5.15.201-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.15.201-rc1 review
This is the start of the stable review cycle for the 5.15.201 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.201-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.201-rc1
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit FN920C04 RNDIS compositions
Yongpeng Yang <[email protected]>
f2fs: fix out-of-bounds access in sysfs attribute read/write
Chao Yu <[email protected]>
f2fs: fix to avoid UAF in f2fs_write_end_io()
Greg Kroah-Hartman <[email protected]>
fbdev: smscufx: properly copy ioctl memory to kernelspace
Guangshuo Li <[email protected]>
fbdev: rivafb: fix divide error in nv3_arb()
Liu Song <[email protected]>
PCI: endpoint: Avoid creating sub-groups asynchronously
Christophe JAILLET <[email protected]>
PCI: endpoint: Remove unused field in struct pci_epf_group
Damien Le Moal <[email protected]>
PCI: endpoint: Automatically create a function specific attributes group
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Free sp in error path to fix system crash
Quinn Tran <[email protected]>
scsi: qla2xxx: Reduce fabric scan duplicate code
Quinn Tran <[email protected]>
scsi: qla2xxx: Remove dead code (GNN ID)
Gleb Chesnokov <[email protected]>
scsi: qla2xxx: Use named initializers for port_[d]state_str
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Fix bsg_done() causing double free
Gui-Dong Han <[email protected]>
bus: fsl-mc: fix use-after-free in driver_override_show()
Chelsy Ratnawat <[email protected]>
bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions
Henrique Carvalho <[email protected]>
smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
Bibo Mao <[email protected]>
crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req
Eric Dumazet <[email protected]>
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: pm: ensure unknown flags are ignored
Vladimir Oltean <[email protected]>
net: dsa: free routing table on probe failure
Paulo Alcantara <[email protected]>
smb: client: set correct id, uid and cruid for multiuser automounts
Boris Burkov <[email protected]>
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
Daniel Borkmann <[email protected]>
Revert "wireguard: device: enable threaded NAPI"
Alban Bedel <[email protected]>
gpiolib: acpi: Fix gpio count with string references
Ziyi Guo <[email protected]>
ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
Rafael J. Wysocki <[email protected]>
platform/x86: panasonic-laptop: Fix sysfs group leak in error path
Rafael J. Wysocki <[email protected]>
platform/x86: classmate-laptop: Add missing NULL pointer checks
Brahmajit Das <[email protected]>
drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
Deepanshu Kartikey <[email protected]>
romfs: check sb_set_blocksize() return value
Xuewen Yan <[email protected]>
gpio: sprd: Change sprd_gpio lock to raw_spin_lock
Tim Guttzeit <[email protected]>
ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
Danilo Krummrich <[email protected]>
gpio: omap: do not register driver in probe()
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Query FW again before proceeding with login
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Delay module unload while fabric scan in progress
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Validate sp before freeing associated memory
Edward Adam Davis <[email protected]>
nilfs2: Fix potential block overflow that cause system hang
Bibo Mao <[email protected]>
crypto: virtio - Add spinlock protection with virtqueue notification
Kees Cook <[email protected]>
crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
Thorsten Blum <[email protected]>
crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
-------------
Diffstat:
Documentation/PCI/endpoint/pci-ntb-howto.rst | 11 +- Makefile | 4 +- drivers/bus/fsl-mc/fsl-mc-bus.c | 10 +- drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 2 +- drivers/crypto/omap-crypto.c | 2 +- drivers/crypto/virtio/virtio_crypto_algs.c | 2 - drivers/crypto/virtio/virtio_crypto_core.c | 5 + drivers/gpio/gpio-omap.c | 22 +- drivers/gpio/gpio-sprd.c | 8 +- drivers/gpio/gpiolib-acpi.c | 1 + drivers/gpu/drm/tegra/hdmi.c | 4 +- drivers/gpu/drm/tegra/sor.c | 4 +- drivers/net/wireguard/device.c | 1 - drivers/pci/endpoint/pci-ep-cfs.c | 54 +- drivers/platform/x86/classmate-laptop.c | 32 ++ drivers/platform/x86/panasonic-laptop.c | 4 +- drivers/scsi/qla2xxx/qla_bsg.c | 25 +- drivers/scsi/qla2xxx/qla_def.h | 50 +- drivers/scsi/qla2xxx/qla_gbl.h | 9 +- drivers/scsi/qla2xxx/qla_gs.c | 586 ++++++++-------------- drivers/scsi/qla2xxx/qla_init.c | 31 +- drivers/scsi/qla2xxx/qla_isr.c | 29 +- drivers/scsi/qla2xxx/qla_os.c | 18 +- drivers/usb/serial/option.c | 6 + drivers/video/fbdev/riva/riva_hw.c | 3 + drivers/video/fbdev/smscufx.c | 8 +- fs/btrfs/block-group.c | 6 +- fs/btrfs/space-info.c | 20 +- fs/btrfs/space-info.h | 6 +- fs/cifs/cifs_dfs_ref.c | 16 + fs/f2fs/data.c | 12 +- fs/f2fs/sysfs.c | 65 ++- fs/ksmbd/transport_tcp.c | 3 +- fs/nilfs2/sufile.c | 4 + fs/romfs/super.c | 5 +- net/dsa/dsa2.c | 21 +- net/mptcp/pm_netlink.c | 16 +- sound/pci/hda/patch_realtek.c | 4 + sound/soc/fsl/fsl_xcvr.c | 3 + tools/testing/selftests/net/mptcp/pm_netlink.sh | 4 + tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 11 + 41 files changed, 576 insertions(+), 551 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/39 crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit 5565a72b24fa7935a9f30af386e92c8c9dfb23b9 upstream.
OTX_CPT_UCODE_NAME_LENGTH limits the microcode name to 64 bytes. If a user writes a string of exactly 64 characters, the original code used 'strlen(buf) > 64' to check the length, but then strscpy() copies only 63 characters before adding a NUL terminator, silently truncating the copied string.
Fix this off-by-one error by using 'count' directly for the length check to ensure long names are rejected early and copied without truncation.
--- drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c +1 -1
@@ -1337,7 +1337,7 @@ static ssize_t ucode_load_store(struct dint del_grp_idx =-1 ;int ucode_idx =0 ; -if (strlen (buf) >OTX_CPT_UCODE_NAME_LENGTH ) +if (count >=OTX_CPT_UCODE_NAME_LENGTH )return -EINVAL ; eng_grps = container_of(attr, struct otx_cpt_eng_grps, ucode_load_attr);
Greg Kroah-Hartman
maintainerPATCH 2/39 crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 1562b1fb7e17c1b3addb15e125c718b2be7f5512 upstream.
The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation.
Use sizeof(*new_sg) to get the correct object size.
--- drivers/crypto/omap-crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/omap-crypto.c +1 -1
@@ -21,7 +21,7 @@ static int omap_crypto_copy_sg_lists(intstruct scatterlist *tmp;if (!(flags &OMAP_CRYPTO_FORCE_SINGLE_ENTRY )) { - new_sg =kmalloc_array (n,sizeof (*sg),GFP_KERNEL ); + new_sg =kmalloc_array (n,sizeof (*new_sg),GFP_KERNEL );if (!new_sg)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 3/39 crypto: virtio - Add spinlock protection with virtqueue notification
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit b505047ffc8057555900d2d3a005d033e6967382 upstream.
When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as
openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32
openssl processes will hangup and there is error reported like this:
virtio_crypto virtio0: dataq.0:id 3 is not a head!
It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well.
--- drivers/crypto/virtio/virtio_crypto_core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/crypto/virtio/virtio_crypto_core.c +5 -0
@@ -27,15 +27,20 @@ static void virtcrypto_done_task(unsignestruct data_queue *data_vq = (struct data_queue *)data;struct virtqueue *vq = data_vq->vq;struct virtio_crypto_request *vc_req; +unsigned long flags;unsigned int len; +spin_lock_irqsave (&data_vq->lock, flags);do {virtqueue_disable_cb (vq);while ((vc_req =virtqueue_get_buf (vq, &len)) !=NULL ) { +spin_unlock_irqrestore (&data_vq->lock, flags);if (vc_req->alg_cb) vc_req->alg_cb (vc_req, len); +spin_lock_irqsave (&data_vq->lock, flags); } }while (!virtqueue_enable_cb (vq)); +spin_unlock_irqrestore (&data_vq->lock, flags); }static void virtcrypto_dataq_callback (struct virtqueue *vq)
Greg Kroah-Hartman
maintainerPATCH 4/39 nilfs2: Fix potential block overflow that cause system hang
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit ed527ef0c264e4bed6c7b2a158ddf516b17f5f66 upstream.
When a user executes the FITRIM command, an underflow can occur when calculating nblocks if end_block is too small. Since nblocks is of type sector_t, which is u64, a negative nblocks value will become a very large positive integer. This ultimately leads to the block layer function __blkdev_issue_discard() taking an excessively long time to process the bio chain, and the ns_segctor_sem lock remains held for a long period. This prevents other tasks from acquiring the ns_segctor_sem lock, resulting in the hang reported by syzbot in [1].
If the ending block is too small, typically if it is smaller than 4KiB range, depending on the usage of the segment 0, it may be possible to attempt a discard request beyond the device size causing the hang.
Exiting successfully and assign the discarded size (0 in this case) to range->len.
Although the start and len values in the user input range are too small, a conservative strategy is adopted here to safely ignore them, which is equivalent to a no-op; it will not perform any trimming and will not throw an error.
[1]
task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000
Call Trace: rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272 nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline] nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684
[ryusuke: corrected part of the commit message about the consequences]
--- fs/nilfs2/sufile.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/nilfs2/sufile.c +4 -0
@@ -1091,6 +1091,9 @@ int nilfs_sufile_trim_fs(struct inode *selse end_block = start_block + len -1 ; +if (end_block < nilfs->ns_first_data_block) + goto out; + segnum =nilfs_get_segnum_of_block (nilfs, start_block); segnum_end =nilfs_get_segnum_of_block (nilfs, end_block);
@@ -1188,6 +1191,7 @@ int nilfs_sufile_trim_fs(struct inode *s out_sem:up_read (&NILFS_MDT (sufile)->mi_sem); +out: range->len = ndiscarded << nilfs->ns_blocksize_bits;return ret; }
Greg Kroah-Hartman
maintainerPATCH 5/39 scsi: qla2xxx: Validate sp before freeing associated memory
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <[email protected]>
commit b6df15aec8c3441357d4da0eaf4339eb20f5999f upstream.
System crash with the following signature
[154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete
[154564.169363] qla2xxx [0000:b0:00.1]-3002:2: nvme: Sched: Set ZIO exchange threshold to 3.
[154564.169405] qla2xxx [0000:b0:00.1]-ffffff:2: SET ZIO Activity exchange threshold to 5.
[154565.539974] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 0080 0000.
[154565.545744] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 00a0 0000.
[154565.545857] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate).
[154565.552760] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate).
[154565.553079] BUG: kernel NULL pointer dereference, address: 00000000000000f8
[154565.553080] #PF: supervisor read access in kernel mode
[154565.553082] #PF: error_code(0x0000) - not-present page
[154565.553084] PGD 80000010488ab067 P4D 80000010488ab067 PUD 104978a067 PMD 0
[154565.553089] Oops: 0000 1 PREEMPT SMP PTI
[154565.553092] CPU: 10 PID: 858 Comm: qla2xxx_2_dpc Kdump: loaded Tainted: G OE ------- --- 5.14.0-503.11.1.el9_5.x86_64 #1
[154565.553096] Hardware name: HPE Synergy 660 Gen10/Synergy 660 Gen10 Compute Module, BIOS I43 09/30/2024
[154565.553097] RIP: 0010:qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx]
[154565.553141] Code: 00 00 e8 58 a3 ec d4 49 89 e9 ba 12 20 00 00 4c 89 e6 49 c7 c0 00 ee a8 c0 48 c7 c1 66 c0 a9 c0 bf 00 80 00 10 e8 15 69 00 00 <4c> 8b 8d f8 00 00 00 4d 85 c9 74 35 49 8b 84 24 00 19 00 00 48 8b
[154565.553143] RSP: 0018:ffffb4dbc8aebdd0 EFLAGS: 00010286
[154565.553145] RAX: 0000000000000000 RBX: ffff8ec2cf0908d0 RCX: 0000000000000002
[154565.553147] RDX: 0000000000000000 RSI: ffffffffc0a9c896 RDI: ffffb4dbc8aebd47
[154565.553148] RBP: 0000000000000000 R08: ffffb4dbc8aebd45 R09: 0000000000ffff0a
[154565.553150] R10: 0000000000000000 R11: 000000000000000f R12: ffff8ec2cf0908d0
[154565.553151] R13: ffff8ec2cf090900 R14: 0000000000000102 R15: ffff8ec2cf084000
[154565.553152] FS: 0000000000000000(0000) GS:ffff8ed27f800000(0000) knlGS:0000000000000000
[154565.553154] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[154565.553155] CR2: 00000000000000f8 CR3: 000000113ae0a005 CR4: 00000000007706f0
[154565.553157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[154565.553158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[154565.553159] PKRU: 55555554
[154565.553160] Call Trace:
[154565.553162] <TASK>
[154565.553165] ? show_trace_log_lvl+0x1c4/0x2df
[154565.553172] ? show_trace_log_lvl+0x1c4/0x2df
[154565.553177] ? qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx]
[154565.553215] ? __die_body.cold+0x8/0xd
[154565.553218] ? page_fault_oops+0x134/0x170
[154565.553223] ? snprintf+0x49/0x70
[154565.553229] ? exc_page_fault+0x62/0x150
[154565.553238] ? asm_exc_page_fault+0x22/0x30Check for sp being non NULL before freeing any associated memory
--- drivers/scsi/qla2xxx/qla_gs.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-)
drivers/scsi/qla2xxx/qla_gs.c +18 -16
@@ -4166,23 +4166,25 @@ int qla24xx_async_gpnft(scsi_qla_host_treturn rval; done_free_sp: -if (sp->u.iocb_cmd.u.ctarg.req) { -dma_free_coherent (&vha->hw->pdev->dev, - sp->u.iocb_cmd.u.ctarg.req_allocated_size, - sp->u.iocb_cmd.u.ctarg.req, - sp->u.iocb_cmd.u.ctarg.req_dma); - sp->u.iocb_cmd.u.ctarg.req =NULL ; - } -if (sp->u.iocb_cmd.u.ctarg.rsp) { -dma_free_coherent (&vha->hw->pdev->dev, - sp->u.iocb_cmd.u.ctarg.rsp_allocated_size, - sp->u.iocb_cmd.u.ctarg.rsp, - sp->u.iocb_cmd.u.ctarg.rsp_dma); - sp->u.iocb_cmd.u.ctarg.rsp =NULL ; - } +if (sp) { +if (sp->u.iocb_cmd.u.ctarg.req) { +dma_free_coherent (&vha->hw->pdev->dev, + sp->u.iocb_cmd.u.ctarg.req_allocated_size, + sp->u.iocb_cmd.u.ctarg.req, + sp->u.iocb_cmd.u.ctarg.req_dma); + sp->u.iocb_cmd.u.ctarg.req =NULL ; + } +if (sp->u.iocb_cmd.u.ctarg.rsp) { +dma_free_coherent (&vha->hw->pdev->dev, + sp->u.iocb_cmd.u.ctarg.rsp_allocated_size, + sp->u.iocb_cmd.u.ctarg.rsp, + sp->u.iocb_cmd.u.ctarg.rsp_dma); + sp->u.iocb_cmd.u.ctarg.rsp =NULL ; + } -/* ref: INIT */ -kref_put (&sp->cmd_kref, qla2x00_sp_release); +/* ref: INIT */ +kref_put (&sp->cmd_kref, qla2x00_sp_release); + }spin_lock_irqsave (&vha->work_lock, flags); vha->scan.scan_flags &= ~SF_SCANNING ;
Greg Kroah-Hartman
maintainerPATCH 6/39 scsi: qla2xxx: Delay module unload while fabric scan in progress
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <[email protected]>
commit 8890bf450e0b6b283f48ac619fca5ac2f14ddd62 upstream.
System crash seen during load/unload test in a loop.
[105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] [105954.384999] ? __wake_up_common+0x80/0x190 [105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] [105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 [105954.385044] ? handle_irq_event+0x58/0xb0 [105954.385046] ? handle_edge_irq+0x93/0x240 [105954.385050] ? __common_interrupt+0x41/0xa0 [105954.385055] ? common_interrupt+0x3e/0xa0 [105954.385060] ? asm_common_interrupt+0x22/0x40
The root cause of this was that there was a free (dma_free_attrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash.
--- drivers/scsi/qla2xxx/qla_os.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_os.c +2 -1
@@ -1216,7 +1216,8 @@ qla2x00_wait_for_hba_ready(scsi_qla_hostwhile ((qla2x00_reset_active (vha) || ha->dpc_active || ha->flags.mbox_busy) ||test_bit (FX00_RESET_RECOVERY , &vha->dpc_flags) || -test_bit (FX00_TARGET_SCAN , &vha->dpc_flags)) { +test_bit (FX00_TARGET_SCAN , &vha->dpc_flags) || + (vha->scan.scan_flags &SF_SCANNING )) {if (test_bit (UNLOADING , &base_vha->dpc_flags))break ;msleep (1000 );
Greg Kroah-Hartman
maintainerPATCH 7/39 scsi: qla2xxx: Query FW again before proceeding with login
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <[email protected]>
commit 42b2dab4340d39b71334151e10c6d7d9b0040ffa upstream.
Issue occurred during a continuous reboot test of several thousand iterations specific to a fabric topo with dual mode target where it sends a PLOGI/PRLI and then sends a LOGO. The initiator was also in the process of discovery and sent a PLOGI to the switch. It then queried a list of ports logged in via mbx 75h and the GPDB response indicated that the target was logged in. This caused a mismatch in the states between the driver and FW. Requery the FW for the state and proceed with the rest of discovery process.
--- drivers/scsi/qla2xxx/qla_init.c | 19 +++++++++++++++++-- drivers/scsi/qla2xxx/qla_isr.c | 19 +++++++++++++++++-- 2 files changed, 34 insertions(+), 4 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +17 -2
@@ -2473,8 +2473,23 @@ qla24xx_handle_plogi_done_event(struct s ea->sp->gen1, fcport->rscn_gen, ea->data[0], ea->data[1], ea->iop[0], ea->iop[1]); -if ((fcport->fw_login_state ==DSC_LS_PLOGI_PEND ) || - (fcport->fw_login_state ==DSC_LS_PRLI_PEND )) { +if (fcport->fw_login_state ==DSC_LS_PLOGI_PEND ) { +ql_dbg (ql_dbg_disc, vha,0x20ea , +"%s %d %8phC Remote is trying to login\n" , + __func__, __LINE__, fcport->port_name); +/* +* If we get here, there is port thats already logged in, +* but it's state has not moved ahead. Recheck with FW on +* what state it is in and proceed ahead +*/ +if (!N2N_TOPO (vha->hw)) { + fcport->fw_login_state =DSC_LS_PRLI_COMP ; +qla24xx_post_gpdb_work (vha, fcport,0 ); + } +return ; + } + +if (fcport->fw_login_state ==DSC_LS_PRLI_PEND ) {ql_dbg (ql_dbg_disc, vha,0x20ea ,"%s %d %8phC Remote is trying to login\n" , __func__, __LINE__, fcport->port_name);
drivers/scsi/qla2xxx/qla_isr.c +17 -2
@@ -1524,13 +1524,28 @@ skip_rio:/* Port logout */ fcport =qla2x00_find_fcport_by_loopid (vha, mb[1 ]); -if (!fcport) +if (!fcport) { +ql_dbg (ql_dbg_async, vha,0x5011 , +"Could not find fcport:%04x %04x %04x\n" , + mb[1 ], mb[2 ], mb[3 ]);break ; -if (atomic_read (&fcport->state) !=FCS_ONLINE ) + } + +if (atomic_read (&fcport->state) !=FCS_ONLINE ) { +ql_dbg (ql_dbg_async, vha,0x5012 , +"Port state is not online State:0x%x \n" , +atomic_read (&fcport->state)); +ql_dbg (ql_dbg_async, vha,0x5012 , +"Scheduling session for deletion \n" ); + fcport->logout_on_delete =0 ; +qlt_schedule_sess_for_deletion (fcport);break ; + } +ql_dbg (ql_dbg_async, vha,0x508a ,"Marking port lost loopid=%04x portid=%06x.\n" , fcport->loop_id, fcport->d_id.b24); +if (qla_ini_mode_enabled (vha)) { fcport->logout_on_delete =0 ;qlt_schedule_sess_for_deletion (fcport);
Greg Kroah-Hartman
maintainerPATCH 8/39 gpio: omap: do not register driver in probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
commit 730e5ebff40c852e3ea57b71bf02a4b89c69435f upstream.
Commit 11a78b794496 ("ARM: OMAP: MPUIO wake updates") registers the omap_mpuio_driver from omap_mpuio_init(), which is called from omap_gpio_probe().
However, it neither makes sense to register drivers from probe() callbacks of other drivers, nor does the driver core allow registering drivers with a device lock already being held.
The latter was revealed by commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") leading to a potential deadlock condition described in [1].
Additionally, the omap_mpuio_driver is never unregistered from the driver core, even if the module is unloaded.
Hence, register the omap_mpuio_driver from the module initcall and unregister it in module_exit().
--- drivers/gpio/gpio-omap.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/gpio/gpio-omap.c +18 -4
@@ -762,10 +762,13 @@ static struct platform_device omap_mpuiostatic inline void omap_mpuio_init (struct gpio_bank *bank) { -platform_set_drvdata (&omap_mpuio_device, bank); +static bool registered; -if (platform_driver_register (&omap_mpuio_driver) ==0 ) - (void )platform_device_register (&omap_mpuio_device); +platform_set_drvdata (&omap_mpuio_device, bank); +if (!registered) { + (void )platform_device_register (&omap_mpuio_device); + registered = true; + } }/*---------------------------------------------------------------------*/
@@ -1574,13 +1577,24 @@ static struct platform_driver omap_gpio_*/ static int __init omap_gpio_drv_reg (void ) { -return platform_driver_register (&omap_gpio_driver); +int ret; + + ret =platform_driver_register (&omap_mpuio_driver); +if (ret) +return ret; + + ret =platform_driver_register (&omap_gpio_driver); +if (ret) +platform_driver_unregister (&omap_mpuio_driver); + +return ret; }postcore_initcall (omap_gpio_drv_reg); static void __exit omap_gpio_exit(void) {platform_driver_unregister (&omap_gpio_driver); +platform_driver_unregister (&omap_mpuio_driver); }module_exit (omap_gpio_exit);
Greg Kroah-Hartman
maintainerPATCH 9/39 ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Guttzeit <[email protected]>
[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ]
Add a PCI quirk to enable microphone detection on the headphone jack of TongFang X6AR55xU devices.
--- sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/patch_realtek.c +4 -0
@@ -10133,6 +10133,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { {0x12, 0x90a60140}, {0x19, 0x04a11030}, {0x21, 0x04211020}), + SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, + {0x17, 0x90170110}, + {0x19, 0x03a11030}, + {0x21, 0x03211020}), SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, ALC282_STANDARD_PINS, {0x12, 0x90a609c0},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/39 gpio: sprd: Change sprd_gpio lock to raw_spin_lock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuewen Yan <[email protected]>
[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ]
There was a lockdep warning in sprd_gpio:
[ 6.258269][T329@C6] [ BUG: Invalid wait context ]
[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE
[ 6.258272][T329@C6] -----------------------------
[ 6.258273][T329@C6] modprobe/329 is trying to lock:
[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd]
[ 6.258282][T329@C6] other info that might help us debug this:
[ 6.258283][T329@C6] context-{5:5}
[ 6.258285][T329@C6] 3 locks held by modprobe/329:
[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204
[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c
[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c
[ 6.258313][T329@C6] stack backtrace:
[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df
[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT)
[ 6.258318][T329@C6] Call trace:
[ 6.258318][T329@C6] show_stack+0x20/0x30 (C)
[ 6.258321][T329@C6] __dump_stack+0x28/0x3c
[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0
[ 6.258326][T329@C6] dump_stack+0x18/0x3c
[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28
[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc
[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4
[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487]
[ 6.258337][T329@C6] irq_startup+0x238/0x350
[ 6.258340][T329@C6] __setup_irq+0x504/0x82c
[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184
[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120
[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350
[ 6.258361][T329@C6] really_probe+0x1a8/0x46c
[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c
[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4
[ 6.258369][T329@C6] __driver_attach+0xd0/0x204
[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168
[ 6.258373][T329@C6] driver_attach+0x2c/0x3c
[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c
[ 6.258378][T329@C6] driver_register+0x70/0x10c
[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8
[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c
[ 6.258392][T329@C6] do_init_module+0x60/0x254
[ 6.258395][T329@C6] load_module+0x1054/0x1220
[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c
[ 6.258400][T329@C6] invoke_syscall+0x60/0xec
[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4
[ 6.258405][T329@C6] do_el0_svc+0x24/0x30
[ 6.258407][T329@C6] el0_svc+0x54/0x1c4
[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc
[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8This is because the spin_lock would change to rt_mutex in PREEMPT_RT, however the sprd_gpio->lock would use in hard-irq, this is unsafe.
So change the spin_lock_t to raw_spin_lock_t to use the spinlock in hard-irq.
--- drivers/gpio/gpio-sprd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpio/gpio-sprd.c +4 -4
@@ -35,7 +35,7 @@struct sprd_gpio {struct gpio_chip chip;void __iomem *base; -spinlock_t lock; +raw_spinlock_t lock;int irq; };
@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,unsigned long flags;u32 tmp; -spin_lock_irqsave (&sprd_gpio->lock, flags); +raw_spin_lock_irqsave (&sprd_gpio->lock, flags); tmp =readl_relaxed (base + reg);if (val)
@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, tmp &= ~BIT (SPRD_GPIO_BIT (offset));writel_relaxed (tmp, base + reg); -spin_unlock_irqrestore (&sprd_gpio->lock, flags); +raw_spin_unlock_irqrestore (&sprd_gpio->lock, flags); }static int sprd_gpio_read (struct gpio_chip *chip,unsigned int offset,u16 reg)
@@ -231,7 +231,7 @@ static int sprd_gpio_probe(struct platform_device *pdev)if (IS_ERR (sprd_gpio->base))return PTR_ERR (sprd_gpio->base); -spin_lock_init (&sprd_gpio->lock); +raw_spin_lock_init (&sprd_gpio->lock); sprd_gpio->chip.label =dev_name (&pdev->dev); sprd_gpio->chip.ngpio =SPRD_GPIO_NR ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/39 romfs: check sb_set_blocksize() return value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ]
romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration.
This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device.
When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting.
The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh():
kernel BUG at fs/buffer.c:1582!
BUG_ON(size > PAGE_SIZE);Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0.
--- fs/romfs/super.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/romfs/super.c +4 -1
@@ -467,7 +467,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc)#ifdef CONFIG_BLOCK if (!sb->s_mtd) { -sb_set_blocksize (sb,ROMBSIZE ); +if (!sb_set_blocksize (sb,ROMBSIZE )) { +errorf (fc,"romfs: unable to set blocksize\n" ); +return -EINVAL ; + } }else { sb->s_blocksize =ROMBSIZE ; sb->s_blocksize_bits =blksize_bits (ROMBSIZE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/39 =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?= =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?=
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ]
The variable j is set, however never used in or outside the loop, thus resulting in dead code.
Building with GCC 16 results in a build error due to -Werror=unused-but-set-variable= enabled by default.
This patch clean up the dead code and fixes the build error.
Example build log:drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=]
1867 | size_t i, j;
| ^
--- drivers/gpu/drm/tegra/hdmi.c | 4 ++-- drivers/gpu/drm/tegra/sor.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/tegra/hdmi.c +2 -2
@@ -635,7 +635,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, {const u8 *ptr = data;unsigned long offset; -size_t i, j; +size_t i;u32 value;switch (ptr[0 ]) {
@@ -668,7 +668,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,* - subpack_low: bytes 0 - 3 * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) */ -for (i =3 , j =0 ; i < size; i +=7 , j +=8 ) { +for (i =3 ; i < size; i +=7 ) {size_t rem = size - i, num =min_t (size_t, rem,4 ); value =tegra_hdmi_subpack (&ptr[i], num);
drivers/gpu/drm/tegra/sor.c +2 -2
@@ -1860,7 +1860,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, {const u8 *ptr = data;unsigned long offset; -size_t i, j; +size_t i;u32 value;switch (ptr[0 ]) {
@@ -1893,7 +1893,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,* - subpack_low: bytes 0 - 3 * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) */ -for (i =3 , j =0 ; i < size; i +=7 , j +=8 ) { +for (i =3 ; i < size; i +=7 ) {size_t rem = size - i, num =min_t (size_t, rem,4 ); value =tegra_sor_hdmi_subpack (&ptr[i], num);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/39 platform/x86: classmate-laptop: Add missing NULL pointer checks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ]
In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it.
For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward.
Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur.
For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward.
Fix this by adding NULL pointer checks in all of the relevant places.
--- drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
drivers/platform/x86/classmate-laptop.c +32 -0
@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, acpi =to_acpi_device (dev); inputdev =dev_get_drvdata (&acpi->dev); +if (!inputdev) +return -ENXIO ; + accel =dev_get_drvdata (&inputdev->dev); +if (!accel) +return -ENXIO ;return sprintf (buf,"%d\n" , accel->sensitivity); }
@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, acpi =to_acpi_device (dev); inputdev =dev_get_drvdata (&acpi->dev); +if (!inputdev) +return -ENXIO ; + accel =dev_get_drvdata (&inputdev->dev); +if (!accel) +return -ENXIO ; r =kstrtoul (buf,0 , &sensitivity);if (r)
@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, acpi =to_acpi_device (dev); inputdev =dev_get_drvdata (&acpi->dev); +if (!inputdev) +return -ENXIO ; + accel =dev_get_drvdata (&inputdev->dev); +if (!accel) +return -ENXIO ;return sprintf (buf,"%d\n" , accel->g_select); }
@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, acpi =to_acpi_device (dev); inputdev =dev_get_drvdata (&acpi->dev); +if (!inputdev) +return -ENXIO ; + accel =dev_get_drvdata (&inputdev->dev); +if (!accel) +return -ENXIO ; r =kstrtoul (buf,0 , &g_select);if (r)
@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) acpi =to_acpi_device (input->dev.parent); accel =dev_get_drvdata (&input->dev); +if (!accel) +return -ENXIO ;cmpc_accel_set_sensitivity_v4 (acpi->handle, accel->sensitivity);cmpc_accel_set_g_select_v4 (acpi->handle, accel->g_select);
@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, acpi =to_acpi_device (dev); inputdev =dev_get_drvdata (&acpi->dev); +if (!inputdev) +return -ENXIO ; + accel =dev_get_drvdata (&inputdev->dev); +if (!accel) +return -ENXIO ;return sprintf (buf,"%d\n" , accel->sensitivity); }
@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, acpi =to_acpi_device (dev); inputdev =dev_get_drvdata (&acpi->dev); +if (!inputdev) +return -ENXIO ; + accel =dev_get_drvdata (&inputdev->dev); +if (!accel) +return -ENXIO ; r =kstrtoul (buf,0 , &sensitivity);if (r)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/39 platform/x86: panasonic-laptop: Fix sysfs group leak in error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ]
The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group if platform_device_register_simple() fails for the "panasonic" platform device.
Address this by making it call sysfs_remove_group() in that case for the group in question.
--- drivers/platform/x86/panasonic-laptop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/panasonic-laptop.c +3 -1
@@ -1073,7 +1073,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) -1, NULL, 0);if (IS_ERR (pcc->platform)) { result =PTR_ERR (pcc->platform); - goto out_backlight; + goto out_sysfs; } result =device_create_file (&pcc->platform->dev, &dev_attr_cdpower);
@@ -1089,6 +1089,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) out_platform:platform_device_unregister (pcc->platform); +out_sysfs: +sysfs_remove_group (&device->dev.kobj, &pcc_attr_group); out_backlight:backlight_device_unregister (pcc->backlight); out_input:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/39 ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ]
fsl_xcvr_activate_ctl() has lockdep_assert_held(&card->snd_card->controls_rwsem), but fsl_xcvr_mode_put() calls it without acquiring this lock.
Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read().
Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl() in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential race conditions when multiple userspace threads access the control.
--- sound/soc/fsl/fsl_xcvr.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/fsl/fsl_xcvr.c +3 -0
@@ -203,10 +203,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, xcvr->mode =snd_soc_enum_item_to_val (e, item[0 ]); +down_read (&card->snd_card->controls_rwsem);fsl_xcvr_activate_ctl (dai, fsl_xcvr_arc_mode_kctl.name, (xcvr->mode ==FSL_XCVR_MODE_ARC ));fsl_xcvr_activate_ctl (dai, fsl_xcvr_earc_capds_kctl.name, (xcvr->mode ==FSL_XCVR_MODE_EARC )); +up_read (&card->snd_card->controls_rwsem); +/* Allow playback for SPDIF only */ rtd =snd_soc_get_pcm_runtime (card, card->dai_link); rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count =
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/39 gpiolib: acpi: Fix gpio count with string references
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Bedel <[email protected]>
[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ]
Since commit 9880702d123f2 ("ACPI: property: Support using strings in reference properties") it is possible to use strings instead of local references. This work fine with single GPIO but not with arrays as acpi_gpio_package_count() didn't handle this case. Update it to handle strings like local references to cover this case as well.
--- drivers/gpio/gpiolib-acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpiolib-acpi.c +1 -0
@@ -1369,6 +1369,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj)while (element < end) {switch (element->type) {case ACPI_TYPE_LOCAL_REFERENCE : +case ACPI_TYPE_STRING : element +=3 ; fallthrough;case ACPI_TYPE_INTEGER :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/39 Revert "wireguard: device: enable threaded NAPI"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
This reverts commit 18e65229a328304a7ef59899a30fd34ad73ed56b which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream.
We have had three independent production user reports in combination with Cilium utilizing WireGuard as encryption underneath that k8s Pod E/W traffic to certain peer nodes fully stalled. The situation appears as follows:
- Occurs very rarely but at random times under heavy networking load.
- Once the issue triggers the decryption side stops working completely for that WireGuard peer, other peers keep working fine. The stall happens also for newly initiated connections towards that particular WireGuard peer.
- Only the decryption side is affected, never the encryption side.
- Once it triggers, it never recovers and remains in this state, the CPU/mem on that node looks normal, no leak, busy loop or crash.
- bpftrace on the affected system shows that wg_prev_queue_enqueue fails, thus the MAX_QUEUED_PACKETS (1024 skbs!) for the peer's rx_queue is reached.
- Also, bpftrace shows that wg_packet_rx_poll for that peer is never called again after reaching this state for that peer. For other peers wg_packet_rx_poll does get called normally.
- Commit db9ae3b ("wireguard: device: enable threaded NAPI") switched WireGuard to threaded NAPI by default. The default has not been changed for triggering the issue, neither did CPU hotplugging occur (i.e. 5bd8de2 ("wireguard: queueing: always return valid online CPU in wg_cpumask_choose_online()")).
- The issue has been observed with stable kernels of v5.15 as well as v6.1. It was reported to us that v5.10 stable is working fine, and no report on v6.6 stable either (somewhat related discussion in [0] though).
- In the WireGuard driver the only material difference between v5.10 stable and v5.15 stable is the switch to threaded NAPI by default.
[0] https://lore.kernel.org/netdev/CA+wXwBTT74RErDGAnj98PqS=wvdh8eM1pi4q6tTdExtjnokKqA@mail.gmail.com/
Breakdown of the problem:
1) skbs arriving for decryption are enqueued to the peer->rx_queue in wg_packet_consume_data via wg_queue_enqueue_per_device_and_peer.
2) The latter only moves the skb into the MPSC peer queue if it does not surpass MAX_QUEUED_PACKETS (1024) which is kept track in an atomic counter via wg_prev_queue_enqueue.
3) In case enqueueing was successful, the skb is also queued up in the device queue, round-robin picks a next online CPU, and schedules the decryption worker.
4) The wg_packet_decrypt_worker, once scheduled, picks these up from the queue, decrypts the packets and once done calls into wg_queue_enqueue_per_peer_rx.
5) The latter updates the state to PACKET_STATE_CRYPTED on success
and calls napi_schedule on the per peer->napi instance.
6) NAPI then polls via wg_packet_rx_poll. wg_prev_queue_peek checks
on the peer->rx_queue. It will wg_prev_queue_dequeue if the
queue->peeked skb was not cached yet, or just return the latter
otherwise. (wg_prev_queue_drop_peeked later clears the cache.) 7) From an ordering perspective, the peer->rx_queue has skbs in order while the device queue with the per-CPU worker threads from a global ordering PoV can finish the decryption and signal the skb PACKET_STATE_CRYPTED out of order.
8) A situation can be observed that the first packet coming in will be stuck waiting for the decryption worker to be scheduled for a longer time when the system is under pressure.
9) While this is the case, the other CPUs in the meantime finish decryption and call into napi_schedule.
10) Now in wg_packet_rx_poll it picks up the first in-order skb from the peer->rx_queue and sees that its state is still PACKET_STATE_UNCRYPTED. The NAPI poll routine then exits early with work_done = 0 and calls napi_complete_done, signalling it "finished" processing.
11) The assumption in wg_packet_decrypt_worker is that when the decryption finished the subsequent napi_schedule will always lead to a later invocation of wg_packet_rx_poll to pick up the finished packet.
12) However, it appears that a later napi_schedule does /not/ schedule a later poll and thus no wg_packet_rx_poll.
13) If this situation happens exactly for the corner case where the decryption worker of the first packet is stuck and waiting to be scheduled, and the network load for WireGuard is very high then the queue can build up to MAX_QUEUED_PACKETS.
14) If this situation occurs, then no new decryption worker will be scheduled and also no new napi_schedule to make forward progress.
15) This means the peer->rx_queue stops processing packets completely and they are indefinitely stuck waiting for a new NAPI poll on that peer which never happens. New packets for that peer are then dropped due to full queue, as it has been observed on the production machines.
Technically, the backport of commit db9ae3b6b43c ("wireguard: device:
enable threaded NAPI") to stable should not have happened since it is more of an optimization rather than a pure fix and addresses a NAPI situation with utilizing many WireGuard tunnel devices in parallel. Revert it from stable given the backport triggers a regression for mentioned kernels.
--- drivers/net/wireguard/device.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireguard/device.c +0 -1
@@ -352,7 +352,6 @@ static int wg_newlink(struct net *src_neif (ret <0 ) goto err_free_handshake_queue; -dev_set_threaded (dev, true); ret =register_netdevice (dev);if (ret <0 ) goto err_uninit_ratelimiter;
Greg Kroah-Hartman
maintainerPATCH 18/39 btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 38e818718c5e04961eea0fa8feff3f100ce40408 ]
Quoted 1 line
From the memory-barriers.txt document regarding memory barrier ordering
guarantees:
(*) These guarantees do not apply to bitfields, because compilers often
generate code to modify these using non-atomic read-modify-write sequences. Do not attempt to use bitfields to synchronize parallel algorithms.
(*) Even in cases where bitfields are protected by locks, all fields
in a given bitfield must be protected by one lock. If two fields in a given bitfield are protected by different locks, the compiler's non-atomic read-modify-write sequences can cause an update to one field to corrupt the value of an adjacent field.
btrfs_space_info has a bitfield sharing an underlying word consisting of the fields full, chunk_alloc, and flush:
struct btrfs_space_info {
struct btrfs_fs_info * fs_info; /* 0 8 */
struct btrfs_space_info * parent; /* 8 8 */ ...
int clamp; /* 172 4 */
unsigned int full:1; /* 176: 0 4 */
unsigned int chunk_alloc:1; /* 176: 1 4 */
unsigned int flush:1; /* 176: 2 4 */
...
Therefore, to be safe from parallel read-modify-writes losing a write to one of the bitfield members protected by a lock, all writes to all the bitfields must use the lock. They almost universally do, except for btrfs_clear_space_info_full() which iterates over the space_infos and writes out found->full = 0 without a lock.
Imagine that we have one thread completing a transaction in which we finished deleting a block_group and are thus calling btrfs_clear_space_info_full() while simultaneously the data reclaim ticket infrastructure is running do_async_reclaim_data_space():
T1 T2btrfs_commit_transaction
btrfs_clear_space_info_full
data_sinfo->full = 0
READ: full:0, chunk_alloc:0, flush:1
do_async_reclaim_data_space(data_sinfo)
spin_lock(&space_info->lock);
if(list_empty(tickets))
space_info->flush = 0;
READ: full: 0, chunk_alloc:0, flush:1
MOD/WRITE: full: 0, chunk_alloc:0, flush:0
spin_unlock(&space_info->lock);
return;MOD/WRITE: full:0, chunk_alloc:0, flush:1
and now data_sinfo->flush is 1 but the reclaim worker has exited. This breaks the invariant that flush is 0 iff there is no work queued or running. Once this invariant is violated, future allocations that go into __reserve_bytes() will add tickets to space_info->tickets but will see space_info->flush is set to 1 and not queue the work. After this, they will block forever on the resulting ticket, as it is now impossible to kick the worker again.
I also confirmed by looking at the assembly of the affected kernel that it is doing RMW operations. For example, to set the flush (3rd) bit to 0, the assembly is:
andb $0xfb,0x60(%rbx)
and similarly for setting the full (1st) bit to 0:
andb $0xfe,-0x20(%rax)
So I think this is really a bug on practical systems. I have observed a number of systems in this exact state, but am currently unable to reproduce it.
Rather than leaving this footgun lying around for the future, take advantage of the fact that there is room in the struct anyway, and that it is already quite large and simply change the three bitfield members to bools. This avoids writes to space_info->full having any effect on writes to space_info->flush, regardless of locking.
[ The context change is due to the commit cc0517fe779f ("btrfs: tweak extent/chunk allocation for space_info sub-space") and the commit 45a59513b4b2
("btrfs: add support for reclaiming from sub-space space_info") in v6.16 which are irrelevant to the logic of this patch. ]
--- fs/btrfs/block-group.c | 6 +++--- fs/btrfs/space-info.c | 20 ++++++++++---------- fs/btrfs/space-info.h | 6 +++--- 3 files changed, 16 insertions(+), 16 deletions(-)
fs/btrfs/block-group.c +3 -3
@@ -3699,7 +3699,7 @@ int btrfs_chunk_alloc(struct btrfs_transmutex_unlock (&fs_info->chunk_mutex); }else {/* Proceed with allocation */ - space_info->chunk_alloc =1 ; + space_info->chunk_alloc = true; wait_for_alloc = false;spin_unlock (&space_info->lock); }
@@ -3735,7 +3735,7 @@ int btrfs_chunk_alloc(struct btrfs_transspin_lock (&space_info->lock);if (ret <0 ) {if (ret == -ENOSPC ) - space_info->full =1 ; + space_info->full = true;else goto out; }else {
@@ -3745,7 +3745,7 @@ int btrfs_chunk_alloc(struct btrfs_trans space_info->force_alloc =CHUNK_ALLOC_NO_FORCE ; out: - space_info->chunk_alloc =0 ; + space_info->chunk_alloc = false;spin_unlock (&space_info->lock);mutex_unlock (&fs_info->chunk_mutex);
fs/btrfs/space-info.c +10 -10
@@ -178,7 +178,7 @@ void btrfs_clear_space_info_full(structstruct btrfs_space_info *found;list_for_each_entry (found, head, list) - found->full =0 ; + found->full = false; }static int create_space_info (struct btrfs_fs_info *info,u64 flags)
@@ -271,7 +271,7 @@ void btrfs_update_space_info(struct btrf found->bytes_readonly += bytes_readonly; found->bytes_zone_unusable += bytes_zone_unusable;if (total_bytes >0 ) - found->full =0 ; + found->full = false;btrfs_try_granting_tickets (info, found);spin_unlock (&found->lock); *space_info = found;
@@ -941,7 +941,7 @@ static void btrfs_async_reclaim_metadataspin_lock (&space_info->lock); to_reclaim =btrfs_calc_reclaim_metadata_size (fs_info, space_info);if (!to_reclaim) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -953,7 +953,7 @@ static void btrfs_async_reclaim_metadataflush_space (fs_info, space_info, to_reclaim, flush_state, false);spin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -996,7 +996,7 @@ static void btrfs_async_reclaim_metadata flush_state =FLUSH_DELAYED_ITEMS_NR ; commit_cycles--; }else { - space_info->flush =0 ; + space_info->flush = false; } }else { flush_state =FLUSH_DELAYED_ITEMS_NR ;
@@ -1158,7 +1158,7 @@ static void btrfs_async_reclaim_data_spaspin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1169,7 +1169,7 @@ static void btrfs_async_reclaim_data_spaflush_space (fs_info, space_info,U64_MAX ,ALLOC_CHUNK_FORCE , false);spin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1182,7 +1182,7 @@ static void btrfs_async_reclaim_data_spa data_flush_states[flush_state], false);spin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1199,7 +1199,7 @@ static void btrfs_async_reclaim_data_spaif (maybe_fail_all_tickets (fs_info, space_info)) flush_state =0 ;else - space_info->flush =0 ; + space_info->flush = false; }else { flush_state =0 ; }
@@ -1510,7 +1510,7 @@ static int __reserve_bytes(struct btrfs_*/ maybe_clamp_preempt (fs_info, space_info); - space_info->flush =1 ; + space_info->flush = true; trace_btrfs_trigger_flush(fs_info, space_info->flags, orig_bytes, flush,
fs/btrfs/space-info.h +3 -3
@@ -28,11 +28,11 @@ struct btrfs_space_info {flushing. The value is >> clamp, so turns out to be a 2^clamp divisor. */ - unsigned int full:1; /* indicates that we cannot allocate any more +bool full;/* indicates that we cannot allocate any more chunks for this space */ - unsigned int chunk_alloc:1; /* set if we are allocating a chunk */ +bool chunk_alloc;/* set if we are allocating a chunk */ - unsigned int flush:1; /* set if we are trying to make space */ +bool flush;/* set if we are trying to make space */ unsigned int force_alloc;/* set if we need to force a chunk alloc for this space */
Greg Kroah-Hartman
maintainerPATCH 19/39 smb: client: set correct id, uid and cruid for multiuser automounts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 4508ec17357094e2075f334948393ddedbb75157 ]
When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the values from the parent mount.
[ The context change is due to the commit 561f82a3a24c ("smb: client: rename cifs_dfs_ref.c to namespace.c") and the commit 0a049935e47e ("smb: client: get rid of dfs naming in automount code") in v6.6 which are irrelevant to the logic of this patch. ]
--- fs/cifs/cifs_dfs_ref.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/cifs/cifs_dfs_ref.c +16 -0
@@ -258,6 +258,21 @@ compose_mount_options_err: goto compose_mount_options_out; } +static void fs_context_set_ids (struct smb3_fs_context *ctx) +{ +kuid_t uid =current_fsuid (); +kgid_t gid =current_fsgid (); + +if (ctx->multiuser) { +if (!ctx->uid_specified) + ctx->linux_uid = uid; +if (!ctx->gid_specified) + ctx->linux_gid = gid; + } +if (!ctx->cruid_specified) + ctx->cred_uid = uid; +} +/* * Create a vfsmount that we can automount */
@@ -309,6 +324,7 @@ static struct vfsmount *cifs_dfs_do_auto tmp.source = full_path; tmp.UNC = tmp.prepath =NULL ; +fs_context_set_ids (&tmp); rc =smb3_fs_context_dup (ctx, &tmp);if (rc) { mnt =ERR_PTR (rc);
Greg Kroah-Hartman
maintainerPATCH 20/39 net: dsa: free routing table on probe failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 8bf108d7161ffc6880ad13a0cc109de3cf631727 ]
If complete = true in dsa_tree_setup(), it means that we are the last switch of the tree which is successfully probing, and we should be setting up all switches from our probe path.
After "complete" becomes true, dsa_tree_setup_cpu_ports() or any subsequent function may fail. If that happens, the entire tree setup is in limbo: the first N-1 switches have successfully finished probing (doing nothing but having allocated persistent memory in the tree's dst->ports, and maybe dst->rtable), and switch N failed to probe, ending the tree setup process before anything is tangible from the user's PoV.
If switch N fails to probe, its memory (ports) will be freed and removed from dst->ports. However, the dst->rtable elements pointing to its ports, as created by dsa_link_touch(), will remain there, and will lead to use-after-free if dereferenced.
If dsa_tree_setup_switches() returns -EPROBE_DEFER, which is entirely possible because that is where ds->ops->setup() is, we get a kasan report like this:
==================================================================
BUG: KASAN: slab-use-after-free in mv88e6xxx_setup_upstream_port+0x240/0x568 Read of size 8 at addr ffff000004f56020 by task kworker/u8:3/42 Call trace: __asan_report_load8_noabort+0x20/0x30 mv88e6xxx_setup_upstream_port+0x240/0x568 mv88e6xxx_setup+0xebc/0x1eb0 dsa_register_switch+0x1af4/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350 Allocated by task 42: __kasan_kmalloc+0x84/0xa0 __kmalloc_cache_noprof+0x298/0x490 dsa_switch_touch_ports+0x174/0x3d8 dsa_register_switch+0x800/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350 Freed by task 42: __kasan_slab_free+0x48/0x68 kfree+0x138/0x418 dsa_register_switch+0x2694/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350
The simplest way to fix the bug is to delete the routing table in its entirety. dsa_tree_setup_routing_table() has no problem in regenerating it even if we deleted links between ports other than those of switch N, because dsa_link_touch() first checks whether the port pair already exists in dst->rtable, allocating if not.
The deletion of the routing table in its entirety already exists in dsa_tree_teardown(), so refactor that into a function that can also be called from the tree setup error path.
In my analysis of the commit to blame, it is the one which added dsa_link elements to dst->rtable. Prior to that, each switch had its own ds->rtable which is freed when the switch fails to probe. But the tree is potentially persistent memory.
[ Backport the fix to net/dsa/dsa2.c in v5.15.y for dsa2.c was renamed back into dsa.c by commit47d2ce03dcfb ("net: dsa: rename dsa2.c back into dsa.c and create its header") since v6.2. ]
--- net/dsa/dsa2.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
net/dsa/dsa2.c +14 -7
@@ -1079,6 +1079,16 @@ static void dsa_tree_teardown_lags(struckfree (dst->lags); } +static void dsa_tree_teardown_routing_table (struct dsa_switch_tree *dst) +{ +struct dsa_link *dl, *next; + +list_for_each_entry_safe (dl, next, &dst->rtable, list) { +list_del (&dl->list); +kfree (dl); + } +} +static int dsa_tree_setup (struct dsa_switch_tree *dst) {bool complete;
@@ -1096,7 +1106,7 @@ static int dsa_tree_setup(struct dsa_swi err =dsa_tree_setup_cpu_ports (dst);if (err) -return err; + goto teardown_rtable; err =dsa_tree_setup_switches (dst);if (err)
@@ -1123,14 +1133,14 @@ teardown_switches:dsa_tree_teardown_switches (dst); teardown_cpu_ports:dsa_tree_teardown_cpu_ports (dst); +teardown_rtable: +dsa_tree_teardown_routing_table (dst);return err; }static void dsa_tree_teardown (struct dsa_switch_tree *dst) { -struct dsa_link *dl, *next; -if (!dst->setup)return ;
@@ -1144,10 +1154,7 @@ static void dsa_tree_teardown(struct dsadsa_tree_teardown_cpu_ports (dst); -list_for_each_entry_safe (dl, next, &dst->rtable, list) { -list_del (&dl->list); -kfree (dl); - } +dsa_tree_teardown_routing_table (dst);pr_info ("DSA: tree %d torn down\n" , dst->index);
Greg Kroah-Hartman
maintainerPATCH 21/39 selftests: mptcp: pm: ensure unknown flags are ignored
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
commit 29f4801e9c8dfd12bdcb33b61a6ac479c7162bd7 upstream.
This validates the previous commit: the userspace can set unknown flags -- the 7th bit is currently unused -- without errors, but only the supported ones are printed in the endpoints dumps.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
[ Conflicts in pm_netlink.sh, because some refactoring have been done
later on: commit 0d16ed0c2e74 ("selftests: mptcp: add {get,format}_endpoint(s) helpers") and commit c99d57d0007a ("selftests: mptcp: use pm_nl endpoint ops") are not in this version. The same operation can still be done at the same place, without using the new helpers.
Also, commit 1dc88d241f92 ("selftests: mptcp: pm_nl_ctl: always look for errors") is not in this version, and create a conflict in the context which is not related to the modification here. Conflicts in pm_nl_ctl.c, because commit 69c6ce7b6eca ("selftests:
mptcp: add implicit endpoint test case") is not in this version, and caused a conflict in the context which is not related to the modification here. ]
--- tools/testing/selftests/net/mptcp/pm_netlink.sh | 4 ++++ tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 11 +++++++++++ 2 files changed, 15 insertions(+)
tools/testing/selftests/net/mptcp/pm_netlink.sh +4 -0
@@ -124,6 +124,10 @@ id 8 flags signal 10.0.1.8" "id limit" ip netns exec $ns1 ./pm_nl_ctl flush check "ip netns exec $ns1 ./pm_nl_ctl dump" "" "flush addrs" +ip netns exec $ns1 ./pm_nl_ctl add 10.0.1.1 flags unknown +check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags 10.0.1.1" "ignore unknown flags" +ip netns exec $ns1 ./pm_nl_ctl flush + ip netns exec $ns1 ./pm_nl_ctl limits 9 1 check "ip netns exec $ns1 ./pm_nl_ctl limits" "$default_limits" "rcv addrs above hard limit"
tools/testing/selftests/net/mptcp/pm_nl_ctl.c +11 -0
@@ -22,6 +22,8 @@#define MPTCP_PM_NAME "mptcp_pm"#endif +#define MPTCP_PM_ADDR_FLAG_UNKNOWN _BITUL(7) +static void syntax (char *argv[]) {fprintf (stderr,"%s add|get|set|del|flush|dump|accept [<args>]\n" , argv[0 ]);
@@ -238,6 +240,8 @@ int add_addr(int fd, int pm_family, int flags |=MPTCP_PM_ADDR_FLAG_BACKUP ; else if (!strcmp(tok, "fullmesh")) flags |=MPTCP_PM_ADDR_FLAG_FULLMESH ; + else if (!strcmp(tok, "unknown")) + flags |=MPTCP_PM_ADDR_FLAG_UNKNOWN ; else error(1, errno, "unknown flag %s", argv[arg]);
@@ -435,6 +439,13 @@ static void print_addr(struct rtattr *atif (flags)printf ("," ); } + +if (flags &MPTCP_PM_ADDR_FLAG_UNKNOWN ) { +printf ("unknown" ); + flags &= ~MPTCP_PM_ADDR_FLAG_UNKNOWN ; +if (flags) +printf ("," ); + }/* bump unknown flags, if any */ if (flags)
Greg Kroah-Hartman
maintainerPATCH 22/39 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d upstream.
syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup()
Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready.
list_splice_init_rcu() can not be called here while holding pernet->lock spinlock.
Many thanks to Eulgyu Kim for providing a repro and testing our patches.
[ Conflicts because the code has been moved from pm_netlink.c to
pm_kernel.c later on in commit 8617e85e04bd ("mptcp: pm: split in-kernel PM specific code"). The same modifications can be applied in pm_netlink.c with one exception, because 'pernet->local_addr_list' has been renamed to 'pernet->endp_list' in commit 35e71e43a56d ("mptcp: pm: in-kernel: rename 'local_addr_list' to 'endp_list'"). The previous name is then still being used in this version. Also, another conflict is caused by commit 7bcf4d8022f9 ("mptcp: pm:
rename helpers linked to 'flush'") which is not in this version:
mptcp_nl_remove_addrs_list() has been renamed to mptcp_nl_flush_addrs_list(). The previous name has then been kept. ]
--- net/mptcp/pm_netlink.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
net/mptcp/pm_netlink.c +13 -3
@@ -1656,16 +1656,26 @@ static void __reset_counters(struct pm_nstatic int mptcp_nl_cmd_flush_addrs (struct sk_buff *skb,struct genl_info *info) {struct pm_nl_pernet *pernet =genl_info_pm_nl (info); -LIST_HEAD (free_list); +struct list_head free_list;spin_lock_bh (&pernet->lock); -list_splice_init (&pernet->local_addr_list, &free_list); + free_list = pernet->local_addr_list; +INIT_LIST_HEAD_RCU (&pernet->local_addr_list);__reset_counters (pernet); pernet->next_id =1 ;bitmap_zero (pernet->id_bitmap,MAX_ADDR_ID +1 );spin_unlock_bh (&pernet->lock); -mptcp_nl_remove_addrs_list (sock_net (skb->sk), &free_list); + +if (free_list.next == &pernet->local_addr_list) +return 0 ; +synchronize_rcu (); + +/* Adjust the pointers to free_list instead of pernet->local_addr_list */ + free_list.prev->next = &free_list; + free_list.next->prev = &free_list; + +mptcp_nl_remove_addrs_list (sock_net (skb->sk), &free_list);__flush_addrs (&free_list);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/39 crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
[ Upstream commit 14f86a1155cca1176abf55987b2fce7f7fcb2455 ]
With function virtio_crypto_skcipher_crypt_req(), there is already virtqueue_kick() call with spinlock held in function __virtio_crypto_skcipher_do_req(). Remove duplicated virtqueue_kick() function call here.
--- drivers/crypto/virtio/virtio_crypto_algs.c | 2 -- 1 file changed, 2 deletions(-)
drivers/crypto/virtio/virtio_crypto_algs.c +0 -2
@@ -569,8 +569,6 @@ int virtio_crypto_skcipher_crypt_req(if (ret <0 )return ret; -virtqueue_kick (data_vq->vq); -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 24/39 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
[ Upstream commit 77ffbcac4e569566d0092d5f22627dfc0896b553 ]
On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter.
Replace free_transport() with ksmbd_tcp_disconnect().
--- fs/ksmbd/transport_tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ksmbd/transport_tcp.c +2 -1
@@ -41,6 +41,7 @@ static struct ksmbd_transport_ops ksmbd_static void tcp_stop_kthread (struct task_struct *kthread);static struct interface *alloc_iface (char *ifname); +static void ksmbd_tcp_disconnect (struct ksmbd_transport *t);#define KSMBD_TRANS (t) (&(t)->transport)#define TCP_TRANS (t) ((struct tcp_transport *)container_of(t, \
@@ -207,7 +208,7 @@ static int ksmbd_tcp_new_connection(struif (IS_ERR (handler)) {pr_err ("cannot start conn thread\n" ); rc =PTR_ERR (handler); -free_transport (t); +ksmbd_tcp_disconnect (KSMBD_TRANS (t)); }return rc;
Greg Kroah-Hartman
maintainerPATCH 25/39 bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chelsy Ratnawat <[email protected]>
[ Upstream commit a50522c805a6c575c80f41b04706e084d814e116 ]
Use sysfs_emit() instead of snprintf()/sprintf() when writing to sysfs buffers, as recommended by the kernel documentation.
Stable-dep-of: 148891e95014 ("bus: fsl-mc: fix use-after-free in driver_override_show()")
--- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/bus/fsl-mc/fsl-mc-bus.c +3 -3
@@ -156,8 +156,8 @@ static ssize_t modalias_show(struct devi {struct fsl_mc_device *mc_dev =to_fsl_mc_device (dev); -return sprintf (buf,"fsl-mc:v%08Xd%s\n" , mc_dev->obj_desc.vendor, - mc_dev->obj_desc.type); +return sysfs_emit (buf,"fsl-mc:v%08Xd%s\n" , mc_dev->obj_desc.vendor, + mc_dev->obj_desc.type); }static DEVICE_ATTR_RO (modalias);
@@ -200,7 +200,7 @@ static ssize_t driver_override_show(stru {struct fsl_mc_device *mc_dev =to_fsl_mc_device (dev); -return snprintf (buf,PAGE_SIZE ,"%s\n" , mc_dev->driver_override); +return sysfs_emit (buf,"%s\n" , mc_dev->driver_override); }static DEVICE_ATTR_RW (driver_override);
Greg Kroah-Hartman
maintainerPATCH 26/39 bus: fsl-mc: fix use-after-free in driver_override_show()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
[ Upstream commit 148891e95014b5dc5878acefa57f1940c281c431 ]
The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock.
This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function.
Fix this by holding the device_lock around the read operation.
--- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/bus/fsl-mc/fsl-mc-bus.c +5 -1
@@ -199,8 +199,12 @@ static ssize_t driver_override_show(stru struct device_attribute *attr, char *buf) { struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); +ssize_t len; -return sysfs_emit (buf,"%s\n" , mc_dev->driver_override); +device_lock (dev); + len =sysfs_emit (buf,"%s\n" , mc_dev->driver_override); +device_unlock (dev); +return len; }static DEVICE_ATTR_RW (driver_override);
Greg Kroah-Hartman
maintainerPATCH 27/39 scsi: qla2xxx: Fix bsg_done() causing double free
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <[email protected]>
[ Upstream commit c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0 ]
Kernel panic observed on system,
[5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page [5353358.825196] PGD 100006067 P4D 0 [5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1 [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025 [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10 [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246 [5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000 [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000 [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000 [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090 [5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000 [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000 [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0 [5353358.825221] PKRU: 55555554 [5353358.825222] Call Trace: [5353358.825223] <TASK> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825232] ? sg_copy_buffer+0xc8/0x110 [5353358.825236] ? __die_body.cold+0x8/0xd [5353358.825238] ? page_fault_oops+0x134/0x170 [5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110 [5353358.825244] ? exc_page_fault+0xa8/0x150 [5353358.825247] ? asm_exc_page_fault+0x22/0x30 [5353358.825252] ? memcpy_erms+0x6/0x10 [5353358.825253] sg_copy_buffer+0xc8/0x110 [5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx] [5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]
Most routines in qla_bsg.c call bsg_done() only for success cases. However a few invoke it for failure case as well leading to a double free. Validate before calling bsg_done().
--- drivers/scsi/qla2xxx/qla_bsg.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
drivers/scsi/qla2xxx/qla_bsg.c +15 -10
@@ -1546,8 +1546,9 @@ qla2x00_update_optrom(struct bsg_job *bs ha->optrom_buffer =NULL ; ha->optrom_state =QLA_SWAITING ;mutex_unlock (&ha->optrom_mutex); -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!rval) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return rval; }
@@ -2525,8 +2526,9 @@ qla2x00_manage_host_stats(struct bsg_job sizeof(struct ql_vnd_mng_host_stats_resp)); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return ret; }
@@ -2615,8 +2617,9 @@ qla2x00_get_host_stats(struct bsg_job *b bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);kfree (data); host_stat_out:
@@ -2715,8 +2718,9 @@ reply: bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); tgt_stat_out:kfree (data);
@@ -2777,8 +2781,9 @@ qla2x00_manage_host_port(struct bsg_job bsg_job->reply_payload.sg_cnt, &rsp_data, sizeof(struct ql_vnd_mng_host_port_resp)); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return ret; }
Greg Kroah-Hartman
maintainerPATCH 28/39 scsi: qla2xxx: Use named initializers for port_[d]state_str
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Chesnokov <[email protected]>
[ Upstream commit 6e0e85d39e528da2915a2da261195f81bfde6915 ]
Make port_state_str and port_dstate_str a little more readable and maintainable by using named initializers.
Also convert FCS_* macros into an enum.
Stable-dep-of: 7adbd2b78090 ("scsi: qla2xxx: Free sp in error path to fix system crash")
--- drivers/scsi/qla2xxx/qla_def.h | 35 +++++++++++++++++++---------------- drivers/scsi/qla2xxx/qla_isr.c | 10 +++++----- 2 files changed, 24 insertions(+), 21 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +19 -16
@@ -2689,25 +2689,28 @@ struct event_arg {/* * Fibre channel port/lun states. */ -#define FCS_UNCONFIGURED 1 -#define FCS_DEVICE_DEAD 2 -#define FCS_DEVICE_LOST 3 -#define FCS_ONLINE 4 +enum { +FCS_UNKNOWN , +FCS_UNCONFIGURED , +FCS_DEVICE_DEAD , +FCS_DEVICE_LOST , +FCS_ONLINE , +};extern const char *const port_state_str[5 ]; -static const char *const port_dstate_str[] = { -"DELETED" , -"GNN_ID" , -"GNL" , -"LOGIN_PEND" , -"LOGIN_FAILED" , -"GPDB" , -"UPD_FCPORT" , -"LOGIN_COMPLETE" , -"ADISC" , -"DELETE_PEND" , -"LOGIN_AUTH_PEND" , +static const char *const port_dstate_str[] = { + [DSC_DELETED ] ="DELETED" , + [DSC_GNN_ID ] ="GNN_ID" , + [DSC_GNL ] ="GNL" , + [DSC_LOGIN_PEND ] ="LOGIN_PEND" , + [DSC_LOGIN_FAILED ] ="LOGIN_FAILED" , + [DSC_GPDB ] ="GPDB" , + [DSC_UPD_FCPORT ] ="UPD_FCPORT" , + [DSC_LOGIN_COMPLETE ] ="LOGIN_COMPLETE" , + [DSC_ADISC ] ="ADISC" , + [DSC_DELETE_PEND ] ="DELETE_PEND" , + [DSC_LOGIN_AUTH_PEND ] ="LOGIN_AUTH_PEND" , };/*
drivers/scsi/qla2xxx/qla_isr.c +5 -5
@@ -49,11 +49,11 @@ qla27xx_process_purex_fpin(struct scsi_q }const char *const port_state_str[] = { -"Unknown" , -"UNCONFIGURED" , -"DEAD" , -"LOST" , -"ONLINE" + [FCS_UNKNOWN ] ="Unknown" , + [FCS_UNCONFIGURED ] ="UNCONFIGURED" , + [FCS_DEVICE_DEAD ] ="DEAD" , + [FCS_DEVICE_LOST ] ="LOST" , + [FCS_ONLINE ] ="ONLINE" }; static void
Greg Kroah-Hartman
maintainerPATCH 29/39 scsi: qla2xxx: Remove dead code (GNN ID)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
[ Upstream commit 87f6dafd50fb6d7214c32596a11b983138b09123 ]
Remove stale/unused code (GNN ID).
Stable-dep-of: 7adbd2b78090 ("scsi: qla2xxx: Free sp in error path to fix system crash")
--- drivers/scsi/qla2xxx/qla_def.h | 3 - drivers/scsi/qla2xxx/qla_gbl.h | 3 - drivers/scsi/qla2xxx/qla_gs.c | 110 ---------------------------------------- drivers/scsi/qla2xxx/qla_init.c | 7 -- drivers/scsi/qla2xxx/qla_os.c | 3 - 5 files changed, 1 insertion(+), 125 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +0 -3
@@ -2488,7 +2488,6 @@ struct ct_sns_desc {enum discovery_state {DSC_DELETED , -DSC_GNN_ID ,DSC_GNL ,DSC_LOGIN_PEND ,DSC_LOGIN_FAILED ,
@@ -2701,7 +2700,6 @@ extern const char *const port_state_str[static const char *const port_dstate_str[] = { [DSC_DELETED ] ="DELETED" , - [DSC_GNN_ID ] ="GNN_ID" , [DSC_GNL ] ="GNL" , [DSC_LOGIN_PEND ] ="LOGIN_PEND" , [DSC_LOGIN_FAILED ] ="LOGIN_FAILED" ,
@@ -3497,7 +3495,6 @@ enum qla_work_type {QLA_EVT_GPNFT ,QLA_EVT_GPNFT_DONE ,QLA_EVT_GNNFT_DONE , -QLA_EVT_GNNID ,QLA_EVT_GFPNID ,QLA_EVT_SP_RETRY , QLA_EVT_IIDMA,
drivers/scsi/qla2xxx/qla_gbl.h +0 -3
@@ -730,9 +730,6 @@ int qla24xx_async_gffid(scsi_qla_host_tint qla24xx_async_gpnft (scsi_qla_host_t *,u8 ,srb_t *);void qla24xx_async_gpnft_done (scsi_qla_host_t *,srb_t *);void qla24xx_async_gnnft_done (scsi_qla_host_t *,srb_t *); -int qla24xx_async_gnnid (scsi_qla_host_t *,fc_port_t *); -void qla24xx_handle_gnnid_event (scsi_qla_host_t *,struct event_arg *); -int qla24xx_post_gnnid_work (struct scsi_qla_host *,fc_port_t *);int qla24xx_post_gfpnid_work (struct scsi_qla_host *,fc_port_t *);int qla24xx_async_gfpnid (scsi_qla_host_t *,fc_port_t *);void qla24xx_handle_gfpnid_event (scsi_qla_host_t *,struct event_arg *);
drivers/scsi/qla2xxx/qla_gs.c +0 -110
116 lines not on this page · raw message
drivers/scsi/qla2xxx/qla_init.c +1 -6
@@ -1725,12 +1725,7 @@ int qla24xx_fcport_handle_login(struct s }break ;default : -if (wwn ==0 ) { -ql_dbg (ql_dbg_disc, vha,0xffff , -"%s %d %8phC post GNNID\n" , - __func__, __LINE__, fcport->port_name); -qla24xx_post_gnnid_work (vha, fcport); - }else if (fcport->loop_id ==FC_NO_LOOP_ID ) { +if (fcport->loop_id ==FC_NO_LOOP_ID ) {ql_dbg (ql_dbg_disc, vha,0x20bd ,"%s %d %8phC post gnl\n" , __func__, __LINE__, fcport->port_name);
drivers/scsi/qla2xxx/qla_os.c +0 -3
@@ -5500,9 +5500,6 @@ qla2x00_do_work(struct scsi_qla_host *vhcase QLA_EVT_GNNFT_DONE :qla24xx_async_gnnft_done (vha, e->u.iosb.sp);break ; -case QLA_EVT_GNNID : -qla24xx_async_gnnid (vha, e->u.fcport.fcport); -break ;case QLA_EVT_GFPNID :qla24xx_async_gfpnid (vha, e->u.fcport.fcport);break ;
Greg Kroah-Hartman
maintainerPATCH 30/39 scsi: qla2xxx: Reduce fabric scan duplicate code
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
[ Upstream commit beafd692461443e0fb1d61aa56886bf85ef6f5e4 ]
For fabric scan, current code uses switch scan opcode and flags as the method to iterate through different commands to carry out the process. This makes it hard to read. This patch convert those opcode and flags into steps. In addition, this help reduce some duplicate code.
Consolidate routines that handle GPNFT & GNNFT.
Stable-dep-of: 7adbd2b78090 ("scsi: qla2xxx: Free sp in error path to fix system crash")
--- drivers/scsi/qla2xxx/qla_def.h | 14 + drivers/scsi/qla2xxx/qla_gbl.h | 6 drivers/scsi/qla2xxx/qla_gs.c | 432 ++++++++++++++++------------------------ drivers/scsi/qla2xxx/qla_init.c | 5 drivers/scsi/qla2xxx/qla_os.c | 12 - 5 files changed, 200 insertions(+), 269 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +11 -3
@@ -3262,11 +3262,20 @@ struct fab_scan_rp {u8 node_name[8 ]; }; +enum scan_step { +FAB_SCAN_START , +FAB_SCAN_GPNFT_FCP , +FAB_SCAN_GNNFT_FCP , +FAB_SCAN_GPNFT_NVME , +FAB_SCAN_GNNFT_NVME , +}; +struct fab_scan {struct fab_scan_rp *l;u32 size;u32 rscn_gen_start;u32 rscn_gen_end; +enum scan_step step;u16 scan_retry;#define MAX_SCAN_RETRIES 5enum scan_flags_t scan_flags;
@@ -3492,9 +3501,8 @@ enum qla_work_type {QLA_EVT_RELOGIN ,QLA_EVT_ASYNC_PRLO ,QLA_EVT_ASYNC_PRLO_DONE , -QLA_EVT_GPNFT , -QLA_EVT_GPNFT_DONE , -QLA_EVT_GNNFT_DONE , +QLA_EVT_SCAN_CMD , +QLA_EVT_SCAN_FINISH ,QLA_EVT_GFPNID ,QLA_EVT_SP_RETRY , QLA_EVT_IIDMA,
drivers/scsi/qla2xxx/qla_gbl.h +3 -3
@@ -727,9 +727,9 @@ void qla24xx_handle_gpsc_event(scsi_qla_int qla2x00_mgmt_svr_login (scsi_qla_host_t *);void qla24xx_handle_gffid_event (scsi_qla_host_t *vha,struct event_arg *ea);int qla24xx_async_gffid (scsi_qla_host_t *vha,fc_port_t *fcport,bool ); -int qla24xx_async_gpnft (scsi_qla_host_t *,u8 ,srb_t *); -void qla24xx_async_gpnft_done (scsi_qla_host_t *,srb_t *); -void qla24xx_async_gnnft_done (scsi_qla_host_t *,srb_t *); +int qla_fab_async_scan (scsi_qla_host_t *,srb_t *); +void qla_fab_scan_start (struct scsi_qla_host *); +void qla_fab_scan_finish (scsi_qla_host_t *,srb_t *);int qla24xx_post_gfpnid_work (struct scsi_qla_host *,fc_port_t *);int qla24xx_async_gfpnid (scsi_qla_host_t *,fc_port_t *);void qla24xx_handle_gfpnid_event (scsi_qla_host_t *,struct event_arg *);
drivers/scsi/qla2xxx/qla_gs.c +181 -251
578 lines not on this page · raw message
drivers/scsi/qla2xxx/qla_init.c +1 -4
@@ -6457,10 +6457,7 @@ qla2x00_configure_fabric(scsi_qla_host_tif (USE_ASYNC_SCAN (ha)) {/* start of scan begins here */ vha->scan.rscn_gen_end =atomic_read (&vha->rscn_gen); - rval =qla24xx_async_gpnft (vha,FC4_TYPE_FCP_SCSI , -NULL ); -if (rval) -set_bit (LOOP_RESYNC_NEEDED , &vha->dpc_flags); +qla_fab_scan_start (vha); }else {list_for_each_entry (fcport, &vha->vp_fcports, list) fcport->scan_state =QLA_FCPORT_SCAN ;
drivers/scsi/qla2xxx/qla_os.c +4 -8
@@ -5490,15 +5490,11 @@ qla2x00_do_work(struct scsi_qla_host *vhqla2x00_async_prlo_done (vha, e->u.logio.fcport, e->u.logio.data);break ; -case QLA_EVT_GPNFT : -qla24xx_async_gpnft (vha, e->u.gpnft.fc4_type, - e->u.gpnft.sp); +case QLA_EVT_SCAN_CMD : +qla_fab_async_scan (vha, e->u.iosb.sp);break ; -case QLA_EVT_GPNFT_DONE : -qla24xx_async_gpnft_done (vha, e->u.iosb.sp); -break ; -case QLA_EVT_GNNFT_DONE : -qla24xx_async_gnnft_done (vha, e->u.iosb.sp); +case QLA_EVT_SCAN_FINISH : +qla_fab_scan_finish (vha, e->u.iosb.sp);break ;case QLA_EVT_GFPNID :qla24xx_async_gfpnid (vha, e->u.fcport.fcport);
Greg Kroah-Hartman
maintainerPATCH 31/39 scsi: qla2xxx: Free sp in error path to fix system crash
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <[email protected]>
[ Upstream commit 7adbd2b7809066c75f0433e5e2a8e114b429f30f ]
System crash seen during load/unload test in a loop,
[61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ============================================================================= [61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() [61110.467501] -----------------------------------------------------------------------------
[61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467515] Call Trace: [61110.467516] <TASK> [61110.467519] dump_stack_lvl+0x34/0x48 [61110.467526] slab_err.cold+0x53/0x67 [61110.467534] __kmem_cache_shutdown+0x16e/0x320 [61110.467540] kmem_cache_destroy+0x51/0x160 [61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467607] ? __do_sys_delete_module.constprop.0+0x178/0x280 [61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [61110.467616] ? do_syscall_64+0x5c/0x90 [61110.467619] ? exc_page_fault+0x62/0x150 [61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [61110.467626] </TASK> [61110.467627] Disabling lock debugging due to kernel taint [61110.467635] Object 0x0000000026f7e6e6 @offset=16000 [61110.467639] ------------[ cut here ]------------ [61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160 [61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160 [61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282 [61110.467727] RAX: 0000000000000000 RBX: ffffffffc0d9a860 RCX: 0000000000000027 [61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI: ffff8fd5ff9598a0 [61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7 [61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000 [61110.467731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000 [61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0 [61110.467736] PKRU: 55555554 [61110.467737] Call Trace: [61110.467738] <TASK> [61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280
Free sp in the error path to fix the crash.
--- drivers/scsi/qla2xxx/qla_gs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_gs.c +2 -2
@@ -3921,8 +3921,8 @@ int qla_fab_async_scan(scsi_qla_host_t *if (vha->scan.scan_flags &SF_SCANNING ) {spin_unlock_irqrestore (&vha->work_lock, flags);ql_dbg (ql_dbg_disc + ql_dbg_verbose, vha,0x2012 , -"%s: scan active\n" , __func__); -return rval; +"%s: scan active for sp:%p\n" , __func__, sp); + goto done_free_sp; } vha->scan.scan_flags |=SF_SCANNING ;if (!sp)
Greg Kroah-Hartman
maintainerPATCH 32/39 PCI: endpoint: Automatically create a function specific attributes group
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 70b3740f2c1941e2006d61539131b70d20cba9a6 ]
A PCI endpoint function driver can define function specific attributes under its function configfs directory using the add_cfs() endpoint driver operation. This is done by tying up the mkdir operation for the function configfs directory to a call to the add_cfs() operation. However, there are no checks preventing the user from repeatedly creating function specific attribute directories with different names, resulting in the same endpoint specific attributes group being added multiple times, which also result in an invalid reference counting for the attribute groups. E.g., using the pci-epf-ntb function driver as an example, the user creates the function as follows:
$ modprobe pci-epf-ntb $ cd /sys/kernel/config/pci_ep/functions/pci_epf_ntb $ mkdir func0 $ tree func0 func0/ |-- baseclass_code |-- cache_line_size |-- ... `-- vendorid
$ mkdir func0/attrs $ tree func0 func0/ |-- attrs | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- baseclass_code |-- cache_line_size |-- ... `-- vendorid
At this point, the function can be started by linking the EP controller. However, if the user mistakenly creates again a directory:
$ mkdir func0/attrs2 $ tree func0 func0/ |-- attrs | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- attrs2 | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- baseclass_code |-- cache_line_size |-- ... `-- vendorid
The endpoint function specific attributes are duplicated and cause a crash when the endpoint function device is torn down:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 2 PID: 834 at lib/refcount.c:25 refcount_warn_saturate+0xc8/0x144 CPU: 2 PID: 834 Comm: rmdir Not tainted 6.3.0-rc1 #1 Hardware name: Pine64 RockPro64 v2.1 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) ... Call trace: refcount_warn_saturate+0xc8/0x144 config_item_get+0x7c/0x80 configfs_rmdir+0x17c/0x30c vfs_rmdir+0x8c/0x204 do_rmdir+0x158/0x184 __arm64_sys_unlinkat+0x64/0x80 invoke_syscall+0x48/0x114 ...
Fix this by modifying pci_epf_cfs_work() to execute the new function pci_ep_cfs_add_type_group() which itself calls pci_epf_type_add_cfs() to obtain the function specific attribute group and the group name (directory name) from the endpoint function driver. If the function driver defines an attribute group, pci_ep_cfs_add_type_group() then proceeds to register this group using configfs_register_group(), thus automatically exposing the function type specific configfs attributes to the user. E.g.:
$ modprobe pci-epf-ntb $ cd /sys/kernel/config/pci_ep/functions/pci_epf_ntb $ mkdir func0 $ tree func0 func0/ |-- baseclass_code |-- cache_line_size |-- ... |-- pci_epf_ntb.0 | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- primary |-- ... `-- vendorid
With this change, there is no need for the user to create or delete directories in the endpoint function attributes directory. The pci_epf_type_group_ops group operations are thus removed.
Also update the documentation for the pci-epf-ntb and pci-epf-vntb function drivers to reflect this change, removing the explanations showing the need to manually create the sub-directory for the function specific attributes.
Stable-dep-of: 7c5c7d06bd1f ("PCI: endpoint: Avoid creating sub-groups asynchronously")
--- Documentation/PCI/endpoint/pci-ntb-howto.rst | 11 ++----- drivers/pci/endpoint/pci-ep-cfs.c | 42 ++++++++++++--------------- 2 files changed, 24 insertions(+), 29 deletions(-)
Documentation/PCI/endpoint/pci-ntb-howto.rst +4 -7
@@ -88,13 +88,10 @@ commands can be used:: # echo 0x104c > functions/pci_epf_ntb/func1/vendorid # echo 0xb00d > functions/pci_epf_ntb/func1/deviceid -In order to configure NTB specific attributes, a new sub-directory to func1 -should be created:: - - # mkdir functions/pci_epf_ntb/func1/pci_epf_ntb.0/ - -The NTB function driver will populate this directory with various attributes -that can be configured by the user:: +The PCI endpoint framework also automatically creates a sub-directory in the +function attribute directory. This sub-directory has the same name as the name +of the function device and is populated with the following NTB specific +attributes that can be configured by the user:: # ls functions/pci_epf_ntb/func1/pci_epf_ntb.0/ db_count mw1 mw2 mw3 mw4 num_mws
drivers/pci/endpoint/pci-ep-cfs.c +20 -22
66 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 33/39 PCI: endpoint: Remove unused field in struct pci_epf_group
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 328e4dffbeecc0f2cc5a149dee6c11a0577c9671 ]
In "struct pci_epf_group", the 'type_group' field is unused.
This was added, but already unused, by commit 70b3740f2c19 ("PCI: endpoint:
Automatically create a function specific attributes group").
Thus, remove it.
Found with cppcheck, unusedStructMember.
Stable-dep-of: 7c5c7d06bd1f ("PCI: endpoint: Avoid creating sub-groups asynchronously")
--- drivers/pci/endpoint/pci-ep-cfs.c | 1 - 1 file changed, 1 deletion(-)
drivers/pci/endpoint/pci-ep-cfs.c +0 -1
@@ -23,7 +23,6 @@ struct pci_epf_group {struct config_group group;struct config_group primary_epc_group;struct config_group secondary_epc_group; -struct config_group *type_group;struct delayed_work cfs_work;struct pci_epf *epf;int index;
Greg Kroah-Hartman
maintainerPATCH 34/39 PCI: endpoint: Avoid creating sub-groups asynchronously
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Song <[email protected]>
[ Upstream commit 7c5c7d06bd1f86d2c3ebe62be903a4ba42db4d2c ]
The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes.
The crash can be easily reproduced with the following commands:
# cd /sys/kernel/config/pci_ep/functions/pci_epf_test
# for i in {1..20}; do mkdir test && rmdir test; doneBUG: kernel NULL pointer dereference, address: 0000000000000088 ... Call Trace: configfs_register_group+0x3d/0x190 pci_epf_cfs_work+0x41/0x110 process_one_work+0x18f/0x350 worker_thread+0x25a/0x3a0
Fix this issue by using configfs_add_default_group() API which does not have the deadlock problem as configfs_register_group() and does not require the delayed work handler.
--- drivers/pci/endpoint/pci-ep-cfs.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
drivers/pci/endpoint/pci-ep-cfs.c +5 -10
@@ -23,7 +23,6 @@ struct pci_epf_group {struct config_group group;struct config_group primary_epc_group;struct config_group secondary_epc_group; -struct delayed_work cfs_work;struct pci_epf *epf;int index; };
@@ -100,7 +99,7 @@ static struct config_group secondary_epc_group = &epf_group->secondary_epc_group;config_group_init_type_name (secondary_epc_group,"secondary" , &pci_secondary_epc_type); -configfs_register_group (&epf_group->group, secondary_epc_group); +configfs_add_default_group (secondary_epc_group, &epf_group->group);return secondary_epc_group; }
@@ -160,7 +159,7 @@ static struct config_groupconfig_group_init_type_name (primary_epc_group,"primary" , &pci_primary_epc_type); -configfs_register_group (&epf_group->group, primary_epc_group); +configfs_add_default_group (primary_epc_group, &epf_group->group);return primary_epc_group; }
@@ -534,15 +533,13 @@ static void pci_ep_cfs_add_type_group(streturn ; } -configfs_register_group (&epf_group->group, group); +configfs_add_default_group (group, &epf_group->group); } -static void pci_epf_cfs_work (struct work_struct *work) +static void pci_epf_cfs_add_sub_groups (struct pci_epf_group *epf_group) { -struct pci_epf_group *epf_group;struct config_group *group; - epf_group = container_of(work, struct pci_epf_group, cfs_work.work); group =pci_ep_cfs_add_primary_group (epf_group);if (IS_ERR (group)) {pr_err ("failed to create 'primary' EPC interface\n" );
@@ -601,9 +598,7 @@ static struct config_group *pci_epf_makekfree (epf_name); -INIT_DELAYED_WORK (&epf_group->cfs_work, pci_epf_cfs_work); -queue_delayed_work (system_wq, &epf_group->cfs_work, -msecs_to_jiffies (1 )); +pci_epf_cfs_add_sub_groups (epf_group);return &epf_group->group;
Greg Kroah-Hartman
maintainerPATCH 35/39 fbdev: rivafb: fix divide error in nv3_arb()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 0209e21e3c372fa2da04c39214bec0b64e4eb5f4 upstream.
A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz (derived from the PRAMDAC MCLK PLL) as a divisor without validating it first.
In a normal setup, state->mclk_khz is provided by the real hardware and is non-zero. However, an attacker can construct a malicious or misconfigured device (e.g. a crafted/emulated PCI device) that exposes a bogus PLL configuration, causing state->mclk_khz to become zero. Once nv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns calculation causes a divide error and crashes the kernel.
Fix this by checking whether state->mclk_khz is zero and bailing out before doing the division.
The following log reveals it:
rivafb: setting virtual Y resolution to 2184
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline] RIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546 Call Trace: nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603 nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline] CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246 riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779 rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196 fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188 __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856
--- drivers/video/fbdev/riva/riva_hw.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/riva/riva_hw.c +3 -0
@@ -436,6 +436,9 @@ static char nv3_arb(nv3_fifo_info * res_ vmisses =2 ; eburst_size = state->memory_width *1 ; mburst_size =32 ; +if (!state->mclk_khz) +return (0 ); + gns =1000000 * (gmisses*state->mem_page_miss + state->mem_latency)/state->mclk_khz; ainfo->by_gfacc = gns*ainfo->gdrain_rate/1000000 ; ainfo->wcmocc =0 ;
Greg Kroah-Hartman
maintainerPATCH 36/39 fbdev: smscufx: properly copy ioctl memory to kernelspace
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 120adae7b42faa641179270c067864544a50ab69 upstream.
The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid data is passed from userspace. Fix this all up by correctly copying the memory before accessing it within the kernel.
--- drivers/video/fbdev/smscufx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/video/fbdev/smscufx.c +6 -2
@@ -986,7 +986,6 @@ static int ufx_ops_ioctl(struct fb_info unsigned long arg) {struct ufx_data *dev = info->par; -struct dloarea *area =NULL ;if (!atomic_read (&dev->usb_active))return 0 ;
@@ -1001,6 +1000,10 @@ static int ufx_ops_ioctl(struct fb_info/* TODO: Help propose a standard fb.h ioctl to report mmap damage */ if (cmd ==UFX_IOCTL_REPORT_DAMAGE ) { + struct dloarea *area __free(kfree) = kmalloc(sizeof(*area), GFP_KERNEL); +if (!area) +return -ENOMEM ; +/* If we have a damage-aware client, turn fb_defio "off" * To avoid perf imact of unnecessary page fault handling. * Done by resetting the delay for this fb_info to a very
@@ -1010,7 +1013,8 @@ static int ufx_ops_ioctl(struct fb_infoif (info->fbdefio) info->fbdefio->delay =UFX_DEFIO_WRITE_DISABLE ; - area = (struct dloarea *)arg; +if (copy_from_user (area, (u8 __user *)arg,sizeof (*area))) +return -EFAULT ;if (area->x <0 ) area->x =0 ;
Greg Kroah-Hartman
maintainerPATCH 37/39 f2fs: fix to avoid UAF in f2fs_write_end_io()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit ce2739e482bce8d2c014d76c4531c877f382aa54 ]
As syzbot reported an use-after-free issue in f2fs_write_end_io().
It is caused by below race condition:
loop device umount
- worker_thread
- loop_process_work
- do_req_filebacked
- lo_rw_aio
- lo_rw_aio_complete
- blk_mq_end_request
- blk_update_request
- f2fs_write_end_io
- dec_page_count
- folio_end_writeback
- kill_f2fs_super
- kill_block_super
- f2fs_put_super
: free(sbi)
: get_pages(, F2FS_WB_CP_DATA)
accessed sbi which is freed
In kill_f2fs_super(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folio_end_writeback().
Let's relocate ckpt thread wakeup flow before folio_end_writeback() to resolve this issue.
--- fs/f2fs/data.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/f2fs/data.c +9 -3
@@ -341,14 +341,20 @@ static void f2fs_write_end_io(struct bio page->index != nid_of_node(page));dec_page_count (sbi, type); + +/* +* we should access sbi before end_page_writeback() to +* avoid racing w/ kill_f2fs_super() +*/ +if (type ==F2FS_WB_CP_DATA && !get_pages (sbi, type) && +wq_has_sleeper (&sbi->cp_wait)) +wake_up (&sbi->cp_wait); +if (f2fs_in_warm_node_list (sbi, page))f2fs_del_fsync_node_entry (sbi, page);clear_page_private_gcing (page);end_page_writeback (page); } -if (!get_pages (sbi,F2FS_WB_CP_DATA ) && -wq_has_sleeper (&sbi->cp_wait)) -wake_up (&sbi->cp_wait);bio_put (bio); }
Greg Kroah-Hartman
maintainerPATCH 38/39 f2fs: fix out-of-bounds access in sysfs attribute read/write
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
[ Upstream commit 98ea0039dbfdd00e5cc1b9a8afa40434476c0955 ]
Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes.
For example:
vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1
carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update.
atgc_age_threshold maps to {struct atgc_management}->age_threshold, which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX.
The root causes are:
1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes.
2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes.
This patch introduces {struct f2fs_attr}->size to record the actual size of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.
--- fs/f2fs/sysfs.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 58 insertions(+), 7 deletions(-)
fs/f2fs/sysfs.c +58 -7
@@ -48,6 +48,7 @@ struct f2fs_attr { const char *, size_t);int struct_type;int offset; +int size;int id; };
@@ -249,11 +250,30 @@ static ssize_t main_blkaddr_show(struct (unsigned long long)MAIN_BLKADDR(sbi)); } +static ssize_t __sbi_show_value (struct f2fs_attr *a, +struct f2fs_sb_info *sbi,char *buf, +unsigned char *value) +{ +switch (a->size) { +case 1 : +return sysfs_emit (buf,"%u\n" , *(u8 *)value); +case 2 : +return sysfs_emit (buf,"%u\n" , *(u16 *)value); +case 4 : +return sysfs_emit (buf,"%u\n" , *(u32 *)value); +case 8 : +return sysfs_emit (buf,"%llu\n" , *(u64 *)value); +default : +f2fs_bug_on (sbi,1 ); +return sysfs_emit (buf, +"show sysfs node value with wrong type\n" ); + } +} +static ssize_t f2fs_sbi_show (struct f2fs_attr *a,struct f2fs_sb_info *sbi,char *buf) {unsigned char *ptr =NULL ; -unsigned int *ui; ptr =__struct_ptr (sbi, a->struct_type);if (!ptr)
@@ -316,9 +336,30 @@ static ssize_t f2fs_sbi_show(struct f2fs sbi->gc_reclaimed_segs[sbi->gc_segment_mode]); } - ui = (unsigned int *)(ptr + a->offset); +return __sbi_show_value (a, sbi, buf, ptr + a->offset); +} -return sprintf (buf,"%u\n" , *ui); +static void __sbi_store_value (struct f2fs_attr *a, +struct f2fs_sb_info *sbi, +unsigned char *ui,unsigned long value) +{ +switch (a->size) { +case 1 : + *(u8 *)ui = value; +break ; +case 2 : + *(u16 *)ui = value; +break ; +case 4 : + *(u32 *)ui = value; +break ; +case 8 : + *(u64 *)ui = value; +break ; +default : +f2fs_bug_on (sbi,1 ); +f2fs_err (sbi,"store sysfs node value with wrong type" ); + } } static ssize_t __sbi_store(struct f2fs_attr *a,
@@ -559,7 +600,7 @@ out:return count; } - *ui = (unsigned int )t; +__sbi_store_value (a, sbi, ptr + a->offset, t);return count; }
@@ -655,19 +696,28 @@ static struct f2fs_attr f2fs_attr_sb_##_ .id = F2FS_FEATURE_##_feat, \ } -#define F2FS_ATTR_OFFSET (_struct_type, _name, _mode, _show, _store, _offset) \ +#define F2FS_ATTR_OFFSET (_struct_type, _name, _mode, _show, _store, _offset, _size) \ static struct f2fs_attr f2fs_attr_##_name = { \ .attr = {.name = __stringify(_name), .mode = _mode }, \ .show = _show, \ .store = _store, \ .struct_type = _struct_type, \ - .offset = _offset \ + .offset = _offset, \ + .size = _size \ } +#define F2FS_RO_ATTR (struct_type, struct_name, name, elname) \ + F2FS_ATTR_OFFSET(struct_type, name, 0444, \ + f2fs_sbi_show, NULL, \ + offsetof(struct struct_name, elname), \ + sizeof_field(struct struct_name, elname)) + +#define F2FS_RW_ATTR (struct_type, struct_name, name, elname) \ F2FS_ATTR_OFFSET(struct_type, name, 0644, \ f2fs_sbi_show, f2fs_sbi_store, \ - offsetof(struct struct_name, elname)) + offsetof(struct struct_name, elname), \ + sizeof_field(struct struct_name, elname))#define F2FS_GENERAL_RO_ATTR (name) \ static struct f2fs_attr f2fs_attr_##name = __ATTR(name, 0444, name##_show, NULL)
@@ -678,6 +728,7 @@ static struct f2fs_attr f2fs_attr_##_nam .show = f2fs_sbi_show, \ .struct_type = _struct_type, \ .offset = offsetof(struct _struct_name, _elname), \ + .size = sizeof_field(struct _struct_name, _elname), \ } F2FS_RW_ATTR(GC_THREAD, f2fs_gc_kthread, gc_urgent_sleep_time,
Greg Kroah-Hartman
maintainerPATCH 39/39 USB: serial: option: add Telit FN920C04 RNDIS compositions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 509f403f3ccec14188036212118651bf23599396 upstream.
Add the following compositions:
0x10a1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a6: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10ab: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10ab Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -1401,12 +1401,16 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a1, 0xff), /* Telit FN20C04 (RNDIS) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a6, 0xff), /* Telit FN920C04 (RNDIS) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */
@@ -1415,6 +1419,8 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10ab, 0xff), /* Telit FN920C04 (RNDIS) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) },
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.201 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.201-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.201 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.201-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
118 tests: 118 pass, 0 failLinux version: 5.15.201-rc1-ge0006213afb7
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 5.15.201-rc1-00040-ge0006213afb7 #1 SMP Wed Feb 18 08:20:11 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.201 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.201 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
Quoted 6 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/
patch-5.15.201-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.
Hi Greg,
No issues were seen on x86_64 and aarch64 platforms with our testing.
Quoted 4 lines
thanks,
greg k-h
thanks,
Vijay
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.201 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.201-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).