5.15.199-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.15.199-rc1 review
This is the start of the stable review cycle for the 5.15.199 release. There are 206 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.199-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.199-rc1
Edward Adam Davis <[email protected]>
wifi: cfg80211: init wiphy_work before allocating rfkill fails
Johannes Berg <[email protected]>
wifi: cfg80211: fully move wiphy work to unbound workqueue
Miri Korenblit <[email protected]>
wifi: cfg80211: cancel wiphy_work before freeing wiphy
Johannes Berg <[email protected]>
wifi: cfg80211: fix wiphy delayed work queueing
Johannes Berg <[email protected]>
wifi: cfg80211: use system_unbound_wq for wiphy work
Nikola Z. Ivanov <[email protected]>
team: Move team device type change at the end of team_port_add
Bartosz Golaszewski <[email protected]>
pinctrl: meson: mark the GPIO controller as sleeping
Matthieu Baerts (NGI0) <[email protected]>
mptcp: avoid dup SUB_CLOSED events after disconnect
Laveesh Bansal <[email protected]>
writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
Johan Hovold <[email protected]>
drm/imx/tve: fix probe device leak
Bartosz Golaszewski <[email protected]>
pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
Pimyn Girgis <[email protected]>
mm/kfence: randomize the freelist on initialization
Chen Ni <[email protected]>
net/sched: act_ife: convert comma to semicolon
JP Kobryn <[email protected]>
btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate()
Haoxiang Li <[email protected]>
drm/amdkfd: fix a memory leak in device_queue_manager_init()
Marc Kleine-Budde <[email protected]>
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
Gyeyoung Baek <[email protected]>
genirq/irq_sim: Initialize work context pointers properly
Henry Martin <[email protected]>
HID: uclogic: Add NULL check in uclogic_input_configured()
Rahul Rameshbabu <[email protected]>
HID: uclogic: Correct devm device reference for hidinput input_dev name
Johannes Berg <[email protected]>
wifi: mac80211: move TDLS work to wiphy work
Johannes Berg <[email protected]>
wifi: mac80211: use wiphy work for sdata->work
Johannes Berg <[email protected]>
wifi: cfg80211: add a work abstraction with special semantics
Ying Hsu <[email protected]>
Bluetooth: Fix hci_suspend_sync crash
Alexis Lothoré <[email protected]>
net: stmmac: make sure that ptp_rate is not 0 before configuring EST
Zqiang <[email protected]>
usbnet: Fix using smp_processor_id() in preemptible code warnings
Maninder Singh <[email protected]>
NFSD: fix race between nfsd registration and exports_proc
Luís Henriques <[email protected]>
ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}Sabrina Dubroca <[email protected]>
espintcp: fix skb leaks
Waiman Long <[email protected]>
blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
Bartlomiej Kubik <[email protected]>
fs/ntfs3: Initialize allocated memory before use
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
Gaosheng Cui <[email protected]>
drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED
Pedro Demarchi Gomes <[email protected]>
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
David Hildenbrand <[email protected]>
mm/pagewalk: add walk_page_range_vma()
Thomas Fourier <[email protected]>
ksmbd: smbd: fix dma_unmap_sg() nents
Alexander Usyskin <[email protected]>
mei: trace: treat reg parameter as string
Samasth Norway Ananda <[email protected]>
ALSA: scarlett2: Fix buffer overflow in config retrieval
Nilay Shroff <[email protected]>
nvme: fix PCIe subsystem reset controller state transition
Keith Busch <[email protected]>
nvme-pci: do not directly handle subsys reset fallout
Daniel Wagner <[email protected]>
nvme-fc: rename free_ctrl callback to match name pattern
Brian Foster <[email protected]>
xfs: set max_agbno to allow sparse alloc of last full inode chunk
Johan Hovold <[email protected]>
dmaengine: stm32: dmamux: fix device leak on route allocation
Johan Hovold <[email protected]>
dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
Thorsten Blum <[email protected]>
w1: therm: Fix off-by-one buffer overflow in alarms_store
Yang Guang <[email protected]>
w1: w1_therm: use swap() to make code cleaner
Geraldo Nascimento <[email protected]>
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
Abdun Nihaal <[email protected]>
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
Johan Hovold <[email protected]>
iio: adc: exynos_adc: fix OF populate on driver rebind
Rob Herring (Arm) <[email protected]>
of: platform: Use default match table for /firmware
Ian Abbott <[email protected]>
comedi: Fix getting range information for subdevices 16 to 255
Kuniyuki Iwashima <[email protected]>
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
Sharath Chandra Vurukala <[email protected]>
net: Add locking to protect skb->dev access in ip_output
Matthieu Baerts (NGI0) <[email protected]>
mptcp: only reset subflow errors when propagated
Thomas Fourier <[email protected]>
scsi: qla2xxx: edif: Fix dma_free_coherent() size
Haoxiang Li <[email protected]>
scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
Fabio Estevam <[email protected]>
ASoC: fsl: imx-card: Do not force slot width to sample width
Sai Sree Kartheek Adivi <[email protected]>
dma/pool: distinguish between missing and exhausted atomic pools
Denis Sergeev <[email protected]>
gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
Kery Qi <[email protected]>
scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
Martin Kaiser <[email protected]>
net: bridge: fix static key check
Kuniyuki Iwashima <[email protected]>
nfc: nci: Fix race between rfkill and nci_unregister_device().
Gal Pressman <[email protected]>
net/mlx5e: Account for netdev stats in ndo_get_stats64
Yafang Shao <[email protected]>
net/mlx5e: Report rx_discards_phy via rx_dropped
Gal Pressman <[email protected]>
net/mlx5e: Expose rx_oversize_pkts_buffer counter
Saeed Mahameed <[email protected]>
net/mlx5: Add HW definitions of vport debug counters
Jesse Brandeburg <[email protected]>
ice: stop counting UDP csum mismatch as rx_errors
Kuniyuki Iwashima <[email protected]>
nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
Kery Qi <[email protected]>
rocker: fix memory leak in rocker_world_port_post_fini()
Fernando Fernandez Mancera <[email protected]>
ipv6: use the right ifindex when replying to icmpv6 from localhost
Zilin Guan <[email protected]>
net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
Zilin Guan <[email protected]>
net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
Jia-Hong Su <[email protected]>
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
Paul Chaignon <[email protected]>
bpf: Reject narrower access to pointer ctx fields
Daniel Borkmann <[email protected]>
bpf: Do not let BPF test infra emit invalid GSO types to stack
Matthew Wilcox (Oracle) <[email protected]>
migrate: correct lock ordering for hugetlb file folios
Marc Kleine-Budde <[email protected]>
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
Arnd Bergmann <[email protected]>
irqchip/gic-v3-its: Avoid truncating memory addresses
Fernand Sieber <[email protected]>
perf/x86/intel: Do not enable BTS for guests
Jeongjun Park <[email protected]>
netrom: fix double-free in nr_route_frame()
Chenghai Huang <[email protected]>
uacce: ensure safe queue release with state management
Yang Shen <[email protected]>
uacce: implement mremap in uacce_vm_ops to return -EPERM
Wenkai Lin <[email protected]>
uacce: fix cdev handling in the cleanup path
Johan Hovold <[email protected]>
intel_th: fix device leak on output open()
Johan Hovold <[email protected]>
slimbus: core: fix device reference leak on report present
Johan Hovold <[email protected]>
slimbus: core: fix runtime PM imbalance on report present
Thomas Fourier <[email protected]>
octeontx2: Fix otx2_dma_map_page() error return code
Zhaoyang Huang <[email protected]>
arm64: Set __nocfi on swsusp_arch_resume()
Marek Vasut <[email protected]>
wifi: rsi: Fix memory corruption due to not set vif driver data size
Dan Carpenter <[email protected]>
wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
Thomas Fourier <[email protected]>
wifi: ath10k: fix dma_free_coherent() pointer
Matthew Schwartz <[email protected]>
mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
Berk Cem Goksel <[email protected]>
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
Takashi Iwai <[email protected]>
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
Kübrich, Andreas <[email protected]>
iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
Pei Xiao <[email protected]>
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
Tomas Melin <[email protected]>
iio: adc: ad9467: fix ad9434 vref mask
Weigang He <[email protected]>
of: fix reference count leak in of_alias_scan()
Hans de Goede <[email protected]>
leds: led-class: Only Add LED to leds_list when it is fully ready
Cedric Xing <[email protected]>
x86: make page fault handling disable interrupts properly
Eric Dumazet <[email protected]>
net/sched: act_ife: avoid possible NULL deref
Ratheesh Kannoth <[email protected]>
octeontx2-af: Fix error handling
Eric Dumazet <[email protected]>
bonding: provide a net pointer to __skb_flow_dissect()
Andrey Vatoropin <[email protected]>
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
Timur Kristóf <[email protected]>
drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
Timur Kristóf <[email protected]>
drm/amd/pm: Don't clear SI SMC table when setting power limit
Laurent Vivier <[email protected]>
usbnet: limit max_mtu based on device's hard_mtu
Eric Dumazet <[email protected]>
ipv6: annotate data-race in ndisc_router_discovery()
Eric Dumazet <[email protected]>
mISDN: annotate data-race around dev->work
Jijie Shao <[email protected]>
net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
Jijie Shao <[email protected]>
net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
Arun Raghavan <[email protected]>
ALSA: usb: Increase volume range that triggers a warning
Cheng-Yu Lee <[email protected]>
regmap: Fix race condition in hwspinlock irqsave routine
Pavel Zhigulin <[email protected]>
iio: adc: ad7280a: handle spi_setup() errors in probe()
Jonathan Cameron <[email protected]>
staging:iio:adc:ad7280a: Register define cleanup.
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
Andrew Cooper <[email protected]>
x86/kfence: avoid writing L1TF-vulnerable PTEs
Long Li <[email protected]>
scsi: storvsc: Process unsupported MODE_SENSE_10
feng <[email protected]>
Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
gongqi <[email protected]>
Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
Thadeu Lima de Souza Cascardo <[email protected]>
Revert "nfc/nci: Add the inconsistency check between the input data length and count"
Haoxiang Li <[email protected]>
w1: fix redundant counter decrement in w1_attach_slave_device()
Ian Abbott <[email protected]>
comedi: dmm32at: serialize use of paged registers
Taeyang Lee <[email protected]>
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
Jamal Hadi Salim <[email protected]>
net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
Jamal Hadi Salim <[email protected]>
net/sched: Enforce that teql can only be used as root qdisc
Dmitry Skorodumov <[email protected]>
ipvlan: Make the addrs_lock be per port
Eric Dumazet <[email protected]>
l2tp: avoid one data-race in l2tp_tunnel_del_work()
Kuniyuki Iwashima <[email protected]>
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
Jakub Kicinski <[email protected]>
net: fou: use policy and operation tables generated from the spec
Jakub Kicinski <[email protected]>
net: fou: rename the source for linking
Jakub Kicinski <[email protected]>
netlink: add a proto specification for FOU
Kuniyuki Iwashima <[email protected]>
gue: Fix skb memleak with inner IP protocol 0.
Raju Rangoju <[email protected]>
amd-xgbe: avoid misleading per-packet error log
Xin Long <[email protected]>
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
Ricardo B. Marlière <[email protected]>
selftests: net: fib-onlink-tests: Convert to use namespaces by default
Hangbin Liu <[email protected]>
selftests/net: convert fib-onlink-tests.sh to run it in unique namespace
Eric Dumazet <[email protected]>
bonding: limit BOND_MODE_8023AD to Ethernet devices
Ethan Nelson-Moore <[email protected]>
net: usb: dm9601: remove broken SR9700 support
Wojtek Wasko <[email protected]>
testptp: Add option to open PHC in readonly mode
Mahesh Bandewar <[email protected]>
selftest/ptp: update ptp selftest to exercise the gettimex options
Xabier Marquiegui <[email protected]>
ptp: add testptp mask test
Alex Maftei <[email protected]>
selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
Alex Maftei <[email protected]>
selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
Rahul Rameshbabu <[email protected]>
testptp: Add support for testing ptp_clock_info .adjphase callback
Maciek Machnikowski <[email protected]>
testptp: add option to shift clock by nanoseconds
Wojtek Wasko <[email protected]>
ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
Wojtek Wasko <[email protected]>
posix-clock: Store file pointer in struct posix_clock_context
Linus Torvalds <[email protected]>
Fix memory leak in posix_clock_open()
Xabier Marquiegui <[email protected]>
posix-clock: introduce posix_clock_context concept
Robbie Ko <[email protected]>
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
Johan Hovold <[email protected]>
dmaengine: ti: k3-udma: fix device leak on udma lookup
Johan Hovold <[email protected]>
dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
Johan Hovold <[email protected]>
dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
Biju Das <[email protected]>
dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
Miaoqian Lin <[email protected]>
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
Johan Hovold <[email protected]>
dmaengine: lpc18xx-dmamux: fix device leak on route allocation
Johan Hovold <[email protected]>
dmaengine: idxd: fix device leaks on compat bind and unbind
Johan Hovold <[email protected]>
dmaengine: bcm-sba-raid: fix device leak on probe
Johan Hovold <[email protected]>
dmaengine: at_hdmac: fix device leak on of_dma_xlate()
Haoxiang Li <[email protected]>
drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
Marek Vasut <[email protected]>
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
Lyude Paul <[email protected]>
drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
Mario Limonciello (AMD) <[email protected]>
drm/amd: Clean up kfd node on surprise disconnect
Aboorva Devarajan <[email protected]>
mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
Xiaochen Shen <[email protected]>
x86/resctrl: Fix memory bandwidth counter width for Hygon
Xiaochen Shen <[email protected]>
x86/resctrl: Add missing resctrl initialization for Hygon
Haoxiang Li <[email protected]>
EDAC/i3200: Fix a resource leak in i3200_probe1()
Haoxiang Li <[email protected]>
EDAC/x38: Fix a resource leak in x38_probe1()
Thomas Weißschuh <[email protected]>
hrtimer: Fix softirq base check in update_needs_ipi()
Yang Erkun <[email protected]>
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
Ilikara Zheng <[email protected]>
nvme-pci: disable secondary temp for Wodposit WPBSNM8
Ethan Nelson-Moore <[email protected]>
USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
Ulrich Mohr <[email protected]>
USB: serial: option: add Telit LE910 MBIM composition
Huacai Chen <[email protected]>
USB: OHCI/UHCI: Add soft dependencies on ehci_platform
Thinh Nguyen <[email protected]>
usb: dwc3: Check for USB4 IP_NAME
Wayne Chang <[email protected]>
phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
Louis Chauvet <[email protected]>
phy: rockchip: inno-usb2: fix disconnection in gadget mode
Luca Ceresoli <[email protected]>
phy: rockchip: inno-usb2: fix communication disruption in gadget mode
Dan Williams <[email protected]>
x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
Tetsuo Handa <[email protected]>
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
Jaroslav Kysela <[email protected]>
ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
Benjamin Tissoires <[email protected]>
HID: usbhid: paper over wrong bNumDescriptor field
Haotian Zhang <[email protected]>
dmaengine: omap-dma: fix dma_pool resource leak in error paths
Krzysztof Kozlowski <[email protected]>
phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
Dan Carpenter <[email protected]>
phy: stm32-usphyc: Fix off by one in probe()
Suraj Gupta <[email protected]>
dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
Sheetal <[email protected]>
dmaengine: tegra-adma: Fix use-after-free
Bagas Sanjaya <[email protected]>
mm, kfence: describe @slab parameter in __kfence_obj_info()
Bagas Sanjaya <[email protected]>
textsearch: describe @list member in ts_ops search
Emil Svendsen <[email protected]>
ASoC: tlv320adcx140: fix word length
Eric Dumazet <[email protected]>
net/sched: sch_qfq: do not free existing class in qfq_change_class()
Gal Pressman <[email protected]>
selftests: drv-net: fix RPS mask handling for high CPU numbers
Saeed Mahameed <[email protected]>
net/mlx5e: Restore destroying state bit after profile cleanup
Stefano Garzarella <[email protected]>
vsock/test: add a final full barrier after run all tests
Eric Dumazet <[email protected]>
ipv4: ip_gre: make ipgre_header() robust
Eric Dumazet <[email protected]>
macvlan: fix possible UAF in macvlan_forward_source()
Eric Dumazet <[email protected]>
net: update netdev_lock_{type,name}Eric Dumazet <[email protected]>
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
Qu Wenruo <[email protected]>
btrfs: send: check for inline extents in range_is_hole_in_parent()
Shivam Kumar <[email protected]>
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
Maurizio Lombardi <[email protected]>
nvmet-tcp: remove boilerplate code
Szymon Wilczek <[email protected]>
can: etas_es58x: allow partial RX URB allocation to succeed
Zilin Guan <[email protected]>
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
-------------
Diffstat:
Documentation/netlink/specs/fou.yaml | 130 ++++++++++
Makefile | 4 +-
arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 1 -
arch/arm64/kernel/hibernate.c | 2 +-
arch/x86/events/perf_event.h | 13 +-
arch/x86/include/asm/kfence.h | 29 ++-
arch/x86/kernel/cpu/resctrl/core.c | 21 +-
arch/x86/kernel/cpu/resctrl/internal.h | 3 +
arch/x86/mm/fault.c | 15 +-
arch/x86/mm/kaslr.c | 10 +-
block/blk-cgroup.c | 4 +
crypto/authencesn.c | 6 +
drivers/base/regmap/regmap.c | 4 +-
drivers/bluetooth/hci_ldisc.c | 4 +-
drivers/comedi/comedi.h | 2 +-
drivers/comedi/comedi_fops.c | 2 +-
drivers/comedi/drivers/dmm32at.c | 32 ++-
drivers/comedi/range.c | 2 +-
drivers/dma/at_hdmac.c | 9 +-
drivers/dma/bcm-sba-raid.c | 6 +-
drivers/dma/idxd/compat.c | 23 +-
drivers/dma/lpc18xx-dmamux.c | 19 +-
drivers/dma/qcom/gpi.c | 6 +-
drivers/dma/sh/rz-dmac.c | 5 +
drivers/dma/stm32-dmamux.c | 22 +-
drivers/dma/tegra210-adma.c | 10 +-
drivers/dma/ti/dma-crossbar.c | 18 +-
drivers/dma/ti/k3-udma-private.c | 2 +-
drivers/dma/ti/omap-dma.c | 4 +
drivers/dma/xilinx/xilinx_dma.c | 7 +-
drivers/edac/i3200_edac.c | 11 +-
drivers/edac/x38_edac.c | 9 +-
drivers/gpio/gpiolib-acpi.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 18 +-
drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 23 +-
drivers/gpu/drm/imx/imx-tve.c | 13 +
drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 +
drivers/gpu/drm/panel/panel-simple.c | 1 +
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +-
drivers/hid/hid-uclogic-core.c | 12 +-
drivers/hid/usbhid/hid-core.c | 17 +-
drivers/hwtracing/intel_th/core.c | 19 +-
drivers/iio/adc/ad9467.c | 2 +-
drivers/iio/adc/at91-sama5d2_adc.c | 1 +
drivers/iio/adc/exynos_adc.c | 13 +-
drivers/iio/dac/ad5686.c | 6 +
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 15 +-
drivers/input/serio/i8042-acpipnpio.h | 18 ++
drivers/irqchip/irq-gic-v3-its.c | 8 +-
drivers/isdn/mISDN/timerdev.c | 13 +-
drivers/leds/led-class.c | 10 +-
drivers/misc/mei/mei-trace.h | 18 +-
drivers/misc/uacce/uacce.c | 42 ++-
drivers/mmc/host/rtsx_pci_sdmmc.c | 41 +++
drivers/net/bonding/bond_main.c | 11 +-
drivers/net/can/usb/ems_usb.c | 8 +-
drivers/net/can/usb/esd_usb2.c | 9 +-
drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 9 +-
drivers/net/can/usb/mcba_usb.c | 8 +-
drivers/net/can/usb/usb_8dev.c | 8 +-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +-
drivers/net/ethernet/emulex/benet/be_cmds.c | 3 +-
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +-
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
drivers/net/ethernet/intel/ice/ice_main.c | 1 -
drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +-
drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 86 +++++--
.../ethernet/marvell/octeontx2/nic/otx2_common.h | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 25 +-
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 21 +-
drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 4 +
.../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +-
drivers/net/ethernet/rocker/rocker_main.c | 5 +-
drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 5 +
.../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 5 +
drivers/net/ipvlan/ipvlan.h | 2 +-
drivers/net/ipvlan/ipvlan_core.c | 16 +-
drivers/net/ipvlan/ipvlan_main.c | 49 ++--
drivers/net/macvlan.c | 20 +-
drivers/net/team/team.c | 23 +-
drivers/net/usb/dm9601.c | 4 -
drivers/net/usb/usbnet.c | 11 +-
drivers/net/wireless/ath/ath10k/ce.c | 16 +-
.../net/wireless/marvell/mwifiex/11n_rxreorder.c | 6 +-
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
drivers/nfc/virtual_ncidev.c | 4 -
drivers/nvme/host/fabrics.c | 15 ++
drivers/nvme/host/fabrics.h | 1 +
drivers/nvme/host/fc.c | 5 +-
drivers/nvme/host/nvme.h | 14 +-
drivers/nvme/host/pci.c | 41 +++
drivers/nvme/host/rdma.c | 1 +
drivers/nvme/host/tcp.c | 1 +
drivers/nvme/target/tcp.c | 28 +-
drivers/of/base.c | 8 +-
drivers/of/platform.c | 2 +-
drivers/pci/Kconfig | 6 -
drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +-
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 12 +-
drivers/phy/st/phy-stm32-usbphyc.c | 2 +-
drivers/phy/tegra/xusb-tegra186.c | 3 +
drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 ++
drivers/ptp/ptp_chardev.c | 37 ++-
drivers/ptp/ptp_private.h | 16 +-
drivers/scsi/be2iscsi/be_mgmt.c | 1 +
drivers/scsi/qla2xxx/qla_os.c | 2 +-
drivers/scsi/storvsc_drv.c | 3 +-
drivers/slimbus/core.c | 19 +-
drivers/staging/iio/adc/ad7280a.c | 283 +++++++++++----------
drivers/target/sbp/sbp_target.c | 4 +-
drivers/usb/dwc3/core.c | 2 +
drivers/usb/dwc3/core.h | 1 +
drivers/usb/host/ohci-platform.c | 1 +
drivers/usb/host/uhci-platform.c | 1 +
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 2 +
drivers/usb/serial/option.c | 1 +
drivers/w1/slaves/w1_therm.c | 67 ++---
drivers/w1/w1.c | 2 -
drivers/xen/xen-scsiback.c | 1 +
fs/btrfs/relocation.c | 13 +
fs/btrfs/send.c | 2 +
fs/btrfs/transaction.c | 11 +-
fs/ext4/ext4.h | 38 +--
fs/ext4/xattr.c | 1 +
fs/fs-writeback.c | 14 +-
fs/ksmbd/mgmt/tree_connect.c | 18 +-
fs/ksmbd/mgmt/tree_connect.h | 1 -
fs/ksmbd/smb2pdu.c | 3 -
fs/ksmbd/transport_rdma.c | 15 +-
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +-
fs/nfsd/nfsctl.c | 17 +-
fs/ntfs3/inode.c | 7 +-
fs/xfs/libxfs/xfs_ialloc.c | 11 +-
include/drm/ttm/ttm_tt.h | 2 +-
include/linux/kfence.h | 1 +
include/linux/mlx5/mlx5_ifc.h | 27 +-
include/linux/nvme.h | 3 +
include/linux/pagewalk.h | 3 +
include/linux/posix-clock.h | 39 ++-
include/linux/textsearch.h | 1 +
include/net/cfg80211.h | 95 ++++++-
include/net/dst.h | 12 +
include/net/nfc/nfc.h | 2 +
include/sound/pcm.h | 2 +-
kernel/bpf/cgroup.c | 8 +-
kernel/dma/pool.c | 7 +-
kernel/irq/irq_sim.c | 2 +-
kernel/time/hrtimer.c | 2 +-
kernel/time/posix-clock.c | 53 ++--
mm/Kconfig | 10 +-
mm/kfence/core.c | 24 +-
mm/ksm.c | 115 ++++++++-
mm/migrate.c | 14 +-
mm/page_alloc.c | 10 +-
mm/pagewalk.c | 20 ++
net/bluetooth/hci_core.c | 4 +
net/bpf/test_run.c | 5 +
net/bridge/br_input.c | 2 +-
net/can/j1939/transport.c | 10 +-
net/core/dev.c | 25 +-
net/core/filter.c | 25 +-
net/ipv4/Makefile | 1 +
net/ipv4/esp4.c | 4 +-
net/ipv4/{fou.c => fou_core.c} | 50 +---
net/ipv4/fou_nl.c | 48 ++++
net/ipv4/fou_nl.h | 25 ++
net/ipv4/ip_gre.c | 11 +-
net/ipv4/ip_output.c | 16 +-
net/ipv6/esp6.c | 4 +-
net/ipv6/icmp.c | 4 +-
net/ipv6/ip6_tunnel.c | 2 +-
net/ipv6/ndisc.c | 4 +-
net/l2tp/l2tp_core.c | 4 +-
net/mac80211/ibss.c | 8 +-
net/mac80211/ieee80211_i.h | 6 +-
net/mac80211/iface.c | 10 +-
net/mac80211/mesh.c | 10 +-
net/mac80211/mesh_hwmp.c | 6 +-
net/mac80211/mlme.c | 13 +-
net/mac80211/ocb.c | 6 +-
net/mac80211/rx.c | 2 +-
net/mac80211/scan.c | 2 +-
net/mac80211/status.c | 5 +-
net/mac80211/tdls.c | 11 +-
net/mac80211/util.c | 2 +-
net/mptcp/protocol.c | 13 +-
net/netrom/nr_route.c | 13 +-
net/nfc/core.c | 27 +-
net/nfc/llcp_commands.c | 17 +-
net/nfc/llcp_core.c | 4 +-
net/nfc/nci/core.c | 4 +-
net/sched/act_ife.c | 12 +-
net/sched/sch_qfq.c | 8 +-
net/sched/sch_teql.c | 5 +
net/sctp/sm_statefuns.c | 10 +-
net/tls/tls_device.c | 18 +-
net/wireless/core.c | 131 +++++++++-
net/wireless/core.h | 7 +
net/wireless/sysfs.c | 8 +-
net/xfrm/espintcp.c | 4 +-
sound/core/oss/pcm_oss.c | 4 +-
sound/core/pcm_native.c | 9 +-
sound/pci/ctxfi/ctamixer.c | 2 +
sound/soc/codecs/tlv320adcx140.c | 4 +-
sound/soc/fsl/imx-card.c | 1 -
sound/usb/mixer.c | 22 +-
sound/usb/mixer_scarlett_gen2.c | 7 +-
tools/testing/selftests/net/fib-onlink-tests.sh | 76 +++---
tools/testing/selftests/net/toeplitz.c | 4 +-
tools/testing/selftests/ptp/testptp.c | 210 +++++++++++++--
tools/testing/vsock/util.c | 12 +
215 files changed, 2400 insertions(+), 888 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/206 pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 0c728083654f0066f5e10a1d2b0bd0907af19a58 ]
In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak.
Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources.
--- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/flexfilelayout/flexfilelayoutdev.c +1 -1
@@ -103,7 +103,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,sizeof (struct nfs4_ff_ds_version ), gfp_flags);if (!ds_versions) - goto out_scratch; + goto out_err_drain_dsaddrs;for (i =0 ; i < version_count; i++) {/* 20 = version(4) + minor_version(4) + rsize(4) + wsize(4) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/206 can: etas_es58x: allow partial RX URB allocation to succeed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Szymon Wilczek <[email protected]>
[ Upstream commit b1979778e98569c1e78c2c7f16bb24d76541ab00 ]
When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked.
As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error.
Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open().
--- drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/usb/etas_es58x/es58x_core.c +1 -1
@@ -1743,7 +1743,7 @@ static int es58x_alloc_rx_urbs(struct es58x_device *es58x_dev)dev_dbg (dev,"%s: Allocated %d rx URBs each of size %zu\n" , __func__, i, rx_buf_len); -return ret; +return 0 ; }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/206 nvmet-tcp: remove boilerplate code
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 75011bd0f9c55db523242f9f9a0b0b826165f14b ]
Simplify the nvmet_tcp_handle_h2c_data_pdu() function by removing boilerplate code.
Stable-dep-of: 32b63acd78f5 ("nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec")
--- drivers/nvme/target/tcp.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/nvme/target/tcp.c +8 -8
@@ -945,8 +945,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)if (unlikely (data->ttag >= queue->nr_cmds)) {pr_err ("queue %d: received out of bound ttag %u, nr_cmds %u\n" , queue->idx, data->ttag, queue->nr_cmds); -nvmet_tcp_fatal_error (queue); -return -EPROTO ; + goto err_proto; } cmd = &queue->cmds[data->ttag]; }else {
@@ -957,9 +956,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)pr_err ("ttag %u unexpected data offset %u (expected %u)\n" , data->ttag,le32_to_cpu (data->data_offset), cmd->rbytes_done); -/* FIXME: use path and transport errors */ -nvmet_tcp_fatal_error (queue); -return -EPROTO ; + goto err_proto; } exp_data_len = le32_to_cpu(data->hdr.plen) -
@@ -972,9 +969,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) cmd->pdu_len == 0 || cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) {pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len); -/* FIXME: use proper transport errors */ -nvmet_tcp_fatal_error (queue); -return -EPROTO ; + goto err_proto; } cmd->pdu_recv =0 ;nvmet_tcp_map_pdu_iovec (cmd);
@@ -982,6 +977,11 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) queue->rcv_state =NVMET_TCP_RECV_DATA ;return 0 ; + +err_proto: +/* FIXME: use proper transport errors */ +nvmet_tcp_fatal_error (queue); +return -EPROTO ; }static int nvmet_tcp_done_recv_pdu (struct nvmet_tcp_queue *queue)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/206 nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <[email protected]>
[ Upstream commit 32b63acd78f577b332d976aa06b56e70d054cbba ]
Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset
validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate
whether the command's data structures (cmd->req.sg and cmd->iov) have
been properly initialized before processing H2C_DATA PDUs.
The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command.
Attack vectors that trigger NULL pointer dereferences:
1. H2C_DATA PDU sent before CONNECT → both pointers NULL
2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL
3. H2C_DATA PDU for uninitialized command slot → both pointers NULL
The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because:
- Uninitialized commands: both NULL
- READ commands: cmd->req.sg allocated, cmd->iov NULL
- WRITE commands: both allocated
--- drivers/nvme/target/tcp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/nvme/target/tcp.c +12 -0
@@ -971,6 +971,18 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len); goto err_proto; } +/* +* Ensure command data structures are initialized. We must check both +* cmd->req.sg and cmd->iov because they can have different NULL states: +* - Uninitialized commands: both NULL +* - READ commands: cmd->req.sg allocated, cmd->iov NULL +* - WRITE commands: both allocated +*/ +if (unlikely (!cmd->req.sg || !cmd->iov)) { +pr_err ("queue %d: H2CData PDU received for invalid command state (ttag %u)\n" , + queue->idx, data->ttag); + goto err_proto; + } cmd->pdu_recv =0 ;nvmet_tcp_map_pdu_iovec (cmd); queue->cmd = cmd;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/206 btrfs: send: check for inline extents in range_is_hole_in_parent()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ]
Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent.
This is because for inline extents their data starts at the offset of the disk_bytenr field. So accessing the disk_bytenr
means we are accessing inline data or in case the inline data is less than 8 bytes we can actually cause an invalid
memory access if this inline extent item is the first item in the leaf or access metadata from other items.
--- fs/btrfs/send.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/send.c +2 -0
@@ -5892,6 +5892,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx, extent_end =btrfs_file_extent_end (path);if (extent_end <= start) goto next; +if (btrfs_file_extent_type (leaf, fi) ==BTRFS_FILE_EXTENT_INLINE ) +return 0 ;if (btrfs_file_extent_disk_bytenr (leaf, fi) ==0 ) { search_start = extent_end; goto next;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/206 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 81c734dae203757fb3c9eee6f9896386940776bd ]
Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1].
Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().
[1]
BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729 __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860 ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1 ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500 ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:318 [inline] ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core net/core/dev.c:6139 [inline] __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252 netif_receive_skb_internal net/core/dev.c:6338 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6397 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
--- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_tunnel.c +1 -1
@@ -846,7 +846,7 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,skb_reset_network_header (skb); -if (!pskb_inet_may_pull (skb)) { +if (skb_vlan_inet_prepare (skb, true)) {DEV_STATS_INC (tunnel->dev, rx_length_errors);DEV_STATS_INC (tunnel->dev, rx_errors); goto drop;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/206 net: update netdev_lock_{type,name}
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eb74c19fe10872ee1f29a8f90ca5ce943921afe9 ]
Add missing entries in netdev_lock_type[] and netdev_lock_name[] :
CAN, MCTP, RAWIP, CAIF, IP6GRE, 6LOWPAN, NETLINK, VSOCKMON, IEEE802154_MONITOR.
Also add a WARN_ONCE() in netdev_lock_pos() to help future bug hunting next time a protocol is added without updating these arrays.
--- net/core/dev.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
net/core/dev.c +19 -6
@@ -426,15 +426,21 @@ static const unsigned short netdev_lock_type[] = {ARPHRD_IEEE1394 ,ARPHRD_EUI64 ,ARPHRD_INFINIBAND ,ARPHRD_SLIP ,ARPHRD_CSLIP ,ARPHRD_SLIP6 ,ARPHRD_CSLIP6 ,ARPHRD_RSRVD ,ARPHRD_ADAPT ,ARPHRD_ROSE ,ARPHRD_X25 ,ARPHRD_HWX25 , +ARPHRD_CAN ,ARPHRD_MCTP ,ARPHRD_PPP ,ARPHRD_CISCO ,ARPHRD_LAPB ,ARPHRD_DDCMP , -ARPHRD_RAWHDLC ,ARPHRD_TUNNEL ,ARPHRD_TUNNEL6 ,ARPHRD_FRAD , +ARPHRD_RAWHDLC ,ARPHRD_RAWIP , +ARPHRD_TUNNEL ,ARPHRD_TUNNEL6 ,ARPHRD_FRAD ,ARPHRD_SKIP ,ARPHRD_LOOPBACK ,ARPHRD_LOCALTLK ,ARPHRD_FDDI ,ARPHRD_BIF ,ARPHRD_SIT ,ARPHRD_IPDDP ,ARPHRD_IPGRE ,ARPHRD_PIMREG ,ARPHRD_HIPPI ,ARPHRD_ASH ,ARPHRD_ECONET ,ARPHRD_IRDA ,ARPHRD_FCPP ,ARPHRD_FCAL ,ARPHRD_FCPL ,ARPHRD_FCFABRIC ,ARPHRD_IEEE80211 ,ARPHRD_IEEE80211_PRISM , -ARPHRD_IEEE80211_RADIOTAP ,ARPHRD_PHONET ,ARPHRD_PHONET_PIPE , - ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE}; +ARPHRD_IEEE80211_RADIOTAP , +ARPHRD_IEEE802154 ,ARPHRD_IEEE802154_MONITOR , +ARPHRD_PHONET ,ARPHRD_PHONET_PIPE , +ARPHRD_CAIF ,ARPHRD_IP6GRE ,ARPHRD_NETLINK ,ARPHRD_6LOWPAN , +ARPHRD_VSOCKMON , + ARPHRD_VOID, ARPHRD_NONE};static const char *const netdev_lock_name[] = { "_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
@@ -443,15 +449,21 @@ static const char *const netdev_lock_name[] = {"_xmit_IEEE1394" ,"_xmit_EUI64" ,"_xmit_INFINIBAND" ,"_xmit_SLIP" ,"_xmit_CSLIP" ,"_xmit_SLIP6" ,"_xmit_CSLIP6" ,"_xmit_RSRVD" ,"_xmit_ADAPT" ,"_xmit_ROSE" ,"_xmit_X25" ,"_xmit_HWX25" , +"_xmit_CAN" ,"_xmit_MCTP" ,"_xmit_PPP" ,"_xmit_CISCO" ,"_xmit_LAPB" ,"_xmit_DDCMP" , -"_xmit_RAWHDLC" ,"_xmit_TUNNEL" ,"_xmit_TUNNEL6" ,"_xmit_FRAD" , +"_xmit_RAWHDLC" ,"_xmit_RAWIP" , +"_xmit_TUNNEL" ,"_xmit_TUNNEL6" ,"_xmit_FRAD" ,"_xmit_SKIP" ,"_xmit_LOOPBACK" ,"_xmit_LOCALTLK" ,"_xmit_FDDI" ,"_xmit_BIF" ,"_xmit_SIT" ,"_xmit_IPDDP" ,"_xmit_IPGRE" ,"_xmit_PIMREG" ,"_xmit_HIPPI" ,"_xmit_ASH" ,"_xmit_ECONET" ,"_xmit_IRDA" ,"_xmit_FCPP" ,"_xmit_FCAL" ,"_xmit_FCPL" ,"_xmit_FCFABRIC" ,"_xmit_IEEE80211" ,"_xmit_IEEE80211_PRISM" , -"_xmit_IEEE80211_RADIOTAP" ,"_xmit_PHONET" ,"_xmit_PHONET_PIPE" , - "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"}; +"_xmit_IEEE80211_RADIOTAP" , +"_xmit_IEEE802154" ,"_xmit_IEEE802154_MONITOR" , +"_xmit_PHONET" ,"_xmit_PHONET_PIPE" , +"_xmit_CAIF" ,"_xmit_IP6GRE" ,"_xmit_NETLINK" ,"_xmit_6LOWPAN" , +"_xmit_VSOCKMON" , + "_xmit_VOID", "_xmit_NONE"};static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE (netdev_lock_type)];static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE (netdev_lock_type)];
@@ -464,6 +476,7 @@ static inline unsigned short netdev_lock_pos(unsigned short dev_type)if (netdev_lock_type[i] == dev_type)return i;/* the last key is used by default */ +WARN_ONCE (1 ,"netdev_lock_pos() could not find dev_type=%u\n" , dev_type);return ARRAY_SIZE (netdev_lock_type) -1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/206 macvlan: fix possible UAF in macvlan_forward_source()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e ]
Add RCU protection on (struct macvlan_source_entry)->vlan.
Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts.
This allows macvlan_forward_source() to skip over entries queued for freeing.
Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)).
https: //lore.kernel.org/netdev/[email protected]/T/#u
--- drivers/net/macvlan.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/net/macvlan.c +13 -7
@@ -56,7 +56,7 @@ struct macvlan_port {struct macvlan_source_entry {struct hlist_node hlist; -struct macvlan_dev *vlan; +struct macvlan_dev __rcu *vlan;unsigned char addr[6 +2 ]__aligned(sizeof(u16)) ;struct rcu_head rcu; };
@@ -143,7 +143,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source(hlist_for_each_entry_rcu (entry, h, hlist,lockdep_rtnl_is_held ()) {if (ether_addr_equal_64bits (entry->addr, addr) && - entry->vlan == vlan) +rcu_access_pointer (entry->vlan) == vlan)return entry; }return NULL ;
@@ -165,7 +165,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan,return -ENOMEM ;ether_addr_copy (entry->addr, addr); - entry->vlan = vlan; +RCU_INIT_POINTER (entry->vlan, vlan); h = &port->vlan_source_hash[macvlan_eth_hash (addr)];hlist_add_head_rcu (&entry->hlist, h); vlan->macaddr_count++;
@@ -184,6 +184,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan)static void macvlan_hash_del_source (struct macvlan_source_entry *entry) { +RCU_INIT_POINTER (entry->vlan,NULL );hlist_del_rcu (&entry->hlist);kfree_rcu (entry, rcu); }
@@ -382,7 +383,7 @@ static void macvlan_flush_sources(struct macvlan_port *port,int i;hash_for_each_safe (port->vlan_source_hash, i, next, entry, hlist) -if (entry->vlan == vlan) +if (rcu_access_pointer (entry->vlan) == vlan)macvlan_hash_del_source (entry); vlan->macaddr_count =0 ;
@@ -425,9 +426,14 @@ static bool macvlan_forward_source(struct sk_buff *skb,hlist_for_each_entry_rcu (entry, h, hlist) {if (ether_addr_equal_64bits (entry->addr, addr)) { -if (entry->vlan->flags &MACVLAN_FLAG_NODST ) +struct macvlan_dev *vlan =rcu_dereference (entry->vlan); + +if (!vlan) +continue ; + +if (vlan->flags &MACVLAN_FLAG_NODST ) consume = true; -macvlan_forward_source_one (skb, entry->vlan); +macvlan_forward_source_one (skb, vlan); } }
@@ -1636,7 +1642,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb,struct macvlan_source_entry *entry;hlist_for_each_entry_rcu (entry, h, hlist,lockdep_rtnl_is_held ()) { -if (entry->vlan != vlan) +if (rcu_access_pointer (entry->vlan) != vlan)continue ;if (nla_put (skb,IFLA_MACVLAN_MACADDR ,ETH_ALEN , entry->addr))return 1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/206 ipv4: ip_gre: make ipgre_header() robust
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e67c577d89894811ce4dcd1a9ed29d8b63476667 ]
Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1].
This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len
In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device.
[1]
skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0
kernel BUG at net/core/skbuff.c:213 !
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
--- net/ipv4/ip_gre.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/ip_gre.c +9 -2
@@ -857,10 +857,17 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev, const void *daddr, const void *saddr, unsigned int len) { struct ip_tunnel *t = netdev_priv(dev); -struct iphdr *iph;struct gre_base_hdr *greh; +struct iphdr *iph; +int needed; + + needed = t->hlen +sizeof (*iph); +if (skb_headroom (skb) < needed && +pskb_expand_head (skb,HH_DATA_ALIGN (needed -skb_headroom (skb)), +0 ,GFP_ATOMIC )) +return -needed; - iph =skb_push (skb, t->hlen +sizeof (*iph)); + iph =skb_push (skb, needed); greh = (struct gre_base_hdr *)(iph+1 ); greh->flags =gre_tnl_flags_to_gre_flags (t->parms.o_flags); greh->protocol =htons (type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/206 vsock/test: add a final full barrier after run all tests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
[ Upstream commit c39a6a277e0e67ffff6a8efcbbf7e7e23ce9e38c ]
If the last test fails, the other side still completes correctly, which could lead to false positives.
Let's add a final barrier that ensures that the last test has finished correctly on both sides, but also that the two sides agree on the number of tests to be performed.
--- tools/testing/vsock/util.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
tools/testing/vsock/util.c +12 -0
@@ -360,6 +360,18 @@ void run_tests(const struct test_case *test_cases,printf ("ok\n" ); } + +printf ("All tests have been executed. Waiting other peer..." ); +fflush (stdout); + +/* +* Final full barrier, to ensure that all tests have been run and +* that even the last one has been successful on both sides. +*/ +control_writeln ("COMPLETED" ); +control_expectln ("COMPLETED" ); + +printf ("ok\n" ); }void list_tests (const struct test_case *test_cases)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/206 net/mlx5e: Restore destroying state bit after profile cleanup
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 5629f8859dca7ef74d7314b60de6a957f23166c0 ]
Profile rollback can fail in mlx5e_netdev_change_profile() and we will end up with invalid mlx5e_priv memset to 0, we must maintain the 'destroying' bit in order to gracefully shutdown even if the profile/priv are not valid.
This patch maintains the previous state of the 'destroying' state of mlx5e_priv after priv cleanup, to allow the remove flow to cleanup common resources from mlx5_core to avoid FW fatal errors as seen below:
$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev
Error: mlx5_core: Failed setting eswitch to offloads.
dmesg: mlx5_core 0000:00:03.0 enp0s3np0: failed to rollback to orig profile, ...$ devlink dev reload pci/0000:00:03.0
mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:00:03.0: poll_health:803:(pid 519): Fatal error 3 detectedmlx5_core 0000:00:03.0: firmware version: 28.41.1000mlx5_core 0000:00:03.0: 0.000 Gb/s available PCIe bandwidth (Unknown x255 link)mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failedmlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failedmlx5_core 0000:00:03.0: mlx5_health_try_recover:340:(pid 141): handling bad device here mlx5_core 0000:00:03.0: mlx5_handle_bad_state:285:(pid 141): Expected to see disabled NIC but it is full driver mlx5_core 0000:00:03.0: mlx5_error_sw_reset:236:(pid 141): startmlx5_core 0000:00:03.0: NIC IFC still 0 after 4000ms.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +3 -0
@@ -4856,6 +4856,7 @@ int mlx5e_priv_init(struct mlx5e_priv *priv,void mlx5e_priv_cleanup (struct mlx5e_priv *priv) { +bool destroying =test_bit (MLX5E_STATE_DESTROYING , &priv->state);int i;/* bail if change profile failed and also rollback failed */
@@ -4870,6 +4871,8 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv)kvfree (priv->htb.qos_sq_stats);memset (priv,0 ,sizeof (*priv)); +if (destroying)/* restore destroying bit, to allow unload */ +set_bit (MLX5E_STATE_DESTROYING , &priv->state); } struct net_device *
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/206 selftests: drv-net: fix RPS mask handling for high CPU numbers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit cf055f8c000445aa688c53a706ef4f580818eedb ]
The RPS bitmask bounds check uses ~(RPS_MAX_CPUS - 1) which equals ~15 = 0xfff0, only allowing CPUs 0-3.
Change the mask to ~((1UL << RPS_MAX_CPUS) - 1) = ~0xffff to allow CPUs 0-15.
--- tools/testing/selftests/net/toeplitz.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/toeplitz.c +2 -2
@@ -471,8 +471,8 @@ static void parse_rps_bitmap(const char *arg) bitmap =strtoul (arg,NULL ,0 ); -if (bitmap & ~(RPS_MAX_CPUS -1 )) -error (1 ,0 ,"rps bitmap 0x%lx out of bounds 0..%lu" , +if (bitmap & ~((1UL <<RPS_MAX_CPUS ) -1 )) +error (1 ,0 ,"rps bitmap 0x%lx out of bounds, max cpu %lu" , bitmap,RPS_MAX_CPUS -1 );for (i =0 ; i <RPS_MAX_CPUS ; i++)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/206 net/sched: sch_qfq: do not free existing class in qfq_change_class()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 ]
Fixes qfq_change_class() error case.
cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.
--- net/sched/sch_qfq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/sched/sch_qfq.c +4 -2
@@ -532,8 +532,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,return 0 ; destroy_class: -qdisc_put (cl->qdisc); -kfree (cl); +if (!existing) { +qdisc_put (cl->qdisc); +kfree (cl); + }return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/206 ASoC: tlv320adcx140: fix word length
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Svendsen <[email protected]>
[ Upstream commit 46378ab9fcb796dca46b51e10646f636e2c661f9 ]
The word length is the physical width of the channel slots. So the hw_params would misconfigure when format width and physical width doesn't match. Like S24_LE which has data width of 24 bits but physical width of 32 bits. So if using asymmetric formats you will get a lot of noise.
--- sound/soc/codecs/tlv320adcx140.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/tlv320adcx140.c +2 -2
@@ -673,7 +673,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,struct adcx140_priv *adcx140 =snd_soc_component_get_drvdata (component);u8 data =0 ; -switch (params_width (params)) { +switch (params_physical_width (params)) {case 16 : data =ADCX140_16_BIT_WORD ;break ;
@@ -688,7 +688,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,break ;default :dev_err (component->dev,"%s: Unsupported width %d\n" , - __func__,params_width (params)); + __func__,params_physical_width (params));return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/206 textsearch: describe @list member in ts_ops search
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit f26528478bb102c28e7ac0cbfc8ec8185afdafc7 ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/textsearch.h:49 struct member 'list' not described in 'ts_ops'
Describe @list member to fix it.
--- include/linux/textsearch.h | 1 + 1 file changed, 1 insertion(+)
include/linux/textsearch.h +1 -0
@@ -35,6 +35,7 @@ struct ts_state* @get_pattern: return head of pattern * @get_pattern_len: return length of pattern * @owner: module reference to algorithm +* @list: list to search */ struct ts_ops {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/206 mm, kfence: describe @slab parameter in __kfence_obj_info()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit 6cfab50e1440fde19af7c614aacd85e11aa4dcea ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/kfence.h:220 function parameter 'slab' not described in '__kfence_obj_info'
Fix it by describing @slab parameter.
--- include/linux/kfence.h | 1 + 1 file changed, 1 insertion(+)
include/linux/kfence.h +1 -0
@@ -208,6 +208,7 @@ struct kmem_obj_info;* __kfence_obj_info() - fill kmem_obj_info struct * @kpp: kmem_obj_info to be filled * @object: the object +* @slab: the slab * * Return: * * false - not a KFENCE object
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/206 dmaengine: tegra-adma: Fix use-after-free
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheetal <[email protected]>
[ Upstream commit 2efd07a7c36949e6fa36a69183df24d368bf9e96 ]
A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it.
The race condition follows this sequence:
1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet)
2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree()
3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory
Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs.
Fix this by properly synchronizing the virtual channel completion:
- Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor.
- Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors.
Crash logs:
[ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0
[ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8
--- drivers/dma/tegra210-adma.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/dma/tegra210-adma.c +9 -1
@@ -344,10 +344,17 @@ static void tegra_adma_stop(struct tegra_adma_chan *tdc)return ; } -kfree (tdc->desc); +vchan_terminate_vdesc (&tdc->desc->vd); tdc->desc =NULL ; } +static void tegra_adma_synchronize (struct dma_chan *dc) +{ +struct tegra_adma_chan *tdc =to_tegra_adma_chan (dc); + +vchan_synchronize (&tdc->vc); +} +static void tegra_adma_start (struct tegra_adma_chan *tdc) {struct virt_dma_desc *vd =vchan_next_desc (&tdc->vc);
@@ -889,6 +896,7 @@ static int tegra_adma_probe(struct platform_device *pdev) tdma->dma_dev.device_config = tegra_adma_slave_config; tdma->dma_dev.device_tx_status = tegra_adma_tx_status; tdma->dma_dev.device_terminate_all = tegra_adma_terminate_all; + tdma->dma_dev.device_synchronize = tegra_adma_synchronize; tdma->dma_dev.src_addr_widths =BIT (DMA_SLAVE_BUSWIDTH_4_BYTES ); tdma->dma_dev.dst_addr_widths =BIT (DMA_SLAVE_BUSWIDTH_4_BYTES ); tdma->dma_dev.directions =BIT (DMA_DEV_TO_MEM ) |BIT (DMA_MEM_TO_DEV );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/206 dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <[email protected]>
[ Upstream commit c0732fe78728718c853ef8e7af5bbb05262acbd1 ]
When device tree lacks optional "xlnx,addrwidth" property, the addr_width variable remained uninitialized with garbage values, causing incorrect DMA mask configuration and subsequent probe failure. The fix ensures a fallback to the default 32-bit address width when this property is missing.
--- drivers/dma/xilinx/xilinx_dma.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +5 -2
@@ -128,6 +128,7 @@#define XILINX_MCDMA_MAX_CHANS_PER_DEVICE 0x20#define XILINX_DMA_MAX_CHANS_PER_DEVICE 0x2#define XILINX_CDMA_MAX_CHANS_PER_DEVICE 0x1 +#define XILINX_DMA_DFAULT_ADDRWIDTH 0x20#define XILINX_DMA_DMAXR_ALL_IRQ_MASK \ (XILINX_DMA_DMASR_FRM_CNT_IRQ | \
@@ -3013,7 +3014,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)struct device_node *node = pdev->dev.of_node;struct xilinx_dma_device *xdev;struct device_node *child, *np = pdev->dev.of_node; -u32 num_frames, addr_width, len_width; +u32 num_frames, addr_width =XILINX_DMA_DFAULT_ADDRWIDTH , len_width;int i, err;/* Allocate and initialize the DMA engine structure */
@@ -3082,7 +3083,9 @@ static int xilinx_dma_probe(struct platform_device *pdev) err =of_property_read_u32 (node,"xlnx,addrwidth" , &addr_width);if (err <0 ) -dev_warn (xdev->dev,"missing xlnx,addrwidth property\n" ); +dev_warn (xdev->dev, +"missing xlnx,addrwidth property, using default value %d\n" , +XILINX_DMA_DFAULT_ADDRWIDTH );if (addr_width >32 ) xdev->ext_addr = true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/206 phy: stm32-usphyc: Fix off by one in probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit cabd25b57216ddc132efbcc31f972baa03aad15a ]
The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.
--- drivers/phy/st/phy-stm32-usbphyc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/st/phy-stm32-usbphyc.c +1 -1
@@ -530,7 +530,7 @@ static int stm32_usbphyc_probe(struct platform_device *pdev) } ret =of_property_read_u32 (child,"reg" , &index); -if (ret || index > usbphyc->nphys) { +if (ret || index >= usbphyc->nphys) {dev_err (&phy->dev,"invalid reg property: %d\n" , ret);if (!ret) ret = -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/206 phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fb21116099bbea1fc59efa9207e63c4be390ab72 ]
"family" is an enum, thus cast of pointer on 64-bit compile test with clang W=1 causes:
phy-bcm-ns-usb3.c:206:17: error: cast to smaller integer type 'enum bcm_ns_family' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
This was already fixed in commit bd6e74a2f0a0 ("phy: broadcom: ns-usb3:
fix Wvoid-pointer-to-enum-cast warning") but then got bad in commit 21bf6fc47a1e ("phy: Use device_get_match_data()").
Note that after various discussions the preferred cast is via "unsigned long", not "uintptr_t".
--- drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/broadcom/phy-bcm-ns-usb3.c +1 -1
@@ -203,7 +203,7 @@ static int bcm_ns_usb3_mdio_probe(struct mdio_device *mdiodev) usb3->dev = dev; usb3->mdiodev = mdiodev; - usb3->family = (enum bcm_ns_family )device_get_match_data (dev); + usb3->family = (unsigned long )device_get_match_data (dev); syscon_np =of_parse_phandle (dev->of_node,"usb3-dmp-syscon" ,0 ); err =of_address_to_resource (syscon_np,0 , &res);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/206 dmaengine: omap-dma: fix dma_pool resource leak in error paths
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 2e1136acf8a8887c29f52e35a77b537309af321f ]
The dma_pool created by dma_pool_create() is not destroyed when dma_async_device_register() or of_dma_controller_register() fails, causing a resource leak in the probe error paths.
Add dma_pool_destroy() in both error paths to properly release the allocated dma_pool resource.
--- drivers/dma/ti/omap-dma.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/ti/omap-dma.c +4 -0
@@ -1804,6 +1804,8 @@ static int omap_dma_probe(struct platform_device *pdev)if (rc) {pr_warn ("OMAP-DMA: failed to register slave DMA engine device: %d\n" , rc); +if (od->ll123_supported) +dma_pool_destroy (od->desc_pool);omap_dma_free (od);return rc; }
@@ -1819,6 +1821,8 @@ static int omap_dma_probe(struct platform_device *pdev)if (rc) {pr_warn ("OMAP-DMA: failed to register DMA controller\n" );dma_async_device_unregister (&od->ddev); +if (od->ll123_supported) +dma_pool_destroy (od->desc_pool);omap_dma_free (od); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/206 HID: usbhid: paper over wrong bNumDescriptor field
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit f28beb69c51517aec7067dfb2074e7c751542384 upstream.
Some faulty devices (ZWO EFWmini) have a wrong optional HID class descriptor count compared to the provided length.
Given that we plainly ignore those optional descriptor, we can attempt to fix the provided number so we do not lock out those devices.
--- drivers/hid/usbhid/hid-core.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/hid/usbhid/hid-core.c +16 -1
@@ -983,6 +983,7 @@ static int usbhid_parse(struct hid_devicstruct usb_device *dev =interface_to_usbdev (intf);struct hid_descriptor *hdesc;struct hid_class_descriptor *hcdesc; +__u8 fixed_opt_descriptors_size;u32 quirks =0 ;unsigned int rsize =0 ;char *rdesc;
@@ -1013,7 +1014,21 @@ static int usbhid_parse(struct hid_devic (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) {dbg_hid ("hid descriptor invalid, bLen=%hhu bNum=%hhu\n" , hdesc->bLength, hdesc->bNumDescriptors); -return -EINVAL ; + +/* +* Some devices may expose a wrong number of descriptors compared +* to the provided length. +* However, we ignore the optional hid class descriptors entirely +* so we can safely recompute the proper field. +*/ +if (hdesc->bLength >=sizeof (*hdesc)) { + fixed_opt_descriptors_size = hdesc->bLength -sizeof (*hdesc); + +hid_warn (intf,"fixing wrong optional hid class descriptors count\n" ); + hdesc->bNumDescriptors = fixed_opt_descriptors_size /sizeof (*hcdesc) +1 ; + }else { +return -EINVAL ; + } } hid->version =le16_to_cpu (hdesc->bcdHID);
Greg Kroah-Hartman
maintainerPATCH 23/206 ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <[email protected]>
commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 upstream.
Handle the error code from snd_pcm_buffer_access_lock() in snd_pcm_runtime_buffer_set_silence() function.
Found by Alexandros Panagiotou <[email protected]>
--- include/sound/pcm.h | 2 +- sound/core/oss/pcm_oss.c | 4 +++- sound/core/pcm_native.c | 9 +++++++-- 3 files changed, 11 insertions(+), 4 deletions(-)
include/sound/pcm.h +1 -1
@@ -1384,7 +1384,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc#define snd_pcm_lib_mmap_iomem NULL#endif -void snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime); +int snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime);/** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
sound/core/oss/pcm_oss.c +3 -1
@@ -1079,7 +1079,9 @@ static int snd_pcm_oss_change_params_loc runtime->oss.params =0 ; runtime->oss.prepare =1 ; runtime->oss.buffer_used =0 ; -snd_pcm_runtime_buffer_set_silence (runtime); + err =snd_pcm_runtime_buffer_set_silence (runtime); +if (err <0 ) + goto failure; runtime->oss.period_frames =snd_pcm_alsa_frames (substream, oss_period_size);
sound/core/pcm_native.c +7 -2
@@ -705,13 +705,18 @@ static void snd_pcm_buffer_access_unlock }/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ -void snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime) +int snd_pcm_runtime_buffer_set_silence (struct snd_pcm_runtime *runtime) { -snd_pcm_buffer_access_lock (runtime); +int err; + + err =snd_pcm_buffer_access_lock (runtime); +if (err <0 ) +return err;if (runtime->dma_area)snd_pcm_format_set_silence (runtime->format, runtime->dma_area,bytes_to_samples (runtime, runtime->dma_bytes));snd_pcm_buffer_access_unlock (runtime); +return 0 ; }EXPORT_SYMBOL_GPL (snd_pcm_runtime_buffer_set_silence);
Greg Kroah-Hartman
maintainerPATCH 24/206 net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 1809c82aa073a11b7d335ae932d81ce51a588a4a upstream.
Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when the timer is enabled, we need to call j1939_session_deactivate_activate_next() if we cancelled the timer. Otherwise, refcount for j1939_session leaks, which will later appear as
| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.
problem.
--- net/can/j1939/transport.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/can/j1939/transport.c +9 -1
@@ -1699,8 +1699,16 @@ static int j1939_xtp_rx_rts_session_actij1939_session_timers_cancel (session);j1939_session_cancel (session,J1939_XTP_ABORT_BUSY ); -if (session->transmission) +if (session->transmission) {j1939_session_deactivate_activate_next (session); + }else if (session->state ==J1939_SESSION_WAITING_ABORT ) { +/* Force deactivation for the receiver. +* If we rely on the timer starting in j1939_session_cancel, +* a second RTS call here will cancel that timer and fail +* to restart it because the state is already WAITING_ABORT. +*/ +j1939_session_deactivate_activate_next (session); + }return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 25/206 x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 upstream.
Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems") is too narrow. The effect being mitigated in that commit is caused by ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general, lets any physical address be added to the direct-map. I.e. not only ACPI hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases.
Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of this problem is limited to the PCI_P2PDMA=n case.
A potential path to recover entropy would be to walk ACPI and determine the limits for hotplug and PCI MMIO before kernel_randomize_memory(). On smaller systems that could yield some KASLR address bits. This needs additional investigation to determine if some limited ACPI table scanning can happen this early without an open coded solution like arch/x86/boot/compressed/acpi.c needs to deploy.
--- arch/x86/mm/kaslr.c | 10 +++++----- drivers/pci/Kconfig | 6 ------ mm/Kconfig | 10 +++++++--- 3 files changed, 12 insertions(+), 14 deletions(-)
arch/x86/mm/kaslr.c +5 -5
@@ -98,12 +98,12 @@ void __init kernel_randomize_memory(void/* * Adapt physical memory region size based on available memory, -* except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the -* device BAR space assuming the direct map space is large enough -* for creating a ZONE_DEVICE mapping in the direct map corresponding -* to the physical BAR address. +* except when CONFIG_ZONE_DEVICE is enabled. ZONE_DEVICE wants to map +* any physical address into the direct-map. KASLR wants to reliably +* steal some physical address bits. Those design choices are in direct +* conflict. */ -if (!IS_ENABLED (CONFIG_PCI_P2PDMA ) && (memory_tb < kaslr_regions[0 ].size_tb)) +if (!IS_ENABLED (CONFIG_ZONE_DEVICE ) && (memory_tb < kaslr_regions[0 ].size_tb)) kaslr_regions[0 ].size_tb = memory_tb;/*
drivers/pci/Kconfig +0 -6
@@ -176,12 +176,6 @@ config PCI_P2PDMA P2P DMA transactions must be between devices behind the same root port. - Enabling this option will reduce the entropy of x86 KASLR memory - regions. For example - on a 46 bit system, the entropy goes down - from 16 bits to 15 bits. The actual reduction in entropy depends - on the physical address bits, on processor features, kernel config - (5 level page table) and physical memory present on the system. - If unsure, say N. config PCI_LABEL
mm/Kconfig +7 -3
@@ -790,10 +790,14 @@ config ZONE_DEVICE Device memory hotplug support allows for establishing pmem, or other device driver discovered memory regions, in the memmap. This allows pfn_to_page() lookups of otherwise - "device-physical" addresses which is needed for using a DAX - mapping in an O_DIRECT operation, among other things. + "device-physical" addresses which is needed for DAX, PCI_P2PDMA, and + DEVICE_PRIVATE features among others. - If FS_DAX is enabled, then say Y. + Enabling this option will reduce the entropy of x86 KASLR memory + regions. For example - on a 46 bit system, the entropy goes down + from 16 bits to 15 bits. The actual reduction in entropy depends + on the physical address bits, on processor features, kernel config + (5 level page table) and physical memory present on the system. config DEV_PAGEMAP_OPS bool
Greg Kroah-Hartman
maintainerPATCH 26/206 phy: rockchip: inno-usb2: fix communication disruption in gadget mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
commit 7d8f725b79e35fa47e42c88716aad8711e1168d8 upstream.
When the OTG USB port is used to power to SoC, configured as peripheral and used in gadget mode, communication stops without notice about 6 seconds after the gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs.
The related code flow in the PHY driver code can be summarized as:
* the first time chg_detect_work starts (6 seconds after gadget is configured and enumerated)
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y]
* rockchip_chg_detect_work() changes state and re-triggers itself a few times until it reaches the DETECTED state:
-> rockchip_chg_detect_work():
if chg_state is DETECTED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z]
At [Y] all existing communications stop. E.g. using a CDC serial gadget, the /dev/tty* devices are still present on both host and device, but no data is transferred anymore. The later call with a 'true' argument at [Z] does not restore it.
Due to the lack of documentation, what chg_det.opmode does exactly is not clear, however by code inspection it seems reasonable that is disables something needed to keep the communication working, and testing proves that disabling these lines lets gadget mode keep working. So prevent changes to chg_det.opmode when there is a cable connected (VBUS present).
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +4 -2
@@ -699,7 +699,8 @@ static void rockchip_chg_detect_work(strif (!rport->suspended)rockchip_usb2phy_power_off (rport->phy);/* put the controller in non-driving mode */ -property_enable (base, &rphy->phy_cfg->chg_det.opmode, false); +if (!vbus_attach) +property_enable (base, &rphy->phy_cfg->chg_det.opmode, false);/* Start DCD processing stage 1 */ rockchip_chg_enable_dcd (rphy, true); rphy->chg_state =USB_CHG_STATE_WAIT_FOR_DCD ;
@@ -763,7 +764,8 @@ static void rockchip_chg_detect_work(str fallthrough;case USB_CHG_STATE_DETECTED :/* put the controller in normal mode */ -property_enable (base, &rphy->phy_cfg->chg_det.opmode, true); +if (!vbus_attach) +property_enable (base, &rphy->phy_cfg->chg_det.opmode, true);rockchip_usb2phy_otg_sm_work (&rport->otg_sm_work.work);dev_dbg (&rport->phy->dev,"charger = %s\n" ,chg_to_string (rphy->chg_type));
Greg Kroah-Hartman
maintainerPATCH 27/206 phy: rockchip: inno-usb2: fix disconnection in gadget mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Chauvet <[email protected]>
commit 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc upstream.
When the OTG USB port is used to power the SoC, configured as peripheral and used in gadget mode, there is a disconnection about 6 seconds after the gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs.
The problem happens because of the PHY driver code flow, summarized as:
* UDC start code (triggered via configfs at any time after boot) -> phy_init
-> rockchip_usb2phy_init
-> schedule_delayed_work(otg_sm_work [A], 6 sec)
-> phy_power_on
-> rockchip_usb2phy_power_on
-> enable clock
-> rockchip_usb2phy_reset* Now the gadget interface is up and running.
* 6 seconds later otg_sm_work starts [A]
-> rockchip_usb2phy_otg_sm_work():
if (B_IDLE state && VBUS present && ...):
schedule_delayed_work(&rport->chg_work [B], 0); * immediately the chg_detect_work starts [B]
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
if (!rport->suspended):
rockchip_usb2phy_power_off() <--- [X]At [X], the PHY is powered off, causing a disconnection. This quickly triggers a new connection and following re-enumeration, but any connection that had been established during the 6 seconds is broken.
The code already checks for !rport->suspended (which, somewhat counter-intuitively, means the PHY is powered on), so add a guard for VBUS as well to avoid a disconnection when a cable is connected.
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +4 -2
@@ -689,14 +689,16 @@ static void rockchip_chg_detect_work(str container_of(work, struct rockchip_usb2phy_port, chg_work.work);struct rockchip_usb2phy *rphy =dev_get_drvdata (rport->phy->dev.parent);struct regmap *base =get_reg_base (rphy); -bool is_dcd, tmout, vout; +bool is_dcd, tmout, vout, vbus_attach;unsigned long delay; + vbus_attach =property_enabled (rphy->grf, &rport->port_cfg->utmi_bvalid); +dev_dbg (&rport->phy->dev,"chg detection work state = %d\n" , rphy->chg_state);switch (rphy->chg_state) {case USB_CHG_STATE_UNDEFINED : -if (!rport->suspended) +if (!rport->suspended && !vbus_attach)rockchip_usb2phy_power_off (rport->phy);/* put the controller in non-driving mode */ if (!vbus_attach)
Greg Kroah-Hartman
maintainerPATCH 28/206 phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit b246caa68037aa495390a60d080acaeb84f45fff upstream.
The USB2 Bias Pad Control register manages analog parameters for signal detection. Previously, the HS_DISCON_LEVEL relied on hardware reset values, which may lead to the detection failure.
Explicitly configure HS_DISCON_LEVEL to 0x7. This ensures the disconnect threshold is sufficient to guarantee reliable detection.
--- drivers/phy/tegra/xusb-tegra186.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/phy/tegra/xusb-tegra186.c +3 -0
@@ -84,6 +84,7 @@#define XUSB_PADCTL_USB2_BIAS_PAD_CTL0 0x284#define BIAS_PAD_PD BIT(11)#define HS_SQUELCH_LEVEL (x) (((x) & 0x7) << 0) +#define HS_DISCON_LEVEL (x) (((x) & 0x7) << 3)#define XUSB_PADCTL_USB2_BIAS_PAD_CTL1 0x288#define USB2_TRK_START_TIMER (x) (((x) & 0x7f) << 12)
@@ -601,6 +602,8 @@ static void tegra186_utmi_bias_pad_power value &= ~BIAS_PAD_PD ; value &= ~HS_SQUELCH_LEVEL (~0 ); value |=HS_SQUELCH_LEVEL (priv->calib.hs_squelch); + value &= ~HS_DISCON_LEVEL (~0 ); + value |=HS_DISCON_LEVEL (0x7 );padctl_writel (padctl, value,XUSB_PADCTL_USB2_BIAS_PAD_CTL0 );udelay (1 );
Greg Kroah-Hartman
maintainerPATCH 29/206 usb: dwc3: Check for USB4 IP_NAME
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit 0ed91d47959cb7573c17e06487f0fb891d59dfb3 upstream.
Synopsys renamed DWC_usb32 IP to DWC_usb4 as of IP version 1.30. No functional change except checking for the IP_NAME here. The driver will treat the new IP_NAME as if it's DWC_usb32. Additional features for USB4 will be introduced and checked separately.
--- drivers/usb/dwc3/core.c | 2 ++ drivers/usb/dwc3/core.h | 1 + 2 files changed, 3 insertions(+)
drivers/usb/dwc3/core.c +2 -0
@@ -778,6 +778,8 @@ static bool dwc3_core_is_valid(struct dw reg =dwc3_readl (dwc->regs,DWC3_GSNPSID ); dwc->ip =DWC3_GSNPS_ID (reg); +if (dwc->ip ==DWC4_IP ) + dwc->ip =DWC32_IP ;/* This should read as U3 followed by revision number */ if (DWC3_IP_IS (DWC3 )) {
drivers/usb/dwc3/core.h +1 -0
@@ -1175,6 +1175,7 @@ struct dwc3 {#define DWC3_IP 0x5533#define DWC31_IP 0x3331#define DWC32_IP 0x3332 +#define DWC4_IP 0x3430u32 revision;
Greg Kroah-Hartman
maintainerPATCH 30/206 USB: OHCI/UHCI: Add soft dependencies on ehci_platform
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 01ef7f1b8713a78ab1a9512cf8096d2474c70633 upstream.
Commit 9beeee6584b9aa4f ("USB: EHCI: log a warning if ehci-hcd is not loaded first") said that ehci-hcd should be loaded before ohci-hcd and uhci-hcd. However, commit 05c92da0c52494ca ("usb: ohci/uhci - add soft dependencies on ehci_pci") only makes ohci-pci/uhci-pci depend on ehci- pci, which is not enough and we may still see the warnings in boot log.
To eliminate the warnings we should make ohci-hcd/uhci-hcd depend on ehci-hcd. But Alan said that the warning introduced by 9beeee6584b9aa4f is bogus, we only need the soft dependencies in the PCI level rather than the HCD level.
However, there is really another neccessary soft dependencies between ohci-platform/uhci-platform and ehci-platform, which is added by this patch. The boot logs are below.
1. ohci-platform loaded before ehci-platform:
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 1
ohci-platform 1f058000.usb: irq 28, io mem 0x1f058000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after
usb 1-4: new low-speed USB device number 2 using ohci-platform
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 2
ehci-platform 1f050000.usb: irq 29, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
usb 1-4: device descriptor read/all, error -62
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 1-4: new low-speed USB device number 3 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb1/1-4/1-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
2. ehci-platform loaded before ohci-platform:
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 1
ehci-platform 1f050000.usb: irq 28, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 2
ohci-platform 1f058000.usb: irq 29, io mem 0x1f058000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 2-4: new low-speed USB device number 2 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb2/2-4/2-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
In the later case, there is no re-connection for USB-1.0/1.1 devices, which is expected.
--- drivers/usb/host/ohci-platform.c | 1 + drivers/usb/host/uhci-platform.c | 1 + 2 files changed, 2 insertions(+)
drivers/usb/host/ohci-platform.c +1 -0
@@ -359,3 +359,4 @@ MODULE_DESCRIPTION(DRIVER_DESC);MODULE_AUTHOR ("Hauke Mehrtens" );MODULE_AUTHOR ("Alan Stern" );MODULE_LICENSE ("GPL" ); +MODULE_SOFTDEP ("pre: ehci_platform" );
drivers/usb/host/uhci-platform.c +1 -0
@@ -190,3 +190,4 @@ static struct platform_driver uhci_platf .of_match_table = platform_uhci_ids, }, }; +MODULE_SOFTDEP ("pre: ehci_platform" );
Greg Kroah-Hartman
maintainerPATCH 31/206 USB: serial: option: add Telit LE910 MBIM composition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulrich Mohr <[email protected]>
commit 8af4274ab5999831f4757dfd5bd11665ba3b1569 upstream.
Add support for Telit LE910 module when operating in MBIM composition with additional ttys. This USB product ID is used by the module when AT#USBCFG is set to 7.
0x1252: MBIM + tty(NMEA) + tty(MODEM) + tty(MODEM) + SAP
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1252 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -1505,6 +1505,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
Greg Kroah-Hartman
maintainerPATCH 32/206 USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
commit c0afe95e62984ceea171c3ea319beaf84a21181c upstream.
The vendor provides instructions to write "0403 bd90" to /sys/bus/usb-serial/drivers/ftdi_sio/new_id; see:
https://picaxe.com/docs/picaxe_linux_instructions.pdf
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 2 ++ 2 files changed, 3 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -828,6 +828,7 @@ static const struct usb_device_id id_tab { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, + { USB_DEVICE(FTDI_VID, FTDI_AXE027_PID) }, { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
drivers/usb/serial/ftdi_sio_ids.h +2 -0
@@ -89,6 +89,8 @@#define LMI_LM3S_EVAL_BOARD_PID 0xbcd9#define LMI_LM3S_ICDI_BOARD_PID 0xbcda +#define FTDI_AXE027_PID 0xBD90/* PICAXE AXE027 USB download cable */ +#define FTDI_TURTELIZER_PID 0xBDC8/* JTAG/RS-232 adapter by egnite GmbH */ /* OpenDCC (www.opendcc.de) product id */
Greg Kroah-Hartman
maintainerPATCH 33/206 nvme-pci: disable secondary temp for Wodposit WPBSNM8
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilikara Zheng <[email protected]>
commit 340f4fc5508c2905a1f30de229e2a4b299d55735 upstream.
Secondary temperature thresholds (temp2_{min,max}) were not reported properly on this NVMe SSD. This resulted in an error while attempting to read these values with sensors(1):
ERROR: Can't get value of subfeature temp2_min: I/O error
ERROR: Can't get value of subfeature temp2_max: I/O error
Add the device to the nvme_id_table with the NVME_QUIRK_NO_SECONDARY_TEMP_THRESH flag to suppress access to all non- composite temperature thresholds.
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -3450,6 +3450,8 @@ static const struct pci_device_id nvme_i .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, { PCI_DEVICE(0x1e49, 0x0041), /* ZHITAI TiPro7000 NVMe SSD */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0x1fa0, 0x2283), /* Wodposit WPBSNM8-256GTP */ + .driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, }, { PCI_DEVICE(0x025e, 0xf1ac), /* SOLIDIGM P44 pro SSDPFKKW020X7 */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, { PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */
Greg Kroah-Hartman
maintainerPATCH 34/206 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 upstream.
The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.
--- fs/ext4/xattr.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/xattr.c +1 -0
@@ -984,6 +984,7 @@ static int ext4_xattr_inode_update_ref(hext4_error_inode (ea_inode, __func__, __LINE__,0 ,"EA inode %lu ref wraparound: ref_count=%lld ref_change=%d" , ea_inode->i_ino, ref_count, ref_change); +brelse (iloc.bh); ret = -EFSCORRUPTED ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 35/206 hrtimer: Fix softirq base check in update_needs_ipi()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 upstream.
The 'clockid' field is not the correct way to check for a softirq base.
Fix the check to correctly compare the base type instead of the clockid.
--- kernel/time/hrtimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/hrtimer.c +1 -1
@@ -903,7 +903,7 @@ static bool update_needs_ipi(struct hrtireturn true;/* Extra check for softirq clock bases */ -if (base->clockid <HRTIMER_BASE_MONOTONIC_SOFT ) +if (base->index <HRTIMER_BASE_MONOTONIC_SOFT )continue ;if (cpu_base->softirq_activated)continue ;
Greg Kroah-Hartman
maintainerPATCH 36/206 EDAC/x38: Fix a resource leak in x38_probe1()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
--- drivers/edac/x38_edac.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/edac/x38_edac.c +6 -3
@@ -341,9 +341,12 @@ static int x38_probe1(struct pci_dev *pd layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = x38_channel_num; layers[1 ].is_virt_csrow = false; + + + rc = -ENOMEM ; mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers,0 );if (!mci) -return -ENOMEM ; + goto unmap;edac_dbg (3 ,"MC: init mci\n" );
@@ -403,9 +406,9 @@ static int x38_probe1(struct pci_dev *pdreturn 0 ; fail: +edac_mc_free (mci); +unmap:iounmap (window); -if (mci) -edac_mc_free (mci);return rc; }
Greg Kroah-Hartman
maintainerPATCH 37/206 EDAC/i3200: Fix a resource leak in i3200_probe1()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d42d5715dcb559342ff356327b241c53a67584d9 upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
--- drivers/edac/i3200_edac.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/edac/i3200_edac.c +6 -5
@@ -358,10 +358,11 @@ static int i3200_probe1(struct pci_dev * layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels; layers[1 ].is_virt_csrow = false; - mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers, -sizeof (struct i3200_priv )); + + rc = -ENOMEM ; + mci =edac_mc_alloc (0 ,ARRAY_SIZE (layers), layers,sizeof (struct i3200_priv ));if (!mci) -return -ENOMEM ; + goto unmap;edac_dbg (3 ,"MC: init mci\n" );
@@ -421,9 +422,9 @@ static int i3200_probe1(struct pci_dev *return 0 ; fail: +edac_mc_free (mci); +unmap:iounmap (window); -if (mci) -edac_mc_free (mci);return rc; }
Greg Kroah-Hartman
maintainerPATCH 38/206 x86/resctrl: Add missing resctrl initialization for Hygon
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <[email protected]>
commit 6ee98aabdc700b5705e4f1833e2edc82a826b53b upstream.
Hygon CPUs supporting Platform QoS features currently undergo partial resctrl initialization through resctrl_cpu_detect() in the Hygon BSP init helper and AMD/Hygon common initialization code. However, several critical data structures remain uninitialized for Hygon CPUs in the following paths:
- get_mem_config()-> __rdt_get_mem_config_amd():
rdt_resource::membw,alloc_capable
hw_res::num_closid
- rdt_init_res_defs()->rdt_init_res_defs_amd():
rdt_resource::cache
hw_res::msr_base,msr_update
Add the missing AMD/Hygon common initialization to ensure proper Platform QoS functionality on Hygon CPUs.
--- arch/x86/kernel/cpu/resctrl/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/core.c +4 -2
@@ -769,7 +769,8 @@ static __init bool get_mem_config(void)if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL )return __get_mem_config_intel (&hw_res->r_resctrl); -else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD ) +else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD || + boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON )return __rdt_get_mem_config_amd (&hw_res->r_resctrl);return false;
@@ -904,7 +905,8 @@ static __init void rdt_init_res_defs(voi {if (boot_cpu_data.x86_vendor ==X86_VENDOR_INTEL )rdt_init_res_defs_intel (); -else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD ) +else if (boot_cpu_data.x86_vendor ==X86_VENDOR_AMD || + boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON )rdt_init_res_defs_amd (); }
Greg Kroah-Hartman
maintainerPATCH 39/206 x86/resctrl: Fix memory bandwidth counter width for Hygon
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <[email protected]>
commit 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c upstream.
The memory bandwidth calculation relies on reading the hardware counter and measuring the delta between samples. To ensure accurate measurement, the software reads the counter frequently enough to prevent it from rolling over twice between reads.
The default Memory Bandwidth Monitoring (MBM) counter width is 24 bits. Hygon CPUs provide a 32-bit width counter, but they do not support the MBM capability CPUID leaf (0xF.[ECX=1]:EAX) to report the width offset (from 24 bits).
Consequently, the kernel falls back to the 24-bit default counter width, which causes incorrect overflow handling on Hygon CPUs.
Fix this by explicitly setting the counter width offset to 8 bits (resulting in a 32-bit total counter width) for Hygon CPUs.
--- arch/x86/kernel/cpu/resctrl/core.c | 15 +++++++++++++-- arch/x86/kernel/cpu/resctrl/internal.h | 3 +++ 2 files changed, 16 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/core.c +13 -2
@@ -937,8 +937,19 @@ void resctrl_cpu_detect(struct cpuinfo_x c->x86_cache_occ_scale = ebx; c->x86_cache_mbm_width_offset = eax &0xff ; -if (c->x86_vendor ==X86_VENDOR_AMD && !c->x86_cache_mbm_width_offset) - c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_AMD ; +if (!c->x86_cache_mbm_width_offset) { +switch (c->x86_vendor) { +case X86_VENDOR_AMD : + c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_AMD ; +break ; +case X86_VENDOR_HYGON : + c->x86_cache_mbm_width_offset =MBM_CNTR_WIDTH_OFFSET_HYGON ; +break ; +default : +/* Leave c->x86_cache_mbm_width_offset as 0 */ +break ; + } + } } }
arch/x86/kernel/cpu/resctrl/internal.h +3 -0
@@ -40,6 +40,9 @@#define MAX_MBA_BW_AMD 0x800#define MBM_CNTR_WIDTH_OFFSET_AMD 20 +/* Hygon MBM counter width as an offset from MBM_CNTR_WIDTH_BASE */ +#define MBM_CNTR_WIDTH_OFFSET_HYGON 8 +#define RMID_VAL_ERROR BIT_ULL(63)#define RMID_VAL_UNAVAIL BIT_ULL(62)/*
Greg Kroah-Hartman
maintainerPATCH 40/206 mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <[email protected]>
commit b9efe36b5e3eb2e91aa3d706066428648af034fc upstream.
When page isolation loops indefinitely during memory offline, reading /proc/sys/vm/percpu_pagelist_high_fraction blocks on pcp_batch_high_lock, causing hung task warnings.
Make procfs reads lock-free since percpu_pagelist_high_fraction is a simple integer with naturally atomic reads, writers still serialize via the mutex.
This prevents hung task warnings when reading the procfs file during long-running memory offline operations.
--- mm/page_alloc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
mm/page_alloc.c +9 -1
@@ -8764,11 +8764,19 @@ int percpu_pagelist_high_fraction_sysctlint old_percpu_pagelist_high_fraction;int ret; +/* +* Avoid using pcp_batch_high_lock for reads as the value is read +* atomically and a race with offlining is harmless. +*/ + +if (!write) +return proc_dointvec_minmax (table, write, buffer, length, ppos); +mutex_lock (&pcp_batch_high_lock); old_percpu_pagelist_high_fraction = percpu_pagelist_high_fraction; ret =proc_dointvec_minmax (table, write, buffer, length, ppos); -if (!write || ret <0 ) +if (ret <0 ) goto out;/* Sanity checking to avoid pcp imbalance */
Greg Kroah-Hartman
maintainerPATCH 41/206 drm/amd: Clean up kfd node on surprise disconnect
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
When an eGPU is unplugged the KFD topology should also be destroyed for that GPU. This never happens because the fini_sw callbacks never get to run. Run them manually before calling amdgpu_device_ip_fini_early() when a device has already been disconnected.
This location is intentionally chosen to make sure that the kfd locking refcount doesn't get incremented unintentionally.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +8 -0
@@ -3999,6 +3999,14 @@ void amdgpu_device_fini_hw(struct amdgpuamdgpu_irq_fini_hw (adev); +/* +* device went through surprise hotplug; we need to destroy topology +* before ip_fini_early to prevent kfd locking refcount issues by calling +* amdgpu_amdkfd_suspend() +*/ +if (drm_dev_is_unplugged (adev_to_drm (adev))) +amdgpu_amdkfd_device_fini_sw (adev); +amdgpu_device_ip_fini_early (adev);amdgpu_gart_dummy_page_fini (adev);
Greg Kroah-Hartman
maintainerPATCH 42/206 drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <[email protected]>
commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
For a while, I've been seeing a strange issue where some (usually not all) of the display DMA channels will suddenly hang, particularly when there is a visible cursor on the screen that is being frequently updated, and especially when said cursor happens to go between two screens. While this brings back lovely memories of fixing Intel Skylake bugs, I would quite like to fix it :).
It turns out the problem that's happening here is that we're managing to reach nv50_head_flush_set() in our atomic commit path without actually holding nv50_disp->mutex. This means that cursor updates happening in parallel (along with any other atomic updates that need to use the core channel) will race with eachother, which eventually causes us to corrupt the pushbuffer - leading to a plethora of various GSP errors, usually:
nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
The reason this is happening is because generally we check whether we need to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). However, curs507a_prepare is called from the fb_prepare callback, which happens after the atomic check phase. As a result, this can lead to commits that both touch the core channel but also don't grab nv50_disp->mutex.
So, fix this by making sure that we set nv50_atom->lock_core in cus507a_prepare().
--- drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/dispnv50/curs507a.c +1 -0
@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw, asyh->curs.handle = handle; asyh->curs.offset = offset; asyh->set.curs = asyh->curs.visible; +nv50_atom (asyh->state.state)->lock_core = true; } }
Greg Kroah-Hartman
maintainerPATCH 43/206 drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set. This leads to a warning and a backtrace in the kernel log and panel does not work:
"
WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
"
The warning is triggered by a check for valid connector type in devm_drm_panel_bridge_add(). If there is no valid connector type set for a panel, the warning is printed and panel is not added. Fill in the missing connector type to fix the warning and make the panel operational once again.
--- drivers/gpu/drm/panel/panel-simple.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panel/panel-simple.c +1 -0
@@ -1921,6 +1921,7 @@ static const struct panel_desc dataimage }, .bus_format = MEDIA_BUS_FMT_RGB888_1X24, .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, + .connector_type = DRM_MODE_CONNECTOR_DPI, };static const struct display_timing dlc_dlc0700yzg_1_timing = {
Greg Kroah-Hartman
maintainerPATCH 44/206 drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
In vmw_compat_shader_add(), the return value check of vmw_shader_alloc() is not proper. Modify the check for the return pointer 'res'.
Found by code review and compiled on ubuntu 20.04.
--- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +3 -1
@@ -996,8 +996,10 @@ int vmw_compat_shader_add(struct vmw_prittm_bo_unreserve (&buf->base); res =vmw_shader_alloc (dev_priv, buf, size,0 , shader_type); -if (unlikely (ret !=0 )) +if (IS_ERR (res)) { + ret =PTR_ERR (res); goto no_reserve; + } ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader, vmw_shader_key(user_key, shader_type),
Greg Kroah-Hartman
maintainerPATCH 45/206 dmaengine: at_hdmac: fix device leak on of_dma_xlate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
Make sure to drop the reference taken when looking up the DMA platform device during of_dma_xlate() when releasing channel resources.
Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") fixed the leak in a couple of error paths but the reference is still leaking on successful allocation.
--- drivers/dma/at_hdmac.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/dma/at_hdmac.c +7 -2
@@ -1339,6 +1339,7 @@ static int atc_config(struct dma_chan *c struct dma_slave_config *sconfig) {struct at_dma_chan *atchan =to_at_dma_chan (chan); +struct at_dma_slave *atslave;dev_vdbg (chan2dev (chan),"%s\n" , __func__);
@@ -1598,8 +1599,12 @@ static void atc_free_chan_resources(stru/* * Free atslave allocated in at_dma_xlate() */ -kfree (chan->private); - chan->private =NULL ; + atslave = chan->private; +if (atslave) { +put_device (atslave->dma_dev); +kfree (atslave); + chan->private =NULL ; + }dev_vdbg (chan2dev (chan),"free_chan_resources: done\n" ); }
Greg Kroah-Hartman
maintainerPATCH 46/206 dmaengine: bcm-sba-raid: fix device leak on probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind.
--- drivers/dma/bcm-sba-raid.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/dma/bcm-sba-raid.c +5 -1
@@ -1707,7 +1707,7 @@ static int sba_probe(struct platform_dev/* Prealloc channel resource */ ret =sba_prealloc_channel_resources (sba);if (ret) - goto fail_free_mchan; + goto fail_put_mbox;/* Check availability of debugfs */ if (!debugfs_initialized ())
@@ -1737,6 +1737,8 @@ skip_debugfs: fail_free_resources:debugfs_remove_recursive (sba->root);sba_freeup_channel_resources (sba); +fail_put_mbox: +put_device (sba->mbox_dev); fail_free_mchan:mbox_free_channel (sba->mchan);return ret;
@@ -1752,6 +1754,8 @@ static int sba_remove(struct platform_desba_freeup_channel_resources (sba); +put_device (sba->mbox_dev); +mbox_free_channel (sba->mchan);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 47/206 dmaengine: idxd: fix device leaks on compat bind and unbind
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 799900f01792cf8b525a44764f065f83fcafd468 upstream.
Make sure to drop the reference taken when looking up the idxd device as part of the compat bind and unbind sysfs interface.
--- drivers/dma/idxd/compat.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/dma/idxd/compat.c +19 -4
@@ -21,11 +21,16 @@ static ssize_t unbind_store(struct devicint rc = -ENODEV ; dev =bus_find_device_by_name (bus,NULL , buf); -if (dev && dev->driver) { +if (!dev) +return -ENODEV ; + +if (dev->driver) {device_driver_detach (dev); rc = count; } +put_device (dev); +return rc; } static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
@@ -39,9 +44,12 @@ static ssize_t bind_store(struct device_struct idxd_dev *idxd_dev; dev =bus_find_device_by_name (bus,NULL , buf); -if (!dev || dev->driver || drv != &dsa_drv.drv) +if (!dev)return -ENODEV ; +if (dev->driver || drv != &dsa_drv.drv) + goto err_put_dev; + idxd_dev =confdev_to_idxd_dev (dev);if (is_idxd_dev (idxd_dev)) { alt_drv =driver_find ("idxd" , bus);
@@ -54,13 +62,20 @@ static ssize_t bind_store(struct device_ alt_drv =driver_find ("user" , bus); }if (!alt_drv) -return -ENODEV ; + goto err_put_dev; rc =device_driver_attach (alt_drv, dev);if (rc <0 ) -return rc; + goto err_put_dev; + +put_device (dev);return count; + +err_put_dev: +put_device (dev); + +return rc; } static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
Greg Kroah-Hartman
maintainerPATCH 48/206 dmaengine: lpc18xx-dmamux: fix device leak on route allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/dma/lpc18xx-dmamux.c +14 -5
@@ -55,30 +55,31 @@ static void *lpc18xx_dmamux_reserve(strustruct lpc18xx_dmamux_data *dmamux =platform_get_drvdata (pdev);unsigned long flags;unsigned mux; +int ret = -EINVAL ;if (dma_spec->args_count !=3 ) {dev_err (&pdev->dev,"invalid number of dma mux args\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; } mux = dma_spec->args[0 ];if (mux >= dmamux->dma_master_requests) {dev_err (&pdev->dev,"invalid mux number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }if (dma_spec->args[1 ] >LPC18XX_DMAMUX_MAX_VAL ) {dev_err (&pdev->dev,"invalid dma mux value: %d\n" , dma_spec->args[1 ]); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }/* The of_node_put() will be done in the core for the node */ dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"can't get dma master\n" ); -return ERR_PTR (-EINVAL ); + goto err_put_pdev; }spin_lock_irqsave (&dmamux->lock, flags);
@@ -87,7 +88,8 @@ static void *lpc18xx_dmamux_reserve(strudev_err (&pdev->dev,"dma request %u busy with %u.%u\n" , mux, mux, dmamux->muxes[mux].value);of_node_put (dma_spec->np); -return ERR_PTR (-EBUSY ); + ret = -EBUSY ; + goto err_put_pdev; } dmamux->muxes[mux].busy = true;
@@ -104,7 +106,14 @@ static void *lpc18xx_dmamux_reserve(strudev_dbg (&pdev->dev,"mapping dmamux %u.%u to dma request %u\n" , mux, dmamux->muxes[mux].value, mux); +put_device (&pdev->dev); +return &dmamux->muxes[mux]; + +err_put_pdev: +put_device (&pdev->dev); + +return ERR_PTR (ret); }static int lpc18xx_dmamux_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 49/206 dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
Fix a memory leak in gpi_peripheral_config() where the original memory pointed to by gchan->config could be lost if krealloc() fails.
The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the reference to the original memory
4. The original memory becomes unreachable and cannot be freed
Fix this by using a temporary variable to hold the krealloc() result and only updating gchan->config when the allocation succeeds.
Found via static analysis and code review.
--- drivers/dma/qcom/gpi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/dma/qcom/gpi.c +4 -2
@@ -1621,14 +1621,16 @@ static int gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) { struct gchan *gchan = to_gchan(chan); +void *new_config;if (!config->peripheral_config)return -EINVAL ; - gchan->config =krealloc (gchan->config, config->peripheral_size,GFP_NOWAIT ); -if (!gchan->config) + new_config =krealloc (gchan->config, config->peripheral_size,GFP_NOWAIT ); +if (!new_config)return -ENOMEM ; + gchan->config = new_config;memcpy (gchan->config, config->peripheral_config, config->peripheral_size);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 50/206 dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream.
After audio full duplex testing, playing the recorded file contains a few playback frames from the previous time. The rz_dmac_terminate_all() does not reset all the hardware descriptors queued previously, leading to the wrong descriptor being picked up during the next DMA transfer. Fix the above issue by resetting all the descriptor headers for a channel in rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg().
--- drivers/dma/sh/rz-dmac.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/dma/sh/rz-dmac.c +5 -0
@@ -531,11 +531,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *cstatic int rz_dmac_terminate_all (struct dma_chan *chan) {struct rz_dmac_chan *channel =to_rz_dmac_chan (chan); +struct rz_lmdesc *lmdesc = channel->lmdesc.base;unsigned long flags; +unsigned int i;LIST_HEAD (head);rz_dmac_disable_hw (channel);spin_lock_irqsave (&channel->vc.lock, flags); +for (i =0 ; i <DMAC_NR_LMDESC ; i++) + lmdesc[i].header =0 ; +list_splice_tail_init (&channel->ld_active, &channel->ld_free);list_splice_tail_init (&channel->ld_queue, &channel->ld_free);spin_unlock_irqrestore (&channel->vc.lock, flags);
Greg Kroah-Hartman
maintainerPATCH 51/206 dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
Make sure to drop the reference taken when looking up the crossbar platform device during dra7x route allocation.
Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the reference is still leaking on successful allocation.
--- drivers/dma/ti/dma-crossbar.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/ti/dma-crossbar.c +2 -0
@@ -287,6 +287,8 @@ static void *ti_dra7_xbar_route_allocateti_dra7_xbar_write (xbar->iomem, map->xbar_out, map->xbar_in); +put_device (&pdev->dev); +return map; }
Greg Kroah-Hartman
maintainerPATCH 52/206 dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
Make sure to drop the reference taken when looking up the crossbar platform device during am335x route allocation.
--- drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/dma/ti/dma-crossbar.c +10 -6
@@ -78,34 +78,35 @@ static void *ti_am335x_xbar_route_alloca {struct platform_device *pdev =of_find_device_by_node (ofdma->of_node);struct ti_am335x_xbar_data *xbar =platform_get_drvdata (pdev); -struct ti_am335x_xbar_map *map; +struct ti_am335x_xbar_map *map =ERR_PTR (-EINVAL );if (dma_spec->args_count !=3 ) -return ERR_PTR (-EINVAL ); + goto out_put_pdev;if (dma_spec->args[2 ] >= xbar->xbar_events) {dev_err (&pdev->dev,"Invalid XBAR event number: %d\n" , dma_spec->args[2 ]); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; }if (dma_spec->args[0 ] >= xbar->dma_requests) {dev_err (&pdev->dev,"Invalid DMA request line number: %d\n" , dma_spec->args[0 ]); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; }/* The of_node_put() will be done in the core for the node */ dma_spec->np =of_parse_phandle (ofdma->of_node,"dma-masters" ,0 );if (!dma_spec->np) {dev_err (&pdev->dev,"Can't get DMA master\n" ); -return ERR_PTR (-EINVAL ); + goto out_put_pdev; } map =kzalloc (sizeof (*map),GFP_KERNEL );if (!map) {of_node_put (dma_spec->np); -return ERR_PTR (-ENOMEM ); + map =ERR_PTR (-ENOMEM ); + goto out_put_pdev; } map->dma_line = (u16 )dma_spec->args[0 ];
@@ -119,6 +120,9 @@ static void *ti_am335x_xbar_route_allocati_am335x_xbar_write (xbar->iomem, map->dma_line, map->mux_val); +out_put_pdev: +put_device (&pdev->dev); +return map; }
Greg Kroah-Hartman
maintainerPATCH 53/206 dmaengine: ti: k3-udma: fix device leak on udma lookup
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
Make sure to drop the reference taken when looking up the UDMA platform device.
Note that holding a reference to a platform device does not prevent its driver data from going away so there is no point in keeping the reference after the lookup helper returns.
--- drivers/dma/ti/k3-udma-private.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/ti/k3-udma-private.c +1 -1
@@ -40,9 +40,9 @@ struct udma_dev *of_xudma_dev_get(struct } ud =platform_get_drvdata (pdev); +put_device (&pdev->dev);if (!ud) {pr_debug ("UDMA has not been probed\n" ); -put_device (&pdev->dev);return ERR_PTR (-EPROBE_DEFER ); }
Greg Kroah-Hartman
maintainerPATCH 54/206 btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit 5037b342825df7094a4906d1e2a9674baab50cb2 upstream.
When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction without considering whether the given transaction type actually needs to wait for that particular transaction state. The btrfs_blocked_trans_types[] array already defines which transaction types should wait for which transaction states, but this check was missing in wait_current_trans().
This can lead to a deadlock scenario involving two transactions and pending ordered extents:
1. Transaction A is in TRANS_STATE_COMMIT_DOING state
2. A worker processing an ordered extent calls start_transaction() with TRANS_JOIN
3. join_transaction() returns -EBUSY because Transaction A is in TRANS_STATE_COMMIT_DOING
4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes
5. A new Transaction B is created (TRANS_STATE_RUNNING)
6. The ordered extent from step 2 is added to Transaction B's pending ordered extents
7. Transaction B immediately starts commit by another task and enters TRANS_STATE_COMMIT_START
8. The worker finally reaches wait_current_trans(), sees Transaction B in TRANS_STATE_COMMIT_START (a blocked state), and waits unconditionally
9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START
according to btrfs_blocked_trans_types[]
10. Transaction B is waiting for pending ordered extents to complete
11. Deadlock: Transaction B waits for ordered extent, ordered extent waits for Transaction B
This can be illustrated by the following call stacks:
CPU0 CPU1
btrfs_finish_ordered_io()
start_transaction(TRANS_JOIN)
join_transaction()
# -EBUSY (Transaction A is # TRANS_STATE_COMMIT_DOING)
# Transaction A completes
# Transaction B created
# ordered extent added to
# Transaction B's pending list
btrfs_commit_transaction()
# Transaction B enters
# TRANS_STATE_COMMIT_START
# waiting for pending ordered
# extents
wait_current_trans()
# waits for Transaction B
# (should not wait!)Task bstore_kv_sync in btrfs_commit_transaction waiting for ordered extents:
__schedule+0x2e7/0x8a0 schedule+0x64/0xe0 btrfs_commit_transaction+0xbf7/0xda0 [btrfs] btrfs_sync_file+0x342/0x4d0 [btrfs] __x64_sys_fdatasync+0x4b/0x80 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Task kworker in wait_current_trans waiting for transaction commit:
Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs] __schedule+0x2e7/0x8a0 schedule+0x64/0xe0 wait_current_trans+0xb0/0x110 [btrfs] start_transaction+0x346/0x5b0 [btrfs] btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs] btrfs_work_helper+0xe8/0x350 [btrfs] process_one_work+0x1d3/0x3c0 worker_thread+0x4d/0x3e0 kthread+0x12d/0x150 ret_from_fork+0x1f/0x30
Fix this by passing the transaction type to wait_current_trans() and checking btrfs_blocked_trans_types[cur_trans->state] against the given type before deciding to wait. This ensures that transaction types which are allowed to join during certain blocked states will not unnecessarily wait and cause deadlocks.
--- fs/btrfs/transaction.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/btrfs/transaction.c +6 -5
@@ -528,13 +528,14 @@ static inline int is_transaction_blocked* when this is done, it is safe to start a new transaction, but the current * transaction might not be fully on disk. */ -static void wait_current_trans (struct btrfs_fs_info *fs_info) +static void wait_current_trans (struct btrfs_fs_info *fs_info,unsigned int type) {struct btrfs_transaction *cur_trans;spin_lock (&fs_info->trans_lock); cur_trans = fs_info->running_transaction; -if (cur_trans &&is_transaction_blocked (cur_trans)) { +if (cur_trans &&is_transaction_blocked (cur_trans) && + (btrfs_blocked_trans_types[cur_trans->state] & type)) {refcount_inc (&cur_trans->use_count);spin_unlock (&fs_info->trans_lock);
@@ -680,12 +681,12 @@ again:sb_start_intwrite (fs_info->sb);if (may_wait_transaction (fs_info, type)) -wait_current_trans (fs_info); +wait_current_trans (fs_info, type); do { ret = join_transaction(fs_info, type); if (ret == -EBUSY) { - wait_current_trans(fs_info); + wait_current_trans(fs_info, type); if (unlikely(type == TRANS_ATTACH || type == TRANS_JOIN_NOSTART)) ret = -ENOENT;
@@ -952,7 +953,7 @@ out:void btrfs_throttle (struct btrfs_fs_info *fs_info) { -wait_current_trans (fs_info); +wait_current_trans (fs_info,TRANS_START ); }static bool should_end_transaction (struct btrfs_trans_handle *trans)
Greg Kroah-Hartman
maintainerPATCH 55/206 posix-clock: introduce posix_clock_context concept
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xabier Marquiegui <[email protected]>
[ Upstream commit 60c6946675fc06dd2fd2b7a4b6fd1c1f046f1056 ]
Add the necessary structure to support custom private-data per posix-clock user.
The previous implementation of posix-clock assumed all file open instances need access to the same clock structure on private_data.
The need for individual data structures per file open instance has been identified when developing support for multiple timestamp event queue users for ptp_clock.
Stable-dep-of: e859d375d169 ("posix-clock: Store file pointer in struct posix_clock_context")
--- drivers/ptp/ptp_chardev.c | 21 +++++++++++++-------- drivers/ptp/ptp_private.h | 16 +++++++++------- include/linux/posix-clock.h | 35 +++++++++++++++++++++++++++-------- kernel/time/posix-clock.c | 36 +++++++++++++++++++++++++++--------- 4 files changed, 76 insertions(+), 32 deletions(-)
drivers/ptp/ptp_chardev.c +13 -8
@@ -103,14 +103,16 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,return 0 ; } -int ptp_open (struct posix_clock *pc,fmode_t fmode) +int ptp_open (struct posix_clock_context *pccontext,fmode_t fmode) {return 0 ; } -long ptp_ioctl (struct posix_clock *pc,unsigned int cmd,unsigned long arg) +long ptp_ioctl (struct posix_clock_context *pccontext,unsigned int cmd, +unsigned long arg) { - struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock);struct ptp_sys_offset_extended *extoff =NULL ;struct ptp_sys_offset_precise precise_offset;struct system_device_crosststamp xtstamp;
@@ -434,9 +436,11 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)return err; } -__poll_t ptp_poll (struct posix_clock *pc,struct file *fp,poll_table *wait) +__poll_t ptp_poll (struct posix_clock_context *pccontext,struct file *fp, +poll_table *wait) { - struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock);poll_wait (fp, &ptp->tsev_wq, wait);
@@ -445,10 +449,11 @@ __poll_t ptp_poll(struct posix_clock *pc, struct file *fp, poll_table *wait)#define EXTTS_BUFSIZE (PTP_BUF_TIMESTAMPS * sizeof(struct ptp_extts_event)) -ssize_t ptp_read (struct posix_clock *pc, -uint rdflags,char __user *buf,size_t cnt) +ssize_t ptp_read (struct posix_clock_context *pccontext,uint rdflags, +char __user *buf,size_t cnt) { - struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock);struct timestamp_event_queue *queue = &ptp->tsevq;struct ptp_extts_event *event;unsigned long flags;
drivers/ptp/ptp_private.h +9 -7
@@ -125,16 +125,18 @@ extern struct class *ptp_class;int ptp_set_pinfunc (struct ptp_clock *ptp,unsigned int pin,enum ptp_pin_function func,unsigned int chan); -long ptp_ioctl (struct posix_clock *pc, -unsigned int cmd,unsigned long arg); +long ptp_ioctl (struct posix_clock_context *pccontext,unsigned int cmd, +unsigned long arg); -int ptp_open (struct posix_clock *pc,fmode_t fmode); +int ptp_open (struct posix_clock_context *pccontext,fmode_t fmode); -ssize_t ptp_read (struct posix_clock *pc, -uint flags,char __user *buf,size_t cnt); +int ptp_release (struct posix_clock_context *pccontext); -__poll_t ptp_poll (struct posix_clock *pc, -struct file *fp,poll_table *wait); +ssize_t ptp_read (struct posix_clock_context *pccontext,uint flags,char __user *buf, +size_t cnt); + +__poll_t ptp_poll (struct posix_clock_context *pccontext,struct file *fp, +poll_table *wait);/* * see ptp_sysfs.c
include/linux/posix-clock.h +27 -8
@@ -14,6 +14,7 @@#include <linux/rwsem.h> struct posix_clock ; +struct posix_clock_context ;/** * struct posix_clock_operations - functional interface to the clock
@@ -50,18 +51,18 @@ struct posix_clock_operations {/* * Optional character device methods: */ -long (*ioctl) (struct posix_clock *pc, -unsigned int cmd,unsigned long arg); +long (*ioctl)(struct posix_clock_context *pccontext,unsigned int cmd, +unsigned long arg); -int (*open) (struct posix_clock *pc,fmode_t f_mode); +int (*open)(struct posix_clock_context *pccontext,fmode_t f_mode); -__poll_t (*poll) (struct posix_clock *pc, -struct file *file,poll_table *wait); +__poll_t (*poll)(struct posix_clock_context *pccontext,struct file *file, +poll_table *wait); -int (*release) (struct posix_clock *pc); +int (*release)(struct posix_clock_context *pccontext); -ssize_t (*read) (struct posix_clock *pc, -uint flags,char __user *buf,size_t cnt); +ssize_t (*read)(struct posix_clock_context *pccontext,uint flags, +char __user *buf,size_t cnt); };/**
@@ -90,6 +91,24 @@ struct posix_clock {bool zombie; }; +/** +* struct posix_clock_context - represents clock file operations context +* +* @clk: Pointer to the clock +* @private_clkdata: Pointer to user data +* +* Drivers should use struct posix_clock_context during specific character +* device file operation methods to access the posix clock. +* +* Drivers can store a private data structure during the open operation +* if they have specific information that is required in other file +* operations. +*/ +struct posix_clock_context { +struct posix_clock *clk; +void *private_clkdata; +}; +/** * posix_clock_register() - register a new clock * @clk: Pointer to the clock. Caller must provide 'ops' field
kernel/time/posix-clock.c +27 -9
@@ -19,7 +19,8 @@*/ static struct posix_clock *get_posix_clock (struct file *fp) { -struct posix_clock *clk = fp->private_data; +struct posix_clock_context *pccontext = fp->private_data; +struct posix_clock *clk = pccontext->clk;down_read (&clk->rwsem);
@@ -39,6 +40,7 @@ static void put_posix_clock(struct posix_clock *clk)static ssize_t posix_clock_read (struct file *fp,char __user *buf,size_t count,loff_t *ppos) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);int err = -EINVAL ;
@@ -46,7 +48,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,return -ENODEV ;if (clk->ops.read) - err = clk->ops.read (clk, fp->f_flags, buf, count); + err = clk->ops.read (pccontext, fp->f_flags, buf, count);put_posix_clock (clk);
@@ -55,6 +57,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,static __poll_t posix_clock_poll (struct file *fp,poll_table *wait) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);__poll_t result =0 ;
@@ -62,7 +65,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait)return EPOLLERR ;if (clk->ops.poll) - result = clk->ops.poll (clk, fp, wait); + result = clk->ops.poll (pccontext, fp, wait);put_posix_clock (clk);
@@ -72,6 +75,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait)static long posix_clock_ioctl (struct file *fp,unsigned int cmd,unsigned long arg) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);int err = -ENOTTY ;
@@ -79,7 +83,7 @@ static long posix_clock_ioctl(struct file *fp,return -ENODEV ;if (clk->ops.ioctl) - err = clk->ops.ioctl (clk, cmd, arg); + err = clk->ops.ioctl (pccontext, cmd, arg);put_posix_clock (clk);
@@ -90,6 +94,7 @@ static long posix_clock_ioctl(struct file *fp,static long posix_clock_compat_ioctl (struct file *fp,unsigned int cmd,unsigned long arg) { +struct posix_clock_context *pccontext = fp->private_data;struct posix_clock *clk =get_posix_clock (fp);int err = -ENOTTY ;
@@ -97,7 +102,7 @@ static long posix_clock_compat_ioctl(struct file *fp,return -ENODEV ;if (clk->ops.ioctl) - err = clk->ops.ioctl (clk, cmd, arg); + err = clk->ops.ioctl (pccontext, cmd, arg);put_posix_clock (clk);
@@ -110,6 +115,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)int err;struct posix_clock *clk = container_of(inode->i_cdev, struct posix_clock, cdev); +struct posix_clock_context *pccontext;down_read (&clk->rwsem);
@@ -117,14 +123,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp) err = -ENODEV ; goto out; } + pccontext =kzalloc (sizeof (*pccontext),GFP_KERNEL ); +if (!pccontext) { + err = -ENOMEM ; + goto out; + } + pccontext->clk = clk; + fp->private_data = pccontext;if (clk->ops.open) - err = clk->ops.open (clk, fp->f_mode); + err = clk->ops.open (pccontext, fp->f_mode);else err =0 ;if (!err) {get_device (clk->dev); - fp->private_data = clk; } out:up_read (&clk->rwsem);
@@ -133,14 +145,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp)static int posix_clock_release (struct inode *inode,struct file *fp) { -struct posix_clock *clk = fp->private_data; +struct posix_clock_context *pccontext = fp->private_data; +struct posix_clock *clk;int err =0 ; +if (!pccontext) +return -ENODEV ; + clk = pccontext->clk; +if (clk->ops.release) - err = clk->ops.release (clk); + err = clk->ops.release (pccontext);put_device (clk->dev); +kfree (pccontext); fp->private_data =NULL ;return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/206 Fix memory leak in posix_clock_open()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit 5b4cdd9c5676559b8a7c944ac5269b914b8c0bb8 ]
If the clk ops.open() function returns an error, we don't release the pccontext we allocated for this clock.
Re-organize the code slightly to make it all more obvious.
Stable-dep-of: e859d375d169 ("posix-clock: Store file pointer in struct posix_clock_context")
--- kernel/time/posix-clock.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
kernel/time/posix-clock.c +9 -7
@@ -129,15 +129,17 @@ static int posix_clock_open(struct inode *inode, struct file *fp) goto out; } pccontext->clk = clk; - fp->private_data = pccontext; -if (clk->ops.open) +if (clk->ops.open) { err = clk->ops.open (pccontext, fp->f_mode); -else - err =0 ; - -if (!err) { -get_device (clk->dev); +if (err) { +kfree (pccontext); + goto out; + } } + + fp->private_data = pccontext; +get_device (clk->dev); + err =0 ; out:up_read (&clk->rwsem);return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/206 posix-clock: Store file pointer in struct posix_clock_context
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit e859d375d1694488015e6804bfeea527a0b25b9f ]
File descriptor based pc_clock_*() operations of dynamic posix clocks have access to the file pointer and implement permission checks in the generic code before invoking the relevant dynamic clock callback.
Character device operations (open, read, poll, ioctl) do not implement a generic permission control and the dynamic clock callbacks have no access to the file pointer to implement them.
Extend struct posix_clock_context with a struct file pointer and initialize it in posix_clock_open(), so that all dynamic clock callbacks can access it.
--- include/linux/posix-clock.h | 6 +++++- kernel/time/posix-clock.c | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
include/linux/posix-clock.h +5 -1
@@ -95,10 +95,13 @@ struct posix_clock {* struct posix_clock_context - represents clock file operations context * * @clk: Pointer to the clock +* @fp: Pointer to the file used to open the clock * @private_clkdata: Pointer to user data * * Drivers should use struct posix_clock_context during specific character -* device file operation methods to access the posix clock. +* device file operation methods to access the posix clock. In particular, +* the file pointer can be used to verify correct access mode for ioctl() +* calls. * * Drivers can store a private data structure during the open operation * if they have specific information that is required in other file
@@ -106,6 +109,7 @@ struct posix_clock {*/ struct posix_clock_context {struct posix_clock *clk; +struct file *fp;void *private_clkdata; };
kernel/time/posix-clock.c +1 -0
@@ -129,6 +129,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp) goto out; } pccontext->clk = clk; + pccontext->fp = fp;if (clk->ops.open) { err = clk->ops.open (pccontext, fp->f_mode);if (err) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/206 ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit b4e53b15c04e3852949003752f48f7a14ae39e86 ]
Many devices implement highly accurate clocks, which the kernel manages as PTP Hardware Clocks (PHCs). Userspace applications rely on these clocks to timestamp events, trace workload execution, correlate timescales across devices, and keep various clocks in sync.
The kernel’s current implementation of PTP clocks does not enforce file permissions checks for most device operations except for POSIX clock operations, where file mode is verified in the POSIX layer before forwarding the call to the PTP subsystem. Consequently, it is common practice to not give unprivileged userspace applications any access to PTP clocks whatsoever by giving the PTP chardevs 600 permissions. An example of users running into this limitation is documented in [1]. Additionally, POSIX layer requires WRITE permission even for readonly adjtime() calls which are used in PTP layer to return current frequency offset applied to the PHC.
Add permission checks for functions that modify the state of a PTP device. Continue enforcing permission checks for POSIX clock operations (settime, adjtime) in the POSIX layer. Only require WRITE access for dynamic clocks adjtime() if any flags are set in the modes field.
[1] https://lists.nwtime.org/sympa/arc/linuxptp-users/2024-01/msg00036.html
Changes in v4:
- Require FMODE_WRITE in ajtime() only for calls modifying the clock in any way.
--- drivers/ptp/ptp_chardev.c | 16 ++++++++++++++++ kernel/time/posix-clock.c | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-)
drivers/ptp/ptp_chardev.c +16 -0
@@ -150,6 +150,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_EXTTS_REQUEST :case PTP_EXTTS_REQUEST2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req)); if (copy_from_user(&req.extts, (void __user *)arg,
@@ -191,6 +195,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_PEROUT_REQUEST :case PTP_PEROUT_REQUEST2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req)); if (copy_from_user(&req.perout, (void __user *)arg,
@@ -259,6 +267,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_ENABLE_PPS :case PTP_ENABLE_PPS2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req));if (!capable (CAP_SYS_TIME ))
@@ -397,6 +409,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_PIN_SETFUNC :case PTP_PIN_SETFUNC2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }if (copy_from_user (&pd, (void __user *)arg,sizeof (pd))) { err = -EFAULT ;break ;
kernel/time/posix-clock.c +1 -1
@@ -253,7 +253,7 @@ static int pc_clock_adjtime(clockid_t id, struct __kernel_timex *tx)if (err)return err; -if ((cd.fp->f_mode &FMODE_WRITE ) ==0 ) { +if (tx->modes && (cd.fp->f_mode &FMODE_WRITE ) ==0 ) { err = -EACCES ; goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/206 testptp: add option to shift clock by nanoseconds
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciek Machnikowski <[email protected]>
[ Upstream commit f64ae40de5efaa33c36f4e2226b33824ba1b42a7 ]
Add option to shift the clock by a specified number of nanoseconds.
The new argument -n will specify the number of nanoseconds to add to the ptp clock. Since the API doesn't support negative shifts those needs to be calculated by subtracting full seconds and adding a nanosecond offset.
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
tools/testing/selftests/ptp/testptp.c +14 -4
@@ -133,6 +133,7 @@ static void usage(char *progname)" 0 - none\n" " 1 - external time stamp\n" " 2 - periodic output\n" +" -n val shift the ptp clock time by 'val' nanoseconds\n" " -p val enable output with a period of 'val' nanoseconds\n" " -H val set output phase to 'val' nanoseconds (requires -p)\n" " -w val set output pulse width to 'val' nanoseconds (requires -p)\n"
@@ -165,6 +166,7 @@ int main(int argc, char *argv[])clockid_t clkid;int adjfreq =0x7fffffff ;int adjtime =0 ; +int adjns =0 ;int capabilities =0 ;int extts =0 ;int flagtest =0 ;
@@ -186,7 +188,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:p:P:sSt:T:w:z" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:p:P:sSt:T:w:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -223,6 +225,9 @@ int main(int argc, char *argv[])return -1 ; }break ; +case 'n' : + adjns =atoi (optarg); +break ;case 'p' : perout =atoll (optarg);break ;
@@ -305,11 +310,16 @@ int main(int argc, char *argv[]) } } -if (adjtime) { +if (adjtime || adjns) {memset (&tx,0 ,sizeof (tx)); - tx.modes =ADJ_SETOFFSET ; + tx.modes =ADJ_SETOFFSET |ADJ_NANO ; tx.time.tv_sec = adjtime; - tx.time.tv_usec =0 ; + tx.time.tv_usec = adjns; +while (tx.time.tv_usec <0 ) { + tx.time.tv_sec -=1 ; + tx.time.tv_usec +=1000000000 ; + } +if (clock_adjtime (clkid, &tx) <0 ) {perror ("clock_adjtime" ); }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/206 testptp: Add support for testing ptp_clock_info .adjphase callback
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <[email protected]>
[ Upstream commit 3a9a9a6139286584d1199f555fa4f96f592a3217 ]
Invoke clock_adjtime syscall with tx.modes set with ADJ_OFFSET when testptp is invoked with a phase adjustment offset value. Support seconds and nanoseconds for the offset value.
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
tools/testing/selftests/ptp/testptp.c +18 -1
@@ -134,6 +134,7 @@ static void usage(char *progname)" 1 - external time stamp\n" " 2 - periodic output\n" " -n val shift the ptp clock time by 'val' nanoseconds\n" +" -o val phase offset (in nanoseconds) to be provided to the PHC servo\n" " -p val enable output with a period of 'val' nanoseconds\n" " -H val set output phase to 'val' nanoseconds (requires -p)\n" " -w val set output pulse width to 'val' nanoseconds (requires -p)\n"
@@ -167,6 +168,7 @@ int main(int argc, char *argv[])int adjfreq =0x7fffffff ;int adjtime =0 ;int adjns =0 ; +int adjphase =0 ;int capabilities =0 ;int extts =0 ;int flagtest =0 ;
@@ -188,7 +190,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:p:P:sSt:T:w:z" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -228,6 +230,9 @@ int main(int argc, char *argv[])case 'n' : adjns =atoi (optarg);break ; +case 'o' : + adjphase =atoi (optarg); +break ;case 'p' : perout =atoll (optarg);break ;
@@ -327,6 +332,18 @@ int main(int argc, char *argv[]) } } +if (adjphase) { +memset (&tx,0 ,sizeof (tx)); + tx.modes =ADJ_OFFSET |ADJ_NANO ; + tx.offset = adjphase; + +if (clock_adjtime (clkid, &tx) <0 ) { +perror ("clock_adjtime" ); + }else { +puts ("phase adjustment okay" ); + } + } +if (gettime) {if (clock_gettime (clkid, &ts)) {perror ("clock_gettime" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/206 selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Maftei <[email protected]>
[ Upstream commit c8ba75c4eb846888f8f2730690b99cb5bf7b337c ]
The -x option (where 'x' stands for eXtended) takes an argument which represents the number of samples to request from the PTP device. The help message will display the maximum number of samples allowed. Providing an invalid argument will also display the maximum number of samples allowed.
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 44 +++++++++++++++++++++++++-- 1 file changed, 42 insertions(+), 2 deletions(-)
tools/testing/selftests/ptp/testptp.c +42 -2
@@ -143,8 +143,9 @@ static void usage(char *progname)" -S set the system time from the ptp clock time\n" " -t val shift the ptp clock time by 'val' seconds\n" " -T val set the ptp clock time to 'val' seconds\n" +" -x val get an extended ptp clock time with the desired number of samples (up to %d)\n" " -z test combinations of rising/falling external time stamp flags\n" , - progname); + progname, PTP_MAX_SAMPLES); }int main (int argc,char *argv[])
@@ -158,6 +159,7 @@ int main(int argc, char *argv[])struct timex tx;struct ptp_clock_time *pct;struct ptp_sys_offset *sysoff; +struct ptp_sys_offset_extended *soe;char *progname;unsigned int i;
@@ -176,6 +178,7 @@ int main(int argc, char *argv[])int index =0 ;int list_pins =0 ;int pct_offset =0 ; +int getextended =0 ;int n_samples =0 ;int pin_index =-1 , pin_func;int pps =-1 ;
@@ -190,7 +193,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:z" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -255,6 +258,15 @@ int main(int argc, char *argv[])case 'w' : pulsewidth =atoi (optarg);break ; +case 'x' : + getextended =atoi (optarg); +if (getextended <1 || getextended >PTP_MAX_SAMPLES ) { +fprintf (stderr, +"number of extended timestamp samples must be between 1 and %d; was asked for %d\n" , +PTP_MAX_SAMPLES , getextended); +return -1 ; + } +break ;case 'z' : flagtest =1 ;break ;
@@ -533,6 +545,34 @@ int main(int argc, char *argv[])free (sysoff); } +if (getextended) { + soe =calloc (1 ,sizeof (*soe)); +if (!soe) { +perror ("calloc" ); +return -1 ; + } + + soe->n_samples = getextended; + +if (ioctl (fd,PTP_SYS_OFFSET_EXTENDED , soe)) { +perror ("PTP_SYS_OFFSET_EXTENDED" ); + }else { +printf ("extended timestamp request returned %d samples\n" , + getextended); + +for (i =0 ; i < getextended; i++) { +printf ("sample #%2d: system time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, soe->ts[i][0 ].nsec); +printf (" phc time: %lld.%09u\n" , + soe->ts[i][1 ].sec, soe->ts[i][1 ].nsec); +printf (" system time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, soe->ts[i][2 ].nsec); + } + } + +free (soe); + } +close (fd);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/206 selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Maftei <[email protected]>
[ Upstream commit 3cf119ad5dc2b5c11385106d6d0ba86fbb47324c ]
The -X option was chosen because X looks like a cross, and the underlying callback is 'get cross timestamp'.
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 31 ++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)
tools/testing/selftests/ptp/testptp.c +30 -1
@@ -144,6 +144,7 @@ static void usage(char *progname)" -t val shift the ptp clock time by 'val' seconds\n" " -T val set the ptp clock time to 'val' seconds\n" " -x val get an extended ptp clock time with the desired number of samples (up to %d)\n" +" -X get a ptp clock cross timestamp\n" " -z test combinations of rising/falling external time stamp flags\n" , progname, PTP_MAX_SAMPLES); }
@@ -160,6 +161,7 @@ int main(int argc, char *argv[])struct ptp_clock_time *pct;struct ptp_sys_offset *sysoff;struct ptp_sys_offset_extended *soe; +struct ptp_sys_offset_precise *xts;char *progname;unsigned int i;
@@ -179,6 +181,7 @@ int main(int argc, char *argv[])int list_pins =0 ;int pct_offset =0 ;int getextended =0 ; +int getcross =0 ;int n_samples =0 ;int pin_index =-1 , pin_func;int pps =-1 ;
@@ -193,7 +196,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:z" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -267,6 +270,9 @@ int main(int argc, char *argv[])return -1 ; }break ; +case 'X' : + getcross =1 ; +break ;case 'z' : flagtest =1 ;break ;
@@ -573,6 +579,29 @@ int main(int argc, char *argv[])free (soe); } +if (getcross) { + xts =calloc (1 ,sizeof (*xts)); +if (!xts) { +perror ("calloc" ); +return -1 ; + } + +if (ioctl (fd,PTP_SYS_OFFSET_PRECISE , xts)) { +perror ("PTP_SYS_OFFSET_PRECISE" ); + }else { +puts ("system and phc crosstimestamping request okay" ); + +printf ("device time: %lld.%09u\n" , + xts->device.sec, xts->device.nsec); +printf ("system time: %lld.%09u\n" , + xts->sys_realtime.sec, xts->sys_realtime.nsec); +printf ("monoraw time: %lld.%09u\n" , + xts->sys_monoraw.sec, xts->sys_monoraw.nsec); + } + +free (xts); + } +close (fd);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/206 ptp: add testptp mask test
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xabier Marquiegui <[email protected]>
[ Upstream commit 26285e689c6cd2cf3849568c83b2ebe53f467143 ]
Add option to test timestamp event queue mask manipulation in testptp.
Option -F allows the user to specify a single channel that will be applied on the mask filter via IOCTL.
The test program will maintain the file open until user input is received.
This allows checking the effect of the IOCTL in debugfs.
eg:
Console 1:
``` Channel 12 exclusively enabled. Check on debugfs. Press any key to continue ```
Console 2:
``` 0x00000000 0x00000001 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 ```
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
tools/testing/selftests/ptp/testptp.c +18 -1
@@ -121,6 +121,7 @@ static void usage(char *progname)" -d name device to open\n" " -e val read 'val' external time stamp events\n" " -f val adjust the ptp clock frequency by 'val' ppb\n" +" -F chan Enable single channel mask and keep device open for debugfs verification.\n" " -g get the ptp clock time\n" " -h prints this message\n" " -i val index for event/trigger\n"
@@ -187,6 +188,7 @@ int main(int argc, char *argv[])int pps =-1 ;int seconds =0 ;int settime =0 ; +int channel =-1 ;int64_t t1, t2, tp;int64_t interval, offset;
@@ -196,7 +198,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -210,6 +212,9 @@ int main(int argc, char *argv[])case 'f' : adjfreq =atoi (optarg);break ; +case 'F' : + channel =atoi (optarg); +break ;case 'g' : gettime =1 ;break ;
@@ -602,6 +607,18 @@ int main(int argc, char *argv[])free (xts); } +if (channel >=0 ) { +if (ioctl (fd,PTP_MASK_CLEAR_ALL )) { +perror ("PTP_MASK_CLEAR_ALL" ); + }else if (ioctl (fd,PTP_MASK_EN_SINGLE , (unsigned int *)&channel)) { +perror ("PTP_MASK_EN_SINGLE" ); + }else { +printf ("Channel %d exclusively enabled. Check on debugfs.\n" , channel); +printf ("Press any key to continue\n." ); +getchar (); + } + } +close (fd);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/206 selftest/ptp: update ptp selftest to exercise the gettimex options
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Bandewar <[email protected]>
[ Upstream commit 3d07b691ee707c00afaf365440975e81bb96cd9b ]
With the inclusion of commit c259acab839e ("ptp/ioctl: support MONOTONIC{,_RAW} timestamps for PTP_SYS_OFFSET_EXTENDED") clock_gettime() now allows retrieval of pre/post timestamps for CLOCK_MONOTONIC and CLOCK_MONOTONIC_RAW timebases along with the previously supported CLOCK_REALTIME.
This patch adds a command line option 'y' to the testptp program to choose one of the allowed timebases [realtime aka system, monotonic, and monotonic-raw).
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 62 ++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 5 deletions(-)
tools/testing/selftests/ptp/testptp.c +57 -5
@@ -146,6 +146,7 @@ static void usage(char *progname)" -T val set the ptp clock time to 'val' seconds\n" " -x val get an extended ptp clock time with the desired number of samples (up to %d)\n" " -X get a ptp clock cross timestamp\n" +" -y val pre/post tstamp timebase to use {realtime|monotonic|monotonic-raw}\n" " -z test combinations of rising/falling external time stamp flags\n" , progname, PTP_MAX_SAMPLES); }
@@ -189,6 +190,7 @@ int main(int argc, char *argv[])int seconds =0 ;int settime =0 ;int channel =-1 ; +clockid_t ext_clockid =CLOCK_REALTIME ;int64_t t1, t2, tp;int64_t interval, offset;
@@ -198,7 +200,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -278,6 +280,21 @@ int main(int argc, char *argv[])case 'X' : getcross =1 ;break ; +case 'y' : +if (!strcasecmp (optarg,"realtime" )) + ext_clockid =CLOCK_REALTIME ; +else if (!strcasecmp (optarg,"monotonic" )) + ext_clockid =CLOCK_MONOTONIC ; +else if (!strcasecmp (optarg,"monotonic-raw" )) + ext_clockid =CLOCK_MONOTONIC_RAW ; +else { +fprintf (stderr, +"type needs to be realtime, monotonic or monotonic-raw; was given %s\n" , + optarg); +return -1 ; + } +break ; +case 'z' : flagtest =1 ;break ;
@@ -564,6 +581,7 @@ int main(int argc, char *argv[]) } soe->n_samples = getextended; + soe->clockid = ext_clockid;if (ioctl (fd,PTP_SYS_OFFSET_EXTENDED , soe)) {perror ("PTP_SYS_OFFSET_EXTENDED" );
@@ -572,12 +590,46 @@ int main(int argc, char *argv[]) getextended);for (i =0 ; i < getextended; i++) { -printf ("sample #%2d: system time before: %lld.%09u\n" , - i, soe->ts[i][0 ].sec, soe->ts[i][0 ].nsec); +switch (ext_clockid) { +case CLOCK_REALTIME : +printf ("sample #%2d: real time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +case CLOCK_MONOTONIC : +printf ("sample #%2d: monotonic time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +case CLOCK_MONOTONIC_RAW : +printf ("sample #%2d: monotonic-raw time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +default : +break ; + }printf (" phc time: %lld.%09u\n" , soe->ts[i][1 ].sec, soe->ts[i][1 ].nsec); -printf (" system time after: %lld.%09u\n" , - soe->ts[i][2 ].sec, soe->ts[i][2 ].nsec); +switch (ext_clockid) { +case CLOCK_REALTIME : +printf (" real time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +case CLOCK_MONOTONIC : +printf (" monotonic time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +case CLOCK_MONOTONIC_RAW : +printf (" monotonic-raw time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +default : +break ; + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/206 testptp: Add option to open PHC in readonly mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit 76868642e42795353106197abf9c607ad80f4c9e ]
PTP Hardware Clocks no longer require WRITE permission to perform readonly operations, such as listing device capabilities or listening to EXTTS events once they have been enabled by a process with WRITE permissions.
Add '-r' option to testptp to open the PHC in readonly mode instead of the default read-write mode. Skip enabling EXTTS if readonly mode is requested.
--- tools/testing/selftests/ptp/testptp.c | 37 +++++++++++++++++---------- 1 file changed, 23 insertions(+), 14 deletions(-)
tools/testing/selftests/ptp/testptp.c +23 -14
@@ -140,6 +140,7 @@ static void usage(char *progname)" -H val set output phase to 'val' nanoseconds (requires -p)\n" " -w val set output pulse width to 'val' nanoseconds (requires -p)\n" " -P val enable or disable (val=1|0) the system clock PPS\n" +" -r open the ptp clock in readonly mode\n" " -s set the ptp clock time from the system time\n" " -S set the system time from the ptp clock time\n" " -t val shift the ptp clock time by 'val' seconds\n"
@@ -188,6 +189,7 @@ int main(int argc, char *argv[])int pin_index =-1 , pin_func;int pps =-1 ;int seconds =0 ; +int readonly =0 ;int settime =0 ;int channel =-1 ;clockid_t ext_clockid =CLOCK_REALTIME ;
@@ -200,7 +202,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:rsSt:T:w:x:Xy:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -252,6 +254,9 @@ int main(int argc, char *argv[])case 'P' : pps =atoi (optarg);break ; +case 'r' : + readonly =1 ; +break ;case 's' : settime =1 ;break ;
@@ -308,7 +313,7 @@ int main(int argc, char *argv[]) } } - fd =open (device,O_RDWR ); + fd =open (device, readonly ?O_RDONLY :O_RDWR );if (fd <0 ) {fprintf (stderr,"opening %s: %s\n" , device,strerror (errno));return -1 ;
@@ -422,14 +427,16 @@ int main(int argc, char *argv[]) }if (extts) { -memset (&extts_request,0 ,sizeof (extts_request)); - extts_request.index = index; - extts_request.flags =PTP_ENABLE_FEATURE ; -if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { -perror ("PTP_EXTTS_REQUEST" ); - extts =0 ; - }else { -puts ("external time stamp request okay" ); +if (!readonly) { +memset (&extts_request,0 ,sizeof (extts_request)); + extts_request.index = index; + extts_request.flags =PTP_ENABLE_FEATURE ; +if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { +perror ("PTP_EXTTS_REQUEST" ); + extts =0 ; + }else { +puts ("external time stamp request okay" ); + } }for (; extts; extts--) { cnt =read (fd, &event,sizeof (event));
@@ -441,10 +448,12 @@ int main(int argc, char *argv[]) event.t.sec, event.t.nsec);fflush (stdout); } -/* Disable the feature again. */ - extts_request.flags =0 ; -if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { -perror ("PTP_EXTTS_REQUEST" ); +if (!readonly) { +/* Disable the feature again. */ + extts_request.flags =0 ; +if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { +perror ("PTP_EXTTS_REQUEST" ); + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/206 net: usb: dm9601: remove broken SR9700 support
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
[ Upstream commit 7d7dbafefbe74f5a25efc4807af093b857a7612e ]
The SR9700 chip sends more than one packet in a USB transaction, like the DM962x chips can optionally do, but the dm9601 driver does not support this mode, and the hardware does not have the DM962x MODE_CTL register to disable it, so this driver drops packets on SR9700 devices. The sr9700 driver correctly handles receiving more than one packet per transaction.
While the dm9601 driver could be improved to handle this, the easiest way to fix this issue in the short term is to remove the SR9700 device ID from the dm9601 driver so the sr9700 driver is always used. This device ID should not have been in more than one driver to begin with.
The "Fixes" commit was chosen so that the patch is automatically included in all kernels that have the sr9700 driver, even though the issue affects dm9601.
--- drivers/net/usb/dm9601.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/usb/dm9601.c +0 -4
@@ -603,10 +603,6 @@ static const struct usb_device_id products[] = { USB_DEVICE(0x0fe6, 0x8101), /* DM9601 USB to Fast Ethernet Adapter */ .driver_info = (unsigned long )&dm9601_info, }, - { -USB_DEVICE (0x0fe6 ,0x9700 ),/* DM9601 USB to Fast Ethernet Adapter */ - .driver_info = (unsigned long)&dm9601_info, - }, {USB_DEVICE (0x0a46 ,0x9000 ),/* DM9000E */ .driver_info = (unsigned long)&dm9601_info,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/206 bonding: limit BOND_MODE_8023AD to Ethernet devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6 ]
BOND_MODE_8023AD makes sense for ARPHRD_ETHER only.
syzbot reported:
BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline] BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497 CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 __hw_addr_create net/core/dev_addr_lists.c:63 [inline] __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 __dev_mc_add net/core/dev_addr_lists.c:868 [inline] dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886 bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180 do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963 do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165 rtnl_changelink net/core/rtnetlink.c:3776 [inline] __rtnl_newlink net/core/rtnetlink.c:3935 [inline] rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x820 net/socket.c:2592 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646 __sys_sendmsg+0x164/0x220 net/socket.c:2678 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e </TASK> The buggy address belongs to the variable: lacpdu_mcast_addr+0x0/0x40
--- drivers/net/bonding/bond_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bonding/bond_main.c +6 -0
@@ -1836,6 +1836,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,*/ if (!bond_has_slaves (bond)) {if (bond_dev->type != slave_dev->type) { +if (slave_dev->type !=ARPHRD_ETHER && +BOND_MODE (bond) ==BOND_MODE_8023AD ) { +SLAVE_NL_ERR (bond_dev, slave_dev, extack, +"8023AD mode requires Ethernet devices" ); +return -EINVAL ; + }slave_dbg (bond_dev, slave_dev,"change device type from %d to %d\n" , bond_dev->type, slave_dev->type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/206 selftests/net: convert fib-onlink-tests.sh to run it in unique namespace
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 3a06833b2adc0a902f2469ad4ce41ccd64f1f3ab ]
Remove PEER_CMD, which is not used in this test
Here is the test result after conversion.
]# ./fib-onlink-tests.sh
Error: ipv4: FIB table does not exist.
Flush terminated
Error: ipv6: FIB table does not exist.
Flush terminated
########################################
Configuring interfaces
...
TEST: Gateway resolves to wrong nexthop device - VRF [ OK ]
Tests passed: 38
Tests failed: 0
Stable-dep-of: 4f5f148dd7c0 ("selftests: net: fib-onlink-tests: Convert to use namespaces by default")
--- tools/testing/selftests/net/fib-onlink-tests.sh | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
tools/testing/selftests/net/fib-onlink-tests.sh +3 -6
@@ -3,6 +3,7 @@ # IPv4 and IPv6 onlink tests +source lib.sh PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no} VERBOSE=0
@@ -74,9 +75,6 @@ TEST_NET4IN6[2]=10.2.1.254 # mcast address MCAST6=ff02::1 - -PEER_NS=bart -PEER_CMD="ip netns exec ${PEER_NS}" VRF=lisa VRF_TABLE=1101 PBR_TABLE=101
@@ -176,8 +174,7 @@ setup() set -e # create namespace - ip netns add ${PEER_NS} - ip -netns ${PEER_NS} li set lo up + setup_ns PEER_NS # add vrf table ip li add ${VRF} type vrf table ${VRF_TABLE}
@@ -219,7 +216,7 @@ setup() cleanup() { # make sure we start from a clean slate - ip netns del ${PEER_NS} 2>/dev/null + cleanup_ns ${PEER_NS} 2>/dev/null for n in 1 3 5 7; do ip link del ${NETIFS[p${n}]} 2>/dev/null done
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/206 selftests: net: fib-onlink-tests: Convert to use namespaces by default
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 4f5f148dd7c0459229d2ab9a769b2e820f9ee6a2 ]
Currently, the test breaks if the SUT already has a default route configured for IPv6. Fix by avoiding the use of the default namespace.
--- .../testing/selftests/net/fib-onlink-tests.sh | 71 ++++++++----------- 1 file changed, 30 insertions(+), 41 deletions(-)
tools/testing/selftests/net/fib-onlink-tests.sh +30 -41
@@ -120,7 +120,7 @@ log_subsection() run_cmd() { - local cmd="$*" + local cmd="$1" local out local rc
@@ -145,7 +145,7 @@ get_linklocal() local pfx local addr - addr=$(${pfx} ip -6 -br addr show dev ${dev} | \ + addr=$(${pfx} ${IP} -6 -br addr show dev ${dev} | \ awk '{ for (i = 3; i <= NF; ++i) { if ($i ~ /^fe80/)
@@ -173,58 +173,48 @@ setup() set -e - # create namespace - setup_ns PEER_NS + # create namespaces + setup_ns ns1 + IP="ip -netns $ns1" + setup_ns ns2 # add vrf table - ip li add ${VRF} type vrf table ${VRF_TABLE} - ip li set ${VRF} up - ip ro add table ${VRF_TABLE} unreachable default metric 8192 - ip -6 ro add table ${VRF_TABLE} unreachable default metric 8192 + ${IP} li add ${VRF} type vrf table ${VRF_TABLE} + ${IP} li set ${VRF} up + ${IP} ro add table ${VRF_TABLE} unreachable default metric 8192 + ${IP} -6 ro add table ${VRF_TABLE} unreachable default metric 8192 # create test interfaces - ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]} - ip li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]} - ip li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]} - ip li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]} + ${IP} li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]} + ${IP} li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]} + ${IP} li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]} + ${IP} li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]} # enslave vrf interfaces for n in 5 7; do - ip li set ${NETIFS[p${n}]} vrf ${VRF} + ${IP} li set ${NETIFS[p${n}]} vrf ${VRF} done # add addresses for n in 1 3 5 7; do - ip li set ${NETIFS[p${n}]} up - ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} - ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad + ${IP} li set ${NETIFS[p${n}]} up + ${IP} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} + ${IP} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad done # move peer interfaces to namespace and add addresses for n in 2 4 6 8; do - ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up - ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} - ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad + ${IP} li set ${NETIFS[p${n}]} netns ${ns2} up + ip -netns $ns2 addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} + ip -netns $ns2 addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad done - ip -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64} - ip -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64} + ${IP} -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64} + ${IP} -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64} set +e } -cleanup() -{ - # make sure we start from a clean slate - cleanup_ns ${PEER_NS} 2>/dev/null - for n in 1 3 5 7; do - ip link del ${NETIFS[p${n}]} 2>/dev/null - done - ip link del ${VRF} 2>/dev/null - ip ro flush table ${VRF_TABLE} - ip -6 ro flush table ${VRF_TABLE} -} - ################################################################################ # IPv4 tests #
@@ -241,7 +231,7 @@ run_ip() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip ro add table "${table}" "${prefix}"/32 via "${gw}" "${dev}" onlink + run_cmd "${IP} ro add table ${table} ${prefix}/32 via ${gw} ${dev} onlink" log_test $? ${exp_rc} "${desc}" }
@@ -257,8 +247,8 @@ run_ip_mpath() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip ro add table "${table}" "${prefix}"/32 \ - nexthop via ${nh1} nexthop via ${nh2} + run_cmd "${IP} ro add table ${table} ${prefix}/32 \ + nexthop via ${nh1} nexthop via ${nh2}" log_test $? ${exp_rc} "${desc}" }
@@ -339,7 +329,7 @@ run_ip6() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip -6 ro add table "${table}" "${prefix}"/128 via "${gw}" "${dev}" onlink + run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 via ${gw} ${dev} onlink" log_test $? ${exp_rc} "${desc}" }
@@ -353,8 +343,8 @@ run_ip6_mpath() local exp_rc="$6" local desc="$7" - run_cmd ip -6 ro add table "${table}" "${prefix}"/128 "${opts}" \ - nexthop via ${nh1} nexthop via ${nh2} + run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 ${opts} \ + nexthop via ${nh1} nexthop via ${nh2}" log_test $? ${exp_rc} "${desc}" }
@@ -491,10 +481,9 @@ do esac done -cleanup setup run_onlink_tests -cleanup +cleanup_ns ${ns1} ${ns2} if [ "$TESTS" != "none" ]; then printf "\nTests passed: %3d\n" ${nsuccess}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/206 sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit a80c9d945aef55b23b54838334345f20251dad83 ]
A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails:
==================================================================
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127
The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently:
- SCTP_CMD_PEER_INIT
- SCTP_CMD_TIMER_STOP (T1_INIT)
- SCTP_CMD_TIMER_START (T1_COOKIE)
- SCTP_CMD_NEW_STATE (COOKIE_ECHOED)
- SCTP_CMD_ASSOC_SHKEY
- SCTP_CMD_GEN_COOKIE_ECHO
If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user().
Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue.
Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup.
--- net/sctp/sm_statefuns.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/sctp/sm_statefuns.c +5 -5
@@ -601,6 +601,11 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,sctp_add_cmd_sf (commands,SCTP_CMD_PEER_INIT ,SCTP_PEER_INIT (initchunk)); +/* SCTP-AUTH: generate the association shared keys so that +* we can potentially sign the COOKIE-ECHO. +*/ +sctp_add_cmd_sf (commands,SCTP_CMD_ASSOC_SHKEY ,SCTP_NULL ()); +/* Reset init error count upon receipt of INIT-ACK. */ sctp_add_cmd_sf (commands,SCTP_CMD_INIT_COUNTER_RESET ,SCTP_NULL ());
@@ -615,11 +620,6 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,sctp_add_cmd_sf (commands,SCTP_CMD_NEW_STATE ,SCTP_STATE (SCTP_STATE_COOKIE_ECHOED )); -/* SCTP-AUTH: generate the association shared keys so that -* we can potentially sign the COOKIE-ECHO. -*/ -sctp_add_cmd_sf (commands,SCTP_CMD_ASSOC_SHKEY ,SCTP_NULL ()); -/* 5.1 C) "A" shall then send the State Cookie received in the * INIT ACK chunk in a COOKIE ECHO chunk, ... */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/206 amd-xgbe: avoid misleading per-packet error log
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit c158f985cf6c2c36c99c4f67af2ff3f5ebe09f8f ]
On the receive path, packet can be damaged because of buffer overflow in Rx FIFO. Avoid misleading per-packet error log when packet->errors is set, this can flood the log. Instead, rely on the standard rtnl_link_stats64 stats.
--- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-drv.c +1 -4
@@ -2112,7 +2112,7 @@ static void xgbe_get_stats64(struct net_device *netdev, s->multicast = pstats->rxmulticastframes_g; s->rx_length_errors = pstats->rxlengtherror; s->rx_crc_errors = pstats->rxcrcerror; - s->rx_fifo_errors = pstats->rxfifooverflow; + s->rx_over_errors = pstats->rxfifooverflow; s->tx_packets = pstats->txframecount_gb; s->tx_bytes = pstats->txoctetcount_gb;
@@ -2566,9 +2566,6 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget) goto read_again;if (error || packet->errors) { -if (packet->errors) -netif_err (pdata, rx_err, netdev, -"error in received packet\n" );dev_kfree_skb (skb); goto next_packet; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/206 gue: Fix skb memleak with inner IP protocol 0.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9a56796ad258786d3624eef5aefba394fc9bdded ]
syzbot reported skb memleak below. [0]
The repro generated a GUE packet with its inner protocol 0.
gue_udp_recv() returns -guehdr->proto_ctype for "resubmit" in ip_protocol_deliver_rcu(), but this only works with non-zero protocol number.
Let's drop such packets.
Note that 0 is a valid number (IPv6 Hop-by-Hop Option).
I think it is not practical to encap HOPOPT in GUE, so once someone starts to complain, we could pass down a resubmit flag pointer to distinguish two zeros from the upper layer:
* no error
* resubmit HOPOPT
[0]
BUG: memory leak
unreferenced object 0xffff888109695a00 (size 240):
comm "syz.0.17", pid 6088, jiffies 4294943096
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@..............
backtrace (crc a84b336f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270
__build_skb+0x23/0x60 net/core/skbuff.c:474
build_skb+0x20/0x190 net/core/skbuff.c:490
__tun_build_skb drivers/net/tun.c:1541 [inline]
tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636
tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770
tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x45d/0x710 fs/read_write.c:686
ksys_write+0xa7/0x170 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/ipv4/fou.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/fou.c +3 -0
@@ -213,6 +213,9 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)return gue_control_message (skb, guehdr); proto_ctype = guehdr->proto_ctype; +if (unlikely (!proto_ctype)) + goto drop; +__skb_pull (skb,sizeof (struct udphdr ) + hdrlen);skb_reset_transport_header (skb);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/206 netlink: add a proto specification for FOU
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 4eb77b4ecd3c5eaab83adf76e67e0a7ed2a24418 ]
FOU has a reasonably modern Genetlink family. Add a spec.
Stable-dep-of: 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.")
--- Documentation/netlink/specs/fou.yaml | 128 +++++++++++++++++++++++++++ 1 file changed, 128 insertions(+) create mode 100644 Documentation/netlink/specs/fou.yaml
Documentation/netlink/specs/fou.yaml new file +128 -0
@@ -0,0 +1,128 @@ +name: fou + +protocol: genetlink-legacy + +doc: | + Foo-over-UDP. + +c-family-name: fou-genl-name +c-version-name: fou-genl-version +max-by-define: true +kernel-policy: global + +definitions: + - + type: enum + name: encap_type + name-prefix: fou-encap- + enum-name: + entries: [ unspec, direct, gue ] + +attribute-sets: + - + name: fou + name-prefix: fou-attr- + attributes: + - + name: unspec + type: unused + - + name: port + type: u16 + byte-order: big-endian + - + name: af + type: u8 + - + name: ipproto + type: u8 + - + name: type + type: u8 + - + name: remcsum_nopartial + type: flag + - + name: local_v4 + type: u32 + - + name: local_v6 + type: binary + checks: + min-len: 16 + - + name: peer_v4 + type: u32 + - + name: peer_v6 + type: binary + checks: + min-len: 16 + - + name: peer_port + type: u16 + byte-order: big-endian + - + name: ifindex + type: s32 + +operations: + list: + - + name: unspec + doc: unused + + - + name: add + doc: Add port. + attribute-set: fou + + dont-validate: [ strict, dump ] + flags: [ admin-perm ] + + do: + request: &all_attrs + attributes: + - port + - ipproto + - type + - remcsum_nopartial + - local_v4 + - peer_v4 + - local_v6 + - peer_v6 + - peer_port + - ifindex + + - + name: del + doc: Delete port. + attribute-set: fou + + dont-validate: [ strict, dump ] + flags: [ admin-perm ] + + do: + request: &select_attrs + attributes: + - af + - ifindex + - port + - peer_port + - local_v4 + - peer_v4 + - local_v6 + - peer_v6 + + - + name: get + doc: Get tunnel info. + attribute-set: fou + dont-validate: [ strict, dump ] + + do: + request: *select_attrs + reply: *all_attrs + + dump: + reply: *all_attrs
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/206 net: fou: rename the source for linking
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 08d323234d10eab077cbf0093eeb5991478a261a ]
We'll need to link two objects together to form the fou module. This means the source can't be called fou, the build system expects fou.o to be the combined object.
Stable-dep-of: 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.")
---
net/ipv4/Makefile | 1 +
net/ipv4/{fou.c => fou_core.c} | 0
2 files changed, 1 insertion(+)
rename net/ipv4/{fou.c => fou_core.c} (100%)net/ipv4/Makefile +1 -0
@@ -26,6 +26,7 @@ obj-$(CONFIG_IP_MROUTE) += ipmr.o obj-$(CONFIG_IP_MROUTE_COMMON) += ipmr_base.o obj-$(CONFIG_NET_IPIP) += ipip.o gre-y := gre_demux.o +fou-y := fou_core.o obj-$(CONFIG_NET_FOU) += fou.o obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o obj-$(CONFIG_NET_IPGRE) += ip_gre.o
net/ipv4/fou_core.c renamed from net/ipv4/fou.c +0 -0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/206 net: fou: use policy and operation tables generated from the spec
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 1d562c32e4392cc091c940918ee1ffd7bfcb9e96 ]
Generate and plug in the spec-based tables.
A little bit of renaming is needed in the FOU code.
Stable-dep-of: 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.")
--- net/ipv4/Makefile | 2 +- net/ipv4/fou_core.c | 47 +++++++------------------------------------- net/ipv4/fou_nl.c | 48 +++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/fou_nl.h | 25 +++++++++++++++++++++++ 4 files changed, 81 insertions(+), 41 deletions(-) create mode 100644 net/ipv4/fou_nl.c create mode 100644 net/ipv4/fou_nl.h
net/ipv4/Makefile +1 -1
@@ -26,7 +26,7 @@ obj-$(CONFIG_IP_MROUTE) += ipmr.o obj-$(CONFIG_IP_MROUTE_COMMON) += ipmr_base.o obj-$(CONFIG_NET_IPIP) += ipip.o gre-y := gre_demux.o -fou-y := fou_core.o +fou-y := fou_core.o fou_nl.o obj-$(CONFIG_NET_FOU) += fou.o obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o obj-$(CONFIG_NET_IPGRE) += ip_gre.o
net/ipv4/fou_core.c +7 -40
94 lines not on this page · raw message
net/ipv4/fou_nl.c new file +48 -0
48 lines not on this page · raw message
net/ipv4/fou_nl.h new file +25 -0
@@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ +/* Do not edit directly, auto-generated from: */ +/* Documentation/netlink/specs/fou.yaml */ +/* YNL-GEN kernel header */ + +#ifndef _LINUX_FOU_GEN_H +#define _LINUX_FOU_GEN_H + +#include <net/netlink.h> +#include <net/genetlink.h> + +#include <linux/fou.h> + +/* Global operation policy for fou */ +extern const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX +1 ]; + +/* Ops table for fou */ +extern const struct genl_small_ops fou_nl_ops[3 ]; + +int fou_nl_add_doit (struct sk_buff *skb,struct genl_info *info); +int fou_nl_del_doit (struct sk_buff *skb,struct genl_info *info); +int fou_nl_get_doit (struct sk_buff *skb,struct genl_info *info); +int fou_nl_get_dumpit (struct sk_buff *skb,struct netlink_callback *cb); + +#endif /* _LINUX_FOU_GEN_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/206 fou: Dont allow 0 for FOU_ATTR_IPPROTO.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5 ]
fou_udp_recv() has the same problem mentioned in the previous patch.
If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu().
Let's forbid 0 for FOU_ATTR_IPPROTO.
--- Documentation/netlink/specs/fou.yaml | 2 ++ net/ipv4/fou_nl.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
Documentation/netlink/specs/fou.yaml +2 -0
@@ -36,6 +36,8 @@ attribute-sets: - name: ipproto type: u8 + checks: + min: 1 - name: type type: u8
net/ipv4/fou_nl.c +1 -1
@@ -14,7 +14,7 @@const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX +1 ] = { [FOU_ATTR_PORT ] = { .type =NLA_U16 , }, [FOU_ATTR_AF ] = { .type =NLA_U8 , }, - [FOU_ATTR_IPPROTO ] = { .type =NLA_U8 , }, + [FOU_ATTR_IPPROTO ] =NLA_POLICY_MIN (NLA_U8 ,1 ), [FOU_ATTR_TYPE ] = { .type =NLA_U8 , }, [FOU_ATTR_REMCSUM_NOPARTIAL ] = { .type =NLA_FLAG , }, [FOU_ATTR_LOCAL_V4 ] = { .type =NLA_U32 , },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/206 l2tp: avoid one data-race in l2tp_tunnel_del_work()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7a29f6bf60f2590fe5e9c4decb451e19afad2bcf ]
We should read sk->sk_socket only when dealing with kernel sockets.
syzbot reported the following data-race:
BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0:
sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1:
l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
value changed: 0xffff88811b818000 -> 0x0000000000000000
--- net/l2tp/l2tp_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/l2tp/l2tp_core.c +2 -2
@@ -1252,8 +1252,6 @@ static void l2tp_tunnel_del_work(struct work_struct *work) { struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel, del_work); -struct sock *sk = tunnel->sock; -struct socket *sock = sk->sk_socket;l2tp_tunnel_closeall (tunnel);
@@ -1261,6 +1259,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work)* the sk API to release it here. */ if (tunnel->fd <0 ) { +struct socket *sock = tunnel->sock->sk_socket; +if (sock) {kernel_sock_shutdown (sock,SHUT_RDWR );sock_release (sock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/206 ipvlan: Make the addrs_lock be per port
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Skorodumov <[email protected]>
[ Upstream commit d3ba32162488283c0a4c5bedd8817aec91748802 ]
Make the addrs_lock be per port, not per ipvlan dev.
Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So
1) Introduce per-port addrs_lock.
2) It was needed to fix places where it was forgotten to take lock (ipvlan_open/ipvlan_close)
This appears to be a very minor problem though. Since it's highly unlikely that ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause:
1) False-negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6, since looks like only ipvlan_addr6_event() can be called without rtnl_lock.
2) Race since ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks
This should not affect performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths.
--- drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_core.c | 16 +++++------ drivers/net/ipvlan/ipvlan_main.c | 49 +++++++++++++++++++------------- 3 files changed, 37 insertions(+), 30 deletions(-)
drivers/net/ipvlan/ipvlan.h +1 -1
@@ -69,7 +69,6 @@ struct ipvl_dev {DECLARE_BITMAP (mac_filters,IPVLAN_MAC_FILTER_SIZE );netdev_features_t sfeatures;u32 msg_enable; -spinlock_t addrs_lock; };struct ipvl_addr {
@@ -90,6 +89,7 @@ struct ipvl_port {struct net_device *dev;possible_net_t pnet;struct hlist_head hlhead[IPVLAN_HASH_SIZE ]; +spinlock_t addrs_lock;/* guards hash-table and addrs */ struct list_head ipvlans;u16 mode;u16 flags;
drivers/net/ipvlan/ipvlan_core.c +7 -9
@@ -104,17 +104,15 @@ void ipvlan_ht_addr_del(struct ipvl_addr *addr)struct ipvl_addr *ipvlan_find_addr (const struct ipvl_dev *ipvlan,const void *iaddr,bool is_v6) { -struct ipvl_addr *addr, *ret =NULL ; +struct ipvl_addr *addr; -rcu_read_lock (); -list_for_each_entry_rcu (addr, &ipvlan->addrs, anode) { -if (addr_equal (is_v6, addr, iaddr)) { - ret = addr; -break ; - } +assert_spin_locked (&ipvlan->port->addrs_lock); + +list_for_each_entry (addr, &ipvlan->addrs, anode) { +if (addr_equal (is_v6, addr, iaddr)) +return addr; } -rcu_read_unlock (); -return ret; +return NULL ; }bool ipvlan_addr_busy (struct ipvl_port *port,void *iaddr,bool is_v6)
drivers/net/ipvlan/ipvlan_main.c +29 -20
173 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/206 net/sched: Enforce that teql can only be used as root qdisc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b ]
Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint.
Although not important, I will describe the scenario that unearthed this issue for the curious.
GangMin Kim <[email protected]> managed to concot a scenario as follows:
ROOT qdisc 1:0 (QFQ)
├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s └── class 1:2 (weight=1, lmax=1514) teql
GangMin sends a packet which is enqueued to 1:1 (netem).
Any invocation of dequeue by QFQ from this class will not return a packet until after 6.4s. In the meantime, a second packet is sent and it lands on 1:2. teql's enqueue will return success and this will activate class 1:2. Main issue is that teql only updates the parent visible qlen (sch->q.qlen) at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's peek always returns NULL), dequeue will never be called and thus the qlen will remain as 0. With that in mind, when GangMin updates 1:2's lmax value, the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's qlen was not incremented, qfq fails to deactivate the class, but still frees its pointers from the aggregate. So when the first packet is rescheduled after 6.4 seconds (netem's delay), a dangling pointer is accessed causing GangMin's causing a UAF.
--- net/sched/sch_teql.c | 5 +++++ 1 file changed, 5 insertions(+)
net/sched/sch_teql.c +5 -0
@@ -178,6 +178,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,if (m->dev == dev)return -ELOOP ; +if (sch->parent !=TC_H_ROOT ) { +NL_SET_ERR_MSG_MOD (extack,"teql can only be used as root" ); +return -EOPNOTSUPP ; + } + q->m = m;skb_queue_head_init (&q->q);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/206 net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit d837fbee92453fbb829f950c8e7cf76207d73f33 ]
This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.
--- net/sched/sch_qfq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_qfq.c +1 -1
@@ -375,7 +375,7 @@ static void qfq_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl)/* Deschedule class and remove it from its parent aggregate. */ static void qfq_deact_rm_from_agg (struct qfq_sched *q,struct qfq_class *cl) { -if (cl->qdisc->q.qlen >0 )/* class is active */ +if (cl_is_active (cl))/* class is active */ qfq_deactivate_class (q, cl);qfq_rm_from_agg (q, cl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/206 crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeyang Lee <[email protected]>
[ Upstream commit 2397e9264676be7794f8f7f1e9763d90bd3c7335 ]
authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_authenc_esn_decrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (DoS).
Add a minimum AAD length check to fail fast on invalid inputs.
--- crypto/authencesn.c | 6 ++++++ 1 file changed, 6 insertions(+)
crypto/authencesn.c +6 -0
@@ -191,6 +191,9 @@ static int crypto_authenc_esn_encrypt(struct aead_request *req)struct scatterlist *src, *dst;int err; +if (assoclen <8 ) +return -EINVAL ; +sg_init_table (areq_ctx->src,2 ); src =scatterwalk_ffwd (areq_ctx->src, req->src, assoclen); dst = src;
@@ -284,6 +287,9 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req)u32 tmp[2 ];int err; +if (assoclen <8 ) +return -EINVAL ; + cryptlen -= authsize;if (req->src != dst) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/206 comedi: dmm32at: serialize use of paged registers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit e03b29b55f2b7c345a919a6ee36633b06bf3fb56 upstream.
Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to select the function of registers at offsets 12 to 15:
00 => 8254 timer/counter registers are accessible 01 => 8255 digital I/O registers are accessible 10 => Reserved
11 => Calibration registers are accessible
The interrupt service routine (dmm32at_isr()) clobbers the bottom two bits of the register with value 00, which would interfere with access to the 8255 registers by the dm32at_8255_io() function (used for Comedi instruction handling on the digital I/O subdevice).
Make use of the generic Comedi device spin-lock dev->spinlock (which is otherwise unused by this driver) to serialize access to the miscellaneous control register and paged registers.
--- drivers/comedi/drivers/dmm32at.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
drivers/comedi/drivers/dmm32at.c +30 -2
@@ -331,6 +331,7 @@ static int dmm32at_ai_cmdtest(struct comstatic void dmm32at_setaitimer (struct comedi_device *dev,unsigned int nansec) { +unsigned long irq_flags;unsigned char lo1, lo2, hi2;unsigned short both2;
@@ -343,6 +344,9 @@ static void dmm32at_setaitimer(struct co/* set counter clocks to 10MHz, disable all aux dio */ outb (0 , dev->iobase +DMM32AT_CTRDIO_CFG_REG ); +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* get access to the clock regs */ outb (DMM32AT_CTRL_PAGE_8254 , dev->iobase +DMM32AT_CTRL_REG );
@@ -355,6 +359,8 @@ static void dmm32at_setaitimer(struct cooutb (lo2, dev->iobase +DMM32AT_CLK2 );outb (hi2, dev->iobase +DMM32AT_CLK2 ); +spin_unlock_irqrestore (&dev->spinlock, irq_flags); +/* enable the ai conversion interrupt and the clock to start scans */ outb(DMM32AT_INTCLK_ADINT | DMM32AT_INTCLK_CLKEN | DMM32AT_INTCLK_CLKSEL,
@@ -364,13 +370,19 @@ static void dmm32at_setaitimer(struct costatic int dmm32at_ai_cmd (struct comedi_device *dev,struct comedi_subdevice *s) {struct comedi_cmd *cmd = &s->async->cmd; +unsigned long irq_flags;int ret;dmm32at_ai_set_chanspec (dev, s, cmd->chanlist[0 ], cmd->chanlist_len); +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* reset the interrupt just in case */ outb (DMM32AT_CTRL_INTRST , dev->iobase +DMM32AT_CTRL_REG ); +spin_unlock_irqrestore (&dev->spinlock, irq_flags); +/* * wait for circuit to settle * we don't have the 'insn' here but it's not needed
@@ -430,8 +442,13 @@ static irqreturn_t dmm32at_isr(int irq,comedi_handle_events (dev, s); } +/* serialize access to control register and paged registers */ +spin_lock (&dev->spinlock); +/* reset the interrupt */ outb (DMM32AT_CTRL_INTRST , dev->iobase +DMM32AT_CTRL_REG ); + +spin_unlock (&dev->spinlock);return IRQ_HANDLED ; }
@@ -482,14 +499,25 @@ static int dmm32at_ao_insn_write(structstatic int dmm32at_8255_io (struct comedi_device *dev,int dir,int port,int data,unsigned long regbase) { +unsigned long irq_flags; +int ret; + +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* get access to the DIO regs */ outb (DMM32AT_CTRL_PAGE_8255 , dev->iobase +DMM32AT_CTRL_REG );if (dir) {outb (data, dev->iobase + regbase + port); -return 0 ; + ret =0 ; + }else { + ret =inb (dev->iobase + regbase + port); } -return inb (dev->iobase + regbase + port); + +spin_unlock_irqrestore (&dev->spinlock, irq_flags); + +return ret; }/* Make sure the board is there and put it to a known state */
Greg Kroah-Hartman
maintainerPATCH 83/206 w1: fix redundant counter decrement in w1_attach_slave_device()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit cc8f92e41eb76f450f05234fef2054afc3633100 upstream.
In w1_attach_slave_device(), if __w1_attach_slave_device() fails, put_device() -> w1_slave_release() is called to do the cleanup job. In w1_slave_release(), sl->family->refcnt and sl->master->slave_count have already been decremented. There is no need to decrement twice in w1_attach_slave_device().
--- drivers/w1/w1.c | 2 -- 1 file changed, 2 deletions(-)
drivers/w1/w1.c +0 -2
@@ -767,8 +767,6 @@ int w1_attach_slave_device(struct w1_masif (err <0 ) {dev_err (&dev->dev,"%s: Attaching %s failed.\n" , __func__, sl->name); - dev->slave_count--; -w1_family_put (sl->family);atomic_dec (&sl->master->refcnt);kfree (sl);return err;
Greg Kroah-Hartman
maintainerPATCH 84/206 Revert "nfc/nci: Add the inconsistency check between the input data length and count"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit f40ddcc0c0ca1a0122a7f4440b429f97d5832bdf upstream.
This reverts commit 068648aab72c9ba7b0597354ef4d81ffaac7b979.
NFC packets may have NUL-bytes. Checking for string length is not a correct assumption here. As long as there is a check for the length copied from copy_from_user, all should be fine.
The fix only prevented the syzbot reproducer from triggering the bug because the packet is not enqueued anymore and the code that triggers the bug is not exercised.
The fix even broke
testing/selftests/nci/nci_dev, making all tests there fail. After the revert, 6 out of 8 tests pass.
--- drivers/nfc/virtual_ncidev.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/nfc/virtual_ncidev.c +0 -4
@@ -121,10 +121,6 @@ static ssize_t virtual_ncidev_write(strukfree_skb (skb);return -EFAULT ; } -if (strnlen (skb->data, count) != count) { -kfree_skb (skb); -return -EINVAL ; - }nci_recv_frame (ndev, skb);return count;
Greg Kroah-Hartman
maintainerPATCH 85/206 Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: gongqi <[email protected]>
commit 19a5d9ba6208e9006a2a9d5962aea4d6e427d8ab upstream.
The MECHREVO Wujie 15X Pro requires several i8042 quirks to function correctly. Specifically, NOMUX, RESET_ALWAYS, NOLOOP, and NOPNP are needed to ensure the keyboard and touchpad work reliably.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1168,6 +1168,13 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, /* * A lot of modern Clevo barebones have touchpad and/or keyboard issues * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
Greg Kroah-Hartman
maintainerPATCH 86/206 Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: feng <[email protected]>
commit 2934325f56150ad8dab8ab92cbe2997242831396 upstream.
The ASUS Zenbook UX425QA_UM425QA fails to initialize the keyboard after a cold boot.
A quirk already exists for "ZenBook UX425", but some Zenbooks report "Zenbook" with a lowercase 'b'. Since DMI matching is case-sensitive, the existing quirk is not applied to these "extra special" Zenbooks.
Testing confirms that this model needs the same quirks as the ZenBook UX425 variants.
--- drivers/input/serio/i8042-acpipnpio.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +11 -0
@@ -114,6 +114,17 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_NEVER) }, { +/* +* ASUS Zenbook UX425QA_UM425QA +* Some Zenbooks report "Zenbook" with a lowercase b. +*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Zenbook UX425QA_UM425QA"), + }, + .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER |SERIO_QUIRK_RESET_NEVER ) + }, + {/* ASUS ZenBook UX425UA/QA */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 87/206 scsi: storvsc: Process unsupported MODE_SENSE_10
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit 9eacec5d18f98f89be520eeeef4b377acee3e4b8 upstream.
The Hyper-V host does not support MODE_SENSE_10 and MODE_SENSE. The driver handles MODE_SENSE as unsupported command, but not for MODE_SENSE_10. Add MODE_SENSE_10 to the same handling logic and return correct code to SCSI layer.
--- drivers/scsi/storvsc_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/storvsc_drv.c +2 -1
@@ -1199,7 +1199,7 @@ static void storvsc_on_io_completion(str* The current SCSI handling on the host side does * not correctly handle: * INQUIRY command with page code parameter set to 0x80 -* MODE_SENSE command with cmd[2] == 0x1c +* MODE_SENSE and MODE_SENSE_10 command with cmd[2] == 0x1c * MAINTENANCE_IN is not supported by HyperV FC passthrough * * Setup srb and scsi status so this won't be fatal.
@@ -1209,6 +1209,7 @@ static void storvsc_on_io_completion(strif ((stor_pkt->vm_srb.cdb[0 ] ==INQUIRY ) || (stor_pkt->vm_srb.cdb[0 ] ==MODE_SENSE ) || + (stor_pkt->vm_srb.cdb[0 ] ==MODE_SENSE_10 ) || (stor_pkt->vm_srb.cdb[0 ] ==MAINTENANCE_IN &&hv_dev_is_fc (device))) { vstor_packet->vm_srb.scsi_status =0 ;
Greg Kroah-Hartman
maintainerPATCH 88/206 x86/kfence: avoid writing L1TF-vulnerable PTEs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Cooper <[email protected]>
commit b505f1944535f83d369ae68813e7634d11b990d3 upstream.
For native, the choice of PTE is fine. There's real memory backing the non-present PTE. However, for XenPV, Xen complains:
(XEN) d1 L1TF-vulnerable L1e 8010000018200066 - Shadowing
To explain, some background on XenPV pagetables:
Xen PV guests are control their own pagetables; they choose the new PTE value, and use hypercalls to make changes so Xen can audit for safety.
In addition to a regular reference count, Xen also maintains a type reference count. e.g. SegDesc (referenced by vGDT/vLDT), Writable (referenced with _PAGE_RW) or L{1..4} (referenced by vCR3 or a lower pagetable level). This is in order to prevent e.g. a page being inserted into the pagetables for which the guest has a writable mapping.
For non-present mappings, all other bits become software accessible, and typically contain metadata rather a real frame address. There is nothing that a reference count could sensibly be tied to. As such, even if Xen could recognise the address as currently safe, nothing would prevent that frame from changing owner to another VM in the future.
When Xen detects a PV guest writing a L1TF-PTE, it responds by activating shadow paging. This is normally only used for the live phase of migration, and comes with a reasonable overhead.
KFENCE only cares about getting #PF to catch wild accesses; it doesn't care about the value for non-present mappings. Use a fully inverted PTE, to avoid hitting the slow path when running under Xen.
While adjusting the logic, take the opportunity to skip all actions if the PTE is already in the right state, half the number PVOps callouts, and skip TLB maintenance on a !P -> P transition which benefits non-Xen cases too.
--- arch/x86/include/asm/kfence.h | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)
arch/x86/include/asm/kfence.h +24 -5
@@ -42,10 +42,34 @@ static inline bool kfence_protect_page(u {unsigned int level;pte_t *pte =lookup_address (addr, &level); +pteval_t val;if (WARN_ON (!pte || level !=PG_LEVEL_4K ))return false; + val =pte_val (*pte); + +/* +* protect requires making the page not-present. If the PTE is +* already in the right state, there's nothing to do. +*/ +if (protect != !!(val & _PAGE_PRESENT)) +return true; + +/* +* Otherwise, invert the entire PTE. This avoids writing out an +* L1TF-vulnerable PTE (not present, without the high address bits +* set). +*/ +set_pte (pte,__pte (~val)); + +/* +* If the page was protected (non-present) and we're making it +* present, there is no need to flush the TLB at all. +*/ +if (!protect) +return true; +/* * We need to avoid IPIs, as we may get KFENCE allocations or faults * with interrupts disabled. Therefore, the below is best-effort, and
@@ -53,11 +77,6 @@ static inline bool kfence_protect_page(u* lazy fault handling takes care of faults after the page is PRESENT. */ -if (protect) -set_pte (pte,__pte (pte_val (*pte) & ~_PAGE_PRESENT)); -else -set_pte (pte,__pte (pte_val (*pte) | _PAGE_PRESENT)); -/* * Flush this CPU's TLB, assuming whoever did the allocation/free is * likely to continue running on this CPU.
Greg Kroah-Hartman
maintainerPATCH 89/206 iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
commit c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3 upstream.
The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However, event detection is not supported for all sensors, and if userspace tries to configure accelerometer wakeup events on a sensor device that does not support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL pointer when trying to write to the wakeup register.
Define an additional struct iio_chan_spec array whose members have a NULL event_spec field, and use this array instead of st_lsm6dsx_acc_channels for sensors without event detection capability.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +11 -4
@@ -74,6 +74,13 @@ static const struct iio_chan_spec st_lsm IIO_CHAN_SOFT_TIMESTAMP(3), }; +static const struct iio_chan_spec st_lsm6ds0_acc_channels[] = { +ST_LSM6DSX_CHANNEL (IIO_ACCEL ,0x28 ,IIO_MOD_X ,0 ), +ST_LSM6DSX_CHANNEL (IIO_ACCEL ,0x2a ,IIO_MOD_Y ,1 ), +ST_LSM6DSX_CHANNEL (IIO_ACCEL ,0x2c ,IIO_MOD_Z ,2 ), +IIO_CHAN_SOFT_TIMESTAMP (3 ), +}; +static const struct iio_chan_spec st_lsm6dsx_gyro_channels[] = {ST_LSM6DSX_CHANNEL (IIO_ANGL_VEL ,0x22 ,IIO_MOD_X ,0 ),ST_LSM6DSX_CHANNEL (IIO_ANGL_VEL ,0x24 ,IIO_MOD_Y ,1 ),
@@ -116,8 +123,8 @@ static const struct st_lsm6dsx_settings }, .channels = { [ST_LSM6DSX_ID_ACC] = { - .chan = st_lsm6dsx_acc_channels, - .len = ARRAY_SIZE(st_lsm6dsx_acc_channels), + .chan = st_lsm6ds0_acc_channels, + .len = ARRAY_SIZE(st_lsm6ds0_acc_channels), }, [ST_LSM6DSX_ID_GYRO] = { .chan = st_lsm6ds0_gyro_channels,
@@ -1016,8 +1023,8 @@ static const struct st_lsm6dsx_settings }, .channels = { [ST_LSM6DSX_ID_ACC] = { - .chan = st_lsm6dsx_acc_channels, - .len = ARRAY_SIZE(st_lsm6dsx_acc_channels), + .chan = st_lsm6ds0_acc_channels, + .len = ARRAY_SIZE(st_lsm6ds0_acc_channels), }, [ST_LSM6DSX_ID_GYRO] = { .chan = st_lsm6dsx_gyro_channels,
Greg Kroah-Hartman
maintainerPATCH 90/206 staging:iio:adc:ad7280a: Register define cleanup.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit 4c59aabd9a93d8f867d9f6aa0407cc6a7db47fa5 ]
1. Postfix register addresses with _REG to distinguish them from fields within the registers
2. Switch to using FIELD_PREP and masks to aid readability.
3. Shorten a few defines to make the lines remain a sensible length.
4. Fix an issue whether where an CTRL_LB field is set in CTRL_HB.
5. Fix wrong AUX1_3_4 which should be AUX_1_3_5 according to table 14 in the datasheet.
Stable-dep-of: 6b39824ac4c1 ("iio: adc: ad7280a: handle spi_setup() errors in probe()")
--- drivers/staging/iio/adc/ad7280a.c | 285 ++++++++++++++++-------------- 1 file changed, 154 insertions(+), 131 deletions(-)
drivers/staging/iio/adc/ad7280a.c +154 -131
@@ -11,6 +11,7 @@#include <linux/slab.h> #include <linux/sysfs.h> #include <linux/spi/spi.h> +#include <linux/bitfield.h> #include <linux/err.h> #include <linux/delay.h> #include <linux/interrupt.h>
@@ -23,78 +24,86 @@#include "ad7280a.h" /* Registers */ -#define AD7280A_CELL_VOLTAGE_1 0x0/* D11 to D0, Read only */ -#define AD7280A_CELL_VOLTAGE_2 0x1/* D11 to D0, Read only */ -#define AD7280A_CELL_VOLTAGE_3 0x2/* D11 to D0, Read only */ -#define AD7280A_CELL_VOLTAGE_4 0x3/* D11 to D0, Read only */ -#define AD7280A_CELL_VOLTAGE_5 0x4/* D11 to D0, Read only */ -#define AD7280A_CELL_VOLTAGE_6 0x5/* D11 to D0, Read only */ -#define AD7280A_AUX_ADC_1 0x6/* D11 to D0, Read only */ -#define AD7280A_AUX_ADC_2 0x7/* D11 to D0, Read only */ -#define AD7280A_AUX_ADC_3 0x8/* D11 to D0, Read only */ -#define AD7280A_AUX_ADC_4 0x9/* D11 to D0, Read only */ -#define AD7280A_AUX_ADC_5 0xA/* D11 to D0, Read only */ -#define AD7280A_AUX_ADC_6 0xB/* D11 to D0, Read only */ -#define AD7280A_SELF_TEST 0xC/* D11 to D0, Read only */ -#define AD7280A_CONTROL_HB 0xD/* D15 to D8, Read/write */ -#define AD7280A_CONTROL_LB 0xE/* D7 to D0, Read/write */ -#define AD7280A_CELL_OVERVOLTAGE 0xF/* D7 to D0, Read/write */ -#define AD7280A_CELL_UNDERVOLTAGE 0x10/* D7 to D0, Read/write */ -#define AD7280A_AUX_ADC_OVERVOLTAGE 0x11/* D7 to D0, Read/write */ -#define AD7280A_AUX_ADC_UNDERVOLTAGE 0x12/* D7 to D0, Read/write */ -#define AD7280A_ALERT 0x13/* D7 to D0, Read/write */ -#define AD7280A_CELL_BALANCE 0x14/* D7 to D0, Read/write */ -#define AD7280A_CB1_TIMER 0x15/* D7 to D0, Read/write */ -#define AD7280A_CB2_TIMER 0x16/* D7 to D0, Read/write */ -#define AD7280A_CB3_TIMER 0x17/* D7 to D0, Read/write */ -#define AD7280A_CB4_TIMER 0x18/* D7 to D0, Read/write */ -#define AD7280A_CB5_TIMER 0x19/* D7 to D0, Read/write */ -#define AD7280A_CB6_TIMER 0x1A/* D7 to D0, Read/write */ -#define AD7280A_PD_TIMER 0x1B/* D7 to D0, Read/write */ -#define AD7280A_READ 0x1C/* D7 to D0, Read/write */ -#define AD7280A_CNVST_CONTROL 0x1D/* D7 to D0, Read/write */ - -/* Bits and Masks */ -#define AD7280A_CTRL_HB_CONV_INPUT_ALL 0 -#define AD7280A_CTRL_HB_CONV_INPUT_6CELL_AUX1_3_4 BIT(6) -#define AD7280A_CTRL_HB_CONV_INPUT_6CELL BIT(7) -#define AD7280A_CTRL_HB_CONV_INPUT_SELF_TEST (BIT(7) | BIT(6)) -#define AD7280A_CTRL_HB_CONV_RES_READ_ALL 0 -#define AD7280A_CTRL_HB_CONV_RES_READ_6CELL_AUX1_3_4 BIT(4) -#define AD7280A_CTRL_HB_CONV_RES_READ_6CELL BIT(5) -#define AD7280A_CTRL_HB_CONV_RES_READ_NO (BIT(5) | BIT(4)) -#define AD7280A_CTRL_HB_CONV_START_CNVST 0 -#define AD7280A_CTRL_HB_CONV_START_CS BIT(3) -#define AD7280A_CTRL_HB_CONV_AVG_DIS 0 -#define AD7280A_CTRL_HB_CONV_AVG_2 BIT(1) -#define AD7280A_CTRL_HB_CONV_AVG_4 BIT(2) -#define AD7280A_CTRL_HB_CONV_AVG_8 (BIT(2) | BIT(1)) -#define AD7280A_CTRL_HB_CONV_AVG (x) ((x) << 1) -#define AD7280A_CTRL_HB_PWRDN_SW BIT(0) - -#define AD7280A_CTRL_LB_SWRST BIT(7) -#define AD7280A_CTRL_LB_ACQ_TIME_400ns 0 -#define AD7280A_CTRL_LB_ACQ_TIME_800ns BIT(5) -#define AD7280A_CTRL_LB_ACQ_TIME_1200ns BIT(6) -#define AD7280A_CTRL_LB_ACQ_TIME_1600ns (BIT(6) | BIT(5)) -#define AD7280A_CTRL_LB_ACQ_TIME (x) ((x) << 5) -#define AD7280A_CTRL_LB_MUST_SET BIT(4) -#define AD7280A_CTRL_LB_THERMISTOR_EN BIT(3) -#define AD7280A_CTRL_LB_LOCK_DEV_ADDR BIT(2) -#define AD7280A_CTRL_LB_INC_DEV_ADDR BIT(1) -#define AD7280A_CTRL_LB_DAISY_CHAIN_RB_EN BIT(0) - -#define AD7280A_ALERT_GEN_STATIC_HIGH BIT(6) -#define AD7280A_ALERT_RELAY_SIG_CHAIN_DOWN (BIT(7) | BIT(6)) +#define AD7280A_CELL_VOLTAGE_1_REG 0x0/* D11 to D0, Read only */ +#define AD7280A_CELL_VOLTAGE_2_REG 0x1/* D11 to D0, Read only */ +#define AD7280A_CELL_VOLTAGE_3_REG 0x2/* D11 to D0, Read only */ +#define AD7280A_CELL_VOLTAGE_4_REG 0x3/* D11 to D0, Read only */ +#define AD7280A_CELL_VOLTAGE_5_REG 0x4/* D11 to D0, Read only */ +#define AD7280A_CELL_VOLTAGE_6_REG 0x5/* D11 to D0, Read only */ +#define AD7280A_AUX_ADC_1_REG 0x6/* D11 to D0, Read only */ +#define AD7280A_AUX_ADC_2_REG 0x7/* D11 to D0, Read only */ +#define AD7280A_AUX_ADC_3_REG 0x8/* D11 to D0, Read only */ +#define AD7280A_AUX_ADC_4_REG 0x9/* D11 to D0, Read only */ +#define AD7280A_AUX_ADC_5_REG 0xA/* D11 to D0, Read only */ +#define AD7280A_AUX_ADC_6_REG 0xB/* D11 to D0, Read only */ +#define AD7280A_SELF_TEST_REG 0xC/* D11 to D0, Read only */ + +#define AD7280A_CTRL_HB_REG 0xD/* D15 to D8, Read/write */ +#define AD7280A_CTRL_HB_CONV_INPUT_MSK GENMASK(7, 6) +#define AD7280A_CTRL_HB_CONV_INPUT_ALL 0 +#define AD7280A_CTRL_HB_CONV_INPUT_6CELL_AUX1_3_5 1 +#define AD7280A_CTRL_HB_CONV_INPUT_6CELL 2 +#define AD7280A_CTRL_HB_CONV_INPUT_SELF_TEST 3 +#define AD7280A_CTRL_HB_CONV_RREAD_MSK GENMASK(5, 4) +#define AD7280A_CTRL_HB_CONV_RREAD_ALL 0 +#define AD7280A_CTRL_HB_CONV_RREAD_6CELL_AUX1_3_5 1 +#define AD7280A_CTRL_HB_CONV_RREAD_6CELL 2 +#define AD7280A_CTRL_HB_CONV_RREAD_NO 3 +#define AD7280A_CTRL_HB_CONV_START_MSK BIT(3) +#define AD7280A_CTRL_HB_CONV_START_CNVST 0 +#define AD7280A_CTRL_HB_CONV_START_CS 1 +#define AD7280A_CTRL_HB_CONV_AVG_MSK GENMASK(2, 1) +#define AD7280A_CTRL_HB_CONV_AVG_DIS 0 +#define AD7280A_CTRL_HB_CONV_AVG_2 1 +#define AD7280A_CTRL_HB_CONV_AVG_4 2 +#define AD7280A_CTRL_HB_CONV_AVG_8 3 +#define AD7280A_CTRL_HB_PWRDN_SW BIT(0) + +#define AD7280A_CTRL_LB_REG 0xE/* D7 to D0, Read/write */ +#define AD7280A_CTRL_LB_SWRST_MSK BIT(7) +#define AD7280A_CTRL_LB_ACQ_TIME_MSK GENMASK(6, 5) +#define AD7280A_CTRL_LB_ACQ_TIME_400ns 0 +#define AD7280A_CTRL_LB_ACQ_TIME_800ns 1 +#define AD7280A_CTRL_LB_ACQ_TIME_1200ns 2 +#define AD7280A_CTRL_LB_ACQ_TIME_1600ns 3 +#define AD7280A_CTRL_LB_MUST_SET BIT(4) +#define AD7280A_CTRL_LB_THERMISTOR_MSK BIT(3) +#define AD7280A_CTRL_LB_LOCK_DEV_ADDR_MSK BIT(2) +#define AD7280A_CTRL_LB_INC_DEV_ADDR_MSK BIT(1) +#define AD7280A_CTRL_LB_DAISY_CHAIN_RB_MSK BIT(0) + +#define AD7280A_CELL_OVERVOLTAGE_REG 0xF/* D7 to D0, Read/write */ +#define AD7280A_CELL_UNDERVOLTAGE_REG 0x10/* D7 to D0, Read/write */ +#define AD7280A_AUX_ADC_OVERVOLTAGE_REG 0x11/* D7 to D0, Read/write */ +#define AD7280A_AUX_ADC_UNDERVOLTAGE_REG 0x12/* D7 to D0, Read/write */ + +#define AD7280A_ALERT_REG 0x13/* D7 to D0, Read/write */ +#define AD7280A_ALERT_GEN_STATIC_HIGH BIT(6) +#define AD7280A_ALERT_RELAY_SIG_CHAIN_DOWN (BIT(7) | BIT(6)) + +#define AD7280A_CELL_BALANCE_REG 0x14/* D7 to D0, Read/write */ +#define AD7280A_CB1_TIMER_REG 0x15/* D7 to D0, Read/write */ +#define AD7280A_CB_TIMER_VAL_MSK GENMASK(7, 3) +#define AD7280A_CB2_TIMER_REG 0x16/* D7 to D0, Read/write */ +#define AD7280A_CB3_TIMER_REG 0x17/* D7 to D0, Read/write */ +#define AD7280A_CB4_TIMER_REG 0x18/* D7 to D0, Read/write */ +#define AD7280A_CB5_TIMER_REG 0x19/* D7 to D0, Read/write */ +#define AD7280A_CB6_TIMER_REG 0x1A/* D7 to D0, Read/write */ +#define AD7280A_PD_TIMER_REG 0x1B/* D7 to D0, Read/write */ +#define AD7280A_READ_REG 0x1C/* D7 to D0, Read/write */ +#define AD7280A_READ_ADDR_MSK GENMASK(7, 2) +#define AD7280A_CNVST_CTRL_REG 0x1D/* D7 to D0, Read/write */ + +/* Magic value used to indicate this special case */ #define AD7280A_ALL_CELLS (0xAD << 16)#define AD7280A_MAX_SPI_CLK_HZ 700000/* < 1MHz */ #define AD7280A_MAX_CHAIN 8#define AD7280A_CELLS_PER_DEV 6#define AD7280A_BITS 12 -#define AD7280A_NUM_CH (AD7280A_AUX_ADC_6 - \ - AD7280A_CELL_VOLTAGE_1 + 1) +#define AD7280A_NUM_CH (AD7280A_AUX_ADC_6_REG - \ + AD7280A_CELL_VOLTAGE_1_REG + 1)#define AD7280A_CALC_VOLTAGE_CHAN_NUM (d, c) (((d) * AD7280A_CELLS_PER_DEV) + \ (c))
@@ -222,23 +231,28 @@ static int ad7280_read(struct ad7280_state *st, unsigned int devaddr,unsigned int tmp;/* turns off the read operation on all parts */ - ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CONTROL_HB ,1 , -AD7280A_CTRL_HB_CONV_INPUT_ALL | -AD7280A_CTRL_HB_CONV_RES_READ_NO | + ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CTRL_HB_REG ,1 , +FIELD_PREP (AD7280A_CTRL_HB_CONV_INPUT_MSK , +AD7280A_CTRL_HB_CONV_INPUT_ALL ) | +FIELD_PREP (AD7280A_CTRL_HB_CONV_RREAD_MSK , +AD7280A_CTRL_HB_CONV_RREAD_NO ) | st->ctrl_hb);if (ret)return ret;/* turns on the read operation on the addressed part */ - ret =ad7280_write (st, devaddr,AD7280A_CONTROL_HB ,0 , -AD7280A_CTRL_HB_CONV_INPUT_ALL | -AD7280A_CTRL_HB_CONV_RES_READ_ALL | + ret =ad7280_write (st, devaddr,AD7280A_CTRL_HB_REG ,0 , +FIELD_PREP (AD7280A_CTRL_HB_CONV_INPUT_MSK , +AD7280A_CTRL_HB_CONV_INPUT_ALL ) | +FIELD_PREP (AD7280A_CTRL_HB_CONV_RREAD_MSK , +AD7280A_CTRL_HB_CONV_RREAD_ALL ) | st->ctrl_hb);if (ret)return ret;/* Set register address on the part to be read from */ - ret =ad7280_write (st, devaddr,AD7280A_READ ,0 , addr <<2 ); + ret =ad7280_write (st, devaddr,AD7280A_READ_REG ,0 , +FIELD_PREP (AD7280A_READ_ADDR_MSK , addr));if (ret)return ret;
@@ -261,21 +275,27 @@ static int ad7280_read_channel(struct ad7280_state *st, unsigned int devaddr,int ret;unsigned int tmp; - ret =ad7280_write (st, devaddr,AD7280A_READ ,0 , addr <<2 ); + ret =ad7280_write (st, devaddr,AD7280A_READ_REG ,0 , +FIELD_PREP (AD7280A_READ_ADDR_MSK , addr));if (ret)return ret; - ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CONTROL_HB ,1 , -AD7280A_CTRL_HB_CONV_INPUT_ALL | -AD7280A_CTRL_HB_CONV_RES_READ_NO | + ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CTRL_HB_REG ,1 , +FIELD_PREP (AD7280A_CTRL_HB_CONV_INPUT_MSK , +AD7280A_CTRL_HB_CONV_INPUT_ALL ) | +FIELD_PREP (AD7280A_CTRL_HB_CONV_RREAD_MSK , +AD7280A_CTRL_HB_CONV_RREAD_NO ) | st->ctrl_hb);if (ret)return ret; - ret =ad7280_write (st, devaddr,AD7280A_CONTROL_HB ,0 , -AD7280A_CTRL_HB_CONV_INPUT_ALL | -AD7280A_CTRL_HB_CONV_RES_READ_ALL | -AD7280A_CTRL_HB_CONV_START_CS | + ret =ad7280_write (st, devaddr,AD7280A_CTRL_HB_REG ,0 , +FIELD_PREP (AD7280A_CTRL_HB_CONV_INPUT_MSK , +AD7280A_CTRL_HB_CONV_INPUT_ALL ) | +FIELD_PREP (AD7280A_CTRL_HB_CONV_RREAD_MSK , +AD7280A_CTRL_HB_CONV_RREAD_ALL ) | +FIELD_PREP (AD7280A_CTRL_HB_CONV_START_MSK , +AD7280A_CTRL_HB_CONV_START_CS ) | st->ctrl_hb);if (ret)return ret;
@@ -301,15 +321,18 @@ static int ad7280_read_all_channels(struct ad7280_state *st, unsigned int cnt,int i, ret;unsigned int tmp, sum =0 ; - ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_READ ,1 , -AD7280A_CELL_VOLTAGE_1 <<2 ); + ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_READ_REG ,1 , +AD7280A_CELL_VOLTAGE_1_REG <<2 );if (ret)return ret; - ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CONTROL_HB ,1 , -AD7280A_CTRL_HB_CONV_INPUT_ALL | -AD7280A_CTRL_HB_CONV_RES_READ_ALL | -AD7280A_CTRL_HB_CONV_START_CS | + ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CTRL_HB_REG ,1 , +FIELD_PREP (AD7280A_CTRL_HB_CONV_INPUT_MSK , +AD7280A_CTRL_HB_CONV_INPUT_ALL ) | +FIELD_PREP (AD7280A_CTRL_HB_CONV_RREAD_MSK , +AD7280A_CTRL_HB_CONV_RREAD_ALL ) | +FIELD_PREP (AD7280A_CTRL_HB_CONV_START_MSK , +AD7280A_CTRL_HB_CONV_START_CS ) | st->ctrl_hb);if (ret)return ret;
@@ -327,7 +350,7 @@ static int ad7280_read_all_channels(struct ad7280_state *st, unsigned int cnt,if (array) array[i] = tmp;/* only sum cell voltages */ -if (((tmp >>23 ) &0xF ) <=AD7280A_CELL_VOLTAGE_6 ) +if (((tmp >>23 ) &0xF ) <=AD7280A_CELL_VOLTAGE_6_REG ) sum += ((tmp >>11 ) &0xFFF ); }
@@ -338,7 +361,7 @@ static void ad7280_sw_power_down(void *data) {struct ad7280_state *st = data; -ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CONTROL_HB ,1 , +ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CTRL_HB_REG ,1 ,AD7280A_CTRL_HB_PWRDN_SW | st->ctrl_hb); }
@@ -347,25 +370,26 @@ static int ad7280_chain_setup(struct ad7280_state *st)unsigned int val, n;int ret; - ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CONTROL_LB ,1 , -AD7280A_CTRL_LB_DAISY_CHAIN_RB_EN | -AD7280A_CTRL_LB_LOCK_DEV_ADDR | + ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CTRL_LB_REG ,1 , +FIELD_PREP (AD7280A_CTRL_LB_DAISY_CHAIN_RB_MSK ,1 ) | +FIELD_PREP (AD7280A_CTRL_LB_LOCK_DEV_ADDR_MSK ,1 ) |AD7280A_CTRL_LB_MUST_SET | -AD7280A_CTRL_LB_SWRST | +FIELD_PREP (AD7280A_CTRL_LB_SWRST_MSK ,1 ) | st->ctrl_lb);if (ret)return ret; - ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CONTROL_LB ,1 , -AD7280A_CTRL_LB_DAISY_CHAIN_RB_EN | -AD7280A_CTRL_LB_LOCK_DEV_ADDR | + ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CTRL_LB_REG ,1 , +FIELD_PREP (AD7280A_CTRL_LB_DAISY_CHAIN_RB_MSK ,1 ) | +FIELD_PREP (AD7280A_CTRL_LB_LOCK_DEV_ADDR_MSK ,1 ) |AD7280A_CTRL_LB_MUST_SET | +FIELD_PREP (AD7280A_CTRL_LB_SWRST_MSK ,0 ) | st->ctrl_lb);if (ret) goto error_power_down; - ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_READ ,1 , -AD7280A_CONTROL_LB <<2 ); + ret =ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_READ_REG ,1 , +FIELD_PREP (AD7280A_READ_ADDR_MSK ,AD7280A_CTRL_LB_REG ));if (ret) goto error_power_down;
@@ -390,7 +414,7 @@ static int ad7280_chain_setup(struct ad7280_state *st) ret = -EFAULT ; error_power_down: -ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CONTROL_HB ,1 , +ad7280_write (st,AD7280A_DEVADDR_MASTER ,AD7280A_CTRL_HB_REG ,1 ,AD7280A_CTRL_HB_PWRDN_SW | st->ctrl_hb);return ret;
@@ -434,7 +458,7 @@ static ssize_t ad7280_store_balance_sw(struct device *dev,else st->cb_mask[devaddr] &= ~(1 << (ch +2 )); - ret =ad7280_write (st, devaddr,AD7280A_CELL_BALANCE , + ret =ad7280_write (st, devaddr,AD7280A_CELL_BALANCE_REG ,0 , st->cb_mask[devaddr]);mutex_unlock (&st->lock);
@@ -459,7 +483,7 @@ static ssize_t ad7280_show_balance_timer(struct device *dev,if (ret <0 )return ret; - msecs = (ret >>3 ) *71500 ; + msecs =FIELD_GET (AD7280A_CB_TIMER_VAL_MSK , ret) *71500 ;return sprintf (buf,"%u\n" , msecs); }
@@ -486,8 +510,8 @@ static ssize_t ad7280_store_balance_timer(struct device *dev,mutex_lock (&st->lock); ret =ad7280_write (st, this_attr->address >>8 , - this_attr->address &0xFF , -0 , (val &0x1F ) <<3 ); + this_attr->address &0xFF ,0 , +FIELD_PREP (AD7280A_CB_TIMER_VAL_MSK , val));mutex_unlock (&st->lock);return ret ? ret : len;
@@ -559,10 +583,10 @@ static void ad7280_init_dev_channels(struct ad7280_state *st, int dev, int *cnt)int addr, ch, i;struct iio_chan_spec *chan; -for (ch =AD7280A_CELL_VOLTAGE_1 ; ch <=AD7280A_AUX_ADC_6 ; ch++) { +for (ch =AD7280A_CELL_VOLTAGE_1_REG ; ch <=AD7280A_AUX_ADC_6_REG ; ch++) { chan = &st->channels[*cnt]; -if (ch <AD7280A_AUX_ADC_1 ) { +if (ch <AD7280A_AUX_ADC_1_REG ) { i =AD7280A_CALC_VOLTAGE_CHAN_NUM (dev, ch);ad7280_voltage_channel_init (chan, i); }else {
@@ -634,7 +658,7 @@ static int ad7280_init_dev_attrs(struct ad7280_state *st, int dev, int *cnt)struct iio_dev_attr *iio_attr;struct device *sdev = &st->spi->dev; -for (ch =AD7280A_CELL_VOLTAGE_1 ; ch <=AD7280A_CELL_VOLTAGE_6 ; ch++) { +for (ch =AD7280A_CELL_VOLTAGE_1_REG ; ch <=AD7280A_CELL_VOLTAGE_6_REG ; ch++) { iio_attr = &st->iio_attr[*cnt]; addr =ad7280a_devaddr (dev) <<8 | ch; i = dev *AD7280A_CELLS_PER_DEV + ch;
@@ -647,7 +671,7 @@ static int ad7280_init_dev_attrs(struct ad7280_state *st, int dev, int *cnt) (*cnt)++; iio_attr = &st->iio_attr[*cnt]; - addr =ad7280a_devaddr (dev) <<8 | (AD7280A_CB1_TIMER + ch); + addr =ad7280a_devaddr (dev) <<8 | (AD7280A_CB1_TIMER_REG + ch); ret =ad7280_balance_timer_attr_init (iio_attr, sdev, addr, i);if (ret <0 )
@@ -691,16 +715,16 @@ static ssize_t ad7280_read_channel_config(struct device *dev,unsigned int val;switch (this_attr->address) { -case AD7280A_CELL_OVERVOLTAGE : +case AD7280A_CELL_OVERVOLTAGE_REG : val =1000 + (st->cell_threshhigh *1568 ) /100 ;break ; -case AD7280A_CELL_UNDERVOLTAGE : +case AD7280A_CELL_UNDERVOLTAGE_REG : val =1000 + (st->cell_threshlow *1568 ) /100 ;break ; -case AD7280A_AUX_ADC_OVERVOLTAGE : +case AD7280A_AUX_ADC_OVERVOLTAGE_REG : val = (st->aux_threshhigh *196 ) /10 ;break ; -case AD7280A_AUX_ADC_UNDERVOLTAGE : +case AD7280A_AUX_ADC_UNDERVOLTAGE_REG : val = (st->aux_threshlow *196 ) /10 ;break ;default :
@@ -727,12 +751,12 @@ static ssize_t ad7280_write_channel_config(struct device *dev,return ret;switch (this_attr->address) { -case AD7280A_CELL_OVERVOLTAGE : -case AD7280A_CELL_UNDERVOLTAGE : +case AD7280A_CELL_OVERVOLTAGE_REG : +case AD7280A_CELL_UNDERVOLTAGE_REG : val = ((val -1000 ) *100 ) /1568 ;/* LSB 15.68mV */ break ; -case AD7280A_AUX_ADC_OVERVOLTAGE : -case AD7280A_AUX_ADC_UNDERVOLTAGE : +case AD7280A_AUX_ADC_OVERVOLTAGE_REG : +case AD7280A_AUX_ADC_UNDERVOLTAGE_REG : val = (val *10 ) /196 ;/* LSB 19.6mV */ break ;default :
@@ -743,16 +767,16 @@ static ssize_t ad7280_write_channel_config(struct device *dev,mutex_lock (&st->lock);switch (this_attr->address) { -case AD7280A_CELL_OVERVOLTAGE : +case AD7280A_CELL_OVERVOLTAGE_REG : st->cell_threshhigh = val;break ; -case AD7280A_CELL_UNDERVOLTAGE : +case AD7280A_CELL_UNDERVOLTAGE_REG : st->cell_threshlow = val;break ; -case AD7280A_AUX_ADC_OVERVOLTAGE : +case AD7280A_AUX_ADC_OVERVOLTAGE_REG : st->aux_threshhigh = val;break ; -case AD7280A_AUX_ADC_UNDERVOLTAGE : +case AD7280A_AUX_ADC_UNDERVOLTAGE_REG : st->aux_threshlow = val;break ; }
@@ -781,7 +805,7 @@ static irqreturn_t ad7280_event_handler(int irq, void *private) goto out;for (i =0 ; i < st->scan_cnt; i++) { -if (((channels[i] >>23 ) &0xF ) <=AD7280A_CELL_VOLTAGE_6 ) { +if (((channels[i] >>23 ) &0xF ) <=AD7280A_CELL_VOLTAGE_6_REG ) {if (((channels[i] >>11 ) &0xFFF ) >= st->cell_threshhigh) { u64 tmp = IIO_EVENT_CODE(IIO_VOLTAGE, 1, 0,
@@ -801,7 +825,7 @@ static irqreturn_t ad7280_event_handler(int irq, void *private) } }else {if (((channels[i] >>11 ) &0xFFF ) >= - st->aux_threshhigh) { + st->aux_threshhigh) {u64 tmp =IIO_UNMOD_EVENT_CODE (IIO_TEMP ,0 ,IIO_EV_TYPE_THRESH ,IIO_EV_DIR_RISING );
@@ -833,26 +857,26 @@ static IIO_DEVICE_ATTR_NAMED(in_thresh_low_value,0644 , ad7280_read_channel_config, ad7280_write_channel_config, - AD7280A_CELL_UNDERVOLTAGE); + AD7280A_CELL_UNDERVOLTAGE_REG); static IIO_DEVICE_ATTR_NAMED(in_thresh_high_value, in_voltage-voltage_thresh_high_value,0644 , ad7280_read_channel_config, ad7280_write_channel_config, - AD7280A_CELL_OVERVOLTAGE); + AD7280A_CELL_OVERVOLTAGE_REG); static IIO_DEVICE_ATTR(in_temp_thresh_low_value,0644 , ad7280_read_channel_config, ad7280_write_channel_config, - AD7280A_AUX_ADC_UNDERVOLTAGE); + AD7280A_AUX_ADC_UNDERVOLTAGE_REG); static IIO_DEVICE_ATTR(in_temp_thresh_high_value,0644 , ad7280_read_channel_config, ad7280_write_channel_config, - AD7280A_AUX_ADC_OVERVOLTAGE); + AD7280A_AUX_ADC_OVERVOLTAGE_REG);static struct attribute *ad7280_event_attributes[] = { &iio_dev_attr_in_thresh_low_value.dev_attr.attr,
@@ -892,7 +916,7 @@ static int ad7280_read_raw(struct iio_dev *indio_dev,return IIO_VAL_INT ;case IIO_CHAN_INFO_SCALE : -if ((chan->address &0xFF ) <=AD7280A_CELL_VOLTAGE_6 ) +if ((chan->address &0xFF ) <=AD7280A_CELL_VOLTAGE_6_REG ) *val =4000 ;else *val =5000 ;
@@ -942,10 +966,9 @@ static int ad7280_probe(struct spi_device *spi) st->spi->mode =SPI_MODE_1 ;spi_setup (st->spi); - st->ctrl_lb =AD7280A_CTRL_LB_ACQ_TIME (pdata->acquisition_time &0x3 ); - st->ctrl_hb =AD7280A_CTRL_HB_CONV_AVG (pdata->conversion_averaging - &0x3 ) | (pdata->thermistor_term_en ? -AD7280A_CTRL_LB_THERMISTOR_EN :0 ); + st->ctrl_lb =FIELD_PREP (AD7280A_CTRL_LB_ACQ_TIME_MSK , pdata->acquisition_time) | +FIELD_PREP (AD7280A_CTRL_LB_THERMISTOR_MSK , pdata->thermistor_term_en); + st->ctrl_hb =FIELD_PREP (AD7280A_CTRL_HB_CONV_AVG_MSK , pdata->conversion_averaging); ret =ad7280_chain_setup (st);if (ret <0 )
@@ -998,13 +1021,13 @@ static int ad7280_probe(struct spi_device *spi)if (spi->irq >0 ) { ret =ad7280_write (st,AD7280A_DEVADDR_MASTER , -AD7280A_ALERT ,1 , +AD7280A_ALERT_REG ,1 ,AD7280A_ALERT_RELAY_SIG_CHAIN_DOWN );if (ret)return ret; ret =ad7280_write (st,ad7280a_devaddr (st->slave_num), -AD7280A_ALERT ,0 , +AD7280A_ALERT_REG ,0 ,AD7280A_ALERT_GEN_STATIC_HIGH | (pdata->chain_last_alert_ignore &0xF ));if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/206 iio: adc: ad7280a: handle spi_setup() errors in probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <[email protected]>
[ Upstream commit 6b39824ac4c15783787e6434449772bfb2e31214 ]
The probe() function ignored the return value of spi_setup(), leaving SPI configuration failures undetected. If spi_setup() fails, the driver should stop initialization and propagate the error to the caller.
Add proper error handling: check the return value of spi_setup() and return it on failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/staging/iio/adc/ad7280a.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/iio/adc/ad7280a.c +3 -1
@@ -964,7 +964,9 @@ static int ad7280_probe(struct spi_device *spi) st->spi->max_speed_hz =AD7280A_MAX_SPI_CLK_HZ ; st->spi->mode =SPI_MODE_1 ; -spi_setup (st->spi); + ret =spi_setup (st->spi); +if (ret <0 ) +return ret; st->ctrl_lb =FIELD_PREP (AD7280A_CTRL_LB_ACQ_TIME_MSK , pdata->acquisition_time) |FIELD_PREP (AD7280A_CTRL_LB_THERMISTOR_MSK , pdata->thermistor_term_en);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/206 regmap: Fix race condition in hwspinlock irqsave routine
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng-Yu Lee <[email protected]>
[ Upstream commit 4b58aac989c1e3fafb1c68a733811859df388250 ]
Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race condition where multiple contexts contending for the lock could overwrite the shared flags variable, potentially corrupting the state for the current lock owner.
Fix this by using a local stack variable 'flags' to store the IRQ state temporarily.
--- drivers/base/regmap/regmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/regmap/regmap.c +3 -1
@@ -473,9 +473,11 @@ static void regmap_lock_hwlock_irq(void *__map)static void regmap_lock_hwlock_irqsave (void *__map) {struct regmap *map = __map; +unsigned long flags =0 ;hwspin_lock_timeout_irqsave (map->hwlock,UINT_MAX , - &map->spinlock_flags); + &flags); + map->spinlock_flags = flags; }static void regmap_unlock_hwlock (void *__map)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/206 ALSA: usb: Increase volume range that triggers a warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Raghavan <[email protected]>
[ Upstream commit 6b971191fcfc9e3c2c0143eea22534f1f48dbb62 ]
On at least the HyperX Cloud III, the range is 18944 (-18944 -> 0 in steps of 1), so the original check for 255 steps is definitely obsolete. Let's give ourselves a little more headroom before we emit a warning.
--- sound/usb/mixer.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
sound/usb/mixer.c +3 -4
@@ -1797,11 +1797,10 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer, range = (cval->max - cval->min) / cval->res;/* -* Are there devices with volume range more than 255? I use a bit more -* to be sure. 384 is a resolution magic number found on Logitech -* devices. It will definitively catch all buggy Logitech devices. +* There are definitely devices with a range of ~20,000, so let's be +* conservative and allow for a bit more. */ -if (range >384 ) { +if (range >65535 ) {usb_audio_warn (mixer->chip,"Warning! Unlikely big volume range (=%u), cval->res is probably wrong." , range);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/206 net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit d57c67c956a1bad15115eba6e59d77a6dfeba01d ]
HCLGE_FD_AD_COUNTER_NUM_M should be at GENMASK(19, 13), rather than at GENMASK(20, 13), because bit 20 is HCLGE_FD_AD_NXT_STEP_B.
This patch corrects the wrong definition.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +1 -1
@@ -1036,7 +1036,7 @@ struct hclge_fd_tcam_config_3_cmd {#define HCLGE_FD_AD_QID_M GENMASK(11, 2)#define HCLGE_FD_AD_USE_COUNTER_B 12#define HCLGE_FD_AD_COUNTER_NUM_S 13 -#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(20, 13) +#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)#define HCLGE_FD_AD_NXT_STEP_B 20#define HCLGE_FD_AD_NXT_KEY_S 21#define HCLGE_FD_AD_NXT_KEY_M GENMASK(25, 21)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/206 net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit f87e034d16e43af984380a95c32c25201b7759a7 ]
Use next_input_key instead of counter_id to set HCLGE_FD_AD_NXT_KEY.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -1
@@ -5856,7 +5856,7 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, HCLGE_FD_AD_COUNTER_NUM_S, action->counter_id);hnae3_set_bit (ad_data,HCLGE_FD_AD_NXT_STEP_B , action->use_next_stage);hnae3_set_field (ad_data,HCLGE_FD_AD_NXT_KEY_M ,HCLGE_FD_AD_NXT_KEY_S , - action->counter_id); + action->next_input_key); req->ad_data =cpu_to_le64 (ad_data); ret =hclge_cmd_send (&hdev->hw, &desc,1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/206 mISDN: annotate data-race around dev->work
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 8175dbf174d487afab81e936a862a8d9b8a1ccb6 ]
dev->work can re read locklessly in mISDN_read() and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations.
BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read
write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:
misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline] mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583 x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:
mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112 do_loop_readv_writev fs/read_write.c:847 [inline] vfs_readv+0x3fb/0x690 fs/read_write.c:1020 do_readv+0xe7/0x210 fs/read_write.c:1080 __do_sys_readv fs/read_write.c:1165 [inline] __se_sys_readv fs/read_write.c:1162 [inline] __x64_sys_readv+0x45/0x50 fs/read_write.c:1162 x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00000000 -> 0x00000001
--- drivers/isdn/mISDN/timerdev.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/isdn/mISDN/timerdev.c +8 -5
@@ -109,14 +109,14 @@ mISDN_read(struct file *filep, char __user *buf, size_t count, loff_t *off)spin_unlock_irq (&dev->lock);if (filep->f_flags &O_NONBLOCK )return -EAGAIN ; -wait_event_interruptible (dev->wait, (dev->work || +wait_event_interruptible (dev->wait, (READ_ONCE (dev->work) || !list_empty (list)));if (signal_pending (current))return -ERESTARTSYS ;spin_lock_irq (&dev->lock); }if (dev->work) - dev->work =0 ; +WRITE_ONCE (dev->work,0 );if (!list_empty (list)) { timer = list_first_entry(list, struct mISDNtimer, list);list_del (&timer->list);
@@ -141,13 +141,16 @@ mISDN_poll(struct file *filep, poll_table *wait)if (*debug &DEBUG_TIMER )printk (KERN_DEBUG "%s(%p, %p)\n" , __func__, filep, wait);if (dev) { +u32 work; +poll_wait (filep, &dev->wait, wait); mask =0 ; -if (dev->work || !list_empty (&dev->expired)) + work =READ_ONCE (dev->work); +if (work || !list_empty (&dev->expired)) mask |= (EPOLLIN |EPOLLRDNORM );if (*debug &DEBUG_TIMER )printk (KERN_DEBUG "%s work(%d) empty(%d)\n" , __func__, - dev->work,list_empty (&dev->expired)); + work,list_empty (&dev->expired)); }return mask; }
@@ -172,7 +175,7 @@ misdn_add_timer(struct mISDNtimerdev *dev, int timeout)struct mISDNtimer *timer;if (!timeout) { - dev->work =1 ; +WRITE_ONCE (dev->work,1 );wake_up_interruptible (&dev->wait); id =0 ; }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/206 ipv6: annotate data-race in ndisc_router_discovery()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9a063f96d87efc3a6cc667f8de096a3d38d74bb5 ]
syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1]
This looks fine, IFLA_INET6_RA_MTU is best effort.
Add READ_ONCE()/WRITE_ONCE() to document the race.
Note that we might also reject illegal MTU values (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch.
[1]
BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery
read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1:
ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79
...
write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0:
ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79
...
value changed: 0x00000000 -> 0xe5400659
--- net/ipv6/ndisc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ndisc.c +2 -2
@@ -1507,8 +1507,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)memcpy (&n, ((u8 *)(ndopts.nd_opts_mtu+1 ))+2 ,sizeof (mtu)); mtu =ntohl (n); -if (in6_dev->ra_mtu != mtu) { - in6_dev->ra_mtu = mtu; +if (READ_ONCE (in6_dev->ra_mtu) != mtu) { +WRITE_ONCE (in6_dev->ra_mtu, mtu); send_ifinfo_notify = true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/206 usbnet: limit max_mtu based on devices hard_mtu
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Vivier <[email protected]>
[ Upstream commit c7159e960f1472a5493ac99aff0086ab1d683594 ]
The usbnet driver initializes net->max_mtu to ETH_MAX_MTU before calling the device's bind() callback. When the bind() callback sets dev->hard_mtu based the device's actual capability (from CDC Ethernet's wMaxSegmentSize descriptor), max_mtu is never updated to reflect this hardware limitation).
This allows userspace (DHCP or IPv6 RA) to configure MTU larger than the device can handle, leading to silent packet drops when the backend sends packet exceeding the device's buffer size.
Fix this by limiting net->max_mtu to the device's hard_mtu after the bind callback returns.
See https://gitlab.com/qemu-project/qemu/-/issues/3268 and
https://bugs.passt.top/attachment.cgi?bugid=189
--- drivers/net/usb/usbnet.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/usb/usbnet.c +6 -3
@@ -1797,9 +1797,12 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)if ((dev->driver_info->flags &FLAG_NOARP ) !=0 ) net->flags |=IFF_NOARP ; -/* maybe the remote can't receive an Ethernet MTU */ -if (net->mtu > (dev->hard_mtu - net->hard_header_len)) - net->mtu = dev->hard_mtu - net->hard_header_len; +if (net->max_mtu > (dev->hard_mtu - net->hard_header_len)) + net->max_mtu = dev->hard_mtu - net->hard_header_len; + +if (net->mtu > net->max_mtu) + net->mtu = net->max_mtu; + }else if (!info->in || !info->out) status =usbnet_get_endpoints (dev, udev);else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/206 drm/amd/pm: Dont clear SI SMC table when setting power limit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d5077426e1a76d269e518e048bde2e9fc49b32ad ]
There is no reason to clear the SMC table.
We also don't need to recalculate the power limit then.
--- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +0 -10
@@ -2242,8 +2242,6 @@ static int si_populate_smc_tdp_limits(struct amdgpu_device *adev,if (scaling_factor ==0 )return -EINVAL ; -memset (smc_table,0 ,sizeof (SISLANDS_SMC_STATETABLE )); - ret = si_calculate_adjusted_tdp_limits(adev, false, /* ??? */ adev->pm.dpm.tdp_adjustment,
@@ -2297,16 +2295,8 @@ static int si_populate_smc_tdp_limits_2(struct amdgpu_device *adev,if (ni_pi->enable_power_containment) {SISLANDS_SMC_STATETABLE *smc_table = &si_pi->smc_statetable; -u32 scaling_factor =si_get_smc_power_scaling_factor (adev);int ret; -memset (smc_table,0 ,sizeof (SISLANDS_SMC_STATETABLE )); - - smc_table->dpm2Params.NearTDPLimit = -cpu_to_be32 (si_scale_power_for_smc (adev->pm.dpm.near_tdp_limit_adjusted, scaling_factor) *1000 ); - smc_table->dpm2Params.SafePowerLimit = -cpu_to_be32 (si_scale_power_for_smc ((adev->pm.dpm.near_tdp_limit_adjusted *SISLANDS_DPM2_TDP_SAFE_LIMIT_PERCENT ) /100 , scaling_factor) *1000 ); - ret = amdgpu_si_copy_bytes_to_smc(adev, (si_pi->state_table_start + offsetof(SISLANDS_SMC_STATETABLE, dpm2Params) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/206 drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 764a90eb02268a23b1bb98be5f4a13671346804a ]
Radeon 430 and 520 are OEM GPUs from 2016~2017 They have the same device id: 0x6611 and revision: 0x87
On the Radeon 430, powertune is buggy and throttles the GPU, never allowing it to reach its maximum SCLK. Work around this bug by raising the TDP limits we program to the SMC from 24W (specified by the VBIOS on Radeon 430) to 32W.
Disabling powertune entirely is not a viable workaround,
because it causes the Radeon 520 to heat up above 100 C,
which I prefer to avoid.
Additionally, revise the maximum SCLK limit. Considering the above issue, these GPUs never reached a high SCLK on Linux, and the workarounds were added before the GPUs were released, so the workaround likely didn't target these specifically. Use 780 MHz (the maximum SCLK according to the VBIOS on the Radeon 430). Note that the Radeon 520 VBIOS has a higher maximum SCLK: 905 MHz, but in practice it doesn't seem to perform better with the higher clock, only heats up more.
v2:
Move the workaround to si_populate_smc_tdp_limits.
--- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +12 -1
@@ -2250,6 +2250,12 @@ static int si_populate_smc_tdp_limits(struct amdgpu_device *adev,if (ret)return ret; +if (adev->pdev->device ==0x6611 && adev->pdev->revision ==0x87 ) { +/* Workaround buggy powertune on Radeon 430 and 520. */ + tdp_limit =32 ; + near_tdp_limit =28 ; + } + smc_table->dpm2Params.TDPLimit =cpu_to_be32 (si_scale_power_for_smc (tdp_limit, scaling_factor) *1000 ); smc_table->dpm2Params.NearTDPLimit =
@@ -3425,10 +3431,15 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, (adev->pdev->revision ==0x80 ) || (adev->pdev->revision ==0x81 ) || (adev->pdev->revision ==0x83 ) || - (adev->pdev->revision == 0x87) || + (adev->pdev->revision ==0x87 && + adev->pdev->device !=0x6611 ) || (adev->pdev->device ==0x6604 ) || (adev->pdev->device == 0x6605)) { max_sclk = 75000; + }else if (adev->pdev->revision ==0x87 && + adev->pdev->device ==0x6611 ) { +/* Radeon 430 and 520 */ + max_sclk =78000 ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/206 be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <[email protected]>
[ Upstream commit 8215794403d264739cc676668087512950b2ff31 ]
When the parameter pmac_id_valid argument of be_cmd_get_mac_from_list() is set to false, the driver may request the PMAC_ID from the firmware of the network card, and this function will store that PMAC_ID at the provided address pmac_id. This is the contract of this function.
However, there is a location within the driver where both pmac_id_valid == false and pmac_id == NULL are being passed. This could result in dereferencing a NULL pointer.
To resolve this issue, it is necessary to pass the address of a stub variable to the function.
--- drivers/net/ethernet/emulex/benet/be_cmds.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/emulex/benet/be_cmds.c +2 -1
@@ -3796,6 +3796,7 @@ int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac) {int status;bool pmac_valid = false; +u32 pmac_id;eth_zero_addr (mac);
@@ -3808,7 +3809,7 @@ int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac) adapter->if_handle, 0); }else { status =be_cmd_get_mac_from_list (adapter, mac, &pmac_valid, -NULL , adapter->if_handle,0 ); + &pmac_id, adapter->if_handle,0 ); }return status;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/206 bonding: provide a net pointer to __skb_flow_dissect()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5f9b329096596b7e53e07d041d7fca4cbe1be752 ]
After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), either via skb->dev, skb->sk, or a user provided pointer.
In the following case, syzbot was able to cook a bare skb.
WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053 Call Trace: <TASK> bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline] __bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157 bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline] bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline] bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515 xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388 bpf_prog_run_xdp include/net/xdp.h:700 [inline] bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421 bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390 bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703 __sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
--- drivers/net/bonding/bond_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/bonding/bond_main.c +3 -2
@@ -3811,8 +3811,9 @@ static bool bond_flow_dissect(struct bonding *bond, struct sk_buff *skb, const vcase BOND_XMIT_POLICY_ENCAP23 :case BOND_XMIT_POLICY_ENCAP34 :memset (fk,0 ,sizeof (*fk)); -return __skb_flow_dissect (NULL , skb, &flow_keys_bonding, - fk, data, l2_proto, nhoff, hlen,0 ); +return __skb_flow_dissect (dev_net (bond->dev), skb, + &flow_keys_bonding, fk, data, + l2_proto, nhoff, hlen,0 );default :break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/206 octeontx2-af: Fix error handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <[email protected]>
[ Upstream commit 19e4175e997a5b85eab97d522f00cc99abd1873c ]
This commit adds error handling and rollback logic to rvu_mbox_handler_attach_resources() to properly clean up partially attached resources when rvu_attach_block() fails.
--- .../net/ethernet/marvell/octeontx2/af/rvu.c | 86 ++++++++++++++----- 1 file changed, 64 insertions(+), 22 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +64 -22
@@ -1455,8 +1455,8 @@ static int rvu_get_attach_blkaddr(struct rvu *rvu, int blktype,return -ENODEV ; } -static void rvu_attach_block (struct rvu *rvu,int pcifunc,int blktype, -int num_lfs,struct rsrc_attach *attach) +static int rvu_attach_block (struct rvu *rvu,int pcifunc,int blktype, +int num_lfs,struct rsrc_attach *attach) {struct rvu_pfvf *pfvf =rvu_get_pfvf (rvu, pcifunc);struct rvu_hwinfo *hw = rvu->hw;
@@ -1466,21 +1466,21 @@ static void rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,u64 cfg;if (!num_lfs) -return ; +return -EINVAL ; blkaddr =rvu_get_attach_blkaddr (rvu, blktype, pcifunc, attach);if (blkaddr <0 ) -return ; +return -EFAULT ; block = &hw->block[blkaddr];if (!block->lf.bmap) -return ; +return -ESRCH ;for (slot =0 ; slot < num_lfs; slot++) {/* Allocate the resource */ lf =rvu_alloc_rsrc (&block->lf);if (lf <0 ) -return ; +return -EFAULT ; cfg = (1ULL <<63 ) | (pcifunc <<8 ) | slot; rvu_write64(rvu, blkaddr, block->lfcfg_reg |
@@ -1491,6 +1491,8 @@ static void rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,/* Set start MSIX vector for this LF within this PF/VF */ rvu_set_msix_offset (rvu, pfvf, block, lf); } + +return 0 ; } static int rvu_check_rsrc_availability(struct rvu *rvu,
@@ -1628,22 +1630,31 @@ int rvu_mbox_handler_attach_resources(struct rvu *rvu,int err;/* If first request, detach all existing attached resources */ -if (!attach->modify) -rvu_detach_rsrcs (rvu,NULL , pcifunc); +if (!attach->modify) { + err =rvu_detach_rsrcs (rvu,NULL , pcifunc); +if (err) +return err; + }mutex_lock (&rvu->rsrc_lock);/* Check if the request can be accommodated */ err =rvu_check_rsrc_availability (rvu, attach, pcifunc);if (err) - goto exit; + goto fail1;/* Now attach the requested resources */ -if (attach->npalf) -rvu_attach_block (rvu, pcifunc,BLKTYPE_NPA ,1 , attach); +if (attach->npalf) { + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_NPA ,1 , attach); +if (err) + goto fail1; + } -if (attach->nixlf) -rvu_attach_block (rvu, pcifunc,BLKTYPE_NIX ,1 , attach); +if (attach->nixlf) { + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_NIX ,1 , attach); +if (err) + goto fail2; + }if (attach->sso) {/* RVU func doesn't know which exact LF or slot is attached
@@ -1653,33 +1664,64 @@ int rvu_mbox_handler_attach_resources(struct rvu *rvu,*/ if (attach->modify)rvu_detach_block (rvu, pcifunc,BLKTYPE_SSO ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_SSO , - attach->sso, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_SSO , + attach->sso, attach); +if (err) + goto fail3; }if (attach->ssow) {if (attach->modify)rvu_detach_block (rvu, pcifunc,BLKTYPE_SSOW ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_SSOW , - attach->ssow, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_SSOW , + attach->ssow, attach); +if (err) + goto fail4; }if (attach->timlfs) {if (attach->modify)rvu_detach_block (rvu, pcifunc,BLKTYPE_TIM ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_TIM , - attach->timlfs, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_TIM , + attach->timlfs, attach); +if (err) + goto fail5; }if (attach->cptlfs) {if (attach->modify &&rvu_attach_from_same_block (rvu,BLKTYPE_CPT , attach))rvu_detach_block (rvu, pcifunc,BLKTYPE_CPT ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_CPT , - attach->cptlfs, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_CPT , + attach->cptlfs, attach); +if (err) + goto fail6; } -exit: +mutex_unlock (&rvu->rsrc_lock); +return 0 ; + +fail6: +if (attach->timlfs) +rvu_detach_block (rvu, pcifunc,BLKTYPE_TIM ); + +fail5: +if (attach->ssow) +rvu_detach_block (rvu, pcifunc,BLKTYPE_SSOW ); + +fail4: +if (attach->sso) +rvu_detach_block (rvu, pcifunc,BLKTYPE_SSO ); + +fail3: +if (attach->nixlf) +rvu_detach_block (rvu, pcifunc,BLKTYPE_NIX ); + +fail2: +if (attach->npalf) +rvu_detach_block (rvu, pcifunc,BLKTYPE_NPA ); + +fail1:mutex_unlock (&rvu->rsrc_lock);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/206 net/sched: act_ife: avoid possible NULL deref
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 27880b0b0d35ad1c98863d09788254e36f874968 ]
tcf_ife_encode() must make sure ife_encode() does not return NULL.
syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166 CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full) Call Trace: <TASK> ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101 tcf_ife_encode net/sched/act_ife.c:841 [inline] tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877 tc_act include/net/tc_wrapper.h:130 [inline] tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152 tcf_exts_exec include/net/pkt_cls.h:349 [inline] mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1764 [inline] tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860 multiq_classify net/sched/sch_multiq.c:39 [inline] multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66 dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147 __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798
--- net/sched/act_ife.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/sched/act_ife.c +4 -2
@@ -820,6 +820,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,/* could be stupid policy setup or mtu config * so lets be conservative.. */ if ((action ==TC_ACT_SHOT ) || exceed_mtu) { +drop:qstats_drop_inc (this_cpu_ptr (ife->common.cpu_qstats));return TC_ACT_SHOT ; }
@@ -828,6 +829,8 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,skb_push (skb, skb->dev->hard_header_len); ife_meta =ife_encode (skb, metalen); +if (!ife_meta) + goto drop;spin_lock (&ife->tcf_lock);
@@ -843,8 +846,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,if (err <0 ) {/* too corrupt to keep around if overwritten */ spin_unlock (&ife->tcf_lock); -qstats_drop_inc (this_cpu_ptr (ife->common.cpu_qstats)); -return TC_ACT_SHOT ; + goto drop; } skboff += err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/206 x86: make page fault handling disable interrupts properly
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cedric Xing <[email protected]>
[ Upstream commit 614da1d3d4cdbd6e41aea06bc97ec15aacff6daf ]
There's a big comment in the x86 do_page_fault() about our interrupt disabling code:
* User address page fault handling might have reenabled
* interrupts. Fixing up all potential exit points of
* do_user_addr_fault() and its leaf functions is just not
* doable w/o creating an unholy mess or turning the code
* upside down.
but it turns out that comment is subtly wrong, and the code as a result is also wrong.
Because it's certainly true that we may have re-enabled interrupts when handling user page faults. And it's most certainly true that we don't want to bother fixing up all the cases.
But what isn't true is that it's limited to user address page faults.
The confusion stems from the fact that we have logic here that depends on the address range of the access, but other code then depends on the _context_ the access was done in. The two are not related, even though both of them are about user-vs-kernel.
In other words, both user and kernel addresses can cause interrupts to have been enabled (eg when __bad_area_nosemaphore() gets called for user accesses to kernel addresses). As a result we should make sure to disable interrupts again regardless of the address range before returning to the low-level fault handling code.
The __bad_area_nosemaphore() code actually did disable interrupts again after enabling them, just not consistently. Ironically, as noted in the original comment, fixing up all the cases is just not worth it, when the simple solution is to just do it unconditionally in one single place.
So remove the incomplete case that unsuccessfully tried to do what the comment said was "not doable" in commit ca4c6a9858c2 ("x86/traps: Make interrupt enable/disable symmetric in C code"), and just make it do the simple and straightforward thing.
--- arch/x86/mm/fault.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
arch/x86/mm/fault.c +5 -10
@@ -804,8 +804,6 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,force_sig_pkuerr ((void __user *)address, pkey); else force_sig_fault(SIGSEGV, si_code, (void __user *)address); - -local_irq_disable (); }static noinline void
@@ -1443,15 +1441,12 @@ handle_page_fault(struct pt_regs *regs, unsigned long error_code,do_kern_addr_fault (regs, error_code, address); }else {do_user_addr_fault (regs, error_code, address); -/* -* User address page fault handling might have reenabled -* interrupts. Fixing up all potential exit points of -* do_user_addr_fault() and its leaf functions is just not -* doable w/o creating an unholy mess or turning the code -* upside down. -*/ -local_irq_disable (); } +/* +* page fault handling might have reenabled interrupts, +* make sure to disable them again. +*/ +local_irq_disable (); }DEFINE_IDTENTRY_RAW_ERRORCODE (exc_page_fault)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/206 leds: led-class: Only Add LED to leds_list when it is fully ready
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit d1883cefd31752f0504b94c3bcfa1f6d511d6e87 upstream.
Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized.
This leaves a window where led_trigger_register() of a LED's default trigger will call led_trigger_set() which calls led_set_brightness() which in turn will end up queueing the *uninitialized* led_classdev.set_brightness_work.
This race gets hit by the lenovo-thinkpad-t14s EC driver which registers 2 LEDs with a default trigger provided by snd_ctl_led.ko in quick succession. The first led_classdev_register() causes an async modprobe of snd_ctl_led to run and that async modprobe manages to exactly hit the window where the second LED is on the leds_list without led_init_core() being called for it, resulting in:
------------[ cut here ]------------ WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390 Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025 ... Call trace: __flush_work+0x344/0x390 (P) flush_work+0x2c/0x50 led_trigger_set+0x1c8/0x340 led_trigger_register+0x17c/0x1c0 led_trigger_register_simple+0x84/0xe8 snd_ctl_led_init+0x40/0xf88 [snd_ctl_led] do_one_initcall+0x5c/0x318 do_init_module+0x9c/0x2b8 load_module+0x7e0/0x998
Close the race window by moving the adding of the LED to leds_list to after the led_init_core() call.
--- drivers/leds/led-class.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/leds/led-class.c +5 -5
@@ -412,11 +412,6 @@ int led_classdev_register_ext(struct dev#ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED led_cdev->brightness_hw_changed =-1 ;#endif -/* add to the list of leds */ -down_write (&leds_list_lock); -list_add_tail (&led_cdev->node, &leds_list); -up_write (&leds_list_lock); -if (!led_cdev->max_brightness) led_cdev->max_brightness =LED_FULL ;
@@ -424,6 +419,11 @@ int led_classdev_register_ext(struct devled_init_core (led_cdev); +/* add to the list of leds */ +down_write (&leds_list_lock); +list_add_tail (&led_cdev->node, &leds_list); +up_write (&leds_list_lock); +#ifdef CONFIG_LEDS_TRIGGERS led_trigger_set_default (led_cdev);#endif
Greg Kroah-Hartman
maintainerPATCH 107/206 of: fix reference count leak in of_alias_scan()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <[email protected]>
commit 81122fba08fa3ccafab6ed272a5c6f2203923a7e upstream.
of_find_node_by_path() returns a device_node with its refcount incremented. When kstrtoint() fails or dt_alloc() fails, the function continues to the next iteration without calling of_node_put(), causing a reference count leak.
Add of_node_put(np) before continue on both error paths to properly release the device_node reference.
--- drivers/of/base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/of/base.c +6 -2
@@ -2018,13 +2018,17 @@ void of_alias_scan(void * (*dt_alloc)(u6 end--; len = end - start; -if (kstrtoint (end,10 , &id) <0 ) +if (kstrtoint (end,10 , &id) <0 ) { +of_node_put (np);continue ; + }/* Allocate an alias_prop with enough space for the stem */ ap = dt_alloc(sizeof(*ap) + len + 1, __alignof__(*ap)); -if (!ap) +if (!ap) { +of_node_put (np);continue ; + }memset (ap,0 ,sizeof (*ap) + len +1 ); ap->alias = start;of_alias_add (ap, np, id, start, len);
Greg Kroah-Hartman
maintainerPATCH 108/206 iio: adc: ad9467: fix ad9434 vref mask
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Melin <[email protected]>
commit 92452b1760ff2d1d411414965d4d06f75e1bda9a upstream.
The mask setting is 5 bits wide for the ad9434
(ref. data sheet register 0x18 FLEX_VREF). Apparently the settings from ad9265 were copied by mistake when support for the device was added to the driver.
--- drivers/iio/adc/ad9467.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad9467.c +1 -1
@@ -90,7 +90,7 @@#define CHIPID_AD9434 0x6A#define AD9434_DEF_OUTPUT_MODE 0x00 -#define AD9434_REG_VREF_MASK 0xC0 +#define AD9434_REG_VREF_MASK GENMASK(4, 0)/* * Analog Devices AD9467 16-Bit, 200/250 MSPS ADC
Greg Kroah-Hartman
maintainerPATCH 109/206 iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
commit dbdb442218cd9d613adeab31a88ac973f22c4873 upstream.
at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq).
If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| at91_adc_workq_handler
at91_adc_remove |
iio_device_unregister(indio_dev) |
//free indio_dev a bit later |
| iio_push_to_buffers(indio_dev)
| //use indio_devFix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove.
--- drivers/iio/adc/at91-sama5d2_adc.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/adc/at91-sama5d2_adc.c +1 -0
@@ -1887,6 +1887,7 @@ static int at91_adc_remove(struct platfostruct at91_adc_state *st =iio_priv (indio_dev);iio_device_unregister (indio_dev); +cancel_work_sync (&st->touch_st.workq);at91_adc_dma_disable (pdev);
Greg Kroah-Hartman
maintainerPATCH 110/206 iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kübrich, Andreas <[email protected]>
commit 441ac29923c9172bc5e4b2c4f52ae756192f5715 upstream.
The chip info for this variant (I2C, four channels, 14 bit, internal reference) seems to have been left out due to oversight, so ad5686_chip_info_tbl[ID_AD5695R] is all zeroes. Initialisation of an AD5695R still succeeds, but the resulting IIO device has no channels and no /dev/iio:device* node.
Add the missing chip info to the table.
--- drivers/iio/dac/ad5686.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/iio/dac/ad5686.c +6 -0
@@ -427,6 +427,12 @@ static const struct ad5686_chip_info ad5 .num_channels = 4, .regmap_type = AD5686_REGMAP, }, + [ID_AD5695R] = { + .channels = ad5685r_channels, + .int_vref_mv = 2500, + .num_channels = 4, + .regmap_type = AD5686_REGMAP, + }, [ID_AD5696] = { .channels = ad5686_channels, .num_channels = 4,
Greg Kroah-Hartman
maintainerPATCH 111/206 ALSA: ctxfi: Fix potential OOB access in audio mixer handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 61006c540cbdedea83b05577dc7fb7fa18fe1276 upstream.
In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()).
As spotted recently by fuzzers, the current code causes OOB access at
those functions.
| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]'
After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field.
This patch addresses those OOB accesses by adding the proper initializations of the loop indices.
--- sound/pci/ctxfi/ctamixer.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/ctxfi/ctamixer.c +2 -0
@@ -205,6 +205,7 @@ static int amixer_rsc_init(struct amixer/* Set amixer specific operations */ amixer->rsc.ops = &amixer_basic_rsc_ops; + amixer->rsc.conj =0 ; amixer->ops = &amixer_ops; amixer->input =NULL ; amixer->sum =NULL ;
@@ -369,6 +370,7 @@ static int sum_rsc_init(struct sum *sum,return err; sum->rsc.ops = &sum_basic_rsc_ops; + sum->rsc.conj =0 ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 112/206 ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Berk Cem Goksel <[email protected]>
commit 930e69757b74c3ae083b0c3c7419bfe7f0edc7b2 upstream.
When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed memory. Later when snd_card_register() runs, the OSS mixer layer calls their callbacks and hits a use-after-free read.
Call trace: get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411 get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241 mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381 snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887 ... snd_card_register+0x4ed/0x6d0 sound/core/init.c:923 usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025
Fix by calling snd_ctl_remove() for all mixer controls before freeing id_elems. We save the next pointer first because snd_ctl_remove() frees the current element.
--- sound/usb/mixer.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
sound/usb/mixer.c +14 -1
@@ -2930,10 +2930,23 @@ static int parse_audio_unit(struct mixerstatic void snd_usb_mixer_free (struct usb_mixer_interface *mixer) { +struct usb_mixer_elem_list *list, *next; +int id; +/* kill pending URBs */ snd_usb_mixer_disconnect (mixer); -kfree (mixer->id_elems); +/* Unregister controls first, snd_ctl_remove() frees the element */ +if (mixer->id_elems) { +for (id =0 ; id <MAX_ID_ELEMS ; id++) { +for (list = mixer->id_elems[id]; list; list = next) { + next = list->next_id_elem; +if (list->kctl) +snd_ctl_remove (mixer->chip->card, list->kctl); + } + } +kfree (mixer->id_elems); + }if (mixer->urb) {kfree (mixer->urb->transfer_buffer);usb_free_urb (mixer->urb);
Greg Kroah-Hartman
maintainerPATCH 113/206 mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <[email protected]>
commit 122610220134b32c742cc056eaf64f7017ac8cd9 upstream.
rtsx_pci_sdmmc does not have an sdmmc_card_busy function, so any voltage switches cause a kernel warning, "mmc0: cannot verify signal voltage switch."
Copy the sdmmc_card_busy function from rtsx_pci_usb to rtsx_pci_sdmmc to fix this.
--- drivers/mmc/host/rtsx_pci_sdmmc.c | 41 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+)
drivers/mmc/host/rtsx_pci_sdmmc.c +41 -0
@@ -1307,6 +1307,46 @@ out:return err; } +static int sdmmc_card_busy (struct mmc_host *mmc) +{ +struct realtek_pci_sdmmc *host =mmc_priv (mmc); +struct rtsx_pcr *pcr = host->pcr; +int err; +u8 stat; +u8 mask =SD_DAT3_STATUS |SD_DAT2_STATUS |SD_DAT1_STATUS + |SD_DAT0_STATUS ; + +mutex_lock (&pcr->pcr_mutex); + +rtsx_pci_start_run (pcr); + + err =rtsx_pci_write_register (pcr,SD_BUS_STAT , +SD_CLK_TOGGLE_EN |SD_CLK_FORCE_STOP , +SD_CLK_TOGGLE_EN ); +if (err) + goto out; + +mdelay (1 ); + + err =rtsx_pci_read_register (pcr,SD_BUS_STAT , &stat); +if (err) + goto out; + + err =rtsx_pci_write_register (pcr,SD_BUS_STAT , +SD_CLK_TOGGLE_EN |SD_CLK_FORCE_STOP ,0 ); +out: +mutex_unlock (&pcr->pcr_mutex); + +if (err) +return err; + +/* check if any pin between dat[0:3] is low */ +if ((stat & mask) != mask) +return 1 ; +else +return 0 ; +} +static int sdmmc_execute_tuning (struct mmc_host *mmc,u32 opcode) {struct realtek_pci_sdmmc *host =mmc_priv (mmc);
@@ -1405,6 +1445,7 @@ static const struct mmc_host_ops realtek .get_ro = sdmmc_get_ro, .get_cd = sdmmc_get_cd, .start_signal_voltage_switch = sdmmc_switch_voltage, + .card_busy = sdmmc_card_busy, .execute_tuning = sdmmc_execute_tuning, .init_sd_express = sdmmc_init_sd_express, };
Greg Kroah-Hartman
maintainerPATCH 114/206 wifi: ath10k: fix dma_free_coherent() pointer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 9282a1e171ad8d2205067e8ec3bbe4e3cef4f29f upstream.
dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses.
--- drivers/net/wireless/ath/ath10k/ce.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/wireless/ath/ath10k/ce.c +8 -8
@@ -1791,8 +1791,8 @@ static void _ath10k_ce_free_pipe(struct (ce_state->src_ring->nentries *sizeof (struct ce_desc ) +CE_DESC_RING_ALIGN ), - ce_state->src_ring->base_addr_owner_space, - ce_state->src_ring->base_addr_ce_space); + ce_state->src_ring->base_addr_owner_space_unaligned, + ce_state->src_ring->base_addr_ce_space_unaligned);kfree (ce_state->src_ring); }
@@ -1801,8 +1801,8 @@ static void _ath10k_ce_free_pipe(struct (ce_state->dest_ring->nentries *sizeof (struct ce_desc ) +CE_DESC_RING_ALIGN ), - ce_state->dest_ring->base_addr_owner_space, - ce_state->dest_ring->base_addr_ce_space); + ce_state->dest_ring->base_addr_owner_space_unaligned, + ce_state->dest_ring->base_addr_ce_space_unaligned);kfree (ce_state->dest_ring); }
@@ -1822,8 +1822,8 @@ static void _ath10k_ce_free_pipe_64(stru (ce_state->src_ring->nentries *sizeof (struct ce_desc_64 ) +CE_DESC_RING_ALIGN ), - ce_state->src_ring->base_addr_owner_space, - ce_state->src_ring->base_addr_ce_space); + ce_state->src_ring->base_addr_owner_space_unaligned, + ce_state->src_ring->base_addr_ce_space_unaligned);kfree (ce_state->src_ring); }
@@ -1832,8 +1832,8 @@ static void _ath10k_ce_free_pipe_64(stru (ce_state->dest_ring->nentries *sizeof (struct ce_desc_64 ) +CE_DESC_RING_ALIGN ), - ce_state->dest_ring->base_addr_owner_space, - ce_state->dest_ring->base_addr_ce_space); + ce_state->dest_ring->base_addr_owner_space_unaligned, + ce_state->dest_ring->base_addr_ce_space_unaligned);kfree (ce_state->dest_ring); }
Greg Kroah-Hartman
maintainerPATCH 115/206 wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 2120f3a3738a65730c81bf10447b1ff776078915 upstream.
The "i" iterator variable is used to count two different things but unfortunately we can't store two different numbers in the same variable. Use "i" for the outside loop and "j" for the inside loop.
--- drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +3 -3
@@ -839,7 +839,7 @@ void mwifiex_update_rxreor_flags(structstatic void mwifiex_update_ampdu_rxwinsize (struct mwifiex_adapter *adapter,bool coex_flag) { -u8 i; +u8 i, j;u32 rx_win_size;struct mwifiex_private *priv;
@@ -879,8 +879,8 @@ static void mwifiex_update_ampdu_rxwinsiif (rx_win_size != priv->add_ba_param.rx_win_size) {if (!priv->media_connected)continue ; -for (i =0 ; i <MAX_NUM_TID ; i++) -mwifiex_11n_delba (priv, i); +for (j =0 ; j <MAX_NUM_TID ; j++) +mwifiex_11n_delba (priv, j); } } }
Greg Kroah-Hartman
maintainerPATCH 116/206 wifi: rsi: Fix memory corruption due to not set vif driver data size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 4f431d88ea8093afc7ba55edf4652978c5a68f33 upstream.
The struct ieee80211_vif contains trailing space for vif driver data, when struct ieee80211_vif is allocated, the total memory size that is allocated is sizeof(struct ieee80211_vif) + size of vif driver data. The size of vif driver data is set by each WiFi driver as needed.
The RSI911x driver does not set vif driver data size, no trailing space for vif driver data is therefore allocated past struct ieee80211_vif . The RSI911x driver does however use the vif driver data to store its vif driver data structure "struct vif_priv". An access to vif->drv_priv leads to access out of struct ieee80211_vif bounds and corruption of some memory.
In case of the failure observed locally, rsi_mac80211_add_interface() would write struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv; vif_info->vap_id = vap_idx. This write corrupts struct fq_tin member struct list_head new_flows . The flow = list_first_entry(head, struct fq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus address, which when accessed causes a crash.
The trigger is very simple, boot the machine with init=/bin/sh , mount devtmpfs, sysfs, procfs, and then do "ip link set wlan0 up", "sleep 1", "ip link set wlan0 down" and the crash occurs.
Fix this by setting the correct size of vif driver data, which is the size of "struct vif_priv", so that memory is allocated and the driver can store its driver data in it, instead of corrupting memory around it.
--- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rsi/rsi_91x_mac80211.c +1 -0
@@ -2022,6 +2022,7 @@ int rsi_mac80211_attach(struct rsi_commo hw->queues =MAX_HW_QUEUES ; hw->extra_tx_headroom =RSI_NEEDED_HEADROOM ; + hw->vif_data_size =sizeof (struct vif_priv ); hw->max_rates =1 ; hw->max_rate_tries =MAX_RETRIES ;
Greg Kroah-Hartman
maintainerPATCH 117/206 arm64: Set __nocfi on swsusp_arch_resume()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Huang <[email protected]>
commit e2f8216ca2d8e61a23cb6ec355616339667e0ba6 upstream.
A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*() and does not have a CFI hash, but swsusp_arch_resume() will attempt to verify the CFI hash when calling a copy of swsusp_arch_suspend_exit().
Given that there's an existing requirement that the entrypoint to swsusp_arch_suspend_exit() is the first byte of the .hibernate_exit.text section, we cannot fix this by marking swsusp_arch_suspend_exit() with SYM_FUNC_*(). The simplest fix for now is to disable the CFI check in swsusp_arch_resume().
Mark swsusp_arch_resume() as __nocfi to disable the CFI check.
[1]
[ 22.991934][ T1] Unable to handle kernel paging request at virtual address 0000000109170ffc [ 22.991934][ T1] Mem abort info: [ 22.991934][ T1] ESR = 0x0000000096000007 [ 22.991934][ T1] EC = 0x25: DABT (current EL), IL = 32 bits [ 22.991934][ T1] SET = 0, FnV = 0 [ 22.991934][ T1] EA = 0, S1PTW = 0 [ 22.991934][ T1] FSC = 0x07: level 3 translation fault [ 22.991934][ T1] Data abort info: [ 22.991934][ T1] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 22.991934][ T1] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 22.991934][ T1] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 22.991934][ T1] [0000000109170ffc] user address but active_mm is swapper [ 22.991934][ T1] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP [ 22.991934][ T1] Dumping ftrace buffer: [ 22.991934][ T1] (ftrace buffer empty) [ 22.991934][ T1] Modules linked in: [ 22.991934][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.98-android15-8-g0b1d2aee7fc3-dirty-4k #1 688c7060a825a3ac418fe53881730b355915a419 [ 22.991934][ T1] Hardware name: Unisoc UMS9360-base Board (DT) [ 22.991934][ T1] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 22.991934][ T1] pc : swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] lr : swsusp_arch_resume+0x294/0x344 [ 22.991934][ T1] sp : ffffffc08006b960 [ 22.991934][ T1] x29: ffffffc08006b9c0 x28: 0000000000000000 x27: 0000000000000000 [ 22.991934][ T1] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000820 [ 22.991934][ T1] x23: ffffffd0817e3000 x22: ffffffd0817e3000 x21: 0000000000000000 [ 22.991934][ T1] x20: ffffff8089171000 x19: ffffffd08252c8c8 x18: ffffffc080061058 [ 22.991934][ T1] x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 0000000000000004 [ 22.991934][ T1] x14: ffffff8178c88000 x13: 0000000000000006 x12: 0000000000000000 [ 22.991934][ T1] x11: 0000000000000015 x10: 0000000000000001 x9 : ffffffd082533000 [ 22.991934][ T1] x8 : 0000000109171000 x7 : 205b5d3433393139 x6 : 392e32322020205b [ 22.991934][ T1] x5 : 000000010916f000 x4 : 000000008164b000 x3 : ffffff808a4e0530 [ 22.991934][ T1] x2 : ffffffd08058e784 x1 : 0000000082326000 x0 : 000000010a283000 [ 22.991934][ T1] Call trace: [ 22.991934][ T1] swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] hibernation_restore+0x158/0x18c [ 22.991934][ T1] load_image_and_restore+0xb0/0xec [ 22.991934][ T1] software_resume+0xf4/0x19c [ 22.991934][ T1] software_resume_initcall+0x34/0x78 [ 22.991934][ T1] do_one_initcall+0xe8/0x370 [ 22.991934][ T1] do_initcall_level+0xc8/0x19c [ 22.991934][ T1] do_initcalls+0x70/0xc0 [ 22.991934][ T1] do_basic_setup+0x1c/0x28 [ 22.991934][ T1] kernel_init_freeable+0xe0/0x148 [ 22.991934][ T1] kernel_init+0x20/0x1a8 [ 22.991934][ T1] ret_from_fork+0x10/0x20 [ 22.991934][ T1] Code: a9400a61 f94013e0 f9438923 f9400a64 (b85fc110)
--- arch/arm64/kernel/hibernate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/hibernate.c +1 -1
@@ -428,7 +428,7 @@ int swsusp_arch_suspend(void)* Memory allocated by get_safe_page() will be dealt with by the hibernate code, * we don't need to free it here. */ -int swsusp_arch_resume (void ) +int __nocfi swsusp_arch_resume(void) {int rc;void *zero_page;
Greg Kroah-Hartman
maintainerPATCH 118/206 octeontx2: Fix otx2_dma_map_page() error return code
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit d998b0e5afffa90d0f03770bad31083767079858 upstream.
0 is a valid DMA address [1] so using it as the error value can lead to errors. The error value of dma_map_XXX() functions is DMA_MAPPING_ERROR which is ~0. The callers of otx2_dma_map_page() use dma_mapping_error() to test the return value of otx2_dma_map_page(). This means that they would not detect an error in otx2_dma_map_page().
Make otx2_dma_map_page() return the raw value of dma_map_page_attrs().
[1] https://lore.kernel.org/all/[email protected]
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +1 -6
@@ -737,13 +737,8 @@ static inline dma_addr_t otx2_dma_map_pa size_t offset, size_t size, enum dma_data_direction dir) { - dma_addr_t iova; - - iova =dma_map_page_attrs (pfvf->dev, page, + return dma_map_page_attrs(pfvf->dev, page,offset ,size ,dir ,DMA_ATTR_SKIP_CPU_SYNC ); -if (unlikely (dma_mapping_error (pfvf->dev, iova))) -return (dma_addr_t )NULL ; -return iova; } static inline void otx2_dma_unmap_page(struct otx2_nic *pfvf,
Greg Kroah-Hartman
maintainerPATCH 119/206 slimbus: core: fix runtime PM imbalance on report present
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 0eb4ff6596114aabba1070a66afa2c2f5593739f upstream.
Make sure to balance the runtime PM usage count in case slimbus device or address allocation fails on report present, which would otherwise prevent the controller from suspending.
--- drivers/slimbus/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/slimbus/core.c +9 -7
@@ -496,21 +496,23 @@ int slim_device_report_present(struct slif (ctrl->sched.clk_state !=SLIM_CLK_ACTIVE ) {dev_err (ctrl->dev,"slim ctrl not active,state:%d, ret:%d\n" , ctrl->sched.clk_state, ret); - goto slimbus_not_active; + goto out_put_rpm; } sbdev =slim_get_device (ctrl, e_addr); -if (IS_ERR (sbdev)) -return -ENODEV ; +if (IS_ERR (sbdev)) { + ret = -ENODEV ; + goto out_put_rpm; + }if (sbdev->is_laddr_valid) { *laddr = sbdev->laddr; -return 0 ; + ret =0 ; + }else { + ret =slim_device_alloc_laddr (sbdev, true); } - ret =slim_device_alloc_laddr (sbdev, true); - -slimbus_not_active: +out_put_rpm:pm_runtime_mark_last_busy (ctrl->dev);pm_runtime_put_autosuspend (ctrl->dev);return ret;
Greg Kroah-Hartman
maintainerPATCH 120/206 slimbus: core: fix device reference leak on report present
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 9391380eb91ea5ac792aae9273535c8da5b9aa01 upstream.
Slimbus devices can be allocated dynamically upon reception of report-present messages.
Make sure to drop the reference taken when looking up already registered devices.
Note that this requires taking an extra reference in case the device has not yet been registered and has to be allocated.
--- drivers/slimbus/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/slimbus/core.c +3 -0
@@ -378,6 +378,8 @@ struct slim_device *slim_get_device(stru sbdev =slim_alloc_device (ctrl, e_addr,NULL );if (!sbdev)return ERR_PTR (-ENOMEM ); + +get_device (&sbdev->dev); }return sbdev;
@@ -512,6 +514,7 @@ int slim_device_report_present(struct sl ret =slim_device_alloc_laddr (sbdev, true); } +put_device (&sbdev->dev); out_put_rpm:pm_runtime_mark_last_busy (ctrl->dev);pm_runtime_put_autosuspend (ctrl->dev);
Greg Kroah-Hartman
maintainerPATCH 121/206 intel_th: fix device leak on output open()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 upstream.
Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close().
Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open().
--- drivers/hwtracing/intel_th/core.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/hwtracing/intel_th/core.c +16 -3
@@ -810,9 +810,12 @@ static int intel_th_output_open(struct iint err; dev =bus_find_device_by_devt (&intel_th_bus, inode->i_rdev); -if (!dev || !dev->driver) { +if (!dev) +return -ENODEV ; + +if (!dev->driver) { err = -ENODEV ; - goto out_no_device; + goto out_put_device; } thdrv =to_intel_th_driver (dev->driver);
@@ -836,12 +839,22 @@ static int intel_th_output_open(struct i out_put_device:put_device (dev); -out_no_device: +return err; } +static int intel_th_output_release (struct inode *inode,struct file *file) +{ +struct intel_th_device *thdev = file->private_data; + +put_device (&thdev->dev); + +return 0 ; +} +static const struct file_operations intel_th_output_fops = { .open = intel_th_output_open, + .release = intel_th_output_release, .llseek = noop_llseek, };
Greg Kroah-Hartman
maintainerPATCH 122/206 uacce: fix cdev handling in the cleanup path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
commit a3bece3678f6c88db1f44c602b2a63e84b4040ac upstream.
When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove.
--- drivers/misc/uacce/uacce.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/misc/uacce/uacce.c +7 -1
@@ -500,6 +500,8 @@ EXPORT_SYMBOL_GPL(uacce_alloc);*/ int uacce_register (struct uacce_device *uacce) { +int ret; +if (!uacce)return -ENODEV ;
@@ -510,7 +512,11 @@ int uacce_register(struct uacce_device * uacce->cdev->ops = &uacce_fops; uacce->cdev->owner =THIS_MODULE ; -return cdev_device_add (uacce->cdev, &uacce->dev); + ret =cdev_device_add (uacce->cdev, &uacce->dev); +if (ret) + uacce->cdev =NULL ; + +return ret; }EXPORT_SYMBOL_GPL (uacce_register);
Greg Kroah-Hartman
maintainerPATCH 123/206 uacce: implement mremap in uacce_vm_ops to return -EPERM
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shen <[email protected]>
commit 02695347be532b628f22488300d40c4eba48b9b7 upstream.
The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users.
The reason we need to explicitly disable mremap is that when the driver does not implement .mremap, it uses the default mremap method. This could lead to a risk scenario:
An application might first mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). Since the default mremap copies the original vma's vm_private_data (i.e., q) to the new vma, both munmap operations would trigger vma_close, causing q->qfr to be freed twice(qfr will be set to null here, so repeated release is ok).
--- drivers/misc/uacce/uacce.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/misc/uacce/uacce.c +6 -0
@@ -208,8 +208,14 @@ static void uacce_vma_close(struct vm_arkfree (qfr); } +static int uacce_vma_mremap (struct vm_area_struct *area) +{ +return -EPERM ; +} +static const struct vm_operations_struct uacce_vm_ops = { .close = uacce_vma_close, + .mremap = uacce_vma_mremap, };static int uacce_fops_mmap (struct file *filep,struct vm_area_struct *vma)
Greg Kroah-Hartman
maintainerPATCH 124/206 uacce: ensure safe queue release with state management
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <[email protected]>
commit 26c08dabe5475d99a13f353d8dd70e518de45663 upstream.
Directly calling put_queue carries risks since it cannot guarantee that resources of uacce_queue have been fully released beforehand. So adding a stop_queue operation for the UACCE_CMD_PUT_Q command and leaving the put_queue operation to the final resource release ensures safety.
Queue states are defined as follows:
- UACCE_Q_ZOMBIE: Initial state
- UACCE_Q_INIT: After opening uacce
- UACCE_Q_STARTED: After start is issued via ioctl
When executing poweroff -f in virt while accelerator are still working, uacce_fops_release and uacce_remove may execute concurrently. This can cause uacce_put_queue within uacce_fops_release to access a NULL ops pointer. Therefore, add state checks to prevent accessing freed pointers.
--- drivers/misc/uacce/uacce.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/misc/uacce/uacce.c +21 -7
@@ -37,20 +37,34 @@ static int uacce_start_queue(struct uaccreturn 0 ; } -static int uacce_put_queue (struct uacce_queue *q) +static int uacce_stop_queue (struct uacce_queue *q) {struct uacce_device *uacce = q->uacce; -if ((q->state ==UACCE_Q_STARTED ) && uacce->ops->stop_queue) +if (q->state !=UACCE_Q_STARTED ) +return 0 ; + +if (uacce->ops->stop_queue) uacce->ops->stop_queue (q); -if ((q->state ==UACCE_Q_INIT || q->state ==UACCE_Q_STARTED ) && - uacce->ops->put_queue) + q->state =UACCE_Q_INIT ; + +return 0 ; +} + +static void uacce_put_queue (struct uacce_queue *q) +{ +struct uacce_device *uacce = q->uacce; + +uacce_stop_queue (q); + +if (q->state !=UACCE_Q_INIT ) +return ; + +if (uacce->ops->put_queue) uacce->ops->put_queue (q); q->state =UACCE_Q_ZOMBIE ; - -return 0 ; } static long uacce_fops_unl_ioctl(struct file *filep,
@@ -77,7 +91,7 @@ static long uacce_fops_unl_ioctl(struct ret =uacce_start_queue (q);break ;case UACCE_CMD_PUT_Q : - ret =uacce_put_queue (q); + ret =uacce_stop_queue (q);break ;default :if (uacce->ops->ioctl)
Greg Kroah-Hartman
maintainerPATCH 125/206 netrom: fix double-free in nr_route_frame()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit ba1096c315283ee3292765f6aea4cca15816c4f7 upstream.
In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug.
Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.
--- net/netrom/nr_route.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/netrom/nr_route.c +9 -4
@@ -752,7 +752,7 @@ int nr_route_frame(struct sk_buff *skb,unsigned char *dptr;ax25_cb *ax25s;int ret; -struct sk_buff *skbn; +struct sk_buff *nskb, *oskb;/* * Reject malformed packets early. Check that it contains at least 2
@@ -811,14 +811,16 @@ int nr_route_frame(struct sk_buff *skb,/* We are going to change the netrom headers so we should get our own skb, we also did not know until now how much header space we had to reserve... - RXQ */ -if ((skbn=skb_copy_expand (skb, dev->hard_header_len,0 ,GFP_ATOMIC )) ==NULL ) { + nskb =skb_copy_expand (skb, dev->hard_header_len,0 ,GFP_ATOMIC ); + +if (!nskb) {nr_node_unlock (nr_node);nr_node_put (nr_node);dev_put (dev);return 0 ; } -kfree_skb (skb); - skb=skbn; + oskb = skb; + skb = nskb; skb->data[14 ]--; dptr =skb_push (skb,1 );
@@ -837,6 +839,9 @@ int nr_route_frame(struct sk_buff *skb,nr_node_unlock (nr_node);nr_node_put (nr_node); +if (ret) +kfree_skb (oskb); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 126/206 perf/x86/intel: Do not enable BTS for guests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernand Sieber <[email protected]>
commit 91dcfae0ff2b9b9ab03c1ec95babaceefbffb9f4 upstream.
By default when users program perf to sample branch instructions (PERF_COUNT_HW_BRANCH_INSTRUCTIONS) with a sample period of 1, perf interprets this as a special case and enables BTS (Branch Trace Store) as an optimization to avoid taking an interrupt on every branch.
Since BTS doesn't virtualize, this optimization doesn't make sense when the request originates from a guest. Add an additional check that prevents this optimization for virtualized events (exclude_host).
--- arch/x86/events/perf_event.h | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
arch/x86/events/perf_event.h +11 -2
@@ -1286,13 +1286,22 @@ static inline bool intel_pmu_has_bts_perstruct hw_perf_event *hwc = &event->hw;unsigned int hw_event, bts_event; -if (event->attr.freq) +/* +* Only use BTS for fixed rate period==1 events. +*/ +if (event->attr.freq || period !=1 ) +return false; + +/* +* BTS doesn't virtualize. +*/ +if (event->attr.exclude_host)return false; hw_event = hwc->config &INTEL_ARCH_EVENT_MASK ; bts_event = x86_pmu.event_map (PERF_COUNT_HW_BRANCH_INSTRUCTIONS ); -return hw_event == bts_event && period ==1 ; +return hw_event == bts_event; }static inline bool intel_pmu_has_bts (struct perf_event *event)
Greg Kroah-Hartman
maintainerPATCH 127/206 irqchip/gic-v3-its: Avoid truncating memory addresses
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream.
On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations.
This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable.
Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address.
The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest.
--- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v3-its.c +4 -4
@@ -609,7 +609,7 @@ static struct its_collection *its_build_struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr;u8 size =ilog2 (desc->its_mapd_cmd.dev->nr_ites); itt_addr =virt_to_phys (desc->its_mapd_cmd.dev->itt);
@@ -780,7 +780,7 @@ static struct its_vpe *its_build_vmapp_c struct its_cmd_desc *desc) {struct its_vpe *vpe =valid_vpe (its, desc->its_vmapp_cmd.vpe); -unsigned long vpt_addr, vconf_addr; +phys_addr_t vpt_addr, vconf_addr;u64 target;bool alloc;
@@ -2413,10 +2413,10 @@ retry_baser: baser->psz = psz; tmp = indirect ?GITS_LVL1_ENTRY_SIZE : esz; -pr_info ("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n" , +pr_info ("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n" , &its->phys_base, (int )(PAGE_ORDER_TO_SIZE (order) / (int )tmp), its_base_type_string[type], - (unsigned long )virt_to_phys (base), + (u64 )virt_to_phys (base), indirect ?"indirect" :"flat" , (int )esz, psz /SZ_1K , (int )shr >>GITS_BASER_SHAREABILITY_SHIFT );
Greg Kroah-Hartman
maintainerPATCH 128/206 can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 0ce73a0eb5a27070957b67fd74059b6da89cc516 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In ems_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In ems_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in ems_usb_close().
Fix the memory leak by anchoring the URB in the ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.
--- drivers/net/can/usb/ems_usb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/usb/ems_usb.c +7 -1
@@ -485,11 +485,17 @@ resubmit_urb: urb->transfer_buffer,RX_BUFFER_SIZE , ems_usb_read_bulk_callback, dev); +usb_anchor_urb (urb, &dev->rx_submitted); + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (!retval) +return ; + +usb_unanchor_urb (urb);if (retval == -ENODEV )netif_device_detach (netdev); -else if (retval) +else netdev_err (netdev,"failed resubmitting read bulk urb: %d\n" , retval); }
Greg Kroah-Hartman
maintainerPATCH 129/206 can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 248e8e1a125fa875158df521b30f2cc7e27eeeaa upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback kvaser_usb_read_bulk_callback(), the URBs are processed and resubmitted. In kvaser_usb_remove_interfaces() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the kvaser_usb_read_bulk_callback() to the dev->rx_submitted anchor.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +8 -1
@@ -350,7 +350,14 @@ resubmit_urb: urb->transfer_buffer,KVASER_USB_RX_BUFFER_SIZE , kvaser_usb_read_bulk_callback, dev); +usb_anchor_urb (urb, &dev->rx_submitted); + err =usb_submit_urb (urb,GFP_ATOMIC ); +if (!err) +return ; + +usb_unanchor_urb (urb); +if (err == -ENODEV ) {for (i =0 ; i < dev->nchannels; i++) {if (!dev->nets[i])
@@ -358,7 +365,7 @@ resubmit_urb:netif_device_detach (dev->nets[i]->netdev); } - }else if (err) { + }else {dev_err (&dev->intf->dev,"Failed resubmitting read bulk urb: %d\n" , err); }
Greg Kroah-Hartman
maintainerPATCH 130/206 can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 710a7529fb13c5a470258ff5508ed3c498d54729 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback mcba_usb_read_bulk_callback(), the URBs are processed and resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor.
--- drivers/net/can/usb/mcba_usb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/usb/mcba_usb.c +7 -1
@@ -614,11 +614,17 @@ resubmit_urb: urb->transfer_buffer,MCBA_USB_RX_BUFF_SIZE , mcba_usb_read_bulk_callback, priv); +usb_anchor_urb (urb, &priv->rx_submitted); + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (!retval) +return ; + +usb_unanchor_urb (urb);if (retval == -ENODEV )netif_device_detach (netdev); -else if (retval) +else netdev_err (netdev,"failed resubmitting read bulk urb: %d\n" , retval); }
Greg Kroah-Hartman
maintainerPATCH 131/206 can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit f7a980b3b8f80fe367f679da376cf76e800f9480 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback usb_8dev_read_bulk_callback(), the URBs are processed and resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor.
--- drivers/net/can/usb/usb_8dev.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/usb/usb_8dev.c +7 -1
@@ -544,11 +544,17 @@ resubmit_urb: urb->transfer_buffer,RX_BUFFER_SIZE , usb_8dev_read_bulk_callback, priv); +usb_anchor_urb (urb, &priv->rx_submitted); + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (!retval) +return ; + +usb_unanchor_urb (urb);if (retval == -ENODEV )netif_device_detach (netdev); -else if (retval) +else netdev_err (netdev,"failed resubmitting read bulk urb: %d\n" , retval); }
Greg Kroah-Hartman
maintainerPATCH 132/206 migrate: correct lock ordering for hugetlb file folios
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
commit b7880cb166ab62c2409046b2347261abf701530e upstream.
Syzbot has found a deadlock (analyzed by Lance Yang):
1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).
2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock.
migrate_pages()
-> migrate_hugetlbs()
-> unmap_and_move_huge_page() <- Takes folio_lock!
-> remove_migration_ptes()
-> __rmap_walk_file()
-> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)!hugetlbfs_fallocate()
-> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)!
-> hugetlbfs_zero_partial_page()
-> filemap_lock_hugetlb_folio()
-> filemap_lock_folio()
-> __filemap_get_folio <- Waits for folio_lock!The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too.
This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages.
--- mm/migrate.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
mm/migrate.c +6 -8
@@ -1291,6 +1291,7 @@ static int unmap_and_move_huge_page(new_struct page *new_hpage;struct anon_vma *anon_vma =NULL ;struct address_space *mapping =NULL ; +enum ttu_flags ttu =0 ;/* * Migratability of hugepages depends on architectures and their size.
@@ -1344,9 +1345,6 @@ static int unmap_and_move_huge_page(new_ goto put_anon;if (page_mapped (hpage)) { -bool mapping_locked = false; -enum ttu_flags ttu =0 ; -if (!PageAnon (hpage)) {/* * In shared mappings, try_to_unmap could potentially
@@ -1358,15 +1356,11 @@ static int unmap_and_move_huge_page(new_if (unlikely (!mapping)) goto unlock_put_anon; - mapping_locked = true; ttu |=TTU_RMAP_LOCKED ; }try_to_migrate (hpage, ttu); page_was_mapped =1 ; - -if (mapping_locked) -i_mmap_unlock_write (mapping); }if (!page_mapped (hpage))
@@ -1374,7 +1368,11 @@ static int unmap_and_move_huge_page(new_if (page_was_mapped)remove_migration_ptes (hpage, - rc ==MIGRATEPAGE_SUCCESS ? new_hpage : hpage, false); + rc ==MIGRATEPAGE_SUCCESS ? new_hpage : hpage, + ttu ? true : false); + +if (ttu &TTU_RMAP_LOCKED ) +i_mmap_unlock_write (mapping); unlock_put_anon:unlock_page (new_hpage);
Greg Kroah-Hartman
maintainerPATCH 133/206 bpf: Do not let BPF test infra emit invalid GSO types to stack
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 04a899573fb87273a656f178b5f920c505f68875 upstream.
Yinhao et al. reported that their fuzzer tool was able to trigger a skb_warn_bad_offload() from netif_skb_features() -> gso_features_check(). When a BPF program - triggered via BPF test infra - pushes the packet to the loopback device via bpf_clone_redirect() then mentioned offload warning can be seen. GSO-related features are then rightfully disabled.
We get into this situation due to convert___skb_to_skb() setting gso_segs and gso_size but not gso_type. Technically, it makes sense that this warning triggers since the GSO properties are malformed due to the gso_type. Potentially, the gso_type could be marked non-trustworthy through setting it at least to SKB_GSO_DODGY without any other specific assumptions, but that also feels wrong given we should not go further into the GSO engine in the first place.
The checks were added in 121d57af308d ("gso: validate gso_type in GSO handlers") because there were malicious (syzbot) senders that combine a protocol with a non-matching gso_type. If we would want to drop such packets, gso_features_check() currently only returns feature flags via netif_skb_features(), so one location for potentially dropping such skbs could be validate_xmit_unreadable_skb(), but then otoh it would be an additional check in the fast-path for a very corner case. Given bpf_clone_redirect() is the only place where BPF test infra could emit such packets, lets reject them right there.
--- net/bpf/test_run.c | 5 +++++ net/core/filter.c | 7 +++++++ 2 files changed, 12 insertions(+)
net/bpf/test_run.c +5 -0
@@ -537,6 +537,11 @@ static int convert___skb_to_skb(struct sif (__skb->gso_segs >GSO_MAX_SEGS )return -EINVAL ; + +/* Currently GSO type is zero/unset. If this gets extended with +* a small list of accepted GSO types in future, the filter for +* an unset GSO type in bpf_clone_redirect() can be lifted. +*/ skb_shinfo (skb)->gso_segs = __skb->gso_segs;skb_shinfo (skb)->gso_size = __skb->gso_size;
net/core/filter.c +7 -0
@@ -2433,6 +2433,13 @@ BPF_CALL_3(bpf_clone_redirect, struct skif (unlikely (flags & (~(BPF_F_INGRESS ) |BPF_F_REDIRECT_INTERNAL )))return -EINVAL ; +/* BPF test infra's convert___skb_to_skb() can create type-less +* GSO packets. gso_features_check() will detect this as a bad +* offload. However, lets not leak them out in the first place. +*/ +if (unlikely (skb_is_gso (skb) && !skb_shinfo (skb)->gso_type)) +return -EBADMSG ; + dev =dev_get_by_index_rcu (dev_net (skb->dev), ifindex);if (unlikely (!dev))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 134/206 bpf: Reject narrower access to pointer ctx fields
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
commit e09299225d5ba3916c91ef70565f7d2187e4cca0 upstream.
The following BPF program, simplified from a syzkaller repro, causes a kernel warning:
r0 = *(u8 *)(r1 + 169);
exit;With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning:
verifier bug: error during ctx access conversion(1)
This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction.
The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency.
Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in
commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.
[shung-hsi.yu: offset(struct bpf_sock_ops, skb_hwtstamp) case was dropped becasuse it was only added in v6.2 with commit 9bb053490f1a ("bpf: Add hwtstamp field for the sockops prog")]
--- kernel/bpf/cgroup.c | 8 ++++---- net/core/filter.c | 18 +++++++++--------- 2 files changed, 13 insertions(+), 13 deletions(-)
kernel/bpf/cgroup.c +4 -4
@@ -2028,22 +2028,22 @@ static bool cg_sockopt_is_valid_access(i }switch (off) { -case offsetof(struct bpf_sockopt , sk): + case bpf_ctx_range_ptr(struct bpf_sockopt, sk):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCKET ;break ; -case offsetof(struct bpf_sockopt , optval): + case bpf_ctx_range_ptr(struct bpf_sockopt, optval):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET ;break ; -case offsetof(struct bpf_sockopt , optval_end): + case bpf_ctx_range_ptr(struct bpf_sockopt, optval_end):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET_END ;break ; -case offsetof(struct bpf_sockopt , retval): + case bpf_ctx_range(struct bpf_sockopt, retval):if (size != size_default)return false;return prog->expected_attach_type ==BPF_CGROUP_GETSOCKOPT ;
net/core/filter.c +9 -9
@@ -8080,7 +8080,7 @@ static bool bpf_skb_is_valid_access(intif (size !=sizeof (__u64))return false;break ; -case offsetof(struct __sk_buff , sk): + case bpf_ctx_range_ptr(struct __sk_buff, sk):if (type ==BPF_WRITE || size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCK_COMMON_OR_NULL ;
@@ -8597,7 +8597,7 @@ static bool sock_addr_is_valid_access(inreturn false; }break ; -case offsetof(struct bpf_sock_addr , sk): + case bpf_ctx_range_ptr(struct bpf_sock_addr, sk):if (type !=BPF_READ )return false;if (size !=sizeof (__u64))
@@ -8651,17 +8651,17 @@ static bool sock_ops_is_valid_access(intif (size !=sizeof (__u64))return false;break ; -case offsetof(struct bpf_sock_ops , sk): + case bpf_ctx_range_ptr(struct bpf_sock_ops, sk):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCKET_OR_NULL ;break ; -case offsetof(struct bpf_sock_ops , skb_data): + case bpf_ctx_range_ptr(struct bpf_sock_ops, skb_data):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET ;break ; -case offsetof(struct bpf_sock_ops , skb_data_end): + case bpf_ctx_range_ptr(struct bpf_sock_ops, skb_data_end):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_PACKET_END ;
@@ -8735,17 +8735,17 @@ static bool sk_msg_is_valid_access(int oreturn false;switch (off) { -case offsetof(struct sk_msg_md , data): + case bpf_ctx_range_ptr(struct sk_msg_md, data): info->reg_type =PTR_TO_PACKET ;if (size !=sizeof (__u64))return false;break ; -case offsetof(struct sk_msg_md , data_end): + case bpf_ctx_range_ptr(struct sk_msg_md, data_end): info->reg_type =PTR_TO_PACKET_END ;if (size !=sizeof (__u64))return false;break ; -case offsetof(struct sk_msg_md , sk): + case bpf_ctx_range_ptr(struct sk_msg_md, sk):if (size !=sizeof (__u64))return false; info->reg_type =PTR_TO_SOCKET ;
@@ -10837,7 +10837,7 @@ static bool sk_lookup_is_valid_access(inreturn false;switch (off) { -case offsetof(struct bpf_sk_lookup , sk): + case bpf_ctx_range_ptr(struct bpf_sk_lookup, sk): info->reg_type =PTR_TO_SOCKET_OR_NULL ;return size ==sizeof (__u64);
Greg Kroah-Hartman
maintainerPATCH 135/206 Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Hong Su <[email protected]>
[ Upstream commit 0c3cd7a0b862c37acbee6d9502107146cc944398 ]
hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv.
The race condition is:
CPU0 CPU1
---- ----
hci_uart_set_proto()
set_bit(HCI_UART_PROTO_INIT)
hci_uart_register_dev()
tty write wakeup
hci_uart_tty_wakeup()
hci_uart_tx_wakeup()
schedule_work(&hu->write_work)
proto->open(hu)
// initializes hu->priv
hci_uart_write_work()
hci_uart_dequeue()
proto->dequeue(hu)
// accesses hu->priv (NULL!)Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.
--- drivers/bluetooth/hci_ldisc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bluetooth/hci_ldisc.c +2 -2
@@ -684,6 +684,8 @@ static int hci_uart_register_dev(struct hci_uart *hu)return err; } +set_bit (HCI_UART_PROTO_INIT , &hu->flags); +if (test_bit (HCI_UART_INIT_PENDING , &hu->hdev_flags))return 0 ;
@@ -711,8 +713,6 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) hu->proto = p; -set_bit (HCI_UART_PROTO_INIT , &hu->flags); - err =hci_uart_register_dev (hu);if (err) {return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/206 net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 108948f723b13874b7ebf6b3f1cc598a7de38622 ]
In esw_acl_ingress_lgcy_setup(), if esw_acl_table_create() fails, the function returns directly without releasing the previously created counter, leading to a memory leak.
Fix this by jumping to the out label instead of returning directly, which aligns with the error handling logic of other paths in this function.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c +1 -1
@@ -188,7 +188,7 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,if (IS_ERR (vport->ingress.acl)) { err =PTR_ERR (vport->ingress.acl); vport->ingress.acl =NULL ; -return err; + goto out; } err =esw_acl_ingress_lgcy_groups_create (esw, vport);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/206 net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 09f979d1f312627b31d2ee1e46f9692e442610cd ]
In mvpp2_ethtool_cls_rule_ins(), the ethtool_rule is allocated by ethtool_rx_flow_rule_create(). If the subsequent conversion to flow type fails, the function jumps to the clean_rule label.
However, the clean_rule label only frees efs, skipping the cleanup of ethtool_rule, which leads to a memory leak.
Fix this by jumping to the clean_eth_rule label, which properly calls ethtool_rx_flow_rule_destroy() before freeing efs.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c +1 -1
@@ -1389,7 +1389,7 @@ int mvpp2_ethtool_cls_rule_ins(struct mvpp2_port *port, efs->rule.flow_type =mvpp2_cls_ethtool_flow_to_type (info->fs.flow_type);if (efs->rule.flow_type <0 ) { ret = efs->rule.flow_type; - goto clean_rule; + goto clean_eth_rule; } ret =mvpp2_cls_rfs_parse_rule (&efs->rule);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/206 ipv6: use the right ifindex when replying to icmpv6 from localhost
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 03cbcdf93866e61beb0063392e6dbb701f03aea2 ]
When replying to a ICMPv6 echo request that comes from localhost address the right output ifindex is 1 (lo) and not rt6i_idev dev index. Use the skb device ifindex instead. This fixes pinging to a local address from localhost source address.
$ ping6 -I ::1 2001:1:1::2 -c 3 PING 2001:1:1::2 (2001:1:1::2) from ::1 : 56 data bytes 64 bytes from 2001:1:1::2: icmp_seq=1 ttl=64 time=0.037 ms 64 bytes from 2001:1:1::2: icmp_seq=2 ttl=64 time=0.069 ms 64 bytes from 2001:1:1::2: icmp_seq=3 ttl=64 time=0.122 ms
2001:1:1::2 ping statistics
3 packets transmitted, 3 received, 0% packet loss, time 2032ms rtt min/avg/max/mdev = 0.037/0.076/0.122/0.035 ms
--- net/ipv6/icmp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/icmp.c +3 -1
@@ -761,7 +761,9 @@ static void icmpv6_echo_reply(struct sk_buff *skb) fl6.daddr =ipv6_hdr (skb)->saddr;if (saddr) fl6.saddr = *saddr; - fl6.flowi6_oif =icmp6_iif (skb); + fl6.flowi6_oif =ipv6_addr_loopback (&fl6.daddr) ? + skb->dev->ifindex : +icmp6_iif (skb); fl6.fl6_icmp_type = type; fl6.flowi6_mark = mark; fl6.flowi6_uid =sock_net_uid (net,NULL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/206 rocker: fix memory leak in rocker_world_port_post_fini()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit 8d7ba71e46216b8657a82ca2ec118bc93812a4d0 ]
In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with kzalloc(wops->port_priv_size, GFP_KERNEL). However, in rocker_world_port_post_fini(), the memory is only freed when wops->port_post_fini callback is set:
if (!wops->port_post_fini)
return;
wops->port_post_fini(rocker_port);
kfree(rocker_port->wpriv);Since rocker_ofdpa_ops does not implement port_post_fini callback (it is NULL), the wpriv memory allocated for each port is never freed when ports are removed. This leads to a memory leak of sizeof(struct ofdpa_port) bytes per port on every device removal.
Fix this by always calling kfree(rocker_port->wpriv) regardless of whether the port_post_fini callback exists.
--- drivers/net/ethernet/rocker/rocker_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/rocker/rocker_main.c +2 -3
@@ -1525,9 +1525,8 @@ static void rocker_world_port_post_fini(struct rocker_port *rocker_port) {struct rocker_world_ops *wops = rocker_port->rocker->wops; -if (!wops->port_post_fini) -return ; - wops->port_post_fini (rocker_port); +if (wops->port_post_fini) + wops->port_post_fini (rocker_port);kfree (rocker_port->wpriv); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 140/206 nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 165c34fb6068ff153e3fc99a932a80a9d5755709 ]
syzbot reported various memory leaks related to NFC, struct nfc_llcp_sock, sk_buff, nfc_dev, etc. [0]
The leading log hinted that nfc_llcp_send_ui_frame() failed to allocate skb due to sock_error(sk) being -ENXIO.
ENXIO is set by nfc_llcp_socket_release() when struct nfc_llcp_local is destroyed by local_cleanup().
The problem is that there is no synchronisation between nfc_llcp_send_ui_frame() and local_cleanup(), and skb could be put into local->tx_queue after it was purged in local_cleanup():
CPU1 CPU2
---- ----
nfc_llcp_send_ui_frame() local_cleanup()
|- do { '
|- pdu = nfc_alloc_send_skb(..., &err)
| .
| |- nfc_llcp_socket_release(local, false, ENXIO);
| |- skb_queue_purge(&local->tx_queue); |
| ' |
|- skb_queue_tail(&local->tx_queue, pdu); | ... |
|- pdu = nfc_alloc_send_skb(..., &err) |
^._________________________________.'
local_cleanup() is called for struct nfc_llcp_local only after nfc_llcp_remove_local() unlinks it from llcp_devices.
If we hold local->tx_queue.lock then, we can synchronise the thread and nfc_llcp_send_ui_frame().
Let's do that and check list_empty(&local->list) before queuing skb to local->tx_queue in nfc_llcp_send_ui_frame().
[0]:
[ 56.074943][ T6096] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6)
[ 64.318868][ T5813] kmemleak: 6 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
BUG: memory leak
unreferenced object 0xffff8881272f6800 (size 1024):
comm "syz.0.17", pid 6096, jiffies 4294942766
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
27 00 03 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
backtrace (crc da58d84d):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__do_kmalloc_node mm/slub.c:5645 [inline]
__kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5658
kmalloc_noprof include/linux/slab.h:961 [inline]
sk_prot_alloc+0x11a/0x1b0 net/core/sock.c:2239
sk_alloc+0x36/0x360 net/core/sock.c:2295
nfc_llcp_sock_alloc+0x37/0x130 net/nfc/llcp_sock.c:979
llcp_sock_create+0x71/0xd0 net/nfc/llcp_sock.c:1044
nfc_sock_create+0xc9/0xf0 net/nfc/af_nfc.c:31
__sock_create+0x1a9/0x340 net/socket.c:1605
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xb9/0x1a0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x1b/0x30 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810fbd9800 (size 240):
comm "syz.0.17", pid 6096, jiffies 4294942850
hex dump (first 32 bytes):
68 f0 ff 08 81 88 ff ff 68 f0 ff 08 81 88 ff ff h.......h.......
00 00 00 00 00 00 00 00 00 68 2f 27 81 88 ff ff .........h/'....
backtrace (crc 6cc652b1):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5336
__alloc_skb+0x203/0x240 net/core/skbuff.c:660
alloc_skb include/linux/skbuff.h:1383 [inline]
alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671
sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965
sock_alloc_send_skb include/net/sock.h:1859 [inline]
nfc_alloc_send_skb+0x45/0x80 net/nfc/core.c:724
nfc_llcp_send_ui_frame+0x162/0x360 net/nfc/llcp_commands.c:766
llcp_sock_sendmsg+0x14c/0x1d0 net/nfc/llcp_sock.c:814
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x2d8/0x2f0 net/socket.c:2244
__do_sys_sendto net/socket.c:2251 [inline]
__se_sys_sendto net/socket.c:2247 [inline]
__x64_sys_sendto+0x28/0x30 net/socket.c:2247
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/nfc/llcp_commands.c | 17 ++++++++++++++++- net/nfc/llcp_core.c | 4 +++- 2 files changed, 19 insertions(+), 2 deletions(-)
net/nfc/llcp_commands.c +16 -1
@@ -786,8 +786,23 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,if (likely (frag_len >0 ))skb_put_data (pdu, msg_ptr, frag_len); +spin_lock (&local->tx_queue.lock); + +if (list_empty (&local->list)) { +spin_unlock (&local->tx_queue.lock); + +kfree_skb (pdu); + + len -= remaining_len; +if (len ==0 ) + len = -ENXIO ; +break ; + } +/* No need to check for the peer RW for UI frames */ -skb_queue_tail (&local->tx_queue, pdu); +__skb_queue_tail (&local->tx_queue, pdu); + +spin_unlock (&local->tx_queue.lock); remaining_len -= frag_len; msg_ptr += frag_len;
net/nfc/llcp_core.c +3 -1
@@ -316,7 +316,9 @@ static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev)spin_lock (&llcp_devices_lock);list_for_each_entry_safe (local, tmp, &llcp_devices, list)if (local->dev == dev) { -list_del (&local->list); +spin_lock (&local->tx_queue.lock); +list_del_init (&local->list); +spin_unlock (&local->tx_queue.lock);spin_unlock (&llcp_devices_lock);return local; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 141/206 ice: stop counting UDP csum mismatch as rx_errors
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <[email protected]>
[ Upstream commit 05faf2c0a76581d0a7fdbb8ec46477ba183df95b ]
Since the beginning, the Intel ice driver has counted receive checksum offload mismatches into the rx_errors member of the rtnl_link_stats64 struct. In ethtool -S these show up as rx_csum_bad.nic.
I believe counting these in rx_errors is fundamentally wrong, as it's pretty clear from the comments in if_link.h and from every other statistic the driver is summing into rx_errors, that all of them would cause a "hardware drop" except for the UDP checksum mismatch, as well as the fact that all the other causes for rx_errors are L2 reasons, and this L4 UDP "mismatch" is an outlier.
A last nail in the coffin is that rx_errors is monitored in production and can indicate a bad NIC/cable/Switch port, but instead some random series of UDP packets with bad checksums will now trigger this alert. This false positive makes the alert useless and affects us as well as other companies.
This packet with presumably a bad UDP checksum is *already* passed to the stack, just not marked as offloaded by the hardware/driver. If it is dropped by the stack it will show up as UDP_MIB_CSUMERRORS.
And one more thing, none of the other Intel drivers, and at least bnxt_en and mlx5 both don't appear to count UDP offload mismatches as rx_errors.
Here is a related customer complaint:
https://community.intel.com/t5/Ethernet-Products/ice-rx-errros-is-too-sensitive-to-IP-TCP-attack-packets-Intel/td-p/1662125
--- drivers/net/ethernet/intel/ice/ice_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +0 -1
@@ -5841,7 +5841,6 @@ void ice_update_vsi_stats(struct ice_vsi *vsi) pf->stats.illegal_bytes + pf->stats.rx_len_errors + pf->stats.rx_undersize + - pf->hw_csum_rx_error + pf->stats.rx_jabber + pf->stats.rx_fragments + pf->stats.rx_oversize;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 142/206 net/mlx5: Add HW definitions of vport debug counters
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 3e94e61bd44d90070dcda53b647fdc826097ef26 ]
total_q_under_processor_handle - number of queues in error state due to an async error or errored command.
send_queue_priority_update_flow - number of QP/SQ priority/SL update events.
cq_overrun - number of times CQ entered an error state due to an overflow.
async_eq_overrun -number of time an EQ mapped to async events was overrun.
comp_eq_overrun - number of time an EQ mapped to completion events was overrun.
quota_exceeded_command - number of commands issued and failed due to quota exceeded.
invalid_command - number of commands issued and failed dues to any reason other than quota exceeded.
Stable-dep-of: 476681f10cc1 ("net/mlx5e: Account for netdev stats in ndo_get_stats64")
--- include/linux/mlx5/mlx5_ifc.h | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
include/linux/mlx5/mlx5_ifc.h +19 -4
@@ -1384,7 +1384,8 @@ struct mlx5_ifc_cmd_hca_cap_bits {u8 reserved_at_120[0xa ];u8 log_max_ra_req_dc[0x6 ]; -u8 reserved_at_130[0xa ]; +u8 reserved_at_130[0x9 ]; +u8 vnic_env_cq_overrun[0x1 ];u8 log_max_ra_res_dc[0x6 ];u8 reserved_at_140[0x6 ];
@@ -1579,7 +1580,11 @@ struct mlx5_ifc_cmd_hca_cap_bits {u8 nic_receive_steering_discard[0x1 ];u8 receive_discard_vport_down[0x1 ];u8 transmit_discard_vport_down[0x1 ]; -u8 reserved_at_343[0x5 ]; +u8 eq_overrun_count[0x1 ]; +u8 reserved_at_344[0x1 ]; +u8 invalid_command_count[0x1 ]; +u8 quota_exceeded_count[0x1 ]; +u8 reserved_at_347[0x1 ];u8 log_max_flow_counter_bulk[0x8 ];u8 max_flow_counter_15_0[0x10 ];
@@ -3318,11 +3323,21 @@ struct mlx5_ifc_vnic_diagnostic_statistics_bits {u8 transmit_discard_vport_down[0x40 ]; -u8 reserved_at_140[0xa0 ]; +u8 async_eq_overrun[0x20 ]; + +u8 comp_eq_overrun[0x20 ]; + +u8 reserved_at_180[0x20 ]; + +u8 invalid_command[0x20 ]; + +u8 quota_exceeded_command[0x20 ];u8 internal_rq_out_of_buffer[0x20 ]; -u8 reserved_at_200[0xe00 ]; +u8 cq_overrun[0x20 ]; + +u8 reserved_at_220[0xde0 ]; };struct mlx5_ifc_traffic_counter_bits {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 143/206 net/mlx5e: Expose rx_oversize_pkts_buffer counter
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 16ab85e78439bab1201ff26ba430231d1574b4ae ]
Add the rx_oversize_pkts_buffer counter to ethtool statistics. This counter exposes the number of dropped received packets due to length which arrived to RQ and exceed software buffer size allocated by the device for incoming traffic. It might imply that the device MTU is larger than the software buffers size.
Stable-dep-of: 476681f10cc1 ("net/mlx5e: Account for netdev stats in ndo_get_stats64")
--- .../net/ethernet/mellanox/mlx5/core/en_main.c | 3 ++- .../ethernet/mellanox/mlx5/core/en_stats.c | 21 ++++++++++++++++++- .../ethernet/mellanox/mlx5/core/en_stats.h | 4 ++++ include/linux/mlx5/mlx5_ifc.h | 8 +++++-- 4 files changed, 32 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -1
@@ -3190,7 +3190,8 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) stats->rx_length_errors =PPORT_802_3_GET (pstats, a_in_range_length_errors) +PPORT_802_3_GET (pstats, a_out_of_range_length_field) + -PPORT_802_3_GET (pstats, a_frame_too_long_errors); +PPORT_802_3_GET (pstats, a_frame_too_long_errors) + +VNIC_ENV_GET (&priv->stats.vnic, eth_wqe_too_small); stats->rx_crc_errors =PPORT_802_3_GET (pstats, a_frame_check_sequence_errors); stats->rx_frame_errors =PPORT_802_3_GET (pstats, a_alignment_errors);
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +20 -1
@@ -567,17 +567,26 @@ static const struct counter_desc vnic_env_stats_dev_oob_desc[] = { VNIC_ENV_OFF(vport_env.internal_rq_out_of_buffer) }, }; +static const struct counter_desc vnic_env_stats_drop_desc[] = { + {"rx_oversize_pkts_buffer" , +VNIC_ENV_OFF (vport_env.eth_wqe_too_small) }, +}; +#define NUM_VNIC_ENV_STEER_COUNTERS (dev) \ (MLX5_CAP_GEN(dev, nic_receive_steering_discard) ? \ ARRAY_SIZE(vnic_env_stats_steer_desc) : 0)#define NUM_VNIC_ENV_DEV_OOB_COUNTERS (dev) \ (MLX5_CAP_GEN(dev, vnic_env_int_rq_oob) ? \ ARRAY_SIZE(vnic_env_stats_dev_oob_desc) : 0) +#define NUM_VNIC_ENV_DROP_COUNTERS (dev) \ + (MLX5_CAP_GEN(dev, eth_wqe_too_small) ? \ + ARRAY_SIZE(vnic_env_stats_drop_desc) : 0)static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS (vnic_env) {return NUM_VNIC_ENV_STEER_COUNTERS (priv->mdev) + -NUM_VNIC_ENV_DEV_OOB_COUNTERS (priv->mdev); +NUM_VNIC_ENV_DEV_OOB_COUNTERS (priv->mdev) + +NUM_VNIC_ENV_DROP_COUNTERS (priv->mdev); }static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS (vnic_env)
@@ -591,6 +600,11 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(vnic_env)for (i =0 ; i <NUM_VNIC_ENV_DEV_OOB_COUNTERS (priv->mdev); i++)strcpy (data + (idx++) *ETH_GSTRING_LEN , vnic_env_stats_dev_oob_desc[i].format); + +for (i =0 ; i <NUM_VNIC_ENV_DROP_COUNTERS (priv->mdev); i++) +strcpy (data + (idx++) *ETH_GSTRING_LEN , + vnic_env_stats_drop_desc[i].format); +return idx; }
@@ -605,6 +619,11 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS(vnic_env)for (i =0 ; i <NUM_VNIC_ENV_DEV_OOB_COUNTERS (priv->mdev); i++) data[idx++] =MLX5E_READ_CTR32_BE (priv->stats.vnic.query_vnic_env_out, vnic_env_stats_dev_oob_desc, i); + +for (i =0 ; i <NUM_VNIC_ENV_DROP_COUNTERS (priv->mdev); i++) + data[idx++] =MLX5E_READ_CTR32_BE (priv->stats.vnic.query_vnic_env_out, + vnic_env_stats_drop_desc, i); +return idx; }
drivers/net/ethernet/mellanox/mlx5/core/en_stats.h +4 -0
@@ -256,6 +256,10 @@ struct mlx5e_qcounter_stats {u32 rx_if_down_packets; }; +#define VNIC_ENV_GET (vnic_env_stats, c) \ + MLX5_GET(query_vnic_env_out, (vnic_env_stats)->query_vnic_env_out, \ + vport_env.c) +struct mlx5e_vnic_env_stats {__be64 query_vnic_env_out[MLX5_ST_SZ_QW (query_vnic_env_out)]; };
include/linux/mlx5/mlx5_ifc.h +6 -2
@@ -1384,7 +1384,9 @@ struct mlx5_ifc_cmd_hca_cap_bits {u8 reserved_at_120[0xa ];u8 log_max_ra_req_dc[0x6 ]; -u8 reserved_at_130[0x9 ]; +u8 reserved_at_130[0x2 ]; +u8 eth_wqe_too_small[0x1 ]; +u8 reserved_at_133[0x6 ];u8 vnic_env_cq_overrun[0x1 ];u8 log_max_ra_res_dc[0x6 ];
@@ -3337,7 +3339,9 @@ struct mlx5_ifc_vnic_diagnostic_statistics_bits {u8 cq_overrun[0x20 ]; -u8 reserved_at_220[0xde0 ]; +u8 eth_wqe_too_small[0x20 ]; + +u8 reserved_at_220[0xdc0 ]; };struct mlx5_ifc_traffic_counter_bits {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 144/206 net/mlx5e: Report rx_discards_phy via rx_dropped
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit c9cfced17365b1df8c6ae6cd5db56aebd7ed9b57 ]
We noticed a high number of rx_discards_phy events on certain servers while running ethtool -S. However, this critical counter is not currently included in the standard /proc/net/dev statistics file, making it difficult to monitor effectively—especially given the diversity of vendors across a large fleet of servers.
Let's report it via the standard rx_dropped metric.
Stable-dep-of: 476681f10cc1 ("net/mlx5e: Account for netdev stats in ndo_get_stats64")
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -0
@@ -3186,6 +3186,7 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) } stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer; + stats->rx_dropped =PPORT_2863_GET (pstats, if_in_discards); stats->rx_length_errors = PPORT_802_3_GET(pstats, a_in_range_length_errors) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/206 net/mlx5e: Account for netdev stats in ndo_get_stats64
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 476681f10cc1e0e56e26856684e75d4678b072b2 ]
The driver's ndo_get_stats64 callback is only reporting mlx5 counters, without accounting for the netdev stats, causing errors from the network stack to be invisible in statistics.
Add netdev_stats_to_stats64() call to first populate the counters, then add mlx5 counters on top, ensuring both are accounted for (where appropriate).
--- .../net/ethernet/mellanox/mlx5/core/en_main.c | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +11 -9
@@ -3169,6 +3169,8 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)mlx5e_queue_update_stats (priv); } +netdev_stats_to_stats64 (stats, &dev->stats); +if (mlx5e_is_uplink_rep (priv)) {struct mlx5e_vport_stats *vstats = &priv->stats.vport;
@@ -3185,21 +3187,21 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)mlx5e_fold_sw_stats64 (priv, stats); } - stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer; - stats->rx_dropped =PPORT_2863_GET (pstats, if_in_discards); + stats->rx_missed_errors += priv->stats.qcnt.rx_out_of_buffer; + stats->rx_dropped +=PPORT_2863_GET (pstats, if_in_discards); - stats->rx_length_errors = + stats->rx_length_errors +=PPORT_802_3_GET (pstats, a_in_range_length_errors) +PPORT_802_3_GET (pstats, a_out_of_range_length_field) +PPORT_802_3_GET (pstats, a_frame_too_long_errors) +VNIC_ENV_GET (&priv->stats.vnic, eth_wqe_too_small); - stats->rx_crc_errors = + stats->rx_crc_errors +=PPORT_802_3_GET (pstats, a_frame_check_sequence_errors); - stats->rx_frame_errors =PPORT_802_3_GET (pstats, a_alignment_errors); - stats->tx_aborted_errors =PPORT_2863_GET (pstats, if_out_discards); - stats->rx_errors = stats->rx_length_errors + stats->rx_crc_errors + - stats->rx_frame_errors; - stats->tx_errors = stats->tx_aborted_errors + stats->tx_carrier_errors; + stats->rx_frame_errors +=PPORT_802_3_GET (pstats, a_alignment_errors); + stats->tx_aborted_errors +=PPORT_2863_GET (pstats, if_out_discards); + stats->rx_errors += stats->rx_length_errors + stats->rx_crc_errors + + stats->rx_frame_errors; + stats->tx_errors += stats->tx_aborted_errors + stats->tx_carrier_errors; }static void mlx5e_nic_set_rx_mode (struct mlx5e_priv *priv)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 146/206 nfc: nci: Fix race between rfkill and nci_unregister_device().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit d2492688bb9fed6ab6e313682c387ae71a66ebae ]
syzbot reported the splat below [0] without a repro.
It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill.
nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think) was called from virtual_ncidev_close() when syzbot close()d an fd of virtual_ncidev.
The problem is that nci_unregister_device() destroys nci_dev.cmd_wq first and then calls nfc_unregister_device(), which removes the device from rfkill by rfkill_unregister().
So, the device is still visible via rfkill even after nci_dev.cmd_wq is destroyed.
Let's unregister the device from rfkill first in nci_unregister_device().
Note that we cannot call nfc_unregister_device() before nci_close_device() because
1) nfc_unregister_device() calls device_del() which frees all memory allocated by devm_kzalloc() and linked to ndev->conn_info_list
2) nci_rx_work() could try to queue nci_conn_info to
ndev->conn_info_list which could be leaked
Thus, nfc_unregister_device() is split into two functions so we can remove rfkill interfaces only before nci_close_device().
[0]:DEBUG_LOCKS_WARN_ON(1)
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x39d/0x2cf0 kernel/locking/lockdep.c:5187, CPU#0: syz.0.8675/6349 Modules linked in: CPU: 0 UID: 0 PID: 6349 Comm: syz.0.8675 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4854 [inline] RIP: 0010:__lock_acquire+0x3a4/0x2cf0 kernel/locking/lockdep.c:5187 Code: 18 00 4c 8b 74 24 08 75 27 90 e8 17 f2 fc 02 85 c0 74 1c 83 3d 50 e0 4e 0e 00 75 13 48 8d 3d 43 f7 51 0e 48 c7 c6 8b 3a de 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f RSP: 0018:ffffc9000c767680 EFLAGS: 00010046 RAX: 0000000000000001 RBX: 0000000000040000 RCX: 0000000000080000 RDX: ffffc90013080000 RSI: ffffffff8dde3a8b RDI: ffffffff8ff24ca0 RBP: 0000000000000003 R08: ffffffff8fef35a3 R09: 1ffffffff1fde6b4 R10: dffffc0000000000 R11: fffffbfff1fde6b5 R12: 00000000000012a2 R13: ffff888030338ba8 R14: ffff888030338000 R15: ffff888030338b30 FS: 00007fa5995f66c0(0000) GS:ffff8881256f8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e72f842d0 CR3: 00000000485a0000 CR4: 00000000003526f0 Call Trace: <TASK> lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868 touch_wq_lockdep_map+0xcb/0x180 kernel/workqueue.c:3940 __flush_workqueue+0x14b/0x14f0 kernel/workqueue.c:3982 nci_close_device+0x302/0x630 net/nfc/nci/core.c:567 nci_dev_down+0x3b/0x50 net/nfc/nci/core.c:639 nfc_dev_down+0x152/0x290 net/nfc/core.c:161 nfc_rfkill_set_block+0x2d/0x100 net/nfc/core.c:179 rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346 rfkill_fop_write+0x461/0x5a0 net/rfkill/core.c:1301 vfs_write+0x29a/0xb90 fs/read_write.c:684 ksys_write+0x150/0x270 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa59b39acb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa5995f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa59b615fa0 RCX: 00007fa59b39acb9 RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000007 RBP: 00007fa59b408bf7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa59b616038 R14: 00007fa59b615fa0 R15: 00007ffc82218788 </TASK>
--- include/net/nfc/nfc.h | 2 ++ net/nfc/core.c | 27 ++++++++++++++++++++++++--- net/nfc/nci/core.c | 4 +++- 3 files changed, 29 insertions(+), 4 deletions(-)
include/net/nfc/nfc.h +2 -0
@@ -215,6 +215,8 @@ static inline void nfc_free_device(struct nfc_dev *dev)int nfc_register_device (struct nfc_dev *dev); +void nfc_unregister_rfkill (struct nfc_dev *dev); +void nfc_remove_device (struct nfc_dev *dev);void nfc_unregister_device (struct nfc_dev *dev);/**
net/nfc/core.c +24 -3
@@ -1147,14 +1147,14 @@ int nfc_register_device(struct nfc_dev *dev)EXPORT_SYMBOL (nfc_register_device);/** -* nfc_unregister_device - unregister a nfc device in the nfc subsystem +* nfc_unregister_rfkill - unregister a nfc device in the rfkill subsystem * * @dev: The nfc device to unregister */ -void nfc_unregister_device (struct nfc_dev *dev) +void nfc_unregister_rfkill (struct nfc_dev *dev) { -int rc;struct rfkill *rfk =NULL ; +int rc;pr_debug ("dev_name=%s\n" ,dev_name (&dev->dev));
@@ -1175,7 +1175,16 @@ void nfc_unregister_device(struct nfc_dev *dev)rfkill_unregister (rfk);rfkill_destroy (rfk); } +} +EXPORT_SYMBOL (nfc_unregister_rfkill); +/** +* nfc_remove_device - remove a nfc device in the nfc subsystem +* +* @dev: The nfc device to remove +*/ +void nfc_remove_device (struct nfc_dev *dev) +{if (dev->ops->check_presence) {del_timer_sync (&dev->check_pres_timer);cancel_work_sync (&dev->check_pres_work);
@@ -1188,6 +1197,18 @@ void nfc_unregister_device(struct nfc_dev *dev)device_del (&dev->dev);mutex_unlock (&nfc_devlist_mutex); } +EXPORT_SYMBOL (nfc_remove_device); + +/** +* nfc_unregister_device - unregister a nfc device in the nfc subsystem +* +* @dev: The nfc device to unregister +*/ +void nfc_unregister_device (struct nfc_dev *dev) +{ +nfc_unregister_rfkill (dev); +nfc_remove_device (dev); +}EXPORT_SYMBOL (nfc_unregister_device);static int __init nfc_init (void )
net/nfc/nci/core.c +3 -1
@@ -1295,6 +1295,8 @@ void nci_unregister_device(struct nci_dev *ndev) {struct nci_conn_info *conn_info, *n; +nfc_unregister_rfkill (ndev->nfc_dev); +/* This set_bit is not protected with specialized barrier, * However, it is fine because the mutex_lock(&ndev->req_lock); * in nci_close_device() will help to emit one.
@@ -1312,7 +1314,7 @@ void nci_unregister_device(struct nci_dev *ndev)/* conn_info is allocated with devm_kzalloc */ } -nfc_unregister_device (ndev->nfc_dev); +nfc_remove_device (ndev->nfc_dev); }EXPORT_SYMBOL (nci_unregister_device);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 147/206 net: bridge: fix static key check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit cc0cf10fdaeadf5542d64a55b5b4120d3df90b7d ]
Fix the check if netfilter's static keys are available. netfilter defines and exports static keys if CONFIG_JUMP_LABEL is enabled. (HAVE_JUMP_LABEL is never defined.)
--- net/bridge/br_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_input.c +1 -1
@@ -225,7 +225,7 @@ static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)int ret; net =dev_net (skb->dev); -#ifdef HAVE_JUMP_LABEL +#ifdef CONFIG_JUMP_LABEL if (!static_key_false (&nf_hooks_needed[NFPROTO_BRIDGE ][NF_BR_PRE_ROUTING ])) goto frame_finish;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 148/206 scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit b2d6b1d443009ed4da2d69f5423ab38e5780505a ]
The code in sbp_make_tpg() limits "tpgt" to UINT_MAX but the data type of "tpg->tport_tpgt" is u16. This causes a type truncation issue.
When a user creates a TPG via configfs mkdir, for example:
mkdir /sys/kernel/config/target/sbp/<wwn>/tpgt_70000
The value 70000 passes the "tpgt > UINT_MAX" check since 70000 is far less than 4294967295. However, when assigned to the u16 field tpg->tport_tpgt, the value is silently truncated to 4464 (70000 & 0xFFFF). This causes the value the user specified to differ from what is actually stored, leading to confusion and potential unexpected behavior.
Fix this by changing the type of "tpgt" to u16 and using kstrtou16() which will properly reject values outside the u16 range.
--- drivers/target/sbp/sbp_target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/target/sbp/sbp_target.c +2 -2
@@ -1986,12 +1986,12 @@ static struct se_portal_group *sbp_make_tpg(struct se_wwn *wwn, container_of(wwn, struct sbp_tport, tport_wwn);struct sbp_tpg *tpg; -unsigned long tpgt; +u16 tpgt;int ret;if (strstr (name,"tpgt_" ) != name)return ERR_PTR (-EINVAL ); -if (kstrtoul (name +5 ,10 , &tpgt) || tpgt >UINT_MAX ) +if (kstrtou16 (name +5 ,10 , &tpgt))return ERR_PTR (-EINVAL );if (tport->tpg) {
Signature · 1 line
2.51.0