save the TRFCR irrespective of whether the ETM is ON */ +if (drvdata->trfc) + drvdata->save_trfcr =read_trfcr (); +/* +* Save and restore the ETM Trace registers only if +* the ETM is active. +*/ +if (local_read (&drvdata->mode) && drvdata->save_state) + ret =__etm4_cpu_save (drvdata); +return ret; +} + +static void __etm4_cpu_restore (struct etmv4_drvdata *drvdata) {int i;struct etmv4_save_state *state = drvdata->save_state;
@@ -1773,6 +1790,14 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata)etm4_cs_lock (drvdata, csa); } +static void etm4_cpu_restore (struct etmv4_drvdata *drvdata) +{ +if (drvdata->trfc) +write_trfcr (drvdata->save_trfcr); +if (drvdata->state_needs_restore) +__etm4_cpu_restore (drvdata); +} +static int etm4_cpu_pm_notify (struct notifier_block *nb,unsigned long cmd,void *v) {
@@ -1784,23 +1809,17 @@ static int etm4_cpu_pm_notify(struct notifier_block *nb, unsigned long cmd, drvdata = etmdrvdata[cpu]; -if (!drvdata->save_state) -return NOTIFY_OK ; -if (WARN_ON_ONCE (drvdata->cpu != cpu))return NOTIFY_BAD ;switch (cmd) {case CPU_PM_ENTER : -/* save the state if self-hosted coresight is in use */ -if (local_read (&drvdata->mode)) -if (etm4_cpu_save (drvdata)) -return NOTIFY_BAD ; +if (etm4_cpu_save (drvdata)) +return NOTIFY_BAD ;break ;case CPU_PM_EXIT :case CPU_PM_ENTER_FAILED : -if (drvdata->state_needs_restore) -etm4_cpu_restore (drvdata); +etm4_cpu_restore (drvdata);break ;default :return NOTIFY_DONE ;
drivers/hwtracing/coresight/coresight-etm4x.h +2 -0
@@ -901,6 +901,7 @@ struct etmv4_save_state {* @lpoverride: If the implementation can support low-power state over. * @trfc: If the implementation supports Arm v8.4 trace filter controls. * @config: structure holding configuration parameters. +* @save_trfcr: Saved TRFCR_EL1 register during a CPU PM event. * @save_state: State to be preserved across power loss * @state_needs_restore: True when there is context to restore after PM exit * @skip_power_up: Indicates if an implementation can skip powering up
@@ -954,6 +955,7 @@ struct etmv4_drvdata {bool lpoverride;bool trfc;struct etmv4_config config; +u64 save_trfcr;struct etmv4_save_state *save_state;bool state_needs_restore;bool skip_power_up;
drivers/hwtracing/coresight/coresight-self-hosted-trace.h new file +24 -0
@@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* +* Arm v8 Self-Hosted trace support. +* +* Copyright (C) 2021 ARM Ltd. +*/ + +#ifndef __CORESIGHT_SELF_HOSTED_TRACE_H +#define __CORESIGHT_SELF_HOSTED_TRACE_H + +#include <asm/sysreg.h> + +static inline u64 read_trfcr (void ) +{ +return read_sysreg_s (SYS_TRFCR_EL1 ); +} + +static inline void write_trfcr (u64 val) +{ +write_sysreg_s (val,SYS_TRFCR_EL1 ); +isb (); +} + +#endif /* __CORESIGHT_SELF_HOSTED_TRACE_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/554 coresight: etm4x: Use Trace Filtering controls dynamically
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit 5f6fd1aa8cc147b111af1a833574487a87237dc0 ]
The Trace Filtering support (FEAT_TRF) ensures that the ETM can be prohibited from generating any trace for a given EL. This is much stricter knob, than the TRCVICTLR exception level masks, which doesn't prevent the ETM from generating Context packets for an "excluded" EL. At the moment, we do a onetime enable trace at user and kernel and leave it untouched for the kernel life time. This implies that the ETM could potentially generate trace packets containing the kernel addresses, and thus leaking the kernel virtual address in the trace.
This patch makes the switch dynamic, by honoring the filters set by the user and enforcing them in the TRFCR controls. We also rename the cpu_enable_tracing() appropriately to cpu_detect_trace_filtering() and the drvdata member trfc => trfcr to indicate the "value" of the TRFCR_EL1.
Stable-dep-of: 64eb04ae5452 ("coresight: etm4x: Add context synchronization before enabling trace")
--- .../coresight/coresight-etm4x-core.c | 63 ++++++++++++++----- drivers/hwtracing/coresight/coresight-etm4x.h | 7 ++- .../coresight/coresight-self-hosted-trace.h | 7 +++ 3 files changed, 59 insertions(+), 18 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +47 -16
@@ -239,6 +239,45 @@ struct etm4_enable_arg {int rc; }; +/* +* etm4x_prohibit_trace - Prohibit the CPU from tracing at all ELs. +* When the CPU supports FEAT_TRF, we could move the ETM to a trace +* prohibited state by filtering the Exception levels via TRFCR_EL1. +*/ +static void etm4x_prohibit_trace (struct etmv4_drvdata *drvdata) +{ +/* If the CPU doesn't support FEAT_TRF, nothing to do */ +if (!drvdata->trfcr) +return ; +cpu_prohibit_trace (); +} + +/* +* etm4x_allow_trace - Allow CPU tracing in the respective ELs, +* as configured by the drvdata->config.mode for the current +* session. Even though we have TRCVICTLR bits to filter the +* trace in the ELs, it doesn't prevent the ETM from generating +* a packet (e.g, TraceInfo) that might contain the addresses from +* the excluded levels. Thus we use the additional controls provided +* via the Trace Filtering controls (FEAT_TRF) to make sure no trace +* is generated for the excluded ELs. +*/ +static void etm4x_allow_trace (struct etmv4_drvdata *drvdata) +{ +u64 trfcr = drvdata->trfcr; + +/* If the CPU doesn't support FEAT_TRF, nothing to do */ +if (!trfcr) +return ; + +if (drvdata->config.mode &ETM_MODE_EXCL_KERN ) + trfcr &= ~TRFCR_ELx_ExTRE; +if (drvdata->config.mode &ETM_MODE_EXCL_USER ) + trfcr &= ~TRFCR_ELx_E0TRE; + +write_trfcr (trfcr); +} +#ifdef CONFIG_ETM4X_IMPDEF_FEATURE #define HISI_HIP08_AMBA_ID 0x000b6d01
@@ -445,6 +484,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)if (etm4x_is_ete (drvdata))etm4x_relaxed_write32 (csa,TRCRSR_TA ,TRCRSR ); +etm4x_allow_trace (drvdata);/* Enable the trace unit */ etm4x_relaxed_write32 (csa,1 ,TRCPRGCTLR );
@@ -740,7 +780,6 @@ static int etm4_enable(struct coresight_device *csdev,static void etm4_disable_hw (void *info) {u32 control; -u64 trfcr;struct etmv4_drvdata *drvdata = info;struct etmv4_config *config = &drvdata->config;struct coresight_device *csdev = drvdata->csdev;
@@ -767,12 +806,7 @@ static void etm4_disable_hw(void *info)* If the CPU supports v8.4 Trace filter Control, * set the ETM to trace prohibited region. */ -if (drvdata->trfc) { - trfcr =read_sysreg_s (SYS_TRFCR_EL1 ); -write_sysreg_s (trfcr & ~(TRFCR_ELx_ExTRE | TRFCR_ELx_E0TRE), -SYS_TRFCR_EL1 ); -isb (); - } +etm4x_prohibit_trace (drvdata);/* * Make sure everything completes before disabling, as recommended * by section 7.3.77 ("TRCVICTLR, ViewInst Main Control Register,
@@ -788,9 +822,6 @@ static void etm4_disable_hw(void *info)if (coresight_timeout (csa,TRCSTATR ,TRCSTATR_PMSTABLE_BIT ,1 ))dev_err (etm_dev,"timeout while waiting for PM stable Trace Status\n" ); -if (drvdata->trfc) -write_sysreg_s (trfcr,SYS_TRFCR_EL1 ); -/* read the status of the single shot comparators */ for (i =0 ; i < drvdata->nr_ss_cmp; i++) { config->ss_status[i] =
@@ -988,15 +1019,15 @@ static bool etm4_init_csdev_access(struct etmv4_drvdata *drvdata,return false; } -static void cpu_enable_tracing (struct etmv4_drvdata *drvdata) +static void cpu_detect_trace_filtering (struct etmv4_drvdata *drvdata) {u64 dfr0 =read_sysreg (id_aa64dfr0_el1);u64 trfcr; + drvdata->trfcr =0 ;if (!cpuid_feature_extract_unsigned_field (dfr0,ID_AA64DFR0_TRACE_FILT_SHIFT ))return ; - drvdata->trfc = true;/* * If the CPU supports v8.4 SelfHosted Tracing, enable * tracing at the kernel EL and EL0, forcing to use the
@@ -1010,7 +1041,7 @@ static void cpu_enable_tracing(struct etmv4_drvdata *drvdata)if (is_kernel_in_hyp_mode ()) trfcr |=TRFCR_EL2_CX ; -write_trfcr (trfcr); + drvdata->trfcr = trfcr; }static void etm4_init_arch_data (void *info)
@@ -1183,7 +1214,7 @@ static void etm4_init_arch_data(void *info)/* NUMCNTR, bits[30:28] number of counters available for tracing */ drvdata->nr_cntr =BMVAL (etmidr5,28 ,30 );etm4_cs_lock (drvdata, csa); -cpu_enable_tracing (drvdata); +cpu_detect_trace_filtering (drvdata); }static inline u32 etm4_get_victlr_access_type (struct etmv4_config *config)
@@ -1680,7 +1711,7 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)int ret =0 ;/* Save the TRFCR irrespective of whether the ETM is ON */ -if (drvdata->trfc) +if (drvdata->trfcr) drvdata->save_trfcr =read_trfcr ();/* * Save and restore the ETM Trace registers only if
@@ -1792,7 +1823,7 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)static void etm4_cpu_restore (struct etmv4_drvdata *drvdata) { -if (drvdata->trfc) +if (drvdata->trfcr)write_trfcr (drvdata->save_trfcr);if (drvdata->state_needs_restore)__etm4_cpu_restore (drvdata);
drivers/hwtracing/coresight/coresight-etm4x.h +5 -2
@@ -899,7 +899,10 @@ struct etmv4_save_state {* @nooverflow: Indicate if overflow prevention is supported. * @atbtrig: If the implementation can support ATB triggers * @lpoverride: If the implementation can support low-power state over. -* @trfc: If the implementation supports Arm v8.4 trace filter controls. +* @trfcr: If the CPU supports FEAT_TRF, value of the TRFCR_ELx that +* allows tracing at all ELs. We don't want to compute this +* at runtime, due to the additional setting of TRFCR_CX when +* in EL2. Otherwise, 0. * @config: structure holding configuration parameters. * @save_trfcr: Saved TRFCR_EL1 register during a CPU PM event. * @save_state: State to be preserved across power loss
@@ -953,7 +956,7 @@ struct etmv4_drvdata {bool nooverflow;bool atbtrig;bool lpoverride; -bool trfc; +u64 trfcr;struct etmv4_config config;u64 save_trfcr;struct etmv4_save_state *save_state;
drivers/hwtracing/coresight/coresight-self-hosted-trace.h +7 -0
@@ -21,4 +21,11 @@ static inline void write_trfcr(u64 val) isb(); } +static inline void cpu_prohibit_trace (void ) +{ +u64 trfcr =read_trfcr (); + +/* Prohibit tracing at EL0 & the kernel EL */ +write_trfcr (trfcr & ~(TRFCR_ELx_ExTRE | TRFCR_ELx_E0TRE)); +}#endif /* __CORESIGHT_SELF_HOSTED_TRACE_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/554 coresight-etm4x: add isb() before reading the TRCSTATR
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanfang Zhang <[email protected]>
[ Upstream commit 4ff6039ffb79a4a8a44b63810a8a2f2b43264856 ]
As recommended by section 4.3.7 ("Synchronization when using system instructions to progrom the trace unit") of ARM IHI 0064H.b, the self-hosted trace analyzer must perform a Context synchronization event between writing to the TRCPRGCTLR and reading the TRCSTATR. Additionally, add an ISB between the each read of TRCSTATR on coresight_timeout() when using system instructions to program the trace unit.
Stable-dep-of: 64eb04ae5452 ("coresight: etm4x: Add context synchronization before enabling trace")
--- drivers/hwtracing/coresight/coresight-core.c | 20 ++++++-- .../coresight/coresight-etm4x-core.c | 48 +++++++++++++++++-- include/linux/coresight.h | 4 ++ 3 files changed, 62 insertions(+), 10 deletions(-)
drivers/hwtracing/coresight/coresight-core.c +15 -5
@@ -1454,18 +1454,20 @@ static void coresight_remove_conns(struct coresight_device *csdev) }/** -* coresight_timeout - loop until a bit has changed to a specific register -* state. +* coresight_timeout_action - loop until a bit has changed to a specific register +* state, with a callback after every trial. * @csa: coresight device access for the device * @offset: Offset of the register from the base of the device. * @position: the position of the bit of interest. * @value: the value the bit should have. +* @cb: Call back after each trial. * * Return: 0 as soon as the bit has taken the desired state or -EAGAIN if * TIMEOUT_US has elapsed, which ever happens first. */ -int coresight_timeout (struct csdev_access *csa,u32 offset, -int position,int value) +int coresight_timeout_action (struct csdev_access *csa,u32 offset, +int position,int value, +coresight_timeout_cb_t cb) {int i;u32 val;
@@ -1481,7 +1483,8 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,if (!(val &BIT (position)))return 0 ; } - +if (cb) +cb (csa, offset, position, value);/* * Delay is arbitrary - the specification doesn't say how long * we are expected to wait. Extra check required to make sure
@@ -1493,6 +1496,13 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,return -EAGAIN ; } +EXPORT_SYMBOL_GPL (coresight_timeout_action); + +int coresight_timeout (struct csdev_access *csa,u32 offset, +int position,int value) +{ +return coresight_timeout_action (csa, offset, position, value,NULL ); +}EXPORT_SYMBOL_GPL (coresight_timeout);u32 coresight_relaxed_read32 (struct coresight_device *csdev,u32 offset)
drivers/hwtracing/coresight/coresight-etm4x-core.c +43 -5
87 lines not on this page · raw message
include/linux/coresight.h +4 -0
@@ -484,6 +484,10 @@ extern int coresight_enable(struct coresight_device *csdev);extern void coresight_disable (struct coresight_device *csdev);extern int coresight_timeout (struct csdev_access *csa,u32 offset,int position,int value); +typedef void (*coresight_timeout_cb_t ) (struct csdev_access *,u32 ,int ,int ); +extern int coresight_timeout_action (struct csdev_access *csa,u32 offset, +int position,int value, +coresight_timeout_cb_t cb);extern int coresight_claim_device (struct coresight_device *csdev);extern int coresight_claim_device_unlocked (struct coresight_device *csdev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/554 coresight: etm4x: Extract the trace unit controlling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 40f682ae5086366d51e29e66eb8a344501245d0d ]
The trace unit is controlled in the ETM hardware enabling and disabling. The sequential changes for support AUX pause and resume will reuse the same operations.
Extract the operations in the etm4_{enable|disable}_trace_unit() functions. A minor improvement in etm4_enable_trace_unit() is for returning the timeout error to callers.
Stable-dep-of: 64eb04ae5452 ("coresight: etm4x: Add context synchronization before enabling trace")
--- .../coresight/coresight-etm4x-core.c | 103 +++++++++++------- 1 file changed, 62 insertions(+), 41 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +62 -41
@@ -392,6 +392,44 @@ static int etm4x_wait_status(struct csdev_access *csa, int pos, int val)return coresight_timeout (csa,TRCSTATR , pos, val); } +static int etm4_enable_trace_unit (struct etmv4_drvdata *drvdata) +{ +struct coresight_device *csdev = drvdata->csdev; +struct device *etm_dev = &csdev->dev; +struct csdev_access *csa = &csdev->access; + +/* +* ETE mandates that the TRCRSR is written to before +* enabling it. +*/ +if (etm4x_is_ete (drvdata)) +etm4x_relaxed_write32 (csa,TRCRSR_TA ,TRCRSR ); + +etm4x_allow_trace (drvdata); +/* Enable the trace unit */ +etm4x_relaxed_write32 (csa,1 ,TRCPRGCTLR ); + +/* Synchronize the register updates for sysreg access */ +if (!csa->io_mem) +isb (); + +/* wait for TRCSTATR.IDLE to go back down to '0' */ +if (etm4x_wait_status (csa,TRCSTATR_IDLE_BIT ,0 )) { +dev_err (etm_dev, +"timeout while waiting for Idle Trace Status\n" ); +return -ETIME ; + } + +/* +* As recommended by section 4.3.7 ("Synchronization when using the +* memory-mapped interface") of ARM IHI 0064D +*/ +dsb (sy); +isb (); + +return 0 ; +} +static int etm4_enable_hw (struct etmv4_drvdata *drvdata) {int i, rc;
@@ -500,33 +538,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)etm4x_relaxed_write32 (csa, trcpdcr |TRCPDCR_PU ,TRCPDCR ); } -/* -* ETE mandates that the TRCRSR is written to before -* enabling it. -*/ -if (etm4x_is_ete (drvdata)) -etm4x_relaxed_write32 (csa,TRCRSR_TA ,TRCRSR ); - -etm4x_allow_trace (drvdata); -/* Enable the trace unit */ -etm4x_relaxed_write32 (csa,1 ,TRCPRGCTLR ); - -/* Synchronize the register updates for sysreg access */ -if (!csa->io_mem) -isb (); - -/* wait for TRCSTATR.IDLE to go back down to '0' */ -if (etm4x_wait_status (csa,TRCSTATR_IDLE_BIT ,0 )) -dev_err (etm_dev, -"timeout while waiting for Idle Trace Status\n" ); - -/* -* As recommended by section 4.3.7 ("Synchronization when using the -* memory-mapped interface") of ARM IHI 0064D -*/ -dsb (sy); -isb (); - + rc =etm4_enable_trace_unit (drvdata); done:etm4_cs_lock (drvdata, csa);
@@ -800,25 +812,12 @@ static int etm4_enable(struct coresight_device *csdev,return ret; } -static void etm4_disable_hw (void *info) +static void etm4_disable_trace_unit (struct etmv4_drvdata *drvdata) {u32 control; -struct etmv4_drvdata *drvdata = info; -struct etmv4_config *config = &drvdata->config;struct coresight_device *csdev = drvdata->csdev;struct device *etm_dev = &csdev->dev;struct csdev_access *csa = &csdev->access; -int i; - -etm4_cs_unlock (drvdata, csa); -etm4_disable_arch_specific (drvdata); - -if (!drvdata->skip_power_up) { -/* power can be removed from the trace unit now */ - control =etm4x_relaxed_read32 (csa,TRCPDCR ); - control &= ~TRCPDCR_PU ; -etm4x_relaxed_write32 (csa, control,TRCPDCR ); - } control =etm4x_relaxed_read32 (csa,TRCPRGCTLR );
@@ -859,6 +858,28 @@ static void etm4_disable_hw(void *info)* of ARM IHI 0064H.b. */ isb (); +} + +static void etm4_disable_hw (void *info) +{ +u32 control; +struct etmv4_drvdata *drvdata = info; +struct etmv4_config *config = &drvdata->config; +struct coresight_device *csdev = drvdata->csdev; +struct csdev_access *csa = &csdev->access; +int i; + +etm4_cs_unlock (drvdata, csa); +etm4_disable_arch_specific (drvdata); + +if (!drvdata->skip_power_up) { +/* power can be removed from the trace unit now */ + control =etm4x_relaxed_read32 (csa,TRCPDCR ); + control &= ~TRCPDCR_PU ; +etm4x_relaxed_write32 (csa, control,TRCPDCR ); + } + +etm4_disable_trace_unit (drvdata);/* read the status of the single shot comparators */ for (i =0 ; i < drvdata->nr_ss_cmp; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/554 coresight: etm4x: Add context synchronization before enabling trace
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 64eb04ae545294e105ad91714dc3167a0b660731 ]
According to the software usage PKLXF in Arm ARM (ARM DDI 0487 L.a), a Context synchronization event is required before enabling the trace unit.
An ISB is added to meet this requirement, particularly for guarding the operations in the flow:
etm4x_allow_trace()
`> kvm_tracing_set_el1_configuration()
`> write_sysreg_s(trfcr_while_in_guest, SYS_TRFCR_EL12)
Improved the barrier comments to provide more accurate information.
--- .../coresight/coresight-etm4x-core.c | 27 ++++++++++++++++--- 1 file changed, 23 insertions(+), 4 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +23 -4
@@ -406,10 +406,24 @@ static int etm4_enable_trace_unit(struct etmv4_drvdata *drvdata)etm4x_relaxed_write32 (csa,TRCRSR_TA ,TRCRSR );etm4x_allow_trace (drvdata); + +/* +* According to software usage PKLXF in Arm ARM (ARM DDI 0487 L.a), +* execute a Context synchronization event to guarantee the trace unit +* will observe the new values of the System registers. +*/ +if (!csa->io_mem) +isb (); +/* Enable the trace unit */ etm4x_relaxed_write32 (csa,1 ,TRCPRGCTLR ); -/* Synchronize the register updates for sysreg access */ +/* +* As recommended by section 4.3.7 ("Synchronization when using system +* instructions to progrom the trace unit") of ARM IHI 0064H.b, the +* self-hosted trace analyzer must perform a Context synchronization +* event between writing to the TRCPRGCTLR and reading the TRCSTATR. +*/ if (!csa->io_mem)isb ();
@@ -830,11 +844,16 @@ static void etm4_disable_trace_unit(struct etmv4_drvdata *drvdata)*/ etm4x_prohibit_trace (drvdata);/* -* Make sure everything completes before disabling, as recommended -* by section 7.3.77 ("TRCVICTLR, ViewInst Main Control Register, -* SSTATUS") of ARM IHI 0064D +* Prevent being speculative at the point of disabling the trace unit, +* as recommended by section 7.3.77 ("TRCVICTLR, ViewInst Main Control +* Register, SSTATUS") of ARM IHI 0064D */ dsb (sy); +/* +* According to software usage VKHHY in Arm ARM (ARM DDI 0487 L.a), +* execute a Context synchronization event to guarantee no new +* program-flow trace is generated. +*/ isb ();/* Trace synchronization barrier, is a nop if not supported */ tsb_csync ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/554 clk: renesas: r9a06g032: Export function to set dmamux
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 885525c1e7e27ea6207d648a8db20dfbbd9e4238 ]
The dmamux register is located within the system controller.
Without syscon, we need an extra helper in order to give write access to this register to a dmamux driver.
Stable-dep-of: f8def051bbcf ("clk: renesas: r9a06g032: Fix memory leak in error path")
--- drivers/clk/renesas/r9a06g032-clocks.c | 35 ++++++++++++++++++- include/linux/soc/renesas/r9a06g032-sysctrl.h | 11 ++++++ 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 include/linux/soc/renesas/r9a06g032-sysctrl.h
drivers/clk/renesas/r9a06g032-clocks.c +34 -1
@@ -20,9 +20,12 @@#include <linux/pm_clock.h> #include <linux/pm_domain.h> #include <linux/slab.h> +#include <linux/soc/renesas/r9a06g032-sysctrl.h> #include <linux/spinlock.h> #include <dt-bindings/clock/r9a06g032-sysctrl.h> +#define R9A06G032_SYSCTRL_DMAMUX 0xA0 +struct r9a06g032_gate {u16 gate, reset, ready, midle, scon, mirack, mistat;
@@ -315,6 +318,30 @@ struct r9a06g032_priv {void __iomem *reg; }; +static struct r9a06g032_priv *sysctrl_priv; + +/* Exported helper to access the DMAMUX register */ +int r9a06g032_sysctrl_set_dmamux (u32 mask,u32 val) +{ +unsigned long flags; +u32 dmamux; + +if (!sysctrl_priv) +return -EPROBE_DEFER ; + +spin_lock_irqsave (&sysctrl_priv->lock, flags); + + dmamux =readl (sysctrl_priv->reg +R9A06G032_SYSCTRL_DMAMUX ); + dmamux &= ~mask; + dmamux |= val & mask; +writel (dmamux, sysctrl_priv->reg +R9A06G032_SYSCTRL_DMAMUX ); + +spin_unlock_irqrestore (&sysctrl_priv->lock, flags); + +return 0 ; +} +EXPORT_SYMBOL_GPL (r9a06g032_sysctrl_set_dmamux); +/* register/bit pairs are encoded as an uint16_t */ static void clk_rdesc_set(struct r9a06g032_priv *clocks,
@@ -962,7 +989,13 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev)if (error)return error; -return r9a06g032_add_clk_domain (dev); + error =r9a06g032_add_clk_domain (dev); +if (error) +return error; + + sysctrl_priv = clocks; + +return 0 ; }static const struct of_device_id r9a06g032_match[] = {
include/linux/soc/renesas/r9a06g032-sysctrl.h new file +11 -0
@@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __LINUX_SOC_RENESAS_R9A06G032_SYSCTRL_H__ +#define __LINUX_SOC_RENESAS_R9A06G032_SYSCTRL_H__ + +#ifdef CONFIG_CLK_R9A06G032 +int r9a06g032_sysctrl_set_dmamux (u32 mask,u32 val); +#else +static inline int r9a06g032_sysctrl_set_dmamux (u32 mask,u32 val) {return -ENODEV ; } +#endif + +#endif /* __LINUX_SOC_RENESAS_R9A06G032_SYSCTRL_H__ */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/554 soc: renesas: r9a06g032-sysctrl: Handle h2mode setting based on USBF presence
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit e9fee814b054e4f6f2faf3d9c1944869fe41c9dd ]
The CFG_USB[H2MODE] allows to switch the USB configuration. The configuration supported are:
- One host and one device
or
- Two hosts
Set CFG_USB[H2MODE] based on the USBF controller (USB device) availability.
Stable-dep-of: f8def051bbcf ("clk: renesas: r9a06g032: Fix memory leak in error path")
--- drivers/clk/renesas/r9a06g032-clocks.c | 28 ++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/clk/renesas/r9a06g032-clocks.c +28 -0
@@ -24,6 +24,8 @@#include <linux/spinlock.h> #include <dt-bindings/clock/r9a06g032-sysctrl.h> +#define R9A06G032_SYSCTRL_USB 0x00 +#define R9A06G032_SYSCTRL_USB_H2MODE (1<<1)#define R9A06G032_SYSCTRL_DMAMUX 0xA0struct r9a06g032_gate {
@@ -919,6 +921,29 @@ static void r9a06g032_clocks_del_clk_provider(void *data)of_clk_del_provider (data); } +static void __init r9a06g032_init_h2mode (struct r9a06g032_priv *clocks) +{ +struct device_node *usbf_np =NULL ; +u32 usb; + +while ((usbf_np =of_find_compatible_node (usbf_np,NULL , +"renesas,rzn1-usbf" ))) { +if (of_device_is_available (usbf_np)) +break ; + } + + usb =readl (clocks->reg +R9A06G032_SYSCTRL_USB ); +if (usbf_np) { +/* 1 host and 1 device mode */ + usb &= ~R9A06G032_SYSCTRL_USB_H2MODE ; +of_node_put (usbf_np); + }else { +/* 2 hosts mode */ + usb |=R9A06G032_SYSCTRL_USB_H2MODE ; + } +writel (usb, clocks->reg +R9A06G032_SYSCTRL_USB ); +} +static int __init r9a06g032_clocks_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -948,6 +973,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev) clocks->reg =of_iomap (np,0 );if (WARN_ON (!clocks->reg))return -ENOMEM ; + +r9a06g032_init_h2mode (clocks); +for (i =0 ; i <ARRAY_SIZE (r9a06g032_clocks); ++i) {const struct r9a06g032_clkdesc *d = &r9a06g032_clocks[i]; const char *parent_name = d->source ?
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/554 clk: renesas: r9a06g032: Fix memory leak in error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit f8def051bbcf8677f64701e9699bf6d11e2780cd ]
The current code uses of_iomap() to map registers but never calls iounmap() on any error path after the mapping. This causes a memory leak when probe fails after successful ioremap, for example when of_clk_add_provider() or r9a06g032_add_clk_domain() fails.
Replace of_iomap() with devm_of_iomap() to automatically unmap the region on probe failure. Update the error check accordingly to use IS_ERR() and PTR_ERR() since devm_of_iomap() returns ERR_PTR on error.
--- drivers/clk/renesas/r9a06g032-clocks.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/renesas/r9a06g032-clocks.c +3 -3
@@ -970,9 +970,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev)if (IS_ERR (mclk))return PTR_ERR (mclk); - clocks->reg =of_iomap (np,0 ); -if (WARN_ON (!clocks->reg)) -return -ENOMEM ; + clocks->reg =devm_of_iomap (dev, np,0 ,NULL ); +if (IS_ERR (clocks->reg)) +return PTR_ERR (clocks->reg);r9a06g032_init_h2mode (clocks);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/554 lib/vsprintf: Check pointer before dereferencing in time_and_date()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 372a12bd5df0199aa234eaf8ef31ed7ecd61d40f ]
The pointer may be invalid when gets to the printf(). In particular the time_and_date() dereferencing it in some cases without checking.
Move the check from rtc_str() to time_and_date() to cover all cases.
--- lib/vsprintf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/vsprintf.c +3 -3
@@ -1889,9 +1889,6 @@ char *rtc_str(char *buf, char *end, const struct rtc_time *tm,bool found = true;int count =2 ; -if (check_pointer (&buf, end, tm, spec)) -return buf; -switch (fmt[count]) {case 'd' : have_t = false;
@@ -1957,6 +1954,9 @@ static noinline_for_stackchar *time_and_date (char *buf,char *end,void *ptr,struct printf_spec spec,const char *fmt) { +if (check_pointer (&buf, end, ptr, spec)) +return buf; +switch (fmt[1 ]) {case 'R' :return rtc_str (buf, end, (const struct rtc_time *)ptr, spec, fmt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/554 ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 8a7d58845fae061c62b50bc5eeb9bae4a1dedc3d ]
In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just to avoid crashing the whole kernel due to a filesystem corruption.
--- fs/ocfs2/move_extents.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/ocfs2/move_extents.c +7 -1
@@ -98,7 +98,13 @@ static int __ocfs2_move_extent(handle_t *handle, rec = &el->l_recs[index]; -BUG_ON (ext_flags != rec->e_flags); +if (ext_flags != rec->e_flags) { + ret =ocfs2_error (inode->i_sb, +"Inode %llu has corrupted extent %d with flags 0x%x at cpos %u\n" , + (unsigned long long )ino, index, rec->e_flags, cpos); + goto out; + } +/* * after moving/defraging to new location, the extent is not going * to be refcounted anymore.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/554 ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 593ee49222a0d751062fd9a5e4a963ade4ec028a ]
acpi_fwnode_graph_parse_endpoint() calls fwnode_get_parent() to obtain the parent fwnode but returns without calling fwnode_handle_put() on it. This potentially leads to a fwnode refcount leak and prevents the parent node from being released properly.
Call fwnode_handle_put() on the parent fwnode before returning to prevent the leak from occurring.
--- drivers/acpi/property.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/property.c +1 -0
@@ -1402,6 +1402,7 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,if (fwnode_property_read_u32 (fwnode,"reg" , &endpoint->id))fwnode_property_read_u32 (fwnode,"endpoint" , &endpoint->id); +fwnode_handle_put (port_fwnode);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/554 scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit acd194d9b5bac419e04968ffa44351afabb50bac ]
The driver calls ioport_map() to map I/O ports in sim710_probe_common() but never calls ioport_unmap() to release the mapping. This causes resource leaks in both the error path when request_irq() fails and in the normal device removal path via sim710_device_remove().
Add ioport_unmap() calls in the out_release error path and in sim710_device_remove().
--- drivers/scsi/sim710.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/sim710.c +2 -0
@@ -133,6 +133,7 @@ static int sim710_probe_common(struct device *dev, unsigned long base_addr, out_put_host:scsi_host_put (host); out_release: +ioport_unmap (hostdata->base);release_region (base_addr,64 ); out_free:kfree (hostdata);
@@ -148,6 +149,7 @@ static int sim710_device_remove(struct device *dev)scsi_remove_host (host);NCR_700_release (host); +ioport_unmap (hostdata->base);kfree (hostdata);free_irq (host->irq, host);release_region (host->base,64 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/554 leds: netxbig: Fix GPIO descriptor leak in error paths
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 03865dd8af52eb16c38062df2ed30a91b604780e ]
The function netxbig_gpio_ext_get() acquires GPIO descriptors but fails to release them when errors occur mid-way through initialization. The cleanup callback registered by devm_add_action_or_reset() only runs on success, leaving acquired GPIOs leaked on error paths.
Add goto-based error handling to release all acquired GPIOs before returning errors.
--- drivers/leds/leds-netxbig.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-)
drivers/leds/leds-netxbig.c +26 -10
@@ -364,6 +364,9 @@ static int netxbig_gpio_ext_get(struct device *dev,if (!addr)return -ENOMEM ; + gpio_ext->addr = addr; + gpio_ext->num_addr =0 ; +/* * We cannot use devm_ managed resources with these GPIO descriptors * since they are associated with the "GPIO extension device" which
@@ -375,45 +378,58 @@ static int netxbig_gpio_ext_get(struct device *dev, gpiod =gpiod_get_index (gpio_ext_dev,"addr" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_set_code;gpiod_set_consumer_name (gpiod,"GPIO extension addr" ); addr[i] = gpiod; + gpio_ext->num_addr++; } - gpio_ext->addr = addr; - gpio_ext->num_addr = num_addr; ret =gpiod_count (gpio_ext_dev,"data" );if (ret <0 ) {dev_err (dev,"Failed to count GPIOs in DT property data-gpios\n" ); -return ret; + goto err_free_addr; } num_data = ret; data =devm_kcalloc (dev, num_data,sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; +if (!data) { + ret = -ENOMEM ; + goto err_free_addr; + } + + gpio_ext->data = data; + gpio_ext->num_data =0 ;for (i =0 ; i < num_data; i++) { gpiod =gpiod_get_index (gpio_ext_dev,"data" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_free_data;gpiod_set_consumer_name (gpiod,"GPIO extension data" ); data[i] = gpiod; + gpio_ext->num_data++; } - gpio_ext->data = data; - gpio_ext->num_data = num_data; gpiod =gpiod_get (gpio_ext_dev,"enable" ,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) {dev_err (dev,"Failed to get GPIO from DT property enable-gpio\n" ); -return PTR_ERR (gpiod); + goto err_free_data; }gpiod_set_consumer_name (gpiod,"GPIO extension enable" ); gpio_ext->enable = gpiod;return devm_add_action_or_reset (dev, netxbig_gpio_ext_remove, gpio_ext); + +err_free_data: +for (i =0 ; i < gpio_ext->num_data; i++) +gpiod_put (gpio_ext->data[i]); +err_set_code: + ret =PTR_ERR (gpiod); +err_free_addr: +for (i =0 ; i < gpio_ext->num_addr; i++) +gpiod_put (gpio_ext->addr[i]); +return ret; } static int netxbig_leds_get_of_pdata(struct device *dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/554 PCI: keystone: Exit ks_pcie_probe() for invalid mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit 95d9c3f0e4546eaec0977f3b387549a8463cd49f ]
Commit under Fixes introduced support for PCIe EP mode on AM654x platforms. When the mode happens to be either "DW_PCIE_RC_TYPE" or "DW_PCIE_EP_TYPE", the PCIe Controller is configured accordingly. However, when the mode is neither of them, an error message is displayed, but the driver probe succeeds. Since this "invalid" mode is not associated with a functional PCIe Controller, the probe should fail.
Fix the behavior by exiting "ks_pcie_probe()" with the return value of "-EINVAL" in addition to displaying the existing error message when the mode is invalid.
--- drivers/pci/controller/dwc/pci-keystone.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/dwc/pci-keystone.c +2 -0
@@ -1328,6 +1328,8 @@ static int ks_pcie_probe(struct platform_device *pdev)break ;default :dev_err (dev,"INVALID device type %d\n" , mode); + ret = -EINVAL ; + goto err_get_sync; }ks_pcie_enable_error_irq (ks_pcie);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/554 ps3disk: use memcpy_{from,to}_bvec index
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rene Rebe <[email protected]>
[ Upstream commit 79bd8c9814a273fa7ba43399e1c07adec3fc95db ]
With 6e0a48552b8c (ps3disk: use memcpy_{from,to}_bvec) converting ps3disk to new bvec helpers, incrementing the offset was accidently lost, corrupting consecutive buffers. Restore index for non-corrupted data transfers.
--- drivers/block/ps3disk.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/block/ps3disk.c +4 -0
@@ -85,10 +85,14 @@ static void ps3disk_scatter_gather(struct ps3_storage_device *dev,struct bio_vec bvec;rq_for_each_segment (bvec, req, iter) { +dev_dbg (&dev->sbd.core,"%s:%u: %u sectors from %llu\n" , + __func__, __LINE__,bio_sectors (iter.bio), + iter.bio->bi_iter.bi_sector);if (gather)memcpy_from_bvec (dev->bounce_buf + offset, &bvec);else memcpy_to_bvec (&bvec, dev->bounce_buf + offset); + offset += bvec.bv_len; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/554 selftests/bpf: Fix failure paths in send_signal test
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit c13339039891dbdfa6c1972f0483bd07f610b776 ]
When test_send_signal_kern__open_and_load() fails parent closes the pipe which cases ASSERT_EQ(read(pipe_p2c...)) to fail, but child continues and enters infinite loop, while parent is stuck in wait(NULL). Other error paths have similar issue, so kill the child before waiting on it.
The bug was discovered while compiling all of selftests with -O1 instead of -O2 which caused progs/test_send_signal_kern.c to fail to load.
--- tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/bpf/prog_tests/send_signal.c +5 -0
@@ -138,6 +138,11 @@ static void test_send_signal_common(struct perf_event_attr *attr, skel_open_load_failure:close (pipe_c2p[0 ]);close (pipe_p2c[1 ]); +/* +* Child is either about to exit cleanly or stuck in case of errors. +* Nudge it to exit. +*/ +kill (pid,SIGKILL );wait (NULL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/554 watchdog: wdat_wdt: Stop watchdog when uninstalling module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Xinpeng <[email protected]>
[ Upstream commit 330415ebea81b65842e4cc6d2fd985c1b369e650 ]
Test shows that wachdog still reboots machine after the module is removed. Use watchdog_stop_on_unregister to stop the watchdog on removing.
Stable-dep-of: 25c0b472eab8 ("watchdog: wdat_wdt: Fix ACPI table leak in probe function")
--- drivers/watchdog/wdat_wdt.c | 1 + 1 file changed, 1 insertion(+)
drivers/watchdog/wdat_wdt.c +1 -0
@@ -463,6 +463,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)watchdog_set_nowayout (&wdat->wdd, nowayout);watchdog_stop_on_reboot (&wdat->wdd); +watchdog_stop_on_unregister (&wdat->wdd);return devm_watchdog_register_device (dev, &wdat->wdd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/554 watchdog: wdat_wdt: Fix ACPI table leak in probe function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 25c0b472eab8379683d4eef681185c104bed8ffd ]
wdat_wdt_probe() calls acpi_get_table() to obtain the WDAT ACPI table but never calls acpi_put_table() on any paths. This causes a permanent ACPI table memory leak.
Add a single cleanup path which calls acpi_put_table() to ensure the ACPI table is always released.
--- drivers/watchdog/wdat_wdt.c | 64 +++++++++++++++++++++++++------------ 1 file changed, 43 insertions(+), 21 deletions(-)
drivers/watchdog/wdat_wdt.c +43 -21
@@ -327,19 +327,27 @@ static int wdat_wdt_probe(struct platform_device *pdev)return -ENODEV ; wdat =devm_kzalloc (dev,sizeof (*wdat),GFP_KERNEL ); -if (!wdat) -return -ENOMEM ; +if (!wdat) { + ret = -ENOMEM ; + goto out_put_table; + } regs =devm_kcalloc (dev, pdev->num_resources,sizeof (*regs),GFP_KERNEL ); -if (!regs) -return -ENOMEM ; +if (!regs) { + ret = -ENOMEM ; + goto out_put_table; + }/* WDAT specification wants to have >= 1ms period */ -if (tbl->timer_period <1 ) -return -EINVAL ; -if (tbl->min_count > tbl->max_count) -return -EINVAL ; +if (tbl->timer_period <1 ) { + ret = -EINVAL ; + goto out_put_table; + } +if (tbl->min_count > tbl->max_count) { + ret = -EINVAL ; + goto out_put_table; + } wdat->period = tbl->timer_period; wdat->wdd.min_hw_heartbeat_ms = wdat->period * tbl->min_count;
@@ -356,15 +364,20 @@ static int wdat_wdt_probe(struct platform_device *pdev) res = &pdev->resource[i];if (resource_type (res) ==IORESOURCE_MEM ) { reg =devm_ioremap_resource (dev, res); -if (IS_ERR (reg)) -return PTR_ERR (reg); +if (IS_ERR (reg)) { + ret =PTR_ERR (reg); + goto out_put_table; + } }else if (resource_type (res) ==IORESOURCE_IO ) { reg =devm_ioport_map (dev, res->start,1 ); -if (!reg) -return -ENOMEM ; +if (!reg) { + ret = -ENOMEM ; + goto out_put_table; + } }else {dev_err (dev,"Unsupported resource\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } regs[i] = reg;
@@ -386,8 +399,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) } instr =devm_kzalloc (dev,sizeof (*instr),GFP_KERNEL ); -if (!instr) -return -ENOMEM ; +if (!instr) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (&instr->node); instr->entry = entries[i];
@@ -418,7 +433,8 @@ static int wdat_wdt_probe(struct platform_device *pdev)if (!instr->reg) {dev_err (dev,"I/O resource not found\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } instructions = wdat->instructions[action];
@@ -426,8 +442,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) instructions =devm_kzalloc (dev,sizeof (*instructions),GFP_KERNEL ); -if (!instructions) -return -ENOMEM ; +if (!instructions) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (instructions); wdat->instructions[action] = instructions;
@@ -441,7 +459,7 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_enable_reboot (wdat);if (ret) -return ret; + goto out_put_table;platform_set_drvdata (pdev, wdat);
@@ -459,12 +477,16 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_set_timeout (&wdat->wdd, timeout);if (ret) -return ret; + goto out_put_table;watchdog_set_nowayout (&wdat->wdd, nowayout);watchdog_stop_on_reboot (&wdat->wdd);watchdog_stop_on_unregister (&wdat->wdd); -return devm_watchdog_register_device (dev, &wdat->wdd); + ret =devm_watchdog_register_device (dev, &wdat->wdd); + +out_put_table: +acpi_put_table ((struct acpi_table_header *)tbl); +return ret; }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/554 NFSD/blocklayout: Fix minlength check in proc_layoutget
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <[email protected]>
[ Upstream commit 3524b021b0ec620a76c89aee78e9d4b4130fb711 ]
The extent returned by the file system may have a smaller offset than the segment offset requested by the client. In this case, the minimum segment length must be checked against the requested range. Otherwise, the client may not be able to continue the read/write operation.
--- fs/nfsd/blocklayout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfsd/blocklayout.c +3 -1
@@ -27,6 +27,7 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, {struct nfsd4_layout_seg *seg = &args->lg_seg;struct super_block *sb = inode->i_sb; +u64 length;u32 block_size =i_blocksize (inode);struct pnfs_block_extent *bex;struct iomap iomap;
@@ -57,7 +58,8 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, goto out_error; } -if (iomap.length < args->lg_minlength) { + length = iomap.offset + iomap.length - seg->offset; +if (length < args->lg_minlength) {dprintk ("pnfsd: extent smaller than minlength\n" ); goto out_layoutunavailable; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/554 wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 9b5b9c042b30befc5b37e4539ace95af70843473 ]
In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit.
Fix that by jumping to err_free_rings label on error, which calls rtl8180_free_rx_ring() to free the allocations. Remove the free of rx_ring in rtl8180_init_rx_ring() error path, and set the freed priv->rx_buf entry to null, to avoid double free.
--- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +2 -7
@@ -1023,9 +1023,6 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)dma_addr_t *mapping; entry = priv->rx_ring + priv->rx_ring_sz*i;if (!skb) { -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma);wiphy_err (dev->wiphy,"Cannot allocate RX skb\n" );return -ENOMEM ; }
@@ -1037,9 +1034,7 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)if (dma_mapping_error (&priv->pdev->dev, *mapping)) {kfree_skb (skb); -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma); + priv->rx_buf[i] =NULL ;wiphy_err (dev->wiphy,"Cannot map DMA for RX skb\n" );return -ENOMEM ; }
@@ -1130,7 +1125,7 @@ static int rtl8180_start(struct ieee80211_hw *dev) ret =rtl8180_init_rx_ring (dev);if (ret) -return ret; + goto err_free_rings;for (i =0 ; i < (dev->queues +1 ); i++)if ((ret =rtl8180_init_tx_ring (dev, i,16 )))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/554 powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
[ Upstream commit eae40a6da63faa9fb63ff61f8fa2b3b57da78a84 ]
HPTE format was changed since Power9 (ISA 3.0) onwards. While dumping kernel hash page tables, nothing gets printed on powernv P9+. This patch utilizes the helpers added in the patch tagged as fixes, to convert new format to old format and dump the hptes. This fix is only needed for native_find() (powernv), since pseries continues to work fine with the old format.
--- arch/powerpc/mm/ptdump/hashpagetable.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/mm/ptdump/hashpagetable.c +6 -0
@@ -216,6 +216,8 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64 vpn =hpt_vpn (ea, vsid, ssize); hash =hpt_hash (vpn, shift, ssize); want_v =hpte_encode_avpn (vpn, psize, ssize); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) + want_v =hpte_old_to_new_v (want_v);/* to check in the secondary hash table, we invert the hash */ if (!primary)
@@ -229,6 +231,10 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64/* HPTE matches */ *v =be64_to_cpu (hptep->v); *r =be64_to_cpu (hptep->r); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) { + *v =hpte_new_to_old_v (*v, *r); + *r =hpte_new_to_old_r (*r); + }return 0 ; } ++hpte_group;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/554 fs/ntfs3: Remove unused mi_mark_free
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 6700eabb90d50c50be21ecbb71131cd6ecf91ded ]
Cleaning up dead code
Fix wrong comments
Stable-dep-of: 4d78d1173a65 ("fs/ntfs3: out1 also needs to put mi")
--- fs/ntfs3/namei.c | 2 +- fs/ntfs3/ntfs_fs.h | 1 - fs/ntfs3/record.c | 22 ---------------------- fs/ntfs3/super.c | 2 +- 4 files changed, 2 insertions(+), 25 deletions(-)
fs/ntfs3/namei.c +1 -1
@@ -218,7 +218,7 @@ static int ntfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir, }/* -* ntfs_rmdir - inode_operations::rm_dir +* ntfs_rmdir - inode_operations::rmdir */ static int ntfs_rmdir (struct inode *dir,struct dentry *dentry) {
fs/ntfs3/ntfs_fs.h +0 -1
@@ -740,7 +740,6 @@ static inline struct ATTRIB *rec_find_attr_le(struct mft_inode *rec,int mi_write (struct mft_inode *mi,int wait);int mi_format_new (struct mft_inode *mi,struct ntfs_sb_info *sbi,CLST rno,__le16 flags,bool is_mft); -void mi_mark_free (struct mft_inode *mi);struct ATTRIB *mi_insert_attr (struct mft_inode *mi,enum ATTR_TYPE type,const __le16 *name,u8 name_len,u32 asize,u16 name_off);
fs/ntfs3/record.c +0 -22
@@ -405,28 +405,6 @@ int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno,return err; } -/* -* mi_mark_free - Mark record as unused and marks it as free in bitmap. -*/ -void mi_mark_free (struct mft_inode *mi) -{ -CLST rno = mi->rno; -struct ntfs_sb_info *sbi = mi->sbi; - -if (rno >=MFT_REC_RESERVED && rno <MFT_REC_FREE ) { -ntfs_clear_mft_tail (sbi, rno, rno +1 ); - mi->dirty = false; -return ; - } - -if (mi->mrec) { -clear_rec_inuse (mi->mrec); - mi->dirty = true; -mi_write (mi,0 ); - } -ntfs_mark_rec_free (sbi, rno); -} -/* * mi_insert_attr - Reserve space for new attribute. *
fs/ntfs3/super.c +1 -1
@@ -1382,7 +1382,7 @@ static const struct fs_context_operations ntfs_context_ops = {/* * ntfs_init_fs_context - Initialize spi and opts * -* This will called when mount/remount. We will first initiliaze +* This will called when mount/remount. We will first initialize * options so that if remount we can use just that. */ static int ntfs_init_fs_context (struct fs_context *fc)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/554 fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 071100ea0e6c353258f322cb2f8dde9be62d6808 ]
This argument helps in avoiding double locking
Stable-dep-of: 4d78d1173a65 ("fs/ntfs3: out1 also needs to put mi")
--- fs/ntfs3/frecord.c | 12 ++++++------ fs/ntfs3/fsntfs.c | 9 ++++++--- fs/ntfs3/inode.c | 2 +- fs/ntfs3/ntfs_fs.h | 2 +- 4 files changed, 14 insertions(+), 11 deletions(-)
fs/ntfs3/frecord.c +6 -6
@@ -1037,7 +1037,7 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, err = -EINVAL ; out1: -ntfs_mark_rec_free (sbi, rno); +ntfs_mark_rec_free (sbi, rno, is_mft); out:return err;
@@ -1232,7 +1232,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) mft_min = mft_new; mi_min = mi_new; }else { -ntfs_mark_rec_free (sbi, mft_new); +ntfs_mark_rec_free (sbi, mft_new, true); mft_new =0 ;ni_remove_mi (ni, mi_new); }
@@ -1315,7 +1315,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) out:if (mft_new) { -ntfs_mark_rec_free (sbi, mft_new); +ntfs_mark_rec_free (sbi, mft_new, true);ni_remove_mi (ni, mi_new); }
@@ -1577,7 +1577,7 @@ int ni_delete_all(struct ntfs_inode *ni) mi->dirty = true;mi_write (mi,0 ); -ntfs_mark_rec_free (sbi, mi->rno); +ntfs_mark_rec_free (sbi, mi->rno, false);ni_remove_mi (ni, mi);mi_put (mi); node = next;
@@ -1588,7 +1588,7 @@ int ni_delete_all(struct ntfs_inode *ni) ni->mi.dirty = true; err =mi_write (&ni->mi,0 ); -ntfs_mark_rec_free (sbi, ni->mi.rno); +ntfs_mark_rec_free (sbi, ni->mi.rno, false);return err; }
@@ -3292,7 +3292,7 @@ int ni_write_inode(struct inode *inode, int sync, const char *hint) err = err2;if (is_empty) { -ntfs_mark_rec_free (sbi, mi->rno); +ntfs_mark_rec_free (sbi, mi->rno, false);rb_erase (node, &ni->mi_tree);mi_put (mi); }
fs/ntfs3/fsntfs.c +6 -3
@@ -703,12 +703,14 @@ int ntfs_look_free_mft(struct ntfs_sb_info *sbi, CLST *rno, bool mft,/* * ntfs_mark_rec_free - Mark record as free. +* is_mft - true if we are changing MFT */ -void ntfs_mark_rec_free (struct ntfs_sb_info *sbi,CLST rno) +void ntfs_mark_rec_free (struct ntfs_sb_info *sbi,CLST rno,bool is_mft) {struct wnd_bitmap *wnd = &sbi->mft.bitmap; -down_write_nested (&wnd->rw_lock,BITMAP_MUTEX_MFT ); +if (!is_mft) +down_write_nested (&wnd->rw_lock,BITMAP_MUTEX_MFT );if (rno >= wnd->nbits) goto out;
@@ -727,7 +729,8 @@ void ntfs_mark_rec_free(struct ntfs_sb_info *sbi, CLST rno) sbi->mft.next_free = rno; out: -up_write (&wnd->rw_lock); +if (!is_mft) +up_write (&wnd->rw_lock); }/*
fs/ntfs3/inode.c +1 -1
@@ -1668,7 +1668,7 @@ struct inode *ntfs_create_inode(struct user_namespace *mnt_userns, ni->mi.dirty = false;discard_new_inode (inode); out3: -ntfs_mark_rec_free (sbi, ino); +ntfs_mark_rec_free (sbi, ino, false); out2:__putname (new_de);
fs/ntfs3/ntfs_fs.h +1 -1
@@ -596,7 +596,7 @@ int ntfs_look_for_free_space(struct ntfs_sb_info *sbi, CLST lcn, CLST len, enum ALLOCATE_OPT opt);int ntfs_look_free_mft (struct ntfs_sb_info *sbi,CLST *rno,bool mft,struct ntfs_inode *ni,struct mft_inode **mi); -void ntfs_mark_rec_free (struct ntfs_sb_info *sbi,CLST rno); +void ntfs_mark_rec_free (struct ntfs_sb_info *sbi,CLST rno,bool is_mft);int ntfs_clear_mft_tail (struct ntfs_sb_info *sbi,size_t from,size_t to);int ntfs_refresh_zone (struct ntfs_sb_info *sbi);int ntfs_update_mftmirr (struct ntfs_sb_info *sbi,int wait);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/554 fs/ntfs3: Make ni_ins_new_attr return error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 451e45a0e6df21e63acfd493feb5194f4697ce11 ]
Function ni_ins_new_attr now returns ERR_PTR(err), so we check it now in other functions like ni_expand_mft_list
Stable-dep-of: 4d78d1173a65 ("fs/ntfs3: out1 also needs to put mi")
--- fs/ntfs3/frecord.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
fs/ntfs3/frecord.c +26 -3
@@ -470,7 +470,7 @@ ni_ins_new_attr(struct ntfs_inode *ni, struct mft_inode *mi, &ref, &le);if (err) {/* No memory or no space. */ -return NULL ; +return ERR_PTR (err); } le_added = true;
@@ -1000,6 +1000,8 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, name_off, svcn, ins_le);if (!attr)continue ; +if (IS_ERR (attr)) +return PTR_ERR (attr);if (ins_attr) *ins_attr = attr;
@@ -1021,8 +1023,15 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, attr =ni_ins_new_attr (ni, mi, le, type, name, name_len, asize, name_off, svcn, ins_le); -if (!attr) +if (!attr) { + err = -EINVAL ; goto out2; + } + +if (IS_ERR (attr)) { + err =PTR_ERR (attr); + goto out2; + }if (ins_attr) *ins_attr = attr;
@@ -1034,7 +1043,6 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, out2:ni_remove_mi (ni, mi);mi_put (mi); - err = -EINVAL ; out1:ntfs_mark_rec_free (sbi, rno, is_mft);
@@ -1090,6 +1098,11 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type,if (asize <= free) { attr =ni_ins_new_attr (ni, &ni->mi,NULL , type, name, name_len, asize, name_off, svcn, ins_le); +if (IS_ERR (attr)) { + err =PTR_ERR (attr); + goto out; + } +if (attr) {if (ins_attr) *ins_attr = attr;
@@ -1187,6 +1200,11 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, goto out; } +if (IS_ERR (attr)) { + err =PTR_ERR (attr); + goto out; + } +if (ins_attr) *ins_attr = attr;if (ins_mi)
@@ -1302,6 +1320,11 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) goto out; } +if (IS_ERR (attr)) { + err =PTR_ERR (attr); + goto out; + } + attr->non_res =1 ; attr->name_off =SIZEOF_NONRESIDENT_LE ; attr->flags =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/554 fs/ntfs3: out1 also needs to put mi
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 4d78d1173a653acdaf7500a32b8dc530ca4ad075 ]
After ntfs_look_free_mft() executes successfully, all subsequent code that fails to execute must put mi.
--- fs/ntfs3/frecord.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/frecord.c +1 -1
@@ -1042,9 +1042,9 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, out2:ni_remove_mi (ni, mi); -mi_put (mi); out1: +mi_put (mi);ntfs_mark_rec_free (sbi, rno, is_mft); out:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/554 fs/ntfs3: Prevent memory leaks in add sub record
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit ccc4e86d1c24260c18ae94541198c3711c140da6 ]
If a rb node with the same ino already exists in the rb tree, the newly alloced mft_inode in ni_add_subrecord() will not have its memory cleaned up, which leads to the memory leak issue reported by syzbot.
The best option to avoid this issue is to put the newly alloced mft node when a rb node with the same ino already exists in the rb tree and return the rb node found in the rb tree to the parent layer.
syzbot reported:
BUG: memory leak
unreferenced object 0xffff888110bef280 (size 128):
backtrace (crc 126a088f):
ni_add_subrecord+0x31/0x180 fs/ntfs3/frecord.c:317
ntfs_look_free_mft+0xf0/0x790 fs/ntfs3/fsntfs.c:715
BUG: memory leak
unreferenced object 0xffff888109093400 (size 1024):
backtrace (crc 7197c55e):
mi_init+0x2b/0x50 fs/ntfs3/record.c:105
mi_format_new+0x40/0x220 fs/ntfs3/record.c:422--- fs/ntfs3/frecord.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ntfs3/frecord.c +4 -2
@@ -376,8 +376,10 @@ bool ni_add_subrecord(struct ntfs_inode *ni, CLST rno, struct mft_inode **mi)mi_get_ref (&ni->mi, &m->mrec->parent_ref); -ni_add_mi (ni, m); - *mi = m; + *mi =ni_ins_mi (ni, &ni->mi_tree, m->rno, &m->node); +if (*mi != m) +mi_put (m); +return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/554 drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Liu <[email protected]>
[ Upstream commit 20ac36b71c53b8c36c6903b5ca87c75226700a97 ]
if matrixbit is 11,
The range of color matrix is from 0 to (BIT(12) - 1). Values from 0 to (BIT(11) - 1) represent positive numbers, values from BIT(11) to (BIT(12) - 1) represent negative numbers. For example, -1 need converted to 8191.
so convert S31.32 to HW Q2.11 format by drm_color_ctm_s31_32_to_qm_n, and set int_bits to 2.
--- drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +---------------------- 1 file changed, 1 insertion(+), 22 deletions(-)
drivers/gpu/drm/mediatek/mtk_disp_ccorr.c +1 -22
@@ -85,27 +85,6 @@ void mtk_ccorr_stop(struct device *dev)writel_relaxed (0x0 , ccorr->regs +DISP_CCORR_EN ); } -/* Converts a DRM S31.32 value to the HW S1.n format. */ -static u16 mtk_ctm_s31_32_to_s1_n (u64 in,u32 n) -{ -u16 r; - -/* Sign bit. */ - r = in &BIT_ULL (63 ) ?BIT (n +1 ) :0 ; - -if ((in &GENMASK_ULL (62 ,33 )) >0 ) { -/* identity value 0x100000000 -> 0x400(mt8183), */ -/* identity value 0x100000000 -> 0x800(mt8192), */ -/* if bigger this, set it to max 0x7ff. */ - r |=GENMASK (n,0 ); - }else { -/* take the n+1 most important bits. */ - r |= (in >> (32 - n)) &GENMASK (n,0 ); - } - -return r; -} -void mtk_ccorr_ctm_set (struct device *dev,struct drm_crtc_state *state) {struct mtk_disp_ccorr *ccorr =dev_get_drvdata (dev);
@@ -124,7 +103,7 @@ void mtk_ccorr_ctm_set(struct device *dev, struct drm_crtc_state *state) input = ctm->matrix;for (i =0 ; i <ARRAY_SIZE (coeffs); i++) - coeffs[i] =mtk_ctm_s31_32_to_s1_n (input[i], matrix_bits); + coeffs[i] =drm_color_ctm_s31_32_to_qm_n (input[i],2 , matrix_bits);mtk_ddp_write (cmdq_pkt, coeffs[0 ] <<16 | coeffs[1 ], &ccorr->cmdq_reg, ccorr->regs,DISP_CCORR_COEF_0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/554 pwm: bcm2835: Make sure the channel is enabled after pwm_request()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit cda323dbda76600bf9761970d58517648f0de67d ]
The .free callback cleared among others the enable bit PWENx in the control register. When the PWM is requested later again this bit isn't restored but the core assumes the PWM is enabled and thus skips a request to configure the same state as before.
To fix that don't touch the hardware configuration in .free(). For symmetry also drop .request() and configure the mode completely in .apply().
--- drivers/pwm/pwm-bcm2835.c | 28 +++------------------------- 1 file changed, 3 insertions(+), 25 deletions(-)
drivers/pwm/pwm-bcm2835.c +3 -25
@@ -35,29 +35,6 @@ static inline struct bcm2835_pwm *to_bcm2835_pwm(struct pwm_chip *chip) return container_of(chip, struct bcm2835_pwm, chip); } -static int bcm2835_pwm_request (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); - value |= (PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); - -return 0 ; -} - -static void bcm2835_pwm_free (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); -} -static int bcm2835_pwm_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) {
@@ -109,6 +86,9 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,/* set polarity */ val =readl (pc->base +PWM_CONTROL ); + val &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); + val |=PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm); +if (state->polarity ==PWM_POLARITY_NORMAL ) val &= ~(PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm));else
@@ -126,8 +106,6 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, }static const struct pwm_ops bcm2835_pwm_ops = { - .request = bcm2835_pwm_request, - .free = bcm2835_pwm_free, .apply = bcm2835_pwm_apply, .owner =THIS_MODULE , };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/554 mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit b4b1bd1f330fdd13706382be6c90ce9f58cee3f5 ]
If devm_request_threaded_irq() fails after irq_domain_create_linear() succeeds in mt6397_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_create_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6397-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6397-irq.c +1 -0
@@ -206,6 +206,7 @@ int mt6397_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"failed to register irq=%d; err: %d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/554 mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 384bd58bf7095e4c4c8fcdbcede316ef342c630c ]
If devm_request_threaded_irq() fails after irq_domain_add_linear() succeeds in mt6358_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_add_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6358-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6358-irq.c +1 -0
@@ -262,6 +262,7 @@ int mt6358_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"Failed to register IRQ=%d, ret=%d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/554 wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit b647d2574e4583c2e3b0ab35568f60c88e910840 ]
The rtl8187_rx_cb() calculates the rx descriptor header address by subtracting its size from the skb tail pointer. However, it does not validate if the received packet (skb->len from urb->actual_length) is large enough to contain this header.
If a truncated packet is received, this will lead to a buffer underflow, reading memory before the start of the skb data area, and causing a kernel panic.
Add length checks for both rtl8187 and rtl8187b descriptor headers before attempting to access them, dropping the packet cleanly if the check fails.
--- .../wireless/realtek/rtl818x/rtl8187/dev.c | 27 +++++++++++++------ 1 file changed, 19 insertions(+), 8 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +19 -8
@@ -338,14 +338,16 @@ static void rtl8187_rx_cb(struct urb *urb)spin_unlock_irqrestore (&priv->rx_queue.lock, f);skb_put (skb, urb->actual_length); -if (unlikely (urb->status)) { -dev_kfree_skb_irq (skb); -return ; - } +if (unlikely (urb->status)) + goto free_skb;if (!priv->is_rtl8187b) { -struct rtl8187_rx_hdr *hdr = - (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); +struct rtl8187_rx_hdr *hdr; + +if (skb->len <sizeof (struct rtl8187_rx_hdr )) + goto free_skb; + + hdr = (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); flags =le32_to_cpu (hdr->flags);/* As with the RTL8187B below, the AGC is used to calculate * signal strength. In this case, the scaling
@@ -355,8 +357,12 @@ static void rtl8187_rx_cb(struct urb *urb) rx_status.antenna = (hdr->signal >>7 ) &1 ; rx_status.mactime =le64_to_cpu (hdr->mac_time); }else { -struct rtl8187b_rx_hdr *hdr = - (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); +struct rtl8187b_rx_hdr *hdr; + +if (skb->len <sizeof (struct rtl8187b_rx_hdr )) + goto free_skb; + + hdr = (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr));/* The Realtek datasheet for the RTL8187B shows that the RX * header contains the following quantities: signal quality, * RSSI, AGC, the received power in dB, and the measured SNR.
@@ -409,6 +415,11 @@ static void rtl8187_rx_cb(struct urb *urb)skb_unlink (skb, &priv->rx_queue);dev_kfree_skb_irq (skb); } +return ; + +free_skb: +dev_kfree_skb_irq (skb); +return ; }static int rtl8187_init_urbs (struct ieee80211_hw *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/554 ima: Handle error code returned by ima_filter_rule_match()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Yipeng <[email protected]>
[ Upstream commit 738c9738e690f5cea24a3ad6fd2d9a323cf614f6 ]
In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if (!rc)' check and sets 'result = true'. The LSM rule is considered a match, causing extra files to be measured by IMA.
This issue can be reproduced in the following scenario:
After unloading the SELinux policy module via 'semodule -d', if an IMA measurement is triggered before ima_lsm_rules is updated,
in ima_match_rules(), the first call to ima_filter_rule_match() returns -ESTALE. This causes the code to enter the 'if (rc == -ESTALE && !rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In ima_lsm_copy_rule(), since the SELinux module has been removed, the rule becomes NULL, and the second call to ima_filter_rule_match() returns -ENOENT. This bypasses the 'if (!rc)' check and results in a false match.
Call trace: selinux_audit_rule_match+0x310/0x3b8 security_audit_rule_match+0x60/0xa0 ima_match_rules+0x2e4/0x4a0 ima_match_policy+0x9c/0x1e8 ima_get_action+0x48/0x60 process_measurement+0xf8/0xa98 ima_bprm_check+0x98/0xd8 security_bprm_check+0x5c/0x78 search_binary_handler+0x6c/0x318 exec_binprm+0x58/0x1b8 bprm_execve+0xb8/0x130 do_execveat_common.isra.0+0x1a8/0x258 __arm64_sys_execve+0x48/0x68 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x200 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0
Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error codes like -ENOENT do not bypass the check and accidentally result in a successful match.
--- security/integrity/ima/ima_policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/ima_policy.c +1 -1
@@ -626,7 +626,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, goto retry; } } -if (!rc) { +if (rc <=0 ) { result = false; goto out; }
Signature · 1 line
2.51.0