5.15.198-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 435/554 ALSA: wavefront: Clear substream pointers on close
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit e11c5c13ce0ab2325d38fe63500be1dd88b81e38 ]
Clear substream pointers in close functions to avoid leaving dangling pointers, helping to improve code safety and
prevents potential issues.
--- sound/isa/wavefront/wavefront_midi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/isa/wavefront/wavefront_midi.c +2 -0
@@ -294,6 +294,7 @@ static int snd_wavefront_midi_input_closreturn -EIO ;spin_lock_irqsave (&midi->open, flags); + midi->substream_input[mpu] =NULL ; midi->mode[mpu] &= ~MPU401_MODE_INPUT ;spin_unlock_irqrestore (&midi->open, flags);
@@ -318,6 +319,7 @@ static int snd_wavefront_midi_output_cloreturn -EIO ;spin_lock_irqsave (&midi->open, flags); + midi->substream_output[mpu] =NULL ; midi->mode[mpu] &= ~MPU401_MODE_OUTPUT ;spin_unlock_irqrestore (&midi->open, flags);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 436/554 ALSA: wavefront: Use standard print API
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 8b4ac5429938dd5f1fbf2eea0687f08cbcccb6be ]
Use the standard print API with dev_*() instead of the old house-baked one. It gives better information and allows dynamically control of debug prints.
Stable-dep-of: 0c4a13ba8859 ("ALSA: wavefront: Fix integer overflow in sample size validation")
--- include/sound/snd_wavefront.h | 4 sound/isa/wavefront/wavefront.c | 61 +++++----- sound/isa/wavefront/wavefront_fx.c | 36 +++--- sound/isa/wavefront/wavefront_midi.c | 15 +- sound/isa/wavefront/wavefront_synth.c | 196 +++++++++++++++++----------------- 5 files changed, 158 insertions(+), 154 deletions(-)
include/sound/snd_wavefront.h +0 -4
@@ -137,8 +137,4 @@ extern int snd_wavefront_fx_ioctl (strextern int snd_wavefront_fx_open (struct snd_hwdep *,struct file *);extern int snd_wavefront_fx_release (struct snd_hwdep *,struct file *); -/* prefix in all snd_printk() delivered messages */ - -#define LOGNAME "WaveFront: " -#endif /* __SOUND_SND_WAVEFRONT_H__ */
sound/isa/wavefront/wavefront.c +31 -30
173 lines not on this page · raw message
sound/isa/wavefront/wavefront_fx.c +18 -18
@@ -38,7 +38,7 @@ wavefront_fx_idle (snd_wavefront_t *dev) }if (x &0x80 ) { -snd_printk ("FX device never idle.\n" ); +dev_err (dev->card->dev,"FX device never idle.\n" );return 0 ; }
@@ -64,14 +64,14 @@ wavefront_fx_memset (snd_wavefront_t *de unsigned short *data) {if (page <0 || page >7 ) { -snd_printk ("FX memset: " -"page must be >= 0 and <= 7\n" ); +dev_err (dev->card->dev, +"FX memset: page must be >= 0 and <= 7\n" );return -EINVAL ; }if (addr <0 || addr >0x7f ) { -snd_printk ("FX memset: " -"addr must be >= 0 and <= 7f\n" ); +dev_err (dev->card->dev, +"FX memset: addr must be >= 0 and <= 7f\n" );return -EINVAL ; }
@@ -83,7 +83,7 @@ wavefront_fx_memset (snd_wavefront_t *deoutb ((data[0 ] >>8 ), dev->fx_dsp_msb);outb ((data[0 ] &0xff ), dev->fx_dsp_lsb); -snd_printk ("FX: addr %d:%x set to 0x%x\n" , +dev_err (dev->card->dev,"FX: addr %d:%x set to 0x%x\n" , page, addr, data[0 ]); }else {
@@ -102,9 +102,9 @@ wavefront_fx_memset (snd_wavefront_t *de }if (i != cnt) { -snd_printk ("FX memset " -"(0x%x, 0x%x, 0x%lx, %d) incomplete\n" , - page, addr, (unsigned long ) data, cnt); +dev_err (dev->card->dev, +"FX memset (0x%x, 0x%x, 0x%lx, %d) incomplete\n" , + page, addr, (unsigned long ) data, cnt);return -EIO ; } }
@@ -123,7 +123,7 @@ snd_wavefront_fx_detect (snd_wavefront_t*/ if (inb (dev->fx_status) &0x80 ) { -snd_printk ("Hmm, probably a Maui or Tropez.\n" ); +dev_err (dev->card->dev,"Hmm, probably a Maui or Tropez.\n" );return -1 ; }
@@ -180,15 +180,15 @@ snd_wavefront_fx_ioctl (struct snd_hwdepcase WFFX_MEMSET :if (r.data[2 ] <=0 ) { -snd_printk ("cannot write " -"<= 0 bytes to FX\n" ); +dev_err (dev->card->dev, +"cannot write <= 0 bytes to FX\n" );return -EIO ; }else if (r.data[2 ] ==1 ) { pd = (unsigned short *) &r.data[3 ]; }else {if (r.data[2 ] >256 ) { -snd_printk ("cannot write " -"> 512 bytes to FX\n" ); +dev_err (dev->card->dev, +"cannot write > 512 bytes to FX\n" );return -EIO ; } page_data = memdup_user((unsigned char __user *)
@@ -208,8 +208,8 @@ snd_wavefront_fx_ioctl (struct snd_hwdepbreak ;default : -snd_printk ("FX: ioctl %d not yet supported\n" , - r.request); +dev_err (dev->card->dev,"FX: ioctl %d not yet supported\n" , + r.request);return -ENOTTY ; }return err;
@@ -254,8 +254,8 @@ snd_wavefront_fx_start (snd_wavefront_t goto out; } }else { -snd_printk (KERN_ERR "invalid address" -" in register data\n" ); +dev_err (dev->card->dev, +"invalid address in register data\n" ); err =-1 ; goto out; }
sound/isa/wavefront/wavefront_midi.c +10 -5
@@ -503,7 +503,8 @@ snd_wavefront_midi_start (snd_wavefront_for (i =0 ; i <30000 && !output_ready (midi); i++);if (!output_ready (midi)) { -snd_printk ("MIDI interface not ready for command\n" ); +dev_err (card->wavefront.card->dev, +"MIDI interface not ready for command\n" );return -1 ; }
@@ -525,7 +526,8 @@ snd_wavefront_midi_start (snd_wavefront_ }if (!ok) { -snd_printk ("cannot set UART mode for MIDI interface" ); +dev_err (card->wavefront.card->dev, +"cannot set UART mode for MIDI interface" ); dev->interrupts_are_midi =0 ;return -1 ; }
@@ -533,7 +535,8 @@ snd_wavefront_midi_start (snd_wavefront_/* Route external MIDI to WaveFront synth (by default) */ if (snd_wavefront_cmd (dev,WFC_MISYNTH_ON , rbuf, wbuf)) { -snd_printk ("can't enable MIDI-IN-2-synth routing.\n" ); +dev_warn (card->wavefront.card->dev, +"can't enable MIDI-IN-2-synth routing.\n" );/* XXX error ? */ }
@@ -549,14 +552,16 @@ snd_wavefront_midi_start (snd_wavefront_*/ if (snd_wavefront_cmd (dev,WFC_VMIDI_OFF , rbuf, wbuf)) { -snd_printk ("virtual MIDI mode not disabled\n" ); +dev_warn (card->wavefront.card->dev, +"virtual MIDI mode not disabled\n" );return 0 ;/* We're OK, but missing the external MIDI dev */ }snd_wavefront_midi_enable_virtual (card);if (snd_wavefront_cmd (dev,WFC_VMIDI_ON , rbuf, wbuf)) { -snd_printk ("cannot enable virtual MIDI mode.\n" ); +dev_warn (card->wavefront.card->dev, +"cannot enable virtual MIDI mode.\n" );snd_wavefront_midi_disable_virtual (card); }return 0 ;
sound/isa/wavefront/wavefront_synth.c +99 -97
561 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 437/554 ALSA: wavefront: Fix integer overflow in sample size validation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 0c4a13ba88594fd4a27292853e736c6b4349823d ]
The wavefront_send_sample() function has an integer overflow issue when validating sample size. The header->size field is u32 but gets cast to int for comparison with dev->freemem
Fix by using unsigned comparison to avoid integer overflow.
--- sound/isa/wavefront/wavefront_synth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/isa/wavefront/wavefront_synth.c +2 -2
@@ -952,9 +952,9 @@ wavefront_send_sample (snd_wavefront_t *if (header->size) { dev->freemem =wavefront_freemem (dev); -if (dev->freemem < (int )header->size) { +if (dev->freemem <0 || dev->freemem < header->size) {dev_err (dev->card->dev, -"insufficient memory to load %d byte sample.\n" , +"insufficient memory to load %u byte sample.\n" , header->size);return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 438/554 NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 27d17641cacfedd816789b75d342430f6b912bd2 ]
Quoted 1 line
Quoted 1 line
From RFC 8881:
5.8.1.14. Attribute 75: suppattr_exclcreat
Quoted 4 lines
The bit vector that would set all REQUIRED and RECOMMENDED attributes that are supported by the
EXCLUSIVE4_1method of file creation via the OPEN operation. The scope of this attribute applies to all objects with a matching fsid.
There's nothing in RFC 8881 that states that suppattr_exclcreat is or is not allowed to contain bits for attributes that are clear in the reported supported_attrs bitmask. But it doesn't make sense for an NFS server to indicate that it /doesn't/ implement an attribute, but then also indicate that clients /are/ allowed to set that attribute using OPEN(create) with EXCLUSIVE4_1.
Ensure that the SECURITY_LABEL and ACL bits are not set in the suppattr_exclcreat bitmask when they are also not set in the supported_attrs bitmask.
--- fs/nfsd/nfs4xdr.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfsd/nfs4xdr.c +5 -0
@@ -3409,6 +3409,11 @@ out_acl:u32 supp[3 ];memcpy (supp, nfsd_suppattrs[minorversion],sizeof (supp)); +if (!IS_POSIXACL (d_inode (dentry))) + supp[0 ] &= ~FATTR4_WORD0_ACL ; +if (!contextsupport) + supp[2 ] &= ~FATTR4_WORD2_SECURITY_LABEL ; + supp[0 ] &=NFSD_SUPPATTR_EXCLCREAT_WORD0 ; supp[1 ] &=NFSD_SUPPATTR_EXCLCREAT_WORD1 ; supp[2 ] &=NFSD_SUPPATTR_EXCLCREAT_WORD2 ;
Greg Kroah-Hartman
maintainerPATCH 439/554 KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongli Zhang <[email protected]>
[ Upstream commit 29763138830916f46daaa50e83e7f4f907a3236b ]
If an APICv status updated was pended while L2 was active, immediately refresh vmcs01's controls instead of pending KVM_REQ_APICV_UPDATE as kvm_vcpu_update_apicv() only calls into vendor code if a change is necessary.
E.g. if APICv is inhibited, and then activated while L2 is running:
kvm_vcpu_update_apicv()
|
-> __kvm_vcpu_update_apicv()
|
-> apic->apicv_active = true
|
-> vmx_refresh_apicv_exec_ctrl()
|
-> vmx->nested.update_vmcs01_apicv_status = true
|
-> returnThen L2 exits to L1:
__nested_vmx_vmexit()
|
-> kvm_make_request(KVM_REQ_APICV_UPDATE)
vcpu_enter_guest(): KVM_REQ_APICV_UPDATE
-> kvm_vcpu_update_apicv()
|
-> __kvm_vcpu_update_apicv()
|
-> return // because if (apic->apicv_active == activate)--- arch/x86/kvm/vmx/nested.c | 2 +- arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/kvm/vmx/vmx.h | 1 + 3 files changed, 3 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/nested.c +1 -1
@@ -4684,7 +4684,7 @@ void nested_vmx_vmexit(struct kvm_vcpu *if (vmx->nested.update_vmcs01_apicv_status) { vmx->nested.update_vmcs01_apicv_status = false; -kvm_make_request (KVM_REQ_APICV_UPDATE , vcpu); +vmx_refresh_apicv_exec_ctrl (vcpu); } if ((vm_exit_reason != -1) &&
arch/x86/kvm/vmx/vmx.c +1 -1
@@ -4217,7 +4217,7 @@ static u32 vmx_vmexit_ctrl(void) ~(VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |VM_EXIT_LOAD_IA32_EFER ); } -static void vmx_refresh_apicv_exec_ctrl (struct kvm_vcpu *vcpu) +void vmx_refresh_apicv_exec_ctrl (struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu);
arch/x86/kvm/vmx/vmx.h +1 -0
@@ -386,6 +386,7 @@ void __vmx_set_segment(struct kvm_vcpu *u64 construct_eptp (struct kvm_vcpu *vcpu,hpa_t root_hpa,int root_level);bool vmx_guest_inject_ac (struct kvm_vcpu *vcpu); +void vmx_refresh_apicv_exec_ctrl (struct kvm_vcpu *vcpu);void vmx_update_exception_bitmap (struct kvm_vcpu *vcpu);bool vmx_nmi_blocked (struct kvm_vcpu *vcpu);bool __vmx_interrupt_blocked (struct kvm_vcpu *vcpu);
Greg Kroah-Hartman
maintainerPATCH 440/554 xfs: fix a memory leak in xfs_buf_item_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit fc40459de82543b565ebc839dca8f7987f16f62e ]
xfs_buf_item_get_format() may allocate memory for bip->bli_formats, free the memory in the error path.
--- fs/xfs/xfs_buf_item.c | 1 + 1 file changed, 1 insertion(+)
fs/xfs/xfs_buf_item.c +1 -0
@@ -825,6 +825,7 @@ xfs_buf_item_init( map_size =DIV_ROUND_UP (chunks,NBWORD );if (map_size >XFS_BLF_DATAMAP_SIZE ) { +xfs_buf_item_free_format (bip);kmem_cache_free (xfs_buf_item_zone, bip); xfs_err(mp, "buffer item dirty bitmap (%u uints) too small to reflect %u bytes!",
Greg Kroah-Hartman
maintainerPATCH 441/554 f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 68d05693f8c031257a0822464366e1c2a239a512 ]
mkfs.f2fs -f /dev/vdd
mount /dev/vdd /mnt/f2fs
touch /mnt/f2fs/foo
sync # avoid CP_UMOUNT_FLAG in last f2fs_checkpoint.ckpt_flags
touch /mnt/f2fs/barf2fs_io fsync /mnt/f2fs/barf2fs_io shutdown 2 /mnt/f2fs
umount /mnt/f2fs
blockdev --setro /dev/vdd
mount /dev/vdd /mnt/f2fs
mount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.
For the case if we create and fsync a new inode before sudden power-cut, without norecovery or disable_roll_forward mount option, the following mount will succeed w/o recovering last fsynced inode.
The problem here is that we only check inode_list list after find_fsync_dnodes() in f2fs_recover_fsync_data() to find out whether there is recoverable data in the iamge, but there is a missed case, if last fsynced inode is not existing in last checkpoint, then, we will fail to get its inode due to nat of inode node is not existing in last checkpoint, so the inode won't be linked in inode_list.
Let's detect such case in dyrun mode to fix this issue.
After this change, mount will fail as expected below:
mount: /mnt/f2fs: cannot mount /dev/vdd read-only.
dmesg(1) may have more information after failed mount system call.
demsg:
F2FS-fs (vdd): Need to recover fsync data, but write access unavailable, please try mount w/ disable_roll_forward or norecovery
--- fs/f2fs/recovery.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/f2fs/recovery.c +6 -3
@@ -343,7 +343,7 @@ static int recover_inode(struct inode *i }static int find_fsync_dnodes (struct f2fs_sb_info *sbi,struct list_head *head, -bool check_only) +bool check_only,bool *new_inode) {struct curseg_info *curseg;struct page *page =NULL ;
@@ -400,6 +400,8 @@ static int find_fsync_dnodes(struct f2fsif (IS_ERR (entry)) { err =PTR_ERR (entry);if (err == -ENOENT ) { +if (check_only) + *new_inode = true; err =0 ; goto next; }
@@ -805,6 +807,7 @@ int f2fs_recover_fsync_data(struct f2fs_unsigned long s_flags = sbi->sb->s_flags;bool need_writecp = false;bool fix_curseg_write_pointer = false; +bool new_inode = false;#ifdef CONFIG_QUOTA int quota_enabled;#endif
@@ -829,8 +832,8 @@ int f2fs_recover_fsync_data(struct f2fs_down_write (&sbi->cp_global_sem);/* step #1: find fsynced inode numbers */ - err =find_fsync_dnodes (sbi, &inode_list, check_only); -if (err ||list_empty (&inode_list)) + err =find_fsync_dnodes (sbi, &inode_list, check_only, &new_inode); +if (err <0 || (list_empty (&inode_list) && (!check_only || !new_inode))) goto skip;if (check_only) {
Greg Kroah-Hartman
maintainerPATCH 442/554 f2fs: use global inline_xattr_slab instead of per-sb slab cache
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 1f27ef42bb0b7c0740c5616ec577ec188b8a1d05 ]
As Hong Yun reported in mailing list:
loop7: detected capacity change from 0 to 131072
------------[ cut here ]------------ kmem_cache of name 'f2fs_xattr_entry-7:7' already exists WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 kmem_cache_sanity_check mm/slab_common.c:109 [inline] WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 __kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307 CPU: 0 UID: 0 PID: 24426 Comm: syz.7.1370 Not tainted 6.17.0-rc4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:109 [inline] RIP: 0010:__kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307 Call Trace: __kmem_cache_create include/linux/slab.h:353 [inline] f2fs_kmem_cache_create fs/f2fs/f2fs.h:2943 [inline] f2fs_init_xattr_caches+0xa5/0xe0 fs/f2fs/xattr.c:843 f2fs_fill_super+0x1645/0x2620 fs/f2fs/super.c:4918 get_tree_bdev_flags+0x1fb/0x260 fs/super.c:1692 vfs_get_tree+0x43/0x140 fs/super.c:1815 do_new_mount+0x201/0x550 fs/namespace.c:3808 do_mount fs/namespace.c:4136 [inline] __do_sys_mount fs/namespace.c:4347 [inline] __se_sys_mount+0x298/0x2f0 fs/namespace.c:4324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x8e/0x3a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The bug can be reproduced w/ below scripts:
- mount /dev/vdb /mnt1
- mount /dev/vdc /mnt2
- umount /mnt1
- mounnt /dev/vdb /mnt1
The reason is if we created two slab caches, named f2fs_xattr_entry-7:3 and f2fs_xattr_entry-7:7, and they have the same slab size. Actually, slab system will only create one slab cache core structure which has slab name of "f2fs_xattr_entry-7:3", and two slab caches share the same structure and cache address.
So, if we destroy f2fs_xattr_entry-7:3 cache w/ cache address, it will decrease reference count of slab cache, rather than release slab cache entirely, since there is one more user has referenced the cache.
Then, if we try to create slab cache w/ name "f2fs_xattr_entry-7:3" again, slab system will find that there is existed cache which has the same name and trigger the warning.
Let's changes to use global inline_xattr_slab instead of per-sb slab cache for fixing.
--- fs/f2fs/f2fs.h | 3 --- fs/f2fs/super.c | 15 +++++++-------- fs/f2fs/xattr.c | 32 +++++++++++--------------------- fs/f2fs/xattr.h | 10 ++++++---- 4 files changed, 24 insertions(+), 36 deletions(-)
fs/f2fs/f2fs.h +0 -3
@@ -1763,9 +1763,6 @@ struct f2fs_sb_info {struct workqueue_struct *post_read_wq;/* post read workqueue */ -struct kmem_cache *inline_xattr_slab;/* inline xattr entry */ -unsigned int inline_xattr_slab_size;/* default inline xattr slab size */ -/* For reclaimed segs statistics per each GC mode */ unsigned int gc_segment_mode;/* GC state for reclaimed segments */ unsigned int gc_reclaimed_segs[MAX_GC_MODE ];/* Reclaimed segs for each mode */
fs/f2fs/super.c +7 -8
@@ -1655,7 +1655,6 @@ static void f2fs_put_super(struct super_destroy_device_list (sbi);f2fs_destroy_page_array_cache (sbi); -f2fs_destroy_xattr_caches (sbi);mempool_destroy (sbi->write_io_dummy);#ifdef CONFIG_QUOTA for (i =0 ; i <MAXQUOTAS ; i++)
@@ -4166,13 +4165,9 @@ try_onemore: } } -/* init per sbi slab cache */ - err =f2fs_init_xattr_caches (sbi); -if (err) - goto free_io_dummy; err =f2fs_init_page_array_cache (sbi);if (err) - goto free_xattr_cache; + goto free_io_dummy;/* get an inode for meta space */ sbi->meta_inode =f2fs_iget (sb,F2FS_META_INO (sbi));
@@ -4492,8 +4487,6 @@ free_meta_inode: sbi->meta_inode =NULL ; free_page_array_cache:f2fs_destroy_page_array_cache (sbi); -free_xattr_cache: -f2fs_destroy_xattr_caches (sbi); free_io_dummy:mempool_destroy (sbi->write_io_dummy); free_percpu:
@@ -4660,7 +4653,12 @@ static int __init init_f2fs_fs(void) err =f2fs_create_casefold_cache ();if (err) goto free_compress_cache; + err =f2fs_init_xattr_cache (); +if (err) + goto free_casefold_cache;return 0 ; +free_casefold_cache: +f2fs_destroy_casefold_cache (); free_compress_cache:f2fs_destroy_compress_cache (); free_compress_mempool:
@@ -4700,6 +4698,7 @@ fail: static void __exit exit_f2fs_fs(void) { +f2fs_destroy_xattr_cache ();f2fs_destroy_casefold_cache ();f2fs_destroy_compress_cache ();f2fs_destroy_compress_mempool ();
fs/f2fs/xattr.c +11 -21
@@ -23,11 +23,12 @@#include "xattr.h" #include "segment.h" +static struct kmem_cache *inline_xattr_slab;static void *xattr_alloc (struct f2fs_sb_info *sbi,int size,bool *is_inline) { -if (likely (size == sbi->inline_xattr_slab_size)) { +if (likely (size ==DEFAULT_XATTR_SLAB_SIZE )) { *is_inline = true; -return f2fs_kmem_cache_alloc (sbi->inline_xattr_slab, +return f2fs_kmem_cache_alloc (inline_xattr_slab,GFP_F2FS_ZERO , false, sbi); } *is_inline = false;
@@ -38,7 +39,7 @@ static void xattr_free(struct f2fs_sb_in bool is_inline) {if (is_inline) -kmem_cache_free (sbi->inline_xattr_slab, xattr_addr); +kmem_cache_free (inline_xattr_slab, xattr_addr);else kfree (xattr_addr); }
@@ -818,25 +819,14 @@ int f2fs_setxattr(struct inode *inode, ireturn err; } -int f2fs_init_xattr_caches (struct f2fs_sb_info *sbi) +int __init f2fs_init_xattr_cache (void ) { -dev_t dev = sbi->sb->s_bdev->bd_dev; -char slab_name[32 ]; - -sprintf (slab_name,"f2fs_xattr_entry-%u:%u" ,MAJOR (dev),MINOR (dev)); - - sbi->inline_xattr_slab_size =F2FS_OPTION (sbi).inline_xattr_size * -sizeof (__le32) +XATTR_PADDING_SIZE ; - - sbi->inline_xattr_slab =f2fs_kmem_cache_create (slab_name, - sbi->inline_xattr_slab_size); -if (!sbi->inline_xattr_slab) -return -ENOMEM ; - -return 0 ; + inline_xattr_slab =f2fs_kmem_cache_create ("f2fs_xattr_entry" , +DEFAULT_XATTR_SLAB_SIZE ); +return inline_xattr_slab ?0 : -ENOMEM ; } -void f2fs_destroy_xattr_caches (struct f2fs_sb_info *sbi) +void f2fs_destroy_xattr_cache (void ) { -kmem_cache_destroy (sbi->inline_xattr_slab); -} +kmem_cache_destroy (inline_xattr_slab); +}
fs/f2fs/xattr.h +6 -4
@@ -88,6 +88,8 @@ struct f2fs_xattr_entry { F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) - \ DEF_INLINE_RESERVED_SIZE - \ MIN_INLINE_DENTRY_SIZE / sizeof(__le32)) +#define DEFAULT_XATTR_SLAB_SIZE (DEFAULT_INLINE_XATTR_ADDRS * \ + sizeof(__le32) + XATTR_PADDING_SIZE)/* * On-disk structure of f2fs_xattr
@@ -131,8 +133,8 @@ extern int f2fs_setxattr(struct inode *,extern int f2fs_getxattr (struct inode *,int ,const char *,void *,size_t ,struct page *);extern ssize_t f2fs_listxattr (struct dentry *,char *,size_t ); -extern int f2fs_init_xattr_caches (struct f2fs_sb_info *); -extern void f2fs_destroy_xattr_caches (struct f2fs_sb_info *); +int __init f2fs_init_xattr_cache (void ); +void f2fs_destroy_xattr_cache (void );#else #define f2fs_xattr_handlers NULL
@@ -149,8 +151,8 @@ static inline int f2fs_getxattr(struct i {return -EOPNOTSUPP ; } -static inline int f2fs_init_xattr_caches (struct f2fs_sb_info *sbi) {return 0 ; } -static inline void f2fs_destroy_xattr_caches (struct f2fs_sb_info *sbi) { } +static inline int __init f2fs_init_xattr_cache (void ) {return 0 ; } +static inline void f2fs_destroy_xattr_cache (void ) { }#endif #ifdef CONFIG_F2FS_FS_SECURITY
Greg Kroah-Hartman
maintainerPATCH 443/554 f2fs: fix to propagate error from f2fs_enable_checkpoint()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit be112e7449a6e1b54aa9feac618825d154b3a5c7 ]
In order to let userspace detect such error rather than suffering silent failure.
--- fs/f2fs/super.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
fs/f2fs/super.c +15 -9
@@ -2177,9 +2177,10 @@ restore_flag:return err; } -static void f2fs_enable_checkpoint (struct f2fs_sb_info *sbi) +static int f2fs_enable_checkpoint (struct f2fs_sb_info *sbi) {int retry =DEFAULT_RETRY_IO_COUNT ; +int ret;/* we should flush all the data to keep data consistency */ do {
@@ -2197,10 +2198,14 @@ static void f2fs_enable_checkpoint(strucset_sbi_flag (sbi,SBI_IS_DIRTY );up_write (&sbi->gc_lock); -f2fs_sync_fs (sbi->sb,1 ); + ret =f2fs_sync_fs (sbi->sb,1 ); +if (ret) +f2fs_err (sbi,"%s sync_fs failed, ret: %d" , __func__, ret);/* Let's ensure there's no pending checkpoint anymore */ f2fs_flush_ckpt_thread (sbi); + +return ret; }static int f2fs_remount (struct super_block *sb,int *flags,char *data)
@@ -2416,7 +2421,9 @@ static int f2fs_remount(struct super_bloif (err) goto restore_discard; }else { -f2fs_enable_checkpoint (sbi); + err =f2fs_enable_checkpoint (sbi); +if (err) + goto restore_discard; } }
@@ -4397,13 +4404,12 @@ reset_checkpoint:/* f2fs_recover_fsync_data() cleared this already */ clear_sbi_flag (sbi,SBI_POR_DOING ); -if (test_opt (sbi,DISABLE_CHECKPOINT )) { +if (test_opt (sbi,DISABLE_CHECKPOINT )) err =f2fs_disable_checkpoint (sbi); -if (err) - goto sync_free_meta; - }else if (is_set_ckpt_flags (sbi,CP_DISABLED_FLAG )) { -f2fs_enable_checkpoint (sbi); - } +else if (is_set_ckpt_flags (sbi,CP_DISABLED_FLAG )) + err =f2fs_enable_checkpoint (sbi); +if (err) + goto sync_free_meta;/* * If filesystem is not mounted as read-only then
Greg Kroah-Hartman
maintainerPATCH 444/554 f2fs: fix to avoid updating zero-sized extent in extent cache
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 7c37c79510329cd951a4dedf3f7bf7e2b18dccec ]
As syzbot reported:
F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0]
------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__update_extent_tree_range+0x13bc/0x1500 fs/f2fs/extent_cache.c:678 Call Trace: <TASK> f2fs_update_read_extent_cache_range+0x192/0x3e0 fs/f2fs/extent_cache.c:1085 f2fs_do_zero_range fs/f2fs/file.c:1657 [inline] f2fs_zero_range+0x10c1/0x1580 fs/f2fs/file.c:1737 f2fs_fallocate+0x583/0x990 fs/f2fs/file.c:2030 vfs_fallocate+0x669/0x7e0 fs/open.c:342 ioctl_preallocate fs/ioctl.c:289 [inline] file_ioctl+0x611/0x780 fs/ioctl.c:-1 do_vfs_ioctl+0xb33/0x1430 fs/ioctl.c:576 __do_sys_ioctl fs/ioctl.c:595 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f07bc58eec9
In error path of f2fs_zero_range(), it may add a zero-sized extent into extent cache, it should be avoided.
--- fs/f2fs/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/file.c +2 -1
@@ -1470,7 +1470,8 @@ static int f2fs_do_zero_range(struct dnof2fs_set_data_blkaddr (dn); } -f2fs_update_extent_cache_range (dn, start,0 , index - start); +if (index > start) +f2fs_update_extent_cache_range (dn, start,0 , index - start);return ret; }
Greg Kroah-Hartman
maintainerPATCH 445/554 usb: dwc3: keep susphy enabled during exit to avoid controller faults
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Udipto Goswami <[email protected]>
[ Upstream commit e1003aa7ec9eccdde4c926bd64ef42816ad55f25 ]
On some platforms, switching USB roles from host to device can trigger controller faults due to premature PHY power-down. This occurs when the PHY is disabled too early during teardown, causing synchronization issues between the PHY and controller.
Keep susphy enabled during dwc3_host_exit() and dwc3_gadget_exit() ensures the PHY remains in a low-power state capable of handling required commands during role switch.
--- drivers/usb/dwc3/gadget.c | 2 +- drivers/usb/dwc3/host.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/usb/dwc3/gadget.c +1 -1
@@ -4585,7 +4585,7 @@ void dwc3_gadget_exit(struct dwc3 *dwc)if (!dwc->gadget)return ; -dwc3_enable_susphy (dwc, false); +dwc3_enable_susphy (dwc, true);usb_del_gadget (dwc->gadget);dwc3_gadget_free_endpoints (dwc);usb_put_gadget (dwc->gadget);
drivers/usb/dwc3/host.c +1 -1
@@ -157,7 +157,7 @@ err:void dwc3_host_exit (struct dwc3 *dwc) { -dwc3_enable_susphy (dwc, false); +dwc3_enable_susphy (dwc, true);platform_device_unregister (dwc->xhci); dwc->xhci =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 446/554 mptcp: pm: ignore unknown endpoint flags
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
[ Upstream commit 0ace3297a7301911e52d8195cb1006414897c859 ]
Before this patch, the kernel was saving any flags set by the userspace, even unknown ones. This doesn't cause critical issues because the kernel is only looking at specific ones. But on the other hand, endpoints dumps could tell the userspace some recent flags seem to be supported on older kernel versions.
Instead, ignore all unknown flags when parsing them. By doing that, the userspace can continue to set unsupported flags, but it has a way to verify what is supported by the kernel.
Note that it sounds better to continue accepting unsupported flags not to change the behaviour, but also that eases things on the userspace side by adding "optional" endpoint types only supported by newer kernel versions without having to deal with the different kernel versions.
A note for the backports: there will be conflicts in mptcp.h on older versions not having the mentioned flags, the new line should still be added last, and the '5' needs to be adapted to have the same value as the last entry.
--- include/uapi/linux/mptcp.h | 1 + net/mptcp/pm_netlink.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
include/uapi/linux/mptcp.h +1 -0
@@ -74,6 +74,7 @@ enum {#define MPTCP_PM_ADDR_FLAG_SUBFLOW (1 << 1)#define MPTCP_PM_ADDR_FLAG_BACKUP (1 << 2)#define MPTCP_PM_ADDR_FLAG_FULLMESH (1 << 3) +#define MPTCP_PM_ADDR_FLAGS_MASK GENMASK(3, 0)enum {MPTCP_PM_CMD_UNSPEC ,
net/mptcp/pm_netlink.c +2 -1
@@ -1294,7 +1294,8 @@ skip_family: entry->addr.id =nla_get_u8 (tb[MPTCP_PM_ADDR_ATTR_ID ]);if (tb[MPTCP_PM_ADDR_ATTR_FLAGS ]) - entry->flags =nla_get_u32 (tb[MPTCP_PM_ADDR_ATTR_FLAGS ]); + entry->flags =nla_get_u32 (tb[MPTCP_PM_ADDR_ATTR_FLAGS ]) & +MPTCP_PM_ADDR_FLAGS_MASK ;if (tb[MPTCP_PM_ADDR_ATTR_PORT ]) {if (!(entry->flags &MPTCP_PM_ADDR_FLAG_SIGNAL )) {
Greg Kroah-Hartman
maintainerPATCH 447/554 usb: ohci-nxp: Use helper function devm_clk_get_enabled()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Zekun <[email protected]>
[ Upstream commit c146ede472717f352b7283a525bd9a1a2b15e2cf ]
devm_clk_get() and clk_prepare_enable() can be replaced by helper function devm_clk_get_enabled(). Let's use devm_clk_get_enabled() to simplify code and avoid calling clk_disable_unprepare().
Stable-dep-of: b4c61e542faf ("usb: ohci-nxp: fix device leak on probe failure")
--- drivers/usb/host/ohci-nxp.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-)
drivers/usb/host/ohci-nxp.c +4 -14
@@ -51,8 +51,6 @@ static struct hc_driver __read_mostly ohstatic struct i2c_client *isp1301_i2c_client; -static struct clk *usb_host_clk; -static void isp1301_configure_lpc32xx (void ) {/* LPC32XX only supports DAT_SE0 USB mode */
@@ -155,6 +153,7 @@ static int ohci_hcd_nxp_probe(struct plastruct resource *res;int ret =0 , irq;struct device_node *isp1301_node; +struct clk *usb_host_clk;if (pdev->dev.of_node) { isp1301_node = of_parse_phandle(pdev->dev.of_node,
@@ -180,26 +179,20 @@ static int ohci_hcd_nxp_probe(struct pla }/* Enable USB host clock */ - usb_host_clk =devm_clk_get (&pdev->dev,NULL ); + usb_host_clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (usb_host_clk)) { -dev_err (&pdev->dev,"failed to acquire USB OHCI clock\n" ); +dev_err (&pdev->dev,"failed to acquire and start USB OHCI clock\n" ); ret =PTR_ERR (usb_host_clk); goto fail_disable; } - ret =clk_prepare_enable (usb_host_clk); -if (ret <0 ) { -dev_err (&pdev->dev,"failed to start USB OHCI clock\n" ); - goto fail_disable; - } -isp1301_configure (); hcd =usb_create_hcd (driver, &pdev->dev,dev_name (&pdev->dev));if (!hcd) {dev_err (&pdev->dev,"Failed to allocate HC buffer\n" ); ret = -ENOMEM ; - goto fail_hcd; + goto fail_disable; } res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );
@@ -230,8 +223,6 @@ static int ohci_hcd_nxp_probe(struct plaohci_nxp_stop_hc (); fail_resource:usb_put_hcd (hcd); -fail_hcd: -clk_disable_unprepare (usb_host_clk); fail_disable: isp1301_i2c_client =NULL ;return ret;
@@ -244,7 +235,6 @@ static int ohci_hcd_nxp_remove(struct plusb_remove_hcd (hcd);ohci_nxp_stop_hc ();usb_put_hcd (hcd); -clk_disable_unprepare (usb_host_clk); isp1301_i2c_client =NULL ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 448/554 usb: ohci-nxp: fix device leak on probe failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit b4c61e542faf8c9131d69ecfc3ad6de96d1b2ab8 ]
Make sure to drop the reference taken when looking up the PHY I2C device during probe on probe failure (e.g. probe deferral) and on driver unbind.
--- drivers/usb/host/ohci-nxp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/ohci-nxp.c +2 -0
@@ -224,6 +224,7 @@ static int ohci_hcd_nxp_probe(struct pla fail_resource:usb_put_hcd (hcd); fail_disable: +put_device (&isp1301_i2c_client->dev); isp1301_i2c_client =NULL ;return ret; }
@@ -235,6 +236,7 @@ static int ohci_hcd_nxp_remove(struct plusb_remove_hcd (hcd);ohci_nxp_stop_hc ();usb_put_hcd (hcd); +put_device (&isp1301_i2c_client->dev); isp1301_i2c_client =NULL ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 449/554 fuse: fix readahead reclaim deadlock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <[email protected]>
[ Upstream commit bd5603eaae0aabf527bfb3ce1bb07e979ce5bd50 ]
Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") skips allocating ff->release_args if the server does not implement open. However in doing so, fuse_prepare_release() now skips grabbing the reference on the inode, which makes it possible for an inode to be evicted from the dcache while there are inflight readahead requests. This causes a deadlock if the server triggers reclaim while servicing the readahead request and reclaim attempts to evict the inode of the file being read ahead. Since the folio is locked during readahead, when reclaim evicts the fuse inode and fuse_evict_inode() attempts to remove all folios associated with the inode from the page cache (truncate_inode_pages_range()), reclaim will block forever waiting for the lock since readahead cannot relinquish the lock because it is itself blocked in reclaim:
Quoted 1 line
Quoted 1 line
Quoted 1 line
stack_trace(1504735)
folio_wait_bit_common (mm/filemap.c:1308:4) folio_lock (./include/linux/pagemap.h:1052:3) truncate_inode_pages_range (mm/truncate.c:336:10) fuse_evict_inode (fs/fuse/inode.c:161:2) evict (fs/inode.c:704:3) dentry_unlink_inode (fs/dcache.c:412:3) __dentry_kill (fs/dcache.c:615:3) shrink_kill (fs/dcache.c:1060:12) shrink_dentry_list (fs/dcache.c:1087:3) prune_dcache_sb (fs/dcache.c:1168:2) super_cache_scan (fs/super.c:221:10) do_shrink_slab (mm/shrinker.c:435:9) shrink_slab (mm/shrinker.c:626:10) shrink_node (mm/vmscan.c:5951:2) shrink_zones (mm/vmscan.c:6195:3) do_try_to_free_pages (mm/vmscan.c:6257:3) do_swap_page (mm/memory.c:4136:11) handle_pte_fault (mm/memory.c:5562:10) handle_mm_fault (mm/memory.c:5870:9) do_user_addr_fault (arch/x86/mm/fault.c:1338:10) handle_page_fault (arch/x86/mm/fault.c:1481:3) exc_page_fault (arch/x86/mm/fault.c:1539:2) asm_exc_page_fault+0x22/0x27
Fix this deadlock by allocating ff->release_args and grabbing the reference on the inode when preparing the file for release even if the server does not implement open. The inode reference will be dropped when the last reference on the fuse file is dropped (see fuse_file_put() -> fuse_release_end()).
--- fs/fuse/file.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
fs/fuse/file.c +19 -7
@@ -112,7 +112,9 @@ static void fuse_file_put(struct fuse_fistruct fuse_args *args = (ra ? &ra->args :NULL );if (!args) { -/* Do nothing when server does not implement 'open' */ +/* Do nothing when server does not implement 'opendir' */ + }else if (args->opcode ==FUSE_RELEASE && ff->fm->fc->no_open) { +fuse_release_end (ff->fm, args,0 ); }else if (sync) {fuse_simple_request (ff->fm, args);fuse_release_end (ff->fm, args,0 );
@@ -133,8 +135,17 @@ struct fuse_file *fuse_file_open(structstruct fuse_file *ff;int opcode = isdir ?FUSE_OPENDIR :FUSE_OPEN ;bool open = isdir ? !fc->no_opendir : !fc->no_open; +bool release = !isdir || open; - ff =fuse_file_alloc (fm, open); +/* +* ff->args->release_args still needs to be allocated (so we can hold an +* inode reference while there are pending inflight file operations when +* ->release() is called, see fuse_prepare_release()) even if +* fc->no_open is set else it becomes possible for reclaim to deadlock +* if while servicing the readahead request the server triggers reclaim +* and reclaim evicts the inode of the file being read ahead. +*/ + ff =fuse_file_alloc (fm, release);if (!ff)return ERR_PTR (-ENOMEM );
@@ -153,13 +164,14 @@ struct fuse_file *fuse_file_open(structfuse_file_free (ff);return ERR_PTR (err); }else { -/* No release needed */ -kfree (ff->release_args); - ff->release_args =NULL ; -if (isdir) +if (isdir) { +/* No release needed */ +kfree (ff->release_args); + ff->release_args =NULL ; fc->no_opendir =1 ; -else + }else { fc->no_open =1 ; + } } }
Greg Kroah-Hartman
maintainerPATCH 450/554 ARM: dts: microchip: sama7g5: fix uart fifo size to 32
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
[ Upstream commit 5654889a94b0de5ad6ceae3793e7f5e0b61b50b6 ]
On some flexcom nodes related to uart, the fifo sizes were wrong: fix them to 32 data.
--- arch/arm/boot/dts/sama7g5.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/sama7g5.dtsi +2 -2
@@ -375,7 +375,7 @@ dma-names = "tx", "rx"; atmel,use-dma-rx; atmel,use-dma-tx; - atmel,fifo-size = <16>; + atmel,fifo-size = <32>; status = "disabled"; }; };
@@ -400,7 +400,7 @@ dma-names = "tx", "rx"; atmel,use-dma-rx; atmel,use-dma-tx; - atmel,fifo-size = <16>; + atmel,fifo-size = <32>; status = "disabled"; }; };
Greg Kroah-Hartman
maintainerPATCH 451/554 svcrdma: bound check rq_pages index in inline path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <[email protected]>
[ Upstream commit d1bea0ce35b6095544ee82bb54156fc62c067e58 ]
svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page.
--- net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 +++ 1 file changed, 3 insertions(+)
net/sunrpc/xprtrdma/svc_rdma_rw.c +3 -0
@@ -789,6 +789,9 @@ static int svc_rdma_copy_inline_range(stfor (page_no =0 ; page_no < numpages; page_no++) {unsigned int page_len; +if (info->ri_pageno >=RPCSVC_MAXPAGES ) +return -EINVAL ; + page_len = min_t(unsigned int, remaining,PAGE_SIZE - info->ri_pageoff);
Greg Kroah-Hartman
maintainerPATCH 452/554 ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
[ Upstream commit 7d5864dc5d5ea6a35983dd05295fb17f2f2f44ce ]
Unlike standalone spi peripherals, on sama5d2, the flexcom spi have fifo size of 32 data. Fix flexcom/spi nodes where this property is wrong.
--- arch/arm/boot/dts/sama5d2.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm/boot/dts/sama5d2.dtsi +5 -5
@@ -555,7 +555,7 @@ AT91_XDMAC_DT_PER_IF(1) | AT91_XDMAC_DT_PERID(12))>; dma-names = "tx", "rx"; - atmel,fifo-size = <16>; + atmel,fifo-size = <32>; status = "disabled"; };
@@ -625,7 +625,7 @@ AT91_XDMAC_DT_PER_IF(1) | AT91_XDMAC_DT_PERID(14))>; dma-names = "tx", "rx"; - atmel,fifo-size = <16>; + atmel,fifo-size = <32>; status = "disabled"; };
@@ -835,7 +835,7 @@ AT91_XDMAC_DT_PER_IF(1) | AT91_XDMAC_DT_PERID(16))>; dma-names = "tx", "rx"; - atmel,fifo-size = <16>; + atmel,fifo-size = <32>; status = "disabled"; };
@@ -925,7 +925,7 @@ AT91_XDMAC_DT_PER_IF(1) | AT91_XDMAC_DT_PERID(18))>; dma-names = "tx", "rx"; - atmel,fifo-size = <16>; + atmel,fifo-size = <32>; status = "disabled"; };
@@ -976,7 +976,7 @@ AT91_XDMAC_DT_PER_IF(1) | AT91_XDMAC_DT_PERID(20))>; dma-names = "tx", "rx"; - atmel,fifo-size = <16>; + atmel,fifo-size = <32>; status = "disabled"; };
Greg Kroah-Hartman
maintainerPATCH 453/554 crypto: af_alg - zero initialize memory allocated via sock_kmalloc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivani Agarwal <[email protected]>
[ Upstream commit 6f6e309328d53a10c0fe1f77dec2db73373179b6 ]
Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future.
The ACVP patches also contain two user-space interface files:algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures.
A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit:
67b164a871af ("crypto: af_alg - Disallow multiple in-flight AIO requests")
Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true:
https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209
The check directly tests ctx->inflight without explicitly comparing against true/false. Since inflight is only ever set to true or false later, an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by uninitialized data.
--- crypto/af_alg.c | 5 ++--- crypto/algif_hash.c | 3 +-- crypto/algif_rng.c | 3 +-- 3 files changed, 4 insertions(+), 7 deletions(-)
crypto/af_alg.c +2 -3
@@ -1139,14 +1139,13 @@ struct af_alg_async_req *af_alg_alloc_arif (unlikely (!areq))return ERR_PTR (-ENOMEM ); +memset (areq,0 , areqlen); + ctx->inflight = true; areq->areqlen = areqlen; areq->sk = sk; - areq->last_rsgl =NULL ;INIT_LIST_HEAD (&areq->rsgl_list); - areq->tsgl =NULL ; - areq->tsgl_entries =0 ;return areq; }
crypto/algif_hash.c +1 -2
@@ -423,9 +423,8 @@ static int hash_accept_parent_nokey(voidif (!ctx)return -ENOMEM ; - ctx->result =NULL ; +memset (ctx,0 , len); ctx->len = len; - ctx->more = false;crypto_init_wait (&ctx->wait); ask->private = ctx;
crypto/algif_rng.c +1 -2
@@ -250,9 +250,8 @@ static int rng_accept_parent(void *privaif (!ctx)return -ENOMEM ; +memset (ctx,0 , len); ctx->len = len; - ctx->addtl =NULL ; - ctx->addtl_len =0 ;/* * No seeding done at that point -- if multiple accepts are
Greg Kroah-Hartman
maintainerPATCH 454/554 KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Mattson <[email protected]>
[ Upstream commit 7c8b465a1c91f674655ea9cec5083744ec5f796a ]
Mark the VMCB_NPT bit as dirty in nested_vmcb02_prepare_save() on every nested VMRUN.
If L1 changes the PAT MSR between two VMRUN instructions on the same L1 vCPU, the g_pat field in the associated vmcb02 will change, and the VMCB_NPT clean bit should be cleared.
--- arch/x86/kvm/svm/nested.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/svm/nested.c +1 -0
@@ -456,6 +456,7 @@ static void nested_vmcb02_prepare_save(sbool new_vmcb12 = false;nested_vmcb02_compute_g_pat (svm); +vmcb_mark_dirty (svm->vmcb,VMCB_NPT );/* Load the nested guest state */ if (svm->nested.vmcb12_gpa != svm->nested.last_vmcb12_gpa) {
Greg Kroah-Hartman
maintainerPATCH 455/554 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <[email protected]>
[ Upstream commit d4b69a6186b215d2dc1ebcab965ed88e8d41768d ]
A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.
--- net/sunrpc/auth_gss/svcauth_gss.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/auth_gss/svcauth_gss.c +2 -1
@@ -1179,7 +1179,8 @@ static int gss_read_proxy_verf(struct sv } length = min_t(unsigned int, inlen, argv->iov_len); -memcpy (page_address (in_token->pages[0 ]), argv->iov_base, length); +if (length) +memcpy (page_address (in_token->pages[0 ]), argv->iov_base, length); inlen -= length; to_offs = length;
Greg Kroah-Hartman
maintainerPATCH 456/554 media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit cdd0f118ef87db8a664fb5ea366fd1766d2df1cd ]
vpu_get_plat_device() increases the reference count of the returned platform device. However, when devm_kzalloc() fails, the reference is not released, causing a reference leak.
Fix this by calling put_device() on fw_pdev->dev before returning on the error path.
--- drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c +3 -1
@@ -94,8 +94,10 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_vpu_wdt_reg_handler (fw_pdev, mtk_vcodec_vpu_reset_handler, dev, rst_id); fw =devm_kzalloc (&dev->plat_dev->dev,sizeof (*fw),GFP_KERNEL ); -if (!fw) +if (!fw) { +put_device (&fw_pdev->dev);return ERR_PTR (-ENOMEM ); + } fw->type =VPU ; fw->ops = &mtk_vcodec_vpu_msg; fw->pdev = fw_pdev;
Greg Kroah-Hartman
maintainerPATCH 457/554 media: vpif_capture: fix section mismatch
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 0ef841113724166c3c484d0e9ae6db1eb5634fde ]
Platform drivers can be probed after their init sections have been discarded (e.g. on probe deferral or manual rebind through sysfs) so the probe function must not live in init.
Note that commit ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section mismatch warning") incorrectly suppressed the modpost warning.
--- drivers/media/platform/davinci/vpif_capture.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/davinci/vpif_capture.c +2 -2
@@ -1614,7 +1614,7 @@ err_cleanup:* This creates device entries by register itself to the V4L2 driver and * initializes fields of each channel objects */ -static __init int vpif_probe (struct platform_device *pdev) +static int vpif_probe (struct platform_device *pdev) {struct vpif_subdev_info *subdevdata;struct i2c_adapter *i2c_adap;
@@ -1817,7 +1817,7 @@ static int vpif_resume(struct device *de static SIMPLE_DEV_PM_OPS(vpif_pm_ops, vpif_suspend, vpif_resume); -static __refdata struct platform_driver vpif_driver = { +static struct platform_driver vpif_driver = { .driver = { .name =VPIF_DRIVER_NAME , .pm = &vpif_pm_ops,
Greg Kroah-Hartman
maintainerPATCH 458/554 media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dufresne <[email protected]>
[ Upstream commit 47825b1646a6a9eca0f90baa3d4f98947c2add96 ]
Fix the Hantro G2 HEVC decoder so that we use DPB index 0 whenever a ninvalid index is received from user space. This protects the hardware from doing faulty memory access which then leads to bus errors.
To be noted that when a reference is missing, userspace such as GStreamer passes an invalid DPB index of 255. This issue was found by seeking to a CRA picture using GStreamer. The framework is currently missing the code to skip over RASL pictures placed after the CRA. This situation can also occur while doing live streaming over lossy transport.
--- drivers/staging/media/hantro/hantro_g2_hevc_dec.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/staging/media/hantro/hantro_g2_hevc_dec.c +13 -2
@@ -264,6 +264,15 @@ static void set_params(struct hantro_ctxhantro_reg_write (vpu, &g2_apf_threshold,8 ); } +static u32 get_dpb_index (const struct v4l2_ctrl_hevc_decode_params *decode_params, +const u32 index) +{ +if (index > decode_params->num_active_dpb_entries) +return 0 ; + +return index; +} +static void set_ref_pic_list (struct hantro_ctx *ctx) {const struct hantro_hevc_dec_ctrls *ctrls = &ctx->hevc_dec.ctrls;
@@ -336,8 +345,10 @@ static void set_ref_pic_list(struct hant list1[j++] = list1[i++];for (i =0 ; i <V4L2_HEVC_DPB_ENTRIES_NUM_MAX ; i++) { -hantro_reg_write (vpu, &ref_pic_regs0[i], list0[i]); -hantro_reg_write (vpu, &ref_pic_regs1[i], list1[i]); +hantro_reg_write (vpu, &ref_pic_regs0[i], +get_dpb_index (decode_params, list0[i])); +hantro_reg_write (vpu, &ref_pic_regs1[i], +get_dpb_index (decode_params, list1[i])); } }
Greg Kroah-Hartman
maintainerPATCH 459/554 NFSD: NFSv4 file creation neglects setting ACL
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 913f7cf77bf14c13cfea70e89bcb6d0b22239562 ]
An NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL afterwards, and finds that it is only a default ACL (based on the mode bits) and not the ACL that was requested during file creation. This violates RFC 8881 section 6.4.1.3: "the ACL attribute is set as given".
The issue occurs in nfsd_create_setattr(). On 6.1.y, the check to determine whether nfsd_setattr() should be called is simply "iap->ia_valid", which only accounts for iattr changes. When only an ACL is present (and no iattr fields are set), nfsd_setattr() is skipped and the POSIX ACL is never applied to the inode.
Subsequently, when the client retrieves the ACL, the server finds no POSIX ACL on the inode and returns one generated from the file's mode bits rather than returning the originally-specified ACL.
--- fs/nfsd/vfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/vfs.c +1 -1
@@ -1319,7 +1319,7 @@ nfsd_create_setattr(struct svc_rqst *rqs* Callers expect new file metadata to be committed even * if the attributes have not changed. */ -if (iap->ia_valid) +if (iap->ia_valid || attrs->na_pacl || attrs->na_dpacl) status =nfsd_setattr (rqstp, resfhp, attrs,0 , (time64_t )0 );else status =nfserrno (commit_metadata (resfhp));
Greg Kroah-Hartman
maintainerPATCH 460/554 media: samsung: exynos4-is: fix potential ABBA deadlock on init
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
[ Upstream commit 17dc8ccd6dd5ffe30aa9b0d36e2af1389344ce2b ]
v4l2_device_register_subdev_nodes() must called without taking media_dev->graph_mutex to avoid potential AB-BA deadlock on further subdevice driver initialization.
--- drivers/media/platform/exynos4-is/media-dev.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/media/platform/exynos4-is/media-dev.c +6 -4
@@ -1411,12 +1411,14 @@ static int subdev_notifier_complete(strumutex_lock (&fmd->media_dev.graph_mutex); ret =fimc_md_create_links (fmd); -if (ret <0 ) - goto unlock; +if (ret <0 ) { +mutex_unlock (&fmd->media_dev.graph_mutex); +return ret; + } - ret =v4l2_device_register_subdev_nodes (&fmd->v4l2_dev); -unlock:mutex_unlock (&fmd->media_dev.graph_mutex); + + ret =v4l2_device_register_subdev_nodes (&fmd->v4l2_dev);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 461/554 media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit 445e1658894fd74eab7e53071fa16233887574ed ]
The function calls of_parse_phandle() which returns
a device node with an incremented reference count. When the bonded device is not available, the function
returns NULL without releasing the reference, causing a reference leak.
Add of_node_put(np) to release the device node reference. The of_node_put function handles NULL pointers.
Found through static analysis by reviewing the doc of of_parse_phandle() and cross-checking its usage patterns across the codebase.
--- drivers/media/platform/rcar_drif.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/rcar_drif.c +1 -0
@@ -1253,6 +1253,7 @@ static struct device_node *rcar_drif_bonif (np &&of_device_is_available (np))return np; +of_node_put (np);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 462/554 powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit fc6bcf9ac4de76f5e7bcd020b3c0a86faff3f2d5 ]
Patch series "powerpc/pseries/cmm: two smaller fixes".
Two smaller fixes identified while doing a bigger rework.
This patch (of 2):
We always have to initialize the balloon_dev_info, even when compaction is not configured in: otherwise the containing list and the lock are left uninitialized.
Likely not many such configs exist in practice, but let's CC stable to be sure.
This was found by code inspection.
--- arch/powerpc/platforms/pseries/cmm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/cmm.c +1 -1
@@ -570,7 +570,6 @@ static int cmm_balloon_compaction_init(v {int rc; -balloon_devinfo_init (&b_dev_info); b_dev_info.migratepage = cmm_migratepage; balloon_mnt =kern_mount (&balloon_fs);
@@ -624,6 +623,7 @@ static int cmm_init(void)if (!firmware_has_feature (FW_FEATURE_CMO ) && !simulate)return -EOPNOTSUPP ; +balloon_devinfo_init (&b_dev_info); rc =cmm_balloon_compaction_init ();if (rc)return rc;
Greg Kroah-Hartman
maintainerPATCH 463/554 PCI: brcmstb: Fix disabling L0s capability
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 9583f9d22991d2cfb5cc59a2552040c4ae98d998 ]
caab002d5069 ("PCI: brcmstb: Disable L0s component of ASPM if requested") set PCI_EXP_LNKCAP_ASPM_L1 and (optionally) PCI_EXP_LNKCAP_ASPM_L0S in PCI_EXP_LNKCAP (aka PCIE_RC_CFG_PRIV1_LINK_CAPABILITY in brcmstb).
But instead of using PCI_EXP_LNKCAP_ASPM_L1 and PCI_EXP_LNKCAP_ASPM_L0S directly, it used PCIE_LINK_STATE_L1 and PCIE_LINK_STATE_L0S, which are Linux-created values that only coincidentally matched the PCIe spec. b478e162f227 ("PCI/ASPM: Consolidate link state defines") later changed them so they no longer matched the PCIe spec, so the bits ended up in the wrong place in PCI_EXP_LNKCAP.
Use PCI_EXP_LNKCAP_ASPM_L0S to clear L0s support when there's an 'aspm-no-l0s' property. Rely on brcmstb hardware to advertise L0s and/or L1 support otherwise.
--- drivers/pci/controller/pcie-brcmstb.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +3 -7
@@ -44,7 +44,6 @@#define PCIE_RC_CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK 0xffffff#define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY 0x04dc -#define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK 0xc00#define PCIE_RC_DL_MDIO_ADDR 0x1100#define PCIE_RC_DL_MDIO_WR_DATA 0x1104
@@ -873,7 +872,7 @@ static int brcm_pcie_setup(struct brcm_pint num_out_wins =0 ;u16 nlw, cls, lnksta;int i, ret, memc; -u32 tmp, burst, aspm_support; +u32 tmp, burst;/* Reset the bridge */ pcie->bridge_sw_init_set (pcie,1 );
@@ -995,12 +994,9 @@ static int brcm_pcie_setup(struct brcm_p }/* Don't advertise L0s capability if 'aspm-no-l0s' */ - aspm_support =PCIE_LINK_STATE_L1 ; -if (!of_property_read_bool (pcie->np,"aspm-no-l0s" )) - aspm_support |=PCIE_LINK_STATE_L0S ; tmp =readl (base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); -u32p_replace_bits (&tmp, aspm_support, -PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK ); +if (of_property_read_bool (pcie->np,"aspm-no-l0s" )) + tmp &= ~PCI_EXP_LNKCAP_ASPM_L0S ;writel (tmp, base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY );/*
Greg Kroah-Hartman
maintainerPATCH 464/554 powerpc/64s/slb: Fix SLB multihit issue during SLB preload
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 00312419f0863964625d6dcda8183f96849412c6 ]
On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache is subject to periodic eviction — typically after every 256 context switches — to remove old entry.
To optimize performance, the kernel skips switch_mmu_context() in switch_mm_irqs_off() when the prev and next mm_struct are the same. However, on hash MMU systems, this can lead to inconsistencies between the hardware SLB and the software preload cache.
If an SLB entry for a process is evicted from the software cache on one CPU, and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. If the kernel then attempts to reload that entry, it can trigger an SLB multi-hit error.
The following timeline shows how stale SLB entries are created and can cause a multi-hit error when a process moves between CPUs without a MMU context switch.
CPU 0 CPU 1
----- -----
Process P
exec swapper/1
load_elf_binary
begin_new_exc
activate_mm
switch_mm_irqs_off
switch_mmu_context
switch_slb
/*
* This invalidates all
* the entries in the HW
* and setup the new HW
* SLB entries as per the
* preload cache.
*/context_switchsched_migrate_task migrates process P to cpu-1
Process swapper/0 context switch (to process P)
(uses mm_struct of Process P) switch_mm_irqs_off()
switch_slb
load_slb++
/*
* load_slb becomes 0 here
* and we evict an entry from
* the preload cache with
* preload_age(). We still
* keep HW SLB and preload
* cache in sync, that is
* because all HW SLB entries
* anyways gets evicted in
* switch_slb during SLBIA.
* We then only add those
* entries back in HW SLB,
* which are currently
* present in preload_cache
* (after eviction). */
load_elf_binary continues...
setup_new_exec()
slb_setup_new_exec()
sched_switch event sched_migrate_task migrates process P to cpu-0
context_switch from swapper/0 to Process P
switch_mm_irqs_off()
/*
* Since both prev and next mm struct are same we don't call
* switch_mmu_context(). This will cause the HW SLB and SW preload
* cache to go out of sync in preload_new_slb_context. Because there
* was an SLB entry which was evicted from both HW and preload cache
* on cpu-1. Now later in preload_new_slb_context(), when we will try
* to add the same preload entry again, we will add this to the SW
* preload cache and then will add it to the HW SLB. Since on cpu-0
* this entry was never invalidated, hence adding this entry to the HW
* SLB will cause a SLB multi-hit error.
*/load_elf_binary continues...
START_THREAD
start_thread
preload_new_slb_context
/*
* This tries to add a new EA to preload cache which was earlier
* evicted from both cpu-1 HW SLB and preload cache. This caused the
* HW SLB of cpu-0 to go out of sync with the SW preload cache. The
* reason for this was, that when we context switched back on CPU-0,
* we should have ideally called switch_mmu_context() which will
* bring the HW SLB entries on CPU-0 in sync with SW preload cache
* entries by setting up the mmu context properly. But we didn't do
* that since the prev mm_struct running on cpu-0 was same as the
* next mm_struct (which is true for swapper / kernel threads). So
* now when we try to add this new entry into the HW SLB of cpu-0,
* we hit a SLB multi-hit error.
*/
WARNING: CPU: 0 PID: 1810970 at arch/powerpc/mm/book3s64/slb.c:62 assert_slb_presence+0x2c/0x50(48 results) 02:47:29 [20157/42149] Modules linked in: CPU: 0 UID: 0 PID: 1810970 Comm: dd Not tainted 6.16.0-rc3-dirty #12 VOLUNTARY Hardware name: IBM pSeries (emulated by qemu) POWER8 (architected) 0x4d0200 0xf000004 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c00000000015426c LR: c0000000001543b4 CTR: 0000000000000000 REGS: c0000000497c77e0 TRAP: 0700 Not tainted (6.16.0-rc3-dirty) MSR: 8000000002823033 <SF,VEC,VSX,FP,ME,IR,DR,RI,LE> CR: 28888482 XER: 00000000 CFAR: c0000000001543b0 IRQMASK: 3 <...> NIP [c00000000015426c] assert_slb_presence+0x2c/0x50 LR [c0000000001543b4] slb_insert_entry+0x124/0x390 Call Trace: 0x7fffceb5ffff (unreliable) preload_new_slb_context+0x100/0x1a0 start_thread+0x26c/0x420 load_elf_binary+0x1b04/0x1c40 bprm_execve+0x358/0x680 do_execveat_common+0x1f8/0x240 sys_execve+0x58/0x70 system_call_exception+0x114/0x300 system_call_common+0x160/0x2c4
Quoted 1 line
Quoted 1 line
From the above analysis, during early exec the hardware SLB is cleared,
and entries from the software preload cache are reloaded into hardware by switch_slb. However, preload_new_slb_context and slb_setup_new_exec also attempt to load some of the same entries, which can trigger a multi-hit. In most cases, these additional preloads simply hit existing entries and add nothing new. Removing these functions avoids redundant preloads and eliminates the multi-hit issue. This patch removes these two functions.
We tested process switching performance using the context_switch benchmark on POWER9/hash, and observed no regression.
Without this patch: 129041 ops/sec With this patch: 129341 ops/sec
We also measured SLB faults during boot, and the counts are essentially the same with and without this patch.
SLB faults without this patch: 19727 SLB faults with this patch: 19786
--- arch/powerpc/include/asm/book3s/64/mmu-hash.h | 1 arch/powerpc/kernel/process.c | 5 - arch/powerpc/mm/book3s64/internal.h | 1 arch/powerpc/mm/book3s64/mmu_context.c | 2 arch/powerpc/mm/book3s64/slb.c | 88 -------------------------- 5 files changed, 97 deletions(-)
arch/powerpc/include/asm/book3s/64/mmu-hash.h +0 -1
@@ -524,7 +524,6 @@ void slb_dump_contents(struct slb_entryextern void slb_vmalloc_update (void );extern void slb_set_size (u16 size); -void preload_new_slb_context (unsigned long start,unsigned long sp);#endif /* __ASSEMBLY__ */ /*
arch/powerpc/kernel/process.c +0 -5
@@ -1794,8 +1794,6 @@ int copy_thread(unsigned long clone_flagreturn 0 ; } -void preload_new_slb_context (unsigned long start,unsigned long sp); -/* * Set up a thread for executing a new program */
@@ -1803,9 +1801,6 @@ void start_thread(struct pt_regs *regs, {#ifdef CONFIG_PPC64 unsigned long load_addr = regs->gpr[2 ];/* saved by ELF_PLAT_INIT */ - -if (IS_ENABLED (CONFIG_PPC_BOOK3S_64 ) && !radix_enabled ()) -preload_new_slb_context (start, sp);#endif #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
arch/powerpc/mm/book3s64/internal.h +0 -1
@@ -13,7 +13,6 @@ static inline bool stress_slb(void)return static_branch_unlikely (&stress_slb_key); } -void slb_setup_new_exec (void );void exit_lazy_flush_tlb (struct mm_struct *mm,bool always_flush);
arch/powerpc/mm/book3s64/mmu_context.c +0 -2
@@ -147,8 +147,6 @@ static int hash__init_new_context(structvoid hash__setup_new_exec (void ) {slice_setup_new_exec (); - -slb_setup_new_exec (); }static int radix__init_new_context (struct mm_struct *mm)
arch/powerpc/mm/book3s64/slb.c +0 -88
94 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 465/554 iommu/qcom: fix device leak on of_xlate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 6a3908ce56e6879920b44ef136252b2f0c954194 ]
Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
Note that commit e2eae09939a8 ("iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success and late failures.
--- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/iommu/arm/arm-smmu/qcom_iommu.c +4 -6
@@ -568,15 +568,15 @@ static int qcom_iommu_of_xlate(struct de qcom_iommu =platform_get_drvdata (iommu_pdev); +put_device (&iommu_pdev->dev); +/* make sure the asid specified in dt is valid, so we don't have * to sanity check this elsewhere, since 'asid - 1' is used to * index into qcom_iommu->ctxs: */ if (WARN_ON (asid <1 ) || -WARN_ON (asid > qcom_iommu->num_ctxs)) { -put_device (&iommu_pdev->dev); +WARN_ON (asid > qcom_iommu->num_ctxs))return -EINVAL ; - }if (!dev_iommu_priv_get (dev)) {dev_iommu_priv_set (dev, qcom_iommu);
@@ -585,10 +585,8 @@ static int qcom_iommu_of_xlate(struct de* multiple different iommu devices. Multiple context * banks are ok, but multiple devices are not: */ -if (WARN_ON (qcom_iommu !=dev_iommu_priv_get (dev))) { -put_device (&iommu_pdev->dev); +if (WARN_ON (qcom_iommu !=dev_iommu_priv_get (dev)))return -EINVAL ; - } }return iommu_fwspec_add_ids (dev, &asid,1 );
Greg Kroah-Hartman
maintainerPATCH 466/554 r8169: fix RTL8117 Wake-on-Lan in DASH mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: René Rebe <[email protected]>
[ Upstream commit dd75c723ef566f7f009c047f47e0eee95fe348ab ]
Wake-on-Lan does currently not work for r8169 in DASH mode, e.g. the ASUS Pro WS X570-ACE with RTL8168fp/RTL8117.
Fix by not returning early in rtl_prepare_power_down when dash_enabled. While this fixes WoL, it still kills the OOB RTL8117 remote management BMC connection. Fix by not calling rtl8168_driver_stop if WoL is enabled.
--- drivers/net/ethernet/realtek/r8169_main.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +1 -4
@@ -2513,9 +2513,6 @@ static void rtl_wol_enable_rx(struct rtlstatic void rtl_prepare_power_down (struct rtl8169_private *tp) { -if (tp->dash_type !=RTL_DASH_NONE ) -return ; -if (tp->mac_version ==RTL_GIGA_MAC_VER_32 || tp->mac_version ==RTL_GIGA_MAC_VER_33 )rtl_ephy_write (tp,0x19 ,0xff64 );
@@ -4763,7 +4760,7 @@ static void rtl8169_down(struct rtl8169_rtl_prepare_power_down (tp); -if (tp->dash_type !=RTL_DASH_NONE ) +if (tp->dash_type !=RTL_DASH_NONE && !tp->saved_wolopts)rtl8168_driver_stop (tp); }
Greg Kroah-Hartman
maintainerPATCH 467/554 ASoC: stm: Use dev_err_probe() helper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit efc162cbd480f1fb47d439c193ec9731bcc6c749 ]
Use the dev_err_probe() helper, instead of open-coding the same operation.
Stable-dep-of: 312ec2f0d9d1 ("ASoC: stm32: sai: fix clk prepare imbalance on probe failure")
--- sound/soc/stm/stm32_i2s.c | 62 ++++++++++++++---------------------------- sound/soc/stm/stm32_sai.c | 37 ++++++++----------------- sound/soc/stm/stm32_sai_sub.c | 25 +++++----------- sound/soc/stm/stm32_spdifrx.c | 44 ++++++++++------------------- 4 files changed, 57 insertions(+), 111 deletions(-)
sound/soc/stm/stm32_i2s.c +21 -41
@@ -1044,36 +1044,24 @@ static int stm32_i2s_parse_dt(struct pla/* Get clocks */ i2s->pclk =devm_clk_get (&pdev->dev,"pclk" ); -if (IS_ERR (i2s->pclk)) { -if (PTR_ERR (i2s->pclk) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Could not get pclk: %ld\n" , -PTR_ERR (i2s->pclk)); -return PTR_ERR (i2s->pclk); - } +if (IS_ERR (i2s->pclk)) +return dev_err_probe (&pdev->dev,PTR_ERR (i2s->pclk), +"Could not get pclk\n" ); i2s->i2sclk =devm_clk_get (&pdev->dev,"i2sclk" ); -if (IS_ERR (i2s->i2sclk)) { -if (PTR_ERR (i2s->i2sclk) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Could not get i2sclk: %ld\n" , -PTR_ERR (i2s->i2sclk)); -return PTR_ERR (i2s->i2sclk); - } +if (IS_ERR (i2s->i2sclk)) +return dev_err_probe (&pdev->dev,PTR_ERR (i2s->i2sclk), +"Could not get i2sclk\n" ); i2s->x8kclk =devm_clk_get (&pdev->dev,"x8k" ); -if (IS_ERR (i2s->x8kclk)) { -if (PTR_ERR (i2s->x8kclk) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Could not get x8k parent clock: %ld\n" , -PTR_ERR (i2s->x8kclk)); -return PTR_ERR (i2s->x8kclk); - } +if (IS_ERR (i2s->x8kclk)) +return dev_err_probe (&pdev->dev,PTR_ERR (i2s->x8kclk), +"Could not get x8k parent clock\n" ); i2s->x11kclk =devm_clk_get (&pdev->dev,"x11k" ); -if (IS_ERR (i2s->x11kclk)) { -if (PTR_ERR (i2s->x11kclk) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Could not get x11k parent clock: %ld\n" , -PTR_ERR (i2s->x11kclk)); -return PTR_ERR (i2s->x11kclk); - } +if (IS_ERR (i2s->x11kclk)) +return dev_err_probe (&pdev->dev,PTR_ERR (i2s->x11kclk), +"Could not get x11k parent clock\n" );/* Register mclk provider if requested */ if (of_find_property (np,"#clock-cells" ,NULL )) {
@@ -1096,12 +1084,10 @@ static int stm32_i2s_parse_dt(struct pla/* Reset */ rst =devm_reset_control_get_optional_exclusive (&pdev->dev,NULL ); -if (IS_ERR (rst)) { -if (PTR_ERR (rst) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Reset controller error %ld\n" , -PTR_ERR (rst)); -return PTR_ERR (rst); - } +if (IS_ERR (rst)) +return dev_err_probe (&pdev->dev,PTR_ERR (rst), +"Reset controller error\n" ); +reset_control_assert (rst);udelay (2 );reset_control_deassert (rst);
@@ -1143,19 +1129,13 @@ static int stm32_i2s_probe(struct platfo i2s->regmap =devm_regmap_init_mmio_clk (&pdev->dev,"pclk" , i2s->base, i2s->regmap_conf); -if (IS_ERR (i2s->regmap)) { -if (PTR_ERR (i2s->regmap) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Regmap init error %ld\n" , -PTR_ERR (i2s->regmap)); -return PTR_ERR (i2s->regmap); - } +if (IS_ERR (i2s->regmap)) +return dev_err_probe (&pdev->dev,PTR_ERR (i2s->regmap), +"Regmap init error\n" ); ret =snd_dmaengine_pcm_register (&pdev->dev, &stm32_i2s_pcm_config,0 ); -if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"PCM DMA register error %d\n" , ret); -return ret; - } +if (ret) +return dev_err_probe (&pdev->dev, ret,"PCM DMA register error\n" ); ret =snd_soc_register_component (&pdev->dev, &stm32_i2s_component, i2s->dai_drv,1 );
sound/soc/stm/stm32_sai.c +13 -24
@@ -173,29 +173,20 @@ static int stm32_sai_probe(struct platfoif (!STM_SAI_IS_F4 (sai)) { sai->pclk =devm_clk_get (&pdev->dev,"pclk" ); -if (IS_ERR (sai->pclk)) { -if (PTR_ERR (sai->pclk) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"missing bus clock pclk: %ld\n" , -PTR_ERR (sai->pclk)); -return PTR_ERR (sai->pclk); - } +if (IS_ERR (sai->pclk)) +return dev_err_probe (&pdev->dev,PTR_ERR (sai->pclk), +"missing bus clock pclk\n" ); } sai->clk_x8k =devm_clk_get (&pdev->dev,"x8k" ); -if (IS_ERR (sai->clk_x8k)) { -if (PTR_ERR (sai->clk_x8k) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"missing x8k parent clock: %ld\n" , -PTR_ERR (sai->clk_x8k)); -return PTR_ERR (sai->clk_x8k); - } +if (IS_ERR (sai->clk_x8k)) +return dev_err_probe (&pdev->dev,PTR_ERR (sai->clk_x8k), +"missing x8k parent clock\n" ); sai->clk_x11k =devm_clk_get (&pdev->dev,"x11k" ); -if (IS_ERR (sai->clk_x11k)) { -if (PTR_ERR (sai->clk_x11k) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"missing x11k parent clock: %ld\n" , -PTR_ERR (sai->clk_x11k)); -return PTR_ERR (sai->clk_x11k); - } +if (IS_ERR (sai->clk_x11k)) +return dev_err_probe (&pdev->dev,PTR_ERR (sai->clk_x11k), +"missing x11k parent clock\n" );/* init irqs */ sai->irq =platform_get_irq (pdev,0 );
@@ -204,12 +195,10 @@ static int stm32_sai_probe(struct platfo/* reset */ rst =devm_reset_control_get_optional_exclusive (&pdev->dev,NULL ); -if (IS_ERR (rst)) { -if (PTR_ERR (rst) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Reset controller error %ld\n" , -PTR_ERR (rst)); -return PTR_ERR (rst); - } +if (IS_ERR (rst)) +return dev_err_probe (&pdev->dev,PTR_ERR (rst), +"Reset controller error\n" ); +reset_control_assert (rst);udelay (2 );reset_control_deassert (rst);
sound/soc/stm/stm32_sai_sub.c +8 -17
@@ -1379,12 +1379,9 @@ static int stm32_sai_sub_parse_of(struct*/ sai->regmap =devm_regmap_init_mmio (&pdev->dev, base, sai->regmap_config); -if (IS_ERR (sai->regmap)) { -if (PTR_ERR (sai->regmap) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Regmap init error %ld\n" , -PTR_ERR (sai->regmap)); -return PTR_ERR (sai->regmap); - } +if (IS_ERR (sai->regmap)) +return dev_err_probe (&pdev->dev,PTR_ERR (sai->regmap), +"Regmap init error\n" );/* Get direction property */ if (of_property_match_string (np,"dma-names" ,"tx" ) >=0 ) {
@@ -1472,12 +1469,9 @@ static int stm32_sai_sub_parse_of(structof_node_put (args.np); sai->sai_ck =devm_clk_get (&pdev->dev,"sai_ck" ); -if (IS_ERR (sai->sai_ck)) { -if (PTR_ERR (sai->sai_ck) != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Missing kernel clock sai_ck: %ld\n" , -PTR_ERR (sai->sai_ck)); -return PTR_ERR (sai->sai_ck); - } +if (IS_ERR (sai->sai_ck)) +return dev_err_probe (&pdev->dev,PTR_ERR (sai->sai_ck), +"Missing kernel clock sai_ck\n" ); ret =clk_prepare (sai->pdata->pclk);if (ret <0 )
@@ -1551,11 +1545,8 @@ static int stm32_sai_sub_probe(struct pl conf = &stm32_sai_pcm_config_spdif; ret =snd_dmaengine_pcm_register (&pdev->dev, conf,0 ); -if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Could not register pcm dma\n" ); -return ret; - } +if (ret) +return dev_err_probe (&pdev->dev, ret,"Could not register pcm dma\n" ); ret =snd_soc_register_component (&pdev->dev, &stm32_component, &sai->cpu_dai_drv,1 );
sound/soc/stm/stm32_spdifrx.c +15 -29
74 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 468/554 ASoC: stm32: sai: Use the devm_clk_get_optional() helper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 374628fb668e50b42fe81f2a63af616182415bcd ]
Use devm_clk_get_optional() instead of hand writing it. This saves some LoC and improves the semantic.
Stable-dep-of: 312ec2f0d9d1 ("ASoC: stm32: sai: fix clk prepare imbalance on probe failure")
--- sound/soc/stm/stm32_sai_sub.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
sound/soc/stm/stm32_sai_sub.c +3 -6
@@ -1486,12 +1486,9 @@ static int stm32_sai_sub_parse_of(structif (ret <0 )return ret; }else { - sai->sai_mclk =devm_clk_get (&pdev->dev,"MCLK" ); -if (IS_ERR (sai->sai_mclk)) { -if (PTR_ERR (sai->sai_mclk) != -ENOENT ) -return PTR_ERR (sai->sai_mclk); - sai->sai_mclk =NULL ; - } + sai->sai_mclk =devm_clk_get_optional (&pdev->dev,"MCLK" ); +if (IS_ERR (sai->sai_mclk)) +return PTR_ERR (sai->sai_mclk); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 469/554 ASoC: stm32: sai: fix clk prepare imbalance on probe failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 312ec2f0d9d1a5656f76d770bbf1d967e9289aa7 ]
Make sure to unprepare the parent clock also on probe failures (e.g. probe deferral).
--- sound/soc/stm/stm32_sai_sub.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
sound/soc/stm/stm32_sai_sub.c +21 -7
@@ -1484,14 +1484,21 @@ static int stm32_sai_sub_parse_of(structif (of_find_property (np,"#clock-cells" ,NULL )) { ret =stm32_sai_add_mclk_provider (sai);if (ret <0 ) -return ret; + goto err_unprepare_pclk; }else { sai->sai_mclk =devm_clk_get_optional (&pdev->dev,"MCLK" ); -if (IS_ERR (sai->sai_mclk)) -return PTR_ERR (sai->sai_mclk); +if (IS_ERR (sai->sai_mclk)) { + ret =PTR_ERR (sai->sai_mclk); + goto err_unprepare_pclk; + } }return 0 ; + +err_unprepare_pclk: +clk_unprepare (sai->pdata->pclk); + +return ret; }static int stm32_sai_sub_probe (struct platform_device *pdev)
@@ -1535,26 +1542,33 @@ static int stm32_sai_sub_probe(struct pl IRQF_SHARED, dev_name(&pdev->dev), sai);if (ret) {dev_err (&pdev->dev,"IRQ request returned %d\n" , ret); -return ret; + goto err_unprepare_pclk; }if (STM_SAI_PROTOCOL_IS_SPDIF (sai)) conf = &stm32_sai_pcm_config_spdif; ret =snd_dmaengine_pcm_register (&pdev->dev, conf,0 ); -if (ret) -return dev_err_probe (&pdev->dev, ret,"Could not register pcm dma\n" ); +if (ret) { + ret =dev_err_probe (&pdev->dev, ret,"Could not register pcm dma\n" ); + goto err_unprepare_pclk; + } ret =snd_soc_register_component (&pdev->dev, &stm32_component, &sai->cpu_dai_drv,1 );if (ret) {snd_dmaengine_pcm_unregister (&pdev->dev); -return ret; + goto err_unprepare_pclk; }pm_runtime_enable (&pdev->dev);return 0 ; + +err_unprepare_pclk: +clk_unprepare (sai->pdata->pclk); + +return ret; }static int stm32_sai_sub_remove (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 470/554 mm/balloon_compaction: make balloon page compaction callbacks static
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaohe Lin <[email protected]>
[ Upstream commit 504c1cabe325df65c18ef38365ddd1a41c6b591b ]
Since commit b1123ea6d3b3 ("mm: balloon: use general non-lru movable page feature"), these functions are called via balloon_aops callbacks. They're not called directly outside this file. So make them static and clean up the relevant code.
Stable-dep-of: 0da2ba35c0d5 ("powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages")
--- include/linux/balloon_compaction.h | 22 ---------------------- mm/balloon_compaction.c | 6 +++--- 2 files changed, 3 insertions(+), 25 deletions(-)
include/linux/balloon_compaction.h +0 -22
@@ -80,12 +80,6 @@ static inline void balloon_devinfo_init(#ifdef CONFIG_BALLOON_COMPACTION extern const struct address_space_operations balloon_aops; -extern bool balloon_page_isolate (struct page *page, -isolate_mode_t mode); -extern void balloon_page_putback (struct page *page); -extern int balloon_page_migrate (struct address_space *mapping, -struct page *newpage, -struct page *page,enum migrate_mode mode);/* * balloon_page_insert - insert a page into the balloon's page list and make
@@ -155,22 +149,6 @@ static inline void balloon_page_delete(slist_del (&page->lru); } -static inline bool balloon_page_isolate (struct page *page) -{ -return false; -} - -static inline void balloon_page_putback (struct page *page) -{ -return ; -} - -static inline int balloon_page_migrate (struct page *newpage, -struct page *page,enum migrate_mode mode) -{ -return 0 ; -} -static inline gfp_t balloon_mapping_gfp_mask (void ) {return GFP_HIGHUSER ;
mm/balloon_compaction.c +3 -3
@@ -203,7 +203,7 @@ EXPORT_SYMBOL_GPL(balloon_page_dequeue);#ifdef CONFIG_BALLOON_COMPACTION -bool balloon_page_isolate (struct page *page,isolate_mode_t mode) +static bool balloon_page_isolate (struct page *page,isolate_mode_t mode) {struct balloon_dev_info *b_dev_info =balloon_page_device (page);
@@ -217,7 +217,7 @@ bool balloon_page_isolate(struct page *preturn true; } -void balloon_page_putback (struct page *page) +static void balloon_page_putback (struct page *page) {struct balloon_dev_info *b_dev_info =balloon_page_device (page);unsigned long flags;
@@ -230,7 +230,7 @@ void balloon_page_putback(struct page *p/* move_to_new_page() counterpart for a ballooned page */ -int balloon_page_migrate (struct address_space *mapping, +static int balloon_page_migrate (struct address_space *mapping,struct page *newpage,struct page *page,enum migrate_mode mode) {
Greg Kroah-Hartman
maintainerPATCH 471/554 mm/balloon_compaction: we cannot have isolated pages in the balloon list
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit fb05f992b6bbb4702307d96f00703ee637b24dbf ]
Patch series "mm/migration: rework movable_ops page migration (part 1)", v2.
In the future, as we decouple "struct page" from "struct folio", pages that support "non-lru page migration" -- movable_ops page migration such as memory balloons and zsmalloc -- will no longer be folios. They will not have ->mapping, ->lru, and likely no refcount and no page lock. But they will have a type and flags 🙂
This is the first part (other parts not written yet) of decoupling movable_ops page migration from folio migration.
In this series, we get rid of the ->mapping usage, and start cleaning up the code + separating it from folio migration.
Migration core will have to be further reworked to not treat movable_ops pages like folios. This is the first step into that direction.
This patch (of 29):
The core will set PG_isolated only after mops->isolate_page() was called. In case of the balloon, that is where we will remove it from the balloon list. So we cannot have isolated pages in the balloon list.
Let's drop this unnecessary check.
Stable-dep-of: 0da2ba35c0d5 ("powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages")
--- mm/balloon_compaction.c | 6 ------ 1 file changed, 6 deletions(-)
mm/balloon_compaction.c +0 -6
@@ -93,12 +93,6 @@ size_t balloon_page_list_dequeue(structif (!trylock_page (page))continue ; -if (IS_ENABLED (CONFIG_BALLOON_COMPACTION ) && -PageIsolated (page)) { -/* raced with isolation */ -unlock_page (page); -continue ; - }balloon_page_delete (page);__count_vm_event (BALLOON_DEFLATE );list_add (&page->lru, pages);
Greg Kroah-Hartman
maintainerPATCH 472/554 mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 15504b1163007bbfbd9a63460d5c14737c16e96d ]
Let's move the removal of the page from the balloon list into the single caller, to remove the dependency on the PG_isolated flag and clarify locking requirements.
Note that for now, balloon_page_delete() was used on two paths:
(1) Removing a page from the balloon for deflation through balloon_page_list_dequeue()
(2) Removing an isolated page from the balloon for migration in the per-driver migration handlers. Isolated pages were already removed from the balloon list during isolation.
So instead of relying on the flag, we can just distinguish both cases directly and handle it accordingly in the caller.
We'll shuffle the operations a bit such that they logically make more sense (e.g., remove from the list before clearing flags).
In balloon migration functions we can now move the balloon_page_finalize() out of the balloon lock and perform the finalization just before dropping the balloon reference.
Document that the page lock is currently required when modifying the movability aspects of a page; hopefully we can soon decouple this from the page lock.
Stable-dep-of: 0da2ba35c0d5 ("powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages")
--- arch/powerpc/platforms/pseries/cmm.c | 2 - drivers/misc/vmw_balloon.c | 3 -- drivers/virtio/virtio_balloon.c | 4 --- include/linux/balloon_compaction.h | 43 +++++++++++++---------------------- mm/balloon_compaction.c | 3 +- 5 files changed, 21 insertions(+), 34 deletions(-)
arch/powerpc/platforms/pseries/cmm.c +1 -1
@@ -550,7 +550,6 @@ static int cmm_migratepage(struct balloospin_lock_irqsave (&b_dev_info->pages_lock, flags);balloon_page_insert (b_dev_info, newpage); -balloon_page_delete (page); b_dev_info->isolated_pages--;spin_unlock_irqrestore (&b_dev_info->pages_lock, flags);
@@ -560,6 +559,7 @@ static int cmm_migratepage(struct balloo*/ plpar_page_set_active (page); +balloon_page_finalize (page);/* balloon page list reference */ put_page (page);
drivers/misc/vmw_balloon.c +1 -2
@@ -1805,8 +1805,7 @@ static int vmballoon_migratepage(struct* @pages_lock . We keep holding @comm_lock since we will need it in a * second. */ -balloon_page_delete (page); - +balloon_page_finalize (page);put_page (page);/* Inflate */
drivers/virtio/virtio_balloon.c +1 -3
@@ -796,15 +796,13 @@ static int virtballoon_migratepage(structell_host (vb, vb->inflate_vq);/* balloon's page migration 2nd step -- deflate "page" */ -spin_lock_irqsave (&vb_dev_info->pages_lock, flags); -balloon_page_delete (page); -spin_unlock_irqrestore (&vb_dev_info->pages_lock, flags); vb->num_pfns =VIRTIO_BALLOON_PAGES_PER_PAGE ;set_page_pfns (vb, vb->pfns, page);tell_host (vb, vb->deflate_vq);mutex_unlock (&vb->balloon_lock); +balloon_page_finalize (page);put_page (page);/* balloon reference */ return MIGRATEPAGE_SUCCESS ;
include/linux/balloon_compaction.h +16 -27
61 lines not on this page · raw message
mm/balloon_compaction.c +2 -1
@@ -93,7 +93,8 @@ size_t balloon_page_list_dequeue(structif (!trylock_page (page))continue ; -balloon_page_delete (page); +list_del (&page->lru); +balloon_page_finalize (page);__count_vm_event (BALLOON_DEFLATE );list_add (&page->lru, pages);unlock_page (page);
Greg Kroah-Hartman
maintainerPATCH 473/554 powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 0da2ba35c0d532ca0fe7af698b17d74c4d084b9a ]
Let's properly adjust BALLOON_MIGRATE like the other drivers.
Note that the INFLATE/DEFLATE events are triggered from the core when enqueueing/dequeueing pages.
This was found by code inspection.
--- arch/powerpc/platforms/pseries/cmm.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/pseries/cmm.c +1 -0
@@ -550,6 +550,7 @@ static int cmm_migratepage(struct balloospin_lock_irqsave (&b_dev_info->pages_lock, flags);balloon_page_insert (b_dev_info, newpage); +__count_vm_event (BALLOON_MIGRATE ); b_dev_info->isolated_pages--;spin_unlock_irqrestore (&b_dev_info->pages_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 474/554 pmdomain: Use device_get_match_data()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit 3ba9fdfaa550936837b50b73d6c27ac401fde875 ]
Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers.
Stable-dep-of: 73cb5f6eafb0 ("pmdomain: imx: Fix reference count leak in imx_gpc_probe()")
--- drivers/soc/actions/owl-sps.c | 16 +++++----------- drivers/soc/imx/gpc.c | 7 +++---- drivers/soc/rockchip/pm_domains.c | 13 ++++--------- 3 files changed, 12 insertions(+), 24 deletions(-)
drivers/soc/actions/owl-sps.c +5 -11
@@ -8,8 +8,10 @@* Copyright (c) 2017 Andreas Färber */ +#include <linux/mod_devicetable.h> #include <linux/of_address.h> -#include <linux/of_platform.h> +#include <linux/platform_device.h> +#include <linux/property.h> #include <linux/pm_domain.h> #include <linux/soc/actions/owl-sps.h> #include <dt-bindings/power/owl-s500-powergate.h>
@@ -96,24 +98,16 @@ static int owl_sps_init_domain(struct owstatic int owl_sps_probe (struct platform_device *pdev) { -const struct of_device_id *match;const struct owl_sps_info *sps_info;struct owl_sps *sps;int i, ret; -if (!pdev->dev.of_node) { -dev_err (&pdev->dev,"no device node\n" ); -return -ENODEV ; - } - - match =of_match_device (pdev->dev.driver->of_match_table, &pdev->dev); -if (!match || !match->data) { + sps_info =device_get_match_data (&pdev->dev); +if (!sps_info) {dev_err (&pdev->dev,"unknown compatible or missing data\n" );return -EINVAL ; } - sps_info = match->data; - sps =devm_kzalloc (&pdev->dev,struct_size (sps, domains, sps_info->num_domains),GFP_KERNEL );
drivers/soc/imx/gpc.c +3 -4
@@ -7,9 +7,10 @@#include <linux/clk.h> #include <linux/delay.h> #include <linux/io.h> -#include <linux/of_device.h> +#include <linux/of.h> #include <linux/platform_device.h> #include <linux/pm_domain.h> +#include <linux/property.h> #include <linux/regmap.h> #include <linux/regulator/consumer.h>
@@ -403,9 +404,7 @@ clk_err:static int imx_gpc_probe (struct platform_device *pdev) { -const struct of_device_id *of_id = -of_match_device (imx_gpc_dt_ids, &pdev->dev); -const struct imx_gpc_dt_data *of_id_data = of_id->data; +const struct imx_gpc_dt_data *of_id_data =device_get_match_data (&pdev->dev);struct device_node *pgc_node;struct regmap *regmap;void __iomem *base;
drivers/soc/rockchip/pm_domains.c +4 -9
@@ -8,11 +8,13 @@#include <linux/io.h> #include <linux/iopoll.h> #include <linux/err.h> +#include <linux/platform_device.h> #include <linux/pm_clock.h> #include <linux/pm_domain.h> +#include <linux/property.h> +#include <linux/of.h> #include <linux/of_address.h> #include <linux/of_clk.h> -#include <linux/of_platform.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/mfd/syscon.h>
@@ -634,7 +636,6 @@ static int rockchip_pm_domain_probe(strustruct device_node *node;struct device *parent;struct rockchip_pmu *pmu; -const struct of_device_id *match;const struct rockchip_pmu_info *pmu_info;int error;
@@ -643,13 +644,7 @@ static int rockchip_pm_domain_probe(strureturn -ENODEV ; } - match =of_match_device (dev->driver->of_match_table, dev); -if (!match || !match->data) { -dev_err (dev,"missing pmu data\n" ); -return -EINVAL ; - } - - pmu_info = match->data; + pmu_info =device_get_match_data (dev); pmu = devm_kzalloc(dev, struct_size(pmu, domains, pmu_info->num_domains),
Greg Kroah-Hartman
maintainerPATCH 475/554 pmdomain: imx: Fix reference count leak in imx_gpc_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit 73cb5f6eafb0ac7aea8cdeb8ff12981aa741d8fb ]
of_get_child_by_name() returns a node pointer with refcount incremented. Use the __free() attribute to manage the pgc_node reference, ensuring automatic of_node_put() cleanup when pgc_node goes out of scope.
This eliminates the need for explicit error handling paths and avoids reference count leaks.
--- drivers/soc/imx/gpc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/soc/imx/gpc.c +2 -3
@@ -405,13 +405,12 @@ clk_err:static int imx_gpc_probe (struct platform_device *pdev) {const struct imx_gpc_dt_data *of_id_data =device_get_match_data (&pdev->dev); -struct device_node *pgc_node; + struct device_node *pgc_node __free(device_node) + =of_get_child_by_name (pdev->dev.of_node,"pgc" );struct regmap *regmap;void __iomem *base;int ret; - pgc_node =of_get_child_by_name (pdev->dev.of_node,"pgc" ); -/* bail out if DT too old and doesn't provide the necessary info */ if (!of_property_read_bool (pdev->dev.of_node,"#power-domain-cells" ) && !pgc_node)
Greg Kroah-Hartman
maintainerPATCH 476/554 lockd: fix vfs_test_lock() calls
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit a49a2a1baa0c553c3548a1c414b6a3c005a8deba ]
Usage of vfs_test_lock() is somewhat confused. Documentation suggests it is given a "lock" but this is not the case. It is given a struct file_lock which contains some details of the sort of lock it should be looking for.
In particular passing a "file_lock" containing fl_lmops or fl_ops is meaningless and possibly confusing.
This is particularly problematic in lockd. nlmsvc_testlock() receives an initialised "file_lock" from xdr-decode, including manager ops and an owner. It then mistakenly passes this to vfs_test_lock() which might replace the owner and the ops. This can lead to confusion when freeing the lock.
The primary role of the 'struct file_lock' passed to vfs_test_lock() is to report a conflicting lock that was found, so it makes more sense for nlmsvc_testlock() to pass "conflock", which it uses for returning the conflicting lock.
With this change, freeing of the lock is not confused and code in __nlm4svc_proc_test() and __nlmsvc_proc_test() can be simplified.
Documentation for vfs_test_lock() is improved to reflect its real purpose, and a WARN_ON_ONCE() is added to avoid a similar problem in the future.
--- fs/lockd/svc4proc.c | 4 +--- fs/lockd/svclock.c | 21 ++++++++++++--------- fs/lockd/svcproc.c | 5 +---- fs/locks.c | 13 +++++++++++-- 4 files changed, 25 insertions(+), 18 deletions(-)
fs/lockd/svc4proc.c +1 -3
@@ -96,7 +96,6 @@ __nlm4svc_proc_test(struct svc_rqst *rqsstruct nlm_args *argp = rqstp->rq_argp;struct nlm_host *host;struct nlm_file *file; -struct nlm_lockowner *test_owner;__be32 rc = rpc_success;dprintk ("lockd: TEST4 called\n" );
@@ -106,7 +105,6 @@ __nlm4svc_proc_test(struct svc_rqst *rqsif ((resp->status =nlm4svc_retrieve_args (rqstp, argp, &host, &file)))return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success; - test_owner = argp->lock.fl.fl_owner;/* Now check for conflicting locks */ resp->status =nlmsvc_testlock (rqstp, file, host, &argp->lock, &resp->lock, &resp->cookie);if (resp->status == nlm_drop_reply)
@@ -114,7 +112,7 @@ __nlm4svc_proc_test(struct svc_rqst *rqselse dprintk ("lockd: TEST4 status %d\n" ,ntohl (resp->status)); -nlmsvc_put_lockowner (test_owner); +nlmsvc_release_lockowner (&argp->lock);nlmsvc_release_host (host);nlm_release_file (file);return rc;
fs/lockd/svclock.c +12 -9
@@ -604,7 +604,13 @@ nlmsvc_testlock(struct svc_rqst *rqstp, } mode =lock_to_openmode (&lock->fl); - error =vfs_test_lock (file->f_file[mode], &lock->fl); +locks_init_lock (&conflock->fl); +/* vfs_test_lock only uses start, end, and owner, but tests fl_file */ + conflock->fl.fl_file = lock->fl.fl_file; + conflock->fl.fl_start = lock->fl.fl_start; + conflock->fl.fl_end = lock->fl.fl_end; + conflock->fl.fl_owner = lock->fl.fl_owner; + error =vfs_test_lock (file->f_file[mode], &conflock->fl);if (error) {/* We can't currently deal with deferred test requests */ if (error ==FILE_LOCK_DEFERRED )
@@ -614,22 +620,19 @@ nlmsvc_testlock(struct svc_rqst *rqstp, goto out; } -if (lock->fl.fl_type ==F_UNLCK ) { +if (conflock->fl.fl_type ==F_UNLCK ) { ret = nlm_granted; goto out; }dprintk ("lockd: conflicting lock(ty=%d, %Ld-%Ld)\n" , - lock->fl.fl_type, (long long )lock->fl.fl_start, - (long long )lock->fl.fl_end); + conflock->fl.fl_type, (long long )conflock->fl.fl_start, + (long long )conflock->fl.fl_end); conflock->caller ="somehost" ;/* FIXME */ conflock->len =strlen (conflock->caller); conflock->oh.len =0 ;/* don't return OH info */ - conflock->svid = lock->fl.fl_pid; - conflock->fl.fl_type = lock->fl.fl_type; - conflock->fl.fl_start = lock->fl.fl_start; - conflock->fl.fl_end = lock->fl.fl_end; -locks_release_private (&lock->fl); + conflock->svid = conflock->fl.fl_pid; +locks_release_private (&conflock->fl); ret = nlm_lck_denied; out:
fs/lockd/svcproc.c +1 -4
@@ -117,7 +117,6 @@ __nlmsvc_proc_test(struct svc_rqst *rqststruct nlm_args *argp = rqstp->rq_argp;struct nlm_host *host;struct nlm_file *file; -struct nlm_lockowner *test_owner;__be32 rc = rpc_success;dprintk ("lockd: TEST called\n" );
@@ -127,8 +126,6 @@ __nlmsvc_proc_test(struct svc_rqst *rqstif ((resp->status =nlmsvc_retrieve_args (rqstp, argp, &host, &file)))return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success; - test_owner = argp->lock.fl.fl_owner; -/* Now check for conflicting locks */ resp->status =cast_status (nlmsvc_testlock (rqstp, file, host, &argp->lock, &resp->lock, &resp->cookie));if (resp->status == nlm_drop_reply)
@@ -137,7 +134,7 @@ __nlmsvc_proc_test(struct svc_rqst *rqstdprintk ("lockd: TEST status %d vers %d\n" ,ntohl (resp->status), rqstp->rq_vers); -nlmsvc_put_lockowner (test_owner); +nlmsvc_release_lockowner (&argp->lock);nlmsvc_release_host (host);nlm_release_file (file);return rc;
fs/locks.c +11 -2
@@ -2229,13 +2229,22 @@ SYSCALL_DEFINE2(flock, unsigned int, fd,/** * vfs_test_lock - test file byte range lock * @filp: The file to test lock for -* @fl: The lock to test; also used to hold result +* @fl: The byte-range in the file to test; also used to hold result * +* On entry, @fl does not contain a lock, but identifies a range (fl_start, fl_end) +* in the file (c.flc_file), and an owner (c.flc_owner) for whom existing locks +* should be ignored. c.flc_type and c.flc_flags are ignored. +* Both fl_lmops and fl_ops in @fl must be NULL. * Returns -ERRNO on failure. Indicates presence of conflicting lock by -* setting conf->fl_type to something other than F_UNLCK. +* setting fl->fl_type to something other than F_UNLCK. +* +* If vfs_test_lock() does find a lock and return it, the caller must +* use locks_free_lock() or locks_release_private() on the returned lock. */ int vfs_test_lock (struct file *filp,struct file_lock *fl) { +WARN_ON_ONCE (fl->fl_ops || fl->fl_lmops); +WARN_ON_ONCE (filp != fl->fl_file);if (filp->f_op->lock)return filp->f_op->lock (filp,F_GETLK , fl);posix_test_lock (filp, fl);
Greg Kroah-Hartman
maintainerPATCH 477/554 ASoC: stm: stm32_sai_sub: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit a3bd37e2e2bce4fb1757a940fa985d556662ba80 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void.
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 23261f0de094 ("ASoC: stm32: sai: fix OF node leak on probe")
--- sound/soc/stm/stm32_sai_sub.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
sound/soc/stm/stm32_sai_sub.c +2 -4
@@ -1571,7 +1571,7 @@ err_unprepare_pclk:return ret; } -static int stm32_sai_sub_remove (struct platform_device *pdev) +static void stm32_sai_sub_remove (struct platform_device *pdev) {struct stm32_sai_sub_data *sai =dev_get_drvdata (&pdev->dev);
@@ -1579,8 +1579,6 @@ static int stm32_sai_sub_remove(struct psnd_dmaengine_pcm_unregister (&pdev->dev);snd_soc_unregister_component (&pdev->dev);pm_runtime_disable (&pdev->dev); - -return 0 ; }#ifdef CONFIG_PM_SLEEP
@@ -1630,7 +1628,7 @@ static struct platform_driver stm32_sai_ .pm = &stm32_sai_sub_pm_ops, }, .probe = stm32_sai_sub_probe, - .remove = stm32_sai_sub_remove, + .remove_new = stm32_sai_sub_remove, };module_platform_driver (stm32_sai_sub_driver);
Re: [PATCH 5.15 477/554] ASoC: stm: stm32_sai_sub: Convert to platform remove callback returning void
Hello,
Quoted 19 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit
a3bd37e2e2bce4fb1757a940fa985d556662ba80]The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void.
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Quoted 8 lines
Signed-off-by Uwe Kleine-König <[email protected]>Acked-by Takashi Iwai <[email protected]>Acked-by Nicolas Ferre <[email protected]>Signed-off-by Mark Brown <[email protected]>Stable-dep-of:
23261f0de094("ASoC: stm32: sai: fix OF node leak on probe")Signed-off-by Sasha Levin <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
While this patch is trivial and there are many patches like that in both mainline and already backported to stable without any known problems, it is also not very hard to backport 23261f0de094 to 5.15.y without this patch. The merge resolution relevant is just:
sound/soc/stm/stm32_sai_sub.c +0 -0
@@@ -1579,8 -1587,7 +1587,9 @@@ static int stm32_sai_sub_remove(structsnd_dmaengine_pcm_unregister (&pdev->dev);snd_soc_unregister_component (&pdev->dev);pm_runtime_disable (&pdev->dev); +of_node_put (sai->np_sync_provider); + + return 0; }#ifdef CONFIG_PM_SLEEP
I don't feel very strong here, but IMHO this is trivial enough to skip backporting the conversion to .remove_new() and it would be the right thing from a pedantic POV. OTOH I also don't want to reply to each such backport, don't object getting patches into stable, don't know how the stable maintainers feel here and don't want to impose additional work on anyone if just picking up the conversion is considered ok and easier with the established workflow.
Best regards
Uwe
Greg Kroah-Hartman
maintainerRe: [PATCH 5.15 477/554] ASoC: stm: stm32_sai_sub: Convert to platform remove callback returning void
Quoted 51 lines · Uwe Kleine-König
Hello,
Quoted 19 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit
a3bd37e2e2bce4fb1757a940fa985d556662ba80]The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void.
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Quoted 8 lines
Signed-off-by Uwe Kleine-König <[email protected]>Acked-by Takashi Iwai <[email protected]>Acked-by Nicolas Ferre <[email protected]>Signed-off-by Mark Brown <[email protected]>Stable-dep-of:
23261f0de094("ASoC: stm32: sai: fix OF node leak on probe")Signed-off-by Sasha Levin <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>While this patch is trivial and there are many patches like that in both mainline and already backported to stable without any known problems, it is also not very hard to backport
23261f0de094to 5.15.y without this patch. The merge resolution relevant is just:sound/soc/stm/stm32_sai_sub.c +1
-0@@@ -1579,8 -1587,7 +1587,9 @@@ static int stm32_sai_sub_remove(structsnd_dmaengine_pcm_unregister (&pdev->dev);snd_soc_unregister_component (&pdev->dev);pm_runtime_disable (&pdev->dev); +of_node_put (sai->np_sync_provider); + + return 0; }#ifdef CONFIG_PM_SLEEP
Quoted 7 lines
I don't feel very strong here, but IMHO this is trivial enough to skip backporting the conversion to .remove_new() and it would be the right thing from a pedantic POV. OTOH I also don't want to reply to each such backport, don't object getting patches into stable, don't know how the stable maintainers feel here and don't want to impose additional work on anyone if just picking up the conversion is considered ok and easier with the established workflow.
Good idea, now done, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 478/554 ASoC: stm32: sai: fix OF node leak on probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 23261f0de09427367e99f39f588e31e2856a690e ]
The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe.
Make sure to drop the reference on platform probe failures (e.g. probe deferral) and on driver unbind.
This also avoids a potential use-after-free in case the DAI is ever reprobed without first rebinding the platform driver.
--- sound/soc/stm/stm32_sai.c | 12 +++--------- sound/soc/stm/stm32_sai_sub.c | 23 ++++++++++++++++------- 2 files changed, 19 insertions(+), 16 deletions(-)
sound/soc/stm/stm32_sai.c +3 -9
@@ -122,7 +122,6 @@ static int stm32_sai_set_sync(struct stmif (!pdev) {dev_err (&sai_client->pdev->dev,"Device not found for node %pOFn\n" , np_provider); -of_node_put (np_provider);return -ENODEV ; }
@@ -131,21 +130,16 @@ static int stm32_sai_set_sync(struct stmif (!sai_provider) {dev_err (&sai_client->pdev->dev,"SAI sync provider data not found\n" ); - ret = -EINVAL ; - goto error; +return -EINVAL ; }/* Configure sync client */ ret =stm32_sai_sync_conf_client (sai_client, synci);if (ret <0 ) - goto error; +return ret;/* Configure sync provider */ - ret =stm32_sai_sync_conf_provider (sai_provider, synco); - -error: -of_node_put (np_provider); -return ret; +return stm32_sai_sync_conf_provider (sai_provider, synco); }static int stm32_sai_probe (struct platform_device *pdev)
sound/soc/stm/stm32_sai_sub.c +16 -7
@@ -1436,7 +1436,8 @@ static int stm32_sai_sub_parse_of(structdev_err (&pdev->dev,"External synchro not supported\n" );of_node_put (args.np); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_sync_provider; } sai->sync =SAI_SYNC_EXTERNAL ;
@@ -1445,7 +1446,8 @@ static int stm32_sai_sub_parse_of(struct (sai->synci > (SAI_GCR_SYNCIN_MAX + 1))) {dev_err (&pdev->dev,"Wrong SAI index\n" );of_node_put (args.np); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_sync_provider; } if (of_property_match_string(args.np, "compatible",
@@ -1459,7 +1461,8 @@ static int stm32_sai_sub_parse_of(structif (!sai->synco) {dev_err (&pdev->dev,"Unknown SAI sub-block\n" );of_node_put (args.np); -return -EINVAL ; + ret = -EINVAL ; + goto err_put_sync_provider; } }
@@ -1469,13 +1472,15 @@ static int stm32_sai_sub_parse_of(structof_node_put (args.np); sai->sai_ck =devm_clk_get (&pdev->dev,"sai_ck" ); -if (IS_ERR (sai->sai_ck)) -return dev_err_probe (&pdev->dev,PTR_ERR (sai->sai_ck), -"Missing kernel clock sai_ck\n" ); +if (IS_ERR (sai->sai_ck)) { + ret =dev_err_probe (&pdev->dev,PTR_ERR (sai->sai_ck), +"Missing kernel clock sai_ck\n" ); + goto err_put_sync_provider; + } ret =clk_prepare (sai->pdata->pclk);if (ret <0 ) -return ret; + goto err_put_sync_provider;if (STM_SAI_IS_F4 (sai->pdata))return 0 ;
@@ -1497,6 +1502,8 @@ static int stm32_sai_sub_parse_of(struct err_unprepare_pclk:clk_unprepare (sai->pdata->pclk); +err_put_sync_provider: +of_node_put (sai->np_sync_provider);return ret; }
@@ -1567,6 +1574,7 @@ static int stm32_sai_sub_probe(struct pl err_unprepare_pclk:clk_unprepare (sai->pdata->pclk); +of_node_put (sai->np_sync_provider);return ret; }
@@ -1579,6 +1587,7 @@ static void stm32_sai_sub_remove(structsnd_dmaengine_pcm_unregister (&pdev->dev);snd_soc_unregister_component (&pdev->dev);pm_runtime_disable (&pdev->dev); +of_node_put (sai->np_sync_provider); }#ifdef CONFIG_PM_SLEEP
Greg Kroah-Hartman
maintainerPATCH 479/554 wifi: mac80211: Discard Beacon frames to non-broadcast address
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Malinen <[email protected]>
[ Upstream commit 193d18f60588e95d62e0f82b6a53893e5f2f19f8 ]
Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the Beacon .. frame shall be set to the broadcast address"). A unicast Beacon frame might be used as a targeted attack to get one of the associated STAs to do something (e.g., using CSA to move it to another channel). As such, it is better have strict filtering for this on the received side and discard all Beacon frames that are sent to an unexpected address.
This is even more important for cases where beacon protection is used. The current implementation in mac80211 is correctly discarding unicast Beacon frames if the Protected Frame bit in the Frame Control field is set to 0. However, if that bit is set to 1, the logic used for checking for configured BIGTK(s) does not actually work. If the driver does not have logic for dropping unicast Beacon frames with Protected Frame bit 1, these frames would be accepted in mac80211 processing as valid Beacon frames even though they are not protected. This would allow beacon protection to be bypassed. While the logic for checking beacon protection could be extended to cover this corner case, a more generic check for discard all Beacon frames based on A1=unicast address covers this without needing additional changes.
Address all these issues by dropping received Beacon frames if they are sent to a non-broadcast address.
--- net/mac80211/rx.c | 5 +++++ 1 file changed, 5 insertions(+)
net/mac80211/rx.c +5 -0
@@ -3193,6 +3193,11 @@ ieee80211_rx_h_mgmt_check(struct ieee802if (!ieee80211_is_mgmt (mgmt->frame_control))return RX_DROP_MONITOR ; +/* Drop non-broadcast Beacon frames */ +if (ieee80211_is_beacon (mgmt->frame_control) && + !is_broadcast_ether_addr (mgmt->da)) +return RX_DROP_MONITOR ; +if (rx->sdata->vif.type ==NL80211_IFTYPE_AP &&ieee80211_is_beacon (mgmt->frame_control) && !(rx->flags &IEEE80211_RX_BEACON_REPORTED )) {
Greg Kroah-Hartman
maintainerPATCH 480/554 drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit be729f9de6c64240645dc80a24162ac4d3fe00a8 ]
Remove psb_fbdev_fb_setcolreg(), which hasn't been called in almost a decade.
Gma500 commit 4d8d096e9ae8 ("gma500: introduce the framebuffer support code") added the helper psb_fbdev_fb_setcolreg() for setting the fbdev palette via fbdev's fb_setcolreg callback. Later
commit 3da6c2f3b730 ("drm/gma500: use DRM_FB_HELPER_DEFAULT_OPS for fb_ops") set several default helpers for fbdev emulation, including fb_setcmap.
The fbdev subsystem always prefers fb_setcmap over fb_setcolreg. [1] Hence, the gma500 code is no longer in use and gma500 has been using drm_fb_helper_setcmap() for several years without issues.
--- drivers/gpu/drm/gma500/framebuffer.c | 42 ----------------------------------- 1 file changed, 42 deletions(-)
drivers/gpu/drm/gma500/framebuffer.c +0 -42
@@ -35,47 +35,6 @@ static const struct drm_framebuffer_func .create_handle = drm_gem_fb_create_handle, }; -#define CMAP_TOHW (_val, _width) ((((_val) << (_width)) + 0x7FFF - (_val)) >> 16) - -static int psbfb_setcolreg (unsigned regno,unsigned red,unsigned green, -unsigned blue,unsigned transp, -struct fb_info *info) -{ -struct drm_fb_helper *fb_helper = info->par; -struct drm_framebuffer *fb = fb_helper->fb; -uint32_t v; - -if (!fb) -return -ENOMEM ; - -if (regno >255 ) -return 1 ; - - red =CMAP_TOHW (red, info->var.red.length); - blue =CMAP_TOHW (blue, info->var.blue.length); - green =CMAP_TOHW (green, info->var.green.length); - transp =CMAP_TOHW (transp, info->var.transp.length); - - v = (red << info->var.red.offset) | - (green << info->var.green.offset) | - (blue << info->var.blue.offset) | - (transp << info->var.transp.offset); - -if (regno <16 ) { -switch (fb->format->cpp[0 ] *8 ) { -case 16 : - ((uint32_t *) info->pseudo_palette)[regno] = v; -break ; -case 24 : -case 32 : - ((uint32_t *) info->pseudo_palette)[regno] = v; -break ; - } - } - -return 0 ; -} -static vm_fault_t psbfb_vm_fault (struct vm_fault *vmf) {struct vm_area_struct *vma = vmf->vma;
@@ -147,7 +106,6 @@ static int psbfb_mmap(struct fb_info *instatic const struct fb_ops psbfb_unaccel_ops = { .owner =THIS_MODULE ,DRM_FB_HELPER_DEFAULT_OPS , - .fb_setcolreg = psbfb_setcolreg, .fb_fillrect = drm_fb_helper_cfb_fillrect, .fb_copyarea = drm_fb_helper_cfb_copyarea, .fb_imageblit = drm_fb_helper_cfb_imageblit,
Greg Kroah-Hartman
maintainerPATCH 481/554 net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit ed3ba9b6e280e14cc3148c1b226ba453f02fa76c upstream.
SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat below [0] under RTNL pressure.
Let's say Thread A is trying to detach a device from a bridge and Thread B is trying to remove the bridge.
In dev_ioctl(), Thread A bumps the bridge device's refcnt by netdev_hold() and releases RTNL because the following br_ioctl_call() also re-acquires RTNL.
In the race window, Thread B could acquire RTNL and try to remove the bridge device. Then, rtnl_unlock() by Thread B will release RTNL and wait for netdev_put() by Thread A.
Thread A, however, must hold RTNL after the unlock in dev_ifsioc(), which may take long under RTNL pressure, resulting in the splat by Thread B.
Thread A (SIOCBRDELIF) Thread B (SIOCBRDELBR)
---------------------- ----------------------
sock_ioctl sock_ioctl
`- sock_do_ioctl `- br_ioctl_call
`- dev_ioctl `- br_ioctl_stub
|- rtnl_lock |
|- dev_ifsioc '
' |- dev = __dev_get_by_name(...)
|- netdev_hold(dev, ...) .
/ |- rtnl_unlock ------. |
| |- br_ioctl_call `---> |- rtnl_lock
Race | | `- br_ioctl_stub |- br_del_bridge
Window | | | |- dev = __dev_get_by_name(...)
| | | May take long | `- br_dev_delete(dev, ...)
| | | under RTNL pressure | `- unregister_netdevice_queue(dev, ...)
| | | | `- rtnl_unlock
\ | |- rtnl_lock <-' `- netdev_run_todo
| |- ... `- netdev_run_todo
| `- rtnl_unlock |- __rtnl_unlock
| |- netdev_wait_allrefs_any
|- netdev_put(dev, ...) <----------------'Wait refcnt decrement and log splat below
To avoid blocking SIOCBRDELBR unnecessarily, let's not call dev_ioctl() for SIOCBRADDIF and SIOCBRDELIF.
In the dev_ioctl() path, we do the following:
1. Copy struct ifreq by get_user_ifreq in sock_do_ioctl()
2. Check CAP_NET_ADMIN in dev_ioctl()
3. Call dev_load() in dev_ioctl()
4. Fetch the master dev from ifr.ifr_name in dev_ifsioc()
3. can be done by request_module() in br_ioctl_call(), so we move 1., 2., and 4. to br_ioctl_stub().
Note that 2. is also checked later in add_del_if(), but it's better performed before RTNL.
SIOCBRADDIF and SIOCBRDELIF have been processed in dev_ioctl() since the pre-git era, and there seems to be no specific reason to process them there.
[0]:unregister_netdevice: waiting for wpan3 to become free. Usage count = 2ref_tracker: wpan3@ffff8880662d8608 has 1/1 users at
__netdev_tracker_alloc include/linux/netdevice.h:4282 [inline]
netdev_hold include/linux/netdevice.h:4311 [inline]
dev_ifsioc+0xc6a/0x1160 net/core/dev_ioctl.c:624
dev_ioctl+0x255/0x10c0 net/core/dev_ioctl.c:826
sock_do_ioctl+0x1ca/0x260 net/socket.c:1213
sock_ioctl+0x23a/0x6c0 net/socket.c:1318
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x1a4/0x210 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- include/linux/if_bridge.h | 6 ++---- net/bridge/br_ioctl.c | 36 +++++++++++++++++++++++++++++++++--- net/bridge/br_private.h | 3 +-- net/core/dev_ioctl.c | 15 --------------- net/socket.c | 19 +++++++++---------- 5 files changed, 45 insertions(+), 34 deletions(-)
include/linux/if_bridge.h +2 -4
@@ -62,11 +62,9 @@ struct br_ip_list {#define BR_DEFAULT_AGEING_TIME (300 * HZ)struct net_bridge ; -void brioctl_set (int (*hook)(struct net *net,struct net_bridge *br, -unsigned int cmd,struct ifreq *ifr, +void brioctl_set (int (*hook)(struct net *net,unsigned int cmd,void __user *uarg)); -int br_ioctl_call (struct net *net,struct net_bridge *br,unsigned int cmd, -struct ifreq *ifr,void __user *uarg); +int br_ioctl_call (struct net *net,unsigned int cmd,void __user *uarg);#if IS_ENABLED (CONFIG_BRIDGE ) &&IS_ENABLED (CONFIG_BRIDGE_IGMP_SNOOPING ) int br_multicast_list_adjacent(struct net_device *dev,
net/bridge/br_ioctl.c +33 -3
@@ -368,10 +368,26 @@ static int old_deviceless(struct net *nereturn -EOPNOTSUPP ; } -int br_ioctl_stub (struct net *net,struct net_bridge *br,unsigned int cmd, -struct ifreq *ifr,void __user *uarg) +int br_ioctl_stub (struct net *net,unsigned int cmd,void __user *uarg) {int ret = -EOPNOTSUPP ; +struct ifreq ifr; + +if (cmd ==SIOCBRADDIF || cmd ==SIOCBRDELIF ) { +void __user *data; +char *colon; + +if (!ns_capable (net->user_ns,CAP_NET_ADMIN )) +return -EPERM ; + +if (get_user_ifreq (&ifr, &data, uarg)) +return -EFAULT ; + + ifr.ifr_name[IFNAMSIZ -1 ] =0 ; + colon =strchr (ifr.ifr_name,':' ); +if (colon) + *colon =0 ; + }rtnl_lock ();
@@ -404,7 +420,21 @@ int br_ioctl_stub(struct net *net, strucbreak ;case SIOCBRADDIF :case SIOCBRDELIF : - ret =add_del_if (br, ifr->ifr_ifindex, cmd ==SIOCBRADDIF ); + { +struct net_device *dev; + + dev =__dev_get_by_name (net, ifr.ifr_name); +if (!dev || !netif_device_present (dev)) { + ret = -ENODEV ; +break ; + } +if (!netif_is_bridge_master (dev)) { + ret = -EOPNOTSUPP ; +break ; + } + + ret =add_del_if (netdev_priv (dev), ifr.ifr_ifindex, cmd ==SIOCBRADDIF ); + }break ; }
net/bridge/br_private.h +1 -2
@@ -875,8 +875,7 @@ br_port_get_check_rtnl(const struct net_/* br_ioctl.c */ int br_dev_siocdevprivate (struct net_device *dev,struct ifreq *rq,void __user *data,int cmd); -int br_ioctl_stub (struct net *net,struct net_bridge *br,unsigned int cmd, -struct ifreq *ifr,void __user *uarg); +int br_ioctl_stub (struct net *net,unsigned int cmd,void __user *uarg);/* br_multicast.c */ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
net/core/dev_ioctl.c +0 -15
@@ -375,19 +375,6 @@ static int dev_ifsioc(struct net *net, scase SIOCWANDEV :return dev_siocwandev (dev, &ifr->ifr_settings); -case SIOCBRADDIF : -case SIOCBRDELIF : -if (!netif_device_present (dev)) -return -ENODEV ; -if (!netif_is_bridge_master (dev)) -return -EOPNOTSUPP ; -dev_hold (dev); -rtnl_unlock (); - err =br_ioctl_call (net,netdev_priv (dev), cmd, ifr,NULL ); -dev_put (dev); -rtnl_lock (); -return err; -case SIOCSHWTSTAMP : err =net_hwtstamp_validate (ifr);if (err)
@@ -574,8 +561,6 @@ int dev_ioctl(struct net *net, unsignedcase SIOCBONDRELEASE :case SIOCBONDSETHWADDR :case SIOCBONDCHANGEACTIVE : -case SIOCBRADDIF : -case SIOCBRDELIF :case SIOCSHWTSTAMP :if (!ns_capable (net->user_ns,CAP_NET_ADMIN ))return -EPERM ;
net/socket.c +9 -10
@@ -1097,12 +1097,10 @@ static ssize_t sock_write_iter(struct ki*/ static DEFINE_MUTEX (br_ioctl_mutex); -static int (*br_ioctl_hook)(struct net *net,struct net_bridge *br, -unsigned int cmd,struct ifreq *ifr, +static int (*br_ioctl_hook)(struct net *net,unsigned int cmd,void __user *uarg); -void brioctl_set (int (*hook)(struct net *net,struct net_bridge *br, -unsigned int cmd,struct ifreq *ifr, +void brioctl_set (int (*hook)(struct net *net,unsigned int cmd,void __user *uarg)) {mutex_lock (&br_ioctl_mutex);
@@ -1111,8 +1109,7 @@ void brioctl_set(int (*hook)(struct net }EXPORT_SYMBOL (brioctl_set); -int br_ioctl_call (struct net *net,struct net_bridge *br,unsigned int cmd, -struct ifreq *ifr,void __user *uarg) +int br_ioctl_call (struct net *net,unsigned int cmd,void __user *uarg) {int err = -ENOPKG ;
@@ -1121,7 +1118,7 @@ int br_ioctl_call(struct net *net, strucmutex_lock (&br_ioctl_mutex);if (br_ioctl_hook) - err =br_ioctl_hook (net, br, cmd, ifr, uarg); + err =br_ioctl_hook (net, cmd, uarg);mutex_unlock (&br_ioctl_mutex);return err;
@@ -1218,7 +1215,9 @@ static long sock_ioctl(struct file *filecase SIOCSIFBR :case SIOCBRADDBR :case SIOCBRDELBR : - err =br_ioctl_call (net,NULL , cmd,NULL , argp); +case SIOCBRADDIF : +case SIOCBRDELIF : + err =br_ioctl_call (net, cmd, argp);break ;case SIOCGIFVLAN :case SIOCSIFVLAN :
@@ -3321,6 +3320,8 @@ static int compat_sock_ioctl_trans(struccase SIOCGPGRP :case SIOCBRADDBR :case SIOCBRDELBR : +case SIOCBRADDIF : +case SIOCBRDELIF :case SIOCGIFVLAN :case SIOCSIFVLAN :case SIOCGSKNS :
@@ -3358,8 +3359,6 @@ static int compat_sock_ioctl_trans(struccase SIOCGIFPFLAGS :case SIOCGIFTXQLEN :case SIOCSIFTXQLEN : -case SIOCBRADDIF : -case SIOCBRDELIF :case SIOCGIFNAME :case SIOCSIFNAME :case SIOCGMIIPHY :
Greg Kroah-Hartman
maintainerPATCH 482/554 mmc: core: use sysfs_emit() instead of sprintf()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11 ]
sprintf() (still used in the MMC core for the sysfs output) is vulnerable to the buffer overflow. Use the new-fangled sysfs_emit() instead.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/mmc/core/bus.c | 9 +++++---- drivers/mmc/core/bus.h | 3 ++- drivers/mmc/core/mmc.c | 16 ++++++++-------- drivers/mmc/core/sd.c | 27 +++++++++++++-------------- drivers/mmc/core/sdio.c | 5 +++-- drivers/mmc/core/sdio_bus.c | 7 ++++--- 6 files changed, 35 insertions(+), 32 deletions(-)
drivers/mmc/core/bus.c +5 -4
@@ -15,6 +15,7 @@#include <linux/stat.h> #include <linux/of.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/card.h> #include <linux/mmc/host.h>
@@ -34,13 +35,13 @@ static ssize_t type_show(struct device *switch (card->type) {case MMC_TYPE_MMC : -return sprintf (buf,"MMC\n" ); +return sysfs_emit (buf,"MMC\n" );case MMC_TYPE_SD : -return sprintf (buf,"SD\n" ); +return sysfs_emit (buf,"SD\n" );case MMC_TYPE_SDIO : -return sprintf (buf,"SDIO\n" ); +return sysfs_emit (buf,"SDIO\n" );case MMC_TYPE_SD_COMBO : -return sprintf (buf,"SDcombo\n" ); +return sysfs_emit (buf,"SDcombo\n" );default :return -EFAULT ; }
drivers/mmc/core/bus.h +2 -1
@@ -9,6 +9,7 @@#define _MMC_CORE_BUS_H#include <linux/device.h> +#include <linux/sysfs.h> struct mmc_host ;struct mmc_card ;
@@ -17,7 +18,7 @@ struct mmc_card; static ssize_t mmc_##name##_show (struct device *dev, struct device_attribute *attr, char *buf) \ { \ struct mmc_card *card = mmc_dev_to_card(dev); \ - return sprintf(buf, fmt, args); \ + return sysfs_emit(buf, fmt, args); \ } \ static DEVICE_ATTR(name, S_IRUGO, mmc_##name##_show, NULL)
drivers/mmc/core/mmc.c +8 -8
@@ -12,6 +12,7 @@#include <linux/slab.h> #include <linux/stat.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/host.h> #include <linux/mmc/card.h>
@@ -812,12 +813,11 @@ static ssize_t mmc_fwrev_show(struct dev {struct mmc_card *card =mmc_dev_to_card (dev); -if (card->ext_csd.rev <7 ) { -return sprintf (buf,"0x%x\n" , card->cid.fwrev); - }else { -return sprintf (buf,"0x%*phN\n" ,MMC_FIRMWARE_LEN , - card->ext_csd.fwrev); - } +if (card->ext_csd.rev <7 ) +return sysfs_emit (buf,"0x%x\n" , card->cid.fwrev); +else +return sysfs_emit (buf,"0x%*phN\n" ,MMC_FIRMWARE_LEN , + card->ext_csd.fwrev); } static DEVICE_ATTR(fwrev, S_IRUGO, mmc_fwrev_show, NULL);
@@ -830,10 +830,10 @@ static ssize_t mmc_dsr_show(struct devicstruct mmc_host *host = card->host;if (card->csd.dsr_imp && host->dsr_req) -return sprintf (buf,"0x%x\n" , host->dsr); +return sysfs_emit (buf,"0x%x\n" , host->dsr);else /* return default DSR value */ -return sprintf (buf,"0x%x\n" ,0x404 ); +return sysfs_emit (buf,"0x%x\n" ,0x404 ); } static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL);
drivers/mmc/core/sd.c +13 -14
@@ -12,6 +12,7 @@#include <linux/slab.h> #include <linux/stat.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/host.h> #include <linux/mmc/card.h>
@@ -707,18 +708,16 @@ MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr)MMC_DEV_ATTR (rca,"0x%04x\n" , card->rca); -static ssize_t mmc_dsr_show (struct device *dev, -struct device_attribute *attr, -char *buf) -{ -struct mmc_card *card =mmc_dev_to_card (dev); -struct mmc_host *host = card->host; - -if (card->csd.dsr_imp && host->dsr_req) -return sprintf (buf,"0x%x\n" , host->dsr); -else -/* return default DSR value */ -return sprintf (buf,"0x%x\n" ,0x404 ); +static ssize_t mmc_dsr_show (struct device *dev,struct device_attribute *attr, +char *buf) +{ +struct mmc_card *card =mmc_dev_to_card (dev); +struct mmc_host *host = card->host; + +if (card->csd.dsr_imp && host->dsr_req) +return sysfs_emit (buf,"0x%x\n" , host->dsr); +/* return default DSR value */ +return sysfs_emit (buf,"0x%x\n" ,0x404 ); } static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL);
@@ -734,9 +733,9 @@ static ssize_t info##num##_show(struct d \if (num > card->num_info) \return -ENODATA ; \ -if (!card->info[num-1 ][0 ]) \ +if (!card->info[num -1 ][0 ]) \return 0 ; \ -return sprintf (buf,"%s\n" , card->info[num-1 ]); \ +return sysfs_emit (buf,"%s\n" , card->info[num -1 ]); \ } \ static DEVICE_ATTR_RO(info##num)
drivers/mmc/core/sdio.c +3 -2
@@ -7,6 +7,7 @@#include <linux/err.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/host.h> #include <linux/mmc/card.h>
@@ -40,9 +41,9 @@ static ssize_t info##num##_show(struct d \if (num > card->num_info) \return -ENODATA ; \ -if (!card->info[num-1 ][0 ]) \ +if (!card->info[num -1 ][0 ]) \return 0 ; \ -return sprintf (buf,"%s\n" , card->info[num-1 ]); \ +return sysfs_emit (buf,"%s\n" , card->info[num -1 ]); \ } \ static DEVICE_ATTR_RO(info##num)
drivers/mmc/core/sdio_bus.c +4 -3
@@ -14,6 +14,7 @@#include <linux/pm_runtime.h> #include <linux/pm_domain.h> #include <linux/acpi.h> +#include <linux/sysfs.h> #include <linux/mmc/card.h> #include <linux/mmc/host.h>
@@ -35,7 +36,7 @@ field##_show(struct device *dev, structstruct sdio_func *func; \ \ func =dev_to_sdio_func (dev); \ -return sprintf (buf, format_string, args); \ +return sysfs_emit (buf, format_string, args); \ } \static DEVICE_ATTR_RO (field)
@@ -52,9 +53,9 @@ static ssize_t info##num##_show(struct d \if (num > func->num_info) \return -ENODATA ; \ -if (!func->info[num-1 ][0 ]) \ +if (!func->info[num -1 ][0 ]) \return 0 ; \ -return sprintf (buf,"%s\n" , func->info[num-1 ]); \ +return sysfs_emit (buf,"%s\n" , func->info[num -1 ]); \ } \ static DEVICE_ATTR_RO(info##num)
Greg Kroah-Hartman
maintainerPATCH 483/554 drm/i915/selftests: fix subtraction overflow bug
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <[email protected]>
[ Upstream commit ab3edc679c552a466e4bf0b11af3666008bd65a2 ]
On some machines hole_end can be small enough to cause subtraction overflow. On the other side (addr + 2 * min_alignment) can overflow in case of mock tests. This patch should handle both cases.
--- drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/selftests/i915_gem_gtt.c +1 -1
@@ -715,7 +715,7 @@ static int pot_hole(struct i915_address_u64 addr;for (addr =round_up (hole_start +I915_GTT_PAGE_SIZE , step) -I915_GTT_PAGE_SIZE ; - addr <=round_down (hole_end -2 *I915_GTT_PAGE_SIZE , step) -I915_GTT_PAGE_SIZE ; + hole_end > addr && hole_end - addr >=2 *I915_GTT_PAGE_SIZE ; addr += step) { err =i915_vma_pin (vma,0 ,0 , addr | flags);if (err) {
Greg Kroah-Hartman
maintainerPATCH 484/554 page_pool: Fix use-after-free in page_pool_recycle_in_ring
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dong Chenchen <[email protected]>
[ Upstream commit 271683bb2cf32e5126c592b5d5e6a756fa374fd9 ]
syzbot reported a uaf in page_pool_recycle_in_ring:
BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline]
root cause is:
page_pool_recycle_in_ring
ptr_ring_produce
spin_lock(&r->producer_lock);
WRITE_ONCE(r->queue[r->producer++], ptr)
//recycle last page to pool
page_pool_release
page_pool_scrub
page_pool_empty_ring
ptr_ring_consume
page_pool_return_page //release all page
__page_pool_destroy
free_percpu(pool->recycle_stats);
free(pool) //free
spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring);
page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled.
recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning.
[ Linux 5.15.y does not support page pool statistics
(CONFIG_PAGE_POOL_STATS), so remove the related source code changes from the patch. ]
--- net/core/page_pool.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/core/page_pool.c +10 -6
@@ -414,14 +414,14 @@ static void page_pool_return_page(structstatic bool page_pool_recycle_in_ring (struct page_pool *pool,struct page *page) { -int ret; +bool in_softirq, ret; +/* BH protection not needed if current is softirq */ -if (in_softirq ()) - ret =ptr_ring_produce (&pool->ring, page); -else - ret =ptr_ring_produce_bh (&pool->ring, page); + in_softirq =page_pool_producer_lock (pool); + ret = !__ptr_ring_produce (&pool->ring, page); +page_pool_producer_unlock (pool, in_softirq); -return (ret ==0 ) ? true : false; +return ret; }/* Only allow direct recycling in special circumstances, into the
@@ -684,10 +684,14 @@ static void page_pool_scrub(struct page_static int page_pool_release (struct page_pool *pool) { +bool in_softirq;int inflight;page_pool_scrub (pool); inflight =page_pool_inflight (pool); +/* Acquire producer lock to make sure producers have exited. */ + in_softirq =page_pool_producer_lock (pool); +page_pool_producer_unlock (pool, in_softirq);if (!inflight)page_pool_free (pool);
Greg Kroah-Hartman
maintainerPATCH 485/554 KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 upstream.
Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory.
Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS.
=============================
WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted
-----------------------------
include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by repro/1071:
#0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm]
stack backtrace: CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x13f/0x1a0 kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] load_vmcs12_host_state+0x432/0xb40 [kvm_intel] vmx_leave_nested+0x30/0x40 [kvm_intel] kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? lock_acquire+0xba/0x2d0 ? find_held_lock+0x2b/0x80 ? do_user_addr_fault+0x40c/0x6f0 ? lock_release+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539 </TASK>
[ Based on kernel 5.15 available functions, using srcu_read_lock/srcu_read_unlock instead of kvm_vcpu_srcu_read_lock/kvm_vcpu_srcu_read_unlock ]
--- arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/x86.c +2 -0
@@ -5294,7 +5294,9 @@ long kvm_arch_vcpu_ioctl(struct file *fiif (copy_from_user (&events, argp,sizeof (struct kvm_vcpu_events )))break ; + vcpu->srcu_idx =srcu_read_lock (&vcpu->kvm->srcu); r =kvm_vcpu_ioctl_x86_set_vcpu_events (vcpu, &events); +srcu_read_unlock (&vcpu->kvm->srcu, vcpu->srcu_idx);break ; }case KVM_GET_DEBUGREGS : {
Greg Kroah-Hartman
maintainerPATCH 486/554 HID: core: Harden s32ton() against conversion to 0 bits
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
[ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ]
Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.
Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
[ s32ton() was moved by c653ffc28340 ("HID: stop exporting hid_snto32()").
Minor context change fixed. ]
--- drivers/hid/hid-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/hid/hid-core.c +6 -1
@@ -1349,7 +1349,12 @@ EXPORT_SYMBOL_GPL(hid_snto32);static u32 s32ton (__s32 value,unsigned n) { -s32 a = value >> (n -1 ); +s32 a; + +if (!value || !n) +return 0 ; + + a = value >> (n -1 );if (a && a !=-1 )return value <0 ?1 << (n -1 ) : (1 << (n -1 )) -1 ;return value & ((1 << n) -1 );
Greg Kroah-Hartman
maintainerPATCH 487/554 mm/mprotect: use long for page accountings and retval
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <[email protected]>
commit a79390f5d6a78647fd70856bd42b22d994de0ba2 upstream.
Switch to use type "long" for page accountings and retval across the whole procedure of change_protection().
The change should have shrinked the possible maximum page number to be half comparing to previous (ULONG_MAX / 2), but it shouldn't overflow on any system either because the maximum possible pages touched by change protection should be ULONG_MAX / PAGE_SIZE.
Two reasons to switch from "unsigned long" to "long":
1. It suites better on count_vm_numa_events(), whose 2nd parameter takes a long type.
2. It paves way for returning negative (error) values in the future.
Currently the only caller that consumes this retval is change_prot_numa(), where the unsigned long was converted to an int. Since at it, touching up the numa code to also take a long, so it'll avoid any possible overflow too during the int-size convertion.
--- include/linux/hugetlb.h | 4 ++-- include/linux/mm.h | 2 +- mm/hugetlb.c | 4 ++-- mm/mempolicy.c | 2 +- mm/mprotect.c | 26 +++++++++++++------------- 5 files changed, 19 insertions(+), 19 deletions(-)
include/linux/hugetlb.h +2 -2
@@ -208,7 +208,7 @@ struct page *follow_huge_pgd(struct mm_sint pmd_huge (pmd_t pmd);int pud_huge (pud_t pud); -unsigned long hugetlb_change_protection (struct vm_area_struct *vma, +long hugetlb_change_protection (struct vm_area_struct *vma,unsigned long address,unsigned long end,pgprot_t newprot);bool is_hugetlb_entry_migration (pte_t pte);
@@ -379,7 +379,7 @@ static inline void move_hugetlb_state(st { } -static inline unsigned long hugetlb_change_protection ( +static inline long hugetlb_change_protection (struct vm_area_struct *vma,unsigned long address,unsigned long end,pgprot_t newprot) {
include/linux/mm.h +1 -1
@@ -1910,7 +1910,7 @@ extern unsigned long move_page_tables(st#define MM_CP_UFFD_WP_ALL (MM_CP_UFFD_WP | \ MM_CP_UFFD_WP_RESOLVE) -extern unsigned long change_protection (struct vm_area_struct *vma,unsigned long start, +extern long change_protection (struct vm_area_struct *vma,unsigned long start,unsigned long end,pgprot_t newprot,unsigned long cp_flags); extern int mprotect_fixup(struct vm_area_struct *vma,
mm/hugetlb.c +2 -2
@@ -5644,7 +5644,7 @@ long follow_hugetlb_page(struct mm_strucreturn i ? i : err; } -unsigned long hugetlb_change_protection (struct vm_area_struct *vma, +long hugetlb_change_protection (struct vm_area_struct *vma,unsigned long address,unsigned long end,pgprot_t newprot) {struct mm_struct *mm = vma->vm_mm;
@@ -5652,7 +5652,7 @@ unsigned long hugetlb_change_protection(pte_t *ptep;pte_t pte;struct hstate *h =hstate_vma (vma); -unsigned long pages =0 ; +long pages =0 ;bool shared_pmd = false;struct mmu_notifier_range range;
mm/mempolicy.c +1 -1
@@ -634,7 +634,7 @@ unlock:unsigned long change_prot_numa (struct vm_area_struct *vma,unsigned long addr,unsigned long end) { -int nr_updated; +long nr_updated; nr_updated =change_protection (vma, addr, end,PAGE_NONE ,MM_CP_PROT_NUMA );if (nr_updated)
mm/mprotect.c +13 -13
@@ -35,13 +35,13 @@#include "internal.h" -static unsigned long change_pte_range (struct vm_area_struct *vma,pmd_t *pmd, +static long change_pte_range (struct vm_area_struct *vma,pmd_t *pmd,unsigned long addr,unsigned long end,pgprot_t newprot,unsigned long cp_flags) {pte_t *pte, oldpte;spinlock_t *ptl; -unsigned long pages =0 ; +long pages =0 ;int target_node =NUMA_NO_NODE ;bool dirty_accountable = cp_flags &MM_CP_DIRTY_ACCT ;bool prot_numa = cp_flags &MM_CP_PROT_NUMA ;
@@ -219,13 +219,13 @@ static inline int pmd_none_or_clear_bad_return 0 ; } -static inline unsigned long change_pmd_range (struct vm_area_struct *vma, +static inline long change_pmd_range (struct vm_area_struct *vma,pud_t *pud,unsigned long addr,unsigned long end,pgprot_t newprot,unsigned long cp_flags) {pmd_t *pmd;unsigned long next; -unsigned long pages =0 ; +long pages =0 ;unsigned long nr_huge_updates =0 ;struct mmu_notifier_range range;
@@ -233,7 +233,7 @@ static inline unsigned long change_pmd_r pmd =pmd_offset (pud, addr); do { - unsigned long this_pages; + long this_pages; next = pmd_addr_end(addr, end);
@@ -291,13 +291,13 @@ next:return pages; } -static inline unsigned long change_pud_range (struct vm_area_struct *vma, +static inline long change_pud_range (struct vm_area_struct *vma,p4d_t *p4d,unsigned long addr,unsigned long end,pgprot_t newprot,unsigned long cp_flags) {pud_t *pud;unsigned long next; -unsigned long pages =0 ; +long pages =0 ; pud =pud_offset (p4d, addr); do {
@@ -311,13 +311,13 @@ static inline unsigned long change_pud_rreturn pages; } -static inline unsigned long change_p4d_range (struct vm_area_struct *vma, +static inline long change_p4d_range (struct vm_area_struct *vma,pgd_t *pgd,unsigned long addr,unsigned long end,pgprot_t newprot,unsigned long cp_flags) {p4d_t *p4d;unsigned long next; -unsigned long pages =0 ; +long pages =0 ; p4d =p4d_offset (pgd, addr); do {
@@ -331,7 +331,7 @@ static inline unsigned long change_p4d_rreturn pages; } -static unsigned long change_protection_range (struct vm_area_struct *vma, +static long change_protection_range (struct vm_area_struct *vma,unsigned long addr,unsigned long end,pgprot_t newprot,unsigned long cp_flags) {
@@ -339,7 +339,7 @@ static unsigned long change_protection_rpgd_t *pgd;unsigned long next;unsigned long start = addr; -unsigned long pages =0 ; +long pages =0 ;BUG_ON (addr >= end); pgd =pgd_offset (mm, addr);
@@ -361,11 +361,11 @@ static unsigned long change_protection_rreturn pages; } -unsigned long change_protection (struct vm_area_struct *vma,unsigned long start, +long change_protection (struct vm_area_struct *vma,unsigned long start,unsigned long end,pgprot_t newprot,unsigned long cp_flags) { -unsigned long pages; +long pages;BUG_ON ((cp_flags &MM_CP_UFFD_WP_ALL ) ==MM_CP_UFFD_WP_ALL );
Greg Kroah-Hartman
maintainerPATCH 488/554 KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Stitt <[email protected]>
A new warning in Clang 22 [1] complains that @clidr passed to get_clidr_el1() is an uninitialized const pointer. get_clidr_el1() doesn't really care since it casts away the const-ness anyways -- it is a false positive.
| ../arch/arm64/kvm/sys_regs.c:2838:23: warning: variable 'clidr' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer] | 2838 | get_clidr_el1(NULL, &clidr); /* Ugly... */ | | ^~~~~
This patch isn't needed for anything past 6.1 as this code section was reworked in Commit 7af0c2534f4c ("KVM: arm64: Normalize cache configuration"). Since there is no upstream equivalent, this patch just needs to be applied to 5.15.
Disable this warning for sys_regs.o with an iron fist as it doesn't make sense to waste maintainer's time or potentially break builds by backporting large changelists from 6.2+.
--- arch/arm64/kvm/Makefile | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/kvm/Makefile +3 -0
@@ -25,3 +25,6 @@ kvm-y := $(KVM)/kvm_main.o $(KVM)/coales vgic/vgic-its.o vgic/vgic-debug.o kvm-$(CONFIG_HW_PERF_EVENTS) += pmu-emul.o + +# Work around a false positive Clang 22 -Wuninitialized-const-pointer warning +CFLAGS_sys_regs.o := $(call cc-disable-warning, uninitialized-const-pointer)
Greg Kroah-Hartman
maintainerPATCH 489/554 ipv6: Fix potential uninit-value access in __ip6_make_skb()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
commit 4e13d3a9c25b7080f8a619f961e943fe08c2672c upstream.
As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on the socket to avoid a race condition which causes uninit-value access.
[ Referred stable v6.1.y version of the patch to generate this one
v6.1 link: https://github.com/gregkh/linux/commit/a05c1ede50e9656f0752e523c7b54f3a3489e9a8 ]
--- net/ipv6/ip6_output.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/ip6_output.c +2 -1
@@ -1928,7 +1928,8 @@ struct sk_buff *__ip6_make_skb(struct sostruct inet6_dev *idev =ip6_dst_idev (skb_dst (skb));u8 icmp6_type; -if (sk->sk_socket->type ==SOCK_RAW && !inet_sk (sk)->hdrincl) +if (sk->sk_socket->type ==SOCK_RAW && + !(fl6->flowi6_flags &FLOWI_FLAG_KNOWN_NH )) icmp6_type = fl6->fl6_icmp_type;else icmp6_type =icmp6_hdr (skb)->icmp6_type;
Greg Kroah-Hartman
maintainerPATCH 490/554 ipv4: Fix uninit-value access in __ip_make_skb()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
commit fc1092f51567277509563800a3c56732070b6aa4 upstream.
KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN.
Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket.
Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout.
Initialize these explicitly in raw_sendmsg().
[1]
BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014
[ Referred stable v6.1.y version of the patch to generate this one
v6.1 link: https://github.com/gregkh/linux/commit/55bf541e018b76b3750cb6c6ea18c46e1ac5562e ]
--- net/ipv4/ip_output.c | 3 ++- net/ipv4/raw.c | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-)
net/ipv4/ip_output.c +2 -1
@@ -1562,7 +1562,8 @@ struct sk_buff *__ip_make_skb(struct soc* so icmphdr does not in skb linear region and can not get icmp_type * by icmp_hdr(skb)->type. */ -if (sk->sk_type ==SOCK_RAW && !inet_sk (sk)->hdrincl) +if (sk->sk_type ==SOCK_RAW && + !(fl4->flowi4_flags &FLOWI_FLAG_KNOWN_NH )) icmp_type = fl4->fl4_icmp_type;else icmp_type =icmp_hdr (skb)->type;
net/ipv4/raw.c +3 -0
@@ -634,6 +634,9 @@ static int raw_sendmsg(struct sock *sk, (hdrincl ?FLOWI_FLAG_KNOWN_NH :0 ), daddr, saddr, 0, 0, sk->sk_uid); + fl4.fl4_icmp_type =0 ; + fl4.fl4_icmp_code =0 ; +if (!hdrincl) { rfv.msg = msg; rfv.hlen =0 ;
Greg Kroah-Hartman
maintainerPATCH 491/554 selftests: net: test_vxlan_under_vrf: fix HV connectivity test
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <[email protected]>
[ Upstream commit e7e4785fa30f9b5d1b60ed2d8e221891325dfc5f ]
It looks like test_vxlan_under_vrf.sh is always failing to verify the connectivity test during the ping between the two simulated VMs.
This is due to the fact that veth-hv in each VM should have a distinct MAC address.
Fix by setting a unique MAC address on each simulated VM interface.
Without this fix:
$ sudo ./tools/testing/selftests/net/test_vxlan_under_vrf.sh Checking HV connectivity [ OK ] Check VM connectivity through VXLAN (underlay in the default VRF) [FAIL]
With this fix applied:
$ sudo ./tools/testing/selftests/net/test_vxlan_under_vrf.sh Checking HV connectivity [ OK ] Check VM connectivity through VXLAN (underlay in the default VRF) [ OK ] Check VM connectivity through VXLAN (underlay in a VRF) [FAIL]
NOTE: the connectivity test with the underlay VRF is still failing; it seems that ARP requests are blocked at the simulated hypervisor level, probably due to some missing ARP forwarding rules. This requires more investigation (in the meantime we may consider to set that test as expected failure - XFAIL).
--- tools/testing/selftests/net/test_vxlan_under_vrf.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/test_vxlan_under_vrf.sh +2 -0
@@ -101,6 +101,8 @@ setup-vm() { ip -netns hv-$id link set veth-tap master br0 ip -netns hv-$id link set veth-tap up + ip link set veth-hv address 02:1d:8d:dd:0c:6$id + ip link set veth-hv netns vm-$id ip -netns vm-$id addr add 10.0.0.$id/24 dev veth-hv ip -netns vm-$id link set veth-hv up
Greg Kroah-Hartman
maintainerPATCH 492/554 x86: remove __range_not_ok()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 36903abedfe8d419e90ce349b2b4ce6dc2883e17 upstream.
The __range_not_ok() helper is an x86 (and sparc64) specific interface that does roughly the same thing as __access_ok(), but with different calling conventions.
Change this to use the normal interface in order for consistency as we clean up all access_ok() implementations.
This changes the limit from TASK_SIZE to TASK_SIZE_MAX, which Al points out is the right thing do do here anyway.
The callers have to use __access_ok() instead of the normal access_ok() though, because on x86 that contains a WARN_ON_IN_IRQ() check that cannot be used inside of NMI context while tracing.
The check in copy_code() is not needed any more, because this one is already done by copy_from_user_nmi().
Stable-dep-of: d319f344561d ("mm: Fix copy_from_user_nofault().")
--- arch/x86/events/core.c | 2 +- arch/x86/include/asm/uaccess.h | 10 ++++++---- arch/x86/kernel/dumpstack.c | 6 ------ arch/x86/kernel/stacktrace.c | 2 +- arch/x86/lib/usercopy.c | 2 +- 5 files changed, 9 insertions(+), 13 deletions(-)
arch/x86/events/core.c +1 -1
@@ -2790,7 +2790,7 @@ perf_callchain_kernel(struct perf_callchstatic inline int valid_user_frame (const void __user *fp,unsigned long size) { -return (__range_not_ok (fp, size,TASK_SIZE ) ==0 ); +return __access_ok (fp, size); }static unsigned long get_segment_base (unsigned int segment)
arch/x86/include/asm/uaccess.h +6 -4
@@ -16,8 +16,10 @@* Test whether a block of memory is a valid user space address. * Returns 0 if the range is valid, nonzero otherwise. */ -static inline bool __chk_range_not_ok (unsigned long addr,unsigned long size,unsigned long limit) +static inline bool __chk_range_not_ok (unsigned long addr,unsigned long size) { +unsigned long limit =TASK_SIZE_MAX ; +/* * If we have used "sizeof()" for the size, * we know it won't overflow the limit (but
@@ -35,10 +37,10 @@ static inline bool __chk_range_not_ok(unreturn unlikely (addr > limit); } -#define __range_not_ok (addr, size, limit) \ +#define __access_ok (addr, size) \ ({ \ __chk_user_ptr(addr); \ - __chk_range_not_ok((unsigned long __force)(addr), size, limit); \ + !__chk_range_not_ok((unsigned long __force)(addr), size); \ })#ifdef CONFIG_DEBUG_ATOMIC_SLEEP
@@ -69,7 +71,7 @@ static inline bool pagefault_disabled(vo#define access_ok (addr, size) \ ({ \ WARN_ON_IN_IRQ(); \ - likely(!__range_not_ok(addr, size, TASK_SIZE_MAX)); \ + likely(__access_ok(addr, size)); \ })extern int __get_user_1 (void );
arch/x86/kernel/dumpstack.c +0 -6
@@ -81,12 +81,6 @@ static int copy_code(struct pt_regs *reg/* The user space code from other tasks cannot be accessed. */ if (regs !=task_pt_regs (current))return -EPERM ; -/* -* Make sure userspace isn't trying to trick us into dumping kernel -* memory by pointing the userspace instruction pointer at it. -*/ -if (__chk_range_not_ok (src, nbytes,TASK_SIZE_MAX )) -return -EINVAL ;/* * Even if named copy_from_user_nmi() this can be invoked from
arch/x86/kernel/stacktrace.c +1 -1
@@ -90,7 +90,7 @@ copy_stack_frame(const struct stack_fram {int ret; -if (__range_not_ok (fp,sizeof (*frame),TASK_SIZE )) +if (!__access_ok (fp,sizeof (*frame)))return 0 ; ret =1 ;
arch/x86/lib/usercopy.c +1 -1
@@ -32,7 +32,7 @@ copy_from_user_nmi(void *to, const void {unsigned long ret; -if (__range_not_ok (from, n,TASK_SIZE )) +if (!__access_ok (from, n))return n;if (!nmi_uaccess_okay ())
Greg Kroah-Hartman
maintainerPATCH 493/554 pwm: stm32: Always program polarity
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
Commit 7346e7a058a2 ("pwm: stm32: Always do lazy disabling") triggered a regression where PWM polarity changes could be ignored.
stm32_pwm_set_polarity() was skipped due to a mismatch between the cached pwm->state.polarity and the actual hardware state, leaving the hardware polarity unchanged.
--- drivers/pwm/pwm-stm32.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pwm/pwm-stm32.c +1 -2
@@ -458,8 +458,7 @@ static int stm32_pwm_apply(struct pwm_chreturn 0 ; } -if (state->polarity != pwm->state.polarity) -stm32_pwm_set_polarity (priv, pwm->hwpwm, state->polarity); +stm32_pwm_set_polarity (priv, pwm->hwpwm, state->polarity); ret =stm32_pwm_config (priv, pwm->hwpwm, state->duty_cycle, state->period);
Greg Kroah-Hartman
maintainerPATCH 494/554 ext4: filesystems without casefold feature cannot be mounted with siphash
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
commit 985b67cd86392310d9e9326de941c22fc9340eec upstream.
When mounting the ext4 filesystem, if the default hash version is set to DX_HASH_SIPHASH but the casefold feature is not set, exit the mounting.
--- fs/ext4/super.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ext4/super.c +8 -0
@@ -3191,6 +3191,14 @@ int ext4_feature_set_ok(struct super_blo }#endif +if (EXT4_SB (sb)->s_es->s_def_hash_version ==DX_HASH_SIPHASH && + !ext4_has_feature_casefold (sb)) { +ext4_msg (sb,KERN_ERR , +"Filesystem without casefold feature cannot be " +"mounted with siphash" ); +return 0 ; + } +if (readonly)return 1 ;
Greg Kroah-Hartman
maintainerPATCH 495/554 ext4: factor out ext4_hash_info_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Yan <[email protected]>
commit db9345d9e6f075e1ec26afadf744078ead935fec upstream.
Factor out ext4_hash_info_init() to simplify __ext4_fill_super(). No functional change.
Stable-dep-of: a2187431c395 ("ext4: fix error message when rejecting the default hash")
--- fs/ext4/super.c | 50 ++++++++++++++++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 20 deletions(-)
fs/ext4/super.c +30 -20
@@ -3897,6 +3897,35 @@ static void ext4_setup_csum_trigger(stru sbi->s_journal_triggers[type].tr_triggers.t_frozen = trigger; } +static void ext4_hash_info_init (struct super_block *sb) +{ +struct ext4_sb_info *sbi =EXT4_SB (sb); +struct ext4_super_block *es = sbi->s_es; +unsigned int i; + +for (i =0 ; i <4 ; i++) + sbi->s_hash_seed[i] =le32_to_cpu (es->s_hash_seed[i]); + + sbi->s_def_hash_version = es->s_def_hash_version; +if (ext4_has_feature_dir_index (sb)) { + i =le32_to_cpu (es->s_flags); +if (i &EXT2_FLAGS_UNSIGNED_HASH ) + sbi->s_hash_unsigned =3 ; +else if ((i &EXT2_FLAGS_SIGNED_HASH ) ==0 ) { +#ifdef __CHAR_UNSIGNED__ +if (!sb_rdonly (sb)) + es->s_flags |= +cpu_to_le32 (EXT2_FLAGS_UNSIGNED_HASH ); + sbi->s_hash_unsigned =3 ; +#else +if (!sb_rdonly (sb)) + es->s_flags |= +cpu_to_le32 (EXT2_FLAGS_SIGNED_HASH ); +#endif + } + } +} +static int ext4_fill_super (struct super_block *sb,void *data,int silent) {struct dax_device *dax_dev =fs_dax_get_by_bdev (sb->s_bdev);
@@ -4415,26 +4444,7 @@ static int ext4_fill_super(struct super_ sbi->s_addr_per_block_bits =ilog2 (EXT4_ADDR_PER_BLOCK (sb)); sbi->s_desc_per_block_bits =ilog2 (EXT4_DESC_PER_BLOCK (sb)); -for (i =0 ; i <4 ; i++) - sbi->s_hash_seed[i] =le32_to_cpu (es->s_hash_seed[i]); - sbi->s_def_hash_version = es->s_def_hash_version; -if (ext4_has_feature_dir_index (sb)) { - i =le32_to_cpu (es->s_flags); -if (i &EXT2_FLAGS_UNSIGNED_HASH ) - sbi->s_hash_unsigned =3 ; -else if ((i &EXT2_FLAGS_SIGNED_HASH ) ==0 ) { -#ifdef __CHAR_UNSIGNED__ -if (!sb_rdonly (sb)) - es->s_flags |= -cpu_to_le32 (EXT2_FLAGS_UNSIGNED_HASH ); - sbi->s_hash_unsigned =3 ; -#else -if (!sb_rdonly (sb)) - es->s_flags |= -cpu_to_le32 (EXT2_FLAGS_SIGNED_HASH ); -#endif - } - } +ext4_hash_info_init (sb);/* Handle clustersize */ clustersize =BLOCK_SIZE <<le32_to_cpu (es->s_log_cluster_size);
Greg Kroah-Hartman
maintainerPATCH 496/554 ext4: fix error message when rejecting the default hash
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
commit a2187431c395cdfbf144e3536f25468c64fc7cfa upstream.
Commit 985b67cd8639 ("ext4: filesystems without casefold feature cannot be mounted with siphash") properly rejects volumes where s_def_hash_version is set to DX_HASH_SIPHASH, but the check and the error message should not look into casefold setup - a filesystem should never have DX_HASH_SIPHASH as the default hash. Fix it and, since we are there, move the check to ext4_hash_info_init.
be mounted with siphash")
--- fs/ext4/ext4.h | 1 + fs/ext4/super.c | 28 +++++++++++++++++----------- 2 files changed, 18 insertions(+), 11 deletions(-)
fs/ext4/ext4.h +1 -0
@@ -2443,6 +2443,7 @@ static inline __le16 ext4_rec_len_to_dis#define DX_HASH_HALF_MD4_UNSIGNED 4#define DX_HASH_TEA_UNSIGNED 5#define DX_HASH_SIPHASH 6 +#define DX_HASH_LAST DX_HASH_SIPHASHstatic inline u32 ext4_chksum (struct ext4_sb_info *sbi,u32 crc,const void *address,unsigned int length)
fs/ext4/super.c +17 -11
@@ -3191,14 +3191,6 @@ int ext4_feature_set_ok(struct super_blo }#endif -if (EXT4_SB (sb)->s_es->s_def_hash_version ==DX_HASH_SIPHASH && - !ext4_has_feature_casefold (sb)) { -ext4_msg (sb,KERN_ERR , -"Filesystem without casefold feature cannot be " -"mounted with siphash" ); -return 0 ; - } -if (readonly)return 1 ;
@@ -3897,16 +3889,27 @@ static void ext4_setup_csum_trigger(stru sbi->s_journal_triggers[type].tr_triggers.t_frozen = trigger; } -static void ext4_hash_info_init (struct super_block *sb) +static int ext4_hash_info_init (struct super_block *sb) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es;unsigned int i; + sbi->s_def_hash_version = es->s_def_hash_version; + +if (sbi->s_def_hash_version >DX_HASH_LAST ) { +ext4_msg (sb,KERN_ERR , +"Invalid default hash set in the superblock" ); +return -EINVAL ; + }else if (sbi->s_def_hash_version ==DX_HASH_SIPHASH ) { +ext4_msg (sb,KERN_ERR , +"SIPHASH is not a valid default hash value" ); +return -EINVAL ; + } +for (i =0 ; i <4 ; i++) sbi->s_hash_seed[i] =le32_to_cpu (es->s_hash_seed[i]); - sbi->s_def_hash_version = es->s_def_hash_version;if (ext4_has_feature_dir_index (sb)) { i =le32_to_cpu (es->s_flags);if (i &EXT2_FLAGS_UNSIGNED_HASH )
@@ -3924,6 +3927,7 @@ static void ext4_hash_info_init(struct s#endif } } +return 0 ; }static int ext4_fill_super (struct super_block *sb,void *data,int silent)
@@ -4444,7 +4448,9 @@ static int ext4_fill_super(struct super_ sbi->s_addr_per_block_bits =ilog2 (EXT4_ADDR_PER_BLOCK (sb)); sbi->s_desc_per_block_bits =ilog2 (EXT4_DESC_PER_BLOCK (sb)); -ext4_hash_info_init (sb); + err =ext4_hash_info_init (sb); +if (err) + goto failed_mount;/* Handle clustersize */ clustersize =BLOCK_SIZE <<le32_to_cpu (es->s_log_cluster_size);
Greg Kroah-Hartman
maintainerPATCH 497/554 firmware: arm_scmi: Fix unused notifier-block in unregister
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amitai Gottlieb <[email protected]>
In scmi_devm_notifier_unregister(), the notifier-block argument was ignored and never passed to devres_release(). As a result, the function always returned -ENOENT and failed to unregister the notifier.
Drivers that depend on this helper for teardown could therefore hit unexpected failures, including kernel panics.
Commit 264a2c520628 ("firmware: arm_scmi: Simplify scmi_devm_notifier_unregister") removed the faulty code path during refactoring and hence this fix is not required upstream.
--- drivers/firmware/arm_scmi/notify.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/arm_scmi/notify.c +1 -0
@@ -1539,6 +1539,7 @@ static int scmi_devm_notifier_unregister dres.handle = sdev->handle; dres.proto_id = proto_id; dres.evt_id = evt_id; + dres.nb = nb;if (src_id) { dres.__src_id = *src_id; dres.src_id = &dres.__src_id;
Greg Kroah-Hartman
maintainerPATCH 498/554 Revert "iommu/amd: Skip enabling command/event buffers for kdump"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit bb8f9de71c9bd442ec5e1d52ce830428860892f0 which is commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb upstream.
This causes problems in older kernel trees as SNP host kdump is not supported in them, so drop it from the stable branches.
--- drivers/iommu/amd/init.c | 28 +++++++++------------------- 1 file changed, 9 insertions(+), 19 deletions(-)
drivers/iommu/amd/init.c +9 -19
@@ -696,16 +696,11 @@ static void iommu_enable_command_buffer(BUG_ON (iommu->cmd_buf ==NULL ); -if (!is_kdump_kernel ()) { -/* -* Command buffer is re-used for kdump kernel and setting -* of MMIO register is not required. -*/ - entry =iommu_virt_to_phys (iommu->cmd_buf); - entry |=MMIO_CMD_SIZE_512 ; -memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , - &entry,sizeof (entry)); - } + entry =iommu_virt_to_phys (iommu->cmd_buf); + entry |=MMIO_CMD_SIZE_512 ; + +memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , + &entry,sizeof (entry));amd_iommu_reset_cmd_buffer (iommu); }
@@ -754,15 +749,10 @@ static void iommu_enable_event_buffer(stBUG_ON (iommu->evt_buf ==NULL ); -if (!is_kdump_kernel ()) { -/* -* Event buffer is re-used for kdump kernel and setting -* of MMIO register is not required. -*/ - entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; -memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , - &entry,sizeof (entry)); - } + entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; + +memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , + &entry,sizeof (entry));/* set head and tail to zero manually */ writel (0x00 , iommu->mmio_base +MMIO_EVT_HEAD_OFFSET );
Greg Kroah-Hartman
maintainerPATCH 499/554 net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
commit 0dcc53abf58d572d34c5313de85f607cd33fc691 upstream.
Clang static checker (scan-build) warning:
net/ethtool/ioctl.c:line 2233, column 2 Called function pointer is null (null dereference).
Return '-EOPNOTSUPP' when 'ops->get_ethtool_phy_stats' is NULL to fix this typo error.
--- net/ethtool/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ethtool/ioctl.c +1 -1
@@ -2111,7 +2111,7 @@ static int ethtool_get_phy_stats_ethtoolconst struct ethtool_ops *ops = dev->ethtool_ops;int n_stats, ret; -if (!ops || !ops->get_sset_count || ops->get_ethtool_phy_stats) +if (!ops || !ops->get_sset_count || !ops->get_ethtool_phy_stats)return -EOPNOTSUPP ; n_stats = ops->get_sset_count (dev,ETH_SS_PHY_STATS );
Greg Kroah-Hartman
maintainerPATCH 500/554 usb: gadget: lpc32xx_udc: fix clock imbalance in error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 782be79e4551550d7a82b1957fc0f7347e6d461f upstream.
A recent change fixing a device reference leak introduced a clock imbalance by reusing an error path so that the clock may be disabled before having been enabled.
Note that the clock framework allows for passing in NULL clocks so there is no risk for a NULL pointer dereference.
Also drop the bogus I2C client NULL check added by the offending commit as the pointer has already been verified to be non-NULL.
--- drivers/usb/gadget/udc/lpc32xx_udc.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/usb/gadget/udc/lpc32xx_udc.c +9 -10
@@ -3025,7 +3025,7 @@ static int lpc32xx_udc_probe(struct plat pdev->dev.dma_mask = &lpc32xx_usbd_dmamask; retval =dma_set_coherent_mask (&pdev->dev,DMA_BIT_MASK (32 ));if (retval) - goto i2c_fail; + goto err_put_client; udc->board = &lpc32xx_usbddata;
@@ -3045,7 +3045,7 @@ static int lpc32xx_udc_probe(struct plat udc->udp_irq[i] =platform_get_irq (pdev, i);if (udc->udp_irq[i] <0 ) { retval = udc->udp_irq[i]; - goto i2c_fail; + goto err_put_client; } }
@@ -3053,7 +3053,7 @@ static int lpc32xx_udc_probe(struct platif (IS_ERR (udc->udp_baseaddr)) {dev_err (udc->dev,"IO map failure\n" ); retval =PTR_ERR (udc->udp_baseaddr); - goto i2c_fail; + goto err_put_client; }/* Get USB device clock */
@@ -3061,14 +3061,14 @@ static int lpc32xx_udc_probe(struct platif (IS_ERR (udc->usb_slv_clk)) {dev_err (udc->dev,"failed to acquire USB device clock\n" ); retval =PTR_ERR (udc->usb_slv_clk); - goto i2c_fail; + goto err_put_client; }/* Enable USB device clock */ retval =clk_prepare_enable (udc->usb_slv_clk);if (retval <0 ) {dev_err (udc->dev,"failed to start USB device clock\n" ); - goto i2c_fail; + goto err_put_client; }/* Setup deferred workqueue data */
@@ -3170,9 +3170,10 @@ dma_alloc_fail:dma_free_coherent (&pdev->dev,UDCA_BUFF_SIZE , udc->udca_v_base, udc->udca_p_base); i2c_fail: -if (udc->isp1301_i2c_client) -put_device (&udc->isp1301_i2c_client->dev);clk_disable_unprepare (udc->usb_slv_clk); +err_put_client: +put_device (&udc->isp1301_i2c_client->dev); +dev_err (udc->dev,"%s probe failed, %d\n" , driver_name, retval);return retval;
@@ -3197,11 +3198,9 @@ static int lpc32xx_udc_remove(struct pladma_free_coherent (&pdev->dev,UDCA_BUFF_SIZE , udc->udca_v_base, udc->udca_p_base); -if (udc->isp1301_i2c_client) -put_device (&udc->isp1301_i2c_client->dev); -clk_disable_unprepare (udc->usb_slv_clk); +put_device (&udc->isp1301_i2c_client->dev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 501/554 atm: Fix dma_free_coherent() size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 4d984b0574ff708e66152763fbfdef24ea40933f upstream.
The size of the buffer is not the same when alloc'd with dma_alloc_coherent() in he_init_tpdrq() and freed.
--- drivers/atm/he.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/atm/he.c +2 -1
@@ -1590,7 +1590,8 @@ he_stop(struct he_dev *he_dev) he_dev->tbrq_base, he_dev->tbrq_phys);if (he_dev->tpdrq_base) -dma_free_coherent (&he_dev->pci_dev->dev,CONFIG_TBRQ_SIZE *sizeof (struct he_tbrq ), +dma_free_coherent (&he_dev->pci_dev->dev, +CONFIG_TPDRQ_SIZE *sizeof (struct he_tpdrq ), he_dev->tpdrq_base, he_dev->tpdrq_phys);dma_pool_destroy (he_dev->tpd_pool);
Greg Kroah-Hartman
maintainerPATCH 502/554 net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit a4e305ed60f7c41bbf9aabc16dd75267194e0de3 upstream.
pdev can be null and free_ring: can be called in 1297 with a null pdev.
--- drivers/net/ethernet/3com/3c59x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/3com/3c59x.c +1 -1
@@ -1471,7 +1471,7 @@ static int vortex_probe1(struct device *return 0 ; free_ring: -dma_free_coherent (&pdev->dev, +dma_free_coherent (gendev,sizeof (struct boom_rx_desc ) *RX_RING_SIZE +sizeof (struct boom_tx_desc ) *TX_RING_SIZE , vp->rx_ring, vp->rx_ring_dma);
Greg Kroah-Hartman
maintainerPATCH 503/554 mei: me: add nova lake point S DID
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 420f423defcf6d0af2263d38da870ca4a20c0990 upstream.
Add Nova Lake S device id.
--- drivers/misc/mei/hw-me-regs.h | 2 ++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/misc/mei/hw-me-regs.h +2 -0
@@ -122,6 +122,8 @@#define MEI_DEV_ID_WCL_P 0x4D70/* Wildcat Lake P */ +#define MEI_DEV_ID_NVL_S 0x6E68/* Nova Lake Point S */ +/* * MEI HW Section */
drivers/misc/mei/pci-me.c +2 -0
@@ -128,6 +128,8 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_NVL_S, MEI_ME_PCH15_CFG)}, +/* required last entry */ {0, } };
Greg Kroah-Hartman
maintainerPATCH 504/554 lib/crypto: aes: Fix missing MMU protection for AES S-box
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 74d74bb78aeccc9edc10db216d6be121cf7ec176 upstream.
__cacheline_aligned puts the data in the ".data..cacheline_aligned" section, which isn't marked read-only i.e. it doesn't receive MMU protection. Replace it with ____cacheline_aligned which does the right thing and just aligns the data while keeping it in ".rodata".
--- lib/crypto/aes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/crypto/aes.c +2 -2
@@ -12,7 +12,7 @@* Emit the sbox as volatile const to prevent the compiler from doing * constant folding on sbox references involving fixed indexes. */ -static volatile const u8 __cacheline_aligned aes_sbox[] = { +static volatile const u8 ____cacheline_aligned aes_sbox[] = {0x63 ,0x7c ,0x77 ,0x7b ,0xf2 ,0x6b ,0x6f ,0xc5 ,0x30 ,0x01 ,0x67 ,0x2b ,0xfe ,0xd7 ,0xab ,0x76 ,0xca ,0x82 ,0xc9 ,0x7d ,0xfa ,0x59 ,0x47 ,0xf0 ,
@@ -47,7 +47,7 @@ static volatile const u8 __cacheline_ali 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16, }; -static volatile const u8 __cacheline_aligned aes_inv_sbox[] = { +static volatile const u8 ____cacheline_aligned aes_inv_sbox[] = {0x52 ,0x09 ,0x6a ,0xd5 ,0x30 ,0x36 ,0xa5 ,0x38 ,0xbf ,0x40 ,0xa3 ,0x9e ,0x81 ,0xf3 ,0xd7 ,0xfb ,0x7c ,0xe3 ,0x39 ,0x82 ,0x9b ,0x2f ,0xff ,0x87 ,
Greg Kroah-Hartman
maintainerPATCH 505/554 drm/pl111: Fix error handling in pl111_amba_probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 0ddd3bb4b14c9102c0267b3fd916c81fe5ab89c1 upstream.
Jump to the existing dev_put label when devm_request_irq() fails so drm_dev_put() and of_reserved_mem_device_release() run instead of returning early and leaking resources.
Found via static analysis and code review.
--- drivers/gpu/drm/pl111/pl111_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/pl111/pl111_drv.c +1 -1
@@ -297,7 +297,7 @@ static int pl111_amba_probe(struct amba_ variant->name, priv);if (ret !=0 ) {dev_err (dev,"%s failed irq %d\n" , __func__, ret); -return ret; + goto dev_put; } ret =pl111_modeset_init (drm);
Greg Kroah-Hartman
maintainerPATCH 506/554 wifi: avoid kernel-infoleak from struct iw_point
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 21cbf883d073abbfe09e3924466aa5e0449e7261 upstream.
struct iw_point has a 32bit hole on 64bit arches.
struct iw_point {
void __user *pointer; /* Pointer to the data (in user space) */ __u16 length; /* number of fields or size in bytes */ __u16 flags; /* Optional params */
};
Make sure to zero the structure to avoid disclosing 32bits of kernel data to user space.
--- net/wireless/wext-core.c | 4 ++++ net/wireless/wext-priv.c | 4 ++++ 2 files changed, 8 insertions(+)
net/wireless/wext-core.c +4 -0
@@ -1084,6 +1084,10 @@ static int compat_standard_call(struct nreturn ioctl_standard_call (dev, iwr, cmd, info, handler); iwp_compat = (struct compat_iw_point *) &iwr->u.data; + +/* struct iw_point has a 32bit hole on 64bit arches. */ +memset (&iwp,0 ,sizeof (iwp)); + iwp.pointer =compat_ptr (iwp_compat->pointer); iwp.length = iwp_compat->length; iwp.flags = iwp_compat->flags;
net/wireless/wext-priv.c +4 -0
@@ -228,6 +228,10 @@ int compat_private_call(struct net_devicstruct iw_point iwp; iwp_compat = (struct compat_iw_point *) &iwr->u.data; + +/* struct iw_point has a 32bit hole on 64bit arches. */ +memset (&iwp,0 ,sizeof (iwp)); + iwp.pointer =compat_ptr (iwp_compat->pointer); iwp.length = iwp_compat->length; iwp.flags = iwp_compat->flags;
Greg Kroah-Hartman
maintainerPATCH 507/554 libceph: prevent potential out-of-bounds reads in handle_auth_done()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: ziming zhang <[email protected]>
commit 818156caffbf55cb4d368f9c3cac64e458fb49c9 upstream.
Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout.
[ idryomov: changelog ]
--- net/ceph/messenger_v2.c | 2 ++ 1 file changed, 2 insertions(+)
net/ceph/messenger_v2.c +2 -0
@@ -2068,7 +2068,9 @@ static int process_auth_done(struct cephceph_decode_64_safe (&p, end, global_id, bad);ceph_decode_32_safe (&p, end, con->v2.con_mode, bad); +ceph_decode_32_safe (&p, end, payload_len, bad); +ceph_decode_need (&p, end, payload_len, bad);dout ("%s con %p global_id %llu con_mode %d payload_len %d\n" , __func__, con, global_id, con->v2.con_mode, payload_len);
Greg Kroah-Hartman
maintainerPATCH 508/554 libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit e00c3f71b5cf75681dbd74ee3f982a99cb690c2b upstream.
If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the incremental osdmap to be invalid.
--- net/ceph/osdmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ceph/osdmap.c +3 -1
@@ -1959,11 +1959,13 @@ struct ceph_osdmap *osdmap_apply_increme sizeof(u64) + sizeof(u32), e_inval);ceph_decode_copy (p, &fsid,sizeof (fsid)); epoch =ceph_decode_32 (p); -BUG_ON (epoch != map->epoch+1 );ceph_decode_copy (p, &modified,sizeof (modified)); new_pool_max =ceph_decode_64 (p); new_flags =ceph_decode_32 (p); +if (epoch != map->epoch +1 ) + goto e_inval; +/* full map? */ ceph_decode_32_safe (p, end, len, e_inval);if (len >0 ) {
Greg Kroah-Hartman
maintainerPATCH 509/554 libceph: make free_choose_arg_map() resilient to partial allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuo Li <[email protected]>
commit e3fe30e57649c551757a02e1cad073c47e1e075e upstream.
free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation.
For example, in decode_choose_args(), if allocation of arg_map->args fails, execution jumps to the fail label and free_choose_arg_map() is called. Since arg_map->size is updated to a non-zero value before memory allocation, free_choose_arg_map() will iterate over arg_map->args and dereference a NULL pointer.
To prevent this potential NULL pointer dereference and make free_choose_arg_map() more resilient, add checks for pointers before iterating.
--- net/ceph/osdmap.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
net/ceph/osdmap.c +12 -8
@@ -225,22 +225,26 @@ static struct crush_choose_arg_map *allostatic void free_choose_arg_map (struct crush_choose_arg_map *arg_map) { -if (arg_map) { -int i, j; +int i, j; -WARN_ON (!RB_EMPTY_NODE (&arg_map->node)); +if (!arg_map) +return ; +WARN_ON (!RB_EMPTY_NODE (&arg_map->node)); + +if (arg_map->args) {for (i =0 ; i < arg_map->size; i++) {struct crush_choose_arg *arg = &arg_map->args[i]; - -for (j =0 ; j < arg->weight_set_size; j++) -kfree (arg->weight_set[j].weights); -kfree (arg->weight_set); +if (arg->weight_set) { +for (j =0 ; j < arg->weight_set_size; j++) +kfree (arg->weight_set[j].weights); +kfree (arg->weight_set); + }kfree (arg->ids); }kfree (arg_map->args); -kfree (arg_map); } +kfree (arg_map); } DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,
Greg Kroah-Hartman
maintainerPATCH 510/554 libceph: return the handler error from mon_handle_auth_done()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit e84b48d31b5008932c0a0902982809fbaa1d3b70 upstream.
Currently any error from ceph_auth_handle_reply_done() is propagated via finish_auth() but isn't returned from mon_handle_auth_done(). This results in higher layers learning that (despite the monitor considering us to be successfully authenticated) something went wrong in the authentication phase and reacting accordingly, but msgr2 still trying to proceed with establishing the session in the background. In the case of secure mode this can trigger a WARN in setup_crypto() and later lead to a NULL pointer dereference inside of prepare_auth_signature().
--- net/ceph/mon_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ceph/mon_client.c +1 -1
@@ -1418,7 +1418,7 @@ static int mon_handle_auth_done(struct cif (!ret)finish_hunting (monc);mutex_unlock (&monc->mutex); -return 0 ; +return ret; } static int mon_handle_auth_bad_method(struct ceph_connection *con,
Greg Kroah-Hartman
maintainerPATCH 511/554 libceph: make calc_target() set t->paused, not just clear it
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit c0fe2994f9a9d0a2ec9e42441ea5ba74b6a16176 upstream.
Currently calc_target() clears t->paused if the request shouldn't be paused anymore, but doesn't ever set t->paused even though it's able to determine when the request should be paused. Setting t->paused is left to __submit_request() which is fine for regular requests but doesn't work for linger requests -- since __submit_request() doesn't operate on linger requests, there is nowhere for lreq->t.paused to be set. One consequence of this is that watches don't get reestablished on paused -> unpaused transitions in cases where requests have been paused long enough for the (paused) unwatch request to time out and for the subsequent (re)watch request to enter the paused state. On top of the watch not getting reestablished, rbd_reregister_watch() gets stuck with rbd_dev->watch_mutex held:
rbd_register_watch
__rbd_register_watch
ceph_osdc_watch
linger_reg_commit_wait
It's waiting for lreq->reg_commit_wait to be completed, but for that to happen the respective request needs to end up on need_resend_linger list and be kicked when requests are unpaused. There is no chance for that if the request in question is never marked paused in the first place.
The fact that rbd_dev->watch_mutex remains taken out forever then prevents the image from getting unmapped -- "rbd unmap" would inevitably hang in D state on an attempt to grab the mutex.
--- net/ceph/osd_client.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ceph/osd_client.c +9 -2
@@ -1529,6 +1529,7 @@ static enum calc_target_result calc_targstruct ceph_pg_pool_info *pi;struct ceph_pg pgid, last_pgid;struct ceph_osds up, acting; +bool should_be_paused;bool is_read = t->flags &CEPH_OSD_FLAG_READ ;bool is_write = t->flags &CEPH_OSD_FLAG_WRITE ;bool force_resend = false;
@@ -1597,10 +1598,16 @@ static enum calc_target_result calc_targ &last_pgid)) force_resend = true; -if (t->paused && !target_should_be_paused (osdc, t, pi)) { - t->paused = false; + should_be_paused =target_should_be_paused (osdc, t, pi); +if (t->paused && !should_be_paused) { unpaused = true; } +if (t->paused != should_be_paused) { +dout ("%s t %p paused %d -> %d\n" , __func__, t, t->paused, + should_be_paused); + t->paused = should_be_paused; + } + legacy_change =ceph_pg_compare (&t->pgid, &pgid) ||ceph_osds_changed (&t->acting, &acting, t->used_replica || any_change);
Greg Kroah-Hartman
maintainerPATCH 512/554 ext4: introduce ITAIL helper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 69f3a3039b0d0003de008659cafd5a1eaaa0a7a4 ]
Introduce ITAIL helper to get the bound of xattr in inode.
--- fs/ext4/xattr.c | 10 +++++----- fs/ext4/xattr.h | 3 +++ 2 files changed, 8 insertions(+), 5 deletions(-)
fs/ext4/xattr.c +5 -5
@@ -599,7 +599,7 @@ ext4_xattr_ibody_get(struct inode *inodereturn error; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); error =xattr_check_inode (inode, header, end);if (error) goto cleanup;
@@ -744,7 +744,7 @@ ext4_xattr_ibody_list(struct dentry *denreturn error; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); error =xattr_check_inode (inode, header, end);if (error) goto cleanup;
@@ -830,7 +830,7 @@ int ext4_get_inode_usage(struct inode *i goto out; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); ret =xattr_check_inode (inode, header, end);if (ret) goto out;
@@ -2228,7 +2228,7 @@ int ext4_xattr_ibody_find(struct inode * header =IHDR (inode, raw_inode); is->s.base = is->s.first =IFIRST (header); is->s.here = is->s.first; - is->s.end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + is->s.end =ITAIL (inode, raw_inode);if (ext4_test_inode_state (inode,EXT4_STATE_XATTR )) { error =xattr_check_inode (inode, header, is->s.end);if (error)
@@ -2753,7 +2753,7 @@ retry:*/ base =IFIRST (header); - end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; + end =ITAIL (inode, raw_inode); min_offs = end - base; total_ino =sizeof (struct ext4_xattr_ibody_header ) +sizeof (u32);
fs/ext4/xattr.h +3 -0
@@ -68,6 +68,9 @@ struct ext4_xattr_entry { ((void *)raw_inode + \ EXT4_GOOD_OLD_INODE_SIZE + \ EXT4_I(inode)->i_extra_isize)) +#define ITAIL (inode, raw_inode) \ + ((void *)(raw_inode) + \ + EXT4_SB((inode)->i_sb)->s_inode_size)#define IFIRST (hdr) ((struct ext4_xattr_entry *)((hdr)+1))/*
Greg Kroah-Hartman
maintainerPATCH 513/554 ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 5701875f9609b000d91351eaa6bfd97fe2f157f4 ]
There's issue as follows:
BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790
Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172
CPU: 3 PID: 15172 Comm: syz-executor.0
Call Trace:
__dump_stack lib/dump_stack.c:82 [inline]
dump_stack+0xbe/0xfd lib/dump_stack.c:123
print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400
__kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560
kasan_report+0x3a/0x50 mm/kasan/report.c:585
ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137
ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896
ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323
evict+0x39f/0x880 fs/inode.c:622
iput_final fs/inode.c:1746 [inline]
iput fs/inode.c:1772 [inline]
iput+0x525/0x6c0 fs/inode.c:1758
ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]
ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300
mount_bdev+0x355/0x410 fs/super.c:1446
legacy_get_tree+0xfe/0x220 fs/fs_context.c:611
vfs_get_tree+0x8d/0x2f0 fs/super.c:1576
do_new_mount fs/namespace.c:2983 [inline]
path_mount+0x119a/0x1ad0 fs/namespace.c:3316
do_mount+0xfc/0x110 fs/namespace.c:3329
__do_sys_mount fs/namespace.c:3540 [inline]
__se_sys_mount+0x219/0x2e0 fs/namespace.c:3514
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Memory state around the buggy address:
ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffAbove issue happens as ext4_xattr_delete_inode() isn't check xattr is valid if xattr is in inode.
To solve above issue call xattr_check_inode() check if xattr if valid in inode. In fact, we can directly verify in ext4_iget_extra_inode(), so that there is no divergent verification.
--- fs/ext4/inode.c | 5 +++++ fs/ext4/xattr.c | 26 +------------------------- fs/ext4/xattr.h | 7 +++++++ 3 files changed, 13 insertions(+), 25 deletions(-)
fs/ext4/inode.c +5 -0
@@ -4562,6 +4562,11 @@ static inline int ext4_iget_extra_inode( *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {int err; + err =xattr_check_inode (inode,IHDR (inode, raw_inode), +ITAIL (inode, raw_inode)); +if (err) +return err; +ext4_set_inode_state (inode,EXT4_STATE_XATTR ); err =ext4_find_inline_data_nolock (inode);if (!err &&ext4_has_inline_data (inode))
fs/ext4/xattr.c +1 -25
@@ -263,7 +263,7 @@ errout: __ext4_xattr_check_block((inode), (bh), __func__, __LINE__) -static int +int __xattr_check_inode (struct inode *inode,struct ext4_xattr_ibody_header *header,void *end,const char *function,unsigned int line) {
@@ -280,9 +280,6 @@ errout:return error; } -#define xattr_check_inode (inode, header, end) \ - __xattr_check_inode((inode), (header), (end), __func__, __LINE__) -static int xattr_find_entry (struct inode *inode,struct ext4_xattr_entry **pentry,void *end,int name_index,const char *name,int sorted)
@@ -600,9 +597,6 @@ ext4_xattr_ibody_get(struct inode *inode raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); end =ITAIL (inode, raw_inode); - error =xattr_check_inode (inode, header, end); -if (error) - goto cleanup; entry =IFIRST (header); error =xattr_find_entry (inode, &entry, end, name_index, name,0 );if (error)
@@ -734,7 +728,6 @@ ext4_xattr_ibody_list(struct dentry *denstruct ext4_xattr_ibody_header *header;struct ext4_inode *raw_inode;struct ext4_iloc iloc; -void *end;int error;if (!ext4_test_inode_state (inode,EXT4_STATE_XATTR ))
@@ -744,14 +737,9 @@ ext4_xattr_ibody_list(struct dentry *denreturn error; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end =ITAIL (inode, raw_inode); - error =xattr_check_inode (inode, header, end); -if (error) - goto cleanup; error =ext4_xattr_list_entries (dentry,IFIRST (header), buffer, buffer_size); -cleanup:brelse (iloc.bh);return error; }
@@ -819,7 +807,6 @@ int ext4_get_inode_usage(struct inode *istruct ext4_xattr_ibody_header *header;struct ext4_xattr_entry *entry;qsize_t ea_inode_refs =0 ; -void *end;int ret;lockdep_assert_held_read (&EXT4_I (inode)->xattr_sem);
@@ -830,10 +817,6 @@ int ext4_get_inode_usage(struct inode *i goto out; raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); - end =ITAIL (inode, raw_inode); - ret =xattr_check_inode (inode, header, end); -if (ret) - goto out;for (entry =IFIRST (header); !IS_LAST_ENTRY (entry); entry =EXT4_XATTR_NEXT (entry))
@@ -2230,9 +2213,6 @@ int ext4_xattr_ibody_find(struct inode * is->s.here = is->s.first; is->s.end =ITAIL (inode, raw_inode);if (ext4_test_inode_state (inode,EXT4_STATE_XATTR )) { - error =xattr_check_inode (inode, header, is->s.end); -if (error) -return error;/* Find the named attribute. */ error =xattr_find_entry (inode, &is->s.here, is->s.end, i->name_index, i->name,0 );
@@ -2757,10 +2737,6 @@ retry: min_offs = end - base; total_ino =sizeof (struct ext4_xattr_ibody_header ) +sizeof (u32); - error =xattr_check_inode (inode, header, end); -if (error) - goto cleanup; - ifree =ext4_xattr_free_space (base, &min_offs, base, &total_ino);if (ifree >= isize_diff) goto shift;
fs/ext4/xattr.h +7 -0
@@ -210,6 +210,13 @@ extern int ext4_xattr_ibody_set(handle_textern struct mb_cache *ext4_xattr_create_cache (void );extern void ext4_xattr_destroy_cache (struct mb_cache *); +extern int +__xattr_check_inode (struct inode *inode,struct ext4_xattr_ibody_header *header, +void *end,const char *function,unsigned int line); + +#define xattr_check_inode (inode, header, end) \ + __xattr_check_inode((inode), (header), (end), __func__, __LINE__) +#ifdef CONFIG_EXT4_FS_SECURITY extern int ext4_init_security (handle_t *handle,struct inode *inode,struct inode *dir,const struct qstr *qstr);
Greg Kroah-Hartman
maintainerPATCH 514/554 net: Add locking to protect skb->dev access in ip_output
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sharath Chandra Vurukala <[email protected]>
[ Upstream commit 1dbf1d590d10a6d1978e8184f8dfe20af22d680a]
In ip_output() skb->dev is updated from the skb_dst(skb)->dev this can become invalid when the interface is unregistered and freed,
Introduced new skb_dst_dev_rcu() function to be used instead of skb_dst_dev() within rcu_locks in ip_output.This will ensure that all the skb's associated with the dev being deregistered will be transnmitted out first, before freeing the dev.
Given that ip_output() is called within an rcu_read_lock() critical section or from a bottom-half context, it is safe to introduce an RCU read-side critical section within it.
Multiple panic call stacks were observed when UL traffic was run in concurrency with device deregistration from different functions, pasting one sample for reference.
[496733.627565][T13385] Call trace: [496733.627570][T13385] bpf_prog_ce7c9180c3b128ea_cgroupskb_egres+0x24c/0x7f0 [496733.627581][T13385] __cgroup_bpf_run_filter_skb+0x128/0x498 [496733.627595][T13385] ip_finish_output+0xa4/0xf4 [496733.627605][T13385] ip_output+0x100/0x1a0 [496733.627613][T13385] ip_send_skb+0x68/0x100 [496733.627618][T13385] udp_send_skb+0x1c4/0x384 [496733.627625][T13385] udp_sendmsg+0x7b0/0x898 [496733.627631][T13385] inet_sendmsg+0x5c/0x7c [496733.627639][T13385] __sys_sendto+0x174/0x1e4 [496733.627647][T13385] __arm64_sys_sendto+0x28/0x3c [496733.627653][T13385] invoke_syscall+0x58/0x11c [496733.627662][T13385] el0_svc_common+0x88/0xf4 [496733.627669][T13385] do_el0_svc+0x2c/0xb0 [496733.627676][T13385] el0_svc+0x2c/0xa4 [496733.627683][T13385] el0t_64_sync_handler+0x68/0xb4 [496733.627689][T13385] el0t_64_sync+0x1a4/0x1a8
Changes in v3:
- Replaced WARN_ON() with WARN_ON_ONCE(), as suggested by Willem de Bruijn.
- Dropped legacy lines mistakenly pulled in from an outdated branch.
Changes in v2:
- Addressed review comments from Eric Dumazet
- Used READ_ONCE() to prevent potential load/store tearing
- Added skb_dst_dev_rcu() and used along with rcu_read_lock() in ip_output
--- include/net/dst.h | 12 ++++++++++++ net/ipv4/ip_output.c | 16 +++++++++++----- 2 files changed, 23 insertions(+), 5 deletions(-)
include/net/dst.h +12 -0
@@ -554,6 +554,18 @@ static inline void skb_dst_update_pmtu_n dst->ops->update_pmtu (dst,NULL , skb, mtu, false); } +static inline struct net_device *dst_dev_rcu (const struct dst_entry *dst) +{ +/* In the future, use rcu_dereference(dst->dev) */ +WARN_ON_ONCE (!rcu_read_lock_held ()); +return READ_ONCE (dst->dev); +} + +static inline struct net_device *skb_dst_dev_rcu (const struct sk_buff *skb) +{ +return dst_dev_rcu (skb_dst (skb)); +} +struct dst_entry *dst_blackhole_check (struct dst_entry *dst,u32 cookie);void dst_blackhole_update_pmtu (struct dst_entry *dst,struct sock *sk,struct sk_buff *skb,u32 mtu,bool confirm_neigh);
net/ipv4/ip_output.c +11 -5
@@ -420,17 +420,23 @@ int ip_mc_output(struct net *net, structint ip_output (struct net *net,struct sock *sk,struct sk_buff *skb) { -struct net_device *dev =skb_dst (skb)->dev, *indev = skb->dev; +struct net_device *dev, *indev = skb->dev; +int ret_val; + +rcu_read_lock (); + dev =skb_dst_dev_rcu (skb);IP_UPD_PO_STATS (net,IPSTATS_MIB_OUT , skb->len); skb->dev = dev; skb->protocol =htons (ETH_P_IP ); -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , - net, sk, skb, indev, dev, - ip_finish_output, - !(IPCB (skb)->flags &IPSKB_REROUTED )); + ret_val =NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , + net, sk, skb, indev, dev, + ip_finish_output, + !(IPCB (skb)->flags &IPSKB_REROUTED )); +rcu_read_unlock (); +return ret_val; }EXPORT_SYMBOL (ip_output);
Greg Kroah-Hartman
maintainerPATCH 515/554 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit c65f27b9c3be2269918e1cbad6d8884741f835c5 ]
get_netdev_for_sock() is called during setsockopt(), so not under RCU.
Using sk_dst_get(sk)->dev could trigger UAF.
Let's use __sk_dst_get() and dst_dev_rcu().
Note that the only ->ndo_sk_get_lower_dev() user is bond_sk_get_lower_dev(), which uses RCU.
--- net/tls/tls_device.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
net/tls/tls_device.c +10 -8
@@ -110,17 +110,19 @@ static void tls_device_queue_ctx_destruc/* We assume that the socket is already connected */ static struct net_device *get_netdev_for_sock (struct sock *sk) { -struct dst_entry *dst =sk_dst_get (sk); -struct net_device *netdev =NULL ; +struct net_device *dev, *lowest_dev =NULL ; +struct dst_entry *dst; -if (likely (dst)) { - netdev =netdev_sk_get_lowest_dev (dst->dev, sk); -dev_hold (netdev); +rcu_read_lock (); + dst =__sk_dst_get (sk); + dev = dst ?dst_dev_rcu (dst) :NULL ; +if (likely (dev)) { + lowest_dev =netdev_sk_get_lowest_dev (dev, sk); +dev_hold (lowest_dev); } +rcu_read_unlock (); -dst_release (dst); - -return netdev; +return lowest_dev; }static void destroy_record (struct tls_record_info *record)
Greg Kroah-Hartman
maintainerPATCH 516/554 csky: fix csky_cmpxchg_fixup not working
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Li <[email protected]>
[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ]
In the csky_cmpxchg_fixup function, it is incorrect to use the global variable csky_cmpxchg_stw to determine the address where the exception occurred.The global variable csky_cmpxchg_stw stores the opcode at the time of the exception, while &csky_cmpxchg_stw shows the address where the exception occurred.
--- arch/csky/mm/fault.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/csky/mm/fault.c +2 -2
@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs)if (trap_no (regs) !=VEC_TLBMODIFIED )return ; -if (instruction_pointer (regs) == csky_cmpxchg_stw) -instruction_pointer_set (regs, csky_cmpxchg_ldw); +if (instruction_pointer (regs) == (unsigned long )&csky_cmpxchg_stw) +instruction_pointer_set (regs, (unsigned long )&csky_cmpxchg_ldw); return; }#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 517/554 ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ]
gup_pgd_range() is invoked with disabled interrupts and invokes __kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() which uses a spinlock_t via lock_kmap_any(). This leads to an sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a sleeping lock and must not be acquired in atomic context.
The loop in map_new_virtual() uses wait_queue_head_t for wake up which also is using a spinlock_t.
Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT to allow the use of get_user_pages_fast().
[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP]
--- arch/arm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/Kconfig +1 -1
@@ -1473,7 +1473,7 @@ config HIGHMEM config HIGHPTE bool "Allocate 2nd-level pagetables from highmem" if EXPERT - depends on HIGHMEM + depends on HIGHMEM && !PREEMPT_RT default y help The VM uses one page of physical memory for each page table.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 518/554 alpha: dont reference obsolete termio struct for TC* constants
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam James <[email protected]>
[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ]
Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead.
This fixes building Python for example, which falls over like:
./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
--- arch/alpha/include/uapi/asm/ioctls.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/alpha/include/uapi/asm/ioctls.h +4 -4
@@ -23,10 +23,10 @@#define TCSETSW _IOW('t', 21, struct termios)#define TCSETSF _IOW('t', 22, struct termios) -#define TCGETA _IOR('t', 23, struct termio) -#define TCSETA _IOW('t', 24, struct termio) -#define TCSETAW _IOW('t', 25, struct termio) -#define TCSETAF _IOW('t', 28, struct termio) +#define TCGETA 0x40127417 +#define TCSETA 0x80127418 +#define TCSETAW 0x80127419 +#define TCSETAF 0x8012741c#define TCSBRK _IO('t', 29)#define TCXONC _IO('t', 30)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 519/554 NFSv4: ensure the open stateid seqid doesnt go backwards
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <[email protected]>
[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ]
We have observed an NFSv4 client receiving a LOCK reply with a status of NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an earlier seqid value in the stateid. As this was for a new lockowner, that would imply that nfs_set_open_stateid_locked() had updated the open stateid seqid with an earlier value.
Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out of sequence, the task will sleep on the state->waitq for up to 5 seconds. If the task waits for the full 5 seconds, then after finishing the wait it'll update the open stateid seqid with whatever value the incoming seqid has. If there are multiple waiters in this scenario, then the last one to perform said update may not be the one with the highest seqid.
Add a check to ensure that the seqid can only be incremented, and add a tracepoint to indicate when old seqids are skipped.
--- fs/nfs/nfs4proc.c | 13 +++++++++++-- fs/nfs/nfs4trace.h | 1 + 2 files changed, 12 insertions(+), 2 deletions(-)
fs/nfs/nfs4proc.c +11 -2
@@ -1709,8 +1709,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state,if (nfs_stateid_is_sequential (state, stateid))break ; -if (status) -break ; +if (status) { +if (nfs4_stateid_match_other (stateid, &state->open_stateid) && + !nfs4_stateid_is_newer (stateid, &state->open_stateid)) { +trace_nfs4_open_stateid_update_skip (state->inode, + stateid, status); +return ; + }else { +break ; + } + } +/* Rely on seqids for serialisation with NFSv4.0 */ if (!nfs4_has_session (NFS_SERVER (state->inode)->nfs_client))break ;
fs/nfs/nfs4trace.h +1 -0
@@ -1205,6 +1205,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr);DEFINE_NFS4_INODE_STATEID_EVENT (nfs4_delegreturn);DEFINE_NFS4_INODE_STATEID_EVENT (nfs4_open_stateid_update);DEFINE_NFS4_INODE_STATEID_EVENT (nfs4_open_stateid_update_wait); +DEFINE_NFS4_INODE_STATEID_EVENT (nfs4_open_stateid_update_skip);DEFINE_NFS4_INODE_STATEID_EVENT (nfs4_close_stateid_update_wait); DECLARE_EVENT_CLASS(nfs4_getattr_event,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 520/554 NFS: Fix up the automount fs_context to use the correct cred
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ]
When automounting, the fs_context should be fixed up to use the cred from the parent filesystem, since the operation is just extending the namespace. Authorisation to enter that namespace will already have been provided by the preceding lookup.
--- fs/nfs/namespace.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/namespace.c +5 -0
@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path)if (!ctx->clone_data.fattr) goto out_fc; +if (fc->cred != server->cred) { +put_cred (fc->cred); + fc->cred =get_cred (server->cred); + } +if (fc->net_ns != client->cl_net) {put_net (fc->net_ns); fc->net_ns =get_net (client->cl_net);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 521/554 scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Xiong <[email protected]>
[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ]
A dynamic remove/add storage adapter test hits EEH on PowerPC:
EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
EEH: [c00000000017e558] process_one_work+0x298/0x590
EEH: [c00000000017eef8] worker_thread+0xa8/0x620
EEH: [c00000000018be34] kthread+0x124/0x130
EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by irqbalance daemon. If we disable irqbalance daemon, we won't see the issue.
With debug enabled in ipr driver:
[ 44.103071] ipr: Entering __ipr_remove [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown [ 44.149918] ipr: Entering ipr_reset_ucode_download [ 44.149935] ipr: Entering ipr_reset_alert [ 44.150032] ipr: Entering ipr_reset_start_timer [ 44.150038] ipr: Leaving ipr_reset_alert [ 44.244343] scsi 1:2:3:0: alua: Detached [ 44.254300] ipr: Entering ipr_reset_start_bist [ 44.254320] ipr: Entering ipr_reset_start_timer [ 44.254325] ipr: Leaving ipr_reset_start_bist [ 44.364329] scsi 1:2:4:0: alua: Detached [ 45.134341] scsi 1:2:5:0: alua: Detached [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa [ 45.860966] ipr: Entering ipr_reset_alert [ 45.861028] ipr: Entering ipr_reset_start_timer [ 45.861035] ipr: Leaving ipr_reset_alert [ 45.964302] ipr: Entering ipr_reset_start_bist [ 45.964309] ipr: Entering ipr_reset_start_timer [ 45.964313] ipr: Leaving ipr_reset_start_bist [ 46.264301] ipr: Entering ipr_reset_bist_done [ 46.264309] ipr: Leaving ipr_reset_bist_done
During adapter reset, ipr device driver blocks config space access but can't block MMIO access for MSI-X entries. There is very small window:
irqbalance daemon kicks in during adapter reset before ipr driver calls pci_restore_state(pdev) to restore MSI-X table.
irqbalance daemon reads back all 0 for that MSI-X vector in __pci_read_msi_msg().
irqbalance daemon:
msi_domain_set_affinity()
->irq_chip_set_affinity_patent()
->xive_irq_set_affinity()
->irq_chip_compose_msi_msg()
->pseries_msi_compose_msg()
->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
->irq_chip_write_msi_msg()
-> pci_write_msg_msi(): write 0 to the msix vector entryWhen ipr driver calls pci_restore_state(pdev) in ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared by irqbalance daemon in pci_write_msg_msix().
pci_restore_state()
->__pci_restore_msix_state()
Below is the MSI-X table for ipr adapter after irqbalance daemon kicked in during adapter reset:
Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 ---------> Hit EEH since msix vector of index=8 are 0
Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0
[ 46.264312] ipr: Entering ipr_reset_restore_cfg_space [ 46.267439] ipr: Entering ipr_fail_all_ops [ 46.267447] ipr: Leaving ipr_fail_all_ops [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space [ 46.267454] ipr: Entering ipr_ioa_bringdown_done [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done [ 46.267467] ipr: Entering ipr_worker_thread [ 46.267470] ipr: Leaving ipr_worker_thread
IRQ balancing is not required during adapter reset.
Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable it after calling pci_restore_state(). The irqbalance daemon is disabled for this short period of time (~2s).
--- drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-)
drivers/scsi/ipr.c +27 -1
@@ -62,8 +62,8 @@#include <linux/hdreg.h> #include <linux/reboot.h> #include <linux/stringify.h> +#include <linux/irq.h> #include <asm/io.h> -#include <asm/irq.h> #include <asm/processor.h> #include <scsi/scsi.h> #include <scsi/scsi_host.h>
@@ -8665,6 +8665,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd)return IPR_RC_JOB_RETURN ; } +/** +* ipr_set_affinity_nobalance +* @ioa_cfg: ipr_ioa_cfg struct for an ipr device +* @flag: bool +* true: ensable "IRQ_NO_BALANCING" bit for msix interrupt +* false: disable "IRQ_NO_BALANCING" bit for msix interrupt +* Description: This function will be called to disable/enable +* "IRQ_NO_BALANCING" to avoid irqbalance daemon +* kicking in during adapter reset. +**/ +static void ipr_set_affinity_nobalance (struct ipr_ioa_cfg *ioa_cfg,bool flag) +{ +int irq, i; + +for (i =0 ; i < ioa_cfg->nvectors; i++) { + irq =pci_irq_vector (ioa_cfg->pdev, i); + +if (flag) +irq_set_status_flags (irq,IRQ_NO_BALANCING ); +else +irq_clear_status_flags (irq,IRQ_NO_BALANCING ); + } +} +/** * ipr_reset_restore_cfg_space - Restore PCI config space. * @ipr_cmd: ipr command struct
@@ -8689,6 +8713,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)return IPR_RC_JOB_CONTINUE ; } +ipr_set_affinity_nobalance (ioa_cfg, false);ipr_fail_all_ops (ioa_cfg);if (ioa_cfg->sis64) {
@@ -8768,6 +8793,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd) rc =pci_write_config_byte (ioa_cfg->pdev,PCI_BIST ,PCI_BIST_START );if (rc ==PCIBIOS_SUCCESSFUL ) { +ipr_set_affinity_nobalance (ioa_cfg, true); ipr_cmd->job_step = ipr_reset_bist_done;ipr_reset_start_timer (ipr_cmd,IPR_WAIT_FOR_BIST_TIMEOUT ); rc =IPR_RC_JOB_RETURN ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 522/554 scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <[email protected]>
[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ]
This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d.
When probing the exp-attached sata device, libsas/libata will issue a hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a broadcast event will be received after the disk probe fails, and this commit causes the probe will be re-executed on the disk, and a faulty disk may get into an indefinite loop of probe.
Therefore, revert this commit, although it can fix some temporary issues with disk probe failure.
--- drivers/scsi/libsas/sas_internal.h | 14 -------------- 1 file changed, 14 deletions(-)
drivers/scsi/libsas/sas_internal.h +0 -14
@@ -111,20 +111,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i func, dev->parent ?"exp-attached" :"direct-attached" , SAS_ADDR(dev->sas_addr), err); - -/* -* If the device probe failed, the expander phy attached address -* needs to be reset so that the phy will not be treated as flutter -* in the next revalidation -*/ -if (dev->parent && !dev_is_expander (dev->dev_type)) { -struct sas_phy *phy = dev->phy; -struct domain_device *parent = dev->parent; -struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; - -memset (ex_phy->attached_sas_addr,0 ,SAS_ADDR_SIZE ); - } -sas_unregister_dev (dev->port, dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 523/554 arm64: dts: add off-on-delay-us for usdhc2 regulator
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
[ Upstream commit ca643894a37a25713029b36cfe7d1bae515cac08 ]
For SD card, according to the spec requirement, for sd card power reset operation, it need sd card supply voltage to be lower than 0.5v and keep over 1ms, otherwise, next time power back the sd card supply voltage to 3.3v, sd card can't support SD3.0 mode again.
To match such requirement on imx8qm-mek board, add 4.8ms delay between sd power off and power on.
--- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8qm-mek.dts +1 -0
@@ -34,6 +34,7 @@ reg_usdhc2_vmmc: usdhc2-vmmc { regulator-max-microvolt = <3000000>; gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>; enable-active-high; + off-on-delay-us = <4800>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 524/554 ARM: dts: imx6q-ba16: fix RTC interrupt level
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Ray <[email protected]>
[ Upstream commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 ]
RTC interrupt level should be set to "LOW". This was revealed by the introduction of commit:
f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
which changed the way IRQ type is obtained.
--- arch/arm/boot/dts/imx6q-ba16.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6q-ba16.dtsi +1 -1
@@ -335,7 +335,7 @@ rtc@32 { pinctrl-0 = <&pinctrl_rtc>; reg = <0x32>; interrupt-parent = <&gpio4>; - interrupts = <10 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <10 IRQ_TYPE_LEVEL_LOW>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 525/554 netfilter: nft_synproxy: avoid possible data-race on update operation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]
During nft_synproxy eval we are reading nf_synproxy_info struct which can be modified on update operation concurrently. As nf_synproxy_info struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
--- net/netfilter/nft_synproxy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/netfilter/nft_synproxy.c +3 -3
@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,struct tcphdr *_tcph, struct synproxy_options *opts) { - struct nf_synproxy_info info = priv->info; + struct nf_synproxy_info info = READ_ONCE(priv->info);struct net *net =nft_net (pkt);struct synproxy_net *snet =synproxy_pernet (net);struct sk_buff *skb = pkt->skb;
@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,struct tcphdr *_tcph, struct synproxy_options *opts) { - struct nf_synproxy_info info = priv->info; + struct nf_synproxy_info info = READ_ONCE(priv->info);struct net *net =nft_net (pkt);struct synproxy_net *snet =synproxy_pernet (net);struct sk_buff *skb = pkt->skb;
@@ -339,7 +339,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,struct nft_synproxy *newpriv =nft_obj_data (newobj);struct nft_synproxy *priv =nft_obj_data (obj); - priv->info = newpriv->info; +WRITE_ONCE (priv->info, newpriv->info); }static struct nft_object_type nft_synproxy_obj_type;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 526/554 netfilter: nf_tables: fix memory leak in nf_tables_newrule()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit d077e8119ddbb4fca67540f1a52453631a47f221 ]
In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to the err_release_rule label without freeing the allocated flow, leading to a memory leak.
Fix this by adding a new label err_destroy_flow and jumping to it when nft_use_inc() fails. This ensures that the flow is properly released in this error case.
--- net/netfilter/nf_tables_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +2 -1
@@ -3741,7 +3741,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,if (!nft_use_inc (&chain->use)) { err = -EMFILE ; - goto err_release_rule; + goto err_destroy_flow; }if (info->nlh->nlmsg_flags &NLM_F_REPLACE ) {
@@ -3791,6 +3791,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, err_destroy_flow_rule:nft_use_dec_restore (&chain->use); +err_destroy_flow:if (flow)nft_flow_rule_destroy (flow); err_release_rule:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 527/554 netfilter: nf_conncount: update last_gc only when GC has been performed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 7811ba452402d58628e68faedf38745b3d485e3c ]
Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely.
Update the last_gc value only when a GC has been actually performed.
--- net/netfilter/nf_conncount.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_conncount.c +1 -1
@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,nf_ct_put (found_ct); } + list->last_gc = (u32 )jiffies; add_new_node:if (WARN_ON_ONCE (list->count >INT_MAX )) {
@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net, conn->jiffies32 = (u32 )jiffies;list_add_tail (&conn->node, &list->head); list->count++; - list->last_gc = (u32 )jiffies; out_put:if (refcounted)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 528/554 net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit a428e0da1248c353557970848994f35fd3f005e2 ]
devlink_alloc() may return NULL on allocation failure, but prestera_devlink_alloc() unconditionally calls devlink_priv() on the returned pointer.
This leads to a NULL pointer dereference if devlink allocation fails. Add a check for a NULL devlink pointer and return NULL early to avoid the crash.
--- drivers/net/ethernet/marvell/prestera/prestera_devlink.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/marvell/prestera/prestera_devlink.c +2 -0
@@ -396,6 +396,8 @@ struct prestera_switch *prestera_devlink_alloc(struct prestera_device *dev) dl =devlink_alloc (&prestera_dl_ops,sizeof (struct prestera_switch ), dev->dev); +if (!dl) +return NULL ;return devlink_priv (dl); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 529/554 bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Knecht <[email protected]>
[ Upstream commit 3128df6be147768fe536986fbb85db1d37806a9f ]
When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is incorrectly stripped from frames during egress processing.
br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also moves any "next" VLAN from the payload into hwaccel:
/* move next vlan tag to hw accel tag */
__skb_vlan_pop(skb, &vlan_tci);
__vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);For QinQ frames where the C-VLAN sits in the payload, this moves it to hwaccel where it gets lost during VXLAN encapsulation.
Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only the hwaccel S-VLAN and leaves the payload untouched.
This path is only taken when vlan_tunnel is enabled and tunnel_info is configured, so 802.1Q bridges are unaffected.
Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN preserved in VXLAN payload via tcpdump.
--- net/bridge/br_vlan_tunnel.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/bridge/br_vlan_tunnel.c +7 -4
@@ -187,7 +187,6 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb, {struct metadata_dst *tunnel_dst;__be64 tunnel_id; -int err;if (!vlan)return 0 ;
@@ -197,9 +196,13 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,return 0 ;skb_dst_drop (skb); - err =skb_vlan_pop (skb); -if (err) -return err; +/* For 802.1ad (QinQ), skb_vlan_pop() incorrectly moves the C-VLAN +* from payload to hwaccel after clearing S-VLAN. We only need to +* clear the hwaccel S-VLAN; the C-VLAN must stay in payload for +* correct VXLAN encapsulation. This is also correct for 802.1Q +* where no C-VLAN exists in payload. +*/ +__vlan_hwaccel_clear_tag (skb); tunnel_dst =rcu_dereference (vlan->tinfo.tunnel_dst);if (tunnel_dst &&dst_hold_safe (&tunnel_dst->dst))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 530/554 net: mscc: ocelot: Fix crash when adding interface under a lag
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Wu <[email protected]>
[ Upstream commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 ]
Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag") fixed a similar issue in the lan966x driver caused by a NULL pointer dereference. The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic and is susceptible to the same crash.
This issue specifically affects the ocelot_vsc7514.c frontend, which leaves unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as it uses the DSA framework which registers all ports.
Fix this by checking if the port pointer is valid before accessing it.
--- drivers/net/ethernet/mscc/ocelot.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/mscc/ocelot.c +4 -2
@@ -1718,14 +1718,16 @@ static void ocelot_set_aggr_pgids(struct ocelot *ocelot)/* Now, set PGIDs for each active LAG */ for (lag =0 ; lag < ocelot->num_phys_ports; lag++) { -struct net_device *bond = ocelot->ports[lag]->bond; +struct ocelot_port *ocelot_port = ocelot->ports[lag];int num_active_ports =0 ; +struct net_device *bond;unsigned long bond_mask;u8 aggr_idx[16 ]; -if (!bond || (visited &BIT (lag))) +if (!ocelot_port || !ocelot_port->bond || (visited &BIT (lag)))continue ; + bond = ocelot_port->bond; bond_mask =ocelot_get_bond_mask (ocelot, bond);for_each_set_bit (port, &bond_mask, ocelot->num_phys_ports) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 531/554 inet: ping: Fix icmp out counting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: yuan.gao <[email protected]>
[ Upstream commit 4c0856c225b39b1def6c9a6bc56faca79550da13 ]
When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO messages, ICMP_MIB_OUTMSGS is counted twice.
ping_v4_sendmsg
ping_v4_push_pending_frames
ip_push_pending_frames
ip_finish_skb
__ip_make_skb
icmp_out_count(net, icmp_type); // first count
icmp_out_count(sock_net(sk), user_icmph.type); // second count
However, when the ping program uses an IPPROTO_RAW socket, ICMP_MIB_OUTMSGS is counted correctly only once.
Therefore, the first count should be removed.
--- net/ipv4/ping.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/ipv4/ping.c +1 -3
@@ -844,10 +844,8 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) out_free:if (free)kfree (ipc.opt); -if (!err) { -icmp_out_count (sock_net (sk), user_icmph.type); +if (!err)return len; - }return err; do_confirm:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 532/554 net: sock: fix hardened usercopy panic in sock_recv_errqueue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ]
skbuff_fclone_cache was created without defining a usercopy region,
[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg().
The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
(from skbuff_fclone_cache) [1]
2. The skb is cloned via skb_clone() using the pre-allocated fclone
[3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5]
When cloned skbs allocated from skbuff_fclone_cache are used in the socket error queue, accessing the sock_exterr_skb structure in skb->cb via put_cmsg() triggers a usercopy hardening violation:
[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)! [ 5.382796] kernel BUG at mm/usercopy.c:102! [ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7 [ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80 [ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490 [ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246 [ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74 [ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0 [ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74 [ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001 [ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00 [ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000 [ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0 [ 5.384903] PKRU: 55555554 [ 5.384903] Call Trace: [ 5.384903] <TASK> [ 5.384903] __check_heap_object+0x9a/0xd0 [ 5.384903] __check_object_size+0x46c/0x690 [ 5.384903] put_cmsg+0x129/0x5e0 [ 5.384903] sock_recv_errqueue+0x22f/0x380 [ 5.384903] tls_sw_recvmsg+0x7ed/0x1960 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? schedule+0x6d/0x270 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? mutex_unlock+0x81/0xd0 [ 5.384903] ? __pfx_mutex_unlock+0x10/0x10 [ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0 [ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
- sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 - offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 = 272 + 24 (inside sock_exterr_skb.ee)
This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
--- net/core/sock.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/core/sock.c +4 -3
@@ -3377,7 +3377,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)int sock_recv_errqueue (struct sock *sk,struct msghdr *msg,int len,int level,int type) { -struct sock_exterr_skb *serr; +struct sock_extended_err ee;struct sk_buff *skb;int copied, err;
@@ -3397,8 +3397,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,sock_recv_timestamp (msg, sk, skb); - serr =SKB_EXT_ERR (skb); -put_cmsg (msg, level, type,sizeof (serr->ee), &serr->ee); +/* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */ + ee =SKB_EXT_ERR (skb)->ee; +put_cmsg (msg, level, type,sizeof (ee), &ee); msg->msg_flags |=MSG_ERRQUEUE ; err = copied;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 533/554 netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Di Zhu <[email protected]>
[ Upstream commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df ]
Directly increment the TSO features incurs a side effect: it will also directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device, which can cause issues such as the inability to enable the nocache copy feature on the bonding driver.
The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby preventing it from being cleared.
--- include/linux/netdevice.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/netdevice.h +2 -1
@@ -5093,7 +5093,8 @@ netdev_features_t netdev_increment_features(netdev_features_t all,static inline netdev_features_t netdev_add_tso_features (netdev_features_t features,netdev_features_t mask) { -return netdev_increment_features (features,NETIF_F_ALL_TSO , mask); +return netdev_increment_features (features,NETIF_F_ALL_TSO | +NETIF_F_ALL_FOR_ALL , mask); }int __netdev_update_features (struct net_device *dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 534/554 net/mlx5e: Dont print error message due to invalid module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 144297e2a24e3e54aee1180ec21120ea38822b97 ]
Dumping module EEPROM on newer modules is supported through the netlink interface only.
Querying with old userspace ethtool (or other tools, such as 'lshw') which still uses the ioctl interface results in an error message that could flood dmesg (in addition to the expected error return value). The original message was added under the assumption that the driver should be able to handle all module types, but now that such flows are easily triggered from userspace, it doesn't serve its purpose.
Change the log level of the print in mlx5_query_module_eeprom() to debug.
--- drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/port.c +2 -1
@@ -414,7 +414,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,mlx5_qsfp_eeprom_params_set (&query.i2c_address, &query.page, &offset);break ;default : -mlx5_core_err (dev,"Module ID not recognized: 0x%x\n" , module_id); +mlx5_core_dbg (dev,"Module ID not recognized: 0x%x\n" , + module_id);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 535/554 eth: bnxt: move and rename reset helpers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit fea2993aecd74d5d11ede1ebbd60e478ebfed996 ]
Move the reset helpers, subsequent patches will need some of them on the Tx path.
While at it rename bnxt_sched_reset(), on more recent chips it schedules a queue reset, instead of a fuller reset.
Stable-dep-of: ffeafa65b2b2 ("bnxt_en: Fix potential data corruption with HW GRO/LRO")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 72 +++++++++++------------ 1 file changed, 36 insertions(+), 36 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +36 -36
@@ -340,6 +340,38 @@ static void bnxt_db_cq(struct bnxt *bp, struct bnxt_db_info *db, u32 idx)BNXT_DB_CQ (db, idx); } +static void bnxt_queue_fw_reset_work (struct bnxt *bp,unsigned long delay) +{ +if (!(test_bit (BNXT_STATE_IN_FW_RESET , &bp->state))) +return ; + +if (BNXT_PF (bp)) +queue_delayed_work (bnxt_pf_wq, &bp->fw_reset_task, delay); +else +schedule_delayed_work (&bp->fw_reset_task, delay); +} + +static void bnxt_queue_sp_work (struct bnxt *bp) +{ +if (BNXT_PF (bp)) +queue_work (bnxt_pf_wq, &bp->sp_task); +else +schedule_work (&bp->sp_task); +} + +static void bnxt_sched_reset_rxr (struct bnxt *bp,struct bnxt_rx_ring_info *rxr) +{ +if (!rxr->bnapi->in_reset) { + rxr->bnapi->in_reset = true; +if (bp->flags &BNXT_FLAG_CHIP_P5 ) +set_bit (BNXT_RESET_TASK_SP_EVENT , &bp->sp_event); +else +set_bit (BNXT_RST_RING_SP_EVENT , &bp->sp_event); +bnxt_queue_sp_work (bp); + } + rxr->rx_next_cons =0xffff ; +} +const u16 bnxt_lhint_arr[] = {TX_BD_FLAGS_LHINT_512_AND_SMALLER ,TX_BD_FLAGS_LHINT_512_TO_1023 ,
@@ -1227,38 +1259,6 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,return 0 ; } -static void bnxt_queue_fw_reset_work (struct bnxt *bp,unsigned long delay) -{ -if (!(test_bit (BNXT_STATE_IN_FW_RESET , &bp->state))) -return ; - -if (BNXT_PF (bp)) -queue_delayed_work (bnxt_pf_wq, &bp->fw_reset_task, delay); -else -schedule_delayed_work (&bp->fw_reset_task, delay); -} - -static void bnxt_queue_sp_work (struct bnxt *bp) -{ -if (BNXT_PF (bp)) -queue_work (bnxt_pf_wq, &bp->sp_task); -else -schedule_work (&bp->sp_task); -} - -static void bnxt_sched_reset (struct bnxt *bp,struct bnxt_rx_ring_info *rxr) -{ -if (!rxr->bnapi->in_reset) { - rxr->bnapi->in_reset = true; -if (bp->flags &BNXT_FLAG_CHIP_P5 ) -set_bit (BNXT_RESET_TASK_SP_EVENT , &bp->sp_event); -else -set_bit (BNXT_RST_RING_SP_EVENT , &bp->sp_event); -bnxt_queue_sp_work (bp); - } - rxr->rx_next_cons =0xffff ; -} -static u16 bnxt_alloc_agg_idx (struct bnxt_rx_ring_info *rxr,u16 agg_id) {struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
@@ -1313,7 +1313,7 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,netdev_warn (bp->dev,"TPA cons %x, expected cons %x, error code %x\n" , cons, rxr->rx_next_cons,TPA_START_ERROR_CODE (tpa_start1)); -bnxt_sched_reset (bp, rxr); +bnxt_sched_reset_rxr (bp, rxr);return ; }/* Store cfa_code in tpa_info to use in tpa_end
@@ -1835,7 +1835,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,if (rxr->rx_next_cons !=0xffff )netdev_warn (bp->dev,"RX cons %x != expected cons %x\n" , cons, rxr->rx_next_cons); -bnxt_sched_reset (bp, rxr); +bnxt_sched_reset_rxr (bp, rxr);if (rc1)return rc1; goto next_rx_no_prod_no_len;
@@ -1873,7 +1873,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, !(bp->fw_cap & BNXT_FW_CAP_RING_MONITOR)) {netdev_warn_once (bp->dev,"RX buffer error %x\n" , rx_err); -bnxt_sched_reset (bp, rxr); +bnxt_sched_reset_rxr (bp, rxr); } } goto next_rx_no_len;
@@ -2254,7 +2254,7 @@ static int bnxt_async_event_process(struct bnxt *bp, goto async_event_process_exit; } rxr = bp->bnapi[grp_idx]->rx_ring; -bnxt_sched_reset (bp, rxr); +bnxt_sched_reset_rxr (bp, rxr); goto async_event_process_exit; }case ASYNC_EVENT_CMPL_EVENT_ID_ECHO_REQUEST : {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 536/554 bnxt_en: Fix potential data corruption with HW GRO/LRO
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srijit Bose <[email protected]>
[ Upstream commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 ]
Fix the max number of bits passed to find_first_zero_bit() in bnxt_alloc_agg_idx(). We were incorrectly passing the number of long words. find_first_zero_bit() may fail to find a zero bit and cause a wrong ID to be used. If the wrong ID is already in use, this can cause data corruption. Sometimes an error like this can also be seen:
bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1
Fix it by passing the correct number of bits MAX_TPA_P5. Use DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity check to warn if a bit cannot be found and reset the ring [MChan].
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +--- 2 files changed, 13 insertions(+), 6 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +12 -3
@@ -1264,9 +1264,11 @@ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;u16 idx = agg_id &MAX_TPA_P5_MASK ; -if (test_bit (idx, map->agg_idx_bmap)) - idx =find_first_zero_bit (map->agg_idx_bmap, -BNXT_AGG_IDX_BMAP_SIZE ); +if (test_bit (idx, map->agg_idx_bmap)) { + idx =find_first_zero_bit (map->agg_idx_bmap,MAX_TPA_P5 ); +if (idx >=MAX_TPA_P5 ) +return INVALID_HW_RING_ID ; + }__set_bit (idx, map->agg_idx_bmap); map->agg_id_tbl[agg_id] = idx;return idx;
@@ -1299,6 +1301,13 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,if (bp->flags &BNXT_FLAG_CHIP_P5 ) { agg_id =TPA_START_AGG_ID_P5 (tpa_start); agg_id =bnxt_alloc_agg_idx (rxr, agg_id); +if (unlikely (agg_id ==INVALID_HW_RING_ID )) { +netdev_warn (bp->dev,"Unable to allocate agg ID for ring %d, agg 0x%x\n" , + rxr->bnapi->index, +TPA_START_AGG_ID_P5 (tpa_start)); +bnxt_sched_reset_rxr (bp, rxr); +return ; + } }else { agg_id =TPA_START_AGG_ID (tpa_start); }
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -3
@@ -872,11 +872,9 @@ struct bnxt_tpa_info {struct rx_agg_cmp *agg_arr; }; -#define BNXT_AGG_IDX_BMAP_SIZE (MAX_TPA_P5 / BITS_PER_LONG) -struct bnxt_tpa_idx_map {u16 agg_id_tbl[1024 ]; -unsigned long agg_idx_bmap[BNXT_AGG_IDX_BMAP_SIZE ]; + DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5); };struct bnxt_rx_ring_info {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 537/554 HID: quirks: work around VID/PID conflict for appledisplay
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: René Rebe <[email protected]>
[ Upstream commit c7fabe4ad9219866c203164a214c474c95b36bf2 ]
For years I wondered why the Apple Cinema Display driver would not just work for me. Turns out the hidraw driver instantly takes it over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
--- drivers/hid/hid-quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/hid/hid-quirks.c +9 -0
@@ -220,6 +220,15 @@ static const struct hid_device_id hid_quirks[] = {* used as a driver. See hid_scan_report(). */ static const struct hid_device_id hid_have_special_driver[] = { +#if IS_ENABLED(CONFIG_APPLEDISPLAY) + {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x9218 ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x9219 ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x921c ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x921d ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x9222 ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x9226 ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x9236 ) }, +#endif #if IS_ENABLED(CONFIG_HID_A4TECH) {HID_USB_DEVICE (USB_VENDOR_ID_A4TECH ,USB_DEVICE_ID_A4TECH_WCP32PU ) }, { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 538/554 net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit c1d73b1480235731e35c81df70b08f4714a7d095 ]
qfq_class->leaf_qdisc->q.qlen > 0 does not imply that the class itself is active.
Two qfq_class objects may point to the same leaf_qdisc. This happens when:
1. one QFQ qdisc is attached to the dev as the root qdisc, and
2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get() / qdisc_put()) and is pending to be destroyed, as in function tc_new_tfilter.
When packets are enqueued through the root QFQ qdisc, the shared leaf_qdisc->q.qlen increases. At the same time, the second QFQ qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters qfq_reset() with its own q->q.qlen == 0, but its class's leaf qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.903571] #PF: supervisor write access in kernel mode [ 0.903860] #PF: error_code(0x0002) - not-present page [ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0 [ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI [ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE [ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2)) [ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
Code starting with the faulting instruction
===========================================
0: 0f 84 4d 01 00 00 je 0x153 6: 48 89 70 18 mov %rsi,0x18(%rax) a: 8b 4b 10 mov 0x10(%rbx),%ecx d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx 14: 48 8b 78 08 mov 0x8(%rax),%rdi 18: 48 d3 e2 shl %cl,%rdx 1b: 48 21 f2 and %rsi,%rdx 1e: 48 2b 13 sub (%rbx),%rdx 21: 48 8b 30 mov (%rax),%rsi 24: 48 d3 ea shr %cl,%rdx 27: 8b 4b 18 mov 0x18(%rbx),%ecx ... [ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246 [ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000 [ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000 [ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000 [ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880 [ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000 [ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0 [ 0.910247] PKRU: 55555554 [ 0.910391] Call Trace: [ 0.910527] <TASK> [ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485) [ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036) [ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076) [ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447) [ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861) [ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 0.912296] ? __alloc_skb (net/core/skbuff.c:706) [ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1)) [ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686) [ 0.913077] ksys_write (fs/read_write.c:738) [ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) [ 0.913687] RIP: 0033:0x424c34 [ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9
Code starting with the faulting instruction
===========================================
0: 89 02 mov %eax,(%rdx) 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax 9: eb bd jmp 0xffffffffffffffc8 b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 12: 00 00 00 15: 90 nop 16: f3 0f 1e fa endbr64 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e 21: 74 13 je 0x36 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a: 09 .byte 0x9 [ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34 [ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003 [ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000 [ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28 [ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001 [ 0.917039] </TASK> [ 0.917158] Modules linked in: [ 0.917316] CR2: 0000000000000000 [ 0.917484] ---[ end trace 0000000000000000 ]--- [ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2)) [ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
Code starting with the faulting instruction
===========================================
0: 0f 84 4d 01 00 00 je 0x153 6: 48 89 70 18 mov %rsi,0x18(%rax) a: 8b 4b 10 mov 0x10(%rbx),%ecx d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx 14: 48 8b 78 08 mov 0x8(%rax),%rdi 18: 48 d3 e2 shl %cl,%rdx 1b: 48 21 f2 and %rsi,%rdx 1e: 48 2b 13 sub (%rbx),%rdx 21: 48 8b 30 mov (%rax),%rsi 24: 48 d3 ea shr %cl,%rdx 27: 8b 4b 18 mov 0x18(%rbx),%ecx ... [ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246 [ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000 [ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000 [ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000 [ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880 [ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000 [ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0 [ 0.922097] PKRU: 55555554 [ 0.922240] Kernel panic - not syncing: Fatal exception [ 0.922590] Kernel Offset: disabled
--- net/sched/sch_qfq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_qfq.c +1 -1
@@ -1491,7 +1491,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)for (i =0 ; i < q->clhash.hashsize; i++) {hlist_for_each_entry (cl, &q->clhash.hash[i], common.hnode) { -if (cl->qdisc->q.qlen >0 ) +if (cl_is_active (cl))qfq_deactivate_class (q, cl);qdisc_reset (cl->qdisc);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 539/554 net: usb: pegasus: fix memory leak in update_eth_regs_async()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petko Manolov <[email protected]>
[ Upstream commit afa27621a28af317523e0836dad430bec551eb54 ]
When asynchronously writing to the device registers and if usb_submit_urb() fail, the code fail to release allocated to this point resources.
--- drivers/net/usb/pegasus.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/pegasus.c +2 -0
@@ -168,6 +168,8 @@ static int update_eth_regs_async(pegasus_t *pegasus)netif_device_detach (pegasus->net);netif_err (pegasus, drv, pegasus->net,"%s returned %d\n" , __func__, ret); +usb_free_urb (async_urb); +kfree (req); }return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 540/554 net: enetc: fix build warning when PAGE_SIZE is greater than 128K
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 4b5bdabb5449b652122e43f507f73789041d4abe ]
The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will be greater than 0xFFFF, thus causing a build warning.
This will not cause any practical issues because ENETC is currently only used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch is only for fixing the build warning that occurs when compiling ENETC drivers for other platforms.
--- drivers/net/ethernet/freescale/enetc/enetc.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.h +2 -2
@@ -40,9 +40,9 @@ struct enetc_tx_swbd {#define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)#define ENETC_RXB_PAD NET_SKB_PAD/* add extra space if needed */ #define ENETC_RXB_DMA_SIZE \ - (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD) + min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD, 0xffff)#define ENETC_RXB_DMA_SIZE_XDP \ - (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM) + min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM, 0xffff)struct enetc_rx_swbd {dma_addr_t dma;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 541/554 arp: do not assume dev_hard_header() does not change skb->head
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]
arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged.
A recent commit broke this assumption.
Initialize @arp pointer after dev_hard_header() call.
--- net/ipv4/arp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/ipv4/arp.c +4 -3
@@ -542,7 +542,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,skb_reserve (skb, hlen);skb_reset_network_header (skb); - arp =skb_put (skb,arp_hdr_len (dev)); +skb_put (skb,arp_hdr_len (dev)); skb->dev = dev; skb->protocol =htons (ETH_P_ARP );if (!src_hw)
@@ -550,12 +550,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,if (!dest_hw) dest_hw = dev->broadcast; -/* -* Fill the device header for the ARP frame +/* Fill the device header for the ARP frame. +* Note: skb->head can be changed. */ if (dev_hard_header (skb, dev, ptype, dest_hw, src_hw, skb->len) <0 ) goto out; + arp =arp_hdr (skb);/* * Fill out the arp protocol part. *
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 542/554 NFS: trace: show TIMEDOUT instead of 0x6e
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Hanxiao <[email protected]>
[ Upstream commit cef48236dfe55fa266d505e8a497963a7bc5ef2a ]
__nfs_revalidate_inode may return ETIMEDOUT.
print symbol of ETIMEDOUT in nfs trace:
before:
cat-5191 [005] 119.331127: nfs_revalidate_inode_exit: error=-110 (0x6e)
after:
cat-1738 [004] 44.365509: nfs_revalidate_inode_exit: error=-110 (TIMEDOUT)
Stable-dep-of: c6c209ceb87f ("NFSD: Remove NFSERR_EAGAIN")
--- include/trace/misc/nfs.h | 1 + 1 file changed, 1 insertion(+)
include/trace/misc/nfs.h +1 -0
@@ -52,6 +52,7 @@ TRACE_DEFINE_ENUM(NFSERR_JUKEBOX); { NFSERR_IO, "IO" }, \ { NFSERR_NXIO, "NXIO" }, \ { ECHILD, "CHILD" }, \ + { ETIMEDOUT, "TIMEDOUT" }, \ { NFSERR_EAGAIN, "AGAIN" }, \ { NFSERR_ACCES, "ACCES" }, \ { NFSERR_EXIST, "EXIST" }, \
Greg Kroah-Hartman
maintainerPATCH 543/554 nfs_common: factor out nfs_errtbl and nfs_stat_to_errno
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
[ Upstream commit 4806ded4c14c5e8fdc6ce885d83221a78c06a428 ]
Common nfs_stat_to_errno() is used by both fs/nfs/nfs2xdr.c and fs/nfs/nfs3xdr.c
Will also be used by fs/nfsd/localio.c
Stable-dep-of: c6c209ceb87f ("NFSD: Remove NFSERR_EAGAIN")
--- fs/nfs/Kconfig | 1 fs/nfs/nfs2xdr.c | 70 ----------------------------- fs/nfs/nfs3xdr.c | 108 ++++++++------------------------------------- fs/nfs/nfs4xdr.c | 4 - fs/nfs_common/Makefile | 2 fs/nfs_common/common.c | 67 +++++++++++++++++++++++++++ fs/nfsd/Kconfig | 1 include/linux/nfs_common.h | 16 ++++++ 8 files changed, 109 insertions(+), 160 deletions(-) create mode 100644 fs/nfs_common/common.c create mode 100644 include/linux/nfs_common.h
fs/nfs/Kconfig +1 -0
@@ -5,6 +5,7 @@ config NFS_FS select CRC32 select LOCKD select SUNRPC + select NFS_COMMON select NFS_ACL_SUPPORT if NFS_V3_ACL help Choose Y here if you want to access files residing on other
fs/nfs/nfs2xdr.c +1 -69
93 lines not on this page · raw message
fs/nfs/nfs3xdr.c +20 -88
237 lines not on this page · raw message
fs/nfs/nfs4xdr.c +1 -3
@@ -52,6 +52,7 @@#include <linux/nfs.h> #include <linux/nfs4.h> #include <linux/nfs_fs.h> +#include <linux/nfs_common.h> #include "nfs4_fs.h" #include "nfs4trace.h"
@@ -63,9 +64,6 @@#define NFSDBG_FACILITY NFSDBG_XDR -/* Mapping from NFS error code to "errno" error code. */ -#define errno_NFSERR_IO EIO -struct compound_hdr ;static int nfs4_stat_to_errno (int ); static void encode_layoutget(struct xdr_stream *xdr,
fs/nfs_common/Makefile +2 -0
@@ -8,3 +8,5 @@ nfs_acl-objs := nfsacl.o obj-$(CONFIG_GRACE_PERIOD) += grace.o obj-$(CONFIG_NFS_V4_2_SSC_HELPER) += nfs_ssc.o + +obj-$(CONFIG_NFS_COMMON) += common.o
fs/nfs_common/common.c new file +67 -0
67 lines not on this page · raw message
fs/nfsd/Kconfig +1 -0
@@ -8,6 +8,7 @@ config NFSD select LOCKD select SUNRPC select EXPORTFS + select NFS_COMMON select NFS_ACL_SUPPORT if NFSD_V2_ACL select NFS_ACL_SUPPORT if NFSD_V3_ACL depends on MULTIUSER
include/linux/nfs_common.h new file +16 -0
@@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* This file contains constants and methods used by both NFS client and server. +*/ +#ifndef _LINUX_NFS_COMMON_H +#define _LINUX_NFS_COMMON_H + +#include <linux/errno.h> +#include <uapi/linux/nfs.h> + +/* Mapping from NFS error code to "errno" error code. */ +#define errno_NFSERR_IO EIO + +int nfs_stat_to_errno (enum nfs_stat status); + +#endif /* _LINUX_NFS_COMMON_H */
Greg Kroah-Hartman
maintainerPATCH 544/554 NFSD: Remove NFSERR_EAGAIN
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit c6c209ceb87f64a6ceebe61761951dcbbf4a0baa ]
I haven't found an NFSERR_EAGAIN in RFCs 1094, 1813, 7530, or 8881. None of these RFCs have an NFS status code that match the numeric value "11".
Based on the meaning of the EAGAIN errno, I presume the use of this status in NFSD means NFS4ERR_DELAY. So replace the one usage of nfserr_eagain, and remove it from NFSD's NFS status conversion tables.
As far as I can tell, NFSERR_EAGAIN has existed since the pre-git era, but was not actually used by any code until commit f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed."), at which time it become possible for NFSD to return a status code of 11 (which is not valid NFS protocol).
--- fs/nfs_common/common.c | 1 - fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfsd.h | 1 - include/trace/misc/nfs.h | 2 -- include/uapi/linux/nfs.h | 1 - 5 files changed, 1 insertion(+), 6 deletions(-)
fs/nfs_common/common.c +0 -1
@@ -16,7 +16,6 @@ static const struct { { NFSERR_NOENT, -ENOENT }, { NFSERR_IO, -errno_NFSERR_IO}, { NFSERR_NXIO, -ENXIO }, -/* { NFSERR_EAGAIN, -EAGAIN }, */ { NFSERR_ACCES, -EACCES }, { NFSERR_EXIST, -EEXIST }, { NFSERR_XDEV, -EXDEV },
fs/nfsd/nfs4proc.c +1 -1
@@ -1322,7 +1322,7 @@ try_again: (freezable_schedule_timeout(20*HZ) == 0)) {finish_wait (&nn->nfsd_ssc_waitq, &wait);kfree (work); -return nfserr_eagain; +return nfserr_jukebox; }finish_wait (&nn->nfsd_ssc_waitq, &wait); goto try_again;
fs/nfsd/nfsd.h +0 -1
@@ -201,7 +201,6 @@ void nfsd_lockd_shutdown(void);#define nfserr_noent cpu_to_be32(NFSERR_NOENT)#define nfserr_io cpu_to_be32(NFSERR_IO)#define nfserr_nxio cpu_to_be32(NFSERR_NXIO) -#define nfserr_eagain cpu_to_be32(NFSERR_EAGAIN)#define nfserr_acces cpu_to_be32(NFSERR_ACCES)#define nfserr_exist cpu_to_be32(NFSERR_EXIST)#define nfserr_xdev cpu_to_be32(NFSERR_XDEV)
include/trace/misc/nfs.h +0 -2
@@ -16,7 +16,6 @@ TRACE_DEFINE_ENUM(NFSERR_PERM);TRACE_DEFINE_ENUM (NFSERR_NOENT );TRACE_DEFINE_ENUM (NFSERR_IO );TRACE_DEFINE_ENUM (NFSERR_NXIO ); -TRACE_DEFINE_ENUM (NFSERR_EAGAIN );TRACE_DEFINE_ENUM (NFSERR_ACCES );TRACE_DEFINE_ENUM (NFSERR_EXIST );TRACE_DEFINE_ENUM (NFSERR_XDEV );
@@ -53,7 +52,6 @@ TRACE_DEFINE_ENUM(NFSERR_JUKEBOX); { NFSERR_NXIO, "NXIO" }, \ { ECHILD, "CHILD" }, \ { ETIMEDOUT, "TIMEDOUT" }, \ - { NFSERR_EAGAIN, "AGAIN" }, \ { NFSERR_ACCES, "ACCES" }, \ { NFSERR_EXIST, "EXIST" }, \ { NFSERR_XDEV, "XDEV" }, \
include/uapi/linux/nfs.h +0 -1
@@ -49,7 +49,6 @@NFSERR_NOENT =2 ,/* v2 v3 v4 */ NFSERR_IO =5 ,/* v2 v3 v4 */ NFSERR_NXIO =6 ,/* v2 v3 v4 */ -NFSERR_EAGAIN =11 ,/* v2 v3 */ NFSERR_ACCES =13 ,/* v2 v3 v4 */ NFSERR_EXIST =17 ,/* v2 v3 v4 */ NFSERR_XDEV = 18, /* v3 v4 */
Greg Kroah-Hartman
maintainerPATCH 545/554 nfsd: provide locking for v4_end_grace
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ]
Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly.
We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock.
nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access.
However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held.
So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished.
This resolves a race which can result in use-after-free.
--- fs/nfsd/netns.h | 2 ++ fs/nfsd/nfs4state.c | 42 ++++++++++++++++++++++++++++++++++++++++-- fs/nfsd/nfsctl.c | 3 +-- fs/nfsd/state.h | 2 +- 4 files changed, 44 insertions(+), 5 deletions(-)
fs/nfsd/netns.h +2 -0
@@ -64,6 +64,8 @@ struct nfsd_net {struct lock_manager nfsd4_manager;bool grace_ended; +bool grace_end_forced; +bool client_tracking_active;time64_t boot_time;struct dentry *nfsd_client_dir;
fs/nfsd/nfs4state.c +40 -2
84 lines not on this page · raw message
fs/nfsd/nfsctl.c +1 -2
@@ -1117,9 +1117,8 @@ static ssize_t write_v4_end_grace(structcase 'Y' :case 'y' :case '1' : -if (!nn->nfsd_serv) +if (!nfsd4_force_end_grace (nn))return -EBUSY ; -nfsd4_end_grace (nn);break ;default :return -EINVAL ;
fs/nfsd/state.h +1 -1
@@ -719,7 +719,7 @@ static inline void get_nfs4_file(structstruct nfsd_file *find_any_file (struct nfs4_file *f);/* grace period management */ -void nfsd4_end_grace (struct nfsd_net *nn); +bool nfsd4_force_end_grace (struct nfsd_net *nn);/* nfs4recover operations */ extern int nfsd4_client_tracking_init (struct net *net);
Greg Kroah-Hartman
maintainerPATCH 546/554 counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
[ Upstream commit 23f9485510c338476b9735d516c1d4aacb810d46 ]
An IRQ handler can either be IRQF_NO_THREAD or acquire spinlock_t, as CONFIG_PROVE_RAW_LOCK_NESTING warns:
=============================
[ BUG: Invalid wait context ]
6.18.0-rc1+git... #1
-----------------------------
some-user-space-process/1251 is trying to lock:
(&counter->events_list_lock){....}-{3:3}, at: counter_push_event [counter] other info that might help us debug this:
context-{2:2}
no locks held by some-user-space-process/....
stack backtrace: CPU: 0 UID: 0 PID: 1251 Comm: some-user-space-process 6.18.0-rc1+git... #1 PREEMPT Call trace: show_stack (C) dump_stack_lvl dump_stack __lock_acquire lock_acquire _raw_spin_lock_irqsave counter_push_event [counter] interrupt_cnt_isr [interrupt_cnt] __handle_irq_event_percpu handle_irq_event handle_simple_irq handle_irq_desc generic_handle_domain_irq gpio_irq_handler handle_irq_desc generic_handle_domain_irq gic_handle_irq call_on_irq_stack do_interrupt_handler el0_interrupt __el0_irq_handler_common el0t_64_irq_handler el0t_64_irq
... and Sebastian correctly points out. Remove IRQF_NO_THREAD as an alternative to switching to raw_spinlock_t, because the latter would limit all potential nested locks to raw_spinlock_t only.
--- drivers/counter/interrupt-cnt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/counter/interrupt-cnt.c +1 -2
@@ -208,8 +208,7 @@ static int interrupt_cnt_probe(struct plirq_set_status_flags (priv->irq,IRQ_NOAUTOEN ); ret =devm_request_irq (dev, priv->irq, interrupt_cnt_isr, -IRQF_TRIGGER_RISING |IRQF_NO_THREAD , -dev_name (dev), priv); +IRQF_TRIGGER_RISING ,dev_name (dev), priv);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 547/554 pinctrl: qcom: lpass-lpi: Remove duplicate assignment of of_gpio_n_cells
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit a3fc976a2d68cb74ae4234314002e4e398e4c337 ]
The of_gpio_n_cells default is 2 when ->of_xlate() callback is not defined. No need to assign it explicitly in the driver.
Stable-dep-of: ebc18e9854e5 ("pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping")
--- drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 1 - 1 file changed, 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +0 -1
@@ -644,7 +644,6 @@ static int lpi_pinctrl_probe(struct plat pctrl->chip.base =-1 ; pctrl->chip.ngpio = data->npins; pctrl->chip.label =dev_name (dev); - pctrl->chip.of_gpio_n_cells =2 ; pctrl->chip.can_sleep = false;mutex_init (&pctrl->lock);
Greg Kroah-Hartman
maintainerPATCH 548/554 pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit ebc18e9854e5a2b62a041fb57b216a903af45b85 ]
The gpio_chip settings in this driver say the controller can't sleep but it actually uses a mutex for synchronization. This triggers the following BUG():
[ 9.233659] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281 [ 9.233665] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 554, name: (udev-worker) [ 9.233669] preempt_count: 1, expected: 0 [ 9.233673] RCU nest depth: 0, expected: 0 [ 9.233688] Tainted: [W]=WARN [ 9.233690] Hardware name: Dell Inc. Latitude 7455/0FK7MX, BIOS 2.10.1 05/20/2025 [ 9.233694] Call trace: [ 9.233696] show_stack+0x24/0x38 (C) [ 9.233709] dump_stack_lvl+0x40/0x88 [ 9.233716] dump_stack+0x18/0x24 [ 9.233722] __might_resched+0x148/0x160 [ 9.233731] __might_sleep+0x38/0x98 [ 9.233736] mutex_lock+0x30/0xd8 [ 9.233749] lpi_config_set+0x2e8/0x3c8 [pinctrl_lpass_lpi] [ 9.233757] lpi_gpio_direction_output+0x58/0x90 [pinctrl_lpass_lpi] [ 9.233761] gpiod_direction_output_raw_commit+0x110/0x428 [ 9.233772] gpiod_direction_output_nonotify+0x234/0x358 [ 9.233779] gpiod_direction_output+0x38/0xd0 [ 9.233786] gpio_shared_proxy_direction_output+0xb8/0x2a8 [gpio_shared_proxy] [ 9.233792] gpiod_direction_output_raw_commit+0x110/0x428 [ 9.233799] gpiod_direction_output_nonotify+0x234/0x358 [ 9.233806] gpiod_configure_flags+0x2c0/0x580 [ 9.233812] gpiod_find_and_request+0x358/0x4f8 [ 9.233819] gpiod_get_index+0x7c/0x98 [ 9.233826] devm_gpiod_get+0x34/0xb0 [ 9.233829] reset_gpio_probe+0x58/0x128 [reset_gpio] [ 9.233836] auxiliary_bus_probe+0xb0/0xf0 [ 9.233845] really_probe+0x14c/0x450 [ 9.233853] __driver_probe_device+0xb0/0x188 [ 9.233858] driver_probe_device+0x4c/0x250 [ 9.233863] __driver_attach+0xf8/0x2a0 [ 9.233868] bus_for_each_dev+0xf8/0x158 [ 9.233872] driver_attach+0x30/0x48 [ 9.233876] bus_add_driver+0x158/0x2b8 [ 9.233880] driver_register+0x74/0x118 [ 9.233886] __auxiliary_driver_register+0x94/0xe8 [ 9.233893] init_module+0x34/0xfd0 [reset_gpio] [ 9.233898] do_one_initcall+0xec/0x300 [ 9.233903] do_init_module+0x64/0x260 [ 9.233910] load_module+0x16c4/0x1900 [ 9.233915] __arm64_sys_finit_module+0x24c/0x378 [ 9.233919] invoke_syscall+0x4c/0xe8 [ 9.233925] el0_svc_common+0x8c/0xf0 [ 9.233929] do_el0_svc+0x28/0x40 [ 9.233934] el0_svc+0x38/0x100 [ 9.233938] el0t_64_sync_handler+0x84/0x130 [ 9.233943] el0t_64_sync+0x17c/0x180
Mark the controller as sleeping.
--- drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +1 -1
@@ -644,7 +644,7 @@ static int lpi_pinctrl_probe(struct plat pctrl->chip.base =-1 ; pctrl->chip.ngpio = data->npins; pctrl->chip.label =dev_name (dev); - pctrl->chip.can_sleep = false; + pctrl->chip.can_sleep = true;mutex_init (&pctrl->lock);
Greg Kroah-Hartman
maintainerPATCH 549/554 blk-throttle: Set BIO_THROTTLED when bio has been throttled
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laibin Qiu <[email protected]>
[ Upstream commit 5a011f889b4832aa80c2a872a5aade5c48d2756f ]
1.In current process, all bio will set the BIO_THROTTLED flag after __blk_throtl_bio().
2.If bio needs to be throttled, it will start the timer and stop submit bio directly. Bio will submit in blk_throtl_dispatch_work_fn() when the timer expires.But in the current process, if bio is throttled. The BIO_THROTTLED will be set to bio after timer start. If the bio has been completed, it may cause use-after-free blow.
BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 Read of size 2 at addr ffff88801b8902d4 by task fio/26380 dump_stack+0x9b/0xce print_address_description.constprop.6+0x3e/0x60 kasan_report.cold.9+0x22/0x3a blk_throtl_bio+0x12f0/0x2c70 submit_bio_checks+0x701/0x1550 submit_bio_noacct+0x83/0xc80 submit_bio+0xa7/0x330 mpage_readahead+0x380/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 26380: kasan_save_stack+0x19/0x40 __kasan_kmalloc.constprop.2+0xc1/0xd0 kmem_cache_alloc+0x146/0x440 mempool_alloc+0x125/0x2f0 bio_alloc_bioset+0x353/0x590 mpage_alloc+0x3b/0x240 do_mpage_readpage+0xddf/0x1ef0 mpage_readahead+0x264/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: kasan_save_stack+0x19/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x1b/0x30 __kasan_slab_free+0x111/0x160 kmem_cache_free+0x94/0x460 mempool_free+0xd6/0x320 bio_free+0xe0/0x130 bio_put+0xab/0xe0 bio_endio+0x3a6/0x5d0 blk_update_request+0x590/0x1370 scsi_end_request+0x7d/0x400 scsi_io_completion+0x1aa/0xe50 scsi_softirq_done+0x11b/0x240 blk_mq_complete_request+0xd4/0x120 scsi_mq_done+0xf0/0x200 virtscsi_vq_done+0xbc/0x150 vring_interrupt+0x179/0x390 __handle_irq_event_percpu+0xf7/0x490 handle_irq_event_percpu+0x7b/0x160 handle_irq_event+0xcc/0x170 handle_edge_irq+0x215/0xb20 common_interrupt+0x60/0x120 asm_common_interrupt+0x1e/0x40
Fix this by move BIO_THROTTLED set into the queue_lock.
--- block/blk-throttle.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
block/blk-throttle.c +10 -6
@@ -2222,8 +2222,10 @@ bool blk_throtl_bio(struct bio *bio)rcu_read_lock ();/* see throtl_charge_bio() */ -if (bio_flagged (bio,BIO_THROTTLED )) - goto out; +if (bio_flagged (bio,BIO_THROTTLED )) { +rcu_read_unlock (); +return false; + }if (!cgroup_subsys_on_dfl (io_cgrp_subsys)) { blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
@@ -2231,8 +2233,10 @@ bool blk_throtl_bio(struct bio *bio)blkg_rwstat_add (&tg->stat_ios, bio->bi_opf,1 ); } -if (!tg->has_rules[rw]) - goto out; +if (!tg->has_rules[rw]) { +rcu_read_unlock (); +return false; + }spin_lock_irq (&q->queue_lock);
@@ -2316,14 +2320,14 @@ again: } out_unlock: -spin_unlock_irq (&q->queue_lock); -out:bio_set_flag (bio,BIO_THROTTLED );#ifdef CONFIG_BLK_DEV_THROTTLING_LOW if (throttled || !td->track_bio_latency) bio->bi_issue.value |=BIO_ISSUE_THROTL_SKIP_LATENCY ;#endif +spin_unlock_irq (&q->queue_lock); +rcu_read_unlock ();return throttled; }
Greg Kroah-Hartman
maintainerPATCH 550/554 powercap: fix race condition in register_control_type()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumeet Pawnikar <[email protected]>
[ Upstream commit 7bda1910c4bccd4b8d4726620bb3d6bbfb62286e ]
The device becomes visible to userspace via device_register() even before it fully initialized by idr_init(). If userspace or another thread tries to register a zone immediately after device_register(), the control_type_valid() will fail because the control_type is not yet in the list. The IDR is not yet initialized, so this race condition causes zone registration failure.
Move idr_init() and list addition before device_register() fix the race condition.
--- drivers/powercap/powercap_sys.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/powercap/powercap_sys.c +11 -5
@@ -624,17 +624,23 @@ struct powercap_control_type *powercap_register_control_type(INIT_LIST_HEAD (&control_type->node); control_type->dev.class = &powercap_class;dev_set_name (&control_type->dev,"%s" , name); - result =device_register (&control_type->dev); -if (result) { -put_device (&control_type->dev); -return ERR_PTR (result); - }idr_init (&control_type->idr);mutex_lock (&powercap_cntrl_list_lock);list_add_tail (&control_type->node, &powercap_cntrl_list);mutex_unlock (&powercap_cntrl_list_lock); + result =device_register (&control_type->dev); +if (result) { +mutex_lock (&powercap_cntrl_list_lock); +list_del (&control_type->node); +mutex_unlock (&powercap_cntrl_list_lock); + +idr_destroy (&control_type->idr); +put_device (&control_type->dev); +return ERR_PTR (result); + } +return control_type; }EXPORT_SYMBOL_GPL (powercap_register_control_type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 551/554 powercap: fix sscanf() error return value handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumeet Pawnikar <[email protected]>
[ Upstream commit efc4c35b741af973de90f6826bf35d3b3ac36bf1 ]
Fix inconsistent error handling for sscanf() return value check.
Implicit boolean conversion is used instead of explicit return value checks. The code checks if (!sscanf(...)) which is incorrect because:
1. sscanf returns the number of successfully parsed items
2. On success, it returns 1 (one item passed)
3. On failure, it returns 0 or EOF
4. The check 'if (!sscanf(...))' is wrong because it treats success (1) as failure
All occurrences of sscanf() now uses explicit return value check. With this behavior it returns '-EINVAL' when parsing fails (returns 0 or EOF), and continues when parsing succeeds (returns 1).
--- drivers/powercap/powercap_sys.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/powercap/powercap_sys.c +3 -3
@@ -67,7 +67,7 @@ static ssize_t show_constraint_##_attr(struct device *dev, \int id; \struct powercap_zone_constraint *pconst;\ \ -if (!sscanf (dev_attr->attr.name,"constraint_%d_" , &id)) \ +if (sscanf (dev_attr->attr.name,"constraint_%d_" , &id) !=1 ) \return -EINVAL ; \if (id >= power_zone->const_id_cnt) \return -EINVAL ; \
@@ -92,7 +92,7 @@ static ssize_t store_constraint_##_attr(struct device *dev,\int id; \struct powercap_zone_constraint *pconst;\ \ -if (!sscanf (dev_attr->attr.name,"constraint_%d_" , &id)) \ +if (sscanf (dev_attr->attr.name,"constraint_%d_" , &id) !=1 ) \return -EINVAL ; \if (id >= power_zone->const_id_cnt) \return -EINVAL ; \
@@ -161,7 +161,7 @@ static ssize_t show_constraint_name(struct device *dev,ssize_t len = -ENODATA ;struct powercap_zone_constraint *pconst; -if (!sscanf (dev_attr->attr.name,"constraint_%d_" , &id)) +if (sscanf (dev_attr->attr.name,"constraint_%d_" , &id) !=1 )return -EINVAL ;if (id >= power_zone->const_id_cnt)return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 552/554 can: j1939: make j1939_session_activate() fail if device is no longer registered
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 5d5602236f5db19e8b337a2cd87a90ace5ea776d ]
syzbot is still reporting
unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed.
Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.
--- net/can/j1939/transport.c | 2 ++ 1 file changed, 2 insertions(+)
net/can/j1939/transport.c +2 -0
@@ -1571,6 +1571,8 @@ int j1939_session_activate(struct j1939_session *session)if (active) {j1939_session_put (active); ret = -EAGAIN ; + }else if (priv->ndev->reg_state !=NETREG_REGISTERED ) { + ret = -ENODEV ; }else {WARN_ON_ONCE (session->state !=J1939_SESSION_NEW ); list_add_tail(&session->active_session_list_entry,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 553/554 ASoC: fsl_sai: Add missing registers to cache default
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 90ed688792a6b7012b3e8a2f858bc3fe7454d0eb ]
Drivers does cache sync during runtime resume, setting all writable registers. Not all writable registers are set in cache default, resulting in the erorr message:
fsl-sai 30c30000.sai: using zero-initialized flat cache, this may cause unexpected behavior
Fix this by adding missing writable register defaults.
--- sound/soc/fsl/fsl_sai.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/fsl/fsl_sai.c +3 -0
@@ -779,6 +779,7 @@ static struct reg_default fsl_sai_reg_defaults_ofs0[] = { {FSL_SAI_TDR6, 0}, {FSL_SAI_TDR7, 0}, {FSL_SAI_TMR, 0}, + {FSL_SAI_TTCTL, 0}, {FSL_SAI_RCR1(0), 0}, {FSL_SAI_RCR2(0), 0}, {FSL_SAI_RCR3(0), 0},
@@ -802,12 +803,14 @@ static struct reg_default fsl_sai_reg_defaults_ofs8[] = { {FSL_SAI_TDR6, 0}, {FSL_SAI_TDR7, 0}, {FSL_SAI_TMR, 0}, + {FSL_SAI_TTCTL, 0}, {FSL_SAI_RCR1(8), 0}, {FSL_SAI_RCR2(8), 0}, {FSL_SAI_RCR3(8), 0}, {FSL_SAI_RCR4(8), 0}, {FSL_SAI_RCR5(8), 0}, {FSL_SAI_RMR, 0}, + {FSL_SAI_RTCTL, 0}, {FSL_SAI_MCTL, 0}, {FSL_SAI_MDIV, 0}, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 554/554 scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Rábek <[email protected]>
[ Upstream commit 0e1677654259a2f3ccf728de1edde922a3c4ba57 ]
A race condition was found in sg_proc_debug_helper(). It was observed on a system using an IBM LTO-9 SAS Tape Drive (ULTRIUM-TD9) and monitoring /proc/scsi/sg/debug every second. A very large elapsed time would sometimes appear. This is caused by two race conditions.
We reproduced the issue with an IBM ULTRIUM-HH9 tape drive on an x86_64 architecture. A patched kernel was built, and the race condition could not be observed anymore after the application of this patch. A reproducer C program utilising the scsi_debug module was also built by Changhui Zhong and can be viewed here:
https://github.com/MichaelRabek/linux-tests/blob/master/drivers/scsi/sg/sg_race_trigger.c
The first race happens between the reading of hp->duration in sg_proc_debug_helper() and request completion in sg_rq_end_io(). The hp->duration member variable may hold either of two types of information:
#1 - The start time of the request. This value is present while
the request is not yet finished.
#2 - The total execution time of the request (end_time - start_time).
If sg_proc_debug_helper() executes *after* the value of hp->duration was changed from #1 to #2, but *before* srp->done is set to 1 in sg_rq_end_io(), a fresh timestamp is taken in the else branch, and the elapsed time (value type #2) is subtracted from a timestamp, which cannot yield a valid elapsed time (which is a type #2 value as well).
To fix this issue, the value of hp->duration must change under the protection of the sfp->rq_list_lock in sg_rq_end_io(). Since sg_proc_debug_helper() takes this read lock, the change to srp->done and srp->header.duration will happen atomically from the perspective of sg_proc_debug_helper() and the race condition is thus eliminated.
The second race condition happens between sg_proc_debug_helper() and sg_new_write(). Even though hp->duration is set to the current time stamp in sg_add_request() under the write lock's protection, it gets overwritten by a call to get_sg_io_hdr(), which calls copy_from_user() to copy struct sg_io_hdr from userspace into kernel space. hp->duration is set to the start time again in sg_common_write(). If sg_proc_debug_helper() is called between these two calls, an arbitrary value set by userspace (usually zero) is used to compute the elapsed time.
To fix this issue, hp->duration must be set to the current timestamp again after get_sg_io_hdr() returns successfully. A small race window still exists between get_sg_io_hdr() and setting hp->duration, but this window is only a few instructions wide and does not result in observable issues in practice, as confirmed by testing.
Additionally, we fix the format specifier from %d to %u for printing unsigned int values in sg_proc_debug_helper().
--- drivers/scsi/sg.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/scsi/sg.c +13 -7
@@ -736,6 +736,8 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,sg_remove_request (sfp, srp);return -EFAULT ; } + hp->duration =jiffies_to_msecs (jiffies); +if (hp->interface_id !='S' ) {sg_remove_request (sfp, srp);return -ENOSYS ;
@@ -821,7 +823,6 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,return -ENODEV ; } - hp->duration =jiffies_to_msecs (jiffies);if (hp->interface_id !='\0' &&/* v3 (or later) interface */ (SG_FLAG_Q_AT_TAIL & hp->flags)) at_head =0 ;
@@ -1343,9 +1344,6 @@ sg_rq_end_io(struct request *rq, blk_status_t status)"sg_cmd_done: pack_id=%d, res=0x%x\n" , srp->header.pack_id, result)); srp->header.resid = resid; - ms =jiffies_to_msecs (jiffies); - srp->header.duration = (ms > srp->header.duration) ? - (ms - srp->header.duration) :0 ;if (0 != result) {struct scsi_sense_hdr sshdr;
@@ -1395,6 +1393,9 @@ sg_rq_end_io(struct request *rq, blk_status_t status) done =0 ; } srp->done = done; + ms =jiffies_to_msecs (jiffies); + srp->header.duration = (ms > srp->header.duration) ? + (ms - srp->header.duration) :0 ;write_unlock_irqrestore (&sfp->rq_list_lock, iflags);if (likely (done)) {
@@ -2523,6 +2524,7 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)const sg_io_hdr_t *hp;const char * cp;unsigned int ms; +unsigned int duration; k =0 ;list_for_each_entry (fp, &sdp->sfds, sfd_siblings) {
@@ -2560,13 +2562,17 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)seq_printf (s," id=%d blen=%d" , srp->header.pack_id, blen);if (srp->done) -seq_printf (s," dur=%d" , hp->duration); +seq_printf (s," dur=%u" , hp->duration);else { ms =jiffies_to_msecs (jiffies); -seq_printf (s," t_o/elap=%d/%d" , + duration =READ_ONCE (hp->duration); +if (duration) + duration = (ms > duration ? + ms - duration :0 ); +seq_printf (s," t_o/elap=%u/%u" , (new_interface ? hp->timeout :jiffies_to_msecs (fp->timeout)), - (ms > hp->duration ? ms - hp->duration :0 )); + duration); }seq_printf (s,"ms sgat=%d op=0x%02x\n" , usg, (int ) srp->data.cmd_opcode);
Signature · 1 line
2.51.0
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 5.15.198-rc1-00555-g34877b74a3b0 #1 SMP Thu Jan 15 17:48:07 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.198 release. There are 554 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late.
5.15.198-rc1 built and run on my x86_64 test system (AMD Ryzen 9 9900X, System76 thelio-mira-r4-n3). No errors or regressions.
Thanks,
Slade
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.198 release. There are 554 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.198-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Jon Hunter
maintainerHi Greg,
Quoted 20 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.198 release. There are 554 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.198-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
...
Quoted 3 lines
Wentao Liang <[email protected]>
pmdomain: imx: Fix reference count leak inimx_gpc_probe()
I am seeing a build failure for ARM with multi_v7_defconfig ...
drivers/soc/imx/gpc.c: In function ‘imx_gpc_probe’:
drivers/soc/imx/gpc.c:409:17: error: cleanup argument not a function
409 | = of_get_child_by_name(pdev->dev.of_node, "pgc");
| ^Reverting the above commit resolves the issue.
Cheers
Jon
Signature · 1 line
nvpublic
Greg Kroah-Hartman
maintainerQuoted 34 lines · Jon Hunter
Hi Greg,
Quoted 20 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.198 release. There are 554 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.198-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:...
Quoted 3 lines
Wentao Liang <[email protected]>
pmdomain: imx: Fix reference count leak inimx_gpc_probe()I am seeing a build failure for ARM with
multi_v7_defconfig...
Quoted 6 lines
drivers/soc/imx/gpc.c: In function ‘imx_gpc_probe’:
drivers/soc/imx/gpc.c:409:17: error: cleanup argument not a function409 | = of_get_child_by_name(pdev->dev.of_node, "pgc"); | ^Reverting the above commit resolves the issue.
Now fixed up, thanks. I'll push out a new -rc soon.
greg k-h
The kernel, bpf tool, perf tool, and kselftest builds fine for v5.15.198-rc1 on x86 and arm64 Azure VM.
Thanks,
Hardik
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.198 release. There are 554 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.198-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah