6.12.67-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.12.67-rc1 review
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 23 Jan 2026 18:13:43 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.67-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.67-rc1
Bruno Faccini <[email protected]>
mm/fake-numa: handle cases with no SRAT info
Vlastimil Babka <[email protected]>
mm/page_alloc: prevent pcp corruption with SMP=n
Joshua Hahn <[email protected]>
mm/page_alloc: batch page freeing in decay_pcp_high
Joshua Hahn <[email protected]>
mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
Zhen Ni <[email protected]>
dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
Wentao Liang <[email protected]>
phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
Dragan Simic <[email protected]>
phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
Ben Dooks <[email protected]>
mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
Bruno Faccini <[email protected]>
mm/fake-numa: allow later numa node hotplug
Ryan Roberts <[email protected]>
mm: kmsan: fix poisoning of high-order non-compound pages
Paul Chaignon <[email protected]>
selftests/bpf: Test invalid narrower ctx load
Paul Chaignon <[email protected]>
bpf: Reject narrower access to pointer ctx fields
SeongJae Park <[email protected]>
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
SeongJae Park <[email protected]>
mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
Brian Foster <[email protected]>
xfs: set max_agbno to allow sparse alloc of last full inode chunk
Robbie Ko <[email protected]>
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
Nathan Chancellor <[email protected]>
HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue()
Zhang Lixu <[email protected]>
HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking
Johan Hovold <[email protected]>
dmaengine: ti: k3-udma: fix device leak on udma lookup
Johan Hovold <[email protected]>
dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
Johan Hovold <[email protected]>
dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
Johan Hovold <[email protected]>
dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
Johan Hovold <[email protected]>
dmaengine: stm32: dmamux: fix device leak on route allocation
Biju Das <[email protected]>
dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
Miaoqian Lin <[email protected]>
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
Johan Hovold <[email protected]>
dmaengine: lpc32xx-dmamux: fix device leak on route allocation
Johan Hovold <[email protected]>
dmaengine: lpc18xx-dmamux: fix device leak on route allocation
Johan Hovold <[email protected]>
dmaengine: idxd: fix device leaks on compat bind and unbind
Johan Hovold <[email protected]>
dmaengine: dw: dmamux: fix OF node leak on route allocation failure
Johan Hovold <[email protected]>
dmaengine: bcm-sba-raid: fix device leak on probe
Johan Hovold <[email protected]>
dmaengine: at_hdmac: fix device leak on of_dma_xlate()
Janne Grunau <[email protected]>
dmaengine: apple-admac: Add "apple,t8103-admac" compatible
Binbin Zhou <[email protected]>
LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells
Binbin Zhou <[email protected]>
LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
Binbin Zhou <[email protected]>
LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells
Binbin Zhou <[email protected]>
LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells
Haoxiang Li <[email protected]>
drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
Marek Vasut <[email protected]>
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
Lyude Paul <[email protected]>
drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
Haoxiang Li <[email protected]>
drm/amdkfd: fix a memory leak in device_queue_manager_init()
Mario Limonciello (AMD) <[email protected]>
drm/amd: Clean up kfd node on surprise disconnect
Mario Limonciello <[email protected]>
drm/amd/display: Bump the HDMI clock to 340MHz
Lisa Robinson <[email protected]>
LoongArch: Fix PMU counter allocation for mixed-type event groups
SeongJae Park <[email protected]>
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
Aboorva Devarajan <[email protected]>
mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
Pavel Butsykin <[email protected]>
mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
Nilay Shroff <[email protected]>
nvme: fix PCIe subsystem reset controller state transition
Xiaochen Shen <[email protected]>
x86/resctrl: Fix memory bandwidth counter width for Hygon
Xiaochen Shen <[email protected]>
x86/resctrl: Add missing resctrl initialization for Hygon
Tommaso Merciai <[email protected]>
i2c: riic: Move suspend handling to NOIRQ phase
Arnaud Ferraris <[email protected]>
tcpm: allow looking for role_sw device in the main node
Haoxiang Li <[email protected]>
EDAC/i3200: Fix a resource leak in i3200_probe1()
Haoxiang Li <[email protected]>
EDAC/x38: Fix a resource leak in x38_probe1()
Thomas Weißschuh <[email protected]>
hrtimer: Fix softirq base check in update_needs_ipi()
Yang Erkun <[email protected]>
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
Johan Hovold <[email protected]>
ASoC: codecs: wsa881x: fix unnecessary initialisation
Ilikara Zheng <[email protected]>
nvme-pci: disable secondary temp for Wodposit WPBSNM8
Ethan Nelson-Moore <[email protected]>
USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
Ulrich Mohr <[email protected]>
USB: serial: option: add Telit LE910 MBIM composition
Huacai Chen <[email protected]>
USB: OHCI/UHCI: Add soft dependencies on ehci_platform
Johannes Brüderl <[email protected]>
usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
Thinh Nguyen <[email protected]>
usb: dwc3: Check for USB4 IP_NAME
Wayne Chang <[email protected]>
phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
Louis Chauvet <[email protected]>
phy: rockchip: inno-usb2: fix disconnection in gadget mode
Rafael Beims <[email protected]>
phy: freescale: imx8m-pcie: assert phy reset during power on
Johan Hovold <[email protected]>
phy: ti: gmii-sel: fix regmap leak on probe failure
Luca Ceresoli <[email protected]>
phy: rockchip: inno-usb2: fix communication disruption in gadget mode
Dan Williams <[email protected]>
x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
Shakeel Butt <[email protected]>
lib/buildid: use __kernel_read() for sleepable context
Nirjhar Roy (IBM) <[email protected]>
xfs: Fix the return value of xfs_rtcopy_summary()
Tetsuo Handa <[email protected]>
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
Ondrej Ille <[email protected]>
can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
Nilay Shroff <[email protected]>
null_blk: fix kmemleak by releasing references to fault configfs items
Jaroslav Kysela <[email protected]>
ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
Brian Kao <[email protected]>
scsi: core: Fix error handler encryption support
Ming Lei <[email protected]>
io_uring: move local task_work in exit cancel loop
Tzung-Bi Shih <[email protected]>
drm/amd/display: mark static functions noinline_for_stack
Johan Hovold <[email protected]>
ASoC: codecs: wsa883x: fix unnecessary initialisation
Ido Schimmel <[email protected]>
bridge: mcast: Fix use-after-free during router port configuration
Benjamin Tissoires <[email protected]>
HID: usbhid: paper over wrong bNumDescriptor field
Neil Armstrong <[email protected]>
i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
Haotian Zhang <[email protected]>
dmaengine: omap-dma: fix dma_pool resource leak in error paths
Günther Noack <[email protected]>
selftests/landlock: Properly close a file descriptor
Krzysztof Kozlowski <[email protected]>
phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
Matthieu Buffet <[email protected]>
selftests/landlock: Remove invalid unix socket bind()
Matthieu Buffet <[email protected]>
selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
Haotian Zhang <[email protected]>
phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors
Dan Carpenter <[email protected]>
phy: stm32-usphyc: Fix off by one in probe()
Loic Poulain <[email protected]>
phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
Johan Hovold <[email protected]>
phy: drop probe registration printks
Ivaylo Ivanov <[email protected]>
phy: phy-snps-eusb2: refactor constructs names
Stefano Radaelli <[email protected]>
phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
Suraj Gupta <[email protected]>
dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
Sheetal <[email protected]>
dmaengine: tegra-adma: Fix use-after-free
Anthony Brandon <[email protected]>
dmaengine: xilinx: xdma: Fix regmap max_register
Bagas Sanjaya <[email protected]>
mm, kfence: describe @slab parameter in __kfence_obj_info()
Bagas Sanjaya <[email protected]>
textsearch: describe @list member in ts_ops search
Bagas Sanjaya <[email protected]>
mm: describe @flags parameter in memalloc_flags_save()
Yang Wang <[email protected]>
drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
Emil Svendsen <[email protected]>
ASoC: tlv320adcx140: fix word length
Emil Svendsen <[email protected]>
ASoC: tlv320adcx140: fix null pointer
Cole Leavitt <[email protected]>
ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type
Eric Dumazet <[email protected]>
net/sched: sch_qfq: do not free existing class in qfq_change_class()
Gal Pressman <[email protected]>
selftests: drv-net: fix RPS mask handling for high CPU numbers
Kuniyuki Iwashima <[email protected]>
ipv6: Fix use-after-free in inet6_addr_del().
Aditya Garg <[email protected]>
net: hv_netvsc: reject RSS hash key programming without RX indirection table
Richard Fitzgerald <[email protected]>
ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
Kery Qi <[email protected]>
net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
Jiasheng Jiang <[email protected]>
btrfs: fix memory leaks in create_space_info() error paths
Naohiro Aota <[email protected]>
btrfs: introduce btrfs_space_info sub-group
Naohiro Aota <[email protected]>
btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
Naohiro Aota <[email protected]>
btrfs: factor out init_space_info() from create_space_info()
Saeed Mahameed <[email protected]>
net/mlx5e: Restore destroying state bit after profile cleanup
Saeed Mahameed <[email protected]>
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
Saeed Mahameed <[email protected]>
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
Saeed Mahameed <[email protected]>
net/mlx5e: Fix crash on profile change rollback failure
Stefano Garzarella <[email protected]>
vsock/test: add a final full barrier after run all tests
Eric Dumazet <[email protected]>
ipv4: ip_gre: make ipgre_header() robust
Eric Dumazet <[email protected]>
macvlan: fix possible UAF in macvlan_forward_source()
Eric Dumazet <[email protected]>
net: update netdev_lock_{type,name}Eric Dumazet <[email protected]>
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
Eric Dumazet <[email protected]>
net: bridge: annotate data-races around fdb->{updated,used}Qu Wenruo <[email protected]>
btrfs: send: check for inline extents in range_is_hole_in_parent()
Shivam Kumar <[email protected]>
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
Szymon Wilczek <[email protected]>
can: etas_es58x: allow partial RX URB allocation to succeed
Yaxiong Tian <[email protected]>
PM: EM: Fix incorrect description of the cost field in struct em_perf_state
Ian Forbes <[email protected]>
drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
Zilin Guan <[email protected]>
pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
Zilin Guan <[email protected]>
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
Trond Myklebust <[email protected]>
NFS: Fix a deadlock involving nfs_release_folio()
Trond Myklebust <[email protected]>
pNFS: Fix a deadlock when returning a delegation during open()
Antony Antony <[email protected]>
xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
Jianbo Liu <[email protected]>
xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
Johan Hovold <[email protected]>
ASoC: codecs: wsa884x: fix codec initialisation
Sean Christopherson <[email protected]>
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
Andreas Gruenbacher <[email protected]>
Revert "gfs2: Fix use of bio_chain"
Morduan Zang <[email protected]>
efi/cper: Fix cper_bits_to_str buffer handling and return value
Peng Fan <[email protected]>
firmware: imx: scu-irq: Set mu_resource_id before get handle
-------------
Diffstat:
Makefile | 4 +- arch/loongarch/boot/dts/loongson-2k0500.dtsi | 3 + arch/loongarch/boot/dts/loongson-2k1000.dtsi | 6 +- arch/loongarch/boot/dts/loongson-2k2000.dtsi | 3 + arch/loongarch/kernel/perf_event.c | 21 +- arch/x86/kernel/cpu/resctrl/core.c | 21 +- arch/x86/kernel/cpu/resctrl/internal.h | 3 + arch/x86/kernel/fpu/core.c | 32 ++- arch/x86/kvm/x86.c | 9 + arch/x86/mm/kaslr.c | 10 +- drivers/acpi/numa/srat.c | 95 ++++++++ drivers/block/null_blk/main.c | 12 +- drivers/dma/apple-admac.c | 1 + drivers/dma/at_hdmac.c | 9 +- drivers/dma/bcm-sba-raid.c | 6 +- drivers/dma/dw/rzn1-dmamux.c | 4 +- drivers/dma/fsl-edma-common.c | 1 + drivers/dma/idxd/compat.c | 23 +- drivers/dma/lpc18xx-dmamux.c | 19 +- drivers/dma/lpc32xx-dmamux.c | 19 +- drivers/dma/qcom/gpi.c | 6 +- drivers/dma/sh/rz-dmac.c | 5 + drivers/dma/stm32/stm32-dmamux.c | 22 +- drivers/dma/tegra210-adma.c | 10 +- drivers/dma/ti/dma-crossbar.c | 18 +- drivers/dma/ti/k3-udma-private.c | 2 +- drivers/dma/ti/omap-dma.c | 4 + drivers/dma/xilinx/xdma-regs.h | 1 + drivers/dma/xilinx/xdma.c | 2 +- drivers/dma/xilinx/xilinx_dma.c | 7 +- drivers/edac/i3200_edac.c | 11 +- drivers/edac/x38_edac.c | 9 +- drivers/firmware/efi/cper.c | 2 +- drivers/firmware/imx/imx-scu-irq.c | 24 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 19 +- drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h | 2 +- .../drm/amd/display/dc/dml2/display_mode_core.c | 12 +- .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 8 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 4 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 3 +- drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + drivers/gpu/drm/panel/panel-simple.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 22 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/hid/intel-ish-hid/ipc/ipc.c | 25 +- drivers/hid/intel-ish-hid/ipc/pci-ish.c | 2 +- drivers/hid/intel-ish-hid/ishtp-hid-client.c | 4 +- drivers/hid/intel-ish-hid/ishtp/bus.c | 18 +- drivers/hid/intel-ish-hid/ishtp/hbm.c | 4 +- drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h | 3 + drivers/hid/usbhid/hid-core.c | 17 +- drivers/i2c/busses/i2c-qcom-geni.c | 11 +- drivers/i2c/busses/i2c-riic.c | 46 +++- drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +- drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +- drivers/net/can/usb/gs_usb.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 13 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 86 ++++--- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 15 +- drivers/net/hyperv/netvsc_drv.c | 3 + drivers/net/macvlan.c | 20 +- drivers/nvme/host/pci.c | 7 +- drivers/nvme/target/tcp.c | 12 + drivers/pci/Kconfig | 6 - drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +- drivers/phy/broadcom/phy-bcm-ns2-pcie.c | 2 - drivers/phy/broadcom/phy-bcm-ns2-usbdrd.c | 1 - drivers/phy/broadcom/phy-bcm-sr-pcie.c | 2 - drivers/phy/broadcom/phy-brcm-sata.c | 2 +- drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + drivers/phy/marvell/phy-pxa-usb.c | 1 - drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 2 - drivers/phy/qualcomm/phy-qcom-m31.c | 2 - drivers/phy/qualcomm/phy-qcom-qusb2.c | 18 +- drivers/phy/qualcomm/phy-qcom-snps-eusb2.c | 256 ++++++++++----------- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 41 ++-- drivers/phy/st/phy-stih407-usb.c | 2 - drivers/phy/st/phy-stm32-usbphyc.c | 6 +- drivers/phy/tegra/xusb-tegra186.c | 3 + drivers/phy/ti/phy-da8xx-usb.c | 7 +- drivers/phy/ti/phy-gmii-sel.c | 2 +- drivers/phy/ti/phy-twl4030-usb.c | 1 - drivers/scsi/scsi_error.c | 24 ++ drivers/usb/core/config.c | 5 + drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/core.c | 2 + drivers/usb/dwc3/core.h | 1 + drivers/usb/host/ohci-platform.c | 1 + drivers/usb/host/uhci-platform.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 2 + drivers/usb/serial/option.c | 1 + drivers/usb/typec/tcpm/tcpm.c | 2 +- fs/btrfs/block-group.c | 60 +++-- fs/btrfs/send.c | 2 + fs/btrfs/space-info.c | 75 ++++-- fs/btrfs/space-info.h | 9 + fs/btrfs/sysfs.c | 18 +- fs/btrfs/transaction.c | 11 +- fs/ext4/xattr.c | 1 + fs/gfs2/lops.c | 2 +- fs/nfs/blocklayout/dev.c | 6 +- fs/nfs/file.c | 3 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- fs/nfs/nfs4proc.c | 6 +- fs/nfs/nfstrace.h | 3 + fs/nfs/pnfs.c | 58 +++-- fs/nfs/pnfs.h | 17 +- fs/nfs/write.c | 33 +++ fs/xfs/libxfs/xfs_ialloc.c | 11 +- fs/xfs/xfs_rtalloc.c | 2 +- include/acpi/acpi_numa.h | 5 + include/linux/energy_model.h | 2 +- include/linux/gfp.h | 2 +- include/linux/intel-ish-client-if.h | 2 + include/linux/kfence.h | 1 + include/linux/nfs_fs.h | 1 + include/linux/numa_memblks.h | 3 + include/linux/sched/mm.h | 1 + include/linux/textsearch.h | 1 + include/linux/usb/quirks.h | 3 + include/scsi/scsi_eh.h | 6 + include/sound/pcm.h | 2 +- io_uring/io_uring.c | 8 +- kernel/bpf/cgroup.c | 8 +- kernel/time/hrtimer.c | 2 +- lib/buildid.c | 32 ++- mm/Kconfig | 10 +- mm/damon/sysfs-schemes.c | 10 +- mm/damon/sysfs.c | 5 +- mm/kmsan/shadow.c | 2 +- mm/numa_emulation.c | 45 +++- mm/numa_memblks.c | 4 +- mm/page_alloc.c | 74 ++++-- mm/vmstat.c | 28 +-- mm/zswap.c | 2 +- net/bridge/br_fdb.c | 28 ++- net/bridge/br_input.c | 4 +- net/bridge/br_multicast.c | 9 + net/can/j1939/transport.c | 10 +- net/core/dev.c | 25 +- net/core/filter.c | 20 +- net/ipv4/esp4_offload.c | 4 +- net/ipv4/ip_gre.c | 11 +- net/ipv6/addrconf.c | 4 +- net/ipv6/esp6_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 2 +- net/sched/sch_qfq.c | 6 +- net/xfrm/xfrm_state.c | 1 + sound/core/oss/pcm_oss.c | 4 +- sound/core/pcm_native.c | 9 +- sound/pci/hda/cirrus_scodec_test.c | 1 + sound/soc/codecs/tlv320adcx140.c | 8 +- sound/soc/codecs/wsa881x.c | 9 + sound/soc/codecs/wsa883x.c | 9 + sound/soc/codecs/wsa884x.c | 3 +- sound/soc/sdw_utils/soc_sdw_cs42l43.c | 2 +- tools/testing/selftests/bpf/progs/verifier_ctx.c | 25 ++ tools/testing/selftests/landlock/common.h | 1 + tools/testing/selftests/landlock/fs_test.c | 6 +- tools/testing/selftests/landlock/net_test.c | 16 +- tools/testing/selftests/net/toeplitz.c | 4 +- tools/testing/vsock/util.c | 12 + 166 files changed, 1424 insertions(+), 596 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/139 firmware: imx: scu-irq: Set mu_resource_id before get handle
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
commit ff3f9913bc0749364fbfd86ea62ba2d31c6136c8 upstream.
mu_resource_id is referenced in imx_scu_irq_get_status() and imx_scu_irq_group_enable() which could be used by other modules, so need to set correct value before using imx_sc_irq_ipc_handle in SCU API call.
--- drivers/firmware/imx/imx-scu-irq.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/firmware/imx/imx-scu-irq.c +12 -12
@@ -203,6 +203,18 @@ int imx_scu_enable_general_irq_channel(sstruct mbox_chan *ch;int ret =0 , i =0 ; +if (!of_parse_phandle_with_args (dev->of_node,"mboxes" , +"#mbox-cells" ,0 , &spec)) { + i =of_alias_get_id (spec.np,"mu" ); +of_node_put (spec.np); + } + +/* use mu1 as general mu irq channel if failed */ +if (i <0 ) + i =1 ; + + mu_resource_id =IMX_SC_R_MU_0A + i; + ret =imx_scu_get_handle (&imx_sc_irq_ipc_handle);if (ret)return ret;
@@ -225,18 +237,6 @@ int imx_scu_enable_general_irq_channel(sreturn ret; } -if (!of_parse_phandle_with_args (dev->of_node,"mboxes" , -"#mbox-cells" ,0 , &spec)) { - i =of_alias_get_id (spec.np,"mu" ); -of_node_put (spec.np); - } - -/* use mu1 as general mu irq channel if failed */ -if (i <0 ) - i =1 ; - - mu_resource_id =IMX_SC_R_MU_0A + i; -/* Create directory under /sysfs/firmware */ wakeup_obj =kobject_create_and_add ("scu_wakeup_source" , firmware_kobj);if (!wakeup_obj) {
Greg Kroah-Hartman
maintainerPATCH 2/139 efi/cper: Fix cper_bits_to_str buffer handling and return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Morduan Zang <[email protected]>
commit d7f1b4bdc7108be1b178e1617b5f45c8918e88d7 upstream.
The return value calculation was incorrect: return len - buf_size; Initially len = buf_size, then len decreases with each operation. This results in a negative return value on success.
Fix by returning buf_size - len which correctly calculates the actual number of bytes written.
--- drivers/firmware/efi/cper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/cper.c +1 -1
@@ -162,7 +162,7 @@ int cper_bits_to_str(char *buf, int buf_ len -= size; str += size; } -return len - buf_size; +return buf_size - len; }EXPORT_SYMBOL_GPL (cper_bits_to_str);
Greg Kroah-Hartman
maintainerPATCH 3/139 Revert "gfs2: Fix use of bio_chain"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 469d71512d135907bf5ea0972dfab8c420f57848 upstream.
This reverts commit 8a157e0a0aa5143b5d94201508c0ca1bb8cfb941.
That commit incorrectly assumed that the bio_chain() arguments were swapped in gfs2. However, gfs2 intentionally constructs bio chains so that the first bio's bi_end_io callback is invoked when all bios in the chain have completed, unlike bio chains where the last bio's callback is invoked.
--- fs/gfs2/lops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/lops.c +1 -1
@@ -485,7 +485,7 @@ static struct bio *gfs2_chain_bio(struct new =bio_alloc (prev->bi_bdev, nr_iovecs, prev->bi_opf,GFP_NOIO );bio_clone_blkg_association (new, prev); new->bi_iter.bi_sector =bio_end_sector (prev); -bio_chain (prev, new); +bio_chain (new, prev);submit_bio (prev);return new; }
Greg Kroah-Hartman
maintainerPATCH 4/139 x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit b45f721775947a84996deb5c661602254ce25ce6 upstream.
When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled features in the saved (or to be restored) XSTATE_BV to ensure KVM doesn't attempt to load state for features that are disabled via the guest's XFD. Because the kernel executes XRSTOR with the guest's XFD, saving XSTATE_BV[i]=1 with XFD[i]=1 will cause XRSTOR to #NM and panic the kernel.
E.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:
------------[ cut here ]------------ WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848 Modules linked in: kvm_intel kvm irqbypass CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:exc_device_not_available+0x101/0x110 Call Trace: <TASK> asm_exc_device_not_available+0x1a/0x20 RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90 switch_fpu_return+0x4a/0xb0 kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm] kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm] __x64_sys_ioctl+0x8f/0xd0 do_syscall_64+0x62/0x940 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> ---[ end trace 0000000000000000 ]---
This can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1, and a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler's call to fpu_update_guest_xfd().
and if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:
------------[ cut here ]------------ WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867 Modules linked in: kvm_intel kvm irqbypass CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:exc_device_not_available+0x101/0x110 Call Trace: <TASK> asm_exc_device_not_available+0x1a/0x20 RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90 fpu_swap_kvm_fpstate+0x6b/0x120 kvm_load_guest_fpu+0x30/0x80 [kvm] kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm] kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm] __x64_sys_ioctl+0x8f/0xd0 do_syscall_64+0x62/0x940 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> ---[ end trace 0000000000000000 ]---
The new behavior is consistent with the AMX architecture. Per Intel's SDM, XSAVE saves XSTATE_BV as '0' for components that are disabled via XFD (and non-compacted XSAVE saves the initial configuration of the state component):
If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i, the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1; instead, it operates as if XINUSE[i] = 0 (and the state component was in its initial state): it saves bit i of XSTATE_BV field of the XSAVE header as 0; in addition, XSAVE saves the initial configuration of the state component (the other instructions do not save state component i).
Alternatively, KVM could always do XRSTOR with XFD=0, e.g. by using a constant XFD based on the set of enabled features when XSAVEing for a struct fpu_guest. However, having XSTATE_BV[i]=1 for XFD-disabled features can only happen in the above interrupt case, or in similar scenarios involving preemption on preemptible kernels, because fpu_swap_kvm_fpstate()'s call to save_fpregs_to_fpstate() saves the outgoing FPU state with the current XFD; and that is (on all but the first WRMSR to XFD) the guest XFD.
Therefore, XFD can only go out of sync with XSTATE_BV in the above interrupt case, or in similar scenarios involving preemption on preemptible kernels, and it we can consider it (de facto) part of KVM ABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.
[Move clearing of XSTATE_BV from fpu_copy_uabi_to_guest_fpstate
to kvm_vcpu_ioctl_x86_set_xsave. - Paolo]
--- arch/x86/kernel/fpu/core.c | 32 +++++++++++++++++++++++++++++--- arch/x86/kvm/x86.c | 9 +++++++++ 2 files changed, 38 insertions(+), 3 deletions(-)
arch/x86/kernel/fpu/core.c +29 -3
@@ -294,10 +294,29 @@ EXPORT_SYMBOL_GPL(fpu_enable_guest_xfd_f#ifdef CONFIG_X86_64 void fpu_update_guest_xfd (struct fpu_guest *guest_fpu,u64 xfd) { +struct fpstate *fpstate = guest_fpu->fpstate; +fpregs_lock (); - guest_fpu->fpstate->xfd = xfd; -if (guest_fpu->fpstate->in_use) -xfd_update_state (guest_fpu->fpstate); + +/* +* KVM's guest ABI is that setting XFD[i]=1 *can* immediately revert the +* save state to its initial configuration. Likewise, KVM_GET_XSAVE does +* the same as XSAVE and returns XSTATE_BV[i]=0 whenever XFD[i]=1. +* +* If the guest's FPU state is in hardware, just update XFD: the XSAVE +* in fpu_swap_kvm_fpstate will clear XSTATE_BV[i] whenever XFD[i]=1. +* +* If however the guest's FPU state is NOT resident in hardware, clear +* disabled components in XSTATE_BV now, or a subsequent XRSTOR will +* attempt to load disabled components and generate #NM _in the host_. +*/ +if (xfd &&test_thread_flag (TIF_NEED_FPU_LOAD )) + fpstate->regs.xsave.header.xfeatures &= ~xfd; + + fpstate->xfd = xfd; +if (fpstate->in_use) +xfd_update_state (fpstate); +fpregs_unlock (); }EXPORT_SYMBOL_GPL (fpu_update_guest_xfd);
@@ -406,6 +425,13 @@ int fpu_copy_uabi_to_guest_fpstate(strucreturn -EINVAL ;/* +* Disabled features must be in their initial state, otherwise XRSTOR +* causes an exception. +*/ +if (WARN_ON_ONCE (ustate->xsave.header.xfeatures & kstate->xfd)) +return -EINVAL ; + +/* * Nullify @vpkru to preserve its current value if PKRU's bit isn't set * in the header. KVM's odd ABI is to leave PKRU untouched in this * case (all other components are eventually re-initialized).
arch/x86/kvm/x86.c +9 -0
@@ -5625,9 +5625,18 @@ static int kvm_vcpu_ioctl_x86_get_xsave(static int kvm_vcpu_ioctl_x86_set_xsave (struct kvm_vcpu *vcpu,struct kvm_xsave *guest_xsave) { +union fpregs_state *xstate = (union fpregs_state *)guest_xsave->region; +if (fpstate_is_confidential (&vcpu->arch.guest_fpu))return vcpu->kvm->arch.has_protected_state ? -EINVAL :0 ; +/* +* For backwards compatibility, do not expect disabled features to be in +* their initial state. XSTATE_BV[i] must still be cleared whenever +* XFD[i]=1, or XRSTOR would cause a #NM. +*/ + xstate->xsave.header.xfeatures &= ~vcpu->arch.guest_fpu.fpstate->xfd; + return fpu_copy_uabi_to_guest_fpstate(&vcpu->arch.guest_fpu, guest_xsave->region, kvm_caps.supported_xcr0,
Greg Kroah-Hartman
maintainerPATCH 5/139 ASoC: codecs: wsa884x: fix codec initialisation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 120f3e6ff76209ee2f62a64e5e7e9d70274df42b upstream.
The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED.
Fix the inverted hw_init flag which was set to false instead of true after initialisation which defeats its purpose and may result in repeated unnecessary initialisation.
Similarly, the initial state of the flag was also inverted so that the codec would only be initialised and brought out of regmap cache only mode if its status first transitions to UNATTACHED.
--- sound/soc/codecs/wsa884x.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/codecs/wsa884x.c +1 -2
@@ -1534,7 +1534,7 @@ static void wsa884x_init(struct wsa884x_wsa884x_set_gain_parameters (wsa884x); - wsa884x->hw_init = false; + wsa884x->hw_init = true; } static int wsa884x_update_status(struct sdw_slave *slave,
@@ -2110,7 +2110,6 @@ static int wsa884x_probe(struct sdw_slav/* Start in cache-only until device is enumerated */ regcache_cache_only (wsa884x->regmap, true); - wsa884x->hw_init = true;if (IS_REACHABLE (CONFIG_HWMON )) {struct device *hwmon;
Greg Kroah-Hartman
maintainerPATCH 6/139 xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 3d5221af9c7711b7aec8da1298c8fc393ef6183d ]
Commit 61fafbee6cfe ("xfrm: Determine inner GSO type from packet inner protocol") attempted to fix GSO segmentation by reading the inner protocol from XFRM_MODE_SKB_CB(skb)->protocol. This was incorrect because the field holds the inner L4 protocol (TCP/UDP) instead of the required tunnel protocol. Also, the memory location (shared by XFRM_SKB_CB(skb) which could be overwritten by xfrm_replay_overflow()) is prone to corruption. This combination caused the kernel to select the wrong inner mode and get the wrong address family.
The correct value is in xfrm_offload(skb)->proto, which is set from the outer tunnel header's protocol field by esp[4|6]_gso_encap(). It is initialized by xfrm[4|6]_tunnel_encap_add() to either IPPROTO_IPIP or IPPROTO_IPV6, using xfrm_af2proto() and correctly reflects the inner packet's address family.
--- net/ipv4/esp4_offload.c | 4 ++-- net/ipv6/esp6_offload.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/esp4_offload.c +2 -2
@@ -122,8 +122,8 @@ static struct sk_buff *xfrm4_tunnel_gso_segment(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features) { -const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, -XFRM_MODE_SKB_CB (skb)->protocol); +struct xfrm_offload *xo =xfrm_offload (skb); +const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, xo->proto);__be16 type = inner_mode->family ==AF_INET6 ?htons (ETH_P_IPV6 ) :htons (ETH_P_IP );
net/ipv6/esp6_offload.c +2 -2
@@ -158,8 +158,8 @@ static struct sk_buff *xfrm6_tunnel_gso_segment(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features) { -const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, -XFRM_MODE_SKB_CB (skb)->protocol); +struct xfrm_offload *xo =xfrm_offload (skb); +const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, xo->proto);__be16 type = inner_mode->family ==AF_INET ?htons (ETH_P_IP ) :htons (ETH_P_IPV6 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/139 xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antony Antony <[email protected]>
[ Upstream commit c196def07bbc6e8306d7a274433913444b0db20a ]
The XFRM_STATE_NOPMTUDISC flag is only meaningful for output SAs, but it was being applied regardless of the SA direction when the sysctl ip_no_pmtu_disc is enabled. This can unintentionally affect input SAs.
Limit setting XFRM_STATE_NOPMTUDISC to output SAs when the SA direction is configured.
--- net/xfrm/xfrm_state.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_state.c +1 -0
@@ -3058,6 +3058,7 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload,int err;if (family ==AF_INET && + (!x->dir || x->dir ==XFRM_SA_DIR_OUT ) &&READ_ONCE (xs_net (x)->ipv4.sysctl_ip_no_pmtu_disc)) x->props.flags |=XFRM_STATE_NOPMTUDISC ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/139 pNFS: Fix a deadlock when returning a delegation during open()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 857bf9056291a16785ae3be1d291026b2437fc48 ]
Ben Coddington reports seeing a hang in the following stack trace:
0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415
1 [ffffd0b50e177548] schedule at ffffffff9ca05717
2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1
3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb
4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]
6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]
10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]
15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea
18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e
19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935
The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated. The state recovery cannot complete until the open() finishes processing the delegations it was given.
The solution is to propagate the existing flags that indicate a non-blocking call to the function pnfs_roc(), so that it knows not to wait in this situation.
--- fs/nfs/nfs4proc.c | 6 ++--- fs/nfs/pnfs.c | 58 +++++++++++++++++++++++++++++++++-------------- fs/nfs/pnfs.h | 17 ++++++-------- 3 files changed, 51 insertions(+), 30 deletions(-)
fs/nfs/nfs4proc.c +3 -3
@@ -3868,8 +3868,8 @@ int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait) calldata->res.seqid = calldata->arg.seqid; calldata->res.server = server; calldata->res.lr_ret = -NFS4ERR_NOMATCHING_LAYOUT ; - calldata->lr.roc =pnfs_roc (state->inode, - &calldata->lr.arg, &calldata->lr.res, msg.rpc_cred); + calldata->lr.roc =pnfs_roc (state->inode, &calldata->lr.arg, + &calldata->lr.res, msg.rpc_cred, wait);if (calldata->lr.roc) { calldata->arg.lr_args = &calldata->lr.arg; calldata->res.lr_res = &calldata->lr.res;
@@ -6895,7 +6895,7 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, data->inode =nfs_igrab_and_active (inode);if (data->inode || issync) { data->lr.roc =pnfs_roc (inode, &data->lr.arg, &data->lr.res, - cred); + cred, issync);if (data->lr.roc) { data->args.lr_args = &data->lr.arg; data->res.lr_res = &data->lr.res;
fs/nfs/pnfs.c +41 -17
97 lines not on this page · raw message
fs/nfs/pnfs.h +7 -10
@@ -303,10 +303,9 @@ int pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo, u32 seq);int pnfs_mark_layout_stateid_invalid (struct pnfs_layout_hdr *lo,struct list_head *lseg_list); -bool pnfs_roc (struct inode *ino, -struct nfs4_layoutreturn_args *args, -struct nfs4_layoutreturn_res *res, -const struct cred *cred); +bool pnfs_roc (struct inode *ino,struct nfs4_layoutreturn_args *args, +struct nfs4_layoutreturn_res *res,const struct cred *cred, +bool sync);int pnfs_roc_done (struct rpc_task *task,struct nfs4_layoutreturn_args **argpp,struct nfs4_layoutreturn_res **respp,int *ret); void pnfs_roc_release(struct nfs4_layoutreturn_args *args,
@@ -773,12 +772,10 @@ pnfs_layoutcommit_outstanding(struct inode *inode)return false; } - -static inline bool -pnfs_roc (struct inode *ino, -struct nfs4_layoutreturn_args *args, -struct nfs4_layoutreturn_res *res, -const struct cred *cred) +static inline bool pnfs_roc (struct inode *ino, +struct nfs4_layoutreturn_args *args, +struct nfs4_layoutreturn_res *res, +const struct cred *cred,bool sync) {return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/139 NFS: Fix a deadlock involving nfs_release_folio()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit cce0be6eb4971456b703aaeafd571650d314bcca ]
Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_release_folio(). The latter cannot make progress due to state recovery being needed.
It seems that the only safe thing to do here is to kick off a writeback of the folio, without waiting for completion, or else kicking off an asynchronous commit.
--- fs/nfs/file.c | 3 ++- fs/nfs/nfstrace.h | 3 +++ fs/nfs/write.c | 33 +++++++++++++++++++++++++++++++++ include/linux/nfs_fs.h | 1 + 4 files changed, 39 insertions(+), 1 deletion(-)
fs/nfs/file.c +2 -1
@@ -461,7 +461,8 @@ static bool nfs_release_folio(struct folio *folio, gfp_t gfp)if ((current_gfp_context (gfp) &GFP_KERNEL ) !=GFP_KERNEL ||current_is_kswapd () ||current_is_kcompactd ())return false; -if (nfs_wb_folio (folio->mapping->host, folio) <0 ) +if (nfs_wb_folio_reclaim (folio->mapping->host, folio) <0 || +folio_test_private (folio))return false; }return nfs_fscache_release_folio (folio, gfp);
fs/nfs/nfstrace.h +3 -0
@@ -1039,6 +1039,9 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done,DEFINE_NFS_FOLIO_EVENT (nfs_aop_readpage);DEFINE_NFS_FOLIO_EVENT_DONE (nfs_aop_readpage_done); +DEFINE_NFS_FOLIO_EVENT (nfs_writeback_folio_reclaim); +DEFINE_NFS_FOLIO_EVENT_DONE (nfs_writeback_folio_reclaim_done); +DEFINE_NFS_FOLIO_EVENT (nfs_writeback_folio);DEFINE_NFS_FOLIO_EVENT_DONE (nfs_writeback_folio_done);
fs/nfs/write.c +33 -0
@@ -2065,6 +2065,39 @@ int nfs_wb_folio_cancel(struct inode *inode, struct folio *folio)return ret; } +/** +* nfs_wb_folio_reclaim - Write back all requests on one page +* @inode: pointer to page +* @folio: pointer to folio +* +* Assumes that the folio has been locked by the caller +*/ +int nfs_wb_folio_reclaim (struct inode *inode,struct folio *folio) +{ +loff_t range_start =folio_pos (folio); +size_t len =folio_size (folio); +struct writeback_control wbc = { + .sync_mode =WB_SYNC_ALL , + .nr_to_write =0 , + .range_start = range_start, + .range_end = range_start + len -1 , + .for_sync =1 , + }; +int ret; + +if (folio_test_writeback (folio)) +return -EBUSY ; +if (folio_clear_dirty_for_io (folio)) { +trace_nfs_writeback_folio_reclaim (inode, range_start, len); + ret =nfs_writepage_locked (folio, &wbc); +trace_nfs_writeback_folio_reclaim_done (inode, range_start, len, + ret); +return ret; + } +nfs_commit_inode (inode,0 ); +return 0 ; +} +/** * nfs_wb_folio - Write back all requests on one page * @inode: pointer to page
include/linux/nfs_fs.h +1 -0
@@ -610,6 +610,7 @@ extern int nfs_update_folio(struct file *file, struct folio *folio,extern int nfs_sync_inode (struct inode *inode);extern int nfs_wb_all (struct inode *inode);extern int nfs_wb_folio (struct inode *inode,struct folio *folio); +extern int nfs_wb_folio_reclaim (struct inode *inode,struct folio *folio);int nfs_wb_folio_cancel (struct inode *inode,struct folio *folio);extern int nfs_commit_inode (struct inode *,int );extern struct nfs_commit_data *nfs_commitdata_alloc (void );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/139 pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 0c728083654f0066f5e10a1d2b0bd0907af19a58 ]
In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak.
Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources.
--- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/flexfilelayout/flexfilelayoutdev.c +1 -1
@@ -103,7 +103,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,sizeof (struct nfs4_ff_ds_version ), gfp_flags);if (!ds_versions) - goto out_scratch; + goto out_err_drain_dsaddrs;for (i =0 ; i < version_count; i++) {/* 20 = version(4) + minor_version(4) + rsize(4) + wsize(4) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/139 pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 5a74af51c3a6f4cd22c128b0c1c019f68fa90011 ]
In bl_parse_scsi(), if the block device length is zero, the function returns immediately without releasing the file reference obtained via bl_open_path(), leading to a memory leak.
Fix this by jumping to the out_blkdev_put label to ensure the file reference is properly released.
--- fs/nfs/blocklayout/dev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/nfs/blocklayout/dev.c +4 -2
@@ -417,8 +417,10 @@ bl_parse_scsi(struct nfs_server *server, struct pnfs_block_dev *d, d->map = bl_map_simple; d->pr_key = v->scsi.pr_key; -if (d->len ==0 ) -return -ENODEV ; +if (d->len ==0 ) { + error = -ENODEV ; + goto out_blkdev_put; + } ops = bdev->bd_disk->fops->pr_ops;if (!ops) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/139 drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 37a0cff4551c14aca4cfa6ef3f2f0e0f61d66825 ]
Some of the warnings need to be reordered between these two functions in order to be correct. This has happened multiple times. Merging them solves this problem once and for all.
--- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c +8 -14
@@ -32,9 +32,15 @@#include <drm/ttm/ttm_placement.h> -static void vmw_bo_release (struct vmw_bo *vbo) +/** +* vmw_bo_free - vmw_bo destructor +* +* @bo: Pointer to the embedded struct ttm_buffer_object +*/ +static void vmw_bo_free (struct ttm_buffer_object *bo) {struct vmw_resource *res; +struct vmw_bo *vbo =to_vmw_bo (&bo->base);WARN_ON (vbo->tbo.base.funcs &&kref_read (&vbo->tbo.base.refcount) !=0 );
@@ -63,20 +69,8 @@ static void vmw_bo_release(struct vmw_bo *vbo) }vmw_surface_unreference (&vbo->dumb_surface); } -drm_gem_object_release (&vbo->tbo.base); -} - -/** -* vmw_bo_free - vmw_bo destructor -* -* @bo: Pointer to the embedded struct ttm_buffer_object -*/ -static void vmw_bo_free (struct ttm_buffer_object *bo) -{ -struct vmw_bo *vbo =to_vmw_bo (&bo->base); -WARN_ON (!RB_EMPTY_ROOT (&vbo->res_tree)); -vmw_bo_release (vbo); +drm_gem_object_release (&vbo->tbo.base);WARN_ON (vbo->dirty);kfree (vbo); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/139 PM: EM: Fix incorrect description of the cost field in struct em_perf_state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yaxiong Tian <[email protected]>
[ Upstream commit 54b603f2db6b95495bc33a8f2bde80f044baff9a ]
Due to commit 1b600da51073 ("PM: EM: Optimize em_cpu_energy() and remove division"), the logic for energy consumption calculation has been modified. The actual calculation of cost is 10 * power * max_frequency / frequency instead of power * max_frequency / frequency.
Therefore, the comment for cost has been updated to reflect the correct content.
--- include/linux/energy_model.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/energy_model.h +1 -1
@@ -18,7 +18,7 @@* @power: The power consumed at this level (by 1 CPU or by a registered * device). It can be a total power: static and dynamic. * @cost: The cost coefficient associated with this level, used during -* energy calculation. Equal to: power * max_frequency / frequency +* energy calculation. Equal to: 10 * power * max_frequency / frequency * @flags: see "em_perf_state flags" description below. */ struct em_perf_state {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/139 can: etas_es58x: allow partial RX URB allocation to succeed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Szymon Wilczek <[email protected]>
[ Upstream commit b1979778e98569c1e78c2c7f16bb24d76541ab00 ]
When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked.
As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error.
Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open().
--- drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/usb/etas_es58x/es58x_core.c +1 -1
@@ -1736,7 +1736,7 @@ static int es58x_alloc_rx_urbs(struct es58x_device *es58x_dev)dev_dbg (dev,"%s: Allocated %d rx URBs each of size %u\n" , __func__, i, rx_buf_len); -return ret; +return 0 ; }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/139 nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <[email protected]>
[ Upstream commit 32b63acd78f577b332d976aa06b56e70d054cbba ]
Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset
validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate
whether the command's data structures (cmd->req.sg and cmd->iov) have
been properly initialized before processing H2C_DATA PDUs.
The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command.
Attack vectors that trigger NULL pointer dereferences:
1. H2C_DATA PDU sent before CONNECT → both pointers NULL
2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL
3. H2C_DATA PDU for uninitialized command slot → both pointers NULL
The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because:
- Uninitialized commands: both NULL
- READ commands: cmd->req.sg allocated, cmd->iov NULL
- WRITE commands: both allocated
--- drivers/nvme/target/tcp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/nvme/target/tcp.c +12 -0
@@ -1021,6 +1021,18 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len); goto err_proto; } +/* +* Ensure command data structures are initialized. We must check both +* cmd->req.sg and cmd->iov because they can have different NULL states: +* - Uninitialized commands: both NULL +* - READ commands: cmd->req.sg allocated, cmd->iov NULL +* - WRITE commands: both allocated +*/ +if (unlikely (!cmd->req.sg || !cmd->iov)) { +pr_err ("queue %d: H2CData PDU received for invalid command state (ttag %u)\n" , + queue->idx, data->ttag); + goto err_proto; + } cmd->pdu_recv =0 ;nvmet_tcp_build_pdu_iovec (cmd); queue->cmd = cmd;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/139 btrfs: send: check for inline extents in range_is_hole_in_parent()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ]
Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent.
This is because for inline extents their data starts at the offset of the disk_bytenr field. So accessing the disk_bytenr
means we are accessing inline data or in case the inline data is less than 8 bytes we can actually cause an invalid
memory access if this inline extent item is the first item in the leaf or access metadata from other items.
--- fs/btrfs/send.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/send.c +2 -0
@@ -6550,6 +6550,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx, extent_end =btrfs_file_extent_end (path);if (extent_end <= start) goto next; +if (btrfs_file_extent_type (leaf, fi) ==BTRFS_FILE_EXTENT_INLINE ) +return 0 ;if (btrfs_file_extent_disk_bytenr (leaf, fi) ==0 ) { search_start = extent_end; goto next;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/139 net: bridge: annotate data-races around fdb->{updated,used}
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b25a0b4a2193407aa72a4cd1df66a7ed07dd4f1e ]
fdb->updated and fdb->used are read and written locklessly.
Add READ_ONCE()/WRITE_ONCE() annotations.
--- net/bridge/br_fdb.c | 28 ++++++++++++++++------------ net/bridge/br_input.c | 4 ++-- 2 files changed, 18 insertions(+), 14 deletions(-)
net/bridge/br_fdb.c +16 -12
@@ -70,7 +70,7 @@ static inline int has_expired(const struct net_bridge *br, {return !test_bit (BR_FDB_STATIC , &fdb->flags) && !test_bit (BR_FDB_ADDED_BY_EXT_LEARN , &fdb->flags) && -time_before_eq (fdb->updated +hold_time (br), jiffies); +time_before_eq (READ_ONCE (fdb->updated) +hold_time (br), jiffies); }static void fdb_rcu_free (struct rcu_head *head)
@@ -133,9 +133,9 @@ static int fdb_fill_info(struct sk_buff *skb, const struct net_bridge *br,if (nla_put_u32 (skb,NDA_FLAGS_EXT , ext_flags)) goto nla_put_failure; - ci.ndm_used =jiffies_to_clock_t (now - fdb->used); + ci.ndm_used =jiffies_to_clock_t (now -READ_ONCE (fdb->used)); ci.ndm_confirmed =0 ; - ci.ndm_updated =jiffies_to_clock_t (now - fdb->updated); + ci.ndm_updated =jiffies_to_clock_t (now -READ_ONCE (fdb->updated)); ci.ndm_refcnt =0 ;if (nla_put (skb,NDA_CACHEINFO ,sizeof (ci), &ci)) goto nla_put_failure;
@@ -552,7 +552,7 @@ void br_fdb_cleanup(struct work_struct *work)*/ rcu_read_lock ();hlist_for_each_entry_rcu (f, &br->fdb_list, fdb_node) { -unsigned long this_timer = f->updated + delay; +unsigned long this_timer =READ_ONCE (f->updated) + delay;if (test_bit (BR_FDB_STATIC , &f->flags) ||test_bit (BR_FDB_ADDED_BY_EXT_LEARN , &f->flags)) {
@@ -829,6 +829,7 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, {struct net_bridge_fdb_entry *f;struct __fdb_entry *fe = buf; +unsigned long delta;int num =0 ;memset (buf,0 , maxnum*sizeof (struct __fdb_entry ));
@@ -858,8 +859,11 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, fe->port_hi = f->dst->port_no >>8 ; fe->is_local =test_bit (BR_FDB_LOCAL , &f->flags); -if (!test_bit (BR_FDB_STATIC , &f->flags)) - fe->ageing_timer_value =jiffies_delta_to_clock_t (jiffies - f->updated); +if (!test_bit (BR_FDB_STATIC , &f->flags)) { + delta = jiffies -READ_ONCE (f->updated); + fe->ageing_timer_value = +jiffies_delta_to_clock_t (delta); + } ++fe; ++num; }
@@ -907,8 +911,8 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,unsigned long now = jiffies;bool fdb_modified = false; -if (now != fdb->updated) { - fdb->updated = now; +if (now !=READ_ONCE (fdb->updated)) { +WRITE_ONCE (fdb->updated, now); fdb_modified =__fdb_mark_active (fdb); }
@@ -1146,10 +1150,10 @@ static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,if (fdb_handle_notify (fdb, notify)) modified = true; - fdb->used = jiffies; +WRITE_ONCE (fdb->used, jiffies);if (modified) {if (refresh) - fdb->updated = jiffies; +WRITE_ONCE (fdb->updated, jiffies);fdb_notify (br, fdb,RTM_NEWNEIGH , true); }
@@ -1462,7 +1466,7 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p, goto err_unlock; } - fdb->updated = jiffies; +WRITE_ONCE (fdb->updated, jiffies);if (READ_ONCE (fdb->dst) != p) {WRITE_ONCE (fdb->dst, p);
@@ -1471,7 +1475,7 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,if (test_and_set_bit (BR_FDB_ADDED_BY_EXT_LEARN , &fdb->flags)) {/* Refresh entry */ - fdb->used = jiffies; +WRITE_ONCE (fdb->used, jiffies); }else { modified = true; }
net/bridge/br_input.c +2 -2
@@ -207,8 +207,8 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skbif (test_bit (BR_FDB_LOCAL , &dst->flags))return br_pass_frame_up (skb, false); -if (now != dst->used) - dst->used = now; +if (now !=READ_ONCE (dst->used)) +WRITE_ONCE (dst->used, now);br_forward (dst->dst, skb, local_rcv, false); }else {if (!mcast_hit)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/139 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 81c734dae203757fb3c9eee6f9896386940776bd ]
Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1].
Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().
[1]
BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729 __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860 ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1 ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500 ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:318 [inline] ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core net/core/dev.c:6139 [inline] __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252 netif_receive_skb_internal net/core/dev.c:6338 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6397 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
--- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_tunnel.c +1 -1
@@ -844,7 +844,7 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,skb_reset_network_header (skb); -if (!pskb_inet_may_pull (skb)) { +if (skb_vlan_inet_prepare (skb, true)) {DEV_STATS_INC (tunnel->dev, rx_length_errors);DEV_STATS_INC (tunnel->dev, rx_errors); goto drop;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/139 net: update netdev_lock_{type,name}
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eb74c19fe10872ee1f29a8f90ca5ce943921afe9 ]
Add missing entries in netdev_lock_type[] and netdev_lock_name[] :
CAN, MCTP, RAWIP, CAIF, IP6GRE, 6LOWPAN, NETLINK, VSOCKMON, IEEE802154_MONITOR.
Also add a WARN_ONCE() in netdev_lock_pos() to help future bug hunting next time a protocol is added without updating these arrays.
--- net/core/dev.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
net/core/dev.c +19 -6
@@ -474,15 +474,21 @@ static const unsigned short netdev_lock_type[] = {ARPHRD_IEEE1394 ,ARPHRD_EUI64 ,ARPHRD_INFINIBAND ,ARPHRD_SLIP ,ARPHRD_CSLIP ,ARPHRD_SLIP6 ,ARPHRD_CSLIP6 ,ARPHRD_RSRVD ,ARPHRD_ADAPT ,ARPHRD_ROSE ,ARPHRD_X25 ,ARPHRD_HWX25 , +ARPHRD_CAN ,ARPHRD_MCTP ,ARPHRD_PPP ,ARPHRD_CISCO ,ARPHRD_LAPB ,ARPHRD_DDCMP , -ARPHRD_RAWHDLC ,ARPHRD_TUNNEL ,ARPHRD_TUNNEL6 ,ARPHRD_FRAD , +ARPHRD_RAWHDLC ,ARPHRD_RAWIP , +ARPHRD_TUNNEL ,ARPHRD_TUNNEL6 ,ARPHRD_FRAD ,ARPHRD_SKIP ,ARPHRD_LOOPBACK ,ARPHRD_LOCALTLK ,ARPHRD_FDDI ,ARPHRD_BIF ,ARPHRD_SIT ,ARPHRD_IPDDP ,ARPHRD_IPGRE ,ARPHRD_PIMREG ,ARPHRD_HIPPI ,ARPHRD_ASH ,ARPHRD_ECONET ,ARPHRD_IRDA ,ARPHRD_FCPP ,ARPHRD_FCAL ,ARPHRD_FCPL ,ARPHRD_FCFABRIC ,ARPHRD_IEEE80211 ,ARPHRD_IEEE80211_PRISM , -ARPHRD_IEEE80211_RADIOTAP ,ARPHRD_PHONET ,ARPHRD_PHONET_PIPE , - ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE}; +ARPHRD_IEEE80211_RADIOTAP , +ARPHRD_IEEE802154 ,ARPHRD_IEEE802154_MONITOR , +ARPHRD_PHONET ,ARPHRD_PHONET_PIPE , +ARPHRD_CAIF ,ARPHRD_IP6GRE ,ARPHRD_NETLINK ,ARPHRD_6LOWPAN , +ARPHRD_VSOCKMON , + ARPHRD_VOID, ARPHRD_NONE};static const char *const netdev_lock_name[] = { "_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
@@ -491,15 +497,21 @@ static const char *const netdev_lock_name[] = {"_xmit_IEEE1394" ,"_xmit_EUI64" ,"_xmit_INFINIBAND" ,"_xmit_SLIP" ,"_xmit_CSLIP" ,"_xmit_SLIP6" ,"_xmit_CSLIP6" ,"_xmit_RSRVD" ,"_xmit_ADAPT" ,"_xmit_ROSE" ,"_xmit_X25" ,"_xmit_HWX25" , +"_xmit_CAN" ,"_xmit_MCTP" ,"_xmit_PPP" ,"_xmit_CISCO" ,"_xmit_LAPB" ,"_xmit_DDCMP" , -"_xmit_RAWHDLC" ,"_xmit_TUNNEL" ,"_xmit_TUNNEL6" ,"_xmit_FRAD" , +"_xmit_RAWHDLC" ,"_xmit_RAWIP" , +"_xmit_TUNNEL" ,"_xmit_TUNNEL6" ,"_xmit_FRAD" ,"_xmit_SKIP" ,"_xmit_LOOPBACK" ,"_xmit_LOCALTLK" ,"_xmit_FDDI" ,"_xmit_BIF" ,"_xmit_SIT" ,"_xmit_IPDDP" ,"_xmit_IPGRE" ,"_xmit_PIMREG" ,"_xmit_HIPPI" ,"_xmit_ASH" ,"_xmit_ECONET" ,"_xmit_IRDA" ,"_xmit_FCPP" ,"_xmit_FCAL" ,"_xmit_FCPL" ,"_xmit_FCFABRIC" ,"_xmit_IEEE80211" ,"_xmit_IEEE80211_PRISM" , -"_xmit_IEEE80211_RADIOTAP" ,"_xmit_PHONET" ,"_xmit_PHONET_PIPE" , - "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"}; +"_xmit_IEEE80211_RADIOTAP" , +"_xmit_IEEE802154" ,"_xmit_IEEE802154_MONITOR" , +"_xmit_PHONET" ,"_xmit_PHONET_PIPE" , +"_xmit_CAIF" ,"_xmit_IP6GRE" ,"_xmit_NETLINK" ,"_xmit_6LOWPAN" , +"_xmit_VSOCKMON" , + "_xmit_VOID", "_xmit_NONE"};static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE (netdev_lock_type)];static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE (netdev_lock_type)];
@@ -512,6 +524,7 @@ static inline unsigned short netdev_lock_pos(unsigned short dev_type)if (netdev_lock_type[i] == dev_type)return i;/* the last key is used by default */ +WARN_ONCE (1 ,"netdev_lock_pos() could not find dev_type=%u\n" , dev_type);return ARRAY_SIZE (netdev_lock_type) -1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/139 macvlan: fix possible UAF in macvlan_forward_source()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e ]
Add RCU protection on (struct macvlan_source_entry)->vlan.
Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts.
This allows macvlan_forward_source() to skip over entries queued for freeing.
Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)).
https: //lore.kernel.org/netdev/[email protected]/T/#u
--- drivers/net/macvlan.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/net/macvlan.c +13 -7
@@ -58,7 +58,7 @@ struct macvlan_port {struct macvlan_source_entry {struct hlist_node hlist; -struct macvlan_dev *vlan; +struct macvlan_dev __rcu *vlan;unsigned char addr[6 +2 ]__aligned(sizeof(u16)) ;struct rcu_head rcu; };
@@ -145,7 +145,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source(hlist_for_each_entry_rcu (entry, h, hlist,lockdep_rtnl_is_held ()) {if (ether_addr_equal_64bits (entry->addr, addr) && - entry->vlan == vlan) +rcu_access_pointer (entry->vlan) == vlan)return entry; }return NULL ;
@@ -167,7 +167,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan,return -ENOMEM ;ether_addr_copy (entry->addr, addr); - entry->vlan = vlan; +RCU_INIT_POINTER (entry->vlan, vlan); h = &port->vlan_source_hash[macvlan_eth_hash (addr)];hlist_add_head_rcu (&entry->hlist, h); vlan->macaddr_count++;
@@ -186,6 +186,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan)static void macvlan_hash_del_source (struct macvlan_source_entry *entry) { +RCU_INIT_POINTER (entry->vlan,NULL );hlist_del_rcu (&entry->hlist);kfree_rcu (entry, rcu); }
@@ -389,7 +390,7 @@ static void macvlan_flush_sources(struct macvlan_port *port,int i;hash_for_each_safe (port->vlan_source_hash, i, next, entry, hlist) -if (entry->vlan == vlan) +if (rcu_access_pointer (entry->vlan) == vlan)macvlan_hash_del_source (entry); vlan->macaddr_count =0 ;
@@ -432,9 +433,14 @@ static bool macvlan_forward_source(struct sk_buff *skb,hlist_for_each_entry_rcu (entry, h, hlist) {if (ether_addr_equal_64bits (entry->addr, addr)) { -if (entry->vlan->flags &MACVLAN_FLAG_NODST ) +struct macvlan_dev *vlan =rcu_dereference (entry->vlan); + +if (!vlan) +continue ; + +if (vlan->flags &MACVLAN_FLAG_NODST ) consume = true; -macvlan_forward_source_one (skb, entry->vlan); +macvlan_forward_source_one (skb, vlan); } }
@@ -1676,7 +1682,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb,struct macvlan_source_entry *entry;hlist_for_each_entry_rcu (entry, h, hlist,lockdep_rtnl_is_held ()) { -if (entry->vlan != vlan) +if (rcu_access_pointer (entry->vlan) != vlan)continue ;if (nla_put (skb,IFLA_MACVLAN_MACADDR ,ETH_ALEN , entry->addr))return 1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/139 ipv4: ip_gre: make ipgre_header() robust
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e67c577d89894811ce4dcd1a9ed29d8b63476667 ]
Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1].
This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len
In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device.
[1]
skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0
kernel BUG at net/core/skbuff.c:213 !
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
--- net/ipv4/ip_gre.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/ip_gre.c +9 -2
@@ -889,10 +889,17 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev, const void *daddr, const void *saddr, unsigned int len) { struct ip_tunnel *t = netdev_priv(dev); -struct iphdr *iph;struct gre_base_hdr *greh; +struct iphdr *iph; +int needed; + + needed = t->hlen +sizeof (*iph); +if (skb_headroom (skb) < needed && +pskb_expand_head (skb,HH_DATA_ALIGN (needed -skb_headroom (skb)), +0 ,GFP_ATOMIC )) +return -needed; - iph =skb_push (skb, t->hlen +sizeof (*iph)); + iph =skb_push (skb, needed); greh = (struct gre_base_hdr *)(iph+1 ); greh->flags =gre_tnl_flags_to_gre_flags (t->parms.o_flags); greh->protocol =htons (type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/139 vsock/test: add a final full barrier after run all tests
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
[ Upstream commit c39a6a277e0e67ffff6a8efcbbf7e7e23ce9e38c ]
If the last test fails, the other side still completes correctly, which could lead to false positives.
Let's add a final barrier that ensures that the last test has finished correctly on both sides, but also that the two sides agree on the number of tests to be performed.
--- tools/testing/vsock/util.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
tools/testing/vsock/util.c +12 -0
@@ -472,6 +472,18 @@ void run_tests(const struct test_case *test_cases,printf ("ok\n" ); } + +printf ("All tests have been executed. Waiting other peer..." ); +fflush (stdout); + +/* +* Final full barrier, to ensure that all tests have been run and +* that even the last one has been successful on both sides. +*/ +control_writeln ("COMPLETED" ); +control_expectln ("COMPLETED" ); + +printf ("ok\n" ); }void list_tests (const struct test_case *test_cases)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/139 net/mlx5e: Fix crash on profile change rollback failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 4dadc4077e3f77d6d31e199a925fc7a705e7adeb ]
mlx5e_netdev_change_profile can fail to attach a new profile and can fail to rollback to old profile, in such case, we could end up with a dangling netdev with a fully reset netdev_priv. A retry to change profile, e.g. another attempt to call mlx5e_netdev_change_profile via switchdev mode change, will crash trying to access the now NULL priv->mdev.
This fix allows mlx5e_netdev_change_profile() to handle previous failures and an empty priv, by not assuming priv is valid.
Pass netdev and mdev to all flows requiring mlx5e_netdev_change_profile() and avoid passing priv.
In mlx5e_netdev_change_profile() check if current priv is valid, and if not, just attach the new profile without trying to access the old one.
This fixes the following oops, when enabling switchdev mode for the 2nd time after first time failure:
## Enabling switchdev mode first time:
mlx5_core 0012:03:00.1: E-Switch: Supported tc chains and prios offload
workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTRmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12
workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTRmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12
^^^^^^^^
mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)
## retry: Enabling switchdev mode 2nd time:
mlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload
BUG: kernel NULL pointer dereference, address: 0000000000000038 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 13 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc4+ #91 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5e_detach_netdev+0x3c/0x90 Code: 50 00 00 f0 80 4f 78 02 48 8b bf e8 07 00 00 48 85 ff 74 16 48 8b 73 78 48 d1 ee 83 e6 01 83 f6 01 40 0f b6 f6 e8 c4 42 00 00 <48> 8b 45 38 48 85 c0 74 08 48 89 df e8 cc 47 40 1e 48 8b bb f0 07 RSP: 0018:ffffc90000673890 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8881036a89c0 RCX: 0000000000000000 RDX: ffff888113f63800 RSI: ffffffff822fe720 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000002dcd R09: 0000000000000000 R10: ffffc900006738e8 R11: 00000000ffffffff R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881036a89c0 R15: 0000000000000000 FS: 00007fdfb8384740(0000) GS:ffff88856a9d6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000038 CR3: 0000000112ae0005 CR4: 0000000000370ef0 Call Trace: <TASK> mlx5e_netdev_change_profile+0x45/0xb0 mlx5e_vport_rep_load+0x27b/0x2d0 mlx5_esw_offloads_rep_load+0x72/0xf0 esw_offloads_enable+0x5d0/0x970 mlx5_eswitch_enable_locked+0x349/0x430 ? is_mp_supported+0x57/0xb0 mlx5_devlink_eswitch_mode_set+0x26b/0x430 devlink_nl_eswitch_set_doit+0x6f/0xf0 genl_family_rcv_msg_doit+0xe8/0x140 genl_rcv_msg+0x18b/0x290 ? __pfx_devlink_nl_pre_doit+0x10/0x10 ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10 ? __pfx_devlink_nl_post_doit+0x10/0x10 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x52/0x100 genl_rcv+0x28/0x40 netlink_unicast+0x282/0x3e0 ? __alloc_skb+0xd6/0x190 netlink_sendmsg+0x1f7/0x430 __sys_sendto+0x213/0x220 ? __sys_recvmsg+0x6a/0xd0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x50/0x1f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fdfb8495047
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 9 ++-- .../net/ethernet/mellanox/mlx5/core/en_main.c | 48 +++++++++++++------ .../net/ethernet/mellanox/mlx5/core/en_rep.c | 11 ++--- 3 files changed, 44 insertions(+), 24 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +6 -3
@@ -1221,9 +1221,12 @@ mlx5e_create_netdev(struct mlx5_core_dev *mdev, const struct mlx5e_profile *profint mlx5e_attach_netdev (struct mlx5e_priv *priv);void mlx5e_detach_netdev (struct mlx5e_priv *priv);void mlx5e_destroy_netdev (struct mlx5e_priv *priv); -int mlx5e_netdev_change_profile (struct mlx5e_priv *priv, -const struct mlx5e_profile *new_profile,void *new_ppriv); -void mlx5e_netdev_attach_nic_profile (struct mlx5e_priv *priv); +int mlx5e_netdev_change_profile (struct net_device *netdev, +struct mlx5_core_dev *mdev, +const struct mlx5e_profile *new_profile, +void *new_ppriv); +void mlx5e_netdev_attach_nic_profile (struct net_device *netdev, +struct mlx5_core_dev *mdev);void mlx5e_set_netdev_mtu_boundaries (struct mlx5e_priv *priv);void mlx5e_build_nic_params (struct mlx5e_priv *priv,struct mlx5e_xsk *xsk,u16 mtu);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +33 -15
68 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +5 -6
@@ -1499,17 +1499,16 @@ mlx5e_vport_uplink_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep * {struct mlx5e_rep_priv *rpriv =mlx5e_rep_to_rep_priv (rep);struct net_device *netdev; -struct mlx5e_priv *priv;int err; netdev =mlx5_uplink_netdev_get (dev);if (!netdev)return 0 ; - priv =netdev_priv (netdev); - rpriv->netdev = priv->netdev; - err =mlx5e_netdev_change_profile (priv, &mlx5e_uplink_rep_profile, - rpriv); +/* must not use netdev_priv(netdev), it might not be initialized yet */ + rpriv->netdev = netdev; + err =mlx5e_netdev_change_profile (netdev, dev, + &mlx5e_uplink_rep_profile, rpriv);mlx5_uplink_netdev_put (dev, netdev);return err; }
@@ -1537,7 +1536,7 @@ mlx5e_vport_uplink_rep_unload(struct mlx5e_rep_priv *rpriv)if (!(priv->mdev->priv.flags &MLX5_PRIV_FLAGS_SWITCH_LEGACY ))unregister_netdev (netdev); -mlx5e_netdev_attach_nic_profile (priv); +mlx5e_netdev_attach_nic_profile (netdev, priv->mdev); } static int
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/139 net/mlx5e: Dont store mlx5e_priv in mlx5e_dev devlink priv
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 123eda2e5b1638e298e3a66bb1e64a8da92de5e1 ]
mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails, mlx5e_priv in mlx5e_dev devlink private is used to reference the netdev and mdev associated with that struct. Instead, store netdev directly into mlx5e_dev and get mdev from the containing mlx5_adev aux device structure.
This fixes a kernel oops in mlx5e_remove when switchdev mode fails due to change profile failure.
$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev Error: mlx5_core: Failed setting eswitch to offloads. dmesg: workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12
$ devlink dev reload pci/0000:00:03.0 ==> oops
BUG: kernel NULL pointer dereference, address: 0000000000000520 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 3 UID: 0 PID: 521 Comm: devlink Not tainted 6.18.0-rc5+ #117 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5e_remove+0x68/0x130 RSP: 0018:ffffc900034838f0 EFLAGS: 00010246 RAX: ffff88810283c380 RBX: ffff888101874400 RCX: ffffffff826ffc45 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff888102d789c0 R08: ffff8881007137f0 R09: ffff888100264e10 R10: ffffc90003483898 R11: ffffc900034838a0 R12: ffff888100d261a0 R13: ffff888100d261a0 R14: ffff8881018749a0 R15: ffff888101874400 FS: 00007f8565fea740(0000) GS:ffff88856a759000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000520 CR3: 000000010b11a004 CR4: 0000000000370ef0 Call Trace: <TASK> device_release_driver_internal+0x19c/0x200 bus_remove_device+0xc6/0x130 device_del+0x160/0x3d0 ? devl_param_driverinit_value_get+0x2d/0x90 mlx5_detach_device+0x89/0xe0 mlx5_unload_one_devl_locked+0x3a/0x70 mlx5_devlink_reload_down+0xc8/0x220 devlink_reload+0x7d/0x260 devlink_nl_reload_doit+0x45b/0x5a0 genl_family_rcv_msg_doit+0xe8/0x140
Stable-dep-of: 4ef8512e1427 ("net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv")
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 20 ++++++++++--------- 2 files changed, 12 insertions(+), 10 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -1
@@ -946,7 +946,7 @@ struct mlx5e_priv { };struct mlx5e_dev { -struct mlx5e_priv *priv; +struct net_device *netdev;struct devlink_port dl_port; };
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +11 -9
@@ -6323,8 +6323,8 @@ static int _mlx5e_resume(struct auxiliary_device *adev) { struct mlx5_adev *edev = container_of(adev, struct mlx5_adev, adev);struct mlx5e_dev *mlx5e_dev =auxiliary_get_drvdata (adev); -struct mlx5e_priv *priv = mlx5e_dev->priv; -struct net_device *netdev = priv->netdev; +struct mlx5e_priv *priv =netdev_priv (mlx5e_dev->netdev); +struct net_device *netdev = mlx5e_dev->netdev;struct mlx5_core_dev *mdev = edev->mdev;struct mlx5_core_dev *pos, *to;int err, i;
@@ -6370,10 +6370,11 @@ static int mlx5e_resume(struct auxiliary_device *adev)static int _mlx5e_suspend (struct auxiliary_device *adev,bool pre_netdev_reg) { + struct mlx5_adev *edev = container_of(adev, struct mlx5_adev, adev);struct mlx5e_dev *mlx5e_dev =auxiliary_get_drvdata (adev); -struct mlx5e_priv *priv = mlx5e_dev->priv; -struct net_device *netdev = priv->netdev; -struct mlx5_core_dev *mdev = priv->mdev; +struct mlx5e_priv *priv =netdev_priv (mlx5e_dev->netdev); +struct net_device *netdev = mlx5e_dev->netdev; +struct mlx5_core_dev *mdev = edev->mdev;struct mlx5_core_dev *pos;int i;
@@ -6434,11 +6435,11 @@ static int _mlx5e_probe(struct auxiliary_device *adev) goto err_devlink_port_unregister; }SET_NETDEV_DEVLINK_PORT (netdev, &mlx5e_dev->dl_port); + mlx5e_dev->netdev = netdev;mlx5e_build_nic_netdev (netdev); priv =netdev_priv (netdev); - mlx5e_dev->priv = priv; priv->profile = profile; priv->ppriv =NULL ;
@@ -6501,7 +6502,8 @@ static void _mlx5e_remove(struct auxiliary_device *adev) { struct mlx5_adev *edev = container_of(adev, struct mlx5_adev, adev);struct mlx5e_dev *mlx5e_dev =auxiliary_get_drvdata (adev); -struct mlx5e_priv *priv = mlx5e_dev->priv; +struct net_device *netdev = mlx5e_dev->netdev; +struct mlx5e_priv *priv =netdev_priv (netdev);struct mlx5_core_dev *mdev = edev->mdev;mlx5_core_uplink_netdev_set (mdev,NULL );
@@ -6510,8 +6512,8 @@ static void _mlx5e_remove(struct auxiliary_device *adev)* if it's from legacy mode. If from switchdev mode, it * is already unregistered before changing to NIC profile. */ -if (priv->netdev->reg_state ==NETREG_REGISTERED ) { -unregister_netdev (priv->netdev); +if (netdev->reg_state ==NETREG_REGISTERED ) { +unregister_netdev (netdev);_mlx5e_suspend (adev, false); }else {struct mlx5_core_dev *pos;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/139 net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 4ef8512e1427111f7ba92b4a847d181ff0aeec42 ]
mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails.
Pass netdev to mlx5e_destroy_netdev() to guarantee it will work on a valid netdev.
On mlx5e_remove: Check validity of priv->profile, before attempting to cleanup any resources that might be not there.
This fixes a kernel oops in mlx5e_remove when switchdev mode fails due to change profile failure.
$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev Error: mlx5_core: Failed setting eswitch to offloads. dmesg: workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12
$ devlink dev reload pci/0000:00:03.0 ==> oops
BUG: kernel NULL pointer dereference, address: 0000000000000370 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 15 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc5+ #115 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100 RSP: 0018:ffffc9000083f8b8 EFLAGS: 00010286 RAX: ffff8881126fc380 RBX: ffff8881015ac400 RCX: ffffffff826ffc45 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881035109c0 RBP: ffff8881035109c0 R08: ffff888101e3e838 R09: ffff888100264e10 R10: ffffc9000083f898 R11: ffffc9000083f8a0 R12: ffff888101b921a0 R13: ffff888101b921a0 R14: ffff8881015ac9a0 R15: ffff8881015ac400 FS: 00007f789a3c8740(0000) GS:ffff88856aa59000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000370 CR3: 000000010b6c0001 CR4: 0000000000370ef0 Call Trace: <TASK> mlx5e_remove+0x57/0x110 device_release_driver_internal+0x19c/0x200 bus_remove_device+0xc6/0x130 device_del+0x160/0x3d0 ? devl_param_driverinit_value_get+0x2d/0x90 mlx5_detach_device+0x89/0xe0 mlx5_unload_one_devl_locked+0x3a/0x70 mlx5_devlink_reload_down+0xc8/0x220 devlink_reload+0x7d/0x260 devlink_nl_reload_doit+0x45b/0x5a0 genl_family_rcv_msg_doit+0xe8/0x140
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 15 +++++++++------ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 4 ++-- 3 files changed, 12 insertions(+), 9 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -1
@@ -1220,7 +1220,7 @@ struct net_device * mlx5e_create_netdev(struct mlx5_core_dev *mdev, const struct mlx5e_profile *profile);int mlx5e_attach_netdev (struct mlx5e_priv *priv);void mlx5e_detach_netdev (struct mlx5e_priv *priv); -void mlx5e_destroy_netdev (struct mlx5e_priv *priv); +void mlx5e_destroy_netdev (struct net_device *netdev); int mlx5e_netdev_change_profile(struct net_device *netdev, struct mlx5_core_dev *mdev, const struct mlx5e_profile *new_profile,
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +9 -6
@@ -6311,11 +6311,12 @@ void mlx5e_netdev_attach_nic_profile(struct net_device *netdev,mlx5e_netdev_change_profile (netdev, mdev, &mlx5e_nic_profile,NULL ); } -void mlx5e_destroy_netdev (struct mlx5e_priv *priv) +void mlx5e_destroy_netdev (struct net_device *netdev) { -struct net_device *netdev = priv->netdev; +struct mlx5e_priv *priv =netdev_priv (netdev); -mlx5e_priv_cleanup (priv); +if (priv->profile) +mlx5e_priv_cleanup (priv);free_netdev (netdev); }
@@ -6472,7 +6473,7 @@ static int _mlx5e_probe(struct auxiliary_device *adev) err_profile_cleanup: profile->cleanup (priv); err_destroy_netdev: -mlx5e_destroy_netdev (priv); +mlx5e_destroy_netdev (netdev); err_devlink_port_unregister:mlx5e_devlink_port_unregister (mlx5e_dev); err_devlink_unregister:
@@ -6507,7 +6508,9 @@ static void _mlx5e_remove(struct auxiliary_device *adev)struct mlx5_core_dev *mdev = edev->mdev;mlx5_core_uplink_netdev_set (mdev,NULL ); -mlx5e_dcbnl_delete_app (priv); + +if (priv->profile) +mlx5e_dcbnl_delete_app (priv);/* When unload driver, the netdev is in registered state * if it's from legacy mode. If from switchdev mode, it * is already unregistered before changing to NIC profile.
@@ -6528,7 +6531,7 @@ static void _mlx5e_remove(struct auxiliary_device *adev)/* Avoid cleanup if profile rollback failed. */ if (priv->profile) priv->profile->cleanup (priv); -mlx5e_destroy_netdev (priv); +mlx5e_destroy_netdev (netdev);mlx5e_devlink_port_unregister (mlx5e_dev);mlx5e_destroy_devlink (mlx5e_dev); }
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +2 -2
@@ -1602,7 +1602,7 @@ mlx5e_vport_vf_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) priv->profile->cleanup (priv); err_destroy_netdev: -mlx5e_destroy_netdev (netdev_priv (netdev)); +mlx5e_destroy_netdev (netdev);return err; }
@@ -1657,7 +1657,7 @@ mlx5e_vport_rep_unload(struct mlx5_eswitch_rep *rep)mlx5e_rep_vnic_reporter_destroy (priv);mlx5e_detach_netdev (priv); priv->profile->cleanup (priv); -mlx5e_destroy_netdev (priv); +mlx5e_destroy_netdev (netdev); free_ppriv:kvfree (ppriv);/* mlx5e_rep_priv */ }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/139 net/mlx5e: Restore destroying state bit after profile cleanup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 5629f8859dca7ef74d7314b60de6a957f23166c0 ]
Profile rollback can fail in mlx5e_netdev_change_profile() and we will end up with invalid mlx5e_priv memset to 0, we must maintain the 'destroying' bit in order to gracefully shutdown even if the profile/priv are not valid.
This patch maintains the previous state of the 'destroying' state of mlx5e_priv after priv cleanup, to allow the remove flow to cleanup common resources from mlx5_core to avoid FW fatal errors as seen below:
$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev
Error: mlx5_core: Failed setting eswitch to offloads.
dmesg: mlx5_core 0000:00:03.0 enp0s3np0: failed to rollback to orig profile, ...$ devlink dev reload pci/0000:00:03.0
mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:00:03.0: poll_health:803:(pid 519): Fatal error 3 detectedmlx5_core 0000:00:03.0: firmware version: 28.41.1000mlx5_core 0000:00:03.0: 0.000 Gb/s available PCIe bandwidth (Unknown x255 link)mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failedmlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failedmlx5_core 0000:00:03.0: mlx5_health_try_recover:340:(pid 141): handling bad device here mlx5_core 0000:00:03.0: mlx5_handle_bad_state:285:(pid 141): Expected to see disabled NIC but it is full driver mlx5_core 0000:00:03.0: mlx5_error_sw_reset:236:(pid 141): startmlx5_core 0000:00:03.0: NIC IFC still 0 after 4000ms.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +3 -0
@@ -6000,6 +6000,7 @@ int mlx5e_priv_init(struct mlx5e_priv *priv,void mlx5e_priv_cleanup (struct mlx5e_priv *priv) { +bool destroying =test_bit (MLX5E_STATE_DESTROYING , &priv->state);int i;/* bail if change profile failed and also rollback failed */
@@ -6026,6 +6027,8 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv) }memset (priv,0 ,sizeof (*priv)); +if (destroying)/* restore destroying bit, to allow unload */ +set_bit (MLX5E_STATE_DESTROYING , &priv->state); } static unsigned int mlx5e_get_max_num_txqs(struct mlx5_core_dev *mdev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/139 btrfs: factor out init_space_info() from create_space_info()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
[ Upstream commit ac5578fef380e68e539a2238ba63dd978a450ef2 ]
Factor out initialization of the space_info struct, which is used in a later patch. There is no functional change.
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
--- fs/btrfs/space-info.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
fs/btrfs/space-info.c +16 -11
@@ -225,19 +225,11 @@ void btrfs_update_space_info_chunk_size(struct btrfs_space_info *space_info,WRITE_ONCE (space_info->chunk_size, chunk_size); } -static int create_space_info (struct btrfs_fs_info *info,u64 flags) +static void init_space_info (struct btrfs_fs_info *info, +struct btrfs_space_info *space_info,u64 flags) { - -struct btrfs_space_info *space_info; -int i; -int ret; - - space_info =kzalloc (sizeof (*space_info),GFP_NOFS ); -if (!space_info) -return -ENOMEM ; - space_info->fs_info = info; -for (i =0 ; i <BTRFS_NR_RAID_TYPES ; i++) +for (int i =0 ; i <BTRFS_NR_RAID_TYPES ; i++)INIT_LIST_HEAD (&space_info->block_groups[i]);init_rwsem (&space_info->groups_sem);spin_lock_init (&space_info->lock);
@@ -251,6 +243,19 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)if (btrfs_is_zoned (info)) space_info->bg_reclaim_threshold =BTRFS_DEFAULT_ZONED_RECLAIM_THRESH ; +} + +static int create_space_info (struct btrfs_fs_info *info,u64 flags) +{ + +struct btrfs_space_info *space_info; +int ret; + + space_info =kzalloc (sizeof (*space_info),GFP_NOFS ); +if (!space_info) +return -ENOMEM ; + +init_space_info (info, space_info, flags); ret =btrfs_sysfs_add_space_info_type (info, space_info);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/139 btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
[ Upstream commit 1cfdbe0d53b27b4b4a4f4cf2a4e430bc65ba2ba5 ]
Factor out check_removing_space_info() from btrfs_free_block_groups(). It sanity checks a to-be-removed space_info. There is no functional change.
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
--- fs/btrfs/block-group.c | 49 +++++++++++++++++++++++------------------- 1 file changed, 27 insertions(+), 22 deletions(-)
fs/btrfs/block-group.c +27 -22
@@ -4416,6 +4416,32 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info) } } +static void check_removing_space_info (struct btrfs_space_info *space_info) +{ +struct btrfs_fs_info *info = space_info->fs_info; + +/* +* Do not hide this behind enospc_debug, this is actually important and +* indicates a real bug if this happens. +*/ +if (WARN_ON (space_info->bytes_pinned >0 || space_info->bytes_may_use >0 )) +btrfs_dump_space_info (info, space_info,0 ,0 ); + +/* +* If there was a failure to cleanup a log tree, very likely due to an +* IO failure on a writeback attempt of one or more of its extent +* buffers, we could not do proper (and cheap) unaccounting of their +* reserved space, so don't warn on bytes_reserved > 0 in that case. +*/ +if (!(space_info->flags &BTRFS_BLOCK_GROUP_METADATA ) || + !BTRFS_FS_LOG_CLEANUP_ERROR (info)) { +if (WARN_ON (space_info->bytes_reserved >0 )) +btrfs_dump_space_info (info, space_info,0 ,0 ); + } + +WARN_ON (space_info->reclaim_size >0 ); +} +/* * Must be called only after stopping all workers, since we could have block * group caching kthreads running, and therefore they could race with us if we
@@ -4517,28 +4543,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info) struct btrfs_space_info, list); -/* -* Do not hide this behind enospc_debug, this is actually -* important and indicates a real bug if this happens. -*/ -if (WARN_ON (space_info->bytes_pinned >0 || - space_info->bytes_may_use >0 )) -btrfs_dump_space_info (info, space_info,0 ,0 ); - -/* -* If there was a failure to cleanup a log tree, very likely due -* to an IO failure on a writeback attempt of one or more of its -* extent buffers, we could not do proper (and cheap) unaccounting -* of their reserved space, so don't warn on bytes_reserved > 0 in -* that case. -*/ -if (!(space_info->flags &BTRFS_BLOCK_GROUP_METADATA ) || - !BTRFS_FS_LOG_CLEANUP_ERROR (info)) { -if (WARN_ON (space_info->bytes_reserved >0 )) -btrfs_dump_space_info (info, space_info,0 ,0 ); - } - -WARN_ON (space_info->reclaim_size >0 ); +check_removing_space_info (space_info);list_del (&space_info->list);btrfs_sysfs_remove_space_info (space_info); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/139 btrfs: introduce btrfs_space_info sub-group
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
[ Upstream commit f92ee31e031c7819126d2febdda0c3e91f5d2eb9 ]
Current code assumes we have only one space_info for each block group type (DATA, METADATA, and SYSTEM). We sometime need multiple space infos to manage special block groups.
One example is handling the data relocation block group for the zoned mode. That block group is dedicated for writing relocated data and we cannot allocate any regular extent from that block group, which is implemented in the zoned extent allocator. This block group still belongs to the normal data space_info. So, when all the normal data block groups are full and there is some free space in the dedicated block group, the space_info looks to have some free space, while it cannot allocate normal extent anymore. That results in a strange ENOSPC error. We need to have a space_info for the relocation data block group to represent the situation properly.
Adds a basic infrastructure for having a "sub-group" of a space_info:
creation and removing. A sub-group space_info belongs to one of the primary space_infos and has the same flags as its parent.
This commit first introduces the relocation data sub-space_info, and the next commit will introduce tree-log sub-space_info. In the future, it could be useful to implement tiered storage for btrfs e.g. by implementing a sub-group space_info for block groups resides on a fast storage.
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
--- fs/btrfs/block-group.c | 11 +++++++++++ fs/btrfs/space-info.c | 44 +++++++++++++++++++++++++++++++++++++++--- fs/btrfs/space-info.h | 9 +++++++++ fs/btrfs/sysfs.c | 18 ++++++++++++++--- 4 files changed, 76 insertions(+), 6 deletions(-)
fs/btrfs/block-group.c +11 -0
@@ -4420,6 +4420,17 @@ static void check_removing_space_info(struct btrfs_space_info *space_info) {struct btrfs_fs_info *info = space_info->fs_info; +if (space_info->subgroup_id ==BTRFS_SUB_GROUP_PRIMARY ) { +/* This is a top space_info, proceed with its children first. */ +for (int i =0 ; i <BTRFS_SPACE_INFO_SUB_GROUP_MAX ; i++) { +if (space_info->sub_group[i]) { +check_removing_space_info (space_info->sub_group[i]); +kfree (space_info->sub_group[i]); + space_info->sub_group[i] =NULL ; + } + } + } +/* * Do not hide this behind enospc_debug, this is actually important and * indicates a real bug if this happens.
fs/btrfs/space-info.c +41 -3
71 lines not on this page · raw message
fs/btrfs/space-info.h +9 -0
@@ -93,8 +93,17 @@ enum btrfs_flush_state { COMMIT_TRANS = 11, }; +enum btrfs_space_info_sub_group { +BTRFS_SUB_GROUP_PRIMARY , +BTRFS_SUB_GROUP_DATA_RELOC , +}; + +#define BTRFS_SPACE_INFO_SUB_GROUP_MAX 1struct btrfs_space_info {struct btrfs_fs_info *fs_info; +struct btrfs_space_info *parent; +struct btrfs_space_info *sub_group[BTRFS_SPACE_INFO_SUB_GROUP_MAX ]; +int subgroup_id;spinlock_t lock;u64 total_bytes;/* total bytes in the space,
fs/btrfs/sysfs.c +15 -3
@@ -1792,16 +1792,28 @@ void btrfs_sysfs_remove_space_info(struct btrfs_space_info *space_info)kobject_put (&space_info->kobj); } -static const char *alloc_name (u64 flags) +static const char *alloc_name (struct btrfs_space_info *space_info) { +u64 flags = space_info->flags; +switch (flags) {case BTRFS_BLOCK_GROUP_METADATA |BTRFS_BLOCK_GROUP_DATA :return "mixed" ;case BTRFS_BLOCK_GROUP_METADATA : +ASSERT (space_info->subgroup_id ==BTRFS_SUB_GROUP_PRIMARY );return "metadata" ;case BTRFS_BLOCK_GROUP_DATA : -return "data" ; +switch (space_info->subgroup_id) { +case BTRFS_SUB_GROUP_PRIMARY : +return "data" ; +case BTRFS_SUB_GROUP_DATA_RELOC : +return "data-reloc" ; +default : +WARN_ON_ONCE (1 ); +return "data (unknown sub-group)" ; + }case BTRFS_BLOCK_GROUP_SYSTEM : +ASSERT (space_info->subgroup_id ==BTRFS_SUB_GROUP_PRIMARY );return "system" ;default :WARN_ON (1 );
@@ -1820,7 +1832,7 @@ int btrfs_sysfs_add_space_info_type(struct btrfs_fs_info *fs_info, ret =kobject_init_and_add (&space_info->kobj, &space_info_ktype, fs_info->space_info_kobj,"%s" , -alloc_name (space_info->flags)); +alloc_name (space_info));if (ret) {kobject_put (&space_info->kobj);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/139 btrfs: fix memory leaks in create_space_info() error paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit a11224a016d6d1d46a4d9b6573244448a80d4d7f ]
In create_space_info(), the 'space_info' object is allocated at the beginning of the function. However, there are two error paths where the function returns an error code without freeing the allocated memory:
1. When create_space_info_sub_group() fails in zoned mode.
2. When btrfs_sysfs_add_space_info_type() fails.
In both cases, 'space_info' has not yet been added to the fs_info->space_info list, resulting in a memory leak. Fix this by adding an error handling label to kfree(space_info) before returning.
--- fs/btrfs/space-info.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/btrfs/space-info.c +6 -2
@@ -291,18 +291,22 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)BTRFS_SUB_GROUP_DATA_RELOC , 0);if (ret) -return ret; + goto out_free; } ret =btrfs_sysfs_add_space_info_type (info, space_info);if (ret) -return ret; + goto out_free;list_add (&space_info->list, &info->space_info);if (flags &BTRFS_BLOCK_GROUP_DATA ) info->data_sinfo = space_info;return ret; + +out_free: +kfree (space_info); +return ret; }int btrfs_init_space_info (struct btrfs_fs_info *fs_info)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/139 net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit f93fc5d12d69012788f82151bee55fce937e1432 ]
octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to ioq_vector. If request_irq() fails part-way, the rollback loop calls free_irq() with dev_id set to 'oct', which does not match the original dev_id and may leave the irqaction registered.
This can keep IRQ handlers alive while ioq_vector is later freed during unwind/teardown, leading to a use-after-free or crash when an interrupt fires.
Fix the error path to free IRQs with the same ioq_vector dev_id used during request_irq().
--- drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c +1 -1
@@ -220,7 +220,7 @@ static int octep_vf_request_irqs(struct octep_vf_device *oct) ioq_irq_err:while (i) { --i; -free_irq (oct->msix_entries[i].vector, oct); +free_irq (oct->msix_entries[i].vector, oct->ioq_vector[i]); }return -1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/139 ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit c5e96e54eca3876d4ce8857e2e22adbe9f44f4a2 ]
Set gpiochip parent to the struct device of the dummy GPIO driver so that the software node will be associated with the GPIO chip.
The recent commit e5d527be7e698 ("gpio: swnode: don't use the swnode's name as the key for GPIO lookup") broke cirrus_scodec_test, because the software node no longer gets associated with the GPIO driver by name.
Instead, setting struct gpio_chip.parent to the owning struct device will find the node using a normal fwnode lookup.
--- sound/pci/hda/cirrus_scodec_test.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/cirrus_scodec_test.c +1 -0
@@ -92,6 +92,7 @@ static int cirrus_scodec_test_gpio_probe(struct platform_device *pdev)/* GPIO core modifies our struct gpio_chip so use a copy */ gpio_priv->chip = cirrus_scodec_test_gpio_chip; + gpio_priv->chip.parent = &pdev->dev; ret =devm_gpiochip_add_data (&pdev->dev, &gpio_priv->chip, gpio_priv);if (ret)return dev_err_probe (&pdev->dev, ret,"Failed to add gpiochip\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/139 net: hv_netvsc: reject RSS hash key programming without RX indirection table
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <[email protected]>
[ Upstream commit d23564955811da493f34412d7de60fa268c8cb50 ]
RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang.
Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior.
--- drivers/net/hyperv/netvsc_drv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/hyperv/netvsc_drv.c +3 -0
@@ -1765,6 +1765,9 @@ static int netvsc_set_rxfh(struct net_device *dev, rxfh->hfunc != ETH_RSS_HASH_TOP)return -EOPNOTSUPP ; +if (!ndc->rx_table_sz) +return -EOPNOTSUPP ; + rndis_dev = ndev->extension;if (rxfh->indir) {for (i =0 ; i < ndc->rx_table_sz; i++)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/139 ipv6: Fix use-after-free in inet6_addr_del().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit ddf96c393a33aef4887e2e406c76c2f8cda1419c ]
syzbot reported use-after-free of inet6_ifaddr ininet6_addr_del(). [0]
The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before reading its ifp->flags for temporary addresses in inet6_addr_del().
Let's move ipv6_del_addr() down to fix the UAF.
[0]:
BUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593 CPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181 inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f164cf8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749 RDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003 RBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288 </TASK> Allocated by task 9593: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120 inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050 addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160 inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6099: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free_freelist_hook mm/slub.c:2569 [inline] slab_free_bulk mm/slub.c:6696 [inline] kmem_cache_free_bulk mm/slub.c:7383 [inline] kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362 kfree_bulk include/linux/slab.h:830 [inline] kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523 kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline] kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
--- net/ipv6/addrconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/addrconf.c +2 -2
@@ -3141,12 +3141,12 @@ static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,in6_ifa_hold (ifp);read_unlock_bh (&idev->lock); -ipv6_del_addr (ifp); -if (!(ifp->flags &IFA_F_TEMPORARY ) && (ifp->flags &IFA_F_MANAGETEMPADDR ))delete_tempaddrs (idev, ifp); +ipv6_del_addr (ifp); +addrconf_verify_rtnl (net);if (ipv6_addr_is_multicast (pfx)) { ipv6_mc_config(net->ipv6.mc_autojoin_sk,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/139 selftests: drv-net: fix RPS mask handling for high CPU numbers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit cf055f8c000445aa688c53a706ef4f580818eedb ]
The RPS bitmask bounds check uses ~(RPS_MAX_CPUS - 1) which equals ~15 = 0xfff0, only allowing CPUs 0-3.
Change the mask to ~((1UL << RPS_MAX_CPUS) - 1) = ~0xffff to allow CPUs 0-15.
--- tools/testing/selftests/net/toeplitz.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/toeplitz.c +2 -2
@@ -473,8 +473,8 @@ static void parse_rps_bitmap(const char *arg) bitmap =strtoul (arg,NULL ,0 ); -if (bitmap & ~(RPS_MAX_CPUS -1 )) -error (1 ,0 ,"rps bitmap 0x%lx out of bounds 0..%lu" , +if (bitmap & ~((1UL <<RPS_MAX_CPUS ) -1 )) +error (1 ,0 ,"rps bitmap 0x%lx out of bounds, max cpu %lu" , bitmap,RPS_MAX_CPUS -1 );for (i =0 ; i <RPS_MAX_CPUS ; i++)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/139 net/sched: sch_qfq: do not free existing class in qfq_change_class()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 ]
Fixes qfq_change_class() error case.
cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.
--- net/sched/sch_qfq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/sched/sch_qfq.c +4 -2
@@ -532,8 +532,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,return 0 ; destroy_class: -qdisc_put (cl->qdisc); -kfree (cl); +if (!existing) { +qdisc_put (cl->qdisc); +kfree (cl); + }return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/139 ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cole Leavitt <[email protected]>
[ Upstream commit 390caeed0897fcac75f3c414dbdd85d593183d9c ]
The CS42L43 codec's load detection can return different impedance values that map to either HEADPHONE or LINEOUT jack types. However, the soc_jack_pins array only maps SND_JACK_HEADPHONE to the "Headphone" DAPM pin, not SND_JACK_LINEOUT.
When headphones are detected with an impedance that maps to LINEOUT (such as impedance value 0x2), the driver reports SND_JACK_LINEOUT. Since this doesn't match the jack pin mask, the "Headphone" DAPM pin is not activated, and no audio is routed to the headphone outputs.
Fix by adding SND_JACK_LINEOUT to the Headphone pin mask, so that both headphone and line-out detection properly enable the headphone output path.
This fixes no audio output on devices like the Lenovo ThinkPad P16 Gen 3 where headphones are detected with LINEOUT impedance.
--- sound/soc/sdw_utils/soc_sdw_cs42l43.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sdw_utils/soc_sdw_cs42l43.c +1 -1
@@ -44,7 +44,7 @@ static const struct snd_soc_dapm_route cs42l43_dmic_map[] = {static struct snd_soc_jack_pin soc_jack_pins[] = { { .pin ="Headphone" , - .mask =SND_JACK_HEADPHONE , + .mask =SND_JACK_HEADPHONE |SND_JACK_LINEOUT , }, { .pin ="Headset Mic" ,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/139 ASoC: tlv320adcx140: fix null pointer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Svendsen <[email protected]>
[ Upstream commit be7664c81d3129fc313ef62ff275fd3d33cfecd4 ]
The "snd_soc_component" in "adcx140_priv" was only used once but never set. It was only used for reaching "dev" which is already present in "adcx140_priv".
--- sound/soc/codecs/tlv320adcx140.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
sound/soc/codecs/tlv320adcx140.c +1 -3
@@ -23,7 +23,6 @@#include "tlv320adcx140.h" struct adcx140_priv { -struct snd_soc_component *component;struct regulator *supply_areg;struct gpio_desc *gpio_reset;struct regmap *regmap;
@@ -701,7 +700,6 @@ static void adcx140_pwr_ctrl(struct adcx140_priv *adcx140, bool power_state) {int pwr_ctrl =0 ;int ret =0 ; -struct snd_soc_component *component = adcx140->component;if (power_state) pwr_ctrl =ADCX140_PWR_CFG_ADC_PDZ |ADCX140_PWR_CFG_PLL_PDZ ;
@@ -713,7 +711,7 @@ static void adcx140_pwr_ctrl(struct adcx140_priv *adcx140, bool power_state) ret =regmap_write (adcx140->regmap,ADCX140_PHASE_CALIB , adcx140->phase_calib_on ?0x00 :0x40 );if (ret) -dev_err (component->dev,"%s: register write error %d\n" , +dev_err (adcx140->dev,"%s: register write error %d\n" , __func__, ret); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/139 ASoC: tlv320adcx140: fix word length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Svendsen <[email protected]>
[ Upstream commit 46378ab9fcb796dca46b51e10646f636e2c661f9 ]
The word length is the physical width of the channel slots. So the hw_params would misconfigure when format width and physical width doesn't match. Like S24_LE which has data width of 24 bits but physical width of 32 bits. So if using asymmetric formats you will get a lot of noise.
--- sound/soc/codecs/tlv320adcx140.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/tlv320adcx140.c +2 -2
@@ -727,7 +727,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,struct adcx140_priv *adcx140 =snd_soc_component_get_drvdata (component);u8 data =0 ; -switch (params_width (params)) { +switch (params_physical_width (params)) {case 16 : data =ADCX140_16_BIT_WORD ;break ;
@@ -742,7 +742,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,break ;default :dev_err (component->dev,"%s: Unsupported width %d\n" , - __func__,params_width (params)); + __func__,params_physical_width (params));return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/139 drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 90dbc0bc2aa60021615969841fed06790c992bde ]
resolving the issue of incorrect type definitions potentially causing calculation errors.
--- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +2 -1
@@ -1672,8 +1672,9 @@ static int smu_v14_0_2_get_power_limit(struct smu_context *smu, table_context->power_play_table;PPTable_t *pptable = table_context->driver_pptable;CustomSkuTable_t *skutable = &pptable->CustomSkuTable; -uint32_t power_limit, od_percent_upper =0 , od_percent_lower =0 ; +int16_t od_percent_upper =0 , od_percent_lower =0 ;uint32_t msg_limit = pptable->SkuTable.MsgLimits.Power[PPT_THROTTLER_PPT0 ][POWER_SOURCE_AC ]; +uint32_t power_limit;if (smu_v14_0_get_current_power_limit (smu, &power_limit)) power_limit = smu->adev->pm.ac_power ?
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/139 mm: describe @flags parameter in memalloc_flags_save()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit e2fb7836b01747815f8bb94981c35f2688afb120 ]
Patch series "mm kernel-doc fixes".
Here are kernel-doc fixes for mm subsystem. I'm also including textsearch fix since there's currently no maintainer for include/linux/textsearch.h (get_maintainer.pl only shows LKML).
This patch (of 4):
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/sched/mm.h:332 function parameter 'flags' not described in 'memalloc_flags_save'
Describe @flags to fix it.
--- include/linux/sched/mm.h | 1 + 1 file changed, 1 insertion(+)
include/linux/sched/mm.h +1 -0
@@ -323,6 +323,7 @@ static inline void might_alloc(gfp_t gfp_mask)/** * memalloc_flags_save - Add a PF_* flag to current->flags, save old value +* @flags: Flags to add. * * This allows PF_* flags to be conveniently added, irrespective of current * value, and then the old version restored with memalloc_flags_restore().
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/139 textsearch: describe @list member in ts_ops search
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit f26528478bb102c28e7ac0cbfc8ec8185afdafc7 ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/textsearch.h:49 struct member 'list' not described in 'ts_ops'
Describe @list member to fix it.
--- include/linux/textsearch.h | 1 + 1 file changed, 1 insertion(+)
include/linux/textsearch.h +1 -0
@@ -35,6 +35,7 @@ struct ts_state* @get_pattern: return head of pattern * @get_pattern_len: return length of pattern * @owner: module reference to algorithm +* @list: list to search */ struct ts_ops {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/139 mm, kfence: describe @slab parameter in __kfence_obj_info()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit 6cfab50e1440fde19af7c614aacd85e11aa4dcea ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/kfence.h:220 function parameter 'slab' not described in '__kfence_obj_info'
Fix it by describing @slab parameter.
--- include/linux/kfence.h | 1 + 1 file changed, 1 insertion(+)
include/linux/kfence.h +1 -0
@@ -211,6 +211,7 @@ struct kmem_obj_info;* __kfence_obj_info() - fill kmem_obj_info struct * @kpp: kmem_obj_info to be filled * @object: the object +* @slab: the slab * * Return: * * false - not a KFENCE object
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/139 dmaengine: xilinx: xdma: Fix regmap max_register
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Brandon <[email protected]>
[ Upstream commit c7d436a6c1a274c1ac28d5fb3b8eb8f03b6d0e10 ]
The max_register field is assigned the size of the register memory region instead of the offset of the last register.
The result is that reading from the regmap via debugfs can cause a segmentation fault:
tail /sys/kernel/debug/regmap/xdma.1.auto/registers
Unable to handle kernel paging request at virtual address ffff800082f70000
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
[...]
Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]---
note: tail[1217] exited with irqs disabled
note: tail[1217] exited with preempt_count 1
Segmentation fault
--- drivers/dma/xilinx/xdma-regs.h | 1 + drivers/dma/xilinx/xdma.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/dma/xilinx/xdma-regs.h +1 -0
@@ -9,6 +9,7 @@/* The length of register space exposed to host */ #define XDMA_REG_SPACE_LEN 65536 +#define XDMA_MAX_REG_OFFSET (XDMA_REG_SPACE_LEN - 4)/* * maximum number of DMA channels for each direction:
drivers/dma/xilinx/xdma.c +1 -1
@@ -38,7 +38,7 @@ static const struct regmap_config xdma_regmap_config = { .reg_bits = 32, .val_bits = 32, .reg_stride = 4, - .max_register = XDMA_REG_SPACE_LEN, + .max_register = XDMA_MAX_REG_OFFSET, };/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/139 dmaengine: tegra-adma: Fix use-after-free
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheetal <[email protected]>
[ Upstream commit 2efd07a7c36949e6fa36a69183df24d368bf9e96 ]
A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it.
The race condition follows this sequence:
1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet)
2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree()
3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory
Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs.
Fix this by properly synchronizing the virtual channel completion:
- Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor.
- Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors.
Crash logs:
[ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0
[ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8
--- drivers/dma/tegra210-adma.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/dma/tegra210-adma.c +9 -1
@@ -343,10 +343,17 @@ static void tegra_adma_stop(struct tegra_adma_chan *tdc)return ; } -kfree (tdc->desc); +vchan_terminate_vdesc (&tdc->desc->vd); tdc->desc =NULL ; } +static void tegra_adma_synchronize (struct dma_chan *dc) +{ +struct tegra_adma_chan *tdc =to_tegra_adma_chan (dc); + +vchan_synchronize (&tdc->vc); +} +static void tegra_adma_start (struct tegra_adma_chan *tdc) {struct virt_dma_desc *vd =vchan_next_desc (&tdc->vc);
@@ -938,6 +945,7 @@ static int tegra_adma_probe(struct platform_device *pdev) tdma->dma_dev.device_config = tegra_adma_slave_config; tdma->dma_dev.device_tx_status = tegra_adma_tx_status; tdma->dma_dev.device_terminate_all = tegra_adma_terminate_all; + tdma->dma_dev.device_synchronize = tegra_adma_synchronize; tdma->dma_dev.src_addr_widths =BIT (DMA_SLAVE_BUSWIDTH_4_BYTES ); tdma->dma_dev.dst_addr_widths =BIT (DMA_SLAVE_BUSWIDTH_4_BYTES ); tdma->dma_dev.directions =BIT (DMA_DEV_TO_MEM ) |BIT (DMA_MEM_TO_DEV );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/139 dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <[email protected]>
[ Upstream commit c0732fe78728718c853ef8e7af5bbb05262acbd1 ]
When device tree lacks optional "xlnx,addrwidth" property, the addr_width variable remained uninitialized with garbage values, causing incorrect DMA mask configuration and subsequent probe failure. The fix ensures a fallback to the default 32-bit address width when this property is missing.
--- drivers/dma/xilinx/xilinx_dma.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +5 -2
@@ -130,6 +130,7 @@#define XILINX_MCDMA_MAX_CHANS_PER_DEVICE 0x20#define XILINX_DMA_MAX_CHANS_PER_DEVICE 0x2#define XILINX_CDMA_MAX_CHANS_PER_DEVICE 0x1 +#define XILINX_DMA_DFAULT_ADDRWIDTH 0x20#define XILINX_DMA_DMAXR_ALL_IRQ_MASK \ (XILINX_DMA_DMASR_FRM_CNT_IRQ | \
@@ -3063,7 +3064,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)struct device_node *node = pdev->dev.of_node;struct xilinx_dma_device *xdev;struct device_node *child, *np = pdev->dev.of_node; -u32 num_frames, addr_width, len_width; +u32 num_frames, addr_width =XILINX_DMA_DFAULT_ADDRWIDTH , len_width;int i, err;/* Allocate and initialize the DMA engine structure */
@@ -3137,7 +3138,9 @@ static int xilinx_dma_probe(struct platform_device *pdev) err =of_property_read_u32 (node,"xlnx,addrwidth" , &addr_width);if (err <0 ) -dev_warn (xdev->dev,"missing xlnx,addrwidth property\n" ); +dev_warn (xdev->dev, +"missing xlnx,addrwidth property, using default value %d\n" , +XILINX_DMA_DFAULT_ADDRWIDTH );if (addr_width >32 ) xdev->ext_addr = true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/139 phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Radaelli <[email protected]>
[ Upstream commit 8becf9179a4b45104a1701010ed666b55bf4b3a6 ]
Clear the PCS_TX_SWING_FULL field mask before setting the new value in PHY_CTRL5 register. Without clearing the mask first, the OR operation could leave previously set bits, resulting in incorrect register configuration.
--- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/phy/freescale/phy-fsl-imx8mq-usb.c +1 -0
@@ -206,6 +206,7 @@ static void imx8m_phy_tune(struct imx8mq_usb_phy *imx_phy)if (imx_phy->pcs_tx_swing_full !=PHY_TUNE_DEFAULT ) { value =readl (imx_phy->base +PHY_CTRL5 ); + value &= ~PHY_CTRL5_PCS_TX_SWING_FULL_MASK ; value |=FIELD_PREP (PHY_CTRL5_PCS_TX_SWING_FULL_MASK , imx_phy->pcs_tx_swing_full);writel (value, imx_phy->base +PHY_CTRL5 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/139 phy: phy-snps-eusb2: refactor constructs names
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivaylo Ivanov <[email protected]>
[ Upstream commit 93dbe9b5b3a265c7e5466c7b6ada439b01577de5 ]
As the driver now resides outside the phy subdirectory under a different name, refactor all definitions, structures and functions to explicitly specify what code is Qualcomm-specific and what is not.
Stable-dep-of: 1ca52c0983c3 ("phy: qcom-qusb2: Fix NULL pointer dereference on early suspend")
--- drivers/phy/qualcomm/phy-qcom-snps-eusb2.c | 256 ++++++++++----------- 1 file changed, 128 insertions(+), 128 deletions(-)
drivers/phy/qualcomm/phy-qcom-snps-eusb2.c +128 -128
@@ -13,15 +13,15 @@#include <linux/regulator/consumer.h> #include <linux/reset.h> -#define USB_PHY_UTMI_CTRL0 (0x3c) +#define QCOM_USB_PHY_UTMI_CTRL0 (0x3c)#define SLEEPM BIT(0)#define OPMODE_MASK GENMASK(4, 3)#define OPMODE_NONDRIVING BIT(3) -#define USB_PHY_UTMI_CTRL5 (0x50) +#define QCOM_USB_PHY_UTMI_CTRL5 (0x50)#define POR BIT(1) -#define USB_PHY_HS_PHY_CTRL_COMMON0 (0x54) +#define QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 (0x54)#define PHY_ENABLE BIT(0)#define SIDDQ_SEL BIT(1)#define SIDDQ BIT(2)
@@ -30,15 +30,15 @@#define FSEL_19_2_MHZ_VAL (0x0)#define FSEL_38_4_MHZ_VAL (0x4) -#define USB_PHY_CFG_CTRL_1 (0x58) +#define QCOM_USB_PHY_CFG_CTRL_1 (0x58)#define PHY_CFG_PLL_CPBIAS_CNTRL_MASK GENMASK(7, 1) -#define USB_PHY_CFG_CTRL_2 (0x5c) +#define QCOM_USB_PHY_CFG_CTRL_2 (0x5c)#define PHY_CFG_PLL_FB_DIV_7_0_MASK GENMASK(7, 0)#define DIV_7_0_19_2_MHZ_VAL (0x90)#define DIV_7_0_38_4_MHZ_VAL (0xc8) -#define USB_PHY_CFG_CTRL_3 (0x60) +#define QCOM_USB_PHY_CFG_CTRL_3 (0x60)#define PHY_CFG_PLL_FB_DIV_11_8_MASK GENMASK(3, 0)#define DIV_11_8_19_2_MHZ_VAL (0x1)#define DIV_11_8_38_4_MHZ_VAL (0x0)
@@ -46,73 +46,73 @@#define PHY_CFG_PLL_REF_DIV GENMASK(7, 4)#define PLL_REF_DIV_VAL (0x0) -#define USB_PHY_HS_PHY_CTRL2 (0x64) +#define QCOM_USB_PHY_HS_PHY_CTRL2 (0x64)#define VBUSVLDEXT0 BIT(0)#define USB2_SUSPEND_N BIT(2)#define USB2_SUSPEND_N_SEL BIT(3)#define VBUS_DET_EXT_SEL BIT(4) -#define USB_PHY_CFG_CTRL_4 (0x68) +#define QCOM_USB_PHY_CFG_CTRL_4 (0x68)#define PHY_CFG_PLL_GMP_CNTRL_MASK GENMASK(1, 0)#define PHY_CFG_PLL_INT_CNTRL_MASK GENMASK(7, 2) -#define USB_PHY_CFG_CTRL_5 (0x6c) +#define QCOM_USB_PHY_CFG_CTRL_5 (0x6c)#define PHY_CFG_PLL_PROP_CNTRL_MASK GENMASK(4, 0)#define PHY_CFG_PLL_VREF_TUNE_MASK GENMASK(7, 6) -#define USB_PHY_CFG_CTRL_6 (0x70) +#define QCOM_USB_PHY_CFG_CTRL_6 (0x70)#define PHY_CFG_PLL_VCO_CNTRL_MASK GENMASK(2, 0) -#define USB_PHY_CFG_CTRL_7 (0x74) +#define QCOM_USB_PHY_CFG_CTRL_7 (0x74) -#define USB_PHY_CFG_CTRL_8 (0x78) +#define QCOM_USB_PHY_CFG_CTRL_8 (0x78)#define PHY_CFG_TX_FSLS_VREF_TUNE_MASK GENMASK(1, 0)#define PHY_CFG_TX_FSLS_VREG_BYPASS BIT(2)#define PHY_CFG_TX_HS_VREF_TUNE_MASK GENMASK(5, 3)#define PHY_CFG_TX_HS_XV_TUNE_MASK GENMASK(7, 6) -#define USB_PHY_CFG_CTRL_9 (0x7c) +#define QCOM_USB_PHY_CFG_CTRL_9 (0x7c)#define PHY_CFG_TX_PREEMP_TUNE_MASK GENMASK(2, 0)#define PHY_CFG_TX_RES_TUNE_MASK GENMASK(4, 3)#define PHY_CFG_TX_RISE_TUNE_MASK GENMASK(6, 5)#define PHY_CFG_RCAL_BYPASS BIT(7) -#define USB_PHY_CFG_CTRL_10 (0x80) +#define QCOM_USB_PHY_CFG_CTRL_10 (0x80) -#define USB_PHY_CFG0 (0x94) +#define QCOM_USB_PHY_CFG0 (0x94)#define DATAPATH_CTRL_OVERRIDE_EN BIT(0)#define CMN_CTRL_OVERRIDE_EN BIT(1) -#define UTMI_PHY_CMN_CTRL0 (0x98) +#define QCOM_UTMI_PHY_CMN_CTRL0 (0x98)#define TESTBURNIN BIT(6) -#define USB_PHY_FSEL_SEL (0xb8) +#define QCOM_USB_PHY_FSEL_SEL (0xb8)#define FSEL_SEL BIT(0) -#define USB_PHY_APB_ACCESS_CMD (0x130) +#define QCOM_USB_PHY_APB_ACCESS_CMD (0x130)#define RW_ACCESS BIT(0)#define APB_START_CMD BIT(1)#define APB_LOGIC_RESET BIT(2) -#define USB_PHY_APB_ACCESS_STATUS (0x134) +#define QCOM_USB_PHY_APB_ACCESS_STATUS (0x134)#define ACCESS_DONE BIT(0)#define TIMED_OUT BIT(1)#define ACCESS_ERROR BIT(2)#define ACCESS_IN_PROGRESS BIT(3) -#define USB_PHY_APB_ADDRESS (0x138) +#define QCOM_USB_PHY_APB_ADDRESS (0x138)#define APB_REG_ADDR_MASK GENMASK(7, 0) -#define USB_PHY_APB_WRDATA_LSB (0x13c) +#define QCOM_USB_PHY_APB_WRDATA_LSB (0x13c)#define APB_REG_WRDATA_7_0_MASK GENMASK(3, 0) -#define USB_PHY_APB_WRDATA_MSB (0x140) +#define QCOM_USB_PHY_APB_WRDATA_MSB (0x140)#define APB_REG_WRDATA_15_8_MASK GENMASK(7, 4) -#define USB_PHY_APB_RDDATA_LSB (0x144) +#define QCOM_USB_PHY_APB_RDDATA_LSB (0x144)#define APB_REG_RDDATA_7_0_MASK GENMASK(3, 0) -#define USB_PHY_APB_RDDATA_MSB (0x148) +#define QCOM_USB_PHY_APB_RDDATA_MSB (0x148)#define APB_REG_RDDATA_15_8_MASK GENMASK(7, 4)static const char *const eusb2_hsphy_vreg_names[] = {
@@ -121,7 +121,7 @@ static const char * const eusb2_hsphy_vreg_names[] = {#define EUSB2_NUM_VREGS ARRAY_SIZE(eusb2_hsphy_vreg_names) -struct qcom_snps_eusb2_hsphy { +struct snps_eusb2_hsphy {struct phy *phy;void __iomem *base;
@@ -135,17 +135,17 @@ struct qcom_snps_eusb2_hsphy {struct phy *repeater; }; -static int qcom_snps_eusb2_hsphy_set_mode (struct phy *p,enum phy_mode mode,int submode) +static int snps_eusb2_hsphy_set_mode (struct phy *p,enum phy_mode mode,int submode) { -struct qcom_snps_eusb2_hsphy *phy =phy_get_drvdata (p); +struct snps_eusb2_hsphy *phy =phy_get_drvdata (p); phy->mode = mode;return phy_set_mode_ext (phy->repeater, mode, submode); } -static void qcom_snps_eusb2_hsphy_write_mask (void __iomem *base,u32 offset, -u32 mask,u32 val) +static void snps_eusb2_hsphy_write_mask (void __iomem *base,u32 offset, +u32 mask,u32 val) {u32 reg;
@@ -158,65 +158,65 @@ static void qcom_snps_eusb2_hsphy_write_mask(void __iomem *base, u32 offset,readl_relaxed (base + offset); } -static void qcom_eusb2_default_parameters (struct qcom_snps_eusb2_hsphy *phy) +static void qcom_eusb2_default_parameters (struct snps_eusb2_hsphy *phy) {/* default parameters: tx pre-emphasis */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_9 , -PHY_CFG_TX_PREEMP_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_PREEMP_TUNE_MASK ,0 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_9 , +PHY_CFG_TX_PREEMP_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_PREEMP_TUNE_MASK ,0 ));/* tx rise/fall time */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_9 , -PHY_CFG_TX_RISE_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_RISE_TUNE_MASK ,0x2 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_9 , +PHY_CFG_TX_RISE_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_RISE_TUNE_MASK ,0x2 ));/* source impedance adjustment */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_9 , -PHY_CFG_TX_RES_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_RES_TUNE_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_9 , +PHY_CFG_TX_RES_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_RES_TUNE_MASK ,0x1 ));/* dc voltage level adjustement */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_8 , -PHY_CFG_TX_HS_VREF_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_HS_VREF_TUNE_MASK ,0x3 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_8 , +PHY_CFG_TX_HS_VREF_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_HS_VREF_TUNE_MASK ,0x3 ));/* transmitter HS crossover adjustement */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_8 , -PHY_CFG_TX_HS_XV_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_HS_XV_TUNE_MASK ,0x0 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_8 , +PHY_CFG_TX_HS_XV_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_HS_XV_TUNE_MASK ,0x0 )); } -static int qcom_eusb2_ref_clk_init (struct qcom_snps_eusb2_hsphy *phy) +static int qcom_eusb2_ref_clk_init (struct snps_eusb2_hsphy *phy) {unsigned long ref_clk_freq =clk_get_rate (phy->ref_clk);switch (ref_clk_freq) {case 19200000 : -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -FSEL_MASK , -FIELD_PREP (FSEL_MASK ,FSEL_19_2_MHZ_VAL )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +FSEL_MASK , +FIELD_PREP (FSEL_MASK ,FSEL_19_2_MHZ_VAL )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_2 , -PHY_CFG_PLL_FB_DIV_7_0_MASK , -DIV_7_0_19_2_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_2 , +PHY_CFG_PLL_FB_DIV_7_0_MASK , +DIV_7_0_19_2_MHZ_VAL ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_3 , -PHY_CFG_PLL_FB_DIV_11_8_MASK , -DIV_11_8_19_2_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_3 , +PHY_CFG_PLL_FB_DIV_11_8_MASK , +DIV_11_8_19_2_MHZ_VAL );break ;case 38400000 : -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -FSEL_MASK , -FIELD_PREP (FSEL_MASK ,FSEL_38_4_MHZ_VAL )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +FSEL_MASK , +FIELD_PREP (FSEL_MASK ,FSEL_38_4_MHZ_VAL )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_2 , -PHY_CFG_PLL_FB_DIV_7_0_MASK , -DIV_7_0_38_4_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_2 , +PHY_CFG_PLL_FB_DIV_7_0_MASK , +DIV_7_0_38_4_MHZ_VAL ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_3 , -PHY_CFG_PLL_FB_DIV_11_8_MASK , -DIV_11_8_38_4_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_3 , +PHY_CFG_PLL_FB_DIV_11_8_MASK , +DIV_11_8_38_4_MHZ_VAL );break ;default :
@@ -224,15 +224,15 @@ static int qcom_eusb2_ref_clk_init(struct qcom_snps_eusb2_hsphy *phy)return -EINVAL ; } -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_3 , -PHY_CFG_PLL_REF_DIV ,PLL_REF_DIV_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_3 , +PHY_CFG_PLL_REF_DIV ,PLL_REF_DIV_VAL );return 0 ; } -static int qcom_snps_eusb2_hsphy_init (struct phy *p) +static int snps_eusb2_hsphy_init (struct phy *p) { -struct qcom_snps_eusb2_hsphy *phy =phy_get_drvdata (p); +struct snps_eusb2_hsphy *phy =phy_get_drvdata (p);int ret; ret =regulator_bulk_enable (ARRAY_SIZE (phy->vregs), phy->vregs);
@@ -265,73 +265,73 @@ static int qcom_snps_eusb2_hsphy_init(struct phy *p) goto disable_ref_clk; } -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG0 , -CMN_CTRL_OVERRIDE_EN ,CMN_CTRL_OVERRIDE_EN ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG0 , +CMN_CTRL_OVERRIDE_EN ,CMN_CTRL_OVERRIDE_EN ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_UTMI_CTRL5 ,POR ,POR ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_UTMI_CTRL5 ,POR ,POR ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -PHY_ENABLE |RETENABLEN ,PHY_ENABLE |RETENABLEN ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +PHY_ENABLE |RETENABLEN ,PHY_ENABLE |RETENABLEN ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_APB_ACCESS_CMD , -APB_LOGIC_RESET ,APB_LOGIC_RESET ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_APB_ACCESS_CMD , +APB_LOGIC_RESET ,APB_LOGIC_RESET ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,UTMI_PHY_CMN_CTRL0 ,TESTBURNIN ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_UTMI_PHY_CMN_CTRL0 ,TESTBURNIN ,0 ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_FSEL_SEL , -FSEL_SEL ,FSEL_SEL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_FSEL_SEL , +FSEL_SEL ,FSEL_SEL );/* update ref_clk related registers */ ret =qcom_eusb2_ref_clk_init (phy);if (ret) - goto disable_ref_clk; +return ret; -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_1 , -PHY_CFG_PLL_CPBIAS_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_CPBIAS_CNTRL_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_1 , +PHY_CFG_PLL_CPBIAS_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_CPBIAS_CNTRL_MASK ,0x1 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_4 , -PHY_CFG_PLL_INT_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_INT_CNTRL_MASK ,0x8 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_4 , +PHY_CFG_PLL_INT_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_INT_CNTRL_MASK ,0x8 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_4 , -PHY_CFG_PLL_GMP_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_GMP_CNTRL_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_4 , +PHY_CFG_PLL_GMP_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_GMP_CNTRL_MASK ,0x1 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_5 , -PHY_CFG_PLL_PROP_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_PROP_CNTRL_MASK ,0x10 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_5 , +PHY_CFG_PLL_PROP_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_PROP_CNTRL_MASK ,0x10 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_6 , -PHY_CFG_PLL_VCO_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_VCO_CNTRL_MASK ,0x0 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_6 , +PHY_CFG_PLL_VCO_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_VCO_CNTRL_MASK ,0x0 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_5 , -PHY_CFG_PLL_VREF_TUNE_MASK , -FIELD_PREP (PHY_CFG_PLL_VREF_TUNE_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_5 , +PHY_CFG_PLL_VREF_TUNE_MASK , +FIELD_PREP (PHY_CFG_PLL_VREF_TUNE_MASK ,0x1 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL2 , -VBUS_DET_EXT_SEL ,VBUS_DET_EXT_SEL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL2 , +VBUS_DET_EXT_SEL ,VBUS_DET_EXT_SEL );/* set default parameters */ qcom_eusb2_default_parameters (phy); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL2 , -USB2_SUSPEND_N_SEL |USB2_SUSPEND_N , -USB2_SUSPEND_N_SEL |USB2_SUSPEND_N ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL2 , +USB2_SUSPEND_N_SEL |USB2_SUSPEND_N , +USB2_SUSPEND_N_SEL |USB2_SUSPEND_N ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_UTMI_CTRL0 ,SLEEPM ,SLEEPM ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_UTMI_CTRL0 ,SLEEPM ,SLEEPM ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -SIDDQ_SEL ,SIDDQ_SEL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +SIDDQ_SEL ,SIDDQ_SEL ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -SIDDQ ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +SIDDQ ,0 ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_UTMI_CTRL5 ,POR ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_UTMI_CTRL5 ,POR ,0 ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL2 , -USB2_SUSPEND_N_SEL ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL2 , +USB2_SUSPEND_N_SEL ,0 );return 0 ;
@@ -344,9 +344,9 @@ static int qcom_snps_eusb2_hsphy_init(struct phy *p)return ret; } -static int qcom_snps_eusb2_hsphy_exit (struct phy *p) +static int snps_eusb2_hsphy_exit (struct phy *p) { -struct qcom_snps_eusb2_hsphy *phy =phy_get_drvdata (p); +struct snps_eusb2_hsphy *phy =phy_get_drvdata (p);clk_disable_unprepare (phy->ref_clk);
@@ -357,18 +357,18 @@ static int qcom_snps_eusb2_hsphy_exit(struct phy *p)return 0 ; } -static const struct phy_ops qcom_snps_eusb2_hsphy_ops = { - .init = qcom_snps_eusb2_hsphy_init, - .exit = qcom_snps_eusb2_hsphy_exit, - .set_mode = qcom_snps_eusb2_hsphy_set_mode, +static const struct phy_ops snps_eusb2_hsphy_ops = { + .init = snps_eusb2_hsphy_init, + .exit = snps_eusb2_hsphy_exit, + .set_mode = snps_eusb2_hsphy_set_mode, .owner =THIS_MODULE , }; -static int qcom_snps_eusb2_hsphy_probe (struct platform_device *pdev) +static int snps_eusb2_hsphy_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;struct device_node *np = dev->of_node; -struct qcom_snps_eusb2_hsphy *phy; +struct snps_eusb2_hsphy *phy;struct phy_provider *phy_provider;struct phy *generic_phy;int ret, i;
@@ -405,7 +405,7 @@ static int qcom_snps_eusb2_hsphy_probe(struct platform_device *pdev)return dev_err_probe (dev,PTR_ERR (phy->repeater),"failed to get repeater\n" ); - generic_phy =devm_phy_create (dev,NULL , &qcom_snps_eusb2_hsphy_ops); + generic_phy =devm_phy_create (dev,NULL , &snps_eusb2_hsphy_ops);if (IS_ERR (generic_phy)) {dev_err (dev,"failed to create phy %d\n" , ret);return PTR_ERR (generic_phy);
@@ -418,25 +418,25 @@ static int qcom_snps_eusb2_hsphy_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"Registered Qcom-eUSB2 phy\n" ); +dev_info (dev,"Registered Snps-eUSB2 phy\n" );return 0 ; } -static const struct of_device_id qcom_snps_eusb2_hsphy_of_match_table[] = { +static const struct of_device_id snps_eusb2_hsphy_of_match_table[] = { { .compatible ="qcom,sm8550-snps-eusb2-phy" , }, { }, }; -MODULE_DEVICE_TABLE (of, qcom_snps_eusb2_hsphy_of_match_table); +MODULE_DEVICE_TABLE (of, snps_eusb2_hsphy_of_match_table); -static struct platform_driver qcom_snps_eusb2_hsphy_driver = { - .probe = qcom_snps_eusb2_hsphy_probe, +static struct platform_driver snps_eusb2_hsphy_driver = { + .probe = snps_eusb2_hsphy_probe, .driver = { - .name ="qcom-snps-eusb2-hsphy" , - .of_match_table = qcom_snps_eusb2_hsphy_of_match_table, + .name ="snps-eusb2-hsphy" , + .of_match_table = snps_eusb2_hsphy_of_match_table, }, }; -module_platform_driver (qcom_snps_eusb2_hsphy_driver); -MODULE_DESCRIPTION ("Qualcomm SNPS eUSB2 HS PHY driver" ); +module_platform_driver (snps_eusb2_hsphy_driver); +MODULE_DESCRIPTION ("Synopsys eUSB2 HS PHY driver" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/139 phy: drop probe registration printks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 95463cbb4fe6489921fb8c72890113dca54ce83f ]
Drivers should generally be quiet on successful probe, but this is not followed by some PHY drivers, for example:
snps-eusb2-hsphy 88e1000.phy: Registered Snps-eUSB2 phy qcom-eusb2-repeater c432000.spmi:pmic@7:phy@fd00: Registered Qcom-eUSB2 repeater qcom-eusb2-repeater c432000.spmi:pmic@a:phy@fd00: Registered Qcom-eUSB2 repeater qcom-eusb2-repeater c432000.spmi:pmic@b:phy@fd00: Registered Qcom-eUSB2 repeater snps-eusb2-hsphy fd3000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy fd9000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy fde000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy 88e0000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy 88e2000.phy: Registered Snps-eUSB2 phy
Drop (or demote to debug level) unnecessary registration info messages to make boot logs a little less noisy.
Stable-dep-of: 1ca52c0983c3 ("phy: qcom-qusb2: Fix NULL pointer dereference on early suspend")
--- drivers/phy/broadcom/phy-bcm-ns2-pcie.c | 2 -- drivers/phy/broadcom/phy-bcm-ns2-usbdrd.c | 1 - drivers/phy/broadcom/phy-bcm-sr-pcie.c | 2 -- drivers/phy/broadcom/phy-brcm-sata.c | 2 +- drivers/phy/marvell/phy-pxa-usb.c | 1 - drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 2 -- drivers/phy/qualcomm/phy-qcom-m31.c | 2 -- drivers/phy/qualcomm/phy-qcom-qusb2.c | 4 +--- drivers/phy/qualcomm/phy-qcom-snps-eusb2.c | 2 -- drivers/phy/st/phy-stih407-usb.c | 2 -- drivers/phy/st/phy-stm32-usbphyc.c | 4 ++-- drivers/phy/ti/phy-twl4030-usb.c | 1 - 12 files changed, 4 insertions(+), 21 deletions(-)
drivers/phy/broadcom/phy-bcm-ns2-pcie.c +0 -2
@@ -61,8 +61,6 @@ static int ns2_pci_phy_probe(struct mdio_device *mdiodev)return PTR_ERR (provider); } -dev_info (dev,"%s PHY registered\n" ,dev_name (dev)); -return 0 ; }
drivers/phy/broadcom/phy-bcm-ns2-usbdrd.c +0 -1
@@ -395,7 +395,6 @@ static int ns2_drd_phy_probe(struct platform_device *pdev)platform_set_drvdata (pdev, driver); -dev_info (dev,"Registered NS2 DRD Phy device\n" );queue_delayed_work (system_power_efficient_wq, &driver->wq_extcon, driver->debounce_jiffies);
drivers/phy/broadcom/phy-bcm-sr-pcie.c +0 -2
@@ -277,8 +277,6 @@ static int sr_pcie_phy_probe(struct platform_device *pdev)return PTR_ERR (provider); } -dev_info (dev,"Stingray PCIe PHY driver initialized\n" ); -return 0 ; }
drivers/phy/broadcom/phy-brcm-sata.c +1 -1
@@ -832,7 +832,7 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)return PTR_ERR (provider); } -dev_info (dev,"registered %d port(s)\n" , count); +dev_dbg (dev,"registered %d port(s)\n" , count);return 0 ; }
drivers/phy/marvell/phy-pxa-usb.c +0 -1
@@ -325,7 +325,6 @@ static int pxa_usb_phy_probe(struct platform_device *pdev)phy_create_lookup (pxa_usb_phy->phy,"usb" ,"mv-otg" ); } -dev_info (dev,"Marvell PXA USB PHY" );return 0 ; }
drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c +0 -2
@@ -241,8 +241,6 @@ static int eusb2_repeater_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"Registered Qcom-eUSB2 repeater\n" ); -return 0 ; }
drivers/phy/qualcomm/phy-qcom-m31.c +0 -2
@@ -311,8 +311,6 @@ static int m31usb_phy_probe(struct platform_device *pdev)phy_set_drvdata (qphy->phy, qphy); phy_provider =devm_of_phy_provider_register (dev, of_phy_simple_xlate); -if (!IS_ERR (phy_provider)) -dev_info (dev,"Registered M31 USB phy\n" );return PTR_ERR_OR_ZERO (phy_provider); }
drivers/phy/qualcomm/phy-qcom-qusb2.c +1 -3
@@ -1084,9 +1084,7 @@ static int qusb2_phy_probe(struct platform_device *pdev)phy_set_drvdata (generic_phy, qphy); phy_provider =devm_of_phy_provider_register (dev, of_phy_simple_xlate); -if (!IS_ERR (phy_provider)) -dev_info (dev,"Registered Qcom-QUSB2 phy\n" ); -else +if (IS_ERR (phy_provider))pm_runtime_disable (dev);return PTR_ERR_OR_ZERO (phy_provider);
drivers/phy/qualcomm/phy-qcom-snps-eusb2.c +0 -2
@@ -418,8 +418,6 @@ static int snps_eusb2_hsphy_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"Registered Snps-eUSB2 phy\n" ); -return 0 ; }
drivers/phy/st/phy-stih407-usb.c +0 -2
@@ -149,8 +149,6 @@ static int stih407_usb2_picophy_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"STiH407 USB Generic picoPHY driver probed!" ); -return 0 ; }
drivers/phy/st/phy-stm32-usbphyc.c +2 -2
@@ -757,8 +757,8 @@ static int stm32_usbphyc_probe(struct platform_device *pdev) } version =readl_relaxed (usbphyc->base +STM32_USBPHYC_VERSION ); -dev_info (dev,"registered rev:%lu.%lu\n" , -FIELD_GET (MAJREV , version),FIELD_GET (MINREV , version)); +dev_dbg (dev,"registered rev: %lu.%lu\n" , +FIELD_GET (MAJREV , version),FIELD_GET (MINREV , version));return 0 ;
drivers/phy/ti/phy-twl4030-usb.c +0 -1
@@ -784,7 +784,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)pm_runtime_mark_last_busy (&pdev->dev);pm_runtime_put_autosuspend (twl->dev); -dev_info (&pdev->dev,"Initialized TWL4030 USB module\n" );return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/139 phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 1ca52c0983c34fca506921791202ed5bdafd5306 ]
Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereference in runtime PM callbacks that expect valid driver data. There is a small window where the suspend callback may run after PM runtime enabling and before runtime forbid. This causes a sporadic crash during boot:
``` Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1 [...] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT Workqueue: pm pm_runtime_work pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2] lr : pm_generic_runtime_suspend+0x2c/0x44 [...] ```
Attach the QPHY instance as driver data before enabling runtime PM to prevent NULL pointer dereference in runtime PM callbacks.
Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a short window where an unnecessary runtime suspend can occur.
Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup.
--- drivers/phy/qualcomm/phy-qcom-qusb2.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/phy/qualcomm/phy-qcom-qusb2.c +8 -8
@@ -1063,29 +1063,29 @@ static int qusb2_phy_probe(struct platform_device *pdev) or->hsdisc_trim.override = true; } -pm_runtime_set_active (dev); -pm_runtime_enable (dev); +dev_set_drvdata (dev, qphy); +/* -* Prevent runtime pm from being ON by default. Users can enable -* it using power/control in sysfs. +* Enable runtime PM support, but forbid it by default. +* Users can allow it again via the power/control attribute in sysfs. */ +pm_runtime_set_active (dev);pm_runtime_forbid (dev); + ret =devm_pm_runtime_enable (dev); +if (ret) +return ret; generic_phy =devm_phy_create (dev,NULL , &qusb2_phy_gen_ops);if (IS_ERR (generic_phy)) { ret =PTR_ERR (generic_phy);dev_err (dev,"failed to create phy, %d\n" , ret); -pm_runtime_disable (dev);return ret; } qphy->phy = generic_phy; -dev_set_drvdata (dev, qphy);phy_set_drvdata (generic_phy, qphy); phy_provider =devm_of_phy_provider_register (dev, of_phy_simple_xlate); -if (IS_ERR (phy_provider)) -pm_runtime_disable (dev);return PTR_ERR_OR_ZERO (phy_provider); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/139 phy: stm32-usphyc: Fix off by one in probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit cabd25b57216ddc132efbcc31f972baa03aad15a ]
The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.
--- drivers/phy/st/phy-stm32-usbphyc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/st/phy-stm32-usbphyc.c +1 -1
@@ -712,7 +712,7 @@ static int stm32_usbphyc_probe(struct platform_device *pdev) } ret =of_property_read_u32 (child,"reg" , &index); -if (ret || index > usbphyc->nphys) { +if (ret || index >= usbphyc->nphys) {dev_err (&phy->dev,"invalid reg property: %d\n" , ret);if (!ret) ret = -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/139 phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 08aa19de72110df8ac10c9e67349dd884eeed41d ]
devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value after calling pm_runtime_set_active(), leaving the device in an inconsistent state if runtime PM initialization fails.
Check the return value of devm_pm_runtime_enable() and return on failure. Also move the declaration of 'ret' to the function scope to support this check.
--- drivers/phy/ti/phy-da8xx-usb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/phy/ti/phy-da8xx-usb.c +4 -3
@@ -180,6 +180,7 @@ static int da8xx_usb_phy_probe(struct platform_device *pdev)struct da8xx_usb_phy_platform_data *pdata = dev->platform_data;struct device_node *node = dev->of_node;struct da8xx_usb_phy *d_phy; +int ret; d_phy =devm_kzalloc (dev,sizeof (*d_phy),GFP_KERNEL );if (!d_phy)
@@ -233,8 +234,6 @@ static int da8xx_usb_phy_probe(struct platform_device *pdev)return PTR_ERR (d_phy->phy_provider); } }else { -int ret; - ret =phy_create_lookup (d_phy->usb11_phy,"usb-phy" ,"ohci-da8xx" );if (ret)
@@ -249,7 +248,9 @@ static int da8xx_usb_phy_probe(struct platform_device *pdev) PHY_INIT_BITS, PHY_INIT_BITS);pm_runtime_set_active (dev); -devm_pm_runtime_enable (dev); + ret =devm_pm_runtime_enable (dev); +if (ret) +return ret;/* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/139 selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Buffet <[email protected]>
[ Upstream commit bd09d9a05cf04028f639e209b416bacaeffd4909 ]
The nominal error code for bind(AF_UNSPEC) on an IPv6 socket is -EAFNOSUPPORT, not -EINVAL. -EINVAL is only returned when the supplied address struct is too short, which happens to be the case in current selftests because they treat AF_UNSPEC like IPv4 sockets do: as an alias for AF_INET (which is a 16-byte struct instead of the 24 bytes required by IPv6 sockets).
Make the union large enough for any address (by adding struct sockaddr_storage to the union), and make AF_UNSPEC addresses large enough for any family.
Test for -EAFNOSUPPORT instead, and add a dedicated test case for truncated inputs with -EINVAL.
--- tools/testing/selftests/landlock/common.h | 1 + tools/testing/selftests/landlock/net_test.c | 16 +++++++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-)
tools/testing/selftests/landlock/common.h +1 -0
@@ -249,6 +249,7 @@ struct service_fixture {struct sockaddr_un unix_addr;socklen_t unix_addr_len; }; +struct sockaddr_storage _largest; }; };
tools/testing/selftests/landlock/net_test.c +15 -1
@@ -120,6 +120,10 @@ static socklen_t get_addrlen(const struct service_fixture *const srv, {switch (srv->protocol.domain) {case AF_UNSPEC : +if (minimal) +return sizeof (sa_family_t); +return sizeof (struct sockaddr_storage ); +case AF_INET :return sizeof (srv->ipv4_addr);
@@ -757,6 +761,11 @@ TEST_F(protocol, bind_unspec) bind_fd =socket_variant (&self->srv0);ASSERT_LE (0 , bind_fd); +/* Tries to bind with too small addrlen. */ +EXPECT_EQ (-EINVAL ,bind_variant_addrlen ( + bind_fd, &self->unspec_any0, +get_addrlen (&self->unspec_any0, true) -1 )); +/* Allowed bind on AF_UNSPEC/INADDR_ANY. */ ret =bind_variant (bind_fd, &self->unspec_any0);if (variant->prot.domain ==AF_INET ) {
@@ -765,6 +774,8 @@ TEST_F(protocol, bind_unspec)TH_LOG ("Failed to bind to unspec/any socket: %s" ,strerror (errno)); } + }else if (variant->prot.domain ==AF_INET6 ) { +EXPECT_EQ (-EAFNOSUPPORT , ret); }else {EXPECT_EQ (-EINVAL , ret); }
@@ -791,6 +802,8 @@ TEST_F(protocol, bind_unspec) }else {EXPECT_EQ (0 , ret); } + }else if (variant->prot.domain ==AF_INET6 ) { +EXPECT_EQ (-EAFNOSUPPORT , ret); }else {EXPECT_EQ (-EINVAL , ret); }
@@ -800,7 +813,8 @@ TEST_F(protocol, bind_unspec) bind_fd =socket_variant (&self->srv0);ASSERT_LE (0 , bind_fd); ret =bind_variant (bind_fd, &self->unspec_srv0); -if (variant->prot.domain ==AF_INET ) { +if (variant->prot.domain ==AF_INET || + variant->prot.domain ==AF_INET6 ) {EXPECT_EQ (-EAFNOSUPPORT , ret); }else {EXPECT_EQ (-EINVAL , ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/139 selftests/landlock: Remove invalid unix socket bind()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Buffet <[email protected]>
[ Upstream commit e1a57c33590a50a6639798e60a597af4a23b0340 ]
Remove bind() call on a client socket that doesn't make sense. Since strlen(cli_un.sun_path) returns a random value depending on stack garbage, that many uninitialized bytes are read from the stack as an unix socket address. This creates random test failures due to the bind address being invalid or already in use if the same stack value comes up twice.
--- tools/testing/selftests/landlock/fs_test.c | 3 --- 1 file changed, 3 deletions(-)
tools/testing/selftests/landlock/fs_test.c +0 -3
@@ -4179,9 +4179,6 @@ TEST_F_FORK(layout1, named_unix_domain_socket_ioctl) cli_fd =socket (AF_UNIX ,SOCK_STREAM ,0 );ASSERT_LE (0 , cli_fd); - size = offsetof(struct sockaddr_un , sun_path) +strlen (cli_un.sun_path); -ASSERT_EQ (0 ,bind (cli_fd, (struct sockaddr *)&cli_un, size)); -bzero (&cli_un,sizeof (cli_un)); cli_un.sun_family =AF_UNIX ;strncpy (cli_un.sun_path, path,sizeof (cli_un.sun_path));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/139 phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fb21116099bbea1fc59efa9207e63c4be390ab72 ]
"family" is an enum, thus cast of pointer on 64-bit compile test with clang W=1 causes:
phy-bcm-ns-usb3.c:206:17: error: cast to smaller integer type 'enum bcm_ns_family' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
This was already fixed in commit bd6e74a2f0a0 ("phy: broadcom: ns-usb3:
fix Wvoid-pointer-to-enum-cast warning") but then got bad in commit 21bf6fc47a1e ("phy: Use device_get_match_data()").
Note that after various discussions the preferred cast is via "unsigned long", not "uintptr_t".
--- drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/broadcom/phy-bcm-ns-usb3.c +1 -1
@@ -203,7 +203,7 @@ static int bcm_ns_usb3_mdio_probe(struct mdio_device *mdiodev) usb3->dev = dev; usb3->mdiodev = mdiodev; - usb3->family = (enum bcm_ns_family )device_get_match_data (dev); + usb3->family = (unsigned long )device_get_match_data (dev); syscon_np =of_parse_phandle (dev->of_node,"usb3-dmp-syscon" ,0 ); err =of_address_to_resource (syscon_np,0 , &res);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/139 selftests/landlock: Properly close a file descriptor
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 15e8d739fda1084d81f7d3813e9600eba6e0f134 ]
Add a missing close(srv_fd) call, and use EXPECT_EQ() to check the result.
--- tools/testing/selftests/landlock/fs_test.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/landlock/fs_test.c +2 -1
@@ -4189,7 +4189,8 @@ TEST_F_FORK(layout1, named_unix_domain_socket_ioctl)/* FIONREAD and other IOCTLs should not be forbidden. */ EXPECT_EQ (0 ,test_fionread_ioctl (cli_fd)); -ASSERT_EQ (0 ,close (cli_fd)); +EXPECT_EQ (0 ,close (cli_fd)); +EXPECT_EQ (0 ,close (srv_fd)); }/* clang-format off */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/139 dmaengine: omap-dma: fix dma_pool resource leak in error paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 2e1136acf8a8887c29f52e35a77b537309af321f ]
The dma_pool created by dma_pool_create() is not destroyed when dma_async_device_register() or of_dma_controller_register() fails, causing a resource leak in the probe error paths.
Add dma_pool_destroy() in both error paths to properly release the allocated dma_pool resource.
--- drivers/dma/ti/omap-dma.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/ti/omap-dma.c +4 -0
@@ -1808,6 +1808,8 @@ static int omap_dma_probe(struct platform_device *pdev)if (rc) {pr_warn ("OMAP-DMA: failed to register slave DMA engine device: %d\n" , rc); +if (od->ll123_supported) +dma_pool_destroy (od->desc_pool);omap_dma_free (od);return rc; }
@@ -1823,6 +1825,8 @@ static int omap_dma_probe(struct platform_device *pdev)if (rc) {pr_warn ("OMAP-DMA: failed to register DMA controller\n" );dma_async_device_unregister (&od->ddev); +if (od->ll123_supported) +dma_pool_destroy (od->desc_pool);omap_dma_free (od); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/139 i2c: qcom-geni: make sure I2C hub controllers cant use SE DMA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit c0c50e3743e467ec4752c638e10e97f89c8644e2 ]
The I2C Hub controller is a simpler GENI I2C variant that doesn't support DMA at all, add a no_dma flag to make sure it nevers selects the SE DMA mode with mappable 32bytes long transfers.
--- drivers/i2c/busses/i2c-qcom-geni.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-qcom-geni.c +7 -4
@@ -97,6 +97,7 @@ struct geni_i2c_dev {dma_addr_t dma_addr;struct dma_chan *tx_c;struct dma_chan *rx_c; +bool no_dma;bool gpi_mode;bool abort_done; };
@@ -411,7 +412,7 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,size_t len = msg->len;struct i2c_msg *cur; - dma_buf =i2c_get_dma_safe_msg_buf (msg,32 ); + dma_buf = gi2c->no_dma ?NULL :i2c_get_dma_safe_msg_buf (msg,32 );if (dma_buf)geni_se_select_mode (se,GENI_SE_DMA );else
@@ -450,7 +451,7 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,size_t len = msg->len;struct i2c_msg *cur; - dma_buf =i2c_get_dma_safe_msg_buf (msg,32 ); + dma_buf = gi2c->no_dma ?NULL :i2c_get_dma_safe_msg_buf (msg,32 );if (dma_buf)geni_se_select_mode (se,GENI_SE_DMA );else
@@ -865,10 +866,12 @@ static int geni_i2c_probe(struct platform_device *pdev)return -ENXIO ; } -if (desc && desc->no_dma_support) +if (desc && desc->no_dma_support) { fifo_disable = false; -else + gi2c->no_dma = true; + }else { fifo_disable =readl_relaxed (gi2c->se.base +GENI_IF_DISABLE_RO ) &FIFO_IF_DISABLE ; + }if (fifo_disable) {/* FIFO is disabled, so we can only use GPI DMA */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/139 HID: usbhid: paper over wrong bNumDescriptor field
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit f28beb69c51517aec7067dfb2074e7c751542384 upstream.
Some faulty devices (ZWO EFWmini) have a wrong optional HID class descriptor count compared to the provided length.
Given that we plainly ignore those optional descriptor, we can attempt to fix the provided number so we do not lock out those devices.
--- drivers/hid/usbhid/hid-core.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/hid/usbhid/hid-core.c +16 -1
@@ -985,6 +985,7 @@ static int usbhid_parse(struct hid_devicstruct usb_device *dev =interface_to_usbdev (intf);struct hid_descriptor *hdesc;struct hid_class_descriptor *hcdesc; +__u8 fixed_opt_descriptors_size;u32 quirks =0 ;unsigned int rsize =0 ;char *rdesc;
@@ -1015,7 +1016,21 @@ static int usbhid_parse(struct hid_devic (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) {dbg_hid ("hid descriptor invalid, bLen=%hhu bNum=%hhu\n" , hdesc->bLength, hdesc->bNumDescriptors); -return -EINVAL ; + +/* +* Some devices may expose a wrong number of descriptors compared +* to the provided length. +* However, we ignore the optional hid class descriptors entirely +* so we can safely recompute the proper field. +*/ +if (hdesc->bLength >=sizeof (*hdesc)) { + fixed_opt_descriptors_size = hdesc->bLength -sizeof (*hdesc); + +hid_warn (intf,"fixing wrong optional hid class descriptors count\n" ); + hdesc->bNumDescriptors = fixed_opt_descriptors_size /sizeof (*hcdesc) +1 ; + }else { +return -EINVAL ; + } } hid->version =le16_to_cpu (hdesc->bcdHID);
Greg Kroah-Hartman
maintainerPATCH 60/139 bridge: mcast: Fix use-after-free during router port configuration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
commit 7544f3f5b0b58c396f374d060898b5939da31709 upstream.
The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding to ensure multicast packets are forwarded to these ports even if the ports are not member in the matching MDB entry.
When per-VLAN multicast snooping is enabled, the per-port multicast context is disabled on each port and the port is removed from the global router port list:
# ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1 # ip link set dev br1 type bridge mcast_vlan_snooping 1 $ bridge -d mdb show | grep router
However, the port can be re-added to the global list even when per-VLAN multicast snooping is enabled:
# ip link set dev dummy1 type bridge_slave mcast_router 0 # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1
Since commit 4b30ae9adb04 ("net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions"), when per-VLAN multicast snooping is enabled, multicast disablement on a port will disable the per-{port, VLAN} multicast contexts and not the per-port one. As a result, a port will remain in the global router port list even after it is deleted. This will lead to a use-after-free [1] when the list is traversed (when adding a new port to the list, for example):
# ip link del dev dummy1 # ip link add name dummy2 up master br1 type dummy # ip link set dev dummy2 type bridge_slave mcast_router 2
Similarly, stale entries can also be found in the per-VLAN router port list. When per-VLAN multicast snooping is disabled, the per-{port, VLAN} contexts are disabled on each port and the port is removed from the per-VLAN router port list:
# ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1
# ip link add name dummy1 up master br1 type dummy
# bridge vlan add vid 2 dev dummy1
# bridge vlan global set vid 2 dev br1 mcast_snooping 1
# bridge vlan set vid 2 dev dummy1 mcast_router 2
$ bridge vlan global show dev br1 vid 2 | grep router
router ports: dummy1
# ip link set dev br1 type bridge mcast_vlan_snooping 0
$ bridge vlan global show dev br1 vid 2 | grep routerHowever, the port can be re-added to the per-VLAN list even when per-VLAN multicast snooping is disabled:
# bridge vlan set vid 2 dev dummy1 mcast_router 0
# bridge vlan set vid 2 dev dummy1 mcast_router 2
$ bridge vlan global show dev br1 vid 2 | grep router
router ports: dummy1When the VLAN is deleted from the port, the per-{port, VLAN} multicast context will not be disabled since multicast snooping is not enabled on the VLAN. As a result, the port will remain in the per-VLAN router port list even after it is no longer member in the VLAN. This will lead to a use-after-free [2] when the list is traversed (when adding a new port to the list, for example):
# ip link add name dummy2 up master br1 type dummy # bridge vlan add vid 2 dev dummy2 # bridge vlan del vid 2 dev dummy1 # bridge vlan set vid 2 dev dummy2 mcast_router 2
Fix these issues by removing the port from the relevant (global or per-VLAN) router port list in br_multicast_port_ctx_deinit(). The function is invoked during port deletion with the per-port multicast context and during VLAN deletion with the per-{port, VLAN} multicast context.
Note that deleting the multicast router timer is not enough as it only takes care of the temporary multicast router states (1 or 3) and not the permanent one (2).
[1]
BUG: KASAN: slab-out-of-bounds in br_multicast_add_router.part.0+0x3f1/0x560 Write of size 8 at addr ffff888004a67328 by task ip/384 [...] Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x6f/0x350 print_report+0x108/0x205 kasan_report+0xdf/0x110 br_multicast_add_router.part.0+0x3f1/0x560 br_multicast_set_port_router+0x74e/0xac0 br_setport+0xa55/0x1870 br_port_slave_changelink+0x95/0x120 __rtnl_newlink+0x5e8/0xa40 rtnl_newlink+0x627/0xb00 rtnetlink_rcv_msg+0x6fb/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x124/0x1c0 do_syscall_64+0xbb/0x360 entry_SYSCALL_64_after_hwframe+0x4b/0x53
[2]
BUG: KASAN: slab-use-after-free in br_multicast_add_router.part.0+0x378/0x560 Read of size 8 at addr ffff888009f00840 by task bridge/391 [...] Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x6f/0x350 print_report+0x108/0x205 kasan_report+0xdf/0x110 br_multicast_add_router.part.0+0x378/0x560 br_multicast_set_port_router+0x6f9/0xac0 br_vlan_process_options+0x8b6/0x1430 br_vlan_rtm_process_one+0x605/0xa30 br_vlan_rtm_process+0x396/0x4c0 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x124/0x1c0 do_syscall_64+0xbb/0x360 entry_SYSCALL_64_after_hwframe+0x4b/0x53
--- net/bridge/br_multicast.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/bridge/br_multicast.c +9 -0
@@ -2014,10 +2014,19 @@ void br_multicast_port_ctx_init(struct nvoid br_multicast_port_ctx_deinit (struct net_bridge_mcast_port *pmctx) { +struct net_bridge *br = pmctx->port->br; +bool del = false; +#if IS_ENABLED (CONFIG_IPV6 )del_timer_sync (&pmctx->ip6_mc_router_timer);#endif del_timer_sync (&pmctx->ip4_mc_router_timer); + +spin_lock_bh (&br->multicast_lock); + del |=br_ip6_multicast_rport_del (pmctx); + del |=br_ip4_multicast_rport_del (pmctx); +br_multicast_rport_del_notify (pmctx, del); +spin_unlock_bh (&br->multicast_lock); }int br_multicast_add_port (struct net_bridge_port *port)
Greg Kroah-Hartman
maintainerPATCH 61/139 ASoC: codecs: wsa883x: fix unnecessary initialisation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 49aadf830eb048134d33ad7329d92ecff45d8dbb upstream.
The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED.
This avoids repeated initialisation of the codecs during boot of machines like the Lenovo ThinkPad X13s:
[ 11.614523] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.618022] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.621377] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.624065] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.631382] wsa883x-codec sdw:1:0:0217:0202:00:2: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.634424] wsa883x-codec sdw:1:0:0217:0202:00:2: WSA883X Version 1_1, Variant: WSA8835_V2
--- sound/soc/codecs/wsa883x.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/codecs/wsa883x.c +9 -0
@@ -441,6 +441,7 @@ struct wsa883x_priv {int active_ports;int dev_mode;int comp_offset; +bool hw_init; };enum {
@@ -1002,6 +1003,9 @@ static int wsa883x_init(struct wsa883x_pstruct regmap *regmap = wsa883x->regmap;int variant, version, ret; +if (wsa883x->hw_init) +return 0 ; + ret =regmap_read (regmap,WSA883X_OTP_REG_0 , &variant);if (ret)return ret;
@@ -1044,6 +1048,8 @@ static int wsa883x_init(struct wsa883x_p wsa883x->comp_offset); } + wsa883x->hw_init = true; +return 0 ; }
@@ -1052,6 +1058,9 @@ static int wsa883x_update_status(struct {struct wsa883x_priv *wsa883x =dev_get_drvdata (&slave->dev); +if (status ==SDW_SLAVE_UNATTACHED ) + wsa883x->hw_init = false; +if (status ==SDW_SLAVE_ATTACHED && slave->dev_num >0 )return wsa883x_init (wsa883x);
Greg Kroah-Hartman
maintainerPATCH 62/139 drm/amd/display: mark static functions noinline_for_stack
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
commit a8d42cd228ec41ad99c50a270db82f0dd9127a28 upstream.
When compiling allmodconfig (CONFIG_WERROR=y) with clang-19, see the following errors:
.../display/dc/dml2/display_mode_core.c:6268:13: warning: stack frame size (3128) exceeds limit (3072) in 'dml_prefetch_check' [-Wframe-larger-than] .../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:7236:13: warning: stack frame size (3256) exceeds limit (3072) in 'dml_core_mode_support' [-Wframe-larger-than]
Mark static functions called by dml_prefetch_check() and dml_core_mode_support() noinline_for_stack to avoid them become huge functions and thus exceed the frame size limit.
A way to reproduce:
$ git checkout next-20250107 $ mkdir build_dir $ export PATH=/tmp/llvm-19.1.6-x86_64/bin:$PATH $ make LLVM=1 O=build_dir allmodconfig $ make LLVM=1 O=build_dir drivers/gpu/drm/ -j
The way how it chose static functions to mark:
[0] Unset CONFIG_WERROR in build_dir/.config.
To get display_mode_core.o without errors.
[1] Get a function list called by dml_prefetch_check().
$ sed -n '6268,6711p' drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c \ | sed -n -r 's/.*\W(\w+)\(.*/\1/p' | sort -u >/tmp/syms
[2] Get the non-inline function list.
Objdump won't show the symbols if they are inline functions.
$ make LLVM=1 O=build_dir drivers/gpu/drm/ -j $ objdump -d build_dir/.../display_mode_core.o | \ ./scripts/checkstack.pl x86_64 0 | \ grep -f /tmp/syms | cut -d' ' -f2- >/tmp/orig
[3] Get the full function list.
Append "-fno-inline" to CFLAGS_.../display_mode_core.o in drivers/gpu/drm/amd/display/dc/dml2/Makefile.
$ make LLVM=1 O=build_dir drivers/gpu/drm/ -j $ objdump -d build_dir/.../display_mode_core.o | \ ./scripts/checkstack.pl x86_64 0 | \ grep -f /tmp/syms | cut -d' ' -f2- >/tmp/noinline
[4] Get the inline function list.
If a symbol only in /tmp/noinline but not in /tmp/orig, it is a good candidate to mark noinline.
$ diff /tmp/orig /tmp/noinline
Chosen functions and their stack sizes:
CalculateBandwidthAvailableForImmediateFlip [display_mode_core.o]:144 CalculateExtraLatency [display_mode_core.o]:176 CalculateTWait [display_mode_core.o]:64 CalculateVActiveBandwithSupport [display_mode_core.o]:112 set_calculate_prefetch_schedule_params [display_mode_core.o]:48
CheckGlobalPrefetchAdmissibility [dml2_core_dcn4_calcs.o]:544 calculate_bandwidth_available [dml2_core_dcn4_calcs.o]:320 calculate_vactive_det_fill_latency [dml2_core_dcn4_calcs.o]:272 CalculateDCFCLKDeepSleep [dml2_core_dcn4_calcs.o]:208 CalculateODMMode [dml2_core_dcn4_calcs.o]:208 CalculateOutputLink [dml2_core_dcn4_calcs.o]:176
--- drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 12 +++++----- drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 8 +++--- 2 files changed, 10 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c +6 -6
@@ -1736,7 +1736,7 @@ static void CalculateBytePerPixelAndBloc#endif }// CalculateBytePerPixelAndBlockSizes -static dml_float_t CalculateTWait( +static noinline_for_stack dml_float_t CalculateTWait( dml_uint_t PrefetchMode, enum dml_use_mall_for_pstate_change_mode UseMALLForPStateChange, dml_bool_t SynchronizeDRRDisplaysForUCLKPStateChangeFinal,
@@ -4458,7 +4458,7 @@ static void CalculateSwathWidth( } }// CalculateSwathWidth -static dml_float_t CalculateExtraLatency( +static noinline_for_stack dml_float_t CalculateExtraLatency( dml_uint_t RoundTripPingLatencyCycles, dml_uint_t ReorderingBytes, dml_float_t DCFCLK,
@@ -5915,7 +5915,7 @@ static dml_uint_t DSCDelayRequirement(return DSCDelayRequirement_val; } -static dml_bool_t CalculateVActiveBandwithSupport(dml_uint_t NumberOfActiveSurfaces, +static noinline_for_stack dml_bool_t CalculateVActiveBandwithSupport(dml_uint_t NumberOfActiveSurfaces, dml_float_t ReturnBW, dml_bool_t NotUrgentLatencyHiding[], dml_float_t ReadBandwidthLuma[],
@@ -6019,7 +6019,7 @@ static void CalculatePrefetchBandwithSup#endif } -static dml_float_t CalculateBandwidthAvailableForImmediateFlip( +static noinline_for_stack dml_float_t CalculateBandwidthAvailableForImmediateFlip( dml_uint_t NumberOfActiveSurfaces, dml_float_t ReturnBW, dml_float_t ReadBandwidthLuma[],
@@ -6213,7 +6213,7 @@ static dml_uint_t CalculateMaxVStartup(return max_vstartup_lines; } -static void set_calculate_prefetch_schedule_params (struct display_mode_lib_st *mode_lib, +static noinline_for_stack void set_calculate_prefetch_schedule_params(struct display_mode_lib_st *mode_lib,struct CalculatePrefetchSchedule_params_st *CalculatePrefetchSchedule_params,dml_uint_t j,dml_uint_t k)
@@ -6265,7 +6265,7 @@ static void set_calculate_prefetch_sched CalculatePrefetchSchedule_params->Tno_bw = &mode_lib->ms.Tno_bw[k]; } -static void dml_prefetch_check (struct display_mode_lib_st *mode_lib) +static noinline_for_stack void dml_prefetch_check(struct display_mode_lib_st *mode_lib) {struct dml_core_mode_support_locals_st *s = &mode_lib->scratch.dml_core_mode_support_locals;struct CalculatePrefetchSchedule_params_st *CalculatePrefetchSchedule_params = &mode_lib->scratch.CalculatePrefetchSchedule_params;
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c +4 -4
@@ -2774,7 +2774,7 @@ static double dml_get_return_bandwidth_areturn return_bw_mbps; } -static void calculate_bandwidth_available( +static noinline_for_stack void calculate_bandwidth_available( double avg_bandwidth_available_min[dml2_core_internal_soc_state_max], double avg_bandwidth_available[dml2_core_internal_soc_state_max][dml2_core_internal_bw_max], double urg_bandwidth_available_min[dml2_core_internal_soc_state_max], // min between SDP and DRAM
@@ -4066,7 +4066,7 @@ static bool ValidateODMMode(enum dml2_odreturn true; } -static void CalculateODMMode( +static noinline_for_stack void CalculateODMMode( unsigned int MaximumPixelsPerLinePerDSCUnit, unsigned int HActive, enum dml2_output_format_class OutFormat,
@@ -4164,7 +4164,7 @@ static void CalculateODMMode(#endif } -static void CalculateOutputLink( +static noinline_for_stack void CalculateOutputLink( struct dml2_core_internal_scratch *s, double PHYCLK, double PHYCLKD18,
@@ -6731,7 +6731,7 @@ static void calculate_bytes_to_fetch_req } } -static void calculate_vactive_det_fill_latency( +static noinline_for_stack void calculate_vactive_det_fill_latency( const struct dml2_display_cfg *display_cfg, unsigned int num_active_planes, unsigned int bytes_required_l[],
Greg Kroah-Hartman
maintainerPATCH 63/139 io_uring: move local task_work in exit cancel loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit da579f05ef0faada3559e7faddf761c75cdf85e1 upstream.
With IORING_SETUP_DEFER_TASKRUN, task work is queued to ctx->work_llist (local work) rather than the fallback list. During io_ring_exit_work(), io_move_task_work_from_local() was called once before the cancel loop, moving work from work_llist to fallback_llist.
However, task work can be added to work_llist during the cancel loop itself. There are two cases:
1) io_kill_timeouts() is called from io_uring_try_cancel_requests() to cancel pending timeouts, and it adds task work via io_req_queue_tw_complete() for each cancelled timeout:
2) URING_CMD requests like ublk can be completed via io_uring_cmd_complete_in_task() from ublk_queue_rq() during canceling, given ublk request queue is only quiesced when canceling the 1st uring_cmd.
Since io_allowed_defer_tw_run() returns false in io_ring_exit_work() (kworker != submitter_task), io_run_local_work() is never invoked, and the work_llist entries are never processed. This causes io_uring_try_cancel_requests() to loop indefinitely, resulting in 100% CPU usage in kworker threads.
Fix this by moving io_move_task_work_from_local() inside the cancel loop, ensuring any work on work_llist is moved to fallback before each cancel attempt.
--- io_uring/io_uring.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
io_uring/io_uring.c +4 -4
@@ -2904,11 +2904,11 @@ static __cold void io_ring_exit_work(strmutex_unlock (&ctx->uring_lock); } -if (ctx->flags &IORING_SETUP_DEFER_TASKRUN ) -io_move_task_work_from_local (ctx); - -while (io_uring_try_cancel_requests (ctx,NULL , true)) +do { +if (ctx->flags &IORING_SETUP_DEFER_TASKRUN ) +io_move_task_work_from_local (ctx);cond_resched (); + }while (io_uring_try_cancel_requests (ctx,NULL , true));if (ctx->sq_data) {struct io_sq_data *sqd = ctx->sq_data;
Greg Kroah-Hartman
maintainerPATCH 64/139 scsi: core: Fix error handler encryption support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Kao <[email protected]>
commit 9a49157deeb23581fc5c8189b486340d7343264a upstream.
Some low-level drivers (LLD) access block layer crypto fields, such as rq->crypt_keyslot and rq->crypt_ctx within struct request, to configure hardware for inline encryption. However, SCSI Error Handling (EH) commands (e.g., TEST UNIT READY, START STOP UNIT) should not involve any encryption setup.
To prevent drivers from erroneously applying crypto settings during EH, this patch saves the original values of rq->crypt_keyslot and rq->crypt_ctx before an EH command is prepared via scsi_eh_prep_cmnd(). These fields in the 'struct request' are then set to NULL. The original values are restored in scsi_eh_restore_cmnd() after the EH command completes.
This ensures that the block layer crypto context does not leak into EH command execution.
--- drivers/scsi/scsi_error.c | 24 ++++++++++++++++++++++++ include/scsi/scsi_eh.h | 6 ++++++ 2 files changed, 30 insertions(+)
drivers/scsi/scsi_error.c +24 -0
@@ -1040,6 +1040,9 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd unsigned char *cmnd, int cmnd_size, unsigned sense_bytes) { struct scsi_device *sdev = scmd->device; +#ifdef CONFIG_BLK_INLINE_ENCRYPTION +struct request *rq =scsi_cmd_to_rq (scmd); +#endif /* * We need saved copies of a number of fields - this is because
@@ -1092,6 +1095,18 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd (sdev->lun <<5 &0xe0 );/* +* Encryption must be disabled for the commands submitted by the error handler. +* Hence, clear the encryption context information. +*/ +#ifdef CONFIG_BLK_INLINE_ENCRYPTION + ses->rq_crypt_keyslot = rq->crypt_keyslot; + ses->rq_crypt_ctx = rq->crypt_ctx; + + rq->crypt_keyslot =NULL ; + rq->crypt_ctx =NULL ; +#endif + +/* * Zero the sense buffer. The scsi spec mandates that any * untransferred sense data should be interpreted as being zero. */
@@ -1108,6 +1123,10 @@ EXPORT_SYMBOL(scsi_eh_prep_cmnd);*/ void scsi_eh_restore_cmnd (struct scsi_cmnd * scmd,struct scsi_eh_save *ses) { +#ifdef CONFIG_BLK_INLINE_ENCRYPTION +struct request *rq =scsi_cmd_to_rq (scmd); +#endif +/* * Restore original data */
@@ -1120,6 +1139,11 @@ void scsi_eh_restore_cmnd(struct scsi_cm scmd->underflow = ses->underflow; scmd->prot_op = ses->prot_op; scmd->eh_eflags = ses->eh_eflags; + +#ifdef CONFIG_BLK_INLINE_ENCRYPTION + rq->crypt_keyslot = ses->rq_crypt_keyslot; + rq->crypt_ctx = ses->rq_crypt_ctx; +#endif }EXPORT_SYMBOL (scsi_eh_restore_cmnd);
include/scsi/scsi_eh.h +6 -0
@@ -41,6 +41,12 @@ struct scsi_eh_save {unsigned char cmnd[32 ];struct scsi_data_buffer sdb;struct scatterlist sense_sgl; + +/* struct request fields */ +#ifdef CONFIG_BLK_INLINE_ENCRYPTION +struct bio_crypt_ctx *rq_crypt_ctx; +struct blk_crypto_keyslot *rq_crypt_keyslot; +#endif }; extern void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd,
Greg Kroah-Hartman
maintainerPATCH 65/139 ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <[email protected]>
commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 upstream.
Handle the error code from snd_pcm_buffer_access_lock() in snd_pcm_runtime_buffer_set_silence() function.
Found by Alexandros Panagiotou <[email protected]>
--- include/sound/pcm.h | 2 +- sound/core/oss/pcm_oss.c | 4 +++- sound/core/pcm_native.c | 9 +++++++-- 3 files changed, 11 insertions(+), 4 deletions(-)
include/sound/pcm.h +1 -1
@@ -1428,7 +1428,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc#define snd_pcm_lib_mmap_iomem NULL#endif -void snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime); +int snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime);/** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
sound/core/oss/pcm_oss.c +3 -1
@@ -1074,7 +1074,9 @@ static int snd_pcm_oss_change_params_loc runtime->oss.params =0 ; runtime->oss.prepare =1 ; runtime->oss.buffer_used =0 ; -snd_pcm_runtime_buffer_set_silence (runtime); + err =snd_pcm_runtime_buffer_set_silence (runtime); +if (err <0 ) + goto failure; runtime->oss.period_frames =snd_pcm_alsa_frames (substream, oss_period_size);
sound/core/pcm_native.c +7 -2
@@ -730,13 +730,18 @@ static void snd_pcm_buffer_access_unlock }/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ -void snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime) +int snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime) { -snd_pcm_buffer_access_lock (runtime); +int err; + + err =snd_pcm_buffer_access_lock (runtime); +if (err <0 ) +return err;if (runtime->dma_area)snd_pcm_format_set_silence (runtime->format, runtime->dma_area,bytes_to_samples (runtime, runtime->dma_bytes));snd_pcm_buffer_access_unlock (runtime); +return 0 ; }EXPORT_SYMBOL_GPL (snd_pcm_runtime_buffer_set_silence);
Greg Kroah-Hartman
maintainerPATCH 66/139 null_blk: fix kmemleak by releasing references to fault configfs items
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
commit 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5 upstream.
When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk driver sets up fault injection support by creating the timeout_inject, requeue_inject, and init_hctx_fault_inject configfs items as children of the top-level nullbX configfs group.
However, when the nullbX device is removed, the references taken to these fault-config configfs items are not released. As a result, kmemleak reports a memory leak, for example:
unreferenced object 0xc00000021ff25c40 (size 32):
comm "mkdir", pid 10665, jiffies 4322121578
hex dump (first 32 bytes):
69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f init_hctx_fault_
69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject..........
backtrace (crc 1a018c86):
__kmalloc_node_track_caller_noprof+0x494/0xbd8
kvasprintf+0x74/0xf4
config_item_set_name+0xf0/0x104
config_group_init_type_name+0x48/0xfc
fault_config_init+0x48/0xf0
0xc0080000180559e4
configfs_mkdir+0x304/0x814
vfs_mkdir+0x49c/0x604
do_mkdirat+0x314/0x3d0
sys_mkdir+0xa0/0xd8
system_call_exception+0x1b0/0x4f0
system_call_vectored_common+0x15c/0x2ecFix this by explicitly releasing the references to the fault-config configfs items when dropping the reference to the top-level nullbX configfs group.
--- drivers/block/null_blk/main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/block/null_blk/main.c +11 -1
@@ -655,12 +655,22 @@ static void nullb_add_fault_config(strucconfigfs_add_default_group (&dev->init_hctx_fault_config.group, &dev->group); } +static void nullb_del_fault_config (struct nullb_device *dev) +{ +config_item_put (&dev->init_hctx_fault_config.group.cg_item); +config_item_put (&dev->requeue_config.group.cg_item); +config_item_put (&dev->timeout_config.group.cg_item); +} +#else static void nullb_add_fault_config (struct nullb_device *dev) { } +static void nullb_del_fault_config (struct nullb_device *dev) +{ +}#endif static struct
@@ -692,7 +702,7 @@ nullb_group_drop_item(struct config_grounull_del_dev (dev->nullb);mutex_unlock (&lock); } - +nullb_del_fault_config (dev);config_item_put (item); }
Greg Kroah-Hartman
maintainerPATCH 67/139 can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 7352e1d5932a0e777e39fa4b619801191f57e603 upstream.
In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close().
Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.
--- drivers/net/can/usb/gs_usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/can/usb/gs_usb.c +2 -0
@@ -748,6 +748,8 @@ resubmit_urb: hf, parent->hf_size_rx, gs_usb_receive_bulk_callback, parent); +usb_anchor_urb (urb, &parent->rx_submitted); + rc =usb_submit_urb (urb,GFP_ATOMIC );/* USB failure take down all interfaces */
Greg Kroah-Hartman
maintainerPATCH 68/139 can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Ille <[email protected]>
commit e707c591a139d1bfa4ddc83036fc820ca006a140 upstream.
The Secondary Sample Point Source field has been set to an incorrect value by some mistake in the past
0b01 - SSP_SRC_NO_SSP - SSP is not used.
for data bitrates above 1 MBit/s. The correct/default value already used for lower bitrates is
0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY
(Measured Transmitter delay) + SSP_OFFSET.
The related configuration register structure is described in section 3.1.46 SSP_CFG of the CTU CAN FD
IP CORE Datasheet.
The analysis leading to the proper configuration is described in section 2.8.3 Secondary sampling point of the datasheet.
The change has been tested on AMD/Xilinx Zynq with the next CTU CN FD IP core versions:
- 2.6 aka master in the "integration with Zynq-7000 system" test 6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git driver (change already included in the driver repo)
- older 2.5 snapshot with mainline kernels with this patch applied locally in the multiple CAN latency tester nightly runs 6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT
6.19.0-rc3-dut
The logs, the datasheet and sources are available at
https://canbus.pages.fel.cvut.cz/
--- drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/ctucanfd/ctucanfd_base.c +1 -1
@@ -310,7 +310,7 @@ static int ctucan_set_secondary_sample_p } ssp_cfg =FIELD_PREP (REG_TRV_DELAY_SSP_OFFSET , ssp_offset); - ssp_cfg |=FIELD_PREP (REG_TRV_DELAY_SSP_SRC ,0x1 ); + ssp_cfg |=FIELD_PREP (REG_TRV_DELAY_SSP_SRC ,0x0 ); }ctucan_write32 (priv,CTUCANFD_TRV_DELAY , ssp_cfg);
Greg Kroah-Hartman
maintainerPATCH 69/139 net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 1809c82aa073a11b7d335ae932d81ce51a588a4a upstream.
Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when the timer is enabled, we need to call j1939_session_deactivate_activate_next() if we cancelled the timer. Otherwise, refcount for j1939_session leaks, which will later appear as
| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.
problem.
--- net/can/j1939/transport.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/can/j1939/transport.c +9 -1
@@ -1699,8 +1699,16 @@ static int j1939_xtp_rx_rts_session_actij1939_session_timers_cancel (session);j1939_session_cancel (session,J1939_XTP_ABORT_BUSY ); -if (session->transmission) +if (session->transmission) {j1939_session_deactivate_activate_next (session); + }else if (session->state ==J1939_SESSION_WAITING_ABORT ) { +/* Force deactivation for the receiver. +* If we rely on the timer starting in j1939_session_cancel, +* a second RTS call here will cancel that timer and fail +* to restart it because the state is already WAITING_ABORT. +*/ +j1939_session_deactivate_activate_next (session); + }return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 70/139 xfs: Fix the return value of xfs_rtcopy_summary()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirjhar Roy (IBM) <[email protected]>
commit 6b2d155366581705a848833a9b626bfea41d5a8d upstream.
xfs_rtcopy_summary() should return the appropriate error code instead of always returning 0. The caller of this function which is xfs_growfs_rt_bmblock() is already handling the error.
--- fs/xfs/xfs_rtalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/xfs_rtalloc.c +1 -1
@@ -118,7 +118,7 @@ xfs_rtcopy_summary( error =0 ; out:xfs_rtbuf_cache_relse (oargs); -return 0 ; +return error; }/* * Mark an extent specified by start and len allocated.
Greg Kroah-Hartman
maintainerPATCH 71/139 lib/buildid: use __kernel_read() for sleepable context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shakeel Butt <[email protected]>
commit 777a8560fd29738350c5094d4166fe5499452409 upstream.
Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio".
For the sleepable context, convert freader to use __kernel_read() instead of direct page cache access via read_cache_folio(). This simplifies the faultable code path by using the standard kernel file reading interface which handles all the complexity of reading file data.
At the moment we are not changing the code for non-sleepable context which uses filemap_get_folio() and only succeeds if the target folios are already in memory and up-to-date. The reason is to keep the patch simple and easier to backport to stable kernels.
Syzbot repro does not crash the kernel anymore and the selftests run successfully.
In the follow up we will make __kernel_read() with IOCB_NOWAIT work for non-sleepable contexts. In addition, I would like to replace the secretmem check with a more generic approach and will add fstest for the buildid code.
--- lib/buildid.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-)
lib/buildid.c +20 -12
@@ -5,6 +5,7 @@#include <linux/elf.h> #include <linux/kernel.h> #include <linux/pagemap.h> +#include <linux/fs.h> #include <linux/secretmem.h> #define BUILD_ID 3
@@ -65,20 +66,9 @@ static int freader_get_folio(struct freafreader_put_folio (r); -/* reject secretmem folios created with memfd_secret() */ -if (secretmem_mapping (r->file->f_mapping)) -return -EFAULT ; - +/* only use page cache lookup - fail if not already cached */ r->folio =filemap_get_folio (r->file->f_mapping, file_off >>PAGE_SHIFT ); -/* if sleeping is allowed, wait for the page, if necessary */ -if (r->may_fault && (IS_ERR (r->folio) || !folio_test_uptodate (r->folio))) { -filemap_invalidate_lock_shared (r->file->f_mapping); - r->folio =read_cache_folio (r->file->f_mapping, file_off >>PAGE_SHIFT , -NULL , r->file); -filemap_invalidate_unlock_shared (r->file->f_mapping); - } -if (IS_ERR (r->folio) || !folio_test_uptodate (r->folio)) {if (!IS_ERR (r->folio))folio_put (r->folio);
@@ -116,6 +106,24 @@ static const void *freader_fetch(structreturn r->data + file_off; } +/* reject secretmem folios created with memfd_secret() */ +if (secretmem_mapping (r->file->f_mapping)) { + r->err = -EFAULT ; +return NULL ; + } + +/* use __kernel_read() for sleepable context */ +if (r->may_fault) { +ssize_t ret; + + ret =__kernel_read (r->file, r->buf, sz, &file_off); +if (ret != sz) { + r->err = (ret <0 ) ? ret : -EIO ; +return NULL ; + } +return r->buf; + } +/* fetch or reuse folio for given file offset */ r->err =freader_get_folio (r, file_off);if (r->err)
Greg Kroah-Hartman
maintainerPATCH 72/139 x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 upstream.
Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems") is too narrow. The effect being mitigated in that commit is caused by ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general, lets any physical address be added to the direct-map. I.e. not only ACPI hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases.
Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of this problem is limited to the PCI_P2PDMA=n case.
A potential path to recover entropy would be to walk ACPI and determine the limits for hotplug and PCI MMIO before kernel_randomize_memory(). On smaller systems that could yield some KASLR address bits. This needs additional investigation to determine if some limited ACPI table scanning can happen this early without an open coded solution like arch/x86/boot/compressed/acpi.c needs to deploy.
--- arch/x86/mm/kaslr.c | 10 +++++----- drivers/pci/Kconfig | 6 ------ mm/Kconfig | 10 +++++++--- 3 files changed, 12 insertions(+), 14 deletions(-)
arch/x86/mm/kaslr.c +5 -5
@@ -111,12 +111,12 @@ void __init kernel_randomize_memory(void/* * Adapt physical memory region size based on available memory, -* except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the -* device BAR space assuming the direct map space is large enough -* for creating a ZONE_DEVICE mapping in the direct map corresponding -* to the physical BAR address. +* except when CONFIG_ZONE_DEVICE is enabled. ZONE_DEVICE wants to map +* any physical address into the direct-map. KASLR wants to reliably +* steal some physical address bits. Those design choices are in direct +* conflict. */ -if (!IS_ENABLED (CONFIG_PCI_P2PDMA ) && (memory_tb < kaslr_regions[0 ].size_tb)) +if (!IS_ENABLED (CONFIG_ZONE_DEVICE ) && (memory_tb < kaslr_regions[0 ].size_tb)) kaslr_regions[0 ].size_tb = memory_tb;/*
drivers/pci/Kconfig +0 -6
@@ -194,12 +194,6 @@ config PCI_P2PDMA P2P DMA transactions must be between devices behind the same root port. - Enabling this option will reduce the entropy of x86 KASLR memory - regions. For example - on a 46 bit system, the entropy goes down - from 16 bits to 15 bits. The actual reduction in entropy depends - on the physical address bits, on processor features, kernel config - (5 level page table) and physical memory present on the system. - If unsure, say N. config PCI_LABEL
mm/Kconfig +7 -3
@@ -1071,10 +1071,14 @@ config ZONE_DEVICE Device memory hotplug support allows for establishing pmem, or other device driver discovered memory regions, in the memmap. This allows pfn_to_page() lookups of otherwise - "device-physical" addresses which is needed for using a DAX - mapping in an O_DIRECT operation, among other things. + "device-physical" addresses which is needed for DAX, PCI_P2PDMA, and + DEVICE_PRIVATE features among others. - If FS_DAX is enabled, then say Y. + Enabling this option will reduce the entropy of x86 KASLR memory + regions. For example - on a 46 bit system, the entropy goes down + from 16 bits to 15 bits. The actual reduction in entropy depends + on the physical address bits, on processor features, kernel config + (5 level page table) and physical memory present on the system. # # Helpers to mirror range of the CPU page tables of a process into device page
Greg Kroah-Hartman
maintainerPATCH 73/139 phy: rockchip: inno-usb2: fix communication disruption in gadget mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
commit 7d8f725b79e35fa47e42c88716aad8711e1168d8 upstream.
When the OTG USB port is used to power to SoC, configured as peripheral and used in gadget mode, communication stops without notice about 6 seconds after the gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs.
The related code flow in the PHY driver code can be summarized as:
* the first time chg_detect_work starts (6 seconds after gadget is configured and enumerated)
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y]
* rockchip_chg_detect_work() changes state and re-triggers itself a few times until it reaches the DETECTED state:
-> rockchip_chg_detect_work():
if chg_state is DETECTED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z]
At [Y] all existing communications stop. E.g. using a CDC serial gadget, the /dev/tty* devices are still present on both host and device, but no data is transferred anymore. The later call with a 'true' argument at [Z] does not restore it.
Due to the lack of documentation, what chg_det.opmode does exactly is not clear, however by code inspection it seems reasonable that is disables something needed to keep the communication working, and testing proves that disabling these lines lets gadget mode keep working. So prevent changes to chg_det.opmode when there is a cable connected (VBUS present).
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +4 -2
@@ -815,7 +815,8 @@ static void rockchip_chg_detect_work(strif (!rport->suspended)rockchip_usb2phy_power_off (rport->phy);/* put the controller in non-driving mode */ -property_enable (base, &rphy->phy_cfg->chg_det.opmode, false); +if (!vbus_attach) +property_enable (base, &rphy->phy_cfg->chg_det.opmode, false);/* Start DCD processing stage 1 */ rockchip_chg_enable_dcd (rphy, true); rphy->chg_state =USB_CHG_STATE_WAIT_FOR_DCD ;
@@ -878,7 +879,8 @@ static void rockchip_chg_detect_work(str fallthrough;case USB_CHG_STATE_DETECTED :/* put the controller in normal mode */ -property_enable (base, &rphy->phy_cfg->chg_det.opmode, true); +if (!vbus_attach) +property_enable (base, &rphy->phy_cfg->chg_det.opmode, true);rockchip_usb2phy_otg_sm_work (&rport->otg_sm_work.work);dev_dbg (&rport->phy->dev,"charger = %s\n" ,chg_to_string (rphy->chg_type));
Greg Kroah-Hartman
maintainerPATCH 74/139 phy: ti: gmii-sel: fix regmap leak on probe failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4914d67da947031d6f645c81c74f7879e0844d5d upstream.
The mmio regmap that may be allocated during probe is never freed.
Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind.
--- drivers/phy/ti/phy-gmii-sel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/ti/phy-gmii-sel.c +1 -1
@@ -480,7 +480,7 @@ static int phy_gmii_sel_probe(struct plareturn dev_err_probe (dev,PTR_ERR (base),"failed to get base memory resource\n" ); - priv->regmap =regmap_init_mmio (dev, base, &phy_gmii_sel_regmap_cfg); + priv->regmap =devm_regmap_init_mmio (dev, base, &phy_gmii_sel_regmap_cfg);if (IS_ERR (priv->regmap))return dev_err_probe (dev,PTR_ERR (priv->regmap),"Failed to get syscon\n" );
Greg Kroah-Hartman
maintainerPATCH 75/139 phy: freescale: imx8m-pcie: assert phy reset during power on
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Beims <[email protected]>
commit f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 upstream.
After U-Boot initializes PCIe with "pcie enum", Linux fails to detect an NVMe disk on some boot cycles with:
phy phy-32f00000.pcie-phy.0: phy poweron failed --> -110
Discussion with NXP identified that the iMX8MP PCIe PHY PLL may fail to lock when re-initialized without a reset cycle [1].
The issue reproduces on 7% of tested hardware platforms, with a 30-40% failure rate per affected device across boot cycles.
Insert a reset cycle in the power-on routine to ensure the PHY is initialized from a known state.
--- drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/phy/freescale/phy-fsl-imx8m-pcie.c +2 -1
@@ -89,7 +89,8 @@ static int imx8_pcie_phy_power_on(structwritel (imx8_phy->tx_deemph_gen2, imx8_phy->base +PCIE_PHY_TRSV_REG6 );break ; -case IMX8MP :/* Do nothing. */ +case IMX8MP : +reset_control_assert (imx8_phy->reset);break ; }
Greg Kroah-Hartman
maintainerPATCH 76/139 phy: rockchip: inno-usb2: fix disconnection in gadget mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Chauvet <[email protected]>
commit 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc upstream.
When the OTG USB port is used to power the SoC, configured as peripheral and used in gadget mode, there is a disconnection about 6 seconds after the gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs.
The problem happens because of the PHY driver code flow, summarized as:
* UDC start code (triggered via configfs at any time after boot) -> phy_init
-> rockchip_usb2phy_init
-> schedule_delayed_work(otg_sm_work [A], 6 sec)
-> phy_power_on
-> rockchip_usb2phy_power_on
-> enable clock
-> rockchip_usb2phy_reset* Now the gadget interface is up and running.
* 6 seconds later otg_sm_work starts [A]
-> rockchip_usb2phy_otg_sm_work():
if (B_IDLE state && VBUS present && ...):
schedule_delayed_work(&rport->chg_work [B], 0); * immediately the chg_detect_work starts [B]
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
if (!rport->suspended):
rockchip_usb2phy_power_off() <--- [X]At [X], the PHY is powered off, causing a disconnection. This quickly triggers a new connection and following re-enumeration, but any connection that had been established during the 6 seconds is broken.
The code already checks for !rport->suspended (which, somewhat counter-intuitively, means the PHY is powered on), so add a guard for VBUS as well to avoid a disconnection when a cable is connected.
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +4 -2
@@ -805,14 +805,16 @@ static void rockchip_chg_detect_work(str container_of(work, struct rockchip_usb2phy_port, chg_work.work);struct rockchip_usb2phy *rphy =dev_get_drvdata (rport->phy->dev.parent);struct regmap *base =get_reg_base (rphy); -bool is_dcd, tmout, vout; +bool is_dcd, tmout, vout, vbus_attach;unsigned long delay; + vbus_attach =property_enabled (rphy->grf, &rport->port_cfg->utmi_bvalid); +dev_dbg (&rport->phy->dev,"chg detection work state = %d\n" , rphy->chg_state);switch (rphy->chg_state) {case USB_CHG_STATE_UNDEFINED : -if (!rport->suspended) +if (!rport->suspended && !vbus_attach)rockchip_usb2phy_power_off (rport->phy);/* put the controller in non-driving mode */ if (!vbus_attach)
Greg Kroah-Hartman
maintainerPATCH 77/139 phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit b246caa68037aa495390a60d080acaeb84f45fff upstream.
The USB2 Bias Pad Control register manages analog parameters for signal detection. Previously, the HS_DISCON_LEVEL relied on hardware reset values, which may lead to the detection failure.
Explicitly configure HS_DISCON_LEVEL to 0x7. This ensures the disconnect threshold is sufficient to guarantee reliable detection.
--- drivers/phy/tegra/xusb-tegra186.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/phy/tegra/xusb-tegra186.c +3 -0
@@ -84,6 +84,7 @@#define XUSB_PADCTL_USB2_BIAS_PAD_CTL0 0x284#define BIAS_PAD_PD BIT(11)#define HS_SQUELCH_LEVEL (x) (((x) & 0x7) << 0) +#define HS_DISCON_LEVEL (x) (((x) & 0x7) << 3)#define XUSB_PADCTL_USB2_BIAS_PAD_CTL1 0x288#define USB2_TRK_START_TIMER (x) (((x) & 0x7f) << 12)
@@ -623,6 +624,8 @@ static void tegra186_utmi_bias_pad_power value &= ~BIAS_PAD_PD ; value &= ~HS_SQUELCH_LEVEL (~0 ); value |=HS_SQUELCH_LEVEL (priv->calib.hs_squelch); + value &= ~HS_DISCON_LEVEL (~0 ); + value |=HS_DISCON_LEVEL (0x7 );padctl_writel (padctl, value,XUSB_PADCTL_USB2_BIAS_PAD_CTL0 );udelay (1 );
Greg Kroah-Hartman
maintainerPATCH 78/139 usb: dwc3: Check for USB4 IP_NAME
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit 0ed91d47959cb7573c17e06487f0fb891d59dfb3 upstream.
Synopsys renamed DWC_usb32 IP to DWC_usb4 as of IP version 1.30. No functional change except checking for the IP_NAME here. The driver will treat the new IP_NAME as if it's DWC_usb32. Additional features for USB4 will be introduced and checked separately.
--- drivers/usb/dwc3/core.c | 2 ++ drivers/usb/dwc3/core.h | 1 + 2 files changed, 3 insertions(+)
drivers/usb/dwc3/core.c +2 -0
@@ -988,6 +988,8 @@ static bool dwc3_core_is_valid(struct dw reg =dwc3_readl (dwc->regs,DWC3_GSNPSID ); dwc->ip =DWC3_GSNPS_ID (reg); +if (dwc->ip ==DWC4_IP ) + dwc->ip =DWC32_IP ;/* This should read as U3 followed by revision number */ if (DWC3_IP_IS (DWC3 )) {
drivers/usb/dwc3/core.h +1 -0
@@ -1254,6 +1254,7 @@ struct dwc3 {#define DWC3_IP 0x5533#define DWC31_IP 0x3331#define DWC32_IP 0x3332 +#define DWC4_IP 0x3430u32 revision;
Greg Kroah-Hartman
maintainerPATCH 79/139 usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Brüderl <[email protected]>
commit 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd upstream.
Add USB_QUIRK_NO_BOS quirk flag to skip requesting the BOS descriptor for devices that cannot handle it.
Add Elgato 4K X (0fd9:009b) to the quirk table. This device hangs when the BOS descriptor is requested at SuperSpeed Plus (10Gbps).
--- drivers/usb/core/config.c | 5 +++++ drivers/usb/core/quirks.c | 3 +++ include/linux/usb/quirks.h | 3 +++ 3 files changed, 11 insertions(+)
drivers/usb/core/config.c +5 -0
@@ -1004,6 +1004,11 @@ int usb_get_bos_descriptor(struct usb_de__u8 cap_type;int ret; +if (dev->quirks &USB_QUIRK_NO_BOS ) { +dev_dbg (ddev,"skipping BOS descriptor\n" ); +return -ENOMSG ; + } + bos =kzalloc (sizeof (*bos),GFP_KERNEL );if (!bos)return -ENOMEM ;
drivers/usb/core/quirks.c +3 -0
@@ -447,6 +447,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0c45, 0x7056), .driver_info = USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* Elgato 4K X - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x0fd9, 0x009b), .driver_info = USB_QUIRK_NO_BOS }, + /* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */ { USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM },
include/linux/usb/quirks.h +3 -0
@@ -75,4 +75,7 @@/* short SET_ADDRESS request timeout */ #define USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT BIT(16) +/* skip BOS descriptor request */ +#define USB_QUIRK_NO_BOS BIT(17) +#endif /* __LINUX_USB_QUIRKS_H */
Greg Kroah-Hartman
maintainerPATCH 80/139 USB: OHCI/UHCI: Add soft dependencies on ehci_platform
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 01ef7f1b8713a78ab1a9512cf8096d2474c70633 upstream.
Commit 9beeee6584b9aa4f ("USB: EHCI: log a warning if ehci-hcd is not loaded first") said that ehci-hcd should be loaded before ohci-hcd and uhci-hcd. However, commit 05c92da0c52494ca ("usb: ohci/uhci - add soft dependencies on ehci_pci") only makes ohci-pci/uhci-pci depend on ehci- pci, which is not enough and we may still see the warnings in boot log.
To eliminate the warnings we should make ohci-hcd/uhci-hcd depend on ehci-hcd. But Alan said that the warning introduced by 9beeee6584b9aa4f is bogus, we only need the soft dependencies in the PCI level rather than the HCD level.
However, there is really another neccessary soft dependencies between ohci-platform/uhci-platform and ehci-platform, which is added by this patch. The boot logs are below.
1. ohci-platform loaded before ehci-platform:
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 1
ohci-platform 1f058000.usb: irq 28, io mem 0x1f058000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after
usb 1-4: new low-speed USB device number 2 using ohci-platform
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 2
ehci-platform 1f050000.usb: irq 29, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
usb 1-4: device descriptor read/all, error -62
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 1-4: new low-speed USB device number 3 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb1/1-4/1-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
2. ehci-platform loaded before ohci-platform:
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 1
ehci-platform 1f050000.usb: irq 28, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 2
ohci-platform 1f058000.usb: irq 29, io mem 0x1f058000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 2-4: new low-speed USB device number 2 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb2/2-4/2-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
In the later case, there is no re-connection for USB-1.0/1.1 devices, which is expected.
--- drivers/usb/host/ohci-platform.c | 1 + drivers/usb/host/uhci-platform.c | 1 + 2 files changed, 2 insertions(+)
drivers/usb/host/ohci-platform.c +1 -0
@@ -376,3 +376,4 @@ MODULE_DESCRIPTION(DRIVER_DESC);MODULE_AUTHOR ("Hauke Mehrtens" );MODULE_AUTHOR ("Alan Stern" );MODULE_LICENSE ("GPL" ); +MODULE_SOFTDEP ("pre: ehci_platform" );
drivers/usb/host/uhci-platform.c +1 -0
@@ -191,3 +191,4 @@ static struct platform_driver uhci_platf .of_match_table = platform_uhci_ids, }, }; +MODULE_SOFTDEP ("pre: ehci_platform" );
Greg Kroah-Hartman
maintainerPATCH 81/139 USB: serial: option: add Telit LE910 MBIM composition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulrich Mohr <[email protected]>
commit 8af4274ab5999831f4757dfd5bd11665ba3b1569 upstream.
Add support for Telit LE910 module when operating in MBIM composition with additional ttys. This USB product ID is used by the module when AT#USBCFG is set to 7.
0x1252: MBIM + tty(NMEA) + tty(MODEM) + tty(MODEM) + SAP
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1252 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -1505,6 +1505,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
Greg Kroah-Hartman
maintainerPATCH 82/139 USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
commit c0afe95e62984ceea171c3ea319beaf84a21181c upstream.
The vendor provides instructions to write "0403 bd90" to /sys/bus/usb-serial/drivers/ftdi_sio/new_id; see:
https://picaxe.com/docs/picaxe_linux_instructions.pdf
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 2 ++ 2 files changed, 3 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -850,6 +850,7 @@ static const struct usb_device_id id_tab { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, + { USB_DEVICE(FTDI_VID, FTDI_AXE027_PID) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
drivers/usb/serial/ftdi_sio_ids.h +2 -0
@@ -96,6 +96,8 @@#define LMI_LM3S_EVAL_BOARD_PID 0xbcd9#define LMI_LM3S_ICDI_BOARD_PID 0xbcda +#define FTDI_AXE027_PID 0xBD90/* PICAXE AXE027 USB download cable */ +#define FTDI_TURTELIZER_PID 0xBDC8/* JTAG/RS-232 adapter by egnite GmbH */ /* OpenDCC (www.opendcc.de) product id */
Greg Kroah-Hartman
maintainerPATCH 83/139 nvme-pci: disable secondary temp for Wodposit WPBSNM8
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilikara Zheng <[email protected]>
commit 340f4fc5508c2905a1f30de229e2a4b299d55735 upstream.
Secondary temperature thresholds (temp2_{min,max}) were not reported properly on this NVMe SSD. This resulted in an error while attempting to read these values with sensors(1):
ERROR: Can't get value of subfeature temp2_min: I/O error
ERROR: Can't get value of subfeature temp2_max: I/O error
Add the device to the nvme_id_table with the NVME_QUIRK_NO_SECONDARY_TEMP_THRESH flag to suppress access to all non- composite temperature thresholds.
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -3726,6 +3726,8 @@ static const struct pci_device_id nvme_i .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, { PCI_DEVICE(0x1e49, 0x0041), /* ZHITAI TiPro7000 NVMe SSD */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0x1fa0, 0x2283), /* Wodposit WPBSNM8-256GTP */ + .driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, }, { PCI_DEVICE(0x025e, 0xf1ac), /* SOLIDIGM P44 pro SSDPFKKW020X7 */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, { PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */
Greg Kroah-Hartman
maintainerPATCH 84/139 ASoC: codecs: wsa881x: fix unnecessary initialisation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 29d71b8a5a40708b3eed9ba4953bfc2312c9c776 upstream.
The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED.
--- sound/soc/codecs/wsa881x.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/codecs/wsa881x.c +9 -0
@@ -683,6 +683,7 @@ struct wsa881x_priv {*/ unsigned int sd_n_val;int active_ports; +bool hw_init;bool port_prepared[WSA881X_MAX_SWR_PORTS ];bool port_enable[WSA881X_MAX_SWR_PORTS ]; };
@@ -692,6 +693,9 @@ static void wsa881x_init(struct wsa881x_struct regmap *rm = wsa881x->regmap;unsigned int val =0 ; +if (wsa881x->hw_init) +return ; +regmap_register_patch (wsa881x->regmap, wsa881x_rev_2_0,ARRAY_SIZE (wsa881x_rev_2_0));
@@ -729,6 +733,8 @@ static void wsa881x_init(struct wsa881x_regmap_update_bits (rm,WSA881X_OTP_REG_28 ,0x3F ,0x3A );regmap_update_bits (rm,WSA881X_BONGO_RESRV_REG1 ,0xFF ,0xB2 );regmap_update_bits (rm,WSA881X_BONGO_RESRV_REG2 ,0xFF ,0x05 ); + + wsa881x->hw_init = true; }static int wsa881x_component_probe (struct snd_soc_component *comp)
@@ -1073,6 +1079,9 @@ static int wsa881x_update_status(struct {struct wsa881x_priv *wsa881x =dev_get_drvdata (&slave->dev); +if (status ==SDW_SLAVE_UNATTACHED ) + wsa881x->hw_init = false; +if (status ==SDW_SLAVE_ATTACHED && slave->dev_num >0 )wsa881x_init (wsa881x);
Greg Kroah-Hartman
maintainerPATCH 85/139 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 upstream.
The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.
--- fs/ext4/xattr.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/xattr.c +1 -0
@@ -1037,6 +1037,7 @@ static int ext4_xattr_inode_update_ref(hext4_error_inode (ea_inode, __func__, __LINE__,0 ,"EA inode %lu ref wraparound: ref_count=%lld ref_change=%d" , ea_inode->i_ino, ref_count, ref_change); +brelse (iloc.bh); ret = -EFSCORRUPTED ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 86/139 hrtimer: Fix softirq base check in update_needs_ipi()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 upstream.
The 'clockid' field is not the correct way to check for a softirq base.
Fix the check to correctly compare the base type instead of the clockid.
--- kernel/time/hrtimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/hrtimer.c +1 -1
@@ -931,7 +931,7 @@ static bool update_needs_ipi(struct hrtireturn true;/* Extra check for softirq clock bases */ -if (base->clockid <HRTIMER_BASE_MONOTONIC_SOFT ) +if (base->index <HRTIMER_BASE_MONOTONIC_SOFT )continue ;if (cpu_base->softirq_activated)continue ;
Greg Kroah-Hartman
maintainerPATCH 87/139 EDAC/x38: Fix a resource leak in x38_probe1()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
--- drivers/edac/x38_edac.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/edac/x38_edac.c +6 -3
@@ -341,9 +341,12 @@ static int x38_probe1(struct pci_dev *pd layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = x38_channel_num; layers[1 ].is_virt_csrow = false; + + + rc = -ENOMEM ; mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers,0 );if (!mci) -return -ENOMEM ; + goto unmap;edac_dbg (3 ,"MC: init mci\n" );
@@ -403,9 +406,9 @@ static int x38_probe1(struct pci_dev *pdreturn 0 ; fail: +edac_mc_free (mci); +unmap:iounmap (window); -if (mci) -edac_mc_free (mci);return rc; }
Greg Kroah-Hartman
maintainerPATCH 88/139 EDAC/i3200: Fix a resource leak in i3200_probe1()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d42d5715dcb559342ff356327b241c53a67584d9 upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
--- drivers/edac/i3200_edac.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/edac/i3200_edac.c +6 -5
@@ -358,10 +358,11 @@ static int i3200_probe1(struct pci_dev * layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels; layers[1 ].is_virt_csrow = false; - mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers, -sizeof (struct i3200_priv )); + + rc = -ENOMEM ; + mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers,sizeof (struct i3200_priv ));if (!mci) -return -ENOMEM ; + goto unmap;edac_dbg (3 ,"MC: init mci\n" );
@@ -421,9 +422,9 @@ static int i3200_probe1(struct pci_dev *return 0 ; fail: +edac_mc_free (mci); +unmap:iounmap (window); -if (mci) -edac_mc_free (mci);return rc; }
Greg Kroah-Hartman
maintainerPATCH 89/139 tcpm: allow looking for role_sw device in the main node
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Ferraris <[email protected]>
commit 1366cd228b0c67b60a2c0c26ef37fe9f7cfedb7f upstream.
If ports are defined in the tcpc main node, fwnode_usb_role_switch_get() returns an error, meaning usb_role_switch_get() (which would succeed) never gets a chance to run as port->role_sw isn't NULL, causing a regression on devices where this is the case.
Fix this by turning the NULL check into IS_ERR_OR_NULL(), so usb_role_switch_get() can actually run and the device get properly probed.
--- drivers/usb/typec/tcpm/tcpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpm.c +1 -1
@@ -7697,7 +7697,7 @@ struct tcpm_port *tcpm_register_port(str port->partner_desc.identity = &port->partner_ident; port->role_sw =fwnode_usb_role_switch_get (tcpc->fwnode); -if (!port->role_sw) +if (IS_ERR_OR_NULL (port->role_sw)) port->role_sw =usb_role_switch_get (port->dev);if (IS_ERR (port->role_sw)) { err =PTR_ERR (port->role_sw);
Greg Kroah-Hartman
maintainerPATCH 90/139 i2c: riic: Move suspend handling to NOIRQ phase
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommaso Merciai <[email protected]>
commit e383f0961422f983451ac4dd6aed1a3d3311f2be upstream.
Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added suspend support for the Renesas I2C driver and following this change on RZ/G3E the following WARNING is seen on entering suspend ...
[ 134.275704] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 134.285536] ------------[ cut here ]------------ [ 134.290298] i2c i2c-2: Transfer while suspended [ 134.295174] WARNING: drivers/i2c/i2c-core.h:56 at __i2c_smbus_xfer+0x1e4/0x214, CPU#0: systemd-sleep/388 [ 134.365507] Tainted: [W]=WARN [ 134.368485] Hardware name: Renesas SMARC EVK version 2 based on r9a09g047e57 (DT) [ 134.375961] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 134.382935] pc : __i2c_smbus_xfer+0x1e4/0x214 [ 134.387329] lr : __i2c_smbus_xfer+0x1e4/0x214 [ 134.391717] sp : ffff800083f23860 [ 134.395040] x29: ffff800083f23860 x28: 0000000000000000 x27: ffff800082ed5d60 [ 134.402226] x26: 0000001f4395fd74 x25: 0000000000000007 x24: 0000000000000001 [ 134.409408] x23: 0000000000000000 x22: 000000000000006f x21: ffff800083f23936 [ 134.416589] x20: ffff0000c090e140 x19: ffff0000c090e0d0 x18: 0000000000000006 [ 134.423771] x17: 6f63657320313030 x16: 2e30206465737061 x15: ffff800083f23280 [ 134.430953] x14: 0000000000000000 x13: ffff800082b16ce8 x12: 0000000000000f09 [ 134.438134] x11: 0000000000000503 x10: ffff800082b6ece8 x9 : ffff800082b16ce8 [ 134.445315] x8 : 00000000ffffefff x7 : ffff800082b6ece8 x6 : 80000000fffff000 [ 134.452495] x5 : 0000000000000504 x4 : 0000000000000000 x3 : 0000000000000000 [ 134.459672] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c9ee9e80 [ 134.466851] Call trace: [ 134.469311] __i2c_smbus_xfer+0x1e4/0x214 (P) [ 134.473715] i2c_smbus_xfer+0xbc/0x120 [ 134.477507] i2c_smbus_read_byte_data+0x4c/0x84 [ 134.482077] isl1208_i2c_read_time+0x44/0x178 [rtc_isl1208] [ 134.487703] isl1208_rtc_read_time+0x14/0x20 [rtc_isl1208] [ 134.493226] __rtc_read_time+0x44/0x88 [ 134.497012] rtc_read_time+0x3c/0x68 [ 134.500622] rtc_suspend+0x9c/0x170
The warning is triggered because I2C transfers can still be attempted while the controller is already suspended, due to inappropriate ordering of the system sleep callbacks.
If the controller is autosuspended, there is no way to wake it up once runtime PM disabled (in suspend_late()). During system resume, the I2C controller will be available only after runtime PM is re-enabled (in resume_early()). However, this may be too late for some devices.
Wake up the controller in the suspend() callback while runtime PM is still enabled. The I2C controller will remain available until the suspend_noirq() callback (pm_runtime_force_suspend()) is called. During resume, the I2C controller can be restored by the resume_noirq() callback (pm_runtime_force_resume()). Finally, the resume() callback re-enables autosuspend. As a result, the I2C controller can remain available until the system enters suspend_noirq() and from resume_noirq().
--- drivers/i2c/busses/i2c-riic.c | 46 +++++++++++++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 7 deletions(-)
drivers/i2c/busses/i2c-riic.c +39 -7
@@ -576,12 +576,39 @@ static const struct riic_of_data riic_rzstatic int riic_i2c_suspend (struct device *dev) { -struct riic_dev *riic =dev_get_drvdata (dev); -int ret; +/* +* Some I2C devices may need the I2C controller to remain active +* during resume_noirq() or suspend_noirq(). If the controller is +* autosuspended, there is no way to wake it up once runtime PM is +* disabled (in suspend_late()). +* +* During system resume, the I2C controller will be available only +* after runtime PM is re-enabled (in resume_early()). However, this +* may be too late for some devices. +* +* Wake up the controller in the suspend() callback while runtime PM +* is still enabled. The I2C controller will remain available until +* the suspend_noirq() callback (pm_runtime_force_suspend()) is +* called. During resume, the I2C controller can be restored by the +* resume_noirq() callback (pm_runtime_force_resume()). +* +* Finally, the resume() callback re-enables autosuspend, ensuring +* the I2C controller remains available until the system enters +* suspend_noirq() and from resume_noirq(). +*/ +return pm_runtime_resume_and_get (dev); +} - ret =pm_runtime_resume_and_get (dev); -if (ret) -return ret; +static int riic_i2c_resume (struct device *dev) +{ +pm_runtime_put_autosuspend (dev); + +return 0 ; +} + +static int riic_i2c_suspend_noirq (struct device *dev) +{ +struct riic_dev *riic =dev_get_drvdata (dev);i2c_mark_adapter_suspended (&riic->adapter);
@@ -589,12 +616,12 @@ static int riic_i2c_suspend(struct devicriic_clear_set_bit (riic,ICCR1_ICE ,0 ,RIIC_ICCR1 );pm_runtime_mark_last_busy (dev); -pm_runtime_put_sync (dev); +pm_runtime_force_suspend (dev);return reset_control_assert (riic->rstc); } -static int riic_i2c_resume (struct device *dev) +static int riic_i2c_resume_noirq (struct device *dev) {struct riic_dev *riic =dev_get_drvdata (dev);int ret;
@@ -603,6 +630,10 @@ static int riic_i2c_resume(struct deviceif (ret)return ret; + ret =pm_runtime_force_resume (dev); +if (ret) +return ret; + ret =riic_init_hw (riic);if (ret) {/*
@@ -620,6 +651,7 @@ static int riic_i2c_resume(struct device }static const struct dev_pm_ops riic_i2c_pm_ops = { + NOIRQ_SYSTEM_SLEEP_PM_OPS(riic_i2c_suspend_noirq, riic_i2c_resume_noirq)SYSTEM_SLEEP_PM_OPS (riic_i2c_suspend, riic_i2c_resume) };
Greg Kroah-Hartman
maintainerPATCH 91/139 x86/resctrl: Add missing resctrl initialization for Hygon
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <[email protected]>
commit 6ee98aabdc700b5705e4f1833e2edc82a826b53b upstream.
Hygon CPUs supporting Platform QoS features currently undergo partial resctrl initialization through resctrl_cpu_detect() in the Hygon BSP init helper and AMD/Hygon common initialization code. However, several critical data structures remain uninitialized for Hygon CPUs in the following paths:
- get_mem_config()-> __rdt_get_mem_config_amd():
rdt_resource::membw,alloc_capable
hw_res::num_closid
- rdt_init_res_defs()->rdt_init_res_defs_amd():
rdt_resource::cache
hw_res::msr_base,msr_update
Add the missing AMD/Hygon common initialization to ensure proper Platform QoS functionality on Hygon CPUs.
--- arch/x86/kernel/cpu/resctrl/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/core.c +4 -2
@@ -892,7 +892,8 @@ static __init bool get_mem_config(void)if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL )return __get_mem_config_intel (&hw_res->r_resctrl); -else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD ) +else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD || + boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON )return __rdt_get_mem_config_amd (&hw_res->r_resctrl);return false;
@@ -1043,7 +1044,8 @@ static __init void rdt_init_res_defs(voi {if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL )rdt_init_res_defs_intel (); -else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD ) +else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD || + boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON )rdt_init_res_defs_amd (); }
Greg Kroah-Hartman
maintainerPATCH 92/139 x86/resctrl: Fix memory bandwidth counter width for Hygon
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <[email protected]>
commit 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c upstream.
The memory bandwidth calculation relies on reading the hardware counter and measuring the delta between samples. To ensure accurate measurement, the software reads the counter frequently enough to prevent it from rolling over twice between reads.
The default Memory Bandwidth Monitoring (MBM) counter width is 24 bits. Hygon CPUs provide a 32-bit width counter, but they do not support the MBM capability CPUID leaf (0xF.[ECX=1]:EAX) to report the width offset (from 24 bits).
Consequently, the kernel falls back to the 24-bit default counter width, which causes incorrect overflow handling on Hygon CPUs.
Fix this by explicitly setting the counter width offset to 8 bits (resulting in a 32-bit total counter width) for Hygon CPUs.
--- arch/x86/kernel/cpu/resctrl/core.c | 15 +++++++++++++-- arch/x86/kernel/cpu/resctrl/internal.h | 3 +++ 2 files changed, 16 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/core.c +13 -2
@@ -1076,8 +1076,19 @@ void resctrl_cpu_detect(struct cpuinfo_x c->x86_cache_occ_scale = ebx; c->x86_cache_mbm_width_offset = eax &0xff ; -if (c->x86_vendor ==X86_VENDOR_AMD && !c->x86_cache_mbm_width_offset) - c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_AMD ; +if (!c->x86_cache_mbm_width_offset) { +switch (c->x86_vendor) { +case X86_VENDOR_AMD : + c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_AMD ; +break ; +case X86_VENDOR_HYGON : + c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_HYGON ; +break ; +default : +/* Leave c->x86_cache_mbm_width_offset as 0 */ +break ; + } + } } }
arch/x86/kernel/cpu/resctrl/internal.h +3 -0
@@ -23,6 +23,9 @@#define MBA_IS_LINEAR 0x4#define MBM_CNTR_WIDTH_OFFSET_AMD 20 +/* Hygon MBM counter width as an offset from MBM_CNTR_WIDTH_BASE */ +#define MBM_CNTR_WIDTH_OFFSET_HYGON 8 +#define RMID_VAL_ERROR BIT_ULL(63)#define RMID_VAL_UNAVAIL BIT_ULL(62)/*
Greg Kroah-Hartman
maintainerPATCH 93/139 nvme: fix PCIe subsystem reset controller state transition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
commit 0edb475ac0a7d153318a24d4dca175a270a5cc4f upstream.
The commit d2fe192348f9 (“nvme: only allow entering LIVE from CONNECTING state”) disallows controller state transitions directly from RESETTING to LIVE. However, the NVMe PCIe subsystem reset path relies on this transition to recover the controller on PowerPC (PPC) systems.
On PPC systems, issuing a subsystem reset causes a temporary loss of communication with the NVMe adapter. A subsequent PCIe MMIO read then triggers EEH recovery, which restores the PCIe link and brings the controller back online. For EEH recovery to proceed correctly, the controller must transition back to the LIVE state.
Due to the changes introduced by commit d2fe192348f9 (“nvme: only allow entering LIVE from CONNECTING state”), the controller can no longer transition directly from RESETTING to LIVE. As a result, EEH recovery exits prematurely, leaving the controller stuck in the RESETTING state.
Fix this by explicitly transitioning the controller state from RESETTING to CONNECTING and then to LIVE. This satisfies the updated state transition rules and allows the controller to be successfully recovered on PPC systems following a PCIe subsystem reset.
--- drivers/nvme/host/pci.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +4 -1
@@ -1264,7 +1264,10 @@ static int nvme_pci_subsystem_reset(stru }writel (NVME_SUBSYS_RESET , dev->bar +NVME_REG_NSSR ); -nvme_change_ctrl_state (ctrl,NVME_CTRL_LIVE ); + +if (!nvme_change_ctrl_state (ctrl,NVME_CTRL_CONNECTING ) || + !nvme_change_ctrl_state (ctrl,NVME_CTRL_LIVE )) + goto unlock;/* * Read controller status to flush the previous write and trigger a
Greg Kroah-Hartman
maintainerPATCH 94/139 mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Butsykin <[email protected]>
commit 590b13669b813d55844fecd9142c56abd567914d upstream.
crypto_alloc_acomp_node() may return ERR_PTR(), but the fail path checks only for NULL and can pass an error pointer to crypto_free_acomp(). Use IS_ERR_OR_NULL() to only free valid acomp instances.
--- mm/zswap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/zswap.c +1 -1
@@ -866,7 +866,7 @@ static int zswap_cpu_comp_prepare(unsignreturn 0 ; fail: -if (acomp) +if (!IS_ERR_OR_NULL (acomp))crypto_free_acomp (acomp);kfree (buffer);return ret;
Greg Kroah-Hartman
maintainerPATCH 95/139 mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <[email protected]>
commit b9efe36b5e3eb2e91aa3d706066428648af034fc upstream.
When page isolation loops indefinitely during memory offline, reading /proc/sys/vm/percpu_pagelist_high_fraction blocks on pcp_batch_high_lock, causing hung task warnings.
Make procfs reads lock-free since percpu_pagelist_high_fraction is a simple integer with naturally atomic reads, writers still serialize via the mutex.
This prevents hung task warnings when reading the procfs file during long-running memory offline operations.
--- mm/page_alloc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
mm/page_alloc.c +9 -1
@@ -6321,11 +6321,19 @@ static int percpu_pagelist_high_fractionint old_percpu_pagelist_high_fraction;int ret; +/* +* Avoid using pcp_batch_high_lock for reads as the value is read +* atomically and a race with offlining is harmless. +*/ + +if (!write) +return proc_dointvec_minmax (table, write, buffer, length, ppos); +mutex_lock (&pcp_batch_high_lock); old_percpu_pagelist_high_fraction = percpu_pagelist_high_fraction; ret =proc_dointvec_minmax (table, write, buffer, length, ppos); -if (!write || ret <0 ) +if (ret <0 ) goto out;/* Sanity checking to avoid pcp imbalance */
Greg Kroah-Hartman
maintainerPATCH 96/139 mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 9814cc832b88bd040fc2a1817c2b5469d0f7e862 upstream.
When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
--- mm/damon/sysfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/damon/sysfs.c +3 -2
@@ -716,7 +716,7 @@ static int damon_sysfs_context_add_dirs( err =damon_sysfs_context_set_targets (context);if (err) - goto put_attrs_out; + goto rmdir_put_attrs_out; err =damon_sysfs_context_set_schemes (context);if (err)
@@ -726,7 +726,8 @@ static int damon_sysfs_context_add_dirs( put_targets_attrs_out:kobject_put (&context->targets->kobj); context->targets =NULL ; -put_attrs_out: +rmdir_put_attrs_out: +damon_sysfs_attrs_rm_dirs (context->attrs);kobject_put (&context->attrs->kobj); context->attrs =NULL ;return err;
Greg Kroah-Hartman
maintainerPATCH 97/139 LoongArch: Fix PMU counter allocation for mixed-type event groups
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lisa Robinson <[email protected]>
commit a91f86e27087f250a5d9c89bb4a427b9c30fd815 upstream.
When validating a perf event group, validate_group() unconditionally attempts to allocate hardware PMU counters for the leader, sibling events and the new event being added.
This is incorrect for mixed-type groups. If a PERF_TYPE_SOFTWARE event is part of the group, the current code still tries to allocate a hardware PMU counter for it, which can wrongly consume hardware PMU resources and cause spurious allocation failures.
Fix this by only allocating PMU counters for hardware events during group validation, and skipping software events.
A trimmed down reproducer is as simple as this:
#include <stdio.h>
#include <assert.h>
#include <unistd.h>
#include <string.h>
#include <sys/syscall.h>
#include <linux/perf_event.h>
int main (int argc, char *argv[])
{
struct perf_event_attr attr = { 0 };
int fds[5];
attr.disabled = 1;
attr.exclude_kernel = 1;
attr.exclude_hv = 1;
attr.read_format = PERF_FORMAT_TOTAL_TIME_ENABLED |
PERF_FORMAT_TOTAL_TIME_RUNNING | PERF_FORMAT_ID | PERF_FORMAT_GROUP;
attr.size = sizeof (attr);
attr.type = PERF_TYPE_SOFTWARE;
attr.config = PERF_COUNT_SW_DUMMY;
fds[0] = syscall (SYS_perf_event_open, &attr, 0, -1, -1, 0);
assert (fds[0] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_CPU_CYCLES;
fds[1] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[1] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_INSTRUCTIONS;
fds[2] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[2] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_BRANCH_MISSES;
fds[3] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[3] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_CACHE_REFERENCES;
fds[4] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[4] >= 0);
printf ("PASSED\n");
return 0;
}--- arch/loongarch/kernel/perf_event.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
arch/loongarch/kernel/perf_event.c +18 -3
@@ -627,6 +627,18 @@ static const struct loongarch_perf_eventreturn pev; } +static inline bool loongarch_pmu_event_requires_counter (const struct perf_event *event) +{ +switch (event->attr.type) { +case PERF_TYPE_HARDWARE : +case PERF_TYPE_HW_CACHE : +case PERF_TYPE_RAW : +return true; +default : +return false; + } +} +static int validate_group (struct perf_event *event) {struct cpu_hw_events fake_cpuc;
@@ -634,15 +646,18 @@ static int validate_group(struct perf_evmemset (&fake_cpuc,0 ,sizeof (fake_cpuc)); -if (loongarch_pmu_alloc_counter (&fake_cpuc, &leader->hw) <0 ) +if (loongarch_pmu_event_requires_counter (leader) && +loongarch_pmu_alloc_counter (&fake_cpuc, &leader->hw) <0 )return -EINVAL ;for_each_sibling_event (sibling, leader) { -if (loongarch_pmu_alloc_counter (&fake_cpuc, &sibling->hw) <0 ) +if (loongarch_pmu_event_requires_counter (sibling) && +loongarch_pmu_alloc_counter (&fake_cpuc, &sibling->hw) <0 )return -EINVAL ; } -if (loongarch_pmu_alloc_counter (&fake_cpuc, &event->hw) <0 ) +if (loongarch_pmu_event_requires_counter (event) && +loongarch_pmu_alloc_counter (&fake_cpuc, &event->hw) <0 )return -EINVAL ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 98/139 drm/amd/display: Bump the HDMI clock to 340MHz
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit fee50077656d8a58011f13bca48f743d1b6d6015 upstream.
[Why]
DP-HDMI dongles can execeed bandwidth requirements on high resolution monitors. This can lead to pruning the high resolution modes.
HDMI 1.3 bumped the clock to 340MHz, but display code never matched it.
[How]
Set default to (DVI) 165MHz. Once HDMI display is identified update to 340MHz.
--- drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h | 2 +- drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h +1 -1
@@ -41,7 +41,7 @@/* kHZ*/ #define DP_ADAPTOR_DVI_MAX_TMDS_CLK 165000/* kHZ*/ -#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 165000 +#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 340000struct dp_hdmi_dongle_signature_data {int8_t id[15 ];/* "DP-HDMI ADAPTOR"*/
drivers/gpu/drm/amd/display/dc/link/link_detection.c +3 -1
@@ -329,7 +329,7 @@ static void query_dp_dual_mode_adaptor(/* Assume we have no valid DP passive dongle connected */ *dongle =DISPLAY_DONGLE_NONE ; - sink_cap->max_hdmi_pixel_clock =DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK ; + sink_cap->max_hdmi_pixel_clock =DP_ADAPTOR_DVI_MAX_TMDS_CLK ;/* Read DP-HDMI dongle I2c (no response interpreted as DP-DVI dongle)*/ if (!i2c_read(
@@ -385,6 +385,8 @@ static void query_dp_dual_mode_adaptor( } } +if (is_valid_hdmi_signature) + sink_cap->max_hdmi_pixel_clock =DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK ;if (is_type2_dongle) { uint32_t max_tmds_clk =
Greg Kroah-Hartman
maintainerPATCH 99/139 drm/amd: Clean up kfd node on surprise disconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
When an eGPU is unplugged the KFD topology should also be destroyed for that GPU. This never happens because the fini_sw callbacks never get to run. Run them manually before calling amdgpu_device_ip_fini_early() when a device has already been disconnected.
This location is intentionally chosen to make sure that the kfd locking refcount doesn't get incremented unintentionally.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +8 -0
@@ -4642,6 +4642,14 @@ void amdgpu_device_fini_hw(struct amdgpuamdgpu_ttm_set_buffer_funcs_status (adev, false); +/* +* device went through surprise hotplug; we need to destroy topology +* before ip_fini_early to prevent kfd locking refcount issues by calling +* amdgpu_amdkfd_suspend() +*/ +if (drm_dev_is_unplugged (adev_to_drm (adev))) +amdgpu_amdkfd_device_fini_sw (adev); +amdgpu_device_ip_fini_early (adev);amdgpu_irq_fini_hw (adev);
Greg Kroah-Hartman
maintainerPATCH 100/139 drm/amdkfd: fix a memory leak in device_queue_manager_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 80614c509810fc051312d1a7ccac8d0012d6b8d0 upstream.
If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd() to release the memory allocated by allocate_hiq_sdma_mqd(). Move deallocate_hiq_sdma_mqd() up to ensure proper function visibility at the point of use.
--- drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 19 ++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +11 -8
@@ -2756,6 +2756,14 @@ static int allocate_hiq_sdma_mqd(structreturn retval; } +static void deallocate_hiq_sdma_mqd (struct kfd_node *dev, +struct kfd_mem_obj *mqd) +{ +WARN (!mqd,"No hiq sdma mqd trunk to free" ); + +amdgpu_amdkfd_free_gtt_mem (dev->adev, &mqd->gtt_mem); +} +struct device_queue_manager *device_queue_manager_init (struct kfd_node *dev) {struct device_queue_manager *dqm;
@@ -2879,19 +2887,14 @@ struct device_queue_manager *device_queureturn dqm; } +if (!dev->kfd->shared_resources.enable_mes) +deallocate_hiq_sdma_mqd (dev, &dqm->hiq_sdma_mqd); + out_free:kfree (dqm);return NULL ; } -static void deallocate_hiq_sdma_mqd (struct kfd_node *dev, -struct kfd_mem_obj *mqd) -{ -WARN (!mqd,"No hiq sdma mqd trunk to free" ); - -amdgpu_amdkfd_free_gtt_mem (dev->adev, &mqd->gtt_mem); -} -void device_queue_manager_uninit (struct device_queue_manager *dqm) { dqm->ops.stop (dqm);
Greg Kroah-Hartman
maintainerPATCH 101/139 drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <[email protected]>
commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
For a while, I've been seeing a strange issue where some (usually not all) of the display DMA channels will suddenly hang, particularly when there is a visible cursor on the screen that is being frequently updated, and especially when said cursor happens to go between two screens. While this brings back lovely memories of fixing Intel Skylake bugs, I would quite like to fix it :).
It turns out the problem that's happening here is that we're managing to reach nv50_head_flush_set() in our atomic commit path without actually holding nv50_disp->mutex. This means that cursor updates happening in parallel (along with any other atomic updates that need to use the core channel) will race with eachother, which eventually causes us to corrupt the pushbuffer - leading to a plethora of various GSP errors, usually:
nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
The reason this is happening is because generally we check whether we need to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). However, curs507a_prepare is called from the fb_prepare callback, which happens after the atomic check phase. As a result, this can lead to commits that both touch the core channel but also don't grab nv50_disp->mutex.
So, fix this by making sure that we set nv50_atom->lock_core in cus507a_prepare().
--- drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/dispnv50/curs507a.c +1 -0
@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw, asyh->curs.handle = handle; asyh->curs.offset = offset; asyh->set.curs = asyh->curs.visible; +nv50_atom (asyh->state.state)->lock_core = true; } }
Greg Kroah-Hartman
maintainerPATCH 102/139 drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set. This leads to a warning and a backtrace in the kernel log and panel does not work:
"
WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
"
The warning is triggered by a check for valid connector type in devm_drm_panel_bridge_add(). If there is no valid connector type set for a panel, the warning is printed and panel is not added. Fill in the missing connector type to fix the warning and make the panel operational once again.
--- drivers/gpu/drm/panel/panel-simple.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panel/panel-simple.c +1 -0
@@ -1782,6 +1782,7 @@ static const struct panel_desc dataimage }, .bus_format = MEDIA_BUS_FMT_RGB888_1X24, .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, + .connector_type = DRM_MODE_CONNECTOR_DPI, };static const struct display_timing dlc_dlc0700yzg_1_timing = {
Greg Kroah-Hartman
maintainerPATCH 103/139 drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
In vmw_compat_shader_add(), the return value check of vmw_shader_alloc() is not proper. Modify the check for the return pointer 'res'.
Found by code review and compiled on ubuntu 20.04.
--- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +3 -1
@@ -923,8 +923,10 @@ int vmw_compat_shader_add(struct vmw_prittm_bo_unreserve (&buf->tbo); res =vmw_shader_alloc (dev_priv, buf, size,0 , shader_type); -if (unlikely (ret !=0 )) +if (IS_ERR (res)) { + ret =PTR_ERR (res); goto no_reserve; + } ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader, vmw_shader_key(user_key, shader_type),
Greg Kroah-Hartman
maintainerPATCH 104/139 LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <[email protected]>
commit c4461754e6fe7e12a3ff198cce4707e3e20e43d4 upstream.
Add missing address-cells 0 to the Local I/O and Extend I/O interrupt controller node to silence W=1 warning:
loongson-2k0500.dtsi:513.5-51: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@0,0:interrupt-map:
Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe11600, using 0 as fallback
Value '0' is correct because:
1. The Local I/O & Extend I/O interrupt controller do not have children,
2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0)
--- arch/loongarch/boot/dts/loongson-2k0500.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/loongarch/boot/dts/loongson-2k0500.dtsi +3 -0
@@ -131,6 +131,7 @@ reg-names = "main", "isr0"; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <2>; interrupt-parent = <&cpuintc>; interrupts = <2>;
@@ -149,6 +150,7 @@ reg-names = "main", "isr0"; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <2>; interrupt-parent = <&cpuintc>; interrupts = <4>;
@@ -164,6 +166,7 @@ compatible = "loongson,ls2k0500-eiointc"; reg = <0x0 0x1fe11600 0x0 0xea00>; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <1>; interrupt-parent = <&cpuintc>; interrupts = <3>;
Greg Kroah-Hartman
maintainerPATCH 105/139 LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <[email protected]>
commit 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 upstream.
Add missing address-cells 0 to the Local I/O interrupt controller node to silence W=1 warning:
loongson-2k1000.dtsi:498.5-55: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map:
Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe01440, using 0 as fallback
Value '0' is correct because:
1. The Local I/O interrupt controller does not have children,
2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0)
--- arch/loongarch/boot/dts/loongson-2k1000.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/loongarch/boot/dts/loongson-2k1000.dtsi +2 -0
@@ -114,6 +114,7 @@ <0x0 0x1fe01140 0x0 0x8>; reg-names = "main", "isr0", "isr1"; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <2>; interrupt-parent = <&cpuintc>; interrupts = <2>;
@@ -131,6 +132,7 @@ <0x0 0x1fe01148 0x0 0x8>; reg-names = "main", "isr0", "isr1"; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <2>; interrupt-parent = <&cpuintc>; interrupts = <3>;
Greg Kroah-Hartman
maintainerPATCH 106/139 LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <[email protected]>
commit 14ea5a3625881d79f75418c66e3a7d98db8518e1 upstream.
The binding wants the node to be named "i2c-number", but those are named "i2c-gpio-number" instead.
Thus rename those to i2c-0, i2c-1 to adhere to the binding and suppress dtbs_check warnings.
--- arch/loongarch/boot/dts/loongson-2k1000.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/loongarch/boot/dts/loongson-2k1000.dtsi +2 -2
@@ -46,7 +46,7 @@ }; /* i2c of the dvi eeprom edid */ - i2c-gpio-0 { + i2c-0 { compatible = "i2c-gpio"; scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
@@ -57,7 +57,7 @@ }; /* i2c of the eeprom edid */ - i2c-gpio-1 { + i2c-1 { compatible = "i2c-gpio"; scl-gpios = <&gpio0 33 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; sda-gpios = <&gpio0 32 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
Greg Kroah-Hartman
maintainerPATCH 107/139 LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <[email protected]>
commit e65df3f77ecd59d3a8647d19df82b22a6ce210a9 upstream.
Add missing address-cells 0 to the Local I/O, Extend I/O and PCH-PIC Interrupt Controller node to silence W=1 warning:
loongson-2k2000.dtsi:364.5-49: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map:
Missing property '#address-cells' in node /bus@10000000/interrupt-controller@10000000, using 0 as fallback
Value '0' is correct because:
1. The LIO/EIO/PCH interrupt controller does not have children,
2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0)
--- arch/loongarch/boot/dts/loongson-2k2000.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/loongarch/boot/dts/loongson-2k2000.dtsi +3 -0
@@ -126,6 +126,7 @@ reg = <0x0 0x1fe01400 0x0 0x64>; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <2>; interrupt-parent = <&cpuintc>; interrupts = <2>;
@@ -140,6 +141,7 @@ compatible = "loongson,ls2k2000-eiointc"; reg = <0x0 0x1fe01600 0x0 0xea00>; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <1>; interrupt-parent = <&cpuintc>; interrupts = <3>;
@@ -149,6 +151,7 @@ compatible = "loongson,pch-pic-1.0"; reg = <0x0 0x10000000 0x0 0x400>; interrupt-controller; + #address-cells = <0>; #interrupt-cells = <2>; loongson,pic-base-vec = <0>; interrupt-parent = <&eiointc>;
Greg Kroah-Hartman
maintainerPATCH 108/139 dmaengine: apple-admac: Add "apple,t8103-admac" compatible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <[email protected]>
commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream.
After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,admac" anymore [1]. Use "apple,t8103-admac" as base compatible as it is the SoC the driver and bindings were written for.
[1]: https://lore.kernel.org/asahi/[email protected]/
--- drivers/dma/apple-admac.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/apple-admac.c +1 -0
@@ -936,6 +936,7 @@ static void admac_remove(struct platform }static const struct of_device_id admac_of_match[] = { + { .compatible ="apple,t8103-admac" , }, { .compatible ="apple,admac" , }, { } };
Greg Kroah-Hartman
maintainerPATCH 109/139 dmaengine: at_hdmac: fix device leak on of_dma_xlate()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
Make sure to drop the reference taken when looking up the DMA platform device during of_dma_xlate() when releasing channel resources.
Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") fixed the leak in a couple of error paths but the reference is still leaking on successful allocation.
--- drivers/dma/at_hdmac.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/dma/at_hdmac.c +7 -2
@@ -1765,6 +1765,7 @@ static int atc_alloc_chan_resources(strustatic void atc_free_chan_resources (struct dma_chan *chan) {struct at_dma_chan *atchan =to_at_dma_chan (chan); +struct at_dma_slave *atslave;BUG_ON (atc_chan_is_enabled (atchan));
@@ -1774,8 +1775,12 @@ static void atc_free_chan_resources(stru/* * Free atslave allocated in at_dma_xlate() */ -kfree (chan->private); - chan->private =NULL ; + atslave = chan->private; +if (atslave) { +put_device (atslave->dma_dev); +kfree (atslave); + chan->private =NULL ; + }dev_vdbg (chan2dev (chan),"free_chan_resources: done\n" ); }
Greg Kroah-Hartman
maintainerPATCH 110/139 dmaengine: bcm-sba-raid: fix device leak on probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind.
--- drivers/dma/bcm-sba-raid.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/dma/bcm-sba-raid.c +5 -1
@@ -1699,7 +1699,7 @@ static int sba_probe(struct platform_dev/* Prealloc channel resource */ ret =sba_prealloc_channel_resources (sba);if (ret) - goto fail_free_mchan; + goto fail_put_mbox;/* Check availability of debugfs */ if (!debugfs_initialized ())
@@ -1729,6 +1729,8 @@ skip_debugfs: fail_free_resources:debugfs_remove_recursive (sba->root);sba_freeup_channel_resources (sba); +fail_put_mbox: +put_device (sba->mbox_dev); fail_free_mchan:mbox_free_channel (sba->mchan);return ret;
@@ -1744,6 +1746,8 @@ static void sba_remove(struct platform_dsba_freeup_channel_resources (sba); +put_device (sba->mbox_dev); +mbox_free_channel (sba->mchan); }
Greg Kroah-Hartman
maintainerPATCH 111/139 dmaengine: dw: dmamux: fix OF node leak on route allocation failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream.
Make sure to drop the reference taken to the DMA master OF node also on late route allocation failures.
--- drivers/dma/dw/rzn1-dmamux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/dw/rzn1-dmamux.c +3 -1
@@ -90,7 +90,7 @@ static void *rzn1_dmamux_route_allocate(if (test_and_set_bit (map->req_idx, dmamux->used_chans)) { ret = -EBUSY ; - goto free_map; + goto put_dma_spec_np; } mask =BIT (map->req_idx);
@@ -103,6 +103,8 @@ static void *rzn1_dmamux_route_allocate( clear_bitmap:clear_bit (map->req_idx, dmamux->used_chans); +put_dma_spec_np: +of_node_put (dma_spec->np); free_map:kfree (map); put_device:
Greg Kroah-Hartman
maintainerPATCH 112/139 dmaengine: idxd: fix device leaks on compat bind and unbind
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 799900f01792cf8b525a44764f065f83fcafd468 upstream.
Make sure to drop the reference taken when looking up the idxd device as part of the compat bind and unbind sysfs interface.
--- drivers/dma/idxd/compat.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/dma/idxd/compat.c +19 -4
@@ -20,11 +20,16 @@ static ssize_t unbind_store(struct devicint rc = -ENODEV ; dev =bus_find_device_by_name (bus,NULL , buf); -if (dev && dev->driver) { +if (!dev) +return -ENODEV ; + +if (dev->driver) {device_driver_detach (dev); rc = count; } +put_device (dev); +return rc; } static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
@@ -38,9 +43,12 @@ static ssize_t bind_store(struct device_struct idxd_dev *idxd_dev; dev =bus_find_device_by_name (bus,NULL , buf); -if (!dev || dev->driver || drv != &dsa_drv.drv) +if (!dev)return -ENODEV ; +if (dev->driver || drv != &dsa_drv.drv) + goto err_put_dev; + idxd_dev =confdev_to_idxd_dev (dev);if (is_idxd_dev (idxd_dev)) { alt_drv =driver_find ("idxd" , bus);
@@ -53,13 +61,20 @@ static ssize_t bind_store(struct device_ alt_drv =driver_find ("user" , bus); }if (!alt_drv) -return -ENODEV ; + goto err_put_dev; rc =device_driver_attach (alt_drv, dev);if (rc <0 ) -return rc; + goto err_put_dev; + +put_device (dev);return count; + +err_put_dev: +put_device (dev); + +return rc; } static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
Greg Kroah-Hartman
maintainerPATCH 113/139 dmaengine: lpc18xx-dmamux: fix device leak on route allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/dma/lpc18xx-dmamux.c +14 -5
@@ -57,30 +57,31 @@ static void *lpc18xx_dmamux_reserve(strustruct lpc18xx_dmamux_data *dmamux =platform_get_drvdata (pdev);unsigned long flags;unsigned mux; +int ret = -EINVAL ;if (dma_spec->args_count !=3 ) {dev_err (&pdev->dev,"invalid number of dma mux args\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; } mux = dma_spec->args[0 ];if (mux >= dmamux->dma_master_requests) {dev_err (&pdev->dev,"invalid mux number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }if (dma_spec->args[1 ] >LPC18XX_DMAMUX_MAX_VAL ) {dev_err (&pdev->dev,"invalid dma mux value: %d\n" , dma_spec->args[1 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }/* The of_node_put() will be done in the core for the node */ dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"can't get dma master\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }spin_lock_irqsave (&dmamux->lock, flags);
@@ -89,7 +90,8 @@ static void *lpc18xx_dmamux_reserve(strudev_err (&pdev->dev,"dma request %u busy with %u.%u\n" , mux, mux, dmamux->muxes[mux].value);of_node_put (dma_spec->np); -return ERR_PTR (-EBUSY ); + ret = -EBUSY ; + goto err_put_pdev; } dmamux->muxes[mux].busy = true;
@@ -106,7 +108,14 @@ static void *lpc18xx_dmamux_reserve(strudev_dbg (&pdev->dev,"mapping dmamux %u.%u to dma request %u\n" , mux, dmamux->muxes[mux].value, mux); +put_device (&pdev->dev); +return &dmamux->muxes[mux]; + +err_put_pdev: +put_device (&pdev->dev); + +return ERR_PTR (ret); }static int lpc18xx_dmamux_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 114/139 dmaengine: lpc32xx-dmamux: fix device leak on route allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d9847e6d1d91462890ba297f7888fa598d47e76e upstream.
Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/dma/lpc32xx-dmamux.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/dma/lpc32xx-dmamux.c +14 -5
@@ -95,11 +95,12 @@ static void *lpc32xx_dmamux_reserve(strustruct lpc32xx_dmamux_data *dmamux =platform_get_drvdata (pdev);unsigned long flags;struct lpc32xx_dmamux *mux =NULL ; +int ret = -EINVAL ;int i;if (dma_spec->args_count !=3 ) {dev_err (&pdev->dev,"invalid number of dma mux args\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }for (i =0 ; i <ARRAY_SIZE (lpc32xx_muxes); i++) {
@@ -111,20 +112,20 @@ static void *lpc32xx_dmamux_reserve(struif (!mux) {dev_err (&pdev->dev,"invalid mux request number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }if (dma_spec->args[2 ] >1 ) {dev_err (&pdev->dev,"invalid dma mux value: %d\n" , dma_spec->args[1 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }/* The of_node_put() will be done in the core for the node */ dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"can't get dma master\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }spin_lock_irqsave (&dmamux->lock, flags);
@@ -133,7 +134,8 @@ static void *lpc32xx_dmamux_reserve(strudev_err (dev,"dma request signal %d busy, routed to %s\n" , mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1);of_node_put (dma_spec->np); -return ERR_PTR (-EBUSY ); + ret = -EBUSY ; + goto err_put_pdev; } mux->busy = true;
@@ -148,7 +150,14 @@ static void *lpc32xx_dmamux_reserve(strudev_dbg (dev,"dma request signal %d routed to %s\n" , mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1); +put_device (&pdev->dev); +return mux; + +err_put_pdev: +put_device (&pdev->dev); + +return ERR_PTR (ret); }static int lpc32xx_dmamux_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 115/139 dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
Fix a memory leak in gpi_peripheral_config() where the original memory pointed to by gchan->config could be lost if krealloc() fails.
The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the reference to the original memory
4. The original memory becomes unreachable and cannot be freed
Fix this by using a temporary variable to hold the krealloc() result and only updating gchan->config when the allocation succeeds.
Found via static analysis and code review.
--- drivers/dma/qcom/gpi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/dma/qcom/gpi.c +4 -2
@@ -1614,14 +1614,16 @@ static int gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) { struct gchan *gchan = to_gchan(chan); +void *new_config;if (!config->peripheral_config)return -EINVAL ; - gchan->config =krealloc (gchan->config, config->peripheral_size,GFP_NOWAIT ); -if (!gchan->config) + new_config =krealloc (gchan->config, config->peripheral_size,GFP_NOWAIT ); +if (!new_config)return -ENOMEM ; + gchan->config = new_config;memcpy (gchan->config, config->peripheral_config, config->peripheral_size);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 116/139 dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream.
After audio full duplex testing, playing the recorded file contains a few playback frames from the previous time. The rz_dmac_terminate_all() does not reset all the hardware descriptors queued previously, leading to the wrong descriptor being picked up during the next DMA transfer. Fix the above issue by resetting all the descriptor headers for a channel in rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg().
--- drivers/dma/sh/rz-dmac.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/dma/sh/rz-dmac.c +5 -0
@@ -533,11 +533,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *cstatic int rz_dmac_terminate_all (struct dma_chan *chan) {struct rz_dmac_chan *channel =to_rz_dmac_chan (chan); +struct rz_lmdesc *lmdesc = channel->lmdesc.base;unsigned long flags; +unsigned int i;LIST_HEAD (head);rz_dmac_disable_hw (channel);spin_lock_irqsave (&channel->vc.lock, flags); +for (i =0 ; i <DMAC_NR_LMDESC ; i++) + lmdesc[i].header =0 ; +list_splice_tail_init (&channel->ld_active, &channel->ld_free);list_splice_tail_init (&channel->ld_queue, &channel->ld_free);vchan_get_all_descriptors (&channel->vc, &head);
Greg Kroah-Hartman
maintainerPATCH 117/139 dmaengine: stm32: dmamux: fix device leak on route allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dd6e4943889fb354efa3f700e42739da9bddb6ef upstream.
Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/dma/stm32/stm32-dmamux.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/dma/stm32/stm32-dmamux.c +12 -6
@@ -90,23 +90,25 @@ static void *stm32_dmamux_route_allocatestruct stm32_dmamux_data *dmamux =platform_get_drvdata (pdev);struct stm32_dmamux *mux;u32 i, min, max; -int ret; +int ret = -EINVAL ;unsigned long flags;if (dma_spec->args_count !=3 ) {dev_err (&pdev->dev,"invalid number of dma mux args\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }if (dma_spec->args[0 ] > dmamux->dmamux_requests) {dev_err (&pdev->dev,"invalid mux request number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; } mux =kzalloc (sizeof (*mux),GFP_KERNEL ); -if (!mux) -return ERR_PTR (-ENOMEM ); +if (!mux) { + ret = -ENOMEM ; + goto err_put_pdev; + }spin_lock_irqsave (&dmamux->lock, flags); mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
@@ -133,7 +135,6 @@ static void *stm32_dmamux_route_allocate dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" , i -1 );if (!dma_spec->np) {dev_err (&pdev->dev,"can't get dma master\n" ); - ret = -EINVAL ; goto error; }
@@ -160,6 +161,8 @@ static void *stm32_dmamux_route_allocatedev_dbg (&pdev->dev,"Mapping DMAMUX(%u) to DMA%u(%u)\n" , mux->request, mux->master, mux->chan_id); +put_device (&pdev->dev); +return mux; error:
@@ -167,6 +170,9 @@ error: error_chan_id:kfree (mux); +err_put_pdev: +put_device (&pdev->dev); +return ERR_PTR (ret); }
Greg Kroah-Hartman
maintainerPATCH 118/139 dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b1b590a590af13ded598e70f0b72bc1e515787a1 upstream.
Make sure to drop the reference taken to the DMA master OF node also on late route allocation failures.
--- drivers/dma/stm32/stm32-dmamux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/stm32/stm32-dmamux.c +3 -1
@@ -143,7 +143,7 @@ static void *stm32_dmamux_route_allocate ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 ) {spin_unlock_irqrestore (&dmamux->lock, flags); - goto error; + goto err_put_dma_spec_np; }spin_unlock_irqrestore (&dmamux->lock, flags);
@@ -165,6 +165,8 @@ static void *stm32_dmamux_route_allocatereturn mux; +err_put_dma_spec_np: +of_node_put (dma_spec->np); error:clear_bit (mux->chan_id, dmamux->dma_inuse);
Greg Kroah-Hartman
maintainerPATCH 119/139 dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
Make sure to drop the reference taken when looking up the crossbar platform device during dra7x route allocation.
Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the reference is still leaking on successful allocation.
--- drivers/dma/ti/dma-crossbar.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/ti/dma-crossbar.c +2 -0
@@ -288,6 +288,8 @@ static void *ti_dra7_xbar_route_allocateti_dra7_xbar_write (xbar->iomem, map->xbar_out, map->xbar_in); +put_device (&pdev->dev); +return map; }
Greg Kroah-Hartman
maintainerPATCH 120/139 dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
Make sure to drop the reference taken when looking up the crossbar platform device during am335x route allocation.
--- drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/dma/ti/dma-crossbar.c +10 -6
@@ -79,34 +79,35 @@ static void *ti_am335x_xbar_route_alloca {struct platform_device *pdev =of_find_device_by_node (ofdma->of_node);struct ti_am335x_xbar_data *xbar =platform_get_drvdata (pdev); -struct ti_am335x_xbar_map *map; +struct ti_am335x_xbar_map *map =ERR_PTR (-EINVAL );if (dma_spec->args_count !=3 ) -return ERR_PTR (-EINVAL ); + goto out_put_pdev;if (dma_spec->args[2 ] >= xbar->xbar_events) {dev_err (&pdev->dev,"Invalid XBAR event number: %d\n" , dma_spec->args[2 ]); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; }if (dma_spec->args[0 ] >= xbar->dma_requests) {dev_err (&pdev->dev,"Invalid DMA request line number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; }/* The of_node_put() will be done in the core for the node */ dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"Can't get DMA master\n" ); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; } map =kzalloc (sizeof (*map),GFP_KERNEL );if (!map) {of_node_put (dma_spec->np); -return ERR_PTR (-ENOMEM ); + map =ERR_PTR (-ENOMEM ); + goto out_put_pdev; } map->dma_line = (u16 )dma_spec->args[0 ];
@@ -120,6 +121,9 @@ static void *ti_am335x_xbar_route_allocati_am335x_xbar_write (xbar->iomem, map->dma_line, map->mux_val); +out_put_pdev: +put_device (&pdev->dev); +return map; }
Greg Kroah-Hartman
maintainerPATCH 121/139 dmaengine: ti: k3-udma: fix device leak on udma lookup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
Make sure to drop the reference taken when looking up the UDMA platform device.
Note that holding a reference to a platform device does not prevent its driver data from going away so there is no point in keeping the reference after the lookup helper returns.
--- drivers/dma/ti/k3-udma-private.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/ti/k3-udma-private.c +1 -1
@@ -42,9 +42,9 @@ struct udma_dev *of_xudma_dev_get(struct } ud =platform_get_drvdata (pdev); +put_device (&pdev->dev);if (!ud) {pr_debug ("UDMA has not been probed\n" ); -put_device (&pdev->dev);return ERR_PTR (-EPROBE_DEFER ); }
Greg Kroah-Hartman
maintainerPATCH 122/139 HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
commit 0d30dae38fe01cd1de358c6039a0b1184689fe51 upstream.
During suspend/resume tests with S2IDLE, some ISH functional failures were observed because of delay in executing ISH resume handler. Here schedule_work() is used from resume handler to do actual work. schedule_work() uses system_wq, which is a per CPU work queue. Although the queuing is not bound to a CPU, but it prefers local CPU of the caller, unless prohibited.
Users of this work queue are not supposed to queue long running work. But in practice, there are scenarios where long running work items are queued on other unbound workqueues, occupying the CPU. As a result, the ISH resume handler may not get a chance to execute in a timely manner.
In one scenario, one of the ish_resume_handler() executions was delayed nearly 1 second because another work item on an unbound workqueue occupied the same CPU. This delay causes ISH functionality failures.
A similar issue was previously observed where the ISH HID driver timed out while getting the HID descriptor during S4 resume in the recovery kernel, likely caused by the same workqueue contention problem.
Create dedicated unbound workqueues for all ISH operations to allow work items to execute on any available CPU, eliminating CPU-specific bottlenecks and improving resume reliability under varying system loads. Also ISH has three different components, a bus driver which implements ISH protocols, a PCI interface layer and HID interface. Use one dedicated work queue for all of them.
--- drivers/hid/intel-ish-hid/ipc/ipc.c | 21 ++++++++++++++++++++- drivers/hid/intel-ish-hid/ipc/pci-ish.c | 2 +- drivers/hid/intel-ish-hid/ishtp-hid-client.c | 4 ++-- drivers/hid/intel-ish-hid/ishtp/bus.c | 18 +++++++++++++++++- drivers/hid/intel-ish-hid/ishtp/hbm.c | 4 ++-- drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h | 3 +++ include/linux/intel-ish-client-if.h | 2 ++ 7 files changed, 47 insertions(+), 7 deletions(-)
drivers/hid/intel-ish-hid/ipc/ipc.c +20 -1
@@ -627,7 +627,7 @@ static void recv_ipc(struct ishtp_deviceif (!ishtp_dev) { ishtp_dev = dev; } -schedule_work (&fw_reset_work); +queue_work (dev->unbound_wq, &fw_reset_work);break ;case MNG_RESET_NOTIFY_ACK :
@@ -932,6 +932,21 @@ static const struct ishtp_hw_ops ish_hw_ .dma_no_cache_snooping = _dma_no_cache_snooping }; +static struct workqueue_struct *devm_ishtp_alloc_workqueue (struct device *dev) +{ +struct workqueue_struct *wq; + + wq =alloc_workqueue ("ishtp_unbound_%d" ,WQ_UNBOUND ,0 , dev->id); +if (!wq) +return NULL ; + +if (devm_add_action_or_reset (dev, (void (*)(void *))destroy_workqueue, + wq)) +return NULL ; + +return wq; +} +/** * ish_dev_init() -Initialize ISH devoce * @pdev: PCI device
@@ -952,6 +967,10 @@ struct ishtp_device *ish_dev_init(structif (!dev)return NULL ; + dev->unbound_wq =devm_ishtp_alloc_workqueue (&pdev->dev); +if (!dev->unbound_wq) +return NULL ; + dev->devc = &pdev->dev;ishtp_device_init (dev);
drivers/hid/intel-ish-hid/ipc/pci-ish.c +1 -1
@@ -381,7 +381,7 @@ static int __maybe_unused ish_resume(str ish_resume_device = device; dev->resume_flag =1 ; -schedule_work (&resume_work); +queue_work (dev->unbound_wq, &resume_work);return 0 ; }
drivers/hid/intel-ish-hid/ishtp-hid-client.c +2 -2
@@ -858,7 +858,7 @@ static int hid_ishtp_cl_reset(struct ishhid_ishtp_trace (client_data,"%s hid_ishtp_cl %p\n" , __func__, hid_ishtp_cl); -schedule_work (&client_data->work); +queue_work (ishtp_get_workqueue (cl_device), &client_data->work);return 0 ; }
@@ -900,7 +900,7 @@ static int hid_ishtp_cl_resume(struct dehid_ishtp_trace (client_data,"%s hid_ishtp_cl %p\n" , __func__, hid_ishtp_cl); -schedule_work (&client_data->resume_work); +queue_work (ishtp_get_workqueue (cl_device), &client_data->resume_work);return 0 ; }
drivers/hid/intel-ish-hid/ishtp/bus.c +17 -1
@@ -541,7 +541,7 @@ void ishtp_cl_bus_rx_event(struct ishtp_return ;if (device->event_cb) -schedule_work (&device->event_work); +queue_work (device->ishtp_dev->unbound_wq, &device->event_work); }/**
@@ -880,6 +880,22 @@ struct device *ishtp_get_pci_device(struEXPORT_SYMBOL (ishtp_get_pci_device);/** +* ishtp_get_workqueue - Retrieve the workqueue associated with an ISHTP device +* @cl_device: Pointer to the ISHTP client device structure +* +* Returns the workqueue_struct pointer (unbound_wq) associated with the given +* ISHTP client device. This workqueue is typically used for scheduling work +* related to the device. +* +* Return: Pointer to struct workqueue_struct. +*/ +struct workqueue_struct *ishtp_get_workqueue (struct ishtp_cl_device *cl_device) +{ +return cl_device->ishtp_dev->unbound_wq; +} +EXPORT_SYMBOL (ishtp_get_workqueue); + +/** * ishtp_trace_callback() - Return trace callback * @cl_device: ISH-TP client device instance *
drivers/hid/intel-ish-hid/ishtp/hbm.c +2 -2
@@ -573,7 +573,7 @@ void ishtp_hbm_dispatch(struct ishtp_dev/* Start firmware loading process if it has loader capability */ if (version_res->host_version_supported &ISHTP_SUPPORT_CAP_LOADER ) -schedule_work (&dev->work_fw_loader); +queue_work (dev->unbound_wq, &dev->work_fw_loader); dev->version.major_version =HBM_MAJOR_VERSION ; dev->version.minor_version =HBM_MINOR_VERSION ;
@@ -864,7 +864,7 @@ void recv_hbm(struct ishtp_device *dev, dev->rd_msg_fifo_tail = (dev->rd_msg_fifo_tail +IPC_PAYLOAD_SIZE ) % (RD_INT_FIFO_SIZE *IPC_PAYLOAD_SIZE );spin_unlock_irqrestore (&dev->rd_msg_spinlock, flags); -schedule_work (&dev->bh_hbm_work); +queue_work (dev->unbound_wq, &dev->bh_hbm_work); eoi:return ; }
drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h +3 -0
@@ -166,6 +166,9 @@ struct ishtp_device {struct hbm_version version;int transfer_path;/* Choice of transfer path: IPC or DMA */ +/* Alloc a dedicated unbound workqueue for ishtp device */ +struct workqueue_struct *unbound_wq; +/* work structure for scheduling firmware loading tasks */ struct work_struct work_fw_loader;/* waitq for waiting for command response from the firmware loader */
include/linux/intel-ish-client-if.h +2 -0
@@ -87,6 +87,8 @@ bool ishtp_wait_resume(struct ishtp_deviishtp_print_log ishtp_trace_callback (struct ishtp_cl_device *cl_device);/* Get device pointer of PCI device for DMA acces */ struct device *ishtp_get_pci_device (struct ishtp_cl_device *cl_device); +/* Get the ISHTP workqueue */ +struct workqueue_struct *ishtp_get_workqueue (struct ishtp_cl_device *cl_device);struct ishtp_cl *ishtp_cl_allocate (struct ishtp_cl_device *cl_device);void ishtp_cl_free (struct ishtp_cl *cl);
Greg Kroah-Hartman
maintainerPATCH 123/139 HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 3644f4411713f52bf231574aa8759e3d8e20b341 upstream.
Clang warns (or errors with CONFIG_WERROR=y / W=e):
drivers/hid/intel-ish-hid/ipc/ipc.c:935:36: error: cast from 'void (*)(struct workqueue_struct *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
935 | if (devm_add_action_or_reset(dev, (void (*)(void *))destroy_workqueue,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/device/devres.h:168:34: note: expanded from macro 'devm_add_action_or_reset'
168 | __devm_add_action_or_ireset(dev, action, data, #action)
| ^~~~~~
This warning is pointing out a kernel control flow integrity (kCFI / CONFIG_CFI=y) violation will occur due to this function cast when the destroy_workqueue() is indirectly called via devm_action_release() because the prototype of destroy_workqueue() does not match the prototype of (*action)().
Use a local function with the correct prototype to wrap destroy_workqueue() to resolve the warning and CFI violation.
--- drivers/hid/intel-ish-hid/ipc/ipc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/hid/intel-ish-hid/ipc/ipc.c +6 -2
@@ -932,6 +932,11 @@ static const struct ishtp_hw_ops ish_hw_ .dma_no_cache_snooping = _dma_no_cache_snooping }; +static void ishtp_free_workqueue (void *wq) +{ +destroy_workqueue (wq); +} +static struct workqueue_struct *devm_ishtp_alloc_workqueue (struct device *dev) {struct workqueue_struct *wq;
@@ -940,8 +945,7 @@ static struct workqueue_struct *devm_ishif (!wq)return NULL ; -if (devm_add_action_or_reset (dev, (void (*)(void *))destroy_workqueue, - wq)) +if (devm_add_action_or_reset (dev, ishtp_free_workqueue, wq))return NULL ;return wq;
Greg Kroah-Hartman
maintainerPATCH 124/139 btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit 5037b342825df7094a4906d1e2a9674baab50cb2 upstream.
When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction without considering whether the given transaction type actually needs to wait for that particular transaction state. The btrfs_blocked_trans_types[] array already defines which transaction types should wait for which transaction states, but this check was missing in wait_current_trans().
This can lead to a deadlock scenario involving two transactions and pending ordered extents:
1. Transaction A is in TRANS_STATE_COMMIT_DOING state
2. A worker processing an ordered extent calls start_transaction() with TRANS_JOIN
3. join_transaction() returns -EBUSY because Transaction A is in TRANS_STATE_COMMIT_DOING
4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes
5. A new Transaction B is created (TRANS_STATE_RUNNING)
6. The ordered extent from step 2 is added to Transaction B's pending ordered extents
7. Transaction B immediately starts commit by another task and enters TRANS_STATE_COMMIT_START
8. The worker finally reaches wait_current_trans(), sees Transaction B in TRANS_STATE_COMMIT_START (a blocked state), and waits unconditionally
9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START
according to btrfs_blocked_trans_types[]
10. Transaction B is waiting for pending ordered extents to complete
11. Deadlock: Transaction B waits for ordered extent, ordered extent waits for Transaction B
This can be illustrated by the following call stacks:
CPU0 CPU1
btrfs_finish_ordered_io()
start_transaction(TRANS_JOIN)
join_transaction()
# -EBUSY (Transaction A is # TRANS_STATE_COMMIT_DOING)
# Transaction A completes
# Transaction B created
# ordered extent added to
# Transaction B's pending list
btrfs_commit_transaction()
# Transaction B enters
# TRANS_STATE_COMMIT_START
# waiting for pending ordered
# extents
wait_current_trans()
# waits for Transaction B
# (should not wait!)Task bstore_kv_sync in btrfs_commit_transaction waiting for ordered extents:
__schedule+0x2e7/0x8a0 schedule+0x64/0xe0 btrfs_commit_transaction+0xbf7/0xda0 [btrfs] btrfs_sync_file+0x342/0x4d0 [btrfs] __x64_sys_fdatasync+0x4b/0x80 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Task kworker in wait_current_trans waiting for transaction commit:
Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs] __schedule+0x2e7/0x8a0 schedule+0x64/0xe0 wait_current_trans+0xb0/0x110 [btrfs] start_transaction+0x346/0x5b0 [btrfs] btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs] btrfs_work_helper+0xe8/0x350 [btrfs] process_one_work+0x1d3/0x3c0 worker_thread+0x4d/0x3e0 kthread+0x12d/0x150 ret_from_fork+0x1f/0x30
Fix this by passing the transaction type to wait_current_trans() and checking btrfs_blocked_trans_types[cur_trans->state] against the given type before deciding to wait. This ensures that transaction types which are allowed to join during certain blocked states will not unnecessarily wait and cause deadlocks.
--- fs/btrfs/transaction.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/btrfs/transaction.c +6 -5
@@ -520,13 +520,14 @@ static inline int is_transaction_blocked* when this is done, it is safe to start a new transaction, but the current * transaction might not be fully on disk. */ -static void wait_current_trans (struct btrfs_fs_info *fs_info) +static void wait_current_trans (struct btrfs_fs_info *fs_info,unsigned int type) {struct btrfs_transaction *cur_trans;spin_lock (&fs_info->trans_lock); cur_trans = fs_info->running_transaction; -if (cur_trans &&is_transaction_blocked (cur_trans)) { +if (cur_trans &&is_transaction_blocked (cur_trans) && + (btrfs_blocked_trans_types[cur_trans->state] & type)) {refcount_inc (&cur_trans->use_count);spin_unlock (&fs_info->trans_lock);
@@ -701,12 +702,12 @@ again:sb_start_intwrite (fs_info->sb);if (may_wait_transaction (fs_info, type)) -wait_current_trans (fs_info); +wait_current_trans (fs_info, type); do { ret = join_transaction(fs_info, type); if (ret == -EBUSY) { - wait_current_trans(fs_info); + wait_current_trans(fs_info, type); if (unlikely(type == TRANS_ATTACH || type == TRANS_JOIN_NOSTART)) ret = -ENOENT;
@@ -1003,7 +1004,7 @@ out:void btrfs_throttle (struct btrfs_fs_info *fs_info) { -wait_current_trans (fs_info); +wait_current_trans (fs_info,TRANS_START ); }bool btrfs_should_end_transaction (struct btrfs_trans_handle *trans)
Greg Kroah-Hartman
maintainerPATCH 125/139 xfs: set max_agbno to allow sparse alloc of last full inode chunk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <[email protected]>
commit c360004c0160dbe345870f59f24595519008926f upstream.
Sparse inode cluster allocation sets min/max agbno values to avoid allocating an inode cluster that might map to an invalid inode chunk. For example, we can't have an inode record mapped to agbno 0 or that extends past the end of a runt AG of misaligned size.
The initial calculation of max_agbno is unnecessarily conservative, however. This has triggered a corner case allocation failure where a small runt AG (i.e. 2063 blocks) is mostly full save for an extent to the EOFS boundary: [2050,13]. max_agbno is set to 2048 in this case, which happens to be the offset of the last possible valid inode chunk in the AG. In practice, we should be able to allocate the 4-block cluster at agbno 2052 to map to the parent inode record at agbno 2048, but the max_agbno value precludes it.
Note that this can result in filesystem shutdown via dirty trans cancel on stable kernels prior to commit 9eb775968b68 ("xfs: walk all AGs if TRYLOCK passed to xfs_alloc_vextent_iterate_ags") because the tail AG selection by the allocator sets t_highest_agno on the transaction. If the inode allocator spins around and finds an inode chunk with free inodes in an earlier AG, the subsequent dir name creation path may still fail to allocate due to the AG restriction and cancel.
To avoid this problem, update the max_agbno calculation to the agbno prior to the last chunk aligned agbno in the AG. This is not necessarily the last valid allocation target for a sparse chunk, but since inode chunks (i.e. records) are chunk aligned and sparse allocs are cluster sized/aligned, this allows the sb_spino_align alignment restriction to take over and round down the max effective agbno to within the last valid inode chunk in the AG.
Note that even though the allocator improvements in the aforementioned commit seem to avoid this particular dirty trans cancel situation, the max_agbno logic improvement still applies as we should be able to allocate from an AG that has been appropriately selected. The more important target for this patch however are older/stable kernels prior to this allocator rework/improvement.
--- fs/xfs/libxfs/xfs_ialloc.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/xfs/libxfs/xfs_ialloc.c +6 -5
@@ -850,15 +850,16 @@ sparse_alloc:* invalid inode records, such as records that start at agbno 0 * or extend beyond the AG. * -* Set min agbno to the first aligned, non-zero agbno and max to -* the last aligned agbno that is at least one full chunk from -* the end of the AG. +* Set min agbno to the first chunk aligned, non-zero agbno and +* max to one less than the last chunk aligned agbno from the +* end of the AG. We subtract 1 from max so that the cluster +* allocation alignment takes over and allows allocation within +* the last full inode chunk in the AG. */ args.min_agbno = args.mp->m_sb.sb_inoalignmt; args.max_agbno =round_down (xfs_ag_block_count (args.mp, pag->pag_agno), - args.mp->m_sb.sb_inoalignmt) - - igeo->ialloc_blks; + args.mp->m_sb.sb_inoalignmt) -1 ; error = xfs_alloc_vextent_near_bno(&args, XFS_AGB_TO_FSB(args.mp, pag->pag_agno,
Greg Kroah-Hartman
maintainerPATCH 126/139 mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit dc7e1d75fd8c505096d0cddeca9e2efb2b55aaf9 upstream.
When a DAMOS-scheme DAMON sysfs directory setup fails after setup of quotas/ directory, subdirectories of quotas/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
--- mm/damon/sysfs-schemes.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/damon/sysfs-schemes.c +3 -2
@@ -1609,7 +1609,7 @@ static int damon_sysfs_scheme_add_dirs(s goto put_access_pattern_out; err =damon_sysfs_scheme_set_watermarks (scheme);if (err) - goto put_quotas_access_pattern_out; + goto rmdir_put_quotas_access_pattern_out; err =damon_sysfs_scheme_set_filters (scheme);if (err) goto put_watermarks_quotas_access_pattern_out;
@@ -1630,7 +1630,8 @@ put_filters_watermarks_quotas_access_pat put_watermarks_quotas_access_pattern_out:kobject_put (&scheme->watermarks->kobj); scheme->watermarks =NULL ; -put_quotas_access_pattern_out: +rmdir_put_quotas_access_pattern_out: +damon_sysfs_quotas_rm_dirs (scheme->quotas);kobject_put (&scheme->quotas->kobj); scheme->quotas =NULL ; put_access_pattern_out:
Greg Kroah-Hartman
maintainerPATCH 127/139 mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 392b3d9d595f34877dd745b470c711e8ebcd225c upstream.
When a DAMOS-scheme DAMON sysfs directory setup fails after setup of access_pattern/ directory, subdirectories of access_pattern/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
--- mm/damon/sysfs-schemes.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/damon/sysfs-schemes.c +3 -2
@@ -1606,7 +1606,7 @@ static int damon_sysfs_scheme_add_dirs(sreturn err; err =damon_sysfs_scheme_set_quotas (scheme);if (err) - goto put_access_pattern_out; + goto rmdir_put_access_pattern_out; err =damon_sysfs_scheme_set_watermarks (scheme);if (err) goto rmdir_put_quotas_access_pattern_out;
@@ -1634,7 +1634,8 @@ rmdir_put_quotas_access_pattern_out:damon_sysfs_quotas_rm_dirs (scheme->quotas);kobject_put (&scheme->quotas->kobj); scheme->quotas =NULL ; -put_access_pattern_out: +rmdir_put_access_pattern_out: +damon_sysfs_access_pattern_rm_dirs (scheme->access_pattern);kobject_put (&scheme->access_pattern->kobj); scheme->access_pattern =NULL ;return err;
Greg Kroah-Hartman
maintainerPATCH 128/139 bpf: Reject narrower access to pointer ctx fields
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
commit e09299225d5ba3916c91ef70565f7d2187e4cca0 upstream.
The following BPF program, simplified from a syzkaller repro, causes a kernel warning:
r0 = *(u8 *)(r1 + 169);
exit;With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning:
verifier bug: error during ctx access conversion(1)
This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction.
The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency.
Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in
commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.
--- kernel/bpf/cgroup.c | 8 ++++---- net/core/filter.c | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-)
kernel/bpf/cgroup.c +4 -4
@@ -2418,22 +2418,22 @@ static bool cg_sockopt_is_valid_access(i }switch (off) { -case offsetof(struct bpf_sockopt , sk): + case bpf_ctx_range_ptr(struct bpf_sockopt, sk):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCKET ;break ; -case offsetof(struct bpf_sockopt , optval): + case bpf_ctx_range_ptr(struct bpf_sockopt, optval):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET ;break ; -case offsetof(struct bpf_sockopt , optval_end): + case bpf_ctx_range_ptr(struct bpf_sockopt, optval_end):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET_END ;break ; -case offsetof(struct bpf_sockopt , retval): + case bpf_ctx_range(struct bpf_sockopt, retval):if (size != size_default)return false;return prog->expected_attach_type ==BPF_CGROUP_GETSOCKOPT ;
net/core/filter.c +10 -10
@@ -8655,7 +8655,7 @@ static bool bpf_skb_is_valid_access(intif (size !=sizeof (__u64))return false;break ; -case offsetof(struct __sk_buff , sk): + case bpf_ctx_range_ptr(struct __sk_buff, sk):if (type ==BPF_WRITE || size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCK_COMMON_OR_NULL ;
@@ -9232,7 +9232,7 @@ static bool sock_addr_is_valid_access(inreturn false; }break ; -case offsetof(struct bpf_sock_addr , sk): + case bpf_ctx_range_ptr(struct bpf_sock_addr, sk):if (type !=BPF_READ )return false;if (size !=sizeof (__u64))
@@ -9286,17 +9286,17 @@ static bool sock_ops_is_valid_access(intif (size !=sizeof (__u64))return false;break ; -case offsetof(struct bpf_sock_ops , sk): + case bpf_ctx_range_ptr(struct bpf_sock_ops, sk):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCKET_OR_NULL ;break ; -case offsetof(struct bpf_sock_ops , skb_data): + case bpf_ctx_range_ptr(struct bpf_sock_ops, skb_data):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET ;break ; -case offsetof(struct bpf_sock_ops , skb_data_end): + case bpf_ctx_range_ptr(struct bpf_sock_ops, skb_data_end):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET_END ;
@@ -9305,7 +9305,7 @@ static bool sock_ops_is_valid_access(intbpf_ctx_record_field_size (info, size_default);return bpf_ctx_narrow_access_ok (off, size, size_default); -case offsetof(struct bpf_sock_ops , skb_hwtstamp): + case bpf_ctx_range(struct bpf_sock_ops, skb_hwtstamp):if (size !=sizeof (__u64))return false;break ;
@@ -9375,17 +9375,17 @@ static bool sk_msg_is_valid_access(int oreturn false;switch (off) { -case offsetof(struct sk_msg_md , data): + case bpf_ctx_range_ptr(struct sk_msg_md, data): info->reg_type =PTR_TO_PACKET ;if (size !=sizeof (__u64))return false;break ; -case offsetof(struct sk_msg_md , data_end): + case bpf_ctx_range_ptr(struct sk_msg_md, data_end): info->reg_type =PTR_TO_PACKET_END ;if (size !=sizeof (__u64))return false;break ; -case offsetof(struct sk_msg_md , sk): + case bpf_ctx_range_ptr(struct sk_msg_md, sk):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCKET ;
@@ -11598,7 +11598,7 @@ static bool sk_lookup_is_valid_access(inreturn false;switch (off) { -case offsetof(struct bpf_sk_lookup , sk): + case bpf_ctx_range_ptr(struct bpf_sk_lookup, sk): info->reg_type =PTR_TO_SOCKET_OR_NULL ;return size ==sizeof (__u64);
Greg Kroah-Hartman
maintainerPATCH 129/139 selftests/bpf: Test invalid narrower ctx load
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
commit ba578b87fe2beef95b37264f8a98c0b505b93de9 upstream.
This patch adds selftests to cover invalid narrower loads on the context. These used to cause kernel warnings before the previous patch. To trigger the warning, the load had to be aligned, to read an affected context field (ex., skb->sk), and not starting at the beginning of the field.
The nine new cases all fail without the previous patch.
--- tools/testing/selftests/bpf/progs/verifier_ctx.c | 25 +++++++++++++++++++++++ 1 file changed, 25 insertions(+)
tools/testing/selftests/bpf/progs/verifier_ctx.c +25 -0
@@ -218,4 +218,29 @@ __naked void null_check_8_null_bind(void : __clobber_all); } +#define narrow_load (type, ctx, field) \ + SEC(type) \ + __description("narrow load on field " #field " of " #ctx) \ + __failure __msg("invalid bpf_context access") \ + __naked void invalid_narrow_load##ctx##field(void) \ + { \ + asm volatile (" \ + r1 = *(u32 *)(r1 + %[off]); \ + r0 = 0; \ + exit;" \ + : \ + : __imm_const(off, offsetof(struct ctx, field) + 4) \ + : __clobber_all); \ + } + +narrow_load ("cgroup/getsockopt" , bpf_sockopt, sk); +narrow_load ("cgroup/getsockopt" , bpf_sockopt, optval); +narrow_load ("cgroup/getsockopt" , bpf_sockopt, optval_end); +narrow_load ("tc" , __sk_buff, sk); +narrow_load ("cgroup/bind4" , bpf_sock_addr, sk); +narrow_load ("sockops" , bpf_sock_ops, sk); +narrow_load ("sockops" , bpf_sock_ops, skb_data); +narrow_load ("sockops" , bpf_sock_ops, skb_data_end); +narrow_load ("sockops" , bpf_sock_ops, skb_hwtstamp); + char _license[] SEC("license") = "GPL";
Greg Kroah-Hartman
maintainerPATCH 130/139 mm: kmsan: fix poisoning of high-order non-compound pages
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
[ Upstream commit 4795d205d78690a46b60164f44b8bb7b3e800865 ]
kmsan_free_page() is called by the page allocator's free_pages_prepare() during page freeing. Its job is to poison all the memory covered by the page. It can be called with an order-0 page, a compound high-order page or a non-compound high-order page. But page_size() only works for order-0 and compound pages. For a non-compound high-order page it will incorrectly return PAGE_SIZE.
The implication is that the tail pages of a high-order non-compound page do not get poisoned at free, so any invalid access while they are free could go unnoticed. It looks like the pages will be poisoned again at allocation time, so that would bookend the window.
Fix this by using the order parameter to calculate the size.
--- mm/kmsan/shadow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/kmsan/shadow.c +1 -1
@@ -208,7 +208,7 @@ void kmsan_free_page(struct page *page,return ;kmsan_enter_runtime ();kmsan_internal_poison_memory (page_address (page), -page_size (page), +PAGE_SIZE << order,GFP_KERNEL ,KMSAN_POISON_CHECK |KMSAN_POISON_FREE );kmsan_leave_runtime ();
Greg Kroah-Hartman
maintainerPATCH 131/139 mm/fake-numa: allow later numa node hotplug
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruno Faccini <[email protected]>
[ Upstream commit 63db8170bf34ce9e0763f87d993cf9b4c9002b09 ]
Current fake-numa implementation prevents new Numa nodes to be later hot-plugged by drivers. A common symptom of this limitation is the "node <X> was absent from the node_possible_map" message by associated warning in mm/memory_hotplug.c: add_memory_resource().
This comes from the lack of remapping in both pxm_to_node_map[] and node_to_pxm_map[] tables to take fake-numa nodes into account and thus triggers collisions with original and physical nodes only-mapping that had been determined from BIOS tables.
This patch fixes this by doing the necessary node-ids translation in both pxm_to_node_map[]/node_to_pxm_map[] tables. node_distance[] table has also been fixed accordingly.
Details:
When trying to use fake-numa feature on our system where new Numa nodes are being "hot-plugged" upon driver load, this fails with the following type of message and warning with stack :
node 8 was absent from the node_possible_map WARNING: CPU: 61 PID: 4259 at mm/memory_hotplug.c:1506 add_memory_resource+0x3dc/0x418
This issue prevents the use of the fake-NUMA debug feature with the system's full configuration, when it has proven to be sometimes extremely useful for performance testing of multi-tasked, memory-bound applications, as it enables better isolation of processes/ranks compared to fat NUMA nodes.
Usual numactl output after driver has “hot-plugged”/unveiled some new Numa nodes with and without memory :
$ numactl --hardware available: 9 nodes (0-8) node 0 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 0 size: 490037 MB node 0 free: 484432 MB node 1 cpus: node 1 size: 97280 MB node 1 free: 97279 MB node 2 cpus: node 2 size: 0 MB node 2 free: 0 MB node 3 cpus: node 3 size: 0 MB node 3 free: 0 MB node 4 cpus: node 4 size: 0 MB node 4 free: 0 MB node 5 cpus: node 5 size: 0 MB node 5 free: 0 MB node 6 cpus: node 6 size: 0 MB node 6 free: 0 MB node 7 cpus: node 7 size: 0 MB node 7 free: 0 MB node 8 cpus: node 8 size: 0 MB node 8 free: 0 MB node distances: node 0 1 2 3 4 5 6 7 8 0: 10 80 80 80 80 80 80 80 80 1: 80 10 255 255 255 255 255 255 255 2: 80 255 10 255 255 255 255 255 255 3: 80 255 255 10 255 255 255 255 255 4: 80 255 255 255 10 255 255 255 255 5: 80 255 255 255 255 10 255 255 255 6: 80 255 255 255 255 255 10 255 255 7: 80 255 255 255 255 255 255 10 255 8: 80 255 255 255 255 255 255 255 10
With recent M.Rapoport set of fake-numa patches in mm-everything and using numa=fake=4 boot parameter :
$ numactl --hardware available: 4 nodes (0-3) node 0 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 0 size: 122518 MB node 0 free: 117141 MB node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 1 size: 219911 MB node 1 free: 219751 MB node 2 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 2 size: 122599 MB node 2 free: 122541 MB node 3 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 3 size: 122479 MB node 3 free: 122408 MB node distances: node 0 1 2 3 0: 10 10 10 10 1: 10 10 10 10 2: 10 10 10 10 3: 10 10 10 10
With recent M.Rapoport set of fake-numa patches in mm-everything, this patch on top, using numa=fake=4 boot parameter :
# numactl —hardware available: 12 nodes (0-11) node 0 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 0 size: 122518 MB node 0 free: 116429 MB node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 1 size: 122631 MB node 1 free: 122576 MB node 2 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 2 size: 122599 MB node 2 free: 122544 MB node 3 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 node 3 size: 122479 MB node 3 free: 122419 MB node 4 cpus: node 4 size: 97280 MB node 4 free: 97279 MB node 5 cpus: node 5 size: 0 MB node 5 free: 0 MB node 6 cpus: node 6 size: 0 MB node 6 free: 0 MB node 7 cpus: node 7 size: 0 MB node 7 free: 0 MB node 8 cpus: node 8 size: 0 MB node 8 free: 0 MB node 9 cpus: node 9 size: 0 MB node 9 free: 0 MB node 10 cpus: node 10 size: 0 MB node 10 free: 0 MB node 11 cpus: node 11 size: 0 MB node 11 free: 0 MB node distances: node 0 1 2 3 4 5 6 7 8 9 10 11 0: 10 10 10 10 80 80 80 80 80 80 80 80 1: 10 10 10 10 80 80 80 80 80 80 80 80 2: 10 10 10 10 80 80 80 80 80 80 80 80 3: 10 10 10 10 80 80 80 80 80 80 80 80 4: 80 80 80 80 10 255 255 255 255 255 255 255 5: 80 80 80 80 255 10 255 255 255 255 255 255 6: 80 80 80 80 255 255 10 255 255 255 255 255 7: 80 80 80 80 255 255 255 10 255 255 255 255 8: 80 80 80 80 255 255 255 255 10 255 255 255 9: 80 80 80 80 255 255 255 255 255 10 255 255 10: 80 80 80 80 255 255 255 255 255 255 10 255 11: 80 80 80 80 255 255 255 255 255 255 255 10
Stable-dep-of: f46c26f1bcd9 ("mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'")
--- drivers/acpi/numa/srat.c | 86 +++++++++++++++++++++++++++++++++++++++++++ include/acpi/acpi_numa.h | 5 ++ include/linux/numa_memblks.h | 3 + mm/numa_emulation.c | 45 +++++++++++++++++++--- mm/numa_memblks.c | 2 - 5 files changed, 133 insertions(+), 8 deletions(-)
drivers/acpi/numa/srat.c +86 -0
@@ -81,6 +81,92 @@ int acpi_map_pxm_to_node(int pxm) }EXPORT_SYMBOL (acpi_map_pxm_to_node); +#ifdef CONFIG_NUMA_EMU +/* +* Take max_nid - 1 fake-numa nodes into account in both +* pxm_to_node_map()/node_to_pxm_map[] tables. +*/ +int __init fix_pxm_node_maps (int max_nid) +{ +static int pxm_to_node_map_copy[MAX_PXM_DOMAINS ]__initdata + = { [0 ...MAX_PXM_DOMAINS -1 ] =NUMA_NO_NODE }; +static int node_to_pxm_map_copy[MAX_NUMNODES ]__initdata + = { [0 ...MAX_NUMNODES -1 ] =PXM_INVAL }; +int i, j, index =-1 , count =0 ; +nodemask_t nodes_to_enable; + +if (numa_off ||srat_disabled ()) +return -1 ; + +/* find fake nodes PXM mapping */ +for (i =0 ; i <MAX_NUMNODES ; i++) { +if (node_to_pxm_map[i] !=PXM_INVAL ) { +for (j =0 ; j <= max_nid; j++) { +if ((emu_nid_to_phys[j] == i) && +WARN (node_to_pxm_map_copy[j] !=PXM_INVAL , +"Node %d is already binded to PXM %d\n" , + j, node_to_pxm_map_copy[j])) +return -1 ; +if (emu_nid_to_phys[j] == i) { + node_to_pxm_map_copy[j] = + node_to_pxm_map[i]; +if (j > index) + index = j; + count++; + } + } + } + } +if (WARN (index != max_nid,"%d max nid when expected %d\n" , + index, max_nid)) +return -1 ; + +nodes_clear (nodes_to_enable); + +/* map phys nodes not used for fake nodes */ +for (i =0 ; i <MAX_NUMNODES ; i++) { +if (node_to_pxm_map[i] !=PXM_INVAL ) { +for (j =0 ; j <= max_nid; j++) +if (emu_nid_to_phys[j] == i) +break ; +/* fake nodes PXM mapping has been done */ +if (j <= max_nid) +continue ; +/* find first hole */ +for (j =0 ; + j <MAX_NUMNODES && + node_to_pxm_map_copy[j] !=PXM_INVAL ; + j++) + ; +if (WARN (j ==MAX_NUMNODES , +"Number of nodes exceeds MAX_NUMNODES\n" )) +return -1 ; + node_to_pxm_map_copy[j] = node_to_pxm_map[i]; +node_set (j, nodes_to_enable); + count++; + } + } + +/* creating reverse mapping in pxm_to_node_map[] */ +for (i =0 ; i <MAX_NUMNODES ; i++) +if (node_to_pxm_map_copy[i] !=PXM_INVAL && + pxm_to_node_map_copy[node_to_pxm_map_copy[i]] ==NUMA_NO_NODE ) + pxm_to_node_map_copy[node_to_pxm_map_copy[i]] = i; + +/* overwrite with new mapping */ +for (i =0 ; i <MAX_NUMNODES ; i++) { + node_to_pxm_map[i] = node_to_pxm_map_copy[i]; + pxm_to_node_map[i] = pxm_to_node_map_copy[i]; + } + +/* enable other nodes found in PXM for hotplug */ +nodes_or (numa_nodes_parsed, nodes_to_enable, numa_nodes_parsed); + +pr_debug ("found %d total number of nodes\n" , count); +return 0 ; +} +#endif +static void __init acpi_table_print_srat_entry (struct acpi_subtable_header *header) {
include/acpi/acpi_numa.h +5 -0
@@ -17,11 +17,16 @@ extern int node_to_pxm(int);extern int acpi_map_pxm_to_node (int );extern unsigned char acpi_srat_revision;extern void disable_srat (void ); +extern int fix_pxm_node_maps (int max_nid);extern void bad_srat (void );extern int srat_disabled (void );#else /* CONFIG_ACPI_NUMA */ +static inline int fix_pxm_node_maps (int max_nid) +{ +return 0 ; +}static inline void disable_srat (void ) { }
include/linux/numa_memblks.h +3 -0
@@ -29,7 +29,10 @@ int __init numa_cleanup_meminfo(struct nint __init numa_memblks_init (int (*init_func)(void ),bool memblock_force_top_down); +extern int numa_distance_cnt; +#ifdef CONFIG_NUMA_EMU +extern int emu_nid_to_phys[MAX_NUMNODES ];int numa_emu_cmdline (char *str);void __init numa_emu_update_cpu_to_node (int *emu_nid_to_phys,unsigned int nr_emu_nids);
mm/numa_emulation.c +38 -7
93 lines not on this page · raw message
mm/numa_memblks.c +1 -1
@@ -7,7 +7,7 @@#include <linux/numa.h> #include <linux/numa_memblks.h> -static int numa_distance_cnt; +int numa_distance_cnt;static u8 *numa_distance;nodemask_t numa_nodes_parsed__initdata ;
Greg Kroah-Hartman
maintainerPATCH 132/139 mm: numa,memblock: include <asm/numa.h> for numa_nodes_parsed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <[email protected]>
[ Upstream commit f46c26f1bcd9164d7f3377f15ca75488a3e44362 ]
The 'numa_nodes_parsed' is defined in <asm/numa.h> but this file is not included in mm/numa_memblks.c (build x86_64) so add this to the incldues to fix the following sparse warning:
mm/numa_memblks.c:13:12: warning: symbol 'numa_nodes_parsed' was not declared. Should it be static?
--- mm/numa_memblks.c | 2 ++ 1 file changed, 2 insertions(+)
mm/numa_memblks.c +2 -0
@@ -7,6 +7,8 @@#include <linux/numa.h> #include <linux/numa_memblks.h> +#include <asm/numa.h> +int numa_distance_cnt;static u8 *numa_distance;
Greg Kroah-Hartman
maintainerPATCH 133/139 phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
[ Upstream commit 40452520850683f6771094ca218ff206d1fcb022 ]
Improve error handling in the probe path by using function dev_err_probe() instead of function dev_err(), where appropriate.
Stable-dep-of: e07dea3de508 ("phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()")
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 27 +++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +10 -17
@@ -424,11 +424,9 @@ static int rockchip_usb2phy_extcon_regisif (of_property_read_bool (node,"extcon" )) { edev =extcon_get_edev_by_phandle (rphy->dev,0 ); -if (IS_ERR (edev)) { -if (PTR_ERR (edev) != -EPROBE_DEFER ) -dev_err (rphy->dev,"Invalid or missing extcon\n" ); -return PTR_ERR (edev); - } +if (IS_ERR (edev)) +return dev_err_probe (rphy->dev,PTR_ERR (edev), +"invalid or missing extcon\n" ); }else {/* Initialize extcon device */ edev = devm_extcon_dev_allocate(rphy->dev,
@@ -438,10 +436,9 @@ static int rockchip_usb2phy_extcon_regisreturn -ENOMEM ; ret =devm_extcon_dev_register (rphy->dev, edev); -if (ret) { -dev_err (rphy->dev,"failed to register extcon device\n" ); -return ret; - } +if (ret) +return dev_err_probe (rphy->dev, ret, +"failed to register extcon device\n" ); } rphy->edev = edev;
@@ -1417,10 +1414,8 @@ static int rockchip_usb2phy_probe(struct } ret =rockchip_usb2phy_clk480m_register (rphy); -if (ret) { -dev_err (dev,"failed to register 480m output clock\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"failed to register 480m output clock\n" );if (rphy->phy_cfg->phy_tuning) { ret = rphy->phy_cfg->phy_tuning (rphy);
@@ -1440,8 +1435,7 @@ static int rockchip_usb2phy_probe(struct phy =devm_phy_create (dev, child_np, &rockchip_usb2phy_ops);if (IS_ERR (phy)) { -dev_err_probe (dev,PTR_ERR (phy),"failed to create phy\n" ); - ret =PTR_ERR (phy); + ret =dev_err_probe (dev,PTR_ERR (phy),"failed to create phy\n" ); goto put_child; }
@@ -1478,8 +1472,7 @@ next_child:"rockchip_usb2phy" , rphy);if (ret) { -dev_err (rphy->dev, -"failed to request usb2phy irq handle\n" ); +dev_err_probe (rphy->dev, ret,"failed to request usb2phy irq handle\n" ); goto put_child; } }
Greg Kroah-Hartman
maintainerPATCH 134/139 phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit e07dea3de508cd6950c937cec42de7603190e1ca ]
The for_each_available_child_of_node() calls of_node_put() to release child_np in each success loop. After breaking from the loop with the child_np has been released, the code will jump to the put_child label and will call the of_node_put() again if the devm_request_threaded_irq() fails. These cause a double free bug.
Fix by returning directly to avoid the duplicate of_node_put().
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +1 -1
@@ -1473,7 +1473,7 @@ next_child: rphy);if (ret) {dev_err_probe (rphy->dev, ret,"failed to request usb2phy irq handle\n" ); - goto put_child; +return ret; } }
Greg Kroah-Hartman
maintainerPATCH 135/139 dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
[ Upstream commit b18cd8b210417f90537d914ffb96e390c85a7379 ]
When fsl_edma_alloc_chan_resources() fails after clk_prepare_enable(), the error paths only free IRQs and destroy the TCD pool, but forget to call clk_disable_unprepare(). This causes the channel clock to remain enabled, leaking power and resources.
Fix it by disabling the channel clock in the error unwind path.
--- drivers/dma/fsl-edma-common.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/fsl-edma-common.c +1 -0
@@ -819,6 +819,7 @@ int fsl_edma_alloc_chan_resources(structif (ret) {dma_pool_destroy (fsl_chan->tcd_pool); +clk_disable_unprepare (fsl_chan->clk);return ret; } }
Greg Kroah-Hartman
maintainerPATCH 136/139 mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hahn <[email protected]>
[ Upstream commit 0acc67c4030c39f39ac90413cc5d0abddd3a9527 ]
Patch series "mm/page_alloc: Batch callers of free_pcppages_bulk", v5.
Motivation & Approach
=====================
While testing workloads with high sustained memory pressure on large machines in the Meta fleet (1Tb memory, 316 CPUs), we saw an unexpectedly high number of softlockups. Further investigation showed that the zone lock in free_pcppages_bulk was being held for a long time, and was called to free 2k+ pages over 100 times just during boot.
This causes starvation in other processes for the zone lock, which can lead to the system stalling as multiple threads cannot make progress without the locks. We can see these issues manifesting as warnings:
[ 4512.591979] rcu: INFO: rcu_sched self-detected stall on CPU [ 4512.604370] rcu: 20-....: (9312 ticks this GP) idle=a654/1/0x4000000000000000 softirq=309340/309344 fqs=5426 [ 4512.626401] rcu: hardirqs softirqs csw/system [ 4512.638793] rcu: number: 0 145 0 [ 4512.651177] rcu: cputime: 30 10410 174 ==> 10558(ms) [ 4512.666657] rcu: (t=21077 jiffies g=783665 q=1242213 ncpus=316)
While these warnings don't indicate a crash or a kernel panic, they do point to the underlying issue of lock contention. To prevent starvation in both locks, batch the freeing of pages using pcp->batch.
Because free_pcppages_bulk is called with the pcp lock and acquires the zone lock, relinquishing and reacquiring the locks are only effective when both of them are broken together (unless the system was built with queued spinlocks). Thus, instead of modifying free_pcppages_bulk to break both locks, batch the freeing from its callers instead.
A similar fix has been implemented in the Meta fleet, and we have seen significantly less softlockups.
Testing
=======
The following are a few synthetic benchmarks, made on three machines. The first is a large machine with 754GiB memory and 316 processors. The second is a relatively smaller machine with 251GiB memory and 176 processors. The third and final is the smallest of the three, which has 62GiB memory and 36 processors.
On all machines, I kick off a kernel build with -j$(nproc). Negative delta is better (faster compilation).
Large machine (754GiB memory, 316 processors)
make -j$(nproc)
+------------+---------------+-----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+-----------+ | real | 0.8070 | - 1.4865 | | user | 0.2823 | + 0.4081 | | sys | 5.0267 | -11.8737 | +------------+---------------+-----------+
Medium machine (251GiB memory, 176 processors)
make -j$(nproc)
+------------+---------------+----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+----------+ | real | 0.2806 | +0.0351 | | user | 0.0994 | +0.3170 | | sys | 0.6229 | -0.6277 | +------------+---------------+----------+
Small machine (62GiB memory, 36 processors)
make -j$(nproc)
+------------+---------------+----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+----------+ | real | 0.1503 | -2.6585 | | user | 0.0431 | -2.2984 | | sys | 0.1870 | -3.2013 | +------------+---------------+----------+
Here, variation is the coefficient of variation, i.e. standard deviation / mean.
Based on these results, it seems like there are varying degrees to how much lock contention this reduces. For the largest and smallest machines that I ran the tests on, it seems like there is quite some significant reduction. There is also some performance increases visible from userspace.
Interestingly, the performance gains don't scale with the size of the machine, but rather there seems to be a dip in the gain there is for the medium-sized machine. One possible theory is that because the high watermark depends on both memory and the number of local CPUs, what impacts zone contention the most is not these individual values, but rather the ratio of mem:processors.
This patch (of 5):
Currently, refresh_cpu_vm_stats returns an int, indicating how many changes were made during its updates. Using this information, callers like vmstat_update can heuristically determine if more work will be done in the future.
However, all of refresh_cpu_vm_stats's callers either (a) ignore the result, only caring about performing the updates, or (b) only care about whether changes were made, but not *how many* changes were made.
Simplify the code by returning a bool instead to indicate if updates were made.
In addition, simplify fold_diff and decay_pcp_high to return a bool for the same reason.
Stable-dep-of: 038a102535eb ("mm/page_alloc: prevent pcp corruption with SMP=n")
--- include/linux/gfp.h | 2 +- mm/page_alloc.c | 8 ++++---- mm/vmstat.c | 28 +++++++++++++++------------- 3 files changed, 20 insertions(+), 18 deletions(-)
include/linux/gfp.h +1 -1
@@ -397,7 +397,7 @@ extern void page_frag_free(void *addr);#define free_page (addr) free_pages((addr), 0)void page_alloc_init_cpuhp (void ); -int decay_pcp_high (struct zone *zone,struct per_cpu_pages *pcp); +bool decay_pcp_high (struct zone *zone,struct per_cpu_pages *pcp);void drain_zone_pages (struct zone *zone,struct per_cpu_pages *pcp);void drain_all_pages (struct zone *zone);void drain_local_pages (struct zone *zone);
mm/page_alloc.c +4 -4
@@ -2363,10 +2363,10 @@ static int rmqueue_bulk(struct zone *zon* Called from the vmstat counter updater to decay the PCP high. * Return whether there are addition works to do. */ -int decay_pcp_high (struct zone *zone,struct per_cpu_pages *pcp) +bool decay_pcp_high (struct zone *zone,struct per_cpu_pages *pcp) {int high_min, to_drain, batch; -int todo =0 ; +bool todo = false; high_min =READ_ONCE (pcp->high_min); batch =READ_ONCE (pcp->batch);
@@ -2379,7 +2379,7 @@ int decay_pcp_high(struct zone *zone, st pcp->high =max3 (pcp->count - (batch <<CONFIG_PCP_BATCH_SCALE_MAX ), pcp->high - (pcp->high >>3 ), high_min);if (pcp->high > high_min) - todo++; + todo = true; } to_drain = pcp->count - pcp->high;
@@ -2387,7 +2387,7 @@ int decay_pcp_high(struct zone *zone, stspin_lock (&pcp->lock);free_pcppages_bulk (zone, to_drain, pcp,0 );spin_unlock (&pcp->lock); - todo++; + todo = true; }return todo;
mm/vmstat.c +15 -13
@@ -768,25 +768,25 @@ EXPORT_SYMBOL(dec_node_page_state);/* * Fold a differential into the global counters. -* Returns the number of counters updated. +* Returns whether counters were updated. */ static int fold_diff (int *zone_diff,int *node_diff) {int i; -int changes =0 ; +bool changed = false;for (i =0 ; i <NR_VM_ZONE_STAT_ITEMS ; i++)if (zone_diff[i]) {atomic_long_add (zone_diff[i], &vm_zone_stat[i]); - changes++; + changed = true; }for (i =0 ; i <NR_VM_NODE_STAT_ITEMS ; i++)if (node_diff[i]) {atomic_long_add (node_diff[i], &vm_node_stat[i]); - changes++; + changed = true; } -return changes; +return changed; }/*
@@ -803,16 +803,16 @@ static int fold_diff(int *zone_diff, int* with the global counters. These could cause remote node cache line * bouncing and will have to be only done when necessary. * -* The function returns the number of global counters updated. +* The function returns whether global counters were updated. */ -static int refresh_cpu_vm_stats (bool do_pagesets) +static bool refresh_cpu_vm_stats (bool do_pagesets) {struct pglist_data *pgdat;struct zone *zone;int i;int global_zone_diff[NR_VM_ZONE_STAT_ITEMS ] = {0 , };int global_node_diff[NR_VM_NODE_STAT_ITEMS ] = {0 , }; -int changes =0 ; +bool changed = false;for_each_populated_zone (zone) {struct per_cpu_zonestat __percpu *pzstats = zone->per_cpu_zonestats;
@@ -836,7 +836,8 @@ static int refresh_cpu_vm_stats(bool do_if (do_pagesets) {cond_resched (); - changes +=decay_pcp_high (zone,this_cpu_ptr (pcp)); +if (decay_pcp_high (zone,this_cpu_ptr (pcp))) + changed = true;#ifdef CONFIG_NUMA /* * Deal with draining the remote pageset of this
@@ -858,13 +859,13 @@ static int refresh_cpu_vm_stats(bool do_ }if (__this_cpu_dec_return (pcp->expire)) { - changes++; + changed = true;continue ; }if (__this_cpu_read (pcp->count)) {drain_zone_pages (zone,this_cpu_ptr (pcp)); - changes++; + changed = true; }#endif }
@@ -884,8 +885,9 @@ static int refresh_cpu_vm_stats(bool do_ } } - changes +=fold_diff (global_zone_diff, global_node_diff); -return changes; +if (fold_diff (global_zone_diff, global_node_diff)) + changed = true; +return changed; }/*
Greg Kroah-Hartman
maintainerPATCH 137/139 mm/page_alloc: batch page freeing in decay_pcp_high
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hahn <[email protected]>
[ Upstream commit fc4b909c368f3a7b08c895dd5926476b58e85312 ]
It is possible for pcp->count - pcp->high to exceed pcp->batch by a lot. When this happens, we should perform batching to ensure that free_pcppages_bulk isn't called with too many pages to free at once and starve out other threads that need the pcp or zone lock.
Since we are still only freeing the difference between the initial pcp->count and pcp->high values, there should be no change to how many pages are freed.
Stable-dep-of: 038a102535eb ("mm/page_alloc: prevent pcp corruption with SMP=n")
--- mm/page_alloc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
mm/page_alloc.c +6 -3
@@ -2365,7 +2365,7 @@ static int rmqueue_bulk(struct zone *zon*/ bool decay_pcp_high (struct zone *zone,struct per_cpu_pages *pcp) { -int high_min, to_drain, batch; +int high_min, to_drain, to_drain_batched, batch;bool todo = false; high_min =READ_ONCE (pcp->high_min);
@@ -2383,11 +2383,14 @@ bool decay_pcp_high(struct zone *zone, s } to_drain = pcp->count - pcp->high; -if (to_drain >0 ) { +while (to_drain >0 ) { + to_drain_batched =min (to_drain, batch);spin_lock (&pcp->lock); -free_pcppages_bulk (zone, to_drain, pcp,0 ); +free_pcppages_bulk (zone, to_drain_batched, pcp,0 );spin_unlock (&pcp->lock); todo = true; + + to_drain -= to_drain_batched; }return todo;
Greg Kroah-Hartman
maintainerPATCH 138/139 mm/page_alloc: prevent pcp corruption with SMP=n
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <[email protected]>
[ Upstream commit 038a102535eb49e10e93eafac54352fcc5d78847 ]
The kernel test robot has reported:
BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0 CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT 8cc09ef94dcec767faa911515ce9e609c45db470 Call Trace: <IRQ> __dump_stack (lib/dump_stack.c:95) dump_stack_lvl (lib/dump_stack.c:123) dump_stack (lib/dump_stack.c:130) spin_dump (kernel/locking/spinlock_debug.c:71) do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?) _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138) __free_frozen_pages (mm/page_alloc.c:2973) ___free_pages (mm/page_alloc.c:5295) __free_pages (mm/page_alloc.c:5334) tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290) ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289) ? rcu_core (kernel/rcu/tree.c:?) rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861) rcu_core_si (kernel/rcu/tree.c:2879) handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623) __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725) irq_exit_rcu (kernel/softirq.c:741) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052) </IRQ> <TASK> RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) free_pcppages_bulk (mm/page_alloc.c:1494) drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632) __drain_all_pages (mm/page_alloc.c:2731) drain_all_pages (mm/page_alloc.c:2747) kcompactd (mm/compaction.c:3115) kthread (kernel/kthread.c:465) ? __cfi_kcompactd (mm/compaction.c:3166) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork (arch/x86/kernel/process.c:164) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) </TASK>
Matthew has analyzed the report and identified that in drain_page_zone() we are in a section protected by spin_lock(&pcp->lock) and then get an interrupt that attempts spin_trylock() on the same lock. The code is designed to work this way without disabling IRQs and occasionally fail the trylock with a fallback. However, the SMP=n spinlock implementation assumes spin_trylock() will always succeed, and thus it's normally a no-op. Here the enabled lock debugging catches the problem, but otherwise it could cause a corruption of the pcp structure.
The problem has been introduced by commit 574907741599 ("mm/page_alloc:
leave IRQs enabled for per-cpu page allocations"). The pcp locking scheme recognizes the need for disabling IRQs to prevent nesting spin_trylock() sections on SMP=n, but the need to prevent the nesting in spin_lock() has not been recognized. Fix it by introducing local wrappers that change the spin_lock() to spin_lock_iqsave() with SMP=n and use them in all places that do spin_lock(&pcp->lock).
--- mm/page_alloc.c | 47 +++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 8 deletions(-)
mm/page_alloc.c +39 -8
@@ -163,6 +163,33 @@ static DEFINE_MUTEX(pcp_batch_high_lock)#define pcp_spin_unlock (ptr) \ pcpu_spin_unlock(lock, ptr) +/* +* With the UP spinlock implementation, when we spin_lock(&pcp->lock) (for i.e. +* a potentially remote cpu drain) and get interrupted by an operation that +* attempts pcp_spin_trylock(), we can't rely on the trylock failure due to UP +* spinlock assumptions making the trylock a no-op. So we have to turn that +* spin_lock() to a spin_lock_irqsave(). This works because on UP there are no +* remote cpu's so we can only be locking the only existing local one. +*/ +#if defined(CONFIG_SMP ) || defined(CONFIG_PREEMPT_RT ) +static inline void __flags_noop (unsigned long *flags) { } +#define pcp_spin_lock_maybe_irqsave (ptr, flags) \ +({ \ + __flags_noop(&(flags)); \ + spin_lock(&(ptr)->lock); \ +}) +#define pcp_spin_unlock_maybe_irqrestore (ptr, flags) \ +({ \ + spin_unlock(&(ptr)->lock); \ + __flags_noop(&(flags)); \ +}) +#else +#define pcp_spin_lock_maybe_irqsave (ptr, flags) \ + spin_lock_irqsave(&(ptr)->lock, flags) +#define pcp_spin_unlock_maybe_irqrestore (ptr, flags) \ + spin_unlock_irqrestore(&(ptr)->lock, flags) +#endif +#ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID DEFINE_PER_CPU (int, numa_node);EXPORT_PER_CPU_SYMBOL (numa_node);
@@ -2366,6 +2393,7 @@ static int rmqueue_bulk(struct zone *zonbool decay_pcp_high (struct zone *zone,struct per_cpu_pages *pcp) {int high_min, to_drain, to_drain_batched, batch; +unsigned long UP_flags;bool todo = false; high_min =READ_ONCE (pcp->high_min);
@@ -2385,9 +2413,9 @@ bool decay_pcp_high(struct zone *zone, s to_drain = pcp->count - pcp->high;while (to_drain >0 ) { to_drain_batched =min (to_drain, batch); -spin_lock (&pcp->lock); +pcp_spin_lock_maybe_irqsave (pcp, UP_flags);free_pcppages_bulk (zone, to_drain_batched, pcp,0 ); -spin_unlock (&pcp->lock); +pcp_spin_unlock_maybe_irqrestore (pcp, UP_flags); todo = true; to_drain -= to_drain_batched;
@@ -2404,14 +2432,15 @@ bool decay_pcp_high(struct zone *zone, s*/ void drain_zone_pages (struct zone *zone,struct per_cpu_pages *pcp) { +unsigned long UP_flags;int to_drain, batch; batch =READ_ONCE (pcp->batch); to_drain =min (pcp->count, batch);if (to_drain >0 ) { -spin_lock (&pcp->lock); +pcp_spin_lock_maybe_irqsave (pcp, UP_flags);free_pcppages_bulk (zone, to_drain, pcp,0 ); -spin_unlock (&pcp->lock); +pcp_spin_unlock_maybe_irqrestore (pcp, UP_flags); } }#endif
@@ -2422,10 +2451,11 @@ void drain_zone_pages(struct zone *zone,static void drain_pages_zone (unsigned int cpu,struct zone *zone) {struct per_cpu_pages *pcp =per_cpu_ptr (zone->per_cpu_pageset, cpu); +unsigned long UP_flags;int count; do { - spin_lock(&pcp->lock); + pcp_spin_lock_maybe_irqsave(pcp, UP_flags); count = pcp->count; if (count) { int to_drain = min(count,
@@ -2434,7 +2464,7 @@ static void drain_pages_zone(unsigned infree_pcppages_bulk (zone, to_drain, pcp,0 ); count -= to_drain; } -spin_unlock (&pcp->lock); +pcp_spin_unlock_maybe_irqrestore (pcp, UP_flags); }while (count); }
@@ -5795,6 +5825,7 @@ static void zone_pcp_update_cacheinfo(st {struct per_cpu_pages *pcp;struct cpu_cacheinfo *cci; +unsigned long UP_flags; pcp =per_cpu_ptr (zone->per_cpu_pageset, cpu); cci =get_cpu_cacheinfo (cpu);
@@ -5805,12 +5836,12 @@ static void zone_pcp_update_cacheinfo(st* This can reduce zone lock contention without hurting * cache-hot pages sharing. */ -spin_lock (&pcp->lock); +pcp_spin_lock_maybe_irqsave (pcp, UP_flags);if ((cci->per_cpu_data_slice_size >>PAGE_SHIFT ) >3 * pcp->batch) pcp->flags |=PCPF_FREE_HIGH_BATCH ;else pcp->flags &= ~PCPF_FREE_HIGH_BATCH ; -spin_unlock (&pcp->lock); +pcp_spin_unlock_maybe_irqrestore (pcp, UP_flags); }void setup_pcp_cacheinfo (unsigned int cpu)
Greg Kroah-Hartman
maintainerPATCH 139/139 mm/fake-numa: handle cases with no SRAT info
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruno Faccini <[email protected]>
commit 4c80187001d3e2876dfe7e011b9eac3b6270156f upstream.
Handle more gracefully cases where no SRAT information is available, like in VMs with no Numa support, and allow fake-numa configuration to complete successfully in these cases
--- drivers/acpi/numa/srat.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/acpi/numa/srat.c +10 -1
@@ -95,9 +95,13 @@ int __init fix_pxm_node_maps(int max_nidint i, j, index =-1 , count =0 ;nodemask_t nodes_to_enable; -if (numa_off ||srat_disabled ()) +if (numa_off)return -1 ; +/* no or incomplete node/PXM mapping set, nothing to do */ +if (srat_disabled ()) +return 0 ; +/* find fake nodes PXM mapping */ for (i =0 ; i <MAX_NUMNODES ; i++) {if (node_to_pxm_map[i] !=PXM_INVAL ) {
@@ -117,6 +121,11 @@ int __init fix_pxm_node_maps(int max_nid } } } +if (index ==-1 ) { +pr_debug ("No node/PXM mapping has been set\n" ); +/* nothing more to be done */ +return 0 ; + }if (WARN (index != max_nid,"%d max nid when expected %d\n" , index, max_nid))return -1 ;
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 23 Jan 2026 18:13:43 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.67-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 23 Jan 2026 18:13:43 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.67-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.12.67-rc1-g90b48e374092 #1 SMP PREEMPT_DYNAMIC Thu Jan 22 05:38:14 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
test_progs, test_progs-no_alu32, test_progs-cpuv4, test_maps, test_verifier in BPF selftests all passes on x86_64.
[...]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 23 Jan 2026 18:13:43 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.67-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.12:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
133 tests: 133 pass, 0 failLinux version: 6.12.67-rc1-g90b48e374092
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 23 Jan 2026 18:13:43 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.67-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Compiled and tested on
- Verdin AM62
- Verdin iMX8MP
Francesco
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 23 Jan 2026 18:13:43 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.67-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Builds successfully. Boots and works on qemu and Dell XPS 15 9520 w/ Intel Core i7-12600H
Thanks,
Brett
Am 21.01.2026 um 19:14 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 8 lines · On Wed, 21 Jan 2026 19:14:08 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.12.67 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 23 Jan 2026 18:13:43 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:
Thanks!
Cheers,
Miguel