6.18.10-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.18.10-rc1 review
This is the start of the stable review cycle for the 6.18.10 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 11 Feb 2026 14:22:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.10-rc1
Nathan Chancellor <[email protected]>
riscv: Add intermediate cast to 'unsigned long' in __get_user_asm
Takashi Iwai <[email protected]>
ALSA: usb-audio: Use the right limit for PCM OOB check
Werner Sembach <[email protected]>
ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
Vishwaroop A <[email protected]>
spi: tegra114: Preserve SPI mode bits in def_command1_reg
Felix Gu <[email protected]>
spi: tegra: Fix a memory leak in tegra_slink_probe()
Breno Leitao <[email protected]>
spi: tegra210-quad: Protect curr_xfer check in IRQ handler
Breno Leitao <[email protected]>
spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer
Breno Leitao <[email protected]>
spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
Breno Leitao <[email protected]>
spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one
Breno Leitao <[email protected]>
spi: tegra210-quad: Move curr_xfer read inside spinlock
Breno Leitao <[email protected]>
spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer
Guodong Xu <[email protected]>
regulator: spacemit-p1: Fix n_voltages for BUCK and LDO regulators
LI Qingwu <[email protected]>
i2c: imx: preserve error state in block data length handler
Chen Ni <[email protected]>
gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()
Chris Bainbridge <[email protected]>
ASoC: amd: fix memory leak in acp3x pdm dma ops
Sergey Shtylyov <[email protected]>
ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
Richard Fitzgerald <[email protected]>
firmware: cs_dsp: rate-limit log messages in KUnit builds
Richard Fitzgerald <[email protected]>
firmware: cs_dsp: Factor out common debugfs string read
Shigeru Yoshida <[email protected]>
ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
Keith Busch <[email protected]>
nvme-pci: handle changing device dma map requirements
Daniele Ceraolo Spurio <[email protected]>
drm/xe/guc: Fix CFI violation in debugfs access.
Andrew Fasano <[email protected]>
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
Arnd Bergmann <[email protected]>
hwmon: (occ) Mark occ_init_attribute() as __printf
Karthik Poosa <[email protected]>
drm/xe/pm: Disable D3Cold for BMG only on specific platforms
Shuicheng Lin <[email protected]>
drm/xe/query: Fix topology query pointer advance
Jacob Keller <[email protected]>
drm/mgag200: fix mgag200_bmc_stop_scanout()
Paolo Abeni <[email protected]>
net: gro: fix outer network offset
Eric Dumazet <[email protected]>
net: add proper RCU protection to /proc/net/ptype
Chen Ni <[email protected]>
net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi()
Melissa Wen <[email protected]>
drm/amd/display: fix wrong color value mapping on MCM shaper LUT
Miri Korenblit <[email protected]>
wifi: iwlwifi: mvm: pause TCM on fast resume
Miri Korenblit <[email protected]>
wifi: iwlwifi: mld: cancel mlo_scan_start_wk
Claudiu Manoil <[email protected]>
net: enetc: Convert 16-bit register reads to 32-bit for ENETC v4
Claudiu Manoil <[email protected]>
net: enetc: Convert 16-bit register writes to 32-bit for ENETC v4
Claudiu Manoil <[email protected]>
net: enetc: Remove CBDR cacheability AXI settings for ENETC v4
Claudiu Manoil <[email protected]>
net: enetc: Remove SI/BDR cacheability AXI settings for ENETC v4
Daniel Hodges <[email protected]>
tipc: use kfree_sensitive() for session key material
Jakub Kicinski <[email protected]>
net: rss: fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for contexts
Jiayuan Chen <[email protected]>
linkwatch: use __dev_put() in callers to prevent UAF
Pavel Begunkov <[email protected]>
io_uring/zcrx: fix page array leak
Jakub Kicinski <[email protected]>
net: don't touch dev->stats in BPF redirect paths
Rafael J. Wysocki <[email protected]>
hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()
Sergey Senozhatsky <[email protected]>
net: usb: r8152: fix resume reset deadlock
Eric Dumazet <[email protected]>
macvlan: fix error recovery in macvlan_common_newlink()
Marek Behún <[email protected]>
net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
Mohammad Heib <[email protected]>
i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
Mohammad Heib <[email protected]>
ice: drop udp_tunnel_get_rx_info() call from ndo_open()
Aaron Ma <[email protected]>
ice: Fix PTP NULL pointer dereference during VSI rebuild
Jacob Keller <[email protected]>
ice: PTP: fix missing timestamps on E825 hardware
Grzegorz Nitka <[email protected]>
ice: fix missing TX timestamps interrupts on E825 devices
Junrui Luo <[email protected]>
dpaa2-switch: add bounds check for if_id in IRQ handler
Zilin Guan <[email protected]>
net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
Zilin Guan <[email protected]>
net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
Zilin Guan <[email protected]>
net: liquidio: Initialize netdev pointer before queue setup
Junrui Luo <[email protected]>
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
Eric Dumazet <[email protected]>
net/sched: cls_u32: use skb_header_pointer_careful()
Eric Dumazet <[email protected]>
net: add skb_header_pointer_careful() helper
[email protected] <[email protected]>
hwmon: (dell-smm) Add Dell G15 5510 to fan control whitelist
ChenXiaoSong <[email protected]>
smb/client: fix memory leak in smb2_open_file()
Ricardo Neri <[email protected]>
platform/x86/intel/tpmi/plr: Make the file domain<n>/status writeable
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Skip empty attribute names
Kaushlendra Kumar <[email protected]>
platform/x86: intel_telemetry: Fix PSS event register mask
Rafael J. Wysocki <[email protected]>
platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
Alex Deucher <[email protected]>
Revert "drm/amd/display: pause the workload setting in dm"
Ian Rogers <[email protected]>
tracing: Avoid possible signed 64-bit truncation
Martin Hamilton <[email protected]>
ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
Qu Wenruo <[email protected]>
btrfs: reject new transactions if the fs is fully read-only
Miri Korenblit <[email protected]>
wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
Edward Adam Davis <[email protected]>
btrfs: sync read disk super and set block size
Miri Korenblit <[email protected]>
wifi: mac80211: correctly check if CSA is active
Qiang Ma <[email protected]>
btrfs: fix Wmaybe-uninitialized warning in replay_one_buffer()
Maurizio Lombardi <[email protected]>
scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
Tim Guttzeit <[email protected]>
ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
Jens Axboe <[email protected]>
io_uring/rw: free potentially allocated iovec on cache put failure
Nathan Chancellor <[email protected]>
riscv: Use 64-bit variable for output in __get_user_asm
Maurizio Lombardi <[email protected]>
scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
Veerendranath Jakkam <[email protected]>
wifi: cfg80211: Fix bitrate calculation overflow for HE rates
Alan Borzeszkowski <[email protected]>
spi: intel-pci: Add support for Nova Lake SPI serial flash
Lianqin Hu <[email protected]>
ALSA: usb-audio: Add delay quirk for MOONDROP Moonriver2 Ti
Kaushlendra Kumar <[email protected]>
regmap: maple: free entry on mas_store_gfp() failure
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
Shenghao Ding <[email protected]>
ALSA: hda/tas2781: Add newly-released HP laptop
Dimitrios Katsaros <[email protected]>
ASoC: tlv320adcx140: Propagate error codes during probe
Radhi Bajahaw <[email protected]>
ASoC: amd: yc: Fix microphone on ASUS M6500RE
Hannes Reinecke <[email protected]>
nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
Edward Adam Davis <[email protected]>
ALSA: usb-audio: Prevent excessive number of frames
Chaitanya Kulkarni <[email protected]>
nvme-fc: release admin tagset if init fails
Shengjiu Wang <[email protected]>
ASoC: simple-card-utils: Check device node before overwrite direction
Kery Qi <[email protected]>
ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
Guodong Xu <[email protected]>
dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
Deep Harsora <[email protected]>
ASoC: Intel: sof_sdw: Add new quirks for PTL on Dell with CS42L43
Baochen Qiang <[email protected]>
wifi: mac80211: collect station statistics earlier when disconnect
Arnoud Willemsen <[email protected]>
HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)
Dennis Marttinen <[email protected]>
HID: logitech: add HID++ support for Logitech MX Anywhere 3S
Martin Kaiser <[email protected]>
riscv: trace: fix snapshot deadlock with sbi ecall
Wupeng Ma <[email protected]>
ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
Perry Yuan <[email protected]>
drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
Rodrigo Lugathe da Conceição Alves <[email protected]>
HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
Even Xu <[email protected]>
HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer
Kwok Kin Ming <[email protected]>
HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
Chris Chiu <[email protected]>
HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
Nathan Chancellor <[email protected]>
drm/amd/display: Reduce number of arguments of dcn30's CalculatePrefetchSchedule()
Daniel Gomez <[email protected]>
netfilter: replace -EEXIST with -EBUSY
Manivannan Sadhasivam <[email protected]>
PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
Ruslan Krupitsa <[email protected]>
ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
Brendan Jackman <[email protected]>
x86/sev: Disable GCOV on noinstr object
Matouš Lánský <[email protected]>
ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
Siarhei Vishniakou <[email protected]>
HID: playstation: Center initial joystick axes to prevent spurious events
Zhang Lixu <[email protected]>
HID: intel-ish-hid: Reset enum_devices_done before enumeration
Lukas Gerlach <[email protected]>
riscv: Sanitize syscall table indexing under speculation
Filipe Manana <[email protected]>
btrfs: fix reservation leak in some error paths when inserting inline extent
DaytonCL <[email protected]>
HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
Zhang Lixu <[email protected]>
HID: intel-ish-hid: Update ishtp bus match to support device ID table
Filipe Manana <[email protected]>
btrfs: do not free data reservation in fallback from inline due to -ENOSPC
ZhangGuoDong <[email protected]>
smb/server: fix refcount leak in parse_durable_handle_context()
Chenghao Duan <[email protected]>
LoongArch: Enable exception fixup for specific ADE subcode
Alexandre Negrel <[email protected]>
io_uring: use GFP_NOWAIT for overflow CQEs on legacy rings
ZhangGuoDong <[email protected]>
smb/server: fix refcount leak in smb2_open()
FengWei Shih <[email protected]>
md: suspend array while updating raid_disks via sysfs
Huacai Chen <[email protected]>
LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
ZhangGuoDong <[email protected]>
smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
shechenglong <[email protected]>
block,bfq: fix aux stat accumulation destination
Dmytro Bagrii <[email protected]>
platform/x86: dell-lis3lv02d: Add Latitude 5400
Yao Zi <[email protected]>
wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP
Ethan Nelson-Moore <[email protected]>
net: usb: sr9700: support devices with virtual driver CD
Johannes Berg <[email protected]>
wifi: mac80211: don't WARN for connections on invalid channels
Peter Åstrand <[email protected]>
wifi: wlcore: ensure skb headroom before skb_push
Moon Hee Lee <[email protected]>
wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
Steven Rostedt <[email protected]>
tracing: Fix ftrace event field alignments
Carlos Llamas <[email protected]>
binderfs: fix ida_alloc_max() upper bound
Carlos Llamas <[email protected]>
binder: fix BR_FROZEN_REPLY error log
Carlos Llamas <[email protected]>
binder: fix UAF in binder_netlink_report()
Carlos Llamas <[email protected]>
rust_binderfs: fix ida_alloc_max() upper bound
Alice Ryhl <[email protected]>
rust_binder: add additional alignment checks
Alice Ryhl <[email protected]>
rust_binder: correctly handle FDA objects of length zero
Peter Zijlstra <[email protected]>
sched/fair: Have SD_SERIALIZE affect newidle balancing
Tim Chen <[email protected]>
sched/fair: Skip sched_balance_running cmpxchg when balance is not due
Daniele Palmas <[email protected]>
bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
Lukas Wunner <[email protected]>
treewide: Drop pci_save_state() after pci_restore_state()
Lukas Wunner <[email protected]>
PCI/ERR: Ensure error recoverability at all times
Gabor Juhos <[email protected]>
hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled
Gabor Juhos <[email protected]>
hwmon: (gpio-fan) Fix set_rpm() return value
Sean Christopherson <[email protected]>
KVM: Don't clobber irqfd routing type when deassigning irqfd
Zhiquan Li <[email protected]>
KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures
Tomas Hlavacek <[email protected]>
net: spacemit: k1-emac: fix jumbo frame support
Kevin Hao <[email protected]>
net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
Kevin Hao <[email protected]>
net: cpsw: Execute ndo_set_rx_mode callback in a work queue
Dave Airlie <[email protected]>
nouveau/gsp: fix suspend/resume regression on r570 firmware
Dave Airlie <[email protected]>
nouveau/gsp: use rpc sequence numbers properly.
Dave Airlie <[email protected]>
nouveau: add a third state to the fini handler.
Bert Karwatzki <[email protected]>
Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
Kairui Song <[email protected]>
mm, shmem: prevent infinite loop on truncate race
Max Yuan <[email protected]>
gve: Correct ethtool rx_dropped calculation
Debarghya Kundu <[email protected]>
gve: Fix stats report corruption on queue count change
Mario Limonciello <[email protected]>
drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52
Chen Ridong <[email protected]>
cgroup/dmem: avoid pool UAF
Chen Ridong <[email protected]>
cgroup/dmem: avoid rcu warning when unregister region
Chen Ridong <[email protected]>
cgroup/dmem: fix NULL pointer dereference when setting max
Daniel Vogelbacher <[email protected]>
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
Thomas Weissschuh <[email protected]>
ARM: 9468/1: fix memset64() on big-endian
Ilya Dryomov <[email protected]>
rbd: check for EOD after exclusive lock is ensured to be held
Viacheslav Dubeyko <[email protected]>
ceph: fix NULL pointer dereference in ceph_mds_auth_match()
Hao Ge <[email protected]>
mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
Andrii Nakryiko <[email protected]>
procfs: avoid fetching build ID while holding VMA lock
Xu Yang <[email protected]>
pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
Xu Yang <[email protected]>
pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup
Jacky Bai <[email protected]>
pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset
Xu Yang <[email protected]>
pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup
Gabor Juhos <[email protected]>
pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state
Takashi Iwai <[email protected]>
ALSA: aloop: Fix racy access at PCM trigger
Kaushlendra Kumar <[email protected]>
platform/x86: intel_telemetry: Fix swapped arrays in PSS output
Sean Christopherson <[email protected]>
KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps()
Andrew Cooper <[email protected]>
x86/kfence: fix booting on 32bit non-PAE systems
Josh Poimboeuf <[email protected]>
x86/vmware: Fix hypercall clobbers
YunJe Shin <[email protected]>
nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
-------------
Diffstat:
Makefile | 4 +- arch/arm/include/asm/string.h | 5 +- arch/loongarch/kernel/traps.c | 5 + arch/loongarch/mm/cache.c | 8 +- arch/riscv/include/asm/uaccess.h | 14 +- arch/riscv/kernel/Makefile | 15 +- arch/riscv/kernel/traps.c | 4 +- arch/x86/coco/sev/Makefile | 2 + arch/x86/include/asm/kfence.h | 7 +- arch/x86/include/asm/vmware.h | 4 +- arch/x86/kvm/svm/svm.c | 2 + arch/x86/kvm/vmx/vmx.c | 2 + arch/x86/kvm/x86.c | 30 +-- arch/x86/kvm/x86.h | 2 + block/bfq-cgroup.c | 2 +- drivers/android/binder.c | 19 +- drivers/android/binder/rust_binderfs.c | 8 +- drivers/android/binder/thread.rs | 109 +++++---- drivers/android/binderfs.c | 8 +- drivers/base/regmap/regcache-maple.c | 11 +- drivers/block/rbd.c | 33 ++- drivers/bus/mhi/host/pci_generic.c | 13 ++ drivers/crypto/intel/qat/qat_common/adf_aer.c | 2 - drivers/dma/ioat/init.c | 1 - drivers/dma/mmp_pdma.c | 6 + drivers/firmware/cirrus/cs_dsp.c | 82 +++++-- drivers/firmware/cirrus/cs_dsp.h | 18 ++ drivers/firmware/cirrus/test/cs_dsp_test_bin.c | 22 +- .../firmware/cirrus/test/cs_dsp_test_bin_error.c | 24 +- drivers/firmware/cirrus/test/cs_dsp_test_wmfw.c | 26 ++- .../firmware/cirrus/test/cs_dsp_test_wmfw_error.c | 24 +- drivers/firmware/cirrus/test/cs_dsp_tests.c | 1 + drivers/gpio/gpio-loongson-64bit.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 - drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 11 - .../gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 7 +- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 258 ++++++--------------- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 7 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 9 +- drivers/gpu/drm/mgag200/mgag200_bmc.c | 31 +-- drivers/gpu/drm/mgag200/mgag200_drv.h | 6 + drivers/gpu/drm/nouveau/include/nvif/client.h | 2 +- drivers/gpu/drm/nouveau/include/nvif/driver.h | 2 +- drivers/gpu/drm/nouveau/include/nvkm/core/device.h | 3 +- drivers/gpu/drm/nouveau/include/nvkm/core/engine.h | 2 +- drivers/gpu/drm/nouveau/include/nvkm/core/object.h | 5 +- drivers/gpu/drm/nouveau/include/nvkm/core/oproxy.h | 2 +- drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h | 4 +- .../drm/nouveau/include/nvkm/core/suspend_state.h | 11 + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 6 + drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_nvif.c | 10 +- drivers/gpu/drm/nouveau/nvif/client.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/engine.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/ioctl.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/object.c | 20 +- drivers/gpu/drm/nouveau/nvkm/core/oproxy.c | 2 +- drivers/gpu/drm/nouveau/nvkm/core/subdev.c | 18 +- drivers/gpu/drm/nouveau/nvkm/core/uevent.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ce/ga100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ce/priv.h | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 22 +- drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/device/priv.h | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/user.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/chan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/falcon.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv04.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv10.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.h | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/sec2/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/xtensa.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/devinit/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/fault/user.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gpio/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/gh100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h | 8 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/fbsr.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 8 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 6 + .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c | 8 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 2 +- drivers/gpu/drm/xe/xe_guc.c | 6 +- drivers/gpu/drm/xe/xe_guc.h | 2 +- drivers/gpu/drm/xe/xe_pm.c | 13 +- drivers/gpu/drm/xe/xe_query.c | 2 +- drivers/hid/hid-elecom.c | 15 +- drivers/hid/hid-ids.h | 7 +- drivers/hid/hid-logitech-hidpp.c | 2 + drivers/hid/hid-multitouch.c | 1 + drivers/hid/hid-playstation.c | 5 + drivers/hid/hid-quirks.c | 5 +- drivers/hid/i2c-hid/i2c-hid-core.c | 1 + drivers/hid/intel-ish-hid/ishtp-hid-client.c | 1 + drivers/hid/intel-ish-hid/ishtp/bus.c | 12 +- .../hid/intel-thc-hid/intel-thc/intel-thc-dma.c | 5 + drivers/hwmon/acpi_power_meter.c | 17 +- drivers/hwmon/dell-smm-hwmon.c | 8 + drivers/hwmon/gpio-fan.c | 6 +- drivers/hwmon/occ/common.c | 1 + drivers/i2c/busses/i2c-imx.c | 3 +- drivers/md/md.c | 4 +- drivers/net/ethernet/adi/adin1110.c | 3 + drivers/net/ethernet/broadcom/bnx2.c | 2 - drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 1 - drivers/net/ethernet/broadcom/tg3.c | 1 - drivers/net/ethernet/cavium/liquidio/lio_main.c | 39 ++-- drivers/net/ethernet/cavium/liquidio/lio_vf_main.c | 4 +- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 1 - drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 - .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 10 + drivers/net/ethernet/freescale/enetc/enetc.c | 11 +- drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 6 +- drivers/net/ethernet/freescale/enetc/enetc_cbdr.c | 4 - drivers/net/ethernet/freescale/enetc/enetc_hw.h | 17 +- drivers/net/ethernet/google/gve/gve_ethtool.c | 77 +++--- drivers/net/ethernet/google/gve/gve_main.c | 4 +- drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 1 - drivers/net/ethernet/intel/e1000e/netdev.c | 1 - drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 6 - drivers/net/ethernet/intel/i40e/i40e_main.c | 2 - drivers/net/ethernet/intel/ice/ice_main.c | 28 +-- drivers/net/ethernet/intel/ice/ice_ptp.c | 179 ++++++++------ drivers/net/ethernet/intel/ice/ice_ptp.h | 18 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 2 - drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 1 - drivers/net/ethernet/mellanox/mlx4/main.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 - drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 1 - drivers/net/ethernet/microchip/lan743x_main.c | 1 - drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 4 - drivers/net/ethernet/neterion/s2io.c | 1 - drivers/net/ethernet/spacemit/k1_emac.c | 21 +- drivers/net/ethernet/ti/cpsw.c | 41 +++- drivers/net/ethernet/ti/cpsw_new.c | 34 ++- drivers/net/ethernet/ti/cpsw_priv.h | 1 + drivers/net/macvlan.c | 5 +- drivers/net/phy/sfp.c | 2 + drivers/net/usb/r8152.c | 29 +-- drivers/net/usb/sr9700.c | 5 + drivers/net/wireless/intel/iwlwifi/mld/iface.c | 2 - drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 + drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 7 + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 7 + drivers/net/wireless/ti/wlcore/tx.c | 5 + drivers/nvme/host/fc.c | 2 + drivers/nvme/host/pci.c | 45 ++-- drivers/nvme/target/tcp.c | 26 ++- drivers/pci/bus.c | 3 + drivers/pci/controller/dwc/pcie-qcom.c | 4 +- drivers/pci/pci.c | 3 - drivers/pci/pcie/portdrv.c | 1 - drivers/platform/x86/dell/dell-lis3lv02d.c | 1 + drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 5 + drivers/platform/x86/intel/plr_tpmi.c | 2 +- drivers/platform/x86/intel/telemetry/debugfs.c | 4 +- drivers/platform/x86/intel/telemetry/pltdrv.c | 2 +- drivers/platform/x86/toshiba_haps.c | 2 +- drivers/pmdomain/imx/gpcv2.c | 8 +- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 2 +- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 30 +++ drivers/pmdomain/qcom/rpmpd.c | 2 +- drivers/regulator/spacemit-p1.c | 6 +- drivers/scsi/bfa/bfad.c | 1 - drivers/scsi/csiostor/csio_init.c | 1 - drivers/scsi/ipr.c | 1 - drivers/scsi/lpfc/lpfc_init.c | 6 - drivers/scsi/qla2xxx/qla_os.c | 5 - drivers/scsi/qla4xxx/ql4_os.c | 5 - drivers/spi/spi-hisi-kunpeng.c | 4 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-tegra114.c | 3 + drivers/spi/spi-tegra20-slink.c | 6 +- drivers/spi/spi-tegra210-quad.c | 56 ++++- drivers/target/iscsi/iscsi_target_util.c | 10 +- drivers/tty/serial/8250/8250_pci.c | 1 - drivers/tty/serial/jsm/jsm_driver.c | 1 - fs/btrfs/disk-io.c | 13 ++ fs/btrfs/fs.h | 8 + fs/btrfs/inode.c | 22 +- fs/btrfs/tree-log.c | 2 +- fs/btrfs/volumes.c | 2 + fs/ceph/crypto.c | 9 +- fs/ceph/mds_client.c | 5 +- fs/ceph/mdsmap.c | 26 ++- fs/ceph/mdsmap.h | 1 + fs/ceph/super.h | 16 +- fs/proc/task_mmu.c | 42 ++-- fs/smb/client/smb2file.c | 1 + fs/smb/server/smb2pdu.c | 8 +- include/linux/buildid.h | 3 + include/linux/ceph/ceph_fs.h | 6 + include/linux/firmware/cirrus/cs_dsp.h | 4 +- include/linux/skbuff.h | 12 + io_uring/io_uring.c | 2 +- io_uring/rw.c | 15 +- io_uring/zcrx.c | 1 + kernel/cgroup/dmem.c | 70 +++++- kernel/sched/fair.c | 54 ++--- kernel/trace/ring_buffer.c | 2 + kernel/trace/trace.c | 8 +- kernel/trace/trace.h | 7 +- kernel/trace/trace_entries.h | 32 +-- kernel/trace/trace_export.c | 21 +- lib/buildid.c | 42 +++- mm/shmem.c | 23 +- mm/slub.c | 6 +- net/bridge/netfilter/ebtables.c | 2 +- net/core/filter.c | 8 +- net/core/gro.c | 2 + net/core/link_watch.c | 20 +- net/core/net-procfs.c | 50 ++-- net/ethtool/common.c | 3 - net/ethtool/rss.c | 9 +- net/ipv6/ip6_fib.c | 3 +- net/mac80211/iface.c | 8 +- net/mac80211/key.c | 3 +- net/mac80211/mlme.c | 5 +- net/mac80211/ocb.c | 3 + net/mac80211/sta_info.c | 7 +- net/netfilter/nf_log.c | 4 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/x_tables.c | 2 +- net/sched/cls_u32.c | 13 +- net/tipc/crypto.c | 4 +- net/wireless/util.c | 8 +- sound/drivers/aloop.c | 62 ++--- sound/hda/codecs/realtek/alc269.c | 27 ++- sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 5 +- sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/tlv320adcx140.c | 3 + sound/soc/generic/simple-card-utils.c | 4 +- sound/soc/intel/boards/sof_sdw.c | 8 + sound/soc/ti/davinci-evm.c | 39 +++- sound/usb/mixer_quirks.c | 9 +- sound/usb/pcm.c | 3 +- sound/usb/quirks.c | 2 + tools/testing/selftests/kvm/Makefile.kvm | 1 + virt/kvm/eventfd.c | 44 ++-- 265 files changed, 1872 insertions(+), 1033 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/175 nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: YunJe Shin <[email protected]>
commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c upstream.
nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.
--- drivers/nvme/target/tcp.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/nvme/target/tcp.c +17 -0
@@ -349,11 +349,14 @@ static void nvmet_tcp_free_cmd_buffers(s cmd->req.sg =NULL ; } +static void nvmet_tcp_fatal_error (struct nvmet_tcp_queue *queue); +static void nvmet_tcp_build_pdu_iovec (struct nvmet_tcp_cmd *cmd) {struct bio_vec *iov = cmd->iov;struct scatterlist *sg;u32 length, offset, sg_offset; +unsigned int sg_remaining;int nr_pages; length = cmd->pdu_len;
@@ -361,9 +364,22 @@ static void nvmet_tcp_build_pdu_iovec(st offset = cmd->rbytes_done; cmd->sg_idx = offset /PAGE_SIZE ; sg_offset = offset %PAGE_SIZE ; +if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) { +nvmet_tcp_fatal_error (cmd->queue); +return ; + } sg = &cmd->req.sg[cmd->sg_idx]; + sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;while (length) { +if (!sg_remaining) { +nvmet_tcp_fatal_error (cmd->queue); +return ; + } +if (!sg->length || sg->length <= sg_offset) { +nvmet_tcp_fatal_error (cmd->queue); +return ; + }u32 iov_len =min_t (u32, length, sg->length - sg_offset); bvec_set_page(iov, sg_page(sg), iov_len,
@@ -371,6 +387,7 @@ static void nvmet_tcp_build_pdu_iovec(st length -= iov_len; sg =sg_next (sg); + sg_remaining--; iov++; sg_offset =0 ; }
Greg Kroah-Hartman
maintainerPATCH 2/175 x86/vmware: Fix hypercall clobbers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
commit 2687c848e57820651b9f69d30c4710f4219f7dbf upstream.
Fedora QA reported the following panic:
BUG: unable to handle page fault for address: 0000000040003e54 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20251119-3.fc43 11/19/2025 RIP: 0010:vmware_hypercall4.constprop.0+0x52/0x90 .. Call Trace: vmmouse_report_events+0x13e/0x1b0 psmouse_handle_byte+0x15/0x60 ps2_interrupt+0x8a/0xd0 ...
because the QEMU VMware mouse emulation is buggy, and clears the top 32 bits of %rdi that the kernel kept a pointer in.
The QEMU vmmouse driver saves and restores the register state in a "uint32_t data[6];" and as a result restores the state with the high bits all cleared.
RDI originally contained the value of a valid kernel stack address (0xff5eeb3240003e54). After the vmware hypercall it now contains 0x40003e54, and we get a page fault as a result when it is dereferenced.
The proper fix would be in QEMU, but this works around the issue in the kernel to keep old setups working, when old kernels had not happened to keep any state in %rdi over the hypercall.
In theory this same issue exists for all the hypercalls in the vmmouse driver; in practice it has only been seen with vmware_hypercall3() and vmware_hypercall4(). For now, just mark RDI/RSI as clobbered for those two calls. This should have a minimal effect on code generation overall as it should be rare for the compiler to want to make RDI/RSI live across hypercalls.
--- arch/x86/include/asm/vmware.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/include/asm/vmware.h +2 -2
@@ -140,7 +140,7 @@ unsigned long vmware_hypercall3(unsigned "b" (in1), "c" (cmd), "d" (0) - : "cc", "memory"); + : "di", "si", "cc", "memory");return out0; }
@@ -165,7 +165,7 @@ unsigned long vmware_hypercall4(unsigned "b" (in1), "c" (cmd), "d" (0) - : "cc", "memory"); + : "di", "si", "cc", "memory");return out0; }
Greg Kroah-Hartman
maintainerPATCH 3/175 x86/kfence: fix booting on 32bit non-PAE systems
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Cooper <[email protected]>
commit 16459fe7e0ca6520a6e8f603de4ccd52b90fd765 upstream.
The original patch inverted the PTE unconditionally to avoid L1TF-vulnerable PTEs, but Linux doesn't make this adjustment in 2-level paging.
Adjust the logic to use the flip_protnone_guard() helper, which is a nop on 2-level paging but inverts the address bits in all other paging modes.
This doesn't matter for the Xen aspect of the original change. Linux no longer supports running 32bit PV under Xen, and Xen doesn't support running any 32bit PV guests without using PAE paging.
--- arch/x86/include/asm/kfence.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/x86/include/asm/kfence.h +4 -3
@@ -42,7 +42,7 @@ static inline bool kfence_protect_page(u {unsigned int level;pte_t *pte =lookup_address (addr, &level); -pteval_t val; +pteval_t val, new;if (WARN_ON (!pte || level !=PG_LEVEL_4K ))return false;
@@ -57,11 +57,12 @@ static inline bool kfence_protect_page(ureturn true;/* -* Otherwise, invert the entire PTE. This avoids writing out an +* Otherwise, flip the Present bit, taking care to avoid writing an * L1TF-vulnerable PTE (not present, without the high address bits * set). */ -set_pte (pte,__pte (~val)); + new = val ^ _PAGE_PRESENT; +set_pte (pte,__pte (flip_protnone_guard (val, new,PTE_PFN_MASK )));/* * If the page was protected (non-present) and we're making it
Greg Kroah-Hartman
maintainerPATCH 4/175 KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit f8ade833b733ae0b72e87ac6d2202a1afbe3eb4a upstream.
Explicitly configure KVM's supported XSS as part of each vendor's setup flow to fix a bug where clearing SHSTK and IBT in kvm_cpu_caps, e.g. due to lack of CET XFEATURE support, makes kvm-intel.ko unloadable when nested VMX is enabled, i.e. when nested=1. The late clearing results in nested_vmx_setup_{entry,exit}_ctls() clearing VM_{ENTRY,EXIT}_LOAD_CET_STATE when nested_vmx_setup_ctls_msrs() runs during the CPU compatibility checks, ultimately leading to a mismatched VMCS config due to the reference config having the CET bits set, but every CPU's "local" config having the bits cleared.
Note, kvm_caps.supported_{xcr0,xss} are unconditionally initialized by kvm_x86_vendor_init(), before calling into vendor code, and not referenced between ops->hardware_setup() and their current/old location.
--- arch/x86/kvm/svm/svm.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 2 ++ arch/x86/kvm/x86.c | 30 +++++++++++++++++------------- arch/x86/kvm/x86.h | 2 ++ 4 files changed, 23 insertions(+), 13 deletions(-)
arch/x86/kvm/svm/svm.c +2 -0
@@ -5285,6 +5285,8 @@ static __init void svm_set_cpu_caps(void*/ kvm_cpu_cap_clear (X86_FEATURE_BUS_LOCK_DETECT );kvm_cpu_cap_clear (X86_FEATURE_MSR_IMM ); + +kvm_setup_xss_caps (); }static __init int svm_hardware_setup (void )
arch/x86/kvm/vmx/vmx.c +2 -0
@@ -8021,6 +8021,8 @@ static __init void vmx_set_cpu_caps(voidkvm_cpu_cap_clear (X86_FEATURE_SHSTK );kvm_cpu_cap_clear (X86_FEATURE_IBT ); } + +kvm_setup_xss_caps (); } static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu,
arch/x86/kvm/x86.c +17 -13
@@ -9954,6 +9954,23 @@ static struct notifier_block pvclock_gto };#endif +void kvm_setup_xss_caps (void ) +{ +if (!kvm_cpu_cap_has (X86_FEATURE_XSAVES )) + kvm_caps.supported_xss =0 ; + +if (!kvm_cpu_cap_has (X86_FEATURE_SHSTK ) && + !kvm_cpu_cap_has (X86_FEATURE_IBT )) + kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL ; + +if ((kvm_caps.supported_xss &XFEATURE_MASK_CET_ALL ) !=XFEATURE_MASK_CET_ALL ) { +kvm_cpu_cap_clear (X86_FEATURE_SHSTK ); +kvm_cpu_cap_clear (X86_FEATURE_IBT ); + kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL ; + } +} +EXPORT_SYMBOL_FOR_KVM_INTERNAL (kvm_setup_xss_caps); +static inline void kvm_ops_update (struct kvm_x86_init_ops *ops) {memcpy (&kvm_x86_ops, ops->runtime_ops,sizeof (kvm_x86_ops));
@@ -10132,19 +10149,6 @@ int kvm_x86_vendor_init(struct kvm_x86_iif (!tdp_enabled) kvm_caps.supported_quirks &= ~KVM_X86_QUIRK_IGNORE_GUEST_PAT ; -if (!kvm_cpu_cap_has (X86_FEATURE_XSAVES )) - kvm_caps.supported_xss =0 ; - -if (!kvm_cpu_cap_has (X86_FEATURE_SHSTK ) && - !kvm_cpu_cap_has (X86_FEATURE_IBT )) - kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL ; - -if ((kvm_caps.supported_xss &XFEATURE_MASK_CET_ALL ) !=XFEATURE_MASK_CET_ALL ) { -kvm_cpu_cap_clear (X86_FEATURE_SHSTK ); -kvm_cpu_cap_clear (X86_FEATURE_IBT ); - kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL ; - } -if (kvm_caps.has_tsc_control) {/* * Make sure the user can only configure tsc_khz values that
arch/x86/kvm/x86.h +2 -0
@@ -457,6 +457,8 @@ extern struct kvm_host_values kvm_host;extern bool enable_pmu; +void kvm_setup_xss_caps (void ); +/* * Get a filtered version of KVM's supported XCR0 that strips out dynamic * features for which the current process doesn't (yet) have permission to use.
Greg Kroah-Hartman
maintainerPATCH 5/175 platform/x86: intel_telemetry: Fix swapped arrays in PSS output
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
commit 25e9e322d2ab5c03602eff4fbf4f7c40019d8de2 upstream.
The LTR blocking statistics and wakeup event counters are incorrectly cross-referenced during debugfs output rendering. The code populates pss_ltr_blkd[] with LTR blocking data and pss_s0ix_wakeup[] with wakeup data, but the display loops reference the wrong arrays.
This causes the "LTR Blocking Status" section to print wakeup events and the "Wakes Status" section to print LTR blockers, misleading power management analysis and S0ix residency debugging.
Fix by aligning array usage with the intended output section labels.
--- drivers/platform/x86/intel/telemetry/debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/intel/telemetry/debugfs.c +2 -2
@@ -449,7 +449,7 @@ static int telem_pss_states_show(structfor (index =0 ; index < debugfs_conf->pss_ltr_evts; index++) {seq_printf (s,"%-32s\t%u\n" , debugfs_conf->pss_ltr_data[index].name, - pss_s0ix_wakeup[index]); + pss_ltr_blkd[index]); }seq_puts (s,"\n--------------------------------------\n" );
@@ -459,7 +459,7 @@ static int telem_pss_states_show(structfor (index =0 ; index < debugfs_conf->pss_wakeup_evts; index++) {seq_printf (s,"%-32s\t%u\n" , debugfs_conf->pss_wakeup[index].name, - pss_ltr_blkd[index]); + pss_s0ix_wakeup[index]); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 6/175 ALSA: aloop: Fix racy access at PCM trigger
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 826af7fa62e347464b1b4e0ba2fe19a92438084f upstream.
The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers.
For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF.
--- sound/drivers/aloop.c | 62 +++++++++++++++++++++++++++++--------------------- 1 file changed, 36 insertions(+), 26 deletions(-)
sound/drivers/aloop.c +36 -26
@@ -336,37 +336,43 @@ static bool is_access_interleaved(snd_pcstatic int loopback_check_format (struct loopback_cable *cable,int stream) { +struct loopback_pcm *dpcm_play, *dpcm_capt;struct snd_pcm_runtime *runtime, *cruntime;struct loopback_setup *setup;struct snd_card *card; +bool stop_capture = false;int check; -if (cable->valid !=CABLE_VALID_BOTH ) { -if (stream ==SNDRV_PCM_STREAM_PLAYBACK ) - goto __notify; -return 0 ; - } - runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK ]-> - substream->runtime; - cruntime = cable->streams[SNDRV_PCM_STREAM_CAPTURE ]-> - substream->runtime; - check = runtime->format != cruntime->format || - runtime->rate != cruntime->rate || - runtime->channels != cruntime->channels || -is_access_interleaved (runtime->access) != -is_access_interleaved (cruntime->access); -if (!check) -return 0 ; -if (stream ==SNDRV_PCM_STREAM_CAPTURE ) { -return -EIO ; - }else { -snd_pcm_stop (cable->streams[SNDRV_PCM_STREAM_CAPTURE ]-> - substream,SNDRV_PCM_STATE_DRAINING ); - __notify: - runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK ]-> - substream->runtime; - setup =get_setup (cable->streams[SNDRV_PCM_STREAM_PLAYBACK ]); - card = cable->streams[SNDRV_PCM_STREAM_PLAYBACK ]->loopback->card; + scoped_guard(spinlock_irqsave, &cable->lock) { + dpcm_play = cable->streams[SNDRV_PCM_STREAM_PLAYBACK ]; + dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE ]; + +if (cable->valid !=CABLE_VALID_BOTH ) { +if (stream ==SNDRV_PCM_STREAM_CAPTURE || !dpcm_play) +return 0 ; + }else { +if (!dpcm_play || !dpcm_capt) +return -EIO ; + runtime = dpcm_play->substream->runtime; + cruntime = dpcm_capt->substream->runtime; +if (!runtime || !cruntime) +return -EIO ; + check = runtime->format != cruntime->format || + runtime->rate != cruntime->rate || + runtime->channels != cruntime->channels || +is_access_interleaved (runtime->access) != +is_access_interleaved (cruntime->access); +if (!check) +return 0 ; +if (stream ==SNDRV_PCM_STREAM_CAPTURE ) +return -EIO ; +else if (cruntime->state ==SNDRV_PCM_STATE_RUNNING ) + stop_capture = true; + } + + setup =get_setup (dpcm_play); + card = dpcm_play->loopback->card; + runtime = dpcm_play->substream->runtime;if (setup->format != runtime->format) {snd_ctl_notify (card,SNDRV_CTL_EVENT_MASK_VALUE , &setup->format_id);
@@ -389,6 +395,10 @@ static int loopback_check_format(struct setup->access = runtime->access; } } + +if (stop_capture) +snd_pcm_stop (dpcm_capt->substream,SNDRV_PCM_STATE_DRAINING ); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 7/175 pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 8aa6f7697f5981d336cac7af6ddd182a03c6da01 upstream.
As it is indicated by the comment, the rpmpd_aggregate_corner() function tries to clamp the state to the highest corner/level supported by the given power domain, however the calculation of the highest state contains an off-by-one error.
The 'max_state' member of the 'rpmpd' structure indicates the highest corner/level, and as such it does not needs to be decremented.
Change the code to use the 'max_state' value directly to avoid the error.
--- drivers/pmdomain/qcom/rpmpd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pmdomain/qcom/rpmpd.c +1 -1
@@ -1001,7 +1001,7 @@ static int rpmpd_aggregate_corner(struct/* Clamp to the highest corner/level if sync_state isn't done yet */ if (!pd->state_synced) - this_active_corner = this_sleep_corner = pd->max_state -1 ; + this_active_corner = this_sleep_corner = pd->max_state;else to_active_sleep (pd, pd->corner, &this_active_corner, &this_sleep_corner);
Greg Kroah-Hartman
maintainerPATCH 8/175 pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit e9ab2b83893dd03cf04d98faded81190e635233f upstream.
Current design will power off all dependent GPC power domains in imx8mp_blk_ctrl_suspend(), even though the user device has enabled wakeup capability. The result is that wakeup function never works for such device.
An example will be USB wakeup on i.MX8MP. PHY device '382f0040.usb-phy' is attached to power domain 'hsioblk-usb-phy2' which is spawned by hsio block control. A virtual power domain device 'genpd:3:32f10000.blk-ctrl' is created to build connection with 'hsioblk-usb-phy2' and it depends on GPC power domain 'usb-otg2'. If device '382f0040.usb-phy' enable wakeup, only power domain 'hsioblk-usb-phy2' keeps on during system suspend, power domain 'usb-otg2' is off all the time. So the wakeup event can't happen.
In order to further establish a connection between the power domains related to GPC and block control during system suspend, register a genpd power on/off notifier for the power_dev. This allows us to prevent the GPC power domain from being powered off, in case the block control power domain is kept on to serve system wakeup.
--- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/pmdomain/imx/imx8mp-blk-ctrl.c +26 -0
@@ -65,6 +65,7 @@ struct imx8mp_blk_ctrl_domain {struct icc_bulk_data paths[DOMAIN_MAX_PATHS ];struct device *power_dev;struct imx8mp_blk_ctrl *bc; +struct notifier_block power_nb;int num_paths;int id; };
@@ -594,6 +595,20 @@ static int imx8mp_blk_ctrl_power_off(strreturn 0 ; } +static int imx8mp_blk_ctrl_gpc_notifier (struct notifier_block *nb, +unsigned long action,void *data) +{ +struct imx8mp_blk_ctrl_domain *domain = + container_of(nb, struct imx8mp_blk_ctrl_domain, power_nb); + +if (action ==GENPD_NOTIFY_PRE_OFF ) { +if (domain->genpd.status ==GENPD_STATE_ON ) +return NOTIFY_BAD ; + } + +return NOTIFY_OK ; +} +static struct lock_class_key blk_ctrl_genpd_lock_class;static int imx8mp_blk_ctrl_probe (struct platform_device *pdev)
@@ -698,6 +713,14 @@ static int imx8mp_blk_ctrl_probe(struct goto cleanup_pds; } + domain->power_nb.notifier_call = imx8mp_blk_ctrl_gpc_notifier; + ret =dev_pm_genpd_add_notifier (domain->power_dev, &domain->power_nb); +if (ret) { +dev_err_probe (dev, ret,"failed to add power notifier\n" ); +dev_pm_domain_detach (domain->power_dev, true); + goto cleanup_pds; + } + domain->genpd.name = data->name; domain->genpd.power_on = imx8mp_blk_ctrl_power_on; domain->genpd.power_off = imx8mp_blk_ctrl_power_off;
@@ -707,6 +730,7 @@ static int imx8mp_blk_ctrl_probe(struct ret =pm_genpd_init (&domain->genpd,NULL , true);if (ret) {dev_err_probe (dev, ret,"failed to init power domain\n" ); +dev_pm_genpd_remove_notifier (domain->power_dev);dev_pm_domain_detach (domain->power_dev, true); goto cleanup_pds; }
@@ -755,6 +779,7 @@ cleanup_provider: cleanup_pds:for (i--; i >=0 ; i--) {pm_genpd_remove (&bc->domains[i].genpd); +dev_pm_genpd_remove_notifier (bc->domains[i].power_dev);dev_pm_domain_detach (bc->domains[i].power_dev, true); }
@@ -774,6 +799,7 @@ static void imx8mp_blk_ctrl_remove(strucstruct imx8mp_blk_ctrl_domain *domain = &bc->domains[i];pm_genpd_remove (&domain->genpd); +dev_pm_genpd_remove_notifier (domain->power_dev);dev_pm_domain_detach (domain->power_dev, true); }
Greg Kroah-Hartman
maintainerPATCH 9/175 pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Bai <[email protected]>
commit ae0a24c5a8dcea20bf8e344eadf6593e6d1959c3 upstream.
On i.MX8MM, the GPUMIX, GPU2D, and GPU3D blocks share a common reset domain. Due to this hardware limitation, powering off/on GPU2D or GPU3D also triggers a reset of the GPUMIX domain, including its ADB400 port. However, the ADB400 interface must always be placed into power‑down mode before being reset.
Currently the GPUMIX and GPU2D/3D power domains rely on runtime PM to handle dependency ordering. In some corner cases, the GPUMIX power off sequence is skipped, leaving the ADB400 port active when GPU2D/3D reset. This causes the GPUMIX ADB400 port to be reset while still active, leading to unpredictable bus behavior and GPU hangs.
To avoid this, refine the power‑domain control logic so that the GPUMIX ADB400 port is explicitly powered down and powered up as part of the GPU power domain on/off sequence. This ensures proper ordering and prevents incorrect ADB400 reset.
--- drivers/pmdomain/imx/gpcv2.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/pmdomain/imx/gpcv2.c +2 -6
@@ -165,13 +165,11 @@#define IMX8M_VPU_HSK_PWRDNREQN BIT(5)#define IMX8M_DISP_HSK_PWRDNREQN BIT(4) -#define IMX8MM_GPUMIX_HSK_PWRDNACKN BIT(29) -#define IMX8MM_GPU_HSK_PWRDNACKN (BIT(27) | BIT(28)) +#define IMX8MM_GPU_HSK_PWRDNACKN GENMASK(29, 27)#define IMX8MM_VPUMIX_HSK_PWRDNACKN BIT(26)#define IMX8MM_DISPMIX_HSK_PWRDNACKN BIT(25)#define IMX8MM_HSIO_HSK_PWRDNACKN (BIT(23) | BIT(24)) -#define IMX8MM_GPUMIX_HSK_PWRDNREQN BIT(11) -#define IMX8MM_GPU_HSK_PWRDNREQN (BIT(9) | BIT(10)) +#define IMX8MM_GPU_HSK_PWRDNREQN GENMASK(11, 9)#define IMX8MM_VPUMIX_HSK_PWRDNREQN BIT(8)#define IMX8MM_DISPMIX_HSK_PWRDNREQN BIT(7)#define IMX8MM_HSIO_HSK_PWRDNREQN (BIT(5) | BIT(6))
@@ -794,8 +792,6 @@ static const struct imx_pgc_domain imx8m .bits = { .pxx = IMX8MM_GPUMIX_SW_Pxx_REQ, .map = IMX8MM_GPUMIX_A53_DOMAIN, - .hskreq = IMX8MM_GPUMIX_HSK_PWRDNREQN, - .hskack = IMX8MM_GPUMIX_HSK_PWRDNACKN, }, .pgc = BIT(IMX8MM_PGC_GPUMIX), .keep_clocks = true,
Greg Kroah-Hartman
maintainerPATCH 10/175 pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit e2c4c5b2bbd4f688a0f9f6da26cdf6d723c53478 upstream.
USB system wakeup need its PHY on, so add the GENPD_FLAG_ACTIVE_WAKEUP flags to USB PHY genpd configuration.
--- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pmdomain/imx/imx8mp-blk-ctrl.c +4 -0
@@ -53,6 +53,7 @@ struct imx8mp_blk_ctrl_domain_data {const char *const *path_names;int num_paths;const char *gpc_name; +const unsigned int flags; };#define DOMAIN_MAX_CLKS 3
@@ -265,10 +266,12 @@ static const struct imx8mp_blk_ctrl_doma [IMX8MP_HSIOBLK_PD_USB_PHY1] = { .name = "hsioblk-usb-phy1", .gpc_name = "usb-phy1", + .flags = GENPD_FLAG_ACTIVE_WAKEUP, }, [IMX8MP_HSIOBLK_PD_USB_PHY2] = { .name = "hsioblk-usb-phy2", .gpc_name = "usb-phy2", + .flags = GENPD_FLAG_ACTIVE_WAKEUP, }, [IMX8MP_HSIOBLK_PD_PCIE] = { .name = "hsioblk-pcie",
@@ -724,6 +727,7 @@ static int imx8mp_blk_ctrl_probe(struct domain->genpd.name = data->name; domain->genpd.power_on = imx8mp_blk_ctrl_power_on; domain->genpd.power_off = imx8mp_blk_ctrl_power_off; + domain->genpd.flags = data->flags; domain->bc = bc; domain->id = i;
Greg Kroah-Hartman
maintainerPATCH 11/175 pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 6bd8b4a92a901fae1a422e6f914801063c345e8d upstream.
Fix out-of-range access of bc->domains in imx8m_blk_ctrl_remove().
--- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pmdomain/imx/imx8m-blk-ctrl.c +1 -1
@@ -340,7 +340,7 @@ static void imx8m_blk_ctrl_remove(structof_genpd_del_provider (pdev->dev.of_node); -for (i =0 ; bc->onecell_data.num_domains; i++) { +for (i =0 ; i < bc->onecell_data.num_domains; i++) {struct imx8m_blk_ctrl_domain *domain = &bc->domains[i];pm_genpd_remove (&domain->genpd);
Greg Kroah-Hartman
maintainerPATCH 12/175 procfs: avoid fetching build ID while holding VMA lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
commit b5cbacd7f86f4f62b8813688c8e73be94e8e1951 upstream.
Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock or per-VMA lock, whichever was used to lock VMA under question, to avoid deadlock reported by syzbot:
-> #1 (&mm->mmap_lock){++++}-{4:4}:
__might_fault+0xed/0x170
_copy_to_iter+0x118/0x1720
copy_page_to_iter+0x12d/0x1e0
filemap_read+0x720/0x10a0
blkdev_read_iter+0x2b5/0x4e0
vfs_read+0x7f4/0xae0
ksys_read+0x12a/0x250
do_syscall_64+0xcb/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (&sb->s_type->i_mutex_key#8){++++}-{4:4}:
__lock_acquire+0x1509/0x26d0
lock_acquire+0x185/0x340
down_read+0x98/0x490
blkdev_read_iter+0x2a7/0x4e0
__kernel_read+0x39a/0xa90
freader_fetch+0x1d5/0xa80
__build_id_parse.isra.0+0xea/0x6a0
do_procmap_query+0xd75/0x1050
procfs_procmap_ioctl+0x7a/0xb0
__x64_sys_ioctl+0x18e/0x210
do_syscall_64+0xcb/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7fother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(&mm->mmap_lock);
lock(&sb->s_type->i_mutex_key#8);
lock(&mm->mmap_lock); rlock(&sb->s_type->i_mutex_key#8);
*** DEADLOCK ***
This seems to be exacerbated (as we haven't seen these syzbot reports before that) by the recent:
777a8560fd29 ("lib/buildid: use __kernel_read() for sleepable context")To make this safe, we need to grab file refcount while VMA is still locked, but other than that everything is pretty straightforward. Internal build_id_parse() API assumes VMA is passed, but it only needs the underlying file reference, so just add another variant build_id_parse_file() that expects file passed directly.
--- fs/proc/task_mmu.c | 42 +++++++++++++++++++++++++++--------------- include/linux/buildid.h | 3 +++ lib/buildid.c | 42 ++++++++++++++++++++++++++++++------------ 3 files changed, 60 insertions(+), 27 deletions(-)
fs/proc/task_mmu.c +27 -15
@@ -656,6 +656,7 @@ static int do_procmap_query(struct mm_ststruct proc_maps_locking_ctx lock_ctx = { .mm = mm };struct procmap_query karg;struct vm_area_struct *vma; +struct file *vm_file =NULL ;const char *name =NULL ;char build_id_buf[BUILD_ID_SIZE_MAX ], *name_buf =NULL ;__u64 usize;
@@ -727,21 +728,6 @@ static int do_procmap_query(struct mm_st karg.inode =0 ; } -if (karg.build_id_size) { -__u32 build_id_sz; - - err =build_id_parse (vma, build_id_buf, &build_id_sz); -if (err) { - karg.build_id_size =0 ; - }else { -if (karg.build_id_size < build_id_sz) { - err = -ENAMETOOLONG ; - goto out; - } - karg.build_id_size = build_id_sz; - } - } -if (karg.vma_name_size) {size_t name_buf_sz =min_t (size_t,PATH_MAX , karg.vma_name_size);const struct path *path;
@@ -775,10 +761,34 @@ static int do_procmap_query(struct mm_st karg.vma_name_size = name_sz; } +if (karg.build_id_size && vma->vm_file) + vm_file =get_file (vma->vm_file); +/* unlock vma or mmap_lock, and put mm_struct before copying data to user */ query_vma_teardown (&lock_ctx);mmput (mm); +if (karg.build_id_size) { +__u32 build_id_sz; + +if (vm_file) + err =build_id_parse_file (vm_file, build_id_buf, &build_id_sz); +else + err = -ENOENT ; +if (err) { + karg.build_id_size =0 ; + }else { +if (karg.build_id_size < build_id_sz) { + err = -ENAMETOOLONG ; + goto out; + } + karg.build_id_size = build_id_sz; + } + } + +if (vm_file) +fput (vm_file); +if (karg.vma_name_size &©_to_user (u64_to_user_ptr (karg.vma_name_addr), name, karg.vma_name_size)) {kfree (name_buf);
@@ -798,6 +808,8 @@ static int do_procmap_query(struct mm_st out:query_vma_teardown (&lock_ctx);mmput (mm); +if (vm_file) +fput (vm_file);kfree (name_buf);return err; }
include/linux/buildid.h +3 -0
@@ -7,7 +7,10 @@#define BUILD_ID_SIZE_MAX 20struct vm_area_struct ; +struct file ; +int build_id_parse (struct vm_area_struct *vma,unsigned char *build_id,__u32 *size); +int build_id_parse_file (struct file *file,unsigned char *build_id,__u32 *size);int build_id_parse_nofault (struct vm_area_struct *vma,unsigned char *build_id,__u32 *size);int build_id_parse_buf (const void *buf,unsigned char *build_id,u32 buf_size);
lib/buildid.c +30 -12
74 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 13/175 mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
commit e6c53ead2d8fa73206e0a63e9cd9aea6bc929837 upstream.
When CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the following warning may be noticed:
[ 3959.023862] ------------[ cut here ]------------ [ 3959.023891] alloc_tag was not cleared (got tag for lib/xarray.c:378) [ 3959.023947] WARNING: ./include/linux/alloc_tag.h:155 at alloc_tag_add+0x128/0x178, CPU#6: mkfs.ntfs/113998 [ 3959.023978] Modules linked in: dns_resolver tun brd overlay exfat btrfs blake2b libblake2b xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel ext4 crc16 mbcache jbd2 rfkill sunrpc vfat fat sg fuse nfnetlink sr_mod virtio_gpu cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper ghash_ce drm sm4 backlight virtio_net net_failover virtio_scsi failover virtio_console virtio_blk virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod i2c_dev aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject] [ 3959.024170] CPU: 6 UID: 0 PID: 113998 Comm: mkfs.ntfs Kdump: loaded Tainted: G W 6.19.0-rc7+ #7 PREEMPT(voluntary) [ 3959.024182] Tainted: [W]=WARN [ 3959.024186] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 3959.024192] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3959.024199] pc : alloc_tag_add+0x128/0x178 [ 3959.024207] lr : alloc_tag_add+0x128/0x178 [ 3959.024214] sp : ffff80008b696d60 [ 3959.024219] x29: ffff80008b696d60 x28: 0000000000000000 x27: 0000000000000240 [ 3959.024232] x26: 0000000000000000 x25: 0000000000000240 x24: ffff800085d17860 [ 3959.024245] x23: 0000000000402800 x22: ffff0000c0012dc0 x21: 00000000000002d0 [ 3959.024257] x20: ffff0000e6ef3318 x19: ffff800085ae0410 x18: 0000000000000000 [ 3959.024269] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 3959.024281] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600064101293 [ 3959.024292] x11: 1fffe00064101292 x10: ffff600064101292 x9 : dfff800000000000 [ 3959.024305] x8 : 00009fff9befed6e x7 : ffff000320809493 x6 : 0000000000000001 [ 3959.024316] x5 : ffff000320809490 x4 : ffff600064101293 x3 : ffff800080691838 [ 3959.024328] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d5bcd640 [ 3959.024340] Call trace: [ 3959.024346] alloc_tag_add+0x128/0x178 (P) [ 3959.024355] __alloc_tagging_slab_alloc_hook+0x11c/0x1a8 [ 3959.024362] kmem_cache_alloc_lru_noprof+0x1b8/0x5e8 [ 3959.024369] xas_alloc+0x304/0x4f0 [ 3959.024381] xas_create+0x1e0/0x4a0 [ 3959.024388] xas_store+0x68/0xda8 [ 3959.024395] __filemap_add_folio+0x5b0/0xbd8 [ 3959.024409] filemap_add_folio+0x16c/0x7e0 [ 3959.024416] __filemap_get_folio_mpol+0x2dc/0x9e8 [ 3959.024424] iomap_get_folio+0xfc/0x180 [ 3959.024435] __iomap_get_folio+0x2f8/0x4b8 [ 3959.024441] iomap_write_begin+0x198/0xc18 [ 3959.024448] iomap_write_iter+0x2ec/0x8f8 [ 3959.024454] iomap_file_buffered_write+0x19c/0x290 [ 3959.024461] blkdev_write_iter+0x38c/0x978 [ 3959.024470] vfs_write+0x4d4/0x928 [ 3959.024482] ksys_write+0xfc/0x1f8 [ 3959.024489] __arm64_sys_write+0x74/0xb0 [ 3959.024496] invoke_syscall+0xd4/0x258 [ 3959.024507] el0_svc_common.constprop.0+0xb4/0x240 [ 3959.024514] do_el0_svc+0x48/0x68 [ 3959.024520] el0_svc+0x40/0xf8 [ 3959.024526] el0t_64_sync_handler+0xa0/0xe8 [ 3959.024533] el0t_64_sync+0x1ac/0x1b0 [ 3959.024540] ---[ end trace 0000000000000000 ]---
When __memcg_slab_post_alloc_hook() fails, there are two different free paths depending on whether size == 1 or size != 1. In the kmem_cache_free_bulk() path, we do call alloc_tagging_slab_free_hook(). However, in memcg_alloc_abort_single() we don't, the above warning will be triggered on the next allocation.
Therefore, add alloc_tagging_slab_free_hook() to the memcg_alloc_abort_single() path.
--- mm/slub.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
mm/slub.c +5 -1
@@ -6667,8 +6667,12 @@ void slab_free(struct kmem_cache *s, strstatic noinline void memcg_alloc_abort_single(struct kmem_cache *s, void *object) { +struct slab *slab =virt_to_slab (object); + +alloc_tagging_slab_free_hook (s, slab, &object,1 ); +if (likely (slab_free_hook (s, object,slab_want_init_on_free (s), false))) -do_slab_free (s,virt_to_slab (object), object, object,1 , _RET_IP_); +do_slab_free (s, slab, object, object,1 , _RET_IP_); }#endif
Greg Kroah-Hartman
maintainerPATCH 14/175 ceph: fix NULL pointer dereference in ceph_mds_auth_match()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
commit 7987cce375ac8ce98e170a77aa2399f2cf6eb99f upstream.
The CephFS kernel client has regression starting from 6.18-rc1. We have issue in ceph_mds_auth_match() if fs_name == NULL:
const char fs_name = mdsc->fsc->mount_options->mds_namespace;
...
if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) {
/ fsname mismatch, try next one */
return 0;
}Patrick Donnelly suggested that: In summary, we should definitely start decoding fs_name from the MDSMap and do strict authorizations checks against it. Note that the -o mds_namespace=foo should only be used for selecting the file system to mount and nothing else. It's possible no mds_namespace is specified but the kernel will mount the only file system that exists which may have name "foo".
This patch reworks ceph_mdsmap_decode() and namespace_equals() with the goal of supporting the suggested concept. Now struct ceph_mdsmap contains m_fs_name field that receives copy of extracted FS name by ceph_extract_encoded_string(). For the case of "old" CephFS file systems, it is used "cephfs" name.
[ idryomov: replace redundant %*pE with %s in ceph_mdsmap_decode(),
get rid of a series of strlen() calls in ceph_namespace_match(), drop changes to namespace_equals() body to avoid treating empty mds_namespace as equal, drop changes to ceph_mdsc_handle_fsmap() as namespace_equals() isn't an equivalent substitution there ]
--- fs/ceph/mds_client.c | 5 +++-- fs/ceph/mdsmap.c | 26 +++++++++++++++++++------- fs/ceph/mdsmap.h | 1 + fs/ceph/super.h | 16 ++++++++++++++-- include/linux/ceph/ceph_fs.h | 6 ++++++ 5 files changed, 43 insertions(+), 11 deletions(-)
fs/ceph/mds_client.c +3 -2
@@ -5655,7 +5655,7 @@ static int ceph_mds_auth_match(struct ceu32 caller_uid =from_kuid (&init_user_ns, cred->fsuid);u32 caller_gid =from_kgid (&init_user_ns, cred->fsgid);struct ceph_client *cl = mdsc->fsc->client; -const char *fs_name = mdsc->fsc->mount_options->mds_namespace; +const char *fs_name = mdsc->mdsmap->m_fs_name;const char *spath = mdsc->fsc->mount_options->server_path;bool gid_matched = false;u32 gid, tlen, len;
@@ -5663,7 +5663,8 @@ static int ceph_mds_auth_match(struct cedoutc (cl,"fsname check fs_name=%s match.fs_name=%s\n" , fs_name, auth->match.fs_name ? auth->match.fs_name :"" ); -if (auth->match.fs_name &&strcmp (auth->match.fs_name, fs_name)) { + +if (!ceph_namespace_match (auth->match.fs_name, fs_name)) {/* fsname mismatch, try next one */ return 0 ; }
fs/ceph/mdsmap.c +19 -7
@@ -353,22 +353,33 @@ struct ceph_mdsmap *ceph_mdsmap_decode(s__decode_and_drop_type (p, end, u8, bad_ext); }if (mdsmap_ev >=8 ) { -u32 fsname_len; +size_t fsname_len; +/* enabled */ ceph_decode_8_safe (p, end, m->m_enabled, bad_ext); +/* fs_name */ -ceph_decode_32_safe (p, end, fsname_len, bad_ext); + m->m_fs_name =ceph_extract_encoded_string (p, end, + &fsname_len, +GFP_NOFS ); +if (IS_ERR (m->m_fs_name)) { + m->m_fs_name =NULL ; + goto nomem; + }/* validate fsname against mds_namespace */ -if (!namespace_equals (mdsc->fsc->mount_options, *p, +if (!namespace_equals (mdsc->fsc->mount_options, m->m_fs_name, fsname_len)) { -pr_warn_client (cl,"fsname %*pE doesn't match mds_namespace %s\n" , - (int )fsname_len, (char *)*p, +pr_warn_client (cl,"fsname %s doesn't match mds_namespace %s\n" , + m->m_fs_name, mdsc->fsc->mount_options->mds_namespace); goto bad; } -/* skip fsname after validation */ -ceph_decode_skip_n (p, end, fsname_len, bad); + }else { + m->m_enabled = false; + m->m_fs_name =kstrdup (CEPH_OLD_FS_NAME ,GFP_NOFS ); +if (!m->m_fs_name) + goto nomem; }/* damaged */ if (mdsmap_ev >=9 ) {
@@ -430,6 +441,7 @@ void ceph_mdsmap_destroy(struct ceph_mdskfree (m->m_info); }kfree (m->m_data_pg_pools); +kfree (m->m_fs_name);kfree (m); }
fs/ceph/mdsmap.h +1 -0
@@ -45,6 +45,7 @@ struct ceph_mdsmap {bool m_enabled;bool m_damaged;int m_num_laggy; +char *m_fs_name; }; static inline struct ceph_entity_addr *
fs/ceph/super.h +14 -2
@@ -104,14 +104,26 @@ struct ceph_mount_options {struct fscrypt_dummy_policy dummy_enc_policy; }; +#define CEPH_NAMESPACE_WILDCARD "*" + +static inline bool ceph_namespace_match (const char *pattern, +const char *target) +{ +if (!pattern || !pattern[0 ] || + !strcmp (pattern,CEPH_NAMESPACE_WILDCARD )) +return true; + +return !strcmp (pattern, target); +} +/* * Check if the mds namespace in ceph_mount_options matches * the passed in namespace string. First time match (when * ->mds_namespace is NULL) is treated specially, since * ->mds_namespace needs to be initialized by the caller. */ -static inline int namespace_equals (struct ceph_mount_options *fsopt, -const char *namespace,size_t len) +static inline bool namespace_equals (struct ceph_mount_options *fsopt, +const char *namespace,size_t len) { return !(fsopt->mds_namespace && (strlen(fsopt->mds_namespace) != len ||
include/linux/ceph/ceph_fs.h +6 -0
@@ -31,6 +31,12 @@#define CEPH_INO_CEPH 2/* hidden .ceph dir */ #define CEPH_INO_GLOBAL_SNAPREALM 3/* global dummy snaprealm */ +/* +* name for "old" CephFS file systems, +* see ceph.git e2b151d009640114b2565c901d6f41f6cd5ec652 +*/ +#define CEPH_OLD_FS_NAME "cephfs" +/* arbitrary limit on max # of monitors (cluster of 3 is typical) */ #define CEPH_MAX_MON 31
Greg Kroah-Hartman
maintainerPATCH 15/175 rbd: check for EOD after exclusive lock is ensured to be held
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit bd3884a204c3b507e6baa9a4091aa927f9af5404 upstream.
Similar to commit 870611e4877e ("rbd: get snapshot context after exclusive lock is ensured to be held"), move the "beyond EOD" check into the image request state machine so that it's performed after exclusive lock is ensured to be held. This avoids various race conditions which can arise when the image is shrunk under I/O (in practice, mostly readahead). In one such scenario
rbd_assert(objno < rbd_dev->object_map_size);
can be triggered if a close-to-EOD read gets queued right before the shrink is initiated and the EOD check is performed against an outdated mapping_size. After the resize is done on the server side and exclusive lock is (re)acquired bringing along the new (now shrunk) object map, the read starts going through the state machine and rbd_obj_may_exist() gets invoked on an object that is out of bounds of rbd_dev->object_map array.
--- drivers/block/rbd.c | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-)
drivers/block/rbd.c +21 -12
@@ -3495,11 +3495,29 @@ static void rbd_img_object_requests(strurbd_assert (!need_exclusive_lock (img_req) ||__rbd_is_lock_owner (rbd_dev)); -if (rbd_img_is_write (img_req)) { -rbd_assert (!img_req->snapc); +if (test_bit (IMG_REQ_CHILD , &img_req->flags)) { +rbd_assert (!rbd_img_is_write (img_req)); + }else { +struct request *rq =blk_mq_rq_from_pdu (img_req); +u64 off = (u64 )blk_rq_pos (rq) <<SECTOR_SHIFT ; +u64 len =blk_rq_bytes (rq); +u64 mapping_size; +down_read (&rbd_dev->header_rwsem); - img_req->snapc =ceph_get_snap_context (rbd_dev->header.snapc); + mapping_size = rbd_dev->mapping.size; +if (rbd_img_is_write (img_req)) { +rbd_assert (!img_req->snapc); + img_req->snapc = +ceph_get_snap_context (rbd_dev->header.snapc); + }up_read (&rbd_dev->header_rwsem); + +if (unlikely (off + len > mapping_size)) { +rbd_warn (rbd_dev,"beyond EOD (%llu~%llu > %llu)" , + off, len, mapping_size); + img_req->pending.result = -EIO ; +return ; + } }for_each_obj_request (img_req, obj_req) {
@@ -4725,7 +4743,6 @@ static void rbd_queue_workfn(struct workstruct request *rq =blk_mq_rq_from_pdu (img_request);u64 offset = (u64 )blk_rq_pos (rq) <<SECTOR_SHIFT ;u64 length =blk_rq_bytes (rq); -u64 mapping_size;int result;/* Ignore/skip any zero-length requests */
@@ -4738,17 +4755,9 @@ static void rbd_queue_workfn(struct workblk_mq_start_request (rq);down_read (&rbd_dev->header_rwsem); - mapping_size = rbd_dev->mapping.size;rbd_img_capture_header (img_request);up_read (&rbd_dev->header_rwsem); -if (offset + length > mapping_size) { -rbd_warn (rbd_dev,"beyond EOD (%llu~%llu > %llu)" , offset, - length, mapping_size); - result = -EIO ; - goto err_img_request; - } -dout ("%s rbd_dev %p img_req %p %s %llu~%llu\n" , __func__, rbd_dev, img_request,obj_op_name (op_type), offset, length);
Greg Kroah-Hartman
maintainerPATCH 16/175 ARM: 9468/1: fix memset64() on big-endian
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weissschuh <[email protected]>
commit 23ea2a4c72323feb6e3e025e8a6f18336513d5ad upstream.
On big-endian systems the 32-bit low and high halves need to be swapped for the underlying assembly implementation to work correctly.
--- arch/arm/include/asm/string.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/arm/include/asm/string.h +4 -1
@@ -42,7 +42,10 @@ static inline void *memset32(uint32_t *pextern void *__memset64 (uint64_t *,uint32_t low,__kernel_size_t ,uint32_t hi);static inline void *memset64 (uint64_t *p,uint64_t v,__kernel_size_t n) { -return __memset64 (p, v, n *8 , v >>32 ); +if (IS_ENABLED (CONFIG_CPU_LITTLE_ENDIAN )) +return __memset64 (p, v, n *8 , v >>32 ); +else +return __memset64 (p, v >>32 , n *8 , v); }/*
Greg Kroah-Hartman
maintainerPATCH 17/175 ceph: fix oops due to invalid pointer for kfree() in parse_longname()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vogelbacher <[email protected]>
commit bc8dedae022ce3058659c3addef3ec4b41d15e00 upstream.
This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running ls /mnt/my_ceph/.snap.
The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer.
Steps to reproduce:
1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)
2. Add cephfs mount to fstab
$ echo "[email protected]=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab
3. Reboot the system
$ systemctl reboot
4. Check if it's really mounted
$ mount | grep stuff
5. List snapshots (expected 63 snapshots on my system)
$ ls /mnt/test/stuff/.snap
Now ls hangs forever and the kernel log shows the oops.
--- fs/ceph/crypto.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ceph/crypto.c +5 -4
@@ -219,12 +219,13 @@ static struct inode *parse_longname(consstruct ceph_vino vino = { .snap =CEPH_NOSNAP };char *name_end, *inode_number;int ret = -EIO ; -/* NUL-terminate */ - char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); +/* Snapshot name must start with an underscore */ +if (*name_len <=0 || name[0 ] !='_' ) +return ERR_PTR (-EIO ); +/* Skip initial '_' and NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name + 1, *name_len - 1, GFP_KERNEL);if (!str)return ERR_PTR (-ENOMEM ); -/* Skip initial '_' */ - str++; name_end =strrchr (str,'_' );if (!name_end) {doutc (cl,"failed to parse long snapshot name: %s\n" , str);
Greg Kroah-Hartman
maintainerPATCH 18/175 cgroup/dmem: fix NULL pointer dereference when setting max
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
commit 43151f812886be1855d2cba059f9c93e4729460b upstream.
An issue was triggered:
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 15 UID: 0 PID: 658 Comm: bash Tainted: 6.19.0-rc6-next-2026012 Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), RIP: 0010:strcmp+0x10/0x30 RSP: 0018:ffffc900017f7dc0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888107cd4358 RDX: 0000000019f73907 RSI: ffffffff82cc381a RDI: 0000000000000000 RBP: ffff8881016bef0d R08: 000000006c0e7145 R09: 0000000056c0e714 R10: 0000000000000001 R11: ffff888107cd4358 R12: 0007ffffffffffff R13: ffff888101399200 R14: ffff888100fcb360 R15: 0007ffffffffffff CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000105c79000 CR4: 00000000000006f0 Call Trace: <TASK> dmemcg_limit_write.constprop.0+0x16d/0x390 ? __pfx_set_resource_max+0x10/0x10 kernfs_fop_write_iter+0x14e/0x200 vfs_write+0x367/0x510 ksys_write+0x66/0xe0 do_syscall_64+0x6b/0x390 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f42697e1887
It was trriggered setting max without limitation, the command is like:
"echo test/region0 > dmem.max". To fix this issue, add check whether options is valid after parsing the region_name.
--- kernel/cgroup/dmem.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/cgroup/dmem.c +3 -0
@@ -700,6 +700,9 @@ static ssize_t dmemcg_limit_write(structif (!region_name[0 ])continue ; +if (!options || !*options) +return -EINVAL ; +rcu_read_lock (); region =dmemcg_get_region_by_name (region_name);rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 19/175 cgroup/dmem: avoid rcu warning when unregister region
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
commit 592a68212c5664bcaa88f24ed80bf791282790fe upstream.
A warnning was detected:
WARNING: suspicious RCU usage
6.19.0-rc7-next-20260129+ #1101 Tainted: G O
kernel/cgroup/dmem.c:456 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by insmod/532:
#0: ffffffff85e78b38 (dmemcg_lock){+.+.}-dmem_cgroup_unregister_region+
stack backtrace: CPU: 2 UID: 0 PID: 532 Comm: insmod Tainted: 6.19.0-rc7-next- Tainted: [O]=OOT_MODULE Call Trace: <TASK> dump_stack_lvl+0xb0/0xd0 lockdep_rcu_suspicious+0x151/0x1c0 dmem_cgroup_unregister_region+0x1e2/0x380 ? __pfx_dmem_test_init+0x10/0x10 [dmem_uaf] dmem_test_init+0x65/0xff0 [dmem_uaf] do_one_initcall+0xbb/0x3a0
The macro list_for_each_rcu() must be used within an RCU read-side critical section (between rcu_read_lock() and rcu_read_unlock()). Using it outside that context, as seen in dmem_cgroup_unregister_region(), triggers the lockdep warning because the RCU protection is not guaranteed.
Replace list_for_each_rcu() with list_for_each_entry_safe(), which is appropriate for traversal under spinlock protection where nodes may be deleted.
--- kernel/cgroup/dmem.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
kernel/cgroup/dmem.c +2 -5
@@ -423,7 +423,7 @@ static void dmemcg_free_region(struct kr*/ void dmem_cgroup_unregister_region (struct dmem_cgroup_region *region) { -struct list_head *entry; +struct dmem_cgroup_pool_state *pool, *next;if (!region)return ;
@@ -433,10 +433,7 @@ void dmem_cgroup_unregister_region(struc/* Remove from global region list */ list_del_rcu (®ion->region_node); -list_for_each_rcu (entry, ®ion->pools) { -struct dmem_cgroup_pool_state *pool = -container_of (entry,typeof (*pool), region_node); - +list_for_each_entry_safe (pool, next, ®ion->pools, region_node) {list_del_rcu (&pool->css_node); }
Greg Kroah-Hartman
maintainerPATCH 20/175 cgroup/dmem: avoid pool UAF
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
commit 99a2ef500906138ba58093b9893972a5c303c734 upstream.
An UAF issue was observed:
BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527 CPU: 4 UID: 0 PID: 527 Comm: insmod 6.19.0-rc7-next-20260129+ #11 Tainted: [O]=OOT_MODULE Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 kasan_report+0xca/0x100 kasan_check_range+0x39/0x1c0 page_counter_uncharge+0x65/0x150 dmem_cgroup_uncharge+0x1f/0x260 Allocated by task 527: Freed by task 0: The buggy address belongs to the object at ffff888106715400
which belongs to the cache kmalloc-512 of size 512 The buggy address is located 64 bytes inside of freed 512-byte region [ffff888106715400, ffff888106715600)
The buggy address belongs to the physical page: Memory state around the buggy address: ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
The issue occurs because a pool can still be held by a caller after its associated memory region is unregistered. The current implementation frees the pool even if users still hold references to it (e.g., before uncharge operations complete).
This patch adds a reference counter to each pool, ensuring that a pool is only freed when its reference count drops to zero.
--- kernel/cgroup/dmem.c | 60 ++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 58 insertions(+), 2 deletions(-)
kernel/cgroup/dmem.c +58 -2
@@ -14,6 +14,7 @@#include <linux/mutex.h> #include <linux/page_counter.h> #include <linux/parser.h> +#include <linux/refcount.h> #include <linux/rculist.h> #include <linux/slab.h>
@@ -71,7 +72,9 @@ struct dmem_cgroup_pool_state {struct rcu_head rcu;struct page_counter cnt; +struct dmem_cgroup_pool_state *parent; +refcount_t ref;bool inited; };
@@ -88,6 +91,9 @@ struct dmem_cgroup_pool_state {static DEFINE_SPINLOCK (dmemcg_lock);static LIST_HEAD (dmem_cgroup_regions); +static void dmemcg_free_region (struct kref *ref); +static void dmemcg_pool_free_rcu (struct rcu_head *rcu); +static inline struct dmemcg_state *css_to_dmemcs (struct cgroup_subsys_state *css) {
@@ -104,10 +110,38 @@ static struct dmemcg_state *parent_dmemcs(struct dmemcg_state *cg)return cg->css.parent ?css_to_dmemcs (cg->css.parent) :NULL ; } +static void dmemcg_pool_get (struct dmem_cgroup_pool_state *pool) +{ +refcount_inc (&pool->ref); +} + +static bool dmemcg_pool_tryget (struct dmem_cgroup_pool_state *pool) +{ +return refcount_inc_not_zero (&pool->ref); +} + +static void dmemcg_pool_put (struct dmem_cgroup_pool_state *pool) +{ +if (!refcount_dec_and_test (&pool->ref)) +return ; + +call_rcu (&pool->rcu, dmemcg_pool_free_rcu); +} + +static void dmemcg_pool_free_rcu (struct rcu_head *rcu) +{ +struct dmem_cgroup_pool_state *pool =container_of (rcu,typeof (*pool), rcu); + +if (pool->parent) +dmemcg_pool_put (pool->parent); +kref_put (&pool->region->ref, dmemcg_free_region); +kfree (pool); +} +static void free_cg_pool (struct dmem_cgroup_pool_state *pool) {list_del (&pool->region_node); -kfree (pool); +dmemcg_pool_put (pool); } static void
@@ -342,6 +376,12 @@ alloc_pool_single(struct dmemcg_state *dmemcs, struct dmem_cgroup_region *regionpage_counter_init (&pool->cnt, ppool ? &ppool->cnt :NULL , true);reset_all_resource_limits (pool); +refcount_set (&pool->ref,1 ); +kref_get (®ion->ref); +if (ppool && !pool->parent) { + pool->parent = ppool; +dmemcg_pool_get (ppool); + }list_add_tail_rcu (&pool->css_node, &dmemcs->pools);list_add_tail (&pool->region_node, ®ion->pools);
@@ -389,6 +429,10 @@ get_cg_pool_locked(struct dmemcg_state *dmemcs, struct dmem_cgroup_region *regio/* Fix up parent links, mark as inited. */ pool->cnt.parent = &ppool->cnt; +if (ppool && !pool->parent) { + pool->parent = ppool; +dmemcg_pool_get (ppool); + } pool->inited = true; pool = ppool;
@@ -435,6 +479,8 @@ void dmem_cgroup_unregister_region(struct dmem_cgroup_region *region)list_for_each_entry_safe (pool, next, ®ion->pools, region_node) {list_del_rcu (&pool->css_node); +list_del (&pool->region_node); +dmemcg_pool_put (pool); }/*
@@ -515,8 +561,10 @@ static struct dmem_cgroup_region *dmemcg_get_region_by_name(const char *name)*/ void dmem_cgroup_pool_state_put (struct dmem_cgroup_pool_state *pool) { -if (pool) +if (pool) {css_put (&pool->cs->css); +dmemcg_pool_put (pool); + } }EXPORT_SYMBOL_GPL (dmem_cgroup_pool_state_put);
@@ -530,6 +578,8 @@ get_cg_pool_unlocked(struct dmemcg_state *cg, struct dmem_cgroup_region *region) pool =find_cg_pool_locked (cg, region);if (pool && !READ_ONCE (pool->inited)) pool =NULL ; +if (pool && !dmemcg_pool_tryget (pool)) + pool =NULL ;rcu_read_unlock ();while (!pool) {
@@ -538,6 +588,8 @@ get_cg_pool_unlocked(struct dmemcg_state *cg, struct dmem_cgroup_region *region) pool =get_cg_pool_locked (cg, region, &allocpool); else pool =ERR_PTR (-ENODEV ); +if (!IS_ERR (pool)) +dmemcg_pool_get (pool);spin_unlock (&dmemcg_lock);if (pool ==ERR_PTR (-ENOMEM )) {
@@ -573,6 +625,7 @@ void dmem_cgroup_uncharge(struct dmem_cgroup_pool_state *pool, u64 size)page_counter_uncharge (&pool->cnt, size);css_put (&pool->cs->css); +dmemcg_pool_put (pool); }EXPORT_SYMBOL_GPL (dmem_cgroup_uncharge);
@@ -624,7 +677,9 @@ int dmem_cgroup_try_charge(struct dmem_cgroup_region *region, u64 size,if (ret_limit_pool) { *ret_limit_pool = container_of(fail, struct dmem_cgroup_pool_state, cnt);css_get (&(*ret_limit_pool)->cs->css); +dmemcg_pool_get (*ret_limit_pool); } +dmemcg_pool_put (pool); ret = -EAGAIN ; goto err; }
@@ -719,6 +774,7 @@ static ssize_t dmemcg_limit_write(struct kernfs_open_file *of,/* And commit */ apply (pool, new_limit); +dmemcg_pool_put (pool); out_put:kref_put (®ion->ref, dmemcg_free_region);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/175 drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 1478a34470bf4755465d29b348b24a610bccc180 upstream.
commit f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") caused a dependency on new enough MES firmware to use amdgpu. This was fixed on most gfx11 and gfx12 hardware with commit 0180e0a5dd5c ("drm/amdgpu/mes: add compatibility checks for set_hw_resource_1"), but this left out that GC 11.0.4 had breakage at MES 0x51.
Bump the requirement to 0x52 instead.
--- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +1 -1
@@ -1667,7 +1667,7 @@ static int mes_v11_0_hw_init(struct amdgif (r) goto failure; -if ((adev->mes.sched_version &AMDGPU_MES_VERSION_MASK ) >=0x50 ) { +if ((adev->mes.sched_version &AMDGPU_MES_VERSION_MASK ) >=0x52 ) { r =mes_v11_0_set_hw_resources_1 (&adev->mes);if (r) {DRM_ERROR ("failed mes_v11_0_set_hw_resources_1, r=%d\n" , r);
Greg Kroah-Hartman
maintainerPATCH 22/175 gve: Fix stats report corruption on queue count change
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Debarghya Kundu <[email protected]>
commit 7b9ebcce0296e104a0d82a6b09d68564806158ff upstream.
The driver and the NIC share a region in memory for stats reporting. The NIC calculates its offset into this region based on the total size of the stats region and the size of the NIC's stats.
When the number of queues is changed, the driver's stats region is resized. If the queue count is increased, the NIC can write past the end of the allocated stats region, causing memory corruption. If the queue count is decreased, there is a gap between the driver and NIC stats, leading to incorrect stats reporting.
This change fixes the issue by allocating stats region with maximum size, and the offset calculation for NIC stats is changed to match with the calculation of the NIC.
--- drivers/net/ethernet/google/gve/gve_ethtool.c | 54 ++++++++++++++++---------- drivers/net/ethernet/google/gve/gve_main.c | 4 - 2 files changed, 36 insertions(+), 22 deletions(-)
drivers/net/ethernet/google/gve/gve_ethtool.c +34 -20
@@ -156,7 +156,8 @@ gve_get_ethtool_stats(struct net_deviceu64 rx_buf_alloc_fail, rx_desc_err_dropped_pkt, rx_hsplit_unsplit_pkt, rx_pkts, rx_hsplit_pkt, rx_skb_alloc_fail, rx_bytes, tx_pkts, tx_bytes, tx_dropped; -int stats_idx, base_stats_idx, max_stats_idx; +int rx_base_stats_idx, max_rx_stats_idx, max_tx_stats_idx; +int stats_idx, stats_region_len, nic_stats_len;struct stats *report_stats;int *rx_qid_to_stats_idx;int *tx_qid_to_stats_idx;
@@ -265,20 +266,38 @@ gve_get_ethtool_stats(struct net_device data[i++] = priv->stats_report_trigger_cnt; i =GVE_MAIN_STATS_LEN ; -/* For rx cross-reporting stats, start from nic rx stats in report */ - base_stats_idx =GVE_TX_STATS_REPORT_NUM * num_tx_queues + -GVE_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues; -/* The boundary between driver stats and NIC stats shifts if there are -* stopped queues. -*/ - base_stats_idx +=NIC_RX_STATS_REPORT_NUM * num_stopped_rxqs + -NIC_TX_STATS_REPORT_NUM * num_stopped_txqs; - max_stats_idx =NIC_RX_STATS_REPORT_NUM * - (priv->rx_cfg.num_queues - num_stopped_rxqs) + - base_stats_idx; + rx_base_stats_idx =0 ; + max_rx_stats_idx =0 ; + max_tx_stats_idx =0 ; + stats_region_len = priv->stats_report_len - +sizeof (struct gve_stats_report ); + nic_stats_len = (NIC_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues + +NIC_TX_STATS_REPORT_NUM * num_tx_queues) *sizeof (struct stats ); +if (unlikely ((stats_region_len - + nic_stats_len) %sizeof (struct stats ))) { +net_err_ratelimited ("Starting index of NIC stats should be multiple of stats size" ); + }else { +/* For rx cross-reporting stats, +* start from nic rx stats in report +*/ + rx_base_stats_idx = (stats_region_len - nic_stats_len) / +sizeof (struct stats ); +/* The boundary between driver stats and NIC stats +* shifts if there are stopped queues +*/ + rx_base_stats_idx +=NIC_RX_STATS_REPORT_NUM * + num_stopped_rxqs +NIC_TX_STATS_REPORT_NUM * + num_stopped_txqs; + max_rx_stats_idx =NIC_RX_STATS_REPORT_NUM * + (priv->rx_cfg.num_queues - num_stopped_rxqs) + + rx_base_stats_idx; + max_tx_stats_idx =NIC_TX_STATS_REPORT_NUM * + (num_tx_queues - num_stopped_txqs) + + max_rx_stats_idx; + }/* Preprocess the stats report for rx, map queue id to start index */ skip_nic_stats = false; -for (stats_idx = base_stats_idx; stats_idx < max_stats_idx; +for (stats_idx = rx_base_stats_idx; stats_idx < max_rx_stats_idx; stats_idx +=NIC_RX_STATS_REPORT_NUM ) {u32 stat_name =be32_to_cpu (report_stats[stats_idx].stat_name);u32 queue_id =be32_to_cpu (report_stats[stats_idx].queue_id);
@@ -354,14 +373,9 @@ gve_get_ethtool_stats(struct net_device i += priv->rx_cfg.num_queues *NUM_GVE_RX_CNTS ; } -/* For tx cross-reporting stats, start from nic tx stats in report */ - base_stats_idx = max_stats_idx; - max_stats_idx =NIC_TX_STATS_REPORT_NUM * - (num_tx_queues - num_stopped_txqs) + - max_stats_idx; -/* Preprocess the stats report for tx, map queue id to start index */ skip_nic_stats = false; -for (stats_idx = base_stats_idx; stats_idx < max_stats_idx; +/* NIC TX stats start right after NIC RX stats */ +for (stats_idx = max_rx_stats_idx; stats_idx < max_tx_stats_idx; stats_idx +=NIC_TX_STATS_REPORT_NUM ) {u32 stat_name =be32_to_cpu (report_stats[stats_idx].stat_name);u32 queue_id =be32_to_cpu (report_stats[stats_idx].queue_id);
drivers/net/ethernet/google/gve/gve_main.c +2 -2
@@ -283,9 +283,9 @@ static int gve_alloc_stats_report(structint tx_stats_num, rx_stats_num; tx_stats_num = (GVE_TX_STATS_REPORT_NUM +NIC_TX_STATS_REPORT_NUM ) * -gve_num_tx_queues (priv); + priv->tx_cfg.max_queues; rx_stats_num = (GVE_RX_STATS_REPORT_NUM +NIC_RX_STATS_REPORT_NUM ) * - priv->rx_cfg.num_queues; + priv->rx_cfg.max_queues; priv->stats_report_len =struct_size (priv->stats_report, stats,size_add (tx_stats_num, rx_stats_num)); priv->stats_report =
Greg Kroah-Hartman
maintainerPATCH 23/175 gve: Correct ethtool rx_dropped calculation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Yuan <[email protected]>
commit c7db85d579a1dccb624235534508c75fbf2dfe46 upstream.
The gve driver's "rx_dropped" statistic, exposed via ethtool -S, incorrectly includes rx_buf_alloc_fail counts. These failures represent an inability to allocate receive buffers, not true packet drops where a received packet is discarded. This misrepresentation can lead to inaccurate diagnostics.
This patch rectifies the ethtool "rx_dropped" calculation. It removes rx_buf_alloc_fail from the total and adds xdp_tx_errors and xdp_redirect_errors, which represent legitimate packet drops within the XDP path.
--- drivers/net/ethernet/google/gve/gve_ethtool.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/net/ethernet/google/gve/gve_ethtool.c +17 -6
@@ -152,10 +152,11 @@ gve_get_ethtool_stats(struct net_deviceu64 tmp_rx_pkts, tmp_rx_hsplit_pkt, tmp_rx_bytes, tmp_rx_hsplit_bytes, tmp_rx_skb_alloc_fail, tmp_rx_buf_alloc_fail, tmp_rx_desc_err_dropped_pkt, tmp_rx_hsplit_unsplit_pkt, - tmp_tx_pkts, tmp_tx_bytes; + tmp_tx_pkts, tmp_tx_bytes, + tmp_xdp_tx_errors, tmp_xdp_redirect_errors;u64 rx_buf_alloc_fail, rx_desc_err_dropped_pkt, rx_hsplit_unsplit_pkt, rx_pkts, rx_hsplit_pkt, rx_skb_alloc_fail, rx_bytes, tx_pkts, tx_bytes, - tx_dropped; + tx_dropped, xdp_tx_errors, xdp_redirect_errors;int rx_base_stats_idx, max_rx_stats_idx, max_tx_stats_idx;int stats_idx, stats_region_len, nic_stats_len;struct stats *report_stats;
@@ -199,6 +200,7 @@ gve_get_ethtool_stats(struct net_devicefor (rx_pkts =0 , rx_bytes =0 , rx_hsplit_pkt =0 , rx_skb_alloc_fail =0 , rx_buf_alloc_fail =0 , rx_desc_err_dropped_pkt =0 , rx_hsplit_unsplit_pkt =0 , + xdp_tx_errors =0 , xdp_redirect_errors =0 , ring =0 ; ring < priv->rx_cfg.num_queues; ring++) {if (priv->rx) {
@@ -216,6 +218,9 @@ gve_get_ethtool_stats(struct net_device rx->rx_desc_err_dropped_pkt; tmp_rx_hsplit_unsplit_pkt = rx->rx_hsplit_unsplit_pkt; + tmp_xdp_tx_errors = rx->xdp_tx_errors; + tmp_xdp_redirect_errors = + rx->xdp_redirect_errors; }while (u64_stats_fetch_retry (&priv->rx[ring].statss, start)); rx_pkts += tmp_rx_pkts;
@@ -225,6 +230,8 @@ gve_get_ethtool_stats(struct net_device rx_buf_alloc_fail += tmp_rx_buf_alloc_fail; rx_desc_err_dropped_pkt += tmp_rx_desc_err_dropped_pkt; rx_hsplit_unsplit_pkt += tmp_rx_hsplit_unsplit_pkt; + xdp_tx_errors += tmp_xdp_tx_errors; + xdp_redirect_errors += tmp_xdp_redirect_errors; } } for (tx_pkts = 0, tx_bytes = 0, tx_dropped = 0, ring = 0;
@@ -250,8 +257,8 @@ gve_get_ethtool_stats(struct net_device data[i++] = rx_bytes; data[i++] = tx_bytes;/* total rx dropped packets */ - data[i++] = rx_skb_alloc_fail + rx_buf_alloc_fail + - rx_desc_err_dropped_pkt; + data[i++] = rx_skb_alloc_fail + rx_desc_err_dropped_pkt + + xdp_tx_errors + xdp_redirect_errors; data[i++] = tx_dropped; data[i++] = priv->tx_timeo_cnt; data[i++] = rx_skb_alloc_fail;
@@ -330,6 +337,9 @@ gve_get_ethtool_stats(struct net_device tmp_rx_buf_alloc_fail = rx->rx_buf_alloc_fail; tmp_rx_desc_err_dropped_pkt = rx->rx_desc_err_dropped_pkt; + tmp_xdp_tx_errors = rx->xdp_tx_errors; + tmp_xdp_redirect_errors = + rx->xdp_redirect_errors; }while (u64_stats_fetch_retry (&priv->rx[ring].statss, start)); data[i++] = tmp_rx_bytes;
@@ -340,8 +350,9 @@ gve_get_ethtool_stats(struct net_device data[i++] = rx->rx_frag_alloc_cnt;/* rx dropped packets */ data[i++] = tmp_rx_skb_alloc_fail + - tmp_rx_buf_alloc_fail + - tmp_rx_desc_err_dropped_pkt; + tmp_rx_desc_err_dropped_pkt + + tmp_xdp_tx_errors + + tmp_xdp_redirect_errors; data[i++] = rx->rx_copybreak_pkt; data[i++] = rx->rx_copied_pkt;/* stats from NIC */
Greg Kroah-Hartman
maintainerPATCH 24/175 mm, shmem: prevent infinite loop on truncate race
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kairui Song <[email protected]>
commit 2030dddf95451b4e7a389f052091e7c4b7b274c6 upstream.
When truncating a large swap entry, shmem_free_swap() returns 0 when the entry's index doesn't match the given index due to lookup alignment. The failure fallback path checks if the entry crosses the end border and aborts when it happens, so truncate won't erase an unexpected entry or range. But one scenario was ignored.
When index points to the middle of a large swap entry, and the large swap entry doesn't go across the end border, find_get_entries() will return that large swap entry as the first item in the batch with indices[0] equal to index. The entry's base index will be smaller than indices[0], so shmem_free_swap() will fail and return 0 due to the "base < index" check. The code will then call shmem_confirm_swap(), get the order, check if it crosses the END boundary (which it doesn't), and retry with the same index.
The next iteration will find the same entry again at the same index with same indices, leading to an infinite loop.
Fix this by retrying with a round-down index, and abort if the index is smaller than the truncate range.
--- mm/shmem.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
mm/shmem.c +14 -9
@@ -1193,17 +1193,22 @@ whole_folios: swaps_freed =shmem_free_swap (mapping, indices[i], end -1 , folio);if (!swaps_freed) { -/* -* If found a large swap entry cross the end border, -* skip it as the truncate_inode_partial_folio above -* should have at least zerod its content once. -*/ +pgoff_t base = indices[i]; + order =shmem_confirm_swap (mapping, indices[i],radix_to_swp_entry (folio)); -if (order >0 && indices[i] + (1 << order) > end) -continue ; -/* Swap was replaced by page: retry */ - index = indices[i]; +/* +* If found a large swap entry cross the end or start +* border, skip it as the truncate_inode_partial_folio +* above should have at least zerod its content once. +*/ +if (order >0 ) { + base =round_down (base,1 << order); +if (base < start || base + (1 << order) > end) +continue ; + } +/* Swap was replaced by page or extended, retry */ + index = base;break ; } nr_swaps_freed += swaps_freed;
Greg Kroah-Hartman
maintainerPATCH 25/175 Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bert Karwatzki <[email protected]>
commit 243b467dea1735fed904c2e54d248a46fa417a2d upstream.
This reverts commit 7294863a6f01248d72b61d38478978d638641bee.
This commit was erroneously applied again after commit 0ab5d711ec74 ("drm/amd: Refactor amdgpu_aspm to be evaluated per device")
removed it, leading to very hard to debug crashes, when used with a system with two AMD GPUs of which only one supports ASPM.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 --- 1 file changed, 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +0 -3
@@ -2334,9 +2334,6 @@ static int amdgpu_pci_probe(struct pci_dreturn -ENODEV ; } -if (amdgpu_aspm ==-1 && !pcie_aspm_enabled (pdev)) - amdgpu_aspm =0 ; -if (amdgpu_virtual_display ||amdgpu_device_asic_has_dc_support (pdev, flags &AMD_ASIC_MASK )) supports_atomic = true;
Greg Kroah-Hartman
maintainerPATCH 26/175 nouveau: add a third state to the fini handler.
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit 8f8a4dce64013737701d13565cf6107f42b725ea upstream.
This is just refactoring to allow the lower layers to distinguish between suspend and runtime suspend.
GSP 570 needs to set a flag with the GPU is going into GCOFF, this flag taken from the opengpu driver is set whenever runtime suspend is enterning GCOFF but not for normal suspend paths.
This just refactors the code, a subsequent patch use the information.
--- drivers/gpu/drm/nouveau/include/nvif/client.h | 2 - drivers/gpu/drm/nouveau/include/nvif/driver.h | 2 - drivers/gpu/drm/nouveau/include/nvkm/core/device.h | 3 + drivers/gpu/drm/nouveau/include/nvkm/core/engine.h | 2 - drivers/gpu/drm/nouveau/include/nvkm/core/object.h | 5 +-- drivers/gpu/drm/nouveau/include/nvkm/core/oproxy.h | 2 - drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h | 4 +- drivers/gpu/drm/nouveau/include/nvkm/core/suspend_state.h | 11 +++++++ drivers/gpu/drm/nouveau/nouveau_drm.c | 2 - drivers/gpu/drm/nouveau/nouveau_nvif.c | 10 +++++- drivers/gpu/drm/nouveau/nvif/client.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/engine.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/ioctl.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/object.c | 20 ++++++++++-- drivers/gpu/drm/nouveau/nvkm/core/oproxy.c | 2 - drivers/gpu/drm/nouveau/nvkm/core/subdev.c | 18 +++++++++-- drivers/gpu/drm/nouveau/nvkm/core/uevent.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/ce/ga100.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/ce/priv.h | 2 - drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 22 ++++++++++---- drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/device/priv.h | 2 - drivers/gpu/drm/nouveau/nvkm/engine/device/user.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/chan.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/falcon.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c | 6 +-- drivers/gpu/drm/nouveau/nvkm/engine/gr/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/gr/nv04.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/gr/nv10.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.h | 2 - drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/sec2/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/engine/xtensa.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/devinit/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/fault/user.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/gpio/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/gsp/gh100.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h | 8 ++--- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 6 +-- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 2 - 56 files changed, 139 insertions(+), 84 deletions(-) create mode 100644 drivers/gpu/drm/nouveau/include/nvkm/core/suspend_state.h
drivers/gpu/drm/nouveau/include/nvif/client.h +1 -1
@@ -11,7 +11,7 @@ struct nvif_client {int nvif_client_ctor (struct nvif_client *parent,const char *name,struct nvif_client *);void nvif_client_dtor (struct nvif_client *); -int nvif_client_suspend (struct nvif_client *); +int nvif_client_suspend (struct nvif_client *,bool );int nvif_client_resume (struct nvif_client *);/*XXX*/
drivers/gpu/drm/nouveau/include/nvif/driver.h +1 -1
@@ -8,7 +8,7 @@ struct nvif_driver {const char *name;int (*init)(const char *name,u64 device,const char *cfg,const char *dbg,void **priv); -int (*suspend)(void *priv); +int (*suspend)(void *priv,bool runtime);int (*resume)(void *priv);int (*ioctl)(void *priv,void *data,u32 size,void **hack);void __iomem *(*map)(void *priv,u64 handle,u32 size);
drivers/gpu/drm/nouveau/include/nvkm/core/device.h +2 -1
@@ -2,6 +2,7 @@#ifndef __NVKM_DEVICE_H__#define __NVKM_DEVICE_H__#include <core/oclass.h> +#include <core/suspend_state.h> #include <core/intr.h> enum nvkm_subdev_type ;
@@ -93,7 +94,7 @@ struct nvkm_device_func {void *(*dtor)(struct nvkm_device *);int (*preinit)(struct nvkm_device *);int (*init)(struct nvkm_device *); -void (*fini)(struct nvkm_device *,bool suspend); +void (*fini)(struct nvkm_device *,enum nvkm_suspend_state suspend);int (*irq)(struct nvkm_device *);resource_size_t (*resource_addr)(struct nvkm_device *,enum nvkm_bar_id );resource_size_t (*resource_size)(struct nvkm_device *,enum nvkm_bar_id );
drivers/gpu/drm/nouveau/include/nvkm/core/engine.h +1 -1
@@ -20,7 +20,7 @@ struct nvkm_engine_func {int (*oneinit)(struct nvkm_engine *);int (*info)(struct nvkm_engine *,u64 mthd,u64 *data);int (*init)(struct nvkm_engine *); -int (*fini)(struct nvkm_engine *,bool suspend); +int (*fini)(struct nvkm_engine *,enum nvkm_suspend_state suspend);int (*reset)(struct nvkm_engine *);int (*nonstall)(struct nvkm_engine *);void (*intr)(struct nvkm_engine *);
drivers/gpu/drm/nouveau/include/nvkm/core/object.h +3 -2
@@ -2,6 +2,7 @@#ifndef __NVKM_OBJECT_H__#define __NVKM_OBJECT_H__#include <core/oclass.h> +#include <core/suspend_state.h> struct nvkm_event ;struct nvkm_gpuobj ;struct nvkm_uevent ;
@@ -27,7 +28,7 @@ enum nvkm_object_map {struct nvkm_object_func {void *(*dtor)(struct nvkm_object *);int (*init)(struct nvkm_object *); -int (*fini)(struct nvkm_object *,bool suspend); +int (*fini)(struct nvkm_object *,enum nvkm_suspend_state suspend);int (*mthd)(struct nvkm_object *,u32 mthd,void *data,u32 size);int (*ntfy)(struct nvkm_object *,u32 mthd,struct nvkm_event **); int (*map)(struct nvkm_object *, void *argv, u32 argc,
@@ -49,7 +50,7 @@ int nvkm_object_new(const struct nvkm_ocvoid nvkm_object_del (struct nvkm_object **);void *nvkm_object_dtor (struct nvkm_object *);int nvkm_object_init (struct nvkm_object *); -int nvkm_object_fini (struct nvkm_object *,bool suspend); +int nvkm_object_fini (struct nvkm_object *,enum nvkm_suspend_state );int nvkm_object_mthd (struct nvkm_object *,u32 mthd,void *data,u32 size);int nvkm_object_ntfy (struct nvkm_object *,u32 mthd,struct nvkm_event **); int nvkm_object_map(struct nvkm_object *, void *argv, u32 argc,
drivers/gpu/drm/nouveau/include/nvkm/core/oproxy.h +1 -1
@@ -13,7 +13,7 @@ struct nvkm_oproxy {struct nvkm_oproxy_func {void (*dtor[2 ])(struct nvkm_oproxy *);int (*init[2 ])(struct nvkm_oproxy *); -int (*fini[2 ])(struct nvkm_oproxy *,bool suspend); +int (*fini[2 ])(struct nvkm_oproxy *,enum nvkm_suspend_state suspend); }; void nvkm_oproxy_ctor(const struct nvkm_oproxy_func *,
drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h +2 -2
@@ -40,7 +40,7 @@ struct nvkm_subdev_func {int (*oneinit)(struct nvkm_subdev *);int (*info)(struct nvkm_subdev *,u64 mthd,u64 *data);int (*init)(struct nvkm_subdev *); -int (*fini)(struct nvkm_subdev *,bool suspend); +int (*fini)(struct nvkm_subdev *,enum nvkm_suspend_state suspend);void (*intr)(struct nvkm_subdev *); };
@@ -65,7 +65,7 @@ void nvkm_subdev_unref(struct nvkm_subdeint nvkm_subdev_preinit (struct nvkm_subdev *);int nvkm_subdev_oneinit (struct nvkm_subdev *);int nvkm_subdev_init (struct nvkm_subdev *); -int nvkm_subdev_fini (struct nvkm_subdev *,bool suspend); +int nvkm_subdev_fini (struct nvkm_subdev *,enum nvkm_suspend_state suspend);int nvkm_subdev_info (struct nvkm_subdev *,u64 ,u64 *);void nvkm_subdev_intr (struct nvkm_subdev *);
drivers/gpu/drm/nouveau/include/nvkm/core/suspend_state.h new file +11 -0
@@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: MIT */ +#ifndef __NVKM_SUSPEND_STATE_H__ +#define __NVKM_SUSPEND_STATE_H__ + +enum nvkm_suspend_state { +NVKM_POWEROFF , +NVKM_SUSPEND , +NVKM_RUNTIME_SUSPEND , +}; + +#endif
drivers/gpu/drm/nouveau/nouveau_drm.c +1 -1
@@ -983,7 +983,7 @@ nouveau_do_suspend(struct nouveau_drm *d }NV_DEBUG (drm,"suspending object tree...\n" ); - ret =nvif_client_suspend (&drm->_client); + ret =nvif_client_suspend (&drm->_client, runtime);if (ret) goto fail_client;
drivers/gpu/drm/nouveau/nouveau_nvif.c +8 -2
@@ -62,10 +62,16 @@ nvkm_client_resume(void *priv) }static int -nvkm_client_suspend (void *priv) +nvkm_client_suspend (void *priv,bool runtime) {struct nvkm_client *client = priv; -return nvkm_object_fini (&client->object, true); +enum nvkm_suspend_state state; + +if (runtime) + state =NVKM_RUNTIME_SUSPEND ; +else + state =NVKM_SUSPEND ; +return nvkm_object_fini (&client->object, state); } static int
drivers/gpu/drm/nouveau/nvif/client.c +2 -2
@@ -30,9 +30,9 @@#include <nvif/if0000.h> int -nvif_client_suspend (struct nvif_client *client) +nvif_client_suspend (struct nvif_client *client,bool runtime) { -return client->driver->suspend (client->object.priv); +return client->driver->suspend (client->object.priv, runtime); }int
drivers/gpu/drm/nouveau/nvkm/core/engine.c +2 -2
@@ -41,7 +41,7 @@ nvkm_engine_reset(struct nvkm_engine *enif (engine->func->reset)return engine->func->reset (engine); -nvkm_subdev_fini (&engine->subdev, false); +nvkm_subdev_fini (&engine->subdev,NVKM_POWEROFF );return nvkm_subdev_init (&engine->subdev); }
@@ -98,7 +98,7 @@ nvkm_engine_info(struct nvkm_subdev *sub }static int -nvkm_engine_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_engine_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_engine *engine =nvkm_engine (subdev);if (engine->func->fini)
drivers/gpu/drm/nouveau/nvkm/core/ioctl.c +2 -2
@@ -141,7 +141,7 @@ nvkm_ioctl_new(struct nvkm_client *clien } ret = -EEXIST ; } -nvkm_object_fini (object, false); +nvkm_object_fini (object,NVKM_POWEROFF ); }nvkm_object_del (&object);
@@ -160,7 +160,7 @@ nvkm_ioctl_del(struct nvkm_client *cliennvif_ioctl (object,"delete size %d\n" , size);if (!(ret =nvif_unvers (ret, &data, &size, args->none))) {nvif_ioctl (object,"delete\n" ); -nvkm_object_fini (object, false); +nvkm_object_fini (object,NVKM_POWEROFF );nvkm_object_del (&object); }
drivers/gpu/drm/nouveau/nvkm/core/object.c +16 -4
@@ -142,13 +142,25 @@ nvkm_object_bind(struct nvkm_object *obj }int -nvkm_object_fini (struct nvkm_object *object,bool suspend) +nvkm_object_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) { -const char *action = suspend ?"suspend" :"fini" ; +const char *action;struct nvkm_object *child;s64 time;int ret; +switch (suspend) { +case NVKM_POWEROFF : +default : + action ="fini" ; +break ; +case NVKM_SUSPEND : + action ="suspend" ; +break ; +case NVKM_RUNTIME_SUSPEND : + action ="runtime" ; +break ; + }nvif_debug (object,"%s children...\n" , action); time =ktime_to_us (ktime_get ());list_for_each_entry_reverse (child, &object->tree, head) {
@@ -212,11 +224,11 @@ nvkm_object_init(struct nvkm_object *obj fail_child:list_for_each_entry_continue_reverse (child, &object->tree, head) -nvkm_object_fini (child, false); +nvkm_object_fini (child,NVKM_POWEROFF ); fail:nvif_error (object,"init failed with %d\n" , ret);if (object->func->fini) - object->func->fini (object, false); + object->func->fini (object,NVKM_POWEROFF );return ret; }
drivers/gpu/drm/nouveau/nvkm/core/oproxy.c +1 -1
@@ -87,7 +87,7 @@ nvkm_oproxy_uevent(struct nvkm_object *o }static int -nvkm_oproxy_fini (struct nvkm_object *object,bool suspend) +nvkm_oproxy_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nvkm_oproxy *oproxy =nvkm_oproxy (object);int ret;
drivers/gpu/drm/nouveau/nvkm/core/subdev.c +15 -3
@@ -51,12 +51,24 @@ nvkm_subdev_info(struct nvkm_subdev *sub }int -nvkm_subdev_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_subdev_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_device *device = subdev->device; -const char *action = suspend ?"suspend" : subdev->use.enabled ?"fini" :"reset" ; +const char *action;s64 time; +switch (suspend) { +case NVKM_POWEROFF : +default : + action = subdev->use.enabled ?"fini" :"reset" ; +break ; +case NVKM_SUSPEND : + action ="suspend" ; +break ; +case NVKM_RUNTIME_SUSPEND : + action ="runtime" ; +break ; + }nvkm_trace (subdev,"%s running...\n" , action); time =ktime_to_us (ktime_get ());
@@ -186,7 +198,7 @@ void nvkm_subdev_unref(struct nvkm_subdev *subdev) {if (refcount_dec_and_mutex_lock (&subdev->use.refcount, &subdev->use.mutex)) { -nvkm_subdev_fini (subdev, false); +nvkm_subdev_fini (subdev,NVKM_POWEROFF );mutex_unlock (&subdev->use.mutex); } }
drivers/gpu/drm/nouveau/nvkm/core/uevent.c +1 -1
@@ -73,7 +73,7 @@ nvkm_uevent_mthd(struct nvkm_object *obj }static int -nvkm_uevent_fini (struct nvkm_object *object,bool suspend) +nvkm_uevent_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nvkm_uevent *uevent =nvkm_uevent (object);
drivers/gpu/drm/nouveau/nvkm/engine/ce/ga100.c +1 -1
@@ -46,7 +46,7 @@ ga100_ce_nonstall(struct nvkm_engine *en }int -ga100_ce_fini (struct nvkm_engine *engine,bool suspend) +ga100_ce_fini (struct nvkm_engine *engine,enum nvkm_suspend_state suspend) {nvkm_inth_block (&engine->subdev.inth);return 0 ;
drivers/gpu/drm/nouveau/nvkm/engine/ce/priv.h +1 -1
@@ -14,7 +14,7 @@ extern const struct nvkm_object_func gv1int ga100_ce_oneinit (struct nvkm_engine *);int ga100_ce_init (struct nvkm_engine *); -int ga100_ce_fini (struct nvkm_engine *,bool ); +int ga100_ce_fini (struct nvkm_engine *,enum nvkm_suspend_state );int ga100_ce_nonstall (struct nvkm_engine *);u32 gb202_ce_grce_mask (struct nvkm_device *);
drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +17 -5
@@ -2935,13 +2935,25 @@ nvkm_device_engine(struct nvkm_device *d }int -nvkm_device_fini (struct nvkm_device *device,bool suspend) +nvkm_device_fini (struct nvkm_device *device,enum nvkm_suspend_state suspend) { -const char *action = suspend ?"suspend" :"fini" ; +const char *action;struct nvkm_subdev *subdev;int ret;s64 time; +switch (suspend) { +case NVKM_POWEROFF : +default : + action ="fini" ; +break ; +case NVKM_SUSPEND : + action ="suspend" ; +break ; +case NVKM_RUNTIME_SUSPEND : + action ="runtime" ; +break ; + }nvdev_trace (device,"%s running...\n" , action); time =ktime_to_us (ktime_get ());
@@ -3031,7 +3043,7 @@ nvkm_device_init(struct nvkm_device *devif (ret)return ret; -nvkm_device_fini (device, false); +nvkm_device_fini (device,NVKM_POWEROFF );nvdev_trace (device,"init running...\n" ); time =ktime_to_us (ktime_get ());
@@ -3059,9 +3071,9 @@ nvkm_device_init(struct nvkm_device *dev fail_subdev:list_for_each_entry_from (subdev, &device->subdev, head) -nvkm_subdev_fini (subdev, false); +nvkm_subdev_fini (subdev,NVKM_POWEROFF ); fail: -nvkm_device_fini (device, false); +nvkm_device_fini (device,NVKM_POWEROFF );nvdev_error (device,"init failed with %d\n" , ret);return ret;
drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c +2 -2
@@ -1605,10 +1605,10 @@ nvkm_device_pci_irq(struct nvkm_device * }static void -nvkm_device_pci_fini (struct nvkm_device *device,bool suspend) +nvkm_device_pci_fini (struct nvkm_device *device,enum nvkm_suspend_state suspend) {struct nvkm_device_pci *pdev =nvkm_device_pci (device); -if (suspend) { +if (suspend !=NVKM_POWEROFF ) {pci_disable_device (pdev->pdev); pdev->suspend = true; }
drivers/gpu/drm/nouveau/nvkm/engine/device/priv.h +1 -1
@@ -56,5 +56,5 @@ int nvkm_device_ctor(const struct nvkm_ const char *name, const char *cfg, const char *dbg, struct nvkm_device *);int nvkm_device_init (struct nvkm_device *); -int nvkm_device_fini (struct nvkm_device *,bool suspend); +int nvkm_device_fini (struct nvkm_device *,enum nvkm_suspend_state suspend);#endif
drivers/gpu/drm/nouveau/nvkm/engine/device/user.c +1 -1
@@ -218,7 +218,7 @@ nvkm_udevice_map(struct nvkm_object *obj }static int -nvkm_udevice_fini (struct nvkm_object *object,bool suspend) +nvkm_udevice_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nvkm_udevice *udev =nvkm_udevice (object);struct nvkm_device *device = udev->device;
drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c +2 -2
@@ -99,13 +99,13 @@ nvkm_disp_intr(struct nvkm_engine *engin }static int -nvkm_disp_fini (struct nvkm_engine *engine,bool suspend) +nvkm_disp_fini (struct nvkm_engine *engine,enum nvkm_suspend_state suspend) {struct nvkm_disp *disp =nvkm_disp (engine);struct nvkm_outp *outp;if (disp->func->fini) - disp->func->fini (disp, suspend); + disp->func->fini (disp, suspend !=NVKM_POWEROFF );list_for_each_entry (outp, &disp->outps, head) {if (outp->func->fini)
drivers/gpu/drm/nouveau/nvkm/engine/disp/chan.c +1 -1
@@ -128,7 +128,7 @@ nvkm_disp_chan_child_get(struct nvkm_obj }static int -nvkm_disp_chan_fini (struct nvkm_object *object,bool suspend) +nvkm_disp_chan_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nvkm_disp_chan *chan =nvkm_disp_chan (object);
drivers/gpu/drm/nouveau/nvkm/engine/falcon.c +2 -2
@@ -93,13 +93,13 @@ nvkm_falcon_intr(struct nvkm_engine *eng }static int -nvkm_falcon_fini (struct nvkm_engine *engine,bool suspend) +nvkm_falcon_fini (struct nvkm_engine *engine,enum nvkm_suspend_state suspend) {struct nvkm_falcon *falcon =nvkm_falcon (engine);struct nvkm_device *device = falcon->engine.subdev.device;const u32 base = falcon->addr; -if (!suspend) { +if (suspend ==NVKM_POWEROFF ) {nvkm_memory_unref (&falcon->core);if (falcon->external) {vfree (falcon->data.data);
drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c +1 -1
@@ -122,7 +122,7 @@ nvkm_fifo_class_get(struct nvkm_oclass * }static int -nvkm_fifo_fini (struct nvkm_engine *engine,bool suspend) +nvkm_fifo_fini (struct nvkm_engine *engine,enum nvkm_suspend_state suspend) {struct nvkm_fifo *fifo =nvkm_fifo (engine);struct nvkm_runl *runl;
drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c +3 -3
@@ -72,7 +72,7 @@ struct nvkm_uobj { };static int -nvkm_uchan_object_fini_1 (struct nvkm_oproxy *oproxy,bool suspend) +nvkm_uchan_object_fini_1 (struct nvkm_oproxy *oproxy,enum nvkm_suspend_state suspend) {struct nvkm_uobj *uobj =container_of (oproxy,typeof (*uobj), oproxy);struct nvkm_chan *chan = uobj->chan;
@@ -87,7 +87,7 @@ nvkm_uchan_object_fini_1(struct nvkm_oprnvkm_chan_cctx_bind (chan, ectx->engn,NULL );if (refcount_dec_and_test (&ectx->uses)) -nvkm_object_fini (ectx->object, false); +nvkm_object_fini (ectx->object,NVKM_POWEROFF );mutex_unlock (&chan->cgrp->mutex); }
@@ -269,7 +269,7 @@ nvkm_uchan_map(struct nvkm_object *objec }static int -nvkm_uchan_fini (struct nvkm_object *object,bool suspend) +nvkm_uchan_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nvkm_chan *chan =nvkm_uchan (object)->chan;
drivers/gpu/drm/nouveau/nvkm/engine/gr/base.c +2 -2
@@ -168,11 +168,11 @@ nvkm_gr_init(struct nvkm_engine *engine) }static int -nvkm_gr_fini (struct nvkm_engine *engine,bool suspend) +nvkm_gr_fini (struct nvkm_engine *engine,enum nvkm_suspend_state suspend) {struct nvkm_gr *gr =nvkm_gr (engine);if (gr->func->fini) -return gr->func->fini (gr, suspend); +return gr->func->fini (gr, suspend !=NVKM_POWEROFF );return 0 ; }
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +1 -1
@@ -2330,7 +2330,7 @@ gf100_gr_reset(struct nvkm_gr *base)WARN_ON (gf100_gr_fecs_halt_pipeline (gr)); - subdev->func->fini (subdev, false); + subdev->func->fini (subdev,NVKM_POWEROFF );nvkm_mc_disable (device, subdev->type, subdev->inst);if (gr->func->gpccs.reset) gr->func->gpccs.reset (gr);
drivers/gpu/drm/nouveau/nvkm/engine/gr/nv04.c +1 -1
@@ -1158,7 +1158,7 @@ nv04_gr_chan_dtor(struct nvkm_object *ob }static int -nv04_gr_chan_fini (struct nvkm_object *object,bool suspend) +nv04_gr_chan_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nv04_gr_chan *chan =nv04_gr_chan (object);struct nv04_gr *gr = chan->gr;
drivers/gpu/drm/nouveau/nvkm/engine/gr/nv10.c +1 -1
@@ -951,7 +951,7 @@ nv10_gr_context_switch(struct nv10_gr *g }static int -nv10_gr_chan_fini (struct nvkm_object *object,bool suspend) +nv10_gr_chan_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nv10_gr_chan *chan =nv10_gr_chan (object);struct nv10_gr *gr = chan->gr;
drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.c +1 -1
@@ -27,7 +27,7 @@ nv20_gr_chan_init(struct nvkm_object *ob }int -nv20_gr_chan_fini (struct nvkm_object *object,bool suspend) +nv20_gr_chan_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nv20_gr_chan *chan =nv20_gr_chan (object);struct nv20_gr *gr = chan->gr;
drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.h +1 -1
@@ -31,5 +31,5 @@ struct nv20_gr_chan {void *nv20_gr_chan_dtor (struct nvkm_object *);int nv20_gr_chan_init (struct nvkm_object *); -int nv20_gr_chan_fini (struct nvkm_object *,bool ); +int nv20_gr_chan_fini (struct nvkm_object *,enum nvkm_suspend_state );#endif
drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c +2 -2
@@ -89,7 +89,7 @@ nv40_gr_chan_bind(struct nvkm_object *ob }static int -nv40_gr_chan_fini (struct nvkm_object *object,bool suspend) +nv40_gr_chan_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nv40_gr_chan *chan =nv40_gr_chan (object);struct nv40_gr *gr = chan->gr;
@@ -101,7 +101,7 @@ nv40_gr_chan_fini(struct nvkm_object *obnvkm_mask (device,0x400720 ,0x00000001 ,0x00000000 );if (nvkm_rd32 (device,0x40032c ) == inst) { -if (suspend) { +if (suspend !=NVKM_POWEROFF ) {nvkm_wr32 (device,0x400720 ,0x00000000 );nvkm_wr32 (device,0x400784 , inst);nvkm_mask (device,0x400310 ,0x00000020 ,0x00000020 );
drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c +1 -1
@@ -65,7 +65,7 @@ nv44_mpeg_chan_bind(struct nvkm_object * }static int -nv44_mpeg_chan_fini (struct nvkm_object *object,bool suspend) +nv44_mpeg_chan_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nv44_mpeg_chan *chan =nv44_mpeg_chan (object);
drivers/gpu/drm/nouveau/nvkm/engine/sec2/base.c +1 -1
@@ -37,7 +37,7 @@ nvkm_sec2_finimsg(void *priv, struct nvf }static int -nvkm_sec2_fini (struct nvkm_engine *engine,bool suspend) +nvkm_sec2_fini (struct nvkm_engine *engine,enum nvkm_suspend_state suspend) {struct nvkm_sec2 *sec2 =nvkm_sec2 (engine);struct nvkm_subdev *subdev = &sec2->engine.subdev;
drivers/gpu/drm/nouveau/nvkm/engine/xtensa.c +2 -2
@@ -76,7 +76,7 @@ nvkm_xtensa_intr(struct nvkm_engine *eng }static int -nvkm_xtensa_fini (struct nvkm_engine *engine,bool suspend) +nvkm_xtensa_fini (struct nvkm_engine *engine,enum nvkm_suspend_state suspend) {struct nvkm_xtensa *xtensa =nvkm_xtensa (engine);struct nvkm_device *device = xtensa->engine.subdev.device;
@@ -85,7 +85,7 @@ nvkm_xtensa_fini(struct nvkm_engine *engnvkm_wr32 (device, base +0xd84 ,0 );/* INTR_EN */ nvkm_wr32 (device, base +0xd94 ,0 );/* FIFO_CTRL */ -if (!suspend) +if (suspend ==NVKM_POWEROFF )nvkm_memory_unref (&xtensa->gpu_fw);return 0 ; }
drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c +1 -1
@@ -182,7 +182,7 @@ nvkm_acr_managed_falcon(struct nvkm_devi }static int -nvkm_acr_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_acr_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {if (!subdev->use.enabled)return 0 ;
drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c +1 -1
@@ -90,7 +90,7 @@ nvkm_bar_bar2_init(struct nvkm_device *d }static int -nvkm_bar_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_bar_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_bar *bar =nvkm_bar (subdev);
drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c +1 -1
@@ -577,7 +577,7 @@ nvkm_clk_read(struct nvkm_clk *clk, enum }static int -nvkm_clk_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_clk_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_clk *clk =nvkm_clk (subdev);flush_work (&clk->work);
drivers/gpu/drm/nouveau/nvkm/subdev/devinit/base.c +2 -2
@@ -67,11 +67,11 @@ nvkm_devinit_post(struct nvkm_devinit *i }static int -nvkm_devinit_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_devinit_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_devinit *init =nvkm_devinit (subdev);/* force full reinit on resume */ -if (suspend) +if (suspend !=NVKM_POWEROFF ) init->post = true;return 0 ; }
drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c +1 -1
@@ -51,7 +51,7 @@ nvkm_fault_intr(struct nvkm_subdev *subd }static int -nvkm_fault_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_fault_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_fault *fault =nvkm_fault (subdev);if (fault->func->fini)
drivers/gpu/drm/nouveau/nvkm/subdev/fault/user.c +1 -1
@@ -56,7 +56,7 @@ nvkm_ufault_map(struct nvkm_object *obje }static int -nvkm_ufault_fini (struct nvkm_object *object,bool suspend) +nvkm_ufault_fini (struct nvkm_object *object,enum nvkm_suspend_state suspend) {struct nvkm_fault_buffer *buffer =nvkm_fault_buffer (object); buffer->fault->func->buffer.fini (buffer);
drivers/gpu/drm/nouveau/nvkm/subdev/gpio/base.c +1 -1
@@ -144,7 +144,7 @@ nvkm_gpio_intr(struct nvkm_subdev *subde }static int -nvkm_gpio_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_gpio_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_gpio *gpio =nvkm_gpio (subdev);u32 mask = (1ULL << gpio->func->lines) -1 ;
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c +1 -1
@@ -48,7 +48,7 @@ nvkm_gsp_intr_stall(struct nvkm_gsp *gsp }static int -nvkm_gsp_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_gsp_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_gsp *gsp =nvkm_gsp (subdev);
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/gh100.c +1 -1
@@ -17,7 +17,7 @@#include <nvhw/ref/gh100/dev_riscv_pri.h> int -gh100_gsp_fini (struct nvkm_gsp *gsp,bool suspend) +gh100_gsp_fini (struct nvkm_gsp *gsp,enum nvkm_suspend_state suspend) {struct nvkm_falcon *falcon = &gsp->falcon;int ret, time =4000 ;
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h +4 -4
@@ -59,7 +59,7 @@ struct nvkm_gsp_func {void (*dtor)(struct nvkm_gsp *);int (*oneinit)(struct nvkm_gsp *);int (*init)(struct nvkm_gsp *); -int (*fini)(struct nvkm_gsp *,bool suspend); +int (*fini)(struct nvkm_gsp *,enum nvkm_suspend_state suspend);int (*reset)(struct nvkm_gsp *);struct {
@@ -75,7 +75,7 @@ int tu102_gsp_fwsec_sb_ctor(struct nvkm_void tu102_gsp_fwsec_sb_dtor (struct nvkm_gsp *);int tu102_gsp_oneinit (struct nvkm_gsp *);int tu102_gsp_init (struct nvkm_gsp *); -int tu102_gsp_fini (struct nvkm_gsp *,bool suspend); +int tu102_gsp_fini (struct nvkm_gsp *,enum nvkm_suspend_state suspend);int tu102_gsp_reset (struct nvkm_gsp *);u64 tu102_gsp_wpr_heap_size (struct nvkm_gsp *);
@@ -87,12 +87,12 @@ int ga102_gsp_reset(struct nvkm_gsp *);int gh100_gsp_oneinit (struct nvkm_gsp *);int gh100_gsp_init (struct nvkm_gsp *); -int gh100_gsp_fini (struct nvkm_gsp *,bool suspend); +int gh100_gsp_fini (struct nvkm_gsp *,enum nvkm_suspend_state suspend);void r535_gsp_dtor (struct nvkm_gsp *);int r535_gsp_oneinit (struct nvkm_gsp *);int r535_gsp_init (struct nvkm_gsp *); -int r535_gsp_fini (struct nvkm_gsp *,bool suspend); +int r535_gsp_fini (struct nvkm_gsp *,enum nvkm_suspend_state suspend);int nvkm_gsp_new_ (const struct nvkm_gsp_fwif *,struct nvkm_device *,enum nvkm_subdev_type ,int ,struct nvkm_gsp **);
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c +1 -1
@@ -1721,7 +1721,7 @@ r535_gsp_sr_data_size(struct nvkm_gsp *g }int -r535_gsp_fini (struct nvkm_gsp *gsp,bool suspend) +r535_gsp_fini (struct nvkm_gsp *gsp,enum nvkm_suspend_state suspend) {struct nvkm_rm *rm = gsp->rm;int ret;
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c +1 -1
@@ -161,7 +161,7 @@ tu102_gsp_reset(struct nvkm_gsp *gsp) }int -tu102_gsp_fini (struct nvkm_gsp *gsp,bool suspend) +tu102_gsp_fini (struct nvkm_gsp *gsp,enum nvkm_suspend_state suspend) {u32 mbox0 =0xff , mbox1 =0xff ;int ret;
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c +1 -1
@@ -135,7 +135,7 @@ nvkm_i2c_intr(struct nvkm_subdev *subdev }static int -nvkm_i2c_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_i2c_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_i2c *i2c =nvkm_i2c (subdev);struct nvkm_i2c_pad *pad;
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c +1 -1
@@ -176,7 +176,7 @@ nvkm_instmem_boot(struct nvkm_instmem *i }static int -nvkm_instmem_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_instmem_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_instmem *imem =nvkm_instmem (subdev);int ret;
drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +1 -1
@@ -74,7 +74,7 @@ nvkm_pci_rom_shadow(struct nvkm_pci *pci }static int -nvkm_pci_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_pci_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_pci *pci =nvkm_pci (subdev);
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c +1 -1
@@ -77,7 +77,7 @@ nvkm_pmu_intr(struct nvkm_subdev *subdev }static int -nvkm_pmu_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_pmu_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_pmu *pmu =nvkm_pmu (subdev);
drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c +3 -3
@@ -341,15 +341,15 @@ nvkm_therm_intr(struct nvkm_subdev *subd }static int -nvkm_therm_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_therm_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_therm *therm =nvkm_therm (subdev);if (therm->func->fini) therm->func->fini (therm); -nvkm_therm_fan_fini (therm, suspend); -nvkm_therm_sensor_fini (therm, suspend); +nvkm_therm_fan_fini (therm, suspend !=NVKM_POWEROFF ); +nvkm_therm_sensor_fini (therm, suspend !=NVKM_POWEROFF );if (suspend) { therm->suspend = therm->mode;
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +1 -1
@@ -149,7 +149,7 @@ nvkm_timer_intr(struct nvkm_subdev *subd }static int -nvkm_timer_fini (struct nvkm_subdev *subdev,bool suspend) +nvkm_timer_fini (struct nvkm_subdev *subdev,enum nvkm_suspend_state suspend) {struct nvkm_timer *tmr =nvkm_timer (subdev); tmr->func->alarm_fini (tmr);
Greg Kroah-Hartman
maintainerPATCH 27/175 nouveau/gsp: use rpc sequence numbers properly.
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit 90caca3b7264cc3e92e347b2004fff4e386fc26e upstream.
There are two layers of sequence numbers, one at the msg level and one at the rpc level.
570 firmware started asserting on the sequence numbers being in the right order, and we would see nocat records with asserts in them.
Add the rpc level sequence number support.
--- drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 6 ++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 4 ++-- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 6 ++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 2 +- 4 files changed, 15 insertions(+), 3 deletions(-)
drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h +6 -0
@@ -44,6 +44,9 @@ typedef void (*nvkm_gsp_event_func)(stru* NVKM_GSP_RPC_REPLY_NOWAIT - If specified, immediately return to the * caller after the GSP RPC command is issued. * +* NVKM_GSP_RPC_REPLY_NOSEQ - If specified, exactly like NOWAIT +* but don't emit RPC sequence number. +* * NVKM_GSP_RPC_REPLY_RECV - If specified, wait and receive the entire GSP * RPC message after the GSP RPC command is issued. *
@@ -53,6 +56,7 @@ typedef void (*nvkm_gsp_event_func)(stru*/ enum nvkm_gsp_rpc_reply_policy {NVKM_GSP_RPC_REPLY_NOWAIT =0 , +NVKM_GSP_RPC_REPLY_NOSEQ ,NVKM_GSP_RPC_REPLY_RECV ,NVKM_GSP_RPC_REPLY_POLL , };
@@ -242,6 +246,8 @@ struct nvkm_gsp {/* The size of the registry RPC */ size_t registry_rpc_size; +u32 rpc_seq; +#ifdef CONFIG_DEBUG_FS /* * Logging buffers in debugfs. The wrapper objects need to remain
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c +2 -2
@@ -704,7 +704,7 @@ r535_gsp_rpc_set_registry(struct nvkm_gsbuild_registry (gsp, rpc); -return nvkm_gsp_rpc_wr (gsp, rpc,NVKM_GSP_RPC_REPLY_NOWAIT ); +return nvkm_gsp_rpc_wr (gsp, rpc,NVKM_GSP_RPC_REPLY_NOSEQ ); fail:clean_registry (gsp);
@@ -921,7 +921,7 @@ r535_gsp_set_system_info(struct nvkm_gsp info->pciConfigMirrorSize = device->pci->func->cfg.size;r535_gsp_acpi_info (gsp, &info->acpiMethodData); -return nvkm_gsp_rpc_wr (gsp, info,NVKM_GSP_RPC_REPLY_NOWAIT ); +return nvkm_gsp_rpc_wr (gsp, info,NVKM_GSP_RPC_REPLY_NOSEQ ); } static int
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c +6 -0
@@ -557,6 +557,7 @@ r535_gsp_rpc_handle_reply(struct nvkm_gsswitch (policy) {case NVKM_GSP_RPC_REPLY_NOWAIT : +case NVKM_GSP_RPC_REPLY_NOSEQ :break ;case NVKM_GSP_RPC_REPLY_RECV : reply =r535_gsp_msg_recv (gsp, fn, gsp_rpc_len);
@@ -588,6 +589,11 @@ r535_gsp_rpc_send(struct nvkm_gsp *gsp, rpc->data, rpc->length - sizeof(*rpc), true); } +if (policy ==NVKM_GSP_RPC_REPLY_NOSEQ ) + rpc->sequence =0 ; +else + rpc->sequence = gsp->rpc_seq++; + ret =r535_gsp_cmdq_push (gsp, rpc);if (ret)return ERR_PTR (ret);
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c +1 -1
@@ -176,7 +176,7 @@ r570_gsp_set_system_info(struct nvkm_gsp info->bIsPrimary =video_is_primary_device (device->dev); info->bPreserveVideoMemoryAllocations = false; -return nvkm_gsp_rpc_wr (gsp, info,NVKM_GSP_RPC_REPLY_NOWAIT ); +return nvkm_gsp_rpc_wr (gsp, info,NVKM_GSP_RPC_REPLY_NOSEQ ); } static void
Greg Kroah-Hartman
maintainerPATCH 28/175 nouveau/gsp: fix suspend/resume regression on r570 firmware
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit 8302d0afeaec0bc57d951dd085e0cffe997d4d18 upstream.
The r570 firmware with certain GPUs (at least RTX6000) needs this flag to reflect the suspend vs runtime PM state of the driver.
This uses that info to set the correct flags to the firmware.
This fixes a regression on RTX6000 and other GPUs since r570 firmware was enabled.
--- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/fbsr.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c | 8 ++++---- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/fbsr.c +1 -1
@@ -208,7 +208,7 @@ r535_fbsr_resume(struct nvkm_gsp *gsp) }static int -r535_fbsr_suspend (struct nvkm_gsp *gsp) +r535_fbsr_suspend (struct nvkm_gsp *gsp,bool runtime) {struct nvkm_subdev *subdev = &gsp->subdev;struct nvkm_device *device = subdev->device;
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c +1 -1
@@ -1748,7 +1748,7 @@ r535_gsp_fini(struct nvkm_gsp *gsp, enum sr->sysmemAddrOfSuspendResumeData = gsp->sr.radix3.lvl0.addr; sr->sizeOfSuspendResumeData = len; - ret = rm->api->fbsr->suspend (gsp); + ret = rm->api->fbsr->suspend (gsp, suspend ==NVKM_RUNTIME_SUSPEND );if (ret) {nvkm_gsp_mem_dtor (&gsp->sr.meta);nvkm_gsp_radix3_dtor (gsp, &gsp->sr.radix3);
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c +4 -4
@@ -62,7 +62,7 @@ r570_fbsr_resume(struct nvkm_gsp *gsp) }static int -r570_fbsr_init (struct nvkm_gsp *gsp,struct sg_table *sgt,u64 size) +r570_fbsr_init (struct nvkm_gsp *gsp,struct sg_table *sgt,u64 size,bool runtime) {NV2080_CTRL_INTERNAL_FBSR_INIT_PARAMS *ctrl;struct nvkm_gsp_object memlist;
@@ -81,7 +81,7 @@ r570_fbsr_init(struct nvkm_gsp *gsp, str ctrl->hClient = gsp->internal.client.object.handle; ctrl->hSysMem = memlist.handle; ctrl->sysmemAddrOfSuspendResumeData = gsp->sr.meta.addr; - ctrl->bEnteringGcoffState =1 ; + ctrl->bEnteringGcoffState = runtime ?1 :0 ; ret =nvkm_gsp_rm_ctrl_wr (&gsp->internal.device.subdevice, ctrl);if (ret)
@@ -92,7 +92,7 @@ r570_fbsr_init(struct nvkm_gsp *gsp, str }static int -r570_fbsr_suspend (struct nvkm_gsp *gsp) +r570_fbsr_suspend (struct nvkm_gsp *gsp,bool runtime) {struct nvkm_subdev *subdev = &gsp->subdev;struct nvkm_device *device = subdev->device;
@@ -133,7 +133,7 @@ r570_fbsr_suspend(struct nvkm_gsp *gsp)return ret;/* Initialise FBSR on RM. */ - ret =r570_fbsr_init (gsp, &gsp->sr.fbsr, size); + ret =r570_fbsr_init (gsp, &gsp->sr.fbsr, size, runtime);if (ret) {nvkm_gsp_sg_free (device, &gsp->sr.fbsr);return ret;
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h +1 -1
@@ -78,7 +78,7 @@ struct nvkm_rm_api { } *device;const struct nvkm_rm_api_fbsr { -int (*suspend)(struct nvkm_gsp *); +int (*suspend)(struct nvkm_gsp *,bool runtime);void (*resume)(struct nvkm_gsp *); } *fbsr;
Greg Kroah-Hartman
maintainerPATCH 29/175 net: cpsw: Execute ndo_set_rx_mode callback in a work queue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <[email protected]>
commit 0b8c878d117319f2be34c8391a77e0f4d5c94d79 upstream.
Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board:
WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481 RTNL: assertion failed at net/8021q/vlan_core.c (236) Modules linked in: CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x28/0x2c show_stack from dump_stack_lvl+0x30/0x38 dump_stack_lvl from __warn+0xb8/0x11c __warn from warn_slowpath_fmt+0x130/0x194 warn_slowpath_fmt from vlan_for_each+0x120/0x124 vlan_for_each from cpsw_add_mc_addr+0x54/0x98 cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88 __dev_mc_add from igmp6_group_added+0x84/0xec igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0 __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4 __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168 do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8 ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c do_sock_setsockopt from __sys_setsockopt+0x84/0xac __sys_setsockopt from ret_fast_syscall+0x0/0x54
This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.
To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver.
Please note: To reproduce this issue, I manually reverted the changes to am335x-bone-common.dtsi from commit c477358e66a3 ("ARM: dts: am335x-bone:
switch to new cpsw switch drv") in order to revert to the legacy cpsw driver.
--- drivers/net/ethernet/ti/cpsw.c | 41 +++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 6 deletions(-)
drivers/net/ethernet/ti/cpsw.c +35 -6
@@ -305,12 +305,19 @@ static int cpsw_purge_all_mc(struct net_device *ndev, const u8 *addr, int num)return 0 ; } -static void cpsw_ndo_set_rx_mode (struct net_device *ndev) +static void cpsw_ndo_set_rx_mode_work (struct work_struct *work) { -struct cpsw_priv *priv =netdev_priv (ndev); + struct cpsw_priv *priv = container_of(work, struct cpsw_priv, rx_mode_work);struct cpsw_common *cpsw = priv->cpsw; +struct net_device *ndev = priv->ndev;int slave_port =-1 ; +rtnl_lock (); +if (!netif_running (ndev)) + goto unlock_rtnl; + +netif_addr_lock_bh (ndev); +if (cpsw->data.dual_emac) slave_port = priv->emac_port +1 ;
@@ -318,7 +325,7 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)/* Enable promiscuous mode */ cpsw_set_promiscious (ndev, true);cpsw_ale_set_allmulti (cpsw->ale,IFF_ALLMULTI , slave_port); -return ; + goto unlock_addr; }else {/* Disable promiscuous mode */ cpsw_set_promiscious (ndev, false);
@@ -331,6 +338,18 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)/* add/remove mcast address either for real netdev or for vlan */ __hw_addr_ref_sync_dev (&ndev->mc, ndev, cpsw_add_mc_addr, cpsw_del_mc_addr); + +unlock_addr: +netif_addr_unlock_bh (ndev); +unlock_rtnl: +rtnl_unlock (); +} + +static void cpsw_ndo_set_rx_mode (struct net_device *ndev) +{ +struct cpsw_priv *priv =netdev_priv (ndev); + +schedule_work (&priv->rx_mode_work); }static unsigned int cpsw_rxbuf_total_len (unsigned int len)
@@ -1472,6 +1491,7 @@ static int cpsw_probe_dual_emac(struct cpsw_priv *priv) priv_sl2->ndev = ndev; priv_sl2->dev = &ndev->dev; priv_sl2->msg_enable =netif_msg_init (debug_level,CPSW_DEBUG ); +INIT_WORK (&priv_sl2->rx_mode_work, cpsw_ndo_set_rx_mode_work);if (is_valid_ether_addr (data->slave_data[1 ].mac_addr)) { memcpy(priv_sl2->mac_addr, data->slave_data[1].mac_addr,
@@ -1653,6 +1673,7 @@ static int cpsw_probe(struct platform_device *pdev) priv->dev = dev; priv->msg_enable =netif_msg_init (debug_level,CPSW_DEBUG ); priv->emac_port =0 ; +INIT_WORK (&priv->rx_mode_work, cpsw_ndo_set_rx_mode_work);if (is_valid_ether_addr (data->slave_data[0 ].mac_addr)) {memcpy (priv->mac_addr, data->slave_data[0 ].mac_addr,ETH_ALEN );
@@ -1758,6 +1779,8 @@ static int cpsw_probe(struct platform_device *pdev)static void cpsw_remove (struct platform_device *pdev) {struct cpsw_common *cpsw =platform_get_drvdata (pdev); +struct net_device *ndev; +struct cpsw_priv *priv;int i, ret; ret =pm_runtime_resume_and_get (&pdev->dev);
@@ -1770,9 +1793,15 @@ static void cpsw_remove(struct platform_device *pdev)return ; } -for (i =0 ; i < cpsw->data.slaves; i++) -if (cpsw->slaves[i].ndev) -unregister_netdev (cpsw->slaves[i].ndev); +for (i =0 ; i < cpsw->data.slaves; i++) { + ndev = cpsw->slaves[i].ndev; +if (!ndev) +continue ; + + priv =netdev_priv (ndev); +unregister_netdev (ndev); +disable_work_sync (&priv->rx_mode_work); + }cpts_release (cpsw->cpts);cpdma_ctlr_destroy (cpsw->dma);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/175 net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <[email protected]>
commit c0b5dc73a38f954e780f93a549b8fe225235c07a upstream.
Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board:
WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496 RTNL: assertion failed at net/8021q/vlan_core.c (236) Modules linked in: CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x28/0x2c show_stack from dump_stack_lvl+0x30/0x38 dump_stack_lvl from __warn+0xb8/0x11c __warn from warn_slowpath_fmt+0x130/0x194 warn_slowpath_fmt from vlan_for_each+0x120/0x124 vlan_for_each from cpsw_add_mc_addr+0x54/0xd8 cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88 __dev_mc_add from igmp6_group_added+0x84/0xec igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0 __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4 __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168 do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8 ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c do_sock_setsockopt from __sys_setsockopt+0x84/0xac __sys_setsockopt from ret_fast_syscall+0x0/0x5
This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.
To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver.
--- drivers/net/ethernet/ti/cpsw_new.c | 34 ++++++++++++++++++++++++----- drivers/net/ethernet/ti/cpsw_priv.h | 1 + 2 files changed, 30 insertions(+), 5 deletions(-)
drivers/net/ethernet/ti/cpsw_new.c +29 -5
@@ -248,16 +248,22 @@ static int cpsw_purge_all_mc(struct net_device *ndev, const u8 *addr, int num)return 0 ; } -static void cpsw_ndo_set_rx_mode (struct net_device *ndev) +static void cpsw_ndo_set_rx_mode_work (struct work_struct *work) { -struct cpsw_priv *priv =netdev_priv (ndev); + struct cpsw_priv *priv = container_of(work, struct cpsw_priv, rx_mode_work);struct cpsw_common *cpsw = priv->cpsw; +struct net_device *ndev = priv->ndev; +rtnl_lock (); +if (!netif_running (ndev)) + goto unlock_rtnl; + +netif_addr_lock_bh (ndev);if (ndev->flags &IFF_PROMISC ) {/* Enable promiscuous mode */ cpsw_set_promiscious (ndev, true);cpsw_ale_set_allmulti (cpsw->ale,IFF_ALLMULTI , priv->emac_port); -return ; + goto unlock_addr; }/* Disable promiscuous mode */
@@ -270,6 +276,18 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)/* add/remove mcast address either for real netdev or for vlan */ __hw_addr_ref_sync_dev (&ndev->mc, ndev, cpsw_add_mc_addr, cpsw_del_mc_addr); + +unlock_addr: +netif_addr_unlock_bh (ndev); +unlock_rtnl: +rtnl_unlock (); +} + +static void cpsw_ndo_set_rx_mode (struct net_device *ndev) +{ +struct cpsw_priv *priv =netdev_priv (ndev); + +schedule_work (&priv->rx_mode_work); }static unsigned int cpsw_rxbuf_total_len (unsigned int len)
@@ -1398,6 +1416,7 @@ static int cpsw_create_ports(struct cpsw_common *cpsw) priv->msg_enable =netif_msg_init (debug_level,CPSW_DEBUG ); priv->emac_port = i +1 ; priv->tx_packet_min =CPSW_MIN_PACKET_SIZE ; +INIT_WORK (&priv->rx_mode_work, cpsw_ndo_set_rx_mode_work);if (is_valid_ether_addr (slave_data->mac_addr)) {ether_addr_copy (priv->mac_addr, slave_data->mac_addr);
@@ -1447,13 +1466,18 @@ static int cpsw_create_ports(struct cpsw_common *cpsw)static void cpsw_unregister_ports (struct cpsw_common *cpsw) { +struct net_device *ndev; +struct cpsw_priv *priv;int i =0 ;for (i =0 ; i < cpsw->data.slaves; i++) { -if (!cpsw->slaves[i].ndev) + ndev = cpsw->slaves[i].ndev; +if (!ndev)continue ; -unregister_netdev (cpsw->slaves[i].ndev); + priv =netdev_priv (ndev); +unregister_netdev (ndev); +disable_work_sync (&priv->rx_mode_work); } }
drivers/net/ethernet/ti/cpsw_priv.h +1 -0
@@ -391,6 +391,7 @@ struct cpsw_priv {u32 tx_packet_min;struct cpsw_ale_ratelimit ale_bc_ratelimit;struct cpsw_ale_ratelimit ale_mc_ratelimit; +struct work_struct rx_mode_work; };#define ndev_to_cpsw (ndev) (((struct cpsw_priv *)netdev_priv(ndev))->cpsw)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/175 net: spacemit: k1-emac: fix jumbo frame support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Hlavacek <[email protected]>
commit 3125fc17016945b11e9725c6aff30ff3326fd58f upstream.
The driver never programs the MAC frame size and jabber registers, causing the hardware to reject frames larger than the default 1518 bytes even when larger DMA buffers are allocated.
Program MAC_MAXIMUM_FRAME_SIZE, MAC_TRANSMIT_JABBER_SIZE, and MAC_RECEIVE_JABBER_SIZE based on the configured MTU. Also fix the maximum buffer size from 4096 to 4095, since the descriptor buffer size field is only 12 bits. Account for double VLAN tags in frame size calculations.
--- drivers/net/ethernet/spacemit/k1_emac.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/net/ethernet/spacemit/k1_emac.c +15 -6
@@ -12,6 +12,7 @@#include <linux/dma-mapping.h> #include <linux/etherdevice.h> #include <linux/ethtool.h> +#include <linux/if_vlan.h> #include <linux/interrupt.h> #include <linux/io.h> #include <linux/iopoll.h>
@@ -38,7 +39,7 @@#define EMAC_DEFAULT_BUFSIZE 1536#define EMAC_RX_BUF_2K 2048 -#define EMAC_RX_BUF_4K 4096 +#define EMAC_RX_BUF_MAX FIELD_MAX(RX_DESC_1_BUFFER_SIZE_1_MASK)/* Tuning parameters from SpacemiT */ #define EMAC_TX_FRAMES 64
@@ -202,8 +203,7 @@ static void emac_init_hw(struct emac_priv *priv) {/* Destination address for 802.3x Ethernet flow control */ u8 fc_dest_addr[ETH_ALEN ] = {0x01 ,0x80 ,0xc2 ,0x00 ,0x00 ,0x01 }; - -u32 rxirq =0 , dma =0 ; +u32 rxirq =0 , dma =0 , frame_sz; regmap_set_bits(priv->regmap_apmu, priv->regmap_apmu_offset + APMU_EMAC_CTRL_REG,
@@ -228,6 +228,15 @@ static void emac_init_hw(struct emac_priv *priv) DEFAULT_TX_THRESHOLD);emac_wr (priv,MAC_RECEIVE_PACKET_START_THRESHOLD ,DEFAULT_RX_THRESHOLD ); +/* Set maximum frame size and jabber size based on configured MTU, +* accounting for Ethernet header, double VLAN tags, and FCS. +*/ + frame_sz = priv->ndev->mtu +ETH_HLEN +2 *VLAN_HLEN +ETH_FCS_LEN ; + +emac_wr (priv,MAC_MAXIMUM_FRAME_SIZE , frame_sz); +emac_wr (priv,MAC_TRANSMIT_JABBER_SIZE , frame_sz); +emac_wr (priv,MAC_RECEIVE_JABBER_SIZE , frame_sz); +/* Configure flow control (enabled in emac_adjust_link() later) */ emac_set_mac_addr_reg (priv, fc_dest_addr,MAC_FC_SOURCE_ADDRESS_HIGH );emac_wr (priv,MAC_FC_PAUSE_HIGH_THRESHOLD ,DEFAULT_FC_FIFO_HIGH );
@@ -924,14 +933,14 @@ static int emac_change_mtu(struct net_device *ndev, int mtu)return -EBUSY ; } - frame_len = mtu +ETH_HLEN +ETH_FCS_LEN ; + frame_len = mtu +ETH_HLEN +2 *VLAN_HLEN +ETH_FCS_LEN ;if (frame_len <=EMAC_DEFAULT_BUFSIZE ) priv->dma_buf_sz =EMAC_DEFAULT_BUFSIZE ;else if (frame_len <=EMAC_RX_BUF_2K ) priv->dma_buf_sz =EMAC_RX_BUF_2K ;else - priv->dma_buf_sz =EMAC_RX_BUF_4K ; + priv->dma_buf_sz =EMAC_RX_BUF_MAX ; ndev->mtu = mtu;
@@ -2025,7 +2034,7 @@ static int emac_probe(struct platform_device *pdev) ndev->hw_features =NETIF_F_SG ; ndev->features |= ndev->hw_features; - ndev->max_mtu =EMAC_RX_BUF_4K - (ETH_HLEN +ETH_FCS_LEN ); + ndev->max_mtu =EMAC_RX_BUF_MAX - (ETH_HLEN +2 *VLAN_HLEN +ETH_FCS_LEN ); ndev->pcpu_stat_type =NETDEV_PCPU_STAT_DSTATS ; priv =netdev_priv (ndev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/175 KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiquan Li <[email protected]>
commit e396a74222654486d6ab45dca5d0c54c408b8b91 upstream.
Some distributions (such as Ubuntu) configure GCC so that _FORTIFY_SOURCE is automatically enabled at -O1 or above. This results in some fortified version of definitions of standard library functions are included. While linker resolves the symbols, the fortified versions might override the definitions in lib/string_override.c and reference to those PLT entries in GLIBC. This is not a problem for the code in host, but it is a disaster for the guest code. E.g., if build and run x86/nested_emulation_test on Ubuntu 24.04 will encounter a L1 #PF due to memset() reference to __memset_chk@plt.
The option -fno-builtin-memset is not helpful here, because those fortified versions are not built-in but some definitions which are included by header, they are for different intentions.
In order to eliminate the unpredictable behaviors may vary depending on the linker and platform, add the "-U_FORTIFY_SOURCE" into CFLAGS to prevent from introducing the fortified definitions.
--- tools/testing/selftests/kvm/Makefile.kvm | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/kvm/Makefile.kvm +1 -0
@@ -245,6 +245,7 @@ LINUX_TOOL_INCLUDE = $(top_srcdir)/tools LINUX_TOOL_ARCH_INCLUDE = $(top_srcdir)/tools/arch/$(ARCH)/include CFLAGS += -Wall -Wstrict-prototypes -Wuninitialized -O2 -g -std=gnu99 \ -Wno-gnu-variable-sized-type-not-at-end -MD -MP -DCONFIG_64BIT \ + -U_FORTIFY_SOURCE \ -fno-builtin-memcmp -fno-builtin-memcpy \ -fno-builtin-memset -fno-builtin-strnlen \ -fno-stack-protector -fno-PIE -fno-strict-aliasing \
Greg Kroah-Hartman
maintainerPATCH 33/175 KVM: Dont clobber irqfd routing type when deassigning irqfd
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit b4d37cdb77a0015f51fee083598fa227cc07aaf1 upstream.
When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86 and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to handle a concurrent routing update, verify that the irqfd is still active before consuming the routing information. As evidenced by the x86 and arm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below), clobbering the entry type without notifying arch code is surprising and error prone.
As a bonus, checking that the irqfd is active provides a convenient location for documenting _why_ KVM must not consume the routing entry for an irqfd that is in the process of being deassigned: once the irqfd is deleted from the list (which happens *before* the eventfd is detached), it will no longer receive updates via kvm_irq_routing_update(), and so KVM could deliver an event using stale routing information (relative to KVM_SET_GSI_ROUTING returning to userspace).
As an even better bonus, explicitly checking for the irqfd being active fixes a similar bug to the one the clobbering is trying to prevent: if an irqfd is deactivated, and then its routing is changed, kvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing() (because the irqfd isn't in the list). And so if the irqfd is in bypass mode, IRQs will continue to be posted using the old routing information.
As for kvm_arch_irq_bypass_del_producer(), clobbering the routing type results in KVM incorrectly keeping the IRQ in bypass mode, which is especially problematic on AMD as KVM tracks IRQs that are being posted to a vCPU in a list whose lifetime is tied to the irqfd.
Without the help of KASAN to detect use-after-free, the most common sympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to the memory for irqfd structure being re-allocated and zeroed, resulting in irqfd->irq_bypass_data being NULL when read by avic_update_iommu_vcpu_affinity():
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0
Oops: Oops: 0000 [#1] SMP
CPU: 6 UID: 0 PID: 40383 Comm: vfio_irq_test
Tainted: G U W O 6.19.0-smp--5dddc257e6b2-irqfd #31 NONE
Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025
RIP: 0010:amd_iommu_update_ga+0x19/0xe0
Call Trace:
<TASK>
avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd]
__avic_vcpu_load+0xf4/0x130 [kvm_amd]
kvm_arch_vcpu_load+0x89/0x210 [kvm]
vcpu_load+0x30/0x40 [kvm]
kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm]
kvm_vcpu_ioctl+0x571/0x6a0 [kvm]
__se_sys_ioctl+0x6d/0xb0
do_syscall_64+0x6f/0x9d0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x46893b
</TASK>
---[ end trace 0000000000000000 ]---If AVIC is inhibited when the irfd is deassigned, the bug will manifest as list corruption, e.g. on the next irqfd assignment.
list_add corruption. next->prev should be prev (ffff8d474d5cd588),
but was 0000000000000000. (next=ffff8d8658f86530). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:31! Oops: invalid opcode: 0000 [#1] SMP CPU: 128 UID: 0 PID: 80818 Comm: vfio_irq_test Tainted: G U W O 6.19.0-smp--f19dc4d680ba-irqfd #28 NONE Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025 RIP: 0010:__list_add_valid_or_report+0x97/0xc0 Call Trace: <TASK> avic_pi_update_irte+0x28e/0x2b0 [kvm_amd] kvm_pi_update_irte+0xbf/0x190 [kvm] kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm] irq_bypass_register_consumer+0xcd/0x170 [irqbypass] kvm_irqfd+0x4c6/0x540 [kvm] kvm_vm_ioctl+0x118/0x5d0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x6f/0x9d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> ---[ end trace 0000000000000000 ]---
On Intel and arm64, the bug is less noisy, as the end result is that the device keeps posting IRQs to the vCPU even after it's been deassigned.
Note, the worst of the breakage can be traced back to commit cb210737675e ("KVM: Pass new routing entries and irqfd when updating IRTEs"), as before that commit KVM would pull the routing information from the per-VM routing table. But as above, similar bugs have existed since support for IRQ bypass was added. E.g. if a routing change finished before irq_shutdown() invoked kvm_arch_irq_bypass_del_producer(), VMX and SVM would see stale routing information and potentially leave the irqfd in bypass mode.
Alternatively, x86 could be fixed by explicitly checking irq_bypass_vcpu instead of irq_entry.type in kvm_arch_irq_bypass_del_producer(), and arm64 could be modified to utilize irq_bypass_vcpu in a similar manner. But (a) that wouldn't fix the routing updates bug, and (b) fixing core code doesn't preclude x86 (or arm64) from adding such code as a sanity check (spoiler alert).
--- virt/kvm/eventfd.c | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-)
virt/kvm/eventfd.c +24 -20
@@ -157,21 +157,28 @@ irqfd_shutdown(struct work_struct *work) } -/* assumes kvm->irqfds.lock is held */ -static bool -irqfd_is_active (struct kvm_kernel_irqfd *irqfd) +static bool irqfd_is_active (struct kvm_kernel_irqfd *irqfd) { +/* +* Assert that either irqfds.lock or SRCU is held, as irqfds.lock must +* be held to prevent false positives (on the irqfd being active), and +* while false negatives are impossible as irqfds are never added back +* to the list once they're deactivated, the caller must at least hold +* SRCU to guard against routing changes if the irqfd is deactivated. +*/ +lockdep_assert_once (lockdep_is_held (&irqfd->kvm->irqfds.lock) || +srcu_read_lock_held (&irqfd->kvm->irq_srcu)); +return list_empty (&irqfd->list) ? false : true; }/* * Mark the irqfd as inactive and schedule it for removal -* -* assumes kvm->irqfds.lock is held */ -static void -irqfd_deactivate (struct kvm_kernel_irqfd *irqfd) +static void irqfd_deactivate (struct kvm_kernel_irqfd *irqfd) { +lockdep_assert_held (&irqfd->kvm->irqfds.lock); +BUG_ON (!irqfd_is_active (irqfd));list_del_init (&irqfd->list);
@@ -217,8 +224,15 @@ irqfd_wakeup(wait_queue_entry_t *wait, u seq =read_seqcount_begin (&irqfd->irq_entry_sc); irq = irqfd->irq_entry; }while (read_seqcount_retry (&irqfd->irq_entry_sc, seq)); -/* An event has been signaled, inject an interrupt */ -if (kvm_arch_set_irq_inatomic (&irq, kvm, + +/* +* An event has been signaled, inject an interrupt unless the +* irqfd is being deassigned (isn't active), in which case the +* routing information may be stale (once the irqfd is removed +* from the list, it will stop receiving routing updates). +*/ +if (unlikely (!irqfd_is_active (irqfd)) || +kvm_arch_set_irq_inatomic (&irq, kvm,KVM_USERSPACE_IRQ_SOURCE_ID ,1 , false) == -EWOULDBLOCK )schedule_work (&irqfd->inject);
@@ -585,18 +599,8 @@ kvm_irqfd_deassign(struct kvm *kvm, struspin_lock_irq (&kvm->irqfds.lock);list_for_each_entry_safe (irqfd, tmp, &kvm->irqfds.items, list) { -if (irqfd->eventfd == eventfd && irqfd->gsi == args->gsi) { -/* -* This clearing of irq_entry.type is needed for when -* another thread calls kvm_irq_routing_update before -* we flush workqueue below (we synchronize with -* kvm_irq_routing_update using irqfds.lock). -*/ -write_seqcount_begin (&irqfd->irq_entry_sc); - irqfd->irq_entry.type =0 ; -write_seqcount_end (&irqfd->irq_entry_sc); +if (irqfd->eventfd == eventfd && irqfd->gsi == args->gsi)irqfd_deactivate (irqfd); - } }spin_unlock_irq (&kvm->irqfds.lock);
Greg Kroah-Hartman
maintainerPATCH 34/175 hwmon: (gpio-fan) Fix set_rpm() return value
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit f5c092787c48296633c2dd7240752f88fa9710fc upstream.
The set_rpm function is used as a 'store' callback of a device attribute, and as such it should return with the number of bytes consumed. However since commit 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support"), the function returns with zero on success.
Due to this, the function gets called again and again whenever the user tries to change the FAN speed by writing the desired RPM value into the 'fan1_target' sysfs attribute.
The broken behaviour can be reproduced easily. For example, the following command never returns unless it gets terminated:
$ echo 500 > /sys/class/hwmon/hwmon1/fan1_target ^C $
Change the code to return with the same value as the 'count' parameter on success to indicate that all bytes from the input buffer are consumed. The function behaved the same way prior to the offending change.
--- drivers/hwmon/gpio-fan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/gpio-fan.c +2 -2
@@ -291,7 +291,7 @@ static ssize_t set_rpm(struct device *de {struct gpio_fan_data *fan_data =dev_get_drvdata (dev);unsigned long rpm; -int ret = count; +int ret;if (kstrtoul (buf,10 , &rpm))return -EINVAL ;
@@ -308,7 +308,7 @@ static ssize_t set_rpm(struct device *de exit_unlock:mutex_unlock (&fan_data->lock); -return ret; +return ret ? ret : count; }static DEVICE_ATTR_RW (pwm1);
Greg Kroah-Hartman
maintainerPATCH 35/175 hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 52fb36a5f9c15285b7d67c0ff87dc17b3206b5df upstream.
When CONFIG_PM is disabled, the GPIO controlled FANs can't be stopped by using the sysfs attributes since commit 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support").
Using either the 'pwm1' or the 'fan1_target' attribute fails the same way:
$ echo 0 > /sys/class/hwmon/hwmon1/pwm1 ash: write error: Function not implemented $ echo 0 > /sys/class/hwmon/hwmon1/fan1_target ash: write error: Function not implemented
Both commands were working flawlessly before the mentioned commit.
The issue happens because pm_runtime_put_sync() returns with -ENOSYS when CONFIG_PM is disabled, and the set_fan_speed() function handles this as an error.
In order to restore the previous behaviour, change the error check in the set_fan_speed() function to ignore the -ENOSYS error code.
--- drivers/hwmon/gpio-fan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/gpio-fan.c +1 -1
@@ -148,7 +148,7 @@ static int set_fan_speed(struct gpio_fan_data *fan_data, int speed_index)int ret; ret =pm_runtime_put_sync (fan_data->dev); -if (ret <0 ) +if (ret <0 && ret != -ENOSYS )return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/175 PCI/ERR: Ensure error recoverability at all times
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit a2f1e22390ac2ca7ac8d77aa0f78c068b6dd2208 upstream.
When the PCI core gained power management support in 2002, it introduced pci_save_state() and pci_restore_state() helpers to restore Config Space after a D3hot or D3cold transition, which implies a Soft or Fundamental Reset (PCIe r7.0 sec 5.8):
https://git.kernel.org/tglx/history/c/a5287abe398b
In 2006, EEH and AER were introduced to recover from errors by performing a reset. Because errors can occur at any time, drivers began calling pci_save_state() on probe to ensure recoverability.
In 2009, recoverability was foiled by commit c82f63e411f1 ("PCI: check saved state before restore"): It amended pci_restore_state() to bail out if the "state_saved" flag has been cleared. The flag is cleared by pci_restore_state() itself, hence a saved state is now allowed to be restored only once and is then invalidated. That doesn't seem to make sense because the saved state should be good enough to be reused.
Soon after, drivers began to work around this behavior by calling pci_save_state() immediately after pci_restore_state(), see e.g. commit b94f2d775a71 ("igb: call pci_save_state after pci_restore_state"). Hilariously, two drivers even set the "saved_state" flag to true before invoking pci_restore_state(), see ipr_reset_restore_cfg_space() and e1000_io_slot_reset().
Despite these workarounds, recoverability at all times is not guaranteed:
E.g. when a PCIe port goes through a runtime suspend and resume cycle, the "saved_state" flag is cleared by:
pci_pm_runtime_resume()
pci_pm_default_resume_early()
pci_restore_state()
... and hence on a subsequent AER event, the port's Config Space cannot be restored. Riana reports a recovery failure of a GPU-integrated PCIe switch and has root-caused it to the behavior of pci_restore_state(). Another workaround would be necessary, namely calling pci_save_state() in pcie_port_device_runtime_resume().
The motivation of commit c82f63e411f1 was to prevent restoring state if pci_save_state() hasn't been called before. But that can be achieved by saving state already on device addition, after Config Space has been initialized. A desirable side effect is that devices become recoverable even if no driver gets bound. This renders the commit unnecessary, so revert it.
--- drivers/pci/bus.c | 3 +++ drivers/pci/pci.c | 3 --- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/pci/bus.c +3 -0
@@ -357,6 +357,9 @@ void pci_bus_add_device(struct pci_dev *pci_proc_attach_device (dev);pci_bridge_d3_update (dev); +/* Save config space for error recoverability */ +pci_save_state (dev); +/* * If the PCI device is associated with a pwrctrl device with a * power supply, create a device link between the PCI device and
drivers/pci/pci.c +0 -3
@@ -1855,9 +1855,6 @@ static void pci_restore_rebar_state(stru*/ void pci_restore_state (struct pci_dev *dev) { -if (!dev->state_saved) -return ; -pci_restore_pcie_state (dev);pci_restore_pasid_state (dev);pci_restore_pri_state (dev);
Greg Kroah-Hartman
maintainerPATCH 37/175 treewide: Drop pci_save_state() after pci_restore_state()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 383d89699c5028de510a6667f674ed38585f77fc upstream.
In 2009, commit c82f63e411f1 ("PCI: check saved state before restore") changed the behavior of pci_restore_state() such that it became necessary to call pci_save_state() afterwards, lest recovery from subsequent PCI errors fails.
The commit has just been reverted and so all the pci_save_state() after pci_restore_state() calls that have accumulated in the tree are now superfluous. Drop them.
Two drivers chose a different approach to achieve the same result:drivers/scsi/ipr.c and drivers/net/ethernet/intel/e1000e/netdev.c set the pci_dev's "state_saved" flag to true before calling pci_restore_state(). Drop this as well.
--- drivers/crypto/intel/qat/qat_common/adf_aer.c | 2 -- drivers/dma/ioat/init.c | 1 - drivers/net/ethernet/broadcom/bnx2.c | 2 -- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 1 - drivers/net/ethernet/broadcom/tg3.c | 1 - drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 1 - drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 -- drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 1 - drivers/net/ethernet/intel/e1000e/netdev.c | 1 - drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 6 ------ drivers/net/ethernet/intel/i40e/i40e_main.c | 1 - drivers/net/ethernet/intel/ice/ice_main.c | 2 -- drivers/net/ethernet/intel/igb/igb_main.c | 2 -- drivers/net/ethernet/intel/igc/igc_main.c | 2 -- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 1 - drivers/net/ethernet/mellanox/mlx4/main.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 - drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 1 - drivers/net/ethernet/microchip/lan743x_main.c | 1 - drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 4 ---- drivers/net/ethernet/neterion/s2io.c | 1 - drivers/pci/pcie/portdrv.c | 1 - drivers/scsi/bfa/bfad.c | 1 - drivers/scsi/csiostor/csio_init.c | 1 - drivers/scsi/ipr.c | 1 - drivers/scsi/lpfc/lpfc_init.c | 6 ------ drivers/scsi/qla2xxx/qla_os.c | 5 ----- drivers/scsi/qla4xxx/ql4_os.c | 5 ----- drivers/tty/serial/8250/8250_pci.c | 1 - drivers/tty/serial/jsm/jsm_driver.c | 1 - 30 files changed, 57 deletions(-)
drivers/crypto/intel/qat/qat_common/adf_aer.c +0 -2
@@ -103,7 +103,6 @@ void adf_dev_restore(struct adf_accel_de accel_dev->accel_id); hw_device->reset_device (accel_dev);pci_restore_state (pdev); -pci_save_state (pdev); } }
@@ -202,7 +201,6 @@ static pci_ers_result_t adf_slot_reset(sif (!pdev->is_busmaster)pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev); res =adf_dev_up (accel_dev, false);if (res && res != -EALREADY )return PCI_ERS_RESULT_DISCONNECT ;
drivers/dma/ioat/init.c +0 -1
@@ -1286,7 +1286,6 @@ static pci_ers_result_t ioat_pcie_error_ }else {pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);pci_wake_from_d3 (pdev, false); }
drivers/net/ethernet/broadcom/bnx2.c +0 -2
@@ -6444,7 +6444,6 @@ bnx2_reset_task(struct work_struct *workif (!(pcicmd &PCI_COMMAND_MEMORY )) {/* in case PCI block has reset */ pci_restore_state (bp->pdev); -pci_save_state (bp->pdev); } rc =bnx2_init_nic (bp,1 );if (rc) {
@@ -8718,7 +8717,6 @@ static pci_ers_result_t bnx2_io_slot_res }else {pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);if (netif_running (dev)) err =bnx2_init_nic (bp,1 );
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +0 -1
@@ -14216,7 +14216,6 @@ static pci_ers_result_t bnx2x_io_slot_repci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);if (netif_running (dev))bnx2x_set_power_state (bp,PCI_D0 );
drivers/net/ethernet/broadcom/tg3.c +0 -1
@@ -18349,7 +18349,6 @@ static pci_ers_result_t tg3_io_slot_resepci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);if (!netdev || !netif_running (netdev)) { rc =PCI_ERS_RESULT_RECOVERED ;
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +0 -1
@@ -2933,7 +2933,6 @@ static int t3_reenable_adapter(struct ad }pci_set_master (adapter->pdev);pci_restore_state (adapter->pdev); -pci_save_state (adapter->pdev);/* Free sge resources */ t3_free_sge_resources (adapter);
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +0 -2
@@ -5456,7 +5456,6 @@ static pci_ers_result_t eeh_slot_reset(sif (!adap) {pci_restore_state (pdev); -pci_save_state (pdev);return PCI_ERS_RESULT_RECOVERED ; }
@@ -5471,7 +5470,6 @@ static pci_ers_result_t eeh_slot_reset(spci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);if (t4_wait_dev_ready (adap->regs) <0 )return PCI_ERS_RESULT_DISCONNECT ;
drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c +0 -1
@@ -160,7 +160,6 @@ static pci_ers_result_t hbg_pci_err_slotpci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);hbg_err_reset (priv);return PCI_ERS_RESULT_RECOVERED ;
drivers/net/ethernet/intel/e1000e/netdev.c +0 -1
@@ -7195,7 +7195,6 @@ static pci_ers_result_t e1000_io_slot_re "Cannot re-enable PCI device after reset.\n"); result =PCI_ERS_RESULT_DISCONNECT ; }else { - pdev->state_saved = true;pci_restore_state (pdev);pci_set_master (pdev);
drivers/net/ethernet/intel/fm10k/fm10k_pci.c +0 -6
@@ -2423,12 +2423,6 @@ static pci_ers_result_t fm10k_io_slot_re }else {pci_set_master (pdev);pci_restore_state (pdev); - -/* After second error pci->state_saved is false, this -* resets it so EEH doesn't break. -*/ -pci_save_state (pdev); -pci_wake_from_d3 (pdev, false); result =PCI_ERS_RESULT_RECOVERED ;
drivers/net/ethernet/intel/i40e/i40e_main.c +0 -1
@@ -16456,7 +16456,6 @@ static pci_ers_result_t i40e_pci_error_s }else {pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);pci_wake_from_d3 (pdev, false); reg =rd32 (&pf->hw,I40E_GLGEN_RTRIG );
drivers/net/ethernet/intel/ice/ice_main.c +0 -2
@@ -5661,7 +5661,6 @@ static int ice_resume(struct device *devpci_set_power_state (pdev,PCI_D0 );pci_restore_state (pdev); -pci_save_state (pdev);if (!pci_device_is_present (pdev))return -ENODEV ;
@@ -5761,7 +5760,6 @@ static pci_ers_result_t ice_pci_err_slot }else {pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);pci_wake_from_d3 (pdev, false);/* Check for life */
drivers/net/ethernet/intel/igb/igb_main.c +0 -2
@@ -9599,7 +9599,6 @@ static int __igb_resume(struct device *dpci_set_power_state (pdev,PCI_D0 );pci_restore_state (pdev); -pci_save_state (pdev);if (!pci_device_is_present (pdev))return -ENODEV ;
@@ -9754,7 +9753,6 @@ static pci_ers_result_t igb_io_slot_rese }else {pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);pci_enable_wake (pdev, PCI_D3hot,0 );pci_enable_wake (pdev, PCI_D3cold,0 );
drivers/net/ethernet/intel/igc/igc_main.c +0 -2
@@ -7530,7 +7530,6 @@ static int __igc_resume(struct device *dpci_set_power_state (pdev,PCI_D0 );pci_restore_state (pdev); -pci_save_state (pdev);if (!pci_device_is_present (pdev))return -ENODEV ;
@@ -7667,7 +7666,6 @@ static pci_ers_result_t igc_io_slot_rese }else {pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);pci_enable_wake (pdev, PCI_D3hot,0 );pci_enable_wake (pdev, PCI_D3cold,0 );
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +0 -1
@@ -12292,7 +12292,6 @@ static pci_ers_result_t ixgbe_io_slot_re adapter->hw.hw_addr = adapter->io_addr;pci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);pci_wake_from_d3 (pdev, false);
drivers/net/ethernet/mellanox/mlx4/main.c +0 -1
@@ -4366,7 +4366,6 @@ static pci_ers_result_t mlx4_pci_slot_repci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);return PCI_ERS_RESULT_RECOVERED ; }
drivers/net/ethernet/mellanox/mlx5/core/main.c +0 -1
@@ -2100,7 +2100,6 @@ static pci_ers_result_t mlx5_pci_slot_repci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev); err =wait_vital (pdev);if (err) {
drivers/net/ethernet/meta/fbnic/fbnic_pci.c +0 -1
@@ -574,7 +574,6 @@ static pci_ers_result_t fbnic_err_slot_rpci_set_power_state (pdev,PCI_D0 );pci_restore_state (pdev); -pci_save_state (pdev);if (pci_enable_device_mem (pdev)) { dev_err(&pdev->dev,
drivers/net/ethernet/microchip/lan743x_main.c +0 -1
@@ -3915,7 +3915,6 @@ static int lan743x_pm_resume(struct devipci_set_power_state (pdev,PCI_D0 );pci_restore_state (pdev); -pci_save_state (pdev);/* Restore HW_CFG that was saved during pm suspend */ if (adapter->is_pci11x1x)
drivers/net/ethernet/myricom/myri10ge/myri10ge.c +0 -4
@@ -3416,10 +3416,6 @@ static void myri10ge_watchdog(struct wor* nic was resumed from power saving mode. */ pci_restore_state (mgp->pdev); - -/* save state again for accounting reasons */ -pci_save_state (mgp->pdev); - }else {/* if we get back -1's from our slot, perhaps somebody * powered off our card. Don't try to reset it in
drivers/net/ethernet/neterion/s2io.c +0 -1
@@ -3425,7 +3425,6 @@ static void s2io_reset(struct s2io_nic */* Restore the PCI state saved during initialization. */ pci_restore_state (sp->pdev); -pci_save_state (sp->pdev);pci_read_config_word (sp->pdev,0x2 , &val16);if (check_pci_device_id (val16) != (u16 )PCI_ANY_ID )break ;
drivers/pci/pcie/portdrv.c +0 -1
@@ -760,7 +760,6 @@ static pci_ers_result_t pcie_portdrv_slodevice_for_each_child (&dev->dev, &off, pcie_port_device_iter);pci_restore_state (dev); -pci_save_state (dev);return PCI_ERS_RESULT_RECOVERED ; }
drivers/scsi/bfa/bfad.c +0 -1
@@ -1528,7 +1528,6 @@ bfad_pci_slot_reset(struct pci_dev *pdev goto out_disable_device; } -pci_save_state (pdev);pci_set_master (pdev); rc =dma_set_mask_and_coherent (&bfad->pcidev->dev,DMA_BIT_MASK (64 ));
drivers/scsi/csiostor/csio_init.c +0 -1
@@ -1093,7 +1093,6 @@ csio_pci_slot_reset(struct pci_dev *pdevpci_set_master (pdev);pci_restore_state (pdev); -pci_save_state (pdev);/* Bring HW s/m to ready state. * but don't resume IOs.
drivers/scsi/ipr.c +0 -1
@@ -7883,7 +7883,6 @@ static int ipr_reset_restore_cfg_space(sstruct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;ENTER ; - ioa_cfg->pdev->state_saved = true;pci_restore_state (ioa_cfg->pdev);if (ipr_set_pcix_cmd_reg (ioa_cfg)) {
drivers/scsi/lpfc/lpfc_init.c +0 -6
@@ -14434,12 +14434,6 @@ lpfc_io_slot_reset_s3(struct pci_dev *pdpci_restore_state (pdev); -/* -* As the new kernel behavior of pci_restore_state() API call clears -* device saved_state flag, need to save the restored state again. -*/ -pci_save_state (pdev); -if (pdev->is_busmaster)pci_set_master (pdev);
drivers/scsi/qla2xxx/qla_os.c +0 -5
@@ -7890,11 +7890,6 @@ qla2xxx_pci_slot_reset(struct pci_dev *ppci_restore_state (pdev); -/* pci_restore_state() clears the saved_state flag of the device -* save restored state which resets saved_state flag -*/ -pci_save_state (pdev); -if (ha->mem_only) rc =pci_enable_device_mem (pdev);else
drivers/scsi/qla4xxx/ql4_os.c +0 -5
@@ -9796,11 +9796,6 @@ qla4xxx_pci_slot_reset(struct pci_dev *p*/ pci_restore_state (pdev); -/* pci_restore_state() clears the saved_state flag of the device -* save restored state which resets saved_state flag -*/ -pci_save_state (pdev); -/* Initialize device or resume if in suspended state */ rc =pci_enable_device (pdev);if (rc) {
drivers/tty/serial/8250/8250_pci.c +0 -1
@@ -6215,7 +6215,6 @@ static pci_ers_result_t serial8250_io_slreturn PCI_ERS_RESULT_DISCONNECT ;pci_restore_state (dev); -pci_save_state (dev);return PCI_ERS_RESULT_RECOVERED ; }
drivers/tty/serial/jsm/jsm_driver.c +0 -1
@@ -355,7 +355,6 @@ static void jsm_io_resume(struct pci_devstruct jsm_board *brd =pci_get_drvdata (pdev);pci_restore_state (pdev); -pci_save_state (pdev);jsm_uart_port_init (brd); }
Greg Kroah-Hartman
maintainerPATCH 38/175 bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 6eaee77923ddf04beedb832c06f983679586361c upstream.
Add SDX72 based modem Telit FE990B40, reusing FN920C04 configuration.
01:00.0 Unassigned class [ff00]: Qualcomm Device 0309
Subsystem: Device 1c5d:2025
--- drivers/bus/mhi/host/pci_generic.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/bus/mhi/host/pci_generic.c +13 -0
@@ -877,6 +877,16 @@ static const struct mhi_pci_dev_info mhi .edl_trigger = true, }; +static const struct mhi_pci_dev_info mhi_telit_fe990b40_info = { + .name ="telit-fe990b40" , + .config = &modem_telit_fn920c04_config, + .bar_num =MHI_PCI_DEFAULT_BAR_NUM , + .dma_data_width =32 , + .sideband_wake = false, + .mru_default =32768 , + .edl_trigger = true, +}; +static const struct mhi_pci_dev_info mhi_netprisma_lcur57_info = { .name ="netprisma-lcur57" , .edl ="qcom/prog_firehose_sdx24.mbn" ,
@@ -933,6 +943,9 @@ static const struct pci_device_id mhi_pc/* Telit FN990B40 (sdx72) */ { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0309, 0x1c5d, 0x201a), .driver_data = (kernel_ulong_t) &mhi_telit_fn990b40_info }, +/* Telit FE990B40 (sdx72) */ + { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0309, 0x1c5d, 0x2025), + .driver_data = (kernel_ulong_t) &mhi_telit_fe990b40_info }, { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0309), .driver_data = (kernel_ulong_t) &mhi_qcom_sdx75_info },/* QDU100, x100-DU */
Greg Kroah-Hartman
maintainerPATCH 39/175 sched/fair: Skip sched_balance_running cmpxchg when balance is not due
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Chen <[email protected]>
commit 3324b2180c17b21c31c16966cc85ca41a7c93703 upstream.
The NUMA sched domain sets the SD_SERIALIZE flag by default, allowing only one NUMA load balancing operation to run system-wide at a time.
Currently, each sched group leader directly under NUMA domain attempts to acquire the global sched_balance_running flag via cmpxchg() before checking whether load balancing is due or whether it is the designated load balancer for that NUMA domain. On systems with a large number of cores, this causes significant cache contention on the shared sched_balance_running flag.
This patch reduces unnecessary cmpxchg() operations by first checking that the balancer is the designated leader for a NUMA domain from should_we_balance(), and the balance interval has expired before trying to acquire sched_balance_running to load balance a NUMA domain.
On a 2-socket Granite Rapids system with sub-NUMA clustering enabled, running an OLTP workload, 7.8% of total CPU cycles were previously spent in sched_balance_domain() contending on sched_balance_running before this change.
: 104 static __always_inline int arch_atomic_cmpxchg(atomic_t *v, int old, int new)
: 105 {
: 106 return arch_cmpxchg(&v->counter, old, new);
0.00 : ffffffff81326e6c: xor %eax,%eax
0.00 : ffffffff81326e6e: mov $0x1,%ecx
0.00 : ffffffff81326e73: lock cmpxchg %ecx,0x2394195(%rip) # ffffffff836bb010 <sched_balance_running>
: 110 sched_balance_domains():
: 12234 if (atomic_cmpxchg_acquire(&sched_balance_running, 0, 1))
99.39 : ffffffff81326e7b: test %eax,%eax
0.00 : ffffffff81326e7d: jne ffffffff81326e99 <sched_balance_domains+0x209>
: 12238 if (time_after_eq(jiffies, sd->last_balance + interval)) {
0.00 : ffffffff81326e7f: mov 0x14e2b3a(%rip),%rax # ffffffff828099c0 <jiffies_64>
0.00 : ffffffff81326e86: sub 0x48(%r14),%rax
0.00 : ffffffff81326e8a: cmp %rdx,%raxAfter applying this fix, sched_balance_domain() is gone from the profile and there is a 5% throughput improvement.
[peterz: made it so that redo retains the 'lock' and split out the
CPU_NEWLY_IDLE change to a separate patch]
--- kernel/sched/fair.c | 54 ++++++++++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 26 deletions(-)
kernel/sched/fair.c +28 -26
@@ -11693,6 +11693,21 @@ static void update_lb_imbalance_stat(str }/* +* This flag serializes load-balancing passes over large domains +* (above the NODE topology level) - only one load-balancing instance +* may run at a time, to reduce overhead on very large systems with +* lots of CPUs and large NUMA distances. +* +* - Note that load-balancing passes triggered while another one +* is executing are skipped and not re-tried. +* +* - Also note that this does not serialize rebalance_domains() +* execution, as non-SD_SERIALIZE domains will still be +* load-balanced in parallel. +*/ +static atomic_t sched_balance_running =ATOMIC_INIT (0 ); + +/* * Check this_cpu to ensure it is balanced within domain. Attempt to move * tasks if there is an imbalance. */
@@ -11717,6 +11732,7 @@ static int sched_balance_rq(int this_cpu .fbq_type = all, .tasks = LIST_HEAD_INIT(env.tasks), }; +bool need_unlock = false;cpumask_and (cpus,sched_domain_span (sd), cpu_active_mask);
@@ -11728,6 +11744,14 @@ redo: goto out_balanced; } +if (!need_unlock && (sd->flags &SD_SERIALIZE ) && idle !=CPU_NEWLY_IDLE ) { +int zero =0 ; +if (!atomic_try_cmpxchg_acquire (&sched_balance_running, &zero,1 )) + goto out_balanced; + + need_unlock = true; + } + group =sched_balance_find_src_group (&env);if (!group) {schedstat_inc (sd->lb_nobusyg[idle]);
@@ -11968,6 +11992,9 @@ out_one_pinned: sd->balance_interval < sd->max_interval) sd->balance_interval *= 2; out: +if (need_unlock) +atomic_set_release (&sched_balance_running,0 ); +return ld_moved; }
@@ -12093,21 +12120,6 @@ out_unlock: }/* -* This flag serializes load-balancing passes over large domains -* (above the NODE topology level) - only one load-balancing instance -* may run at a time, to reduce overhead on very large systems with -* lots of CPUs and large NUMA distances. -* -* - Note that load-balancing passes triggered while another one -* is executing are skipped and not re-tried. -* -* - Also note that this does not serialize rebalance_domains() -* execution, as non-SD_SERIALIZE domains will still be -* load-balanced in parallel. -*/ -static atomic_t sched_balance_running =ATOMIC_INIT (0 ); - -/* * Scale the max sched_balance_rq interval with the number of CPUs in the system. * This trades load-balance latency on larger machines for less cross talk. */
@@ -12175,7 +12187,7 @@ static void sched_balance_domains(struct/* Earliest time when we have to do rebalance again */ unsigned long next_balance = jiffies +60 *HZ ;int update_next_balance =0 ; -int need_serialize, need_decay =0 ; +int need_decay =0 ;u64 max_cost =0 ;rcu_read_lock ();
@@ -12199,13 +12211,6 @@ static void sched_balance_domains(struct } interval =get_sd_balance_interval (sd, busy); - - need_serialize = sd->flags &SD_SERIALIZE ; -if (need_serialize) { -if (atomic_cmpxchg_acquire (&sched_balance_running,0 ,1 )) - goto out; - } -if (time_after_eq (jiffies, sd->last_balance + interval)) {if (sched_balance_rq (cpu, rq, sd, idle, &continue_balancing)) {/*
@@ -12219,9 +12224,6 @@ static void sched_balance_domains(struct sd->last_balance = jiffies; interval =get_sd_balance_interval (sd, busy); } -if (need_serialize) -atomic_set_release (&sched_balance_running,0 ); -out:if (time_after (next_balance, sd->last_balance + interval)) { next_balance = sd->last_balance + interval; update_next_balance =1 ;
Greg Kroah-Hartman
maintainerPATCH 40/175 sched/fair: Have SD_SERIALIZE affect newidle balancing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 522fb20fbdbe48ed98f587d628637ff38ececd2d upstream.
Also serialize the possiblty much more frequent newidle balancing for the 'expensive' domains that have SD_BALANCE set.
Initial benchmarking by K Prateek and Tim showed no negative effect.
Split out from the larger patch moving sched_balance_running around for ease of bisect and such.
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -11744,7 +11744,7 @@ redo: goto out_balanced; } -if (!need_unlock && (sd->flags &SD_SERIALIZE ) && idle !=CPU_NEWLY_IDLE ) { +if (!need_unlock && (sd->flags &SD_SERIALIZE )) {int zero =0 ;if (!atomic_try_cmpxchg_acquire (&sched_balance_running, &zero,1 )) goto out_balanced;
Greg Kroah-Hartman
maintainerPATCH 41/175 rust_binder: correctly handle FDA objects of length zero
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit 8f589c9c3be539d6c2b393c82940c3783831082f upstream.
Fix a bug where an empty FDA (fd array) object with 0 fds would cause an out-of-bounds error. The previous implementation used skip == 0 to mean "this is a pointer fixup", but 0 is also the correct skip length for an empty FDA. If the FDA is at the end of the buffer, then this results in an attempt to write 8-bytes out of bounds. This is caught and results in an EINVAL error being returned to userspace.
The pattern of using skip == 0 as a special value originates from the C-implementation of Binder. As part of fixing this bug, this pattern is replaced with a Rust enum.
I considered the alternate option of not pushing a fixup when the length is zero, but I think it's cleaner to just get rid of the zero-is-special stuff.
The root cause of this bug was diagnosed by Gemini CLI on first try. I used the following prompt:
Quoted 6 lines
There appears to be a bug in
@drivers/android/binder/thread.rswhere the Fixups oob bug is triggered with 316 304 316 324. This implies that we somehow ended up with a fixup where buffer A has a pointer to buffer B, but the pointer is located at an index in buffer A that is out of bounds. Please investigate the code to find the bug. You may compare with@drivers/android/binder.cthat implements this correctly.
--- drivers/android/binder/thread.rs | 59 ++++++++++++++++++-------------- 1 file changed, 34 insertions(+), 25 deletions(-)
drivers/android/binder/thread.rs +34 -25
@@ -69,17 +69,24 @@ struct ScatterGatherEntry { }/// This entry specifies that a fixup should happen at `target_offset` of the -/// buffer. If `skip` is nonzero, then the fixup is a `binder_fd_array_object` -/// and is applied later. Otherwise if `skip` is zero, then the size of the -/// fixup is `sizeof::<u64>()` and `pointer_value` is written to the buffer. -struct PointerFixupEntry { -/// The number of bytes to skip, or zero for a `binder_buffer_object` fixup. - skip:usize , -/// The translated pointer to write when `skip` is zero. - pointer_value:u64 , -/// The offset at which the value should be written. The offset is relative -/// to the original buffer. - target_offset:usize , +/// buffer. +enum PointerFixupEntry { +/// A fixup for a `binder_buffer_object`. +Fixup { +/// The translated pointer to write. + pointer_value:u64 , +/// The offset at which the value should be written. The offset is relative +/// to the original buffer. + target_offset:usize , + }, +/// A skip for a `binder_fd_array_object`. +Skip { +/// The number of bytes to skip. + skip:usize , +/// The offset at which the skip should happen. The offset is relative +/// to the original buffer. + target_offset:usize , + }, }/// Return type of `apply_and_validate_fixup_in_parent`.
@@ -762,8 +769,7 @@ fn translate_object( parent_entry.fixup_min_offset = info.new_min_offset; parent_entry.pointer_fixups.push ( -PointerFixupEntry { - skip:0 , +PointerFixupEntry ::Fixup { pointer_value: buffer_ptr_in_user_space, target_offset: info.target_offset, },
@@ -807,9 +813,8 @@ fn translate_object( parent_entry .pointer_fixups .push ( -PointerFixupEntry { +PointerFixupEntry ::Skip { skip: fds_len, - pointer_value:0 , target_offset: info.target_offset, }, GFP_KERNEL,
@@ -871,17 +876,21 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->let mut reader =UserSlice ::new (UserPtr ::from_addr (sg_entry.sender_uaddr), sg_entry.length).reader ();for fixupin &mut sg_entry.pointer_fixups { -let fixup_len =if fixup.skip ==0 { -size_of ::<u64 >() - }else { - fixup.skip +let (fixup_len, fixup_offset) =match fixup { +PointerFixupEntry ::Fixup { target_offset, .. } => { + (size_of ::<u64 >(), *target_offset) + } +PointerFixupEntry ::Skip { + skip, + target_offset, + } => (*skip, *target_offset), }; -let target_offset_end = fixup.target_offset.checked_add (fixup_len).ok_or (EINVAL )?; -if fixup.target_offset < end_of_previous_fixup || offset_end < target_offset_end { +let target_offset_end = fixup_offset.checked_add (fixup_len).ok_or (EINVAL )?; +if fixup_offset < end_of_previous_fixup || offset_end < target_offset_end {pr_warn! ("Fixups oob {} {} {} {}" , - fixup.target_offset, + fixup_offset, end_of_previous_fixup, offset_end, target_offset_end
@@ -890,13 +899,13 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) -> }let copy_off = end_of_previous_fixup; -let copy_len = fixup.target_offset - end_of_previous_fixup; +let copy_len = fixup_offset - end_of_previous_fixup;if let Err (err) = alloc.copy_into (&mut reader, copy_off, copy_len) {pr_warn! ("Failed copying into alloc: {:?}" , err);return Err (err.into ()); } -if fixup.skip ==0 { -let res = alloc.write ::<u64 >(fixup.target_offset, &fixup.pointer_value); +if let PointerFixupEntry ::Fixup { pointer_value, .. } = fixup { +let res = alloc.write ::<u64 >(fixup_offset, pointer_value);if let Err (err) = res {pr_warn! ("Failed copying ptr into alloc: {:?}" , err);return Err (err.into ());
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/175 rust_binder: add additional alignment checks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit d047248190d86a52164656d47bec9bfba61dc71e upstream.
This adds some alignment checks to match C Binder more closely. This causes the driver to reject more transactions. I don't think any of the transactions in question are harmful, but it's still a bug because it's the wrong uapi to accept them.
The cases where usize is changed for u64, it will affect only 32-bit kernels.
--- drivers/android/binder/thread.rs | 50 +++++++++++++++++++++++--------- 1 file changed, 36 insertions(+), 14 deletions(-)
drivers/android/binder/thread.rs +36 -14
@@ -39,6 +39,10 @@ sync::atomic::{AtomicU32, Ordering}, }; +fn is_aligned (value:usize , to:usize ) ->bool { + value % to ==0 +} +/// Stores the layout of the scatter-gather entries. This is used during the `translate_objects` /// call and is discarded when it returns. struct ScatterGatherState {
@@ -795,6 +799,10 @@ fn translate_object(let num_fds = usize::try_from (obj.num_fds).map_err (|_|EINVAL )?;let fds_len = num_fds.checked_mul (size_of ::<u32 >()).ok_or (EINVAL )?; +if !is_aligned (parent_offset,size_of ::<u32 >()) { +return Err (EINVAL .into ()); + } +let info = sg_state.validate_parent_fixup (parent_index, parent_offset, fds_len)?; view.alloc.info_add_fd_reserve (num_fds)?;
@@ -809,6 +817,10 @@ fn translate_object( } }; +if !is_aligned (parent_entry.sender_uaddr,size_of ::<u32 >()) { +return Err (EINVAL .into ()); + } + parent_entry.fixup_min_offset = info.new_min_offset; parent_entry .pointer_fixups
@@ -825,6 +837,7 @@ fn translate_object( .sender_uaddr .checked_add (parent_offset) .ok_or (EINVAL )?; +let mut fda_bytes =KVec ::new ();UserSlice ::new (UserPtr ::from_addr (fda_uaddras _ ), fds_len) .read_all (&mut fda_bytes,GFP_KERNEL )?;
@@ -958,25 +971,30 @@ pub(crate) fn copy_transaction_data(let data_size = trd.data_size.try_into ().map_err (|_|EINVAL )?;let aligned_data_size =ptr_align (data_size).ok_or (EINVAL )?; -let offsets_size = trd.offsets_size.try_into ().map_err (|_|EINVAL )?; -let aligned_offsets_size =ptr_align (offsets_size).ok_or (EINVAL )?; -let buffers_size = tr.buffers_size.try_into ().map_err (|_|EINVAL )?; -let aligned_buffers_size =ptr_align (buffers_size).ok_or (EINVAL )?; +let offsets_size:usize = trd.offsets_size.try_into ().map_err (|_|EINVAL )?; +let buffers_size:usize = tr.buffers_size.try_into ().map_err (|_|EINVAL )?;let aligned_secctx_size =match secctx.as_ref () {Some ((_offset, ctx)) =>ptr_align (ctx.len ()).ok_or (EINVAL )?,None =>0 , }; +if !is_aligned (offsets_size,size_of ::<u64 >()) { +return Err (EINVAL .into ()); + } +if !is_aligned (buffers_size,size_of ::<u64 >()) { +return Err (EINVAL .into ()); + } +// This guarantees that at least `sizeof(usize)` bytes will be allocated. let len = usize::max ( aligned_data_size - .checked_add (aligned_offsets_size) - .and_then (|sum| sum.checked_add (aligned_buffers_size)) + .checked_add (offsets_size) + .and_then (|sum| sum.checked_add (buffers_size)) .and_then (|sum| sum.checked_add (aligned_secctx_size)) .ok_or (ENOMEM )?, -size_of ::<usize >(), +size_of ::<u64 >(), ); -let secctx_off = aligned_data_size + aligned_offsets_size + aligned_buffers_size; +let secctx_off = aligned_data_size + offsets_size + buffers_size;let mut alloc =match to_process.buffer_alloc (debug_id, len, is_oneway, self.process.task.pid ()) {Ok (alloc) => alloc,
@@ -1008,13 +1026,13 @@ pub(crate) fn copy_transaction_data( }let offsets_start = aligned_data_size; -let offsets_end = aligned_data_size + aligned_offsets_size; +let offsets_end = aligned_data_size + offsets_size;// This state is used for BINDER_TYPE_PTR objects. let sg_state = sg_state.insert(ScatterGatherState { unused_buffer_space: UnusedBufferSpace { offset: offsets_end, - limit: len, + limit: offsets_end + buffers_size, }, sg_entries: KVec::new(), ancestors: KVec::new(),
@@ -1023,12 +1041,16 @@ pub(crate) fn copy_transaction_data(// Traverse the objects specified. let mut view =AllocationView ::new (&mut alloc, data_size);for (index, index_offset)in (offsets_start..offsets_end) - .step_by (size_of ::<usize >()) + .step_by (size_of ::<u64 >()) .enumerate () { -let offset = view.alloc.read (index_offset)?; +let offset:usize = view + .alloc + .read ::<u64 >(index_offset)? + .try_into () + .map_err (|_|EINVAL )?; -if offset < end_of_previous_object { +if offset < end_of_previous_object || !is_aligned (offset,size_of ::<u32 >()) {pr_warn! ("Got transaction with invalid offset." );return Err (EINVAL .into ()); }
@@ -1060,7 +1082,7 @@ pub(crate) fn copy_transaction_data( }// Update the indexes containing objects to clean up. -let offset_after_object = index_offset +size_of ::<usize >(); +let offset_after_object = index_offset +size_of ::<u64 >(); view.alloc .set_info_offsets (offsets_start..offset_after_object); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/175 rust_binderfs: fix ida_alloc_max() upper bound
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit d6ba734814266bbf7ee01f9030436597116805f3 upstream.
The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'.
--- drivers/android/binder/rust_binderfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/android/binder/rust_binderfs.c +4 -4
@@ -132,8 +132,8 @@ static int binderfs_binder_device_createmutex_lock (&binderfs_minors_mutex);if (++info->device_count <= info->mount_opts.max) minor =ida_alloc_max (&binderfs_minors, - use_reserve ?BINDERFS_MAX_MINOR : -BINDERFS_MAX_MINOR_CAPPED , + use_reserve ?BINDERFS_MAX_MINOR -1 : +BINDERFS_MAX_MINOR_CAPPED -1 ,GFP_KERNEL );else minor = -ENOSPC ;
@@ -416,8 +416,8 @@ static int binderfs_binder_ctl_create(st/* Reserve a new minor number for the new device. */ mutex_lock (&binderfs_minors_mutex); minor =ida_alloc_max (&binderfs_minors, - use_reserve ?BINDERFS_MAX_MINOR : -BINDERFS_MAX_MINOR_CAPPED , + use_reserve ?BINDERFS_MAX_MINOR -1 : +BINDERFS_MAX_MINOR_CAPPED -1 ,GFP_KERNEL );mutex_unlock (&binderfs_minors_mutex);if (minor <0 ) {
Greg Kroah-Hartman
maintainerPATCH 44/175 binder: fix UAF in binder_netlink_report()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 5e8a3d01544282e50d887d76f30d1496a0a53562 upstream.
Oneway transactions sent to frozen targets via binder_proc_transaction() return a BR_TRANSACTION_PENDING_FROZEN error but they are still treated as successful since the target is expected to thaw at some point. It is then not safe to access 't' after BR_TRANSACTION_PENDING_FROZEN errors as the transaction could have been consumed by the now thawed target.
This is the case for binder_netlink_report() which derreferences 't' after a pending frozen error, as pointed out by the following KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in binder_netlink_report.isra.0+0x694/0x6c8 Read of size 8 at addr ffff00000f98ba38 by task binder-util/522 CPU: 4 UID: 0 PID: 522 Comm: binder-util Not tainted 6.19.0-rc6-00015-gc03e9c42ae8f #1 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: binder_netlink_report.isra.0+0x694/0x6c8 binder_transaction+0x66e4/0x79b8 binder_thread_write+0xab4/0x4440 binder_ioctl+0x1fd4/0x2940 [...] Allocated by task 522: __kmalloc_cache_noprof+0x17c/0x50c binder_transaction+0x584/0x79b8 binder_thread_write+0xab4/0x4440 binder_ioctl+0x1fd4/0x2940 [...] Freed by task 488: kfree+0x1d0/0x420 binder_free_transaction+0x150/0x234 binder_thread_read+0x2d08/0x3ce4 binder_ioctl+0x488/0x2940 [...] ==================================================================
Instead, make a transaction copy so the data can be safely accessed by binder_netlink_report() after a pending frozen error. While here, add a comment about not using t->buffer in binder_netlink_report().
--- drivers/android/binder.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/android/binder.c +13 -1
@@ -2991,6 +2991,10 @@ static void binder_set_txn_from_error(st* @t: the binder transaction that failed * @data_size: the user provided data size for the transaction * @error: enum binder_driver_return_protocol returned to sender +* +* Note that t->buffer is not safe to access here, as it may have been +* released (or not yet allocated). Callers should guarantee all the +* transaction items used here are safe to access. */ static void binder_netlink_report(struct binder_proc *proc, struct binder_transaction *t,
@@ -3780,6 +3784,14 @@ static void binder_transaction(struct bi goto err_dead_proc_or_thread; } }else { +/* +* Make a transaction copy. It is not safe to access 't' after +* binder_proc_transaction() reported a pending frozen. The +* target could thaw and consume the transaction at any point. +* Instead, use a safe 't_copy' for binder_netlink_report(). +*/ +struct binder_transaction t_copy = *t; +BUG_ON (target_node ==NULL );BUG_ON (t->buffer->async_transaction !=1 ); return_error =binder_proc_transaction (t, target_proc,NULL );
@@ -3790,7 +3802,7 @@ static void binder_transaction(struct bi*/ if (return_error ==BR_TRANSACTION_PENDING_FROZEN ) { tcomplete->type =BINDER_WORK_TRANSACTION_PENDING ; -binder_netlink_report (proc, t, tr->data_size, +binder_netlink_report (proc, &t_copy, tr->data_size, return_error); }binder_enqueue_thread_work (thread, tcomplete);
Greg Kroah-Hartman
maintainerPATCH 45/175 binder: fix BR_FROZEN_REPLY error log
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 1769f90e5ba2a6d24bb46b85da33fe861c68f005 upstream.
The error logging for failed transactions is misleading as it always reports "dead process or thread" even when the target is actually frozen. Additionally, the pid and tid are reversed which can further confuse debugging efforts. Fix both issues.
--- drivers/android/binder.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/android/binder.c +3 -2
@@ -3824,8 +3824,9 @@ static void binder_transaction(struct bireturn ; err_dead_proc_or_thread: -binder_txn_error ("%d:%d dead process or thread\n" , - thread->pid, proc->pid); +binder_txn_error ("%d:%d %s process or thread\n" , + proc->pid, thread->pid, + return_error ==BR_FROZEN_REPLY ?"frozen" :"dead" ); return_error_line = __LINE__;binder_dequeue_work (proc, tcomplete); err_translate_failed:
Greg Kroah-Hartman
maintainerPATCH 46/175 binderfs: fix ida_alloc_max() upper bound
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit ec4ddc90d201d09ef4e4bef8a2c6d9624525ad68 upstream.
The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'.
--- drivers/android/binderfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/android/binderfs.c +4 -4
@@ -132,8 +132,8 @@ static int binderfs_binder_device_createmutex_lock (&binderfs_minors_mutex);if (++info->device_count <= info->mount_opts.max) minor =ida_alloc_max (&binderfs_minors, - use_reserve ?BINDERFS_MAX_MINOR : -BINDERFS_MAX_MINOR_CAPPED , + use_reserve ?BINDERFS_MAX_MINOR -1 : +BINDERFS_MAX_MINOR_CAPPED -1 ,GFP_KERNEL );else minor = -ENOSPC ;
@@ -424,8 +424,8 @@ static int binderfs_binder_ctl_create(st/* Reserve a new minor number for the new device. */ mutex_lock (&binderfs_minors_mutex); minor =ida_alloc_max (&binderfs_minors, - use_reserve ?BINDERFS_MAX_MINOR : -BINDERFS_MAX_MINOR_CAPPED , + use_reserve ?BINDERFS_MAX_MINOR -1 : +BINDERFS_MAX_MINOR_CAPPED -1 ,GFP_KERNEL );mutex_unlock (&binderfs_minors_mutex);if (minor <0 ) {
Greg Kroah-Hartman
maintainerPATCH 47/175 tracing: Fix ftrace event field alignments
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 033c55fe2e326bea022c3cc5178ecf3e0e459b82 ]
The fields of ftrace specific events (events used to save ftrace internal events like function traces and trace_printk) are generated similarly to how normal trace event fields are generated. That is, the fields are added to a trace_events_fields array that saves the name, offset, size, alignment and signness of the field. It is used to produce the output in the format file in tracefs so that tooling knows how to parse the binary data of the trace events.
The issue is that some of the ftrace event structures are packed. The function graph exit event structures are one of them. The 64 bit calltime and rettime fields end up 4 byte aligned, but the algorithm to show to userspace shows them as 8 byte aligned.
The macros that create the ftrace events has one for embedded structure fields. There's two macros for theses fields:
__field_desc() and __field_packed()
The difference of the latter macro is that it treats the field as packed.
Rename that field to __field_desc_packed() and create replace the __field_packed() to be a normal field that is packed and have the calltime and rettime use those.
This showed up on 32bit architectures for function graph time fields. It had:
~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format
[..]
field:unsigned long func; offset:8; size:4; signed:0;
field:unsigned int depth; offset:12; size:4; signed:0;
field:unsigned int overrun; offset:16; size:4; signed:0;
field:unsigned long long calltime; offset:24; size:8; signed:0;
field:unsigned long long rettime; offset:32; size:8; signed:0;Notice that overrun is at offset 16 with size 4, where in the structure calltime is at offset 20 (16 + 4), but it shows the offset at 24. That's because it used the alignment of unsigned long long when used as a declaration and not as a member of a structure where it would be aligned by word size (in this case 4).
By using the proper structure alignment, the format has it at the correct offset:
~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format
[..]
field:unsigned long func; offset:8; size:4; signed:0;
field:unsigned int depth; offset:12; size:4; signed:0;
field:unsigned int overrun; offset:16; size:4; signed:0;
field:unsigned long long calltime; offset:20; size:8; signed:0;
field:unsigned long long rettime; offset:28; size:8; signed:0;--- kernel/trace/trace.h | 7 +++++-- kernel/trace/trace_entries.h | 32 ++++++++++++++++---------------- kernel/trace/trace_export.c | 21 +++++++++++++++------ 3 files changed, 36 insertions(+), 24 deletions(-)
kernel/trace/trace.h +5 -2
@@ -67,14 +67,17 @@ enum trace_type {#undef __field_fn#define __field_fn (type, item) type item; +#undef __field_packed +#define __field_packed (type, item) type item; +#undef __field_struct#define __field_struct (type, item) __field(type, item)#undef __field_desc#define __field_desc (type, container, item) -#undef __field_packed -#define __field_packed (type, container, item) +#undef __field_desc_packed +#define __field_desc_packed (type, container, item)#undef __array#define __array (type, item, size) type item[size];
kernel/trace/trace_entries.h +16 -16
@@ -79,8 +79,8 @@ FTRACE_ENTRY(funcgraph_entry, ftrace_graF_STRUCT (__field_struct (struct ftrace_graph_ent ,graph_ent ) - __field_packed( unsigned long, graph_ent, func ) - __field_packed( unsigned int, graph_ent, depth ) + __field_desc_packed(unsigned long, graph_ent, func ) + __field_desc_packed(unsigned int, graph_ent, depth ) __dynamic_array(unsigned long, args ) ),
@@ -96,9 +96,9 @@ FTRACE_ENTRY_PACKED(fgraph_retaddr_entry F_STRUCT( __field_struct( struct fgraph_retaddr_ent, graph_ent ) - __field_packed( unsigned long, graph_ent, func ) - __field_packed( unsigned int, graph_ent, depth ) - __field_packed( unsigned long, graph_ent, retaddr ) + __field_desc_packed( unsigned long, graph_ent, func ) + __field_desc_packed( unsigned int, graph_ent, depth ) + __field_desc_packed( unsigned long, graph_ent, retaddr ) ), F_printk("--> %ps (%u) <- %ps", (void *)__entry->func, __entry->depth,
@@ -122,12 +122,12 @@ FTRACE_ENTRY_PACKED(funcgraph_exit, ftra F_STRUCT( __field_struct( struct ftrace_graph_ret, ret ) - __field_packed( unsigned long, ret, func ) - __field_packed( unsigned long, ret, retval ) - __field_packed( unsigned int, ret, depth ) - __field_packed( unsigned int, ret, overrun ) - __field(unsigned long long, calltime ) - __field(unsigned long long, rettime ) + __field_desc_packed( unsigned long, ret, func ) + __field_desc_packed( unsigned long, ret, retval ) + __field_desc_packed( unsigned int, ret, depth ) + __field_desc_packed( unsigned int, ret, overrun ) + __field_packed(unsigned long long, calltime) + __field_packed(unsigned long long, rettime ) ), F_printk("<-- %ps (%u) (start: %llx end: %llx) over: %u retval: %lx",
@@ -145,11 +145,11 @@ FTRACE_ENTRY_PACKED(funcgraph_exit, ftra F_STRUCT( __field_struct( struct ftrace_graph_ret, ret ) - __field_packed( unsigned long, ret, func ) - __field_packed( unsigned int, ret, depth ) - __field_packed( unsigned int, ret, overrun ) - __field(unsigned long long, calltime ) - __field(unsigned long long, rettime ) + __field_desc_packed( unsigned long, ret, func ) + __field_desc_packed( unsigned int, ret, depth ) + __field_desc_packed( unsigned int, ret, overrun ) + __field_packed(unsigned long long, calltime ) + __field_packed(unsigned long long, rettime ) ), F_printk("<-- %ps (%u) (start: %llx end: %llx) over: %u",
kernel/trace/trace_export.c +15 -6
@@ -42,11 +42,14 @@ static int ftrace_event_register(struct#undef __field_fn#define __field_fn (type, item) type item; +#undef __field_packed +#define __field_packed (type, item) type item; +#undef __field_desc#define __field_desc (type, container, item) type item; -#undef __field_packed -#define __field_packed (type, container, item) type item; +#undef __field_desc_packed +#define __field_desc_packed (type, container, item) type item;#undef __array#define __array (type, item, size) type item[size];
@@ -104,11 +107,14 @@ static void __always_unused ____ftrace_c#undef __field_fn#define __field_fn (_type, _item) __field_ext(_type, _item, FILTER_TRACE_FN) +#undef __field_packed +#define __field_packed (_type, _item) __field_ext_packed(_type, _item, FILTER_OTHER) +#undef __field_desc#define __field_desc (_type, _container, _item) __field_ext(_type, _item, FILTER_OTHER) -#undef __field_packed -#define __field_packed (_type, _container, _item) __field_ext_packed(_type, _item, FILTER_OTHER) +#undef __field_desc_packed +#define __field_desc_packed (_type, _container, _item) __field_ext_packed(_type, _item, FILTER_OTHER)#undef __array#define __array (_type, _item, _len) { \
@@ -146,11 +152,14 @@ static struct trace_event_fields ftrace_#undef __field_fn#define __field_fn (type, item) +#undef __field_packed +#define __field_packed (type, item) +#undef __field_desc#define __field_desc (type, container, item) -#undef __field_packed -#define __field_packed (type, container, item) +#undef __field_desc_packed +#define __field_desc_packed (type, container, item)#undef __array#define __array (type, item, len)
Greg Kroah-Hartman
maintainerPATCH 48/175 wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Hee Lee <[email protected]>
[ Upstream commit ff4071c60018a668249dc6a2df7d16330543540e ]
ieee80211_ocb_rx_no_sta() assumes a valid channel context, which is only present after JOIN_OCB.
RX may run before JOIN_OCB is executed, in which case the OCB interface is not operational. Skip RX peer handling when the interface is not joined to avoid warnings in the RX path.
--- net/mac80211/ocb.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/ocb.c +3 -0
@@ -47,6 +47,9 @@ void ieee80211_ocb_rx_no_sta(struct ieee80211_sub_if_data *sdata,struct sta_info *sta;int band; +if (!ifocb->joined) +return ; +/* XXX: Consider removing the least recently used entry and * allow new one to be added. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/175 wifi: wlcore: ensure skb headroom before skb_push
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Åstrand <[email protected]>
[ Upstream commit e75665dd096819b1184087ba5718bd93beafff51 ]
This avoids occasional skb_under_panic Oops from wl1271_tx_work. In this case, headroom is less than needed (typically 110 - 94 = 16 bytes).
--- drivers/net/wireless/ti/wlcore/tx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/ti/wlcore/tx.c +5 -0
@@ -207,6 +207,11 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif, total_blocks =wlcore_hw_calc_tx_blocks (wl, total_len, spare_blocks);if (total_blocks <= wl->tx_blocks_available) { +if (skb_headroom (skb) < (total_len - skb->len) && +pskb_expand_head (skb, (total_len - skb->len),0 ,GFP_ATOMIC )) { +wl1271_free_tx_id (wl, id); +return -EAGAIN ; + } desc =skb_push (skb, total_len - skb->len); wlcore_hw_set_tx_desc_blocks(wl, desc, total_blocks,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/175 wifi: mac80211: dont WARN for connections on invalid channels
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 99067b58a408a384d2a45c105eb3dce980a862ce ]
It's not clear (to me) how exactly syzbot managed to hit this, but it seems conceivable that e.g. regulatory changed and has disabled a channel between scanning (channel is checked to be usable by cfg80211_get_ies_channel_number) and connecting on the channel later.
With one scenario that isn't covered elsewhere described above, the warning isn't good, replace it with a (more informative) error message.
--- net/mac80211/mlme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/mac80211/mlme.c +4 -1
@@ -1126,7 +1126,10 @@ ieee80211_determine_chan_mode(struct ieee80211_sub_if_data *sdata,while (!ieee80211_chandef_usable (sdata, &chanreq->oper,IEEE80211_CHAN_DISABLED )) { -if (WARN_ON (chanreq->oper.width ==NL80211_CHAN_WIDTH_20_NOHT )) { +if (chanreq->oper.width ==NL80211_CHAN_WIDTH_20_NOHT ) { +link_id_info (sdata, link_id, +"unusable channel (%d MHz) for connection\n" , + chanreq->oper.chan->center_freq); ret = -EINVAL ; goto free; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/175 net: usb: sr9700: support devices with virtual driver CD
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
[ Upstream commit bf4172bd870c3a34d3065cbb39192c22cbd7b18d ]
Some SR9700 devices have an SPI flash chip containing a virtual driver CD, in which case they appear as a device with two interfaces and product ID 0x9702. Interface 0 is the driver CD and interface 1 is the Ethernet device.
--- drivers/net/usb/sr9700.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/usb/sr9700.c +5 -0
@@ -539,6 +539,11 @@ static const struct usb_device_id products[] = { USB_DEVICE(0x0fe6, 0x9700), /* SR9700 device */ .driver_info = (unsigned long)&sr9700_driver_info, }, + { +/* SR9700 with virtual driver CD-ROM - interface 0 is the CD-ROM device */ + USB_DEVICE_INTERFACE_NUMBER(0x0fe6, 0x9702, 1), + .driver_info = (unsigned long)&sr9700_driver_info, + }, {}, /* END */ };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/175 wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Zi <[email protected]>
[ Upstream commit 81d90d93d22ca4f61833cba921dce9a0bd82218f ]
Since commit dfb073d32cac ("ptp: Return -EINVAL on ptp_clock_register if required ops are NULL"), PTP clock registered through ptp_clock_register is required to have ptp_clock_info.settime64 set, however, neither MVM nor MLD's PTP clock implementation sets it, resulting in warnings when the interface starts up, like
WARNING: drivers/ptp/ptp_clock.c:325 at ptp_clock_register+0x2c8/0x6b8, CPU#1: wpa_supplicant/469 CPU: 1 UID: 0 PID: 469 Comm: wpa_supplicant Not tainted 6.18.0+ #101 PREEMPT(full) ra: ffff800002732cd4 iwl_mvm_ptp_init+0x114/0x188 [iwlmvm] ERA: 9000000002fdc468 ptp_clock_register+0x2c8/0x6b8
iwlwifi 0000:01:00.0: Failed to register PHC clock (-22)
I don't find an appropriate firmware interface to implement settime64() for iwlwifi MLD/MVM, thus instead create a stub that returns -EOPTNOTSUPP only, suppressing the warning and allowing the PTP clock to be registered.
--- drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 7 +++++++ drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 7 +++++++ 2 files changed, 14 insertions(+)
drivers/net/wireless/intel/iwlwifi/mld/ptp.c +7 -0
@@ -121,6 +121,12 @@ static int iwl_mld_ptp_gettime(struct ptp_clock_info *ptp,return 0 ; } +static int iwl_mld_ptp_settime (struct ptp_clock_info *ptp, +const struct timespec64 *ts) +{ +return -EOPNOTSUPP ; +} +static int iwl_mld_ptp_adjtime (struct ptp_clock_info *ptp,s64 delta) { struct iwl_mld *mld = container_of(ptp, struct iwl_mld,
@@ -279,6 +285,7 @@ void iwl_mld_ptp_init(struct iwl_mld *mld) mld->ptp_data.ptp_clock_info.owner =THIS_MODULE ; mld->ptp_data.ptp_clock_info.gettime64 = iwl_mld_ptp_gettime; + mld->ptp_data.ptp_clock_info.settime64 = iwl_mld_ptp_settime; mld->ptp_data.ptp_clock_info.max_adj =0x7fffffff ; mld->ptp_data.ptp_clock_info.adjtime = iwl_mld_ptp_adjtime; mld->ptp_data.ptp_clock_info.adjfine = iwl_mld_ptp_adjfine;
drivers/net/wireless/intel/iwlwifi/mvm/ptp.c +7 -0
@@ -220,6 +220,12 @@ static int iwl_mvm_ptp_gettime(struct ptp_clock_info *ptp,return 0 ; } +static int iwl_mvm_ptp_settime (struct ptp_clock_info *ptp, +const struct timespec64 *ts) +{ +return -EOPNOTSUPP ; +} +static int iwl_mvm_ptp_adjtime (struct ptp_clock_info *ptp,s64 delta) { struct iwl_mvm *mvm = container_of(ptp, struct iwl_mvm,
@@ -281,6 +287,7 @@ void iwl_mvm_ptp_init(struct iwl_mvm *mvm) mvm->ptp_data.ptp_clock_info.adjfine = iwl_mvm_ptp_adjfine; mvm->ptp_data.ptp_clock_info.adjtime = iwl_mvm_ptp_adjtime; mvm->ptp_data.ptp_clock_info.gettime64 = iwl_mvm_ptp_gettime; + mvm->ptp_data.ptp_clock_info.settime64 = iwl_mvm_ptp_settime; mvm->ptp_data.scaled_freq =SCALE_FACTOR ;/* Give a short 'friendly name' to identify the PHC clock */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/175 platform/x86: dell-lis3lv02d: Add Latitude 5400
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmytro Bagrii <[email protected]>
[ Upstream commit a5b9fdd33c59a964a26d12c39b636ef85a25b074 ]
Add accelerometer address 0x29 for Dell Latitude 5400.
The address is verified as below:
$ cat /sys/class/dmi/id/product_name
Latitude 5400 $ grep -H '' /sys/bus/pci/drivers/i801_smbus/0000\:00*/i2c-*/name
/sys/bus/pci/drivers/i801_smbus/0000:00:1f.4/i2c-10/name:SMBus I801 adapter at 0000:00:1f.4 $ i2cdetect 10
WARNING! This program can confuse your I2C bus, cause data loss and worse!
I will probe file /dev/i2c-10.
I will probe address range 0x08-0x77.
Continue? [Y/n] Y
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: 08 -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- UU -- -- -- -- -- --
30: 30 -- -- -- -- 35 UU UU -- -- -- -- -- -- -- --
40: -- -- -- -- 44 -- -- -- -- -- -- -- -- -- -- --
50: UU -- 52 -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- -- $ xargs -n1 -a /proc/cmdline | grep ^dell_lis3lv02d
dell_lis3lv02d.probe_i2c_addr=1 $ dmesg | grep lis3lv02d
...
[ 206.012411] i2c i2c-10: Probing for lis3lv02d on address 0x29
[ 206.013727] i2c i2c-10: Detected lis3lv02d on address 0x29, please report this upstream to [email protected] so that a quirk can be added
[ 206.240841] lis3lv02d_i2c 10-0029: supply Vdd not found, using dummy regulator
[ 206.240868] lis3lv02d_i2c 10-0029: supply Vdd_IO not found, using dummy regulator
[ 206.261258] lis3lv02d: 8 bits 3DC sensor found
[ 206.346722] input: ST LIS3LV02DL Accelerometer as /devices/faux/lis3lv02d/input/input17 $ cat /sys/class/input/input17/name
ST LIS3LV02DL Accelerometer--- drivers/platform/x86/dell/dell-lis3lv02d.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell/dell-lis3lv02d.c +1 -0
@@ -44,6 +44,7 @@ static const struct dmi_system_id lis3lv02d_devices[] __initconst = {/* * Additional individual entries were added after verification. */ +DELL_LIS3LV02D_DMI_ENTRY ("Latitude 5400" ,0x29 ),DELL_LIS3LV02D_DMI_ENTRY ("Latitude 5480" ,0x29 ),DELL_LIS3LV02D_DMI_ENTRY ("Latitude 5500" ,0x29 ), DELL_LIS3LV02D_DMI_ENTRY("Latitude E6330", 0x29),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/175 block,bfq: fix aux stat accumulation destination
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: shechenglong <[email protected]>
[ Upstream commit 04bdb1a04d8a2a89df504c1e34250cd3c6e31a1c ]
Route bfqg_stats_add_aux() time accumulation into the destination stats object instead of the source, aligning with other stat fields.
--- block/bfq-cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-cgroup.c +1 -1
@@ -380,7 +380,7 @@ static void bfqg_stats_add_aux(struct bfqg_stats *to, struct bfqg_stats *from)blkg_rwstat_add_aux (&to->merged, &from->merged);blkg_rwstat_add_aux (&to->service_time, &from->service_time);blkg_rwstat_add_aux (&to->wait_time, &from->wait_time); -bfq_stat_add_aux (&from->time, &from->time); +bfq_stat_add_aux (&to->time, &from->time);bfq_stat_add_aux (&to->avg_queue_size_sum, &from->avg_queue_size_sum);bfq_stat_add_aux (&to->avg_queue_size_samples, &from->avg_queue_size_samples);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/175 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <[email protected]>
[ Upstream commit 7c28f8eef5ac5312794d8a52918076dcd787e53b ]
When ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().
--- fs/smb/server/smb2pdu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +4 -1
@@ -2291,7 +2291,7 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work) {struct smb2_create_rsp *rsp;struct smb2_create_req *req; -int id; +int id =-1 ;int err;char *name;
@@ -2348,6 +2348,9 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work)break ; } +if (id >=0 ) +ksmbd_session_rpc_close (work->sess, id); +if (!IS_ERR (name))kfree (name);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/175 LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit d5be446948b379f1d1a8e7bc6656d13f44c5c7b1 ]
For 32BIT platform _PAGE_PROTNONE is 0, so set a VMA to be VM_NONE or VM_SHARED will make pages non-present, then cause Oops with kernel page fault.
Fix it by set correct protection_map[] for VM_NONE/VM_SHARED, replacing _PAGE_PROTNONE with _PAGE_PRESENT.
--- arch/loongarch/mm/cache.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/loongarch/mm/cache.c +4 -4
@@ -160,8 +160,8 @@ void cpu_cache_init(void)static const pgprot_t protection_map[16 ] = { [VM_NONE ] =__pgprot (_CACHE_CC | _PAGE_USER | - _PAGE_PROTNONE | _PAGE_NO_EXEC | - _PAGE_NO_READ), + _PAGE_NO_EXEC | _PAGE_NO_READ | + (_PAGE_PROTNONE ? : _PAGE_PRESENT)), [VM_READ ] =__pgprot (_CACHE_CC | _PAGE_VALID | _PAGE_USER | _PAGE_PRESENT | _PAGE_NO_EXEC),
@@ -180,8 +180,8 @@ static const pgprot_t protection_map[16] = { [VM_EXEC | VM_WRITE | VM_READ] = __pgprot(_CACHE_CC | _PAGE_VALID | _PAGE_USER | _PAGE_PRESENT), [VM_SHARED ] =__pgprot (_CACHE_CC | _PAGE_USER | - _PAGE_PROTNONE | _PAGE_NO_EXEC | - _PAGE_NO_READ), + _PAGE_NO_EXEC | _PAGE_NO_READ | + (_PAGE_PROTNONE ? : _PAGE_PRESENT)), [VM_SHARED |VM_READ ] =__pgprot (_CACHE_CC | _PAGE_VALID | _PAGE_USER | _PAGE_PRESENT | _PAGE_NO_EXEC),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/175 md: suspend array while updating raid_disks via sysfs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FengWei Shih <[email protected]>
[ Upstream commit 2cc583653bbe050bacd1cadcc9776d39bf449740 ]
In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->raid_disks, and unfreeze_array() is called after the update is completed.
However, freeze_array() only waits until nr_sync_pending and (nr_pending - nr_queued) of all buckets reaches zero. When an I/O error occurs, nr_queued is increased and the corresponding r1bio is queued to either retry_list or bio_end_io_list. As a result, freeze_array() may unblock before these r1bios are released.
This can lead to a situation where conf->raid_disks and the mempool have already been updated while queued r1bios, allocated with the old raid_disks value, are later released. Consequently, free_r1bio() may access memory out of bounds in put_all_bios() and release r1bios of the wrong size to the new mempool, potentially causing issues with the mempool as well.
Since only normal I/O might increase nr_queued while an I/O error occurs, suspending the array avoids this issue.
Note: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends the array. Therefore, we suspend the array when updating raid_disks via sysfs to avoid this issue too.
--- drivers/md/md.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/md.c +2 -2
@@ -4396,7 +4396,7 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len)if (err <0 )return err; - err =mddev_lock (mddev); + err =mddev_suspend_and_lock (mddev);if (err)return err;if (mddev->pers)
@@ -4421,7 +4421,7 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len) }else mddev->raid_disks = n; out_unlock: -mddev_unlock (mddev); +mddev_unlock_and_resume (mddev);return err ? err : len; } static struct md_sysfs_entry md_raid_disks =
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/175 smb/server: fix refcount leak in smb2_open()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <[email protected]>
[ Upstream commit f416c556997aa56ec4384c6b6efd6a0e6ac70aa7 ]
When ksmbd_vfs_getattr() fails, the reference count of ksmbd_file must be released.
--- fs/smb/server/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +1 -1
@@ -3019,10 +3019,10 @@ int smb2_open(struct ksmbd_work *work) file_info =FILE_OPENED ; rc =ksmbd_vfs_getattr (&fp->filp->f_path, &stat); +ksmbd_put_durable_fd (fp);if (rc) goto err_out2; -ksmbd_put_durable_fd (fp); goto reconnected_fp; } }else if (req_op_level ==SMB2_OPLOCK_LEVEL_LEASE )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/175 io_uring: use GFP_NOWAIT for overflow CQEs on legacy rings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Negrel <[email protected]>
[ Upstream commit fc5ff2500976cd2710a7acecffd12d95ee4f98fc ]
Allocate the overflowing CQE with GFP_NOWAIT instead of GFP_ATOMIC. This changes causes allocations to fail earlier in out-of-memory situations, rather than being deferred. Using GFP_ATOMIC allows a process to exceed memory limits.
--- io_uring/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/io_uring.c +1 -1
@@ -897,7 +897,7 @@ static __cold bool io_cqe_overflow_locked(struct io_ring_ctx *ctx, {struct io_overflow_cqe *ocqe; - ocqe =io_alloc_ocqe (ctx, cqe, big_cqe,GFP_ATOMIC ); + ocqe =io_alloc_ocqe (ctx, cqe, big_cqe,GFP_NOWAIT );return io_cqring_add_overflow (ctx, ocqe); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/175 LoongArch: Enable exception fixup for specific ADE subcode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghao Duan <[email protected]>
[ Upstream commit 9bdc1ab5e4ce6f066119018d8f69631a46f9c5a0 ]
This patch allows the LoongArch BPF JIT to handle recoverable memory access errors generated by BPF_PROBE_MEM* instructions.
When a BPF program performs memory access operations, the instructions it executes may trigger ADEM exceptions. The kernel’s built-in BPF exception table mechanism (EX_TYPE_BPF) will generate corresponding exception fixup entries in the JIT compilation phase; however, the architecture-specific trap handling function needs to proactively call the common fixup routine to achieve exception recovery.
do_ade(): fix EX_TYPE_BPF memory access exceptions for BPF programs, ensure safe execution.
Relevant test cases: illegal address access tests in module_attach and subprogs_extable of selftests/bpf.
--- arch/loongarch/kernel/traps.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/loongarch/kernel/traps.c +5 -0
@@ -535,10 +535,15 @@ asmlinkage void noinstr do_fpe(struct pt_regs *regs, unsigned long fcsr) asmlinkage void noinstr do_ade(struct pt_regs *regs) {irqentry_state_t state =irqentry_enter (regs); +unsigned int esubcode =FIELD_GET (CSR_ESTAT_ESUBCODE , regs->csr_estat); + +if ((esubcode ==EXSUBCODE_ADEM ) &&fixup_exception (regs)) + goto out;die_if_kernel ("Kernel ade access" , regs);force_sig_fault (SIGBUS ,BUS_ADRERR , (void __user *)regs->csr_badvaddr); +out:irqentry_exit (regs, state); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/175 smb/server: fix refcount leak in parse_durable_handle_context()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <[email protected]>
[ Upstream commit 3296c3012a9d9a27e81e34910384e55a6ff3cff0 ]
When the command is a replay operation and -ENOEXEC is returned, the refcount of ksmbd_file must be released.
--- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/smb2pdu.c +1 -0
@@ -2822,6 +2822,7 @@ static int parse_durable_handle_context(struct ksmbd_work *work, SMB2_CLIENT_GUID_SIZE)) {if (!(req->hdr.Flags &SMB2_FLAGS_REPLAY_OPERATION )) { err = -ENOEXEC ; +ksmbd_put_durable_fd (dh_info->fp); goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/175 btrfs: do not free data reservation in fallback from inline due to -ENOSPC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit f8da41de0bff9eb1d774a7253da0c9f637c4470a ]
If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc. However we were always freeing the reserved qgroup data, which is wrong since we will use data. Fix this by freeing the reserved qgroup data in __cow_file_range_inline() only if we are not doing the fallback (ret is <= 0).
--- fs/btrfs/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/inode.c +5 -1
@@ -670,8 +670,12 @@ static noinline int __cow_file_range_inline(struct btrfs_inode *inode,* it won't count as data extent, free them directly here. * And at reserve time, it's always aligned to page size, so * just free one page here. +* +* If we fallback to non-inline (ret == 1) due to -ENOSPC, then we need +* to keep the data reservation. */ -btrfs_qgroup_free_data (inode,NULL ,0 , fs_info->sectorsize,NULL ); +if (ret <=0 ) +btrfs_qgroup_free_data (inode,NULL ,0 , fs_info->sectorsize,NULL );btrfs_free_path (path);btrfs_end_transaction (trans);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/175 HID: intel-ish-hid: Update ishtp bus match to support device ID table
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit daeed86b686855adda79f13729e0c9b0530990be ]
The ishtp_cl_bus_match() function previously only checked the first entry in the driver's device ID table. Update it to iterate over the entire table, allowing proper matching for drivers with multiple supported protocol GUIDs.
--- drivers/hid/intel-ish-hid/ishtp/bus.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/hid/intel-ish-hid/ishtp/bus.c +10 -2
@@ -240,9 +240,17 @@ static int ishtp_cl_bus_match(struct device *dev, const struct device_driver *dr {struct ishtp_cl_device *device =to_ishtp_cl_device (dev);struct ishtp_cl_driver *driver =to_ishtp_cl_driver (drv); +struct ishtp_fw_client *client = device->fw_client; +const struct ishtp_device_id *id; -return (device->fw_client ?guid_equal (&driver->id[0 ].guid, - &device->fw_client->props.protocol_name) :0 ); +if (client) { +for (id = driver->id; !guid_is_null (&id->guid); id++) { +if (guid_equal (&id->guid, &client->props.protocol_name)) +return 1 ; + } + } + +return 0 ; }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/175 HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaytonCL <[email protected]>
[ Upstream commit ff3f234ff1dcd6d626a989151db067a1b7f0f215 ]
Some VTL-class touchpads (e.g. TOPS0102:00 35CC:0104) intermittently fail to release a finger contact. A previous slot remains logically active, accompanied by stale BTN_TOOL_DOUBLETAP state, causing gestures to stay latched and resulting in stuck two-finger scrolling and false right-clicks.
Apply MT_QUIRK_STICKY_FINGERS to handle the unreleased contact correctly.
--- drivers/hid/hid-multitouch.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/hid-multitouch.c +1 -0
@@ -393,6 +393,7 @@ static const struct mt_class mt_classes[] = { { .name = MT_CLS_VTL, .quirks = MT_QUIRK_ALWAYS_VALID | MT_QUIRK_CONTACT_CNT_ACCURATE | + MT_QUIRK_STICKY_FINGERS | MT_QUIRK_FORCE_GET_FEATURE, }, { .name = MT_CLS_GOOGLE,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/175 btrfs: fix reservation leak in some error paths when inserting inline extent
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit c1c050f92d8f6aac4e17f7f2230160794fceef0c ]
If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the reserved qgroup data, resulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data() in such cases.
--- fs/btrfs/inode.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
fs/btrfs/inode.c +10 -6
@@ -614,19 +614,22 @@ static noinline int __cow_file_range_inline(struct btrfs_inode *inode,struct btrfs_drop_extents_args drop_args = {0 };struct btrfs_root *root = inode->root;struct btrfs_fs_info *fs_info = root->fs_info; -struct btrfs_trans_handle *trans; +struct btrfs_trans_handle *trans =NULL ;u64 data_len = (compressed_size ?: size);int ret;struct btrfs_path *path; path =btrfs_alloc_path (); -if (!path) -return -ENOMEM ; +if (!path) { + ret = -ENOMEM ; + goto out; + } trans =btrfs_join_transaction (root);if (IS_ERR (trans)) { -btrfs_free_path (path); -return PTR_ERR (trans); + ret =PTR_ERR (trans); + trans =NULL ; + goto out; } trans->block_rsv = &inode->block_rsv;
@@ -677,7 +680,8 @@ static noinline int __cow_file_range_inline(struct btrfs_inode *inode,if (ret <=0 )btrfs_qgroup_free_data (inode,NULL ,0 , fs_info->sectorsize,NULL );btrfs_free_path (path); -btrfs_end_transaction (trans); +if (trans) +btrfs_end_transaction (trans);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/175 riscv: Sanitize syscall table indexing under speculation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Gerlach <[email protected]>
[ Upstream commit 25fd7ee7bf58ac3ec7be3c9f82ceff153451946c ]
The syscall number is a user-controlled value used to index into the syscall table. Use array_index_nospec() to clamp this value after the bounds check to prevent speculative out-of-bounds access and subsequent data leakage via cache side channels.
--- arch/riscv/kernel/traps.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/riscv/kernel/traps.c +3 -1
@@ -339,8 +339,10 @@ void do_trap_ecall_u(struct pt_regs *regs)add_random_kstack_offset (); -if (syscall >=0 && syscall < NR_syscalls) +if (syscall >=0 && syscall < NR_syscalls) { + syscall =array_index_nospec (syscall, NR_syscalls);syscall_handler (regs, syscall); + }/* * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/175 HID: intel-ish-hid: Reset enum_devices_done before enumeration
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 56e230723e3a818373bd62331bccb1c6d2b3881b ]
Some systems have enabled ISH without any sensors. In this case sending HOSTIF_DM_ENUM_DEVICES results in 0 sensors. This triggers ISH hardware reset on subsequent enumeration after S3/S4 resume.
The enum_devices_done flag was not reset before sending the HOSTIF_DM_ENUM_DEVICES command. On subsequent enumeration calls (such as after S3/S4 resume), this flag retains its previous true value, causing the wait loop to be skipped and returning prematurely to hid_ishtp_cl_init(). If 0 HID devices are found, hid_ishtp_cl_init() skips getting HID device descriptors and sets init_done to true. When the delayed enumeration response arrives with init_done already true, the driver treats it as a bad packet and triggers an ISH hardware reset.
Set enum_devices_done to false before sending the enumeration command, consistent with similar functions like ishtp_get_hid_descriptor() and ishtp_get_report_descriptor() which reset their respective flags.
--- drivers/hid/intel-ish-hid/ishtp-hid-client.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/intel-ish-hid/ishtp-hid-client.c +1 -0
@@ -495,6 +495,7 @@ static int ishtp_enum_enum_devices(struct ishtp_cl *hid_ishtp_cl)int rv;/* Send HOSTIF_DM_ENUM_DEVICES */ + client_data->enum_devices_done = false;memset (&msg,0 ,sizeof (struct hostif_msg )); msg.hdr.command =HOSTIF_DM_ENUM_DEVICES ; rv = ishtp_cl_send(hid_ishtp_cl, (unsigned char *)&msg,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/175 HID: playstation: Center initial joystick axes to prevent spurious events
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siarhei Vishniakou <[email protected]>
[ Upstream commit e9143268d259d98e111a649affa061acb8e13c5b ]
When a new PlayStation gamepad (DualShock 4 or DualSense) is initialized, the input subsystem sets the default value for its absolute axes (e.g., ABS_X, ABS_Y) to 0.
However, the hardware's actual neutral/resting state for these joysticks is 128 (0x80). This creates a mismatch.
When the first HID report arrives from the device, the driver sees the resting value of 128. The kernel compares this to its initial state of 0 and incorrectly interprets this as a delta (0 -> 128). Consequently, it generates EV_ABS events for this initial, non-existent movement.
This behavior can fail userspace 'sanity check' tests (e.g., in Android CTS) that correctly assert no motion events should be generated from a device that is already at rest.
This patch fixes the issue by explicitly setting the initial value of the main joystick axes (e.g., ABS_X, ABS_Y, ABS_RX, ABS_RY) to 128 (0x80) in the common ps_gamepad_create() function.
This aligns the kernel's initial state with the hardware's expected neutral state, ensuring that the first report (at 128) produces no delta and thus, no spurious event.
--- drivers/hid/hid-playstation.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hid/hid-playstation.c +5 -0
@@ -753,11 +753,16 @@ ps_gamepad_create(struct hid_device *hdev,if (IS_ERR (gamepad))return ERR_CAST (gamepad); +/* Set initial resting state for joysticks to 128 (center) */ input_set_abs_params (gamepad,ABS_X ,0 ,255 ,0 ,0 ); + gamepad->absinfo[ABS_X ].value =128 ;input_set_abs_params (gamepad,ABS_Y ,0 ,255 ,0 ,0 ); + gamepad->absinfo[ABS_Y ].value =128 ;input_set_abs_params (gamepad,ABS_Z ,0 ,255 ,0 ,0 );input_set_abs_params (gamepad,ABS_RX ,0 ,255 ,0 ,0 ); + gamepad->absinfo[ABS_RX ].value =128 ;input_set_abs_params (gamepad,ABS_RY ,0 ,255 ,0 ,0 ); + gamepad->absinfo[ABS_RY ].value =128 ;input_set_abs_params (gamepad,ABS_RZ ,0 ,255 ,0 ,0 );input_set_abs_params (gamepad,ABS_HAT0X ,-1 ,1 ,0 ,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/175 ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matouš Lánský <[email protected]>
[ Upstream commit 9be25402d8522e16e5ebe84f2b1b6c5de082a388 ]
Add headset mic quirk for Acer Nitro AN517-55. This laptop uses the same audio configuration as the AN515-58 model.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6239,6 +6239,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1025 ,0x1466 ,"Acer Aspire A515-56" ,ALC255_FIXUP_ACER_HEADPHONE_AND_MIC ),SND_PCI_QUIRK (0x1025 ,0x1534 ,"Acer Predator PH315-54" ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1025 ,0x159c ,"Acer Nitro 5 AN515-58" ,ALC2XX_FIXUP_HEADSET_MIC ), +SND_PCI_QUIRK (0x1025 ,0x1597 ,"Acer Nitro 5 AN517-55" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x169a ,"Acer Swift SFG16" ,ALC256_FIXUP_ACER_SFG16_MICMUTE_LED ),SND_PCI_QUIRK (0x1025 ,0x1826 ,"Acer Helios ZPC" ,ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1025, 0x182c, "Acer Helios ZPD", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/175 x86/sev: Disable GCOV on noinstr object
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brendan Jackman <[email protected]>
[ Upstream commit 9efb74f84ba82a9de81fc921baf3c5e2decf8256 ]
With Debian clang version 19.1.7 (3+build5) there are calls to kasan_check_write() from __sev_es_nmi_complete(), which violates noinstr. Fix it by disabling GCOV for the noinstr object, as has been done for previous such instrumentation issues.
Note that this file already disables __SANITIZE_ADDRESS__ and __SANITIZE_THREAD__, thus calls like kasan_check_write() ought to be nops regardless of GCOV. This has been fixed in other patches. However, to avoid any other accidental instrumentation showing up, (and since, in principle GCOV is instrumentation and hence should be disabled for noinstr code anyway), disable GCOV overall as well.
--- arch/x86/coco/sev/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/coco/sev/Makefile +2 -0
@@ -8,3 +8,5 @@ UBSAN_SANITIZE_noinstr.o := n # GCC may fail to respect __no_sanitize_address or __no_kcsan when inlining KASAN_SANITIZE_noinstr.o := n KCSAN_SANITIZE_noinstr.o := n + +GCOV_PROFILE_noinstr.o := n
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/175 ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruslan Krupitsa <[email protected]>
[ Upstream commit 9ed7a28225af02b74f61e7880d460db49db83758 ]
HP Laptop 15s-eq1xxx with ALC236 codec does not enable the mute LED automatically. This patch adds a quirk entry for subsystem ID 0x8706 using the ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6427,6 +6427,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x863e ,"HP Spectre x360 15-df1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_DF1 ),SND_PCI_QUIRK (0x103c ,0x86e8 ,"HP Spectre x360 15-eb0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x86f9 ,"HP Spectre x360 13-aw0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED ), +SND_PCI_QUIRK (0x103c ,0x8706 ,"HP Laptop 15s-eq1xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8716 ,"HP Elite Dragonfly G2 Notebook PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8720 ,"HP EliteBook x360 1040 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/175 PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 0cc13256b60510936c34098ee7b929098eed823b ]
Though I couldn't confirm ASPM L0s support with the Qcom hardware team, a bug report from Dmitry suggests that L0s is broken on this legacy SoC. Hence, remove L0s support from the Root Port Link Capabilities in this SoC.
Since qcom_pcie_clear_aspm_l0s() is now used by more than one SoC config, call it from qcom_pcie_host_init() instead.
--- drivers/pci/controller/dwc/pcie-qcom.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-qcom.c +3 -1
@@ -1033,7 +1033,6 @@ static int qcom_pcie_post_init_2_7_0(struct qcom_pcie *pcie)writel (WR_NO_SNOOP_OVERRIDE_EN |RD_NO_SNOOP_OVERRIDE_EN , pcie->parf +PARF_NO_SNOOP_OVERRIDE ); -qcom_pcie_clear_aspm_l0s (pcie->pci);qcom_pcie_clear_hpc (pcie->pci);return 0 ;
@@ -1302,6 +1301,8 @@ static int qcom_pcie_host_init(struct dw_pcie_rp *pp) goto err_disable_phy; } +qcom_pcie_clear_aspm_l0s (pcie->pci); +qcom_ep_reset_deassert (pcie);if (pcie->cfg->ops->config_sid) {
@@ -1450,6 +1451,7 @@ static const struct qcom_pcie_cfg cfg_2_1_0 = {static const struct qcom_pcie_cfg cfg_2_3_2 = { .ops = &ops_2_3_2, + .no_l0s = true, };static const struct qcom_pcie_cfg cfg_2_3_3 = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/175 netfilter: replace -EEXIST with -EBUSY
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gomez <[email protected]>
[ Upstream commit 2bafeb8d2f380c3a81d98bd7b78b854b564f9cd4 ]
The -EEXIST error code is reserved by the module loading infrastructure to indicate that a module is already loaded. When a module's init function returns -EEXIST, userspace tools like kmod interpret this as "module already loaded" and treat the operation as successful, returning 0 to the user even though the module initialization actually failed.
Replace -EEXIST with -EBUSY to ensure correct error reporting in the module initialization path.
Affected modules:
* ebtable_broute ebtable_filter ebtable_nat arptable_filter
* ip6table_filter ip6table_mangle ip6table_nat ip6table_raw
* ip6table_security iptable_filter iptable_mangle iptable_nat
* iptable_raw iptable_security
--- net/bridge/netfilter/ebtables.c | 2 +- net/netfilter/nf_log.c | 4 ++-- net/netfilter/x_tables.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
net/bridge/netfilter/ebtables.c +1 -1
@@ -1299,7 +1299,7 @@ int ebt_register_template(const struct ebt_table *t, int (*table_init)(struct nelist_for_each_entry (tmpl, &template_tables, list) {if (WARN_ON_ONCE (strcmp (t->name, tmpl->name) ==0 )) {mutex_unlock (&ebt_mutex); -return -EEXIST ; +return -EBUSY ; } }
net/netfilter/nf_log.c +2 -2
@@ -89,7 +89,7 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)if (pf ==NFPROTO_UNSPEC ) {for (i =NFPROTO_UNSPEC ; i <NFPROTO_NUMPROTO ; i++) {if (rcu_access_pointer (loggers[i][logger->type])) { - ret = -EEXIST ; + ret = -EBUSY ; goto unlock; } }
@@ -97,7 +97,7 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)rcu_assign_pointer (loggers[i][logger->type], logger); }else {if (rcu_access_pointer (loggers[pf][logger->type])) { - ret = -EEXIST ; + ret = -EBUSY ; goto unlock; }rcu_assign_pointer (loggers[pf][logger->type], logger);
net/netfilter/x_tables.c +1 -1
@@ -1764,7 +1764,7 @@ EXPORT_SYMBOL_GPL(xt_hook_ops_alloc);int xt_register_template (const struct xt_table *table,int (*table_init)(struct net *net)) { -int ret = -EEXIST , af = table->af; +int ret = -EBUSY , af = table->af;struct xt_template *t;mutex_lock (&xt[af].mutex);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/175 drm/amd/display: Reduce number of arguments of dcn30s CalculatePrefetchSchedule()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit f54a91f5337cd918eb86cf600320d25b6cfd8209 ]
After an innocuous optimization change in clang-22, dml30_ModeSupportAndSystemConfigurationFull() is over the 2048 byte stack limit for display_mode_vba_30.c.
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3529:6: warning: stack frame size (2096) exceeds limit (2048) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Wframe-larger-than]
3529 | void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
| ^
With clang-21, this function was already close to the limit:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3529:6: warning: stack frame size (1912) exceeds limit (1586) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Wframe-larger-than]
3529 | void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
| ^
CalculatePrefetchSchedule() has a large number of parameters, which must be passed on the stack. Most of the parameters between the two callsites are the same, so they can be accessed through the existing mode_lib pointer, instead of being passed as explicit arguments. Doing this reduces the stack size of dml30_ModeSupportAndSystemConfigurationFull() from 2096 bytes to 1912 bytes with clang-22.
--- .../dc/dml/dcn30/display_mode_vba_30.c | 258 +++++------------- 1 file changed, 73 insertions(+), 185 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +73 -185
@@ -77,32 +77,14 @@ static unsigned int dscceComputeDelay(static unsigned int dscComputeDelay (enum output_format_class pixelFormat,enum output_encoder_class Output); -// Super monster function with some 45 argument static bool CalculatePrefetchSchedule( struct display_mode_lib *mode_lib, - double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData, - double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly, + unsigned int k, Pipe *myPipe, unsigned int DSCDelay, - double DPPCLKDelaySubtotalPlusCNVCFormater, - double DPPCLKDelaySCL, - double DPPCLKDelaySCLLBOnly, - double DPPCLKDelayCNVCCursor, - double DISPCLKDelaySubtotal, unsigned int DPP_RECOUT_WIDTH, - enum output_format_class OutputFormat, - unsigned int MaxInterDCNTileRepeaters, unsigned int VStartup, unsigned int MaxVStartup, - unsigned int GPUVMPageTableLevels, - bool GPUVMEnable, - bool HostVMEnable, - unsigned int HostVMMaxNonCachedPageTableLevels, - double HostVMMinPageSize, - bool DynamicMetadataEnable, - bool DynamicMetadataVMEnabled, - int DynamicMetadataLinesBeforeActiveRequired, - unsigned int DynamicMetadataTransmittedBytes, double UrgentLatency, double UrgentExtraLatency, double TCalc,
@@ -116,7 +98,6 @@ static bool CalculatePrefetchSchedule(unsigned int MaxNumSwathY, double PrefetchSourceLinesC, unsigned int SwathWidthC, - int BytePerPixelC, double VInitPreFillC, unsigned int MaxNumSwathC, long swath_width_luma_ub,
@@ -124,9 +105,6 @@ static bool CalculatePrefetchSchedule(unsigned int SwathHeightY, unsigned int SwathHeightC, double TWait, - bool ProgressiveToInterlaceUnitInOPP, - double *DSTXAfterScaler, - double *DSTYAfterScaler, double *DestinationLinesForPrefetch, double *PrefetchBandwidth, double *DestinationLinesToRequestVMInVBlank,
@@ -135,14 +113,7 @@ static bool CalculatePrefetchSchedule(double *VRatioPrefetchC, double *RequiredPrefetchPixDataBWLuma, double *RequiredPrefetchPixDataBWChroma, - bool *NotEnoughTimeForDynamicMetadata, - double *Tno_bw, - double *prefetch_vmrow_bw, - double *Tdmdl_vm, - double *Tdmdl, - unsigned int *VUpdateOffsetPix, - double *VUpdateWidthPix, - double *VReadyOffsetPix); + bool *NotEnoughTimeForDynamicMetadata);static double RoundToDFSGranularityUp (double Clock,double VCOSpeed);static double RoundToDFSGranularityDown (double Clock,double VCOSpeed); static void CalculateDCCConfiguration(
@@ -810,29 +781,12 @@ static unsigned int dscComputeDelay(enum output_format_class pixelFormat, enum o static bool CalculatePrefetchSchedule( struct display_mode_lib *mode_lib, - double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData, - double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly, + unsigned int k, Pipe *myPipe, unsigned int DSCDelay, - double DPPCLKDelaySubtotalPlusCNVCFormater, - double DPPCLKDelaySCL, - double DPPCLKDelaySCLLBOnly, - double DPPCLKDelayCNVCCursor, - double DISPCLKDelaySubtotal, unsigned int DPP_RECOUT_WIDTH, - enum output_format_class OutputFormat, - unsigned int MaxInterDCNTileRepeaters, unsigned int VStartup, unsigned int MaxVStartup, - unsigned int GPUVMPageTableLevels, - bool GPUVMEnable, - bool HostVMEnable, - unsigned int HostVMMaxNonCachedPageTableLevels, - double HostVMMinPageSize, - bool DynamicMetadataEnable, - bool DynamicMetadataVMEnabled, - int DynamicMetadataLinesBeforeActiveRequired, - unsigned int DynamicMetadataTransmittedBytes, double UrgentLatency, double UrgentExtraLatency, double TCalc,
@@ -846,7 +800,6 @@ static bool CalculatePrefetchSchedule(unsigned int MaxNumSwathY, double PrefetchSourceLinesC, unsigned int SwathWidthC, - int BytePerPixelC, double VInitPreFillC, unsigned int MaxNumSwathC, long swath_width_luma_ub,
@@ -854,9 +807,6 @@ static bool CalculatePrefetchSchedule(unsigned int SwathHeightY, unsigned int SwathHeightC, double TWait, - bool ProgressiveToInterlaceUnitInOPP, - double *DSTXAfterScaler, - double *DSTYAfterScaler, double *DestinationLinesForPrefetch, double *PrefetchBandwidth, double *DestinationLinesToRequestVMInVBlank,
@@ -865,15 +815,10 @@ static bool CalculatePrefetchSchedule(double *VRatioPrefetchC, double *RequiredPrefetchPixDataBWLuma, double *RequiredPrefetchPixDataBWChroma, - bool *NotEnoughTimeForDynamicMetadata, - double *Tno_bw, - double *prefetch_vmrow_bw, - double *Tdmdl_vm, - double *Tdmdl, - unsigned int *VUpdateOffsetPix, - double *VUpdateWidthPix, - double *VReadyOffsetPix) + bool *NotEnoughTimeForDynamicMetadata) { + struct vba_vars_st *v = &mode_lib->vba; +double DPPCLKDelaySubtotalPlusCNVCFormater = v->DPPCLKDelaySubtotal + v->DPPCLKDelayCNVCFormater;bool MyError = false;unsigned int DPPCycles =0 , DISPCLKCycles =0 ;double DSTTotalPixelsAfterScaler =0 ;
@@ -905,26 +850,26 @@ static bool CalculatePrefetchSchedule(double Tdmec =0 ;double Tdmsks =0 ; -if (GPUVMEnable == true && HostVMEnable == true) { - HostVMInefficiencyFactor = PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData / PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly; - HostVMDynamicLevelsTrips = HostVMMaxNonCachedPageTableLevels; +if (v->GPUVMEnable == true && v->HostVMEnable == true) { + HostVMInefficiencyFactor = v->PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData / v->PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly; + HostVMDynamicLevelsTrips = v->HostVMMaxNonCachedPageTableLevels; }else { HostVMInefficiencyFactor =1 ; HostVMDynamicLevelsTrips =0 ; } CalculateDynamicMetadataParameters( - MaxInterDCNTileRepeaters, + v->MaxInterDCNTileRepeaters, myPipe->DPPCLK, myPipe->DISPCLK, myPipe->DCFCLKDeepSleep, myPipe->PixelClock, myPipe->HTotal, myPipe->VBlank, - DynamicMetadataTransmittedBytes, - DynamicMetadataLinesBeforeActiveRequired, + v->DynamicMetadataTransmittedBytes[k], + v->DynamicMetadataLinesBeforeActiveRequired[k], myPipe->InterlaceEnable, - ProgressiveToInterlaceUnitInOPP, + v->ProgressiveToInterlaceUnitInOPP, &Tsetup, &Tdmbf, &Tdmec,
@@ -932,16 +877,16 @@ static bool CalculatePrefetchSchedule( LineTime = myPipe->HTotal / myPipe->PixelClock; trip_to_mem = UrgentLatency; - Tvm_trips = UrgentExtraLatency + trip_to_mem * (GPUVMPageTableLevels * (HostVMDynamicLevelsTrips +1 ) -1 ); + Tvm_trips = UrgentExtraLatency + trip_to_mem * (v->GPUVMMaxPageTableLevels * (HostVMDynamicLevelsTrips +1 ) -1 ); -if (DynamicMetadataVMEnabled == true && GPUVMEnable == true) { - *Tdmdl = TWait + Tvm_trips + trip_to_mem; +if (v->DynamicMetadataVMEnabled == true && v->GPUVMEnable == true) { + v->Tdmdl[k] = TWait + Tvm_trips + trip_to_mem; }else { - *Tdmdl = TWait + UrgentExtraLatency; + v->Tdmdl[k] = TWait + UrgentExtraLatency; } -if (DynamicMetadataEnable == true) { -if (VStartup * LineTime < Tsetup + *Tdmdl + Tdmbf + Tdmec + Tdmsks) { +if (v->DynamicMetadataEnable[k] == true) { +if (VStartup * LineTime < Tsetup + v->Tdmdl[k] + Tdmbf + Tdmec + Tdmsks) { *NotEnoughTimeForDynamicMetadata = true; }else { *NotEnoughTimeForDynamicMetadata = false;
@@ -949,39 +894,39 @@ static bool CalculatePrefetchSchedule(dml_print ("DML: Tdmbf: %fus - time for dmd transfer from dchub to dio output buffer\n" , Tdmbf);dml_print ("DML: Tdmec: %fus - time dio takes to transfer dmd\n" , Tdmec);dml_print ("DML: Tdmsks: %fus - time before active dmd must complete transmission at dio\n" , Tdmsks); -dml_print ("DML: Tdmdl: %fus - time for fabric to become ready and fetch dmd \n" , *Tdmdl); +dml_print ("DML: Tdmdl: %fus - time for fabric to become ready and fetch dmd \n" , v->Tdmdl[k]); } }else { *NotEnoughTimeForDynamicMetadata = false; } - *Tdmdl_vm = (DynamicMetadataEnable == true && DynamicMetadataVMEnabled == true && GPUVMEnable == true ? TWait + Tvm_trips :0 ); + v->Tdmdl_vm[k] = (v->DynamicMetadataEnable[k] == true && v->DynamicMetadataVMEnabled == true && v->GPUVMEnable == true ? TWait + Tvm_trips :0 );if (myPipe->ScalerEnabled) - DPPCycles = DPPCLKDelaySubtotalPlusCNVCFormater + DPPCLKDelaySCL; + DPPCycles = DPPCLKDelaySubtotalPlusCNVCFormater + v->DPPCLKDelaySCL;else - DPPCycles = DPPCLKDelaySubtotalPlusCNVCFormater + DPPCLKDelaySCLLBOnly; + DPPCycles = DPPCLKDelaySubtotalPlusCNVCFormater + v->DPPCLKDelaySCLLBOnly; - DPPCycles = DPPCycles + myPipe->NumberOfCursors * DPPCLKDelayCNVCCursor; + DPPCycles = DPPCycles + myPipe->NumberOfCursors * v->DPPCLKDelayCNVCCursor; - DISPCLKCycles = DISPCLKDelaySubtotal; + DISPCLKCycles = v->DISPCLKDelaySubtotal;if (myPipe->DPPCLK ==0.0 || myPipe->DISPCLK ==0.0 )return true; - *DSTXAfterScaler = DPPCycles * myPipe->PixelClock / myPipe->DPPCLK + DISPCLKCycles * myPipe->PixelClock / myPipe->DISPCLK + v->DSTXAfterScaler[k] = DPPCycles * myPipe->PixelClock / myPipe->DPPCLK + DISPCLKCycles * myPipe->PixelClock / myPipe->DISPCLK + DSCDelay; - *DSTXAfterScaler = *DSTXAfterScaler + ((myPipe->ODMCombineEnabled)?18 :0 ) + (myPipe->DPPPerPlane -1 ) *DPP_RECOUT_WIDTH ; + v->DSTXAfterScaler[k] = v->DSTXAfterScaler[k] + ((myPipe->ODMCombineEnabled)?18 :0 ) + (myPipe->DPPPerPlane -1 ) *DPP_RECOUT_WIDTH ; -if (OutputFormat == dm_420 || (myPipe->InterlaceEnable && ProgressiveToInterlaceUnitInOPP)) - *DSTYAfterScaler =1 ; +if (v->OutputFormat[k] == dm_420 || (myPipe->InterlaceEnable && v->ProgressiveToInterlaceUnitInOPP)) + v->DSTYAfterScaler[k] =1 ;else - *DSTYAfterScaler =0 ; + v->DSTYAfterScaler[k] =0 ; - DSTTotalPixelsAfterScaler = *DSTYAfterScaler * myPipe->HTotal + *DSTXAfterScaler; - *DSTYAfterScaler =dml_floor (DSTTotalPixelsAfterScaler / myPipe->HTotal,1 ); - *DSTXAfterScaler = DSTTotalPixelsAfterScaler - ((double ) (*DSTYAfterScaler * myPipe->HTotal)); + DSTTotalPixelsAfterScaler = v->DSTYAfterScaler[k] * myPipe->HTotal + v->DSTXAfterScaler[k]; + v->DSTYAfterScaler[k] =dml_floor (DSTTotalPixelsAfterScaler / myPipe->HTotal,1 ); + v->DSTXAfterScaler[k] = DSTTotalPixelsAfterScaler - ((double ) (v->DSTYAfterScaler[k] * myPipe->HTotal)); MyError = false;
@@ -990,33 +935,33 @@ static bool CalculatePrefetchSchedule( Tvm_trips_rounded =dml_ceil (4.0 * Tvm_trips / LineTime,1 ) /4 * LineTime; Tr0_trips_rounded =dml_ceil (4.0 * Tr0_trips / LineTime,1 ) /4 * LineTime; -if (GPUVMEnable) { -if (GPUVMPageTableLevels >=3 ) { - *Tno_bw = UrgentExtraLatency + trip_to_mem * ((GPUVMPageTableLevels -2 ) -1 ); +if (v->GPUVMEnable) { +if (v->GPUVMMaxPageTableLevels >=3 ) { + v->Tno_bw[k] = UrgentExtraLatency + trip_to_mem * ((v->GPUVMMaxPageTableLevels -2 ) -1 ); }else - *Tno_bw =0 ; + v->Tno_bw[k] =0 ; }else if (!myPipe->DCCEnable) - *Tno_bw = LineTime; + v->Tno_bw[k] = LineTime;else - *Tno_bw = LineTime /4 ; + v->Tno_bw[k] = LineTime /4 ; - dst_y_prefetch_equ = VStartup - (Tsetup +dml_max (TWait + TCalc, *Tdmdl)) / LineTime - - (*DSTYAfterScaler + *DSTXAfterScaler / myPipe->HTotal); + dst_y_prefetch_equ = VStartup - (Tsetup +dml_max (TWait + TCalc, v->Tdmdl[k])) / LineTime + - (v->DSTYAfterScaler[k] + v->DSTXAfterScaler[k] / myPipe->HTotal); dst_y_prefetch_equ =dml_min (dst_y_prefetch_equ,63.75 );// limit to the reg limit of U6.2 for DST_Y_PREFETCH Lsw_oto =dml_max (PrefetchSourceLinesY, PrefetchSourceLinesC); Tsw_oto = Lsw_oto * LineTime; - prefetch_bw_oto = (PrefetchSourceLinesY * swath_width_luma_ub * BytePerPixelY + PrefetchSourceLinesC * swath_width_chroma_ub * BytePerPixelC) / Tsw_oto; + prefetch_bw_oto = (PrefetchSourceLinesY * swath_width_luma_ub * BytePerPixelY + PrefetchSourceLinesC * swath_width_chroma_ub * v->BytePerPixelC[k]) / Tsw_oto; -if (GPUVMEnable == true) { - Tvm_oto =dml_max3 (*Tno_bw + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / prefetch_bw_oto, +if (v->GPUVMEnable == true) { + Tvm_oto =dml_max3 (v->Tno_bw[k] + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / prefetch_bw_oto, Tvm_trips, LineTime /4.0 ); }else Tvm_oto = LineTime /4.0 ; -if ((GPUVMEnable == true || myPipe->DCCEnable == true)) { +if ((v->GPUVMEnable == true || myPipe->DCCEnable == true)) { Tr0_oto =dml_max3 ( (MetaRowByte + PixelPTEBytesPerRow * HostVMInefficiencyFactor) / prefetch_bw_oto, LineTime - Tvm_oto, LineTime /4 );
@@ -1042,10 +987,10 @@ static bool CalculatePrefetchSchedule(dml_print ("DML: Tdmbf: %fus - time for dmd transfer from dchub to dio output buffer\n" , Tdmbf);dml_print ("DML: Tdmec: %fus - time dio takes to transfer dmd\n" , Tdmec);dml_print ("DML: Tdmsks: %fus - time before active dmd must complete transmission at dio\n" , Tdmsks); -dml_print ("DML: Tdmdl_vm: %fus - time for vm stages of dmd \n" , *Tdmdl_vm); -dml_print ("DML: Tdmdl: %fus - time for fabric to become ready and fetch dmd \n" , *Tdmdl); -dml_print ("DML: dst_x_after_scl: %f pixels - number of pixel clocks pipeline and buffer delay after scaler \n" , *DSTXAfterScaler); -dml_print ("DML: dst_y_after_scl: %d lines - number of lines of pipeline and buffer delay after scaler \n" , (int )*DSTYAfterScaler); +dml_print ("DML: Tdmdl_vm: %fus - time for vm stages of dmd \n" , v->Tdmdl_vm[k]); +dml_print ("DML: Tdmdl: %fus - time for fabric to become ready and fetch dmd \n" , v->Tdmdl[k]); +dml_print ("DML: dst_x_after_scl: %f pixels - number of pixel clocks pipeline and buffer delay after scaler \n" , v->DSTXAfterScaler[k]); +dml_print ("DML: dst_y_after_scl: %d lines - number of lines of pipeline and buffer delay after scaler \n" , (int )v->DSTYAfterScaler[k]); *PrefetchBandwidth =0 ; *DestinationLinesToRequestVMInVBlank =0 ;
@@ -1059,26 +1004,26 @@ static bool CalculatePrefetchSchedule(double PrefetchBandwidth3 =0 ;double PrefetchBandwidth4 =0 ; -if (Tpre_rounded - *Tno_bw >0 ) +if (Tpre_rounded - v->Tno_bw[k] >0 ) PrefetchBandwidth1 = (PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor +2 * MetaRowByte +2 * PixelPTEBytesPerRow * HostVMInefficiencyFactor + PrefetchSourceLinesY * swath_width_luma_ub * BytePerPixelY - + PrefetchSourceLinesC * swath_width_chroma_ub * BytePerPixelC) - / (Tpre_rounded - *Tno_bw); + + PrefetchSourceLinesC * swath_width_chroma_ub * v->BytePerPixelC[k]) + / (Tpre_rounded - v->Tno_bw[k]);else PrefetchBandwidth1 =0 ; -if (VStartup == MaxVStartup && (PrefetchBandwidth1 >4 * prefetch_bw_oto) && (Tpre_rounded - Tsw_oto /4 -0.75 * LineTime - *Tno_bw) >0 ) { - PrefetchBandwidth1 = (PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor +2 * MetaRowByte +2 * PixelPTEBytesPerRow * HostVMInefficiencyFactor) / (Tpre_rounded - Tsw_oto /4 -0.75 * LineTime - *Tno_bw); +if (VStartup == MaxVStartup && (PrefetchBandwidth1 >4 * prefetch_bw_oto) && (Tpre_rounded - Tsw_oto /4 -0.75 * LineTime - v->Tno_bw[k]) >0 ) { + PrefetchBandwidth1 = (PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor +2 * MetaRowByte +2 * PixelPTEBytesPerRow * HostVMInefficiencyFactor) / (Tpre_rounded - Tsw_oto /4 -0.75 * LineTime - v->Tno_bw[k]); } -if (Tpre_rounded - *Tno_bw -2 * Tr0_trips_rounded >0 ) +if (Tpre_rounded - v->Tno_bw[k] -2 * Tr0_trips_rounded >0 ) PrefetchBandwidth2 = (PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor + PrefetchSourceLinesY * swath_width_luma_ub * BytePerPixelY + PrefetchSourceLinesC * swath_width_chroma_ub * - BytePerPixelC) / - (Tpre_rounded - *Tno_bw -2 * Tr0_trips_rounded); + v->BytePerPixelC[k]) / + (Tpre_rounded - v->Tno_bw[k] -2 * Tr0_trips_rounded);else PrefetchBandwidth2 =0 ;
@@ -1086,7 +1031,7 @@ static bool CalculatePrefetchSchedule( PrefetchBandwidth3 = (2 * MetaRowByte +2 * PixelPTEBytesPerRow * HostVMInefficiencyFactor + PrefetchSourceLinesY * swath_width_luma_ub * BytePerPixelY + PrefetchSourceLinesC * - swath_width_chroma_ub * BytePerPixelC) / (Tpre_rounded - + swath_width_chroma_ub * v->BytePerPixelC[k]) / (Tpre_rounded - Tvm_trips_rounded); else PrefetchBandwidth3 =0 ;
@@ -1096,7 +1041,7 @@ static bool CalculatePrefetchSchedule( }if (Tpre_rounded - Tvm_trips_rounded -2 * Tr0_trips_rounded >0 ) - PrefetchBandwidth4 = (PrefetchSourceLinesY * swath_width_luma_ub * BytePerPixelY + PrefetchSourceLinesC * swath_width_chroma_ub * BytePerPixelC) + PrefetchBandwidth4 = (PrefetchSourceLinesY * swath_width_luma_ub * BytePerPixelY + PrefetchSourceLinesC * swath_width_chroma_ub * v->BytePerPixelC[k]) / (Tpre_rounded - Tvm_trips_rounded -2 * Tr0_trips_rounded);else PrefetchBandwidth4 =0 ;
@@ -1107,7 +1052,7 @@ static bool CalculatePrefetchSchedule(bool Case3OK;if (PrefetchBandwidth1 >0 ) { -if (*Tno_bw + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / PrefetchBandwidth1 +if (v->Tno_bw[k] + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / PrefetchBandwidth1 >= Tvm_trips_rounded && (MetaRowByte + PixelPTEBytesPerRow * HostVMInefficiencyFactor) / PrefetchBandwidth1 >= Tr0_trips_rounded) { Case1OK = true; }else {
@@ -1118,7 +1063,7 @@ static bool CalculatePrefetchSchedule( }if (PrefetchBandwidth2 >0 ) { -if (*Tno_bw + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / PrefetchBandwidth2 +if (v->Tno_bw[k] + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / PrefetchBandwidth2 >= Tvm_trips_rounded && (MetaRowByte + PixelPTEBytesPerRow * HostVMInefficiencyFactor) / PrefetchBandwidth2 < Tr0_trips_rounded) { Case2OK = true; }else {
@@ -1129,7 +1074,7 @@ static bool CalculatePrefetchSchedule( }if (PrefetchBandwidth3 >0 ) { -if (*Tno_bw + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / PrefetchBandwidth3 +if (v->Tno_bw[k] + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / PrefetchBandwidth3 < Tvm_trips_rounded && (MetaRowByte + PixelPTEBytesPerRow * HostVMInefficiencyFactor) / PrefetchBandwidth3 >= Tr0_trips_rounded) { Case3OK = true; }else {
@@ -1152,13 +1097,13 @@ static bool CalculatePrefetchSchedule(dml_print ("DML: prefetch_bw_equ: %f\n" , prefetch_bw_equ);if (prefetch_bw_equ >0 ) { -if (GPUVMEnable) { - Tvm_equ =dml_max3 (*Tno_bw + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / prefetch_bw_equ, Tvm_trips, LineTime /4 ); +if (v->GPUVMEnable) { + Tvm_equ =dml_max3 (v->Tno_bw[k] + PDEAndMetaPTEBytesFrame * HostVMInefficiencyFactor / prefetch_bw_equ, Tvm_trips, LineTime /4 ); }else { Tvm_equ = LineTime /4 ; } -if ((GPUVMEnable || myPipe->DCCEnable)) { +if ((v->GPUVMEnable || myPipe->DCCEnable)) { Tr0_equ = dml_max4( (MetaRowByte + PixelPTEBytesPerRow * HostVMInefficiencyFactor) / prefetch_bw_equ, Tr0_trips,
@@ -1227,7 +1172,7 @@ static bool CalculatePrefetchSchedule( } *RequiredPrefetchPixDataBWLuma = (double ) PrefetchSourceLinesY / LinesToRequestPrefetchPixelData * BytePerPixelY * swath_width_luma_ub / LineTime; - *RequiredPrefetchPixDataBWChroma = (double ) PrefetchSourceLinesC / LinesToRequestPrefetchPixelData * BytePerPixelC * swath_width_chroma_ub / LineTime; + *RequiredPrefetchPixDataBWChroma = (double ) PrefetchSourceLinesC / LinesToRequestPrefetchPixelData * v->BytePerPixelC[k] * swath_width_chroma_ub / LineTime; }else { MyError = true;dml_print ("DML: MyErr set %s:%d\n" , __FILE__, __LINE__);
@@ -1243,9 +1188,9 @@ static bool CalculatePrefetchSchedule(dml_print ("DML: Tr0: %fus - time to fetch first row of data pagetables and first row of meta data (done in parallel)\n" , TimeForFetchingRowInVBlank);dml_print ("DML: Tr1: %fus - time to fetch second row of data pagetables and second row of meta data (done in parallel)\n" , TimeForFetchingRowInVBlank);dml_print ("DML: Tsw: %fus = time to fetch enough pixel data and cursor data to feed the scalers init position and detile\n" , (double )LinesToRequestPrefetchPixelData * LineTime); -dml_print ("DML: To: %fus - time for propagation from scaler to optc\n" , (*DSTYAfterScaler + ((*DSTXAfterScaler) / (double ) myPipe->HTotal)) * LineTime); +dml_print ("DML: To: %fus - time for propagation from scaler to optc\n" , (v->DSTYAfterScaler[k] + ((v->DSTXAfterScaler[k]) / (double ) myPipe->HTotal)) * LineTime);dml_print ("DML: Tvstartup - Tsetup - Tcalc - Twait - Tpre - To > 0\n" ); -dml_print ("DML: Tslack(pre): %fus - time left over in schedule\n" , VStartup * LineTime - TimeForFetchingMetaPTE -2 * TimeForFetchingRowInVBlank - (*DSTYAfterScaler + ((*DSTXAfterScaler) / (double ) myPipe->HTotal)) * LineTime - TWait - TCalc - Tsetup); +dml_print ("DML: Tslack(pre): %fus - time left over in schedule\n" , VStartup * LineTime - TimeForFetchingMetaPTE -2 * TimeForFetchingRowInVBlank - (v->DSTYAfterScaler[k] + ((v->DSTXAfterScaler[k]) / (double ) myPipe->HTotal)) * LineTime - TWait - TCalc - Tsetup);dml_print ("DML: row_bytes = dpte_row_bytes (per_pipe) = PixelPTEBytesPerRow = : %d\n" , PixelPTEBytesPerRow); }else {
@@ -1276,7 +1221,7 @@ static bool CalculatePrefetchSchedule(dml_print ("DML: MyErr set %s:%d\n" , __FILE__, __LINE__); } - *prefetch_vmrow_bw =dml_max (prefetch_vm_bw, prefetch_row_bw); + v->prefetch_vmrow_bw[k] =dml_max (prefetch_vm_bw, prefetch_row_bw); }if (MyError) {
@@ -2437,30 +2382,12 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman v->ErrorResult[k] = CalculatePrefetchSchedule( mode_lib, - v->PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData, - v->PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly, + k, &myPipe, v->DSCDelay[k], - v->DPPCLKDelaySubtotal - + v->DPPCLKDelayCNVCFormater, - v->DPPCLKDelaySCL, - v->DPPCLKDelaySCLLBOnly, - v->DPPCLKDelayCNVCCursor, - v->DISPCLKDelaySubtotal, (unsigned int) (v->SwathWidthY[k] / v->HRatio[k]), - v->OutputFormat[k], - v->MaxInterDCNTileRepeaters, dml_min(v->VStartupLines, v->MaxVStartupLines[k]), v->MaxVStartupLines[k], - v->GPUVMMaxPageTableLevels, - v->GPUVMEnable, - v->HostVMEnable, - v->HostVMMaxNonCachedPageTableLevels, - v->HostVMMinPageSize, - v->DynamicMetadataEnable[k], - v->DynamicMetadataVMEnabled, - v->DynamicMetadataLinesBeforeActiveRequired[k], - v->DynamicMetadataTransmittedBytes[k], v->UrgentLatency, v->UrgentExtraLatency, v->TCalc,
@@ -2474,7 +2401,6 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman v->MaxNumSwathY[k], v->PrefetchSourceLinesC[k], v->SwathWidthC[k], - v->BytePerPixelC[k], v->VInitPreFillC[k], v->MaxNumSwathC[k], v->swath_width_luma_ub[k],
@@ -2482,9 +2408,6 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman v->SwathHeightY[k], v->SwathHeightC[k], TWait, - v->ProgressiveToInterlaceUnitInOPP, - &v->DSTXAfterScaler[k], - &v->DSTYAfterScaler[k], &v->DestinationLinesForPrefetch[k], &v->PrefetchBandwidth[k], &v->DestinationLinesToRequestVMInVBlank[k],
@@ -2493,14 +2416,7 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman &v->VRatioPrefetchC[k], &v->RequiredPrefetchPixDataBWLuma[k], &v->RequiredPrefetchPixDataBWChroma[k], - &v->NotEnoughTimeForDynamicMetadata[k], - &v->Tno_bw[k], - &v->prefetch_vmrow_bw[k], - &v->Tdmdl_vm[k], - &v->Tdmdl[k], - &v->VUpdateOffsetPix[k], - &v->VUpdateWidthPix[k], - &v->VReadyOffsetPix[k]); + &v->NotEnoughTimeForDynamicMetadata[k]);if (v->BlendingAndTiming[k] == k) {double TotalRepeaterDelayTime = v->MaxInterDCNTileRepeaters * (2 / v->DPPCLK[k] +3 / v->DISPCLK); v->VUpdateWidthPix[k] = (14 / v->DCFCLKDeepSleep +12 / v->DPPCLK[k] + TotalRepeaterDelayTime) * v->PixelClock[k];
@@ -4770,29 +4686,12 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l v->NoTimeForPrefetch[i][j][k] = CalculatePrefetchSchedule( mode_lib, - v->PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData, - v->PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly, + k, &myPipe, v->DSCDelayPerState[i][k], - v->DPPCLKDelaySubtotal + v->DPPCLKDelayCNVCFormater, - v->DPPCLKDelaySCL, - v->DPPCLKDelaySCLLBOnly, - v->DPPCLKDelayCNVCCursor, - v->DISPCLKDelaySubtotal, v->SwathWidthYThisState[k] / v->HRatio[k], - v->OutputFormat[k], - v->MaxInterDCNTileRepeaters, dml_min(v->MaxVStartup, v->MaximumVStartup[i][j][k]), v->MaximumVStartup[i][j][k], - v->GPUVMMaxPageTableLevels, - v->GPUVMEnable, - v->HostVMEnable, - v->HostVMMaxNonCachedPageTableLevels, - v->HostVMMinPageSize, - v->DynamicMetadataEnable[k], - v->DynamicMetadataVMEnabled, - v->DynamicMetadataLinesBeforeActiveRequired[k], - v->DynamicMetadataTransmittedBytes[k], v->UrgLatency[i], v->ExtraLatency, v->TimeCalc,
@@ -4806,7 +4705,6 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l v->MaxNumSwY[k], v->PrefetchLinesC[i][j][k], v->SwathWidthCThisState[k], - v->BytePerPixelC[k], v->PrefillC[k], v->MaxNumSwC[k], v->swath_width_luma_ub_this_state[k],
@@ -4814,9 +4712,6 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l v->SwathHeightYThisState[k], v->SwathHeightCThisState[k], v->TWait, - v->ProgressiveToInterlaceUnitInOPP, - &v->DSTXAfterScaler[k], - &v->DSTYAfterScaler[k], &v->LineTimesForPrefetch[k], &v->PrefetchBW[k], &v->LinesForMetaPTE[k],
@@ -4825,14 +4720,7 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l &v->VRatioPreC[i][j][k], &v->RequiredPrefetchPixelDataBWLuma[i][j][k], &v->RequiredPrefetchPixelDataBWChroma[i][j][k], - &v->NoTimeForDynamicMetadata[i][j][k], - &v->Tno_bw[k], - &v->prefetch_vmrow_bw[k], - &v->Tdmdl_vm[k], - &v->Tdmdl[k], - &v->VUpdateOffsetPix[k], - &v->VUpdateWidthPix[k], - &v->VReadyOffsetPix[k]); + &v->NoTimeForDynamicMetadata[i][j][k]); }for (k =0 ; k <= v->NumberOfActivePlanes -1 ; k++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/175 HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Chiu <[email protected]>
[ Upstream commit c06bc3557542307b9658fbd43cc946a14250347b ]
Another Chicony Electronics HP 5MP Camera with USB ID 04F2:B882 reports a HID sensor interface that is not actually implemented.
Add the device to the HID ignore list so the bogus sensor is never exposed to userspace. Then the system won't hang when runtime PM tries to wake the unresponsive device.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -317,6 +317,7 @@#define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c +#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA3 0xb882#define USB_VENDOR_ID_CHUNGHWAT 0x2247#define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001
drivers/hid/hid-quirks.c +1 -0
@@ -778,6 +778,7 @@ static const struct hid_device_id hid_ignore_list[] = { { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) }, { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) }, { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA3) }, { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) }, { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) }, { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/175 HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kwok Kin Ming <[email protected]>
[ Upstream commit 2497ff38c530b1af0df5130ca9f5ab22c5e92f29 ]
i2c_hid_xfer is used to read recv_len + sizeof(__le16) bytes of data into ihid->rawbuf.
The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set max_buffer_size field of struct hid_ll_driver which we do not).
The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value.
Fix this by truncating recv_len to ihid->bufsize - sizeof(__le16).
The impact is low since access to hidraw devices requires root.
--- drivers/hid/i2c-hid/i2c-hid-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/i2c-hid/i2c-hid-core.c +1 -0
@@ -286,6 +286,7 @@ static int i2c_hid_get_report(struct i2c_hid *ihid,* In addition to report data device will supply data length * in the first 2 bytes of the response, so adjust . */ + recv_len =min (recv_len, ihid->bufsize -sizeof (__le16)); error =i2c_hid_xfer (ihid, ihid->cmdbuf, length, ihid->rawbuf, recv_len +sizeof (__le16));if (error) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/175 HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Even Xu <[email protected]>
[ Upstream commit a9a917998d172ec117f9e9de1919174153c0ace4 ]
Add DMA buffer readiness check before reading DMA buffer to avoid unexpected NULL pointer accessing.
--- drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c +5 -0
@@ -575,6 +575,11 @@ static int read_dma_buffer(struct thc_device *dev,return -EINVAL ; } +if (!read_config->prd_tbls || !read_config->sgls[prd_table_index]) { +dev_err_once (dev->dev,"PRD tables are not ready yet\n" ); +return -EINVAL ; + } + prd_tbl = &read_config->prd_tbls[prd_table_index]; mes_len =calc_message_len (prd_tbl, &nent);if (mes_len > read_config->max_packet_size) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/175 HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Lugathe da Conceição Alves <[email protected]>
[ Upstream commit 85a866809333cd2bf8ddac93d9a3e3ba8e4f807d ]
The USB speaker has a bug that causes it to reboot when changing the brightness using the physical knob.
Add a new vendor and product ID entry in hid-ids.h, and register the corresponding device in hid-quirks.c with the required quirk.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -439,6 +439,9 @@#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 +#define USB_VENDOR_ID_EDIFIER 0x2d99 +#define USB_DEVICE_ID_EDIFIER_QR30 0xa101/* EDIFIER Hal0 2.0 SE */ +#define USB_VENDOR_ID_ELAN 0x04f3#define USB_DEVICE_ID_TOSHIBA_CLICK_L9W 0x0401#define USB_DEVICE_ID_HP_X2 0x074d
drivers/hid/hid-quirks.c +1 -0
@@ -81,6 +81,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER), HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_EDIFIER, USB_DEVICE_ID_EDIFIER_QR30), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II), HID_QUIRK_MULTI_INPUT },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/175 drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Perry Yuan <[email protected]>
[ Upstream commit 0de604d0357d0d22cbf03af1077d174b641707b6 ]
During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access MMIO registers during this window (e.g., from interrupt handlers or other driver threads) can result in uncompleted PCIe transactions, leading to NMI panics or system hangs.
To prevent this, set the no_hw_access flag to true immediately after triggering the reset. This signals other driver components to skip register accesses while the device is offline.
A memory barrier smp_mb() is added to ensure the flag update is globally visible to all cores before the driver enters the sleep/wait state.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 7 ++++++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 9 +++++++-- 3 files changed, 16 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +3 -0
@@ -5739,6 +5739,9 @@ int amdgpu_device_mode1_reset(struct amdgpu_device *adev)if (ret) goto mode1_reset_failed; +/* enable mmio access after mode 1 reset completed */ + adev->no_hw_access = false; +amdgpu_device_load_pci_state (adev->pdev); ret =amdgpu_psp_wait_for_bootloader (adev);if (ret)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +6 -1
@@ -2922,8 +2922,13 @@ static int smu_v13_0_0_mode1_reset(struct smu_context *smu)break ; } -if (!ret) +if (!ret) { +/* disable mmio access while doing mode 1 reset*/ + smu->adev->no_hw_access = true; +/* ensure no_hw_access is globally visible before any MMIO */ +smp_mb ();msleep (SMU13_MODE1_RESET_WAIT_TIME_IN_MS ); + }return ret; }
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +7 -2
@@ -2143,10 +2143,15 @@ static int smu_v14_0_2_mode1_reset(struct smu_context *smu) ret =smu_cmn_send_debug_smc_msg (smu, DEBUGSMC_MSG_Mode1Reset);if (!ret) { -if (amdgpu_emu_mode ==1 ) +if (amdgpu_emu_mode ==1 ) {msleep (50000 ); -else + }else { +/* disable mmio access while doing mode 1 reset*/ + smu->adev->no_hw_access = true; +/* ensure no_hw_access is globally visible before any MMIO */ +smp_mb ();msleep (1000 ); + } }return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/175 ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wupeng Ma <[email protected]>
[ Upstream commit 6435ffd6c7fcba330dfa91c58dc30aed2df3d0bf ]
When user resize all trace ring buffer through file 'buffer_size_kb', then in ring_buffer_resize(), kernel allocates buffer pages for each cpu in a loop.
If the kernel preemption model is PREEMPT_NONE and there are many cpus and there are many buffer pages to be freed, it may not give up cpu for a long time and finally cause a softlockup.
To avoid it, call cond_resched() after each cpu buffer free as Commit f6bd2c92488c ("ring-buffer: Avoid softlockup in ring_buffer_resize()") does.
Detailed call trace as follow:
rcu: INFO: rcu_sched self-detected stall on CPU rcu: 24-....: (14837 ticks this GP) idle=521c/1/0x4000000000000000 softirq=230597/230597 fqs=5329 rcu: (t=15004 jiffies g=26003221 q=211022 ncpus=96) CPU: 24 UID: 0 PID: 11253 Comm: bash Kdump: loaded Tainted: G EL 6.18.2+ #278 NONE pc : arch_local_irq_restore+0x8/0x20 arch_local_irq_restore+0x8/0x20 (P) free_frozen_page_commit+0x28c/0x3b0 __free_frozen_pages+0x1c0/0x678 ___free_pages+0xc0/0xe0 free_pages+0x3c/0x50 ring_buffer_resize.part.0+0x6a8/0x880 ring_buffer_resize+0x3c/0x58 __tracing_resize_ring_buffer.part.0+0x34/0xd8 tracing_resize_ring_buffer+0x8c/0xd0 tracing_entries_write+0x74/0xd8 vfs_write+0xcc/0x288 ksys_write+0x74/0x118 __arm64_sys_write+0x24/0x38
--- kernel/trace/ring_buffer.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/ring_buffer.c +2 -0
@@ -3121,6 +3121,8 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, list) {list_del_init (&bpage->list);free_buffer_page (bpage); + +cond_resched (); } } out_err_unlock:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/175 riscv: trace: fix snapshot deadlock with sbi ecall
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0 ]
If sbi_ecall.c's functions are traceable,
echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter
may get the kernel into a deadlock.
(Functions in sbi_ecall.c are excluded from tracing if CONFIG_RISCV_ALTERNATIVE_EARLY is set.)
__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code raises an IPI interrupt, which results in another call to __sbi_ecall and another snapshot...
All it takes to get into this endless loop is one initial __sbi_ecall. On RISC-V systems without SSTC extension, the clock events in timer-riscv.c issue periodic sbi ecalls, making the problem easy to trigger.
Always exclude the sbi_ecall.c functions from tracing to fix the potential deadlock.
sbi ecalls can easiliy be logged via trace events, excluding ecall functions from function tracing is not a big limitation.
--- arch/riscv/kernel/Makefile | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
arch/riscv/kernel/Makefile +8 -7
@@ -3,12 +3,6 @@ # Makefile for the RISC-V Linux kernel # -ifdef CONFIG_FTRACE -CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE) -CFLAGS_REMOVE_patch.o = $(CC_FLAGS_FTRACE) -CFLAGS_REMOVE_sbi.o = $(CC_FLAGS_FTRACE) -CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE) -endif CFLAGS_syscall_table.o += $(call cc-disable-warning, override-init) CFLAGS_compat_syscall_table.o += $(call cc-disable-warning, override-init)
@@ -24,7 +18,6 @@ CFLAGS_sbi_ecall.o := -mcmodel=medany ifdef CONFIG_FTRACE CFLAGS_REMOVE_alternative.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_cpufeature.o = $(CC_FLAGS_FTRACE) -CFLAGS_REMOVE_sbi_ecall.o = $(CC_FLAGS_FTRACE) endif ifdef CONFIG_RELOCATABLE CFLAGS_alternative.o += -fno-pie
@@ -43,6 +36,14 @@ CFLAGS_sbi_ecall.o += -D__NO_FORTIFY endif endif +ifdef CONFIG_FTRACE +CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_patch.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_sbi.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_sbi_ecall.o = $(CC_FLAGS_FTRACE) +endif + always-$(KBUILD_BUILTIN) += vmlinux.lds obj-y += head.o
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/175 HID: logitech: add HID++ support for Logitech MX Anywhere 3S
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Marttinen <[email protected]>
[ Upstream commit d7f6629bffdcb962d383ef8c9a30afef81e997fe ]
I've acquired a Logitech MX Anywhere 3S mouse, which supports HID++ over Bluetooth. Adding its PID 0xb037 to the allowlist enables the additional features, such as high-resolution scrolling. Tested working across multiple machines, with a mix of Intel and Mediatek Bluetooth chips.
--- drivers/hid/hid-logitech-hidpp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-logitech-hidpp.c +2 -0
@@ -4661,6 +4661,8 @@ static const struct hid_device_id hidpp_devices[] = { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb025) }, {/* MX Master 3S mouse over Bluetooth */ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb034) }, + { /* MX Anywhere 3S mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) }, { /* MX Anywhere 3SB mouse over Bluetooth */ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) }, {}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/175 HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnoud Willemsen <[email protected]>
[ Upstream commit 12adb969658ec39265eb8c7ea9e1856867fb9ceb ]
Wireless/new version of the Elecom trackball mouse M-XT3DRBK has a product id that differs from the existing M-XT3DRBK.
The report descriptor format also seems to have changed and matches other (newer?) models instead (except for six buttons instead of eight). This patch follows the same format as the patch for the M-XT3URBK (018F) by Naoki Ueki (Nov 3rd 2025) to enable the sixth mouse button.
dmesg output:
[ 292.074664] usb 1-2: new full-speed USB device number 7 using xhci_hcd [ 292.218667] usb 1-2: New USB device found, idVendor=056e, idProduct=018c, bcdDevice= 1.00 [ 292.218676] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 292.218679] usb 1-2: Product: ELECOM TrackBall Mouse [ 292.218681] usb 1-2: Manufacturer: ELECOM
usbhid-dump output:
001:006:000:DESCRIPTOR 1765072638.050578
05 01 09 02 A1 01 09 01 A1 00 85 01 05 09 19 01
29 05 15 00 25 01 95 08 75 01 81 02 95 01 75 00
81 01 05 01 09 30 09 31 16 00 80 26 FF 7F 75 10
95 02 81 06 C0 A1 00 05 01 09 38 15 81 25 7F 75
08 95 01 81 06 C0 A1 00 05 0C 0A 38 02 95 01 75
08 15 81 25 7F 81 06 C0 C0 06 01 FF 09 00 A1 01
85 02 09 00 15 00 26 FF 00 75 08 95 07 81 02 C0
05 0C 09 01 A1 01 85 05 15 00 26 3C 02 19 00 2A
3C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85
03 19 81 29 83 15 00 25 01 95 03 75 01 81 02 95
01 75 05 81 01 C0 06 BC FF 09 88 A1 01 85 04 95
01 75 08 15 00 26 FF 00 19 00 2A FF 00 81 00 C0
06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 FF 00
75 08 95 07 B1 02 C0
--- drivers/hid/hid-elecom.c | 15 +++++++++++++-- drivers/hid/hid-ids.h | 3 ++- drivers/hid/hid-quirks.c | 3 ++- 3 files changed, 17 insertions(+), 4 deletions(-)
drivers/hid/hid-elecom.c +13 -2
@@ -77,7 +77,7 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,break ;case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB :case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F : -case USB_DEVICE_ID_ELECOM_M_XT3DRBK : +case USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC :case USB_DEVICE_ID_ELECOM_M_XT4DRBK :/* * Report descriptor format:
@@ -102,6 +102,16 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ mouse_button_fixup (hdev, rdesc, *rsize,12 ,30 ,14 ,20 ,8 );break ; +case USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C : +/* +* Report descriptor format: +* 22: button bit count +* 30: padding bit count +* 24: button report size +* 16: button usage maximum +*/ +mouse_button_fixup (hdev, rdesc, *rsize,22 ,30 ,24 ,16 ,6 ); +break ;case USB_DEVICE_ID_ELECOM_M_DT2DRBK :case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C :/*
@@ -122,7 +132,8 @@ static const struct hid_device_id elecom_devices[] = { { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
drivers/hid/hid-ids.h +2 -1
@@ -455,7 +455,8 @@#define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f -#define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc +#define USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC 0x00fc +#define USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C 0x018c#define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd#define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe#define USB_DEVICE_ID_ELECOM_M_DT1DRBK 0x00ff
drivers/hid/hid-quirks.c +2 -1
@@ -422,7 +422,8 @@ static const struct hid_device_id hid_have_special_driver[] = { { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/175 wifi: mac80211: collect station statistics earlier when disconnect
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit a203dbeeca15a9b924f0d51f510921f4bae96801 ]
In __sta_info_destroy_part2(), station statistics are requested after the IEEE80211_STA_NONE -> IEEE80211_STA_NOTEXIST transition. This is problematic because the driver may be unable to handle the request due to the STA being in the NOTEXIST state (i.e. if the driver destroys the underlying data when transitioning to NOTEXIST).
Move the statistics collection to before the state transition to avoid this issue.
--- net/mac80211/sta_info.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/mac80211/sta_info.c +4 -3
@@ -1533,6 +1533,10 @@ static void __sta_info_destroy_part2(struct sta_info *sta, bool recalc) } } + sinfo =kzalloc (sizeof (*sinfo),GFP_KERNEL ); +if (sinfo) +sta_set_sinfo (sta, sinfo, true); +if (sta->uploaded) { ret =drv_sta_state (local, sdata, sta,IEEE80211_STA_NONE ,IEEE80211_STA_NOTEXIST );
@@ -1541,9 +1545,6 @@ static void __sta_info_destroy_part2(struct sta_info *sta, bool recalc)sta_dbg (sdata,"Removed STA %pM\n" , sta->sta.addr); - sinfo =kzalloc (sizeof (*sinfo),GFP_KERNEL ); -if (sinfo) -sta_set_sinfo (sta, sinfo, true);cfg80211_del_sta_sinfo (sdata->dev, sta->sta.addr, sinfo,GFP_KERNEL );kfree (sinfo);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/175 ASoC: Intel: sof_sdw: Add new quirks for PTL on Dell with CS42L43
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deep Harsora <[email protected]>
[ Upstream commit 12cacdfb023d1b2f6c4e5af471f2d5b6f0cbf909 ]
Add missing quirks for some new Dell laptops using cs42l43's speaker outputs.
--- sound/soc/intel/boards/sof_sdw.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/intel/boards/sof_sdw.c +8 -0
@@ -750,6 +750,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { .driver_data = (void *)(SOC_SDW_CODEC_SPKR), },/* Pantherlake devices*/ + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"0DD6" ) + }, + .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), + }, { .callback = sof_sdw_quirk_cb, .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/175 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guodong Xu <[email protected]>
[ Upstream commit a143545855bc2c6e1330f6f57ae375ac44af00a7 ]
Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents.
The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors:
CPU 0 CPU 1
----- -----mmp_pdma_tx_status()mmp_pdma_residue()
-> NO LOCK held
list_for_each_entry(sw, ..)
DMA interrupt
dma_do_tasklet()
-> spin_lock(&desc_lock)
list_move(sw->node, ...)
spin_unlock(&desc_lock) | dma_pool_free(sw) <- FREED!
-> access sw->desc <- UAF!
This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan > 1).
Fix by protecting the chain_running list iteration and descriptor access with the chan->desc_lock spinlock.
--- drivers/dma/mmp_pdma.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/dma/mmp_pdma.c +6 -0
@@ -928,6 +928,7 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, {struct mmp_pdma_desc_sw *sw;struct mmp_pdma_device *pdev =to_mmp_pdma_dev (chan->chan.device); +unsigned long flags;u64 curr;u32 residue =0 ;bool passed = false;
@@ -945,6 +946,8 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan,else curr = pdev->ops->read_src_addr (chan->phy); +spin_lock_irqsave (&chan->desc_lock, flags); +list_for_each_entry (sw, &chan->chain_running, node) {u64 start, end;u32 len;
@@ -989,6 +992,7 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan,continue ;if (sw->async_tx.cookie == cookie) { +spin_unlock_irqrestore (&chan->desc_lock, flags);return residue; }else { residue =0 ;
@@ -996,6 +1000,8 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, } } +spin_unlock_irqrestore (&chan->desc_lock, flags); +/* We should only get here in case of cyclic transactions */ return residue; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/175 ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit 5b577d214fcc109707bcb77b4ae72a31cfd86798 ]
The davinci_evm_probe() function calls of_parse_phandle() to acquire device nodes for "ti,audio-codec" and "ti,mcasp-controller". These functions return device nodes with incremented reference counts.
However, in several error paths (e.g., when the second of_parse_phandle(), snd_soc_of_parse_card_name(), or devm_snd_soc_register_card() fails), the function returns directly without releasing the acquired nodes, leading to reference leaks.
This patch adds an error handling path 'err_put' to properly release the device nodes using of_node_put() and clean up the pointers when an error occurs.
--- sound/soc/ti/davinci-evm.c | 39 ++++++++++++++++++++++++++++++-------- 1 file changed, 31 insertions(+), 8 deletions(-)
sound/soc/ti/davinci-evm.c +31 -8
@@ -193,27 +193,32 @@ static int davinci_evm_probe(struct platform_device *pdev)return -EINVAL ; dai->cpus->of_node =of_parse_phandle (np,"ti,mcasp-controller" ,0 ); -if (!dai->cpus->of_node) -return -EINVAL ; +if (!dai->cpus->of_node) { + ret = -EINVAL ; + goto err_put; + } dai->platforms->of_node = dai->cpus->of_node; evm_soc_card.dev = &pdev->dev; ret =snd_soc_of_parse_card_name (&evm_soc_card,"ti,model" );if (ret) -return ret; + goto err_put; mclk =devm_clk_get (&pdev->dev,"mclk" );if (PTR_ERR (mclk) == -EPROBE_DEFER ) { -return -EPROBE_DEFER ; + ret = -EPROBE_DEFER ; + goto err_put; }else if (IS_ERR (mclk)) {dev_dbg (&pdev->dev,"mclk not found.\n" ); mclk =NULL ; } drvdata =devm_kzalloc (&pdev->dev,sizeof (*drvdata),GFP_KERNEL ); -if (!drvdata) -return -ENOMEM ; +if (!drvdata) { + ret = -ENOMEM ; + goto err_put; + } drvdata->mclk = mclk;
@@ -223,7 +228,8 @@ static int davinci_evm_probe(struct platform_device *pdev)if (!drvdata->mclk) {dev_err (&pdev->dev,"No clock or clock rate defined.\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_put; } drvdata->sysclk =clk_get_rate (drvdata->mclk); }else if (drvdata->mclk) {
@@ -239,8 +245,25 @@ static int davinci_evm_probe(struct platform_device *pdev)snd_soc_card_set_drvdata (&evm_soc_card, drvdata); ret =devm_snd_soc_register_card (&pdev->dev, &evm_soc_card); -if (ret) +if (ret) {dev_err (&pdev->dev,"snd_soc_register_card failed (%d)\n" , ret); + goto err_put; + } + +return ret; + +err_put: + dai->platforms->of_node =NULL ; + +if (dai->cpus->of_node) { +of_node_put (dai->cpus->of_node); + dai->cpus->of_node =NULL ; + } + +if (dai->codecs->of_node) { +of_node_put (dai->codecs->of_node); + dai->codecs->of_node =NULL ; + }return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/175 ASoC: simple-card-utils: Check device node before overwrite direction
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 22a507d7680f2c3499c133f6384349f62f916176 ]
Even the device node don't exist, the graph_util_parse_link_direction() will overwrite the playback_only and capture_only to be zero. Which cause the playback_only and capture_only are not correct, so check device node exist or not before update the value.
--- sound/soc/generic/simple-card-utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/generic/simple-card-utils.c +2 -2
@@ -1179,9 +1179,9 @@ void graph_util_parse_link_direction(struct device_node *np,bool is_playback_only =of_property_read_bool (np,"playback-only" );bool is_capture_only =of_property_read_bool (np,"capture-only" ); -if (playback_only) +if (np && playback_only) *playback_only = is_playback_only; -if (capture_only) +if (np && capture_only) *capture_only = is_capture_only; }EXPORT_SYMBOL_GPL (graph_util_parse_link_direction);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/175 nvme-fc: release admin tagset if init fails
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya Kulkarni <[email protected]>
[ Upstream commit d1877cc7270302081a315a81a0ee8331f19f95c8 ]
nvme_fabrics creates an NVMe/FC controller in following path:
nvmf_dev_write()
-> nvmf_create_ctrl()
-> nvme_fc_create_ctrl()
-> nvme_fc_init_ctrl()nvme_fc_init_ctrl() allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc.
Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts.
--- drivers/nvme/host/fc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/fc.c +2 -0
@@ -3584,6 +3584,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, ctrl->ctrl.opts =NULL ; +if (ctrl->ctrl.admin_tagset) +nvme_remove_admin_tag_set (&ctrl->ctrl);/* initiate nvme ctrl ref counting teardown */ nvme_uninit_ctrl (&ctrl->ctrl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/175 ALSA: usb-audio: Prevent excessive number of frames
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit ef5749ef8b307bf8717945701b1b79d036af0a15 ]
In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer size for each data URB is maxpacksize * packets, which in this example is 40 * 6 = 240; When the user performs a write operation to send audio data into the ALSA PCM playback stream, the calculated number of frames is packsize[0] * packets = 264, which exceeds the allocated URB buffer size, triggering the out-of-bounds (OOB) issue reported by syzbot [1].
Added a check for the number of single data URB frames when calculating the number of frames to prevent [1].
[1]
BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506 Call Trace: copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611 prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333
--- sound/usb/pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/pcm.c +1 -1
@@ -1553,7 +1553,7 @@ static int prepare_playback_urb(struct snd_usb_substream *subs,for (i =0 ; i < ctx->packets; i++) { counts =snd_usb_endpoint_next_packet_size (ep, ctx, i, avail); -if (counts <0 ) +if (counts <0 || frames + counts >= ep->max_urb_frames)break ;/* set up descriptor */ urb->iso_frame_desc[i].offset = frames * stride;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/175 nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit 2fa8961d3a6a1c2395d8d560ffed2c782681bade ]
When the socket is closed while in TCP_LISTEN a callback is run to flush all outstanding packets, which in turns calls nvmet_tcp_listen_data_ready() with the sk_callback_lock held. So we need to check if we are in TCP_LISTEN before attempting to get the sk_callback_lock() to avoid a deadlock.
--- drivers/nvme/target/tcp.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/nvme/target/tcp.c +4 -5
@@ -2021,14 +2021,13 @@ static void nvmet_tcp_listen_data_ready(struct sock *sk)trace_sk_data_ready (sk); +if (sk->sk_state !=TCP_LISTEN ) +return ; +read_lock_bh (&sk->sk_callback_lock); port = sk->sk_user_data; -if (!port) - goto out; - -if (sk->sk_state ==TCP_LISTEN ) +if (port)queue_work (nvmet_wq, &port->accept_work); -out:read_unlock_bh (&sk->sk_callback_lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/175 ASoC: amd: yc: Fix microphone on ASUS M6500RE
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhi Bajahaw <[email protected]>
[ Upstream commit 8e29db1b08808f709231e6fd4c79dcdee5b17a17 ]
Add DMI match for ASUSTeK COMPUTER INC. M6500RE to enable the internal microphone.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -416,6 +416,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "M6500RE"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/175 ASoC: tlv320adcx140: Propagate error codes during probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dimitrios Katsaros <[email protected]>
[ Upstream commit d89aad92cfd15edbd704746f44c98fe687f9366f ]
When scanning for the reset pin, we could get an -EPROBE_DEFER. The driver would assume that no reset pin had been defined, which would mean that the chip would never be powered.
Now we both respect any error we get from devm_gpiod_get_optional. We also now properly report the missing GPIO definition when 'gpio_reset' is NULL.
--- sound/soc/codecs/tlv320adcx140.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/codecs/tlv320adcx140.c +3 -0
@@ -1156,6 +1156,9 @@ static int adcx140_i2c_probe(struct i2c_client *i2c) adcx140->gpio_reset =devm_gpiod_get_optional (adcx140->dev,"reset" ,GPIOD_OUT_LOW );if (IS_ERR (adcx140->gpio_reset)) +return dev_err_probe (&i2c->dev,PTR_ERR (adcx140->gpio_reset), +"Failed to get Reset GPIO\n" ); +if (!adcx140->gpio_reset)dev_info (&i2c->dev,"Reset GPIO not defined\n" ); adcx140->supply_areg = devm_regulator_get_optional(adcx140->dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/175 ALSA: hda/tas2781: Add newly-released HP laptop
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
[ Upstream commit 46b8d0888f01f250fbd24d00ff80b755c3c42cd4 ]
HP released the new laptop with the subid 0x103C.
--- sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c +4 -1
@@ -2,7 +2,7 @@// // TAS2781 HDA I2C driver // -// Copyright 2023 - 2025 Texas Instruments, Inc. +// Copyright 2023 - 2026 Texas Instruments, Inc. // // Author: Shenghao Ding <[email protected]> // Current maintainer: Baojun Xu <[email protected]>
@@ -571,6 +571,9 @@ static int tas2781_hda_bind(struct device *dev, struct device *master,case 0x1028 : tas_hda->catlog_id =DELL ;break ; +case 0x103C : + tas_hda->catlog_id =HP ; +break ;default : tas_hda->catlog_id =LENOVO ;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/175 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <[email protected]>
[ Upstream commit b062a899c997df7b9ce29c62164888baa7a85833 ]
In hisi_spi_debugfs_init, spi controller pointer is calculated by container_of macro, and the member is hs->dev. But the host cannot be calculated offset directly by this. (hs->dev) points to (pdev->dev), and it is the (host->dev.parent) rather than (host->dev) points to the (pdev->dev), which is set in __spi_alloc_controller.
In this patch, this issues is fixed by getting the spi_controller data from pdev->dev by dev_get_drvdata() directly. (dev->driver_data) points to the spi controller data in the probe stage.
--- drivers/spi/spi-hisi-kunpeng.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/spi/spi-hisi-kunpeng.c +1 -3
@@ -161,10 +161,8 @@ static const struct debugfs_reg32 hisi_spi_regs[] = {static int hisi_spi_debugfs_init (struct hisi_spi *hs) {char name[32 ]; +struct spi_controller *host =dev_get_drvdata (hs->dev); -struct spi_controller *host; - - host = container_of(hs->dev, struct spi_controller, dev);snprintf (name,32 ,"hisi_spi%d" , host->bus_num); hs->debugfs =debugfs_create_dir (name,NULL );if (IS_ERR (hs->debugfs))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/175 regmap: maple: free entry on mas_store_gfp() failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8 ]
regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory.
Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper').
--- drivers/base/regmap/regcache-maple.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/base/regmap/regcache-maple.c +6 -5
@@ -95,12 +95,13 @@ static int regcache_maple_write(struct regmap *map, unsigned int reg,mas_unlock (&mas); -if (ret ==0 ) { -kfree (lower); -kfree (upper); +if (ret) { +kfree (entry); +return ret; } - -return ret; +kfree (lower); +kfree (upper); +return 0 ; } static int regcache_maple_drop(struct regmap *map, unsigned int min,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/175 ALSA: usb-audio: Add delay quirk for MOONDROP Moonriver2 Ti
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianqin Hu <[email protected]>
[ Upstream commit 49985bc466b51af88d534485631c8cd8c9c65f43 ]
Audio control requests that sets sampling frequency sometimes fail on this card. Adding delay between control messages eliminates that problem.
usb 1-1: New USB device found, idVendor=2fc6, idProduct=f06b usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: MOONDROP Moonriver2 Ti
usb 1-1: Manufacturer: MOONDROP
usb 1-1: SerialNumber: MOONDROP Moonriver2 Ti
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2390,6 +2390,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_CTL_MSG_DELAY_1M),DEVICE_FLG (0x2d99 ,0x0026 ,/* HECATE G2 GAMING HEADSET */ QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE ), +DEVICE_FLG (0x2fc6 ,0xf06b ,/* MOONDROP Moonriver2 Ti */ +QUIRK_FLAG_CTL_MSG_DELAY ),DEVICE_FLG (0x2fc6 ,0xf0b7 ,/* iBasso DC07 Pro */ QUIRK_FLAG_CTL_MSG_DELAY_1M ), DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/175 spi: intel-pci: Add support for Nova Lake SPI serial flash
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Borzeszkowski <[email protected]>
[ Upstream commit caa329649259d0f90c0056c9860ca659d4ba3211 ]
Add Intel Nova Lake PCH-S SPI serial flash PCI ID to the list of supported devices. This is the same controller found in previous generations.
--- drivers/spi/spi-intel-pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-intel-pci.c +1 -0
@@ -81,6 +81,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { { PCI_VDEVICE(INTEL, 0x54a4), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x5794), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x5825), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0x6e24), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x7723), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x7a24), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x7aa4), (unsigned long)&cnl_info },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/175 wifi: cfg80211: Fix bitrate calculation overflow for HE rates
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Veerendranath Jakkam <[email protected]>
[ Upstream commit a3034bf0746d88a00cceda9541534a5721445a24 ]
An integer overflow occurs in cfg80211_calculate_bitrate_he() when calculating bitrates for high throughput HE configurations. For example, with 160 MHz bandwidth, HE-MCS 13, HE-NSS 4, and HE-GI 0, the multiplication (result * rate->nss) overflows the 32-bit 'result' variable before division by 8, leading to significantly underestimated bitrate values.
The overflow occurs because the NSS multiplication operates on a 32-bit integer that cannot accommodate intermediate values exceeding 4,294,967,295. When overflow happens, the value wraps around, producing incorrect bitrates for high MCS and NSS combinations.
Fix this by utilizing the 64-bit 'tmp' variable for the NSS multiplication and subsequent divisions via do_div(). This approach preserves full precision throughout the entire calculation, with the final value assigned to 'result' only after completing all operations.
--- net/wireless/util.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/wireless/util.c +5 -3
@@ -1561,12 +1561,14 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) tmp = result; tmp *=SCALE ;do_div (tmp, mcs_divisors[rate->mcs]); - result = tmp;/* and take NSS, DCM into account */ - result = (result * rate->nss) /8 ; + tmp *= rate->nss; +do_div (tmp,8 );if (rate->he_dcm) - result /=2 ; +do_div (tmp,2 ); + + result = tmp;return result /10000 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/175 scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 84dc6037390b8607c5551047d3970336cb51ba9a ]
In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately.
This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free.
To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.
--- drivers/target/iscsi/iscsi_target_util.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target_util.c +4 -1
@@ -741,8 +741,11 @@ void iscsit_dec_session_usage_count(struct iscsit_session *sess)spin_lock_bh (&sess->session_usage_lock); sess->session_usage_count--; -if (!sess->session_usage_count && sess->session_waiting_on_uc) +if (!sess->session_usage_count && sess->session_waiting_on_uc) { +spin_unlock_bh (&sess->session_usage_lock);complete (&sess->session_waiting_on_uc_comp); +return ; + }spin_unlock_bh (&sess->session_usage_lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/175 riscv: Use 64-bit variable for output in __get_user_asm
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit bdce162f2e57a969803e5e9375999a3e0546905f ]
After commit f6bff7827a48 ("riscv: uaccess: use 'asm_goto_output' for get_user()"), which was the first commit that started using asm goto with outputs on RISC-V, builds of clang built with assertions enabled start crashing in certain files that use get_user() with:
clang: llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp:12743: Register FollowCopyChain(MachineRegisterInfo &, Register): Assertion `MI->getOpcode() == TargetOpcode::COPY && "start of copy chain MUST be COPY"' failed.
Internally, LLVM generates an addiw instruction when the output of the inline asm (which may be any scalar type) needs to be sign extended for ABI reasons, such as a later function call, so that basic block does not have to do it.
Use a temporary 64-bit variable as the output of the inline assembly in __get_user_asm() and explicitly cast it to truncate it if necessary, avoiding the addiw that triggers the assertion.
--- arch/riscv/include/asm/uaccess.h | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
arch/riscv/include/asm/uaccess.h +12 -2
@@ -97,13 +97,23 @@ static inline unsigned long __untagged_addr_remote(struct mm_struct *mm, unsigne*/ #ifdef CONFIG_CC_HAS_ASM_GOTO_OUTPUT +/* +* Use a temporary variable for the output of the asm goto to avoid a +* triggering an LLVM assertion due to sign extending the output when +* it is used in later function calls: +* https://github.com/llvm/llvm-project/issues/143795 +*/ #define __get_user_asm (insn, x, ptr, label) \ +do { \ + u64 __tmp; \ asm_goto_output( \ "1:\n" \ " " insn " %0, %1\n" \ _ASM_EXTABLE_UACCESS_ERR(1b, %l2, %0) \ - : "=&r" (x) \ - : "m" (*(ptr)) : : label) + : "=&r" (__tmp) \ + : "m" (*(ptr)) : : label); \ + (x) = (__typeof__(x))__tmp; \ +} while (0)#else /* !CONFIG_CC_HAS_ASM_GOTO_OUTPUT */ #define __get_user_asm (insn, x, ptr, label) \ do { \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/175 io_uring/rw: free potentially allocated iovec on cache put failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 4b9748055457ac3a0710bf210c229d01ea1b01b9 ]
If a read/write request goes through io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cache, then it may end up with an unaccounted iovec pointer. Have io_rw_recycle() return whether it recycled the request or not, and use that to gauge whether to free a potential iovec or not.
--- io_uring/rw.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
io_uring/rw.c +11 -4
@@ -144,19 +144,22 @@ static inline int io_import_rw_buffer(int rw, struct io_kiocb *req,return 0 ; } -static void io_rw_recycle (struct io_kiocb *req,unsigned int issue_flags) +static bool io_rw_recycle (struct io_kiocb *req,unsigned int issue_flags) {struct io_async_rw *rw = req->async_data;if (unlikely (issue_flags &IO_URING_F_UNLOCKED )) -return ; +return false;io_alloc_cache_vec_kasan (&rw->vec);if (rw->vec.nr >IO_VEC_CACHE_SOFT_CAP )io_vec_free (&rw->vec); -if (io_alloc_cache_put (&req->ctx->rw_cache, rw)) +if (io_alloc_cache_put (&req->ctx->rw_cache, rw)) {io_req_async_data_clear (req,0 ); +return true; + } +return false; }static void io_req_rw_cleanup (struct io_kiocb *req,unsigned int issue_flags)
@@ -190,7 +193,11 @@ static void io_req_rw_cleanup(struct io_kiocb *req, unsigned int issue_flags)*/ if (!(req->flags & (REQ_F_REISSUE |REQ_F_REFCOUNT ))) { req->flags &= ~REQ_F_NEED_CLEANUP ; -io_rw_recycle (req, issue_flags); +if (!io_rw_recycle (req, issue_flags)) { +struct io_async_rw *rw = req->async_data; + +io_vec_free (&rw->vec); + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/175 ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Guttzeit <[email protected]>
[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ]
Add a PCI quirk to enable microphone detection on the headphone jack of TongFang X6AR55xU devices.
--- sound/hda/codecs/realtek/alc269.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/hda/codecs/realtek/alc269.c +4 -0
@@ -7679,6 +7679,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { {0x12, 0x90a60140}, {0x19, 0x04a11030}, {0x21, 0x04211020}), + SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, + {0x17, 0x90170110}, + {0x19, 0x03a11030}, + {0x21, 0x03211020}), SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, ALC282_STANDARD_PINS, {0x12, 0x90a609c0},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/175 scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 9411a89e9e7135cc459178fa77a3f1d6191ae903 ]
In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure.
If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure.
Fix this by releasing the spinlock before calling complete().
--- drivers/target/iscsi/iscsi_target_util.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target_util.c +4 -1
@@ -813,8 +813,11 @@ void iscsit_dec_conn_usage_count(struct iscsit_conn *conn)spin_lock_bh (&conn->conn_usage_lock); conn->conn_usage_count--; -if (!conn->conn_usage_count && conn->conn_waiting_on_uc) +if (!conn->conn_usage_count && conn->conn_waiting_on_uc) { +spin_unlock_bh (&conn->conn_usage_lock);complete (&conn->conn_waiting_on_uc_comp); +return ; + }spin_unlock_bh (&conn->conn_usage_lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/175 btrfs: fix Wmaybe-uninitialized warning in replay_one_buffer()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Ma <[email protected]>
[ Upstream commit 9c7e71c97c8cd086b148d0d3d1cd84a1deab023c ]
Warning was found when compiling using loongarch64-gcc 12.3.1:
$ make CFLAGS_tree-log.o=-Wmaybe-uninitialized
In file included from fs/btrfs/ctree.h:21,
from fs/btrfs/tree-log.c:12:
fs/btrfs/accessors.h: In function 'replay_one_buffer':
fs/btrfs/accessors.h:66:16: warning: 'inode_item' may be used uninitialized [-Wmaybe-uninitialized]
66 | return btrfs_get_##bits(eb, s, offsetof(type, member)); \
| ^~~~~~~~~~ fs/btrfs/tree-log.c:2803:42: note: 'inode_item' declared here
2803 | struct btrfs_inode_item *inode_item;
| ^~~~~~~~~~
Initialize the inode_item to NULL, the compiler does not seem to see the relation between the first 'wc->log_key.type == BTRFS_INODE_ITEM_KEY' check and the other one that also checks the replay phase.
--- fs/btrfs/tree-log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/tree-log.c +1 -1
@@ -2800,7 +2800,7 @@ static int replay_one_buffer(struct extent_buffer *eb, nritems =btrfs_header_nritems (eb);for (wc->log_slot =0 ; wc->log_slot < nritems; wc->log_slot++) { -struct btrfs_inode_item *inode_item; +struct btrfs_inode_item *inode_item =NULL ;btrfs_item_key_to_cpu (eb, &wc->log_key, wc->log_slot);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/175 wifi: mac80211: correctly check if CSA is active
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit db1d0b6ab11f612ea8a327663a578c8946efeee9 ]
We are not adding an interface if an existing one is doing CSA. But the check won't work for MLO station interfaces, since for those, vif->bss_conf is zeroed out.
Fix this by checking if any link of the vif has an active CSA.
--- net/mac80211/iface.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/mac80211/iface.c +6 -2
@@ -350,6 +350,8 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,/* we hold the RTNL here so can safely walk the list */ list_for_each_entry (nsdata, &local->interfaces, list) {if (nsdata != sdata &&ieee80211_sdata_running (nsdata)) { +struct ieee80211_link_data *link; +/* * Only OCB and monitor mode may coexist */
@@ -376,8 +378,10 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,* will not add another interface while any channel * switch is active. */ -if (nsdata->vif.bss_conf.csa_active) -return -EBUSY ; +for_each_link_data (nsdata, link) { +if (link->conf->csa_active) +return -EBUSY ; + }/* * The remaining checks are only performed for interfaces
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/175 btrfs: sync read disk super and set block size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 3f29d661e5686f3aa14e6f11537ff5c49846f2e2 ]
When the user performs a btrfs mount, the block device is not set correctly. The user sets the block size of the block device to 0x4000 by executing the BLKBSZSET command.
Since the block size change also changes the mapping->flags value, this further affects the result of the mapping_min_folio_order() calculation.
Let's analyze the following two scenarios:
Scenario 1: Without executing the BLKBSZSET command, the block size is 0x1000, and mapping_min_folio_order() returns 0;
Scenario 2: After executing the BLKBSZSET command, the block size is 0x4000, and mapping_min_folio_order() returns 2.
do_read_cache_folio() allocates a folio before the BLKBSZSET command is executed. This results in the allocated folio having an order value of 0. Later, after BLKBSZSET is executed, the block size increases to 0x4000, and the mapping_min_folio_order() calculation result becomes 2.
This leads to two undesirable consequences:
1. filemap_add_folio() triggers a VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) assertion.
2. The syzbot report [1] shows a null pointer dereference in create_empty_buffers() due to a buffer head allocation failure.
Synchronization should be established based on the inode between the BLKBSZSET command and read cache page to prevent inconsistencies in block size or mapping flags before and after folio allocation.
[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694 Call Trace: folio_create_buffers+0x109/0x150 fs/buffer.c:1802 block_read_full_folio+0x14c/0x850 fs/buffer.c:2403 filemap_read_folio+0xc8/0x2a0 mm/filemap.c:2496 do_read_cache_folio+0x266/0x5c0 mm/filemap.c:4096 do_read_cache_page mm/filemap.c:4162 [inline] read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195 btrfs_read_disk_super+0x192/0x500 fs/btrfs/volumes.c:1367
--- fs/btrfs/volumes.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/volumes.c +2 -0
@@ -1365,7 +1365,9 @@ struct btrfs_super_block *btrfs_read_disk_super(struct block_device *bdev, (bytenr + BTRFS_SUPER_INFO_SIZE) >> PAGE_SHIFT); } +filemap_invalidate_lock (mapping); page =read_cache_page_gfp (mapping, bytenr >>PAGE_SHIFT ,GFP_NOFS ); +filemap_invalidate_unlock (mapping);if (IS_ERR (page))return ERR_CAST (page);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/175 wifi: mac80211: dont increment crypto_tx_tailroom_needed_cnt twice
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 3f3d8ff31496874a69b131866f62474eb24ed20a ]
In reconfig, in case the driver asks to disconnect during the reconfig, all the keys of the interface are marked as tainted.
Then ieee80211_reenable_keys will loop over all the interface keys, and for each one it will
a) increment crypto_tx_tailroom_needed_cnt
b) call ieee80211_key_enable_hw_accel, which in turn will detect that this key is tainted, so it will mark it as "not in hardware", which is paired with crypto_tx_tailroom_needed_cnt incrementation, so we get two incrementations for each tainted key.
Then we get a warning in ieee80211_free_keys.
To fix it, don't increment the count in ieee80211_reenable_keys for tainted keys
--- net/mac80211/key.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/key.c +2 -1
@@ -987,7 +987,8 @@ void ieee80211_reenable_keys(struct ieee80211_sub_if_data *sdata)if (ieee80211_sdata_running (sdata)) {list_for_each_entry (key, &sdata->key_list, list) { -increment_tailroom_need_count (sdata); +if (!(key->flags &KEY_FLAG_TAINTED )) +increment_tailroom_need_count (sdata);ieee80211_key_enable_hw_accel (key); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/175 btrfs: reject new transactions if the fs is fully read-only
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 1972f44c189c8aacde308fa9284e474c1a5cbd9f ]
[BUG]
There is a bug report where a heavily fuzzed fs is mounted with all rescue mount options, which leads to the following warnings during unmount:
BTRFS: Transaction aborted (error -22)
Modules linked in: CPU: 0 UID: 0 PID: 9758 Comm: repro.out Not tainted 6.19.0-rc5-00002-gb71e635feefc #7 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:find_free_extent_update_loop fs/btrfs/extent-tree.c:4208 [inline] RIP: 0010:find_free_extent+0x52f0/0x5d20 fs/btrfs/extent-tree.c:4611 Call Trace: <TASK> btrfs_reserve_extent+0x2cd/0x790 fs/btrfs/extent-tree.c:4705 btrfs_alloc_tree_block+0x1e1/0x10e0 fs/btrfs/extent-tree.c:5157 btrfs_force_cow_block+0x578/0x2410 fs/btrfs/ctree.c:517 btrfs_cow_block+0x3c4/0xa80 fs/btrfs/ctree.c:708 btrfs_search_slot+0xcad/0x2b50 fs/btrfs/ctree.c:2130 btrfs_truncate_inode_items+0x45d/0x2350 fs/btrfs/inode-item.c:499 btrfs_evict_inode+0x923/0xe70 fs/btrfs/inode.c:5628 evict+0x5f4/0xae0 fs/inode.c:837 __dentry_kill+0x209/0x660 fs/dcache.c:670 finish_dput+0xc9/0x480 fs/dcache.c:879 shrink_dcache_for_umount+0xa0/0x170 fs/dcache.c:1661 generic_shutdown_super+0x67/0x2c0 fs/super.c:621 kill_anon_super+0x3b/0x70 fs/super.c:1289 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2127 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318 task_work_run+0x1d4/0x260 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x694/0x22f0 kernel/exit.c:971 do_group_exit+0x21c/0x2d0 kernel/exit.c:1112 __do_sys_exit_group kernel/exit.c:1123 [inline] __se_sys_exit_group kernel/exit.c:1121 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1121 x64_sys_call+0x2210/0x2210 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x44f639 Code: Unable to access opcode bytes at 0x44f60f. RSP: 002b:00007ffc15c4e088 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00000000004c32f0 RCX: 000000000044f639 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004c32f0 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 </TASK>
Since rescue mount options will mark the full fs read-only, there should be no new transaction triggered.
But during unmount we will evict all inodes, which can trigger a new transaction, and triggers warnings on a heavily corrupted fs.
[CAUSE]
Btrfs allows new transaction even on a read-only fs, this is to allow log replay happen even on read-only mounts, just like what ext4/xfs do.
However with rescue mount options, the fs is fully read-only and cannot be remounted read-write, thus in that case we should also reject any new transactions.
[FIX]
If we find the fs has rescue mount options, we should treat the fs as error, so that no new transaction can be started.
--- fs/btrfs/disk-io.c | 13 +++++++++++++ fs/btrfs/fs.h | 8 ++++++++ 2 files changed, 21 insertions(+)
fs/btrfs/disk-io.c +13 -0
@@ -3248,6 +3248,15 @@ int btrfs_check_features(struct btrfs_fs_info *fs_info, bool is_rw_mount)return 0 ; } +static bool fs_is_full_ro (const struct btrfs_fs_info *fs_info) +{ +if (!sb_rdonly (fs_info->sb)) +return false; +if (unlikely (fs_info->mount_opt &BTRFS_MOUNT_FULL_RO_MASK )) +return true; +return false; +} +int __cold open_ctree (struct super_block *sb,struct btrfs_fs_devices *fs_devices) {u32 sectorsize;
@@ -3356,6 +3365,10 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_deviceif (btrfs_super_flags (disk_super) &BTRFS_SUPER_FLAG_ERROR )WRITE_ONCE (fs_info->fs_error, -EUCLEAN ); +/* If the fs has any rescue options, no transaction is allowed. */ +if (fs_is_full_ro (fs_info)) +WRITE_ONCE (fs_info->fs_error, -EROFS ); +/* Set up fs_info before parsing mount options */ nodesize =btrfs_super_nodesize (disk_super); sectorsize =btrfs_super_sectorsize (disk_super);
fs/btrfs/fs.h +8 -0
@@ -250,6 +250,14 @@ enum { BTRFS_MOUNT_REF_TRACKER = (1ULL << 33), }; +/* These mount options require a full read-only fs, no new transaction is allowed. */ +#define BTRFS_MOUNT_FULL_RO_MASK \ + (BTRFS_MOUNT_NOLOGREPLAY | \ + BTRFS_MOUNT_IGNOREBADROOTS | \ + BTRFS_MOUNT_IGNOREDATACSUMS | \ + BTRFS_MOUNT_IGNOREMETACSUMS | \ + BTRFS_MOUNT_IGNORESUPERFLAGS) +/* * Compat flags that we support. If any incompat flags are set other than the * ones specified below then we will fail to mount
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/175 ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Hamilton <[email protected]>
[ Upstream commit 64e0924ed3b446fdd758dfab582e0e961863a116 ]
The amp/speakers on the Lenovo Yoga Book 9i 13IRU8 laptop aren't fully powered up, resulting in horrible tinny sound by default.
The kernel has an existing quirk for PCI SSID 0x17aa3843 which matches this machine and several others. The quirk applies the ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP fixup, however the fixup does not work on this machine.
This patch modifies the existing quirk by adding a check for the subsystem ID 0x17aa3881. If present, ALC287_FIXUP_TAS2781_I2C will be applied instead of ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP. With this change the TAS2781 amp is powered up, firmware is downloaded and recognised by HDA/SOF - i.e. all is good, and we can boogie.
Code is re-used from alc298_fixup_lenovo_c940_duet7(), which fixes a similar problem with two other Lenovo laptops.
Cross checked against ALSA cardinfo database for potential clashes. Tested against 6.18.5 kernel built with Arch Linux default options. Tested in HDA mode and SOF mode.
Note: Possible further work required to address quality of life issues caused by the firmware's agressive power saving, and to improve ALSA control mappings.
--- sound/hda/codecs/realtek/alc269.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
sound/hda/codecs/realtek/alc269.c +23 -1
@@ -3674,6 +3674,7 @@ enum {ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ,ALC298_FIXUP_LENOVO_C940_DUET7 , +ALC287_FIXUP_LENOVO_YOGA_BOOK_9I ,ALC287_FIXUP_13S_GEN2_SPEAKERS ,ALC256_FIXUP_SET_COEF_DEFAULTS , ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
@@ -3757,6 +3758,23 @@ static void alc298_fixup_lenovo_c940_duet7(struct hda_codec *codec,__snd_hda_apply_fixup (codec, id, action,0 ); } +/* A special fixup for Lenovo Yoga 9i and Yoga Book 9i 13IRU8 +* both have the very same PCI SSID and vendor ID, so we need +* to apply different fixups depending on the subsystem ID +*/ +static void alc287_fixup_lenovo_yoga_book_9i (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +int id; + +if (codec->core.subsystem_id ==0x17aa3881 ) + id =ALC287_FIXUP_TAS2781_I2C ;/* Yoga Book 9i 13IRU8 */ +else + id =ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP ;/* Yoga 9i */ +__snd_hda_apply_fixup (codec, id, action,0 ); +} +static const struct hda_fixup alc269_fixups[] = { [ALC269_FIXUP_GPIO2 ] = { .type =HDA_FIXUP_FUNC ,
@@ -5764,6 +5782,10 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc298_fixup_lenovo_c940_duet7, }, + [ALC287_FIXUP_LENOVO_YOGA_BOOK_9I] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc287_fixup_lenovo_yoga_book_9i, + }, [ALC287_FIXUP_13S_GEN2_SPEAKERS] = { .type = HDA_FIXUP_VERBS, .v.verbs = (const struct hda_verb []) {
@@ -7088,7 +7110,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ),SND_PCI_QUIRK (0x17aa ,0x3834 ,"Lenovo IdeaPad Slim 9i 14ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x383d ,"Legion Y9000X 2019" ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ), -SND_PCI_QUIRK (0x17aa ,0x3843 ,"Yoga 9i" ,ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP ), +SND_PCI_QUIRK (0x17aa ,0x3843 ,"Lenovo Yoga 9i / Yoga Book 9i" ,ALC287_FIXUP_LENOVO_YOGA_BOOK_9I ),SND_PCI_QUIRK (0x17aa ,0x3847 ,"Legion 7 16ACHG6" ,ALC287_FIXUP_LEGION_16ACHG6 ),SND_PCI_QUIRK (0x17aa ,0x384a ,"Lenovo Yoga 7 15ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/175 tracing: Avoid possible signed 64-bit truncation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 00f13e28a9c3acd40f0551cde7e9d2d1a41585bf ]
64-bit truncation to 32-bit can result in the sign of the truncated value changing. The cmp_mod_entry is used in bsearch and so the truncation could result in an invalid search order. This would only happen were the addresses more than 2GB apart and so unlikely, but let's fix the potentially broken compare anyway.
--- kernel/trace/trace.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/trace/trace.c +4 -4
@@ -6061,10 +6061,10 @@ static int cmp_mod_entry(const void *key, const void *pivot)unsigned long addr = (unsigned long )key;const struct trace_mod_entry *ent = pivot; -if (addr >= ent[0 ].mod_addr && addr < ent[1 ].mod_addr) -return 0 ; -else -return addr - ent->mod_addr; +if (addr < ent[0 ].mod_addr) +return -1 ; + +return addr >= ent[1 ].mod_addr; }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/175 Revert "drm/amd/display: pause the workload setting in dm"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit f377ea0561c9576cdb7e3890bcf6b8168d455464 ]
This reverts commit bc6d54ac7e7436721a19443265f971f890c13cc5.
The workload profile needs to be in the default state when the dc idle optimizaion state is entered. However, when jobs come in for video or GFX or compute, the profile may be set to a non-default profile resulting in the dc idle optimizations not taking affect and resulting in higher power usage. As such we need to pause the workload profile changes during this transition. When this patch was originally committed, it caused a regression with a Dell U3224KB display, but no other problems were reported at the time. When it was reapplied (this patch) to address increased power usage, it seems to have caused additional regressions. This change seems to have a number of side affects (audio issues, stuttering, etc.). I suspect the pause should only happen when all displays are off or in static screen mode, but I think this call site gets called more often than that which results in idle state entry more often than intended. For now revert.
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 11 ----------- 1 file changed, 11 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +0 -11
@@ -248,8 +248,6 @@ static void amdgpu_dm_crtc_vblank_control_worker(struct work_struct *work)struct vblank_control_work *vblank_work = container_of(work, struct vblank_control_work, work);struct amdgpu_display_manager *dm = vblank_work->dm; -struct amdgpu_device *adev =drm_to_adev (dm->ddev); -int r;mutex_lock (&dm->dc_lock);
@@ -279,16 +277,7 @@ static void amdgpu_dm_crtc_vblank_control_worker(struct work_struct *work)if (dm->active_vblank_irq_count ==0 ) {dc_post_update_surfaces_to_stream (dm->dc); - - r =amdgpu_dpm_pause_power_profile (adev, true); -if (r) -dev_warn (adev->dev,"failed to set default power profile mode\n" ); -dc_allow_idle_optimizations (dm->dc, true); - - r =amdgpu_dpm_pause_power_profile (adev, false); -if (r) -dev_warn (adev->dev,"failed to restore the power profile mode\n" ); }mutex_unlock (&dm->dc_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/175 platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 128497456756e1b952bd5a912cd073836465109d ]
toshiba_haps_add() leaks the haps object allocated by it if it returns an error after allocating that object successfully.
toshiba_haps_remove() does not free the object pointed to by toshiba_haps before clearing that pointer, so it becomes unreachable allocated memory.
Address these memory leaks by using devm_kzalloc() for allocating the memory in question.
--- drivers/platform/x86/toshiba_haps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/toshiba_haps.c +1 -1
@@ -183,7 +183,7 @@ static int toshiba_haps_add(struct acpi_device *acpi_dev)pr_info ("Toshiba HDD Active Protection Sensor device\n" ); - haps =kzalloc (sizeof (struct toshiba_haps_dev ),GFP_KERNEL ); + haps =devm_kzalloc (&acpi_dev->dev,sizeof (*haps),GFP_KERNEL );if (!haps)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/175 platform/x86: intel_telemetry: Fix PSS event register mask
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 39e9c376ac42705af4ed4ae39eec028e8bced9b4 ]
The PSS telemetry info parsing incorrectly applies TELEM_INFO_SRAMEVTS_MASK when extracting event register count from firmware response. This reads bits 15-8 instead of the correct bits 7-0, causing misdetection of hardware capabilities.
The IOSS path correctly uses TELEM_INFO_NENABLES_MASK for register count. Apply the same mask to PSS parsing for consistency.
--- drivers/platform/x86/intel/telemetry/pltdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/intel/telemetry/pltdrv.c +1 -1
@@ -610,7 +610,7 @@ static int telemetry_setup(struct platform_device *pdev)/* Get telemetry Info */ events = (read_buf &TELEM_INFO_SRAMEVTS_MASK ) >>TELEM_INFO_SRAMEVTS_SHIFT ; - event_regs = read_buf &TELEM_INFO_SRAMEVTS_MASK ; + event_regs = read_buf &TELEM_INFO_NENABLES_MASK ;if ((events <TELEM_MAX_EVENTS_SRAM ) || (event_regs <TELEM_MAX_EVENTS_SRAM )) {dev_err (&pdev->dev,"PSS:Insufficient Space for SRAM Trace\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/175 platform/x86: hp-bioscfg: Skip empty attribute names
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 6222883af286e2feb3c9ff2bf9fd8fdf4220c55a ]
Avoid registering kobjects with empty names when a BIOS attribute name decodes to an empty string.
--- drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c +5 -0
@@ -696,6 +696,11 @@ static int hp_init_bios_package_attribute(enum hp_wmi_data_type attr_type,return ret; } +if (!str_value || !str_value[0 ]) { +pr_debug ("Ignoring attribute with empty name\n" ); + goto pack_attr_exit; + } +/* All duplicate attributes found are ignored */ duplicate =kset_find_obj (temp_kset, str_value);if (duplicate) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/175 platform/x86/intel/tpmi/plr: Make the file domain<n>/status writeable
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Neri <[email protected]>
[ Upstream commit 008bec8ffe6e7746588d1e12c5b3865fa478fc91 ]
The file sys/kernel/debug/tpmi-<n>/plr/domain<n>/status has store and show callbacks. Make it writeable.
--- drivers/platform/x86/intel/plr_tpmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/intel/plr_tpmi.c +1 -1
@@ -316,7 +316,7 @@ static int intel_plr_probe(struct auxiliary_device *auxdev, const struct auxiliasnprintf (name,sizeof (name),"domain%d" , i); dentry =debugfs_create_dir (name, plr->dbgfs_dir); -debugfs_create_file ("status" ,0444 , dentry, &plr->die_info[i], +debugfs_create_file ("status" ,0644 , dentry, &plr->die_info[i], &plr_status_fops); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/175 smb/client: fix memory leak in smb2_open_file()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <[email protected]>
[ Upstream commit e3a43633023e3cacaca60d4b8972d084a2b06236 ]
Reproducer:
1. server: directories are exported read-only
2. client: mount -t cifs //${server_ip}/export /mnt
3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
4. client: umount /mnt
5. client: sleep 1
6. client: modprobe -r cifs
The error message is as follows:
=============================================================================
BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
-----------------------------------------------------------------------------
Object 0x00000000d47521be @offset=14336
...
WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577 ... Call Trace: <TASK> kmem_cache_destroy+0x94/0x190 cifs_destroy_request_bufs+0x3e/0x50 [cifs] cleanup_module+0x4e/0x540 [cifs] __se_sys_delete_module+0x278/0x400 __x64_sys_delete_module+0x5f/0x70 x64_sys_call+0x2299/0x2ff0 do_syscall_64+0x89/0x350 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs] WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577
--- fs/smb/client/smb2file.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/client/smb2file.c +1 -0
@@ -177,6 +177,7 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 rc =SMB2_open (xid, oparms, smb2_path, &smb2_oplock, smb2_data,NULL , &err_iov, &err_buftype);if (rc == -EACCES && retry_without_read_attributes) { +free_rsp_buf (err_buftype, err_iov.iov_base); oparms->desired_access &= ~FILE_READ_ATTRIBUTES ; rc =SMB2_open (xid, oparms, smb2_path, &smb2_oplock, smb2_data,NULL , &err_iov, &err_buftype);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/175 hwmon: (dell-smm) Add Dell G15 5510 to fan control whitelist
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: [email protected] <[email protected]>
[ Upstream commit 830e0bef79aaaea8b1ef426b8032e70c63a58653 ]
On the Dell G15 5510, fans spin at maximum speed when AC power is connected. This behavior has been observed as a regression in recent kernels (v6.18+).
Add the Dell G15 5510 to the fan control whitelist to enable manual fan control and resolve the issue. This model requires the same fan control configuration as the Dell G15 5511.
--- drivers/hwmon/dell-smm-hwmon.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hwmon/dell-smm-hwmon.c +8 -0
@@ -1630,6 +1630,14 @@ static const struct dmi_system_id i8k_whitelist_fan_control[] __initconst = { }, .driver_data = (void *)&i8k_fan_control_data[I8K_FAN_30A3_31A3], }, + { + .ident = "Dell G15 5510", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Dell G15 5510"), + }, + .driver_data = (void *)&i8k_fan_control_data[I8K_FAN_30A3_31A3], + }, { .ident ="Dell G15 5511" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/175 net: add skb_header_pointer_careful() helper
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 13e00fdc9236bd4d0bff4109d2983171fbcb74c4 ]
This variant of skb_header_pointer() should be used in contexts where @offset argument is user-controlled and could be negative.
Negative offsets are supported, as long as the zone starts between skb->head and skb->data.
Stable-dep-of: cabd1a976375 ("net/sched: cls_u32: use skb_header_pointer_careful()")
--- include/linux/skbuff.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)
include/linux/skbuff.h +12 -0
@@ -4301,6 +4301,18 @@ skb_header_pointer(const struct sk_buff *skb, int offset, int len, void *buffer) skb_headlen(skb), buffer); } +/* Variant of skb_header_pointer() where @offset is user-controlled +* and potentially negative. +*/ +static inline void *__must_check +skb_header_pointer_careful (const struct sk_buff *skb,int offset, +int len,void *buffer) +{ +if (unlikely (offset <0 && -offset >skb_headroom (skb))) +return NULL ; +return skb_header_pointer (skb, offset, len, buffer); +} +static inline void *__must_check skb_pointer_if_linear (const struct sk_buff *skb,int offset,int len) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/175 net/sched: cls_u32: use skb_header_pointer_careful()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cabd1a976375780dabab888784e356f574bbaed8 ]
skb_header_pointer() does not fully validate negative @offset values.
Use skb_header_pointer_careful() instead.
GangMin Kim provided a report and a repro fooling u32_classify():
BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0
net/sched/cls_u32.c:221
--- net/sched/cls_u32.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/sched/cls_u32.c +6 -7
@@ -161,10 +161,8 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,int toff = off + key->off + (off2 & key->offmask);__be32 *data, hdata; -if (skb_headroom (skb) + toff >INT_MAX ) - goto out; - - data =skb_header_pointer (skb, toff,4 , &hdata); + data =skb_header_pointer_careful (skb, toff,4 , + &hdata);if (!data) goto out;if ((*data ^ key->val) & key->mask) {
@@ -214,8 +212,9 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,if (ht->divisor) {__be32 *data, hdata; - data =skb_header_pointer (skb, off + n->sel.hoff,4 , - &hdata); + data =skb_header_pointer_careful (skb, + off + n->sel.hoff, +4 , &hdata);if (!data) goto out; sel = ht->divisor & u32_hash_fold(*data, &n->sel,
@@ -229,7 +228,7 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,if (n->sel.flags &TC_U32_VAROFFSET ) {__be16 *data, hdata; - data =skb_header_pointer (skb, + data =skb_header_pointer_careful (skb, off + n->sel.offoff,2 , &hdata);if (!data)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/175 dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit ed48a84a72fefb20a82dd90a7caa7807e90c6f66 ]
The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL.
Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.
Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +6 -0
@@ -3024,6 +3024,12 @@ static int dpaa2_switch_init(struct fsl_mc_device *sw_dev) goto err_close; } +if (!ethsw->sw_attr.num_ifs) { +dev_err (dev,"DPSW device has no interfaces\n" ); + err = -ENODEV ; + goto err_close; + } + err =dpsw_get_api_version (ethsw->mc_io,0 , ðsw->major, ðsw->minor);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/175 net: liquidio: Initialize netdev pointer before queue setup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 926ede0c85e1e57c97d64d9612455267d597bb2c ]
In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues().
If either of these functions fails, setup_nic_devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio_destroy_nic_device() will fail to find and free the netdev, resulting in a memory leak.
Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- .../net/ethernet/cavium/liquidio/lio_main.c | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/net/ethernet/cavium/liquidio/lio_main.c +17 -17
@@ -3515,6 +3515,23 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)*/ netdev->netdev_ops = &lionetdevops; + lio =GET_LIO (netdev); + +memset (lio,0 ,sizeof (struct lio )); + + lio->ifidx = ifidx_or_pfnum; + + props = &octeon_dev->props[i]; + props->gmxport = resp->cfg_info.linfo.gmxport; + props->netdev = netdev; + +/* Point to the properties for octeon device to which this +* interface belongs. +*/ + lio->oct_dev = octeon_dev; + lio->octprops = props; + lio->netdev = netdev; + retval =netif_set_real_num_rx_queues (netdev, num_oqueues);if (retval) { dev_err(&octeon_dev->pci_dev->dev,
@@ -3531,16 +3548,6 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) goto setup_nic_dev_free; } - lio =GET_LIO (netdev); - -memset (lio,0 ,sizeof (struct lio )); - - lio->ifidx = ifidx_or_pfnum; - - props = &octeon_dev->props[i]; - props->gmxport = resp->cfg_info.linfo.gmxport; - props->netdev = netdev; - lio->linfo.num_rxpciq = num_oqueues; lio->linfo.num_txpciq = num_iqueues;for (j =0 ; j < num_oqueues; j++) {
@@ -3606,13 +3613,6 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) netdev->min_mtu =LIO_MIN_MTU_SIZE ; netdev->max_mtu =LIO_MAX_MTU_SIZE ; -/* Point to the properties for octeon device to which this -* interface belongs. -*/ - lio->oct_dev = octeon_dev; - lio->octprops = props; - lio->netdev = netdev; -dev_dbg (&octeon_dev->pci_dev->dev,"if%d gmx: %d hw_addr: 0x%llx\n" , i, lio->linfo.gmxport,CVM_CAST64 (lio->linfo.hw_addr));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/175 net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 8558aef4e8a1a83049ab906d21d391093cfa7e7f ]
In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak.
Fix this by changing the loop to iterate from the current index i down to 0.
Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index.
Compile tested only. Issue found using code review.
--- drivers/net/ethernet/cavium/liquidio/lio_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/cavium/liquidio/lio_main.c +3 -2
@@ -3760,6 +3760,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)if (!devlink) {device_unlock (&octeon_dev->pci_dev->dev);dev_err (&octeon_dev->pci_dev->dev,"devlink alloc failed\n" ); + i--; goto setup_nic_dev_free; }
@@ -3775,11 +3776,11 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) setup_nic_dev_free: -while (i--) { +do {dev_err (&octeon_dev->pci_dev->dev,"NIC ifidx:%d Setup failed\n" , i);liquidio_destroy_nic_device (octeon_dev, i); - } + }while (i--); setup_nic_dev_done:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/175 net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 6cbba46934aefdfb5d171e0a95aec06c24f7ca30 ]
In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak.
Fix this by changing the loop to iterate from the current index i down to 0.
Compile tested only. Issue found using code review.
--- drivers/net/ethernet/cavium/liquidio/lio_vf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/cavium/liquidio/lio_vf_main.c +2 -2
@@ -2222,11 +2222,11 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) setup_nic_dev_free: -while (i--) { +do {dev_err (&octeon_dev->pci_dev->dev,"NIC ifidx:%d Setup failed\n" , i);liquidio_destroy_nic_device (octeon_dev, i); - } + }while (i--); setup_nic_dev_done:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/175 dpaa2-switch: add bounds check for if_id in IRQ handler
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 31a7a0bbeb006bac2d9c81a2874825025214b6d8 ]
The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially.
Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +4 -0
@@ -1531,6 +1531,10 @@ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg) } if_id = (status &0xFFFF0000 ) >>16 ; +if (if_id >= ethsw->sw_attr.num_ifs) { +dev_err (dev,"Invalid if_id %d in IRQ status\n" , if_id); + goto out; + } port_priv = ethsw->ports[if_id];if (status &DPSW_IRQ_EVENT_LINK_CHANGED )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/175 ice: fix missing TX timestamps interrupts on E825 devices
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grzegorz Nitka <[email protected]>
[ Upstream commit 99854c167cfc113ad863832b1601c4ca1a639cfe ]
Modify PTP (Precision Time Protocol) configuration on link down flow. Previously, PHY_REG_TX_OFFSET_READY register was cleared in such case. This register is used to determine if the timestamp is valid or not on the hardware side.
However, there is a possibility that there is still the packet in the HW queue which originally was supposed to be timestamped but the link is already down and given register is cleared.
This potentially might lead to the situation in which that 'delayed' packet's timestamp is treated as invalid one when the link is up again.
This in turn leads to the situation in which the driver is not able to effectively clean timestamp memory and interrupt configuration.
Quoted 1 line
From the hardware perspective, that 'old' interrupt was not handled
properly and even if new timestamp packets are processed, no new interrupts is generated. As a result, providing timestamps to the user applications (like ptp4l) is not possible.
The solution for this problem is implemented at the driver level rather than the firmware, and maintains the tx_ready bit high, even during link down events. This avoids entering a potential inconsistent state between the driver and the timestamp hardware.
Testing hints:
- run PTP traffic at higher rate (like 16 PTP messages per second)
- observe ptp4l behaviour at the client side in the following conditions:
a) trigger link toggle events. It needs to be physiscal link down/up events
b) link speed change
In all above cases, PTP processing at ptp4l application should resume always. In failure case, the following permanent error message in ptp4l log was observed:
controller-0 ptp4l: err [6175.116] ptp4l-legacy timed out while polling
for tx timestamp
--- drivers/net/ethernet/intel/ice/ice_ptp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_ptp.c +4 -1
@@ -1338,9 +1338,12 @@ void ice_ptp_link_change(struct ice_pf *pf, bool linkup)/* Do not reconfigure E810 or E830 PHY */ return ;case ICE_MAC_GENERIC : -case ICE_MAC_GENERIC_3K_E825 :ice_ptp_port_phy_restart (ptp_port);return ; +case ICE_MAC_GENERIC_3K_E825 : +if (linkup) +ice_ptp_port_phy_restart (ptp_port); +return ;default :dev_warn (ice_pf_to_dev (pf),"%s: Unknown PHY type\n" , __func__); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/175 ice: PTP: fix missing timestamps on E825 hardware
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 88b68f35eb43ad5ac77ac1107059040b04e6f477 ]
The E825 hardware currently has each PF handle the PFINT_TSYN_TX cause of the miscellaneous OICR interrupt vector. The actual interrupt cause underlying this is shared by all ports on the same quad:
┌─────────────────────────────────┐
│ │
│ ┌────┐ ┌────┐ ┌────┐ ┌────┐ │
│ │PF 0│ │PF 1│ │PF 2│ │PF 3│ │
│ └────┘ └────┘ └────┘ └────┘ │
│ │
└────────────────▲────────────────┘
│
│
┌────────────────┼────────────────┐
│ PHY QUAD │
└───▲────────▲────────▲────────▲──┘
│ │ │ │
┌───┼──┐ ┌───┴──┐ ┌───┼──┐ ┌───┼──┐
│Port 0│ │Port 1│ │Port 2│ │Port 3│
└──────┘ └──────┘ └──────┘ └──────┘If multiple PFs issue Tx timestamp requests near simultaneously, it is possible that the correct PF will not be interrupted and will miss its timestamp. Understanding why is somewhat complex.
Consider the following sequence of events:
CPU 0:
Send Tx packet on PF 0
...
PF 0 enqueues packet with Tx request CPU 1, PF1: ... Send Tx packet on PF1 ... PF 1 enqueues packet with Tx request
HW:
PHY Port 0 sends packet
PHY raises Tx timestamp event interrupt
MAC raises each PF interrupt
CPU 0, PF0: CPU 1, PF1: ice_misc_intr() checks for Tx timestamps ice_misc_intr() checks for Tx timestamp Sees packet ready bit set Sees nothing available ... Exits
...
...
HW:
PHY port 1 sends packet
PHY interrupt ignored because not all packet timestamps read yet.
...
Read timestamp, report to stack
Because the interrupt event is shared for all ports on the same quad, the PHY will not raise a new interrupt for any PF until all timestamps are read.
In the example above, the second timestamp comes in for port 1 before the timestamp from port 0 is read. At this point, there is no longer an interrupt thread running that will read the timestamps, because each PF has checked and found that there was no work to do. Applications such as ptp4l will timeout after waiting a few milliseconds. Eventually, the watchdog service task will re-check for all quads and notice that there are outstanding timestamps, and issue a software interrupt to recover. However, by this point it is far too late, and applications have already failed.
All of this occurs because of the underlying hardware behavior. The PHY cannot raise a new interrupt signal until all outstanding timestamps have been read.
As a first step to fix this, switch the E825C hardware to the ICE_PTP_TX_INTERRUPT_ALL mode. In this mode, only the clock owner PF will respond to the PFINT_TSYN_TX cause. Other PFs disable this cause and will not wake. In this mode, the clock owner will iterate over all ports and handle timestamps for each connected port.
This matches the E822 behavior, and is a necessary but insufficient step to resolve the missing timestamps.
Even with use of the ICE_PTP_TX_INTERRUPT_ALL mode, we still sometimes miss a timestamp event. The ice_ptp_tx_tstamp_owner() does re-check the ready bitmap, but does so before re-enabling the OICR interrupt vector. It also only checks the ready bitmap, but not the software Tx timestamp tracker.
To avoid risk of losing a timestamp, refactor the logic to check both the software Tx timestamp tracker bitmap *and* the hardware ready bitmap. Additionally, do this outside of ice_ptp_process_ts() after we have already re-enabled the OICR interrupt.
Remove the checks from the ice_ptp_tx_tstamp(), ice_ptp_tx_tstamp_owner(), and the ice_ptp_process_ts() functions. This results in ice_ptp_tx_tstamp() being nothing more than a wrapper around ice_ptp_process_tx_tstamp() so we can remove it.
Add the ice_ptp_tx_tstamps_pending() function which returns a boolean indicating if there are any pending Tx timestamps. First, check the software timestamp tracker bitmap. In ICE_PTP_TX_INTERRUPT_ALL mode, check *all* ports software trackers. If a tracker has outstanding timestamp requests, return true. Additionally, check the PHY ready bitmap to confirm if the PHY indicates any outstanding timestamps.
In the ice_misc_thread_fn(), call ice_ptp_tx_tstamps_pending() just before returning from the IRQ thread handler. If it returns true, write to PFINT_OICR to trigger a PFINT_OICR_TSYN_TX_M software interrupt. This will force the handler to interrupt again and complete the work even if the PHY hardware did not interrupt for any reason.
This results in the following new flow for handling Tx timestamps:
1) send Tx packet
2) PHY captures timestamp
3) PHY triggers MAC interrupt
4) clock owner executes ice_misc_intr() with PFINT_OICR_TSYN_TX flag set
5) ice_ptp_ts_irq() returns IRQ_WAKE_THREAD
7) The interrupt thread wakes up and kernel calls ice_misc_intr_thread_fn()
8) ice_ptp_process_ts() is called to handle any outstanding timestamps
9) ice_irq_dynamic_ena() is called to re-enable the OICR hardware interrupt cause
10) ice_ptp_tx_tstamps_pending() is called to check if we missed any more outstanding timestamps, checking both software and hardware indicators.
With this change, it should no longer be possible for new timestamps to come in such a way that we lose an interrupt. If a timestamp comes in before the ice_ptp_tx_tstamps_pending() call, it will be noticed by at least one of the software bitmap check or the hardware bitmap check. If the timestamp comes in *after* this check, it should cause a timestamp interrupt as we have already read all timestamps from the PHY and the OICR vector has been re-enabled.
--- drivers/net/ethernet/intel/ice/ice_main.c | 20 +-- drivers/net/ethernet/intel/ice/ice_ptp.c | 148 ++++++++++++---------- drivers/net/ethernet/intel/ice/ice_ptp.h | 13 +- 3 files changed, 103 insertions(+), 78 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +11 -9
@@ -3323,18 +3323,20 @@ static irqreturn_t ice_misc_intr_thread_fn(int __always_unused irq, void *data)if (ice_is_reset_in_progress (pf->state)) goto skip_irq; -if (test_and_clear_bit (ICE_MISC_THREAD_TX_TSTAMP , pf->misc_thread)) { -/* Process outstanding Tx timestamps. If there is more work, -* re-arm the interrupt to trigger again. -*/ -if (ice_ptp_process_ts (pf) ==ICE_TX_TSTAMP_WORK_PENDING ) { -wr32 (hw,PFINT_OICR ,PFINT_OICR_TSYN_TX_M ); -ice_flush (hw); - } - } +if (test_and_clear_bit (ICE_MISC_THREAD_TX_TSTAMP , pf->misc_thread)) +ice_ptp_process_ts (pf); skip_irq:ice_irq_dynamic_ena (hw,NULL ,NULL ); +ice_flush (hw); + +if (ice_ptp_tx_tstamps_pending (pf)) { +/* If any new Tx timestamps happened while in interrupt, +* re-arm the interrupt to trigger it again. +*/ +wr32 (hw,PFINT_OICR ,PFINT_OICR_TSYN_TX_M ); +ice_flush (hw); + }return IRQ_HANDLED ; }
drivers/net/ethernet/intel/ice/ice_ptp.c +84 -64
198 lines not on this page · raw message
drivers/net/ethernet/intel/ice/ice_ptp.h +8 -5
@@ -302,8 +302,9 @@ void ice_ptp_extts_event(struct ice_pf *pf);s8 ice_ptp_request_ts (struct ice_ptp_tx *tx,struct sk_buff *skb);void ice_ptp_req_tx_single_tstamp (struct ice_ptp_tx *tx,u8 idx);void ice_ptp_complete_tx_single_tstamp (struct ice_ptp_tx *tx); -enum ice_tx_tstamp_work ice_ptp_process_ts (struct ice_pf *pf); +void ice_ptp_process_ts (struct ice_pf *pf);irqreturn_t ice_ptp_ts_irq (struct ice_pf *pf); +bool ice_ptp_tx_tstamps_pending (struct ice_pf *pf);u64 ice_ptp_read_src_clk_reg (struct ice_pf *pf,struct ptp_system_timestamp *sts);
@@ -343,16 +344,18 @@ static inline void ice_ptp_req_tx_single_tstamp(struct ice_ptp_tx *tx, u8 idx)static inline void ice_ptp_complete_tx_single_tstamp (struct ice_ptp_tx *tx) { } -static inline bool ice_ptp_process_ts (struct ice_pf *pf) -{ -return true; -} +static inline void ice_ptp_process_ts (struct ice_pf *pf) { }static inline irqreturn_t ice_ptp_ts_irq (struct ice_pf *pf) {return IRQ_HANDLED ; } +static inline bool ice_ptp_tx_tstamps_pending (struct ice_pf *pf) +{ +return false; +} +static inline u64 ice_ptp_read_src_clk_reg (struct ice_pf *pf,struct ptp_system_timestamp *sts) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/175 ice: Fix PTP NULL pointer dereference during VSI rebuild
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
[ Upstream commit fc6f36eaaedcf4b81af6fe1a568f018ffd530660 ]
Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.
The sequence was:
1. ice_ptp_prepare_for_reset() cancels PTP work
2. ice_ptp_rebuild() immediately queues PTP work
3. VSI rebuild happens AFTER ice_ptp_rebuild()
4. PTP work runs and accesses NULL vsi->rx_rings
Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().
Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.
Error log:
[ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>
--- drivers/net/ethernet/intel/ice/ice_main.c | 3 +++ drivers/net/ethernet/intel/ice/ice_ptp.c | 26 ++++++++++++++++++----- drivers/net/ethernet/intel/ice/ice_ptp.h | 5 +++++ 3 files changed, 29 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +3 -0
@@ -7815,6 +7815,9 @@ static void ice_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type)/* Restore timestamp mode settings after VSI rebuild */ ice_ptp_restore_timestamp_mode (pf); + +/* Start PTP periodic work after VSI is fully rebuilt */ +ice_ptp_queue_work (pf);return ; err_vsi_rebuild:
drivers/net/ethernet/intel/ice/ice_ptp.c +21 -5
@@ -2832,6 +2832,20 @@ static void ice_ptp_periodic_work(struct kthread_work *work) msecs_to_jiffies(err ? 10 : 500)); } +/** +* ice_ptp_queue_work - Queue PTP periodic work for a PF +* @pf: Board private structure +* +* Helper function to queue PTP periodic work after VSI rebuild completes. +* This ensures that PTP work only runs when VSI structures are ready. +*/ +void ice_ptp_queue_work (struct ice_pf *pf) +{ +if (test_bit (ICE_FLAG_PTP_SUPPORTED , pf->flags) && + pf->ptp.state ==ICE_PTP_READY ) +kthread_queue_delayed_work (pf->ptp.kworker, &pf->ptp.work,0 ); +} +/** * ice_ptp_prepare_rebuild_sec - Prepare second NAC for PTP reset or rebuild * @pf: Board private structure
@@ -2850,10 +2864,15 @@ static void ice_ptp_prepare_rebuild_sec(struct ice_pf *pf, bool rebuild,struct ice_pf *peer_pf =ptp_port_to_pf (port);if (!ice_is_primary (&peer_pf->hw)) { -if (rebuild) +if (rebuild) { +/* TODO: When implementing rebuild=true: +* 1. Ensure secondary PFs' VSIs are rebuilt +* 2. Call ice_ptp_queue_work(peer_pf) after VSI rebuild +*/ ice_ptp_rebuild (peer_pf, reset_type); -else + }else {ice_ptp_prepare_for_reset (peer_pf, reset_type); + } } } }
@@ -2999,9 +3018,6 @@ void ice_ptp_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type) ptp->state =ICE_PTP_READY ; -/* Start periodic work going */ -kthread_queue_delayed_work (ptp->kworker, &ptp->work,0 ); -dev_info (ice_pf_to_dev (pf),"PTP reset successful\n" );return ;
drivers/net/ethernet/intel/ice/ice_ptp.h +5 -0
@@ -316,6 +316,7 @@ void ice_ptp_prepare_for_reset(struct ice_pf *pf,void ice_ptp_init (struct ice_pf *pf);void ice_ptp_release (struct ice_pf *pf);void ice_ptp_link_change (struct ice_pf *pf,bool linkup); +void ice_ptp_queue_work (struct ice_pf *pf);#else /* IS_ENABLED(CONFIG_PTP_1588_CLOCK) */ static inline int ice_ptp_hwtstamp_get(struct net_device *netdev,
@@ -384,6 +385,10 @@ static inline void ice_ptp_link_change(struct ice_pf *pf, bool linkup) { } +static inline void ice_ptp_queue_work (struct ice_pf *pf) +{ +} +static inline int ice_ptp_clock_index (struct ice_pf *pf) {return -1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/175 ice: drop udp_tunnel_get_rx_info() call from ndo_open()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammad Heib <[email protected]>
[ Upstream commit 234e615bfece9e3e91c50fe49ab9e68ee37c791a ]
The ice driver calls udp_tunnel_get_rx_info() during ice_open_internal(). This is redundant because UDP tunnel RX offload state is preserved across device down/up cycles. The udp_tunnel core handles synchronization automatically when required.
Furthermore, recent changes in the udp_tunnel infrastructure require querying RX info while holding the udp_tunnel lock. Calling it directly from the ndo_open path violates this requirement, triggering the following lockdep warning:
Call Trace: <TASK> ice_open_internal+0x253/0x350 [ice] __udp_tunnel_nic_assert_locked+0x86/0xb0 [udp_tunnel] __dev_open+0x2f5/0x880 __dev_change_flags+0x44c/0x660 netif_change_flags+0x80/0x160 devinet_ioctl+0xd21/0x15f0 inet_ioctl+0x311/0x350 sock_ioctl+0x114/0x220 __x64_sys_ioctl+0x131/0x1a0 ... </TASK>
Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from ice_open_internal() to resolve the locking violation
--- drivers/net/ethernet/intel/ice/ice_main.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +0 -3
@@ -9678,9 +9678,6 @@ int ice_open_internal(struct net_device *netdev)netdev_err (netdev,"Failed to open VSI 0x%04X on switch 0x%04X\n" , vsi->vsi_num, vsi->vsw->sw_id); -/* Update existing tunnels information */ -udp_tunnel_get_rx_info (netdev); -return err; }
Signature · 1 line
2.51.0