6.6.122-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.6.122-rc1 review
This is the start of the stable review cycle for the 6.6.122 release. There are 254 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 30 Jan 2026 14:53:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.122-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.122-rc1
Russell King (Oracle) <[email protected]>
net: phy: fix phy_uses_state_machine()
Vladimir Oltean <[email protected]>
net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
Vladimir Oltean <[email protected]>
net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
Sean Christopherson <[email protected]>
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
P Praneesh <[email protected]>
wifi: ath11k: fix RCU stall while reaping monitor destination ring
Philip Yang <[email protected]>
drm/amdgpu: csa unmap use uninterruptible lock
Bartlomiej Kubik <[email protected]>
fs/ntfs3: Initialize allocated memory before use
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_session_rpc_open
Zqiang <[email protected]>
usbnet: Fix using smp_processor_id() in preemptible code warnings
Maninder Singh <[email protected]>
NFSD: fix race between nfsd registration and exports_proc
Nilay Shroff <[email protected]>
nvme: fix PCIe subsystem reset controller state transition
Keith Busch <[email protected]>
nvme-pci: do not directly handle subsys reset fallout
Daniel Wagner <[email protected]>
nvme-fc: rename free_ctrl callback to match name pattern
Johan Hovold <[email protected]>
ASoC: codecs: wsa883x: fix unnecessary initialisation
Johan Hovold <[email protected]>
ASoC: codecs: wsa881x: fix unnecessary initialisation
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wsa881x: Drop unused version readout
Wentao Liang <[email protected]>
phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
Dragan Simic <[email protected]>
phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
Ryan Roberts <[email protected]>
mm: kmsan: fix poisoning of high-order non-compound pages
Vlastimil Babka <[email protected]>
mm/page_alloc: prevent pcp corruption with SMP=n
Johan Hovold <[email protected]>
dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
Johan Hovold <[email protected]>
dmaengine: stm32: dmamux: fix device leak on route allocation
Johan Hovold <[email protected]>
iio: adc: exynos_adc: fix OF populate on driver rebind
Samasth Norway Ananda <[email protected]>
ALSA: scarlett2: Fix buffer overflow in config retrieval
Geraldo Nascimento <[email protected]>
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
David Hildenbrand (Red Hat) <[email protected]>
mm/rmap: fix two comments related to huge_pmd_unshare()
Rasmus Villemoes <[email protected]>
iio: core: add separate lockdep class for info_exist_lock
Andy Shevchenko <[email protected]>
iio: core: add missing mutex_destroy in iio_dev_release()
SeongJae Park <[email protected]>
mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
SeongJae Park <[email protected]>
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
Marc Kleine-Budde <[email protected]>
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
Ido Schimmel <[email protected]>
bridge: mcast: Fix use-after-free during router port configuration
Daniel Borkmann <[email protected]>
bpf: Do not let BPF test infra emit invalid GSO types to stack
Ihor Solodrai <[email protected]>
selftests/bpf: Check for timeout in perf_link test
Matthew Wilcox (Oracle) <[email protected]>
migrate: correct lock ordering for hugetlb file folios
Marc Kleine-Budde <[email protected]>
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
Arnd Bergmann <[email protected]>
irqchip/gic-v3-its: Avoid truncating memory addresses
Fernand Sieber <[email protected]>
perf/x86/intel: Do not enable BTS for guests
Ming Qian <[email protected]>
pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Fix automatic module loading
Jeongjun Park <[email protected]>
netrom: fix double-free in nr_route_frame()
Chenghai Huang <[email protected]>
uacce: ensure safe queue release with state management
Yang Shen <[email protected]>
uacce: implement mremap in uacce_vm_ops to return -EPERM
Chenghai Huang <[email protected]>
uacce: fix isolate sysfs check condition
Wenkai Lin <[email protected]>
uacce: fix cdev handling in the cleanup path
Johan Hovold <[email protected]>
intel_th: fix device leak on output open()
Steven Rostedt <[email protected]>
tracing: Fix crash on synthetic stacktrace field usage
Johan Hovold <[email protected]>
slimbus: core: fix device reference leak on report present
Johan Hovold <[email protected]>
slimbus: core: fix runtime PM imbalance on report present
Thomas Fourier <[email protected]>
octeontx2: Fix otx2_dma_map_page() error return code
Zhaoyang Huang <[email protected]>
arm64: Set __nocfi on swsusp_arch_resume()
Mark Rutland <[email protected]>
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
Marek Vasut <[email protected]>
wifi: rsi: Fix memory corruption due to not set vif driver data size
Dan Carpenter <[email protected]>
wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
Thomas Fourier <[email protected]>
wifi: ath12k: fix dma_free_coherent() pointer
Thomas Fourier <[email protected]>
wifi: ath10k: fix dma_free_coherent() pointer
Shawn Lin <[email protected]>
mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
Matthew Schwartz <[email protected]>
mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
Berk Cem Goksel <[email protected]>
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
Takashi Iwai <[email protected]>
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
Kübrich, Andreas <[email protected]>
iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
Fiona Klute <[email protected]>
iio: chemical: scd4x: fix reported channel endianness
Pei Xiao <[email protected]>
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
Tomas Melin <[email protected]>
iio: adc: ad9467: fix ad9434 vref mask
Markus Koeniger <[email protected]>
iio: accel: iis328dq: fix gain values
Rob Herring (Arm) <[email protected]>
of: platform: Use default match table for /firmware
Weigang He <[email protected]>
of: fix reference count leak in of_alias_scan()
Hans de Goede <[email protected]>
leds: led-class: Only Add LED to leds_list when it is fully ready
Cedric Xing <[email protected]>
x86: make page fault handling disable interrupts properly
Eric Dumazet <[email protected]>
net/sched: act_ife: avoid possible NULL deref
Melbin K Mathew <[email protected]>
vsock/virtio: cap TX credit to local buffer size
Stefano Garzarella <[email protected]>
vsock/test: fix seqpacket message bounds test
Melbin K Mathew <[email protected]>
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
David Yang <[email protected]>
net: openvswitch: fix data race in ovs_vport_get_upcall_stats
Ratheesh Kannoth <[email protected]>
octeontx2-af: Fix error handling
Vladimir Oltean <[email protected]>
net: dsa: fix off-by-one in maximum bridge ID determination
Eric Dumazet <[email protected]>
bonding: provide a net pointer to __skb_flow_dissect()
Taehee Yoo <[email protected]>
selftests: net: amt: wait longer for connection before sending packets
Andrey Vatoropin <[email protected]>
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
Timur Kristóf <[email protected]>
drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
Timur Kristóf <[email protected]>
drm/amd/pm: Don't clear SI SMC table when setting power limit
Laurent Vivier <[email protected]>
usbnet: limit max_mtu based on device's hard_mtu
Eric Dumazet <[email protected]>
ipv6: annotate data-race in ndisc_router_discovery()
Eric Dumazet <[email protected]>
mISDN: annotate data-race around dev->work
Jijie Shao <[email protected]>
net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
Jijie Shao <[email protected]>
net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
David Yang <[email protected]>
be2net: fix data race in be_get_new_eqd
David Yang <[email protected]>
net: hns3: fix data race in hns3_fetch_stats
Yun Lu <[email protected]>
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
Arun Raghavan <[email protected]>
ALSA: usb: Increase volume range that triggers a warning
Jiasheng Jiang <[email protected]>
scsi: qla2xxx: Sanitize payload size to prevent member overflow
David Jeffery <[email protected]>
scsi: core: Wake up the error handler when final completions race against each other
Naohiko Shimizu <[email protected]>
riscv: clocksource: Fix stimecmp update hazard on RV32
Arkadiusz Kozdra <[email protected]>
kconfig: fix static linking of nconf
Cheng-Yu Lee <[email protected]>
regmap: Fix race condition in hwspinlock irqsave routine
Felix Gu <[email protected]>
spi: spi-sprd-adi: Fix double free in probe error path
Yang Yingliang <[email protected]>
spi: sprd-adi: switch to use spi_alloc_host()
Andrew Davis <[email protected]>
spi: sprd: adi: Use devm_register_restart_handler()
Georgi Djakov <[email protected]>
interconnect: debugfs: initialize src_node and dst_node to empty strings
Pavel Zhigulin <[email protected]>
iio: adc: ad7280a: handle spi_setup() errors in probe()
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
Jens Axboe <[email protected]>
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
Ian Abbott <[email protected]>
comedi: Fix getting range information for subdevices 16 to 255
Andrew Cooper <[email protected]>
x86/kfence: avoid writing L1TF-vulnerable PTEs
Ondrej Jirman <[email protected]>
arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
Geraldo Nascimento <[email protected]>
arm64: dts: rockchip: remove dangerous max-link-speed from helios64
Abdun Nihaal <[email protected]>
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
Long Li <[email protected]>
scsi: storvsc: Process unsupported MODE_SENSE_10
feng <[email protected]>
Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
gongqi <[email protected]>
Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
Thadeu Lima de Souza Cascardo <[email protected]>
Revert "nfc/nci: Add the inconsistency check between the input data length and count"
Haoxiang Li <[email protected]>
w1: fix redundant counter decrement in w1_attach_slave_device()
Thorsten Blum <[email protected]>
w1: therm: Fix off-by-one buffer overflow in alarms_store
Ian Abbott <[email protected]>
comedi: dmm32at: serialize use of paged registers
Marnix Rijnart <[email protected]>
serial: 8250_pci: Fix broken RS485 for F81504/508/512
Taeyang Lee <[email protected]>
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
Jamal Hadi Salim <[email protected]>
net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
Jamal Hadi Salim <[email protected]>
net/sched: Enforce that teql can only be used as root qdisc
Alok Tiwari <[email protected]>
octeontx2: cn10k: fix RX flowid TCAM mask handling
Dmitry Skorodumov <[email protected]>
ipvlan: Make the addrs_lock be per port
Eric Dumazet <[email protected]>
l2tp: avoid one data-race in l2tp_tunnel_del_work()
David Yang <[email protected]>
veth: fix data race in veth_get_ethtool_stats
Kuniyuki Iwashima <[email protected]>
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
Kuniyuki Iwashima <[email protected]>
tools: ynl: Specify --no-line-number in ynl-regen.sh.
Kuniyuki Iwashima <[email protected]>
gue: Fix skb memleak with inner IP protocol 0.
Raju Rangoju <[email protected]>
amd-xgbe: avoid misleading per-packet error log
Xin Long <[email protected]>
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
Ricardo B. Marlière <[email protected]>
selftests: net: fib-onlink-tests: Convert to use namespaces by default
Hangbin Liu <[email protected]>
selftests/net: convert fib-onlink-tests.sh to run it in unique namespace
Eric Dumazet <[email protected]>
bonding: limit BOND_MODE_8023AD to Ethernet devices
Ethan Nelson-Moore <[email protected]>
net: usb: dm9601: remove broken SR9700 support
Chwee-Lin Choong <[email protected]>
igc: fix race condition in TX timestamp read for register 0
Dave Ertman <[email protected]>
ice: Avoid detrimental cleanup for bond during interface stop
Jacob Keller <[email protected]>
ice: initialize ring_stats->syncp
Niklas Cassel <[email protected]>
ata: libata: Print features also for ATAPI devices
Niklas Cassel <[email protected]>
ata: libata: Call ata_dev_config_lpm() for ATAPI devices
Damien Le Moal <[email protected]>
ata: libata-core: Introduce ata_dev_config_lpm()
Niklas Cassel <[email protected]>
ata: libata: Add cpr_log to ata_dev_print_features() early return
Konrad Dybcio <[email protected]>
pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
Konrad Dybcio <[email protected]>
dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
Dmitry Baryshkov <[email protected]>
dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
Akhil P Oommen <[email protected]>
dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
Taniya Das <[email protected]>
dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
Sibi Sankar <[email protected]>
dt-bindings: power: rpmpd: Update part number to X1E80100
Neil Armstrong <[email protected]>
dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains
Otto Pflüger <[email protected]>
dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215
Danila Tikhonov <[email protected]>
dt-bindings: power: qcom,rpmpd: Add SM7150
Mark Harmstone <[email protected]>
btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
Michael Kelley <[email protected]>
Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
Nuno Das Neves <[email protected]>
hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_*
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
Wojtek Wasko <[email protected]>
testptp: Add option to open PHC in readonly mode
Mahesh Bandewar <[email protected]>
selftest/ptp: update ptp selftest to exercise the gettimex options
Xabier Marquiegui <[email protected]>
ptp: add testptp mask test
Wojtek Wasko <[email protected]>
ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
Wojtek Wasko <[email protected]>
posix-clock: Store file pointer in struct posix_clock_context
Linus Torvalds <[email protected]>
Fix memory leak in posix_clock_open()
Xabier Marquiegui <[email protected]>
posix-clock: introduce posix_clock_context concept
Ming Lei <[email protected]>
io_uring: move local task_work in exit cancel loop
Robbie Ko <[email protected]>
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
Johan Hovold <[email protected]>
dmaengine: ti: k3-udma: fix device leak on udma lookup
Johan Hovold <[email protected]>
dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
Johan Hovold <[email protected]>
dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
Biju Das <[email protected]>
dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
Miaoqian Lin <[email protected]>
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
Johan Hovold <[email protected]>
dmaengine: lpc18xx-dmamux: fix device leak on route allocation
Johan Hovold <[email protected]>
dmaengine: idxd: fix device leaks on compat bind and unbind
Johan Hovold <[email protected]>
dmaengine: dw: dmamux: fix OF node leak on route allocation failure
Johan Hovold <[email protected]>
dmaengine: bcm-sba-raid: fix device leak on probe
Johan Hovold <[email protected]>
dmaengine: at_hdmac: fix device leak on of_dma_xlate()
Janne Grunau <[email protected]>
dmaengine: apple-admac: Add "apple,t8103-admac" compatible
Haoxiang Li <[email protected]>
drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
Marek Vasut <[email protected]>
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
Lyude Paul <[email protected]>
drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
Haoxiang Li <[email protected]>
drm/amdkfd: fix a memory leak in device_queue_manager_init()
Mario Limonciello (AMD) <[email protected]>
drm/amd: Clean up kfd node on surprise disconnect
Mario Limonciello <[email protected]>
drm/amd/display: Bump the HDMI clock to 340MHz
Lisa Robinson <[email protected]>
LoongArch: Fix PMU counter allocation for mixed-type event groups
SeongJae Park <[email protected]>
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
Aboorva Devarajan <[email protected]>
mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
Xiaochen Shen <[email protected]>
x86/resctrl: Fix memory bandwidth counter width for Hygon
Xiaochen Shen <[email protected]>
x86/resctrl: Add missing resctrl initialization for Hygon
Arnaud Ferraris <[email protected]>
tcpm: allow looking for role_sw device in the main node
Haoxiang Li <[email protected]>
EDAC/i3200: Fix a resource leak in i3200_probe1()
Haoxiang Li <[email protected]>
EDAC/x38: Fix a resource leak in x38_probe1()
Thomas Weißschuh <[email protected]>
hrtimer: Fix softirq base check in update_needs_ipi()
Yang Erkun <[email protected]>
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
Ilikara Zheng <[email protected]>
nvme-pci: disable secondary temp for Wodposit WPBSNM8
Ethan Nelson-Moore <[email protected]>
USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
Ulrich Mohr <[email protected]>
USB: serial: option: add Telit LE910 MBIM composition
Huacai Chen <[email protected]>
USB: OHCI/UHCI: Add soft dependencies on ehci_platform
Johannes Brüderl <[email protected]>
usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
Thinh Nguyen <[email protected]>
usb: dwc3: Check for USB4 IP_NAME
Wayne Chang <[email protected]>
phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
Louis Chauvet <[email protected]>
phy: rockchip: inno-usb2: fix disconnection in gadget mode
Rafael Beims <[email protected]>
phy: freescale: imx8m-pcie: assert phy reset during power on
Luca Ceresoli <[email protected]>
phy: rockchip: inno-usb2: fix communication disruption in gadget mode
Dan Williams <[email protected]>
x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
Tetsuo Handa <[email protected]>
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
Ondrej Ille <[email protected]>
can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
Nilay Shroff <[email protected]>
null_blk: fix kmemleak by releasing references to fault configfs items
Jaroslav Kysela <[email protected]>
ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
Brian Kao <[email protected]>
scsi: core: Fix error handler encryption support
Alex Hung <[email protected]>
drm/amd/display: Check dce_hwseq before dereferencing it
Benjamin Tissoires <[email protected]>
HID: usbhid: paper over wrong bNumDescriptor field
Neil Armstrong <[email protected]>
i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
Haotian Zhang <[email protected]>
dmaengine: omap-dma: fix dma_pool resource leak in error paths
Krzysztof Kozlowski <[email protected]>
phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
Dan Carpenter <[email protected]>
phy: stm32-usphyc: Fix off by one in probe()
Loic Poulain <[email protected]>
phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
Johan Hovold <[email protected]>
phy: drop probe registration printks
Ivaylo Ivanov <[email protected]>
phy: phy-snps-eusb2: refactor constructs names
Stefano Radaelli <[email protected]>
phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
Suraj Gupta <[email protected]>
dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
Sheetal <[email protected]>
dmaengine: tegra-adma: Fix use-after-free
Anthony Brandon <[email protected]>
dmaengine: xilinx: xdma: Fix regmap max_register
Bagas Sanjaya <[email protected]>
mm, kfence: describe @slab parameter in __kfence_obj_info()
Bagas Sanjaya <[email protected]>
textsearch: describe @list member in ts_ops search
Emil Svendsen <[email protected]>
ASoC: tlv320adcx140: fix word length
Emil Svendsen <[email protected]>
ASoC: tlv320adcx140: fix null pointer
Eric Dumazet <[email protected]>
net/sched: sch_qfq: do not free existing class in qfq_change_class()
Gal Pressman <[email protected]>
selftests: drv-net: fix RPS mask handling for high CPU numbers
Kuniyuki Iwashima <[email protected]>
ipv6: Fix use-after-free in inet6_addr_del().
Aditya Garg <[email protected]>
net: hv_netvsc: reject RSS hash key programming without RX indirection table
Jiasheng Jiang <[email protected]>
btrfs: fix memory leaks in create_space_info() error paths
Naohiro Aota <[email protected]>
btrfs: introduce btrfs_space_info sub-group
Naohiro Aota <[email protected]>
btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
Naohiro Aota <[email protected]>
btrfs: factor out init_space_info() from create_space_info()
Boris Burkov <[email protected]>
btrfs: store fs_info in space_info
Saeed Mahameed <[email protected]>
net/mlx5e: Restore destroying state bit after profile cleanup
Stefano Garzarella <[email protected]>
vsock/test: add a final full barrier after run all tests
Eric Dumazet <[email protected]>
ipv4: ip_gre: make ipgre_header() robust
Eric Dumazet <[email protected]>
macvlan: fix possible UAF in macvlan_forward_source()
Eric Dumazet <[email protected]>
net: update netdev_lock_{type,name}Eric Dumazet <[email protected]>
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
Eric Dumazet <[email protected]>
net: bridge: annotate data-races around fdb->{updated,used}Johannes Nixdorf <[email protected]>
net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry
Qu Wenruo <[email protected]>
btrfs: send: check for inline extents in range_is_hole_in_parent()
Shivam Kumar <[email protected]>
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
Maurizio Lombardi <[email protected]>
nvmet-tcp: remove boilerplate code
Szymon Wilczek <[email protected]>
can: etas_es58x: allow partial RX URB allocation to succeed
Zilin Guan <[email protected]>
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
Jianbo Liu <[email protected]>
xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
Johan Hovold <[email protected]>
ASoC: codecs: wsa884x: fix codec initialisation
Andreas Gruenbacher <[email protected]>
Revert "gfs2: Fix use of bio_chain"
Morduan Zang <[email protected]>
efi/cper: Fix cper_bits_to_str buffer handling and return value
Peng Fan <[email protected]>
firmware: imx: scu-irq: Set mu_resource_id before get handle
-------------
Diffstat:
.../devicetree/bindings/power/qcom,rpmpd.yaml | 83 ++++--- Documentation/netlink/specs/fou.yaml | 2 + Makefile | 4 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 16 +- .../boot/dts/rockchip/rk3399-kobol-helios64.dts | 1 - arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 1 - .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 4 +- arch/arm64/include/asm/hyperv-tlfs.h | 45 ++-- arch/arm64/include/asm/mshyperv.h | 4 +- arch/arm64/kernel/hibernate.c | 2 +- arch/arm64/kernel/signal.c | 4 + arch/loongarch/kernel/perf_event.c | 21 +- arch/x86/events/perf_event.h | 13 +- arch/x86/hyperv/hv_init.c | 8 +- arch/x86/include/asm/hyperv-tlfs.h | 145 ++++++------ arch/x86/include/asm/kfence.h | 29 ++- arch/x86/include/asm/mshyperv.h | 30 +-- arch/x86/kernel/cpu/mshyperv.c | 56 ++--- arch/x86/kernel/cpu/resctrl/core.c | 21 +- arch/x86/kernel/cpu/resctrl/internal.h | 3 + arch/x86/kernel/fpu/core.c | 32 ++- arch/x86/kvm/x86.c | 9 + arch/x86/mm/fault.c | 15 +- arch/x86/mm/kaslr.c | 10 +- crypto/authencesn.c | 6 + drivers/ata/libata-core.c | 32 ++- drivers/base/regmap/regmap.c | 4 +- drivers/block/null_blk/main.c | 12 +- drivers/clocksource/hyperv_timer.c | 26 +-- drivers/clocksource/timer-riscv.c | 3 +- drivers/comedi/comedi_fops.c | 2 +- drivers/comedi/drivers/dmm32at.c | 32 ++- drivers/comedi/range.c | 2 +- drivers/dma/apple-admac.c | 1 + drivers/dma/at_hdmac.c | 9 +- drivers/dma/bcm-sba-raid.c | 6 +- drivers/dma/dw/rzn1-dmamux.c | 4 +- drivers/dma/idxd/compat.c | 23 +- drivers/dma/lpc18xx-dmamux.c | 19 +- drivers/dma/qcom/gpi.c | 6 +- drivers/dma/sh/rz-dmac.c | 5 + drivers/dma/stm32-dmamux.c | 22 +- drivers/dma/tegra210-adma.c | 10 +- drivers/dma/ti/dma-crossbar.c | 18 +- drivers/dma/ti/k3-udma-private.c | 2 +- drivers/dma/ti/omap-dma.c | 4 + drivers/dma/xilinx/xdma-regs.h | 1 + drivers/dma/xilinx/xdma.c | 2 +- drivers/dma/xilinx/xilinx_dma.c | 7 +- drivers/edac/i3200_edac.c | 11 +- drivers/edac/x38_edac.c | 9 +- drivers/firmware/efi/cper.c | 2 +- drivers/firmware/imx/imx-scu-irq.c | 24 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 19 +- drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h | 2 +- .../amd/display/dc/dce110/dce110_hw_sequencer.c | 2 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 4 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 23 +- drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + drivers/gpu/drm/panel/panel-simple.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/hid/usbhid/hid-core.c | 17 +- drivers/hv/hv.c | 36 ++- drivers/hv/hv_common.c | 32 +-- drivers/hwtracing/intel_th/core.c | 19 +- drivers/i2c/busses/i2c-qcom-geni.c | 11 +- drivers/iio/accel/st_accel_core.c | 72 +++++- drivers/iio/adc/ad7280a.c | 4 +- drivers/iio/adc/ad9467.c | 2 +- drivers/iio/adc/at91-sama5d2_adc.c | 1 + drivers/iio/adc/exynos_adc.c | 13 +- drivers/iio/chemical/scd4x.c | 6 +- drivers/iio/dac/ad5686.c | 6 + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 15 +- drivers/iio/industrialio-core.c | 12 +- drivers/input/serio/i8042-acpipnpio.h | 18 ++ drivers/interconnect/debugfs-client.c | 5 + drivers/irqchip/irq-gic-v3-its.c | 8 +- drivers/isdn/mISDN/timerdev.c | 13 +- drivers/leds/led-class.c | 10 +- drivers/misc/uacce/uacce.c | 48 +++- drivers/mmc/host/rtsx_pci_sdmmc.c | 41 ++++ drivers/mmc/host/sdhci-of-dwcmshc.c | 7 + drivers/net/bonding/bond_main.c | 11 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +- drivers/net/can/usb/ems_usb.c | 8 +- drivers/net/can/usb/esd_usb.c | 9 +- drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +- drivers/net/can/usb/gs_usb.c | 9 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 9 +- drivers/net/can/usb/mcba_usb.c | 8 +- drivers/net/can/usb/usb_8dev.c | 8 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 3 +- drivers/net/ethernet/emulex/benet/be_main.c | 8 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 69 +++--- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_lib.c | 29 ++- drivers/net/ethernet/intel/igc/igc_ptp.c | 43 ++-- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 86 +++++-- .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 7 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 + drivers/net/hyperv/netvsc_drv.c | 3 + drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_core.c | 16 +- drivers/net/ipvlan/ipvlan_main.c | 49 ++-- drivers/net/macvlan.c | 20 +- drivers/net/netdevsim/bpf.c | 6 + drivers/net/netdevsim/dev.c | 2 + drivers/net/netdevsim/netdevsim.h | 1 + drivers/net/phy/phy_device.c | 58 +++-- drivers/net/usb/dm9601.c | 4 - drivers/net/usb/usbnet.c | 11 +- drivers/net/veth.c | 8 +- drivers/net/wireless/ath/ath10k/ce.c | 16 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 4 +- drivers/net/wireless/ath/ath12k/ce.c | 12 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 6 +- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 + drivers/nfc/virtual_ncidev.c | 4 - drivers/nvme/host/fabrics.c | 15 ++ drivers/nvme/host/fabrics.h | 1 + drivers/nvme/host/fc.c | 5 +- drivers/nvme/host/nvme.h | 14 +- drivers/nvme/host/pci.c | 41 ++++ drivers/nvme/host/rdma.c | 1 + drivers/nvme/host/tcp.c | 1 + drivers/nvme/target/tcp.c | 28 ++- drivers/of/base.c | 8 +- drivers/of/platform.c | 2 +- drivers/pci/Kconfig | 6 - drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +- drivers/phy/broadcom/phy-bcm-ns2-pcie.c | 2 - drivers/phy/broadcom/phy-bcm-ns2-usbdrd.c | 1 - drivers/phy/broadcom/phy-bcm-sr-pcie.c | 2 - drivers/phy/broadcom/phy-brcm-sata.c | 2 +- drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + drivers/phy/marvell/phy-pxa-usb.c | 1 - drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 2 - drivers/phy/qualcomm/phy-qcom-m31.c | 2 - drivers/phy/qualcomm/phy-qcom-qusb2.c | 18 +- drivers/phy/qualcomm/phy-qcom-snps-eusb2.c | 256 ++++++++++----------- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 41 ++-- drivers/phy/st/phy-stih407-usb.c | 2 - drivers/phy/st/phy-stm32-usbphyc.c | 6 +- drivers/phy/tegra/xusb-tegra186.c | 3 + drivers/phy/ti/phy-twl4030-usb.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 8 + drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 12 +- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 11 +- drivers/pmdomain/qcom/rpmhpd.c | 4 + drivers/ptp/ptp_chardev.c | 37 ++- drivers/ptp/ptp_private.h | 16 +- drivers/scsi/qla2xxx/qla_isr.c | 7 + drivers/scsi/scsi_error.c | 35 ++- drivers/scsi/scsi_lib.c | 8 + drivers/scsi/storvsc_drv.c | 3 +- drivers/slimbus/core.c | 19 +- drivers/spi/spi-sprd-adi.c | 63 ++--- drivers/tty/serial/8250/8250_pci.c | 2 +- drivers/usb/core/config.c | 5 + drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/core.c | 2 + drivers/usb/dwc3/core.h | 1 + drivers/usb/host/ohci-platform.c | 1 + drivers/usb/host/uhci-platform.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 2 + drivers/usb/serial/option.c | 1 + drivers/usb/typec/tcpm/tcpm.c | 2 +- drivers/w1/slaves/w1_therm.c | 60 ++--- drivers/w1/w1.c | 2 - drivers/xen/xen-scsiback.c | 1 + fs/btrfs/block-group.c | 60 +++-- fs/btrfs/disk-io.c | 2 +- fs/btrfs/send.c | 2 + fs/btrfs/space-info.c | 76 ++++-- fs/btrfs/space-info.h | 10 + fs/btrfs/sysfs.c | 18 +- fs/btrfs/transaction.c | 11 +- fs/ext4/xattr.c | 1 + fs/gfs2/lops.c | 2 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- fs/nfsd/nfsctl.c | 17 +- fs/ntfs3/inode.c | 7 +- fs/smb/server/mgmt/user_session.c | 20 +- fs/smb/server/mgmt/user_session.h | 1 + include/asm-generic/hyperv-tlfs.h | 32 ++- include/asm-generic/mshyperv.h | 2 +- include/dt-bindings/power/qcom,rpmhpd.h | 235 +++++++++++++++++++ include/dt-bindings/power/qcom-rpmpd.h | 246 ++------------------ include/linux/iio/iio-opaque.h | 2 + include/linux/kfence.h | 1 + include/linux/nvme.h | 3 + include/linux/posix-clock.h | 39 +++- include/linux/textsearch.h | 1 + include/linux/usb/quirks.h | 3 + include/scsi/scsi_eh.h | 6 + include/sound/pcm.h | 2 +- include/uapi/linux/comedi.h | 2 +- io_uring/io-wq.c | 2 +- io_uring/io_uring.c | 8 +- kernel/time/hrtimer.c | 2 +- kernel/time/posix-clock.c | 53 +++-- kernel/trace/trace_events_hist.c | 9 + kernel/trace/trace_events_synth.c | 8 +- mm/Kconfig | 10 +- mm/damon/sysfs-schemes.c | 11 +- mm/damon/sysfs.c | 5 +- mm/kmsan/shadow.c | 2 +- mm/migrate.c | 12 +- mm/page_alloc.c | 47 +++- mm/rmap.c | 20 +- net/bpf/test_run.c | 5 + net/bridge/br_fdb.c | 35 +-- net/bridge/br_input.c | 4 +- net/bridge/br_multicast.c | 9 + net/can/j1939/transport.c | 10 +- net/core/dev.c | 25 +- net/core/filter.c | 7 + net/dsa/dsa.c | 2 +- net/ipv4/esp4_offload.c | 4 +- net/ipv4/fou_core.c | 3 + net/ipv4/fou_nl.c | 2 +- net/ipv4/ip_gre.c | 11 +- net/ipv6/addrconf.c | 4 +- net/ipv6/esp6_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 2 +- net/ipv6/ndisc.c | 4 +- net/l2tp/l2tp_core.c | 4 +- net/netrom/nr_route.c | 13 +- net/openvswitch/vport.c | 11 +- net/sched/act_ife.c | 6 +- net/sched/sch_qfq.c | 8 +- net/sched/sch_teql.c | 5 + net/sctp/sm_statefuns.c | 10 +- net/vmw_vsock/virtio_transport_common.c | 30 ++- scripts/kconfig/nconf-cfg.sh | 11 +- sound/core/oss/pcm_oss.c | 4 +- sound/core/pcm_native.c | 9 +- sound/pci/ctxfi/ctamixer.c | 2 + sound/soc/codecs/tlv320adcx140.c | 8 +- sound/soc/codecs/wsa881x.c | 11 +- sound/soc/codecs/wsa883x.c | 9 + sound/soc/codecs/wsa884x.c | 3 +- sound/usb/mixer.c | 22 +- sound/usb/mixer_scarlett2.c | 7 +- tools/net/ynl/ynl-regen.sh | 2 +- tools/testing/selftests/bpf/prog_tests/perf_link.c | 15 +- tools/testing/selftests/net/amt.sh | 7 +- tools/testing/selftests/net/fib-onlink-tests.sh | 76 +++--- tools/testing/selftests/net/toeplitz.c | 4 +- tools/testing/selftests/ptp/testptp.c | 114 +++++++-- tools/testing/vsock/util.c | 12 + tools/testing/vsock/vsock_test.c | 11 + 260 files changed, 2726 insertions(+), 1457 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/254 firmware: imx: scu-irq: Set mu_resource_id before get handle
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
commit ff3f9913bc0749364fbfd86ea62ba2d31c6136c8 upstream.
mu_resource_id is referenced in imx_scu_irq_get_status() and imx_scu_irq_group_enable() which could be used by other modules, so need to set correct value before using imx_sc_irq_ipc_handle in SCU API call.
--- drivers/firmware/imx/imx-scu-irq.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/firmware/imx/imx-scu-irq.c +12 -12
@@ -203,6 +203,18 @@ int imx_scu_enable_general_irq_channel(sstruct mbox_chan *ch;int ret =0 , i =0 ; +if (!of_parse_phandle_with_args (dev->of_node,"mboxes" , +"#mbox-cells" ,0 , &spec)) { + i =of_alias_get_id (spec.np,"mu" ); +of_node_put (spec.np); + } + +/* use mu1 as general mu irq channel if failed */ +if (i <0 ) + i =1 ; + + mu_resource_id =IMX_SC_R_MU_0A + i; + ret =imx_scu_get_handle (&imx_sc_irq_ipc_handle);if (ret)return ret;
@@ -225,18 +237,6 @@ int imx_scu_enable_general_irq_channel(sreturn ret; } -if (!of_parse_phandle_with_args (dev->of_node,"mboxes" , -"#mbox-cells" ,0 , &spec)) { - i =of_alias_get_id (spec.np,"mu" ); -of_node_put (spec.np); - } - -/* use mu1 as general mu irq channel if failed */ -if (i <0 ) - i =1 ; - - mu_resource_id =IMX_SC_R_MU_0A + i; -/* Create directory under /sysfs/firmware */ wakeup_obj =kobject_create_and_add ("scu_wakeup_source" , firmware_kobj);if (!wakeup_obj) {
Greg Kroah-Hartman
maintainerPATCH 2/254 efi/cper: Fix cper_bits_to_str buffer handling and return value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Morduan Zang <[email protected]>
commit d7f1b4bdc7108be1b178e1617b5f45c8918e88d7 upstream.
The return value calculation was incorrect: return len - buf_size; Initially len = buf_size, then len decreases with each operation. This results in a negative return value on success.
Fix by returning buf_size - len which correctly calculates the actual number of bytes written.
--- drivers/firmware/efi/cper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/cper.c +1 -1
@@ -162,7 +162,7 @@ int cper_bits_to_str(char *buf, int buf_ len -= size; str += size; } -return len - buf_size; +return buf_size - len; }EXPORT_SYMBOL_GPL (cper_bits_to_str);
Greg Kroah-Hartman
maintainerPATCH 3/254 Revert "gfs2: Fix use of bio_chain"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 469d71512d135907bf5ea0972dfab8c420f57848 upstream.
This reverts commit 8a157e0a0aa5143b5d94201508c0ca1bb8cfb941.
That commit incorrectly assumed that the bio_chain() arguments were swapped in gfs2. However, gfs2 intentionally constructs bio chains so that the first bio's bi_end_io callback is invoked when all bios in the chain have completed, unlike bio chains where the last bio's callback is invoked.
--- fs/gfs2/lops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/lops.c +1 -1
@@ -492,7 +492,7 @@ static struct bio *gfs2_chain_bio(struct new =bio_alloc (prev->bi_bdev, nr_iovecs, prev->bi_opf,GFP_NOIO );bio_clone_blkg_association (new, prev); new->bi_iter.bi_sector =bio_end_sector (prev); -bio_chain (prev, new); +bio_chain (new, prev);submit_bio (prev);return new; }
Greg Kroah-Hartman
maintainerPATCH 4/254 ASoC: codecs: wsa884x: fix codec initialisation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 120f3e6ff76209ee2f62a64e5e7e9d70274df42b upstream.
The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED.
Fix the inverted hw_init flag which was set to false instead of true after initialisation which defeats its purpose and may result in repeated unnecessary initialisation.
Similarly, the initial state of the flag was also inverted so that the codec would only be initialised and brought out of regmap cache only mode if its status first transitions to UNATTACHED.
--- sound/soc/codecs/wsa884x.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/codecs/wsa884x.c +1 -2
@@ -1482,7 +1482,7 @@ static void wsa884x_init(struct wsa884x_wsa884x_set_gain_parameters (wsa884x); - wsa884x->hw_init = false; + wsa884x->hw_init = true; } static int wsa884x_update_status(struct sdw_slave *slave,
@@ -1884,7 +1884,6 @@ static int wsa884x_probe(struct sdw_slav/* Start in cache-only until device is enumerated */ regcache_cache_only (wsa884x->regmap, true); - wsa884x->hw_init = true;pm_runtime_set_autosuspend_delay (dev,3000 );pm_runtime_use_autosuspend (dev);
Greg Kroah-Hartman
maintainerPATCH 5/254 xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 3d5221af9c7711b7aec8da1298c8fc393ef6183d ]
Commit 61fafbee6cfe ("xfrm: Determine inner GSO type from packet inner protocol") attempted to fix GSO segmentation by reading the inner protocol from XFRM_MODE_SKB_CB(skb)->protocol. This was incorrect because the field holds the inner L4 protocol (TCP/UDP) instead of the required tunnel protocol. Also, the memory location (shared by XFRM_SKB_CB(skb) which could be overwritten by xfrm_replay_overflow()) is prone to corruption. This combination caused the kernel to select the wrong inner mode and get the wrong address family.
The correct value is in xfrm_offload(skb)->proto, which is set from the outer tunnel header's protocol field by esp[4|6]_gso_encap(). It is initialized by xfrm[4|6]_tunnel_encap_add() to either IPPROTO_IPIP or IPPROTO_IPV6, using xfrm_af2proto() and correctly reflects the inner packet's address family.
--- net/ipv4/esp4_offload.c | 4 ++-- net/ipv6/esp6_offload.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/esp4_offload.c +2 -2
@@ -111,8 +111,8 @@ static struct sk_buff *xfrm4_tunnel_gso_segment(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features) { -const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, -XFRM_MODE_SKB_CB (skb)->protocol); +struct xfrm_offload *xo =xfrm_offload (skb); +const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, xo->proto);__be16 type = inner_mode->family ==AF_INET6 ?htons (ETH_P_IPV6 ) :htons (ETH_P_IP );
net/ipv6/esp6_offload.c +2 -2
@@ -145,8 +145,8 @@ static struct sk_buff *xfrm6_tunnel_gso_segment(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features) { -const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, -XFRM_MODE_SKB_CB (skb)->protocol); +struct xfrm_offload *xo =xfrm_offload (skb); +const struct xfrm_mode *inner_mode =xfrm_ip2inner_mode (x, xo->proto);__be16 type = inner_mode->family ==AF_INET ?htons (ETH_P_IP ) :htons (ETH_P_IPV6 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/254 pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 0c728083654f0066f5e10a1d2b0bd0907af19a58 ]
In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak.
Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources.
--- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/flexfilelayout/flexfilelayoutdev.c +1 -1
@@ -103,7 +103,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,sizeof (struct nfs4_ff_ds_version ), gfp_flags);if (!ds_versions) - goto out_scratch; + goto out_err_drain_dsaddrs;for (i =0 ; i < version_count; i++) {/* 20 = version(4) + minor_version(4) + rsize(4) + wsize(4) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/254 can: etas_es58x: allow partial RX URB allocation to succeed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Szymon Wilczek <[email protected]>
[ Upstream commit b1979778e98569c1e78c2c7f16bb24d76541ab00 ]
When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked.
As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error.
Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open().
--- drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/usb/etas_es58x/es58x_core.c +1 -1
@@ -1736,7 +1736,7 @@ static int es58x_alloc_rx_urbs(struct es58x_device *es58x_dev)dev_dbg (dev,"%s: Allocated %d rx URBs each of size %u\n" , __func__, i, rx_buf_len); -return ret; +return 0 ; }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/254 nvmet-tcp: remove boilerplate code
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 75011bd0f9c55db523242f9f9a0b0b826165f14b ]
Simplify the nvmet_tcp_handle_h2c_data_pdu() function by removing boilerplate code.
Stable-dep-of: 32b63acd78f5 ("nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec")
--- drivers/nvme/target/tcp.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/nvme/target/tcp.c +8 -8
@@ -969,8 +969,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)if (unlikely (data->ttag >= queue->nr_cmds)) {pr_err ("queue %d: received out of bound ttag %u, nr_cmds %u\n" , queue->idx, data->ttag, queue->nr_cmds); -nvmet_tcp_fatal_error (queue); -return -EPROTO ; + goto err_proto; } cmd = &queue->cmds[data->ttag]; }else {
@@ -981,9 +980,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)pr_err ("ttag %u unexpected data offset %u (expected %u)\n" , data->ttag,le32_to_cpu (data->data_offset), cmd->rbytes_done); -/* FIXME: use path and transport errors */ -nvmet_tcp_fatal_error (queue); -return -EPROTO ; + goto err_proto; } exp_data_len = le32_to_cpu(data->hdr.plen) -
@@ -996,9 +993,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) cmd->pdu_len == 0 || cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) {pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len); -/* FIXME: use proper transport errors */ -nvmet_tcp_fatal_error (queue); -return -EPROTO ; + goto err_proto; } cmd->pdu_recv =0 ;nvmet_tcp_build_pdu_iovec (cmd);
@@ -1006,6 +1001,11 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) queue->rcv_state =NVMET_TCP_RECV_DATA ;return 0 ; + +err_proto: +/* FIXME: use proper transport errors */ +nvmet_tcp_fatal_error (queue); +return -EPROTO ; }static int nvmet_tcp_done_recv_pdu (struct nvmet_tcp_queue *queue)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/254 nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <[email protected]>
[ Upstream commit 32b63acd78f577b332d976aa06b56e70d054cbba ]
Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset
validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate
whether the command's data structures (cmd->req.sg and cmd->iov) have
been properly initialized before processing H2C_DATA PDUs.
The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command.
Attack vectors that trigger NULL pointer dereferences:
1. H2C_DATA PDU sent before CONNECT → both pointers NULL
2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL
3. H2C_DATA PDU for uninitialized command slot → both pointers NULL
The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because:
- Uninitialized commands: both NULL
- READ commands: cmd->req.sg allocated, cmd->iov NULL
- WRITE commands: both allocated
--- drivers/nvme/target/tcp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/nvme/target/tcp.c +12 -0
@@ -995,6 +995,18 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len); goto err_proto; } +/* +* Ensure command data structures are initialized. We must check both +* cmd->req.sg and cmd->iov because they can have different NULL states: +* - Uninitialized commands: both NULL +* - READ commands: cmd->req.sg allocated, cmd->iov NULL +* - WRITE commands: both allocated +*/ +if (unlikely (!cmd->req.sg || !cmd->iov)) { +pr_err ("queue %d: H2CData PDU received for invalid command state (ttag %u)\n" , + queue->idx, data->ttag); + goto err_proto; + } cmd->pdu_recv =0 ;nvmet_tcp_build_pdu_iovec (cmd); queue->cmd = cmd;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/254 btrfs: send: check for inline extents in range_is_hole_in_parent()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ]
Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent.
This is because for inline extents their data starts at the offset of the disk_bytenr field. So accessing the disk_bytenr
means we are accessing inline data or in case the inline data is less than 8 bytes we can actually cause an invalid
memory access if this inline extent item is the first item in the leaf or access metadata from other items.
--- fs/btrfs/send.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/send.c +2 -0
@@ -6545,6 +6545,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx, extent_end =btrfs_file_extent_end (path);if (extent_end <= start) goto next; +if (btrfs_file_extent_type (leaf, fi) ==BTRFS_FILE_EXTENT_INLINE ) +return 0 ;if (btrfs_file_extent_disk_bytenr (leaf, fi) ==0 ) { search_start = extent_end; goto next;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/254 net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Nixdorf <[email protected]>
[ Upstream commit cbf51acbc5d50341290c79c97bda8cf46f5c4f22 ]
In preparation of the following fdb limit for dynamically learned entries, allow fdb_create to detect that the entry was added by the user. This way it can skip applying the limit in this case.
Stable-dep-of: b25a0b4a2193 ("net: bridge: annotate data-races around fdb->{updated,used}")
--- net/bridge/br_fdb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/bridge/br_fdb.c +4 -3
@@ -1056,7 +1056,8 @@ static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,if (!(flags &NLM_F_CREATE ))return -ENOENT ; - fdb =fdb_create (br, source, addr, vid,0 ); + fdb =fdb_create (br, source, addr, vid, +BIT (BR_FDB_ADDED_BY_USER ));if (!fdb)return -ENOMEM ;
@@ -1069,6 +1070,8 @@ static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,WRITE_ONCE (fdb->dst, source); modified = true; } + +set_bit (BR_FDB_ADDED_BY_USER , &fdb->flags); }if (fdb_to_nud (br, fdb) != state) {
@@ -1100,8 +1103,6 @@ static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,if (fdb_handle_notify (fdb, notify)) modified = true; -set_bit (BR_FDB_ADDED_BY_USER , &fdb->flags); - fdb->used = jiffies;if (modified) {if (refresh)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/254 net: bridge: annotate data-races around fdb->{updated,used}
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b25a0b4a2193407aa72a4cd1df66a7ed07dd4f1e ]
fdb->updated and fdb->used are read and written locklessly.
Add READ_ONCE()/WRITE_ONCE() annotations.
--- net/bridge/br_fdb.c | 28 ++++++++++++++++------------ net/bridge/br_input.c | 4 ++-- 2 files changed, 18 insertions(+), 14 deletions(-)
net/bridge/br_fdb.c +16 -12
@@ -73,7 +73,7 @@ static inline int has_expired(const struct net_bridge *br, {return !test_bit (BR_FDB_STATIC , &fdb->flags) && !test_bit (BR_FDB_ADDED_BY_EXT_LEARN , &fdb->flags) && -time_before_eq (fdb->updated +hold_time (br), jiffies); +time_before_eq (READ_ONCE (fdb->updated) +hold_time (br), jiffies); }static void fdb_rcu_free (struct rcu_head *head)
@@ -136,9 +136,9 @@ static int fdb_fill_info(struct sk_buff *skb, const struct net_bridge *br,if (nla_put_u32 (skb,NDA_FLAGS_EXT , ext_flags)) goto nla_put_failure; - ci.ndm_used =jiffies_to_clock_t (now - fdb->used); + ci.ndm_used =jiffies_to_clock_t (now -READ_ONCE (fdb->used)); ci.ndm_confirmed =0 ; - ci.ndm_updated =jiffies_to_clock_t (now - fdb->updated); + ci.ndm_updated =jiffies_to_clock_t (now -READ_ONCE (fdb->updated)); ci.ndm_refcnt =0 ;if (nla_put (skb,NDA_CACHEINFO ,sizeof (ci), &ci)) goto nla_put_failure;
@@ -534,7 +534,7 @@ void br_fdb_cleanup(struct work_struct *work)*/ rcu_read_lock ();hlist_for_each_entry_rcu (f, &br->fdb_list, fdb_node) { -unsigned long this_timer = f->updated + delay; +unsigned long this_timer =READ_ONCE (f->updated) + delay;if (test_bit (BR_FDB_STATIC , &f->flags) ||test_bit (BR_FDB_ADDED_BY_EXT_LEARN , &f->flags)) {
@@ -792,6 +792,7 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, {struct net_bridge_fdb_entry *f;struct __fdb_entry *fe = buf; +unsigned long delta;int num =0 ;memset (buf,0 , maxnum*sizeof (struct __fdb_entry ));
@@ -821,8 +822,11 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, fe->port_hi = f->dst->port_no >>8 ; fe->is_local =test_bit (BR_FDB_LOCAL , &f->flags); -if (!test_bit (BR_FDB_STATIC , &f->flags)) - fe->ageing_timer_value =jiffies_delta_to_clock_t (jiffies - f->updated); +if (!test_bit (BR_FDB_STATIC , &f->flags)) { + delta = jiffies -READ_ONCE (f->updated); + fe->ageing_timer_value = +jiffies_delta_to_clock_t (delta); + } ++fe; ++num; }
@@ -870,8 +874,8 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,unsigned long now = jiffies;bool fdb_modified = false; -if (now != fdb->updated) { - fdb->updated = now; +if (now !=READ_ONCE (fdb->updated)) { +WRITE_ONCE (fdb->updated, now); fdb_modified =__fdb_mark_active (fdb); }
@@ -1103,10 +1107,10 @@ static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,if (fdb_handle_notify (fdb, notify)) modified = true; - fdb->used = jiffies; +WRITE_ONCE (fdb->used, jiffies);if (modified) {if (refresh) - fdb->updated = jiffies; +WRITE_ONCE (fdb->updated, jiffies);fdb_notify (br, fdb,RTM_NEWNEIGH , true); }
@@ -1419,7 +1423,7 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p, goto err_unlock; } - fdb->updated = jiffies; +WRITE_ONCE (fdb->updated, jiffies);if (READ_ONCE (fdb->dst) != p) {WRITE_ONCE (fdb->dst, p);
@@ -1428,7 +1432,7 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,if (test_and_set_bit (BR_FDB_ADDED_BY_EXT_LEARN , &fdb->flags)) {/* Refresh entry */ - fdb->used = jiffies; +WRITE_ONCE (fdb->used, jiffies); }else { modified = true; }
net/bridge/br_input.c +2 -2
@@ -207,8 +207,8 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skbif (test_bit (BR_FDB_LOCAL , &dst->flags))return br_pass_frame_up (skb, false); -if (now != dst->used) - dst->used = now; +if (now !=READ_ONCE (dst->used)) +WRITE_ONCE (dst->used, now);br_forward (dst->dst, skb, local_rcv, false); }else {if (!mcast_hit)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/254 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 81c734dae203757fb3c9eee6f9896386940776bd ]
Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1].
Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().
[1]
BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729 __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860 ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1 ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500 ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:318 [inline] ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core net/core/dev.c:6139 [inline] __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252 netif_receive_skb_internal net/core/dev.c:6338 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6397 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
--- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_tunnel.c +1 -1
@@ -844,7 +844,7 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,skb_reset_network_header (skb); -if (!pskb_inet_may_pull (skb)) { +if (skb_vlan_inet_prepare (skb, true)) {DEV_STATS_INC (tunnel->dev, rx_length_errors);DEV_STATS_INC (tunnel->dev, rx_errors); goto drop;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/254 net: update netdev_lock_{type,name}
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eb74c19fe10872ee1f29a8f90ca5ce943921afe9 ]
Add missing entries in netdev_lock_type[] and netdev_lock_name[] :
CAN, MCTP, RAWIP, CAIF, IP6GRE, 6LOWPAN, NETLINK, VSOCKMON, IEEE802154_MONITOR.
Also add a WARN_ONCE() in netdev_lock_pos() to help future bug hunting next time a protocol is added without updating these arrays.
--- net/core/dev.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
net/core/dev.c +19 -6
@@ -481,15 +481,21 @@ static const unsigned short netdev_lock_type[] = {ARPHRD_IEEE1394 ,ARPHRD_EUI64 ,ARPHRD_INFINIBAND ,ARPHRD_SLIP ,ARPHRD_CSLIP ,ARPHRD_SLIP6 ,ARPHRD_CSLIP6 ,ARPHRD_RSRVD ,ARPHRD_ADAPT ,ARPHRD_ROSE ,ARPHRD_X25 ,ARPHRD_HWX25 , +ARPHRD_CAN ,ARPHRD_MCTP ,ARPHRD_PPP ,ARPHRD_CISCO ,ARPHRD_LAPB ,ARPHRD_DDCMP , -ARPHRD_RAWHDLC ,ARPHRD_TUNNEL ,ARPHRD_TUNNEL6 ,ARPHRD_FRAD , +ARPHRD_RAWHDLC ,ARPHRD_RAWIP , +ARPHRD_TUNNEL ,ARPHRD_TUNNEL6 ,ARPHRD_FRAD ,ARPHRD_SKIP ,ARPHRD_LOOPBACK ,ARPHRD_LOCALTLK ,ARPHRD_FDDI ,ARPHRD_BIF ,ARPHRD_SIT ,ARPHRD_IPDDP ,ARPHRD_IPGRE ,ARPHRD_PIMREG ,ARPHRD_HIPPI ,ARPHRD_ASH ,ARPHRD_ECONET ,ARPHRD_IRDA ,ARPHRD_FCPP ,ARPHRD_FCAL ,ARPHRD_FCPL ,ARPHRD_FCFABRIC ,ARPHRD_IEEE80211 ,ARPHRD_IEEE80211_PRISM , -ARPHRD_IEEE80211_RADIOTAP ,ARPHRD_PHONET ,ARPHRD_PHONET_PIPE , - ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE}; +ARPHRD_IEEE80211_RADIOTAP , +ARPHRD_IEEE802154 ,ARPHRD_IEEE802154_MONITOR , +ARPHRD_PHONET ,ARPHRD_PHONET_PIPE , +ARPHRD_CAIF ,ARPHRD_IP6GRE ,ARPHRD_NETLINK ,ARPHRD_6LOWPAN , +ARPHRD_VSOCKMON , + ARPHRD_VOID, ARPHRD_NONE};static const char *const netdev_lock_name[] = { "_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
@@ -498,15 +504,21 @@ static const char *const netdev_lock_name[] = {"_xmit_IEEE1394" ,"_xmit_EUI64" ,"_xmit_INFINIBAND" ,"_xmit_SLIP" ,"_xmit_CSLIP" ,"_xmit_SLIP6" ,"_xmit_CSLIP6" ,"_xmit_RSRVD" ,"_xmit_ADAPT" ,"_xmit_ROSE" ,"_xmit_X25" ,"_xmit_HWX25" , +"_xmit_CAN" ,"_xmit_MCTP" ,"_xmit_PPP" ,"_xmit_CISCO" ,"_xmit_LAPB" ,"_xmit_DDCMP" , -"_xmit_RAWHDLC" ,"_xmit_TUNNEL" ,"_xmit_TUNNEL6" ,"_xmit_FRAD" , +"_xmit_RAWHDLC" ,"_xmit_RAWIP" , +"_xmit_TUNNEL" ,"_xmit_TUNNEL6" ,"_xmit_FRAD" ,"_xmit_SKIP" ,"_xmit_LOOPBACK" ,"_xmit_LOCALTLK" ,"_xmit_FDDI" ,"_xmit_BIF" ,"_xmit_SIT" ,"_xmit_IPDDP" ,"_xmit_IPGRE" ,"_xmit_PIMREG" ,"_xmit_HIPPI" ,"_xmit_ASH" ,"_xmit_ECONET" ,"_xmit_IRDA" ,"_xmit_FCPP" ,"_xmit_FCAL" ,"_xmit_FCPL" ,"_xmit_FCFABRIC" ,"_xmit_IEEE80211" ,"_xmit_IEEE80211_PRISM" , -"_xmit_IEEE80211_RADIOTAP" ,"_xmit_PHONET" ,"_xmit_PHONET_PIPE" , - "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"}; +"_xmit_IEEE80211_RADIOTAP" , +"_xmit_IEEE802154" ,"_xmit_IEEE802154_MONITOR" , +"_xmit_PHONET" ,"_xmit_PHONET_PIPE" , +"_xmit_CAIF" ,"_xmit_IP6GRE" ,"_xmit_NETLINK" ,"_xmit_6LOWPAN" , +"_xmit_VSOCKMON" , + "_xmit_VOID", "_xmit_NONE"};static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE (netdev_lock_type)];static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE (netdev_lock_type)];
@@ -519,6 +531,7 @@ static inline unsigned short netdev_lock_pos(unsigned short dev_type)if (netdev_lock_type[i] == dev_type)return i;/* the last key is used by default */ +WARN_ONCE (1 ,"netdev_lock_pos() could not find dev_type=%u\n" , dev_type);return ARRAY_SIZE (netdev_lock_type) -1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/254 macvlan: fix possible UAF in macvlan_forward_source()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e ]
Add RCU protection on (struct macvlan_source_entry)->vlan.
Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts.
This allows macvlan_forward_source() to skip over entries queued for freeing.
Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)).
https: //lore.kernel.org/netdev/[email protected]/T/#u
--- drivers/net/macvlan.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/net/macvlan.c +13 -7
@@ -58,7 +58,7 @@ struct macvlan_port {struct macvlan_source_entry {struct hlist_node hlist; -struct macvlan_dev *vlan; +struct macvlan_dev __rcu *vlan;unsigned char addr[6 +2 ]__aligned(sizeof(u16)) ;struct rcu_head rcu; };
@@ -145,7 +145,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source(hlist_for_each_entry_rcu (entry, h, hlist,lockdep_rtnl_is_held ()) {if (ether_addr_equal_64bits (entry->addr, addr) && - entry->vlan == vlan) +rcu_access_pointer (entry->vlan) == vlan)return entry; }return NULL ;
@@ -167,7 +167,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan,return -ENOMEM ;ether_addr_copy (entry->addr, addr); - entry->vlan = vlan; +RCU_INIT_POINTER (entry->vlan, vlan); h = &port->vlan_source_hash[macvlan_eth_hash (addr)];hlist_add_head_rcu (&entry->hlist, h); vlan->macaddr_count++;
@@ -186,6 +186,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan)static void macvlan_hash_del_source (struct macvlan_source_entry *entry) { +RCU_INIT_POINTER (entry->vlan,NULL );hlist_del_rcu (&entry->hlist);kfree_rcu (entry, rcu); }
@@ -389,7 +390,7 @@ static void macvlan_flush_sources(struct macvlan_port *port,int i;hash_for_each_safe (port->vlan_source_hash, i, next, entry, hlist) -if (entry->vlan == vlan) +if (rcu_access_pointer (entry->vlan) == vlan)macvlan_hash_del_source (entry); vlan->macaddr_count =0 ;
@@ -432,9 +433,14 @@ static bool macvlan_forward_source(struct sk_buff *skb,hlist_for_each_entry_rcu (entry, h, hlist) {if (ether_addr_equal_64bits (entry->addr, addr)) { -if (entry->vlan->flags &MACVLAN_FLAG_NODST ) +struct macvlan_dev *vlan =rcu_dereference (entry->vlan); + +if (!vlan) +continue ; + +if (vlan->flags &MACVLAN_FLAG_NODST ) consume = true; -macvlan_forward_source_one (skb, entry->vlan); +macvlan_forward_source_one (skb, vlan); } }
@@ -1685,7 +1691,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb,struct macvlan_source_entry *entry;hlist_for_each_entry_rcu (entry, h, hlist,lockdep_rtnl_is_held ()) { -if (entry->vlan != vlan) +if (rcu_access_pointer (entry->vlan) != vlan)continue ;if (nla_put (skb,IFLA_MACVLAN_MACADDR ,ETH_ALEN , entry->addr))return 1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/254 ipv4: ip_gre: make ipgre_header() robust
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e67c577d89894811ce4dcd1a9ed29d8b63476667 ]
Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1].
This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len
In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device.
[1]
skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0
kernel BUG at net/core/skbuff.c:213 !
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
--- net/ipv4/ip_gre.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/ip_gre.c +9 -2
@@ -860,10 +860,17 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev, const void *daddr, const void *saddr, unsigned int len) { struct ip_tunnel *t = netdev_priv(dev); -struct iphdr *iph;struct gre_base_hdr *greh; +struct iphdr *iph; +int needed; + + needed = t->hlen +sizeof (*iph); +if (skb_headroom (skb) < needed && +pskb_expand_head (skb,HH_DATA_ALIGN (needed -skb_headroom (skb)), +0 ,GFP_ATOMIC )) +return -needed; - iph =skb_push (skb, t->hlen +sizeof (*iph)); + iph =skb_push (skb, needed); greh = (struct gre_base_hdr *)(iph+1 ); greh->flags =gre_tnl_flags_to_gre_flags (t->parms.o_flags); greh->protocol =htons (type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/254 vsock/test: add a final full barrier after run all tests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
[ Upstream commit c39a6a277e0e67ffff6a8efcbbf7e7e23ce9e38c ]
If the last test fails, the other side still completes correctly, which could lead to false positives.
Let's add a final barrier that ensures that the last test has finished correctly on both sides, but also that the two sides agree on the number of tests to be performed.
--- tools/testing/vsock/util.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
tools/testing/vsock/util.c +12 -0
@@ -360,6 +360,18 @@ void run_tests(const struct test_case *test_cases,printf ("ok\n" ); } + +printf ("All tests have been executed. Waiting other peer..." ); +fflush (stdout); + +/* +* Final full barrier, to ensure that all tests have been run and +* that even the last one has been successful on both sides. +*/ +control_writeln ("COMPLETED" ); +control_expectln ("COMPLETED" ); + +printf ("ok\n" ); }void list_tests (const struct test_case *test_cases)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/254 net/mlx5e: Restore destroying state bit after profile cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 5629f8859dca7ef74d7314b60de6a957f23166c0 ]
Profile rollback can fail in mlx5e_netdev_change_profile() and we will end up with invalid mlx5e_priv memset to 0, we must maintain the 'destroying' bit in order to gracefully shutdown even if the profile/priv are not valid.
This patch maintains the previous state of the 'destroying' state of mlx5e_priv after priv cleanup, to allow the remove flow to cleanup common resources from mlx5_core to avoid FW fatal errors as seen below:
$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev
Error: mlx5_core: Failed setting eswitch to offloads.
dmesg: mlx5_core 0000:00:03.0 enp0s3np0: failed to rollback to orig profile, ...$ devlink dev reload pci/0000:00:03.0
mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:00:03.0: poll_health:803:(pid 519): Fatal error 3 detectedmlx5_core 0000:00:03.0: firmware version: 28.41.1000mlx5_core 0000:00:03.0: 0.000 Gb/s available PCIe bandwidth (Unknown x255 link)mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failedmlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failedmlx5_core 0000:00:03.0: mlx5_health_try_recover:340:(pid 141): handling bad device here mlx5_core 0000:00:03.0: mlx5_handle_bad_state:285:(pid 141): Expected to see disabled NIC but it is full driver mlx5_core 0000:00:03.0: mlx5_error_sw_reset:236:(pid 141): startmlx5_core 0000:00:03.0: NIC IFC still 0 after 4000ms.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +3 -0
@@ -5687,6 +5687,7 @@ int mlx5e_priv_init(struct mlx5e_priv *priv,void mlx5e_priv_cleanup (struct mlx5e_priv *priv) { +bool destroying =test_bit (MLX5E_STATE_DESTROYING , &priv->state);int i;/* bail if change profile failed and also rollback failed */
@@ -5712,6 +5713,8 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv) }memset (priv,0 ,sizeof (*priv)); +if (destroying)/* restore destroying bit, to allow unload */ +set_bit (MLX5E_STATE_DESTROYING , &priv->state); } static unsigned int mlx5e_get_max_num_txqs(struct mlx5_core_dev *mdev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/254 btrfs: store fs_info in space_info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 42f620aec182f62ee72e3fce41cb3353951b3508 ]
This is handy when computing space_info dynamic reclaim thresholds where we do not have access to a block group. We could add it to the various functions as a parameter, but it seems reasonable for space_info to have an fs_info pointer.
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
--- fs/btrfs/space-info.c | 1 + fs/btrfs/space-info.h | 1 + 2 files changed, 2 insertions(+)
fs/btrfs/space-info.c +1 -0
@@ -233,6 +233,7 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)if (!space_info)return -ENOMEM ; + space_info->fs_info = info;for (i =0 ; i <BTRFS_NR_RAID_TYPES ; i++)INIT_LIST_HEAD (&space_info->block_groups[i]);init_rwsem (&space_info->groups_sem);
fs/btrfs/space-info.h +1 -0
@@ -84,6 +84,7 @@ enum btrfs_flush_state { };struct btrfs_space_info { +struct btrfs_fs_info *fs_info;spinlock_t lock;u64 total_bytes;/* total bytes in the space,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/254 btrfs: factor out init_space_info() from create_space_info()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
[ Upstream commit ac5578fef380e68e539a2238ba63dd978a450ef2 ]
Factor out initialization of the space_info struct, which is used in a later patch. There is no functional change.
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
--- fs/btrfs/space-info.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
fs/btrfs/space-info.c +16 -11
@@ -222,19 +222,11 @@ void btrfs_update_space_info_chunk_size(struct btrfs_space_info *space_info,WRITE_ONCE (space_info->chunk_size, chunk_size); } -static int create_space_info (struct btrfs_fs_info *info,u64 flags) +static void init_space_info (struct btrfs_fs_info *info, +struct btrfs_space_info *space_info,u64 flags) { - -struct btrfs_space_info *space_info; -int i; -int ret; - - space_info =kzalloc (sizeof (*space_info),GFP_NOFS ); -if (!space_info) -return -ENOMEM ; - space_info->fs_info = info; -for (i =0 ; i <BTRFS_NR_RAID_TYPES ; i++) +for (int i =0 ; i <BTRFS_NR_RAID_TYPES ; i++)INIT_LIST_HEAD (&space_info->block_groups[i]);init_rwsem (&space_info->groups_sem);spin_lock_init (&space_info->lock);
@@ -248,6 +240,19 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)if (btrfs_is_zoned (info)) space_info->bg_reclaim_threshold =BTRFS_DEFAULT_ZONED_RECLAIM_THRESH ; +} + +static int create_space_info (struct btrfs_fs_info *info,u64 flags) +{ + +struct btrfs_space_info *space_info; +int ret; + + space_info =kzalloc (sizeof (*space_info),GFP_NOFS ); +if (!space_info) +return -ENOMEM ; + +init_space_info (info, space_info, flags); ret =btrfs_sysfs_add_space_info_type (info, space_info);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/254 btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
[ Upstream commit 1cfdbe0d53b27b4b4a4f4cf2a4e430bc65ba2ba5 ]
Factor out check_removing_space_info() from btrfs_free_block_groups(). It sanity checks a to-be-removed space_info. There is no functional change.
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
--- fs/btrfs/block-group.c | 49 +++++++++++++++++++++++------------------- 1 file changed, 27 insertions(+), 22 deletions(-)
fs/btrfs/block-group.c +27 -22
@@ -4377,6 +4377,32 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info) } } +static void check_removing_space_info (struct btrfs_space_info *space_info) +{ +struct btrfs_fs_info *info = space_info->fs_info; + +/* +* Do not hide this behind enospc_debug, this is actually important and +* indicates a real bug if this happens. +*/ +if (WARN_ON (space_info->bytes_pinned >0 || space_info->bytes_may_use >0 )) +btrfs_dump_space_info (info, space_info,0 ,0 ); + +/* +* If there was a failure to cleanup a log tree, very likely due to an +* IO failure on a writeback attempt of one or more of its extent +* buffers, we could not do proper (and cheap) unaccounting of their +* reserved space, so don't warn on bytes_reserved > 0 in that case. +*/ +if (!(space_info->flags &BTRFS_BLOCK_GROUP_METADATA ) || + !BTRFS_FS_LOG_CLEANUP_ERROR (info)) { +if (WARN_ON (space_info->bytes_reserved >0 )) +btrfs_dump_space_info (info, space_info,0 ,0 ); + } + +WARN_ON (space_info->reclaim_size >0 ); +} +/* * Must be called only after stopping all workers, since we could have block * group caching kthreads running, and therefore they could race with us if we
@@ -4478,28 +4504,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info) struct btrfs_space_info, list); -/* -* Do not hide this behind enospc_debug, this is actually -* important and indicates a real bug if this happens. -*/ -if (WARN_ON (space_info->bytes_pinned >0 || - space_info->bytes_may_use >0 )) -btrfs_dump_space_info (info, space_info,0 ,0 ); - -/* -* If there was a failure to cleanup a log tree, very likely due -* to an IO failure on a writeback attempt of one or more of its -* extent buffers, we could not do proper (and cheap) unaccounting -* of their reserved space, so don't warn on bytes_reserved > 0 in -* that case. -*/ -if (!(space_info->flags &BTRFS_BLOCK_GROUP_METADATA ) || - !BTRFS_FS_LOG_CLEANUP_ERROR (info)) { -if (WARN_ON (space_info->bytes_reserved >0 )) -btrfs_dump_space_info (info, space_info,0 ,0 ); - } - -WARN_ON (space_info->reclaim_size >0 ); +check_removing_space_info (space_info);list_del (&space_info->list);btrfs_sysfs_remove_space_info (space_info); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/254 btrfs: introduce btrfs_space_info sub-group
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
[ Upstream commit f92ee31e031c7819126d2febdda0c3e91f5d2eb9 ]
Current code assumes we have only one space_info for each block group type (DATA, METADATA, and SYSTEM). We sometime need multiple space infos to manage special block groups.
One example is handling the data relocation block group for the zoned mode. That block group is dedicated for writing relocated data and we cannot allocate any regular extent from that block group, which is implemented in the zoned extent allocator. This block group still belongs to the normal data space_info. So, when all the normal data block groups are full and there is some free space in the dedicated block group, the space_info looks to have some free space, while it cannot allocate normal extent anymore. That results in a strange ENOSPC error. We need to have a space_info for the relocation data block group to represent the situation properly.
Adds a basic infrastructure for having a "sub-group" of a space_info:
creation and removing. A sub-group space_info belongs to one of the primary space_infos and has the same flags as its parent.
This commit first introduces the relocation data sub-space_info, and the next commit will introduce tree-log sub-space_info. In the future, it could be useful to implement tiered storage for btrfs e.g. by implementing a sub-group space_info for block groups resides on a fast storage.
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
--- fs/btrfs/block-group.c | 11 +++++++++++ fs/btrfs/space-info.c | 44 +++++++++++++++++++++++++++++++++++++++--- fs/btrfs/space-info.h | 9 +++++++++ fs/btrfs/sysfs.c | 18 ++++++++++++++--- 4 files changed, 76 insertions(+), 6 deletions(-)
fs/btrfs/block-group.c +11 -0
@@ -4381,6 +4381,17 @@ static void check_removing_space_info(struct btrfs_space_info *space_info) {struct btrfs_fs_info *info = space_info->fs_info; +if (space_info->subgroup_id ==BTRFS_SUB_GROUP_PRIMARY ) { +/* This is a top space_info, proceed with its children first. */ +for (int i =0 ; i <BTRFS_SPACE_INFO_SUB_GROUP_MAX ; i++) { +if (space_info->sub_group[i]) { +check_removing_space_info (space_info->sub_group[i]); +kfree (space_info->sub_group[i]); + space_info->sub_group[i] =NULL ; + } + } + } +/* * Do not hide this behind enospc_debug, this is actually important and * indicates a real bug if this happens.
fs/btrfs/space-info.c +41 -3
71 lines not on this page · raw message
fs/btrfs/space-info.h +9 -0
@@ -83,8 +83,17 @@ enum btrfs_flush_state { COMMIT_TRANS = 11, }; +enum btrfs_space_info_sub_group { +BTRFS_SUB_GROUP_PRIMARY , +BTRFS_SUB_GROUP_DATA_RELOC , +}; + +#define BTRFS_SPACE_INFO_SUB_GROUP_MAX 1struct btrfs_space_info {struct btrfs_fs_info *fs_info; +struct btrfs_space_info *parent; +struct btrfs_space_info *sub_group[BTRFS_SPACE_INFO_SUB_GROUP_MAX ]; +int subgroup_id;spinlock_t lock;u64 total_bytes;/* total bytes in the space,
fs/btrfs/sysfs.c +15 -3
@@ -1641,16 +1641,28 @@ void btrfs_sysfs_remove_space_info(struct btrfs_space_info *space_info)kobject_put (&space_info->kobj); } -static const char *alloc_name (u64 flags) +static const char *alloc_name (struct btrfs_space_info *space_info) { +u64 flags = space_info->flags; +switch (flags) {case BTRFS_BLOCK_GROUP_METADATA |BTRFS_BLOCK_GROUP_DATA :return "mixed" ;case BTRFS_BLOCK_GROUP_METADATA : +ASSERT (space_info->subgroup_id ==BTRFS_SUB_GROUP_PRIMARY );return "metadata" ;case BTRFS_BLOCK_GROUP_DATA : -return "data" ; +switch (space_info->subgroup_id) { +case BTRFS_SUB_GROUP_PRIMARY : +return "data" ; +case BTRFS_SUB_GROUP_DATA_RELOC : +return "data-reloc" ; +default : +WARN_ON_ONCE (1 ); +return "data (unknown sub-group)" ; + }case BTRFS_BLOCK_GROUP_SYSTEM : +ASSERT (space_info->subgroup_id ==BTRFS_SUB_GROUP_PRIMARY );return "system" ;default :WARN_ON (1 );
@@ -1669,7 +1681,7 @@ int btrfs_sysfs_add_space_info_type(struct btrfs_fs_info *fs_info, ret =kobject_init_and_add (&space_info->kobj, &space_info_ktype, fs_info->space_info_kobj,"%s" , -alloc_name (space_info->flags)); +alloc_name (space_info));if (ret) {kobject_put (&space_info->kobj);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/254 btrfs: fix memory leaks in create_space_info() error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit a11224a016d6d1d46a4d9b6573244448a80d4d7f ]
In create_space_info(), the 'space_info' object is allocated at the beginning of the function. However, there are two error paths where the function returns an error code without freeing the allocated memory:
1. When create_space_info_sub_group() fails in zoned mode.
2. When btrfs_sysfs_add_space_info_type() fails.
In both cases, 'space_info' has not yet been added to the fs_info->space_info list, resulting in a memory leak. Fix this by adding an error handling label to kfree(space_info) before returning.
--- fs/btrfs/space-info.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/btrfs/space-info.c +6 -2
@@ -288,18 +288,22 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)BTRFS_SUB_GROUP_DATA_RELOC , 0);if (ret) -return ret; + goto out_free; } ret =btrfs_sysfs_add_space_info_type (info, space_info);if (ret) -return ret; + goto out_free;list_add (&space_info->list, &info->space_info);if (flags &BTRFS_BLOCK_GROUP_DATA ) info->data_sinfo = space_info;return ret; + +out_free: +kfree (space_info); +return ret; }int btrfs_init_space_info (struct btrfs_fs_info *fs_info)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/254 net: hv_netvsc: reject RSS hash key programming without RX indirection table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <[email protected]>
[ Upstream commit d23564955811da493f34412d7de60fa268c8cb50 ]
RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang.
Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior.
--- drivers/net/hyperv/netvsc_drv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/hyperv/netvsc_drv.c +3 -0
@@ -1762,6 +1762,9 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir,if (hfunc !=ETH_RSS_HASH_NO_CHANGE && hfunc !=ETH_RSS_HASH_TOP )return -EOPNOTSUPP ; +if (!ndc->rx_table_sz) +return -EOPNOTSUPP ; + rndis_dev = ndev->extension;if (indir) {for (i =0 ; i < ndc->rx_table_sz; i++)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/254 ipv6: Fix use-after-free in inet6_addr_del().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit ddf96c393a33aef4887e2e406c76c2f8cda1419c ]
syzbot reported use-after-free of inet6_ifaddr ininet6_addr_del(). [0]
The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before reading its ifp->flags for temporary addresses in inet6_addr_del().
Let's move ipv6_del_addr() down to fix the UAF.
[0]:
BUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593 CPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181 inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f164cf8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749 RDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003 RBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288 </TASK> Allocated by task 9593: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120 inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050 addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160 inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6099: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free_freelist_hook mm/slub.c:2569 [inline] slab_free_bulk mm/slub.c:6696 [inline] kmem_cache_free_bulk mm/slub.c:7383 [inline] kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362 kfree_bulk include/linux/slab.h:830 [inline] kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523 kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline] kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
--- net/ipv6/addrconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/addrconf.c +2 -2
@@ -3111,12 +3111,12 @@ static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,in6_ifa_hold (ifp);read_unlock_bh (&idev->lock); -ipv6_del_addr (ifp); -if (!(ifp->flags &IFA_F_TEMPORARY ) && (ifp->flags &IFA_F_MANAGETEMPADDR ))delete_tempaddrs (idev, ifp); +ipv6_del_addr (ifp); +addrconf_verify_rtnl (net);if (ipv6_addr_is_multicast (pfx)) { ipv6_mc_config(net->ipv6.mc_autojoin_sk,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/254 selftests: drv-net: fix RPS mask handling for high CPU numbers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit cf055f8c000445aa688c53a706ef4f580818eedb ]
The RPS bitmask bounds check uses ~(RPS_MAX_CPUS - 1) which equals ~15 = 0xfff0, only allowing CPUs 0-3.
Change the mask to ~((1UL << RPS_MAX_CPUS) - 1) = ~0xffff to allow CPUs 0-15.
--- tools/testing/selftests/net/toeplitz.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/toeplitz.c +2 -2
@@ -473,8 +473,8 @@ static void parse_rps_bitmap(const char *arg) bitmap =strtoul (arg,NULL ,0 ); -if (bitmap & ~(RPS_MAX_CPUS -1 )) -error (1 ,0 ,"rps bitmap 0x%lx out of bounds 0..%lu" , +if (bitmap & ~((1UL <<RPS_MAX_CPUS ) -1 )) +error (1 ,0 ,"rps bitmap 0x%lx out of bounds, max cpu %lu" , bitmap,RPS_MAX_CPUS -1 );for (i =0 ; i <RPS_MAX_CPUS ; i++)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/254 net/sched: sch_qfq: do not free existing class in qfq_change_class()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 ]
Fixes qfq_change_class() error case.
cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.
--- net/sched/sch_qfq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/sched/sch_qfq.c +4 -2
@@ -532,8 +532,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,return 0 ; destroy_class: -qdisc_put (cl->qdisc); -kfree (cl); +if (!existing) { +qdisc_put (cl->qdisc); +kfree (cl); + }return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/254 ASoC: tlv320adcx140: fix null pointer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Svendsen <[email protected]>
[ Upstream commit be7664c81d3129fc313ef62ff275fd3d33cfecd4 ]
The "snd_soc_component" in "adcx140_priv" was only used once but never set. It was only used for reaching "dev" which is already present in "adcx140_priv".
--- sound/soc/codecs/tlv320adcx140.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
sound/soc/codecs/tlv320adcx140.c +1 -3
@@ -24,7 +24,6 @@#include "tlv320adcx140.h" struct adcx140_priv { -struct snd_soc_component *component;struct regulator *supply_areg;struct gpio_desc *gpio_reset;struct regmap *regmap;
@@ -702,7 +701,6 @@ static void adcx140_pwr_ctrl(struct adcx140_priv *adcx140, bool power_state) {int pwr_ctrl =0 ;int ret =0 ; -struct snd_soc_component *component = adcx140->component;if (power_state) pwr_ctrl =ADCX140_PWR_CFG_ADC_PDZ |ADCX140_PWR_CFG_PLL_PDZ ;
@@ -714,7 +712,7 @@ static void adcx140_pwr_ctrl(struct adcx140_priv *adcx140, bool power_state) ret =regmap_write (adcx140->regmap,ADCX140_PHASE_CALIB , adcx140->phase_calib_on ?0x00 :0x40 );if (ret) -dev_err (component->dev,"%s: register write error %d\n" , +dev_err (adcx140->dev,"%s: register write error %d\n" , __func__, ret); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/254 ASoC: tlv320adcx140: fix word length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Svendsen <[email protected]>
[ Upstream commit 46378ab9fcb796dca46b51e10646f636e2c661f9 ]
The word length is the physical width of the channel slots. So the hw_params would misconfigure when format width and physical width doesn't match. Like S24_LE which has data width of 24 bits but physical width of 32 bits. So if using asymmetric formats you will get a lot of noise.
--- sound/soc/codecs/tlv320adcx140.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/tlv320adcx140.c +2 -2
@@ -728,7 +728,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,struct adcx140_priv *adcx140 =snd_soc_component_get_drvdata (component);u8 data =0 ; -switch (params_width (params)) { +switch (params_physical_width (params)) {case 16 : data =ADCX140_16_BIT_WORD ;break ;
@@ -743,7 +743,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,break ;default :dev_err (component->dev,"%s: Unsupported width %d\n" , - __func__,params_width (params)); + __func__,params_physical_width (params));return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/254 textsearch: describe @list member in ts_ops search
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit f26528478bb102c28e7ac0cbfc8ec8185afdafc7 ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/textsearch.h:49 struct member 'list' not described in 'ts_ops'
Describe @list member to fix it.
--- include/linux/textsearch.h | 1 + 1 file changed, 1 insertion(+)
include/linux/textsearch.h +1 -0
@@ -35,6 +35,7 @@ struct ts_state* @get_pattern: return head of pattern * @get_pattern_len: return length of pattern * @owner: module reference to algorithm +* @list: list to search */ struct ts_ops {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/254 mm, kfence: describe @slab parameter in __kfence_obj_info()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit 6cfab50e1440fde19af7c614aacd85e11aa4dcea ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/kfence.h:220 function parameter 'slab' not described in '__kfence_obj_info'
Fix it by describing @slab parameter.
--- include/linux/kfence.h | 1 + 1 file changed, 1 insertion(+)
include/linux/kfence.h +1 -0
@@ -211,6 +211,7 @@ struct kmem_obj_info;* __kfence_obj_info() - fill kmem_obj_info struct * @kpp: kmem_obj_info to be filled * @object: the object +* @slab: the slab * * Return: * * false - not a KFENCE object
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/254 dmaengine: xilinx: xdma: Fix regmap max_register
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Brandon <[email protected]>
[ Upstream commit c7d436a6c1a274c1ac28d5fb3b8eb8f03b6d0e10 ]
The max_register field is assigned the size of the register memory region instead of the offset of the last register.
The result is that reading from the regmap via debugfs can cause a segmentation fault:
tail /sys/kernel/debug/regmap/xdma.1.auto/registers
Unable to handle kernel paging request at virtual address ffff800082f70000
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
[...]
Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]---
note: tail[1217] exited with irqs disabled
note: tail[1217] exited with preempt_count 1
Segmentation fault
--- drivers/dma/xilinx/xdma-regs.h | 1 + drivers/dma/xilinx/xdma.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/dma/xilinx/xdma-regs.h +1 -0
@@ -9,6 +9,7 @@/* The length of register space exposed to host */ #define XDMA_REG_SPACE_LEN 65536 +#define XDMA_MAX_REG_OFFSET (XDMA_REG_SPACE_LEN - 4)/* * maximum number of DMA channels for each direction:
drivers/dma/xilinx/xdma.c +1 -1
@@ -38,7 +38,7 @@ static const struct regmap_config xdma_regmap_config = { .reg_bits = 32, .val_bits = 32, .reg_stride = 4, - .max_register = XDMA_REG_SPACE_LEN, + .max_register = XDMA_MAX_REG_OFFSET, };/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/254 dmaengine: tegra-adma: Fix use-after-free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheetal <[email protected]>
[ Upstream commit 2efd07a7c36949e6fa36a69183df24d368bf9e96 ]
A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it.
The race condition follows this sequence:
1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet)
2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree()
3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory
Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs.
Fix this by properly synchronizing the virtual channel completion:
- Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor.
- Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors.
Crash logs:
[ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0
[ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8
--- drivers/dma/tegra210-adma.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/dma/tegra210-adma.c +9 -1
@@ -342,10 +342,17 @@ static void tegra_adma_stop(struct tegra_adma_chan *tdc)return ; } -kfree (tdc->desc); +vchan_terminate_vdesc (&tdc->desc->vd); tdc->desc =NULL ; } +static void tegra_adma_synchronize (struct dma_chan *dc) +{ +struct tegra_adma_chan *tdc =to_tegra_adma_chan (dc); + +vchan_synchronize (&tdc->vc); +} +static void tegra_adma_start (struct tegra_adma_chan *tdc) {struct virt_dma_desc *vd =vchan_next_desc (&tdc->vc);
@@ -909,6 +916,7 @@ static int tegra_adma_probe(struct platform_device *pdev) tdma->dma_dev.device_config = tegra_adma_slave_config; tdma->dma_dev.device_tx_status = tegra_adma_tx_status; tdma->dma_dev.device_terminate_all = tegra_adma_terminate_all; + tdma->dma_dev.device_synchronize = tegra_adma_synchronize; tdma->dma_dev.src_addr_widths =BIT (DMA_SLAVE_BUSWIDTH_4_BYTES ); tdma->dma_dev.dst_addr_widths =BIT (DMA_SLAVE_BUSWIDTH_4_BYTES ); tdma->dma_dev.directions =BIT (DMA_DEV_TO_MEM ) |BIT (DMA_MEM_TO_DEV );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/254 dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <[email protected]>
[ Upstream commit c0732fe78728718c853ef8e7af5bbb05262acbd1 ]
When device tree lacks optional "xlnx,addrwidth" property, the addr_width variable remained uninitialized with garbage values, causing incorrect DMA mask configuration and subsequent probe failure. The fix ensures a fallback to the default 32-bit address width when this property is missing.
--- drivers/dma/xilinx/xilinx_dma.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +5 -2
@@ -128,6 +128,7 @@#define XILINX_MCDMA_MAX_CHANS_PER_DEVICE 0x20#define XILINX_DMA_MAX_CHANS_PER_DEVICE 0x2#define XILINX_CDMA_MAX_CHANS_PER_DEVICE 0x1 +#define XILINX_DMA_DFAULT_ADDRWIDTH 0x20#define XILINX_DMA_DMAXR_ALL_IRQ_MASK \ (XILINX_DMA_DMASR_FRM_CNT_IRQ | \
@@ -3057,7 +3058,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)struct device_node *node = pdev->dev.of_node;struct xilinx_dma_device *xdev;struct device_node *child, *np = pdev->dev.of_node; -u32 num_frames, addr_width, len_width; +u32 num_frames, addr_width =XILINX_DMA_DFAULT_ADDRWIDTH , len_width;int i, err;/* Allocate and initialize the DMA engine structure */
@@ -3131,7 +3132,9 @@ static int xilinx_dma_probe(struct platform_device *pdev) err =of_property_read_u32 (node,"xlnx,addrwidth" , &addr_width);if (err <0 ) -dev_warn (xdev->dev,"missing xlnx,addrwidth property\n" ); +dev_warn (xdev->dev, +"missing xlnx,addrwidth property, using default value %d\n" , +XILINX_DMA_DFAULT_ADDRWIDTH );if (addr_width >32 ) xdev->ext_addr = true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/254 phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Radaelli <[email protected]>
[ Upstream commit 8becf9179a4b45104a1701010ed666b55bf4b3a6 ]
Clear the PCS_TX_SWING_FULL field mask before setting the new value in PHY_CTRL5 register. Without clearing the mask first, the OR operation could leave previously set bits, resulting in incorrect register configuration.
--- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/phy/freescale/phy-fsl-imx8mq-usb.c +1 -0
@@ -206,6 +206,7 @@ static void imx8m_phy_tune(struct imx8mq_usb_phy *imx_phy)if (imx_phy->pcs_tx_swing_full !=PHY_TUNE_DEFAULT ) { value =readl (imx_phy->base +PHY_CTRL5 ); + value &= ~PHY_CTRL5_PCS_TX_SWING_FULL_MASK ; value |=FIELD_PREP (PHY_CTRL5_PCS_TX_SWING_FULL_MASK , imx_phy->pcs_tx_swing_full);writel (value, imx_phy->base +PHY_CTRL5 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/254 phy: phy-snps-eusb2: refactor constructs names
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivaylo Ivanov <[email protected]>
[ Upstream commit 93dbe9b5b3a265c7e5466c7b6ada439b01577de5 ]
As the driver now resides outside the phy subdirectory under a different name, refactor all definitions, structures and functions to explicitly specify what code is Qualcomm-specific and what is not.
Stable-dep-of: 1ca52c0983c3 ("phy: qcom-qusb2: Fix NULL pointer dereference on early suspend")
--- drivers/phy/qualcomm/phy-qcom-snps-eusb2.c | 256 ++++++++++----------- 1 file changed, 128 insertions(+), 128 deletions(-)
drivers/phy/qualcomm/phy-qcom-snps-eusb2.c +128 -128
@@ -13,15 +13,15 @@#include <linux/regulator/consumer.h> #include <linux/reset.h> -#define USB_PHY_UTMI_CTRL0 (0x3c) +#define QCOM_USB_PHY_UTMI_CTRL0 (0x3c)#define SLEEPM BIT(0)#define OPMODE_MASK GENMASK(4, 3)#define OPMODE_NONDRIVING BIT(3) -#define USB_PHY_UTMI_CTRL5 (0x50) +#define QCOM_USB_PHY_UTMI_CTRL5 (0x50)#define POR BIT(1) -#define USB_PHY_HS_PHY_CTRL_COMMON0 (0x54) +#define QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 (0x54)#define PHY_ENABLE BIT(0)#define SIDDQ_SEL BIT(1)#define SIDDQ BIT(2)
@@ -30,15 +30,15 @@#define FSEL_19_2_MHZ_VAL (0x0)#define FSEL_38_4_MHZ_VAL (0x4) -#define USB_PHY_CFG_CTRL_1 (0x58) +#define QCOM_USB_PHY_CFG_CTRL_1 (0x58)#define PHY_CFG_PLL_CPBIAS_CNTRL_MASK GENMASK(7, 1) -#define USB_PHY_CFG_CTRL_2 (0x5c) +#define QCOM_USB_PHY_CFG_CTRL_2 (0x5c)#define PHY_CFG_PLL_FB_DIV_7_0_MASK GENMASK(7, 0)#define DIV_7_0_19_2_MHZ_VAL (0x90)#define DIV_7_0_38_4_MHZ_VAL (0xc8) -#define USB_PHY_CFG_CTRL_3 (0x60) +#define QCOM_USB_PHY_CFG_CTRL_3 (0x60)#define PHY_CFG_PLL_FB_DIV_11_8_MASK GENMASK(3, 0)#define DIV_11_8_19_2_MHZ_VAL (0x1)#define DIV_11_8_38_4_MHZ_VAL (0x0)
@@ -46,73 +46,73 @@#define PHY_CFG_PLL_REF_DIV GENMASK(7, 4)#define PLL_REF_DIV_VAL (0x0) -#define USB_PHY_HS_PHY_CTRL2 (0x64) +#define QCOM_USB_PHY_HS_PHY_CTRL2 (0x64)#define VBUSVLDEXT0 BIT(0)#define USB2_SUSPEND_N BIT(2)#define USB2_SUSPEND_N_SEL BIT(3)#define VBUS_DET_EXT_SEL BIT(4) -#define USB_PHY_CFG_CTRL_4 (0x68) +#define QCOM_USB_PHY_CFG_CTRL_4 (0x68)#define PHY_CFG_PLL_GMP_CNTRL_MASK GENMASK(1, 0)#define PHY_CFG_PLL_INT_CNTRL_MASK GENMASK(7, 2) -#define USB_PHY_CFG_CTRL_5 (0x6c) +#define QCOM_USB_PHY_CFG_CTRL_5 (0x6c)#define PHY_CFG_PLL_PROP_CNTRL_MASK GENMASK(4, 0)#define PHY_CFG_PLL_VREF_TUNE_MASK GENMASK(7, 6) -#define USB_PHY_CFG_CTRL_6 (0x70) +#define QCOM_USB_PHY_CFG_CTRL_6 (0x70)#define PHY_CFG_PLL_VCO_CNTRL_MASK GENMASK(2, 0) -#define USB_PHY_CFG_CTRL_7 (0x74) +#define QCOM_USB_PHY_CFG_CTRL_7 (0x74) -#define USB_PHY_CFG_CTRL_8 (0x78) +#define QCOM_USB_PHY_CFG_CTRL_8 (0x78)#define PHY_CFG_TX_FSLS_VREF_TUNE_MASK GENMASK(1, 0)#define PHY_CFG_TX_FSLS_VREG_BYPASS BIT(2)#define PHY_CFG_TX_HS_VREF_TUNE_MASK GENMASK(5, 3)#define PHY_CFG_TX_HS_XV_TUNE_MASK GENMASK(7, 6) -#define USB_PHY_CFG_CTRL_9 (0x7c) +#define QCOM_USB_PHY_CFG_CTRL_9 (0x7c)#define PHY_CFG_TX_PREEMP_TUNE_MASK GENMASK(2, 0)#define PHY_CFG_TX_RES_TUNE_MASK GENMASK(4, 3)#define PHY_CFG_TX_RISE_TUNE_MASK GENMASK(6, 5)#define PHY_CFG_RCAL_BYPASS BIT(7) -#define USB_PHY_CFG_CTRL_10 (0x80) +#define QCOM_USB_PHY_CFG_CTRL_10 (0x80) -#define USB_PHY_CFG0 (0x94) +#define QCOM_USB_PHY_CFG0 (0x94)#define DATAPATH_CTRL_OVERRIDE_EN BIT(0)#define CMN_CTRL_OVERRIDE_EN BIT(1) -#define UTMI_PHY_CMN_CTRL0 (0x98) +#define QCOM_UTMI_PHY_CMN_CTRL0 (0x98)#define TESTBURNIN BIT(6) -#define USB_PHY_FSEL_SEL (0xb8) +#define QCOM_USB_PHY_FSEL_SEL (0xb8)#define FSEL_SEL BIT(0) -#define USB_PHY_APB_ACCESS_CMD (0x130) +#define QCOM_USB_PHY_APB_ACCESS_CMD (0x130)#define RW_ACCESS BIT(0)#define APB_START_CMD BIT(1)#define APB_LOGIC_RESET BIT(2) -#define USB_PHY_APB_ACCESS_STATUS (0x134) +#define QCOM_USB_PHY_APB_ACCESS_STATUS (0x134)#define ACCESS_DONE BIT(0)#define TIMED_OUT BIT(1)#define ACCESS_ERROR BIT(2)#define ACCESS_IN_PROGRESS BIT(3) -#define USB_PHY_APB_ADDRESS (0x138) +#define QCOM_USB_PHY_APB_ADDRESS (0x138)#define APB_REG_ADDR_MASK GENMASK(7, 0) -#define USB_PHY_APB_WRDATA_LSB (0x13c) +#define QCOM_USB_PHY_APB_WRDATA_LSB (0x13c)#define APB_REG_WRDATA_7_0_MASK GENMASK(3, 0) -#define USB_PHY_APB_WRDATA_MSB (0x140) +#define QCOM_USB_PHY_APB_WRDATA_MSB (0x140)#define APB_REG_WRDATA_15_8_MASK GENMASK(7, 4) -#define USB_PHY_APB_RDDATA_LSB (0x144) +#define QCOM_USB_PHY_APB_RDDATA_LSB (0x144)#define APB_REG_RDDATA_7_0_MASK GENMASK(3, 0) -#define USB_PHY_APB_RDDATA_MSB (0x148) +#define QCOM_USB_PHY_APB_RDDATA_MSB (0x148)#define APB_REG_RDDATA_15_8_MASK GENMASK(7, 4)static const char *const eusb2_hsphy_vreg_names[] = {
@@ -121,7 +121,7 @@ static const char * const eusb2_hsphy_vreg_names[] = {#define EUSB2_NUM_VREGS ARRAY_SIZE(eusb2_hsphy_vreg_names) -struct qcom_snps_eusb2_hsphy { +struct snps_eusb2_hsphy {struct phy *phy;void __iomem *base;
@@ -135,17 +135,17 @@ struct qcom_snps_eusb2_hsphy {struct phy *repeater; }; -static int qcom_snps_eusb2_hsphy_set_mode (struct phy *p,enum phy_mode mode,int submode) +static int snps_eusb2_hsphy_set_mode (struct phy *p,enum phy_mode mode,int submode) { -struct qcom_snps_eusb2_hsphy *phy =phy_get_drvdata (p); +struct snps_eusb2_hsphy *phy =phy_get_drvdata (p); phy->mode = mode;return phy_set_mode_ext (phy->repeater, mode, submode); } -static void qcom_snps_eusb2_hsphy_write_mask (void __iomem *base,u32 offset, -u32 mask,u32 val) +static void snps_eusb2_hsphy_write_mask (void __iomem *base,u32 offset, +u32 mask,u32 val) {u32 reg;
@@ -158,65 +158,65 @@ static void qcom_snps_eusb2_hsphy_write_mask(void __iomem *base, u32 offset,readl_relaxed (base + offset); } -static void qcom_eusb2_default_parameters (struct qcom_snps_eusb2_hsphy *phy) +static void qcom_eusb2_default_parameters (struct snps_eusb2_hsphy *phy) {/* default parameters: tx pre-emphasis */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_9 , -PHY_CFG_TX_PREEMP_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_PREEMP_TUNE_MASK ,0 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_9 , +PHY_CFG_TX_PREEMP_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_PREEMP_TUNE_MASK ,0 ));/* tx rise/fall time */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_9 , -PHY_CFG_TX_RISE_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_RISE_TUNE_MASK ,0x2 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_9 , +PHY_CFG_TX_RISE_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_RISE_TUNE_MASK ,0x2 ));/* source impedance adjustment */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_9 , -PHY_CFG_TX_RES_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_RES_TUNE_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_9 , +PHY_CFG_TX_RES_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_RES_TUNE_MASK ,0x1 ));/* dc voltage level adjustement */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_8 , -PHY_CFG_TX_HS_VREF_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_HS_VREF_TUNE_MASK ,0x3 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_8 , +PHY_CFG_TX_HS_VREF_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_HS_VREF_TUNE_MASK ,0x3 ));/* transmitter HS crossover adjustement */ -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_8 , -PHY_CFG_TX_HS_XV_TUNE_MASK , -FIELD_PREP (PHY_CFG_TX_HS_XV_TUNE_MASK ,0x0 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_8 , +PHY_CFG_TX_HS_XV_TUNE_MASK , +FIELD_PREP (PHY_CFG_TX_HS_XV_TUNE_MASK ,0x0 )); } -static int qcom_eusb2_ref_clk_init (struct qcom_snps_eusb2_hsphy *phy) +static int qcom_eusb2_ref_clk_init (struct snps_eusb2_hsphy *phy) {unsigned long ref_clk_freq =clk_get_rate (phy->ref_clk);switch (ref_clk_freq) {case 19200000 : -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -FSEL_MASK , -FIELD_PREP (FSEL_MASK ,FSEL_19_2_MHZ_VAL )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +FSEL_MASK , +FIELD_PREP (FSEL_MASK ,FSEL_19_2_MHZ_VAL )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_2 , -PHY_CFG_PLL_FB_DIV_7_0_MASK , -DIV_7_0_19_2_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_2 , +PHY_CFG_PLL_FB_DIV_7_0_MASK , +DIV_7_0_19_2_MHZ_VAL ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_3 , -PHY_CFG_PLL_FB_DIV_11_8_MASK , -DIV_11_8_19_2_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_3 , +PHY_CFG_PLL_FB_DIV_11_8_MASK , +DIV_11_8_19_2_MHZ_VAL );break ;case 38400000 : -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -FSEL_MASK , -FIELD_PREP (FSEL_MASK ,FSEL_38_4_MHZ_VAL )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +FSEL_MASK , +FIELD_PREP (FSEL_MASK ,FSEL_38_4_MHZ_VAL )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_2 , -PHY_CFG_PLL_FB_DIV_7_0_MASK , -DIV_7_0_38_4_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_2 , +PHY_CFG_PLL_FB_DIV_7_0_MASK , +DIV_7_0_38_4_MHZ_VAL ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_3 , -PHY_CFG_PLL_FB_DIV_11_8_MASK , -DIV_11_8_38_4_MHZ_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_3 , +PHY_CFG_PLL_FB_DIV_11_8_MASK , +DIV_11_8_38_4_MHZ_VAL );break ;default :
@@ -224,15 +224,15 @@ static int qcom_eusb2_ref_clk_init(struct qcom_snps_eusb2_hsphy *phy)return -EINVAL ; } -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_3 , -PHY_CFG_PLL_REF_DIV ,PLL_REF_DIV_VAL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_3 , +PHY_CFG_PLL_REF_DIV ,PLL_REF_DIV_VAL );return 0 ; } -static int qcom_snps_eusb2_hsphy_init (struct phy *p) +static int snps_eusb2_hsphy_init (struct phy *p) { -struct qcom_snps_eusb2_hsphy *phy =phy_get_drvdata (p); +struct snps_eusb2_hsphy *phy =phy_get_drvdata (p);int ret; ret =regulator_bulk_enable (ARRAY_SIZE (phy->vregs), phy->vregs);
@@ -265,73 +265,73 @@ static int qcom_snps_eusb2_hsphy_init(struct phy *p) goto disable_ref_clk; } -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG0 , -CMN_CTRL_OVERRIDE_EN ,CMN_CTRL_OVERRIDE_EN ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG0 , +CMN_CTRL_OVERRIDE_EN ,CMN_CTRL_OVERRIDE_EN ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_UTMI_CTRL5 ,POR ,POR ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_UTMI_CTRL5 ,POR ,POR ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -PHY_ENABLE |RETENABLEN ,PHY_ENABLE |RETENABLEN ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +PHY_ENABLE |RETENABLEN ,PHY_ENABLE |RETENABLEN ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_APB_ACCESS_CMD , -APB_LOGIC_RESET ,APB_LOGIC_RESET ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_APB_ACCESS_CMD , +APB_LOGIC_RESET ,APB_LOGIC_RESET ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,UTMI_PHY_CMN_CTRL0 ,TESTBURNIN ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_UTMI_PHY_CMN_CTRL0 ,TESTBURNIN ,0 ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_FSEL_SEL , -FSEL_SEL ,FSEL_SEL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_FSEL_SEL , +FSEL_SEL ,FSEL_SEL );/* update ref_clk related registers */ ret =qcom_eusb2_ref_clk_init (phy);if (ret) - goto disable_ref_clk; +return ret; -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_1 , -PHY_CFG_PLL_CPBIAS_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_CPBIAS_CNTRL_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_1 , +PHY_CFG_PLL_CPBIAS_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_CPBIAS_CNTRL_MASK ,0x1 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_4 , -PHY_CFG_PLL_INT_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_INT_CNTRL_MASK ,0x8 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_4 , +PHY_CFG_PLL_INT_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_INT_CNTRL_MASK ,0x8 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_4 , -PHY_CFG_PLL_GMP_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_GMP_CNTRL_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_4 , +PHY_CFG_PLL_GMP_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_GMP_CNTRL_MASK ,0x1 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_5 , -PHY_CFG_PLL_PROP_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_PROP_CNTRL_MASK ,0x10 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_5 , +PHY_CFG_PLL_PROP_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_PROP_CNTRL_MASK ,0x10 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_6 , -PHY_CFG_PLL_VCO_CNTRL_MASK , -FIELD_PREP (PHY_CFG_PLL_VCO_CNTRL_MASK ,0x0 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_6 , +PHY_CFG_PLL_VCO_CNTRL_MASK , +FIELD_PREP (PHY_CFG_PLL_VCO_CNTRL_MASK ,0x0 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_CFG_CTRL_5 , -PHY_CFG_PLL_VREF_TUNE_MASK , -FIELD_PREP (PHY_CFG_PLL_VREF_TUNE_MASK ,0x1 )); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_CFG_CTRL_5 , +PHY_CFG_PLL_VREF_TUNE_MASK , +FIELD_PREP (PHY_CFG_PLL_VREF_TUNE_MASK ,0x1 )); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL2 , -VBUS_DET_EXT_SEL ,VBUS_DET_EXT_SEL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL2 , +VBUS_DET_EXT_SEL ,VBUS_DET_EXT_SEL );/* set default parameters */ qcom_eusb2_default_parameters (phy); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL2 , -USB2_SUSPEND_N_SEL |USB2_SUSPEND_N , -USB2_SUSPEND_N_SEL |USB2_SUSPEND_N ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL2 , +USB2_SUSPEND_N_SEL |USB2_SUSPEND_N , +USB2_SUSPEND_N_SEL |USB2_SUSPEND_N ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_UTMI_CTRL0 ,SLEEPM ,SLEEPM ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_UTMI_CTRL0 ,SLEEPM ,SLEEPM ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -SIDDQ_SEL ,SIDDQ_SEL ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +SIDDQ_SEL ,SIDDQ_SEL ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL_COMMON0 , -SIDDQ ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL_COMMON0 , +SIDDQ ,0 ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_UTMI_CTRL5 ,POR ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_UTMI_CTRL5 ,POR ,0 ); -qcom_snps_eusb2_hsphy_write_mask (phy->base,USB_PHY_HS_PHY_CTRL2 , -USB2_SUSPEND_N_SEL ,0 ); +snps_eusb2_hsphy_write_mask (phy->base,QCOM_USB_PHY_HS_PHY_CTRL2 , +USB2_SUSPEND_N_SEL ,0 );return 0 ;
@@ -344,9 +344,9 @@ static int qcom_snps_eusb2_hsphy_init(struct phy *p)return ret; } -static int qcom_snps_eusb2_hsphy_exit (struct phy *p) +static int snps_eusb2_hsphy_exit (struct phy *p) { -struct qcom_snps_eusb2_hsphy *phy =phy_get_drvdata (p); +struct snps_eusb2_hsphy *phy =phy_get_drvdata (p);clk_disable_unprepare (phy->ref_clk);
@@ -357,18 +357,18 @@ static int qcom_snps_eusb2_hsphy_exit(struct phy *p)return 0 ; } -static const struct phy_ops qcom_snps_eusb2_hsphy_ops = { - .init = qcom_snps_eusb2_hsphy_init, - .exit = qcom_snps_eusb2_hsphy_exit, - .set_mode = qcom_snps_eusb2_hsphy_set_mode, +static const struct phy_ops snps_eusb2_hsphy_ops = { + .init = snps_eusb2_hsphy_init, + .exit = snps_eusb2_hsphy_exit, + .set_mode = snps_eusb2_hsphy_set_mode, .owner =THIS_MODULE , }; -static int qcom_snps_eusb2_hsphy_probe (struct platform_device *pdev) +static int snps_eusb2_hsphy_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;struct device_node *np = dev->of_node; -struct qcom_snps_eusb2_hsphy *phy; +struct snps_eusb2_hsphy *phy;struct phy_provider *phy_provider;struct phy *generic_phy;int ret, i;
@@ -405,7 +405,7 @@ static int qcom_snps_eusb2_hsphy_probe(struct platform_device *pdev)return dev_err_probe (dev,PTR_ERR (phy->repeater),"failed to get repeater\n" ); - generic_phy =devm_phy_create (dev,NULL , &qcom_snps_eusb2_hsphy_ops); + generic_phy =devm_phy_create (dev,NULL , &snps_eusb2_hsphy_ops);if (IS_ERR (generic_phy)) {dev_err (dev,"failed to create phy %d\n" , ret);return PTR_ERR (generic_phy);
@@ -418,25 +418,25 @@ static int qcom_snps_eusb2_hsphy_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"Registered Qcom-eUSB2 phy\n" ); +dev_info (dev,"Registered Snps-eUSB2 phy\n" );return 0 ; } -static const struct of_device_id qcom_snps_eusb2_hsphy_of_match_table[] = { +static const struct of_device_id snps_eusb2_hsphy_of_match_table[] = { { .compatible ="qcom,sm8550-snps-eusb2-phy" , }, { }, }; -MODULE_DEVICE_TABLE (of, qcom_snps_eusb2_hsphy_of_match_table); +MODULE_DEVICE_TABLE (of, snps_eusb2_hsphy_of_match_table); -static struct platform_driver qcom_snps_eusb2_hsphy_driver = { - .probe = qcom_snps_eusb2_hsphy_probe, +static struct platform_driver snps_eusb2_hsphy_driver = { + .probe = snps_eusb2_hsphy_probe, .driver = { - .name ="qcom-snps-eusb2-hsphy" , - .of_match_table = qcom_snps_eusb2_hsphy_of_match_table, + .name ="snps-eusb2-hsphy" , + .of_match_table = snps_eusb2_hsphy_of_match_table, }, }; -module_platform_driver (qcom_snps_eusb2_hsphy_driver); -MODULE_DESCRIPTION ("Qualcomm SNPS eUSB2 HS PHY driver" ); +module_platform_driver (snps_eusb2_hsphy_driver); +MODULE_DESCRIPTION ("Synopsys eUSB2 HS PHY driver" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/254 phy: drop probe registration printks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 95463cbb4fe6489921fb8c72890113dca54ce83f ]
Drivers should generally be quiet on successful probe, but this is not followed by some PHY drivers, for example:
snps-eusb2-hsphy 88e1000.phy: Registered Snps-eUSB2 phy qcom-eusb2-repeater c432000.spmi:pmic@7:phy@fd00: Registered Qcom-eUSB2 repeater qcom-eusb2-repeater c432000.spmi:pmic@a:phy@fd00: Registered Qcom-eUSB2 repeater qcom-eusb2-repeater c432000.spmi:pmic@b:phy@fd00: Registered Qcom-eUSB2 repeater snps-eusb2-hsphy fd3000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy fd9000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy fde000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy 88e0000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy 88e2000.phy: Registered Snps-eUSB2 phy
Drop (or demote to debug level) unnecessary registration info messages to make boot logs a little less noisy.
Stable-dep-of: 1ca52c0983c3 ("phy: qcom-qusb2: Fix NULL pointer dereference on early suspend")
--- drivers/phy/broadcom/phy-bcm-ns2-pcie.c | 2 -- drivers/phy/broadcom/phy-bcm-ns2-usbdrd.c | 1 - drivers/phy/broadcom/phy-bcm-sr-pcie.c | 2 -- drivers/phy/broadcom/phy-brcm-sata.c | 2 +- drivers/phy/marvell/phy-pxa-usb.c | 1 - drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 2 -- drivers/phy/qualcomm/phy-qcom-m31.c | 2 -- drivers/phy/qualcomm/phy-qcom-qusb2.c | 4 +--- drivers/phy/qualcomm/phy-qcom-snps-eusb2.c | 2 -- drivers/phy/st/phy-stih407-usb.c | 2 -- drivers/phy/st/phy-stm32-usbphyc.c | 4 ++-- drivers/phy/ti/phy-twl4030-usb.c | 1 - 12 files changed, 4 insertions(+), 21 deletions(-)
drivers/phy/broadcom/phy-bcm-ns2-pcie.c +0 -2
@@ -61,8 +61,6 @@ static int ns2_pci_phy_probe(struct mdio_device *mdiodev)return PTR_ERR (provider); } -dev_info (dev,"%s PHY registered\n" ,dev_name (dev)); -return 0 ; }
drivers/phy/broadcom/phy-bcm-ns2-usbdrd.c +0 -1
@@ -395,7 +395,6 @@ static int ns2_drd_phy_probe(struct platform_device *pdev)platform_set_drvdata (pdev, driver); -dev_info (dev,"Registered NS2 DRD Phy device\n" );queue_delayed_work (system_power_efficient_wq, &driver->wq_extcon, driver->debounce_jiffies);
drivers/phy/broadcom/phy-bcm-sr-pcie.c +0 -2
@@ -277,8 +277,6 @@ static int sr_pcie_phy_probe(struct platform_device *pdev)return PTR_ERR (provider); } -dev_info (dev,"Stingray PCIe PHY driver initialized\n" ); -return 0 ; }
drivers/phy/broadcom/phy-brcm-sata.c +1 -1
@@ -836,7 +836,7 @@ static int brcm_sata_phy_probe(struct platform_device *pdev)return PTR_ERR (provider); } -dev_info (dev,"registered %d port(s)\n" , count); +dev_dbg (dev,"registered %d port(s)\n" , count);return 0 ; put_child:
drivers/phy/marvell/phy-pxa-usb.c +0 -1
@@ -325,7 +325,6 @@ static int pxa_usb_phy_probe(struct platform_device *pdev)phy_create_lookup (pxa_usb_phy->phy,"usb" ,"mv-otg" ); } -dev_info (dev,"Marvell PXA USB PHY" );return 0 ; }
drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c +0 -2
@@ -251,8 +251,6 @@ static int eusb2_repeater_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"Registered Qcom-eUSB2 repeater\n" ); -return 0 ; }
drivers/phy/qualcomm/phy-qcom-m31.c +0 -2
@@ -267,8 +267,6 @@ static int m31usb_phy_probe(struct platform_device *pdev)phy_set_drvdata (qphy->phy, qphy); phy_provider =devm_of_phy_provider_register (dev, of_phy_simple_xlate); -if (!IS_ERR (phy_provider)) -dev_info (dev,"Registered M31 USB phy\n" );return PTR_ERR_OR_ZERO (phy_provider); }
drivers/phy/qualcomm/phy-qcom-qusb2.c +1 -3
@@ -1084,9 +1084,7 @@ static int qusb2_phy_probe(struct platform_device *pdev)phy_set_drvdata (generic_phy, qphy); phy_provider =devm_of_phy_provider_register (dev, of_phy_simple_xlate); -if (!IS_ERR (phy_provider)) -dev_info (dev,"Registered Qcom-QUSB2 phy\n" ); -else +if (IS_ERR (phy_provider))pm_runtime_disable (dev);return PTR_ERR_OR_ZERO (phy_provider);
drivers/phy/qualcomm/phy-qcom-snps-eusb2.c +0 -2
@@ -418,8 +418,6 @@ static int snps_eusb2_hsphy_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"Registered Snps-eUSB2 phy\n" ); -return 0 ; }
drivers/phy/st/phy-stih407-usb.c +0 -2
@@ -149,8 +149,6 @@ static int stih407_usb2_picophy_probe(struct platform_device *pdev)if (IS_ERR (phy_provider))return PTR_ERR (phy_provider); -dev_info (dev,"STiH407 USB Generic picoPHY driver probed!" ); -return 0 ; }
drivers/phy/st/phy-stm32-usbphyc.c +2 -2
@@ -757,8 +757,8 @@ static int stm32_usbphyc_probe(struct platform_device *pdev) } version =readl_relaxed (usbphyc->base +STM32_USBPHYC_VERSION ); -dev_info (dev,"registered rev:%lu.%lu\n" , -FIELD_GET (MAJREV , version),FIELD_GET (MINREV , version)); +dev_dbg (dev,"registered rev: %lu.%lu\n" , +FIELD_GET (MAJREV , version),FIELD_GET (MINREV , version));return 0 ;
drivers/phy/ti/phy-twl4030-usb.c +0 -1
@@ -784,7 +784,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)pm_runtime_mark_last_busy (&pdev->dev);pm_runtime_put_autosuspend (twl->dev); -dev_info (&pdev->dev,"Initialized TWL4030 USB module\n" );return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/254 phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 1ca52c0983c34fca506921791202ed5bdafd5306 ]
Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereference in runtime PM callbacks that expect valid driver data. There is a small window where the suspend callback may run after PM runtime enabling and before runtime forbid. This causes a sporadic crash during boot:
``` Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1 [...] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT Workqueue: pm pm_runtime_work pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2] lr : pm_generic_runtime_suspend+0x2c/0x44 [...] ```
Attach the QPHY instance as driver data before enabling runtime PM to prevent NULL pointer dereference in runtime PM callbacks.
Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a short window where an unnecessary runtime suspend can occur.
Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup.
--- drivers/phy/qualcomm/phy-qcom-qusb2.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/phy/qualcomm/phy-qcom-qusb2.c +8 -8
@@ -1063,29 +1063,29 @@ static int qusb2_phy_probe(struct platform_device *pdev) or->hsdisc_trim.override = true; } -pm_runtime_set_active (dev); -pm_runtime_enable (dev); +dev_set_drvdata (dev, qphy); +/* -* Prevent runtime pm from being ON by default. Users can enable -* it using power/control in sysfs. +* Enable runtime PM support, but forbid it by default. +* Users can allow it again via the power/control attribute in sysfs. */ +pm_runtime_set_active (dev);pm_runtime_forbid (dev); + ret =devm_pm_runtime_enable (dev); +if (ret) +return ret; generic_phy =devm_phy_create (dev,NULL , &qusb2_phy_gen_ops);if (IS_ERR (generic_phy)) { ret =PTR_ERR (generic_phy);dev_err (dev,"failed to create phy, %d\n" , ret); -pm_runtime_disable (dev);return ret; } qphy->phy = generic_phy; -dev_set_drvdata (dev, qphy);phy_set_drvdata (generic_phy, qphy); phy_provider =devm_of_phy_provider_register (dev, of_phy_simple_xlate); -if (IS_ERR (phy_provider)) -pm_runtime_disable (dev);return PTR_ERR_OR_ZERO (phy_provider); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/254 phy: stm32-usphyc: Fix off by one in probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit cabd25b57216ddc132efbcc31f972baa03aad15a ]
The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.
--- drivers/phy/st/phy-stm32-usbphyc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/st/phy-stm32-usbphyc.c +1 -1
@@ -712,7 +712,7 @@ static int stm32_usbphyc_probe(struct platform_device *pdev) } ret =of_property_read_u32 (child,"reg" , &index); -if (ret || index > usbphyc->nphys) { +if (ret || index >= usbphyc->nphys) {dev_err (&phy->dev,"invalid reg property: %d\n" , ret);if (!ret) ret = -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/254 phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fb21116099bbea1fc59efa9207e63c4be390ab72 ]
"family" is an enum, thus cast of pointer on 64-bit compile test with clang W=1 causes:
phy-bcm-ns-usb3.c:206:17: error: cast to smaller integer type 'enum bcm_ns_family' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
This was already fixed in commit bd6e74a2f0a0 ("phy: broadcom: ns-usb3:
fix Wvoid-pointer-to-enum-cast warning") but then got bad in commit 21bf6fc47a1e ("phy: Use device_get_match_data()").
Note that after various discussions the preferred cast is via "unsigned long", not "uintptr_t".
--- drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/broadcom/phy-bcm-ns-usb3.c +1 -1
@@ -203,7 +203,7 @@ static int bcm_ns_usb3_mdio_probe(struct mdio_device *mdiodev) usb3->dev = dev; usb3->mdiodev = mdiodev; - usb3->family = (enum bcm_ns_family )device_get_match_data (dev); + usb3->family = (unsigned long )device_get_match_data (dev); syscon_np =of_parse_phandle (dev->of_node,"usb3-dmp-syscon" ,0 ); err =of_address_to_resource (syscon_np,0 , &res);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/254 dmaengine: omap-dma: fix dma_pool resource leak in error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 2e1136acf8a8887c29f52e35a77b537309af321f ]
The dma_pool created by dma_pool_create() is not destroyed when dma_async_device_register() or of_dma_controller_register() fails, causing a resource leak in the probe error paths.
Add dma_pool_destroy() in both error paths to properly release the allocated dma_pool resource.
--- drivers/dma/ti/omap-dma.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/ti/omap-dma.c +4 -0
@@ -1809,6 +1809,8 @@ static int omap_dma_probe(struct platform_device *pdev)if (rc) {pr_warn ("OMAP-DMA: failed to register slave DMA engine device: %d\n" , rc); +if (od->ll123_supported) +dma_pool_destroy (od->desc_pool);omap_dma_free (od);return rc; }
@@ -1824,6 +1826,8 @@ static int omap_dma_probe(struct platform_device *pdev)if (rc) {pr_warn ("OMAP-DMA: failed to register DMA controller\n" );dma_async_device_unregister (&od->ddev); +if (od->ll123_supported) +dma_pool_destroy (od->desc_pool);omap_dma_free (od); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/254 i2c: qcom-geni: make sure I2C hub controllers cant use SE DMA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit c0c50e3743e467ec4752c638e10e97f89c8644e2 ]
The I2C Hub controller is a simpler GENI I2C variant that doesn't support DMA at all, add a no_dma flag to make sure it nevers selects the SE DMA mode with mappable 32bytes long transfers.
--- drivers/i2c/busses/i2c-qcom-geni.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-qcom-geni.c +7 -4
@@ -97,6 +97,7 @@ struct geni_i2c_dev {dma_addr_t dma_addr;struct dma_chan *tx_c;struct dma_chan *rx_c; +bool no_dma;bool gpi_mode;bool abort_done; };
@@ -411,7 +412,7 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,size_t len = msg->len;struct i2c_msg *cur; - dma_buf =i2c_get_dma_safe_msg_buf (msg,32 ); + dma_buf = gi2c->no_dma ?NULL :i2c_get_dma_safe_msg_buf (msg,32 );if (dma_buf)geni_se_select_mode (se,GENI_SE_DMA );else
@@ -450,7 +451,7 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,size_t len = msg->len;struct i2c_msg *cur; - dma_buf =i2c_get_dma_safe_msg_buf (msg,32 ); + dma_buf = gi2c->no_dma ?NULL :i2c_get_dma_safe_msg_buf (msg,32 );if (dma_buf)geni_se_select_mode (se,GENI_SE_DMA );else
@@ -866,10 +867,12 @@ static int geni_i2c_probe(struct platform_device *pdev)return -ENXIO ; } -if (desc && desc->no_dma_support) +if (desc && desc->no_dma_support) { fifo_disable = false; -else + gi2c->no_dma = true; + }else { fifo_disable =readl_relaxed (gi2c->se.base +GENI_IF_DISABLE_RO ) &FIFO_IF_DISABLE ; + }if (fifo_disable) {/* FIFO is disabled, so we can only use GPI DMA */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/254 HID: usbhid: paper over wrong bNumDescriptor field
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit f28beb69c51517aec7067dfb2074e7c751542384 upstream.
Some faulty devices (ZWO EFWmini) have a wrong optional HID class descriptor count compared to the provided length.
Given that we plainly ignore those optional descriptor, we can attempt to fix the provided number so we do not lock out those devices.
--- drivers/hid/usbhid/hid-core.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/hid/usbhid/hid-core.c +16 -1
@@ -983,6 +983,7 @@ static int usbhid_parse(struct hid_devicstruct usb_device *dev =interface_to_usbdev (intf);struct hid_descriptor *hdesc;struct hid_class_descriptor *hcdesc; +__u8 fixed_opt_descriptors_size;u32 quirks =0 ;unsigned int rsize =0 ;char *rdesc;
@@ -1013,7 +1014,21 @@ static int usbhid_parse(struct hid_devic (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) {dbg_hid ("hid descriptor invalid, bLen=%hhu bNum=%hhu\n" , hdesc->bLength, hdesc->bNumDescriptors); -return -EINVAL ; + +/* +* Some devices may expose a wrong number of descriptors compared +* to the provided length. +* However, we ignore the optional hid class descriptors entirely +* so we can safely recompute the proper field. +*/ +if (hdesc->bLength >=sizeof (*hdesc)) { + fixed_opt_descriptors_size = hdesc->bLength -sizeof (*hdesc); + +hid_warn (intf,"fixing wrong optional hid class descriptors count\n" ); + hdesc->bNumDescriptors = fixed_opt_descriptors_size /sizeof (*hcdesc) +1 ; + }else { +return -EINVAL ; + } } hid->version =le16_to_cpu (hdesc->bcdHID);
Greg Kroah-Hartman
maintainerPATCH 44/254 drm/amd/display: Check dce_hwseq before dereferencing it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
commit b669507b637eb6b1aaecf347f193efccc65d756e upstream.
[WHAT]
hws was checked for null earlier in dce110_blank_stream, indicating hws can be null, and should be checked whenever it is used.
--- drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +1 -1
@@ -1228,7 +1228,7 @@ void dce110_blank_stream(struct pipe_ctxstruct dce_hwseq *hws = link->dc->hwseq;if (link->local_sink && link->local_sink->sink_signal ==SIGNAL_TYPE_EDP ) { -if (!link->skip_implict_edp_power_control) +if (!link->skip_implict_edp_power_control && hws) hws->funcs.edp_backlight_control (link, false); link->dc->hwss.set_abm_immediate_disable (pipe_ctx); }
Greg Kroah-Hartman
maintainerPATCH 45/254 scsi: core: Fix error handler encryption support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Kao <[email protected]>
commit 9a49157deeb23581fc5c8189b486340d7343264a upstream.
Some low-level drivers (LLD) access block layer crypto fields, such as rq->crypt_keyslot and rq->crypt_ctx within struct request, to configure hardware for inline encryption. However, SCSI Error Handling (EH) commands (e.g., TEST UNIT READY, START STOP UNIT) should not involve any encryption setup.
To prevent drivers from erroneously applying crypto settings during EH, this patch saves the original values of rq->crypt_keyslot and rq->crypt_ctx before an EH command is prepared via scsi_eh_prep_cmnd(). These fields in the 'struct request' are then set to NULL. The original values are restored in scsi_eh_restore_cmnd() after the EH command completes.
This ensures that the block layer crypto context does not leak into EH command execution.
--- drivers/scsi/scsi_error.c | 24 ++++++++++++++++++++++++ include/scsi/scsi_eh.h | 6 ++++++ 2 files changed, 30 insertions(+)
drivers/scsi/scsi_error.c +24 -0
@@ -1039,6 +1039,9 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd unsigned char *cmnd, int cmnd_size, unsigned sense_bytes) { struct scsi_device *sdev = scmd->device; +#ifdef CONFIG_BLK_INLINE_ENCRYPTION +struct request *rq =scsi_cmd_to_rq (scmd); +#endif /* * We need saved copies of a number of fields - this is because
@@ -1091,6 +1094,18 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd (sdev->lun <<5 &0xe0 );/* +* Encryption must be disabled for the commands submitted by the error handler. +* Hence, clear the encryption context information. +*/ +#ifdef CONFIG_BLK_INLINE_ENCRYPTION + ses->rq_crypt_keyslot = rq->crypt_keyslot; + ses->rq_crypt_ctx = rq->crypt_ctx; + + rq->crypt_keyslot =NULL ; + rq->crypt_ctx =NULL ; +#endif + +/* * Zero the sense buffer. The scsi spec mandates that any * untransferred sense data should be interpreted as being zero. */
@@ -1107,6 +1122,10 @@ EXPORT_SYMBOL(scsi_eh_prep_cmnd);*/ void scsi_eh_restore_cmnd (struct scsi_cmnd * scmd,struct scsi_eh_save *ses) { +#ifdef CONFIG_BLK_INLINE_ENCRYPTION +struct request *rq =scsi_cmd_to_rq (scmd); +#endif +/* * Restore original data */
@@ -1119,6 +1138,11 @@ void scsi_eh_restore_cmnd(struct scsi_cm scmd->underflow = ses->underflow; scmd->prot_op = ses->prot_op; scmd->eh_eflags = ses->eh_eflags; + +#ifdef CONFIG_BLK_INLINE_ENCRYPTION + rq->crypt_keyslot = ses->rq_crypt_keyslot; + rq->crypt_ctx = ses->rq_crypt_ctx; +#endif }EXPORT_SYMBOL (scsi_eh_restore_cmnd);
include/scsi/scsi_eh.h +6 -0
@@ -41,6 +41,12 @@ struct scsi_eh_save {unsigned char cmnd[32 ];struct scsi_data_buffer sdb;struct scatterlist sense_sgl; + +/* struct request fields */ +#ifdef CONFIG_BLK_INLINE_ENCRYPTION +struct bio_crypt_ctx *rq_crypt_ctx; +struct blk_crypto_keyslot *rq_crypt_keyslot; +#endif }; extern void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd,
Greg Kroah-Hartman
maintainerPATCH 46/254 ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <[email protected]>
commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 upstream.
Handle the error code from snd_pcm_buffer_access_lock() in snd_pcm_runtime_buffer_set_silence() function.
Found by Alexandros Panagiotou <[email protected]>
--- include/sound/pcm.h | 2 +- sound/core/oss/pcm_oss.c | 4 +++- sound/core/pcm_native.c | 9 +++++++-- 3 files changed, 11 insertions(+), 4 deletions(-)
include/sound/pcm.h +1 -1
@@ -1427,7 +1427,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc#define snd_pcm_lib_mmap_iomem NULL#endif -void snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime); +int snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime);/** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
sound/core/oss/pcm_oss.c +3 -1
@@ -1085,7 +1085,9 @@ static int snd_pcm_oss_change_params_loc runtime->oss.params =0 ; runtime->oss.prepare =1 ; runtime->oss.buffer_used =0 ; -snd_pcm_runtime_buffer_set_silence (runtime); + err =snd_pcm_runtime_buffer_set_silence (runtime); +if (err <0 ) + goto failure; runtime->oss.period_frames =snd_pcm_alsa_frames (substream, oss_period_size);
sound/core/pcm_native.c +7 -2
@@ -705,13 +705,18 @@ static void snd_pcm_buffer_access_unlock }/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ -void snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime) +int snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime) { -snd_pcm_buffer_access_lock (runtime); +int err; + + err =snd_pcm_buffer_access_lock (runtime); +if (err <0 ) +return err;if (runtime->dma_area)snd_pcm_format_set_silence (runtime->format, runtime->dma_area,bytes_to_samples (runtime, runtime->dma_bytes));snd_pcm_buffer_access_unlock (runtime); +return 0 ; }EXPORT_SYMBOL_GPL (snd_pcm_runtime_buffer_set_silence);
Greg Kroah-Hartman
maintainerPATCH 47/254 null_blk: fix kmemleak by releasing references to fault configfs items
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
commit 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5 upstream.
When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk driver sets up fault injection support by creating the timeout_inject, requeue_inject, and init_hctx_fault_inject configfs items as children of the top-level nullbX configfs group.
However, when the nullbX device is removed, the references taken to these fault-config configfs items are not released. As a result, kmemleak reports a memory leak, for example:
unreferenced object 0xc00000021ff25c40 (size 32):
comm "mkdir", pid 10665, jiffies 4322121578
hex dump (first 32 bytes):
69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f init_hctx_fault_
69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject..........
backtrace (crc 1a018c86):
__kmalloc_node_track_caller_noprof+0x494/0xbd8
kvasprintf+0x74/0xf4
config_item_set_name+0xf0/0x104
config_group_init_type_name+0x48/0xfc
fault_config_init+0x48/0xf0
0xc0080000180559e4
configfs_mkdir+0x304/0x814
vfs_mkdir+0x49c/0x604
do_mkdirat+0x314/0x3d0
sys_mkdir+0xa0/0xd8
system_call_exception+0x1b0/0x4f0
system_call_vectored_common+0x15c/0x2ecFix this by explicitly releasing the references to the fault-config configfs items when dropping the reference to the top-level nullbX configfs group.
--- drivers/block/null_blk/main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/block/null_blk/main.c +11 -1
@@ -622,12 +622,22 @@ static void nullb_add_fault_config(strucconfigfs_add_default_group (&dev->init_hctx_fault_config.group, &dev->group); } +static void nullb_del_fault_config (struct nullb_device *dev) +{ +config_item_put (&dev->init_hctx_fault_config.group.cg_item); +config_item_put (&dev->requeue_config.group.cg_item); +config_item_put (&dev->timeout_config.group.cg_item); +} +#else static void nullb_add_fault_config (struct nullb_device *dev) { } +static void nullb_del_fault_config (struct nullb_device *dev) +{ +}#endif static struct
@@ -659,7 +669,7 @@ nullb_group_drop_item(struct config_grounull_del_dev (dev->nullb);mutex_unlock (&lock); } - +nullb_del_fault_config (dev);config_item_put (item); }
Greg Kroah-Hartman
maintainerPATCH 48/254 can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 7352e1d5932a0e777e39fa4b619801191f57e603 upstream.
In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close().
Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.
--- drivers/net/can/usb/gs_usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/can/usb/gs_usb.c +2 -0
@@ -748,6 +748,8 @@ resubmit_urb: hf, parent->hf_size_rx, gs_usb_receive_bulk_callback, parent); +usb_anchor_urb (urb, &parent->rx_submitted); + rc =usb_submit_urb (urb,GFP_ATOMIC );/* USB failure take down all interfaces */
Greg Kroah-Hartman
maintainerPATCH 49/254 can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Ille <[email protected]>
commit e707c591a139d1bfa4ddc83036fc820ca006a140 upstream.
The Secondary Sample Point Source field has been set to an incorrect value by some mistake in the past
0b01 - SSP_SRC_NO_SSP - SSP is not used.
for data bitrates above 1 MBit/s. The correct/default value already used for lower bitrates is
0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY
(Measured Transmitter delay) + SSP_OFFSET.
The related configuration register structure is described in section 3.1.46 SSP_CFG of the CTU CAN FD
IP CORE Datasheet.
The analysis leading to the proper configuration is described in section 2.8.3 Secondary sampling point of the datasheet.
The change has been tested on AMD/Xilinx Zynq with the next CTU CN FD IP core versions:
- 2.6 aka master in the "integration with Zynq-7000 system" test 6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git driver (change already included in the driver repo)
- older 2.5 snapshot with mainline kernels with this patch applied locally in the multiple CAN latency tester nightly runs 6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT
6.19.0-rc3-dut
The logs, the datasheet and sources are available at
https://canbus.pages.fel.cvut.cz/
--- drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/ctucanfd/ctucanfd_base.c +1 -1
@@ -310,7 +310,7 @@ static int ctucan_set_secondary_sample_p } ssp_cfg =FIELD_PREP (REG_TRV_DELAY_SSP_OFFSET , ssp_offset); - ssp_cfg |=FIELD_PREP (REG_TRV_DELAY_SSP_SRC ,0x1 ); + ssp_cfg |=FIELD_PREP (REG_TRV_DELAY_SSP_SRC ,0x0 ); }ctucan_write32 (priv,CTUCANFD_TRV_DELAY , ssp_cfg);
Greg Kroah-Hartman
maintainerPATCH 50/254 net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 1809c82aa073a11b7d335ae932d81ce51a588a4a upstream.
Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when the timer is enabled, we need to call j1939_session_deactivate_activate_next() if we cancelled the timer. Otherwise, refcount for j1939_session leaks, which will later appear as
| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.
problem.
--- net/can/j1939/transport.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/can/j1939/transport.c +9 -1
@@ -1699,8 +1699,16 @@ static int j1939_xtp_rx_rts_session_actij1939_session_timers_cancel (session);j1939_session_cancel (session,J1939_XTP_ABORT_BUSY ); -if (session->transmission) +if (session->transmission) {j1939_session_deactivate_activate_next (session); + }else if (session->state ==J1939_SESSION_WAITING_ABORT ) { +/* Force deactivation for the receiver. +* If we rely on the timer starting in j1939_session_cancel, +* a second RTS call here will cancel that timer and fail +* to restart it because the state is already WAITING_ABORT. +*/ +j1939_session_deactivate_activate_next (session); + }return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 51/254 x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 upstream.
Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems") is too narrow. The effect being mitigated in that commit is caused by ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general, lets any physical address be added to the direct-map. I.e. not only ACPI hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases.
Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of this problem is limited to the PCI_P2PDMA=n case.
A potential path to recover entropy would be to walk ACPI and determine the limits for hotplug and PCI MMIO before kernel_randomize_memory(). On smaller systems that could yield some KASLR address bits. This needs additional investigation to determine if some limited ACPI table scanning can happen this early without an open coded solution like arch/x86/boot/compressed/acpi.c needs to deploy.
--- arch/x86/mm/kaslr.c | 10 +++++----- drivers/pci/Kconfig | 6 ------ mm/Kconfig | 10 +++++++--- 3 files changed, 12 insertions(+), 14 deletions(-)
arch/x86/mm/kaslr.c +5 -5
@@ -111,12 +111,12 @@ void __init kernel_randomize_memory(void/* * Adapt physical memory region size based on available memory, -* except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the -* device BAR space assuming the direct map space is large enough -* for creating a ZONE_DEVICE mapping in the direct map corresponding -* to the physical BAR address. +* except when CONFIG_ZONE_DEVICE is enabled. ZONE_DEVICE wants to map +* any physical address into the direct-map. KASLR wants to reliably +* steal some physical address bits. Those design choices are in direct +* conflict. */ -if (!IS_ENABLED (CONFIG_PCI_P2PDMA ) && (memory_tb < kaslr_regions[0 ].size_tb)) +if (!IS_ENABLED (CONFIG_ZONE_DEVICE ) && (memory_tb < kaslr_regions[0 ].size_tb)) kaslr_regions[0 ].size_tb = memory_tb;/*
drivers/pci/Kconfig +0 -6
@@ -180,12 +180,6 @@ config PCI_P2PDMA P2P DMA transactions must be between devices behind the same root port. - Enabling this option will reduce the entropy of x86 KASLR memory - regions. For example - on a 46 bit system, the entropy goes down - from 16 bits to 15 bits. The actual reduction in entropy depends - on the physical address bits, on processor features, kernel config - (5 level page table) and physical memory present on the system. - If unsure, say N. config PCI_LABEL
mm/Kconfig +7 -3
@@ -1067,10 +1067,14 @@ config ZONE_DEVICE Device memory hotplug support allows for establishing pmem, or other device driver discovered memory regions, in the memmap. This allows pfn_to_page() lookups of otherwise - "device-physical" addresses which is needed for using a DAX - mapping in an O_DIRECT operation, among other things. + "device-physical" addresses which is needed for DAX, PCI_P2PDMA, and + DEVICE_PRIVATE features among others. - If FS_DAX is enabled, then say Y. + Enabling this option will reduce the entropy of x86 KASLR memory + regions. For example - on a 46 bit system, the entropy goes down + from 16 bits to 15 bits. The actual reduction in entropy depends + on the physical address bits, on processor features, kernel config + (5 level page table) and physical memory present on the system. # # Helpers to mirror range of the CPU page tables of a process into device page
Greg Kroah-Hartman
maintainerPATCH 52/254 phy: rockchip: inno-usb2: fix communication disruption in gadget mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
commit 7d8f725b79e35fa47e42c88716aad8711e1168d8 upstream.
When the OTG USB port is used to power to SoC, configured as peripheral and used in gadget mode, communication stops without notice about 6 seconds after the gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs.
The related code flow in the PHY driver code can be summarized as:
* the first time chg_detect_work starts (6 seconds after gadget is configured and enumerated)
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y]
* rockchip_chg_detect_work() changes state and re-triggers itself a few times until it reaches the DETECTED state:
-> rockchip_chg_detect_work():
if chg_state is DETECTED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z]
At [Y] all existing communications stop. E.g. using a CDC serial gadget, the /dev/tty* devices are still present on both host and device, but no data is transferred anymore. The later call with a 'true' argument at [Z] does not restore it.
Due to the lack of documentation, what chg_det.opmode does exactly is not clear, however by code inspection it seems reasonable that is disables something needed to keep the communication working, and testing proves that disabling these lines lets gadget mode keep working. So prevent changes to chg_det.opmode when there is a cable connected (VBUS present).
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +4 -2
@@ -799,7 +799,8 @@ static void rockchip_chg_detect_work(strif (!rport->suspended)rockchip_usb2phy_power_off (rport->phy);/* put the controller in non-driving mode */ -property_enable (base, &rphy->phy_cfg->chg_det.opmode, false); +if (!vbus_attach) +property_enable (base, &rphy->phy_cfg->chg_det.opmode, false);/* Start DCD processing stage 1 */ rockchip_chg_enable_dcd (rphy, true); rphy->chg_state =USB_CHG_STATE_WAIT_FOR_DCD ;
@@ -862,7 +863,8 @@ static void rockchip_chg_detect_work(str fallthrough;case USB_CHG_STATE_DETECTED :/* put the controller in normal mode */ -property_enable (base, &rphy->phy_cfg->chg_det.opmode, true); +if (!vbus_attach) +property_enable (base, &rphy->phy_cfg->chg_det.opmode, true);rockchip_usb2phy_otg_sm_work (&rport->otg_sm_work.work);dev_dbg (&rport->phy->dev,"charger = %s\n" ,chg_to_string (rphy->chg_type));
Greg Kroah-Hartman
maintainerPATCH 53/254 phy: freescale: imx8m-pcie: assert phy reset during power on
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Beims <[email protected]>
commit f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 upstream.
After U-Boot initializes PCIe with "pcie enum", Linux fails to detect an NVMe disk on some boot cycles with:
phy phy-32f00000.pcie-phy.0: phy poweron failed --> -110
Discussion with NXP identified that the iMX8MP PCIe PHY PLL may fail to lock when re-initialized without a reset cycle [1].
The issue reproduces on 7% of tested hardware platforms, with a 30-40% failure rate per affected device across boot cycles.
Insert a reset cycle in the power-on routine to ensure the PHY is initialized from a known state.
--- drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/phy/freescale/phy-fsl-imx8m-pcie.c +2 -1
@@ -89,7 +89,8 @@ static int imx8_pcie_phy_power_on(structwritel (imx8_phy->tx_deemph_gen2, imx8_phy->base +PCIE_PHY_TRSV_REG6 );break ; -case IMX8MP :/* Do nothing. */ +case IMX8MP : +reset_control_assert (imx8_phy->reset);break ; }
Greg Kroah-Hartman
maintainerPATCH 54/254 phy: rockchip: inno-usb2: fix disconnection in gadget mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Chauvet <[email protected]>
commit 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc upstream.
When the OTG USB port is used to power the SoC, configured as peripheral and used in gadget mode, there is a disconnection about 6 seconds after the gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs.
The problem happens because of the PHY driver code flow, summarized as:
* UDC start code (triggered via configfs at any time after boot) -> phy_init
-> rockchip_usb2phy_init
-> schedule_delayed_work(otg_sm_work [A], 6 sec)
-> phy_power_on
-> rockchip_usb2phy_power_on
-> enable clock
-> rockchip_usb2phy_reset* Now the gadget interface is up and running.
* 6 seconds later otg_sm_work starts [A]
-> rockchip_usb2phy_otg_sm_work():
if (B_IDLE state && VBUS present && ...):
schedule_delayed_work(&rport->chg_work [B], 0); * immediately the chg_detect_work starts [B]
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
if (!rport->suspended):
rockchip_usb2phy_power_off() <--- [X]At [X], the PHY is powered off, causing a disconnection. This quickly triggers a new connection and following re-enumeration, but any connection that had been established during the 6 seconds is broken.
The code already checks for !rport->suspended (which, somewhat counter-intuitively, means the PHY is powered on), so add a guard for VBUS as well to avoid a disconnection when a cable is connected.
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +4 -2
@@ -789,14 +789,16 @@ static void rockchip_chg_detect_work(str container_of(work, struct rockchip_usb2phy_port, chg_work.work);struct rockchip_usb2phy *rphy =dev_get_drvdata (rport->phy->dev.parent);struct regmap *base =get_reg_base (rphy); -bool is_dcd, tmout, vout; +bool is_dcd, tmout, vout, vbus_attach;unsigned long delay; + vbus_attach =property_enabled (rphy->grf, &rport->port_cfg->utmi_bvalid); +dev_dbg (&rport->phy->dev,"chg detection work state = %d\n" , rphy->chg_state);switch (rphy->chg_state) {case USB_CHG_STATE_UNDEFINED : -if (!rport->suspended) +if (!rport->suspended && !vbus_attach)rockchip_usb2phy_power_off (rport->phy);/* put the controller in non-driving mode */ if (!vbus_attach)
Greg Kroah-Hartman
maintainerPATCH 55/254 phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit b246caa68037aa495390a60d080acaeb84f45fff upstream.
The USB2 Bias Pad Control register manages analog parameters for signal detection. Previously, the HS_DISCON_LEVEL relied on hardware reset values, which may lead to the detection failure.
Explicitly configure HS_DISCON_LEVEL to 0x7. This ensures the disconnect threshold is sufficient to guarantee reliable detection.
--- drivers/phy/tegra/xusb-tegra186.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/phy/tegra/xusb-tegra186.c +3 -0
@@ -84,6 +84,7 @@#define XUSB_PADCTL_USB2_BIAS_PAD_CTL0 0x284#define BIAS_PAD_PD BIT(11)#define HS_SQUELCH_LEVEL (x) (((x) & 0x7) << 0) +#define HS_DISCON_LEVEL (x) (((x) & 0x7) << 3)#define XUSB_PADCTL_USB2_BIAS_PAD_CTL1 0x288#define USB2_TRK_START_TIMER (x) (((x) & 0x7f) << 12)
@@ -623,6 +624,8 @@ static void tegra186_utmi_bias_pad_power value &= ~BIAS_PAD_PD ; value &= ~HS_SQUELCH_LEVEL (~0 ); value |=HS_SQUELCH_LEVEL (priv->calib.hs_squelch); + value &= ~HS_DISCON_LEVEL (~0 ); + value |=HS_DISCON_LEVEL (0x7 );padctl_writel (padctl, value,XUSB_PADCTL_USB2_BIAS_PAD_CTL0 );udelay (1 );
Greg Kroah-Hartman
maintainerPATCH 56/254 usb: dwc3: Check for USB4 IP_NAME
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit 0ed91d47959cb7573c17e06487f0fb891d59dfb3 upstream.
Synopsys renamed DWC_usb32 IP to DWC_usb4 as of IP version 1.30. No functional change except checking for the IP_NAME here. The driver will treat the new IP_NAME as if it's DWC_usb32. Additional features for USB4 will be introduced and checked separately.
--- drivers/usb/dwc3/core.c | 2 ++ drivers/usb/dwc3/core.h | 1 + 2 files changed, 3 insertions(+)
drivers/usb/dwc3/core.c +2 -0
@@ -892,6 +892,8 @@ static bool dwc3_core_is_valid(struct dw reg =dwc3_readl (dwc->regs,DWC3_GSNPSID ); dwc->ip =DWC3_GSNPS_ID (reg); +if (dwc->ip ==DWC4_IP ) + dwc->ip =DWC32_IP ;/* This should read as U3 followed by revision number */ if (DWC3_IP_IS (DWC3 )) {
drivers/usb/dwc3/core.h +1 -0
@@ -1221,6 +1221,7 @@ struct dwc3 {#define DWC3_IP 0x5533#define DWC31_IP 0x3331#define DWC32_IP 0x3332 +#define DWC4_IP 0x3430u32 revision;
Greg Kroah-Hartman
maintainerPATCH 57/254 usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Brüderl <[email protected]>
commit 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd upstream.
Add USB_QUIRK_NO_BOS quirk flag to skip requesting the BOS descriptor for devices that cannot handle it.
Add Elgato 4K X (0fd9:009b) to the quirk table. This device hangs when the BOS descriptor is requested at SuperSpeed Plus (10Gbps).
--- drivers/usb/core/config.c | 5 +++++ drivers/usb/core/quirks.c | 3 +++ include/linux/usb/quirks.h | 3 +++ 3 files changed, 11 insertions(+)
drivers/usb/core/config.c +5 -0
@@ -1004,6 +1004,11 @@ int usb_get_bos_descriptor(struct usb_de__u8 cap_type;int ret; +if (dev->quirks &USB_QUIRK_NO_BOS ) { +dev_dbg (ddev,"skipping BOS descriptor\n" ); +return -ENOMSG ; + } + bos =kzalloc (sizeof (*bos),GFP_KERNEL );if (!bos)return -ENOMEM ;
drivers/usb/core/quirks.c +3 -0
@@ -447,6 +447,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0c45, 0x7056), .driver_info = USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* Elgato 4K X - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x0fd9, 0x009b), .driver_info = USB_QUIRK_NO_BOS }, + /* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */ { USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM },
include/linux/usb/quirks.h +3 -0
@@ -75,4 +75,7 @@/* short SET_ADDRESS request timeout */ #define USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT BIT(16) +/* skip BOS descriptor request */ +#define USB_QUIRK_NO_BOS BIT(17) +#endif /* __LINUX_USB_QUIRKS_H */
Greg Kroah-Hartman
maintainerPATCH 58/254 USB: OHCI/UHCI: Add soft dependencies on ehci_platform
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 01ef7f1b8713a78ab1a9512cf8096d2474c70633 upstream.
Commit 9beeee6584b9aa4f ("USB: EHCI: log a warning if ehci-hcd is not loaded first") said that ehci-hcd should be loaded before ohci-hcd and uhci-hcd. However, commit 05c92da0c52494ca ("usb: ohci/uhci - add soft dependencies on ehci_pci") only makes ohci-pci/uhci-pci depend on ehci- pci, which is not enough and we may still see the warnings in boot log.
To eliminate the warnings we should make ohci-hcd/uhci-hcd depend on ehci-hcd. But Alan said that the warning introduced by 9beeee6584b9aa4f is bogus, we only need the soft dependencies in the PCI level rather than the HCD level.
However, there is really another neccessary soft dependencies between ohci-platform/uhci-platform and ehci-platform, which is added by this patch. The boot logs are below.
1. ohci-platform loaded before ehci-platform:
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 1
ohci-platform 1f058000.usb: irq 28, io mem 0x1f058000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after
usb 1-4: new low-speed USB device number 2 using ohci-platform
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 2
ehci-platform 1f050000.usb: irq 29, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
usb 1-4: device descriptor read/all, error -62
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 1-4: new low-speed USB device number 3 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb1/1-4/1-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
2. ehci-platform loaded before ohci-platform:
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 1
ehci-platform 1f050000.usb: irq 28, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 2
ohci-platform 1f058000.usb: irq 29, io mem 0x1f058000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 2-4: new low-speed USB device number 2 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb2/2-4/2-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
In the later case, there is no re-connection for USB-1.0/1.1 devices, which is expected.
--- drivers/usb/host/ohci-platform.c | 1 + drivers/usb/host/uhci-platform.c | 1 + 2 files changed, 2 insertions(+)
drivers/usb/host/ohci-platform.c +1 -0
@@ -376,3 +376,4 @@ MODULE_DESCRIPTION(DRIVER_DESC);MODULE_AUTHOR ("Hauke Mehrtens" );MODULE_AUTHOR ("Alan Stern" );MODULE_LICENSE ("GPL" ); +MODULE_SOFTDEP ("pre: ehci_platform" );
drivers/usb/host/uhci-platform.c +1 -0
@@ -191,3 +191,4 @@ static struct platform_driver uhci_platf .of_match_table = platform_uhci_ids, }, }; +MODULE_SOFTDEP ("pre: ehci_platform" );
Greg Kroah-Hartman
maintainerPATCH 59/254 USB: serial: option: add Telit LE910 MBIM composition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulrich Mohr <[email protected]>
commit 8af4274ab5999831f4757dfd5bd11665ba3b1569 upstream.
Add support for Telit LE910 module when operating in MBIM composition with additional ttys. This USB product ID is used by the module when AT#USBCFG is set to 7.
0x1252: MBIM + tty(NMEA) + tty(MODEM) + tty(MODEM) + SAP
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1252 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -1505,6 +1505,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
Greg Kroah-Hartman
maintainerPATCH 60/254 USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
commit c0afe95e62984ceea171c3ea319beaf84a21181c upstream.
The vendor provides instructions to write "0403 bd90" to /sys/bus/usb-serial/drivers/ftdi_sio/new_id; see:
https://picaxe.com/docs/picaxe_linux_instructions.pdf
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 2 ++ 2 files changed, 3 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -850,6 +850,7 @@ static const struct usb_device_id id_tab { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, + { USB_DEVICE(FTDI_VID, FTDI_AXE027_PID) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
drivers/usb/serial/ftdi_sio_ids.h +2 -0
@@ -96,6 +96,8 @@#define LMI_LM3S_EVAL_BOARD_PID 0xbcd9#define LMI_LM3S_ICDI_BOARD_PID 0xbcda +#define FTDI_AXE027_PID 0xBD90/* PICAXE AXE027 USB download cable */ +#define FTDI_TURTELIZER_PID 0xBDC8/* JTAG/RS-232 adapter by egnite GmbH */ /* OpenDCC (www.opendcc.de) product id */
Greg Kroah-Hartman
maintainerPATCH 61/254 nvme-pci: disable secondary temp for Wodposit WPBSNM8
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilikara Zheng <[email protected]>
commit 340f4fc5508c2905a1f30de229e2a4b299d55735 upstream.
Secondary temperature thresholds (temp2_{min,max}) were not reported properly on this NVMe SSD. This resulted in an error while attempting to read these values with sensors(1):
ERROR: Can't get value of subfeature temp2_min: I/O error
ERROR: Can't get value of subfeature temp2_max: I/O error
Add the device to the nvme_id_table with the NVME_QUIRK_NO_SECONDARY_TEMP_THRESH flag to suppress access to all non- composite temperature thresholds.
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -3563,6 +3563,8 @@ static const struct pci_device_id nvme_i .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, { PCI_DEVICE(0x1e49, 0x0041), /* ZHITAI TiPro7000 NVMe SSD */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0x1fa0, 0x2283), /* Wodposit WPBSNM8-256GTP */ + .driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, }, { PCI_DEVICE(0x025e, 0xf1ac), /* SOLIDIGM P44 pro SSDPFKKW020X7 */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, { PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */
Greg Kroah-Hartman
maintainerPATCH 62/254 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 upstream.
The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.
--- fs/ext4/xattr.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/xattr.c +1 -0
@@ -1037,6 +1037,7 @@ static int ext4_xattr_inode_update_ref(hext4_error_inode (ea_inode, __func__, __LINE__,0 ,"EA inode %lu ref wraparound: ref_count=%lld ref_change=%d" , ea_inode->i_ino, ref_count, ref_change); +brelse (iloc.bh); ret = -EFSCORRUPTED ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 63/254 hrtimer: Fix softirq base check in update_needs_ipi()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 upstream.
The 'clockid' field is not the correct way to check for a softirq base.
Fix the check to correctly compare the base type instead of the clockid.
--- kernel/time/hrtimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/hrtimer.c +1 -1
@@ -941,7 +941,7 @@ static bool update_needs_ipi(struct hrtireturn true;/* Extra check for softirq clock bases */ -if (base->clockid <HRTIMER_BASE_MONOTONIC_SOFT ) +if (base->index <HRTIMER_BASE_MONOTONIC_SOFT )continue ;if (cpu_base->softirq_activated)continue ;
Greg Kroah-Hartman
maintainerPATCH 64/254 EDAC/x38: Fix a resource leak in x38_probe1()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
--- drivers/edac/x38_edac.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/edac/x38_edac.c +6 -3
@@ -341,9 +341,12 @@ static int x38_probe1(struct pci_dev *pd layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = x38_channel_num; layers[1 ].is_virt_csrow = false; + + + rc = -ENOMEM ; mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers,0 );if (!mci) -return -ENOMEM ; + goto unmap;edac_dbg (3 ,"MC: init mci\n" );
@@ -403,9 +406,9 @@ static int x38_probe1(struct pci_dev *pdreturn 0 ; fail: +edac_mc_free (mci); +unmap:iounmap (window); -if (mci) -edac_mc_free (mci);return rc; }
Greg Kroah-Hartman
maintainerPATCH 65/254 EDAC/i3200: Fix a resource leak in i3200_probe1()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d42d5715dcb559342ff356327b241c53a67584d9 upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
--- drivers/edac/i3200_edac.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/edac/i3200_edac.c +6 -5
@@ -358,10 +358,11 @@ static int i3200_probe1(struct pci_dev * layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels; layers[1 ].is_virt_csrow = false; - mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers, -sizeof (struct i3200_priv )); + + rc = -ENOMEM ; + mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers,sizeof (struct i3200_priv ));if (!mci) -return -ENOMEM ; + goto unmap;edac_dbg (3 ,"MC: init mci\n" );
@@ -421,9 +422,9 @@ static int i3200_probe1(struct pci_dev *return 0 ; fail: +edac_mc_free (mci); +unmap:iounmap (window); -if (mci) -edac_mc_free (mci);return rc; }
Greg Kroah-Hartman
maintainerPATCH 66/254 tcpm: allow looking for role_sw device in the main node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Ferraris <[email protected]>
commit 1366cd228b0c67b60a2c0c26ef37fe9f7cfedb7f upstream.
If ports are defined in the tcpc main node, fwnode_usb_role_switch_get() returns an error, meaning usb_role_switch_get() (which would succeed) never gets a chance to run as port->role_sw isn't NULL, causing a regression on devices where this is the case.
Fix this by turning the NULL check into IS_ERR_OR_NULL(), so usb_role_switch_get() can actually run and the device get properly probed.
--- drivers/usb/typec/tcpm/tcpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpm.c +1 -1
@@ -6637,7 +6637,7 @@ struct tcpm_port *tcpm_register_port(str port->port_type = port->typec_caps.type; port->role_sw =fwnode_usb_role_switch_get (tcpc->fwnode); -if (!port->role_sw) +if (IS_ERR_OR_NULL (port->role_sw)) port->role_sw =usb_role_switch_get (port->dev);if (IS_ERR (port->role_sw)) { err =PTR_ERR (port->role_sw);
Greg Kroah-Hartman
maintainerPATCH 67/254 x86/resctrl: Add missing resctrl initialization for Hygon
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <[email protected]>
commit 6ee98aabdc700b5705e4f1833e2edc82a826b53b upstream.
Hygon CPUs supporting Platform QoS features currently undergo partial resctrl initialization through resctrl_cpu_detect() in the Hygon BSP init helper and AMD/Hygon common initialization code. However, several critical data structures remain uninitialized for Hygon CPUs in the following paths:
- get_mem_config()-> __rdt_get_mem_config_amd():
rdt_resource::membw,alloc_capable
hw_res::num_closid
- rdt_init_res_defs()->rdt_init_res_defs_amd():
rdt_resource::cache
hw_res::msr_base,msr_update
Add the missing AMD/Hygon common initialization to ensure proper Platform QoS functionality on Hygon CPUs.
--- arch/x86/kernel/cpu/resctrl/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/core.c +4 -2
@@ -755,7 +755,8 @@ static __init bool get_mem_config(void)if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL )return __get_mem_config_intel (&hw_res->r_resctrl); -else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD ) +else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD || + boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON )return __rdt_get_mem_config_amd (&hw_res->r_resctrl);return false;
@@ -907,7 +908,8 @@ static __init void rdt_init_res_defs(voi {if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL )rdt_init_res_defs_intel (); -else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD ) +else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD || + boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON )rdt_init_res_defs_amd (); }
Greg Kroah-Hartman
maintainerPATCH 68/254 x86/resctrl: Fix memory bandwidth counter width for Hygon
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <[email protected]>
commit 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c upstream.
The memory bandwidth calculation relies on reading the hardware counter and measuring the delta between samples. To ensure accurate measurement, the software reads the counter frequently enough to prevent it from rolling over twice between reads.
The default Memory Bandwidth Monitoring (MBM) counter width is 24 bits. Hygon CPUs provide a 32-bit width counter, but they do not support the MBM capability CPUID leaf (0xF.[ECX=1]:EAX) to report the width offset (from 24 bits).
Consequently, the kernel falls back to the 24-bit default counter width, which causes incorrect overflow handling on Hygon CPUs.
Fix this by explicitly setting the counter width offset to 8 bits (resulting in a 32-bit total counter width) for Hygon CPUs.
--- arch/x86/kernel/cpu/resctrl/core.c | 15 +++++++++++++-- arch/x86/kernel/cpu/resctrl/internal.h | 3 +++ 2 files changed, 16 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/core.c +13 -2
@@ -940,8 +940,19 @@ void resctrl_cpu_detect(struct cpuinfo_x c->x86_cache_occ_scale = ebx; c->x86_cache_mbm_width_offset = eax &0xff ; -if (c->x86_vendor ==X86_VENDOR_AMD && !c->x86_cache_mbm_width_offset) - c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_AMD ; +if (!c->x86_cache_mbm_width_offset) { +switch (c->x86_vendor) { +case X86_VENDOR_AMD : + c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_AMD ; +break ; +case X86_VENDOR_HYGON : + c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_HYGON ; +break ; +default : +/* Leave c->x86_cache_mbm_width_offset as 0 */ +break ; + } + } } }
arch/x86/kernel/cpu/resctrl/internal.h +3 -0
@@ -20,6 +20,9 @@#define MBA_IS_LINEAR 0x4#define MBM_CNTR_WIDTH_OFFSET_AMD 20 +/* Hygon MBM counter width as an offset from MBM_CNTR_WIDTH_BASE */ +#define MBM_CNTR_WIDTH_OFFSET_HYGON 8 +#define RMID_VAL_ERROR BIT_ULL(63)#define RMID_VAL_UNAVAIL BIT_ULL(62)/*
Greg Kroah-Hartman
maintainerPATCH 69/254 mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <[email protected]>
commit b9efe36b5e3eb2e91aa3d706066428648af034fc upstream.
When page isolation loops indefinitely during memory offline, reading /proc/sys/vm/percpu_pagelist_high_fraction blocks on pcp_batch_high_lock, causing hung task warnings.
Make procfs reads lock-free since percpu_pagelist_high_fraction is a simple integer with naturally atomic reads, writers still serialize via the mutex.
This prevents hung task warnings when reading the procfs file during long-running memory offline operations.
--- mm/page_alloc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
mm/page_alloc.c +9 -1
@@ -5936,11 +5936,19 @@ static int percpu_pagelist_high_fractionint old_percpu_pagelist_high_fraction;int ret; +/* +* Avoid using pcp_batch_high_lock for reads as the value is read +* atomically and a race with offlining is harmless. +*/ + +if (!write) +return proc_dointvec_minmax (table, write, buffer, length, ppos); +mutex_lock (&pcp_batch_high_lock); old_percpu_pagelist_high_fraction = percpu_pagelist_high_fraction; ret =proc_dointvec_minmax (table, write, buffer, length, ppos); -if (!write || ret <0 ) +if (ret <0 ) goto out;/* Sanity checking to avoid pcp imbalance */
Greg Kroah-Hartman
maintainerPATCH 70/254 mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 9814cc832b88bd040fc2a1817c2b5469d0f7e862 upstream.
When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
--- mm/damon/sysfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/damon/sysfs.c +3 -2
@@ -716,7 +716,7 @@ static int damon_sysfs_context_add_dirs( err =damon_sysfs_context_set_targets (context);if (err) - goto put_attrs_out; + goto rmdir_put_attrs_out; err =damon_sysfs_context_set_schemes (context);if (err)
@@ -726,7 +726,8 @@ static int damon_sysfs_context_add_dirs( put_targets_attrs_out:kobject_put (&context->targets->kobj); context->targets =NULL ; -put_attrs_out: +rmdir_put_attrs_out: +damon_sysfs_attrs_rm_dirs (context->attrs);kobject_put (&context->attrs->kobj); context->attrs =NULL ;return err;
Greg Kroah-Hartman
maintainerPATCH 71/254 LoongArch: Fix PMU counter allocation for mixed-type event groups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lisa Robinson <[email protected]>
commit a91f86e27087f250a5d9c89bb4a427b9c30fd815 upstream.
When validating a perf event group, validate_group() unconditionally attempts to allocate hardware PMU counters for the leader, sibling events and the new event being added.
This is incorrect for mixed-type groups. If a PERF_TYPE_SOFTWARE event is part of the group, the current code still tries to allocate a hardware PMU counter for it, which can wrongly consume hardware PMU resources and cause spurious allocation failures.
Fix this by only allocating PMU counters for hardware events during group validation, and skipping software events.
A trimmed down reproducer is as simple as this:
#include <stdio.h>
#include <assert.h>
#include <unistd.h>
#include <string.h>
#include <sys/syscall.h>
#include <linux/perf_event.h>
int main (int argc, char *argv[])
{
struct perf_event_attr attr = { 0 };
int fds[5];
attr.disabled = 1;
attr.exclude_kernel = 1;
attr.exclude_hv = 1;
attr.read_format = PERF_FORMAT_TOTAL_TIME_ENABLED |
PERF_FORMAT_TOTAL_TIME_RUNNING | PERF_FORMAT_ID | PERF_FORMAT_GROUP;
attr.size = sizeof (attr);
attr.type = PERF_TYPE_SOFTWARE;
attr.config = PERF_COUNT_SW_DUMMY;
fds[0] = syscall (SYS_perf_event_open, &attr, 0, -1, -1, 0);
assert (fds[0] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_CPU_CYCLES;
fds[1] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[1] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_INSTRUCTIONS;
fds[2] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[2] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_BRANCH_MISSES;
fds[3] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[3] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_CACHE_REFERENCES;
fds[4] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[4] >= 0);
printf ("PASSED\n");
return 0;
}--- arch/loongarch/kernel/perf_event.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
arch/loongarch/kernel/perf_event.c +18 -3
@@ -637,6 +637,18 @@ static const struct loongarch_perf_eventreturn pev; } +static inline bool loongarch_pmu_event_requires_counter (const struct perf_event *event) +{ +switch (event->attr.type) { +case PERF_TYPE_HARDWARE : +case PERF_TYPE_HW_CACHE : +case PERF_TYPE_RAW : +return true; +default : +return false; + } +} +static int validate_group (struct perf_event *event) {struct cpu_hw_events fake_cpuc;
@@ -644,15 +656,18 @@ static int validate_group(struct perf_evmemset (&fake_cpuc,0 ,sizeof (fake_cpuc)); -if (loongarch_pmu_alloc_counter (&fake_cpuc, &leader->hw) <0 ) +if (loongarch_pmu_event_requires_counter (leader) && +loongarch_pmu_alloc_counter (&fake_cpuc, &leader->hw) <0 )return -EINVAL ;for_each_sibling_event (sibling, leader) { -if (loongarch_pmu_alloc_counter (&fake_cpuc, &sibling->hw) <0 ) +if (loongarch_pmu_event_requires_counter (sibling) && +loongarch_pmu_alloc_counter (&fake_cpuc, &sibling->hw) <0 )return -EINVAL ; } -if (loongarch_pmu_alloc_counter (&fake_cpuc, &event->hw) <0 ) +if (loongarch_pmu_event_requires_counter (event) && +loongarch_pmu_alloc_counter (&fake_cpuc, &event->hw) <0 )return -EINVAL ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 72/254 drm/amd/display: Bump the HDMI clock to 340MHz
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit fee50077656d8a58011f13bca48f743d1b6d6015 upstream.
[Why]
DP-HDMI dongles can execeed bandwidth requirements on high resolution monitors. This can lead to pruning the high resolution modes.
HDMI 1.3 bumped the clock to 340MHz, but display code never matched it.
[How]
Set default to (DVI) 165MHz. Once HDMI display is identified update to 340MHz.
--- drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h | 2 +- drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h +1 -1
@@ -41,7 +41,7 @@/* kHZ*/ #define DP_ADAPTOR_DVI_MAX_TMDS_CLK 165000/* kHZ*/ -#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 165000 +#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 340000struct dp_hdmi_dongle_signature_data {int8_t id[15 ];/* "DP-HDMI ADAPTOR"*/
drivers/gpu/drm/amd/display/dc/link/link_detection.c +3 -1
@@ -325,7 +325,7 @@ static void query_dp_dual_mode_adaptor(/* Assume we have no valid DP passive dongle connected */ *dongle =DISPLAY_DONGLE_NONE ; - sink_cap->max_hdmi_pixel_clock =DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK ; + sink_cap->max_hdmi_pixel_clock =DP_ADAPTOR_DVI_MAX_TMDS_CLK ;/* Read DP-HDMI dongle I2c (no response interpreted as DP-DVI dongle)*/ if (!i2c_read(
@@ -381,6 +381,8 @@ static void query_dp_dual_mode_adaptor( } } +if (is_valid_hdmi_signature) + sink_cap->max_hdmi_pixel_clock =DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK ;if (is_type2_dongle) { uint32_t max_tmds_clk =
Greg Kroah-Hartman
maintainerPATCH 73/254 drm/amd: Clean up kfd node on surprise disconnect
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
When an eGPU is unplugged the KFD topology should also be destroyed for that GPU. This never happens because the fini_sw callbacks never get to run. Run them manually before calling amdgpu_device_ip_fini_early() when a device has already been disconnected.
This location is intentionally chosen to make sure that the kfd locking refcount doesn't get incremented unintentionally.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +8 -0
@@ -4029,6 +4029,14 @@ void amdgpu_device_fini_hw(struct amdgpu/* disable ras feature must before hw fini */ amdgpu_ras_pre_fini (adev); +/* +* device went through surprise hotplug; we need to destroy topology +* before ip_fini_early to prevent kfd locking refcount issues by calling +* amdgpu_amdkfd_suspend() +*/ +if (drm_dev_is_unplugged (adev_to_drm (adev))) +amdgpu_amdkfd_device_fini_sw (adev); +amdgpu_device_ip_fini_early (adev);amdgpu_irq_fini_hw (adev);
Greg Kroah-Hartman
maintainerPATCH 74/254 drm/amdkfd: fix a memory leak in device_queue_manager_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 80614c509810fc051312d1a7ccac8d0012d6b8d0 upstream.
If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd() to release the memory allocated by allocate_hiq_sdma_mqd(). Move deallocate_hiq_sdma_mqd() up to ensure proper function visibility at the point of use.
--- drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 19 ++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +11 -8
@@ -2446,6 +2446,14 @@ static int allocate_hiq_sdma_mqd(structreturn retval; } +static void deallocate_hiq_sdma_mqd (struct kfd_node *dev, +struct kfd_mem_obj *mqd) +{ +WARN (!mqd,"No hiq sdma mqd trunk to free" ); + +amdgpu_amdkfd_free_gtt_mem (dev->adev, &mqd->gtt_mem); +} +struct device_queue_manager *device_queue_manager_init (struct kfd_node *dev) {struct device_queue_manager *dqm;
@@ -2567,19 +2575,14 @@ struct device_queue_manager *device_queureturn dqm; } +if (!dev->kfd->shared_resources.enable_mes) +deallocate_hiq_sdma_mqd (dev, &dqm->hiq_sdma_mqd); + out_free:kfree (dqm);return NULL ; } -static void deallocate_hiq_sdma_mqd (struct kfd_node *dev, -struct kfd_mem_obj *mqd) -{ -WARN (!mqd,"No hiq sdma mqd trunk to free" ); - -amdgpu_amdkfd_free_gtt_mem (dev->adev, &mqd->gtt_mem); -} -void device_queue_manager_uninit (struct device_queue_manager *dqm) { dqm->ops.stop (dqm);
Greg Kroah-Hartman
maintainerPATCH 75/254 drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <[email protected]>
commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
For a while, I've been seeing a strange issue where some (usually not all) of the display DMA channels will suddenly hang, particularly when there is a visible cursor on the screen that is being frequently updated, and especially when said cursor happens to go between two screens. While this brings back lovely memories of fixing Intel Skylake bugs, I would quite like to fix it :).
It turns out the problem that's happening here is that we're managing to reach nv50_head_flush_set() in our atomic commit path without actually holding nv50_disp->mutex. This means that cursor updates happening in parallel (along with any other atomic updates that need to use the core channel) will race with eachother, which eventually causes us to corrupt the pushbuffer - leading to a plethora of various GSP errors, usually:
nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
The reason this is happening is because generally we check whether we need to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). However, curs507a_prepare is called from the fb_prepare callback, which happens after the atomic check phase. As a result, this can lead to commits that both touch the core channel but also don't grab nv50_disp->mutex.
So, fix this by making sure that we set nv50_atom->lock_core in cus507a_prepare().
--- drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/dispnv50/curs507a.c +1 -0
@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw, asyh->curs.handle = handle; asyh->curs.offset = offset; asyh->set.curs = asyh->curs.visible; +nv50_atom (asyh->state.state)->lock_core = true; } }
Greg Kroah-Hartman
maintainerPATCH 76/254 drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set. This leads to a warning and a backtrace in the kernel log and panel does not work:
"
WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
"
The warning is triggered by a check for valid connector type in devm_drm_panel_bridge_add(). If there is no valid connector type set for a panel, the warning is printed and panel is not added. Fill in the missing connector type to fix the warning and make the panel operational once again.
--- drivers/gpu/drm/panel/panel-simple.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panel/panel-simple.c +1 -0
@@ -1607,6 +1607,7 @@ static const struct panel_desc dataimage }, .bus_format = MEDIA_BUS_FMT_RGB888_1X24, .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, + .connector_type = DRM_MODE_CONNECTOR_DPI, };static const struct display_timing dlc_dlc0700yzg_1_timing = {
Greg Kroah-Hartman
maintainerPATCH 77/254 drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
In vmw_compat_shader_add(), the return value check of vmw_shader_alloc() is not proper. Modify the check for the return pointer 'res'.
Found by code review and compiled on ubuntu 20.04.
--- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +3 -1
@@ -923,8 +923,10 @@ int vmw_compat_shader_add(struct vmw_prittm_bo_unreserve (&buf->tbo); res =vmw_shader_alloc (dev_priv, buf, size,0 , shader_type); -if (unlikely (ret !=0 )) +if (IS_ERR (res)) { + ret =PTR_ERR (res); goto no_reserve; + } ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader, vmw_shader_key(user_key, shader_type),
Greg Kroah-Hartman
maintainerPATCH 78/254 dmaengine: apple-admac: Add "apple,t8103-admac" compatible
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <[email protected]>
commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream.
After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,admac" anymore [1]. Use "apple,t8103-admac" as base compatible as it is the SoC the driver and bindings were written for.
[1]: https://lore.kernel.org/asahi/[email protected]/
--- drivers/dma/apple-admac.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/apple-admac.c +1 -0
@@ -938,6 +938,7 @@ static int admac_remove(struct platform_ }static const struct of_device_id admac_of_match[] = { + { .compatible ="apple,t8103-admac" , }, { .compatible ="apple,admac" , }, { } };
Greg Kroah-Hartman
maintainerPATCH 79/254 dmaengine: at_hdmac: fix device leak on of_dma_xlate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
Make sure to drop the reference taken when looking up the DMA platform device during of_dma_xlate() when releasing channel resources.
Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") fixed the leak in a couple of error paths but the reference is still leaking on successful allocation.
--- drivers/dma/at_hdmac.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/dma/at_hdmac.c +7 -2
@@ -1755,6 +1755,7 @@ static int atc_alloc_chan_resources(strustatic void atc_free_chan_resources (struct dma_chan *chan) {struct at_dma_chan *atchan =to_at_dma_chan (chan); +struct at_dma_slave *atslave;BUG_ON (atc_chan_is_enabled (atchan));
@@ -1764,8 +1765,12 @@ static void atc_free_chan_resources(stru/* * Free atslave allocated in at_dma_xlate() */ -kfree (chan->private); - chan->private =NULL ; + atslave = chan->private; +if (atslave) { +put_device (atslave->dma_dev); +kfree (atslave); + chan->private =NULL ; + }dev_vdbg (chan2dev (chan),"free_chan_resources: done\n" ); }
Greg Kroah-Hartman
maintainerPATCH 80/254 dmaengine: bcm-sba-raid: fix device leak on probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind.
--- drivers/dma/bcm-sba-raid.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/dma/bcm-sba-raid.c +5 -1
@@ -1699,7 +1699,7 @@ static int sba_probe(struct platform_dev/* Prealloc channel resource */ ret =sba_prealloc_channel_resources (sba);if (ret) - goto fail_free_mchan; + goto fail_put_mbox;/* Check availability of debugfs */ if (!debugfs_initialized ())
@@ -1729,6 +1729,8 @@ skip_debugfs: fail_free_resources:debugfs_remove_recursive (sba->root);sba_freeup_channel_resources (sba); +fail_put_mbox: +put_device (sba->mbox_dev); fail_free_mchan:mbox_free_channel (sba->mchan);return ret;
@@ -1744,6 +1746,8 @@ static int sba_remove(struct platform_desba_freeup_channel_resources (sba); +put_device (sba->mbox_dev); +mbox_free_channel (sba->mchan);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 81/254 dmaengine: dw: dmamux: fix OF node leak on route allocation failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream.
Make sure to drop the reference taken to the DMA master OF node also on late route allocation failures.
--- drivers/dma/dw/rzn1-dmamux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/dw/rzn1-dmamux.c +3 -1
@@ -90,7 +90,7 @@ static void *rzn1_dmamux_route_allocate(if (test_and_set_bit (map->req_idx, dmamux->used_chans)) { ret = -EBUSY ; - goto free_map; + goto put_dma_spec_np; } mask =BIT (map->req_idx);
@@ -103,6 +103,8 @@ static void *rzn1_dmamux_route_allocate( clear_bitmap:clear_bit (map->req_idx, dmamux->used_chans); +put_dma_spec_np: +of_node_put (dma_spec->np); free_map:kfree (map); put_device:
Greg Kroah-Hartman
maintainerPATCH 82/254 dmaengine: idxd: fix device leaks on compat bind and unbind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 799900f01792cf8b525a44764f065f83fcafd468 upstream.
Make sure to drop the reference taken when looking up the idxd device as part of the compat bind and unbind sysfs interface.
--- drivers/dma/idxd/compat.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/dma/idxd/compat.c +19 -4
@@ -21,11 +21,16 @@ static ssize_t unbind_store(struct devicint rc = -ENODEV ; dev =bus_find_device_by_name (bus,NULL , buf); -if (dev && dev->driver) { +if (!dev) +return -ENODEV ; + +if (dev->driver) {device_driver_detach (dev); rc = count; } +put_device (dev); +return rc; } static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
@@ -39,9 +44,12 @@ static ssize_t bind_store(struct device_struct idxd_dev *idxd_dev; dev =bus_find_device_by_name (bus,NULL , buf); -if (!dev || dev->driver || drv != &dsa_drv.drv) +if (!dev)return -ENODEV ; +if (dev->driver || drv != &dsa_drv.drv) + goto err_put_dev; + idxd_dev =confdev_to_idxd_dev (dev);if (is_idxd_dev (idxd_dev)) { alt_drv =driver_find ("idxd" , bus);
@@ -54,13 +62,20 @@ static ssize_t bind_store(struct device_ alt_drv =driver_find ("user" , bus); }if (!alt_drv) -return -ENODEV ; + goto err_put_dev; rc =device_driver_attach (alt_drv, dev);if (rc <0 ) -return rc; + goto err_put_dev; + +put_device (dev);return count; + +err_put_dev: +put_device (dev); + +return rc; } static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
Greg Kroah-Hartman
maintainerPATCH 83/254 dmaengine: lpc18xx-dmamux: fix device leak on route allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/dma/lpc18xx-dmamux.c +14 -5
@@ -57,30 +57,31 @@ static void *lpc18xx_dmamux_reserve(strustruct lpc18xx_dmamux_data *dmamux =platform_get_drvdata (pdev);unsigned long flags;unsigned mux; +int ret = -EINVAL ;if (dma_spec->args_count !=3 ) {dev_err (&pdev->dev,"invalid number of dma mux args\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; } mux = dma_spec->args[0 ];if (mux >= dmamux->dma_master_requests) {dev_err (&pdev->dev,"invalid mux number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }if (dma_spec->args[1 ] >LPC18XX_DMAMUX_MAX_VAL ) {dev_err (&pdev->dev,"invalid dma mux value: %d\n" , dma_spec->args[1 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }/* The of_node_put() will be done in the core for the node */ dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"can't get dma master\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }spin_lock_irqsave (&dmamux->lock, flags);
@@ -89,7 +90,8 @@ static void *lpc18xx_dmamux_reserve(strudev_err (&pdev->dev,"dma request %u busy with %u.%u\n" , mux, mux, dmamux->muxes[mux].value);of_node_put (dma_spec->np); -return ERR_PTR (-EBUSY ); + ret = -EBUSY ; + goto err_put_pdev; } dmamux->muxes[mux].busy = true;
@@ -106,7 +108,14 @@ static void *lpc18xx_dmamux_reserve(strudev_dbg (&pdev->dev,"mapping dmamux %u.%u to dma request %u\n" , mux, dmamux->muxes[mux].value, mux); +put_device (&pdev->dev); +return &dmamux->muxes[mux]; + +err_put_pdev: +put_device (&pdev->dev); + +return ERR_PTR (ret); }static int lpc18xx_dmamux_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 84/254 dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
Fix a memory leak in gpi_peripheral_config() where the original memory pointed to by gchan->config could be lost if krealloc() fails.
The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the reference to the original memory
4. The original memory becomes unreachable and cannot be freed
Fix this by using a temporary variable to hold the krealloc() result and only updating gchan->config when the allocation succeeds.
Found via static analysis and code review.
--- drivers/dma/qcom/gpi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/dma/qcom/gpi.c +4 -2
@@ -1621,14 +1621,16 @@ static int gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) { struct gchan *gchan = to_gchan(chan); +void *new_config;if (!config->peripheral_config)return -EINVAL ; - gchan->config =krealloc (gchan->config, config->peripheral_size,GFP_NOWAIT ); -if (!gchan->config) + new_config =krealloc (gchan->config, config->peripheral_size,GFP_NOWAIT ); +if (!new_config)return -ENOMEM ; + gchan->config = new_config;memcpy (gchan->config, config->peripheral_config, config->peripheral_size);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 85/254 dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream.
After audio full duplex testing, playing the recorded file contains a few playback frames from the previous time. The rz_dmac_terminate_all() does not reset all the hardware descriptors queued previously, leading to the wrong descriptor being picked up during the next DMA transfer. Fix the above issue by resetting all the descriptor headers for a channel in rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg().
--- drivers/dma/sh/rz-dmac.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/dma/sh/rz-dmac.c +5 -0
@@ -533,11 +533,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *cstatic int rz_dmac_terminate_all (struct dma_chan *chan) {struct rz_dmac_chan *channel =to_rz_dmac_chan (chan); +struct rz_lmdesc *lmdesc = channel->lmdesc.base;unsigned long flags; +unsigned int i;LIST_HEAD (head);rz_dmac_disable_hw (channel);spin_lock_irqsave (&channel->vc.lock, flags); +for (i =0 ; i <DMAC_NR_LMDESC ; i++) + lmdesc[i].header =0 ; +list_splice_tail_init (&channel->ld_active, &channel->ld_free);list_splice_tail_init (&channel->ld_queue, &channel->ld_free);spin_unlock_irqrestore (&channel->vc.lock, flags);
Greg Kroah-Hartman
maintainerPATCH 86/254 dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
Make sure to drop the reference taken when looking up the crossbar platform device during dra7x route allocation.
Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the reference is still leaking on successful allocation.
--- drivers/dma/ti/dma-crossbar.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/ti/dma-crossbar.c +2 -0
@@ -288,6 +288,8 @@ static void *ti_dra7_xbar_route_allocateti_dra7_xbar_write (xbar->iomem, map->xbar_out, map->xbar_in); +put_device (&pdev->dev); +return map; }
Greg Kroah-Hartman
maintainerPATCH 87/254 dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
Make sure to drop the reference taken when looking up the crossbar platform device during am335x route allocation.
--- drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/dma/ti/dma-crossbar.c +10 -6
@@ -79,34 +79,35 @@ static void *ti_am335x_xbar_route_alloca {struct platform_device *pdev =of_find_device_by_node (ofdma->of_node);struct ti_am335x_xbar_data *xbar =platform_get_drvdata (pdev); -struct ti_am335x_xbar_map *map; +struct ti_am335x_xbar_map *map =ERR_PTR (-EINVAL );if (dma_spec->args_count !=3 ) -return ERR_PTR (-EINVAL ); + goto out_put_pdev;if (dma_spec->args[2 ] >= xbar->xbar_events) {dev_err (&pdev->dev,"Invalid XBAR event number: %d\n" , dma_spec->args[2 ]); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; }if (dma_spec->args[0 ] >= xbar->dma_requests) {dev_err (&pdev->dev,"Invalid DMA request line number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; }/* The of_node_put() will be done in the core for the node */ dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"Can't get DMA master\n" ); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; } map =kzalloc (sizeof (*map),GFP_KERNEL );if (!map) {of_node_put (dma_spec->np); -return ERR_PTR (-ENOMEM ); + map =ERR_PTR (-ENOMEM ); + goto out_put_pdev; } map->dma_line = (u16 )dma_spec->args[0 ];
@@ -120,6 +121,9 @@ static void *ti_am335x_xbar_route_allocati_am335x_xbar_write (xbar->iomem, map->dma_line, map->mux_val); +out_put_pdev: +put_device (&pdev->dev); +return map; }
Greg Kroah-Hartman
maintainerPATCH 88/254 dmaengine: ti: k3-udma: fix device leak on udma lookup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
Make sure to drop the reference taken when looking up the UDMA platform device.
Note that holding a reference to a platform device does not prevent its driver data from going away so there is no point in keeping the reference after the lookup helper returns.
--- drivers/dma/ti/k3-udma-private.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/ti/k3-udma-private.c +1 -1
@@ -42,9 +42,9 @@ struct udma_dev *of_xudma_dev_get(struct } ud =platform_get_drvdata (pdev); +put_device (&pdev->dev);if (!ud) {pr_debug ("UDMA has not been probed\n" ); -put_device (&pdev->dev);return ERR_PTR (-EPROBE_DEFER ); }
Greg Kroah-Hartman
maintainerPATCH 89/254 btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit 5037b342825df7094a4906d1e2a9674baab50cb2 upstream.
When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction without considering whether the given transaction type actually needs to wait for that particular transaction state. The btrfs_blocked_trans_types[] array already defines which transaction types should wait for which transaction states, but this check was missing in wait_current_trans().
This can lead to a deadlock scenario involving two transactions and pending ordered extents:
1. Transaction A is in TRANS_STATE_COMMIT_DOING state
2. A worker processing an ordered extent calls start_transaction() with TRANS_JOIN
3. join_transaction() returns -EBUSY because Transaction A is in TRANS_STATE_COMMIT_DOING
4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes
5. A new Transaction B is created (TRANS_STATE_RUNNING)
6. The ordered extent from step 2 is added to Transaction B's pending ordered extents
7. Transaction B immediately starts commit by another task and enters TRANS_STATE_COMMIT_START
8. The worker finally reaches wait_current_trans(), sees Transaction B in TRANS_STATE_COMMIT_START (a blocked state), and waits unconditionally
9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START
according to btrfs_blocked_trans_types[]
10. Transaction B is waiting for pending ordered extents to complete
11. Deadlock: Transaction B waits for ordered extent, ordered extent waits for Transaction B
This can be illustrated by the following call stacks:
CPU0 CPU1
btrfs_finish_ordered_io()
start_transaction(TRANS_JOIN)
join_transaction()
# -EBUSY (Transaction A is # TRANS_STATE_COMMIT_DOING)
# Transaction A completes
# Transaction B created
# ordered extent added to
# Transaction B's pending list
btrfs_commit_transaction()
# Transaction B enters
# TRANS_STATE_COMMIT_START
# waiting for pending ordered
# extents
wait_current_trans()
# waits for Transaction B
# (should not wait!)Task bstore_kv_sync in btrfs_commit_transaction waiting for ordered extents:
__schedule+0x2e7/0x8a0 schedule+0x64/0xe0 btrfs_commit_transaction+0xbf7/0xda0 [btrfs] btrfs_sync_file+0x342/0x4d0 [btrfs] __x64_sys_fdatasync+0x4b/0x80 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Task kworker in wait_current_trans waiting for transaction commit:
Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs] __schedule+0x2e7/0x8a0 schedule+0x64/0xe0 wait_current_trans+0xb0/0x110 [btrfs] start_transaction+0x346/0x5b0 [btrfs] btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs] btrfs_work_helper+0xe8/0x350 [btrfs] process_one_work+0x1d3/0x3c0 worker_thread+0x4d/0x3e0 kthread+0x12d/0x150 ret_from_fork+0x1f/0x30
Fix this by passing the transaction type to wait_current_trans() and checking btrfs_blocked_trans_types[cur_trans->state] against the given type before deciding to wait. This ensures that transaction types which are allowed to join during certain blocked states will not unnecessarily wait and cause deadlocks.
--- fs/btrfs/transaction.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/btrfs/transaction.c +6 -5
@@ -517,13 +517,14 @@ static inline int is_transaction_blocked* when this is done, it is safe to start a new transaction, but the current * transaction might not be fully on disk. */ -static void wait_current_trans (struct btrfs_fs_info *fs_info) +static void wait_current_trans (struct btrfs_fs_info *fs_info,unsigned int type) {struct btrfs_transaction *cur_trans;spin_lock (&fs_info->trans_lock); cur_trans = fs_info->running_transaction; -if (cur_trans &&is_transaction_blocked (cur_trans)) { +if (cur_trans &&is_transaction_blocked (cur_trans) && + (btrfs_blocked_trans_types[cur_trans->state] & type)) {refcount_inc (&cur_trans->use_count);spin_unlock (&fs_info->trans_lock);
@@ -676,12 +677,12 @@ again:sb_start_intwrite (fs_info->sb);if (may_wait_transaction (fs_info, type)) -wait_current_trans (fs_info); +wait_current_trans (fs_info, type); do { ret = join_transaction(fs_info, type); if (ret == -EBUSY) { - wait_current_trans(fs_info); + wait_current_trans(fs_info, type); if (unlikely(type == TRANS_ATTACH || type == TRANS_JOIN_NOSTART)) ret = -ENOENT;
@@ -966,7 +967,7 @@ out:void btrfs_throttle (struct btrfs_fs_info *fs_info) { -wait_current_trans (fs_info); +wait_current_trans (fs_info,TRANS_START ); }bool btrfs_should_end_transaction (struct btrfs_trans_handle *trans)
Greg Kroah-Hartman
maintainerPATCH 90/254 io_uring: move local task_work in exit cancel loop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit da579f05ef0faada3559e7faddf761c75cdf85e1 upstream.
With IORING_SETUP_DEFER_TASKRUN, task work is queued to ctx->work_llist (local work) rather than the fallback list. During io_ring_exit_work(), io_move_task_work_from_local() was called once before the cancel loop, moving work from work_llist to fallback_llist.
However, task work can be added to work_llist during the cancel loop itself. There are two cases:
1) io_kill_timeouts() is called from io_uring_try_cancel_requests() to cancel pending timeouts, and it adds task work via io_req_queue_tw_complete() for each cancelled timeout:
2) URING_CMD requests like ublk can be completed via io_uring_cmd_complete_in_task() from ublk_queue_rq() during canceling, given ublk request queue is only quiesced when canceling the 1st uring_cmd.
Since io_allowed_defer_tw_run() returns false in io_ring_exit_work() (kworker != submitter_task), io_run_local_work() is never invoked, and the work_llist entries are never processed. This causes io_uring_try_cancel_requests() to loop indefinitely, resulting in 100% CPU usage in kworker threads.
Fix this by moving io_move_task_work_from_local() inside the cancel loop, ensuring any work on work_llist is moved to fallback before each cancel attempt.
--- io_uring/io_uring.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
io_uring/io_uring.c +4 -4
@@ -3191,11 +3191,11 @@ static __cold void io_ring_exit_work(strmutex_unlock (&ctx->uring_lock); } -if (ctx->flags &IORING_SETUP_DEFER_TASKRUN ) -io_move_task_work_from_local (ctx); - -while (io_uring_try_cancel_requests (ctx,NULL , true)) +do { +if (ctx->flags &IORING_SETUP_DEFER_TASKRUN ) +io_move_task_work_from_local (ctx);cond_resched (); + }while (io_uring_try_cancel_requests (ctx,NULL , true));if (ctx->sq_data) {struct io_sq_data *sqd = ctx->sq_data;
Greg Kroah-Hartman
maintainerPATCH 91/254 posix-clock: introduce posix_clock_context concept
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xabier Marquiegui <[email protected]>
[ Upstream commit 60c6946675fc06dd2fd2b7a4b6fd1c1f046f1056 ]
Add the necessary structure to support custom private-data per posix-clock user.
The previous implementation of posix-clock assumed all file open instances need access to the same clock structure on private_data.
The need for individual data structures per file open instance has been identified when developing support for multiple timestamp event queue users for ptp_clock.
Stable-dep-of: e859d375d169 ("posix-clock: Store file pointer in struct posix_clock_context")
--- drivers/ptp/ptp_chardev.c | 21 +++++++++++++-------- drivers/ptp/ptp_private.h | 16 +++++++++------- include/linux/posix-clock.h | 35 +++++++++++++++++++++++++++-------- kernel/time/posix-clock.c | 36 +++++++++++++++++++++++++++--------- 4 files changed, 76 insertions(+), 32 deletions(-)
drivers/ptp/ptp_chardev.c +13 -8
@@ -103,14 +103,16 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,return 0 ; } -int ptp_open (struct posix_clock *pc,fmode_t fmode) +int ptp_open (struct posix_clock_context *pccontext,fmode_t fmode) {return 0 ; } -long ptp_ioctl (struct posix_clock *pc,unsigned int cmd,unsigned long arg) +long ptp_ioctl (struct posix_clock_context *pccontext,unsigned int cmd, +unsigned long arg) { - struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock);struct ptp_sys_offset_extended *extoff =NULL ;struct ptp_sys_offset_precise precise_offset;struct system_device_crosststamp xtstamp;
@@ -437,9 +439,11 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)return err; } -__poll_t ptp_poll (struct posix_clock *pc,struct file *fp,poll_table *wait) +__poll_t ptp_poll (struct posix_clock_context *pccontext,struct file *fp, +poll_table *wait) { - struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock);poll_wait (fp, &ptp->tsev_wq, wait);
@@ -448,10 +452,11 @@ __poll_t ptp_poll(struct posix_clock *pc, struct file *fp, poll_table *wait)#define EXTTS_BUFSIZE (PTP_BUF_TIMESTAMPS * sizeof(struct ptp_extts_event)) -ssize_t ptp_read (struct posix_clock *pc, -uint rdflags,char __user *buf,size_t cnt) +ssize_t ptp_read (struct posix_clock_context *pccontext,uint rdflags, +char __user *buf,size_t cnt) { - struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock);struct timestamp_event_queue *queue = &ptp->tsevq;struct ptp_extts_event *event;unsigned long flags;
drivers/ptp/ptp_private.h +9 -7
@@ -136,16 +136,18 @@ extern struct class *ptp_class;int ptp_set_pinfunc (struct ptp_clock *ptp,unsigned int pin,enum ptp_pin_function func,unsigned int chan); -long ptp_ioctl (struct posix_clock *pc, -unsigned int cmd,unsigned long arg); +long ptp_ioctl (struct posix_clock_context *pccontext,unsigned int cmd, +unsigned long arg); -int ptp_open (struct posix_clock *pc,fmode_t fmode); +int ptp_open (struct posix_clock_context *pccontext,fmode_t fmode); -ssize_t ptp_read (struct posix_clock *pc, -uint flags,char __user *buf,size_t cnt); +int ptp_release (struct posix_clock_context *pccontext); -__poll_t ptp_poll (struct posix_clock *pc, -struct file *fp,poll_table *wait); +ssize_t ptp_read (struct posix_clock_context *pccontext,uint flags,char __user *buf, +size_t cnt); + +__poll_t ptp_poll (struct posix_clock_context *pccontext,struct file *fp, +poll_table *wait);/* * see ptp_sysfs.c
include/linux/posix-clock.h +27 -8
@@ -14,6 +14,7 @@#include <linux/rwsem.h> struct posix_clock ; +struct posix_clock_context ;/** * struct posix_clock_operations - functional interface to the clock
@@ -50,18 +51,18 @@ struct posix_clock_operations {/* * Optional character device methods: */ -long (*ioctl) (struct posix_clock *pc, -unsigned int cmd,unsigned long arg); +long (*ioctl)(struct posix_clock_context *pccontext,unsigned int cmd, +unsigned long arg); -int (*open) (struct posix_clock *pc,fmode_t f_mode); +int (*open)(struct posix_clock_context *pccontext,fmode_t f_mode); -__poll_t (*poll) (struct posix_clock *pc, -struct file *file,poll_table *wait); +__poll_t (*poll)(struct posix_clock_context *pccontext,struct file *file, +poll_table *wait); -int (*release) (struct posix_clock *pc); +int (*release)(struct posix_clock_context *pccontext); -ssize_t (*read) (struct posix_clock *pc, -uint flags,char __user *buf,size_t cnt); +ssize_t (*read)(struct posix_clock_context *pccontext,uint flags, +char __user *buf,size_t cnt); };/**
@@ -90,6 +91,24 @@ struct posix_clock {bool zombie; }; +/** +* struct posix_clock_context - represents clock file operations context +* +* @clk: Pointer to the clock +* @private_clkdata: Pointer to user data +* +* Drivers should use struct posix_clock_context during specific character +* device file operation methods to access the posix clock. +* +* Drivers can store a private data structure during the open operation +* if they have specific information that is required in other file +* operations. +*/ +struct posix_clock_context { +struct posix_clock *clk; +void *private_clkdata; +}; +/** * posix_clock_register() - register a new clock * @clk: Pointer to the clock. Caller must provide 'ops' field
kernel/time/posix-clock.c +27 -9
@@ -19,7 +19,8 @@*/ static struct posix_clock *get_posix_clock (struct file *fp) { -struct posix_clock *clk = fp->private_data; +struct posix_clock_context *pccontext = fp->private_data; +struct posix_clock *clk = pccontext->clk;down_read (&clk->rwsem);
@@ -39,6 +40,7 @@ static void put_posix_clock(struct posix_clock *clk)static ssize_t posix_clock_read (struct file *fp,char __user *buf,size_t count,loff_t *ppos) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);int err = -EINVAL ;
@@ -46,7 +48,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,return -ENODEV ;if (clk->ops.read) - err = clk->ops.read (clk, fp->f_flags, buf, count); + err = clk->ops.read (pccontext, fp->f_flags, buf, count);put_posix_clock (clk);
@@ -55,6 +57,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,static __poll_t posix_clock_poll (struct file *fp,poll_table *wait) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);__poll_t result =0 ;
@@ -62,7 +65,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait)return EPOLLERR ;if (clk->ops.poll) - result = clk->ops.poll (clk, fp, wait); + result = clk->ops.poll (pccontext, fp, wait);put_posix_clock (clk);
@@ -72,6 +75,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait)static long posix_clock_ioctl (struct file *fp,unsigned int cmd,unsigned long arg) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);int err = -ENOTTY ;
@@ -79,7 +83,7 @@ static long posix_clock_ioctl(struct file *fp,return -ENODEV ;if (clk->ops.ioctl) - err = clk->ops.ioctl (clk, cmd, arg); + err = clk->ops.ioctl (pccontext, cmd, arg);put_posix_clock (clk);
@@ -90,6 +94,7 @@ static long posix_clock_ioctl(struct file *fp,static long posix_clock_compat_ioctl (struct file *fp,unsigned int cmd,unsigned long arg) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);int err = -ENOTTY ;
@@ -97,7 +102,7 @@ static long posix_clock_compat_ioctl(struct file *fp,return -ENODEV ;if (clk->ops.ioctl) - err = clk->ops.ioctl (clk, cmd, arg); + err = clk->ops.ioctl (pccontext, cmd, arg);put_posix_clock (clk);
@@ -110,6 +115,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)int err;struct posix_clock *clk = container_of(inode->i_cdev, struct posix_clock, cdev); +struct posix_clock_context *pccontext;down_read (&clk->rwsem);
@@ -117,14 +123,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp) err = -ENODEV ; goto out; } + pccontext =kzalloc (sizeof (*pccontext),GFP_KERNEL ); +if (!pccontext) { + err = -ENOMEM ; + goto out; + } + pccontext->clk = clk; + fp->private_data = pccontext;if (clk->ops.open) - err = clk->ops.open (clk, fp->f_mode); + err = clk->ops.open (pccontext, fp->f_mode);else err =0 ;if (!err) {get_device (clk->dev); - fp->private_data = clk; } out:up_read (&clk->rwsem);
@@ -133,14 +145,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp)static int posix_clock_release (struct inode *inode,struct file *fp) { -struct posix_clock *clk = fp->private_data; +struct posix_clock_context *pccontext = fp->private_data; +struct posix_clock *clk;int err =0 ; +if (!pccontext) +return -ENODEV ; + clk = pccontext->clk; +if (clk->ops.release) - err = clk->ops.release (clk); + err = clk->ops.release (pccontext);put_device (clk->dev); +kfree (pccontext); fp->private_data =NULL ;return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/254 Fix memory leak in posix_clock_open()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit 5b4cdd9c5676559b8a7c944ac5269b914b8c0bb8 ]
If the clk ops.open() function returns an error, we don't release the pccontext we allocated for this clock.
Re-organize the code slightly to make it all more obvious.
Stable-dep-of: e859d375d169 ("posix-clock: Store file pointer in struct posix_clock_context")
--- kernel/time/posix-clock.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
kernel/time/posix-clock.c +9 -7
@@ -129,15 +129,17 @@ static int posix_clock_open(struct inode *inode, struct file *fp) goto out; } pccontext->clk = clk; - fp->private_data = pccontext; -if (clk->ops.open) +if (clk->ops.open) { err = clk->ops.open (pccontext, fp->f_mode); -else - err =0 ; - -if (!err) { -get_device (clk->dev); +if (err) { +kfree (pccontext); + goto out; + } } + + fp->private_data = pccontext; +get_device (clk->dev); + err =0 ; out:up_read (&clk->rwsem);return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/254 posix-clock: Store file pointer in struct posix_clock_context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit e859d375d1694488015e6804bfeea527a0b25b9f ]
File descriptor based pc_clock_*() operations of dynamic posix clocks have access to the file pointer and implement permission checks in the generic code before invoking the relevant dynamic clock callback.
Character device operations (open, read, poll, ioctl) do not implement a generic permission control and the dynamic clock callbacks have no access to the file pointer to implement them.
Extend struct posix_clock_context with a struct file pointer and initialize it in posix_clock_open(), so that all dynamic clock callbacks can access it.
--- include/linux/posix-clock.h | 6 +++++- kernel/time/posix-clock.c | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
include/linux/posix-clock.h +5 -1
@@ -95,10 +95,13 @@ struct posix_clock {* struct posix_clock_context - represents clock file operations context * * @clk: Pointer to the clock +* @fp: Pointer to the file used to open the clock * @private_clkdata: Pointer to user data * * Drivers should use struct posix_clock_context during specific character -* device file operation methods to access the posix clock. +* device file operation methods to access the posix clock. In particular, +* the file pointer can be used to verify correct access mode for ioctl() +* calls. * * Drivers can store a private data structure during the open operation * if they have specific information that is required in other file
@@ -106,6 +109,7 @@ struct posix_clock {*/ struct posix_clock_context {struct posix_clock *clk; +struct file *fp;void *private_clkdata; };
kernel/time/posix-clock.c +1 -0
@@ -129,6 +129,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp) goto out; } pccontext->clk = clk; + pccontext->fp = fp;if (clk->ops.open) { err = clk->ops.open (pccontext, fp->f_mode);if (err) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/254 ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit b4e53b15c04e3852949003752f48f7a14ae39e86 ]
Many devices implement highly accurate clocks, which the kernel manages as PTP Hardware Clocks (PHCs). Userspace applications rely on these clocks to timestamp events, trace workload execution, correlate timescales across devices, and keep various clocks in sync.
The kernel’s current implementation of PTP clocks does not enforce file permissions checks for most device operations except for POSIX clock operations, where file mode is verified in the POSIX layer before forwarding the call to the PTP subsystem. Consequently, it is common practice to not give unprivileged userspace applications any access to PTP clocks whatsoever by giving the PTP chardevs 600 permissions. An example of users running into this limitation is documented in [1]. Additionally, POSIX layer requires WRITE permission even for readonly adjtime() calls which are used in PTP layer to return current frequency offset applied to the PHC.
Add permission checks for functions that modify the state of a PTP device. Continue enforcing permission checks for POSIX clock operations (settime, adjtime) in the POSIX layer. Only require WRITE access for dynamic clocks adjtime() if any flags are set in the modes field.
[1] https://lists.nwtime.org/sympa/arc/linuxptp-users/2024-01/msg00036.html
Changes in v4:
- Require FMODE_WRITE in ajtime() only for calls modifying the clock in any way.
--- drivers/ptp/ptp_chardev.c | 16 ++++++++++++++++ kernel/time/posix-clock.c | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-)
drivers/ptp/ptp_chardev.c +16 -0
@@ -153,6 +153,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_EXTTS_REQUEST :case PTP_EXTTS_REQUEST2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req)); if (copy_from_user(&req.extts, (void __user *)arg,
@@ -194,6 +198,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_PEROUT_REQUEST :case PTP_PEROUT_REQUEST2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req)); if (copy_from_user(&req.perout, (void __user *)arg,
@@ -262,6 +270,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_ENABLE_PPS :case PTP_ENABLE_PPS2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req));if (!capable (CAP_SYS_TIME ))
@@ -400,6 +412,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_PIN_SETFUNC :case PTP_PIN_SETFUNC2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }if (copy_from_user (&pd, (void __user *)arg,sizeof (pd))) { err = -EFAULT ;break ;
kernel/time/posix-clock.c +1 -1
@@ -253,7 +253,7 @@ static int pc_clock_adjtime(clockid_t id, struct __kernel_timex *tx)if (err)return err; -if ((cd.fp->f_mode &FMODE_WRITE ) ==0 ) { +if (tx->modes && (cd.fp->f_mode &FMODE_WRITE ) ==0 ) { err = -EACCES ; goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/254 ptp: add testptp mask test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xabier Marquiegui <[email protected]>
[ Upstream commit 26285e689c6cd2cf3849568c83b2ebe53f467143 ]
Add option to test timestamp event queue mask manipulation in testptp.
Option -F allows the user to specify a single channel that will be applied on the mask filter via IOCTL.
The test program will maintain the file open until user input is received.
This allows checking the effect of the IOCTL in debugfs.
eg:
Console 1:
``` Channel 12 exclusively enabled. Check on debugfs. Press any key to continue ```
Console 2:
``` 0x00000000 0x00000001 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 ```
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
tools/testing/selftests/ptp/testptp.c +18 -1
@@ -121,6 +121,7 @@ static void usage(char *progname)" -d name device to open\n" " -e val read 'val' external time stamp events\n" " -f val adjust the ptp clock frequency by 'val' ppb\n" +" -F chan Enable single channel mask and keep device open for debugfs verification.\n" " -g get the ptp clock time\n" " -h prints this message\n" " -i val index for event/trigger\n"
@@ -187,6 +188,7 @@ int main(int argc, char *argv[])int pps =-1 ;int seconds =0 ;int settime =0 ; +int channel =-1 ;int64_t t1, t2, tp;int64_t interval, offset;
@@ -196,7 +198,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -210,6 +212,9 @@ int main(int argc, char *argv[])case 'f' : adjfreq =atoi (optarg);break ; +case 'F' : + channel =atoi (optarg); +break ;case 'g' : gettime =1 ;break ;
@@ -604,6 +609,18 @@ int main(int argc, char *argv[])free (xts); } +if (channel >=0 ) { +if (ioctl (fd,PTP_MASK_CLEAR_ALL )) { +perror ("PTP_MASK_CLEAR_ALL" ); + }else if (ioctl (fd,PTP_MASK_EN_SINGLE , (unsigned int *)&channel)) { +perror ("PTP_MASK_EN_SINGLE" ); + }else { +printf ("Channel %d exclusively enabled. Check on debugfs.\n" , channel); +printf ("Press any key to continue\n." ); +getchar (); + } + } +close (fd);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/254 selftest/ptp: update ptp selftest to exercise the gettimex options
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Bandewar <[email protected]>
[ Upstream commit 3d07b691ee707c00afaf365440975e81bb96cd9b ]
With the inclusion of commit c259acab839e ("ptp/ioctl: support MONOTONIC{,_RAW} timestamps for PTP_SYS_OFFSET_EXTENDED") clock_gettime() now allows retrieval of pre/post timestamps for CLOCK_MONOTONIC and CLOCK_MONOTONIC_RAW timebases along with the previously supported CLOCK_REALTIME.
This patch adds a command line option 'y' to the testptp program to choose one of the allowed timebases [realtime aka system, monotonic, and monotonic-raw).
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 62 ++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 5 deletions(-)
tools/testing/selftests/ptp/testptp.c +57 -5
@@ -146,6 +146,7 @@ static void usage(char *progname)" -T val set the ptp clock time to 'val' seconds\n" " -x val get an extended ptp clock time with the desired number of samples (up to %d)\n" " -X get a ptp clock cross timestamp\n" +" -y val pre/post tstamp timebase to use {realtime|monotonic|monotonic-raw}\n" " -z test combinations of rising/falling external time stamp flags\n" , progname, PTP_MAX_SAMPLES); }
@@ -189,6 +190,7 @@ int main(int argc, char *argv[])int seconds =0 ;int settime =0 ;int channel =-1 ; +clockid_t ext_clockid =CLOCK_REALTIME ;int64_t t1, t2, tp;int64_t interval, offset;
@@ -198,7 +200,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -278,6 +280,21 @@ int main(int argc, char *argv[])case 'X' : getcross =1 ;break ; +case 'y' : +if (!strcasecmp (optarg,"realtime" )) + ext_clockid =CLOCK_REALTIME ; +else if (!strcasecmp (optarg,"monotonic" )) + ext_clockid =CLOCK_MONOTONIC ; +else if (!strcasecmp (optarg,"monotonic-raw" )) + ext_clockid =CLOCK_MONOTONIC_RAW ; +else { +fprintf (stderr, +"type needs to be realtime, monotonic or monotonic-raw; was given %s\n" , + optarg); +return -1 ; + } +break ; +case 'z' : flagtest =1 ;break ;
@@ -566,6 +583,7 @@ int main(int argc, char *argv[]) } soe->n_samples = getextended; + soe->clockid = ext_clockid;if (ioctl (fd,PTP_SYS_OFFSET_EXTENDED , soe)) {perror ("PTP_SYS_OFFSET_EXTENDED" );
@@ -574,12 +592,46 @@ int main(int argc, char *argv[]) getextended);for (i =0 ; i < getextended; i++) { -printf ("sample #%2d: system time before: %lld.%09u\n" , - i, soe->ts[i][0 ].sec, soe->ts[i][0 ].nsec); +switch (ext_clockid) { +case CLOCK_REALTIME : +printf ("sample #%2d: real time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +case CLOCK_MONOTONIC : +printf ("sample #%2d: monotonic time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +case CLOCK_MONOTONIC_RAW : +printf ("sample #%2d: monotonic-raw time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +default : +break ; + }printf (" phc time: %lld.%09u\n" , soe->ts[i][1 ].sec, soe->ts[i][1 ].nsec); -printf (" system time after: %lld.%09u\n" , - soe->ts[i][2 ].sec, soe->ts[i][2 ].nsec); +switch (ext_clockid) { +case CLOCK_REALTIME : +printf (" real time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +case CLOCK_MONOTONIC : +printf (" monotonic time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +case CLOCK_MONOTONIC_RAW : +printf (" monotonic-raw time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +default : +break ; + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/254 testptp: Add option to open PHC in readonly mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit 76868642e42795353106197abf9c607ad80f4c9e ]
PTP Hardware Clocks no longer require WRITE permission to perform readonly operations, such as listing device capabilities or listening to EXTTS events once they have been enabled by a process with WRITE permissions.
Add '-r' option to testptp to open the PHC in readonly mode instead of the default read-write mode. Skip enabling EXTTS if readonly mode is requested.
--- tools/testing/selftests/ptp/testptp.c | 37 +++++++++++++++++---------- 1 file changed, 23 insertions(+), 14 deletions(-)
tools/testing/selftests/ptp/testptp.c +23 -14
@@ -140,6 +140,7 @@ static void usage(char *progname)" -H val set output phase to 'val' nanoseconds (requires -p)\n" " -w val set output pulse width to 'val' nanoseconds (requires -p)\n" " -P val enable or disable (val=1|0) the system clock PPS\n" +" -r open the ptp clock in readonly mode\n" " -s set the ptp clock time from the system time\n" " -S set the system time from the ptp clock time\n" " -t val shift the ptp clock time by 'val' seconds\n"
@@ -188,6 +189,7 @@ int main(int argc, char *argv[])int pin_index =-1 , pin_func;int pps =-1 ;int seconds =0 ; +int readonly =0 ;int settime =0 ;int channel =-1 ;clockid_t ext_clockid =CLOCK_REALTIME ;
@@ -200,7 +202,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:rsSt:T:w:x:Xy:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -252,6 +254,9 @@ int main(int argc, char *argv[])case 'P' : pps =atoi (optarg);break ; +case 'r' : + readonly =1 ; +break ;case 's' : settime =1 ;break ;
@@ -308,7 +313,7 @@ int main(int argc, char *argv[]) } } - fd =open (device,O_RDWR ); + fd =open (device, readonly ?O_RDONLY :O_RDWR );if (fd <0 ) {fprintf (stderr,"opening %s: %s\n" , device,strerror (errno));return -1 ;
@@ -436,14 +441,16 @@ int main(int argc, char *argv[]) }if (extts) { -memset (&extts_request,0 ,sizeof (extts_request)); - extts_request.index = index; - extts_request.flags =PTP_ENABLE_FEATURE ; -if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { -perror ("PTP_EXTTS_REQUEST" ); - extts =0 ; - }else { -puts ("external time stamp request okay" ); +if (!readonly) { +memset (&extts_request,0 ,sizeof (extts_request)); + extts_request.index = index; + extts_request.flags =PTP_ENABLE_FEATURE ; +if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { +perror ("PTP_EXTTS_REQUEST" ); + extts =0 ; + }else { +puts ("external time stamp request okay" ); + } }for (; extts; extts--) { cnt =read (fd, &event,sizeof (event));
@@ -455,10 +462,12 @@ int main(int argc, char *argv[]) event.t.sec, event.t.nsec);fflush (stdout); } -/* Disable the feature again. */ - extts_request.flags =0 ; -if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { -perror ("PTP_EXTTS_REQUEST" ); +if (!readonly) { +/* Disable the feature again. */ + extts_request.flags =0 ; +if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { +perror ("PTP_EXTTS_REQUEST" ); + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/254 arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 868b979c5328b867c95a6d5a93ba13ad0d3cd2f1 ]
To make sure that power rail is voted for, wire it up to its consumers.
--- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/qcom/sc8280xp.dtsi +12 -4
@@ -4412,8 +4412,12 @@ remoteproc_nsp0: remoteproc@1b300000 { clocks = <&rpmhcc RPMH_CXO_CLK>; clock-names = "xo"; - power-domains = <&rpmhpd SC8280XP_NSP>; - power-domain-names = "nsp"; + power-domains = <&rpmhpd SC8280XP_NSP>, + <&rpmhpd SC8280XP_CX>, + <&rpmhpd SC8280XP_MXC>; + power-domain-names = "nsp", + "cx", + "mxc"; memory-region = <&pil_nsp0_mem>;
@@ -4543,8 +4547,12 @@ remoteproc_nsp1: remoteproc@21300000 { clocks = <&rpmhcc RPMH_CXO_CLK>; clock-names = "xo"; - power-domains = <&rpmhpd SC8280XP_NSP>; - power-domain-names = "nsp"; + power-domains = <&rpmhpd SC8280XP_NSP>, + <&rpmhpd SC8280XP_CX>, + <&rpmhpd SC8280XP_MXC>; + power-domain-names = "nsp", + "cx", + "mxc"; memory-region = <&pil_nsp1_mem>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/254 hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_*
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Das Neves <[email protected]>
[ Upstream commit 0e3f7d120086c8b9d6e1ae0dd4917fc529daa1ca ]
The HV_REGISTER_ are used as arguments to hv_set/get_register(), which delegate to arch-specific mechanisms for getting/setting synthetic Hyper-V MSRs.
On arm64, HV_REGISTER_ defines are synthetic VP registers accessed via the get/set vp registers hypercalls. The naming matches the TLFS document, although these register names are not specific to arm64.
However, on x86 the prefix HV_REGISTER_ indicates Hyper-V MSRs accessed via rdmsrl()/wrmsrl(). This is not consistent with the TLFS doc, where HV_REGISTER_ is *only* used for used for VP register names used by the get/set register hypercalls.
To fix this inconsistency and prevent future confusion, change the arch-generic aliases used by callers of hv_set/get_register() to have the prefix HV_MSR_ instead of HV_REGISTER_.
Use the prefix HV_X64_MSR_ for the x86-only Hyper-V MSRs. On x86, the generic HV_MSR_'s point to the corresponding HV_X64_MSR_.
Move the arm64 HV_REGISTER_* defines to the asm-generic hyperv-tlfs.h, since these are not specific to arm64. On arm64, the generic HV_MSR_'s point to the corresponding HV_REGISTER_.
While at it, rename hv_get/set_registers() and related functions to hv_get/set_msr(), hv_get/set_nested_msr(), etc. These are only used for Hyper-V MSRs and this naming makes that clear.
Message-ID: <1708440933-27125-1-git-send-email-nunodasneves@linux.microsoft.com>
Stable-dep-of: 49f49d47af67 ("Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()")
--- arch/arm64/include/asm/hyperv-tlfs.h | 45 ++++----- arch/arm64/include/asm/mshyperv.h | 4 +- arch/x86/hyperv/hv_init.c | 8 +- arch/x86/include/asm/hyperv-tlfs.h | 145 ++++++++++++++------------- arch/x86/include/asm/mshyperv.h | 30 +++--- arch/x86/kernel/cpu/mshyperv.c | 56 +++++------ drivers/clocksource/hyperv_timer.c | 26 ++--- drivers/hv/hv.c | 36 +++---- drivers/hv/hv_common.c | 22 ++-- include/asm-generic/hyperv-tlfs.h | 32 +++++- include/asm-generic/mshyperv.h | 2 +- 11 files changed, 216 insertions(+), 190 deletions(-)
arch/arm64/include/asm/hyperv-tlfs.h +19 -26
@@ -21,14 +21,6 @@* byte ordering of Linux running on ARM64, so no special handling is required. */ -/* -* These Hyper-V registers provide information equivalent to the CPUID -* instruction on x86/x64. -*/ -#define HV_REGISTER_HYPERVISOR_VERSION 0x00000100/*CPUID 0x40000002 */ -#define HV_REGISTER_FEATURES 0x00000200/*CPUID 0x40000003 */ -#define HV_REGISTER_ENLIGHTENMENTS 0x00000201/*CPUID 0x40000004 */ -/* * Group C Features. See the asm-generic version of hyperv-tlfs.h * for a description of Feature Groups.
@@ -41,28 +33,29 @@#define HV_STIMER_DIRECT_MODE_AVAILABLE BIT(13)/* -* Synthetic register definitions equivalent to MSRs on x86/x64 +* To support arch-generic code calling hv_set/get_register: +* - On x86, HV_MSR_ indicates an MSR accessed via rdmsrl/wrmsrl +* - On ARM, HV_MSR_ indicates a VP register accessed via hypercall */ -#define HV_REGISTER_CRASH_P0 0x00000210 -#define HV_REGISTER_CRASH_P1 0x00000211 -#define HV_REGISTER_CRASH_P2 0x00000212 -#define HV_REGISTER_CRASH_P3 0x00000213 -#define HV_REGISTER_CRASH_P4 0x00000214 -#define HV_REGISTER_CRASH_CTL 0x00000215 +#define HV_MSR_CRASH_P0 (HV_REGISTER_CRASH_P0) +#define HV_MSR_CRASH_P1 (HV_REGISTER_CRASH_P1) +#define HV_MSR_CRASH_P2 (HV_REGISTER_CRASH_P2) +#define HV_MSR_CRASH_P3 (HV_REGISTER_CRASH_P3) +#define HV_MSR_CRASH_P4 (HV_REGISTER_CRASH_P4) +#define HV_MSR_CRASH_CTL (HV_REGISTER_CRASH_CTL) -#define HV_REGISTER_GUEST_OSID 0x00090002 -#define HV_REGISTER_VP_INDEX 0x00090003 -#define HV_REGISTER_TIME_REF_COUNT 0x00090004 -#define HV_REGISTER_REFERENCE_TSC 0x00090017 +#define HV_MSR_VP_INDEX (HV_REGISTER_VP_INDEX) +#define HV_MSR_TIME_REF_COUNT (HV_REGISTER_TIME_REF_COUNT) +#define HV_MSR_REFERENCE_TSC (HV_REGISTER_REFERENCE_TSC) -#define HV_REGISTER_SINT0 0x000A0000 -#define HV_REGISTER_SCONTROL 0x000A0010 -#define HV_REGISTER_SIEFP 0x000A0012 -#define HV_REGISTER_SIMP 0x000A0013 -#define HV_REGISTER_EOM 0x000A0014 +#define HV_MSR_SINT0 (HV_REGISTER_SINT0) +#define HV_MSR_SCONTROL (HV_REGISTER_SCONTROL) +#define HV_MSR_SIEFP (HV_REGISTER_SIEFP) +#define HV_MSR_SIMP (HV_REGISTER_SIMP) +#define HV_MSR_EOM (HV_REGISTER_EOM) -#define HV_REGISTER_STIMER0_CONFIG 0x000B0000 -#define HV_REGISTER_STIMER0_COUNT 0x000B0001 +#define HV_MSR_STIMER0_CONFIG (HV_REGISTER_STIMER0_CONFIG) +#define HV_MSR_STIMER0_COUNT (HV_REGISTER_STIMER0_COUNT)union hv_msi_entry {u64 as_uint64[2 ];
arch/arm64/include/asm/mshyperv.h +2 -2
@@ -31,12 +31,12 @@ void hv_set_vpreg(u32 reg, u64 value);u64 hv_get_vpreg (u32 reg);void hv_get_vpreg_128 (u32 reg,struct hv_get_vp_registers_output *result); -static inline void hv_set_register (unsigned int reg,u64 value) +static inline void hv_set_msr (unsigned int reg,u64 value) {hv_set_vpreg (reg, value); } -static inline u64 hv_get_register (unsigned int reg) +static inline u64 hv_get_msr (unsigned int reg) {return hv_get_vpreg (reg); }
arch/x86/hyperv/hv_init.c +4 -4
@@ -664,14 +664,14 @@ void hyperv_cleanup(void) hv_hypercall_pg =NULL ;/* Reset the hypercall page */ - hypercall_msr.as_uint64 =hv_get_register (HV_X64_MSR_HYPERCALL ); + hypercall_msr.as_uint64 =hv_get_msr (HV_X64_MSR_HYPERCALL ); hypercall_msr.enable =0 ; -hv_set_register (HV_X64_MSR_HYPERCALL , hypercall_msr.as_uint64); +hv_set_msr (HV_X64_MSR_HYPERCALL , hypercall_msr.as_uint64);/* Reset the TSC page */ - tsc_msr.as_uint64 =hv_get_register (HV_X64_MSR_REFERENCE_TSC ); + tsc_msr.as_uint64 =hv_get_msr (HV_X64_MSR_REFERENCE_TSC ); tsc_msr.enable =0 ; -hv_set_register (HV_X64_MSR_REFERENCE_TSC , tsc_msr.as_uint64); +hv_set_msr (HV_X64_MSR_REFERENCE_TSC , tsc_msr.as_uint64); }void hyperv_report_panic (struct pt_regs *regs,long err,bool in_die)
arch/x86/include/asm/hyperv-tlfs.h +76 -69
185 lines not on this page · raw message
arch/x86/include/asm/mshyperv.h +15 -15
@@ -292,24 +292,24 @@ static inline void hv_ivm_msr_write(u64 msr, u64 value) {}static inline void hv_ivm_msr_read (u64 msr,u64 *value) {}#endif -static inline bool hv_is_synic_reg (unsigned int reg) +static inline bool hv_is_synic_msr (unsigned int reg) { -return (reg >=HV_REGISTER_SCONTROL ) && - (reg <=HV_REGISTER_SINT15 ); +return (reg >=HV_X64_MSR_SCONTROL ) && + (reg <=HV_X64_MSR_SINT15 ); } -static inline bool hv_is_sint_reg (unsigned int reg) +static inline bool hv_is_sint_msr (unsigned int reg) { -return (reg >=HV_REGISTER_SINT0 ) && - (reg <=HV_REGISTER_SINT15 ); +return (reg >=HV_X64_MSR_SINT0 ) && + (reg <=HV_X64_MSR_SINT15 ); } -u64 hv_get_register (unsigned int reg); -void hv_set_register (unsigned int reg,u64 value); -u64 hv_get_non_nested_register (unsigned int reg); -void hv_set_non_nested_register (unsigned int reg,u64 value); +u64 hv_get_msr (unsigned int reg); +void hv_set_msr (unsigned int reg,u64 value); +u64 hv_get_non_nested_msr (unsigned int reg); +void hv_set_non_nested_msr (unsigned int reg,u64 value); -static __always_inline u64 hv_raw_get_register(unsigned int reg) +static __always_inline u64 hv_raw_get_msr(unsigned int reg) {return __rdmsr (reg); }
@@ -330,10 +330,10 @@ static inline int hyperv_flush_guest_mapping_range(u64 as, {return -1 ; } -static inline void hv_set_register (unsigned int reg,u64 value) { } -static inline u64 hv_get_register (unsigned int reg) {return 0 ; } -static inline void hv_set_non_nested_register (unsigned int reg,u64 value) { } -static inline u64 hv_get_non_nested_register (unsigned int reg) {return 0 ; } +static inline void hv_set_msr (unsigned int reg,u64 value) { } +static inline u64 hv_get_msr (unsigned int reg) {return 0 ; } +static inline void hv_set_non_nested_msr (unsigned int reg,u64 value) { } +static inline u64 hv_get_non_nested_msr (unsigned int reg) {return 0 ; }#endif /* CONFIG_HYPERV */
arch/x86/kernel/cpu/mshyperv.c +28 -28
98 lines not on this page · raw message
drivers/clocksource/hyperv_timer.c +13 -13
@@ -82,14 +82,14 @@ static int hv_ce_set_next_event(unsigned long delta, current_tick =hv_read_reference_counter (); current_tick += delta; -hv_set_register (HV_REGISTER_STIMER0_COUNT , current_tick); +hv_set_msr (HV_MSR_STIMER0_COUNT , current_tick);return 0 ; }static int hv_ce_shutdown (struct clock_event_device *evt) { -hv_set_register (HV_REGISTER_STIMER0_COUNT ,0 ); -hv_set_register (HV_REGISTER_STIMER0_CONFIG ,0 ); +hv_set_msr (HV_MSR_STIMER0_COUNT ,0 ); +hv_set_msr (HV_MSR_STIMER0_CONFIG ,0 );if (direct_mode_enabled && stimer0_irq >=0 )disable_percpu_irq (stimer0_irq);
@@ -120,7 +120,7 @@ static int hv_ce_set_oneshot(struct clock_event_device *evt) timer_cfg.direct_mode =0 ; timer_cfg.sintx = stimer0_message_sint; } -hv_set_register (HV_REGISTER_STIMER0_CONFIG , timer_cfg.as_uint64); +hv_set_msr (HV_MSR_STIMER0_CONFIG , timer_cfg.as_uint64);return 0 ; }
@@ -373,11 +373,11 @@ static __always_inline u64 read_hv_clock_msr(void)* is set to 0 when the partition is created and is incremented in 100 * nanosecond units. * -* Use hv_raw_get_register() because this function is used from -* noinstr. Notable; while HV_REGISTER_TIME_REF_COUNT is a synthetic +* Use hv_raw_get_msr() because this function is used from +* noinstr. Notable; while HV_MSR_TIME_REF_COUNT is a synthetic * register it doesn't need the GHCB path. */ -return hv_raw_get_register (HV_REGISTER_TIME_REF_COUNT ); +return hv_raw_get_msr (HV_MSR_TIME_REF_COUNT ); }/*
@@ -440,9 +440,9 @@ static void suspend_hv_clock_tsc(struct clocksource *arg)union hv_reference_tsc_msr tsc_msr;/* Disable the TSC page */ - tsc_msr.as_uint64 =hv_get_register (HV_REGISTER_REFERENCE_TSC ); + tsc_msr.as_uint64 =hv_get_msr (HV_MSR_REFERENCE_TSC ); tsc_msr.enable =0 ; -hv_set_register (HV_REGISTER_REFERENCE_TSC , tsc_msr.as_uint64); +hv_set_msr (HV_MSR_REFERENCE_TSC , tsc_msr.as_uint64); }
@@ -451,10 +451,10 @@ static void resume_hv_clock_tsc(struct clocksource *arg)union hv_reference_tsc_msr tsc_msr;/* Re-enable the TSC page */ - tsc_msr.as_uint64 =hv_get_register (HV_REGISTER_REFERENCE_TSC ); + tsc_msr.as_uint64 =hv_get_msr (HV_MSR_REFERENCE_TSC ); tsc_msr.enable =1 ; tsc_msr.pfn = tsc_pfn; -hv_set_register (HV_REGISTER_REFERENCE_TSC , tsc_msr.as_uint64); +hv_set_msr (HV_MSR_REFERENCE_TSC , tsc_msr.as_uint64); }/*
@@ -567,14 +567,14 @@ static void __init hv_init_tsc_clocksource(void)* thus TSC clocksource will work even without the real TSC page * mapped. */ - tsc_msr.as_uint64 =hv_get_register (HV_REGISTER_REFERENCE_TSC ); + tsc_msr.as_uint64 =hv_get_msr (HV_MSR_REFERENCE_TSC );if (hv_root_partition) tsc_pfn = tsc_msr.pfn;else tsc_pfn =HVPFN_DOWN (virt_to_phys (tsc_page)); tsc_msr.enable =1 ; tsc_msr.pfn = tsc_pfn; -hv_set_register (HV_REGISTER_REFERENCE_TSC , tsc_msr.as_uint64); +hv_set_msr (HV_MSR_REFERENCE_TSC , tsc_msr.as_uint64);clocksource_register_hz (&hyperv_cs_tsc,NSEC_PER_SEC /100 );
drivers/hv/hv.c +16 -20
@@ -270,7 +270,7 @@ void hv_synic_enable_regs(unsigned int cpu)union hv_synic_scontrol sctrl;/* Setup the Synic's message page */ - simp.as_uint64 =hv_get_register (HV_REGISTER_SIMP ); + simp.as_uint64 =hv_get_msr (HV_MSR_SIMP ); simp.simp_enabled =1 ;if (ms_hyperv.paravisor_present || hv_root_partition) {
@@ -286,10 +286,10 @@ void hv_synic_enable_regs(unsigned int cpu) >> HV_HYP_PAGE_SHIFT; } -hv_set_register (HV_REGISTER_SIMP , simp.as_uint64); +hv_set_msr (HV_MSR_SIMP , simp.as_uint64);/* Setup the Synic's event page */ - siefp.as_uint64 =hv_get_register (HV_REGISTER_SIEFP ); + siefp.as_uint64 =hv_get_msr (HV_MSR_SIEFP ); siefp.siefp_enabled =1 ;if (ms_hyperv.paravisor_present || hv_root_partition) {
@@ -305,13 +305,12 @@ void hv_synic_enable_regs(unsigned int cpu) >> HV_HYP_PAGE_SHIFT; } -hv_set_register (HV_REGISTER_SIEFP , siefp.as_uint64); +hv_set_msr (HV_MSR_SIEFP , siefp.as_uint64);/* Setup the shared SINT. */ if (vmbus_irq !=-1 )enable_percpu_irq (vmbus_irq,0 ); - shared_sint.as_uint64 =hv_get_register (HV_REGISTER_SINT0 + -VMBUS_MESSAGE_SINT ); + shared_sint.as_uint64 =hv_get_msr (HV_MSR_SINT0 +VMBUS_MESSAGE_SINT ); shared_sint.vector = vmbus_interrupt; shared_sint.masked = false;
@@ -326,14 +325,13 @@ void hv_synic_enable_regs(unsigned int cpu)#else shared_sint.auto_eoi =0 ;#endif -hv_set_register (HV_REGISTER_SINT0 +VMBUS_MESSAGE_SINT , - shared_sint.as_uint64); +hv_set_msr (HV_MSR_SINT0 +VMBUS_MESSAGE_SINT , shared_sint.as_uint64);/* Enable the global synic bit */ - sctrl.as_uint64 =hv_get_register (HV_REGISTER_SCONTROL ); + sctrl.as_uint64 =hv_get_msr (HV_MSR_SCONTROL ); sctrl.enable =1 ; -hv_set_register (HV_REGISTER_SCONTROL , sctrl.as_uint64); +hv_set_msr (HV_MSR_SCONTROL , sctrl.as_uint64); }int hv_synic_init (unsigned int cpu)
@@ -357,17 +355,15 @@ void hv_synic_disable_regs(unsigned int cpu)union hv_synic_siefp siefp;union hv_synic_scontrol sctrl; - shared_sint.as_uint64 =hv_get_register (HV_REGISTER_SINT0 + -VMBUS_MESSAGE_SINT ); + shared_sint.as_uint64 =hv_get_msr (HV_MSR_SINT0 +VMBUS_MESSAGE_SINT ); shared_sint.masked =1 ;/* Need to correctly cleanup in the case of SMP!!! */ /* Disable the interrupt */ -hv_set_register (HV_REGISTER_SINT0 +VMBUS_MESSAGE_SINT , - shared_sint.as_uint64); +hv_set_msr (HV_MSR_SINT0 +VMBUS_MESSAGE_SINT , shared_sint.as_uint64); - simp.as_uint64 =hv_get_register (HV_REGISTER_SIMP ); + simp.as_uint64 =hv_get_msr (HV_MSR_SIMP );/* * In Isolation VM, sim and sief pages are allocated by * paravisor. These pages also will be used by kdump
@@ -382,9 +378,9 @@ void hv_synic_disable_regs(unsigned int cpu) simp.base_simp_gpa =0 ; } -hv_set_register (HV_REGISTER_SIMP , simp.as_uint64); +hv_set_msr (HV_MSR_SIMP , simp.as_uint64); - siefp.as_uint64 =hv_get_register (HV_REGISTER_SIEFP ); + siefp.as_uint64 =hv_get_msr (HV_MSR_SIEFP ); siefp.siefp_enabled =0 ;if (ms_hyperv.paravisor_present || hv_root_partition) {
@@ -394,12 +390,12 @@ void hv_synic_disable_regs(unsigned int cpu) siefp.base_siefp_gpa =0 ; } -hv_set_register (HV_REGISTER_SIEFP , siefp.as_uint64); +hv_set_msr (HV_MSR_SIEFP , siefp.as_uint64);/* Disable the global synic bit */ - sctrl.as_uint64 =hv_get_register (HV_REGISTER_SCONTROL ); + sctrl.as_uint64 =hv_get_msr (HV_MSR_SCONTROL ); sctrl.enable =0 ; -hv_set_register (HV_REGISTER_SCONTROL , sctrl.as_uint64); +hv_set_msr (HV_MSR_SCONTROL , sctrl.as_uint64);if (vmbus_irq !=-1 )disable_percpu_irq (vmbus_irq);
drivers/hv/hv_common.c +11 -11
@@ -228,19 +228,19 @@ static void hv_kmsg_dump(struct kmsg_dumper *dumper,* contain the size of the panic data in that page. Rest of the * registers are no-op when the NOTIFY_MSG flag is set. */ -hv_set_register (HV_REGISTER_CRASH_P0 ,0 ); -hv_set_register (HV_REGISTER_CRASH_P1 ,0 ); -hv_set_register (HV_REGISTER_CRASH_P2 ,0 ); -hv_set_register (HV_REGISTER_CRASH_P3 ,virt_to_phys (hv_panic_page)); -hv_set_register (HV_REGISTER_CRASH_P4 , bytes_written); +hv_set_msr (HV_MSR_CRASH_P0 ,0 ); +hv_set_msr (HV_MSR_CRASH_P1 ,0 ); +hv_set_msr (HV_MSR_CRASH_P2 ,0 ); +hv_set_msr (HV_MSR_CRASH_P3 ,virt_to_phys (hv_panic_page)); +hv_set_msr (HV_MSR_CRASH_P4 , bytes_written);/* * Let Hyper-V know there is crash data available along with * the panic message. */ -hv_set_register (HV_REGISTER_CRASH_CTL , - (HV_CRASH_CTL_CRASH_NOTIFY | -HV_CRASH_CTL_CRASH_NOTIFY_MSG )); +hv_set_msr (HV_MSR_CRASH_CTL , + (HV_CRASH_CTL_CRASH_NOTIFY | +HV_CRASH_CTL_CRASH_NOTIFY_MSG )); }static struct kmsg_dumper hv_kmsg_dumper = {
@@ -311,7 +311,7 @@ int __init hv_common_init(void)* Register for panic kmsg callback only if the right * capability is supported by the hypervisor. */ - hyperv_crash_ctl =hv_get_register (HV_REGISTER_CRASH_CTL ); + hyperv_crash_ctl =hv_get_msr (HV_MSR_CRASH_CTL );if (hyperv_crash_ctl &HV_CRASH_CTL_CRASH_NOTIFY_MSG )hv_kmsg_dump_register ();
@@ -410,7 +410,7 @@ int hv_common_cpu_init(unsigned int cpu) *inputarg = mem; } - msr_vp_index =hv_get_register (HV_REGISTER_VP_INDEX ); + msr_vp_index =hv_get_msr (HV_MSR_VP_INDEX ); hv_vp_index[cpu] = msr_vp_index;
@@ -507,7 +507,7 @@ EXPORT_SYMBOL_GPL(hv_is_hibernation_supported);*/ static u64 __hv_read_ref_counter (void ) { -return hv_get_register (HV_REGISTER_TIME_REF_COUNT ); +return hv_get_msr (HV_MSR_TIME_REF_COUNT ); }u64 (*hv_read_reference_counter)(void) = __hv_read_ref_counter;
include/asm-generic/hyperv-tlfs.h +31 -1
@@ -625,6 +625,37 @@ struct hv_retarget_device_interrupt {struct hv_device_interrupt_target int_target; } __packed__aligned(8) ; +/* +* These Hyper-V registers provide information equivalent to the CPUID +* instruction on x86/x64. +*/ +#define HV_REGISTER_HYPERVISOR_VERSION 0x00000100/*CPUID 0x40000002 */ +#define HV_REGISTER_FEATURES 0x00000200/*CPUID 0x40000003 */ +#define HV_REGISTER_ENLIGHTENMENTS 0x00000201/*CPUID 0x40000004 */ + +/* +* Synthetic register definitions equivalent to MSRs on x86/x64 +*/ +#define HV_REGISTER_CRASH_P0 0x00000210 +#define HV_REGISTER_CRASH_P1 0x00000211 +#define HV_REGISTER_CRASH_P2 0x00000212 +#define HV_REGISTER_CRASH_P3 0x00000213 +#define HV_REGISTER_CRASH_P4 0x00000214 +#define HV_REGISTER_CRASH_CTL 0x00000215 + +#define HV_REGISTER_GUEST_OSID 0x00090002 +#define HV_REGISTER_VP_INDEX 0x00090003 +#define HV_REGISTER_TIME_REF_COUNT 0x00090004 +#define HV_REGISTER_REFERENCE_TSC 0x00090017 + +#define HV_REGISTER_SINT0 0x000A0000 +#define HV_REGISTER_SCONTROL 0x000A0010 +#define HV_REGISTER_SIEFP 0x000A0012 +#define HV_REGISTER_SIMP 0x000A0013 +#define HV_REGISTER_EOM 0x000A0014 + +#define HV_REGISTER_STIMER0_CONFIG 0x000B0000 +#define HV_REGISTER_STIMER0_COUNT 0x000B0001/* HvGetVpRegisters hypercall input with variable size reg name list*/ struct hv_get_vp_registers_input {
@@ -640,7 +671,6 @@ struct hv_get_vp_registers_input { } element[]; } __packed; -/* HvGetVpRegisters returns an array of these output elements */ struct hv_get_vp_registers_output { union {
include/asm-generic/mshyperv.h +1 -1
@@ -157,7 +157,7 @@ static inline void vmbus_signal_eom(struct hv_message *msg, u32 old_msg_type)* possibly deliver another msg from the * hypervisor */ -hv_set_register (HV_REGISTER_EOM ,0 ); +hv_set_msr (HV_MSR_EOM ,0 ); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/254 Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 49f49d47af67f8a7b221db1d758fc634242dc91a ]
hv_kmsg_dump() currently skips the panic notification entirely if it doesn't get any message bytes to pass to Hyper-V due to an error from kmsg_dump_get_buffer(). Skipping the notification is undesirable because it leaves the Hyper-V host uncertain about the state of a panic'ed guest.
Fix this by always doing the panic notification, even if bytes_written is zero. Also ensure that bytes_written is initialized, which fixes a kernel test robot warning. The warning is actually bogus because kmsg_dump_get_buffer() happens to set bytes_written even if it fails, and in the kernel test robot's CONFIG_PRINTK not set case, hv_kmsg_dump() is never called. But do the initialization for robustness and to quiet the static checker.
--- drivers/hv/hv_common.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/hv/hv_common.c +7 -5
@@ -216,13 +216,15 @@ static void hv_kmsg_dump(struct kmsg_dumper *dumper,/* * Write dump contents to the page. No need to synchronize; panic should -* be single-threaded. +* be single-threaded. Ignore failures from kmsg_dump_get_buffer() since +* panic notification should be done even if there is no message data. +* Don't assume bytes_written is set in case of failure, so initialize it. */ kmsg_dump_rewind (&iter); -kmsg_dump_get_buffer (&iter, false, hv_panic_page,HV_HYP_PAGE_SIZE , + bytes_written =0 ; + (void )kmsg_dump_get_buffer (&iter, false, hv_panic_page,HV_HYP_PAGE_SIZE , &bytes_written); -if (!bytes_written) -return ; +/* * P3 to contain the physical address of the panic page & P4 to * contain the size of the panic data in that page. Rest of the
@@ -231,7 +233,7 @@ static void hv_kmsg_dump(struct kmsg_dumper *dumper,hv_set_msr (HV_MSR_CRASH_P0 ,0 );hv_set_msr (HV_MSR_CRASH_P1 ,0 );hv_set_msr (HV_MSR_CRASH_P2 ,0 ); -hv_set_msr (HV_MSR_CRASH_P3 ,virt_to_phys (hv_panic_page)); +hv_set_msr (HV_MSR_CRASH_P3 , bytes_written ?virt_to_phys (hv_panic_page) :0 );hv_set_msr (HV_MSR_CRASH_P4 , bytes_written);/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/254 btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit 1d8f69f453c2e8a2d99b158e58e02ed65031fa6d ]
When the BLOCK_GROUP_TREE compat_ro flag is set, the extent root and csum root fields are getting missed.
This is because EXTENT_TREE_V2 treated these differently, and when they were split off this special-casing was mistakenly assigned to BGT rather than the rump EXTENT_TREE_V2. There's no reason why the existence of the block group tree should mean that we don't record the details of the last commit's extent root and csum root.
Fix the code in backup_super_roots() so that the correct check gets made.
--- fs/btrfs/disk-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/disk-io.c +1 -1
@@ -1654,7 +1654,7 @@ static void backup_super_roots(struct btrfs_fs_info *info)btrfs_set_backup_chunk_root_level (root_backup,btrfs_header_level (info->chunk_root->node)); -if (!btrfs_fs_compat_ro (info,BLOCK_GROUP_TREE )) { +if (!btrfs_fs_incompat (info,EXTENT_TREE_V2 )) {struct btrfs_root *extent_root =btrfs_extent_root (info,0 );struct btrfs_root *csum_root =btrfs_csum_root (info,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/254 dt-bindings: power: qcom,rpmpd: Add SM7150
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Tikhonov <[email protected]>
[ Upstream commit 0cd3f86ad558d3f585634e211c6fccbe786cbc28 ]
Add a compatible for SM7150 platforms.
Stable-dep-of: 45e1be5ddec9 ("dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO")
--- Documentation/devicetree/bindings/power/qcom,rpmpd.yaml | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/power/qcom,rpmpd.yaml +1 -0
@@ -46,6 +46,7 @@ properties: - qcom,sm6125-rpmpd - qcom,sm6350-rpmhpd - qcom,sm6375-rpmpd + - qcom,sm7150-rpmhpd - qcom,sm8150-rpmhpd - qcom,sm8250-rpmhpd - qcom,sm8350-rpmhpd
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/254 dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Otto Pflüger <[email protected]>
[ Upstream commit 61848698288d93a230cab9c0585e726df66f2402 ]
The MSM8917, MSM8937 and QM215 SoCs have VDDCX and VDDMX power domains controlled in voltage level mode. Define the MSM8937 and QM215 power domains as aliases because these SoCs are similar to MSM8917 and may share some parts of the device tree.
Also add the compatibles for these SoCs to the documentation, with qcom,msm8937-rpmpd using qcom,msm8917-rpmpd as a fallback compatible because there are no known differences. QM215 is not compatible with these because it uses different regulators.
Stable-dep-of: 45e1be5ddec9 ("dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO")
--- .../devicetree/bindings/power/qcom,rpmpd.yaml | 81 ++++++++++--------- include/dt-bindings/power/qcom-rpmpd.h | 21 +++++ 2 files changed, 65 insertions(+), 37 deletions(-)
Documentation/devicetree/bindings/power/qcom,rpmpd.yaml +44 -37
@@ -15,43 +15,50 @@ description: properties: compatible: - enum: - - qcom,mdm9607-rpmpd - - qcom,msm8226-rpmpd - - qcom,msm8909-rpmpd - - qcom,msm8916-rpmpd - - qcom,msm8939-rpmpd - - qcom,msm8953-rpmpd - - qcom,msm8976-rpmpd - - qcom,msm8994-rpmpd - - qcom,msm8996-rpmpd - - qcom,msm8998-rpmpd - - qcom,qcm2290-rpmpd - - qcom,qcs404-rpmpd - - qcom,qdu1000-rpmhpd - - qcom,sa8155p-rpmhpd - - qcom,sa8540p-rpmhpd - - qcom,sa8775p-rpmhpd - - qcom,sdm660-rpmpd - - qcom,sc7180-rpmhpd - - qcom,sc7280-rpmhpd - - qcom,sc8180x-rpmhpd - - qcom,sc8280xp-rpmhpd - - qcom,sdm670-rpmhpd - - qcom,sdm845-rpmhpd - - qcom,sdx55-rpmhpd - - qcom,sdx65-rpmhpd - - qcom,sdx75-rpmhpd - - qcom,sm6115-rpmpd - - qcom,sm6125-rpmpd - - qcom,sm6350-rpmhpd - - qcom,sm6375-rpmpd - - qcom,sm7150-rpmhpd - - qcom,sm8150-rpmhpd - - qcom,sm8250-rpmhpd - - qcom,sm8350-rpmhpd - - qcom,sm8450-rpmhpd - - qcom,sm8550-rpmhpd + oneOf: + - enum: + - qcom,mdm9607-rpmpd + - qcom,msm8226-rpmpd + - qcom,msm8909-rpmpd + - qcom,msm8916-rpmpd + - qcom,msm8917-rpmpd + - qcom,msm8939-rpmpd + - qcom,msm8953-rpmpd + - qcom,msm8976-rpmpd + - qcom,msm8994-rpmpd + - qcom,msm8996-rpmpd + - qcom,msm8998-rpmpd + - qcom,qcm2290-rpmpd + - qcom,qcs404-rpmpd + - qcom,qdu1000-rpmhpd + - qcom,qm215-rpmpd + - qcom,sa8155p-rpmhpd + - qcom,sa8540p-rpmhpd + - qcom,sa8775p-rpmhpd + - qcom,sc7180-rpmhpd + - qcom,sc7280-rpmhpd + - qcom,sc8180x-rpmhpd + - qcom,sc8280xp-rpmhpd + - qcom,sdm660-rpmpd + - qcom,sdm670-rpmhpd + - qcom,sdm845-rpmhpd + - qcom,sdx55-rpmhpd + - qcom,sdx65-rpmhpd + - qcom,sdx75-rpmhpd + - qcom,sm6115-rpmpd + - qcom,sm6125-rpmpd + - qcom,sm6350-rpmhpd + - qcom,sm6375-rpmpd + - qcom,sm7150-rpmhpd + - qcom,sm8150-rpmhpd + - qcom,sm8250-rpmhpd + - qcom,sm8350-rpmhpd + - qcom,sm8450-rpmhpd + - qcom,sm8550-rpmhpd + - items: + - enum: + - qcom,msm8937-rpmpd + - const: qcom,msm8917-rpmpd '#power-domain-cells': const: 1
include/dt-bindings/power/qcom-rpmpd.h +21 -0
@@ -278,6 +278,27 @@#define MSM8909_VDDMX MSM8916_VDDMX#define MSM8909_VDDMX_AO MSM8916_VDDMX_AO +/* MSM8917 Power Domain Indexes */ +#define MSM8917_VDDCX 0 +#define MSM8917_VDDCX_AO 1 +#define MSM8917_VDDCX_VFL 2 +#define MSM8917_VDDMX 3 +#define MSM8917_VDDMX_AO 4 + +/* MSM8937 Power Domain Indexes */ +#define MSM8937_VDDCX MSM8917_VDDCX +#define MSM8937_VDDCX_AO MSM8917_VDDCX_AO +#define MSM8937_VDDCX_VFL MSM8917_VDDCX_VFL +#define MSM8937_VDDMX MSM8917_VDDMX +#define MSM8937_VDDMX_AO MSM8917_VDDMX_AO + +/* QM215 Power Domain Indexes */ +#define QM215_VDDCX MSM8917_VDDCX +#define QM215_VDDCX_AO MSM8917_VDDCX_AO +#define QM215_VDDCX_VFL MSM8917_VDDCX_VFL +#define QM215_VDDMX MSM8917_VDDMX +#define QM215_VDDMX_AO MSM8917_VDDMX_AO +/* MSM8953 Power Domain Indexes */ #define MSM8953_VDDMD 0#define MSM8953_VDDMD_AO 1
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/254 dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit d4d56c079ddd19293b11de1f2309add0b8972af2 ]
Document the RPMh Power Domains on the SM8650 Platform.
Stable-dep-of: 45e1be5ddec9 ("dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO")
--- Documentation/devicetree/bindings/power/qcom,rpmpd.yaml | 1 + include/dt-bindings/power/qcom,rpmhpd.h | 1 + 2 files changed, 2 insertions(+)
Documentation/devicetree/bindings/power/qcom,rpmpd.yaml +1 -0
@@ -55,6 +55,7 @@ properties: - qcom,sm8350-rpmhpd - qcom,sm8450-rpmhpd - qcom,sm8550-rpmhpd + - qcom,sm8650-rpmhpd - items: - enum: - qcom,msm8937-rpmpd
include/dt-bindings/power/qcom,rpmhpd.h +1 -0
@@ -26,5 +26,6 @@#define RPMHPD_QPHY 16#define RPMHPD_DDR 17#define RPMHPD_XO 18 +#define RPMHPD_NSP2 19#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/254 dt-bindings: power: rpmpd: Update part number to X1E80100
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
[ Upstream commit 3d123f513af055b4c085b555f9c856bbd7390536 ]
There was a recent part number update from SC8380XP to X1E80100 and as a result of which the SC8380xp rpmpd bindings introduced is no longer correct. Given that it currently has no users, it was agreed that it can be updated to the correct part number (X1E80100) without causing any binding breakage.
Stable-dep-of: 45e1be5ddec9 ("dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO")
--- Documentation/devicetree/bindings/power/qcom,rpmpd.yaml | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/power/qcom,rpmpd.yaml +1 -0
@@ -56,6 +56,7 @@ properties: - qcom,sm8450-rpmhpd - qcom,sm8550-rpmhpd - qcom,sm8650-rpmhpd + - qcom,x1e80100-rpmhpd - items: - enum: - qcom,msm8937-rpmpd
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/254 dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taniya Das <[email protected]>
[ Upstream commit 134e9d035d830aabd1121bcda89f7ee9a476d3a3 ]
Document the RPMh Power Domains on the SM8750 Platform.
Message-ID: <[email protected]>
Stable-dep-of: 45e1be5ddec9 ("dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO")
--- Documentation/devicetree/bindings/power/qcom,rpmpd.yaml | 1 + include/dt-bindings/power/qcom-rpmpd.h | 2 ++ 2 files changed, 3 insertions(+)
Documentation/devicetree/bindings/power/qcom,rpmpd.yaml +1 -0
@@ -56,6 +56,7 @@ properties: - qcom,sm8450-rpmhpd - qcom,sm8550-rpmhpd - qcom,sm8650-rpmhpd + - qcom,sm8750-rpmhpd - qcom,x1e80100-rpmhpd - items: - enum:
include/dt-bindings/power/qcom-rpmpd.h +2 -0
@@ -218,6 +218,7 @@/* SDM845 Power Domain performance levels */ #define RPMH_REGULATOR_LEVEL_RETENTION 16#define RPMH_REGULATOR_LEVEL_MIN_SVS 48 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D3 50#define RPMH_REGULATOR_LEVEL_LOW_SVS_D2 52#define RPMH_REGULATOR_LEVEL_LOW_SVS_D1 56#define RPMH_REGULATOR_LEVEL_LOW_SVS_D0 60
@@ -238,6 +239,7 @@#define RPMH_REGULATOR_LEVEL_TURBO_L1 416#define RPMH_REGULATOR_LEVEL_TURBO_L2 432#define RPMH_REGULATOR_LEVEL_TURBO_L3 448 +#define RPMH_REGULATOR_LEVEL_TURBO_L4 452#define RPMH_REGULATOR_LEVEL_SUPER_TURBO 464#define RPMH_REGULATOR_LEVEL_SUPER_TURBO_NO_CPR 480
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/254 dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit 1c402295c10891988fb2a6fc658e6e95d4852a20 ]
Update the RPMH level definitions to include TURBO_L5 corner.
Patchwork: https://patchwork.freedesktop.org/patch/661840/
Stable-dep-of: 45e1be5ddec9 ("dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO")
--- include/dt-bindings/power/qcom-rpmpd.h | 1 + 1 file changed, 1 insertion(+)
include/dt-bindings/power/qcom-rpmpd.h +1 -0
@@ -240,6 +240,7 @@#define RPMH_REGULATOR_LEVEL_TURBO_L2 432#define RPMH_REGULATOR_LEVEL_TURBO_L3 448#define RPMH_REGULATOR_LEVEL_TURBO_L4 452 +#define RPMH_REGULATOR_LEVEL_TURBO_L5 456#define RPMH_REGULATOR_LEVEL_SUPER_TURBO 464#define RPMH_REGULATOR_LEVEL_SUPER_TURBO_NO_CPR 480
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/254 dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit dcb8d01b65fb5a891ddbbedcbe6eff0b8ec37867 ]
Historically both RPM and RPMh domain definitions were a part of the same, qcom-rpmpd.h header. Now as we have a separate header for RPMh definitions, qcom,rpmhpd.h, move all RPMh power domain definitions to that header.
Stable-dep-of: 45e1be5ddec9 ("dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO")
--- include/dt-bindings/power/qcom,rpmhpd.h | 233 ++++++++++++++++++++++++ include/dt-bindings/power/qcom-rpmpd.h | 228 +---------------------- 2 files changed, 234 insertions(+), 227 deletions(-)
include/dt-bindings/power/qcom,rpmhpd.h +233 -0
@@ -28,4 +28,237 @@#define RPMHPD_XO 18#define RPMHPD_NSP2 19 +/* RPMh Power Domain performance levels */ +#define RPMH_REGULATOR_LEVEL_RETENTION 16 +#define RPMH_REGULATOR_LEVEL_MIN_SVS 48 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D3 50 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D2 52 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D1 56 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D0 60 +#define RPMH_REGULATOR_LEVEL_LOW_SVS 64 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_P1 72 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_L1 80 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_L2 96 +#define RPMH_REGULATOR_LEVEL_SVS 128 +#define RPMH_REGULATOR_LEVEL_SVS_L0 144 +#define RPMH_REGULATOR_LEVEL_SVS_L1 192 +#define RPMH_REGULATOR_LEVEL_SVS_L2 224 +#define RPMH_REGULATOR_LEVEL_NOM 256 +#define RPMH_REGULATOR_LEVEL_NOM_L0 288 +#define RPMH_REGULATOR_LEVEL_NOM_L1 320 +#define RPMH_REGULATOR_LEVEL_NOM_L2 336 +#define RPMH_REGULATOR_LEVEL_TURBO 384 +#define RPMH_REGULATOR_LEVEL_TURBO_L0 400 +#define RPMH_REGULATOR_LEVEL_TURBO_L1 416 +#define RPMH_REGULATOR_LEVEL_TURBO_L2 432 +#define RPMH_REGULATOR_LEVEL_TURBO_L3 448 +#define RPMH_REGULATOR_LEVEL_TURBO_L4 452 +#define RPMH_REGULATOR_LEVEL_TURBO_L5 456 +#define RPMH_REGULATOR_LEVEL_SUPER_TURBO 464 +#define RPMH_REGULATOR_LEVEL_SUPER_TURBO_NO_CPR 480 + +/* +* Platform-specific power domain bindings. Don't add new entries here, use +* RPMHPD_* above. +*/ + +/* SA8775P Power Domain Indexes */ +#define SA8775P_CX 0 +#define SA8775P_CX_AO 1 +#define SA8775P_DDR 2 +#define SA8775P_EBI 3 +#define SA8775P_GFX 4 +#define SA8775P_LCX 5 +#define SA8775P_LMX 6 +#define SA8775P_MMCX 7 +#define SA8775P_MMCX_AO 8 +#define SA8775P_MSS 9 +#define SA8775P_MX 10 +#define SA8775P_MX_AO 11 +#define SA8775P_MXC 12 +#define SA8775P_MXC_AO 13 +#define SA8775P_NSP0 14 +#define SA8775P_NSP1 15 +#define SA8775P_XO 16 + +/* SDM670 Power Domain Indexes */ +#define SDM670_MX 0 +#define SDM670_MX_AO 1 +#define SDM670_CX 2 +#define SDM670_CX_AO 3 +#define SDM670_LMX 4 +#define SDM670_LCX 5 +#define SDM670_GFX 6 +#define SDM670_MSS 7 + +/* SDM845 Power Domain Indexes */ +#define SDM845_EBI 0 +#define SDM845_MX 1 +#define SDM845_MX_AO 2 +#define SDM845_CX 3 +#define SDM845_CX_AO 4 +#define SDM845_LMX 5 +#define SDM845_LCX 6 +#define SDM845_GFX 7 +#define SDM845_MSS 8 + +/* SDX55 Power Domain Indexes */ +#define SDX55_MSS 0 +#define SDX55_MX 1 +#define SDX55_CX 2 + +/* SDX65 Power Domain Indexes */ +#define SDX65_MSS 0 +#define SDX65_MX 1 +#define SDX65_MX_AO 2 +#define SDX65_CX 3 +#define SDX65_CX_AO 4 +#define SDX65_MXC 5 + +/* SM6350 Power Domain Indexes */ +#define SM6350_CX 0 +#define SM6350_GFX 1 +#define SM6350_LCX 2 +#define SM6350_LMX 3 +#define SM6350_MSS 4 +#define SM6350_MX 5 + +/* SM8150 Power Domain Indexes */ +#define SM8150_MSS 0 +#define SM8150_EBI 1 +#define SM8150_LMX 2 +#define SM8150_LCX 3 +#define SM8150_GFX 4 +#define SM8150_MX 5 +#define SM8150_MX_AO 6 +#define SM8150_CX 7 +#define SM8150_CX_AO 8 +#define SM8150_MMCX 9 +#define SM8150_MMCX_AO 10 + +/* SA8155P is a special case, kept for backwards compatibility */ +#define SA8155P_CX SM8150_CX +#define SA8155P_CX_AO SM8150_CX_AO +#define SA8155P_EBI SM8150_EBI +#define SA8155P_GFX SM8150_GFX +#define SA8155P_MSS SM8150_MSS +#define SA8155P_MX SM8150_MX +#define SA8155P_MX_AO SM8150_MX_AO + +/* SM8250 Power Domain Indexes */ +#define SM8250_CX 0 +#define SM8250_CX_AO 1 +#define SM8250_EBI 2 +#define SM8250_GFX 3 +#define SM8250_LCX 4 +#define SM8250_LMX 5 +#define SM8250_MMCX 6 +#define SM8250_MMCX_AO 7 +#define SM8250_MX 8 +#define SM8250_MX_AO 9 + +/* SM8350 Power Domain Indexes */ +#define SM8350_CX 0 +#define SM8350_CX_AO 1 +#define SM8350_EBI 2 +#define SM8350_GFX 3 +#define SM8350_LCX 4 +#define SM8350_LMX 5 +#define SM8350_MMCX 6 +#define SM8350_MMCX_AO 7 +#define SM8350_MX 8 +#define SM8350_MX_AO 9 +#define SM8350_MXC 10 +#define SM8350_MXC_AO 11 +#define SM8350_MSS 12 + +/* SM8450 Power Domain Indexes */ +#define SM8450_CX 0 +#define SM8450_CX_AO 1 +#define SM8450_EBI 2 +#define SM8450_GFX 3 +#define SM8450_LCX 4 +#define SM8450_LMX 5 +#define SM8450_MMCX 6 +#define SM8450_MMCX_AO 7 +#define SM8450_MX 8 +#define SM8450_MX_AO 9 +#define SM8450_MXC 10 +#define SM8450_MXC_AO 11 +#define SM8450_MSS 12 + +/* SM8550 Power Domain Indexes */ +#define SM8550_CX 0 +#define SM8550_CX_AO 1 +#define SM8550_EBI 2 +#define SM8550_GFX 3 +#define SM8550_LCX 4 +#define SM8550_LMX 5 +#define SM8550_MMCX 6 +#define SM8550_MMCX_AO 7 +#define SM8550_MX 8 +#define SM8550_MX_AO 9 +#define SM8550_MXC 10 +#define SM8550_MXC_AO 11 +#define SM8550_MSS 12 +#define SM8550_NSP 13 + +/* QDU1000/QRU1000 Power Domain Indexes */ +#define QDU1000_EBI 0 +#define QDU1000_MSS 1 +#define QDU1000_CX 2 +#define QDU1000_MX 3 + +/* SC7180 Power Domain Indexes */ +#define SC7180_CX 0 +#define SC7180_CX_AO 1 +#define SC7180_GFX 2 +#define SC7180_MX 3 +#define SC7180_MX_AO 4 +#define SC7180_LMX 5 +#define SC7180_LCX 6 +#define SC7180_MSS 7 + +/* SC7280 Power Domain Indexes */ +#define SC7280_CX 0 +#define SC7280_CX_AO 1 +#define SC7280_EBI 2 +#define SC7280_GFX 3 +#define SC7280_MX 4 +#define SC7280_MX_AO 5 +#define SC7280_LMX 6 +#define SC7280_LCX 7 +#define SC7280_MSS 8 + +/* SC8180X Power Domain Indexes */ +#define SC8180X_CX 0 +#define SC8180X_CX_AO 1 +#define SC8180X_EBI 2 +#define SC8180X_GFX 3 +#define SC8180X_LCX 4 +#define SC8180X_LMX 5 +#define SC8180X_MMCX 6 +#define SC8180X_MMCX_AO 7 +#define SC8180X_MSS 8 +#define SC8180X_MX 9 +#define SC8180X_MX_AO 10 + +/* SC8280XP Power Domain Indexes */ +#define SC8280XP_CX 0 +#define SC8280XP_CX_AO 1 +#define SC8280XP_DDR 2 +#define SC8280XP_EBI 3 +#define SC8280XP_GFX 4 +#define SC8280XP_LCX 5 +#define SC8280XP_LMX 6 +#define SC8280XP_MMCX 7 +#define SC8280XP_MMCX_AO 8 +#define SC8280XP_MSS 9 +#define SC8280XP_MX 10 +#define SC8280XP_MXC 12 +#define SC8280XP_MX_AO 11 +#define SC8280XP_NSP 13 +#define SC8280XP_QPHY 14 +#define SC8280XP_XO 15 +#endif
include/dt-bindings/power/qcom-rpmpd.h +1 -227
240 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/254 dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 45e1be5ddec98db71e7481fa7a3005673200d85c ]
Not sure how useful it's gonna be in practice, but the definition is missing (unlike the previously-unused SC8280XP_MXC-non-_AO), so add it to allow the driver to create the corresponding pmdomain.
--- include/dt-bindings/power/qcom,rpmhpd.h | 1 + 1 file changed, 1 insertion(+)
include/dt-bindings/power/qcom,rpmhpd.h +1 -0
@@ -260,5 +260,6 @@#define SC8280XP_NSP 13#define SC8280XP_QPHY 14#define SC8280XP_XO 15 +#define SC8280XP_MXC_AO 16#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/254 pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 5bc3e720e725cd5fa34875fa1e5434d565858067 ]
This was apparently accounted for in dt-bindings, but never made its way into the driver.
Fix it for SC8280XP and its VDD_GFX-less cousin, SA8540P.
--- drivers/pmdomain/qcom/rpmhpd.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pmdomain/qcom/rpmhpd.c +4 -0
@@ -217,6 +217,8 @@ static struct rpmhpd *sa8540p_rpmhpds[] = { [SC8280XP_MMCX_AO] = &mmcx_ao, [SC8280XP_MX] = &mx, [SC8280XP_MX_AO] = &mx_ao, + [SC8280XP_MXC] = &mxc, + [SC8280XP_MXC_AO] = &mxc_ao, [SC8280XP_NSP] = &nsp, };
@@ -541,6 +543,8 @@ static struct rpmhpd *sc8280xp_rpmhpds[] = { [SC8280XP_MMCX_AO] = &mmcx_ao, [SC8280XP_MX] = &mx, [SC8280XP_MX_AO] = &mx_ao, + [SC8280XP_MXC] = &mxc, + [SC8280XP_MXC_AO] = &mxc_ao, [SC8280XP_NSP] = &nsp, [SC8280XP_QPHY] = &qphy, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/254 ata: libata: Add cpr_log to ata_dev_print_features() early return
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit a6bee5e5243ad02cae575becc4c83df66fc29573 ]
ata_dev_print_features() is supposed to return early and not print anything if there are no features supported.
However, commit fe22e1c2f705 ("libata: support concurrent positioning ranges log") added another feature to ata_dev_print_features() without updating the early return conditional.
Add the missing feature to the early return conditional.
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -2782,7 +2782,7 @@ static void ata_dev_config_cpr(struct ata_device *dev)static void ata_dev_print_features (struct ata_device *dev) { -if (!(dev->flags &ATA_DFLAG_FEATURES_MASK )) +if (!(dev->flags &ATA_DFLAG_FEATURES_MASK ) && !dev->cpr_log)return ; ata_dev_info(dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/254 ata: libata-core: Introduce ata_dev_config_lpm()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit d360121832d8a36871249271df5b9ff05f835f62 ]
If the port of a device does not support Device Initiated Power Management (DIPM), that is, the port is flagged with ATA_FLAG_NO_DIPM, the DIPM feature of a device should not be used. Though DIPM is disabled by default on a device, the "Software Settings Preservation feature" may keep DIPM enabled or DIPM may have been enabled by the system firmware.
Introduce the function ata_dev_config_lpm() to always disable DIPM on a device that supports this feature if the port of the device is flagged with ATA_FLAG_NO_DIPM. ata_dev_config_lpm() is called from ata_dev_configure(), ensuring that a device DIPM feature is disabled when it cannot be used.
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
--- drivers/ata/libata-core.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
drivers/ata/libata-core.c +25 -0
@@ -2780,6 +2780,30 @@ static void ata_dev_config_cpr(struct ata_device *dev)kfree (buf); } +/* +* Configure features related to link power management. +*/ +static void ata_dev_config_lpm (struct ata_device *dev) +{ +struct ata_port *ap = dev->link->ap; +unsigned int err_mask; + +/* +* Device Initiated Power Management (DIPM) is normally disabled by +* default on a device. However, DIPM may have been enabled and that +* setting kept even after COMRESET because of the Software Settings +* Preservation feature. So if the port does not support DIPM and the +* device does, disable DIPM on the device. +*/ +if (ap->flags &ATA_FLAG_NO_DIPM &&ata_id_has_dipm (dev->id)) { + err_mask =ata_dev_set_feature (dev, +SETFEATURES_SATA_DISABLE ,SATA_DIPM ); +if (err_mask && err_mask !=AC_ERR_DEV ) +ata_dev_err (dev,"Disable DIPM failed, Emask 0x%x\n" , + err_mask); + } +} +static void ata_dev_print_features (struct ata_device *dev) {if (!(dev->flags &ATA_DFLAG_FEATURES_MASK ) && !dev->cpr_log)
@@ -2949,6 +2973,7 @@ int ata_dev_configure(struct ata_device *dev)ata_dev_config_chs (dev); } +ata_dev_config_lpm (dev);ata_dev_config_fua (dev);ata_dev_config_devslp (dev);ata_dev_config_sense_reporting (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/254 ata: libata: Call ata_dev_config_lpm() for ATAPI devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 8f3fb33f8f3f825c708ece800c921977c157f9b6 ]
Commit d360121832d8 ("ata: libata-core: Introduce ata_dev_config_lpm()") introduced ata_dev_config_lpm(). However, it only called this function for ATA_DEV_ATA and ATA_DEV_ZAC devices, not for ATA_DEV_ATAPI devices.
Additionally, commit d99a9142e782 ("ata: libata-core: Move device LPM quirk settings to ata_dev_config_lpm()") moved the LPM quirk application from ata_dev_configure() to ata_dev_config_lpm(), causing LPM quirks for ATAPI devices to no longer be applied.
Call ata_dev_config_lpm() also for ATAPI devices, such that LPM quirks are applied for ATAPI devices with an entry in __ata_dev_quirks once again.
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
--- drivers/ata/libata-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/libata-core.c +2 -0
@@ -3047,6 +3047,8 @@ int ata_dev_configure(struct ata_device *dev)ata_mode_string (xfer_mask), cdb_intr_string, atapi_an_string, dma_dir_string); + +ata_dev_config_lpm (dev); }/* determine max_sectors */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/254 ata: libata: Print features also for ATAPI devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit c8c6fb886f57d5bf71fb6de6334a143608d35707 ]
Commit d633b8a702ab ("libata: print feature list on device scan") added a print of the features supported by the device for ATA_DEV_ATA and ATA_DEV_ZAC devices, but not for ATA_DEV_ATAPI devices.
Fix this by printing the features also for ATAPI devices.
Before changes:
ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133
After changes:
ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133 ata1.00: Features: Dev-Attention HIPM DIPM
--- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/ata/libata-core.c +3 -0
@@ -3049,6 +3049,9 @@ int ata_dev_configure(struct ata_device *dev) dma_dir_string);ata_dev_config_lpm (dev); + +if (print_info) +ata_dev_print_features (dev); }/* determine max_sectors */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/254 ice: initialize ring_stats->syncp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 8439016c3b8b5ab687c2420317b1691585106611 ]
The u64_stats_sync structure is empty on 64-bit systems. However, on 32-bit systems it contains a seqcount_t which needs to be initialized. While the memory is zero-initialized, a lack of u64_stats_init means that lockdep won't get initialized properly. Fix this by adding u64_stats_init() calls to the rings just after allocation.
--- drivers/net/ethernet/intel/ice/ice_lib.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/ice/ice_lib.c +4 -0
@@ -396,6 +396,8 @@ static int ice_vsi_alloc_ring_stats(struct ice_vsi *vsi)if (!ring_stats) goto err_out; +u64_stats_init (&ring_stats->syncp); +WRITE_ONCE (tx_ring_stats[i], ring_stats); }
@@ -415,6 +417,8 @@ static int ice_vsi_alloc_ring_stats(struct ice_vsi *vsi)if (!ring_stats) goto err_out; +u64_stats_init (&ring_stats->syncp); +WRITE_ONCE (rx_ring_stats[i], ring_stats); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/254 ice: Avoid detrimental cleanup for bond during interface stop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Ertman <[email protected]>
[ Upstream commit a9d45c22ed120cdd15ff56d0a6e4700c46451901 ]
When the user issues an administrative down to an interface that is the primary for an aggregate bond, the prune lists are being purged. This breaks communication to the secondary interface, which shares a prune list on the main switch block while bonded together.
For the primary interface of an aggregate, avoid deleting these prune lists during stop, and since they are hardcoded to specific values for the default vlan and QinQ vlans, the attempt to re-add them during the up phase will quietly fail without any additional problem.
--- drivers/net/ethernet/intel/ice/ice_lib.c | 25 ++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +17 -8
@@ -3897,22 +3897,31 @@ int ice_vsi_add_vlan_zero(struct ice_vsi *vsi)int ice_vsi_del_vlan_zero (struct ice_vsi *vsi) {struct ice_vsi_vlan_ops *vlan_ops =ice_get_compat_vsi_vlan_ops (vsi); +struct ice_pf *pf = vsi->back;struct ice_vlan vlan;int err; - vlan =ICE_VLAN (0 ,0 ,0 ); - err = vlan_ops->del_vlan (vsi, &vlan); -if (err && err != -EEXIST ) -return err; +if (pf->lag && pf->lag->primary) { +dev_dbg (ice_pf_to_dev (pf),"Interface is primary in aggregate - not deleting prune list\n" ); + }else { + vlan =ICE_VLAN (0 ,0 ,0 ); + err = vlan_ops->del_vlan (vsi, &vlan); +if (err && err != -EEXIST ) +return err; + }/* in SVM both VLAN 0 filters are identical */ if (!ice_is_dvm_ena (&vsi->back->hw))return 0 ; - vlan =ICE_VLAN (ETH_P_8021Q ,0 ,0 ); - err = vlan_ops->del_vlan (vsi, &vlan); -if (err && err != -EEXIST ) -return err; +if (pf->lag && pf->lag->primary) { +dev_dbg (ice_pf_to_dev (pf),"Interface is primary in aggregate - not deleting QinQ prune list\n" ); + }else { + vlan =ICE_VLAN (ETH_P_8021Q ,0 ,0 ); + err = vlan_ops->del_vlan (vsi, &vlan); +if (err && err != -EEXIST ) +return err; + }/* when deleting the last VLAN filter, make sure to disable the VLAN * promisc mode so the filter isn't left by accident
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/254 igc: fix race condition in TX timestamp read for register 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chwee-Lin Choong <[email protected]>
[ Upstream commit 6990dc392a9ab10e52af37e0bee8c7b753756dc4 ]
The current HW bug workaround checks the TXTT_0 ready bit first, then reads TXSTMPL_0 twice (before and after reading TXSTMPH_0) to detect whether a new timestamp was captured by timestamp register 0 during the workaround.
This sequence has a race: if a new timestamp is captured after checking the TXTT_0 bit but before the first TXSTMPL_0 read, the detection fails because both the "old" and "new" values come from the same timestamp.
Fix by reading TXSTMPL_0 first to establish a baseline, then checking the TXTT_0 bit. This ensures any timestamp captured during the race window will be detected.
Old sequence:
1. Check TXTT_0 ready bit
2. Read TXSTMPL_0 (baseline)
3. Read TXSTMPH_0 (interrupt workaround)
4. Read TXSTMPL_0 (detect changes vs baseline)
New sequence:
1. Read TXSTMPL_0 (baseline)
2. Check TXTT_0 ready bit
3. Read TXSTMPH_0 (interrupt workaround)
4. Read TXSTMPL_0 (detect changes vs baseline)
--- drivers/net/ethernet/intel/igc/igc_ptp.c | 43 ++++++++++++++---------- 1 file changed, 25 insertions(+), 18 deletions(-)
drivers/net/ethernet/intel/igc/igc_ptp.c +25 -18
@@ -758,36 +758,43 @@ static void igc_ptp_tx_reg_to_stamp(struct igc_adapter *adapter,static void igc_ptp_tx_hwtstamp (struct igc_adapter *adapter) {struct igc_hw *hw = &adapter->hw; +u32 txstmpl_old;u64 regval;u32 mask;int i; +/* Establish baseline of TXSTMPL_0 before checking TXTT_0. +* This baseline is used to detect if a new timestamp arrives in +* register 0 during the hardware bug workaround below. +*/ + txstmpl_old =rd32 (IGC_TXSTMPL ); + mask =rd32 (IGC_TSYNCTXCTL ) &IGC_TSYNCTXCTL_TXTT_ANY ;if (mask &IGC_TSYNCTXCTL_TXTT_0 ) { regval =rd32 (IGC_TXSTMPL ); regval |= (u64 )rd32 (IGC_TXSTMPH ) <<32 ; }else { -/* There's a bug in the hardware that could cause -* missing interrupts for TX timestamping. The issue -* is that for new interrupts to be triggered, the -* IGC_TXSTMPH_0 register must be read. +/* TXTT_0 not set - register 0 has no new timestamp initially. +* +* Hardware bug: Future timestamp interrupts won't fire unless +* TXSTMPH_0 is read, even if the timestamp was captured in +* registers 1-3. * -* To avoid discarding a valid timestamp that just -* happened at the "wrong" time, we need to confirm -* that there was no timestamp captured, we do that by -* assuming that no two timestamps in sequence have -* the same nanosecond value. +* Workaround: Read TXSTMPH_0 here to enable future interrupts. +* However, this read clears TXTT_0. If a timestamp arrives in +* register 0 after checking TXTT_0 but before this read, it +* would be lost. * -* So, we read the "low" register, read the "high" -* register (to latch a new timestamp) and read the -* "low" register again, if "old" and "new" versions -* of the "low" register are different, a valid -* timestamp was captured, we can read the "high" -* register again. +* To detect this race: We saved a baseline read of TXSTMPL_0 +* before TXTT_0 check. After performing the workaround read of +* TXSTMPH_0, we read TXSTMPL_0 again. Since consecutive +* timestamps never share the same nanosecond value, a change +* between the baseline and new TXSTMPL_0 indicates a timestamp +* arrived during the race window. If so, read the complete +* timestamp. */ -u32 txstmpl_old, txstmpl_new; +u32 txstmpl_new; - txstmpl_old =rd32 (IGC_TXSTMPL );rd32 (IGC_TXSTMPH ); txstmpl_new =rd32 (IGC_TXSTMPL );
@@ -802,7 +809,7 @@ static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter) done:/* Now that the problematic first register was handled, we can -* use retrieve the timestamps from the other registers +* retrieve the timestamps from the other registers * (starting from '1') with less complications. */ for (i =1 ; i <IGC_MAX_TX_TSTAMP_REGS ; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/254 net: usb: dm9601: remove broken SR9700 support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
[ Upstream commit 7d7dbafefbe74f5a25efc4807af093b857a7612e ]
The SR9700 chip sends more than one packet in a USB transaction, like the DM962x chips can optionally do, but the dm9601 driver does not support this mode, and the hardware does not have the DM962x MODE_CTL register to disable it, so this driver drops packets on SR9700 devices. The sr9700 driver correctly handles receiving more than one packet per transaction.
While the dm9601 driver could be improved to handle this, the easiest way to fix this issue in the short term is to remove the SR9700 device ID from the dm9601 driver so the sr9700 driver is always used. This device ID should not have been in more than one driver to begin with.
The "Fixes" commit was chosen so that the patch is automatically included in all kernels that have the sr9700 driver, even though the issue affects dm9601.
--- drivers/net/usb/dm9601.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/usb/dm9601.c +0 -4
@@ -603,10 +603,6 @@ static const struct usb_device_id products[] = { USB_DEVICE(0x0fe6, 0x8101), /* DM9601 USB to Fast Ethernet Adapter */ .driver_info = (unsigned long )&dm9601_info, }, - { -USB_DEVICE (0x0fe6 ,0x9700 ),/* DM9601 USB to Fast Ethernet Adapter */ - .driver_info = (unsigned long)&dm9601_info, - }, {USB_DEVICE (0x0a46 ,0x9000 ),/* DM9000E */ .driver_info = (unsigned long)&dm9601_info,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/254 bonding: limit BOND_MODE_8023AD to Ethernet devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6 ]
BOND_MODE_8023AD makes sense for ARPHRD_ETHER only.
syzbot reported:
BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline] BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497 CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 __hw_addr_create net/core/dev_addr_lists.c:63 [inline] __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 __dev_mc_add net/core/dev_addr_lists.c:868 [inline] dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886 bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180 do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963 do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165 rtnl_changelink net/core/rtnetlink.c:3776 [inline] __rtnl_newlink net/core/rtnetlink.c:3935 [inline] rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x820 net/socket.c:2592 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646 __sys_sendmsg+0x164/0x220 net/socket.c:2678 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e </TASK> The buggy address belongs to the variable: lacpdu_mcast_addr+0x0/0x40
--- drivers/net/bonding/bond_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bonding/bond_main.c +6 -0
@@ -1942,6 +1942,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,*/ if (!bond_has_slaves (bond)) {if (bond_dev->type != slave_dev->type) { +if (slave_dev->type !=ARPHRD_ETHER && +BOND_MODE (bond) ==BOND_MODE_8023AD ) { +SLAVE_NL_ERR (bond_dev, slave_dev, extack, +"8023AD mode requires Ethernet devices" ); +return -EINVAL ; + }slave_dbg (bond_dev, slave_dev,"change device type from %d to %d\n" , bond_dev->type, slave_dev->type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/254 selftests/net: convert fib-onlink-tests.sh to run it in unique namespace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 3a06833b2adc0a902f2469ad4ce41ccd64f1f3ab ]
Remove PEER_CMD, which is not used in this test
Here is the test result after conversion.
]# ./fib-onlink-tests.sh
Error: ipv4: FIB table does not exist.
Flush terminated
Error: ipv6: FIB table does not exist.
Flush terminated
########################################
Configuring interfaces
...
TEST: Gateway resolves to wrong nexthop device - VRF [ OK ]
Tests passed: 38
Tests failed: 0
Stable-dep-of: 4f5f148dd7c0 ("selftests: net: fib-onlink-tests: Convert to use namespaces by default")
--- tools/testing/selftests/net/fib-onlink-tests.sh | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
tools/testing/selftests/net/fib-onlink-tests.sh +3 -6
@@ -3,6 +3,7 @@ # IPv4 and IPv6 onlink tests +source lib.sh PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no} VERBOSE=0
@@ -74,9 +75,6 @@ TEST_NET4IN6[2]=10.2.1.254 # mcast address MCAST6=ff02::1 - -PEER_NS=bart -PEER_CMD="ip netns exec ${PEER_NS}" VRF=lisa VRF_TABLE=1101 PBR_TABLE=101
@@ -176,8 +174,7 @@ setup() set -e # create namespace - ip netns add ${PEER_NS} - ip -netns ${PEER_NS} li set lo up + setup_ns PEER_NS # add vrf table ip li add ${VRF} type vrf table ${VRF_TABLE}
@@ -219,7 +216,7 @@ setup() cleanup() { # make sure we start from a clean slate - ip netns del ${PEER_NS} 2>/dev/null + cleanup_ns ${PEER_NS} 2>/dev/null for n in 1 3 5 7; do ip link del ${NETIFS[p${n}]} 2>/dev/null done
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/254 selftests: net: fib-onlink-tests: Convert to use namespaces by default
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 4f5f148dd7c0459229d2ab9a769b2e820f9ee6a2 ]
Currently, the test breaks if the SUT already has a default route configured for IPv6. Fix by avoiding the use of the default namespace.
--- .../testing/selftests/net/fib-onlink-tests.sh | 71 ++++++++----------- 1 file changed, 30 insertions(+), 41 deletions(-)
tools/testing/selftests/net/fib-onlink-tests.sh +30 -41
@@ -120,7 +120,7 @@ log_subsection() run_cmd() { - local cmd="$*" + local cmd="$1" local out local rc
@@ -145,7 +145,7 @@ get_linklocal() local pfx local addr - addr=$(${pfx} ip -6 -br addr show dev ${dev} | \ + addr=$(${pfx} ${IP} -6 -br addr show dev ${dev} | \ awk '{ for (i = 3; i <= NF; ++i) { if ($i ~ /^fe80/)
@@ -173,58 +173,48 @@ setup() set -e - # create namespace - setup_ns PEER_NS + # create namespaces + setup_ns ns1 + IP="ip -netns $ns1" + setup_ns ns2 # add vrf table - ip li add ${VRF} type vrf table ${VRF_TABLE} - ip li set ${VRF} up - ip ro add table ${VRF_TABLE} unreachable default metric 8192 - ip -6 ro add table ${VRF_TABLE} unreachable default metric 8192 + ${IP} li add ${VRF} type vrf table ${VRF_TABLE} + ${IP} li set ${VRF} up + ${IP} ro add table ${VRF_TABLE} unreachable default metric 8192 + ${IP} -6 ro add table ${VRF_TABLE} unreachable default metric 8192 # create test interfaces - ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]} - ip li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]} - ip li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]} - ip li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]} + ${IP} li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]} + ${IP} li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]} + ${IP} li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]} + ${IP} li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]} # enslave vrf interfaces for n in 5 7; do - ip li set ${NETIFS[p${n}]} vrf ${VRF} + ${IP} li set ${NETIFS[p${n}]} vrf ${VRF} done # add addresses for n in 1 3 5 7; do - ip li set ${NETIFS[p${n}]} up - ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} - ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad + ${IP} li set ${NETIFS[p${n}]} up + ${IP} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} + ${IP} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad done # move peer interfaces to namespace and add addresses for n in 2 4 6 8; do - ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up - ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} - ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad + ${IP} li set ${NETIFS[p${n}]} netns ${ns2} up + ip -netns $ns2 addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} + ip -netns $ns2 addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad done - ip -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64} - ip -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64} + ${IP} -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64} + ${IP} -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64} set +e } -cleanup() -{ - # make sure we start from a clean slate - cleanup_ns ${PEER_NS} 2>/dev/null - for n in 1 3 5 7; do - ip link del ${NETIFS[p${n}]} 2>/dev/null - done - ip link del ${VRF} 2>/dev/null - ip ro flush table ${VRF_TABLE} - ip -6 ro flush table ${VRF_TABLE} -} - ################################################################################ # IPv4 tests #
@@ -241,7 +231,7 @@ run_ip() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip ro add table "${table}" "${prefix}"/32 via "${gw}" "${dev}" onlink + run_cmd "${IP} ro add table ${table} ${prefix}/32 via ${gw} ${dev} onlink" log_test $? ${exp_rc} "${desc}" }
@@ -257,8 +247,8 @@ run_ip_mpath() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip ro add table "${table}" "${prefix}"/32 \ - nexthop via ${nh1} nexthop via ${nh2} + run_cmd "${IP} ro add table ${table} ${prefix}/32 \ + nexthop via ${nh1} nexthop via ${nh2}" log_test $? ${exp_rc} "${desc}" }
@@ -339,7 +329,7 @@ run_ip6() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip -6 ro add table "${table}" "${prefix}"/128 via "${gw}" "${dev}" onlink + run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 via ${gw} ${dev} onlink" log_test $? ${exp_rc} "${desc}" }
@@ -353,8 +343,8 @@ run_ip6_mpath() local exp_rc="$6" local desc="$7" - run_cmd ip -6 ro add table "${table}" "${prefix}"/128 "${opts}" \ - nexthop via ${nh1} nexthop via ${nh2} + run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 ${opts} \ + nexthop via ${nh1} nexthop via ${nh2}" log_test $? ${exp_rc} "${desc}" }
@@ -491,10 +481,9 @@ do esac done -cleanup setup run_onlink_tests -cleanup +cleanup_ns ${ns1} ${ns2} if [ "$TESTS" != "none" ]; then printf "\nTests passed: %3d\n" ${nsuccess}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/254 can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7 ]
In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup.
However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty.
To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message.
--- drivers/net/can/usb/gs_usb.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/can/usb/gs_usb.c +7 -0
@@ -751,6 +751,10 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)usb_anchor_urb (urb, &parent->rx_submitted); rc =usb_submit_urb (urb,GFP_ATOMIC ); +if (!rc) +return ; + +usb_unanchor_urb (urb);/* USB failure take down all interfaces */ if (rc == -ENODEV ) {
@@ -759,6 +763,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)if (parent->canch[rc])netif_device_detach (parent->canch[rc]->netdev); } + }else if (rc != -ESHUTDOWN &&net_ratelimit ()) { +netdev_info (netdev,"failed to re-submit IN URB: %pe\n" , +ERR_PTR (urb->status)); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/254 sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit a80c9d945aef55b23b54838334345f20251dad83 ]
A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails:
==================================================================
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127
The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently:
- SCTP_CMD_PEER_INIT
- SCTP_CMD_TIMER_STOP (T1_INIT)
- SCTP_CMD_TIMER_START (T1_COOKIE)
- SCTP_CMD_NEW_STATE (COOKIE_ECHOED)
- SCTP_CMD_ASSOC_SHKEY
- SCTP_CMD_GEN_COOKIE_ECHO
If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user().
Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue.
Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup.
--- net/sctp/sm_statefuns.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/sctp/sm_statefuns.c +5 -5
@@ -602,6 +602,11 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,sctp_add_cmd_sf (commands,SCTP_CMD_PEER_INIT ,SCTP_PEER_INIT (initchunk)); +/* SCTP-AUTH: generate the association shared keys so that +* we can potentially sign the COOKIE-ECHO. +*/ +sctp_add_cmd_sf (commands,SCTP_CMD_ASSOC_SHKEY ,SCTP_NULL ()); +/* Reset init error count upon receipt of INIT-ACK. */ sctp_add_cmd_sf (commands,SCTP_CMD_INIT_COUNTER_RESET ,SCTP_NULL ());
@@ -616,11 +621,6 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,sctp_add_cmd_sf (commands,SCTP_CMD_NEW_STATE ,SCTP_STATE (SCTP_STATE_COOKIE_ECHOED )); -/* SCTP-AUTH: generate the association shared keys so that -* we can potentially sign the COOKIE-ECHO. -*/ -sctp_add_cmd_sf (commands,SCTP_CMD_ASSOC_SHKEY ,SCTP_NULL ()); -/* 5.1 C) "A" shall then send the State Cookie received in the * INIT ACK chunk in a COOKIE ECHO chunk, ... */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/254 amd-xgbe: avoid misleading per-packet error log
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit c158f985cf6c2c36c99c4f67af2ff3f5ebe09f8f ]
On the receive path, packet can be damaged because of buffer overflow in Rx FIFO. Avoid misleading per-packet error log when packet->errors is set, this can flood the log. Instead, rely on the standard rtnl_link_stats64 stats.
--- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-drv.c +1 -4
@@ -2105,7 +2105,7 @@ static void xgbe_get_stats64(struct net_device *netdev, s->multicast = pstats->rxmulticastframes_g; s->rx_length_errors = pstats->rxlengtherror; s->rx_crc_errors = pstats->rxcrcerror; - s->rx_fifo_errors = pstats->rxfifooverflow; + s->rx_over_errors = pstats->rxfifooverflow; s->tx_packets = pstats->txframecount_gb; s->tx_bytes = pstats->txoctetcount_gb;
@@ -2559,9 +2559,6 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget) goto read_again;if (error || packet->errors) { -if (packet->errors) -netif_err (pdata, rx_err, netdev, -"error in received packet\n" );dev_kfree_skb (skb); goto next_packet; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/254 gue: Fix skb memleak with inner IP protocol 0.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9a56796ad258786d3624eef5aefba394fc9bdded ]
syzbot reported skb memleak below. [0]
The repro generated a GUE packet with its inner protocol 0.
gue_udp_recv() returns -guehdr->proto_ctype for "resubmit" in ip_protocol_deliver_rcu(), but this only works with non-zero protocol number.
Let's drop such packets.
Note that 0 is a valid number (IPv6 Hop-by-Hop Option).
I think it is not practical to encap HOPOPT in GUE, so once someone starts to complain, we could pass down a resubmit flag pointer to distinguish two zeros from the upper layer:
* no error
* resubmit HOPOPT
[0]
BUG: memory leak
unreferenced object 0xffff888109695a00 (size 240):
comm "syz.0.17", pid 6088, jiffies 4294943096
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@..............
backtrace (crc a84b336f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270
__build_skb+0x23/0x60 net/core/skbuff.c:474
build_skb+0x20/0x190 net/core/skbuff.c:490
__tun_build_skb drivers/net/tun.c:1541 [inline]
tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636
tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770
tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x45d/0x710 fs/read_write.c:686
ksys_write+0xa7/0x170 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/ipv4/fou_core.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/fou_core.c +3 -0
@@ -215,6 +215,9 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)return gue_control_message (skb, guehdr); proto_ctype = guehdr->proto_ctype; +if (unlikely (!proto_ctype)) + goto drop; +__skb_pull (skb,sizeof (struct udphdr ) + hdrlen);skb_reset_transport_header (skb);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/254 tools: ynl: Specify --no-line-number in ynl-regen.sh.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 68578370f9b3a2aba5964b273312d51c581b6aad ]
If grep.lineNumber is enabled in .gitconfig,
[grep]
lineNumber = true
ynl-regen.sh fails with the following error:
$ ./tools/net/ynl/ynl-regen.sh -f ... ynl_gen_c.py: error: argument --mode: invalid choice: '4:' (choose from user, kernel, uapi) GEN 4: net/ipv4/fou_nl.c
Let's specify --no-line-number explicitly.
--- tools/net/ynl/ynl-regen.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/net/ynl/ynl-regen.sh +1 -1
@@ -21,7 +21,7 @@ files=$(git grep --files-with-matches '^/\* YNL-GEN \(kernel\|uapi\|user\)') for f in $files; do # params: 0 1 2 3 # $YAML YNL-GEN kernel $mode - params=( $(git grep -B1 -h '/\* YNL-GEN' $f | sed 's@/\*\(.*\)\*/@\1@') ) + params=( $(git grep --no-line-number -B1 -h '/\* YNL-GEN' $f | sed 's@/\*\(.*\)\*/@\1@') ) args=$(sed -n 's@/\* YNL-ARG \(.*\) \*/@\1@p' $f) if [ $f -nt ${params[0]} -a -z "$force" ]; then
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/254 fou: Dont allow 0 for FOU_ATTR_IPPROTO.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5 ]
fou_udp_recv() has the same problem mentioned in the previous patch.
If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu().
Let's forbid 0 for FOU_ATTR_IPPROTO.
--- Documentation/netlink/specs/fou.yaml | 2 ++ net/ipv4/fou_nl.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
Documentation/netlink/specs/fou.yaml +2 -0
@@ -39,6 +39,8 @@ attribute-sets: - name: ipproto type: u8 + checks: + min: 1 - name: type type: u8
net/ipv4/fou_nl.c +1 -1
@@ -14,7 +14,7 @@const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX +1 ] = { [FOU_ATTR_PORT ] = { .type =NLA_U16 , }, [FOU_ATTR_AF ] = { .type =NLA_U8 , }, - [FOU_ATTR_IPPROTO ] = { .type =NLA_U8 , }, + [FOU_ATTR_IPPROTO ] =NLA_POLICY_MIN (NLA_U8 ,1 ), [FOU_ATTR_TYPE ] = { .type =NLA_U8 , }, [FOU_ATTR_REMCSUM_NOPARTIAL ] = { .type =NLA_FLAG , }, [FOU_ATTR_LOCAL_V4 ] = { .type =NLA_U32 , },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/254 veth: fix data race in veth_get_ethtool_stats
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <[email protected]>
[ Upstream commit b47adaab8b3d443868096bac08fdbb3d403194ba ]
In veth_get_ethtool_stats(), some statistics protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics, peer_tq_xdp_xmit and peer_tq_xdp_xmit_err, are already accumulated by veth_xdp_xmit(). Fix this by reading them into a temporary buffer first.
--- drivers/net/veth.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/veth.c +6 -2
@@ -226,16 +226,20 @@ static void veth_get_ethtool_stats(struct net_device *dev,const struct veth_rq_stats *rq_stats = &rcv_priv->rq[i].stats;const void *base = (void *)&rq_stats->vs;unsigned int start, tx_idx = idx; +u64 buf[VETH_TQ_STATS_LEN ];size_t offset; - tx_idx += (i % dev->real_num_tx_queues) *VETH_TQ_STATS_LEN ;do { start =u64_stats_fetch_begin (&rq_stats->syncp);for (j =0 ; j <VETH_TQ_STATS_LEN ; j++) { offset = veth_tq_stats_desc[j].offset; - data[tx_idx + j] += *(u64 *)(base + offset); + buf[j] = *(u64 *)(base + offset); } }while (u64_stats_fetch_retry (&rq_stats->syncp, start)); + + tx_idx += (i % dev->real_num_tx_queues) *VETH_TQ_STATS_LEN ; +for (j =0 ; j <VETH_TQ_STATS_LEN ; j++) + data[tx_idx + j] += buf[j]; } pp_idx = idx + dev->real_num_tx_queues *VETH_TQ_STATS_LEN ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/254 l2tp: avoid one data-race in l2tp_tunnel_del_work()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7a29f6bf60f2590fe5e9c4decb451e19afad2bcf ]
We should read sk->sk_socket only when dealing with kernel sockets.
syzbot reported the following data-race:
BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0:
sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1:
l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
value changed: 0xffff88811b818000 -> 0x0000000000000000
--- net/l2tp/l2tp_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/l2tp/l2tp_core.c +2 -2
@@ -1250,8 +1250,6 @@ static void l2tp_tunnel_del_work(struct work_struct *work) { struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel, del_work); -struct sock *sk = tunnel->sock; -struct socket *sock = sk->sk_socket;l2tp_tunnel_closeall (tunnel);
@@ -1259,6 +1257,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work)* the sk API to release it here. */ if (tunnel->fd <0 ) { +struct socket *sock = tunnel->sock->sk_socket; +if (sock) {kernel_sock_shutdown (sock,SHUT_RDWR );sock_release (sock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/254 ipvlan: Make the addrs_lock be per port
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Skorodumov <[email protected]>
[ Upstream commit d3ba32162488283c0a4c5bedd8817aec91748802 ]
Make the addrs_lock be per port, not per ipvlan dev.
Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So
1) Introduce per-port addrs_lock.
2) It was needed to fix places where it was forgotten to take lock (ipvlan_open/ipvlan_close)
This appears to be a very minor problem though. Since it's highly unlikely that ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause:
1) False-negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6, since looks like only ipvlan_addr6_event() can be called without rtnl_lock.
2) Race since ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks
This should not affect performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths.
--- drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_core.c | 16 +++++------ drivers/net/ipvlan/ipvlan_main.c | 49 +++++++++++++++++++------------- 3 files changed, 37 insertions(+), 30 deletions(-)
drivers/net/ipvlan/ipvlan.h +1 -1
@@ -69,7 +69,6 @@ struct ipvl_dev {DECLARE_BITMAP (mac_filters,IPVLAN_MAC_FILTER_SIZE );netdev_features_t sfeatures;u32 msg_enable; -spinlock_t addrs_lock; };struct ipvl_addr {
@@ -90,6 +89,7 @@ struct ipvl_port {struct net_device *dev;possible_net_t pnet;struct hlist_head hlhead[IPVLAN_HASH_SIZE ]; +spinlock_t addrs_lock;/* guards hash-table and addrs */ struct list_head ipvlans;u16 mode;u16 flags;
drivers/net/ipvlan/ipvlan_core.c +7 -9
@@ -107,17 +107,15 @@ void ipvlan_ht_addr_del(struct ipvl_addr *addr)struct ipvl_addr *ipvlan_find_addr (const struct ipvl_dev *ipvlan,const void *iaddr,bool is_v6) { -struct ipvl_addr *addr, *ret =NULL ; +struct ipvl_addr *addr; -rcu_read_lock (); -list_for_each_entry_rcu (addr, &ipvlan->addrs, anode) { -if (addr_equal (is_v6, addr, iaddr)) { - ret = addr; -break ; - } +assert_spin_locked (&ipvlan->port->addrs_lock); + +list_for_each_entry (addr, &ipvlan->addrs, anode) { +if (addr_equal (is_v6, addr, iaddr)) +return addr; } -rcu_read_unlock (); -return ret; +return NULL ; }bool ipvlan_addr_busy (struct ipvl_port *port,void *iaddr,bool is_v6)
drivers/net/ipvlan/ipvlan_main.c +29 -20
173 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/254 octeontx2: cn10k: fix RX flowid TCAM mask handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit ab9b218a1521133a4410722907fa7189566be9bc ]
The RX flowid programming initializes the TCAM mask to all ones, but then overwrites it when clearing the MAC DA mask bits. This results in losing the intended initialization and may affect other match fields.
Update the code to clear the MAC DA bits using an AND operation, making the handling of mask[0] consistent with mask[1], where the field-specific bits are cleared after initializing the mask to ~0ULL.
--- drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c +1 -1
@@ -330,7 +330,7 @@ static int cn10k_mcs_write_rx_flowid(struct otx2_nic *pfvf, req->data[0 ] =FIELD_PREP (MCS_TCAM0_MAC_DA_MASK , mac_da); req->mask[0 ] = ~0ULL ; - req->mask[0 ] = ~MCS_TCAM0_MAC_DA_MASK ; + req->mask[0 ] &= ~MCS_TCAM0_MAC_DA_MASK ; req->data[1 ] =FIELD_PREP (MCS_TCAM1_ETYPE_MASK ,ETH_P_MACSEC ); req->mask[1 ] = ~0ULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/254 net/sched: Enforce that teql can only be used as root qdisc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b ]
Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint.
Although not important, I will describe the scenario that unearthed this issue for the curious.
GangMin Kim <[email protected]> managed to concot a scenario as follows:
ROOT qdisc 1:0 (QFQ)
├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s └── class 1:2 (weight=1, lmax=1514) teql
GangMin sends a packet which is enqueued to 1:1 (netem).
Any invocation of dequeue by QFQ from this class will not return a packet until after 6.4s. In the meantime, a second packet is sent and it lands on 1:2. teql's enqueue will return success and this will activate class 1:2. Main issue is that teql only updates the parent visible qlen (sch->q.qlen) at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's peek always returns NULL), dequeue will never be called and thus the qlen will remain as 0. With that in mind, when GangMin updates 1:2's lmax value, the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's qlen was not incremented, qfq fails to deactivate the class, but still frees its pointers from the aggregate. So when the first packet is rescheduled after 6.4 seconds (netem's delay), a dangling pointer is accessed causing GangMin's causing a UAF.
--- net/sched/sch_teql.c | 5 +++++ 1 file changed, 5 insertions(+)
net/sched/sch_teql.c +5 -0
@@ -178,6 +178,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,if (m->dev == dev)return -ELOOP ; +if (sch->parent !=TC_H_ROOT ) { +NL_SET_ERR_MSG_MOD (extack,"teql can only be used as root" ); +return -EOPNOTSUPP ; + } + q->m = m;skb_queue_head_init (&q->q);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/254 net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit d837fbee92453fbb829f950c8e7cf76207d73f33 ]
This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.
--- net/sched/sch_qfq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_qfq.c +1 -1
@@ -373,7 +373,7 @@ static void qfq_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl)/* Deschedule class and remove it from its parent aggregate. */ static void qfq_deact_rm_from_agg (struct qfq_sched *q,struct qfq_class *cl) { -if (cl->qdisc->q.qlen >0 )/* class is active */ +if (cl_is_active (cl))/* class is active */ qfq_deactivate_class (q, cl);qfq_rm_from_agg (q, cl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/254 crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeyang Lee <[email protected]>
[ Upstream commit 2397e9264676be7794f8f7f1e9763d90bd3c7335 ]
authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_authenc_esn_decrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (DoS).
Add a minimum AAD length check to fail fast on invalid inputs.
--- crypto/authencesn.c | 6 ++++++ 1 file changed, 6 insertions(+)
crypto/authencesn.c +6 -0
@@ -189,6 +189,9 @@ static int crypto_authenc_esn_encrypt(struct aead_request *req)struct scatterlist *src, *dst;int err; +if (assoclen <8 ) +return -EINVAL ; +sg_init_table (areq_ctx->src,2 ); src =scatterwalk_ffwd (areq_ctx->src, req->src, assoclen); dst = src;
@@ -281,6 +284,9 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req)u32 tmp[2 ];int err; +if (assoclen <8 ) +return -EINVAL ; + cryptlen -= authsize;if (req->src != dst) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/254 serial: 8250_pci: Fix broken RS485 for F81504/508/512
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marnix Rijnart <[email protected]>
commit 27aff0a56b3c77ea1a73641c9b3c4172a8f7238f upstream.
Fintek F81504/508/512 can support both RTS_ON_SEND and RTS_AFTER_SEND, but pci_fintek_rs485_supported only announces the former.
This makes it impossible to unset SER_RS485_RTS_ON_SEND from userspace because of uart_sanitize_serial_rs485(). Some devices with these chips need RTS low on TX, so they are effectively broken.
Fix this by announcing the support for SER_RS485_RTS_AFTER_SEND, similar to commit 068d35a7be65 ("serial: sc16is7xx: announce support for SER_RS485_RTS_ON_SEND").
--- drivers/tty/serial/8250/8250_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_pci.c +1 -1
@@ -1563,7 +1563,7 @@ static int pci_fintek_rs485_config(struc }static const struct serial_rs485 pci_fintek_rs485_supported = { - .flags =SER_RS485_ENABLED |SER_RS485_RTS_ON_SEND , + .flags =SER_RS485_ENABLED |SER_RS485_RTS_ON_SEND |SER_RS485_RTS_AFTER_SEND ,/* F81504/508/512 does not support RTS delay before or after send */ };
Greg Kroah-Hartman
maintainerPATCH 136/254 comedi: dmm32at: serialize use of paged registers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit e03b29b55f2b7c345a919a6ee36633b06bf3fb56 upstream.
Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to select the function of registers at offsets 12 to 15:
00 => 8254 timer/counter registers are accessible 01 => 8255 digital I/O registers are accessible 10 => Reserved
11 => Calibration registers are accessible
The interrupt service routine (dmm32at_isr()) clobbers the bottom two bits of the register with value 00, which would interfere with access to the 8255 registers by the dm32at_8255_io() function (used for Comedi instruction handling on the digital I/O subdevice).
Make use of the generic Comedi device spin-lock dev->spinlock (which is otherwise unused by this driver) to serialize access to the miscellaneous control register and paged registers.
--- drivers/comedi/drivers/dmm32at.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
drivers/comedi/drivers/dmm32at.c +30 -2
@@ -330,6 +330,7 @@ static int dmm32at_ai_cmdtest(struct comstatic void dmm32at_setaitimer (struct comedi_device *dev,unsigned int nansec) { +unsigned long irq_flags;unsigned char lo1, lo2, hi2;unsigned short both2;
@@ -342,6 +343,9 @@ static void dmm32at_setaitimer(struct co/* set counter clocks to 10MHz, disable all aux dio */ outb (0 , dev->iobase +DMM32AT_CTRDIO_CFG_REG ); +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* get access to the clock regs */ outb (DMM32AT_CTRL_PAGE_8254 , dev->iobase +DMM32AT_CTRL_REG );
@@ -354,6 +358,8 @@ static void dmm32at_setaitimer(struct cooutb (lo2, dev->iobase +DMM32AT_CLK2 );outb (hi2, dev->iobase +DMM32AT_CLK2 ); +spin_unlock_irqrestore (&dev->spinlock, irq_flags); +/* enable the ai conversion interrupt and the clock to start scans */ outb(DMM32AT_INTCLK_ADINT | DMM32AT_INTCLK_CLKEN | DMM32AT_INTCLK_CLKSEL,
@@ -363,13 +369,19 @@ static void dmm32at_setaitimer(struct costatic int dmm32at_ai_cmd (struct comedi_device *dev,struct comedi_subdevice *s) {struct comedi_cmd *cmd = &s->async->cmd; +unsigned long irq_flags;int ret;dmm32at_ai_set_chanspec (dev, s, cmd->chanlist[0 ], cmd->chanlist_len); +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* reset the interrupt just in case */ outb (DMM32AT_CTRL_INTRST , dev->iobase +DMM32AT_CTRL_REG ); +spin_unlock_irqrestore (&dev->spinlock, irq_flags); +/* * wait for circuit to settle * we don't have the 'insn' here but it's not needed
@@ -429,8 +441,13 @@ static irqreturn_t dmm32at_isr(int irq,comedi_handle_events (dev, s); } +/* serialize access to control register and paged registers */ +spin_lock (&dev->spinlock); +/* reset the interrupt */ outb (DMM32AT_CTRL_INTRST , dev->iobase +DMM32AT_CTRL_REG ); + +spin_unlock (&dev->spinlock);return IRQ_HANDLED ; }
@@ -481,14 +498,25 @@ static int dmm32at_ao_insn_write(structstatic int dmm32at_8255_io (struct comedi_device *dev,int dir,int port,int data,unsigned long regbase) { +unsigned long irq_flags; +int ret; + +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* get access to the DIO regs */ outb (DMM32AT_CTRL_PAGE_8255 , dev->iobase +DMM32AT_CTRL_REG );if (dir) {outb (data, dev->iobase + regbase + port); -return 0 ; + ret =0 ; + }else { + ret =inb (dev->iobase + regbase + port); } -return inb (dev->iobase + regbase + port); + +spin_unlock_irqrestore (&dev->spinlock, irq_flags); + +return ret; }/* Make sure the board is there and put it to a known state */
Greg Kroah-Hartman
maintainerPATCH 137/254 w1: therm: Fix off-by-one buffer overflow in alarms_store
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit 761fcf46a1bd797bd32d23f3ea0141ffd437668a upstream.
The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'.
Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.
--- drivers/w1/slaves/w1_therm.c | 60 +++++++++++++------------------------------ 1 file changed, 19 insertions(+), 41 deletions(-)
drivers/w1/slaves/w1_therm.c +19 -41
@@ -1846,53 +1846,35 @@ static ssize_t alarms_store(struct devicstruct w1_slave *sl =dev_to_w1_slave (device);struct therm_info info;u8 new_config_register[3 ];/* array of data to be written */ -int temp, ret; -char *token =NULL ; +long long temp; +int ret =0 ;s8 tl, th;/* 1 byte per value + temp ring order */ -char *p_args, *orig; +const char *p = buf; +char *endp; - p_args = orig =kmalloc (size,GFP_KERNEL ); -/* Safe string copys as buf is const */ -if (!p_args) { -dev_warn (device, -"%s: error unable to allocate memory %d\n" , - __func__, -ENOMEM ); -return size; - } -strcpy (p_args, buf); - -/* Split string using space char */ - token =strsep (&p_args," " ); - -if (!token) { -dev_info (device, -"%s: error parsing args %d\n" , __func__, -EINVAL ); - goto free_m; - } - -/* Convert 1st entry to int */ - ret =kstrtoint (token,10 , &temp); + temp =simple_strtoll (p, &endp,10 ); +if (p == endp || *endp !=' ' ) + ret = -EINVAL ; +else if (temp <INT_MIN || temp >INT_MAX ) + ret = -ERANGE ;if (ret) {dev_info (device,"%s: error parsing args %d\n" , __func__, ret); - goto free_m; +return size; } tl =int_to_short (temp); -/* Split string using space char */ - token =strsep (&p_args," " ); -if (!token) { -dev_info (device, -"%s: error parsing args %d\n" , __func__, -EINVAL ); - goto free_m; - } -/* Convert 2nd entry to int */ - ret =kstrtoint (token,10 , &temp); + p = endp +1 ; + temp =simple_strtoll (p, &endp,10 ); +if (p == endp) + ret = -EINVAL ; +else if (temp <INT_MIN || temp >INT_MAX ) + ret = -ERANGE ;if (ret) {dev_info (device,"%s: error parsing args %d\n" , __func__, ret); - goto free_m; +return size; }/* Prepare to cast to short by eliminating out of range values */
@@ -1915,7 +1897,7 @@ static ssize_t alarms_store(struct devicdev_info (device,"%s: error reading from the slave device %d\n" , __func__, ret); - goto free_m; +return size; }/* Write data in the device RAM */
@@ -1923,7 +1905,7 @@ static ssize_t alarms_store(struct devicdev_info (device,"%s: Device not supported by the driver %d\n" , __func__, -ENODEV ); - goto free_m; +return size; } ret =SLAVE_SPECIFIC_FUNC (sl)->write_data (sl, new_config_register);
@@ -1932,10 +1914,6 @@ static ssize_t alarms_store(struct devic"%s: error writing to the slave device %d\n" , __func__, ret); -free_m: -/* free allocated memory */ -kfree (orig); -return size; }
Greg Kroah-Hartman
maintainerPATCH 138/254 w1: fix redundant counter decrement in w1_attach_slave_device()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit cc8f92e41eb76f450f05234fef2054afc3633100 upstream.
In w1_attach_slave_device(), if __w1_attach_slave_device() fails, put_device() -> w1_slave_release() is called to do the cleanup job. In w1_slave_release(), sl->family->refcnt and sl->master->slave_count have already been decremented. There is no need to decrement twice in w1_attach_slave_device().
--- drivers/w1/w1.c | 2 -- 1 file changed, 2 deletions(-)
drivers/w1/w1.c +0 -2
@@ -758,8 +758,6 @@ int w1_attach_slave_device(struct w1_masif (err <0 ) {dev_err (&dev->dev,"%s: Attaching %s failed.\n" , __func__, sl->name); - dev->slave_count--; -w1_family_put (sl->family);atomic_dec (&sl->master->refcnt);kfree (sl);return err;
Greg Kroah-Hartman
maintainerPATCH 139/254 Revert "nfc/nci: Add the inconsistency check between the input data length and count"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit f40ddcc0c0ca1a0122a7f4440b429f97d5832bdf upstream.
This reverts commit 068648aab72c9ba7b0597354ef4d81ffaac7b979.
NFC packets may have NUL-bytes. Checking for string length is not a correct assumption here. As long as there is a check for the length copied from copy_from_user, all should be fine.
The fix only prevented the syzbot reproducer from triggering the bug because the packet is not enqueued anymore and the code that triggers the bug is not exercised.
The fix even broke
testing/selftests/nci/nci_dev, making all tests there fail. After the revert, 6 out of 8 tests pass.
--- drivers/nfc/virtual_ncidev.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/nfc/virtual_ncidev.c +0 -4
@@ -125,10 +125,6 @@ static ssize_t virtual_ncidev_write(strukfree_skb (skb);return -EFAULT ; } -if (strnlen (skb->data, count) != count) { -kfree_skb (skb); -return -EINVAL ; - }nci_recv_frame (vdev->ndev, skb);return count;
Greg Kroah-Hartman
maintainerPATCH 140/254 Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: gongqi <[email protected]>
commit 19a5d9ba6208e9006a2a9d5962aea4d6e427d8ab upstream.
The MECHREVO Wujie 15X Pro requires several i8042 quirks to function correctly. Specifically, NOMUX, RESET_ALWAYS, NOLOOP, and NOPNP are needed to ensure the keyboard and touchpad work reliably.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1176,6 +1176,13 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, /* * A lot of modern Clevo barebones have touchpad and/or keyboard issues * after suspend fixable with the forcenorestore quirk.
Greg Kroah-Hartman
maintainerPATCH 141/254 Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: feng <[email protected]>
commit 2934325f56150ad8dab8ab92cbe2997242831396 upstream.
The ASUS Zenbook UX425QA_UM425QA fails to initialize the keyboard after a cold boot.
A quirk already exists for "ZenBook UX425", but some Zenbooks report "Zenbook" with a lowercase 'b'. Since DMI matching is case-sensitive, the existing quirk is not applied to these "extra special" Zenbooks.
Testing confirms that this model needs the same quirks as the ZenBook UX425 variants.
--- drivers/input/serio/i8042-acpipnpio.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +11 -0
@@ -116,6 +116,17 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_NEVER) }, { +/* +* ASUS Zenbook UX425QA_UM425QA +* Some Zenbooks report "Zenbook" with a lowercase b. +*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Zenbook UX425QA_UM425QA"), + }, + .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER |SERIO_QUIRK_RESET_NEVER ) + }, + {/* ASUS ZenBook UX425UA/QA */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 142/254 scsi: storvsc: Process unsupported MODE_SENSE_10
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit 9eacec5d18f98f89be520eeeef4b377acee3e4b8 upstream.
The Hyper-V host does not support MODE_SENSE_10 and MODE_SENSE. The driver handles MODE_SENSE as unsupported command, but not for MODE_SENSE_10. Add MODE_SENSE_10 to the same handling logic and return correct code to SCSI layer.
--- drivers/scsi/storvsc_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/storvsc_drv.c +2 -1
@@ -1145,7 +1145,7 @@ static void storvsc_on_io_completion(str* The current SCSI handling on the host side does * not correctly handle: * INQUIRY command with page code parameter set to 0x80 -* MODE_SENSE command with cmd[2] == 0x1c +* MODE_SENSE and MODE_SENSE_10 command with cmd[2] == 0x1c * MAINTENANCE_IN is not supported by HyperV FC passthrough * * Setup srb and scsi status so this won't be fatal.
@@ -1155,6 +1155,7 @@ static void storvsc_on_io_completion(strif ((stor_pkt->vm_srb.cdb[0 ] ==INQUIRY ) || (stor_pkt->vm_srb.cdb[0 ] ==MODE_SENSE ) || + (stor_pkt->vm_srb.cdb[0 ] ==MODE_SENSE_10 ) || (stor_pkt->vm_srb.cdb[0 ] ==MAINTENANCE_IN &&hv_dev_is_fc (device))) { vstor_packet->vm_srb.scsi_status =0 ;