6.18.9-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.18.9-rc1 review
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.9-rc1
Matthieu Baerts (NGI0) <[email protected]>
mptcp: avoid dup SUB_CLOSED events after disconnect
Tejun Heo <[email protected]>
sched_ext: Fix SCX_KICK_WAIT to work reliably
Tejun Heo <[email protected]>
sched_ext: Don't kick CPUs running higher classes
Chen Ni <[email protected]>
net/sched: act_ife: convert comma to semicolon
John Ogness <[email protected]>
Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
Mikhail Gavrilov <[email protected]>
libbpf: Fix -Wdiscarded-qualifiers under C23
Andy Shevchenko <[email protected]>
gpiolib: acpi: Fix potential out-of-boundary left shift
Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Reset VCMDQ in tegra241_vcmdq_hw_init_user()
Alex Deucher <[email protected]>
drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
Jon Doron <[email protected]>
drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: adjust KGQ reset sequence
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: fix wptr reset in KGQ init
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: adjust KGQ reset sequence
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: fix wptr reset in KGQ init
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix wptr reset in KGQ init
Alex Deucher <[email protected]>
drm/amdgpu/soc21: fix xclk for APUs
Yang Wang <[email protected]>
drm/amd/pm: fix smu v14 soft clock frequency setting issue
Yang Wang <[email protected]>
drm/amd/pm: fix smu v13 soft clock frequency setting issue
Johan Hovold <[email protected]>
drm/imx/tve: fix probe device leak
Johan Hovold <[email protected]>
drm/msm/a6xx: fix bogus hwcg register updates
Miguel Ojeda <[email protected]>
drm/tyr: depend on COMMON_CLK to fix build error
Tvrtko Ursulin <[email protected]>
drm/xe/xelp: Fix Wa_18022495364
Tvrtko Ursulin <[email protected]>
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
SeungJong Ha <[email protected]>
scripts: generate_rust_analyzer: fix resolution of #[pin_data] macros
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: compile sysroot with correct edition
Onur Özkan <[email protected]>
scripts: generate_rust_analyzer: remove sysroot assertion
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: Add pin_init_internal deps
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: Add pin_init -> compiler_builtins dep
Alexandre Courbot <[email protected]>
rust: sync: refcount: always inline functions using build_assert with arguments
Miguel Ojeda <[email protected]>
rust: sync: atomic: Provide stub for rusttest 32-bit hosts
Alexandre Courbot <[email protected]>
rust: bits: always inline functions using build_assert with arguments
Jibin Zhang <[email protected]>
net: fix segmentation of forwarding fraglist GRO
Kairui Song <[email protected]>
mm/shmem, swap: fix race of truncate and swap entry split
Jane Chu <[email protected]>
mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn
robin.kuo <[email protected]>
mm, swap: restore swap_space attr aviod kernel panic
Jane Chu <[email protected]>
mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
Pimyn Girgis <[email protected]>
mm/kfence: randomize the freelist on initialization
Qu Wenruo <[email protected]>
btrfs: do not strictly require dirty metadata threshold for metadata writepages
Jan Kara <[email protected]>
flex_proportions: make fprop_new_period() hardirq safe
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: fix local endp not being tracked
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: check subflow errors in close events
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: check no dup close events after error
Matthieu Baerts (NGI0) <[email protected]>
mptcp: only reset subflow errors when propagated
Andrey Ryabinin <[email protected]>
mm/kasan: fix KASAN poisoning in vrealloc()
Robin Murphy <[email protected]>
gpio: rockchip: Stop calling pinctrl for set_direction
Zhang Heng <[email protected]>
ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine
Ming Lei <[email protected]>
nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
Kohei Enju <[email protected]>
efivarfs: fix error propagation in efivar_entry_get()
Thomas Fourier <[email protected]>
scsi: qla2xxx: edif: Fix dma_free_coherent() size
Chen Miao <[email protected]>
kbuild: rust: clean libpin_init_internal in mrproper
Martin Larsson <[email protected]>
gpio: pca953x: mask interrupts in irq shutdown
Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
Haoxiang Li <[email protected]>
scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
Fabio Estevam <[email protected]>
ASoC: fsl: imx-card: Do not force slot width to sample width
Miguel Ojeda <[email protected]>
rust: kbuild: give --config-path to rustfmt in .rsi target
Hang Shu <[email protected]>
rust: rbtree: fix documentation typo in CursorMut peek_next method
Han Gao <[email protected]>
riscv: compat: fix COMPAT_UTS_MACHINE definition
Takashi Sakamoto <[email protected]>
firewire: core: fix race condition against transaction list
Steven Rostedt <[email protected]>
perf: sched: Fix perf crash with new is_user_task() helper
Krzysztof Kozlowski <[email protected]>
pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins
Bartosz Golaszewski <[email protected]>
pinctrl: meson: mark the GPIO controller as sleeping
Bartosz Golaszewski <[email protected]>
pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
Laveesh Bansal <[email protected]>
writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
Peter Zijlstra <[email protected]>
sched/deadline: Fix 'stuck' dl_server
Peter Zijlstra <[email protected]>
sched/deadline: Document dl_server
Shuicheng Lin <[email protected]>
drm/xe/nvm: Fix double-free on aux add failure
Shuicheng Lin <[email protected]>
drm/xe/nvm: Manage nvm aux cleanup with devres
Shuicheng Lin <[email protected]>
drm/xe/configfs: Fix is_bound() pci_dev lifetime
Sai Sree Kartheek Adivi <[email protected]>
dma/pool: distinguish between missing and exhausted atomic pools
Shida Zhang <[email protected]>
bcache: fix I/O accounting leak in detached_dev_do_request
Shida Zhang <[email protected]>
bcache: use bio cloning for detached device requests
Shida Zhang <[email protected]>
bcache: fix improper use of bi_end_io
Oreoluwa Babatunde <[email protected]>
of: reserved_mem: Allow reserved_mem framework detect "cma=" kernel param
Yuntao Wang <[email protected]>
of/reserved_mem: Simplify the logic of fdt_scan_reserved_mem_reg_nodes()
Ethan Zuo <[email protected]>
kbuild: Fix permissions of modules.builtin.modinfo
Nathan Chancellor <[email protected]>
kbuild: rpm-pkg: Generate debuginfo package manually
Doug Berger <[email protected]>
gpio: brcmstb: correct hwirq to bank map
Yang Wang <[email protected]>
drm/amd/pm: fix race in power state check before mutex lock
Yuhao Huang <[email protected]>
gpio: virtuser: fix UAF in configfs release path
Denis Sergeev <[email protected]>
gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
Tagir Garaev <[email protected]>
ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
Shuicheng Lin <[email protected]>
drm/xe: Skip address copy for sync-only execs
Bard Liao <[email protected]>
ASoC: soc-acpi-intel-ptl-match: fix name_prefix of rt1320-2
Kery Qi <[email protected]>
scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
Benjamin Berg <[email protected]>
wifi: mac80211: correctly decode TTLM with default link map
Benjamin Berg <[email protected]>
wifi: mac80211: apply advertised TTLM from association response
Benjamin Berg <[email protected]>
wifi: mac80211: parse all TTLM entries
Jianbo Liu <[email protected]>
net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
Parav Pandit <[email protected]>
net/mlx5: Fix vhca_id access call trace use before alloc
Cosmin Ratiu <[email protected]>
net/mlx5: Initialize events outside devlink lock
Shay Drory <[email protected]>
net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
Wei Fang <[email protected]>
net: phy: micrel: fix clk warning when removing the driver
Daniel Zahka <[email protected]>
net/mlx5e: don't assume psp tx skbs are ipv6 csum handling
Martin Kaiser <[email protected]>
net: bridge: fix static key check
Kuniyuki Iwashima <[email protected]>
nfc: nci: Fix race between rfkill and nci_unregister_device().
Gal Pressman <[email protected]>
net/mlx5e: Account for netdev stats in ndo_get_stats64
Mark Bloch <[email protected]>
net/mlx5e: TC, delete flows only for existing peers
Jesse Brandeburg <[email protected]>
ice: stop counting UDP csum mismatch as rx_errors
Aaron Ma <[email protected]>
ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
Kohei Enju <[email protected]>
ixgbe: don't initialize aci lock in ixgbe_recovery_probe()
Kohei Enju <[email protected]>
ixgbe: fix memory leaks in the ixgbe_recovery_probe() path
Nikolay Aleksandrov <[email protected]>
bonding: fix use-after-free due to enslave fail after slave array update
Kuniyuki Iwashima <[email protected]>
nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
Vivian Wang <[email protected]>
net: spacemit: Check for netif_carrier_ok() in emac_stats_update()
Eric Dumazet <[email protected]>
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
Kery Qi <[email protected]>
rocker: fix memory leak in rocker_world_port_post_fini()
Zeng Chi <[email protected]>
net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id()
Kery Qi <[email protected]>
net: wwan: t7xx: fix potential skb->frags overflow in RX path
Fernando Fernandez Mancera <[email protected]>
ipv6: use the right ifindex when replying to icmpv6 from localhost
Zilin Guan <[email protected]>
net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
Edward Cree <[email protected]>
sfc: fix deadlock in RSS config read
Eric Dumazet <[email protected]>
bonding: annotate data-races around slave->last_rx
Zilin Guan <[email protected]>
octeon_ep: Fix memory leak in octep_device_setup()
Justin Chen <[email protected]>
net: bcmasp: fix early exit leak with fixed phy
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
Zilin Guan <[email protected]>
net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
Jianpeng Chang <[email protected]>
Bluetooth: MGMT: Fix memory leak in set_ssp_complete
Jia-Hong Su <[email protected]>
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
Zilin Guan <[email protected]>
can: at91_can: Fix memory leak in at91_can_probe()
Qu Wenruo <[email protected]>
btrfs: zlib: fix the folio leak on S390 hardware acceleration
Amir Goldstein <[email protected]>
readdir: require opt-in for d_type flags
-------------
Diffstat:
Makefile | 7 +- arch/arm64/configs/defconfig | 1 - arch/riscv/include/asm/compat.h | 2 +- drivers/bluetooth/hci_ldisc.c | 4 +- drivers/firewire/core-transaction.c | 19 +- drivers/gpio/gpio-brcmstb.c | 8 +- drivers/gpio/gpio-pca953x.c | 2 + drivers/gpio/gpio-rockchip.c | 8 - drivers/gpio/gpio-virtuser.c | 8 +- drivers/gpio/gpiolib-acpi-core.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 25 +-- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 25 +-- drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 1 + drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 1 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 + drivers/gpu/drm/drm_gem.c | 18 +- drivers/gpu/drm/imx/ipuv3/imx-tve.c | 13 ++ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 - drivers/gpu/drm/nouveau/nouveau_display.c | 2 - drivers/gpu/drm/tyr/Kconfig | 1 + drivers/gpu/drm/xe/xe_configfs.c | 3 +- drivers/gpu/drm/xe/xe_device.c | 2 - drivers/gpu/drm/xe/xe_exec.c | 6 +- drivers/gpu/drm/xe/xe_lrc.c | 2 +- drivers/gpu/drm/xe/xe_nvm.c | 55 +++--- drivers/gpu/drm/xe/xe_nvm.h | 2 - drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 3 + drivers/md/bcache/bcache.h | 9 + drivers/md/bcache/request.c | 82 ++++---- drivers/md/bcache/super.c | 12 +- drivers/net/bonding/bond_main.c | 28 +-- drivers/net/bonding/bond_options.c | 8 +- drivers/net/can/at91_can.c | 2 +- drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 5 +- drivers/net/ethernet/intel/ice/ice_lib.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 1 - drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 26 +-- drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 16 ++ .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 +- .../mellanox/mlx5/core/en_accel/psp_rxtx.c | 17 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 20 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +- .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 36 ++-- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + drivers/net/ethernet/rocker/rocker_main.c | 5 +- drivers/net/ethernet/sfc/mcdi_filters.c | 7 +- drivers/net/ethernet/spacemit/k1_emac.c | 34 +++- drivers/net/phy/micrel.c | 17 +- drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 9 +- drivers/nvme/target/io-cmd-bdev.c | 3 +- drivers/of/of_reserved_mem.c | 44 +++-- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 9 +- drivers/pinctrl/qcom/Kconfig | 15 +- drivers/pinctrl/qcom/Makefile | 1 - drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 ++ drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c | 3 + drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c | 151 -------------- drivers/scsi/be2iscsi/be_mgmt.c | 1 + drivers/scsi/qla2xxx/qla_os.c | 2 +- drivers/target/sbp/sbp_target.c | 4 +- fs/btrfs/disk-io.c | 22 --- fs/btrfs/extent_io.c | 3 +- fs/btrfs/extent_io.h | 3 +- fs/btrfs/zlib.c | 1 + fs/efivarfs/vars.c | 2 +- fs/fs-writeback.c | 14 +- fs/readdir.c | 3 + include/linux/cma.h | 9 + include/linux/fs.h | 6 +- include/linux/kasan.h | 14 ++ include/linux/sched.h | 5 + include/net/bonding.h | 13 +- include/net/nfc/nfc.h | 2 + kernel/dma/contiguous.c | 16 +- kernel/dma/pool.c | 7 +- kernel/events/callchain.c | 2 +- kernel/events/core.c | 6 +- kernel/sched/deadline.c | 206 +++++++++++++++++++ kernel/sched/ext.c | 57 +++--- kernel/sched/ext_internal.h | 6 +- lib/flex_proportions.c | 5 +- mm/kasan/common.c | 21 ++ mm/kfence/core.c | 23 ++- mm/memory-failure.c | 99 ++++++---- mm/shmem.c | 45 +++-- mm/swap.h | 2 +- mm/swap_state.c | 3 +- mm/vmalloc.c | 7 +- net/bluetooth/mgmt.c | 3 + net/bridge/br_input.c | 2 +- net/core/filter.c | 2 + net/ipv4/tcp_offload.c | 3 +- net/ipv4/udp_offload.c | 3 +- net/ipv6/icmp.c | 4 +- net/ipv6/tcpv6_offload.c | 3 +- net/mac80211/ieee80211_i.h | 2 - net/mac80211/mlme.c | 217 ++++++++++++--------- net/mptcp/pm_kernel.c | 16 +- net/mptcp/protocol.c | 13 +- net/nfc/core.c | 27 ++- net/nfc/llcp_commands.c | 17 +- net/nfc/llcp_core.c | 4 +- net/nfc/nci/core.c | 4 +- net/sched/act_ife.c | 6 +- rust/kernel/bits.rs | 6 +- rust/kernel/rbtree.rs | 2 +- rust/kernel/sync/atomic/predefine.rs | 11 ++ rust/kernel/sync/refcount.rs | 3 +- scripts/Makefile.build | 2 +- scripts/Makefile.vmlinux | 3 +- scripts/generate_rust_analyzer.py | 40 +++- scripts/package/kernel.spec | 65 +++--- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 8 + sound/soc/fsl/imx-card.c | 1 - sound/soc/intel/boards/sof_es8336.c | 2 +- sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 2 +- tools/lib/bpf/libbpf.c | 7 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 81 +++++++- 133 files changed, 1285 insertions(+), 784 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/122 readdir: require opt-in for d_type flags
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit c644bce62b9c6b441143a03c910f986109c47001 ]
Commit c31f91c6af96 ("fuse: don't allow signals to interrupt getdents copying") introduced the use of high bits in d_type as flags. However, overlayfs was not adapted to handle this change.
In ovl_cache_entry_new(), the code checks if d_type == DT_CHR to determine if an entry might be a whiteout. When fuse is used as the lower layer and sets high bits in d_type, this comparison fails, causing whiteout files to not be recognized properly and resulting in incorrect overlayfs behavior.
Fix this by requiring callers of iterate_dir() to opt-in for getting flag bits in d_type outside of S_DT_MASK.
--- fs/readdir.c | 3 +++ include/linux/fs.h | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-)
fs/readdir.c +3 -0
@@ -316,6 +316,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,struct getdents_callback buf = { .ctx.actor = filldir, .ctx.count = count, + .ctx.dt_flags_mask =FILLDIR_FLAG_NOINTR , .current_dir = dirent };int error;
@@ -400,6 +401,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,struct getdents_callback64 buf = { .ctx.actor = filldir64, .ctx.count = count, + .ctx.dt_flags_mask =FILLDIR_FLAG_NOINTR , .current_dir = dirent };int error;
@@ -569,6 +571,7 @@ COMPAT_SYSCALL_DEFINE3(getdents, unsigned int, fd,struct compat_getdents_callback buf = { .ctx.actor = compat_filldir, .ctx.count = count, + .ctx.dt_flags_mask =FILLDIR_FLAG_NOINTR , .current_dir = dirent, };int error;
include/linux/fs.h +5 -1
@@ -2207,6 +2207,8 @@ struct dir_context {* INT_MAX unlimited */ int count; +/* @actor supports these flags in d_type high bits */ +unsigned int dt_flags_mask; };/* If OR-ed with d_type, pending signals are not checked */
@@ -3985,7 +3987,9 @@ static inline bool dir_emit(struct dir_context *ctx, const char *name, int namelen, u64 ino, unsigned type) { - return ctx->actor(ctx, name, namelen, ctx->pos, ino, type); + unsigned int dt_mask = S_DT_MASK | ctx->dt_flags_mask; + +return ctx->actor (ctx, name, namelen, ctx->pos, ino, type & dt_mask); }static inline bool dir_emit_dot (struct file *file,struct dir_context *ctx) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/122 btrfs: zlib: fix the folio leak on S390 hardware acceleration
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 0d0f1314e8f86f5205f71f9e31e272a1d008e40b ]
[BUG]
After commit aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation"), we no longer release the folio of the page cache of folio returned by btrfs_compress_filemap_get_folio() for S390 hardware acceleration path.
[CAUSE]
Before that commit, we call kumap_local() and folio_put() after handling each folio.
Although the timing is not ideal (it release previous folio at the beginning of the loop, and rely on some extra cleanup out of the loop), it at least handles the folio release correctly.
Meanwhile the refactored code is easier to read, it lacks the call to release the filemap folio.
[FIX]
Add the missing folio_put() for copy_data_into_buffer().
--- fs/btrfs/zlib.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/zlib.c +1 -0
@@ -139,6 +139,7 @@ static int copy_data_into_buffer(struct address_space *mapping, data_in =kmap_local_folio (folio, offset);memcpy (workspace->buf + cur - filepos, data_in, copy_length);kunmap_local (data_in); +folio_put (folio); cur += copy_length; }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/122 can: at91_can: Fix memory leak in at91_can_probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 0baa4d3170d72a2a8dc93bf729d6d04ad113dc72 ]
In at91_can_probe(), the dev structure is allocated via alloc_candev(). However, if the subsequent call to devm_phy_optional_get() fails, the code jumps directly to exit_iounmap, missing the call to free_candev(). This results in a memory leak of the allocated net_device structure.
Fix this by jumping to the exit_free label instead, which ensures that free_candev() is called to properly release the memory.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/can/at91_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/at91_can.c +1 -1
@@ -1100,7 +1100,7 @@ static int at91_can_probe(struct platform_device *pdev)if (IS_ERR (transceiver)) { err =PTR_ERR (transceiver);dev_err_probe (&pdev->dev, err,"failed to get phy\n" ); - goto exit_iounmap; + goto exit_free; } dev->netdev_ops = &at91_netdev_ops;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/122 Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Hong Su <[email protected]>
[ Upstream commit 0c3cd7a0b862c37acbee6d9502107146cc944398 ]
hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv.
The race condition is:
CPU0 CPU1
---- ----
hci_uart_set_proto()
set_bit(HCI_UART_PROTO_INIT)
hci_uart_register_dev()
tty write wakeup
hci_uart_tty_wakeup()
hci_uart_tx_wakeup()
schedule_work(&hu->write_work)
proto->open(hu)
// initializes hu->priv
hci_uart_write_work()
hci_uart_dequeue()
proto->dequeue(hu)
// accesses hu->priv (NULL!)Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.
--- drivers/bluetooth/hci_ldisc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bluetooth/hci_ldisc.c +2 -2
@@ -685,6 +685,8 @@ static int hci_uart_register_dev(struct hci_uart *hu)return err; } +set_bit (HCI_UART_PROTO_INIT , &hu->flags); +if (test_bit (HCI_UART_INIT_PENDING , &hu->hdev_flags))return 0 ;
@@ -712,8 +714,6 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) hu->proto = p; -set_bit (HCI_UART_PROTO_INIT , &hu->flags); - err =hci_uart_register_dev (hu);if (err) {return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/122 Bluetooth: MGMT: Fix memory leak in set_ssp_complete
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianpeng Chang <[email protected]>
[ Upstream commit 1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2 ]
Fix memory leak in set_ssp_complete() where mgmt_pending_cmd structures are not freed after being removed from the pending list.
Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but missed adding mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). Other completion functions like set_le_complete() were fixed correctly in the same commit.
This causes a memory leak of the mgmt_pending_cmd structure and its associated parameter data for each SSP command that completes.
Add the missing mgmt_pending_free(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in set_advertising_complete().
--- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/mgmt.c +3 -0
@@ -1954,6 +1954,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) }mgmt_cmd_status (cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); +mgmt_pending_free (cmd);return ; }
@@ -1972,6 +1973,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)sock_put (match.sk);hci_update_eir_sync (hdev); +mgmt_pending_free (cmd); }static int set_ssp_sync (struct hci_dev *hdev,void *data)
@@ -6356,6 +6358,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)hci_dev_clear_flag (hdev,HCI_ADVERTISING );settings_rsp (cmd, &match); +mgmt_pending_free (cmd);new_settings (hdev, match.sk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/122 net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 108948f723b13874b7ebf6b3f1cc598a7de38622 ]
In esw_acl_ingress_lgcy_setup(), if esw_acl_table_create() fails, the function returns directly without releasing the previously created counter, leading to a memory leak.
Fix this by jumping to the out label instead of returning directly, which aligns with the error handling logic of other paths in this function.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c +1 -1
@@ -188,7 +188,7 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,if (IS_ERR (vport->ingress.acl)) { err =PTR_ERR (vport->ingress.acl); vport->ingress.acl =NULL ; -return err; + goto out; } err =esw_acl_ingress_lgcy_groups_create (esw, vport);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/122 can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 494fc029f662c331e06b7c2031deff3c64200eed ]
Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback():
unanchor URL on usb_submit_urb() error") a failing resubmit URB will print an info message.
In the case of a short read where netdev has not yet been assigned, initialize as NULL to avoid dereferencing an undefined value. Also report the error value of the failed resubmit.
--- drivers/net/can/usb/gs_usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/usb/gs_usb.c +2 -2
@@ -610,7 +610,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) {struct gs_usb *parent = urb->context;struct gs_can *dev; -struct net_device *netdev; +struct net_device *netdev =NULL ;int rc;struct net_device_stats *stats;struct gs_host_frame *hf = urb->transfer_buffer;
@@ -768,7 +768,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) } }else if (rc != -ESHUTDOWN &&net_ratelimit ()) {netdev_info (netdev,"failed to re-submit IN URB: %pe\n" , -ERR_PTR (urb->status)); +ERR_PTR (rc)); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/122 net: bcmasp: fix early exit leak with fixed phy
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit 6de4436bf369e1444606445e4cd5df5bcfc74b48 ]
We are not deregistering the fixed phy link when hitting the early exit condition. Add the correct early exit sequence.
--- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +4 -1
@@ -1261,7 +1261,7 @@ struct bcmasp_intf *bcmasp_interface_create(struct bcmasp_priv *priv,netdev_err (intf->ndev,"invalid PHY mode: %s for port %d\n" ,phy_modes (intf->phy_interface), intf->port); ret = -EINVAL ; - goto err_free_netdev; + goto err_deregister_fixed_link; } ret =of_get_ethdev_address (ndev_dn, ndev);
@@ -1286,6 +1286,9 @@ struct bcmasp_intf *bcmasp_interface_create(struct bcmasp_priv *priv,return intf; +err_deregister_fixed_link: +if (of_phy_is_fixed_link (ndev_dn)) +of_phy_deregister_fixed_link (ndev_dn); err_free_netdev:free_netdev (ndev); err:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/122 octeon_ep: Fix memory leak in octep_device_setup()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 8016dc5ee19a77678c264f8ba368b1e873fa705b ]
In octep_device_setup(), if octep_ctrl_net_init() fails, the function returns directly without unmapping the mapped resources and freeing the allocated configuration memory.
Fix this by jumping to the unsupported_dev label, which performs the necessary cleanup. This aligns with the error handling logic of other paths in this function.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +1 -1
@@ -1338,7 +1338,7 @@ int octep_device_setup(struct octep_device *oct) ret =octep_ctrl_net_init (oct);if (ret) -return ret; + goto unsupported_dev;INIT_WORK (&oct->tx_timeout_task, octep_tx_timeout_task);INIT_WORK (&oct->ctrl_mbox_task, octep_ctrl_mbox_task);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/122 bonding: annotate data-races around slave->last_rx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f6c3665b6dc53c3ab7d31b585446a953a74340ef ]
slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations.
syzbot reported:
BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate
write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:
bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
...
write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:
bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:318 [inline]
...
value changed: 0x0000000100005365 -> 0x0000000100005366
--- drivers/net/bonding/bond_main.c | 18 ++++++++++-------- drivers/net/bonding/bond_options.c | 8 ++++---- include/net/bonding.h | 13 +++++++------ 3 files changed, 21 insertions(+), 18 deletions(-)
drivers/net/bonding/bond_main.c +10 -8
@@ -3138,8 +3138,8 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32 __func__, &sip);return ; } - slave->last_rx = jiffies; - slave->target_last_arp_rx[i] = jiffies; +WRITE_ONCE (slave->last_rx, jiffies); +WRITE_ONCE (slave->target_last_arp_rx[i], jiffies); } static int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
@@ -3358,8 +3358,8 @@ static void bond_validate_na(struct bonding *bond, struct slave *slave, __func__, saddr);return ; } - slave->last_rx = jiffies; - slave->target_last_arp_rx[i] = jiffies; +WRITE_ONCE (slave->last_rx, jiffies); +WRITE_ONCE (slave->target_last_arp_rx[i], jiffies); } static int bond_na_rcv(const struct sk_buff *skb, struct bonding *bond,
@@ -3429,7 +3429,7 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond, (slave_do_arp_validate_only(bond) && is_ipv6) || #endif !slave_do_arp_validate_only(bond)) - slave->last_rx = jiffies; +WRITE_ONCE (slave->last_rx, jiffies); return RX_HANDLER_ANOTHER; }else if (is_arp) {return bond_arp_rcv (skb, bond, slave);
@@ -3497,7 +3497,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)if (slave->link !=BOND_LINK_UP ) {if (bond_time_in_interval (bond, last_tx,1 ) && -bond_time_in_interval (bond, slave->last_rx,1 )) { +bond_time_in_interval (bond,READ_ONCE (slave->last_rx),1 )) {bond_propose_link_state (slave,BOND_LINK_UP ); slave_state_changed =1 ;
@@ -3521,8 +3521,10 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)* when the source ip is 0, so don't take the link down * if we don't know our ip yet */ -if (!bond_time_in_interval (bond, last_tx, bond->params.missed_max) || - !bond_time_in_interval (bond, slave->last_rx, bond->params.missed_max)) { +if (!bond_time_in_interval (bond, last_tx, + bond->params.missed_max) || + !bond_time_in_interval (bond,READ_ONCE (slave->last_rx), + bond->params.missed_max)) {bond_propose_link_state (slave,BOND_LINK_DOWN ); slave_state_changed =1 ;
drivers/net/bonding/bond_options.c +4 -4
@@ -1152,7 +1152,7 @@ static void _bond_options_arp_ip_target_set(struct bonding *bond, int slot,if (slot >=0 && slot <BOND_MAX_ARP_TARGETS ) {bond_for_each_slave (bond, slave, iter) - slave->target_last_arp_rx[slot] = last_rx; +WRITE_ONCE (slave->target_last_arp_rx[slot], last_rx); targets[slot] = target; } }
@@ -1221,8 +1221,8 @@ static int bond_option_arp_ip_target_rem(struct bonding *bond, __be32 target)bond_for_each_slave (bond, slave, iter) { targets_rx = slave->target_last_arp_rx;for (i = ind; (i <BOND_MAX_ARP_TARGETS -1 ) && targets[i+1 ]; i++) - targets_rx[i] = targets_rx[i+1 ]; - targets_rx[i] =0 ; +WRITE_ONCE (targets_rx[i],READ_ONCE (targets_rx[i+1 ])); +WRITE_ONCE (targets_rx[i],0 ); }for (i = ind; (i <BOND_MAX_ARP_TARGETS -1 ) && targets[i+1 ]; i++) targets[i] = targets[i+1 ];
@@ -1377,7 +1377,7 @@ static void _bond_options_ns_ip6_target_set(struct bonding *bond, int slot,if (slot >=0 && slot <BOND_MAX_NS_TARGETS ) {bond_for_each_slave (bond, slave, iter) { - slave->target_last_arp_rx[slot] = last_rx; +WRITE_ONCE (slave->target_last_arp_rx[slot], last_rx);slave_set_ns_maddr (bond, slave, target, &targets[slot]); } targets[slot] = *target;
include/net/bonding.h +7 -6
@@ -521,13 +521,14 @@ static inline int bond_is_ip6_target_ok(struct in6_addr *addr)static inline unsigned long slave_oldest_target_arp_rx (struct bonding *bond,struct slave *slave) { +unsigned long tmp, ret =READ_ONCE (slave->target_last_arp_rx[0 ]);int i =1 ; -unsigned long ret = slave->target_last_arp_rx[0 ]; - -for (; (i <BOND_MAX_ARP_TARGETS ) && bond->params.arp_targets[i]; i++) -if (time_before (slave->target_last_arp_rx[i], ret)) - ret = slave->target_last_arp_rx[i]; +for (; (i <BOND_MAX_ARP_TARGETS ) && bond->params.arp_targets[i]; i++) { + tmp =READ_ONCE (slave->target_last_arp_rx[i]); +if (time_before (tmp, ret)) + ret = tmp; + }return ret; }
@@ -537,7 +538,7 @@ static inline unsigned long slave_last_rx(struct bonding *bond,if (bond->params.arp_all_targets ==BOND_ARP_TARGETS_ALL )return slave_oldest_target_arp_rx (bond, slave); -return slave->last_rx; +return READ_ONCE (slave->last_rx); }static inline void slave_update_last_tx (struct slave *slave)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/122 sfc: fix deadlock in RSS config read
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Cree <[email protected]>
[ Upstream commit 944c614b0a7afa5b87612c3fb557b95a50ad654c ]
Since cited commit, core locks the net_device's rss_lock when handling
ethtool -x command, so driver's implementation should not lock it again. Remove the latter.
--- drivers/net/ethernet/sfc/mcdi_filters.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/ethernet/sfc/mcdi_filters.c +1 -6
@@ -2182,12 +2182,7 @@ int efx_mcdi_rx_pull_rss_context_config(struct efx_nic *efx,int efx_mcdi_rx_pull_rss_config (struct efx_nic *efx) { -int rc; - -mutex_lock (&efx->net_dev->ethtool->rss_lock); - rc =efx_mcdi_rx_pull_rss_context_config (efx, &efx->rss_context); -mutex_unlock (&efx->net_dev->ethtool->rss_lock); -return rc; +return efx_mcdi_rx_pull_rss_context_config (efx, &efx->rss_context); }void efx_mcdi_rx_restore_rss_contexts (struct efx_nic *efx)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/122 net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 09f979d1f312627b31d2ee1e46f9692e442610cd ]
In mvpp2_ethtool_cls_rule_ins(), the ethtool_rule is allocated by ethtool_rx_flow_rule_create(). If the subsequent conversion to flow type fails, the function jumps to the clean_rule label.
However, the clean_rule label only frees efs, skipping the cleanup of ethtool_rule, which leads to a memory leak.
Fix this by jumping to the clean_eth_rule label, which properly calls ethtool_rx_flow_rule_destroy() before freeing efs.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c +1 -1
@@ -1389,7 +1389,7 @@ int mvpp2_ethtool_cls_rule_ins(struct mvpp2_port *port, efs->rule.flow_type =mvpp2_cls_ethtool_flow_to_type (info->fs.flow_type);if (efs->rule.flow_type <0 ) { ret = efs->rule.flow_type; - goto clean_rule; + goto clean_eth_rule; } ret =mvpp2_cls_rfs_parse_rule (&efs->rule);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/122 ipv6: use the right ifindex when replying to icmpv6 from localhost
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 03cbcdf93866e61beb0063392e6dbb701f03aea2 ]
When replying to a ICMPv6 echo request that comes from localhost address the right output ifindex is 1 (lo) and not rt6i_idev dev index. Use the skb device ifindex instead. This fixes pinging to a local address from localhost source address.
$ ping6 -I ::1 2001:1:1::2 -c 3 PING 2001:1:1::2 (2001:1:1::2) from ::1 : 56 data bytes 64 bytes from 2001:1:1::2: icmp_seq=1 ttl=64 time=0.037 ms 64 bytes from 2001:1:1::2: icmp_seq=2 ttl=64 time=0.069 ms 64 bytes from 2001:1:1::2: icmp_seq=3 ttl=64 time=0.122 ms
2001:1:1::2 ping statistics
3 packets transmitted, 3 received, 0% packet loss, time 2032ms rtt min/avg/max/mdev = 0.037/0.076/0.122/0.035 ms
--- net/ipv6/icmp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/icmp.c +3 -1
@@ -769,7 +769,9 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb) fl6.daddr =ipv6_hdr (skb)->saddr;if (saddr) fl6.saddr = *saddr; - fl6.flowi6_oif =icmp6_iif (skb); + fl6.flowi6_oif =ipv6_addr_loopback (&fl6.daddr) ? + skb->dev->ifindex : +icmp6_iif (skb); fl6.fl6_icmp_type = type; fl6.flowi6_mark = mark; fl6.flowi6_uid =sock_net_uid (net,NULL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/122 net: wwan: t7xx: fix potential skb->frags overflow in RX path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit f0813bcd2d9d97fdbdf2efb9532ab03ae92e99e6 ]
When receiving data in the DPMAIF RX path,
the t7xx_dpmaif_set_frag_to_skb() function adds
page fragments to an skb without checking if the number of fragments has exceeded MAX_SKB_FRAGS. This could lead to a buffer overflow in skb_shinfo(skb)->frags[] array, corrupting adjacent memory and potentially causing kernel crashes or other undefined behavior.
This issue was identified through static code analysis by comparing with a similar vulnerability fixed in the mt76 driver commit b102f0c522cf ("mt76:
fix array overflow on receiving too many fragments for a packet").
The vulnerability could be triggered if the modem firmware sends packets with excessive fragments. While under normal protocol conditions (MTU 3080 bytes, BAT buffer 3584 bytes),
a single packet should not require additional
fragments, the kernel should not blindly trust firmware behavior. Malicious, buggy, or compromised firmware could potentially craft packets with more fragments than the kernel expects.
Fix this by adding a bounds check before calling skb_add_rx_frag() to ensure nr_frags does not exceed MAX_SKB_FRAGS.
The check must be performed before unmapping to avoid a page leak and double DMA unmap during device teardown.
--- drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c +7 -2
@@ -395,6 +395,7 @@ static int t7xx_dpmaif_set_frag_to_skb(const struct dpmaif_rx_queue *rxq, struct sk_buff *skb) {unsigned long long data_bus_addr, data_base_addr; +struct skb_shared_info *shinfo =skb_shinfo (skb);struct device *dev = rxq->dpmaif_ctrl->dev;struct dpmaif_bat_page *page_info;unsigned int data_len;
@@ -402,18 +403,22 @@ static int t7xx_dpmaif_set_frag_to_skb(const struct dpmaif_rx_queue *rxq, page_info = rxq->bat_frag->bat_skb; page_info +=t7xx_normal_pit_bid (pkt_info); -dma_unmap_page (dev, page_info->data_bus_addr, page_info->data_len,DMA_FROM_DEVICE );if (!page_info->page)return -EINVAL ; +if (shinfo->nr_frags >=MAX_SKB_FRAGS ) +return -EINVAL ; + +dma_unmap_page (dev, page_info->data_bus_addr, page_info->data_len,DMA_FROM_DEVICE ); + data_bus_addr =le32_to_cpu (pkt_info->pd.data_addr_h); data_bus_addr = (data_bus_addr <<32 ) +le32_to_cpu (pkt_info->pd.data_addr_l); data_base_addr = page_info->data_bus_addr; data_offset = data_bus_addr - data_base_addr; data_offset += page_info->offset; data_len =FIELD_GET (PD_PIT_DATA_LEN ,le32_to_cpu (pkt_info->header)); -skb_add_rx_frag (skb,skb_shinfo (skb)->nr_frags, page_info->page, +skb_add_rx_frag (skb, shinfo->nr_frags, page_info->page, data_offset, data_len, page_info->data_len); page_info->page =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/122 net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Chi <[email protected]>
[ Upstream commit ca12c4a155ebf84e9ef29b05ce979bc89364290f ]
The function mlx5_esw_vport_vhca_id() is declared to return bool, but returns -EOPNOTSUPP (-45), which is an int error code. This causes a signedness bug as reported by smatch.
This patch fixes this smatch report:drivers/net/ethernet/mellanox/mlx5/core/eswitch.h:981 mlx5_esw_vport_vhca_id()
warn: signedness bug returning '(-45)'
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +1 -1
@@ -1002,7 +1002,7 @@ mlx5_esw_host_functions_enabled(const struct mlx5_core_dev *dev)static inline bool mlx5_esw_vport_vhca_id (struct mlx5_eswitch *esw,u16 vportn,u16 *vhca_id) { -return -EOPNOTSUPP ; +return false; }#endif /* CONFIG_MLX5_ESWITCH */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/122 rocker: fix memory leak in rocker_world_port_post_fini()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit 8d7ba71e46216b8657a82ca2ec118bc93812a4d0 ]
In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with kzalloc(wops->port_priv_size, GFP_KERNEL). However, in rocker_world_port_post_fini(), the memory is only freed when wops->port_post_fini callback is set:
if (!wops->port_post_fini)
return;
wops->port_post_fini(rocker_port);
kfree(rocker_port->wpriv);Since rocker_ofdpa_ops does not implement port_post_fini callback (it is NULL), the wpriv memory allocated for each port is never freed when ports are removed. This leads to a memory leak of sizeof(struct ofdpa_port) bytes per port on every device removal.
Fix this by always calling kfree(rocker_port->wpriv) regardless of whether the port_post_fini callback exists.
--- drivers/net/ethernet/rocker/rocker_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/rocker/rocker_main.c +2 -3
@@ -1524,9 +1524,8 @@ static void rocker_world_port_post_fini(struct rocker_port *rocker_port) {struct rocker_world_ops *wops = rocker_port->rocker->wops; -if (!wops->port_post_fini) -return ; - wops->port_post_fini (rocker_port); +if (wops->port_post_fini) + wops->port_post_fini (rocker_port);kfree (rocker_port->wpriv); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/122 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d ]
syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup()
Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready.
list_splice_init_rcu() can not be called here while holding pernet->lock spinlock.
Many thanks to Eulgyu Kim for providing a repro and testing our patches.
--- net/mptcp/pm_kernel.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
net/mptcp/pm_kernel.c +13 -3
@@ -1276,16 +1276,26 @@ static void __reset_counters(struct pm_nl_pernet *pernet)int mptcp_pm_nl_flush_addrs_doit (struct sk_buff *skb,struct genl_info *info) {struct pm_nl_pernet *pernet =genl_info_pm_nl (info); -LIST_HEAD (free_list); +struct list_head free_list;spin_lock_bh (&pernet->lock); -list_splice_init (&pernet->endp_list, &free_list); + free_list = pernet->endp_list; +INIT_LIST_HEAD_RCU (&pernet->endp_list);__reset_counters (pernet); pernet->next_id =1 ;bitmap_zero (pernet->id_bitmap,MPTCP_PM_MAX_ADDR_ID +1 );spin_unlock_bh (&pernet->lock); -mptcp_nl_flush_addrs_list (sock_net (skb->sk), &free_list); + +if (free_list.next == &pernet->endp_list) +return 0 ; +synchronize_rcu (); + +/* Adjust the pointers to free_list instead of pernet->endp_list */ + free_list.prev->next = &free_list; + free_list.next->prev = &free_list; + +mptcp_nl_flush_addrs_list (sock_net (skb->sk), &free_list);__flush_addrs (&free_list);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/122 net: spacemit: Check for netif_carrier_ok() in emac_stats_update()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivian Wang <[email protected]>
[ Upstream commit 2c84959167d6493dbdac88965c7389b8ab88bf4e ]
Some PHYs stop the refclk for power saving, usually while link down. This causes reading stats to time out.
Therefore, in emac_stats_update(), also don't update and reschedule if !netif_carrier_ok(). But that means we could be missing later updates if the link comes back up, so also reschedule when link up is detected in emac_adjust_link().
While we're at it, improve the comments and error message prints around this to reflect the better understanding of how this could happen. Hopefully if this happens again on new hardware, these comments will direct towards a solution.
--- drivers/net/ethernet/spacemit/k1_emac.c | 34 ++++++++++++++++++++----- 1 file changed, 27 insertions(+), 7 deletions(-)
drivers/net/ethernet/spacemit/k1_emac.c +27 -7
@@ -1099,7 +1099,13 @@ static int emac_read_stat_cnt(struct emac_priv *priv, u8 cnt, u32 *res, 100, 10000);if (ret) { -netdev_err (priv->ndev,"Read stat timeout\n" ); +/* +* This could be caused by the PHY stopping its refclk even when +* the link is up, for power saving. See also comments in +* emac_stats_update(). +*/ +dev_err_ratelimited (&priv->ndev->dev, +"Read stat timeout. PHY clock stopped?\n" );return ret; }
@@ -1147,17 +1153,25 @@ static void emac_stats_update(struct emac_priv *priv)assert_spin_locked (&priv->stats_lock); -if (!netif_running (priv->ndev) || !netif_device_present (priv->ndev)) { -/* Not up, don't try to update */ +/* +* We can't read statistics if the interface is not up. Also, some PHYs +* stop their reference clocks for link down power saving, which also +* causes reading statistics to time out. Don't update and don't +* reschedule in these cases. +*/ +if (!netif_running (priv->ndev) || + !netif_carrier_ok (priv->ndev) || + !netif_device_present (priv->ndev)) {return ; }for (i =0 ; i <sizeof (priv->tx_stats) /sizeof (*tx_stats); i++) {/* -* If reading stats times out, everything is broken and there's -* nothing we can do. Reading statistics also can't return an -* error, so just return without updating and without -* rescheduling. +* If reading stats times out anyway, the stat registers will be +* stuck, and we can't really recover from that. +* +* Reading statistics also can't return an error, so just return +* without updating and without rescheduling. */ if (emac_tx_read_stat_cnt (priv, i, &res))return ;
@@ -1636,6 +1650,12 @@ static void emac_adjust_link(struct net_device *dev)emac_wr (priv,MAC_GLOBAL_CONTROL , ctrl);emac_set_fc_autoneg (priv); + +/* +* Reschedule stats updates now that link is up. See comments in +* emac_stats_update(). +*/ +mod_timer (&priv->stats_timer, jiffies); }phy_print_status (phydev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/122 nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 165c34fb6068ff153e3fc99a932a80a9d5755709 ]
syzbot reported various memory leaks related to NFC, struct nfc_llcp_sock, sk_buff, nfc_dev, etc. [0]
The leading log hinted that nfc_llcp_send_ui_frame() failed to allocate skb due to sock_error(sk) being -ENXIO.
ENXIO is set by nfc_llcp_socket_release() when struct nfc_llcp_local is destroyed by local_cleanup().
The problem is that there is no synchronisation between nfc_llcp_send_ui_frame() and local_cleanup(), and skb could be put into local->tx_queue after it was purged in local_cleanup():
CPU1 CPU2
---- ----
nfc_llcp_send_ui_frame() local_cleanup()
|- do { '
|- pdu = nfc_alloc_send_skb(..., &err)
| .
| |- nfc_llcp_socket_release(local, false, ENXIO);
| |- skb_queue_purge(&local->tx_queue); |
| ' |
|- skb_queue_tail(&local->tx_queue, pdu); | ... |
|- pdu = nfc_alloc_send_skb(..., &err) |
^._________________________________.'
local_cleanup() is called for struct nfc_llcp_local only after nfc_llcp_remove_local() unlinks it from llcp_devices.
If we hold local->tx_queue.lock then, we can synchronise the thread and nfc_llcp_send_ui_frame().
Let's do that and check list_empty(&local->list) before queuing skb to local->tx_queue in nfc_llcp_send_ui_frame().
[0]:
[ 56.074943][ T6096] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6)
[ 64.318868][ T5813] kmemleak: 6 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
BUG: memory leak
unreferenced object 0xffff8881272f6800 (size 1024):
comm "syz.0.17", pid 6096, jiffies 4294942766
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
27 00 03 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
backtrace (crc da58d84d):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__do_kmalloc_node mm/slub.c:5645 [inline]
__kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5658
kmalloc_noprof include/linux/slab.h:961 [inline]
sk_prot_alloc+0x11a/0x1b0 net/core/sock.c:2239
sk_alloc+0x36/0x360 net/core/sock.c:2295
nfc_llcp_sock_alloc+0x37/0x130 net/nfc/llcp_sock.c:979
llcp_sock_create+0x71/0xd0 net/nfc/llcp_sock.c:1044
nfc_sock_create+0xc9/0xf0 net/nfc/af_nfc.c:31
__sock_create+0x1a9/0x340 net/socket.c:1605
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xb9/0x1a0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x1b/0x30 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810fbd9800 (size 240):
comm "syz.0.17", pid 6096, jiffies 4294942850
hex dump (first 32 bytes):
68 f0 ff 08 81 88 ff ff 68 f0 ff 08 81 88 ff ff h.......h.......
00 00 00 00 00 00 00 00 00 68 2f 27 81 88 ff ff .........h/'....
backtrace (crc 6cc652b1):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5336
__alloc_skb+0x203/0x240 net/core/skbuff.c:660
alloc_skb include/linux/skbuff.h:1383 [inline]
alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671
sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965
sock_alloc_send_skb include/net/sock.h:1859 [inline]
nfc_alloc_send_skb+0x45/0x80 net/nfc/core.c:724
nfc_llcp_send_ui_frame+0x162/0x360 net/nfc/llcp_commands.c:766
llcp_sock_sendmsg+0x14c/0x1d0 net/nfc/llcp_sock.c:814
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x2d8/0x2f0 net/socket.c:2244
__do_sys_sendto net/socket.c:2251 [inline]
__se_sys_sendto net/socket.c:2247 [inline]
__x64_sys_sendto+0x28/0x30 net/socket.c:2247
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/nfc/llcp_commands.c | 17 ++++++++++++++++- net/nfc/llcp_core.c | 4 +++- 2 files changed, 19 insertions(+), 2 deletions(-)
net/nfc/llcp_commands.c +16 -1
@@ -778,8 +778,23 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,if (likely (frag_len >0 ))skb_put_data (pdu, msg_ptr, frag_len); +spin_lock (&local->tx_queue.lock); + +if (list_empty (&local->list)) { +spin_unlock (&local->tx_queue.lock); + +kfree_skb (pdu); + + len -= remaining_len; +if (len ==0 ) + len = -ENXIO ; +break ; + } +/* No need to check for the peer RW for UI frames */ -skb_queue_tail (&local->tx_queue, pdu); +__skb_queue_tail (&local->tx_queue, pdu); + +spin_unlock (&local->tx_queue.lock); remaining_len -= frag_len; msg_ptr += frag_len;
net/nfc/llcp_core.c +3 -1
@@ -316,7 +316,9 @@ static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev)spin_lock (&llcp_devices_lock);list_for_each_entry_safe (local, tmp, &llcp_devices, list)if (local->dev == dev) { -list_del (&local->list); +spin_lock (&local->tx_queue.lock); +list_del_init (&local->list); +spin_unlock (&local->tx_queue.lock);spin_unlock (&llcp_devices_lock);return local; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/122 bonding: fix use-after-free due to enslave fail after slave array update
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit e9acda52fd2ee0cdca332f996da7a95c5fd25294 ]
Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdp_pass prog:
ip l add bond1 type bond mode balance-xor
ip l set bond1 up
ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass
ip l add dumdum type dummy
Then run in parallel:
while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn"
The crash happens almost immediately:
[ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] <TASK> [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding]
--- drivers/net/bonding/bond_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/bonding/bond_main.c +5 -5
@@ -2293,11 +2293,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,unblock_netpoll_tx (); } -/* broadcast mode uses the all_slaves to loop through slaves. */ -if (bond_mode_can_use_xmit_hash (bond) || -BOND_MODE (bond) ==BOND_MODE_BROADCAST ) -bond_update_slave_arr (bond,NULL ); -if (!slave_dev->netdev_ops->ndo_bpf || !slave_dev->netdev_ops->ndo_xdp_xmit) {if (bond->xdp_prog) {
@@ -2331,6 +2326,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,bpf_prog_inc (bond->xdp_prog); } +/* broadcast mode uses the all_slaves to loop through slaves. */ +if (bond_mode_can_use_xmit_hash (bond) || +BOND_MODE (bond) ==BOND_MODE_BROADCAST ) +bond_update_slave_arr (bond,NULL ); +bond_xdp_set_features (bond_dev); slave_info(bond_dev, slave_dev, "Enslaving as %s interface with %s link\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/122 ixgbe: fix memory leaks in the ixgbe_recovery_probe() path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit 638344712aefeba97b6e0d90f560815fd88abd0f ]
When ixgbe_recovery_probe() is invoked and this function fails, allocated resources in advance are not completely freed, because ixgbe_probe() returns ixgbe_recovery_probe() directly and ixgbe_recovery_probe() only frees partial resources, resulting in memory leaks including:
- adapter->io_addr
- adapter->jump_tables[0]
- adapter->mac_table
- adapter->rss_key
- adapter->af_xdp_zc_qps
The leaked MMIO region can be observed in /proc/vmallocinfo, and the remaining leaks are reported by kmemleak.
Don't return ixgbe_recovery_probe() directly, and instead let ixgbe_probe() to clean up resources on failures.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +8 -12
@@ -11468,14 +11468,12 @@ static void ixgbe_set_fw_version(struct ixgbe_adapter *adapter)*/ static int ixgbe_recovery_probe (struct ixgbe_adapter *adapter) { -struct net_device *netdev = adapter->netdev;struct pci_dev *pdev = adapter->pdev;struct ixgbe_hw *hw = &adapter->hw; -bool disable_dev;int err = -EIO ;if (hw->mac.type != ixgbe_mac_e610) - goto clean_up_probe; +return err;ixgbe_get_hw_control (adapter);mutex_init (&hw->aci.lock);
@@ -11507,13 +11505,6 @@ static int ixgbe_recovery_probe(struct ixgbe_adapter *adapter) shutdown_aci:mutex_destroy (&adapter->hw.aci.lock);ixgbe_release_hw_control (adapter); -clean_up_probe: - disable_dev = !test_and_set_bit (__IXGBE_DISABLED, &adapter->state); -free_netdev (netdev); -devlink_free (adapter->devlink); -pci_release_mem_regions (pdev); -if (disable_dev) -pci_disable_device (pdev);return err; }
@@ -11655,8 +11646,13 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)if (err) goto err_sw_init; -if (ixgbe_check_fw_error (adapter)) -return ixgbe_recovery_probe (adapter); +if (ixgbe_check_fw_error (adapter)) { + err =ixgbe_recovery_probe (adapter); +if (err) + goto err_sw_init; + +return 0 ; + }if (adapter->hw.mac.type == ixgbe_mac_e610) { err =ixgbe_get_caps (&adapter->hw);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/122 ixgbe: dont initialize aci lock in ixgbe_recovery_probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit 100cf7b4ca6ed770ec4287f3789b1da2e340a05a ]
hw->aci.lock is already initialized in ixgbe_sw_init(), so ixgbe_recovery_probe() doesn't need to initialize the lock. This function is also not responsible for destroying the lock on failures.
Additionally, change the name of label in accordance with this change.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +2 -4
@@ -11476,10 +11476,9 @@ static int ixgbe_recovery_probe(struct ixgbe_adapter *adapter)return err;ixgbe_get_hw_control (adapter); -mutex_init (&hw->aci.lock); err =ixgbe_get_flash_data (&adapter->hw);if (err) - goto shutdown_aci; + goto err_release_hw_control;timer_setup (&adapter->service_timer, ixgbe_service_timer,0 );INIT_WORK (&adapter->service_task, ixgbe_recovery_service_task);
@@ -11502,8 +11501,7 @@ static int ixgbe_recovery_probe(struct ixgbe_adapter *adapter)devl_unlock (adapter->devlink);return 0 ; -shutdown_aci: -mutex_destroy (&adapter->hw.aci.lock); +err_release_hw_control:ixgbe_release_hw_control (adapter);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/122 ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
[ Upstream commit 9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85 ]
Add NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes during resume from suspend when rings[q_idx]->q_vector is NULL.
Tested adaptor:
60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02)
Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003]
SR-IOV state: both disabled and enabled can reproduce this issue.
kernel version: v6.18
Reproduce steps:
Boot up and execute suspend like systemctl suspend or rtcwake.
Log:
<1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040 <1>[ 231.444052] #PF: supervisor read access in kernel mode <1>[ 231.444484] #PF: error_code(0x0000) - not-present page <6>[ 231.444913] PGD 0 P4D 0 <4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI <4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170 <4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89 <4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202 <4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010 <4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000 <4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000 <4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 <4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000 <4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000 <4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0 <4>[ 231.451629] PKRU: 55555554 <4>[ 231.452076] Call Trace: <4>[ 231.452549] <TASK> <4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice] <4>[ 231.453482] ice_resume+0xfd/0x220 [ice] <4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.454425] pci_pm_resume+0x8c/0x140 <4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.455347] dpm_run_callback+0x5f/0x160 <4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170 <4>[ 231.456244] device_resume+0x177/0x270 <4>[ 231.456708] dpm_resume+0x209/0x2f0 <4>[ 231.457151] dpm_resume_end+0x15/0x30 <4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0 <4>[ 231.458054] enter_state+0x10e/0x570
Add defensive checks for both the ring pointer and its q_vector before dereferencing, allowing the system to resume successfully even when q_vectors are unmapped.
--- drivers/net/ethernet/intel/ice/ice_lib.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +6 -4
@@ -2784,12 +2784,14 @@ void ice_vsi_set_napi_queues(struct ice_vsi *vsi)return ;ice_for_each_rxq (vsi, q_idx) -netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_RX , - &vsi->rx_rings[q_idx]->q_vector->napi); +if (vsi->rx_rings[q_idx] && vsi->rx_rings[q_idx]->q_vector) +netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_RX , + &vsi->rx_rings[q_idx]->q_vector->napi);ice_for_each_txq (vsi, q_idx) -netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_TX , - &vsi->tx_rings[q_idx]->q_vector->napi); +if (vsi->tx_rings[q_idx] && vsi->tx_rings[q_idx]->q_vector) +netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_TX , + &vsi->tx_rings[q_idx]->q_vector->napi);/* Also set the interrupt number for the NAPI */ ice_for_each_q_vector (vsi, v_idx) {struct ice_q_vector *q_vector = vsi->q_vectors[v_idx];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/122 ice: stop counting UDP csum mismatch as rx_errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <[email protected]>
[ Upstream commit 05faf2c0a76581d0a7fdbb8ec46477ba183df95b ]
Since the beginning, the Intel ice driver has counted receive checksum offload mismatches into the rx_errors member of the rtnl_link_stats64 struct. In ethtool -S these show up as rx_csum_bad.nic.
I believe counting these in rx_errors is fundamentally wrong, as it's pretty clear from the comments in if_link.h and from every other statistic the driver is summing into rx_errors, that all of them would cause a "hardware drop" except for the UDP checksum mismatch, as well as the fact that all the other causes for rx_errors are L2 reasons, and this L4 UDP "mismatch" is an outlier.
A last nail in the coffin is that rx_errors is monitored in production and can indicate a bad NIC/cable/Switch port, but instead some random series of UDP packets with bad checksums will now trigger this alert. This false positive makes the alert useless and affects us as well as other companies.
This packet with presumably a bad UDP checksum is *already* passed to the stack, just not marked as offloaded by the hardware/driver. If it is dropped by the stack it will show up as UDP_MIB_CSUMERRORS.
And one more thing, none of the other Intel drivers, and at least bnxt_en and mlx5 both don't appear to count UDP offload mismatches as rx_errors.
Here is a related customer complaint:
https://community.intel.com/t5/Ethernet-Products/ice-rx-errros-is-too-sensitive-to-IP-TCP-attack-packets-Intel/td-p/1662125
--- drivers/net/ethernet/intel/ice/ice_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +0 -1
@@ -6993,7 +6993,6 @@ void ice_update_vsi_stats(struct ice_vsi *vsi) cur_ns->rx_errors = pf->stats.crc_errors + pf->stats.illegal_bytes + pf->stats.rx_undersize + - pf->hw_csum_rx_error + pf->stats.rx_jabber + pf->stats.rx_fragments + pf->stats.rx_oversize;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/122 net/mlx5e: TC, delete flows only for existing peers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Bloch <[email protected]>
[ Upstream commit f67666938ae626cbda63fbf5176b3583c07e7124 ]
When deleting TC steering flows, iterate only over actual devcom peers instead of assuming all possible ports exist. This avoids touching non-existent peers and ensures cleanup is limited to devices the driver is currently connected to.
BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 133c8a067 P4D 0 Oops: Oops: 0002 [#1] SMP CPU: 19 UID: 0 PID: 2169 Comm: tc Not tainted 6.18.0+ #156 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0xbe/0x200 [mlx5_core] Code: 00 00 a8 08 74 a8 49 8b 46 18 f6 c4 02 74 9f 4c 8d bf a0 12 00 00 4c 89 ff e8 0e e7 96 e1 49 8b 44 24 08 49 8b 0c 24 4c 89 ff <48> 89 41 08 48 89 08 49 89 2c 24 49 89 5c 24 08 e8 7d ce 96 e1 49 RSP: 0018:ff11000143867528 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dead000000000122 RCX: 0000000000000000 RDX: ff11000143691580 RSI: ff110001026e5000 RDI: ff11000106f3d2a0 RBP: dead000000000100 R08: 00000000000003fd R09: 0000000000000002 R10: ff11000101c75690 R11: ff1100085faea178 R12: ff11000115f0ae78 R13: 0000000000000000 R14: ff11000115f0a800 R15: ff11000106f3d2a0 FS: 00007f35236bf740(0000) GS:ff110008dc809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000157a01001 CR4: 0000000000373eb0 Call Trace: <TASK> mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] mlx5e_flow_put+0x25/0x50 [mlx5_core] mlx5e_delete_flower+0x2a6/0x3e0 [mlx5_core] tc_setup_cb_reoffload+0x20/0x80 fl_reoffload+0x26f/0x2f0 [cls_flower] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] tcf_block_playback_offloads+0x9e/0x1c0 tcf_block_unbind+0x7b/0xd0 tcf_block_setup+0x186/0x1d0 tcf_block_offload_cmd.isra.0+0xef/0x130 tcf_block_offload_unbind+0x43/0x70 __tcf_block_put+0x85/0x160 ingress_destroy+0x32/0x110 [sch_ingress] __qdisc_destroy+0x44/0x100 qdisc_graft+0x22b/0x610 tc_get_qdisc+0x183/0x4d0 rtnetlink_rcv_msg+0x2d7/0x3d0 ? rtnl_calcit.isra.0+0x100/0x100 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x249/0x320 ? __alloc_skb+0x102/0x1f0 netlink_sendmsg+0x1e3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1ef/0x230 ? copy_msghdr_from_user+0x6c/0xa0 ___sys_sendmsg+0x7f/0xc0 ? ___sys_recvmsg+0x8a/0xc0 ? __sys_sendto+0x119/0x180 __sys_sendmsg+0x61/0xb0 do_syscall_64+0x55/0x640 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f35238bb764 Code: 15 b9 86 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d e5 08 0d 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55 RSP: 002b:00007ffed4c35638 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000055a2efcc75e0 RCX: 00007f35238bb764 RDX: 0000000000000000 RSI: 00007ffed4c356a0 RDI: 0000000000000003 RBP: 00007ffed4c35710 R08: 0000000000000010 R09: 00007f3523984b20 R10: 0000000000000004 R11: 0000000000000202 R12: 00007ffed4c35790 R13: 000000006947df8f R14: 000055a2efcc75e0 R15: 00007ffed4c35780
--- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +13 -6
@@ -2147,11 +2147,14 @@ static void mlx5e_tc_del_fdb_peer_flow(struct mlx5e_tc_flow *flow,static void mlx5e_tc_del_fdb_peers_flow (struct mlx5e_tc_flow *flow) { +struct mlx5_devcom_comp_dev *devcom; +struct mlx5_devcom_comp_dev *pos; +struct mlx5_eswitch *peer_esw;int i; -for (i =0 ; i <MLX5_MAX_PORTS ; i++) { -if (i ==mlx5_get_dev_index (flow->priv->mdev)) -continue ; + devcom = flow->priv->mdev->priv.eswitch->devcom; +mlx5_devcom_for_each_peer_entry (devcom, peer_esw, pos) { + i =mlx5_get_dev_index (peer_esw->dev);mlx5e_tc_del_fdb_peer_flow (flow, i); } }
@@ -5511,12 +5514,16 @@ int mlx5e_tc_num_filters(struct mlx5e_priv *priv, unsigned long flags)void mlx5e_tc_clean_fdb_peer_flows (struct mlx5_eswitch *esw) { +struct mlx5_devcom_comp_dev *devcom; +struct mlx5_devcom_comp_dev *pos;struct mlx5e_tc_flow *flow, *tmp; +struct mlx5_eswitch *peer_esw;int i; -for (i =0 ; i <MLX5_MAX_PORTS ; i++) { -if (i ==mlx5_get_dev_index (esw->dev)) -continue ; + devcom = esw->devcom; + +mlx5_devcom_for_each_peer_entry (devcom, peer_esw, pos) { + i =mlx5_get_dev_index (peer_esw->dev);list_for_each_entry_safe (flow, tmp, &esw->offloads.peer_flows[i], peer[i])mlx5e_tc_del_fdb_peers_flow (flow); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/122 net/mlx5e: Account for netdev stats in ndo_get_stats64
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 476681f10cc1e0e56e26856684e75d4678b072b2 ]
The driver's ndo_get_stats64 callback is only reporting mlx5 counters, without accounting for the netdev stats, causing errors from the network stack to be invisible in statistics.
Add netdev_stats_to_stats64() call to first populate the counters, then add mlx5 counters on top, ensuring both are accounted for (where appropriate).
--- .../net/ethernet/mellanox/mlx5/core/en_main.c | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +11 -9
@@ -4033,6 +4033,8 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)mlx5e_queue_update_stats (priv); } +netdev_stats_to_stats64 (stats, &dev->stats); +if (mlx5e_is_uplink_rep (priv)) {struct mlx5e_vport_stats *vstats = &priv->stats.vport;
@@ -4049,21 +4051,21 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)mlx5e_fold_sw_stats64 (priv, stats); } - stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer; - stats->rx_dropped =PPORT_2863_GET (pstats, if_in_discards); + stats->rx_missed_errors += priv->stats.qcnt.rx_out_of_buffer; + stats->rx_dropped +=PPORT_2863_GET (pstats, if_in_discards); - stats->rx_length_errors = + stats->rx_length_errors +=PPORT_802_3_GET (pstats, a_in_range_length_errors) +PPORT_802_3_GET (pstats, a_out_of_range_length_field) +PPORT_802_3_GET (pstats, a_frame_too_long_errors) +VNIC_ENV_GET (&priv->stats.vnic, eth_wqe_too_small); - stats->rx_crc_errors = + stats->rx_crc_errors +=PPORT_802_3_GET (pstats, a_frame_check_sequence_errors); - stats->rx_frame_errors =PPORT_802_3_GET (pstats, a_alignment_errors); - stats->tx_aborted_errors =PPORT_2863_GET (pstats, if_out_discards); - stats->rx_errors = stats->rx_length_errors + stats->rx_crc_errors + - stats->rx_frame_errors; - stats->tx_errors = stats->tx_aborted_errors + stats->tx_carrier_errors; + stats->rx_frame_errors +=PPORT_802_3_GET (pstats, a_alignment_errors); + stats->tx_aborted_errors +=PPORT_2863_GET (pstats, if_out_discards); + stats->rx_errors += stats->rx_length_errors + stats->rx_crc_errors + + stats->rx_frame_errors; + stats->tx_errors += stats->tx_aborted_errors + stats->tx_carrier_errors; }static void mlx5e_nic_set_rx_mode (struct mlx5e_priv *priv)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/122 nfc: nci: Fix race between rfkill and nci_unregister_device().
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit d2492688bb9fed6ab6e313682c387ae71a66ebae ]
syzbot reported the splat below [0] without a repro.
It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill.
nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think) was called from virtual_ncidev_close() when syzbot close()d an fd of virtual_ncidev.
The problem is that nci_unregister_device() destroys nci_dev.cmd_wq first and then calls nfc_unregister_device(), which removes the device from rfkill by rfkill_unregister().
So, the device is still visible via rfkill even after nci_dev.cmd_wq is destroyed.
Let's unregister the device from rfkill first in nci_unregister_device().
Note that we cannot call nfc_unregister_device() before nci_close_device() because
1) nfc_unregister_device() calls device_del() which frees all memory allocated by devm_kzalloc() and linked to ndev->conn_info_list
2) nci_rx_work() could try to queue nci_conn_info to
ndev->conn_info_list which could be leaked
Thus, nfc_unregister_device() is split into two functions so we can remove rfkill interfaces only before nci_close_device().
[0]:DEBUG_LOCKS_WARN_ON(1)
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x39d/0x2cf0 kernel/locking/lockdep.c:5187, CPU#0: syz.0.8675/6349 Modules linked in: CPU: 0 UID: 0 PID: 6349 Comm: syz.0.8675 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4854 [inline] RIP: 0010:__lock_acquire+0x3a4/0x2cf0 kernel/locking/lockdep.c:5187 Code: 18 00 4c 8b 74 24 08 75 27 90 e8 17 f2 fc 02 85 c0 74 1c 83 3d 50 e0 4e 0e 00 75 13 48 8d 3d 43 f7 51 0e 48 c7 c6 8b 3a de 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f RSP: 0018:ffffc9000c767680 EFLAGS: 00010046 RAX: 0000000000000001 RBX: 0000000000040000 RCX: 0000000000080000 RDX: ffffc90013080000 RSI: ffffffff8dde3a8b RDI: ffffffff8ff24ca0 RBP: 0000000000000003 R08: ffffffff8fef35a3 R09: 1ffffffff1fde6b4 R10: dffffc0000000000 R11: fffffbfff1fde6b5 R12: 00000000000012a2 R13: ffff888030338ba8 R14: ffff888030338000 R15: ffff888030338b30 FS: 00007fa5995f66c0(0000) GS:ffff8881256f8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e72f842d0 CR3: 00000000485a0000 CR4: 00000000003526f0 Call Trace: <TASK> lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868 touch_wq_lockdep_map+0xcb/0x180 kernel/workqueue.c:3940 __flush_workqueue+0x14b/0x14f0 kernel/workqueue.c:3982 nci_close_device+0x302/0x630 net/nfc/nci/core.c:567 nci_dev_down+0x3b/0x50 net/nfc/nci/core.c:639 nfc_dev_down+0x152/0x290 net/nfc/core.c:161 nfc_rfkill_set_block+0x2d/0x100 net/nfc/core.c:179 rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346 rfkill_fop_write+0x461/0x5a0 net/rfkill/core.c:1301 vfs_write+0x29a/0xb90 fs/read_write.c:684 ksys_write+0x150/0x270 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa59b39acb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa5995f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa59b615fa0 RCX: 00007fa59b39acb9 RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000007 RBP: 00007fa59b408bf7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa59b616038 R14: 00007fa59b615fa0 R15: 00007ffc82218788 </TASK>
--- include/net/nfc/nfc.h | 2 ++ net/nfc/core.c | 27 ++++++++++++++++++++++++--- net/nfc/nci/core.c | 4 +++- 3 files changed, 29 insertions(+), 4 deletions(-)
include/net/nfc/nfc.h +2 -0
@@ -219,6 +219,8 @@ static inline void nfc_free_device(struct nfc_dev *dev)int nfc_register_device (struct nfc_dev *dev); +void nfc_unregister_rfkill (struct nfc_dev *dev); +void nfc_remove_device (struct nfc_dev *dev);void nfc_unregister_device (struct nfc_dev *dev);/**
net/nfc/core.c +24 -3
@@ -1147,14 +1147,14 @@ int nfc_register_device(struct nfc_dev *dev)EXPORT_SYMBOL (nfc_register_device);/** -* nfc_unregister_device - unregister a nfc device in the nfc subsystem +* nfc_unregister_rfkill - unregister a nfc device in the rfkill subsystem * * @dev: The nfc device to unregister */ -void nfc_unregister_device (struct nfc_dev *dev) +void nfc_unregister_rfkill (struct nfc_dev *dev) { -int rc;struct rfkill *rfk =NULL ; +int rc;pr_debug ("dev_name=%s\n" ,dev_name (&dev->dev));
@@ -1175,7 +1175,16 @@ void nfc_unregister_device(struct nfc_dev *dev)rfkill_unregister (rfk);rfkill_destroy (rfk); } +} +EXPORT_SYMBOL (nfc_unregister_rfkill); +/** +* nfc_remove_device - remove a nfc device in the nfc subsystem +* +* @dev: The nfc device to remove +*/ +void nfc_remove_device (struct nfc_dev *dev) +{if (dev->ops->check_presence) {timer_delete_sync (&dev->check_pres_timer);cancel_work_sync (&dev->check_pres_work);
@@ -1188,6 +1197,18 @@ void nfc_unregister_device(struct nfc_dev *dev)device_del (&dev->dev);mutex_unlock (&nfc_devlist_mutex); } +EXPORT_SYMBOL (nfc_remove_device); + +/** +* nfc_unregister_device - unregister a nfc device in the nfc subsystem +* +* @dev: The nfc device to unregister +*/ +void nfc_unregister_device (struct nfc_dev *dev) +{ +nfc_unregister_rfkill (dev); +nfc_remove_device (dev); +}EXPORT_SYMBOL (nfc_unregister_device);static int __init nfc_init (void )
net/nfc/nci/core.c +3 -1
@@ -1303,6 +1303,8 @@ void nci_unregister_device(struct nci_dev *ndev) {struct nci_conn_info *conn_info, *n; +nfc_unregister_rfkill (ndev->nfc_dev); +/* This set_bit is not protected with specialized barrier, * However, it is fine because the mutex_lock(&ndev->req_lock); * in nci_close_device() will help to emit one.
@@ -1320,7 +1322,7 @@ void nci_unregister_device(struct nci_dev *ndev)/* conn_info is allocated with devm_kzalloc */ } -nfc_unregister_device (ndev->nfc_dev); +nfc_remove_device (ndev->nfc_dev); }EXPORT_SYMBOL (nci_unregister_device);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/122 net: bridge: fix static key check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit cc0cf10fdaeadf5542d64a55b5b4120d3df90b7d ]
Fix the check if netfilter's static keys are available. netfilter defines and exports static keys if CONFIG_JUMP_LABEL is enabled. (HAVE_JUMP_LABEL is never defined.)
--- net/bridge/br_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_input.c +1 -1
@@ -274,7 +274,7 @@ static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)int ret; net =dev_net (skb->dev); -#ifdef HAVE_JUMP_LABEL +#ifdef CONFIG_JUMP_LABEL if (!static_key_false (&nf_hooks_needed[NFPROTO_BRIDGE ][NF_BR_PRE_ROUTING ])) goto frame_finish;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/122 net/mlx5e: dont assume psp tx skbs are ipv6 csum handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Zahka <[email protected]>
[ Upstream commit a62f7d62d2b115e67c7224e36ace4ef12a9650b4 ]
mlx5e_psp_handle_tx_skb() assumes skbs are ipv6 when doing a partial TCP checksum with tso. Make correctly mlx5e_psp_handle_tx_skb() handle ipv4 packets.
--- .../mellanox/mlx5/core/en_accel/psp_rxtx.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c +11 -6
@@ -177,8 +177,6 @@ bool mlx5e_psp_handle_tx_skb(struct net_device *netdev, {struct mlx5e_priv *priv =netdev_priv (netdev);struct net *net =sock_net (skb->sk); -const struct ipv6hdr *ip6; -struct tcphdr *th;if (!mlx5e_psp_set_state (priv, skb, psp_st))return true;
@@ -189,11 +187,18 @@ bool mlx5e_psp_handle_tx_skb(struct net_device *netdev,return false; }if (skb_is_gso (skb)) { - ip6 =ipv6_hdr (skb); - th =inner_tcp_hdr (skb); +int len =skb_shinfo (skb)->gso_size +inner_tcp_hdrlen (skb); +struct tcphdr *th =inner_tcp_hdr (skb); - th->check = ~tcp_v6_check (skb_shinfo (skb)->gso_size +inner_tcp_hdrlen (skb), &ip6->saddr, - &ip6->daddr,0 ); +if (skb->protocol ==htons (ETH_P_IP )) { +const struct iphdr *ip =ip_hdr (skb); + + th->check = ~tcp_v4_check (len, ip->saddr, ip->daddr,0 ); + }else { +const struct ipv6hdr *ip6 =ipv6_hdr (skb); + + th->check = ~tcp_v6_check (len, &ip6->saddr, &ip6->daddr,0 ); + } }return true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/122 net: phy: micrel: fix clk warning when removing the driver
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 2aa1545ba8d4801fba5be83a404e28014b80196a ]
Since the commit 25c6a5ab151f ("net: phy: micrel: Dynamically control external clock of KSZ PHY"), the clock of Micrel PHY has been enabled by phy_driver::resume() and disabled by phy_driver::suspend(). However, devm_clk_get_optional_enabled() is used in kszphy_probe(), so the clock will automatically be disabled when the device is unbound from the bus. Therefore, this could cause the clock to be disabled twice, resulting in clk driver warnings.
For example, this issue can be reproduced on i.MX6ULL platform, and we can see the following logs when removing the FEC MAC drivers.
$ echo 2188000.ethernet > /sys/bus/platform/drivers/fec/unbind $ echo 20b4000.ethernet > /sys/bus/platform/drivers/fec/unbind [ 109.758207] ------------[ cut here ]------------ [ 109.758240] WARNING: drivers/clk/clk.c:1188 at clk_core_disable+0xb4/0xd0, CPU#0: sh/639 [ 109.771011] enet2_ref already disabled [ 109.793359] Call trace: [ 109.822006] clk_core_disable from clk_disable+0x28/0x34 [ 109.827340] clk_disable from clk_disable_unprepare+0xc/0x18 [ 109.833029] clk_disable_unprepare from devm_clk_release+0x1c/0x28 [ 109.839241] devm_clk_release from devres_release_all+0x98/0x100 [ 109.845278] devres_release_all from device_unbind_cleanup+0xc/0x70 [ 109.851571] device_unbind_cleanup from device_release_driver_internal+0x1a4/0x1f4 [ 109.859170] device_release_driver_internal from bus_remove_device+0xbc/0xe4 [ 109.866243] bus_remove_device from device_del+0x140/0x458 [ 109.871757] device_del from phy_mdio_device_remove+0xc/0x24 [ 109.877452] phy_mdio_device_remove from mdiobus_unregister+0x40/0xac [ 109.883918] mdiobus_unregister from fec_enet_mii_remove+0x40/0x78 [ 109.890125] fec_enet_mii_remove from fec_drv_remove+0x4c/0x158 [ 109.896076] fec_drv_remove from device_release_driver_internal+0x17c/0x1f4 [ 109.962748] WARNING: drivers/clk/clk.c:1047 at clk_core_unprepare+0xfc/0x13c, CPU#0: sh/639 [ 109.975805] enet2_ref already unprepared [ 110.002866] Call trace: [ 110.031758] clk_core_unprepare from clk_unprepare+0x24/0x2c [ 110.037440] clk_unprepare from devm_clk_release+0x1c/0x28 [ 110.042957] devm_clk_release from devres_release_all+0x98/0x100 [ 110.048989] devres_release_all from device_unbind_cleanup+0xc/0x70 [ 110.055280] device_unbind_cleanup from device_release_driver_internal+0x1a4/0x1f4 [ 110.062877] device_release_driver_internal from bus_remove_device+0xbc/0xe4 [ 110.069950] bus_remove_device from device_del+0x140/0x458 [ 110.075469] device_del from phy_mdio_device_remove+0xc/0x24 [ 110.081165] phy_mdio_device_remove from mdiobus_unregister+0x40/0xac [ 110.087632] mdiobus_unregister from fec_enet_mii_remove+0x40/0x78 [ 110.093836] fec_enet_mii_remove from fec_drv_remove+0x4c/0x158 [ 110.099782] fec_drv_remove from device_release_driver_internal+0x17c/0x1f4
After analyzing the process of removing the FEC driver, as shown below, it can be seen that the clock was disabled twice by the PHY driver.
fec_drv_remove()
--> fec_enet_close()
--> phy_stop()
--> phy_suspend()
--> kszphy_suspend() #1 The clock is disabled
--> fec_enet_mii_remove()
--> mdiobus_unregister()
--> phy_mdio_device_remove()
--> device_del()
--> devm_clk_release() #2 The clock is disabled againTherefore, devm_clk_get_optional() is used to fix the above issue. And to avoid the issue mentioned by the commit 985329462723 ("net: phy:
micrel: use devm_clk_get_optional_enabled for the rmii-ref clock"), the clock is enabled by clk_prepare_enable() to get the correct clock rate.
--- drivers/net/phy/micrel.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/net/phy/micrel.c +13 -4
@@ -2541,11 +2541,21 @@ static int kszphy_probe(struct phy_device *phydev)kszphy_parse_led_mode (phydev); - clk =devm_clk_get_optional_enabled (&phydev->mdio.dev,"rmii-ref" ); + clk =devm_clk_get_optional (&phydev->mdio.dev,"rmii-ref" );/* NOTE: clk may be NULL if building without CONFIG_HAVE_CLK */ if (!IS_ERR_OR_NULL (clk)) { -unsigned long rate =clk_get_rate (clk);bool rmii_ref_clk_sel_25_mhz; +unsigned long rate; +int err; + + err =clk_prepare_enable (clk); +if (err) { +phydev_err (phydev,"Failed to enable rmii-ref clock\n" ); +return err; + } + + rate =clk_get_rate (clk); +clk_disable_unprepare (clk);if (type) priv->rmii_ref_clk_sel = type->has_rmii_ref_clk_sel;
@@ -2563,13 +2573,12 @@ static int kszphy_probe(struct phy_device *phydev) } }else if (!clk) {/* unnamed clock from the generic ethernet-phy binding */ - clk =devm_clk_get_optional_enabled (&phydev->mdio.dev,NULL ); + clk =devm_clk_get_optional (&phydev->mdio.dev,NULL ); }if (IS_ERR (clk))return PTR_ERR (clk); -clk_disable_unprepare (clk); priv->clk = clk;if (ksz8041_fiber_mode (phydev))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/122 net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 2610a3d65691a1301ab10c92ff6ebab0bedf9199 ]
The capability check for reset_root_to_default was inverted, causing the function to return -EOPNOTSUPP when the capability IS supported, rather than when it is NOT supported.
Fix the capability check condition.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c +2 -1
@@ -1167,7 +1167,8 @@ int mlx5_fs_cmd_set_tx_flow_table_root(struct mlx5_core_dev *dev, u32 ft_id, boou32 out[MLX5_ST_SZ_DW (set_flow_table_root_out)] = {};u32 in[MLX5_ST_SZ_DW (set_flow_table_root_in)] = {}; -if (disconnect &&MLX5_CAP_FLOWTABLE_NIC_TX (dev, reset_root_to_default)) +if (disconnect && + !MLX5_CAP_FLOWTABLE_NIC_TX (dev, reset_root_to_default))return -EOPNOTSUPP ; MLX5_SET(set_flow_table_root_in, in, opcode,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/122 net/mlx5: Initialize events outside devlink lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit b6b03097f9826db72aeb3f751774c5e9edd9a5b3 ]
Move event init/cleanup outside of mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions.
By doing this, we avoid the events being reinitialized on devlink reload and, more importantly, the events->sw_nh notifier chain becomes available earlier in the init procedure, which will be used in subsequent patches. This makes sense because the events struct is pure software, independent of any HW details.
Stable-dep-of: a8f930b7be7b ("net/mlx5: Fix vhca_id access call trace use before alloc")
--- .../net/ethernet/mellanox/mlx5/core/main.c | 34 +++++++++++++------ 1 file changed, 24 insertions(+), 10 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +24 -10
@@ -999,16 +999,10 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) goto err_irq_cleanup; } - err =mlx5_events_init (dev); -if (err) { -mlx5_core_err (dev,"failed to initialize events\n" ); - goto err_eq_cleanup; - } - err =mlx5_fw_reset_init (dev);if (err) {mlx5_core_err (dev,"failed to initialize fw reset events\n" ); - goto err_events_cleanup; + goto err_eq_cleanup; }mlx5_cq_debugfs_init (dev);
@@ -1110,8 +1104,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev)mlx5_cleanup_reserved_gids (dev);mlx5_cq_debugfs_cleanup (dev);mlx5_fw_reset_cleanup (dev); -err_events_cleanup: -mlx5_events_cleanup (dev); err_eq_cleanup:mlx5_eq_table_cleanup (dev); err_irq_cleanup:
@@ -1144,7 +1136,6 @@ static void mlx5_cleanup_once(struct mlx5_core_dev *dev)mlx5_cleanup_reserved_gids (dev);mlx5_cq_debugfs_cleanup (dev);mlx5_fw_reset_cleanup (dev); -mlx5_events_cleanup (dev);mlx5_eq_table_cleanup (dev);mlx5_irq_table_cleanup (dev);mlx5_devcom_unregister_device (dev->priv.devc);
@@ -1822,6 +1813,24 @@ static int vhca_id_show(struct seq_file *file, void *priv)DEFINE_SHOW_ATTRIBUTE (vhca_id); +static int mlx5_notifiers_init (struct mlx5_core_dev *dev) +{ +int err; + + err =mlx5_events_init (dev); +if (err) { +mlx5_core_err (dev,"failed to initialize events\n" ); +return err; + } + +return 0 ; +} + +static void mlx5_notifiers_cleanup (struct mlx5_core_dev *dev) +{ +mlx5_events_cleanup (dev); +} +int mlx5_mdev_init (struct mlx5_core_dev *dev,int profile_idx) {struct mlx5_priv *priv = &dev->priv;
@@ -1877,6 +1886,10 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx)if (err) goto err_hca_caps; + err =mlx5_notifiers_init (dev); +if (err) + goto err_hca_caps; +/* The conjunction of sw_vhca_id with sw_owner_id will be a global * unique id per function which uses mlx5_core. * Those values are supplied to FW as part of the init HCA command to
@@ -1919,6 +1932,7 @@ void mlx5_mdev_uninit(struct mlx5_core_dev *dev)if (priv->sw_vhca_id >0 )ida_free (&sw_vhca_ida, dev->priv.sw_vhca_id); +mlx5_notifiers_cleanup (dev);mlx5_hca_caps_free (dev);mlx5_adev_cleanup (dev);mlx5_pagealloc_cleanup (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/122 net/mlx5: Fix vhca_id access call trace use before alloc
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <[email protected]>
[ Upstream commit a8f930b7be7be3f18f14446df461e17137400407 ]
HCA CAP structure is allocated in mlx5_hca_caps_alloc(). mlx5_mdev_init()
mlx5_hca_caps_alloc()
And HCA CAP is read from the device in mlx5_init_one().
The vhca_id's debugfs file is published even before above two operations are done.
Due to this when user reads the vhca id before the initialization, following call trace is observed.
Fix this by deferring debugfs publication until the HCA CAP is allocated and read from the device.
BUG: kernel NULL pointer dereference, address: 0000000000000004 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 23 UID: 0 PID: 6605 Comm: cat Kdump: loaded Not tainted 6.18.0-rc7-sf+ #110 PREEMPT(full) Hardware name: Supermicro SYS-6028U-TR4+/X10DRU-i+, BIOS 2.0b 08/09/2016 RIP: 0010:vhca_id_show+0x17/0x30 [mlx5_core] Code: cb 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 8b 47 70 48 c7 c6 45 f0 12 c1 48 8b 80 70 03 00 00 <8b> 50 04 0f ca 0f b7 d2 e8 8c 82 47 cb 31 c0 c3 cc cc cc cc 0f 1f RSP: 0018:ffffd37f4f337d40 EFLAGS: 00010203 RAX: 0000000000000000 RBX: ffff8f18445c9b40 RCX: 0000000000000001 RDX: ffff8f1109825180 RSI: ffffffffc112f045 RDI: ffff8f18445c9b40 RBP: 0000000000000000 R08: 0000645eac0d2928 R09: 0000000000000006 R10: ffffd37f4f337d48 R11: 0000000000000000 R12: ffffd37f4f337dd8 R13: ffffd37f4f337db0 R14: ffff8f18445c9b68 R15: 0000000000000001 FS: 00007f3eea099580(0000) GS:ffff8f2090f1f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000004 CR3: 00000008b64e4006 CR4: 00000000003726f0 Call Trace: <TASK> seq_read_iter+0x11f/0x4f0 ? _raw_spin_unlock+0x15/0x30 ? do_anonymous_page+0x104/0x810 seq_read+0xf6/0x120 ? srso_alias_untrain_ret+0x1/0x10 full_proxy_read+0x5c/0x90 vfs_read+0xad/0x320 ? handle_mm_fault+0x1ab/0x290 ksys_read+0x52/0xd0 do_syscall_64+0x61/0x11e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- .../net/ethernet/mellanox/mlx5/core/debugfs.c | 16 ++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 +++----------- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + 4 files changed, 21 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/debugfs.c +16 -0
@@ -613,3 +613,19 @@ void mlx5_debug_cq_remove(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq) cq->dbg =NULL ; } } + +static int vhca_id_show (struct seq_file *file,void *priv) +{ +struct mlx5_core_dev *dev = file->private; + +seq_printf (file,"0x%x\n" ,MLX5_CAP_GEN (dev, vhca_id)); +return 0 ; +} + +DEFINE_SHOW_ATTRIBUTE (vhca_id); + +void mlx5_vhca_debugfs_init (struct mlx5_core_dev *dev) +{ +debugfs_create_file ("vhca_id" ,0400 , dev->priv.dbg.dbg_root, dev, + &vhca_id_fops); +}
drivers/net/ethernet/mellanox/mlx5/core/main.c +3 -11
@@ -1803,16 +1803,6 @@ static int mlx5_hca_caps_alloc(struct mlx5_core_dev *dev)return -ENOMEM ; } -static int vhca_id_show (struct seq_file *file,void *priv) -{ -struct mlx5_core_dev *dev = file->private; - -seq_printf (file,"0x%x\n" ,MLX5_CAP_GEN (dev, vhca_id)); -return 0 ; -} - -DEFINE_SHOW_ATTRIBUTE (vhca_id); -static int mlx5_notifiers_init (struct mlx5_core_dev *dev) {int err;
@@ -1855,7 +1845,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx) priv->numa_node =dev_to_node (mlx5_core_dma_dev (dev)); priv->dbg.dbg_root =debugfs_create_dir (dev_name (dev->device), mlx5_debugfs_root); -debugfs_create_file ("vhca_id" ,0400 , priv->dbg.dbg_root, dev, &vhca_id_fops); +INIT_LIST_HEAD (&priv->traps); err =mlx5_cmd_init (dev);
@@ -1993,6 +1983,8 @@ static int probe_one(struct pci_dev *pdev, const struct pci_device_id *id) goto err_init_one; } +mlx5_vhca_debugfs_init (dev); +pci_save_state (pdev);return 0 ;
drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +1 -0
@@ -258,6 +258,7 @@ int mlx5_wait_for_pages(struct mlx5_core_dev *dev, int *pages);void mlx5_cmd_flush (struct mlx5_core_dev *dev);void mlx5_cq_debugfs_init (struct mlx5_core_dev *dev);void mlx5_cq_debugfs_cleanup (struct mlx5_core_dev *dev); +void mlx5_vhca_debugfs_init (struct mlx5_core_dev *dev);int mlx5_query_pcam_reg (struct mlx5_core_dev *dev,u32 *pcam,u8 feature_group,u8 access_reg_group);
drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +1 -0
@@ -76,6 +76,7 @@ static int mlx5_sf_dev_probe(struct auxiliary_device *adev, const struct auxilia goto init_one_err; } +mlx5_vhca_debugfs_init (mdev);return 0 ; init_one_err:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/122 net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 011be342dd24b5168a5dcf408b14c3babe503341 ]
Commit a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay window size") introduced logic to setup the ESN replay window size. This logic is only valid for packet offload.
However, the check to skip this block only covered outbound offloads. It was not skipped for crypto offload, causing it to fall through to the new switch statement and trigger its WARN_ON default case (for instance, if a window larger than 256 bits was configured).
Fix this by amending the condition to also skip the replay window setup if the offload type is not XFRM_DEV_OFFLOAD_PACKET.
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +2 -1
@@ -430,7 +430,8 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, attrs->replay_esn.esn = sa_entry->esn_state.esn; attrs->replay_esn.esn_msb = sa_entry->esn_state.esn_msb; attrs->replay_esn.overlap = sa_entry->esn_state.overlap; -if (attrs->dir ==XFRM_DEV_OFFLOAD_OUT ) +if (attrs->dir ==XFRM_DEV_OFFLOAD_OUT || + x->xso.type !=XFRM_DEV_OFFLOAD_PACKET ) goto skip_replay_window;switch (x->replay_esn->replay_window) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/122 wifi: mac80211: parse all TTLM entries
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 3fa2886d11d4545dc0dcfd0759ffbd03f88b5410 ]
For the follow up patch, we need to properly parse TTLM entries that do not have a switch time. Change the logic so that ieee80211_parse_adv_t2l returns usable values in all non-error cases. Before the values filled in were technically incorrect but enough for ieee80211_process_adv_ttlm.
Stable-dep-of: 1eab33aa63c9 ("wifi: mac80211: correctly decode TTLM with default link map")
--- net/mac80211/mlme.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
net/mac80211/mlme.c +14 -11
@@ -7014,10 +7014,6 @@ ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata, pos = (void *)ttlm->optional; control = ttlm->control; -if ((control &IEEE80211_TTLM_CONTROL_DEF_LINK_MAP ) || - !(control &IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT )) -return 0 ; -if ((control &IEEE80211_TTLM_CONTROL_DIRECTION ) !=IEEE80211_TTLM_DIRECTION_BOTH ) {sdata_info (sdata,"Invalid advertised T2L map direction\n" );
@@ -7027,21 +7023,28 @@ ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata, link_map_presence = *pos; pos++; - ttlm_info->switch_time =get_unaligned_le16 (pos); +if (control &IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT ) { + ttlm_info->switch_time =get_unaligned_le16 (pos); -/* Since ttlm_info->switch_time == 0 means no switch time, bump it -* by 1. -*/ -if (!ttlm_info->switch_time) - ttlm_info->switch_time =1 ; +/* Since ttlm_info->switch_time == 0 means no switch time, bump +* it by 1. +*/ +if (!ttlm_info->switch_time) + ttlm_info->switch_time =1 ; - pos +=2 ; + pos +=2 ; + }if (control &IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT ) { ttlm_info->duration = pos[0 ] | pos[1 ] <<8 | pos[2 ] <<16 ; pos +=3 ; } +if (control &IEEE80211_TTLM_CONTROL_DEF_LINK_MAP ) { + ttlm_info->map =0xffff ; +return 0 ; + } +if (control &IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE ) map_size =1 ;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/122 wifi: mac80211: apply advertised TTLM from association response
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit aebc29dec67aa998a9ea6d34aacba7b5c6a74d33 ]
When the AP has a disabled link that the station can include in the association, the fact that the link is dormant needs to be advertised in the TID to Link Mapping (TTLM). Section 35.3.7.2.3 ("Negotiation of TTLM") of Draft P802.11REVmf_D1.0 also states that the mapping needs to be included in the association response frame.
As such, we can simply rely on the TTLM from the association response. Before this change mac80211 would not properly track that an advertised TTLM was effectively active, resulting in it not enabling the link once it became available again.
For the link reconfiguration case, the data was not used at all. This behaviour is actually correct because Draft P802.11REVmf_D1.0 states in section 35.3.6.4 that we "shall operate with all the TIDs mapped to the newly added links ..."
Stable-dep-of: 1eab33aa63c9 ("wifi: mac80211: correctly decode TTLM with default link map")
--- net/mac80211/ieee80211_i.h | 2 - net/mac80211/mlme.c | 216 ++++++++++++++++++++----------------- 2 files changed, 119 insertions(+), 99 deletions(-)
net/mac80211/ieee80211_i.h +0 -2
@@ -451,8 +451,6 @@ struct ieee80211_mgd_assoc_data {struct ieee80211_conn_settings conn;u16 status; - -bool disabled; } link[IEEE80211_MLD_MAX_NUM_LINKS ];u8 ap_addr[ETH_ALEN ]__aligned(2) ;
net/mac80211/mlme.c +119 -97
252 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/122 wifi: mac80211: correctly decode TTLM with default link map
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 1eab33aa63c993685dd341e03bd5b267dd7403fa ]
TID-To-Link Mapping (TTLM) elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped.
Note that access points should not explicitly report an advertised TTLM with a default mapping as that is the implied mapping if the element is not included, this is even the case when switching back to the default mapping. However, mac80211 would incorrectly parse the frame and would also read one byte beyond the end of the element.
--- net/mac80211/mlme.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/mac80211/mlme.c +5 -3
@@ -8,7 +8,7 @@* Copyright 2007, Michael Wu <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015 - 2017 Intel Deutschland GmbH -* Copyright (C) 2018 - 2025 Intel Corporation +* Copyright (C) 2018 - 2026 Intel Corporation */ #include <linux/delay.h>
@@ -6190,8 +6190,10 @@ ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata,return -EINVAL ; } - link_map_presence = *pos; - pos++; +if (!(control &IEEE80211_TTLM_CONTROL_DEF_LINK_MAP )) { + link_map_presence = *pos; + pos++; + }if (control &IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT ) { ttlm_info->switch_time =get_unaligned_le16 (pos);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/122 scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit b2d6b1d443009ed4da2d69f5423ab38e5780505a ]
The code in sbp_make_tpg() limits "tpgt" to UINT_MAX but the data type of "tpg->tport_tpgt" is u16. This causes a type truncation issue.
When a user creates a TPG via configfs mkdir, for example:
mkdir /sys/kernel/config/target/sbp/<wwn>/tpgt_70000
The value 70000 passes the "tpgt > UINT_MAX" check since 70000 is far less than 4294967295. However, when assigned to the u16 field tpg->tport_tpgt, the value is silently truncated to 4464 (70000 & 0xFFFF). This causes the value the user specified to differ from what is actually stored, leading to confusion and potential unexpected behavior.
Fix this by changing the type of "tpgt" to u16 and using kstrtou16() which will properly reject values outside the u16 range.
--- drivers/target/sbp/sbp_target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/target/sbp/sbp_target.c +2 -2
@@ -1961,12 +1961,12 @@ static struct se_portal_group *sbp_make_tpg(struct se_wwn *wwn, container_of(wwn, struct sbp_tport, tport_wwn);struct sbp_tpg *tpg; -unsigned long tpgt; +u16 tpgt;int ret;if (strstr (name,"tpgt_" ) != name)return ERR_PTR (-EINVAL ); -if (kstrtoul (name +5 ,10 , &tpgt) || tpgt >UINT_MAX ) +if (kstrtou16 (name +5 ,10 , &tpgt))return ERR_PTR (-EINVAL );if (tport->tpg) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/122 ASoC: soc-acpi-intel-ptl-match: fix name_prefix of rt1320-2
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <[email protected]>
[ Upstream commit 403a0591be681eebc0c4825f8b42afe7fd13ee7f ]
rt1320_2_group2_adr works with rt1320_1_group2_adr and the name_prefix should be rt1320-2.
--- sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/common/soc-acpi-intel-ptl-match.c +1 -1
@@ -418,7 +418,7 @@ static const struct snd_soc_acpi_adr_device rt1320_2_group2_adr[] = { .adr = 0x000230025D132001ull, .num_endpoints = 1, .endpoints = &spk_r_endpoint, - .name_prefix = "rt1320-1" + .name_prefix = "rt1320-2" } };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/122 drm/xe: Skip address copy for sync-only execs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit c73a8917b31e8ddbd53cc248e17410cec27f8f58 ]
For parallel exec queues, xe_exec_ioctl() copied the batch buffer address array from userspace without checking num_batch_buffer.
If user creates a sync-only exec that doesn't use the address field, the exec will fail with -EFAULT.
Add num_batch_buffer check to skip the copy, and the exec could be executed successfully.
Here is the sync-only exec:
struct drm_xe_exec exec = {
.extensions = 0,
.exec_queue_id = qid,
.num_syncs = 1,
.syncs = (uintptr_t)&sync,
.address = 0, /* ignored for sync-only */
.num_batch_buffer = 0, /* sync-only */
};
--- drivers/gpu/drm/xe/xe_exec.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/xe/xe_exec.c +3 -3
@@ -182,9 +182,9 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file) goto err_syncs; } -if (xe_exec_queue_is_parallel (q)) { - err =copy_from_user (addresses, addresses_user,sizeof (u64) * - q->width); +if (args->num_batch_buffer &&xe_exec_queue_is_parallel (q)) { + err =copy_from_user (addresses, addresses_user, +sizeof (u64) * q->width);if (err) { err = -EFAULT ; goto err_syncs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/122 ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tagir Garaev <[email protected]>
[ Upstream commit 213c4e51267fd825cd21a08a055450cac7e0b7fb ]
The headphone GPIO should be set to the inverse of speaker_en. When speakers are enabled, headphones should be disabled and vice versa.
Currently both GPIOs are set to the same value (speaker_en), causing audio to play through both speakers and headphones simultaneously when headphones are plugged in.
Tested on Huawei Matebook (BOD-WXX9) with ES8336 codec.
--- sound/soc/intel/boards/sof_es8336.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/boards/sof_es8336.c +1 -1
@@ -120,7 +120,7 @@ static void pcm_pop_work_events(struct work_struct *work)gpiod_set_value_cansleep (priv->gpio_speakers, priv->speaker_en);if (quirk &SOF_ES8336_HEADPHONE_GPIO ) -gpiod_set_value_cansleep (priv->gpio_headphone, priv->speaker_en); +gpiod_set_value_cansleep (priv->gpio_headphone, !priv->speaker_en); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/122 gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Sergeev <[email protected]>
[ Upstream commit c0ae43d303e45764918fa8c1dc13d6a5db59c479 ]
The BIT() macro uses unsigned long, which is 32 bits on 32-bit architectures. When iterating over GPIO pins with index >= 32, the expression (*value & BIT(i)) causes undefined behavior due to shifting by a value >= type width.
Since 'value' is a pointer to u64, use BIT_ULL() to ensure correct 64-bit mask on all architectures.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- drivers/gpio/gpiolib-acpi-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpiolib-acpi-core.c +1 -1
@@ -1159,7 +1159,7 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address,mutex_unlock (&achip->conn_lock);if (function ==ACPI_WRITE ) -gpiod_set_raw_value_cansleep (desc, !!(*value &BIT (i))); +gpiod_set_raw_value_cansleep (desc, !!(*value &BIT_ULL (i)));else *value |= (u64 )gpiod_get_raw_value_cansleep (desc) << i; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/122 gpio: virtuser: fix UAF in configfs release path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Huang <[email protected]>
[ Upstream commit 53ad4a948a4586359b841d607c08fb16c5503230 ]
The gpio-virtuser configfs release path uses guard(mutex) to protect the device structure. However, the device is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory.
Specifically, gpio_virtuser_device_config_group_release() destroys the mutex and frees the device while still inside the guard(mutex) scope. When the function returns, the guard cleanup invokes mutex_unlock(&dev->lock), resulting in a slab use-after-free.
Limit the mutex lifetime by using a scoped_guard() only around the activation check, so that the lock is released before mutex_destroy() and kfree() are called.
--- drivers/gpio/gpio-virtuser.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpio/gpio-virtuser.c +4 -4
@@ -1684,10 +1684,10 @@ static void gpio_virtuser_device_config_group_release(struct config_item *item) {struct gpio_virtuser_device *dev =to_gpio_virtuser_device (item); -guard (mutex)(&dev->lock); - -if (gpio_virtuser_device_is_live (dev)) -gpio_virtuser_device_deactivate (dev); + scoped_guard(mutex, &dev->lock) { +if (gpio_virtuser_device_is_live (dev)) +gpio_virtuser_device_deactivate (dev); + }mutex_destroy (&dev->lock);ida_free (&gpio_virtuser_ida, dev->id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/122 drm/amd/pm: fix race in power state check before mutex lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit ee8d07cd5730038e33bf5e551448190bbd480eb8 ]
The power state check in amdgpu_dpm_set_powergating_by_smu() is done before acquiring the pm mutex, leading to a race condition where:
1. Thread A checks state and thinks no change is needed
2. Thread B acquires mutex and modifies the state
3. Thread A returns without updating state, causing inconsistency
Fix this by moving the mutex lock before the power state check, ensuring atomicity of the state check and modification.
--- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/pm/amdgpu_dpm.c +4 -3
@@ -80,15 +80,15 @@ int amdgpu_dpm_set_powergating_by_smu(struct amdgpu_device *adev,enum ip_power_state pwr_state = gate ?POWER_STATE_OFF :POWER_STATE_ON ;bool is_vcn = block_type ==AMD_IP_BLOCK_TYPE_VCN ; +mutex_lock (&adev->pm.mutex); +if (atomic_read (&adev->pm.pwr_state[block_type]) == pwr_state && (!is_vcn || adev->vcn.num_vcn_inst ==1 )) {dev_dbg (adev->dev,"IP block%d already in the target %s state!" , block_type, gate ?"gate" :"ungate" ); -return 0 ; + goto out_unlock; } -mutex_lock (&adev->pm.mutex); -switch (block_type) {case AMD_IP_BLOCK_TYPE_UVD :case AMD_IP_BLOCK_TYPE_VCE :
@@ -115,6 +115,7 @@ int amdgpu_dpm_set_powergating_by_smu(struct amdgpu_device *adev,if (!ret)atomic_set (&adev->pm.pwr_state[block_type], pwr_state); +out_unlock:mutex_unlock (&adev->pm.mutex);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/122 gpio: brcmstb: correct hwirq to bank map
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Berger <[email protected]>
[ Upstream commit b2cf569ed81e7574d4287eaf3b2c38690a934d34 ]
The brcmstb_gpio_hwirq_to_bank() function was designed to accommodate the downward numbering of dynamic GPIOs by traversing the bank list in the reverse order. However, the dynamic numbering has changed to increment upward which can produce an incorrect mapping.
The function is modified to no longer assume an ordering of the list to accommodate either option.
--- drivers/gpio/gpio-brcmstb.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpio/gpio-brcmstb.c +3 -5
@@ -301,12 +301,10 @@ static struct brcmstb_gpio_bank *brcmstb_gpio_hwirq_to_bank( struct brcmstb_gpio_priv *priv, irq_hw_number_t hwirq) {struct brcmstb_gpio_bank *bank; -int i =0 ; -/* banks are in descending order */ -list_for_each_entry_reverse (bank, &priv->bank_list, node) { - i += bank->chip.gc.ngpio; -if (hwirq < i) +list_for_each_entry (bank, &priv->bank_list, node) { +if (hwirq >= bank->chip.gc.offset && + hwirq < (bank->chip.gc.offset + bank->chip.gc.ngpio))return bank; }return NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/122 kbuild: rpm-pkg: Generate debuginfo package manually
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit 62089b804895e845f82e132ea9d46a1fc53ed5a7 ]
Commit a7c699d090a1 ("kbuild: rpm-pkg: build a debuginfo RPM") adjusted the __spec_install_post macro to include __os_install_post, which runs brp-strip. This ends up stripping module signatures, breaking loading modules with lockdown enabled.
Undo most of the changes of the aforementioned debuginfo patch and mirror commit 16c36f8864e3 ("kbuild: deb-pkg: use build ID instead of debug link for dbg package") in kernel.spec to generate a functionally equivalent debuginfo package while avoiding touching the modules after they have already been signed during modules_install.
--- scripts/package/kernel.spec | 65 +++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 35 deletions(-)
scripts/package/kernel.spec +30 -35
@@ -2,6 +2,8 @@ %{!?_arch: %define _arch dummy} %{!?make: %define make make} %define makeflags %{?_smp_mflags} ARCH=%{ARCH} +%define __spec_install_post /usr/lib/rpm/brp-compress || : +%define debug_package %{nil} Name: kernel Summary: The Linux Kernel
@@ -46,34 +48,12 @@ against the %{version} kernel package. %endif %if %{with_debuginfo} -# list of debuginfo-related options taken from distribution kernel.spec -# files -%undefine _include_minidebuginfo -%undefine _find_debuginfo_dwz_opts -%undefine _unique_build_ids -%undefine _unique_debug_names -%undefine _unique_debug_srcs -%undefine _debugsource_packages -%undefine _debuginfo_subpackages -%global _find_debuginfo_opts -r -%global _missing_build_ids_terminate_build 1 -%global _no_recompute_build_ids 1 -%{debug_package} +%package debuginfo +Summary: Debug information package for the Linux kernel +%description debuginfo +This package provides debug information for the kernel image and modules from the +%{version} package. %endif -# some (but not all) versions of rpmbuild emit %%debug_package with -# %%install. since we've already emitted it manually, that would cause -# a package redefinition error. ensure that doesn't happen -%define debug_package %{nil} - -# later, we make all modules executable so that find-debuginfo.sh strips -# them up. but they don't actually need to be executable, so remove the -# executable bit, taking care to do it _after_ find-debuginfo.sh has run -%define __spec_install_post \ - %{?__debug_package:%{__debug_install_post}} \ - %{__arch_install_post} \ - %{__os_install_post} \ - find %{buildroot}/lib/modules/%{KERNELRELEASE} -name "*.ko" -type f \\\ - | xargs --no-run-if-empty chmod u-x %prep %setup -q -n linux
@@ -87,7 +67,7 @@ patch -p1 < %{SOURCE2} mkdir -p %{buildroot}/lib/modules/%{KERNELRELEASE} cp $(%{make} %{makeflags} -s image_name) %{buildroot}/lib/modules/%{KERNELRELEASE}/vmlinuz # DEPMOD=true makes depmod no-op. We do not package depmod-generated files. -%{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} DEPMOD=true modules_install +%{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} INSTALL_MOD_STRIP=1 DEPMOD=true modules_install %{make} %{makeflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install cp System.map %{buildroot}/lib/modules/%{KERNELRELEASE} cp .config %{buildroot}/lib/modules/%{KERNELRELEASE}/config
@@ -118,22 +98,31 @@ ln -fns /usr/src/kernels/%{KERNELRELEASE} %{buildroot}/lib/modules/%{KERNELRELEA echo "%exclude /lib/modules/%{KERNELRELEASE}/build" } > %{buildroot}/kernel.list -# make modules executable so that find-debuginfo.sh strips them. this -# will be undone later in %%__spec_install_post -find %{buildroot}/lib/modules/%{KERNELRELEASE} -name "*.ko" -type f \ - | xargs --no-run-if-empty chmod u+x - %if %{with_debuginfo} # copying vmlinux directly to the debug directory means it will not get # stripped (but its source paths will still be collected + fixed up) mkdir -p %{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE} cp vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE} + +echo /usr/lib/debug/lib/modules/%{KERNELRELEASE}/vmlinux > %{buildroot}/debuginfo.list + +while read -r mod; do + mod="${mod%.o}.ko" + dbg="%{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}/kernel/${mod}" + buildid=$("${READELF}" -n "${mod}" | sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p') + link="%{buildroot}/usr/lib/debug/.build-id/${buildid}.debug" + + mkdir -p "${dbg%/*}" "${link%/*}" + "${OBJCOPY}" --only-keep-debug "${mod}" "${dbg}" + ln -sf --relative "${dbg}" "${link}" + + echo "${dbg#%{buildroot}}" >> %{buildroot}/debuginfo.list + echo "${link#%{buildroot}}" >> %{buildroot}/debuginfo.list +done < modules.order %endif %clean rm -rf %{buildroot} -rm -f debugfiles.list debuglinks.list debugsourcefiles.list debugsources.list \ - elfbins.list %post if [ -x /usr/bin/kernel-install ]; then
@@ -172,3 +161,9 @@ fi /usr/src/kernels/%{KERNELRELEASE} /lib/modules/%{KERNELRELEASE}/build %endif + +%if %{with_debuginfo} +%files -f %{buildroot}/debuginfo.list debuginfo +%defattr (-, root, root) +%exclude /debuginfo.list +%endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/122 kbuild: Fix permissions of modules.builtin.modinfo
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Zuo <[email protected]>
[ Upstream commit 6d60354ea2f90352b22039ed8371c4f4321df90e ]
Currently, modules.builtin.modinfo is created with executable permissions (0755). This is because after commit 39cfd5b12160 ("kbuild: extract modules.builtin.modinfo from vmlinux.unstripped"), modules.builtin.modinfo is extracted from vmlinux.unstripped using objcopy. When extracting sections, objcopy inherits attributes from the source ELF file.
Since modules.builtin.modinfo is a data file and not an executable, it should have regular file permissions (0644). The executable bit can trigger warnings in Debian's Lintian tool.
Explicitly remove the executable bit after generation.
--- scripts/Makefile.vmlinux | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
scripts/Makefile.vmlinux +2 -1
@@ -113,7 +113,8 @@ vmlinux: vmlinux.unstripped FORCE # what kmod expects to parse. quiet_cmd_modules_builtin_modinfo = GEN $@ cmd_modules_builtin_modinfo = $(cmd_objcopy); \ - sed -i 's/\x00\+$$/\x00/g' $@ + sed -i 's/\x00\+$$/\x00/g' $@; \ + chmod -x $@ OBJCOPYFLAGS_modules.builtin.modinfo := -j .modinfo -O binary
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/122 of/reserved_mem: Simplify the logic of fdt_scan_reserved_mem_reg_nodes()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit 85a8a30c5b8e0ffaaf9f4dc51550dc71a1100df4 ]
Use the existing helper functions to simplify the logic of fdt_scan_reserved_mem_reg_nodes()
Stable-dep-of: 0fd17e598333 ("of: reserved_mem: Allow reserved_mem framework detect "cma=" kernel param")
--- drivers/of/of_reserved_mem.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-)
drivers/of/of_reserved_mem.c +7 -18
@@ -230,12 +230,9 @@ static void __init __rmem_check_for_overlap(void);*/ void __init fdt_scan_reserved_mem_reg_nodes (void ) { -int t_len = (dt_root_addr_cells + dt_root_size_cells) *sizeof (__be32);const void *fdt = initial_boot_params;phys_addr_t base, size; -const __be32 *prop;int node, child; -int len;if (!fdt)return ;
@@ -256,29 +253,21 @@ void __init fdt_scan_reserved_mem_reg_nodes(void)fdt_for_each_subnode (child, fdt, node) {const char *uname; +u64 b, s; - prop =of_get_flat_dt_prop (child,"reg" , &len); -if (!prop) -continue ;if (!of_fdt_device_is_available (fdt, child))continue ; - uname =fdt_get_name (fdt, child,NULL ); -if (len && len % t_len !=0 ) { -pr_err ("Reserved memory: invalid reg property in '%s', skipping node.\n" , - uname); +if (!of_flat_dt_get_addr_size (child,"reg" , &b, &s))continue ; - } -if (len > t_len) -pr_warn ("%s() ignores %d regions in node '%s'\n" , - __func__, len / t_len -1 , uname); + base = b; + size = s; - base =dt_mem_next_cell (dt_root_addr_cells, &prop); - size =dt_mem_next_cell (dt_root_size_cells, &prop); - -if (size) +if (size) { + uname =fdt_get_name (fdt, child,NULL );fdt_reserved_mem_save_node (child, uname, base, size); + } }/* check for overlapping reserved regions */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/122 of: reserved_mem: Allow reserved_mem framework detect "cma=" kernel param
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oreoluwa Babatunde <[email protected]>
[ Upstream commit 0fd17e5983337231dc655e9ca0095d2ca3f47405 ]
When initializing the default cma region, the "cma=" kernel parameter takes priority over a DT defined linux,cma-default region. Hence, give the reserved_mem framework the ability to detect this so that the DT defined cma region can skip initialization accordingly.
[mszyprow: rebased onto v6.19-rc1, added fixes tags, added a stub for
cma_skip_dt_default_reserved_mem() if no CONFIG_DMA_CMA is set]
--- drivers/of/of_reserved_mem.c | 19 +++++++++++++++++-- include/linux/cma.h | 9 +++++++++ kernel/dma/contiguous.c | 16 ++++++++++------ 3 files changed, 36 insertions(+), 8 deletions(-)
drivers/of/of_reserved_mem.c +17 -2
@@ -158,7 +158,7 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,phys_addr_t base, size;int len;const __be32 *prop; -bool nomap; +bool nomap, default_cma; prop =of_get_flat_dt_prop (node,"reg" , &len);if (!prop)
@@ -171,6 +171,12 @@ static int __init __reserved_mem_reserve_reg(unsigned long node, } nomap =of_get_flat_dt_prop (node,"no-map" ,NULL ) !=NULL ; + default_cma =of_get_flat_dt_prop (node,"linux,cma-default" ,NULL ); + +if (default_cma &&cma_skip_dt_default_reserved_mem ()) { +pr_err ("Skipping dt linux,cma-default for \"cma=\" kernel param.\n" ); +return -EINVAL ; + }while (len >= t_len) { base =dt_mem_next_cell (dt_root_addr_cells, &prop);
@@ -253,10 +259,13 @@ void __init fdt_scan_reserved_mem_reg_nodes(void)fdt_for_each_subnode (child, fdt, node) {const char *uname; +bool default_cma =of_get_flat_dt_prop (child,"linux,cma-default" ,NULL );u64 b, s;if (!of_fdt_device_is_available (fdt, child))continue ; +if (default_cma &&cma_skip_dt_default_reserved_mem ()) +continue ;if (!of_flat_dt_get_addr_size (child,"reg" , &b, &s))continue ;
@@ -395,7 +404,7 @@ static int __init __reserved_mem_alloc_size(unsigned long node, const char *unamphys_addr_t base =0 , align =0 , size;int len;const __be32 *prop; -bool nomap; +bool nomap, default_cma;int ret; prop =of_get_flat_dt_prop (node,"size" , &len);
@@ -419,6 +428,12 @@ static int __init __reserved_mem_alloc_size(unsigned long node, const char *unam } nomap =of_get_flat_dt_prop (node,"no-map" ,NULL ) !=NULL ; + default_cma =of_get_flat_dt_prop (node,"linux,cma-default" ,NULL ); + +if (default_cma &&cma_skip_dt_default_reserved_mem ()) { +pr_err ("Skipping dt linux,cma-default for \"cma=\" kernel param.\n" ); +return -EINVAL ; + }/* Need adjust the alignment to satisfy the CMA requirement */ if (IS_ENABLED(CONFIG_CMA)
include/linux/cma.h +9 -0
@@ -57,6 +57,15 @@ extern bool cma_intersects(struct cma *cma, unsigned long start, unsigned long eextern void cma_reserve_pages_on_error (struct cma *cma); +#ifdef CONFIG_DMA_CMA +extern bool cma_skip_dt_default_reserved_mem (void ); +#else +static inline bool cma_skip_dt_default_reserved_mem (void ) +{ +return false; +} +#endif +#ifdef CONFIG_CMA struct folio *cma_alloc_folio (struct cma *cma,int order,gfp_t gfp);bool cma_free_folio (struct cma *cma,const struct folio *folio);
kernel/dma/contiguous.c +10 -6
@@ -90,6 +90,16 @@ static int __init early_cma(char *p) }early_param ("cma" , early_cma); +/* +* cma_skip_dt_default_reserved_mem - This is called from the +* reserved_mem framework to detect if the default cma region is being +* set by the "cma=" kernel parameter. +*/ +bool __init cma_skip_dt_default_reserved_mem (void ) +{ +return size_cmdline !=-1 ; +} +#ifdef CONFIG_DMA_NUMA_CMA static struct cma *dma_contiguous_numa_area[MAX_NUMNODES ];
@@ -463,12 +473,6 @@ static int __init rmem_cma_setup(struct reserved_mem *rmem)struct cma *cma;int err; -if (size_cmdline !=-1 && default_cma) { -pr_info ("Reserved memory: bypass %s node, using cmdline CMA params instead\n" , - rmem->name); -return -EBUSY ; - } -if (!of_get_flat_dt_prop (node,"reusable" ,NULL ) ||of_get_flat_dt_prop (node,"no-map" ,NULL ))return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/122 bcache: fix improper use of bi_end_io
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ]
Don't call bio->bi_end_io() directly. Use the bio_endio() helper function instead, which handles completion more safely and uniformly.
Stable-dep-of: 4da7c5c3ec34 ("bcache: fix I/O accounting leak in detached_dev_do_request")
--- drivers/md/bcache/request.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/bcache/request.c +3 -3
@@ -1104,7 +1104,7 @@ static void detached_dev_end_io(struct bio *bio) }kfree (ddip); - bio->bi_end_io (bio); +bio_endio (bio); } static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
@@ -1121,7 +1121,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, ddip =kzalloc (sizeof (struct detached_dev_io_private ),GFP_NOIO );if (!ddip) { bio->bi_status =BLK_STS_RESOURCE ; - bio->bi_end_io (bio); +bio_endio (bio);return ; }
@@ -1136,7 +1136,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,if ((bio_op (bio) ==REQ_OP_DISCARD ) && !bdev_max_discard_sectors (dc->bdev)) - bio->bi_end_io (bio); +detached_dev_end_io (bio);else submit_bio_noacct (bio); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/122 bcache: use bio cloning for detached device requests
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit 3ef825dfd4e487d6f92b23ee2df2455814583ef4 ]
Previously, bcache hijacked the bi_end_io and bi_private fields of the incoming bio when the backing device was in a detached state. This is fragile and breaks if the bio is needed to be processed by other layers.
This patch transitions to using a cloned bio embedded within a private structure. This ensures the original bio's metadata remains untouched.
Stable-dep-of: 4da7c5c3ec34 ("bcache: fix I/O accounting leak in detached_dev_do_request")
--- drivers/md/bcache/bcache.h | 9 +++++ drivers/md/bcache/request.c | 79 ++++++++++++++++--------------------- drivers/md/bcache/super.c | 12 +++++- 3 files changed, 54 insertions(+), 46 deletions(-)
drivers/md/bcache/bcache.h +9 -0
@@ -273,6 +273,8 @@ struct bcache_device {struct bio_set bio_split; +struct bio_set bio_detached; + unsigned int data_csum:1; int (*cache_miss)(struct btree *b, struct search *s,
@@ -755,6 +757,13 @@ struct bbio {struct bio bio; }; +struct detached_dev_io_private { +struct bcache_device *d; +unsigned long start_time; +struct bio *orig_bio; +struct bio bio; +}; +#define BTREE_PRIO USHRT_MAX#define INITIAL_PRIO 32768U
drivers/md/bcache/request.c +35 -44
122 lines not on this page · raw message
drivers/md/bcache/super.c +10 -2
@@ -887,6 +887,7 @@ static void bcache_device_free(struct bcache_device *d) }bioset_exit (&d->bio_split); +bioset_exit (&d->bio_detached);kvfree (d->full_dirty_stripes);kvfree (d->stripe_sectors_dirty);
@@ -949,6 +950,11 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER)) goto out_ida_remove; +if (bioset_init (&d->bio_detached,4 , + offsetof(struct detached_dev_io_private , bio), +BIOSET_NEED_BVECS |BIOSET_NEED_RESCUER )) + goto out_bioset_split_exit; +if (lim.logical_block_size >PAGE_SIZE && cached_bdev) {/* * This should only happen with BCACHE_SB_VERSION_BDEV.
@@ -964,7 +970,7 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, d->disk =blk_alloc_disk (&lim,NUMA_NO_NODE );if (IS_ERR (d->disk)) - goto out_bioset_exit; + goto out_bioset_detach_exit;set_capacity (d->disk, sectors);snprintf (d->disk->disk_name,DISK_NAME_LEN ,"bcache%i" , idx);
@@ -976,7 +982,9 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, d->disk->private_data = d;return 0 ; -out_bioset_exit: +out_bioset_detach_exit: +bioset_exit (&d->bio_detached); +out_bioset_split_exit:bioset_exit (&d->bio_split); out_ida_remove:ida_free (&bcache_device_idx, idx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/122 bcache: fix I/O accounting leak in detached_dev_do_request
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f ]
When a bcache device is detached, discard requests are completed immediately. However, the I/O accounting started in cached_dev_make_request() is not ended, leading to 100% disk utilization reports in iostat. Add the missing bio_end_io_acct() call.
--- drivers/md/bcache/request.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/bcache/request.c +1 -0
@@ -1107,6 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d,if (bio_op (orig_bio) ==REQ_OP_DISCARD && !bdev_max_discard_sectors (dc->bdev)) { +bio_end_io_acct (orig_bio, start_time);bio_endio (orig_bio);return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/122 dma/pool: distinguish between missing and exhausted atomic pools
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sai Sree Kartheek Adivi <[email protected]>
[ Upstream commit 56c430c7f06d838fe3b2077dbbc4cc0bf992312b ]
Currently, dma_alloc_from_pool() unconditionally warns and dumps a stack trace when an allocation fails, with the message "Failed to get suitable pool".
This conflates two distinct failure modes:
1. Configuration error: No atomic pool is available for the requested DMA mask (a fundamental system setup issue)
2. Resource Exhaustion: A suitable pool exists but is currently full (a recoverable runtime state)
This lack of distinction prevents drivers from using __GFP_NOWARN to suppress error messages during temporary pressure spikes, such as when awaiting synchronous reclaim of descriptors.
Refactor the error handling to distinguish these cases:
- If no suitable pool is found, keep the unconditional WARN regarding the missing pool.
- If a pool was found but is exhausted, respect __GFP_NOWARN and update the warning message to explicitly state "DMA pool exhausted".
--- kernel/dma/pool.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/dma/pool.c +6 -1
@@ -268,15 +268,20 @@ struct page *dma_alloc_from_pool(struct device *dev, size_t size, {struct gen_pool *pool =NULL ;struct page *page; +bool pool_found = false;while ((pool =dma_guess_pool (pool, gfp))) { + pool_found = true; page =__dma_alloc_from_pool (dev, size, pool, cpu_addr, phys_addr_ok);if (page)return page; } -WARN (1 ,"Failed to get suitable pool for %s\n" ,dev_name (dev)); +if (pool_found) +WARN (!(gfp & __GFP_NOWARN),"DMA pool exhausted for %s\n" ,dev_name (dev)); +else +WARN (1 ,"Failed to get suitable pool for %s\n" ,dev_name (dev));return NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/122 drm/xe/configfs: Fix is_bound() pci_dev lifetime
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit c1ed856c09d0d730c2f63bbb757cb6011db148f9 ]
Move pci_dev_put() after pci_dbg() to avoid using pdev after dropping its reference.
--- drivers/gpu/drm/xe/xe_configfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_configfs.c +1 -2
@@ -258,11 +258,10 @@ static bool is_bound(struct xe_config_group_device *dev)return false; ret =pci_get_drvdata (pdev); -pci_dev_put (pdev); -if (ret)pci_dbg (pdev,"Already bound to driver\n" ); +pci_dev_put (pdev);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/122 drm/xe/nvm: Manage nvm aux cleanup with devres
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit 2da8fbb8f1c17129a08c1e0e42c71eabdca76062 ]
Move nvm teardown to a devm-managed action registered from xe_nvm_init(). This ensures the auxiliary NVM device is deleted on probe failure and device detach without requiring explicit calls from remove paths.
As part of this, drop xe_nvm_fini() from xe_device_remove() and from the survivability sysfs teardown, and remove the public xe_nvm_fini() API from the header.
This is to fix below warn message when there is probe failure after xe_nvm_init(), then xe_device_probe() is called again:
"
[ 207.318152] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/xe.nvm.768' [ 207.318157] CPU: 5 UID: 0 PID: 10261 Comm: modprobe Tainted: G B W 6.19.0-rc2-lgci-xe-kernel+ #223 PREEMPT(voluntary) [ 207.318160] Tainted: [B]=BAD_PAGE, [W]=WARN [ 207.318161] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 [ 207.318163] Call Trace: [ 207.318163] <TASK> [ 207.318165] dump_stack_lvl+0xa0/0xc0 [ 207.318170] dump_stack+0x10/0x20 [ 207.318171] sysfs_warn_dup+0xd5/0x110 [ 207.318175] sysfs_create_dir_ns+0x1f6/0x280 [ 207.318177] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 207.318179] ? lock_acquire+0x1a4/0x2e0 [ 207.318182] ? __kasan_check_read+0x11/0x20 [ 207.318185] ? do_raw_spin_unlock+0x5c/0x240 [ 207.318187] kobject_add_internal+0x28d/0x8e0 [ 207.318189] kobject_add+0x11f/0x1f0 [ 207.318191] ? __pfx_kobject_add+0x10/0x10 [ 207.318193] ? lockdep_init_map_type+0x4b/0x230 [ 207.318195] ? get_device_parent.isra.0+0x43/0x4c0 [ 207.318197] ? kobject_get+0x55/0xf0 [ 207.318199] device_add+0x2d7/0x1500 [ 207.318201] ? __pfx_device_add+0x10/0x10 [ 207.318203] ? lockdep_init_map_type+0x4b/0x230 [ 207.318205] __auxiliary_device_add+0x99/0x140 [ 207.318208] xe_nvm_init+0x7a2/0xef0 [xe] [ 207.318333] ? xe_devcoredump_init+0x80/0x110 [xe] [ 207.318452] ? __devm_add_action+0x82/0xc0 [ 207.318454] ? fs_reclaim_release+0xc0/0x110 [ 207.318457] xe_device_probe+0x17dd/0x2c40 [xe] [ 207.318574] ? __pfx___drm_dev_dbg+0x10/0x10 [ 207.318576] ? add_dr+0x180/0x220 [ 207.318579] ? __pfx___drmm_mutex_release+0x10/0x10 [ 207.318582] ? __pfx_xe_device_probe+0x10/0x10 [xe] [ 207.318697] ? xe_pm_init_early+0x33a/0x410 [xe] [ 207.318850] xe_pci_probe+0x936/0x1250 [xe] [ 207.318999] ? lock_acquire+0x1a4/0x2e0 [ 207.319003] ? __pfx_xe_pci_probe+0x10/0x10 [xe] [ 207.319151] local_pci_probe+0xe6/0x1a0 [ 207.319154] pci_device_probe+0x523/0x840 [ 207.319157] ? __pfx_pci_device_probe+0x10/0x10 [ 207.319159] ? sysfs_do_create_link_sd.isra.0+0x8c/0x110 [ 207.319162] ? sysfs_create_link+0x48/0xc0
...
"
--- drivers/gpu/drm/xe/xe_device.c | 2 -- drivers/gpu/drm/xe/xe_nvm.c | 43 +++++++++++++++++----------------- drivers/gpu/drm/xe/xe_nvm.h | 2 -- 3 files changed, 22 insertions(+), 25 deletions(-)
drivers/gpu/drm/xe/xe_device.c +0 -2
@@ -974,8 +974,6 @@ void xe_device_remove(struct xe_device *xe) {xe_display_unregister (xe); -xe_nvm_fini (xe); -drm_dev_unplug (&xe->drm);xe_bo_pci_dev_remove_all (xe);
drivers/gpu/drm/xe/xe_nvm.c +22 -21
58 lines not on this page · raw message
drivers/gpu/drm/xe/xe_nvm.h +0 -2
@@ -10,6 +10,4 @@ struct xe_device;int xe_nvm_init (struct xe_device *xe); -void xe_nvm_fini (struct xe_device *xe); -#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/122 drm/xe/nvm: Fix double-free on aux add failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit 8a44241b0b83a6047c5448da1fff03fcc29496b5 ]
After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the .release callback will be triggered to free the memory associated with the auxiliary_device.
Move the kfree(nvm) into the auxiliary_device_init() failure path and remove the err goto path to fix below error.
"
[ 13.232905] ================================================================== [ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe] [ 13.233112] Free of addr ffff888120635000 by task systemd-udevd/273
[ 13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel+ #225 PREEMPT(voluntary) ... [ 13.233125] Call Trace: [ 13.233126] <TASK> [ 13.233127] dump_stack_lvl+0x7f/0xc0 [ 13.233132] print_report+0xce/0x610 [ 13.233136] ? kasan_complete_mode_report_info+0x5d/0x1e0 [ 13.233139] ? xe_nvm_init+0x751/0xf10 [xe]
...
"
v2: drop err goto path. (Alexander)
--- drivers/gpu/drm/xe/xe_nvm.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/gpu/drm/xe/xe_nvm.c +5 -7
@@ -153,19 +153,17 @@ int xe_nvm_init(struct xe_device *xe) ret =auxiliary_device_init (aux_dev);if (ret) {drm_err (&xe->drm,"xe-nvm aux init failed %d\n" , ret); - goto err; +kfree (nvm); + xe->nvm =NULL ; +return ret; } ret =auxiliary_device_add (aux_dev);if (ret) {drm_err (&xe->drm,"xe-nvm aux add failed %d\n" , ret);auxiliary_device_uninit (aux_dev); - goto err; + xe->nvm =NULL ; +return ret; }return devm_add_action_or_reset (xe->drm.dev, xe_nvm_fini, xe); - -err: -kfree (nvm); - xe->nvm =NULL ; -return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/122 sched/deadline: Document dl_server
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 2614069c5912e9d6f1f57c262face1b368fb8c93 ]
Place the notes that resulted from going through the dl_server code in a comment.
Stable-dep-of: 115135422562 ("sched/deadline: Fix 'stuck' dl_server")
--- kernel/sched/deadline.c | 194 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 194 insertions(+)
kernel/sched/deadline.c +194 -0
@@ -1573,6 +1573,200 @@ void dl_server_update(struct sched_dl_entity *dl_se, s64 delta_exec)update_curr_dl_se (dl_se->rq, dl_se, delta_exec); } +/* +* dl_server && dl_defer: +* +* 6 +* +--------------------+ +* v | +* +-------------+ 4 +-----------+ 5 +------------------+ +* +-> | A:init | <--- | D:running | -----> | E:replenish-wait | +* | +-------------+ +-----------+ +------------------+ +* | | | 1 ^ ^ | +* | | 1 +----------+ | 3 | +* | v | | +* | +--------------------------------+ 2 | +* | | | ----+ | +* | 8 | B:zero_laxity-wait | | | +* | | | <---+ | +* | +--------------------------------+ | +* | | ^ ^ 2 | +* | | 7 | 2 +--------------------+ +* | v | +* | +-------------+ | +* +-- | C:idle-wait | -+ +* +-------------+ +* ^ 7 | +* +---------+ +* +* +* [A] - init +* dl_server_active = 0 +* dl_throttled = 0 +* dl_defer_armed = 0 +* dl_defer_running = 0/1 +* dl_defer_idle = 0 +* +* [B] - zero_laxity-wait +* dl_server_active = 1 +* dl_throttled = 1 +* dl_defer_armed = 1 +* dl_defer_running = 0 +* dl_defer_idle = 0 +* +* [C] - idle-wait +* dl_server_active = 1 +* dl_throttled = 1 +* dl_defer_armed = 1 +* dl_defer_running = 0 +* dl_defer_idle = 1 +* +* [D] - running +* dl_server_active = 1 +* dl_throttled = 0 +* dl_defer_armed = 0 +* dl_defer_running = 1 +* dl_defer_idle = 0 +* +* [E] - replenish-wait +* dl_server_active = 1 +* dl_throttled = 1 +* dl_defer_armed = 0 +* dl_defer_running = 1 +* dl_defer_idle = 0 +* +* +* [1] A->B, A->D +* dl_server_start() +* dl_server_active = 1; +* enqueue_dl_entity() +* update_dl_entity(WAKEUP) +* if (!dl_defer_running) +* dl_defer_armed = 1; +* dl_throttled = 1; +* if (dl_throttled && start_dl_timer()) +* return; // [B] +* __enqueue_dl_entity(); +* // [D] +* +* // deplete server runtime from client-class +* [2] B->B, C->B, E->B +* dl_server_update() +* update_curr_dl_se() // idle = false +* if (dl_defer_idle) +* dl_defer_idle = 0; +* if (dl_defer && dl_throttled && dl_runtime_exceeded()) +* dl_defer_running = 0; +* hrtimer_try_to_cancel(); // stop timer +* replenish_dl_new_period() +* // fwd period +* dl_throttled = 1; +* dl_defer_armed = 1; +* start_dl_timer(); // restart timer +* // [B] +* +* // timer actually fires means we have runtime +* [3] B->D +* dl_server_timer() +* if (dl_defer_armed) +* dl_defer_running = 1; +* enqueue_dl_entity(REPLENISH) +* replenish_dl_entity() +* // fwd period +* if (dl_throttled) +* dl_throttled = 0; +* if (dl_defer_armed) +* dl_defer_armed = 0; +* __enqueue_dl_entity(); +* // [D] +* +* // schedule server +* [4] D->A +* pick_task_dl() +* p = server_pick_task(); +* if (!p) +* dl_server_stop() +* dequeue_dl_entity(); +* hrtimer_try_to_cancel(); +* dl_defer_armed = 0; +* dl_throttled = 0; +* dl_server_active = 0; +* // [A] +* return p; +* +* // server running +* [5] D->E +* update_curr_dl_se() +* if (dl_runtime_exceeded()) +* dl_throttled = 1; +* dequeue_dl_entity(); +* start_dl_timer(); +* // [E] +* +* // server replenished +* [6] E->D +* dl_server_timer() +* enqueue_dl_entity(REPLENISH) +* replenish_dl_entity() +* fwd-period +* if (dl_throttled) +* dl_throttled = 0; +* __enqueue_dl_entity(); +* // [D] +* +* // deplete server runtime from idle +* [7] B->C, C->C +* dl_server_update_idle() +* update_curr_dl_se() // idle = true +* if (dl_defer && dl_throttled && dl_runtime_exceeded()) +* if (dl_defer_idle) +* return; +* dl_defer_running = 0; +* hrtimer_try_to_cancel(); +* replenish_dl_new_period() +* // fwd period +* dl_throttled = 1; +* dl_defer_armed = 1; +* dl_defer_idle = 1; +* start_dl_timer(); // restart timer +* // [C] +* +* // stop idle server +* [8] C->A +* dl_server_timer() +* if (dl_defer_idle) +* dl_server_stop(); +* // [A] +* +* +* digraph dl_server { +* "A:init" -> "B:zero_laxity-wait" [label="1:dl_server_start"] +* "A:init" -> "D:running" [label="1:dl_server_start"] +* "B:zero_laxity-wait" -> "B:zero_laxity-wait" [label="2:dl_server_update"] +* "B:zero_laxity-wait" -> "C:idle-wait" [label="7:dl_server_update_idle"] +* "B:zero_laxity-wait" -> "D:running" [label="3:dl_server_timer"] +* "C:idle-wait" -> "A:init" [label="8:dl_server_timer"] +* "C:idle-wait" -> "B:zero_laxity-wait" [label="2:dl_server_update"] +* "C:idle-wait" -> "C:idle-wait" [label="7:dl_server_update_idle"] +* "D:running" -> "A:init" [label="4:pick_task_dl"] +* "D:running" -> "E:replenish-wait" [label="5:update_curr_dl_se"] +* "E:replenish-wait" -> "B:zero_laxity-wait" [label="2:dl_server_update"] +* "E:replenish-wait" -> "D:running" [label="6:dl_server_timer"] +* } +* +* +* Notes: +* +* - When there are fair tasks running the most likely loop is [2]->[2]. +* the dl_server never actually runs, the timer never fires. +* +* - When there is actual fair starvation; the timer fires and starts the +* dl_server. This will then throttle and replenish like a normal DL +* task. Notably it will not 'defer' again. +* +* - When idle it will push the actication forward once, and then wait +* for the timer to hit or a non-idle update to restart things. +*/ void dl_server_start (struct sched_dl_entity *dl_se) {struct rq *rq = dl_se->rq;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/122 sched/deadline: Fix stuck dl_server
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 115135422562e2f791e98a6f55ec57b2da3b3a95 ]
Andrea reported the dl_server getting stuck for him. He tracked it down to a state where dl_server_start() saw dl_defer_running==1, but the dl_server's job is no longer valid at the time of dl_server_start().
In the state diagram this corresponds to [4] D->A (or dl_server_stop() due to no more runnable tasks) followed by [1], which in case of a lapsed deadline must then be A->B.
Now our A has dl_defer_running==1, while B demands dl_defer_running==0, therefore it must get cleared when the CBS wakeup rules demand a replenish.
--- kernel/sched/deadline.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
kernel/sched/deadline.c +12 -0
@@ -1043,6 +1043,12 @@ static void update_dl_entity(struct sched_dl_entity *dl_se)return ; } +/* +* When [4] D->A is followed by [1] A->B, dl_defer_running +* needs to be cleared, otherwise it will fail to properly +* start the zero-laxity timer. +*/ + dl_se->dl_defer_running =0 ;replenish_dl_new_period (dl_se, rq); }else if (dl_server (dl_se) && dl_se->dl_defer) {/*
@@ -1641,6 +1647,12 @@ void dl_server_update(struct sched_dl_entity *dl_se, s64 delta_exec)* dl_server_active = 1; * enqueue_dl_entity() * update_dl_entity(WAKEUP) +* if (dl_time_before() || dl_entity_overflow()) +* dl_defer_running = 0; +* replenish_dl_new_period(); +* // fwd period +* dl_throttled = 1; +* dl_defer_armed = 1; * if (!dl_defer_running) * dl_defer_armed = 1; * dl_throttled = 1;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/122 writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laveesh Bansal <[email protected]>
commit 543467d6fe97e27e22a26e367fda972dbefebbff upstream.
When vm.dirtytime_expire_seconds is set to 0, wakeup_dirtytime_writeback() schedules delayed work with a delay of 0, causing immediate execution. The function then reschedules itself with 0 delay again, creating an infinite busy loop that causes 100% kworker CPU usage.
Fix by:
- Only scheduling delayed work in wakeup_dirtytime_writeback() when dirtytime_expire_interval is non-zero
- Cancelling the delayed work in dirtytime_interval_handler() when the interval is set to 0
- Adding a guard in start_dirtytime_writeback() for defensive coding
Tested by booting kernel in QEMU with virtme-ng:
- Before fix: kworker CPU spikes to ~73%
- After fix: CPU remains at normal levels
- Setting interval back to non-zero correctly resumes writeback
--- fs/fs-writeback.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/fs-writeback.c +10 -4
@@ -2471,7 +2471,8 @@ static void wakeup_dirtytime_writeback(swb_wakeup (wb); }rcu_read_unlock (); -schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ ); +if (dirtytime_expire_interval) +schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ ); } static int dirtytime_interval_handler(const struct ctl_table *table, int write,
@@ -2480,8 +2481,12 @@ static int dirtytime_interval_handler(coint ret; ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos); -if (ret ==0 && write) -mod_delayed_work (system_percpu_wq, &dirtytime_work,0 ); +if (ret ==0 && write) { +if (dirtytime_expire_interval) +mod_delayed_work (system_percpu_wq, &dirtytime_work,0 ); +else +cancel_delayed_work_sync (&dirtytime_work); + }return ret; }
@@ -2498,7 +2503,8 @@ static const struct ctl_table vm_fs_writstatic int __init start_dirtytime_writeback (void ) { -schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ ); +if (dirtytime_expire_interval) +schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ );register_sysctl_init ("vm" , vm_fs_writeback_table);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 60/122 pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 4f0d22ec60cee420125f4055af76caa0f373a3fe upstream.
GPIO controller driver should typically implement the .get_direction() callback as GPIOLIB internals may try to use it to determine the state of a pin. Add it for the LPASS LPI driver.
--- drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +17 -0
@@ -312,6 +312,22 @@ static const struct pinconf_ops lpi_gpio .pin_config_group_set = lpi_config_set, }; +static int lpi_gpio_get_direction (struct gpio_chip *chip,unsigned int pin) +{ +unsigned long config =pinconf_to_config_packed (PIN_CONFIG_LEVEL ,0 ); +struct lpi_pinctrl *state =gpiochip_get_data (chip); +unsigned long arg; +int ret; + + ret =lpi_config_get (state->ctrl, pin, &config); +if (ret) +return ret; + + arg =pinconf_to_config_argument (config); + +return arg ?GPIO_LINE_DIRECTION_OUT :GPIO_LINE_DIRECTION_IN ; +} +static int lpi_gpio_direction_input (struct gpio_chip *chip,unsigned int pin) {struct lpi_pinctrl *state =gpiochip_get_data (chip);
@@ -409,6 +425,7 @@ static void lpi_gpio_dbg_show(struct seq#endif static const struct gpio_chip lpi_gpio_template = { + .get_direction = lpi_gpio_get_direction, .direction_input = lpi_gpio_direction_input, .direction_output = lpi_gpio_direction_output, .get = lpi_gpio_get,
Greg Kroah-Hartman
maintainerPATCH 61/122 pinctrl: meson: mark the GPIO controller as sleeping
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 28f24068387169722b508bba6b5257cb68b86e74 upstream.
The GPIO controller is configured as non-sleeping but it uses generic pinctrl helpers which use a mutex for synchronization.
This can cause the following lockdep splat with shared GPIOs enabled on boards which have multiple devices using the same GPIO:
BUG: sleeping function called from invalid context at
kernel/locking/mutex.c:591in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 142, name:
kworker/u25:3preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
irq event stamp: 46379 hardirqs last enabled at (46379): [<ffff8000813acb24>] _raw_spin_unlock_irqrestore+0x74/0x78 hardirqs last disabled at (46378): [<ffff8000813abf38>] _raw_spin_lock_irqsave+0x84/0x88 softirqs last enabled at (46330): [<ffff8000800c71b4>] handle_softirqs+0x4c4/0x4dc softirqs last disabled at (46295): [<ffff800080010674>] __do_softirq+0x14/0x20 CPU: 1 UID: 0 PID: 142 Comm: kworker/u25:3 Tainted: G C 6.19.0-rc4-next-20260105+ #11963 PREEMPT Tainted: [C]=CRAP Hardware name: Khadas VIM3 (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x90/0xd0 dump_stack+0x18/0x24 __might_resched+0x144/0x248 __might_sleep+0x48/0x98 __mutex_lock+0x5c/0x894 mutex_lock_nested+0x24/0x30 pinctrl_get_device_gpio_range+0x44/0x128 pinctrl_gpio_set_config+0x40/0xdc gpiochip_generic_config+0x28/0x3c gpio_do_set_config+0xa8/0x194 gpiod_set_config+0x34/0xfc gpio_shared_proxy_set_config+0x6c/0xfc [gpio_shared_proxy] gpio_do_set_config+0xa8/0x194 gpiod_set_transitory+0x4c/0xf0 gpiod_configure_flags+0xa4/0x480 gpiod_find_and_request+0x1a0/0x574 gpiod_get_index+0x58/0x84 devm_gpiod_get_index+0x20/0xb4 devm_gpiod_get+0x18/0x24 mmc_pwrseq_emmc_probe+0x40/0xb8 platform_probe+0x5c/0xac really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0xdc/0x164 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x80/0xdc __device_attach+0xa8/0x1b0
--- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson.c +1 -1
@@ -619,7 +619,7 @@ static int meson_gpiolib_register(struct pc->chip.set = meson_gpio_set; pc->chip.base =-1 ; pc->chip.ngpio = pc->data->num_pins; - pc->chip.can_sleep = false; + pc->chip.can_sleep = true; ret =gpiochip_add_data (&pc->chip, pc);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 62/122 pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 1fbe3abb449c5ef2178e1c3e3e8b9a43a7a410ac upstream.
Qualcomm SC7280 and SM8350 SoCs have slightly different LPASS audio blocks (v9.4.5 and v9.2), however the LPASS LPI pin controllers are exactly the same. The driver for SM8350 has two issues, which can be fixed by simply moving over to SC7280 driver which has them correct:
1. "i2s2_data_groups" listed twice GPIO12, but should have both GPIO12 and GPIO13,
2. "swr_tx_data_groups" contained GPIO5 for "swr_tx_data2" function, but that function is also available on GPIO14, thus listing it twice is not necessary. OTOH, GPIO5 has also "swr_rx_data1", so selecting swr_rx_data function should not block the TX one.
--- arch/arm64/configs/defconfig | 1 drivers/pinctrl/qcom/Kconfig | 15 -- drivers/pinctrl/qcom/Makefile | 1 drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c | 3 drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c | 151 ------------------------ 5 files changed, 6 insertions(+), 165 deletions(-) delete mode 100644 drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c
arch/arm64/configs/defconfig +0 -1
@@ -662,7 +662,6 @@ CONFIG_PINCTRL_LPASS_LPI=m CONFIG_PINCTRL_SC7280_LPASS_LPI=m CONFIG_PINCTRL_SM6115_LPASS_LPI=m CONFIG_PINCTRL_SM8250_LPASS_LPI=m -CONFIG_PINCTRL_SM8350_LPASS_LPI=m CONFIG_PINCTRL_SM8450_LPASS_LPI=m CONFIG_PINCTRL_SC8280XP_LPASS_LPI=m CONFIG_PINCTRL_SM8550_LPASS_LPI=m
drivers/pinctrl/qcom/Kconfig +3 -12
@@ -61,13 +61,14 @@ config PINCTRL_LPASS_LPI (Low Power Island) found on the Qualcomm Technologies Inc SoCs. config PINCTRL_SC7280_LPASS_LPI - tristate "Qualcomm Technologies Inc SC7280 LPASS LPI pin controller driver" + tristate "Qualcomm Technologies Inc SC7280 and SM8350 LPASS LPI pin controller driver" depends on ARM64 || COMPILE_TEST depends on PINCTRL_LPASS_LPI help This is the pinctrl, pinmux, pinconf and gpiolib driver for the Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI - (Low Power Island) found on the Qualcomm Technologies Inc SC7280 platform. + (Low Power Island) found on the Qualcomm Technologies Inc SC7280 + and SM8350 platforms. config PINCTRL_SDM660_LPASS_LPI tristate "Qualcomm Technologies Inc SDM660 LPASS LPI pin controller driver"
@@ -106,16 +107,6 @@ config PINCTRL_SM8250_LPASS_LPI Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI (Low Power Island) found on the Qualcomm Technologies Inc SM8250 platform. -config PINCTRL_SM8350_LPASS_LPI - tristate "Qualcomm Technologies Inc SM8350 LPASS LPI pin controller driver" - depends on ARM64 || COMPILE_TEST - depends on PINCTRL_LPASS_LPI - help - This is the pinctrl, pinmux, pinconf and gpiolib driver for the - Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI - (Low Power Island) found on the Qualcomm Technologies Inc SM8350 - platform. - config PINCTRL_SM8450_LPASS_LPI tristate "Qualcomm Technologies Inc SM8450 LPASS LPI pin controller driver" depends on ARM64 || COMPILE_TEST
drivers/pinctrl/qcom/Makefile +0 -1
@@ -63,7 +63,6 @@ obj-$(CONFIG_PINCTRL_SM8150) += pinctrl- obj-$(CONFIG_PINCTRL_SM8250) += pinctrl-sm8250.o obj-$(CONFIG_PINCTRL_SM8250_LPASS_LPI) += pinctrl-sm8250-lpass-lpi.o obj-$(CONFIG_PINCTRL_SM8350) += pinctrl-sm8350.o -obj-$(CONFIG_PINCTRL_SM8350_LPASS_LPI) += pinctrl-sm8350-lpass-lpi.o obj-$(CONFIG_PINCTRL_SM8450) += pinctrl-sm8450.o obj-$(CONFIG_PINCTRL_SM8450_LPASS_LPI) += pinctrl-sm8450-lpass-lpi.o obj-$(CONFIG_PINCTRL_SM8550) += pinctrl-sm8550.o
drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c +3 -0
@@ -131,6 +131,9 @@ static const struct of_device_id lpi_pin { .compatible = "qcom,sc7280-lpass-lpi-pinctrl", .data = &sc7280_lpi_data, + }, { + .compatible = "qcom,sm8350-lpass-lpi-pinctrl", + .data = &sc7280_lpi_data, }, { } };
drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c deleted +0 -151
151 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 63/122 perf: sched: Fix perf crash with new is_user_task() helper
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 76ed27608f7dd235b727ebbb12163438c2fbb617 upstream.
In order to do a user space stacktrace the current task needs to be a user task that has executed in user space. It use to be possible to test if a task is a user task or not by simply checking the task_struct mm field. If it was non NULL, it was a user task and if not it was a kernel task.
But things have changed over time, and some kernel tasks now have their own mm field.
An idea was made to instead test PF_KTHREAD and two functions were used to wrap this check in case it became more complex to test if a task was a user task or not[1]. But this was rejected and the C code simply checked the PF_KTHREAD directly.
It was later found that not all kernel threads set PF_KTHREAD. The io-uring helpers instead set PF_USER_WORKER and this needed to be added as well.
But checking the flags is still not enough. There's a very small window when a task exits that it frees its mm field and it is set back to NULL. If perf were to trigger at this moment, the flags test would say its a user space task but when perf would read the mm field it would crash with at NULL pointer dereference.
Now there are flags that can be used to test if a task is exiting, but they are set in areas that perf may still want to profile the user space task (to see where it exited). The only real test is to check both the flags and the mm field.
Instead of making this modification in every location, create a new is_user_task() helper function that does all the tests needed to know if it is safe to read the user space memory or not.
[1] https://lore.kernel.org/all/[email protected]/
--- include/linux/sched.h | 5 +++++ kernel/events/callchain.c | 2 +- kernel/events/core.c | 6 +++--- 3 files changed, 9 insertions(+), 4 deletions(-)
include/linux/sched.h +5 -0
@@ -1798,6 +1798,11 @@ static __always_inline bool is_percpu_th (current->nr_cpus_allowed ==1 ); } +static __always_inline bool is_user_task(struct task_struct *task) +{ +return task->mm && !(task->flags & (PF_KTHREAD |PF_USER_WORKER )); +} +/* Per-process atomic flags. */ #define PFA_NO_NEW_PRIVS 0/* May not gain new privileges. */ #define PFA_SPREAD_PAGE 1/* Spread page cache over cpuset */
kernel/events/callchain.c +1 -1
@@ -246,7 +246,7 @@ get_perf_callchain(struct pt_regs *regs,if (user && !crosstask) {if (!user_mode (regs)) { -if (current->flags & (PF_KTHREAD |PF_USER_WORKER )) +if (!is_user_task (current)) goto exit_put; regs =task_pt_regs (current); }
kernel/events/core.c +3 -3
@@ -7459,7 +7459,7 @@ static void perf_sample_regs_user(structif (user_mode (regs)) { regs_user->abi =perf_reg_abi (current); regs_user->regs = regs; - }else if (!(current->flags & (PF_KTHREAD |PF_USER_WORKER ))) { + }else if (is_user_task (current)) {perf_get_regs_user (regs_user, regs); }else { regs_user->abi =PERF_SAMPLE_REGS_ABI_NONE ;
@@ -8099,7 +8099,7 @@ static u64 perf_virt_to_phys(u64 virt)* Try IRQ-safe get_user_page_fast_only first. * If failed, leave phys_addr as 0. */ -if (!(current->flags & (PF_KTHREAD |PF_USER_WORKER ))) { +if (is_user_task (current)) {struct page *p;pagefault_disable ();
@@ -8212,7 +8212,7 @@ perf_callchain(struct perf_event *event, {bool kernel = !event->attr.exclude_callchain_kernel;bool user = !event->attr.exclude_callchain_user && - !(current->flags & (PF_KTHREAD |PF_USER_WORKER )); +is_user_task (current);/* Disallow cross-task user callchains. */ bool crosstask = event->ctx->task && event->ctx->task != current;const u32 max_stack = event->attr.sample_max_stack;
Greg Kroah-Hartman
maintainerPATCH 64/122 firewire: core: fix race condition against transaction list
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit 20e01bba2ae4898ce65cdcacd1bd6bec5111abd9 upstream.
The list of transaction is enumerated without acquiring card lock when processing AR response event. This causes a race condition bug when processing AT request completion event concurrently.
This commit fixes the bug by put timer start for split transaction expiration into the scope of lock. The value of jiffies in card structure is referred before acquiring the lock.
--- drivers/firewire/core-transaction.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/firewire/core-transaction.c +10 -9
@@ -134,20 +134,14 @@ static void split_transaction_timeout_ca } } -static void start_split_transaction_timeout (struct fw_transaction *t, -struct fw_card *card) +// card->transactions.lock should be acquired in advance for the linked list. +static void start_split_transaction_timeout (struct fw_transaction *t,unsigned int delta) { -unsigned long delta; -if (list_empty (&t->link) ||WARN_ON (t->is_split_transaction))return ; t->is_split_transaction = true; -// NOTE: This can be without irqsave when we can guarantee that __fw_send_request() for -// local destination never runs in any type of IRQ context. -scoped_guard (spinlock_irqsave, &card->split_timeout.lock) - delta = card->split_timeout.jiffies;mod_timer (&t->split_timeout_timer, jiffies + delta); }
@@ -168,13 +162,20 @@ static void transmit_complete_callback(sbreak ;case ACK_PENDING : { +unsigned int delta; +// NOTE: This can be without irqsave when we can guarantee that __fw_send_request() for // local destination never runs in any type of IRQ context. scoped_guard(spinlock_irqsave, &card->split_timeout.lock) { t->split_timeout_cycle =compute_split_timeout_timestamp (card, packet->timestamp) &0xffff ; + delta = card->split_timeout.jiffies; } -start_split_transaction_timeout (t, card); + +// NOTE: This can be without irqsave when we can guarantee that __fw_send_request() for +// local destination never runs in any type of IRQ context. + scoped_guard(spinlock_irqsave, &card->transactions.lock) +start_split_transaction_timeout (t, delta);break ; }case ACK_BUSY_X :
Greg Kroah-Hartman
maintainerPATCH 65/122 riscv: compat: fix COMPAT_UTS_MACHINE definition
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Gao <[email protected]>
commit 0ea05c4f7527a98f5946f96c829733788934311d upstream.
The COMPAT_UTS_MACHINE for riscv was incorrectly defined as "riscv". Change it to "riscv32" to reflect the correct 32-bit compat name.
--- arch/riscv/include/asm/compat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/compat.h +1 -1
@@ -2,7 +2,7 @@#ifndef __ASM_COMPAT_H#define __ASM_COMPAT_H -#define COMPAT_UTS_MACHINE "riscv\0\0" +#define COMPAT_UTS_MACHINE "riscv32\0\0"/* * Architecture specific compatibility types
Greg Kroah-Hartman
maintainerPATCH 66/122 rust: rbtree: fix documentation typo in CursorMut peek_next method
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hang Shu <[email protected]>
commit 45f6aed8a835ee2bdd0a5d5ee626a91fe285014f upstream.
The peek_next method's doc comment incorrectly stated it accesses the "previous" node when it actually accesses the next node.
Fix the documentation to accurately reflect the method's behavior.
--- rust/kernel/rbtree.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/kernel/rbtree.rs +1 -1
@@ -835,7 +835,7 @@ impl<'a, K, V> Cursor<'a, K, V> { self.peek (Direction ::Prev ) } -/// Access the previous node without moving the cursor. +/// Access the next node without moving the cursor. pub fn peek_next (&self) ->Option <(&K , &V )> { self.peek (Direction ::Next ) }
Greg Kroah-Hartman
maintainerPATCH 67/122 rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit af20ae33e7dd949f2e770198e74ac8f058cb299d upstream.
rustfmt is configured via the .rustfmt.toml file in the source tree, and we apply rustfmt to the macro expanded sources generated by the .rsi target.
However, under an O= pointing to an external folder (i.e. not just a subdir), rustfmt will not find the file when checking the parent folders. Since the edition is configured in this file, this can lead to errors when it encounters newer syntax, e.g.
error: expected one of `!`, `.`, `::`, `;`, `?`, `where`, `{`, or an operator, found `"rust_minimal"`
--> samples/rust/rust_minimal.rsi:29:49
|
28 | impl ::kernel::ModuleMetadata for RustMinimal {
| - while parsing this item list starting here
29 | const NAME: &'static ::kernel::str::CStr = c"rust_minimal";
| ^^^^^^^^^^^^^^ expected one of 8 possible tokens
30 | }
| - the item list ends here
|
= note: you may be trying to write a c-string literal
= note: c-string literals require Rust 2021 or later
= help: pass `--edition 2024` to `rustc`
= note: for more on editions, read https://doc.rust-lang.org/edition-guideA workaround is to use RUSTFMT=n, which is documented in the Makefile help for cases where macro expanded source may happen to break rustfmt for other reasons, but this is not one of those cases.
One solution would be to pass --edition, but we want rustfmt to use the entire configuration, even if currently we essentially use the default configuration.
Thus explicitly give the path to the config file to rustfmt instead.
--- scripts/Makefile.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.build +1 -1
@@ -356,7 +356,7 @@ $(obj)/%.o: $(obj)/%.rs FORCE quiet_cmd_rustc_rsi_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@ cmd_rustc_rsi_rs = \ $(rust_common_cmd) -Zunpretty=expanded $< >$@; \ - command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) $@ + command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) --config-path $(srctree)/.rustfmt.toml $@ $(obj)/%.rsi: $(obj)/%.rs FORCE +$(call if_changed_dep,rustc_rsi_rs)
Greg Kroah-Hartman
maintainerPATCH 68/122 ASoC: fsl: imx-card: Do not force slot width to sample width
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream.
imx-card currently sets the slot width to the physical sample width for I2S links. This breaks controllers that use fixed-width slots (e.g. 32-bit FIFO words), causing the unused bits in the slot to contain undefined data when playing 16-bit streams.
Do not override the slot width in the machine driver and let the CPU DAI select an appropriate default instead. This matches the behavior of simple-audio-card and avoids embedding controller-specific policy in the machine driver.
On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots, playing 16-bit audio resulted in spurious frequencies and an incorrect SAI data waveform, as the slot width was forced to 16 bits. After this change, audio artifacts are eliminated and the 16-bit samples correctly occupy the first half of the 32-bit slot, with the remaining bits padded with zeroes.
--- sound/soc/fsl/imx-card.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/fsl/imx-card.c +0 -1
@@ -346,7 +346,6 @@ static int imx_aif_hw_params(struct snd_SND_SOC_DAIFMT_PDM ; }else { slots =2 ; - slot_width =params_physical_width (params); fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK ) |SND_SOC_DAIFMT_I2S ; }
Greg Kroah-Hartman
maintainerPATCH 69/122 scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream.
If nonemb_cmd->va fails to be allocated, free the allocation previously made by alloc_mcc_wrb().
--- drivers/scsi/be2iscsi/be_mgmt.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/be2iscsi/be_mgmt.c +1 -0
@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru &nonemb_cmd->dma, GFP_KERNEL);if (!nonemb_cmd->va) { +free_mcc_wrb (ctrl, tag);mutex_unlock (&ctrl->mbox_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 70/122 ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
commit 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d upstream.
Add a DMI quirk for the Acer TravelMate P216-41-TCO fixing the issue where the internal microphone was not detected.
--- sound/soc/amd/yc/acp6x-mach.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +8 -0
@@ -668,6 +668,14 @@ static const struct dmi_system_id yc_acp DMI_MATCH(DMI_PRODUCT_NAME, "GOH-X"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "RB"), + DMI_MATCH(DMI_BOARD_NAME, "XyloD5_RBU"), + } + }, + {} };
Greg Kroah-Hartman
maintainerPATCH 71/122 gpio: pca953x: mask interrupts in irq shutdown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Larsson <[email protected]>
commit d02f20a4de0c498fbba2b0e3c1496e72c630a91e upstream.
In the existing implementation irq_shutdown does not mask the interrupts in hardware. This can cause spurious interrupts from the IO expander. Add masking to irq_shutdown to prevent spurious interrupts.
--- drivers/gpio/gpio-pca953x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpio/gpio-pca953x.c +2 -0
@@ -911,6 +911,8 @@ static void pca953x_irq_shutdown(structclear_bit (hwirq, chip->irq_trig_fall);clear_bit (hwirq, chip->irq_trig_level_low);clear_bit (hwirq, chip->irq_trig_level_high); + +pca953x_irq_mask (d); }static void pca953x_irq_print_chip (struct irq_data *data,struct seq_file *p)
Greg Kroah-Hartman
maintainerPATCH 72/122 kbuild: rust: clean libpin_init_internal in mrproper
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Miao <[email protected]>
commit a44bfed9df8a514962e2cb076d9c0b594caeff36 upstream.
When I enabled Rust compilation, I wanted to clean up its output, so I used make mrproper. However, I was still able to find that libpin_init_internal.so in the rust directory was not deleted, while all other corresponding outputs were cleared.
Thus add it to the MRPROPER_FILES list.
--- Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Makefile +2 -1
@@ -1590,7 +1590,8 @@ MRPROPER_FILES += include/config include certs/x509.genkey \ vmlinux-gdb.py \ rpmbuild \ - rust/libmacros.so rust/libmacros.dylib + rust/libmacros.so rust/libmacros.dylib \ + rust/libpin_init_internal.so rust/libpin_init_internal.dylib # clean - Delete most, but leave enough to build external modules #
Greg Kroah-Hartman
maintainerPATCH 73/122 scsi: qla2xxx: edif: Fix dma_free_coherent() size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream.
Earlier in the function, the ha->flt buffer is allocated with size sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error path with size SFP_DEV_SIZE.
--- drivers/scsi/qla2xxx/qla_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_os.c +1 -1
@@ -4488,7 +4488,7 @@ fail_lsrjt: fail_elsrej:dma_pool_destroy (ha->purex_dma_pool); fail_flt: -dma_free_coherent (&ha->pdev->dev,SFP_DEV_SIZE , +dma_free_coherent (&ha->pdev->dev,sizeof (struct qla_flt_header ) +FLT_REGIONS_SIZE , ha->flt, ha->flt_dma); fail_flt_buffer:
Greg Kroah-Hartman
maintainerPATCH 74/122 efivarfs: fix error propagation in efivar_entry_get()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 upstream.
efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors.
This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path.
Fix it by returning the error from __efivar_entry_get().
--- fs/efivarfs/vars.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/efivarfs/vars.c +1 -1
@@ -552,7 +552,7 @@ int efivar_entry_get(struct efivar_entry err =__efivar_entry_get (entry, attributes, size, data);efivar_unlock (); -return 0 ; +return err; }/**
Greg Kroah-Hartman
maintainerPATCH 75/122 nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit 0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e upstream.
There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start():
1. nvmet_bio_done() is called when a bio completes
2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req)
3. The queue_response callback can re-queue and re-submit the same request
4. The re-submission reuses the same inline_bio from nvmet_req
5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL
6. The re-submitted bio enters submit_bio_noacct_nocheck()
7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:
BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0
Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.
--- drivers/nvme/target/io-cmd-bdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/target/io-cmd-bdev.c +2 -1
@@ -180,9 +180,10 @@ u16 blk_to_nvme_status(struct nvmet_reqstatic void nvmet_bio_done (struct bio *bio) {struct nvmet_req *req = bio->bi_private; +blk_status_t blk_status = bio->bi_status; -nvmet_req_complete (req,blk_to_nvme_status (req, bio->bi_status));nvmet_req_bio_put (req, bio); +nvmet_req_complete (req,blk_to_nvme_status (req, blk_status)); }#ifdef CONFIG_BLK_DEV_INTEGRITY
Greg Kroah-Hartman
maintainerPATCH 76/122 ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
commit 891b77d459d0ce993c68365d899134bc9fd47ac0 upstream.
The HP EliteBook 630 G11 (103c:8c8f) is using ALC236 codec which used 0x02 to control mute LED and 0x01 to control micmute LED. Therefore, add a quirk to make it works.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6631,6 +6631,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x103c ,0x8c8c ,"HP EliteBook 660" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c8d ,"HP ProBook 440 G11" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c8e ,"HP ProBook 460 G11" ,ALC236_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c8f ,"HP EliteBook 630 G11" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c90 ,"HP EliteBook 640" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c91 ,"HP EliteBook 660" ,ALC236_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8c96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
Greg Kroah-Hartman
maintainerPATCH 77/122 gpio: rockchip: Stop calling pinctrl for set_direction
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit 7ca497be00163610afb663867db24ac408752f13 upstream.
Marking the whole controller as sleeping due to the pinctrl calls in the .direction_{input,output} callbacks has the unfortunate side effect that legitimate invocations of .get and .set, which cannot themselves sleep, in atomic context now spew WARN()s from gpiolib.
However, as Heiko points out, the driver doing this is a bit silly to begin with, as the pinctrl .gpio_set_direction hook doesn't even care about the direction, the hook is only used to claim the mux. And sure enough, the .gpio_request_enable hook exists to serve this very purpose, so switch to that and remove the problematic business entirely.
--- drivers/gpio/gpio-rockchip.c | 8 -------- drivers/pinctrl/pinctrl-rockchip.c | 9 ++++----- 2 files changed, 4 insertions(+), 13 deletions(-)
drivers/gpio/gpio-rockchip.c +0 -8
@@ -18,7 +18,6 @@#include <linux/of.h> #include <linux/of_address.h> #include <linux/of_irq.h> -#include <linux/pinctrl/consumer.h> #include <linux/pinctrl/pinconf-generic.h> #include <linux/platform_device.h> #include <linux/regmap.h>
@@ -164,12 +163,6 @@ static int rockchip_gpio_set_direction(sunsigned long flags;u32 data = input ?0 :1 ; - -if (input) -pinctrl_gpio_direction_input (chip, offset); -else -pinctrl_gpio_direction_output (chip, offset); -raw_spin_lock_irqsave (&bank->slock, flags);rockchip_gpio_writel_bit (bank, offset, data, bank->gpio_regs->port_ddr);raw_spin_unlock_irqrestore (&bank->slock, flags);
@@ -593,7 +586,6 @@ static int rockchip_gpiolib_register(str gc->ngpio = bank->nr_pins; gc->label = bank->name; gc->parent = bank->dev; - gc->can_sleep = true; ret =gpiochip_add_data (gc, bank);if (ret) {
drivers/pinctrl/pinctrl-rockchip.c +4 -5
@@ -3184,10 +3184,9 @@ static int rockchip_pmx_set(struct pinctreturn 0 ; } -static int rockchip_pmx_gpio_set_direction (struct pinctrl_dev *pctldev, -struct pinctrl_gpio_range *range, -unsigned offset, -bool input) +static int rockchip_pmx_gpio_request_enable (struct pinctrl_dev *pctldev, +struct pinctrl_gpio_range *range, +unsigned int offset) {struct rockchip_pinctrl *info =pinctrl_dev_get_drvdata (pctldev);struct rockchip_pin_bank *bank;
@@ -3201,7 +3200,7 @@ static const struct pinmux_ops rockchip_ .get_function_name = rockchip_pmx_get_func_name, .get_function_groups = rockchip_pmx_get_groups, .set_mux = rockchip_pmx_set, - .gpio_set_direction = rockchip_pmx_gpio_set_direction, + .gpio_request_enable = rockchip_pmx_gpio_request_enable, };/*
Greg Kroah-Hartman
maintainerPATCH 78/122 mm/kasan: fix KASAN poisoning in vrealloc()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <[email protected]>
commit 9b47d4eea3f7c1f620e95bda1d6221660bde7d7b upstream.
A KASAN warning can be triggered when vrealloc() changes the requested size to a value that is not aligned to KASAN_GRANULE_SIZE.
------------[ cut here ]------------
WARNING: CPU: 2 PID: 1 at mm/kasan/shadow.c:174 kasan_unpoison+0x40/0x48
...
pc : kasan_unpoison+0x40/0x48
lr : __kasan_unpoison_vmalloc+0x40/0x68
Call trace:
kasan_unpoison+0x40/0x48 (P)
vrealloc_node_align_noprof+0x200/0x320
bpf_patch_insn_data+0x90/0x2f0
convert_ctx_accesses+0x8c0/0x1158
bpf_check+0x1488/0x1900
bpf_prog_load+0xd20/0x1258
__sys_bpf+0x96c/0xdf0
__arm64_sys_bpf+0x50/0xa0
invoke_syscall+0x90/0x160Introduce a dedicated kasan_vrealloc() helper that centralizes KASAN handling for vmalloc reallocations. The helper accounts for KASAN granule alignment when growing or shrinking an allocation and ensures that partial granules are handled correctly.
Use this helper from vrealloc_node_align_noprof() to fix poisoning logic.
--- include/linux/kasan.h | 14 ++++++++++++++ mm/kasan/common.c | 21 +++++++++++++++++++++ mm/vmalloc.c | 7 ++----- 3 files changed, 37 insertions(+), 5 deletions(-)
include/linux/kasan.h +14 -0
@@ -625,6 +625,17 @@ kasan_unpoison_vmap_areas(struct vm_stru__kasan_unpoison_vmap_areas (vms, nr_vms, flags); } +void __kasan_vrealloc (const void *start,unsigned long old_size, +unsigned long new_size); + +static __always_inline void kasan_vrealloc(const void *start, +unsigned long old_size, +unsigned long new_size) +{ +if (kasan_enabled ()) +__kasan_vrealloc (start, old_size, new_size); +} +#else /* CONFIG_KASAN_VMALLOC */ static inline void kasan_populate_early_vm_area_shadow(void *start,
@@ -654,6 +665,9 @@ kasan_unpoison_vmap_areas(struct vm_stru kasan_vmalloc_flags_t flags) { } +static inline void kasan_vrealloc (const void *start,unsigned long old_size, +unsigned long new_size) { } +#endif /* CONFIG_KASAN_VMALLOC */ #if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \
mm/kasan/common.c +21 -0
@@ -613,4 +613,25 @@ void __kasan_unpoison_vmap_areas(struct __kasan_unpoison_vmalloc(addr, size, flags | KASAN_VMALLOC_KEEP_TAG); } } + +void __kasan_vrealloc (const void *addr,unsigned long old_size, +unsigned long new_size) +{ +if (new_size < old_size) { +kasan_poison_last_granule (addr, new_size); + + new_size =round_up (new_size,KASAN_GRANULE_SIZE ); + old_size =round_up (old_size,KASAN_GRANULE_SIZE ); +if (new_size < old_size) +__kasan_poison_vmalloc (addr + new_size, + old_size - new_size); + }else if (new_size > old_size) { + old_size =round_down (old_size,KASAN_GRANULE_SIZE ); +__kasan_unpoison_vmalloc (addr + old_size, + new_size - old_size, +KASAN_VMALLOC_PROT_NORMAL | +KASAN_VMALLOC_VM_ALLOC | +KASAN_VMALLOC_KEEP_TAG ); + } +}#endif
mm/vmalloc.c +2 -5
@@ -4167,7 +4167,7 @@ void *vrealloc_node_align_noprof(const vif (want_init_on_free () ||want_init_on_alloc (flags))memset ((void *)p + size,0 , old_size - size); vm->requested_size = size; -kasan_poison_vmalloc (p + size, old_size - size); +kasan_vrealloc (p, old_size, size);return (void *)p; }
@@ -4175,16 +4175,13 @@ void *vrealloc_node_align_noprof(const v* We already have the bytes available in the allocation; use them. */ if (size <= alloced_size) { -kasan_unpoison_vmalloc (p + old_size, size - old_size, -KASAN_VMALLOC_PROT_NORMAL | -KASAN_VMALLOC_VM_ALLOC | -KASAN_VMALLOC_KEEP_TAG );/* * No need to zero memory here, as unused memory will have * already been zeroed at initial allocation time or during * realloc shrink time. */ vm->requested_size = size; +kasan_vrealloc (p, old_size, size);return (void *)p; }
Greg Kroah-Hartman
maintainerPATCH 79/122 mptcp: only reset subflow errors when propagated
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream.
Some subflow socket errors need to be reported to the MPTCP socket: the initial subflow connect (MP_CAPABLE), and the ones from the fallback sockets. The others are not propagated.
The issue is that sock_error() was used to retrieve the error, which was also resetting the sk_err field. Because of that, when notifying the userspace about subflow close events later on from the MPTCP worker, the ssk->sk_err field was always 0.
Now, the error (sk_err) is only reset when propagating it to the msk.
--- net/mptcp/protocol.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/mptcp/protocol.c +5 -4
@@ -784,11 +784,8 @@ static bool __mptcp_ofo_queue(struct mptstatic bool __mptcp_subflow_error_report (struct sock *sk,struct sock *ssk) { -int err =sock_error (ssk);int ssk_state; - -if (!err) -return false; +int err;/* only propagate errors on fallen-back sockets or * on MPC connect
@@ -796,6 +793,10 @@ static bool __mptcp_subflow_error_reportif (sk->sk_state !=TCP_SYN_SENT && !__mptcp_check_fallback (mptcp_sk (sk)))return false; + err =sock_error (ssk); +if (!err) +return false; +/* We need to propagate only transition to CLOSE state. * Orphaned socket will see such state change via * subflow_sched_work_if_closed() and that path will properly
Greg Kroah-Hartman
maintainerPATCH 80/122 selftests: mptcp: check no dup close events after error
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 8467458dfa61b37e259e3485a5d3e415d08193c1 upstream.
This validates the previous commit: subflow closed events are re-sent with less info when the initial subflow is disconnected after an error and each time a subflow is closed after that.
In this new test, the userspace PM is involved because that's how it was discovered, but it is not specific to it. The initial subflow is terminated with a RESET, and that will cause the subflow disconnect. Then, a new subflow is initiated, but also got rejected, which cause a second subflow closed event, but not a third one.
While at it, in case of failure to get the expected amount of events, the events are printed.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 51 ++++++++++++++++++++++++ 1 file changed, 51 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +51 -0
@@ -3717,11 +3717,32 @@ chk_evt_nr() count=$(grep -cw "type:${evt}" "${evts}") if [ "${count}" != "${exp}" ]; then fail_test "got ${count} events, expected ${exp}" + cat "${evts}" else print_ok fi } +# $1: ns ; $2: event type ; $3: expected count +wait_event() +{ + local ns="${1}" + local evt_name="${2}" + local exp="${3}" + + local evt="${!evt_name}" + local evts="${evts_ns1}" + local count + + [ "${ns}" == "ns2" ] && evts="${evts_ns2}" + + for _ in $(seq 100); do + count=$(grep -cw "type:${evt}" "${evts}") + [ "${count}" -ge "${exp}" ] && break + sleep 0.1 + done +} + userspace_tests() { # userspace pm type prevents add_addr
@@ -3930,6 +3951,36 @@ userspace_tests() kill_events_pids mptcp_lib_kill_group_wait $tests_pid fi + + # userspace pm no duplicated spurious close events after an error + if reset_with_events "userspace pm no dup close events after error" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns2 + pm_nl_set_limits $ns1 0 2 + { timeout_test=120 test_linkfail=128 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + wait_event ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 + userspace_pm_add_sf $ns2 10.0.3.2 20 + chk_mptcp_info subflows 1 subflows 1 + chk_subflows_total 2 2 + + # force quick loss + ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1 + if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \ + -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset && + ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \ + -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then + wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1 + wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1 + chk_subflows_total 1 1 + userspace_pm_add_sf $ns2 10.0.1.2 0 + wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + fi + kill_events_pids + mptcp_lib_kill_group_wait $tests_pid + fi } endpoint_tests()
Greg Kroah-Hartman
maintainerPATCH 81/122 selftests: mptcp: check subflow errors in close events
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 2ef9e3a3845d0a20b62b01f5b731debd0364688d upstream.
This validates the previous commit: subflow closed events should contain an error field when a subflow got closed with an error, e.g. reset or timeout.
For this test, the chk_evt_nr helper has been extended to check attributes in the matched events.
In this test, the 2 subflow closed events should have an error.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +20 -3
@@ -3692,21 +3692,28 @@ userspace_pm_chk_get_addr() fi } -# $1: ns ; $2: event type ; $3: count +# $1: ns ; $2: event type ; $3: count ; [ $4: attr ; $5: attr count ] chk_evt_nr() { local ns=${1} local evt_name="${2}" local exp="${3}" + local attr="${4}" + local attr_exp="${5}" local evts="${evts_ns1}" local evt="${!evt_name}" + local attr_name local count + if [ -n "${attr}" ]; then + attr_name=", ${attr}: ${attr_exp}" + fi + evt_name="${evt_name:16}" # without MPTCP_LIB_EVENT_ [ "${ns}" == "ns2" ] && evts="${evts_ns2}" - print_check "event ${ns} ${evt_name} (${exp})" + print_check "event ${ns} ${evt_name} (${exp}${attr_name})" if [[ "${evt_name}" = "LISTENER_"* ]] && ! mptcp_lib_kallsyms_has "mptcp_event_pm_listener$"; then
@@ -3718,6 +3725,16 @@ chk_evt_nr() if [ "${count}" != "${exp}" ]; then fail_test "got ${count} events, expected ${exp}" cat "${evts}" + return + elif [ -z "${attr}" ]; then + print_ok + return + fi + + count=$(grep -w "type:${evt}" "${evts}" | grep -c ",${attr}:") + if [ "${count}" != "${attr_exp}" ]; then + fail_test "got ${count} event attributes, expected ${attr_exp}" + grep -w "type:${evt}" "${evts}" else print_ok fi
@@ -3976,7 +3993,7 @@ userspace_tests() chk_subflows_total 1 1 userspace_pm_add_sf $ns2 10.0.1.2 0 wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 - chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 error 2 fi kill_events_pids mptcp_lib_kill_group_wait $tests_pid
Greg Kroah-Hartman
maintainerPATCH 82/122 selftests: mptcp: join: fix local endp not being tracked
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc upstream.
When running this mptcp_join.sh selftest on older kernel versions not supporting local endpoints tracking, this test fails because 3 MP_JOIN ACKs have been received, while only 2 were expected.
It is not clear why only 2 MP_JOIN ACKs were expected on old kernel versions, while 3 MP_JOIN SYN and SYN+ACK were expected. When testing on the v5.15.197 kernel, 3 MP_JOIN ACKs are seen, which is also what is expected in the selftests included in this kernel version, see commit f4480eaad489 ("selftests: mptcp: add missing join check").
Switch the expected MP_JOIN ACKs to 3. While at it, move this chk_join_nr helper out of the special condition for older kernel versions as it is now the same as with more recent ones. Also, invert the condition to be more logical: what's expected on newer kernel versions having such helper first.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +4 -5
@@ -2305,17 +2305,16 @@ signal_address_tests() ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1 speed=slow \ run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 3 3 3 # It is not directly linked to the commit introducing this # symbol but for the parent one which is linked anyway. - if ! mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then - chk_join_nr 3 3 2 - chk_add_nr 4 4 - else - chk_join_nr 3 3 3 + if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then # the server will not signal the address terminating # the MPC subflow chk_add_nr 3 3 + else + chk_add_nr 4 4 fi fi }
Greg Kroah-Hartman
maintainerPATCH 83/122 flex_proportions: make fprop_new_period() hardirq safe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc upstream.
Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race:
<timer fires>run_timer_softirq - we are in softirq context
call_timer_fn
writeout_period
fprop_new_period
write_seqcount_begin(&p->sequence);
<hardirq is raised>
...
blk_mq_end_request()
blk_update_request()
ext4_end_bio()
folio_end_writeback()
__wb_writeout_add()
__fprop_add_percpu_max()
if (unlikely(max_frac < FPROP_FRAC_BASE)) {
fprop_fraction_percpu()
seq = read_seqcount_begin(&p->sequence);
- sees odd sequence so loops indefinitelyNote that a deadlock like this is only possible if the bdi has configured maximum fraction of writeout throughput which is very rare in general but frequent for example for FUSE bdis. To fix this problem we have to make sure write section of the sequence counter is irqsafe.
--- lib/flex_proportions.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/flex_proportions.c +3 -2
@@ -64,13 +64,14 @@ void fprop_global_destroy(struct fprop_gbool fprop_new_period (struct fprop_global *p,int periods) {s64 events =percpu_counter_sum (&p->events); +unsigned long flags;/* * Don't do anything if there are no events. */ if (events <=1 )return false; -preempt_disable_nested (); +local_irq_save (flags);write_seqcount_begin (&p->sequence);if (periods <64 ) events -= events >> periods;
@@ -78,7 +79,7 @@ bool fprop_new_period(struct fprop_globapercpu_counter_add (&p->events, -events); p->period += periods;write_seqcount_end (&p->sequence); -preempt_enable_nested (); +local_irq_restore (flags);return true; }
Greg Kroah-Hartman
maintainerPATCH 84/122 btrfs: do not strictly require dirty metadata threshold for metadata writepages
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
commit 4e159150a9a56d66d247f4b5510bed46fe58aa1c upstream.
[BUG]
There is an internal report that over 1000 processes are waiting at the io_schedule_timeout() of balance_dirty_pages(), causing a system hang and trigger a kernel coredump.
The kernel is v6.4 kernel based, but the root problem still applies to any upstream kernel before v6.18.
[CAUSE]
Quoted 1 line
From Jan Kara for his wisdom on the dirty page balance behavior first.
This cgroup dirty limit was what was actually playing the role here because the cgroup had only a small amount of memory and so the dirty limit for it was something like 16MB.
Dirty throttling is responsible for enforcing that nobody can dirty (significantly) more dirty memory than there's dirty limit. Thus when a task is dirtying pages it periodically enters into balance_dirty_pages() and we let it sleep there to slow down the dirtying.
When the system is over dirty limit already (either globally or within a cgroup of the running task), we will not let the task exit from balance_dirty_pages() until the number of dirty pages drops below the limit.
So in this particular case, as I already mentioned, there was a cgroup with relatively small amount of memory and as a result with dirty limit set at 16MB. A task from that cgroup has dirtied about 28MB worth of pages in btrfs btree inode and these were practically the only dirty pages in that cgroup.
So that means the only way to reduce the dirty pages of that cgroup is to writeback the dirty pages of btrfs btree inode, and only after that those processes can exit balance_dirty_pages().
Now back to the btrfs part, btree_writepages() is responsible for writing back dirty btree inode pages.
The problem here is, there is a btrfs internal threshold that if the btree inode's dirty bytes are below the 32M threshold, it will not do any writeback.
This behavior is to batch as much metadata as possible so we won't write back those tree blocks and then later re-COW them again for another modification.
This internal 32MiB is higher than the existing dirty page size (28MiB), meaning no writeback will happen, causing a deadlock between btrfs and cgroup:
- Btrfs doesn't want to write back btree inode until more dirty pages
- Cgroup/MM doesn't want more dirty pages for btrfs btree inode Thus any process touching that btree inode is put into sleep until the number of dirty pages is reduced.
Thanks Jan Kara a lot for the analysis of the root cause.
[ENHANCEMENT]
Since kernel commit b55102826d7d ("btrfs: set AS_KERNEL_FILE on the btree_inode"), btrfs btree inode pages will only be charged to the root cgroup which should have a much larger limit than btrfs' 32MiB threshold.
So it should not affect newer kernels.
But for all current LTS kernels, they are all affected by this problem, and backporting the whole AS_KERNEL_FILE may not be a good idea.
Even for newer kernels I still think it's a good idea to get rid of the internal threshold at btree_writepages(), since for most cases cgroup/MM has a better view of full system memory usage than btrfs' fixed threshold.
For internal callers using btrfs_btree_balance_dirty() since that function is already doing internal threshold check, we don't need to bother them.
But for external callers of btree_writepages(), just respect their requests and write back whatever they want, ignoring the internal btrfs threshold to avoid such deadlock on btree inode dirty page balancing.
--- fs/btrfs/disk-io.c | 22 ---------------------- fs/btrfs/extent_io.c | 3 +-- fs/btrfs/extent_io.h | 3 +-- 3 files changed, 2 insertions(+), 26 deletions(-)
fs/btrfs/disk-io.c +0 -22
@@ -490,28 +490,6 @@ static int btree_migrate_folio(struct ad#define btree_migrate_folio NULL#endif -static int btree_writepages (struct address_space *mapping, -struct writeback_control *wbc) -{ -int ret; - -if (wbc->sync_mode ==WB_SYNC_NONE ) { -struct btrfs_fs_info *fs_info; - -if (wbc->for_kupdate) -return 0 ; - - fs_info =inode_to_fs_info (mapping->host); -/* this is a bit racy, but that's ok */ - ret =__percpu_counter_compare (&fs_info->dirty_metadata_bytes, -BTRFS_DIRTY_METADATA_THRESH , - fs_info->dirty_metadata_batch); -if (ret <0 ) -return 0 ; - } -return btree_write_cache_pages (mapping, wbc); -} -static bool btree_release_folio (struct folio *folio,gfp_t gfp_flags) {if (folio_test_writeback (folio) ||folio_test_dirty (folio))
fs/btrfs/extent_io.c +1 -2
@@ -2289,8 +2289,7 @@ void btrfs_btree_wait_writeback_range(st } } -int btree_write_cache_pages (struct address_space *mapping, -struct writeback_control *wbc) +int btree_writepages (struct address_space *mapping,struct writeback_control *wbc) {struct btrfs_eb_write_context ctx = { .wbc = wbc };struct btrfs_fs_info *fs_info =inode_to_fs_info (mapping->host);
fs/btrfs/extent_io.h +1 -2
@@ -238,8 +238,7 @@ void extent_write_locked_range(struct in u64 start, u64 end, struct writeback_control *wbc, bool pages_dirty);int btrfs_writepages (struct address_space *mapping,struct writeback_control *wbc); -int btree_write_cache_pages (struct address_space *mapping, -struct writeback_control *wbc); +int btree_writepages (struct address_space *mapping,struct writeback_control *wbc);void btrfs_btree_wait_writeback_range (struct btrfs_fs_info *fs_info,u64 start,u64 end);void btrfs_readahead (struct readahead_control *rac);int set_folio_extent_mapped (struct folio *folio);
Greg Kroah-Hartman
maintainerPATCH 85/122 mm/kfence: randomize the freelist on initialization
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pimyn Girgis <[email protected]>
commit 870ff19251bf3910dda7a7245da826924045fedd upstream.
Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below().
Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop.
--- mm/kfence/core.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
mm/kfence/core.c +19 -4
@@ -595,7 +595,7 @@ static void rcu_guarded_free(struct rcu_static unsigned long kfence_init_pool (void ) {unsigned long addr, start_pfn; -int i; +int i, rand;if (!arch_kfence_init_pool ())return (unsigned long )__kfence_pool;
@@ -645,13 +645,27 @@ static unsigned long kfence_init_pool(voINIT_LIST_HEAD (&meta->list);raw_spin_lock_init (&meta->lock); meta->state =KFENCE_OBJECT_UNUSED ; - meta->addr = addr;/* Initialize for validation in metadata_to_pageaddr(). */ -list_add_tail (&meta->list, &kfence_freelist); +/* Use addr to randomize the freelist. */ + meta->addr = i;/* Protect the right redzone. */ -if (unlikely (!kfence_protect (addr +PAGE_SIZE ))) +if (unlikely (!kfence_protect (addr +2 * i *PAGE_SIZE +PAGE_SIZE ))) goto reset_slab; + } + +for (i =CONFIG_KFENCE_NUM_OBJECTS ; i >0 ; i--) { + rand =get_random_u32_below (i); +swap (kfence_metadata_init[i -1 ].addr, kfence_metadata_init[rand].addr); + } +for (i =0 ; i <CONFIG_KFENCE_NUM_OBJECTS ; i++) { +struct kfence_metadata *meta_1 = &kfence_metadata_init[i]; +struct kfence_metadata *meta_2 = &kfence_metadata_init[meta_1->addr]; + +list_add_tail (&meta_2->list, &kfence_freelist); + } +for (i =0 ; i <CONFIG_KFENCE_NUM_OBJECTS ; i++) { + kfence_metadata_init[i].addr = addr; addr +=2 *PAGE_SIZE ; }
@@ -664,6 +678,7 @@ static unsigned long kfence_init_pool(voreturn 0 ; reset_slab: + addr +=2 * i *PAGE_SIZE ;for (i =0 ; i <KFENCE_POOL_SIZE /PAGE_SIZE ; i++) {struct slab *slab;
Greg Kroah-Hartman
maintainerPATCH 86/122 mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jane Chu <[email protected]>
commit a148a2040191b12b45b82cb29c281cb3036baf90 upstream.
When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both.
While at it, define __get_huge_page_for_hwpoison() return values in terms of symbol names for better readibility. Also rename folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected.
--- mm/memory-failure.c | 93 +++++++++++++++++++++++++++++++--------------------- 1 file changed, 56 insertions(+), 37 deletions(-)
mm/memory-failure.c +56 -37
@@ -1873,12 +1873,22 @@ static unsigned long __folio_free_raw_hwreturn count; } -static int folio_set_hugetlb_hwpoison (struct folio *folio,struct page *page) +#define MF_HUGETLB_FREED 0/* freed hugepage */ +#define MF_HUGETLB_IN_USED 1/* in-use hugepage */ +#define MF_HUGETLB_NON_HUGEPAGE 2/* not a hugepage */ +#define MF_HUGETLB_FOLIO_PRE_POISONED 3/* folio already poisoned */ +#define MF_HUGETLB_PAGE_PRE_POISONED 4/* exact page already poisoned */ +#define MF_HUGETLB_RETRY 5/* hugepage is busy, retry */ +/* +* Set hugetlb folio as hwpoisoned, update folio private raw hwpoison list +* to keep track of the poisoned pages. +*/ +static int hugetlb_update_hwpoison (struct folio *folio,struct page *page) {struct llist_head *head;struct raw_hwp_page *raw_hwp;struct raw_hwp_page *p; -int ret =folio_test_set_hwpoison (folio) ? -EHWPOISON :0 ; +int ret =folio_test_set_hwpoison (folio) ?MF_HUGETLB_FOLIO_PRE_POISONED :0 ;/* * Once the hwpoison hugepage has lost reliable raw error info,
@@ -1886,20 +1896,17 @@ static int folio_set_hugetlb_hwpoison(st* so skip to add additional raw error info. */ if (folio_test_hugetlb_raw_hwp_unreliable (folio)) -return -EHWPOISON ; +return MF_HUGETLB_FOLIO_PRE_POISONED ; head =raw_hwp_list_head (folio);llist_for_each_entry (p, head->first, node) {if (p->page == page) -return -EHWPOISON ; +return MF_HUGETLB_PAGE_PRE_POISONED ; } raw_hwp =kmalloc (sizeof (struct raw_hwp_page ),GFP_ATOMIC );if (raw_hwp) { raw_hwp->page = page;llist_add (&raw_hwp->node, head); -/* the first error event will be counted in action_result(). */ -if (ret) -num_poisoned_pages_inc (page_to_pfn (page)); }else {/* * Failed to save raw error info. We no longer trace all
@@ -1947,42 +1954,39 @@ void folio_clear_hugetlb_hwpoison(struct/* * Called from hugetlb code with hugetlb_lock held. -* -* Return values: -* 0 - free hugepage -* 1 - in-use hugepage -* 2 - not a hugepage -* -EBUSY - the hugepage is busy (try to retry) -* -EHWPOISON - the hugepage is already hwpoisoned */ int __get_huge_page_for_hwpoison (unsigned long pfn,int flags,bool *migratable_cleared) {struct page *page =pfn_to_page (pfn);struct folio *folio =page_folio (page); -int ret =2 ;/* fallback to normal page handling */ bool count_increased = false; +int ret, rc; -if (!folio_test_hugetlb (folio)) +if (!folio_test_hugetlb (folio)) { + ret =MF_HUGETLB_NON_HUGEPAGE ; goto out; - -if (flags &MF_COUNT_INCREASED ) { - ret =1 ; + }else if (flags &MF_COUNT_INCREASED ) { + ret =MF_HUGETLB_IN_USED ; count_increased = true; }else if (folio_test_hugetlb_freed (folio)) { - ret =0 ; + ret =MF_HUGETLB_FREED ; }else if (folio_test_hugetlb_migratable (folio)) { - ret =folio_try_get (folio); -if (ret) +if (folio_try_get (folio)) { + ret =MF_HUGETLB_IN_USED ; count_increased = true; + }else { + ret =MF_HUGETLB_FREED ; + } }else { - ret = -EBUSY ; + ret =MF_HUGETLB_RETRY ;if (!(flags &MF_NO_RETRY )) goto out; } -if (folio_set_hugetlb_hwpoison (folio, page)) { - ret = -EHWPOISON ; + rc =hugetlb_update_hwpoison (folio, page); +if (rc >=MF_HUGETLB_FOLIO_PRE_POISONED ) { + ret = rc; goto out; }
@@ -2007,10 +2011,16 @@ out:* with basic operations like hugepage allocation/free/demotion. * So some of prechecks for hwpoison (pinning, and testing/setting * PageHWPoison) should be done in single hugetlb_lock range. +* Returns: +* 0 - not hugetlb, or recovered +* -EBUSY - not recovered +* -EOPNOTSUPP - hwpoison_filter'ed +* -EHWPOISON - folio or exact page already poisoned +* -EFAULT - kill_accessing_process finds current->mm null */ static int try_memory_failure_hugetlb (unsigned long pfn,int flags,int *hugetlb) { -int res; +int res, rv;struct page *p =pfn_to_page (pfn);struct folio *folio;unsigned long page_flags;
@@ -2019,22 +2029,31 @@ static int try_memory_failure_hugetlb(un *hugetlb =1 ; retry: res =get_huge_page_for_hwpoison (pfn, flags, &migratable_cleared); -if (res ==2 ) {/* fallback to normal page handling */ +switch (res) { +case MF_HUGETLB_NON_HUGEPAGE :/* fallback to normal page handling */ *hugetlb =0 ;return 0 ; - }else if (res == -EHWPOISON ) { -if (flags &MF_ACTION_REQUIRED ) { - folio =page_folio (p); - res =kill_accessing_process (current,folio_pfn (folio), flags); - } -action_result (pfn,MF_MSG_ALREADY_POISONED ,MF_FAILED ); -return res; - }else if (res == -EBUSY ) { +case MF_HUGETLB_RETRY :if (!(flags &MF_NO_RETRY )) { flags |=MF_NO_RETRY ; goto retry; }return action_result (pfn,MF_MSG_GET_HWPOISON ,MF_IGNORED ); +case MF_HUGETLB_FOLIO_PRE_POISONED : +case MF_HUGETLB_PAGE_PRE_POISONED : + rv = -EHWPOISON ; +if (flags &MF_ACTION_REQUIRED ) { + folio =page_folio (p); + rv =kill_accessing_process (current,folio_pfn (folio), flags); + } +if (res ==MF_HUGETLB_PAGE_PRE_POISONED ) +action_result (pfn,MF_MSG_ALREADY_POISONED ,MF_FAILED ); +else +action_result (pfn,MF_MSG_HUGE ,MF_FAILED ); +return rv; +default : +WARN_ON ((res !=MF_HUGETLB_FREED ) && (res !=MF_HUGETLB_IN_USED )); +break ; } folio =page_folio (p);
@@ -2045,7 +2064,7 @@ retry:if (migratable_cleared)folio_set_hugetlb_migratable (folio);folio_unlock (folio); -if (res ==1 ) +if (res ==MF_HUGETLB_IN_USED )folio_put (folio);return -EOPNOTSUPP ; }
@@ -2054,7 +2073,7 @@ retry:* Handling free hugepage. The possible race with hugepage allocation * or demotion can be prevented by PageHWPoison flag. */ -if (res ==0 ) { +if (res ==MF_HUGETLB_FREED ) {folio_unlock (folio);if (__page_handle_poison (p) >0 ) {page_ref_inc (p);
Greg Kroah-Hartman
maintainerPATCH 87/122 mm, swap: restore swap_space attr aviod kernel panic
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: robin.kuo <[email protected]>
commit a0f3c0845a4ff68d403c568266d17e9cc553e561 upstream.
commit 8b47299a411a ("mm, swap: mark swap address space ro and add context debug check") made the swap address space read-only. It may lead to kernel panic if arch_prepare_to_swap returns a failure under heavy memory pressure as follows,
el1_abort+0x40/0x64 el1h_64_sync_handler+0x48/0xcc el1h_64_sync+0x84/0x88 errseq_set+0x4c/0xb8 (P) __filemap_set_wb_err+0x20/0xd0 shrink_folio_list+0xc20/0x11cc evict_folios+0x1520/0x1be4 try_to_shrink_lruvec+0x27c/0x3dc shrink_one+0x9c/0x228 shrink_node+0xb3c/0xeac do_try_to_free_pages+0x170/0x4f0 try_to_free_pages+0x334/0x534 __alloc_pages_direct_reclaim+0x90/0x158 __alloc_pages_slowpath+0x334/0x588 __alloc_frozen_pages_noprof+0x224/0x2fc __folio_alloc_noprof+0x14/0x64 vma_alloc_zeroed_movable_folio+0x34/0x44 do_pte_missing+0xad4/0x1040 handle_mm_fault+0x4a4/0x790 do_page_fault+0x288/0x5f8 do_translation_fault+0x38/0x54 do_mem_abort+0x54/0xa8
Restore swap address space as not ro to avoid the panic.
--- mm/swap.h | 2 +- mm/swap_state.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
mm/swap.h +1 -1
@@ -198,7 +198,7 @@ int swap_writeout(struct folio *folio, struct swap_iocb **swap_plug);void __swap_writepage (struct folio *folio,struct swap_iocb **swap_plug);/* linux/mm/swap_state.c */ -extern struct address_space swap_space__ro_after_init ; +extern struct address_space swap_space__read_mostly ;static inline struct address_space *swap_address_space (swp_entry_t entry) {return &swap_space;
mm/swap_state.c +1 -2
@@ -37,8 +37,7 @@ static const struct address_space_operations swap_aops = {#endif }; -/* Set swap_space as read only as swap cache is handled by swap table */ -struct address_space swap_space__ro_after_init = { +struct address_space swap_space__read_mostly = { .a_ops = &swap_aops, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/122 mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jane Chu <[email protected]>
commit 057a6f2632c956483e2b2628477f0fcd1cd8a844 upstream.
When a hugetlb folio is being poisoned again, try_memory_failure_hugetlb() passed head pfn to kill_accessing_process(), that is not right. The precise pfn of the poisoned page should be used in order to determine the precise vaddr as the SIGBUS payload.
This issue has already been taken care of in the normal path, that is, hwpoison_user_mappings(), see [1][2]. Further more, for [3] to work correctly in the hugetlb repoisoning case, it's essential to inform VM the precise poisoned page, not the head page.
[1] https://lkml.kernel.org/r/[email protected]
[2] https://lkml.kernel.org/r/[email protected]
[3] https://lore.kernel.org/lkml/[email protected]/
--- mm/memory-failure.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
mm/memory-failure.c +8 -6
@@ -684,6 +684,8 @@ static int check_hwpoisoned_entry(pte_t unsigned long poisoned_pfn, struct to_kill *tk) { unsigned long pfn = 0; +unsigned long hwpoison_vaddr; +unsigned long mask;if (pte_present (pte)) { pfn =pte_pfn (pte);
@@ -694,10 +696,12 @@ static int check_hwpoisoned_entry(pte_t pfn =swp_offset_pfn (swp); } -if (!pfn || pfn != poisoned_pfn) + mask = ~((1UL << (shift -PAGE_SHIFT )) -1 ); +if (!pfn || pfn != (poisoned_pfn & mask))return 0 ; -set_to_kill (tk, addr, shift); + hwpoison_vaddr = addr + ((poisoned_pfn - pfn) <<PAGE_SHIFT ); +set_to_kill (tk, hwpoison_vaddr, shift);return 1 ; }
@@ -2042,10 +2046,8 @@ retry:case MF_HUGETLB_FOLIO_PRE_POISONED :case MF_HUGETLB_PAGE_PRE_POISONED : rv = -EHWPOISON ; -if (flags &MF_ACTION_REQUIRED ) { - folio =page_folio (p); - rv =kill_accessing_process (current,folio_pfn (folio), flags); - } +if (flags &MF_ACTION_REQUIRED ) + rv =kill_accessing_process (current, pfn, flags);if (res ==MF_HUGETLB_PAGE_PRE_POISONED )action_result (pfn,MF_MSG_ALREADY_POISONED ,MF_FAILED );else
Greg Kroah-Hartman
maintainerPATCH 89/122 mm/shmem, swap: fix race of truncate and swap entry split
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kairui Song <[email protected]>
commit 8a1968bd997f45a9b11aefeabdd1232e1b6c7184 upstream.
The helper for shmem swap freeing is not handling the order of swap entries correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it gets the entry order before that using xa_get_order without lock protection, and it may get an outdated order value if the entry is split or changed in other ways after the xa_get_order and before the xa_cmpxchg_irq.
And besides, the order could grow and be larger than expected, and cause truncation to erase data beyond the end border. For example, if the target entry and following entries are swapped in or freed, then a large folio was added in place and swapped out, using the same entry, the xa_cmpxchg_irq will still succeed, it's very unlikely to happen though.
To fix that, open code the Xarray cmpxchg and put the order retrieval and value checking in the same critical section. Also, ensure the order won't exceed the end border, skip it if the entry goes across the border.
Skipping large swap entries crosses the end border is safe here. Shmem truncate iterates the range twice, in the first iteration, find_lock_entries already filtered such entries, and shmem will swapin the entries that cross the end border and partially truncate the folio (split the folio or at least zero part of it). So in the second loop here, if we see a swap entry that crosses the end order, it must at least have its content erased already.
I observed random swapoff hangs and kernel panics when stress testing ZSWAP with shmem. After applying this patch, all problems are gone.
--- mm/shmem.c | 45 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 34 insertions(+), 11 deletions(-)
mm/shmem.c +34 -11
@@ -944,17 +944,29 @@ static void shmem_delete_from_page_cache* being freed). */ static long shmem_free_swap (struct address_space *mapping, -pgoff_t index,void *radswap) +pgoff_t index,pgoff_t end,void *radswap) { -int order =xa_get_order (&mapping->i_pages, index); -void *old; +XA_STATE (xas, &mapping->i_pages, index); +unsigned int nr_pages =0 ; +pgoff_t base; +void *entry; + +xas_lock_irq (&xas); + entry =xas_load (&xas); +if (entry == radswap) { + nr_pages =1 <<xas_get_order (&xas); + base =round_down (xas.xa_index, nr_pages); +if (base < index || base + nr_pages -1 > end) + nr_pages =0 ; +else +xas_store (&xas,NULL ); + } +xas_unlock_irq (&xas); - old =xa_cmpxchg_irq (&mapping->i_pages, index, radswap,NULL ,0 ); -if (old != radswap) -return 0 ; -free_swap_and_cache_nr (radix_to_swp_entry (radswap),1 << order); +if (nr_pages) +free_swap_and_cache_nr (radix_to_swp_entry (radswap), nr_pages); -return 1 << order; +return nr_pages; }/*
@@ -1106,8 +1118,8 @@ static void shmem_undo_range(struct inodif (xa_is_value (folio)) {if (unfalloc)continue ; - nr_swaps_freed +=shmem_free_swap (mapping, - indices[i], folio); + nr_swaps_freed +=shmem_free_swap (mapping, indices[i], + end -1 , folio);continue ; }
@@ -1173,12 +1185,23 @@ whole_folios: folio = fbatch.folios[i];if (xa_is_value (folio)) { +int order;long swaps_freed;if (unfalloc)continue ; - swaps_freed =shmem_free_swap (mapping, indices[i], folio); + swaps_freed =shmem_free_swap (mapping, indices[i], + end -1 , folio);if (!swaps_freed) { +/* +* If found a large swap entry cross the end border, +* skip it as the truncate_inode_partial_folio above +* should have at least zerod its content once. +*/ + order =shmem_confirm_swap (mapping, indices[i], +radix_to_swp_entry (folio)); +if (order >0 && indices[i] + (1 << order) > end) +continue ;/* Swap was replaced by page: retry */ index = indices[i];break ;
Greg Kroah-Hartman
maintainerPATCH 90/122 net: fix segmentation of forwarding fraglist GRO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jibin Zhang <[email protected]>
commit 426ca15c7f6cb6562a081341ca88893a50c59fa2 upstream.
This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface.
Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput.
To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.
--- net/core/filter.c | 2 ++ net/ipv4/tcp_offload.c | 3 ++- net/ipv4/udp_offload.c | 3 ++- net/ipv6/tcpv6_offload.c | 3 ++- 4 files changed, 8 insertions(+), 3 deletions(-)
net/core/filter.c +2 -0
@@ -3352,6 +3352,7 @@ static int bpf_skb_proto_4_to_6(struct s shinfo->gso_type &= ~SKB_GSO_TCPV4 ; shinfo->gso_type |=SKB_GSO_TCPV6 ; } + shinfo->gso_type |=SKB_GSO_DODGY ; }bpf_skb_change_protocol (skb,ETH_P_IPV6 );
@@ -3382,6 +3383,7 @@ static int bpf_skb_proto_6_to_4(struct s shinfo->gso_type &= ~SKB_GSO_TCPV6 ; shinfo->gso_type |=SKB_GSO_TCPV4 ; } + shinfo->gso_type |=SKB_GSO_DODGY ; }bpf_skb_change_protocol (skb,ETH_P_IP );
net/ipv4/tcp_offload.c +2 -1
@@ -107,7 +107,8 @@ static struct sk_buff *tcp4_gso_segment(if (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST ) {struct tcphdr *th =tcp_hdr (skb); -if (skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) +if ((skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) && + !(skb_shinfo (skb)->gso_type &SKB_GSO_DODGY ))return __tcp4_gso_segment_list (skb, features); skb->ip_summed =CHECKSUM_NONE ;
net/ipv4/udp_offload.c +2 -1
@@ -514,7 +514,8 @@ struct sk_buff *__udp_gso_segment(structif (skb_shinfo (gso_skb)->gso_type &SKB_GSO_FRAGLIST ) {/* Detect modified geometry and pass those to skb_segment. */ -if (skb_pagelen (gso_skb) -sizeof (*uh) ==skb_shinfo (gso_skb)->gso_size) +if ((skb_pagelen (gso_skb) -sizeof (*uh) ==skb_shinfo (gso_skb)->gso_size) && + !(skb_shinfo (gso_skb)->gso_type &SKB_GSO_DODGY ))return __udp_gso_segment_list (gso_skb, features, is_ipv6); ret =__skb_linearize (gso_skb);
net/ipv6/tcpv6_offload.c +2 -1
@@ -170,7 +170,8 @@ static struct sk_buff *tcp6_gso_segment(if (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST ) {struct tcphdr *th =tcp_hdr (skb); -if (skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) +if ((skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) && + !(skb_shinfo (skb)->gso_type &SKB_GSO_DODGY ))return __tcp6_gso_segment_list (skb, features); skb->ip_summed =CHECKSUM_NONE ;
Greg Kroah-Hartman
maintainerPATCH 91/122 rust: bits: always inline functions using build_assert with arguments
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Courbot <[email protected]>
commit 09c3c9112d71c44146419c87c55c710e68335741 upstream.
build_assert relies on the compiler to optimize out its error path. Functions using it with its arguments must thus always be inlined, otherwise the error path of build_assert might not be optimized out, triggering a build error.
--- rust/kernel/bits.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
rust/kernel/bits.rs +4 -2
@@ -27,7 +27,8 @@ pub fn [<checked_bit_ $ty>](n: u32) -> Option<$ty> {/// /// This version is the default and should be used if `n` is known at /// compile time. -#[inline] +// Always inline to optimize out error path of `build_assert`. +#[inline(always)] pub const fn [<bit_ $ty>](n: u32) -> $ty {build_assert! (n < <$ty>::BITS ); (1 as $ty) << n
@@ -75,7 +76,8 @@ pub fn [<genmask_checked_ $ty>](range: RangeInclusive<u32>) -> Option<$ty> {/// This version is the default and should be used if the range is known /// at compile time. $(#[$genmask_ex])* - #[inline] + // Always inline to optimize out error path of `build_assert`. + #[inline(always)] pub const fn [<genmask_ $ty>](range: RangeInclusive<u32>) -> $ty { let start = *range.start(); let end = *range.end();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/122 rust: sync: atomic: Provide stub for `rusttest` 32-bit hosts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit bd36f6e2abf7f85644f7ea8deb1de4040b03bbc1 upstream.
For arm32, on a x86_64 builder, running the rusttest target yields:
error[E0080]: evaluation of constant value failed
--> rust/kernel/static_assert.rs:37:23
|
37 | const _: () = ::core::assert!($condition $(,$arg)?);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the evaluated program panicked at 'assertion failed: size_of::<isize>() == size_of::<isize_atomic_repr>()', rust/kernel/sync/atomic/predefine.rs:68:1
|
::: rust/kernel/sync/atomic/predefine.rs:68:1
|
68 | static_assert!(size_of::<isize>() == size_of::<isize_atomic_repr>());
| -------------------------------------------------------------------- in this macro invocation
|
= note: this error originates in the macro `::core::assert` which comes from the expansion of the macro `static_assert` (in Nightly builds, run with -Z macro-backtrace for more info)The reason is that rusttest runs on the host, so for e.g. a x86_64 builder isize is 64 bits but it is not a CONFIG_64BIT build.
Fix it by providing a stub for rusttest as usual.
--- rust/kernel/sync/atomic/predefine.rs | 11 +++++++++++ 1 file changed, 11 insertions(+)
rust/kernel/sync/atomic/predefine.rs +11 -0
@@ -35,12 +35,23 @@ fn rhs_into_delta(rhs: i64) -> i64 {// as `isize` and `usize`, and `isize` and `usize` are always bi-directional transmutable to // `isize_atomic_repr`, which also always implements `AtomicImpl`. #[allow(non_camel_case_types)] +#[cfg(not(testlib))] #[cfg(not( CONFIG_64BIT ))] type isize_atomic_repr =i32 ;#[allow(non_camel_case_types)] +#[cfg(not(testlib))] #[cfg( CONFIG_64BIT )] type isize_atomic_repr =i64 ; +#[allow(non_camel_case_types)] +#[cfg(testlib)] +#[cfg(target_pointer_width = "32" )] +type isize_atomic_repr =i32 ; +#[allow(non_camel_case_types)] +#[cfg(testlib)] +#[cfg(target_pointer_width = "64" )] +type isize_atomic_repr =i64 ; +// Ensure size and alignment requirements are checked. static_assert! (size_of ::<isize >() ==size_of ::<isize_atomic_repr >());static_assert! (align_of ::<isize >() ==align_of ::<isize_atomic_repr >());
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/122 rust: sync: refcount: always inline functions using build_assert with arguments
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Courbot <[email protected]>
commit d6ff6e870077ae0f01a6f860ca1e4a5a825dc032 upstream.
build_assert relies on the compiler to optimize out its error path. Functions using it with its arguments must thus always be inlined, otherwise the error path of build_assert might not be optimized out, triggering a build error.
--- rust/kernel/sync/refcount.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
rust/kernel/sync/refcount.rs +2 -1
@@ -23,7 +23,8 @@ impl Refcount {/// Construct a new [`Refcount`] from an initial value. /// /// The initial value should be non-saturated. -#[inline] +// Always inline to optimize out error path of `build_assert`. +#[inline(always)] pub fn new (value:i32 ) ->Self {build_assert! (value >=0 ,"initial value saturated" );// SAFETY: There are no safety requirements for this FFI call.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/122 scripts: generate_rust_analyzer: Add pin_init -> compiler_builtins dep
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <[email protected]>
commit 98dcca855343512a99432224447f07c5988753ad upstream.
Add a dependency edge from pin_init to compiler_builtins to scripts/generate_rust_analyzer.py to match rust/Makefile. This has been incorrect since commit d7659acca7a3 ("rust: add pin-init crate build infrastructure").
--- scripts/generate_rust_analyzer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/generate_rust_analyzer.py +1 -1
@@ -110,7 +110,7 @@ def generate_crates(srctree, objtree, sy append_crate( "pin_init", srctree / "rust" / "pin-init" / "src" / "lib.rs", - ["core", "pin_init_internal", "macros"], + ["core", "compiler_builtins", "pin_init_internal", "macros"], cfg=["kernel"], )
Greg Kroah-Hartman
maintainerPATCH 95/122 scripts: generate_rust_analyzer: Add pin_init_internal deps
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <[email protected]>
commit 74e15ac34b098934895fd27655d098971d2b43d9 upstream.
Commit d7659acca7a3 ("rust: add pin-init crate build infrastructure") did not add dependencies to pin_init_internal, resulting in broken navigation. Thus add them now.
[ Tamir elaborates:
"before this series, go-to-symbol from pin_init_internal to e.g.
proc_macro::TokenStream doesn't work."
- Miguel ]
--- scripts/generate_rust_analyzer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/generate_rust_analyzer.py +1 -1
@@ -102,7 +102,7 @@ def generate_crates(srctree, objtree, sy append_crate( "pin_init_internal", srctree / "rust" / "pin-init" / "internal" / "src" / "lib.rs", - [], + ["std", "proc_macro"], cfg=["kernel"], is_proc_macro=True, )
Greg Kroah-Hartman
maintainerPATCH 96/122 scripts: generate_rust_analyzer: remove sysroot assertion
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Onur Özkan <[email protected]>
commit 1b83ef9f7ad4635c913b80ef5e718f95f48e85af upstream.
With nixpkgs's rustc, rust-src component is not bundled with the compiler by default and is instead provided from a separate store path, so this assumption does not hold.
The assertion assumes these paths are in the same location which causes make LLVM=1 rust-analyzer to fail on NixOS.
--- scripts/generate_rust_analyzer.py | 3 --- 1 file changed, 3 deletions(-)
scripts/generate_rust_analyzer.py +0 -3
@@ -192,9 +192,6 @@ def main(): level=logging.INFO if args.verbose else logging.WARNING ) - # Making sure that the `sysroot` and `sysroot_src` belong to the same toolchain. - assert args.sysroot in args.sysroot_src.parents - rust_project = { "crates": generate_crates(args.srctree, args.objtree, args.sysroot_src, args.exttree, args.cfgs, args.core_edition), "sysroot": str(args.sysroot),
Greg Kroah-Hartman
maintainerPATCH 97/122 scripts: generate_rust_analyzer: compile sysroot with correct edition
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <[email protected]>
commit ac3c50b9a24e9ebeb585679078d6c47922034bb6 upstream.
Use core_edition for all sysroot crates rather than just core as all were updated to edition 2024 in Rust 1.87.
--- scripts/generate_rust_analyzer.py | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
scripts/generate_rust_analyzer.py +26 -3
@@ -61,7 +61,6 @@ def generate_crates(srctree, objtree, sy display_name, deps, cfg=[], - edition="2021", ): append_crate( display_name,
@@ -69,13 +68,37 @@ def generate_crates(srctree, objtree, sy deps, cfg, is_workspace_member=False, - edition=edition, + # Miguel Ojeda writes: + # + # > ... in principle even the sysroot crates may have different + # > editions. + # > + # > For instance, in the move to 2024, it seems all happened at once + # > in 1.87.0 in these upstream commits: + # > + # > 0e071c2c6a58 ("Migrate core to Rust 2024") + # > f505d4e8e380 ("Migrate alloc to Rust 2024") + # > 0b2489c226c3 ("Migrate proc_macro to Rust 2024") + # > 993359e70112 ("Migrate std to Rust 2024") + # > + # > But in the previous move to 2021, `std` moved in 1.59.0, while + # > the others in 1.60.0: + # > + # > b656384d8398 ("Update stdlib to the 2021 edition") + # > 06a1c14d52a8 ("Switch all libraries to the 2021 edition") + # + # Link: https://lore.kernel.org/all/CANiq72kd9bHdKaAm=8xCUhSHMy2csyVed69bOc4dXyFAW4sfuw@mail.gmail.com/ + # + # At the time of writing all rust versions we support build the + # sysroot crates with the same edition. We may need to relax this + # assumption if future edition moves span multiple rust versions. + edition=core_edition, ) # NB: sysroot crates reexport items from one another so setting up our transitive dependencies # here is important for ensuring that rust-analyzer can resolve symbols. The sources of truth # for this dependency graph are `(sysroot_src / crate / "Cargo.toml" for crate in crates)`. - append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", []), edition=core_edition) + append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", [])) append_sysroot_crate("alloc", ["core"]) append_sysroot_crate("std", ["alloc", "core"]) append_sysroot_crate("proc_macro", ["core", "std"])
Greg Kroah-Hartman
maintainerPATCH 98/122 scripts: generate_rust_analyzer: fix resolution of #[pin_data] macros
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeungJong Ha <[email protected]>
commit e440bc5c190cd0e5f148b2892aeb1f4bbbf54507 upstream.
Currently, rust-analyzer fails to properly resolve structs annotated with #[pin_data]. This prevents IDE features like "Go to Definition" from working correctly for those structs.
Add the missing configuration to generate_rust_analyzer.py to ensure the pin-init crate macros are handled correctly.
--- scripts/generate_rust_analyzer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/generate_rust_analyzer.py +1 -1
@@ -192,7 +192,7 @@ def generate_crates(srctree, objtree, sy append_crate( name, path, - ["core", "kernel"], + ["core", "kernel", "pin_init"], cfg=cfg, )
Greg Kroah-Hartman
maintainerPATCH 99/122 scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <[email protected]>
commit 5157c328edb35bac05ce77da473c3209d20e0bbb upstream.
Add a dependency edge from compiler_builtins to core to scripts/generate_rust_analyzer.py to match rust/Makefile. This has been incorrect since commit 8c4555ccc55c ("scripts: add generate_rust_analyzer.py")
--- scripts/generate_rust_analyzer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/generate_rust_analyzer.py +1 -1
@@ -106,7 +106,7 @@ def generate_crates(srctree, objtree, sy append_crate( "compiler_builtins", srctree / "rust" / "compiler_builtins.rs", - [], + ["core"], ) append_crate(
Greg Kroah-Hartman
maintainerPATCH 100/122 drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
commit 12f15d52d38ac53f7c70ea3d4b3d76afed04e064 upstream.
Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning:
idr_alloc():
...
if (WARN_ON_ONCE(start < 0)) return -EINVAL;
...
Fix it by rejecting new handles above INT_MAX and at the same time make the end limit calculation more obvious by moving into int domain.
--- drivers/gpu/drm/drm_gem.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/gpu/drm/drm_gem.c +12 -6
@@ -970,16 +970,21 @@ int drm_gem_change_handle_ioctl(struct d {struct drm_gem_change_handle *args = data;struct drm_gem_object *obj; -int ret; +int handle, ret;if (!drm_core_check_feature (dev,DRIVER_GEM ))return -EOPNOTSUPP ; +/* idr_alloc() limitation. */ +if (args->new_handle >INT_MAX ) +return -EINVAL ; + handle = args->new_handle; + obj =drm_gem_object_lookup (file_priv, args->handle);if (!obj)return -ENOENT ; -if (args->handle == args->new_handle) { +if (args->handle == handle) { ret =0 ; goto out; }
@@ -987,18 +992,19 @@ int drm_gem_change_handle_ioctl(struct dmutex_lock (&file_priv->prime.lock);spin_lock (&file_priv->table_lock); - ret =idr_alloc (&file_priv->object_idr, obj, - args->new_handle, args->new_handle +1 ,GFP_NOWAIT ); + ret =idr_alloc (&file_priv->object_idr, obj, handle, handle +1 , +GFP_NOWAIT );spin_unlock (&file_priv->table_lock);if (ret <0 ) goto out_unlock;if (obj->dma_buf) { - ret =drm_prime_add_buf_handle (&file_priv->prime, obj->dma_buf, args->new_handle); + ret =drm_prime_add_buf_handle (&file_priv->prime, obj->dma_buf, + handle);if (ret <0 ) {spin_lock (&file_priv->table_lock); -idr_remove (&file_priv->object_idr, args->new_handle); +idr_remove (&file_priv->object_idr, handle);spin_unlock (&file_priv->table_lock); goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 101/122 drm/xe/xelp: Fix Wa_18022495364
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
commit 051be49133971076717846e2a04c746ab3476282 upstream.
It looks I mistyped CS_DEBUG_MODE2 as CS_DEBUG_MODE1 when adding the workaround. Fix it.
--- drivers/gpu/drm/xe/xe_lrc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_lrc.c +1 -1
@@ -1185,7 +1185,7 @@ static ssize_t setup_invalidate_state_cache_wa(struct xe_lrc *lrc,return -ENOSPC ; *cmd++ =MI_LOAD_REGISTER_IMM |MI_LRI_NUM_REGS (1 ); - *cmd++ =CS_DEBUG_MODE1 (0 ).addr; + *cmd++ =CS_DEBUG_MODE2 (0 ).addr; *cmd++ =_MASKED_BIT_ENABLE (INSTRUCTION_STATE_CACHE_INVALIDATE );return cmd - batch;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 102/122 drm/tyr: depend on `COMMON_CLK` to fix build error
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit b0581f6ab952ffd135ca4402d2ee3da641538d6b upstream.
Tyr needs CONFIG_COMMON_CLK to build:
error[E0432]: unresolved import `kernel::clk::Clk`
--> drivers/gpu/drm/tyr/driver.rs:3:5
|
3 | use kernel::clk::Clk;
| ^^^^^^^^^^^^^^^^ no `Clk` in `clk`
error[E0432]: unresolved import `kernel::clk::OptionalClk`
--> drivers/gpu/drm/tyr/driver.rs:4:5
|
4 | use kernel::clk::OptionalClk;
| ^^^^^^^^^^^^^^^^^^^^^^^^ no `OptionalClk` in `clk`Thus add the dependency to fix it.
--- drivers/gpu/drm/tyr/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/tyr/Kconfig +1 -0
@@ -6,6 +6,7 @@ config DRM_TYR depends on RUST depends on ARM || ARM64 || COMPILE_TEST depends on !GENERIC_ATOMIC64 # for IOMMU_IO_PGTABLE_LPAE + depends on COMMON_CLK default n help Rust DRM driver for ARM Mali CSF-based GPUs.
Greg Kroah-Hartman
maintainerPATCH 103/122 drm/msm/a6xx: fix bogus hwcg register updates
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dedb897f11c5d7e32c0e0a0eff7cec23a8047167 upstream.
The hw clock gating register sequence consists of register value pairs that are written to the GPU during initialisation.
The a690 hwcg sequence has two GMU registers in it that used to amount to random writes in the GPU mapping, but since commit 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets") they trigger a fault as the updated offsets now lie outside the mapping. This in turn breaks boot of machines like the Lenovo ThinkPad X13s.
Note that the updates of these GMU registers is already taken care of properly since commit 40c297eb245b ("drm/msm/a6xx: Set GMU CGC properties on a6xx too"), but for some reason these two entries were left in the table.
Patchwork: https://patchwork.freedesktop.org/patch/695778/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_catalog.c +0 -2
@@ -501,8 +501,6 @@ static const struct adreno_reglist a690_ {REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222}, {REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111}, {REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555}, - {REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111}, - {REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555}, {} };
Greg Kroah-Hartman
maintainerPATCH 104/122 drm/imx/tve: fix probe device leak
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e535c23513c63f02f67e3e09e0787907029efeaf upstream.
Make sure to drop the reference taken to the DDC device during probe on probe failure (e.g. probe deferral) and on driver unbind.
--- drivers/gpu/drm/imx/ipuv3/imx-tve.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/gpu/drm/imx/ipuv3/imx-tve.c +13 -0
@@ -525,6 +525,13 @@ static const struct component_ops imx_tv .bind = imx_tve_bind, }; +static void imx_tve_put_device (void *_dev) +{ +struct device *dev = _dev; + +put_device (dev); +} +static int imx_tve_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -546,6 +553,12 @@ static int imx_tve_probe(struct platformif (ddc_node) { tve->ddc =of_find_i2c_adapter_by_node (ddc_node);of_node_put (ddc_node); +if (tve->ddc) { + ret =devm_add_action_or_reset (dev, imx_tve_put_device, + &tve->ddc->dev); +if (ret) +return ret; + } } tve->mode =of_get_tve_mode (np);
Greg Kroah-Hartman
maintainerPATCH 105/122 drm/amd/pm: fix smu v13 soft clock frequency setting issue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
commit c764b7af15289051718b4859a67f9a3bc69d3fb2 upstream.
v1:
resolve the issue where some freq frequencies cannot be set correctly due to insufficient floating-point precision.
v2:
patch this convert on 'max' value only.
--- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 1 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 1 + 2 files changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +1 -0
@@ -56,6 +56,7 @@#define SMUQ10_TO_UINT (x) ((x) >> 10)#define SMUQ10_FRAC (x) ((x) & 0x3ff)#define SMUQ10_ROUND (x) ((SMUQ10_TO_UINT(x)) + ((SMUQ10_FRAC(x)) >= 0x200)) +#define SMU_V13_SOFT_FREQ_ROUND (x) ((x) + 1)extern const int pmfw_decoded_link_speed[5 ];extern const int pmfw_decoded_link_width[7 ];
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +1 -0
@@ -1555,6 +1555,7 @@ int smu_v13_0_set_soft_freq_limited_rangreturn clk_id;if (max >0 ) { + max =SMU_V13_SOFT_FREQ_ROUND (max);if (automatic) param = (uint32_t )((clk_id <<16 ) |0xffff );else
Greg Kroah-Hartman
maintainerPATCH 106/122 drm/amd/pm: fix smu v14 soft clock frequency setting issue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
commit 239d0ccf567c3b09aed58eb88cd3376af37aaf14 upstream.
v1:
resolve the issue where some freq frequencies cannot be set correctly due to insufficient floating-point precision.
v2:
patch this convert on 'max' value only.
--- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 1 + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 + 2 files changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h +1 -0
@@ -57,6 +57,7 @@ extern const int decoded_link_width[8];#define DECODE_GEN_SPEED (gen_speed_idx) (decoded_link_speed[gen_speed_idx])#define DECODE_LANE_WIDTH (lane_width_idx) (decoded_link_width[lane_width_idx]) +#define SMU_V14_SOFT_FREQ_ROUND (x) ((x) + 1)struct smu_14_0_max_sustainable_clocks {uint32_t display_clock;
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c +1 -0
@@ -1178,6 +1178,7 @@ int smu_v14_0_set_soft_freq_limited_rangreturn clk_id;if (max >0 ) { + max =SMU_V14_SOFT_FREQ_ROUND (max);if (automatic) param = (uint32_t )((clk_id <<16 ) |0xffff );else
Greg Kroah-Hartman
maintainerPATCH 107/122 drm/amdgpu/soc21: fix xclk for APUs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit e7fbff9e7622a00c2b53cb14df481916f0019742 upstream.
The reference clock is supposed to be 100Mhz, but it appears to actually be slightly lower (99.81Mhz).
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/soc21.c +7 -1
@@ -225,7 +225,13 @@ static u32 soc21_get_config_memsize(strustatic u32 soc21_get_xclk (struct amdgpu_device *adev) { -return adev->clock.spll.reference_freq; +u32 reference_clock = adev->clock.spll.reference_freq; + +/* reference clock is actually 99.81 Mhz rather than 100 Mhz */ +if ((adev->flags &AMD_IS_APU ) && reference_clock ==10000 ) +return 9981 ; + +return reference_clock; }
Greg Kroah-Hartman
maintainerPATCH 108/122 drm/amdgpu/gfx10: fix wptr reset in KGQ init
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit cc4f433b14e05eaa4a98fd677b836e9229422387 upstream.
wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +1 -1
@@ -6878,7 +6878,7 @@ static int gfx_v10_0_kgq_init_queue(strumemcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; - *ring->wptr_cpu_addr =0 ; +atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );amdgpu_ring_clear_ring (ring); }
Greg Kroah-Hartman
maintainerPATCH 109/122 drm/amdgpu/gfx11: fix wptr reset in KGQ init
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b1f810471c6a6bd349f7f9f2f2fed96082056d46 upstream.
wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +1 -1
@@ -4199,7 +4199,7 @@ static int gfx_v11_0_kgq_init_queue(strumemcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; - *ring->wptr_cpu_addr =0 ; +atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );amdgpu_ring_clear_ring (ring); }
Greg Kroah-Hartman
maintainerPATCH 110/122 drm/amdgpu/gfx11: adjust KGQ reset sequence
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 3eb46fbb601f9a0b4df8eba79252a0a85e983044 upstream.
Kernel gfx queues do not need to be reinitialized or remapped after a reset. This fixes queue reset failures on APUs.
v2: preserve init and remap for MMIO case.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +13 -10
@@ -6821,11 +6821,12 @@ static int gfx_v11_0_reset_kgq(struct am struct amdgpu_fence *timedout_fence) {struct amdgpu_device *adev = ring->adev; +bool use_mmio = false;int r;amdgpu_ring_reset_helper_begin (ring, timedout_fence); - r =amdgpu_mes_reset_legacy_queue (ring->adev, ring, vmid, false); + r =amdgpu_mes_reset_legacy_queue (ring->adev, ring, vmid, use_mmio);if (r) {dev_warn (adev->dev,"reset via MES failed and try pipe reset %d\n" , r);
@@ -6834,16 +6835,18 @@ static int gfx_v11_0_reset_kgq(struct amreturn r; } - r =gfx_v11_0_kgq_init_queue (ring, true); -if (r) { -dev_err (adev->dev,"failed to init kgq\n" ); -return r; - } +if (use_mmio) { + r =gfx_v11_0_kgq_init_queue (ring, true); +if (r) { +dev_err (adev->dev,"failed to init kgq\n" ); +return r; + } - r =amdgpu_mes_map_legacy_queue (adev, ring); -if (r) { -dev_err (adev->dev,"failed to remap kgq\n" ); -return r; + r =amdgpu_mes_map_legacy_queue (adev, ring); +if (r) { +dev_err (adev->dev,"failed to remap kgq\n" ); +return r; + } }return amdgpu_ring_reset_helper_end (ring, timedout_fence);
Greg Kroah-Hartman
maintainerPATCH 111/122 drm/amdgpu/gfx12: fix wptr reset in KGQ init
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 9077d32a4b570fa20500aa26e149981c366c965d upstream.
wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs.
--- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +1 -1
@@ -3078,7 +3078,7 @@ static int gfx_v12_0_kgq_init_queue(strumemcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; - *ring->wptr_cpu_addr =0 ; +atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );amdgpu_ring_clear_ring (ring); }
Greg Kroah-Hartman
maintainerPATCH 112/122 drm/amdgpu/gfx12: adjust KGQ reset sequence
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit dfd64f6e8cd7b59238cdaf8af7a55711f13a89db upstream.
Kernel gfx queues do not need to be reinitialized or remapped after a reset. Align with gfx11.
v2: preserve init and remap for MMIO case.
--- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +13 -10
@@ -5296,11 +5296,12 @@ static int gfx_v12_0_reset_kgq(struct am struct amdgpu_fence *timedout_fence) {struct amdgpu_device *adev = ring->adev; +bool use_mmio = false;int r;amdgpu_ring_reset_helper_begin (ring, timedout_fence); - r =amdgpu_mes_reset_legacy_queue (ring->adev, ring, vmid, false); + r =amdgpu_mes_reset_legacy_queue (ring->adev, ring, vmid, use_mmio);if (r) {dev_warn (adev->dev,"reset via MES failed and try pipe reset %d\n" , r); r =gfx_v12_reset_gfx_pipe (ring);
@@ -5308,16 +5309,18 @@ static int gfx_v12_0_reset_kgq(struct amreturn r; } - r =gfx_v12_0_kgq_init_queue (ring, true); -if (r) { -dev_err (adev->dev,"failed to init kgq\n" ); -return r; - } +if (use_mmio) { + r =gfx_v12_0_kgq_init_queue (ring, true); +if (r) { +dev_err (adev->dev,"failed to init kgq\n" ); +return r; + } - r =amdgpu_mes_map_legacy_queue (adev, ring); -if (r) { -dev_err (adev->dev,"failed to remap kgq\n" ); -return r; + r =amdgpu_mes_map_legacy_queue (adev, ring); +if (r) { +dev_err (adev->dev,"failed to remap kgq\n" ); +return r; + } }return amdgpu_ring_reset_helper_end (ring, timedout_fence);
Greg Kroah-Hartman
maintainerPATCH 113/122 drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Doron <[email protected]>
commit 8b1ecc9377bc641533cd9e76dfa3aee3cd04a007 upstream.
On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and ih2 interrupt ring buffers are not initialized. This is by design, as these secondary IH rings are only available on discrete GPUs. See vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when AMD_IS_APU is set.
However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to get the timestamp of the last interrupt entry. When retry faults are enabled on APUs (noretry=0), this function is called from the SVM page fault recovery path, resulting in a NULL pointer dereference when amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[].
The crash manifests as:
BUG: kernel NULL pointer dereference, address: 0000000000000004 RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu] Call Trace: amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu] svm_range_restore_pages+0xae5/0x11c0 [amdgpu] amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu] gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu] amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu] amdgpu_ih_process+0x84/0x100 [amdgpu]
This issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1") which changed the default for Renoir APU from noretry=1 to noretry=0, enabling retry fault handling and thus exercising the buggy code path.
Fix this by adding a check for ih1.ring_size before attempting to use it. Also restore the soft_ih support from commit dd299441654f ("drm/amdgpu:
Rework retry fault removal"). This is needed if the hardware doesn't support secondary HW IH rings.
v2: additional updates (Alex)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +6 -1
@@ -498,8 +498,13 @@ void amdgpu_gmc_filter_faults_remove(strif (adev->irq.retry_cam_enabled)return ; +else if (adev->irq.ih1.ring_size) + ih = &adev->irq.ih1; +else if (adev->irq.ih_soft.enabled) + ih = &adev->irq.ih_soft; +else +return ; - ih = &adev->irq.ih1;/* Get the WPTR of the last entry in IH ring */ last_wptr =amdgpu_ih_get_wptr (adev, ih);/* Order wptr with ring data. */
Greg Kroah-Hartman
maintainerPATCH 114/122 drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b1defcdc4457649db236415ee618a7151e28788c upstream.
The EXEC_COUNT field must be > 0. In the gfx shadow handling we always emit a cond_exec packet after the gfx_shadow packet, but the EXEC_COUNT never gets patched. This leads to a hang when we try and reset queues on gfx11 APUs.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +3 -2
@@ -228,7 +228,7 @@ int amdgpu_ib_schedule(struct amdgpu_rinamdgpu_ring_ib_begin (ring); -if (ring->funcs->emit_gfx_shadow) +if (ring->funcs->emit_gfx_shadow && adev->gfx.cp_gfx_shadow)amdgpu_ring_emit_gfx_shadow (ring, shadow_va, csa_va, gds_va, init_shadow, vmid);
@@ -284,7 +284,8 @@ int amdgpu_ib_schedule(struct amdgpu_rin fence_flags | AMDGPU_FENCE_FLAG_64BIT); } -if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec) { +if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec && + adev->gfx.cp_gfx_shadow) {amdgpu_ring_emit_gfx_shadow (ring,0 ,0 ,0 , false,0 );amdgpu_ring_init_cond_exec (ring, ring->cond_exe_gpu_addr); }
Greg Kroah-Hartman
maintainerPATCH 115/122 iommu/tegra241-cmdqv: Reset VCMDQ in tegra241_vcmdq_hw_init_user()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <[email protected]>
commit 80f1a2c2332fee0edccd006fe87fc8a6db94bab3 upstream.
The Enable bits in CMDQV/VINTF/VCMDQ_CONFIG registers do not actually reset the HW registers. So, the driver explicitly clears all the registers when a VINTF or VCMDQ is being initialized calling its hw_deinit() function.
However, a userspace VCMDQ is not properly reset, unlike an in-kernel VCMDQ getting reset in tegra241_vcmdq_hw_init().
Meanwhile, tegra241_vintf_hw_init() calling tegra241_vintf_hw_deinit() will not deinit any VCMDQ, since there is no userspace VCMDQ mapped to the VINTF at that stage.
Then, this may result in dirty VCMDQ registers, which can fail the VM.
Like tegra241_vcmdq_hw_init(), reset a VCMDQ in tegra241_vcmdq_hw_init() to fix this bug. This is required by a host kernel.
--- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +3 -0
@@ -1078,6 +1078,9 @@ static int tegra241_vcmdq_hw_init_user(struct tegra241_vcmdq *vcmdq) {char header[64 ]; +/* Reset VCMDQ */ +tegra241_vcmdq_hw_deinit (vcmdq); +/* Configure the vcmdq only; User space does the enabling */ writeq_relaxed (vcmdq->cmdq.q.q_base,REG_VCMDQ_PAGE1 (vcmdq,BASE ));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/122 gpiolib: acpi: Fix potential out-of-boundary left shift
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit e64d1cb21a1c6ecd51bc1c94c83f6fc656f7c94d upstream.
GPIO Address Space handler gets a pointer to the in or out value. This value is supposed to be at least 64-bit, but it's not limited to be exactly 64-bit. When ACPI tables are being parsed, for the bigger Connection():s ACPICA creates a Buffer instead of regular Integer object. The Buffer exists as long as Namespace holds the certain Connection(). Hence we can access the necessary bits without worrying. On the other hand, the left shift, used in the code, is limited by 31 (on 32-bit platforms) and otherwise considered to be Undefined Behaviour. Also the code uses only the first 64-bit word for the value, and anything bigger than 63 will be also subject to UB. Fix all this by modifying the code to correctly set or clear the respective bit in the bitmap constructed of 64-bit words.
--- drivers/gpio/gpiolib-acpi-core.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/gpio/gpiolib-acpi-core.c +17 -4
@@ -1104,6 +1104,7 @@ acpi_gpio_adr_space_handler(u32 functionunsigned int pin = agpio->pin_table[i];struct acpi_gpio_connection *conn;struct gpio_desc *desc; +u16 word, shift;bool found;mutex_lock (&achip->conn_lock);
@@ -1158,10 +1159,22 @@ acpi_gpio_adr_space_handler(u32 functionmutex_unlock (&achip->conn_lock); -if (function ==ACPI_WRITE ) -gpiod_set_raw_value_cansleep (desc, !!(*value &BIT_ULL (i))); -else - *value |= (u64 )gpiod_get_raw_value_cansleep (desc) << i; +/* +* For the cases when OperationRegion() consists of more than +* 64 bits calculate the word and bit shift to use that one to +* access the value. +*/ + word = i /64 ; + shift = i %64 ; + +if (function ==ACPI_WRITE ) { +gpiod_set_raw_value_cansleep (desc, value[word] &BIT_ULL (shift)); + }else { +if (gpiod_get_raw_value_cansleep (desc)) + value[word] |=BIT_ULL (shift); +else + value[word] &= ~BIT_ULL (shift); + } } out:
Greg Kroah-Hartman
maintainerPATCH 117/122 libbpf: Fix -Wdiscarded-qualifiers under C23
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
commit d70f79fef65810faf64dbae1f3a1b5623cdb2345 upstream.
glibc ≥ 2.42 (GCC 15) defaults to -std=gnu23, which promotes -Wdiscarded-qualifiers to an error.
In C23, strstr() and strchr() return "const char *".
Change variable types to const char * where the pointers are never modified (res, sym_sfx, next_path).
[ shung-hsi.yu: needed to fix kernel build failure due to libbpf since glibc
2.43+ (which adds 'const' qualifier to strstr) ]
--- tools/lib/bpf/libbpf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
tools/lib/bpf/libbpf.c +4 -3
@@ -8245,7 +8245,7 @@ static int kallsyms_cb(unsigned long lonstruct bpf_object *obj = ctx;const struct btf_type *t;struct extern_desc *ext; -char *res; +const char *res; res =strstr (sym_name,".llvm." );if (sym_type =='d' && res)
@@ -11574,7 +11574,8 @@ static int avail_kallsyms_cb(unsigned lo* * [0] fb6a421fb615 ("kallsyms: Match symbols exactly with CONFIG_LTO_CLANG") */ -char sym_trim[256 ], *psym_trim = sym_trim, *sym_sfx; +char sym_trim[256 ], *psym_trim = sym_trim; +const char *sym_sfx;if (!(sym_sfx =strstr (sym_name,".llvm." )))return 0 ;
@@ -12159,7 +12160,7 @@ static int resolve_full_path(const charif (!search_paths[i])continue ;for (s = search_paths[i]; s !=NULL ; s =strchr (s,':' )) { -char *next_path; +const char *next_path;int seg_len;if (s[0 ] ==':' )
Greg Kroah-Hartman
maintainerPATCH 118/122 Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
commit 6c65db809796717f0a96cf22f80405dbc1a31a4b upstream.
This reverts commit 604826acb3f53c6648a7ee99a3914ead680ab7fb.
Apparently there is more to supporting atomic modesetting than providing atomic_(check|commit) callbacks. Before this revert:
WARNING: [] drivers/gpu/drm/drm_plane.c:389 at .__drm_universal_plane_init+0x13c/0x794 [drm], CPU#1: modprobe/1790
BUG: Kernel NULL pointer dereference on read at 0x00000000 .drm_atomic_get_plane_state+0xd4/0x210 [drm] (unreliable) .drm_client_modeset_commit_atomic+0xf8/0x338 [drm] .drm_client_modeset_commit_locked+0x80/0x260 [drm] .drm_client_modeset_commit+0x40/0x7c [drm] .__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0xfc/0x108 [drm_kms_helper] .drm_fb_helper_set_par+0x8c/0xb8 [drm_kms_helper] .fbcon_init+0x31c/0x618 [...] .__drm_fb_helper_initial_config_and_unlock+0x474/0x7f4 [drm_kms_helper] .drm_fbdev_client_hotplug+0xb0/0x120 [drm_client_lib] .drm_client_register+0x88/0xe4 [drm] .drm_fbdev_client_setup+0x12c/0x19b4 [drm_client_lib] .drm_client_setup+0x15c/0x18c [drm_client_lib] .nouveau_drm_probe+0x19c/0x268 [nouveau]
--- drivers/gpu/drm/nouveau/nouveau_display.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/nouveau/nouveau_display.c +0 -2
@@ -351,8 +351,6 @@ nouveau_user_framebuffer_create(struct dstatic const struct drm_mode_config_funcs nouveau_mode_config_funcs = { .fb_create = nouveau_user_framebuffer_create, - .atomic_commit = drm_atomic_helper_commit, - .atomic_check = drm_atomic_helper_check, };
Greg Kroah-Hartman
maintainerPATCH 119/122 net/sched: act_ife: convert comma to semicolon
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
commit 205305c028ad986d0649b8b100bab6032dcd1bb5 upstream.
Replace comma between expressions with semicolons.
Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended.
Found by inspection.
No functional change intended.
Compile tested only.
--- net/sched/act_ife.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/sched/act_ife.c +3 -3
@@ -649,9 +649,9 @@ static int tcf_ife_dump(struct sk_buff *memset (&opt,0 ,sizeof (opt)); - opt.index = ife->tcf_index, - opt.refcnt =refcount_read (&ife->tcf_refcnt) - ref, - opt.bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, + opt.index = ife->tcf_index; + opt.refcnt =refcount_read (&ife->tcf_refcnt) - ref; + opt.bindcnt =atomic_read (&ife->tcf_bindcnt) - bind;spin_lock_bh (&ife->tcf_lock); opt.action = ife->tcf_action;
Greg Kroah-Hartman
maintainerPATCH 120/122 sched_ext: Dont kick CPUs running higher classes
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit a9c1fbbd6dadbaa38c157a07d5d11005460b86b9 upstream.
When a sched_ext scheduler tries to kick a CPU, the CPU may be running a higher class task. sched_ext has no control over such CPUs. A sched_ext scheduler couldn't have expected to get access to the CPU after kicking it anyway. Skip kicking when the target CPU is running a higher class.
--- kernel/sched/ext.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
kernel/sched/ext.c +8 -3
@@ -5164,18 +5164,23 @@ static bool kick_one_cpu(s32 cpu, struct {struct rq *rq =cpu_rq (cpu);struct scx_rq *this_scx = &this_rq->scx; +const struct sched_class *cur_class;bool should_wait = false;unsigned long flags;raw_spin_rq_lock_irqsave (rq, flags); + cur_class = rq->curr->sched_class;/* * During CPU hotplug, a CPU may depend on kicking itself to make -* forward progress. Allow kicking self regardless of online state. +* forward progress. Allow kicking self regardless of online state. If +* @cpu is running a higher class task, we have no control over @cpu. +* Skip kicking. */ -if (cpu_online (cpu) || cpu ==cpu_of (this_rq)) { +if ((cpu_online (cpu) || cpu ==cpu_of (this_rq)) && + !sched_class_above (cur_class, &ext_sched_class)) {if (cpumask_test_cpu (cpu, this_scx->cpus_to_preempt)) { -if (rq->curr->sched_class == &ext_sched_class) +if (cur_class == &ext_sched_class) rq->curr->scx.slice =0 ;cpumask_clear_cpu (cpu, this_scx->cpus_to_preempt); }
Greg Kroah-Hartman
maintainerPATCH 121/122 sched_ext: Fix SCX_KICK_WAIT to work reliably
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit a379fa1e2cae15d7422b4eead83a6366f2f445cb upstream.
SCX_KICK_WAIT is used to synchronously wait for the target CPU to complete a reschedule and can be used to implement operations like core scheduling.
This used to be implemented by scx_next_task_picked() incrementing pnt_seq, which was always called when a CPU picks the next task to run, allowing SCX_KICK_WAIT to reliably wait for the target CPU to enter the scheduler and pick the next task.
However, commit b999e365c298 ("sched_ext: Replace scx_next_task_picked() with switch_class()") replaced scx_next_task_picked() with the switch_class() callback, which is only called when switching between sched classes. This broke SCX_KICK_WAIT because pnt_seq would no longer be reliably incremented unless the previous task was SCX and the next task was not.
This fix leverages commit 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") which refactored the pick path making put_prev_task_scx() the natural place to track task switches for SCX_KICK_WAIT. The fix moves pnt_seq increment to put_prev_task_scx() and also increments it in pick_task_scx() to handle cases where the same task is re-selected, whether by BPF scheduler decision or slice refill. The semantics: If the current task on the target CPU is SCX, SCX_KICK_WAIT waits until the CPU enters the scheduling path. This provides sufficient guarantee for use cases like core scheduling while keeping the operation self-contained within SCX.
v2: - Also increment pnt_seq in pick_task_scx() to handle same-task
re-selection (Andrea Righi).
- Use smp_cond_load_acquire() for the busy-wait loop for better architecture optimization (Peter Zijlstra).
--- kernel/sched/ext.c | 46 ++++++++++++++++++++++++-------------------- kernel/sched/ext_internal.h | 6 +++-- 2 files changed, 30 insertions(+), 22 deletions(-)
kernel/sched/ext.c +26 -20
@@ -2306,12 +2306,6 @@ static void switch_class(struct rq *rq,struct scx_sched *sch = scx_root;const struct sched_class *next_class = next->sched_class; -/* -* Pairs with the smp_load_acquire() issued by a CPU in -* kick_cpus_irq_workfn() who is waiting for this CPU to perform a -* resched. -*/ -smp_store_release (&rq->scx.pnt_seq, rq->scx.pnt_seq +1 );if (!(sch->ops.flags &SCX_OPS_HAS_CPU_PREEMPT ))return ;
@@ -2351,6 +2345,10 @@ static void put_prev_task_scx(struct rq struct task_struct *next) {struct scx_sched *sch = scx_root; + +/* see kick_cpus_irq_workfn() */ +smp_store_release (&rq->scx.pnt_seq, rq->scx.pnt_seq +1 ); +update_curr_scx (rq);/* see dequeue_task_scx() on why we skip when !QUEUED */
@@ -2404,6 +2402,9 @@ static struct task_struct *pick_task_scxbool keep_prev = rq->scx.flags &SCX_RQ_BAL_KEEP ;bool kick_idle = false; +/* see kick_cpus_irq_workfn() */ +smp_store_release (&rq->scx.pnt_seq, rq->scx.pnt_seq +1 ); +/* * WORKAROUND: *
@@ -5186,8 +5187,12 @@ static bool kick_one_cpu(s32 cpu, struct }if (cpumask_test_cpu (cpu, this_scx->cpus_to_wait)) { - pseqs[cpu] = rq->scx.pnt_seq; - should_wait = true; +if (cur_class == &ext_sched_class) { + pseqs[cpu] = rq->scx.pnt_seq; + should_wait = true; + }else { +cpumask_clear_cpu (cpu, this_scx->cpus_to_wait); + } }resched_curr (rq);
@@ -5248,18 +5253,19 @@ static void kick_cpus_irq_workfn(structfor_each_cpu (cpu, this_scx->cpus_to_wait) {unsigned long *wait_pnt_seq = &cpu_rq (cpu)->scx.pnt_seq; -if (cpu !=cpu_of (this_rq)) { -/* -* Pairs with smp_store_release() issued by this CPU in -* switch_class() on the resched path. -* -* We busy-wait here to guarantee that no other task can -* be scheduled on our core before the target CPU has -* entered the resched path. -*/ -while (smp_load_acquire (wait_pnt_seq) == pseqs[cpu]) -cpu_relax (); - } +/* +* Busy-wait until the task running at the time of kicking is no +* longer running. This can be used to implement e.g. core +* scheduling. +* +* smp_cond_load_acquire() pairs with store_releases in +* pick_task_scx() and put_prev_task_scx(). The former breaks +* the wait if SCX's scheduling path is entered even if the same +* task is picked subsequently. The latter is necessary to break +* the wait when $cpu is taken by a higher sched class. +*/ +if (cpu !=cpu_of (this_rq)) +smp_cond_load_acquire (wait_pnt_seq,VAL != pseqs[cpu]);cpumask_clear_cpu (cpu, this_scx->cpus_to_wait); }
kernel/sched/ext_internal.h +4 -2
@@ -986,8 +986,10 @@ enum scx_kick_flags {SCX_KICK_PREEMPT =1LLU <<1 ,/* -* Wait for the CPU to be rescheduled. The scx_bpf_kick_cpu() call will -* return after the target CPU finishes picking the next task. +* The scx_bpf_kick_cpu() call will return after the current SCX task of +* the target CPU switches out. This can be used to implement e.g. core +* scheduling. This has no effect if the current task on the target CPU +* is not on SCX. */ SCX_KICK_WAIT = 1LLU << 2, };
Greg Kroah-Hartman
maintainerPATCH 122/122 mptcp: avoid dup SUB_CLOSED events after disconnect
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
[ Upstream commit 280d654324e33f8e6e3641f76764694c7b64c5db ]
In case of subflow disconnect(), which can also happen with the first subflow in case of errors like timeout or reset, mptcp_subflow_ctx_reset will reset most fields from the mptcp_subflow_context structure, including close_event_done. Then, when another subflow is closed, yet another SUB_CLOSED event for the disconnected initial subflow is sent. Because of the previous reset, there are no source address and destination port.
A solution is then to also check the subflow's local id: it shouldn't be negative anyway.
Another solution would be not to reset subflow->close_event_done at disconnect time, but when reused. But then, probably the whole reset could be done when being reused. Let's not change this logic, similar to TCP with tcp_disconnect().
--- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mptcp/protocol.c +2 -2
@@ -2534,8 +2534,8 @@ out:void mptcp_close_ssk (struct sock *sk,struct sock *ssk,struct mptcp_subflow_context *subflow) { -/* The first subflow can already be closed and still in the list */ -if (subflow->close_event_done) +/* The first subflow can already be closed or disconnected */ +if (subflow->close_event_done ||READ_ONCE (subflow->local_id) <0 )return ; subflow->close_event_done = true;
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
Thanks! Build-tested on all Alpine architectures & boot-tested on x86_64.
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.18.9-rc1-gcc6f56fd087b #1 SMP PREEMPT_DYNAMIC Wed Feb 4 19:43:37 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.18:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
133 tests: 133 pass, 0 failLinux version: 6.18.9-rc1-gcc6f56fd087b
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.
Hi Greg
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
6.18.9-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.18.9-rc1rv-gcc6f56fd087b
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 15.2.1 20260103, GNU ld (GNU Binutils) 2.45.1) #1 SMP PREEMPT_DYNAMIC Thu Feb 5 07:21:27 JST 2026
Thanks
Am 04.02.2026 um 15:39 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
AMD Ryzen 5 5600 6-Core Processor:
https://www.inet.se/produkt/5304697/amd-ryzen-5-5600-3-5-ghz-35mb on a
https://www.gigabyte.com/Motherboard/B550-AORUS-ELITE-V2-rev-12
https://www.inet.se/produkt/1903406/gigabyte-b550-aorus-elite-v2
motherboard :)
running Arch Linux with the testing repos enabled:
https://archlinux.org/ https://archboot.com/
https://wiki.archlinux.org/title/Arch_Testing_Team
Den ons 4 feb. 2026 kl 16:38 skrev Greg Kroah-Hartman <[email protected]>:
Quoted 533 lines
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 6.18.9-rc1Matthieu Baerts (NGI0) <[email protected]>
mptcp: avoid dupSUB_CLOSEDevents after disconnectTejun Heo <[email protected]>
sched_ext: FixSCX_KICK_WAITto work reliablyTejun Heo <[email protected]>
sched_ext: Don't kick CPUs running higher classesChen Ni <[email protected]>
net/sched:act_ife: convert comma to semicolonJohn Ogness <[email protected]>
Revert "drm/nouveau/disp: Setdrm_mode_config_funcs.atomic_(check|commit)"Mikhail Gavrilov <[email protected]>
libbpf: Fix -Wdiscarded-qualifiers under C23Andy Shevchenko <[email protected]>
gpiolib: acpi: Fix potential out-of-boundary left shiftNicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Reset VCMDQ integra241_vcmdq_hw_init_user()Alex Deucher <[email protected]>
drm/amdgpu: Fixcond_exechandling inamdgpu_ib_schedule()Jon Doron <[email protected]>
drm/amdgpu: fix NULL pointer dereference inamdgpu_gmc_filter_faults_removeAlex Deucher <[email protected]>
drm/amdgpu/gfx12: adjust KGQ reset sequenceAlex Deucher <[email protected]>
drm/amdgpu/gfx12: fix wptr reset in KGQ initAlex Deucher <[email protected]>
drm/amdgpu/gfx11: adjust KGQ reset sequenceAlex Deucher <[email protected]>
drm/amdgpu/gfx11: fix wptr reset in KGQ initAlex Deucher <[email protected]>
drm/amdgpu/gfx10: fix wptr reset in KGQ initAlex Deucher <[email protected]>
drm/amdgpu/soc21: fix xclk for APUsYang Wang <[email protected]>
drm/amd/pm: fix smu v14 soft clock frequency setting issueYang Wang <[email protected]>
drm/amd/pm: fix smu v13 soft clock frequency setting issueJohan Hovold <[email protected]>
drm/imx/tve: fix probe device leakJohan Hovold <[email protected]>
drm/msm/a6xx: fix bogus hwcg register updatesMiguel Ojeda <[email protected]>
drm/tyr: depend onCOMMON_CLKto fix build errorTvrtko Ursulin <[email protected]>
drm/xe/xelp: Fix Wa_18022495364Tvrtko Ursulin <[email protected]>
drm: Do not allow userspace to trigger kernel warnings indrm_gem_change_handle_ioctl()Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: Add compiler_builtins -> core depSeungJong Ha <[email protected]>
scripts:generate_rust_analyzer: fix resolution of #[pin_data] macrosTamir Duberstein <[email protected]>
scripts:generate_rust_analyzer: compile sysroot with correct editionOnur Özkan <[email protected]>
scripts:generate_rust_analyzer: remove sysroot assertionTamir Duberstein <[email protected]>
scripts:generate_rust_analyzer: Addpin_init_internaldepsTamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: Add pin_init -> compiler_builtins depAlexandre Courbot <[email protected]>
rust: sync: refcount: always inline functions usingbuild_assertwith argumentsMiguel Ojeda <[email protected]>
rust: sync: atomic: Provide stub forrusttest32-bit hostsAlexandre Courbot <[email protected]>
rust: bits: always inline functions usingbuild_assertwith argumentsJibin Zhang <[email protected]>
net: fix segmentation of forwarding fraglist GROKairui Song <[email protected]>
mm/shmem, swap: fix race of truncate and swap entry splitJane Chu <[email protected]>
mm/memory-failure: teachkill_accessing_processto accept hugetlb tail page pfnrobin.kuo <[email protected]>
mm, swap: restoreswap_spaceattr aviod kernel panicJane Chu <[email protected]>
mm/memory-failure: fix missing ->mf_stats count in hugetlb poisonPimyn Girgis <[email protected]>
mm/kfence: randomize the freelist on initializationQu Wenruo <[email protected]>
btrfs: do not strictly require dirty metadata threshold for metadata writepagesJan Kara <[email protected]>
flex_proportions: makefprop_new_period()hardirq safeMatthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: fix local endp not being trackedMatthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: check subflow errors in close eventsMatthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: check no dup close events after errorMatthieu Baerts (NGI0) <[email protected]>
mptcp: only reset subflow errors when propagatedAndrey Ryabinin <[email protected]>
mm/kasan: fix KASAN poisoning invrealloc()Robin Murphy <[email protected]>
gpio: rockchip: Stop calling pinctrl forset_directionZhang Heng <[email protected]>
ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machineMing Lei <[email protected]>
nvmet: fix race innvmet_bio_done()leading to NULL pointer dereferenceKohei Enju <[email protected]>
efivarfs: fix error propagation inefivar_entry_get()Thomas Fourier <[email protected]>
scsi: qla2xxx: edif: Fixdma_free_coherent()sizeChen Miao <[email protected]>
kbuild: rust: cleanlibpin_init_internalin mrproperMartin Larsson <[email protected]>
gpio: pca953x: mask interrupts in irq shutdownZhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCOHaoxiang Li <[email protected]>
scsi: be2iscsi: Fix a memory leak inbeiscsi_boot_get_sinfo()Fabio Estevam <[email protected]>
ASoC: fsl: imx-card: Do not force slot width to sample widthMiguel Ojeda <[email protected]>
rust: kbuild: give--config-pathtorustfmtin.rsitargetHang Shu <[email protected]>
rust: rbtree: fix documentation typo in CursorMutpeek_nextmethodHan Gao <[email protected]>
riscv: compat: fixCOMPAT_UTS_MACHINEdefinitionTakashi Sakamoto <[email protected]>
firewire: core: fix race condition against transaction listSteven Rostedt <[email protected]>
perf: sched: Fix perf crash with newis_user_task()helperKrzysztof Kozlowski <[email protected]>
pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pinsBartosz Golaszewski <[email protected]>
pinctrl: meson: mark the GPIO controller as sleepingBartosz Golaszewski <[email protected]>
pinctrl: lpass-lpi: implement .get_direction() for the GPIO driverLaveesh Bansal <[email protected]>
writeback: fix 100% CPU usage whendirtytime_expire_intervalis 0Peter Zijlstra <[email protected]>
sched/deadline: Fix 'stuck'dl_serverPeter Zijlstra <[email protected]>
sched/deadline: Documentdl_serverShuicheng Lin <[email protected]>
drm/xe/nvm: Fix double-free on aux add failureShuicheng Lin <[email protected]>
drm/xe/nvm: Manage nvm aux cleanup with devresShuicheng Lin <[email protected]>
drm/xe/configfs: Fixis_bound()pci_devlifetimeSai Sree Kartheek Adivi <[email protected]>
dma/pool: distinguish between missing and exhausted atomic poolsShida Zhang <[email protected]>
bcache: fix I/O accounting leak indetached_dev_do_requestShida Zhang <[email protected]>
bcache: use bio cloning for detached device requestsShida Zhang <[email protected]>
bcache: fix improper use ofbi_end_ioOreoluwa Babatunde <[email protected]>
of:reserved_mem: Allowreserved_memframework detect "cma=" kernel paramYuntao Wang <[email protected]>
of/reserved_mem: Simplify the logic offdt_scan_reserved_mem_reg_nodes()Ethan Zuo <[email protected]>
kbuild: Fix permissions of modules.builtin.modinfoNathan Chancellor <[email protected]>
kbuild: rpm-pkg: Generate debuginfo package manuallyDoug Berger <[email protected]>
gpio: brcmstb: correct hwirq to bank mapYang Wang <[email protected]>
drm/amd/pm: fix race in power state check before mutex lockYuhao Huang <[email protected]>
gpio: virtuser: fix UAF in configfs release pathDenis Sergeev <[email protected]>
gpiolib: acpi: useBIT_ULL()for u64 mask in address space handlerTagir Garaev <[email protected]>
ASoC: Intel:sof_es8336: fix headphone GPIO logic inversionShuicheng Lin <[email protected]>
drm/xe: Skip address copy for sync-only execsBard Liao <[email protected]>
ASoC: soc-acpi-intel-ptl-match: fixname_prefixof rt1320-2Kery Qi <[email protected]>
scsi: firewire: sbp-target: Fix overflow insbp_make_tpg()Benjamin Berg <[email protected]>
wifi: mac80211: correctly decode TTLM with default link mapBenjamin Berg <[email protected]>
wifi: mac80211: apply advertised TTLM from association responseBenjamin Berg <[email protected]>
wifi: mac80211: parse all TTLM entriesJianbo Liu <[email protected]>
net/mlx5e: Skip ESN replay window setup for IPsec crypto offloadParav Pandit <[email protected]>
net/mlx5: Fixvhca_idaccess call trace use before allocCosmin Ratiu <[email protected]>
net/mlx5: Initialize events outside devlink lockShay Drory <[email protected]>
net/mlx5: fs, Fix inverted cap check in tx flow table root disconnectWei Fang <[email protected]>
net: phy: micrel: fix clk warning when removing the driverDaniel Zahka <[email protected]>
net/mlx5e: don't assume psp tx skbs are ipv6 csum handlingMartin Kaiser <[email protected]>
net: bridge: fix static key checkKuniyuki Iwashima <[email protected]>
nfc: nci: Fix race between rfkill andnci_unregister_device().Gal Pressman <[email protected]>
net/mlx5e: Account for netdev stats inndo_get_stats64Mark Bloch <[email protected]>
net/mlx5e: TC, delete flows only for existing peersJesse Brandeburg <[email protected]>
ice: stop counting UDP csum mismatch asrx_errorsAaron Ma <[email protected]>
ice: Fix NULL pointer dereference inice_vsi_set_napi_queuesKohei Enju <[email protected]>
ixgbe: don't initialize aci lock inixgbe_recovery_probe()Kohei Enju <[email protected]>
ixgbe: fix memory leaks in theixgbe_recovery_probe()pathNikolay Aleksandrov <[email protected]>
bonding: fix use-after-free due to enslave fail after slave array updateKuniyuki Iwashima <[email protected]>
nfc: llcp: Fix memleak innfc_llcp_send_ui_frame().Vivian Wang <[email protected]>
net: spacemit: Check fornetif_carrier_ok()inemac_stats_update()Eric Dumazet <[email protected]>
mptcp: fix race inmptcp_pm_nl_flush_addrs_doit()Kery Qi <[email protected]>
rocker: fix memory leak inrocker_world_port_post_fini()Zeng Chi <[email protected]>
net/mlx5: Fix return type mismatch inmlx5_esw_vport_vhca_id()Kery Qi <[email protected]>
net: wwan: t7xx: fix potential skb->frags overflow in RX pathFernando Fernandez Mancera <[email protected]>
ipv6: use the right ifindex when replying to icmpv6 from localhostZilin Guan <[email protected]>
net: mvpp2: cls: Fix memory leak inmvpp2_ethtool_cls_rule_ins()Edward Cree <[email protected]>
sfc: fix deadlock in RSS config readEric Dumazet <[email protected]>
bonding: annotate data-races around slave->last_rxZilin Guan <[email protected]>
octeon_ep: Fix memory leak inoctep_device_setup()Justin Chen <[email protected]>
net: bcmasp: fix early exit leak with fixed phyMarc Kleine-Budde <[email protected]>
can:gs_usb:gs_usb_receive_bulk_callback(): fix error messageZilin Guan <[email protected]>
net/mlx5: Fix memory leak inesw_acl_ingress_lgcy_setup()Jianpeng Chang <[email protected]>
Bluetooth: MGMT: Fix memory leak inset_ssp_completeJia-Hong Su <[email protected]>
Bluetooth:hci_uart: fix null-ptr-deref inhci_uart_write_workZilin Guan <[email protected]>
can:at91_can: Fix memory leak inat91_can_probe()Qu Wenruo <[email protected]>
btrfs: zlib: fix the folio leak on S390 hardware accelerationAmir Goldstein <[email protected]>
readdir: require opt-in ford_typeflags-------------
Diffstat:
Makefile | 7 +- arch/arm64/configs/defconfig | 1 - arch/riscv/include/asm/compat.h | 2 +- drivers/bluetooth/hci_ldisc.c | 4 +- drivers/firewire/core-transaction.c | 19 +- drivers/gpio/gpio-brcmstb.c | 8 +- drivers/gpio/gpio-pca953x.c | 2 + drivers/gpio/gpio-rockchip.c | 8 - drivers/gpio/gpio-virtuser.c | 8 +- drivers/gpio/gpiolib-acpi-core.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 25 +-- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 25 +-- drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 1 + drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 1 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 + drivers/gpu/drm/drm_gem.c | 18 +- drivers/gpu/drm/imx/ipuv3/imx-tve.c | 13 ++ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 - drivers/gpu/drm/nouveau/nouveau_display.c | 2 - drivers/gpu/drm/tyr/Kconfig | 1 + drivers/gpu/drm/xe/xe_configfs.c | 3 +- drivers/gpu/drm/xe/xe_device.c | 2 - drivers/gpu/drm/xe/xe_exec.c | 6 +- drivers/gpu/drm/xe/xe_lrc.c | 2 +- drivers/gpu/drm/xe/xe_nvm.c | 55 +++--- drivers/gpu/drm/xe/xe_nvm.h | 2 - drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 3 + drivers/md/bcache/bcache.h | 9 + drivers/md/bcache/request.c | 82 ++++---- drivers/md/bcache/super.c | 12 +- drivers/net/bonding/bond_main.c | 28 +-- drivers/net/bonding/bond_options.c | 8 +- drivers/net/can/at91_can.c | 2 +- drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 5 +- drivers/net/ethernet/intel/ice/ice_lib.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 1 - drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 26 +-- drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 16 ++ .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 +- .../mellanox/mlx5/core/en_accel/psp_rxtx.c | 17 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 20 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +- .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 36 ++-- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + drivers/net/ethernet/rocker/rocker_main.c | 5 +- drivers/net/ethernet/sfc/mcdi_filters.c | 7 +- drivers/net/ethernet/spacemit/k1_emac.c | 34 +++- drivers/net/phy/micrel.c | 17 +- drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 9 +- drivers/nvme/target/io-cmd-bdev.c | 3 +- drivers/of/of_reserved_mem.c | 44 +++-- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 9 +- drivers/pinctrl/qcom/Kconfig | 15 +- drivers/pinctrl/qcom/Makefile | 1 - drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 ++ drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c | 3 + drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c | 151 -------------- drivers/scsi/be2iscsi/be_mgmt.c | 1 + drivers/scsi/qla2xxx/qla_os.c | 2 +- drivers/target/sbp/sbp_target.c | 4 +- fs/btrfs/disk-io.c | 22 --- fs/btrfs/extent_io.c | 3 +- fs/btrfs/extent_io.h | 3 +- fs/btrfs/zlib.c | 1 + fs/efivarfs/vars.c | 2 +- fs/fs-writeback.c | 14 +- fs/readdir.c | 3 + include/linux/cma.h | 9 + include/linux/fs.h | 6 +- include/linux/kasan.h | 14 ++ include/linux/sched.h | 5 + include/net/bonding.h | 13 +- include/net/nfc/nfc.h | 2 + kernel/dma/contiguous.c | 16 +- kernel/dma/pool.c | 7 +- kernel/events/callchain.c | 2 +- kernel/events/core.c | 6 +- kernel/sched/deadline.c | 206 +++++++++++++++++++ kernel/sched/ext.c | 57 +++--- kernel/sched/ext_internal.h | 6 +- lib/flex_proportions.c | 5 +- mm/kasan/common.c | 21 ++ mm/kfence/core.c | 23 ++- mm/memory-failure.c | 99 ++++++---- mm/shmem.c | 45 +++-- mm/swap.h | 2 +- mm/swap_state.c | 3 +- mm/vmalloc.c | 7 +- net/bluetooth/mgmt.c | 3 + net/bridge/br_input.c | 2 +- net/core/filter.c | 2 + net/ipv4/tcp_offload.c | 3 +- net/ipv4/udp_offload.c | 3 +- net/ipv6/icmp.c | 4 +- net/ipv6/tcpv6_offload.c | 3 +- net/mac80211/ieee80211_i.h | 2 - net/mac80211/mlme.c | 217 ++++++++++++--------- net/mptcp/pm_kernel.c | 16 +- net/mptcp/protocol.c | 13 +- net/nfc/core.c | 27 ++- net/nfc/llcp_commands.c | 17 +- net/nfc/llcp_core.c | 4 +- net/nfc/nci/core.c | 4 +- net/sched/act_ife.c | 6 +- rust/kernel/bits.rs | 6 +- rust/kernel/rbtree.rs | 2 +- rust/kernel/sync/atomic/predefine.rs | 11 ++ rust/kernel/sync/refcount.rs | 3 +- scripts/Makefile.build | 2 +- scripts/Makefile.vmlinux | 3 +- scripts/generate_rust_analyzer.py | 40 +++- scripts/package/kernel.spec | 65 +++--- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 8 + sound/soc/fsl/imx-card.c | 1 - sound/soc/intel/boards/sof_es8336.c | 2 +- sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 2 +- tools/lib/bpf/libbpf.c | 7 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 81 +++++++- 133 files changed, 1285 insertions(+), 784 deletions(-)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
Builds successfully. Boots and works on qemu and Intel Core i7-10810U
Thanks,
Brett
The kernel, bpf tool, perf tool, and kselftest builds fine for v6.18.9-rc1 on x86 and arm64 Azure VM.
Thanks,
Hardik
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
Tested on two amd64 systems, a Lenovo ThinkPad T14 Gen 1 and a DIY home NAS. Working well, no regressions observed.
Signature · 1 line
-Barry K. Nathan <[email protected]>
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
test_progs, test_progs-no_alu32, test_progs-cpuv4, test_maps, test_verifier in BPF selftests all passes[1] on x86_64.
1: https://github.com/shunghsiyu/libbpf/actions/runs/21724288947/job/62662113823
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.9-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.
Quoted 5 lines
thanks,
greg k-h
-------------
build and boot report for Linux 6.18.9-rc1.
The kernel was built and booted successfull on both arm64 and x86_64 architectures using the defconfig. Testing was performed in virtual environments,
and the system ran as expected.
No dmesg regressions were found during testing.
Build details:
Architectures: arm64, x86_64
Kernel version: 6.18.9
Configuration: defconfig
Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 28a73c31d7f5d9d2276c92e1d4891c18a5631e6e
Quoted 8 lines · On Wed, 04 Feb 2026 15:39:42 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.18.9 release. There are 122 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:
Thanks!
Cheers,
Miguel
Build error related
screenshot below.
--------------------<screenshot>-----------------------
$make -j 4
DESCEND objtool
DESCEND bpf/resolve_btfids
INSTALL libsubcmd_headers
INSTALL libbpf_headers
INSTALL libsubcmd_headers
make[5]: *** No rule to make target 'str_error.h', needed by '/home/jeffrin/kernel/linux-stable-rc/tools/bpf/resolve_btfids/libbpf/staticobjs/libbpf.o'. Stop.
make[4]: *** [Makefile:152:/home/jeffrin/kernel/linux-stable-rc/tools/bpf/resolve_btfids/libbpf/staticobjs/libbpf-in.o] Error 2
make[3]: *** [Makefile:61:/home/jeffrin/kernel/linux-stable-rc/tools/bpf/resolve_btfids//libbpf/libbpf.a] Error 2
make[2]: *** [Makefile:76: bpf/resolve_btfids] Error 2
make[1]: *** [/home/jeffrin/kernel/linux-stable-rc/Makefile:1449:tools/bpf/resolve_btfids] Error 2
make[1]: *** Waiting for unfinished jobs....
CALL scripts/checksyscalls.sh
make: *** [Makefile:248: __sub-make] Error 2 -----------------------<screenshot>---------------------------
--
software engineer
rajagiri school of engineering and technology
Greg Kroah-Hartman
maintainerQuoted 19 lines · Jeffrin Thalakkottoor
Build error related
screenshot below.--------------------<screenshot>-----------------------
$make -j 4
DESCEND objtool
DESCEND bpf/resolve_btfids
INSTALLlibsubcmd_headers
INSTALLlibbpf_headers
INSTALLlibsubcmd_headers
make[5]: *** No rule to make target 'str_error.h', needed by '/home/jeffrin/kernel/linux-stable-rc/tools/bpf/resolve_btfids/libbpf/staticobjs/libbpf.o'. Stop.
make[4]: *** [Makefile:152:/home/jeffrin/kernel/linux-stable-rc/tools/bpf/resolve_btfids/libbpf/staticobjs/libbpf-in.o] Error 2
make[3]: *** [Makefile:61:/home/jeffrin/kernel/linux-stable-rc/tools/bpf/resolve_btfids//libbpf/libbpf.a]
Quoted 8 lines
Error 2
make[2]: *** [Makefile:76: bpf/resolve_btfids] Error 2 make[1]: *** [/home/jeffrin/kernel/linux-stable-rc/Makefile:1449:tools/bpf/resolve_btfids] Error 2
make[1]: *** Waiting for unfinished jobs....
CALLscripts/checksyscalls.sh
make: *** [Makefile:248: __sub-make] Error 2 -----------------------<screenshot>---------------------------
What .config causes this?
thanks,
greg k-h