6.18.14-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 511/641 ovpn: fix possible use-after-free in ovpn_net_xmit
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41 ]
When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations:
- peer lookup,
- skb_dst_drop (even though all segments produced by skb_gso_segment will have a dst attached),
- ovpn_peer_stats_increment_tx.
Fix this by moving the peer lookup and skb_dst_drop before segmentation so that the original skb is still valid when used. Return early if all segments fail skb_share_check and the list ends up empty. Also switch ovpn_peer_stats_increment_tx to use skb_list.next; the next patch fixes the stats logic.
--- drivers/net/ovpn/io.c | 52 ++++++++++++++++++++++++++----------------- 1 file changed, 31 insertions(+), 21 deletions(-)
drivers/net/ovpn/io.c +31 -21
@@ -365,7 +365,27 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev)/* verify IP header size in network packet */ proto =ovpn_ip_check_protocol (skb);if (unlikely (!proto || skb->protocol != proto)) - goto drop; + goto drop_no_peer; + +/* retrieve peer serving the destination IP of this packet */ + peer =ovpn_peer_get_by_dst (ovpn, skb); +if (unlikely (!peer)) { +switch (skb->protocol) { +case htons (ETH_P_IP ): +net_dbg_ratelimited ("%s: no peer to send data to dst=%pI4\n" , +netdev_name (ovpn->dev), + &ip_hdr (skb)->daddr); +break ; +case htons (ETH_P_IPV6 ): +net_dbg_ratelimited ("%s: no peer to send data to dst=%pI6c\n" , +netdev_name (ovpn->dev), + &ipv6_hdr (skb)->daddr); +break ; + } + goto drop_no_peer; + } +/* dst was needed for peer selection - it can now be dropped */ +skb_dst_drop (skb);if (skb_is_gso (skb)) { segments =skb_gso_segment (skb,0 );
@@ -396,34 +416,24 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev)__skb_queue_tail (&skb_list, curr); } - skb_list.prev->next =NULL ; -/* retrieve peer serving the destination IP of this packet */ - peer =ovpn_peer_get_by_dst (ovpn, skb); -if (unlikely (!peer)) { -switch (skb->protocol) { -case htons (ETH_P_IP ): -net_dbg_ratelimited ("%s: no peer to send data to dst=%pI4\n" , -netdev_name (ovpn->dev), - &ip_hdr (skb)->daddr); -break ; -case htons (ETH_P_IPV6 ): -net_dbg_ratelimited ("%s: no peer to send data to dst=%pI6c\n" , -netdev_name (ovpn->dev), - &ipv6_hdr (skb)->daddr); -break ; - } - goto drop; +/* no segments survived: don't jump to 'drop' because we already +* incremented the counter for each failure in the loop +*/ +if (unlikely (skb_queue_empty (&skb_list))) { +ovpn_peer_put (peer); +return NETDEV_TX_OK ; } -/* dst was needed for peer selection - it can now be dropped */ -skb_dst_drop (skb); + skb_list.prev->next =NULL ; -ovpn_peer_stats_increment_tx (&peer->vpn_stats, skb->len); +ovpn_peer_stats_increment_tx (&peer->vpn_stats, skb_list.next->len);ovpn_send (ovpn, skb_list.next, peer);return NETDEV_TX_OK ; drop: +ovpn_peer_put (peer); +drop_no_peer:dev_dstats_tx_dropped (ovpn->dev);skb_tx_error (skb);kfree_skb_list (skb);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 512/641 ovpn: fix VPN TX bytes counting
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit b660b13d4c6379ca6360f24aaef8c5807fefd237 ]
In ovpn_net_xmit, after GSO segmentation and segment processing, the first segment on the list is used to increment VPN TX statistics, which fails to account for any subsequent segments in the chain.
Fix this by accumulating the length of every segment that successfully passes skb_share_check into a tx_bytes variable. This ensures the peer statistics accurately reflect the total data volume sent, regardless of whether the original packet was segmented.
--- drivers/net/ovpn/io.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ovpn/io.c +4 -1
@@ -355,6 +355,7 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev)struct ovpn_priv *ovpn =netdev_priv (dev);struct sk_buff *segments, *curr, *next;struct sk_buff_head skb_list; +unsigned int tx_bytes =0 ;struct ovpn_peer *peer;__be16 proto;int ret;
@@ -414,6 +415,8 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev)continue ; } +/* only count what we actually send */ + tx_bytes += curr->len;__skb_queue_tail (&skb_list, curr); }
@@ -426,7 +429,7 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) } skb_list.prev->next =NULL ; -ovpn_peer_stats_increment_tx (&peer->vpn_stats, skb_list.next->len); +ovpn_peer_stats_increment_tx (&peer->vpn_stats, tx_bytes);ovpn_send (ovpn, skb_list.next, peer);return NETDEV_TX_OK ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 513/641 selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit a2646773a005b59fd1dc7ff3ba15df84889ca5d2 ]
As explained in [1], iproute2 started rejecting tc-police burst sizes that result in an overflow. This can happen when the burst size is high enough and the rate is low enough.
A couple of test cases specify such configurations, resulting in iproute2 errors and test failure.
Fix by reducing the burst size so that the test will pass with both new and old iproute2 versions.
[1] https://lore.kernel.org/netdev/[email protected]/
--- tools/testing/selftests/drivers/net/mlxsw/tc_restrictions.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/drivers/net/mlxsw/tc_restrictions.sh +2 -2
@@ -317,7 +317,7 @@ police_limits_test() tc filter add dev $swp1 ingress pref 1 proto ip handle 101 \ flower skip_sw \ - action police rate 0.5kbit burst 1m conform-exceed drop/ok + action police rate 0.5kbit burst 2k conform-exceed drop/ok check_fail $? "Incorrect success to add police action with too low rate" tc filter add dev $swp1 ingress pref 1 proto ip handle 101 \
@@ -327,7 +327,7 @@ police_limits_test() tc filter add dev $swp1 ingress pref 1 proto ip handle 101 \ flower skip_sw \ - action police rate 1.5kbit burst 1m conform-exceed drop/ok + action police rate 1.5kbit burst 2k conform-exceed drop/ok check_err $? "Failed to add police action with low rate" tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 514/641 selftests: net: lib: Fix jq parsing error
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit 10ec0fc0ccc525abc807b0ca8ad5a26a0bd56361 ]
The testcase failed as below:$./vlan_bridge_binding.sh
...
+ adf_ip_link_set_up d1
+ local name=d1
+ shift
+ ip_link_is_up d1
+ ip_link_has_flag d1 UP
+ local name=d1
+ shift
+ local flag=UP
+ shift
++ ip -j link show d1
++ jq --arg flag UP 'any(.[].flags.[]; . == $flag)'
jq: error: syntax error, unexpected '[', expecting FORMAT or QQSTRING_START
(Unix shell quoting issues?) at <top-level>, line 1:
any(.[].flags.[]; . == $flag)
jq: 1 compile error
Remove the extra dot (.) after flags array to fix this.
--- tools/testing/selftests/net/lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/lib.sh +1 -1
@@ -576,7 +576,7 @@ ip_link_has_flag() local flag=$1; shift local state=$(ip -j link show "$name" | - jq --arg flag "$flag" 'any(.[].flags.[]; . == $flag)') + jq --arg flag "$flag" 'any(.[].flags[]; . == $flag)') [[ $state == true ]] }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 515/641 net: stmmac: remove broken PCS code
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <[email protected]>
[ Upstream commit 813882ae22756bcf9645d405e045c60e5aab0a93 ]
Changing the netif_carrier_*() state behind phylink's back has always been prohibited because it messes up with phylinks state tracking, and means that phylink no longer guarantees to call the mac_link_down() and mac_link_up() methods at the appropriate times. This was later documented in the sfp-phylink network driver conversion guide.
stmmac was converted to phylink in 2019, but nothing was done with the "PCS" code. Since then, apart from the updates as part of phylink development, nothing has happened with stmmac to improve its use of phylink, or even to address this point.
A couple of years ago, a has_integrated_pcs boolean was added by Bart, which later became the STMMAC_FLAG_HAS_INTEGRATED_PCS flag, to avoid manipulating the netif_carrier_*() state. This flag is mis-named, because whenever the stmmac is synthesized for its native SGMII, TBI or RTBI interfaces, it has an "integrated PCS". This boolean/flag actually means "ignore the status from the integrated PCS".
Discussing with Bart, the reasons for this are lost to the winds of time (which is why we should always document the reasons in the commit message.)
RGMII also has in-band status, and the dwmac cores and stmmac code supports this but with one bug that saves the day.
When dwmac cores are synthesised for RGMII only, they do not contain an integrated PCS, and so priv->dma_cap.pcs is clear, which prevents (incorrectly) the "RGMII PCS" being used, meaning we don't read the in-band status. However, a core synthesised for RGMII and also SGMII, TBI or RTBI will have this capability bit set, thus making these code paths reachable.
The Jetson Xavier NX uses RGMII mode to talk to its PHY, and removing the incorrect check for priv->dma_cap.pcs reveals the theortical issue with netif_carrier_*() manipulation is real:
dwc-eth-dwmac 2490000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 dwc-eth-dwmac 2490000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=141) dwc-eth-dwmac 2490000.ethernet eth0: No Safety Features support found
dwc-eth-dwmac 2490000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported dwc-eth-dwmac 2490000.ethernet eth0: registered PTP clock
dwc-eth-dwmac 2490000.ethernet eth0: configuring for phy/rgmii-id link mode
8021q: adding VLAN 0 to HW filter on device eth0
dwc-eth-dwmac 2490000.ethernet eth0: Adding VLAN ID 0 is not supported
Link is Up - 1000/Full
Link is Down
Link is Up - 1000/Full
This looks good until one realises that the phylink "Link" status messages are missing, even when the RJ45 cable is reconnected. Nothing one can do results in the interface working. The interrupt handler (which prints those "Link is" messages) always wins over phylink's resolve worker, meaning phylink never calls the mac_link_up() nor mac_link_down() methods.
eth0 also sees no traffic received, and is unable to obtain a DHCP address:
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group defa ult qlen 1000
link/ether e6:d3:6a:e6:92:de brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
27686 149 0 0 0 0
With the STMMAC_FLAG_HAS_INTEGRATED_PCS flag set, which disables the netif_carrier_*() manipulation then stmmac works normally:
dwc-eth-dwmac 2490000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 dwc-eth-dwmac 2490000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=141) dwc-eth-dwmac 2490000.ethernet eth0: No Safety Features support found
dwc-eth-dwmac 2490000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported dwc-eth-dwmac 2490000.ethernet eth0: registered PTP clock
dwc-eth-dwmac 2490000.ethernet eth0: configuring for phy/rgmii-id link mode
8021q: adding VLAN 0 to HW filter on device eth0
dwc-eth-dwmac 2490000.ethernet eth0: Adding VLAN ID 0 is not supported
Link is Up - 1000/Full
dwc-eth-dwmac 2490000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
and packets can be transferred.
This clearly shows that when priv->hw->pcs is set, but STMMAC_FLAG_HAS_INTEGRATED_PCS is clear, the driver reliably fails.
Discovering whether a platform falls into this is impossible as parsing all the dtsi and dts files to find out which use the stmmac driver, whether any of them use RGMII or SGMII and also depends whether an external interface is being used. The kernel likely doesn't contain all dts files either.
The only driver that sets this flag uses the qcom,sa8775p-ethqos compatible, and uses SGMII or 2500BASE-X.
but these are saved from this problem by the incorrect check for priv->dma_cap.pcs.
So, we have to assume that for every other platform that uses SGMII with stmmac is using an external PCS.
Moreover, ethtool output can be incorrect. With the full-duplex link negotiated, ethtool reports:
Speed: 1000Mb/s
Duplex: Halfbecause with dwmac4, the full-duplex bit is in bit 16 of the status, priv->xstats.pcs_duplex becomes BIT(16) for full duplex, but the ethtool ksettings duplex member is u8 - so becomes zero. Moreover, the supported, advertised and link partner modes are all "not reported".
Finally, ksettings_set() won't be able to set the advertisement on a PHY if this PCS code is activated, which is incorrect when SGMII is used with a PHY.
Thus, remove:
1. the incorrect netif_carrier_*() manipulation.
2. the broken ethtool ksettings code.
Given that all uses of STMMAC_FLAG_HAS_INTEGRATED_PCS are now gone, remove the flag from stmmac.h and dwmac-qcom-ethqos.c.
Stable-dep-of: babab1b42ed6 ("net: stmmac: fix oops when split header is enabled")
--- .../stmicro/stmmac/dwmac-qcom-ethqos.c | 4 -- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 55 ------------------- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 9 --- include/linux/stmmac.h | 1 - 4 files changed, 69 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c +0 -4
@@ -96,7 +96,6 @@ struct ethqos_emac_driver_data {bool rgmii_config_loopback_en;bool has_emac_ge_3;const char *link_clk_name; -bool has_integrated_pcs;u32 dma_addr_width;struct dwmac4_addrs dwmac4_addrs;bool needs_sgmii_loopback;
@@ -282,7 +281,6 @@ static const struct ethqos_emac_driver_data emac_v4_0_0_data = { .rgmii_config_loopback_en = false, .has_emac_ge_3 = true, .link_clk_name = "phyaux", - .has_integrated_pcs = true, .needs_sgmii_loopback = true, .dma_addr_width = 36, .dwmac4_addrs = {
@@ -856,8 +854,6 @@ static int qcom_ethqos_probe(struct platform_device *pdev) plat_dat->flags |=STMMAC_FLAG_TSO_EN ;if (of_device_is_compatible (np,"qcom,qcs404-ethqos" )) plat_dat->flags |=STMMAC_FLAG_RX_CLK_RUNS_IN_LPI ; -if (data->has_integrated_pcs) - plat_dat->flags |=STMMAC_FLAG_HAS_INTEGRATED_PCS ;if (data->dma_addr_width) plat_dat->host_dma_width = data->dma_addr_width;
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +0 -55
67 lines not on this page · raw message
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +0 -9
@@ -6012,15 +6012,6 @@ static void stmmac_common_interrupt(struct stmmac_priv *priv)for (queue =0 ; queue < queues_count; queue++)stmmac_host_mtl_irq_status (priv, priv->hw, queue); -/* PCS link status */ -if (priv->hw->pcs && - !(priv->plat->flags &STMMAC_FLAG_HAS_INTEGRATED_PCS )) { -if (priv->xstats.pcs_link) -netif_carrier_on (priv->dev); -else -netif_carrier_off (priv->dev); - } -stmmac_timestamp_interrupt (priv, priv); } }
include/linux/stmmac.h +0 -1
@@ -171,7 +171,6 @@ struct dwmac4_addrs {u32 mtl_low_cred_offset; }; -#define STMMAC_FLAG_HAS_INTEGRATED_PCS BIT(0)#define STMMAC_FLAG_SPH_DISABLE BIT(1)#define STMMAC_FLAG_USE_PHY_WOL BIT(2)#define STMMAC_FLAG_HAS_SUN8I BIT(3)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 516/641 net: stmmac: replace has_xxxx with core_type
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <[email protected]>
[ Upstream commit 26ab9830beabda863766be4a79dc590c7645f4d9 ]
Replace the has_gmac, has_gmac4 and has_xgmac ints, of which only one can be set when matching a core to its driver backend, with an enumerated type carrying the DWMAC core type.
Stable-dep-of: babab1b42ed6 ("net: stmmac: fix oops when split header is enabled")
--- drivers/net/ethernet/stmicro/stmmac/common.h | 5 ++ .../stmicro/stmmac/dwmac-dwc-qos-eth.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 5 +- .../ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +- .../ethernet/stmicro/stmmac/dwmac-loongson.c | 2 +- .../ethernet/stmicro/stmmac/dwmac-lpc18xx.c | 2 +- .../stmicro/stmmac/dwmac-qcom-ethqos.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +- .../net/ethernet/stmicro/stmmac/dwmac-s32.c | 2 +- .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-tegra.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.c | 73 +++++++------------ .../net/ethernet/stmicro/stmmac/stmmac_est.c | 4 +- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 13 ++-- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 34 +++++---- .../net/ethernet/stmicro/stmmac/stmmac_mdio.c | 14 ++-- .../net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 +- .../ethernet/stmicro/stmmac/stmmac_platform.c | 9 +-- .../net/ethernet/stmicro/stmmac/stmmac_ptp.c | 4 +- include/linux/stmmac.h | 11 ++- 21 files changed, 94 insertions(+), 104 deletions(-)
drivers/net/ethernet/stmicro/stmmac/common.h +5 -0
@@ -43,6 +43,11 @@#define DWXGMAC_ID 0x76#define DWXLGMAC_ID 0x27 +static inline bool dwmac_is_xmac (enum dwmac_core_type core_type) +{ +return core_type ==DWMAC_CORE_GMAC4 || core_type ==DWMAC_CORE_XGMAC ; +} +#define STMMAC_CHAN0 0/* Always supported and default for all chips */ /* TX and RX Descriptor Length, these need to be power of two.
drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c +1 -1
@@ -109,7 +109,7 @@ static int dwc_eth_dwmac_config_dt(struct platform_device *pdev, }/* dwc-qos needs GMAC4, AAL, TSO and PMT */ - plat_dat->has_gmac4 =1 ; + plat_dat->core_type =DWMAC_CORE_GMAC4 ; plat_dat->dma_cfg->aal =1 ; plat_dat->flags |=STMMAC_FLAG_TSO_EN ; plat_dat->pmt =1 ;
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +2 -3
@@ -565,7 +565,7 @@ static void common_default_data(struct plat_stmmacenet_data *plat) {/* clk_csr_i = 20-35MHz & MDC = clk_csr_i/16 */ plat->clk_csr =STMMAC_CSR_20_35M ; - plat->has_gmac =1 ; + plat->core_type =DWMAC_CORE_GMAC ; plat->force_sf_dma_mode =1 ; plat->mdio_bus_data->needs_reset = true;
@@ -612,8 +612,7 @@ static int intel_mgbe_common_data(struct pci_dev *pdev, plat->pdev = pdev; plat->phy_addr =-1 ; plat->clk_csr =STMMAC_CSR_250_300M ; - plat->has_gmac =0 ; - plat->has_gmac4 =1 ; + plat->core_type =DWMAC_CORE_GMAC4 ; plat->force_sf_dma_mode =0 ; plat->flags |= (STMMAC_FLAG_TSO_EN |STMMAC_FLAG_SPH_DISABLE );
drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +1 -1
@@ -473,7 +473,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)return err; } - plat_dat->has_gmac = true; + plat_dat->core_type =DWMAC_CORE_GMAC ; plat_dat->bsp_priv = gmac; plat_dat->set_clk_tx_rate = ipq806x_gmac_set_clk_tx_rate; plat_dat->multicast_filter_bins =0 ;
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +1 -1
@@ -92,7 +92,7 @@ static void loongson_default_data(struct pci_dev *pdev,/* clk_csr_i = 20-35MHz & MDC = clk_csr_i/16 */ plat->clk_csr =STMMAC_CSR_20_35M ; - plat->has_gmac =1 ; + plat->core_type =DWMAC_CORE_GMAC ; plat->force_sf_dma_mode =1 ;/* Set default value for multicast hash bins */
drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c +1 -1
@@ -41,7 +41,7 @@ static int lpc18xx_dwmac_probe(struct platform_device *pdev)if (IS_ERR (plat_dat))return PTR_ERR (plat_dat); - plat_dat->has_gmac = true; + plat_dat->core_type =DWMAC_CORE_GMAC ; reg =syscon_regmap_lookup_by_compatible ("nxp,lpc1850-creg" );if (IS_ERR (reg)) {
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c +1 -1
@@ -846,7 +846,7 @@ static int qcom_ethqos_probe(struct platform_device *pdev) plat_dat->fix_mac_speed = ethqos_fix_mac_speed; plat_dat->dump_debug_regs = rgmii_dump; plat_dat->ptp_clk_freq_config = ethqos_ptp_clk_freq_config; - plat_dat->has_gmac4 =1 ; + plat_dat->core_type =DWMAC_CORE_GMAC4 ;if (ethqos->has_emac_ge_3) plat_dat->dwmac4_addrs = &data->dwmac4_addrs; plat_dat->pmt =1 ;
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +2 -2
@@ -1751,8 +1751,8 @@ static int rk_gmac_probe(struct platform_device *pdev)/* If the stmmac is not already selected as gmac4, * then make sure we fallback to gmac. */ -if (!plat_dat->has_gmac4) { - plat_dat->has_gmac = true; +if (plat_dat->core_type !=DWMAC_CORE_GMAC4 ) { + plat_dat->core_type =DWMAC_CORE_GMAC ; plat_dat->rx_fifo_size =4096 ; plat_dat->tx_fifo_size =2048 ; }
drivers/net/ethernet/stmicro/stmmac/dwmac-s32.c +1 -1
@@ -146,7 +146,7 @@ static int s32_dwmac_probe(struct platform_device *pdev) gmac->ioaddr = res.addr;/* S32CC core feature set */ - plat->has_gmac4 = true; + plat->core_type =DWMAC_CORE_GMAC4 ; plat->pmt =1 ; plat->flags |=STMMAC_FLAG_SPH_DISABLE ; plat->rx_fifo_size =20480 ;
drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +1 -1
@@ -497,7 +497,7 @@ static int socfpga_dwmac_probe(struct platform_device *pdev) plat_dat->pcs_init = socfpga_dwmac_pcs_init; plat_dat->pcs_exit = socfpga_dwmac_pcs_exit; plat_dat->select_pcs = socfpga_dwmac_select_pcs; - plat_dat->has_gmac = true; + plat_dat->core_type =DWMAC_CORE_GMAC ; plat_dat->riwt_off =1 ;
drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +1 -1
@@ -136,7 +136,7 @@ static int sun7i_gmac_probe(struct platform_device *pdev)/* platform data specifying hardware features and callbacks. * hardware features were copied from Allwinner drivers. */ plat_dat->tx_coe =1 ; - plat_dat->has_gmac = true; + plat_dat->core_type =DWMAC_CORE_GMAC ; plat_dat->bsp_priv = gmac; plat_dat->init = sun7i_gmac_init; plat_dat->exit = sun7i_gmac_exit;
drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c +1 -1
@@ -308,7 +308,7 @@ static int tegra_mgbe_probe(struct platform_device *pdev) goto disable_clks; } - plat->has_xgmac =1 ; + plat->core_type =DWMAC_CORE_XGMAC ; plat->flags |=STMMAC_FLAG_TSO_EN ; plat->pmt =1 ; plat->bsp_priv = mgbe;
drivers/net/ethernet/stmicro/stmmac/hwif.c +26 -47
163 lines not on this page · raw message
drivers/net/ethernet/stmicro/stmmac/stmmac_est.c +2 -2
@@ -53,7 +53,7 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg, } ctrl =readl (est_addr +EST_CONTROL ); -if (priv->plat->has_xgmac) { +if (priv->plat->core_type ==DWMAC_CORE_XGMAC ) { ctrl &= ~EST_XGMAC_PTOV ; ctrl |= ((NSEC_PER_SEC / ptp_rate) *EST_XGMAC_PTOV_MUL ) <<EST_XGMAC_PTOV_SHIFT ;
@@ -148,7 +148,7 @@ static void est_irq_status(struct stmmac_priv *priv, struct net_device *dev, }if (status &EST_BTRE ) { -if (priv->plat->has_xgmac) { +if (priv->plat->core_type ==DWMAC_CORE_XGMAC ) { btrl =FIELD_GET (EST_XGMAC_BTRL , status); btrl_max =FIELD_MAX (EST_XGMAC_BTRL ); }else {
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +7 -6
@@ -303,9 +303,10 @@ static void stmmac_ethtool_getdrvinfo(struct net_device *dev, {struct stmmac_priv *priv =netdev_priv (dev); -if (priv->plat->has_gmac || priv->plat->has_gmac4) +if (priv->plat->core_type ==DWMAC_CORE_GMAC || + priv->plat->core_type ==DWMAC_CORE_GMAC4 )strscpy (info->driver,GMAC_ETHTOOL_NAME ,sizeof (info->driver)); -else if (priv->plat->has_xgmac) +else if (priv->plat->core_type ==DWMAC_CORE_XGMAC )strscpy (info->driver,XGMAC_ETHTOOL_NAME ,sizeof (info->driver));else strscpy(info->driver, MAC100_ETHTOOL_NAME,
@@ -351,9 +352,9 @@ static int stmmac_ethtool_get_regs_len(struct net_device *dev) {struct stmmac_priv *priv =netdev_priv (dev); -if (priv->plat->has_xgmac) +if (priv->plat->core_type ==DWMAC_CORE_XGMAC )return XGMAC_REGSIZE *4 ; -else if (priv->plat->has_gmac4) +else if (priv->plat->core_type ==DWMAC_CORE_GMAC4 )return GMAC4_REG_SPACE_SIZE ;return REG_SPACE_SIZE ; }
@@ -368,12 +369,12 @@ static void stmmac_ethtool_gregs(struct net_device *dev,stmmac_dump_dma_regs (priv, priv->ioaddr, reg_space);/* Copy DMA registers to where ethtool expects them */ -if (priv->plat->has_gmac4) { +if (priv->plat->core_type ==DWMAC_CORE_GMAC4 ) {/* GMAC4 dumps its DMA registers at its DMA_CHAN_BASE_ADDR */ memcpy (®_space[ETHTOOL_DMA_OFFSET ], ®_space[GMAC4_DMA_CHAN_BASE_ADDR /4 ],NUM_DWMAC4_DMA_REGS *4 ); - }else if (!priv->plat->has_xgmac) { + }else if (priv->plat->core_type !=DWMAC_CORE_XGMAC ) {memcpy (®_space[ETHTOOL_DMA_OFFSET ], ®_space[DMA_BUS_MODE /4 ],NUM_DWMAC1000_DMA_REGS *4 );
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +18 -16
@@ -446,7 +446,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,if (!priv->hwts_rx_en)return ;/* For GMAC4, the valid timestamp is from CTX next desc. */ -if (priv->plat->has_gmac4 || priv->plat->has_xgmac) +if (dwmac_is_xmac (priv->plat->core_type)) desc = np;/* Check if timestamp is available */
@@ -697,7 +697,7 @@ static int stmmac_hwtstamp_get(struct net_device *dev,static int stmmac_init_tstamp_counter (struct stmmac_priv *priv,u32 systime_flags) { -bool xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; +bool xmac =dwmac_is_xmac (priv->plat->core_type);struct timespec64 now;u32 sec_inc =0 ;u64 temp =0 ;
@@ -746,7 +746,7 @@ static int stmmac_init_tstamp_counter(struct stmmac_priv *priv,*/ static int stmmac_init_timestamping (struct stmmac_priv *priv) { -bool xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; +bool xmac =dwmac_is_xmac (priv->plat->core_type);int ret;if (priv->plat->ptp_clk_freq_config)
@@ -2398,7 +2398,7 @@ static void stmmac_dma_operation_mode(struct stmmac_priv *priv) txfifosz = priv->dma_cap.tx_fifo_size;/* Split up the shared Tx/Rx FIFO memory on DW QoS Eth and DW XGMAC */ -if (priv->plat->has_gmac4 || priv->plat->has_xgmac) { +if (dwmac_is_xmac (priv->plat->core_type)) { rxfifosz /= rx_channels_count; txfifosz /= tx_channels_count; }
@@ -4514,7 +4514,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)if (skb_is_gso (skb) && priv->tso) {if (gso & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 ))return stmmac_tso_xmit (skb, dev); -if (priv->plat->has_gmac4 && (gso &SKB_GSO_UDP_L4 )) +if (priv->plat->core_type ==DWMAC_CORE_GMAC4 && + (gso &SKB_GSO_UDP_L4 ))return stmmac_tso_xmit (skb, dev); }
@@ -5984,7 +5985,7 @@ static void stmmac_common_interrupt(struct stmmac_priv *priv)u32 queue;bool xmac; - xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; + xmac =dwmac_is_xmac (priv->plat->core_type); queues_count = (rx_cnt > tx_cnt) ? rx_cnt : tx_cnt;if (priv->irq_wake)
@@ -5998,7 +5999,7 @@ static void stmmac_common_interrupt(struct stmmac_priv *priv)stmmac_fpe_irq_status (priv);/* To handle GMAC own interrupts */ -if ((priv->plat->has_gmac) || xmac) { +if (priv->plat->core_type ==DWMAC_CORE_GMAC || xmac) {int status =stmmac_host_irq_status (priv, priv->hw, &priv->xstats);if (unlikely (status)) {
@@ -6359,7 +6360,7 @@ static int stmmac_dma_cap_show(struct seq_file *seq, void *v) (priv->dma_cap.mbps_1000) ? "Y" : "N");seq_printf (seq,"\tHalf duplex: %s\n" , (priv->dma_cap.half_duplex) ?"Y" :"N" ); -if (priv->plat->has_xgmac) { +if (priv->plat->core_type ==DWMAC_CORE_XGMAC ) {seq_printf (seq,"\tNumber of Additional MAC address registers: %d\n" , priv->dma_cap.multi_addr);
@@ -6383,7 +6384,7 @@ static int stmmac_dma_cap_show(struct seq_file *seq, void *v) (priv->dma_cap.time_stamp) ? "Y" : "N");seq_printf (seq,"\tIEEE 1588-2008 Advanced Time Stamp: %s\n" , (priv->dma_cap.atime_stamp) ?"Y" :"N" ); -if (priv->plat->has_xgmac) +if (priv->plat->core_type ==DWMAC_CORE_XGMAC )seq_printf (seq,"\tTimestamp System Time Source: %s\n" , dwxgmac_timestamp_source[priv->dma_cap.tssrc]); seq_printf(seq, "\t802.3az - Energy-Efficient Ethernet (EEE): %s\n",
@@ -6392,7 +6393,7 @@ static int stmmac_dma_cap_show(struct seq_file *seq, void *v)seq_printf (seq,"\tChecksum Offload in TX: %s\n" , (priv->dma_cap.tx_coe) ?"Y" :"N" );if (priv->synopsys_id >=DWMAC_CORE_4_00 || - priv->plat->has_xgmac) { + priv->plat->core_type ==DWMAC_CORE_XGMAC ) {seq_printf (seq,"\tIP Checksum Offload in RX: %s\n" , (priv->dma_cap.rx_coe) ?"Y" :"N" ); }else {
@@ -7244,8 +7245,9 @@ static int stmmac_hw_init(struct stmmac_priv *priv)* has to be disable and this can be done by passing the * riwt_off field from the platform. */ -if (((priv->synopsys_id >=DWMAC_CORE_3_50 ) || - (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) { +if ((priv->synopsys_id >=DWMAC_CORE_3_50 || + priv->plat->core_type ==DWMAC_CORE_XGMAC ) && + !priv->plat->riwt_off) { priv->use_riwt =1 ;dev_info (priv->device,"Enable RX Mitigation via HW Watchdog Timer\n" );
@@ -7359,7 +7361,7 @@ static int stmmac_xdp_rx_timestamp(const struct xdp_md *_ctx, u64 *timestamp)return -ENODATA ;/* For GMAC4, the valid timestamp is from CTX next desc. */ -if (priv->plat->has_gmac4 || priv->plat->has_xgmac) +if (dwmac_is_xmac (priv->plat->core_type)) desc_contains_ts = ndesc;/* Check if timestamp is available */
@@ -7515,7 +7517,7 @@ int stmmac_dvr_probe(struct device *device,if ((priv->plat->flags &STMMAC_FLAG_TSO_EN ) && (priv->dma_cap.tsoen)) { ndev->hw_features |=NETIF_F_TSO |NETIF_F_TSO6 ; -if (priv->plat->has_gmac4) +if (priv->plat->core_type ==DWMAC_CORE_GMAC4 ) ndev->hw_features |=NETIF_F_GSO_UDP_L4 ; priv->tso = true;dev_info (priv->device,"TSO feature enabled\n" );
@@ -7568,7 +7570,7 @@ int stmmac_dvr_probe(struct device *device,#ifdef STMMAC_VLAN_TAG_USED /* Both mac100 and gmac support receive VLAN tag detection */ ndev->features |=NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_STAG_RX ; -if (priv->plat->has_gmac4 || priv->plat->has_xgmac) { +if (dwmac_is_xmac (priv->plat->core_type)) { ndev->hw_features |=NETIF_F_HW_VLAN_CTAG_RX ; priv->hw->hw_vlan_en = true; }
@@ -7596,7 +7598,7 @@ int stmmac_dvr_probe(struct device *device,/* MTU range: 46 - hw-specific max */ ndev->min_mtu =ETH_ZLEN -ETH_HLEN ; -if (priv->plat->has_xgmac) +if (priv->plat->core_type ==DWMAC_CORE_XGMAC ) ndev->max_mtu =XGMAC_JUMBO_LEN ;else if ((priv->plat->enh_desc) || (priv->synopsys_id >=DWMAC_CORE_4_00 )) ndev->max_mtu =JUMBO_LEN ;
drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +7 -7
@@ -301,7 +301,7 @@ static int stmmac_mdio_read_c22(struct mii_bus *bus, int phyaddr, int phyreg)struct stmmac_priv *priv =netdev_priv (bus->priv);u32 cmd; -if (priv->plat->has_gmac4) +if (priv->plat->core_type ==DWMAC_CORE_GMAC4 ) cmd =MII_GMAC4_READ ;else cmd =0 ;
@@ -344,7 +344,7 @@ static int stmmac_mdio_write_c22(struct mii_bus *bus, int phyaddr, int phyreg,struct stmmac_priv *priv =netdev_priv (bus->priv);u32 cmd; -if (priv->plat->has_gmac4) +if (priv->plat->core_type ==DWMAC_CORE_GMAC4 ) cmd =MII_GMAC4_WRITE ;else cmd =MII_ADDR_GWRITE ;
@@ -417,7 +417,7 @@ int stmmac_mdio_reset(struct mii_bus *bus)* on MDC, so perform a dummy mdio read. To be updated for GMAC4 * if needed. */ -if (!priv->plat->has_gmac4) +if (priv->plat->core_type !=DWMAC_CORE_GMAC4 )writel (0 , priv->ioaddr + mii_address);#endif return 0 ;
@@ -528,7 +528,7 @@ static u32 stmmac_clk_csr_set(struct stmmac_priv *priv) value =0 ; } -if (priv->plat->has_xgmac) { +if (priv->plat->core_type ==DWMAC_CORE_XGMAC ) {if (clk_rate >400000000 ) value =0x5 ;else if (clk_rate >350000000 )
@@ -600,7 +600,7 @@ int stmmac_mdio_register(struct net_device *ndev) new_bus->name ="stmmac" ; -if (priv->plat->has_xgmac) { +if (priv->plat->core_type ==DWMAC_CORE_XGMAC ) { new_bus->read = &stmmac_xgmac2_mdio_read_c22; new_bus->write = &stmmac_xgmac2_mdio_write_c22; new_bus->read_c45 = &stmmac_xgmac2_mdio_read_c45;
@@ -621,7 +621,7 @@ int stmmac_mdio_register(struct net_device *ndev) }else { new_bus->read = &stmmac_mdio_read_c22; new_bus->write = &stmmac_mdio_write_c22; -if (priv->plat->has_gmac4) { +if (priv->plat->core_type ==DWMAC_CORE_GMAC4 ) { new_bus->read_c45 = &stmmac_mdio_read_c45; new_bus->write_c45 = &stmmac_mdio_write_c45; }
@@ -649,7 +649,7 @@ int stmmac_mdio_register(struct net_device *ndev) }/* Looks like we need a dummy read for XGMAC only and C45 PHYs */ -if (priv->plat->has_xgmac) +if (priv->plat->core_type ==DWMAC_CORE_XGMAC )stmmac_xgmac2_mdio_read_c45 (new_bus,0 ,0 ,0 );/* If fixed-link is set, skip PHY scanning */
drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +2 -2
@@ -23,7 +23,7 @@ static void common_default_data(struct plat_stmmacenet_data *plat) {/* clk_csr_i = 20-35MHz & MDC = clk_csr_i/16 */ plat->clk_csr =STMMAC_CSR_20_35M ; - plat->has_gmac =1 ; + plat->core_type =DWMAC_CORE_GMAC ; plat->force_sf_dma_mode =1 ; plat->mdio_bus_data->needs_reset = true;
@@ -76,7 +76,7 @@ static int snps_gmac5_default_data(struct pci_dev *pdev,int i; plat->clk_csr =STMMAC_CSR_250_300M ; - plat->has_gmac4 =1 ; + plat->core_type =DWMAC_CORE_GMAC4 ; plat->force_sf_dma_mode =1 ; plat->flags |=STMMAC_FLAG_TSO_EN ; plat->pmt =1 ;
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +4 -5
@@ -552,12 +552,12 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) &pdev->dev, plat->unicast_filter_entries); plat->multicast_filter_bins =dwmac1000_validate_mcast_bins ( &pdev->dev, plat->multicast_filter_bins); - plat->has_gmac =1 ; + plat->core_type =DWMAC_CORE_GMAC ; plat->pmt =1 ; }if (of_device_is_compatible (np,"snps,dwmac-3.40a" )) { - plat->has_gmac =1 ; + plat->core_type =DWMAC_CORE_GMAC ; plat->enh_desc =1 ; plat->tx_coe =1 ; plat->bugged_jumbo =1 ;
@@ -565,8 +565,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) }if (of_device_compatible_match (np, stmmac_gmac4_compats)) { - plat->has_gmac4 =1 ; - plat->has_gmac =0 ; + plat->core_type =DWMAC_CORE_GMAC4 ; plat->pmt =1 ;if (of_property_read_bool (np,"snps,tso" )) plat->flags |=STMMAC_FLAG_TSO_EN ;
@@ -580,7 +579,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) }if (of_device_is_compatible (np,"snps,dwxgmac" )) { - plat->has_xgmac =1 ; + plat->core_type =DWMAC_CORE_XGMAC ; plat->pmt =1 ;if (of_property_read_bool (np,"snps,tso" )) plat->flags |=STMMAC_FLAG_TSO_EN ;
drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +2 -2
@@ -57,7 +57,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)bool xmac, est_rst = false;int ret; - xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; + xmac =dwmac_is_xmac (priv->plat->core_type);if (delta <0 ) { neg_adj =1 ;
@@ -344,7 +344,7 @@ void stmmac_ptp_register(struct stmmac_priv *priv)/* Calculate the clock domain crossing (CDC) error if necessary */ priv->plat->cdc_error_adj =0 ; -if (priv->plat->has_gmac4) +if (priv->plat->core_type ==DWMAC_CORE_GMAC4 ) priv->plat->cdc_error_adj = (2 *NSEC_PER_SEC ) / priv->plat->clk_ptp_rate;/* Update the ptp clock parameters based on feature discovery, when
include/linux/stmmac.h +8 -3
@@ -171,6 +171,13 @@ struct dwmac4_addrs {u32 mtl_low_cred_offset; }; +enum dwmac_core_type { +DWMAC_CORE_MAC100 , +DWMAC_CORE_GMAC , +DWMAC_CORE_GMAC4 , +DWMAC_CORE_XGMAC , +}; +#define STMMAC_FLAG_SPH_DISABLE BIT(1)#define STMMAC_FLAG_USE_PHY_WOL BIT(2)#define STMMAC_FLAG_HAS_SUN8I BIT(3)
@@ -186,6 +193,7 @@ struct dwmac4_addrs {#define STMMAC_FLAG_HWTSTAMP_CORRECT_LATENCY BIT(13)struct plat_stmmacenet_data { +enum dwmac_core_type core_type;int bus_id;int phy_addr;/* MAC ----- optional PCS ----- SerDes ----- optional PHY ----- Media
@@ -219,7 +227,6 @@ struct plat_stmmacenet_data {struct stmmac_dma_cfg *dma_cfg;struct stmmac_safety_feature_cfg *safety_feat_cfg;int clk_csr; -int has_gmac;int enh_desc;int tx_coe;int rx_coe;
@@ -282,10 +289,8 @@ struct plat_stmmacenet_data {struct reset_control *stmmac_rst;struct reset_control *stmmac_ahb_rst;struct stmmac_axi *axi; -int has_gmac4;int rss_en;int mac_port_sel_speed; -int has_xgmac;u8 vlan_fail_q;struct pci_dev *pdev;int int_snapshot_num;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 517/641 net: stmmac: fix oops when split header is enabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Zhang <[email protected]>
[ Upstream commit babab1b42ed68877ef669a08384becf281ad2582 ]
For GMAC4, when split header is enabled, in some rare cases, the hardware does not fill buf2 of the first descriptor with payload. Thus we cannot assume buf2 is always fully filled if it is not the last descriptor. Otherwise, the length of buf2 of the second descriptor will be calculated wrong and cause an oops:
Unable to handle kernel paging request at virtual address ffff00019246bfc0 ... x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000 Call trace: dcache_inval_poc+0x28/0x58 (P) dma_direct_sync_single_for_cpu+0x38/0x6c __dma_sync_single_for_cpu+0x34/0x6c stmmac_napi_poll_rx+0x8f0/0xb60 __napi_poll.constprop.0+0x30/0x144 net_rx_action+0x160/0x274 handle_softirqs+0x1b8/0x1fc
...
To fix this, the PL bit-field in RDES3 register is used for all descriptors, whether it is the last descriptor or not.
--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +17 -3
@@ -4880,13 +4880,27 @@ static unsigned int stmmac_rx_buf2_len(struct stmmac_priv *priv,if (!priv->sph)return 0 ; -/* Not last descriptor */ -if (status & rx_not_ls) +/* For GMAC4, when split header is enabled, in some rare cases, the +* hardware does not fill buf2 of the first descriptor with payload. +* Thus we cannot assume buf2 is always fully filled if it is not +* the last descriptor. Otherwise, the length of buf2 of the second +* descriptor will be calculated wrong and cause an oops. +* +* If this is the last descriptor, 'plen' is the length of the +* received packet that was transferred to system memory. +* Otherwise, it is the accumulated number of bytes that have been +* transferred for the current packet. +* +* Thus 'plen - len' always gives the correct length of buf2. +*/ + +/* Not GMAC4 and not last descriptor */ +if (priv->plat->core_type !=DWMAC_CORE_GMAC4 && (status & rx_not_ls))return priv->dma_conf.dma_buf_sz; +/* GMAC4 or last descriptor */ plen =stmmac_get_rx_frame_len (priv, p, coe); -/* Last descriptor */ return plen - len; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 518/641 net: sparx5/lan969x: fix DWRR cost max to match hardware register width
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Machon <[email protected]>
[ Upstream commit 6c28aa8dfdf24f554d4c5d4ff7d723a95360d94a ]
DWRR (Deficit Weighted Round Robin) scheduling distributes bandwidth across traffic classes based on per-queue cost values, where lower cost means higher bandwidth share.
The SPX5_DWRR_COST_MAX constant is 63 (6 bits) but the hardware register field HSCH_DWRR_ENTRY_DWRR_COST is GENMASK(24, 20), only 5 bits wide (max 31). This causes sparx5_weight_to_hw_cost() to compute cost values that silently overflow via FIELD_PREP, resulting in incorrect scheduling weights.
Set SPX5_DWRR_COST_MAX to 31 to match the hardware register width.
--- drivers/net/ethernet/microchip/sparx5/sparx5_qos.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/microchip/sparx5/sparx5_qos.h +1 -1
@@ -35,7 +35,7 @@#define SPX5_SE_BURST_UNIT 4096/* Dwrr */ -#define SPX5_DWRR_COST_MAX 63 +#define SPX5_DWRR_COST_MAX 31struct sparx5_shaper {u32 mode;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 519/641 net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
[ Upstream commit 29372f07f7969a2f0490793226ecf6c8c6bde0fa ]
Extract the PTP timestamp handling logic from ocelot_port_xmit() into a separate ocelot_xmit_timestamp() helper function. This is a pure refactor with no behavioral change.
The helper returns false if the skb was consumed (freed) due to a timestamp request failure, and true if the caller should continue with frame injection. The rew_op value is returned via pointer.
This prepares for splitting ocelot_port_xmit() into separate FDMA and register injection paths in a subsequent patch.
Stable-dep-of: 026f6513c588 ("net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()")
--- drivers/net/ethernet/mscc/ocelot_net.c | 36 ++++++++++++++++---------- 1 file changed, 22 insertions(+), 14 deletions(-)
drivers/net/ethernet/mscc/ocelot_net.c +22 -14
@@ -551,33 +551,41 @@ static int ocelot_port_stop(struct net_device *dev)return 0 ; } -static netdev_tx_t ocelot_port_xmit (struct sk_buff *skb,struct net_device *dev) +static bool ocelot_xmit_timestamp (struct ocelot *ocelot,int port, +struct sk_buff *skb,u32 *rew_op) { -struct ocelot_port_private *priv =netdev_priv (dev); -struct ocelot_port *ocelot_port = &priv->port; -struct ocelot *ocelot = ocelot_port->ocelot; -int port = priv->port.index; -u32 rew_op =0 ; - -if (!static_branch_unlikely (&ocelot_fdma_enabled) && - !ocelot_can_inject (ocelot,0 )) -return NETDEV_TX_BUSY ; - -/* Check if timestamping is needed */ if (ocelot->ptp && (skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP )) {struct sk_buff *clone =NULL ;if (ocelot_port_txtstamp_request (ocelot, port, skb, &clone)) {kfree_skb (skb); -return NETDEV_TX_OK ; +return false; }if (clone)OCELOT_SKB_CB (skb)->clone = clone; - rew_op =ocelot_ptp_rew_op (skb); + *rew_op =ocelot_ptp_rew_op (skb); } +return true; +} + +static netdev_tx_t ocelot_port_xmit (struct sk_buff *skb,struct net_device *dev) +{ +struct ocelot_port_private *priv =netdev_priv (dev); +struct ocelot_port *ocelot_port = &priv->port; +struct ocelot *ocelot = ocelot_port->ocelot; +int port = priv->port.index; +u32 rew_op =0 ; + +if (!static_branch_unlikely (&ocelot_fdma_enabled) && + !ocelot_can_inject (ocelot,0 )) +return NETDEV_TX_BUSY ; + +if (!ocelot_xmit_timestamp (ocelot, port, skb, &rew_op)) +return NETDEV_TX_OK ; +if (static_branch_unlikely (&ocelot_fdma_enabled)) {ocelot_fdma_inject_frame (ocelot, port, rew_op, skb, dev); }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 520/641 net: mscc: ocelot: split xmit into FDMA and register injection paths
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
[ Upstream commit 47f79b20e7fb885aa1623b759a68e8e27401ec4d ]
Split ocelot_port_xmit() into two separate functions:
- ocelot_port_xmit_fdma(): handles the FDMA injection path
- ocelot_port_xmit_inj(): handles the register-based injection path
The top-level ocelot_port_xmit() now dispatches to the appropriate function based on the ocelot_fdma_enabled static key.
This is a pure refactor with no behavioral change. Separating the two code paths makes each one simpler and prepares for adding proper locking to the register injection path without affecting the FDMA path.
Stable-dep-of: 026f6513c588 ("net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()")
--- drivers/net/ethernet/mscc/ocelot_net.c | 39 ++++++++++++++++++++------ 1 file changed, 30 insertions(+), 9 deletions(-)
drivers/net/ethernet/mscc/ocelot_net.c +30 -9
@@ -571,7 +571,25 @@ static bool ocelot_xmit_timestamp(struct ocelot *ocelot, int port,return true; } -static netdev_tx_t ocelot_port_xmit (struct sk_buff *skb,struct net_device *dev) +static netdev_tx_t ocelot_port_xmit_fdma (struct sk_buff *skb, +struct net_device *dev) +{ +struct ocelot_port_private *priv =netdev_priv (dev); +struct ocelot_port *ocelot_port = &priv->port; +struct ocelot *ocelot = ocelot_port->ocelot; +int port = priv->port.index; +u32 rew_op =0 ; + +if (!ocelot_xmit_timestamp (ocelot, port, skb, &rew_op)) +return NETDEV_TX_OK ; + +ocelot_fdma_inject_frame (ocelot, port, rew_op, skb, dev); + +return NETDEV_TX_OK ; +} + +static netdev_tx_t ocelot_port_xmit_inj (struct sk_buff *skb, +struct net_device *dev) {struct ocelot_port_private *priv =netdev_priv (dev);struct ocelot_port *ocelot_port = &priv->port;
@@ -579,24 +597,27 @@ static netdev_tx_t ocelot_port_xmit(struct sk_buff *skb, struct net_device *dev)int port = priv->port.index;u32 rew_op =0 ; -if (!static_branch_unlikely (&ocelot_fdma_enabled) && - !ocelot_can_inject (ocelot,0 )) +if (!ocelot_can_inject (ocelot,0 ))return NETDEV_TX_BUSY ;if (!ocelot_xmit_timestamp (ocelot, port, skb, &rew_op))return NETDEV_TX_OK ; -if (static_branch_unlikely (&ocelot_fdma_enabled)) { -ocelot_fdma_inject_frame (ocelot, port, rew_op, skb, dev); - }else { -ocelot_port_inject_frame (ocelot, port,0 , rew_op, skb); +ocelot_port_inject_frame (ocelot, port,0 , rew_op, skb); -consume_skb (skb); - } +consume_skb (skb);return NETDEV_TX_OK ; } +static netdev_tx_t ocelot_port_xmit (struct sk_buff *skb,struct net_device *dev) +{ +if (static_branch_unlikely (&ocelot_fdma_enabled)) +return ocelot_port_xmit_fdma (skb, dev); + +return ocelot_port_xmit_inj (skb, dev); +} +enum ocelot_action_type {OCELOT_MACT_LEARN ,OCELOT_MACT_FORGET ,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 521/641 net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
[ Upstream commit 026f6513c5880c2c89e38ad66bbec2868f978605 ]
ocelot_port_xmit_inj() calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock. Both functions contain lockdep_assert_held() for the injection lock, and the correct caller felix_port_deferred_xmit() properly acquires the lock using ocelot_lock_inj_grp() before calling these functions.
Add ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register injection path to fix the missing lock protection. The FDMA path is not affected as it uses its own locking mechanism.
--- drivers/net/ethernet/mscc/ocelot_net.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/mscc/ocelot_net.c +10 -2
@@ -597,14 +597,22 @@ static netdev_tx_t ocelot_port_xmit_inj(struct sk_buff *skb,int port = priv->port.index;u32 rew_op =0 ; -if (!ocelot_can_inject (ocelot,0 )) +ocelot_lock_inj_grp (ocelot,0 ); + +if (!ocelot_can_inject (ocelot,0 )) { +ocelot_unlock_inj_grp (ocelot,0 );return NETDEV_TX_BUSY ; + } -if (!ocelot_xmit_timestamp (ocelot, port, skb, &rew_op)) +if (!ocelot_xmit_timestamp (ocelot, port, skb, &rew_op)) { +ocelot_unlock_inj_grp (ocelot,0 );return NETDEV_TX_OK ; + }ocelot_port_inject_frame (ocelot, port,0 , rew_op, skb); +ocelot_unlock_inj_grp (ocelot,0 ); +consume_skb (skb);return NETDEV_TX_OK ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 522/641 selftests: netconsole: remove log noise due to socat exit
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Carvalho <[email protected]>
[ Upstream commit e3b8cbf40c6e60a7a935bd8980884d5741a7a77b ]
This removes some noise that can be distracting while looking at selftests by redirecting socat stderr to /dev/null.
Before this commit, netcons_basic would output:
Running with target mode: basic (ipv6) 2025/11/29 12:08:03 socat[259] W exiting on signal 15 2025/11/29 12:08:03 socat[271] W exiting on signal 15 basic : ipv6 : Test passed
Running with target mode: basic (ipv4) 2025/11/29 12:08:05 socat[329] W exiting on signal 15 2025/11/29 12:08:05 socat[322] W exiting on signal 15 basic : ipv4 : Test passed
Running with target mode: extended (ipv6) 2025/11/29 12:08:08 socat[386] W exiting on signal 15 2025/11/29 12:08:08 socat[386] W exiting on signal 15 2025/11/29 12:08:08 socat[380] W exiting on signal 15 extended : ipv6 : Test passed
Running with target mode: extended (ipv4) 2025/11/29 12:08:10 socat[440] W exiting on signal 15 2025/11/29 12:08:10 socat[435] W exiting on signal 15 2025/11/29 12:08:10 socat[435] W exiting on signal 15 extended : ipv4 : Test passed
After these changes, output looks like:
Running with target mode: basic (ipv6)
basic : ipv6 : Test passed
Running with target mode: basic (ipv4)
basic : ipv4 : Test passed
Running with target mode: extended (ipv6)
extended : ipv6 : Test passed
Running with target mode: extended (ipv4)
extended : ipv4 : Test passed
Stable-dep-of: a68a9bd086c2 ("selftests: netconsole: Increase port listening timeout")
--- tools/testing/selftests/drivers/net/lib/sh/lib_netcons.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/drivers/net/lib/sh/lib_netcons.sh +1 -1
@@ -249,7 +249,7 @@ function listen_port_and_save_to() { # Just wait for 2 seconds timeout 2 ip netns exec "${NAMESPACE}" \ - socat "${SOCAT_MODE}":"${PORT}",fork "${OUTPUT}" + socat "${SOCAT_MODE}":"${PORT}",fork "${OUTPUT}" 2> /dev/null } # Only validate that the message arrived properly
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 523/641 selftests: netconsole: Increase port listening timeout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pin-yen Lin <[email protected]>
[ Upstream commit a68a9bd086c2822d0c629443bd16ad1317afe501 ]
wait_for_port() can wait up to 2 seconds with the sleep and the polling in wait_local_port_listen() combined. So, in netcons_basic.sh, the socat process could die before the test writes to the netconsole.
Increase the timeout to 3 seconds to make netcons_basic.sh pass consistently.
--- tools/testing/selftests/drivers/net/lib/sh/lib_netcons.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/drivers/net/lib/sh/lib_netcons.sh +2 -2
@@ -247,8 +247,8 @@ function listen_port_and_save_to() { SOCAT_MODE="UDP6-LISTEN" fi - # Just wait for 2 seconds - timeout 2 ip netns exec "${NAMESPACE}" \ + # Just wait for 3 seconds + timeout 3 ip netns exec "${NAMESPACE}" \ socat "${SOCAT_MODE}":"${PORT}",fork "${OUTPUT}" 2> /dev/null }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 524/641 ipv6: Fix out-of-bound access in fib6_add_rt2node().
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 8244f959e2c125c849e569f5b23ed49804cce695 ]
syzbot reported out-of-bound read in fib6_add_rt2node(). [0]
When IPv6 route is created with RTA_NH_ID, struct fib6_info does not have the trailing struct fib6_nh.
The cited commit started to check !iter->fib6_nh->fib_nh_gw_family to ensure that rt6_qualify_for_ecmp() will return false for iter.
If iter->nh is not NULL, rt6_qualify_for_ecmp() returns false anyway.
Let's check iter->nh before reading iter->fib6_nh and avoid OOB read.
[0]:
BUG: KASAN: slab-out-of-bounds in fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 Read of size 1 at addr ffff8880384ba6de by task syz.0.18/5500 CPU: 0 UID: 0 PID: 5500 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1363 [inline] fib6_add+0x910/0x18c0 net/ipv6/ip6_fib.c:1531 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3957 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9316b9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8809b678 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9316e15fa0 RCX: 00007f9316b9aeb9 RDX: 0000000000000000 RSI: 0000200000004380 RDI: 0000000000000003 RBP: 00007f9316c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9316e15fac R14: 00007f9316e15fa0 R15: 00007f9316e15fa0 </TASK> Allocated by task 5499: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_noprof+0x40c/0x7e0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] fib6_info_alloc+0x30/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x142/0x860 net/ipv6/route.c:3820 ip6_route_add+0x49/0x1b0 net/ipv6/route.c:3949 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/ipv6/ip6_fib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_fib.c +1 -1
@@ -1139,7 +1139,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,fib6_add_gc_list (iter); }if (!(rt->fib6_flags & (RTF_ADDRCONF |RTF_PREFIX_RT )) && - !iter->fib6_nh->fib_nh_gw_family) { + (iter->nh || !iter->fib6_nh->fib_nh_gw_family)) { iter->fib6_flags &= ~RTF_ADDRCONF ; iter->fib6_flags &= ~RTF_PREFIX_RT ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 526/641 fbnic: close fw_log race between users and teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
[ Upstream commit ee5492fd88cfc079c19fbeac78e9e53b7f6c04f3 ]
Fixes a theoretical race on fw_log between the teardown path and fw_log write functions.
fw_log is written inside fbnic_fw_log_write() and can be reached from the mailbox handler fbnic_fw_msix_intr(), but fw_log is freed before IRQ/MBX teardown during cleanup, resulting in a potential data race of dereferencing a freed/null variable.
Possible Interleaving Scenario:
CPU0: fbnic_fw_msix_intr() // Entry
fbnic_fw_log_write()
if (fbnic_fw_log_ready()) // true
... preempt ...
CPU1: fbnic_remove() // Entry
fbnic_fw_log_free()
vfree(log->data_start);
log->data_start = NULL; CPU0: continues, walks log->entries or writes to log->data_start
The initialization also has an incorrect order problem, as the fw_log is currently allocated after MBX setup during initialization. Fix the problems by adjusting the synchronization order to put initialization in place before the mailbox is enabled, and not cleared until after the mailbox has been disabled.
--- .../net/ethernet/meta/fbnic/fbnic_fw_log.c | 3 --- drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 19 ++++++++++++------- 2 files changed, 12 insertions(+), 10 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_fw_log.c +0 -3
@@ -51,8 +51,6 @@ int fbnic_fw_log_init(struct fbnic_dev *fbd) log->data_start = data; log->data_end = data +FBNIC_FW_LOG_SIZE ; -fbnic_fw_log_enable (fbd, true); -return 0 ; }
@@ -63,7 +61,6 @@ void fbnic_fw_log_free(struct fbnic_dev *fbd)if (!fbnic_fw_log_ready (fbd))return ; -fbnic_fw_log_disable (fbd);INIT_LIST_HEAD (&log->entries); log->size =0 ;vfree (log->data_start);
drivers/net/ethernet/meta/fbnic/fbnic_pci.c +12 -7
@@ -303,11 +303,17 @@ static int fbnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) goto free_irqs; } + err =fbnic_fw_log_init (fbd); +if (err) +dev_warn (fbd->dev, +"Unable to initialize firmware log buffer: %d\n" , + err); + err =fbnic_fw_request_mbx (fbd);if (err) {dev_err (&pdev->dev,"Firmware mailbox initialization failure\n" ); - goto free_irqs; + goto free_fw_log; }/* Send the request to enable the FW logging to host. Note if this
@@ -315,11 +321,7 @@ static int fbnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)* possible the FW is just too old to support the logging and needs * to be updated. */ - err =fbnic_fw_log_init (fbd); -if (err) -dev_warn (fbd->dev, -"Unable to initialize firmware log buffer: %d\n" , - err); +fbnic_fw_log_enable (fbd, true);fbnic_devlink_register (fbd);fbnic_devlink_otp_check (fbd,"error detected during probe" );
@@ -363,6 +365,8 @@ static int fbnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)* firmware updates for fixes. */ return 0 ; +free_fw_log: +fbnic_fw_log_free (fbd); free_irqs:fbnic_free_irqs (fbd); err_destroy_health:
@@ -397,8 +401,9 @@ static void fbnic_remove(struct pci_dev *pdev)fbnic_hwmon_unregister (fbd);fbnic_dbg_fbd_exit (fbd);fbnic_devlink_unregister (fbd); -fbnic_fw_log_free (fbd); +fbnic_fw_log_disable (fbd);fbnic_fw_free_mbx (fbd); +fbnic_fw_log_free (fbd);fbnic_free_irqs (fbd);fbnic_devlink_health_destroy (fbd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 527/641 libbpf: Fix invalid write loop logic in bpf_linker__add_buf()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <[email protected]>
[ Upstream commit 04999b99e81eaa7b6223ec1c03af3bcb4ac57aaa ]
Fix bpf_linker__add_buf()'s logic of copying data from memory buffer into memfd. In the event of short write not writing entire buf_sz bytes into memfd file, we'll append bytes from the beginning of buf *again* (corrupting ELF file contents) instead of correctly appending the rest of not-yet-read buf contents.
--- tools/lib/bpf/linker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/linker.c +1 -1
@@ -581,7 +581,7 @@ int bpf_linker__add_buf(struct bpf_linker *linker, void *buf, size_t buf_sz, written =0 ;while (written < buf_sz) { - ret =write (fd, buf, buf_sz); + ret =write (fd, buf + written, buf_sz - written);if (ret <0 ) { ret = -errno;pr_warn ("failed to write '%s': %s\n" , filename,errstr (ret));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 528/641 bpf: Fix a potential use-after-free of BTF object
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit ccd2d799ed4467c07f5ee18c2f5c59bcc990822c ]
Refcounting in the check_pseudo_btf_id() function is incorrect:
the __check_pseudo_btf_id() function might get called with a zero refcounted btf. Fix this, and patch related code accordingly.
v3: rephrase a comment (AI)
v2: fix a refcount leak introduced in v1 (AI)
--- kernel/bpf/verifier.c | 52 +++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 26 deletions(-)
kernel/bpf/verifier.c +26 -26
@@ -20219,29 +20219,29 @@ static int find_btf_percpu_datasec(struct btf *btf) }/* -* Add btf to the used_btfs array and return the index. (If the btf was -* already added, then just return the index.) Upon successful insertion -* increase btf refcnt, and, if present, also refcount the corresponding -* kernel module. +* Add btf to the env->used_btfs array. If needed, refcount the +* corresponding kernel module. To simplify caller's logic +* in case of error or if btf was added before the function +* decreases the btf refcount. */ static int __add_used_btf (struct bpf_verifier_env *env,struct btf *btf) {struct btf_mod_pair *btf_mod; +int ret =0 ;int i;/* check whether we recorded this BTF (and maybe module) already */ for (i =0 ; i < env->used_btf_cnt; i++)if (env->used_btfs[i].btf == btf) -return i; + goto ret_put;if (env->used_btf_cnt >=MAX_USED_BTFS ) {verbose (env,"The total number of btfs per program has reached the limit of %u\n" ,MAX_USED_BTFS ); -return -E2BIG ; + ret = -E2BIG ; + goto ret_put; } -btf_get (btf); - btf_mod = &env->used_btfs[env->used_btf_cnt]; btf_mod->btf = btf; btf_mod->module =NULL ;
@@ -20250,12 +20250,18 @@ static int __add_used_btf(struct bpf_verifier_env *env, struct btf *btf)if (btf_is_module (btf)) { btf_mod->module =btf_try_get_module (btf);if (!btf_mod->module) { -btf_put (btf); -return -ENXIO ; + ret = -ENXIO ; + goto ret_put; } } -return env->used_btf_cnt++; + env->used_btf_cnt++; +return 0 ; + +ret_put: +/* Either error or this BTF was already added */ +btf_put (btf); +return ret; }/* replace pseudo btf_id with kernel symbol address */
@@ -20352,9 +20358,7 @@ static int check_pseudo_btf_id(struct bpf_verifier_env *env, btf_fd = insn[1 ].imm;if (btf_fd) { -CLASS (fd, f)(btf_fd); - - btf =__btf_get_by_fd (f); + btf =btf_get_by_fd (btf_fd);if (IS_ERR (btf)) {verbose (env,"invalid module BTF object FD specified.\n" );return -EINVAL ;
@@ -20364,17 +20368,17 @@ static int check_pseudo_btf_id(struct bpf_verifier_env *env,verbose (env,"kernel is missing BTF, make sure CONFIG_DEBUG_INFO_BTF=y is specified in Kconfig.\n" );return -EINVAL ; } +btf_get (btf_vmlinux); btf = btf_vmlinux; } err =__check_pseudo_btf_id (env, insn, aux, btf); -if (err) +if (err) { +btf_put (btf);return err; + } - err =__add_used_btf (env, btf); -if (err <0 ) -return err; -return 0 ; +return __add_used_btf (env, btf); }static bool is_tracing_prog_type (enum bpf_prog_type type)
@@ -24094,13 +24098,9 @@ static int add_fd_from_fd_array(struct bpf_verifier_env *env, int fd)return 0 ; } - btf =__btf_get_by_fd (f); -if (!IS_ERR (btf)) { - err =__add_used_btf (env, btf); -if (err <0 ) -return err; -return 0 ; - } + btf =btf_get_by_fd (fd); +if (!IS_ERR (btf)) +return __add_used_btf (env, btf);verbose (env,"fd %d is not pointing to valid bpf_map or btf\n" , fd);return PTR_ERR (map);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 529/641 bpf: Add a map/btf from a fd array more consistently
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit b0b1a8583d8e797114e613139e3e3318a1704690 ]
The add_fd_from_fd_array() function takes a file descriptor as a parameter and tries to add either map or btf to the corresponding list of used objects. As was reported by Dan Carpenter, since the commit c81e4322acf0 ("bpf: Fix a potential use-after-free of BTF object"), the fdget() is called twice on the file descriptor, and thus userspace, potentially, can replace the file pointed to by the file descriptor in between the two calls. On practice, this shouldn't break anything on the kernel side, but for consistency fix the code such that only one fdget() is executed.
--- kernel/bpf/verifier.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/bpf/verifier.c +4 -2
@@ -24098,9 +24098,11 @@ static int add_fd_from_fd_array(struct bpf_verifier_env *env, int fd)return 0 ; } - btf =btf_get_by_fd (fd); -if (!IS_ERR (btf)) + btf =__btf_get_by_fd (f); +if (!IS_ERR (btf)) { +btf_get (btf);return __add_used_btf (env, btf); + }verbose (env,"fd %d is not pointing to valid bpf_map or btf\n" , fd);return PTR_ERR (map);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 530/641 eth: fbnic: Configure RDE settings for pause frame
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohsin Bashir <[email protected]>
[ Upstream commit 0135333914d63181f823bd340ae96737c8a820ca ]
fbnic supports pause frames. When pause frames are enabled presumably user expects lossless operation from the NIC. Make sure we configure RDE (Rx DMA Engine) to DROP_NEVER mode to avoid discards due to delays in fetching Rx descriptors from the host.
While at it enable DROP_NEVER when NIC only has a single queue configured. In this case the NIC acts as a FIFO so there's no risk of head-of-line blocking other queues by making RDE wait. If pause is disabled this just moves the packet loss from the DMA engine to the Rx buffer.
Remove redundant call to fbnic_config_drop_mode_rcq(), introduced by commit 0cb4c0a13723 ("eth: fbnic: Implement Rx queue alloc/start/stop/free"). This call does not add value as fbnic_enable_rcq(), which is called immediately afterward, already handles this.
Although we do not support autoneg at this time, preserve tx_pause in .mac_link_up instead of fbnic_phylink_get_pauseparam()
Stable-dep-of: bbeb3bfbffe0 ("eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0")
--- .../net/ethernet/meta/fbnic/fbnic_netdev.h | 2 ++ .../net/ethernet/meta/fbnic/fbnic_phylink.c | 3 +++ drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 26 ++++++++++++++++--- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 1 + 4 files changed, 28 insertions(+), 4 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_netdev.h +2 -0
@@ -73,6 +73,8 @@ struct fbnic_net {/* Time stamping filter config */ struct kernel_hwtstamp_config hwtstamp_config; + +bool tx_pause; };int __fbnic_open (struct fbnic_net *fbn);
drivers/net/ethernet/meta/fbnic/fbnic_phylink.c +3 -0
@@ -208,6 +208,9 @@ fbnic_phylink_mac_link_up(struct phylink_config *config,struct fbnic_net *fbn =netdev_priv (netdev);struct fbnic_dev *fbd = fbn->fbd; + fbn->tx_pause = tx_pause; +fbnic_config_drop_mode (fbn, tx_pause); + fbd->mac->link_up (fbd, tx_pause, rx_pause); }
drivers/net/ethernet/meta/fbnic/fbnic_txrx.c +22 -4
@@ -2573,11 +2573,15 @@ static void fbnic_enable_bdq(struct fbnic_ring *hpq, struct fbnic_ring *ppq) }static void fbnic_config_drop_mode_rcq (struct fbnic_napi_vector *nv, -struct fbnic_ring *rcq) +struct fbnic_ring *rcq,bool tx_pause) { +struct fbnic_net *fbn =netdev_priv (nv->napi.dev);u32 drop_mode, rcq_ctl; - drop_mode =FBNIC_QUEUE_RDE_CTL0_DROP_IMMEDIATE ; +if (!tx_pause && fbn->num_rx_queues >1 ) + drop_mode =FBNIC_QUEUE_RDE_CTL0_DROP_IMMEDIATE ; +else + drop_mode =FBNIC_QUEUE_RDE_CTL0_DROP_NEVER ;/* Specify packet layout */ rcq_ctl = FIELD_PREP(FBNIC_QUEUE_RDE_CTL0_DROP_MODE_MASK, drop_mode) |
@@ -2587,6 +2591,21 @@ static void fbnic_config_drop_mode_rcq(struct fbnic_napi_vector *nv,fbnic_ring_wr32 (rcq,FBNIC_QUEUE_RDE_CTL0 , rcq_ctl); } +void fbnic_config_drop_mode (struct fbnic_net *fbn,bool tx_pause) +{ +int i, t; + +for (i =0 ; i < fbn->num_napi; i++) { +struct fbnic_napi_vector *nv = fbn->napi[i]; + +for (t =0 ; t < nv->rxt_count; t++) { +struct fbnic_q_triad *qt = &nv->qt[nv->txt_count + t]; + +fbnic_config_drop_mode_rcq (nv, &qt->cmpl, tx_pause); + } + } +} +static void fbnic_config_rim_threshold (struct fbnic_ring *rcq,u16 nv_idx,u32 rx_desc) {u32 threshold;
@@ -2636,7 +2655,7 @@ static void fbnic_enable_rcq(struct fbnic_napi_vector *nv,u32 hds_thresh = fbn->hds_thresh;u32 rcq_ctl =0 ; -fbnic_config_drop_mode_rcq (nv, rcq); +fbnic_config_drop_mode_rcq (nv, rcq, fbn->tx_pause);/* Force lower bound on MAX_HEADER_BYTES. Below this, all frames should * be split at L4. It would also result in the frames being split at
@@ -2699,7 +2718,6 @@ static void __fbnic_nv_enable(struct fbnic_napi_vector *nv) &nv->napi);fbnic_enable_bdq (&qt->sub0, &qt->sub1); -fbnic_config_drop_mode_rcq (nv, &qt->cmpl);fbnic_enable_rcq (nv, &qt->cmpl); } }
drivers/net/ethernet/meta/fbnic/fbnic_txrx.h +1 -0
@@ -184,6 +184,7 @@ void fbnic_reset_netif_queues(struct fbnic_net *fbn);irqreturn_t fbnic_msix_clean_rings (int irq,void *data);void fbnic_napi_enable (struct fbnic_net *fbn);void fbnic_napi_disable (struct fbnic_net *fbn); +void fbnic_config_drop_mode (struct fbnic_net *fbn,bool tx_pause);void fbnic_enable (struct fbnic_net *fbn);void fbnic_disable (struct fbnic_net *fbn);void fbnic_flush (struct fbnic_net *fbn);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 531/641 eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bobby Eshleman <[email protected]>
[ Upstream commit bbeb3bfbffe0279fa47c041658b037fb38a93965 ]
Fix EN_HDR_SPLIT configuration by writing the field to RDE_CTL0 instead of RDE_CTL1.
Because drop mode configuration and header splitting enablement both use RDE_CTL0, we consolidate these configurations into the single function fbnic_config_drop_mode.
--- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 25 +++++++++++--------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_txrx.c +14 -11
@@ -2573,7 +2573,8 @@ static void fbnic_enable_bdq(struct fbnic_ring *hpq, struct fbnic_ring *ppq) }static void fbnic_config_drop_mode_rcq (struct fbnic_napi_vector *nv, -struct fbnic_ring *rcq,bool tx_pause) +struct fbnic_ring *rcq,bool tx_pause, +bool hdr_split) {struct fbnic_net *fbn =netdev_priv (nv->napi.dev);u32 drop_mode, rcq_ctl;
@@ -2586,22 +2587,26 @@ static void fbnic_config_drop_mode_rcq(struct fbnic_napi_vector *nv,/* Specify packet layout */ rcq_ctl =FIELD_PREP (FBNIC_QUEUE_RDE_CTL0_DROP_MODE_MASK , drop_mode) |FIELD_PREP (FBNIC_QUEUE_RDE_CTL0_MIN_HROOM_MASK ,FBNIC_RX_HROOM ) | -FIELD_PREP (FBNIC_QUEUE_RDE_CTL0_MIN_TROOM_MASK ,FBNIC_RX_TROOM ); +FIELD_PREP (FBNIC_QUEUE_RDE_CTL0_MIN_TROOM_MASK ,FBNIC_RX_TROOM ) | +FIELD_PREP (FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT , hdr_split);fbnic_ring_wr32 (rcq,FBNIC_QUEUE_RDE_CTL0 , rcq_ctl); } -void fbnic_config_drop_mode (struct fbnic_net *fbn,bool tx_pause) +void fbnic_config_drop_mode (struct fbnic_net *fbn,bool txp) { +bool hds;int i, t; + hds = fbn->hds_thresh <FBNIC_HDR_BYTES_MIN ; +for (i =0 ; i < fbn->num_napi; i++) {struct fbnic_napi_vector *nv = fbn->napi[i];for (t =0 ; t < nv->rxt_count; t++) {struct fbnic_q_triad *qt = &nv->qt[nv->txt_count + t]; -fbnic_config_drop_mode_rcq (nv, &qt->cmpl, tx_pause); +fbnic_config_drop_mode_rcq (nv, &qt->cmpl, txp, hds); } } }
@@ -2652,20 +2657,18 @@ static void fbnic_enable_rcq(struct fbnic_napi_vector *nv, {struct fbnic_net *fbn =netdev_priv (nv->napi.dev);u32 log_size =fls (rcq->size_mask); -u32 hds_thresh = fbn->hds_thresh;u32 rcq_ctl =0 ; - -fbnic_config_drop_mode_rcq (nv, rcq, fbn->tx_pause); +bool hdr_split; +u32 hds_thresh;/* Force lower bound on MAX_HEADER_BYTES. Below this, all frames should * be split at L4. It would also result in the frames being split at * L2/L3 depending on the frame size. */ -if (fbn->hds_thresh <FBNIC_HDR_BYTES_MIN ) { - rcq_ctl =FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT ; - hds_thresh =FBNIC_HDR_BYTES_MIN ; - } + hdr_split = fbn->hds_thresh <FBNIC_HDR_BYTES_MIN ; +fbnic_config_drop_mode_rcq (nv, rcq, fbn->tx_pause, hdr_split); + hds_thresh =max (fbn->hds_thresh,FBNIC_HDR_BYTES_MIN ); rcq_ctl |=FIELD_PREP (FBNIC_QUEUE_RDE_CTL1_PADLEN_MASK ,FBNIC_RX_PAD ) |FIELD_PREP (FBNIC_QUEUE_RDE_CTL1_MAX_HDR_MASK , hds_thresh) | FIELD_PREP(FBNIC_QUEUE_RDE_CTL1_PAYLD_OFF_MASK,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 532/641 eth: fbnic: increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bobby Eshleman <[email protected]>
[ Upstream commit bd254115f38db3c046332bb62e8719e0dc7c2b53 ]
Increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes. The previous minimum was too small to guarantee that very long L2+L3+L4 headers always fit within the header buffer. When EN_HDR_SPLIT is disabled and a packet exceeds MAX_HEADER_BYTES, splitting occurs at that byte offset instead of the header boundary, resulting in some of the header landing in the payload page. The increased minimum ensures headers always fit with the MAX_HEADER_BYTES cut off and land in the header page.
--- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/meta/fbnic/fbnic_txrx.h +1 -1
@@ -66,7 +66,7 @@ struct fbnic_net; (4096 - FBNIC_RX_HROOM - FBNIC_RX_TROOM - FBNIC_RX_PAD)#define FBNIC_HDS_THRESH_DEFAULT \ (1536 - FBNIC_RX_PAD) -#define FBNIC_HDR_BYTES_MIN 128 +#define FBNIC_HDR_BYTES_MIN 256struct fbnic_pkt_buff {struct xdp_buff buff;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 533/641 eth: fbnic: set DMA_HINT_L4 for all flows
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bobby Eshleman <[email protected]>
[ Upstream commit 0f30a31b55c4179fc55613a75ef41d496687d465 ]
fbnic always advertises ETHTOOL_TCP_DATA_SPLIT_ENABLED via ethtool .get_ringparam. To enable proper splitting for all flow types, even for IP/Ethernet flows, this patch sets DMA_HINT_L4 unconditionally for all RSS and NFC flow steering rules. According to the spec, L4 falls back to L3 if no valid L4 is found, and L3 falls back to L2 if no L3 is found. This makes sure that the correct header boundary is used regardless of traffic type. This is important for zero-copy use cases where we must ensure that all ZC packets are split correctly.
--- drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c | 3 +++ drivers/net/ethernet/meta/fbnic/fbnic_rpc.c | 5 ++--- 2 files changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c +3 -0
@@ -1142,6 +1142,9 @@ static int fbnic_set_cls_rule_ins(struct fbnic_net *fbn,return -EINVAL ; } + dest |=FIELD_PREP (FBNIC_RPC_ACT_TBL0_DMA_HINT , +FBNIC_RCD_HDR_AL_DMA_HINT_L4 ); +/* Write action table values */ act_tcam->dest = dest; act_tcam->rss_en_mask =fbnic_flow_hash_2_rss_en_mask (fbn, hash_idx);
drivers/net/ethernet/meta/fbnic/fbnic_rpc.c +2 -3
@@ -338,9 +338,8 @@ void fbnic_rss_reinit(struct fbnic_dev *fbd, struct fbnic_net *fbn)else if (tstamp_mask & (1u << flow_type)) dest |=FBNIC_RPC_ACT_TBL0_TS_ENA ; -if (act1_value[flow_type] &FBNIC_RPC_TCAM_ACT1_L4_VALID ) - dest |=FIELD_PREP (FBNIC_RPC_ACT_TBL0_DMA_HINT , -FBNIC_RCD_HDR_AL_DMA_HINT_L4 ); + dest |=FIELD_PREP (FBNIC_RPC_ACT_TBL0_DMA_HINT , +FBNIC_RCD_HDR_AL_DMA_HINT_L4 ); rss_en_mask =fbnic_flow_hash_2_rss_en_mask (fbn, flow_type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 534/641 ovpn: tcp - dont deref NULL sk_socket member after tcp_close()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Quartulli <[email protected]>
[ Upstream commit 94560267d6c41b1ff3fafbab726e3f8a55a6af34 ]
When deleting a peer in case of keepalive expiration, the peer is removed from the OpenVPN hashtable and is temporary inserted in a "release list" for further processing.
This happens in:ovpn_peer_keepalive_work()
unlock_ovpn(release_list)
This processing includes detaching from the socket being used to talk to this peer, by restoring its original proto and socket ops/callbacks.
In case of TCP it may happen that, while the peer is sitting in the release list, userspace decides to close the socket. This will result in a concurrent execution of:
tcp_close(sk)
__tcp_close(sk)
sock_orphan(sk)
sk_set_socket(sk, NULL)
The last function call will set sk->sk_socket to NULL.
When the releasing routine is resumed, ovpn_tcp_socket_detach() will attempt to dereference sk->sk_socket to restore its original ops member. This operation will crash due to sk->sk_socket being NULL.
Fix this race condition by testing-and-accessing sk->sk_socket atomically under sk->sk_callback_lock.
--- drivers/net/ovpn/tcp.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/net/ovpn/tcp.c +13 -1
@@ -199,7 +199,19 @@ void ovpn_tcp_socket_detach(struct ovpn_socket *ovpn_sock) sk->sk_data_ready = peer->tcp.sk_cb.sk_data_ready; sk->sk_write_space = peer->tcp.sk_cb.sk_write_space; sk->sk_prot = peer->tcp.sk_cb.prot; - sk->sk_socket->ops = peer->tcp.sk_cb.ops; + +/* tcp_close() may race this function and could set +* sk->sk_socket to NULL. It does so by invoking +* sock_orphan(), which holds sk_callback_lock before +* doing the assignment. +* +* For this reason we acquire the same lock to avoid +* sk_socket to disappear under our feet +*/ +write_lock_bh (&sk->sk_callback_lock); +if (sk->sk_socket) + sk->sk_socket->ops = peer->tcp.sk_cb.ops; +write_unlock_bh (&sk->sk_callback_lock);rcu_assign_sk_user_data (sk,NULL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 535/641 net: usb: catc: enable basic endpoint checking
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
[ Upstream commit 9e7021d2aeae57c323a6f722ed7915686cdcc123 ]
catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors:
- usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
- usb_rcvintpipe(usbdev, 2) for interrupt status
A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes.
Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time.
Similar to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150.
--- drivers/net/usb/catc.c | 37 +++++++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-)
drivers/net/usb/catc.c +31 -6
@@ -64,6 +64,16 @@ static const char driver_name[] = "catc";#define CTRL_QUEUE 16/* Max control requests in flight (power of two) */ #define RX_PKT_SZ 1600/* Max size of receive packet for F5U011 */ +/* +* USB endpoints. +*/ + +enum catc_usb_ep { +CATC_USB_EP_CONTROL =0 , +CATC_USB_EP_BULK =1 , +CATC_USB_EP_INT_IN =2 , +}; +/* * Control requests. */
@@ -772,6 +782,13 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *idu8 broadcast[ETH_ALEN ];u8 *macbuf;int pktsz, ret = -ENOMEM ; +static const u8 bulk_ep_addr[] = { +CATC_USB_EP_BULK |USB_DIR_OUT , +CATC_USB_EP_BULK |USB_DIR_IN , +0 }; +static const u8 int_ep_addr[] = { +CATC_USB_EP_INT_IN |USB_DIR_IN , +0 }; macbuf =kmalloc (ETH_ALEN ,GFP_KERNEL );if (!macbuf)
@@ -784,6 +801,14 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id goto fail_mem; } +/* Verify that all required endpoints are present */ +if (!usb_check_bulk_endpoints (intf, bulk_ep_addr) || + !usb_check_int_endpoints (intf, int_ep_addr)) { +dev_err (dev,"Missing or invalid endpoints\n" ); + ret = -ENODEV ; + goto fail_mem; + } + netdev =alloc_etherdev (sizeof (struct catc ));if (!netdev) goto fail_mem;
@@ -828,14 +853,14 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *idusb_fill_control_urb (catc->ctrl_urb, usbdev,usb_sndctrlpipe (usbdev,0 ),NULL ,NULL ,0 , catc_ctrl_done, catc); -usb_fill_bulk_urb (catc->tx_urb, usbdev,usb_sndbulkpipe (usbdev,1 ), -NULL ,0 , catc_tx_done, catc); +usb_fill_bulk_urb (catc->tx_urb, usbdev,usb_sndbulkpipe (usbdev,CATC_USB_EP_BULK ), +NULL ,0 , catc_tx_done, catc); -usb_fill_bulk_urb (catc->rx_urb, usbdev,usb_rcvbulkpipe (usbdev,1 ), - catc->rx_buf, pktsz, catc_rx_done, catc); +usb_fill_bulk_urb (catc->rx_urb, usbdev,usb_rcvbulkpipe (usbdev,CATC_USB_EP_BULK ), + catc->rx_buf, pktsz, catc_rx_done, catc); -usb_fill_int_urb (catc->irq_urb, usbdev,usb_rcvintpipe (usbdev,2 ), - catc->irq_buf,2 , catc_irq_done, catc,1 ); +usb_fill_int_urb (catc->irq_urb, usbdev,usb_rcvintpipe (usbdev,CATC_USB_EP_INT_IN ), + catc->irq_buf,2 , catc_irq_done, catc,1 );if (!catc->is_f5u011) {u32 *buf;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 536/641 xen-netback: reject zero-queue configuration from guest
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
[ Upstream commit 6d1dc8014334c7fb25719999bca84d811e60a559 ]
A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range().
On systems with panic_on_warn=1, this allows a guest-to-host denial of service.
The Xen network interface specification requires
the queue count to be "greater than zero".
Add a zero check to match the validation already present in xen-blkback, which has included this
guard since its multi-queue support was added.
--- drivers/net/xen-netback/xenbus.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/xen-netback/xenbus.c +3 -2
@@ -735,10 +735,11 @@ static void connect(struct backend_info *be)*/ requested_num_queues =xenbus_read_unsigned (dev->otherend,"multi-queue-num-queues" ,1 ); -if (requested_num_queues > xenvif_max_queues) { +if (requested_num_queues > xenvif_max_queues || + requested_num_queues ==0 ) {/* buggy or malicious guest */ xenbus_dev_fatal (dev, -EINVAL , -"guest requested %u queues, exceeding the maximum of %u." , +"guest requested %u queues, but valid range is 1 - %u." , requested_num_queues, xenvif_max_queues);return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 537/641 net/rds: rds_sendmsg should not discard payload_len
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allison Henderson <[email protected]>
[ Upstream commit da29e453dcb3aa7cabead7915f5f945d0add3a52 ]
Commit 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with connection teardown") modifies rds_sendmsg to avoid enqueueing work while a tear down is in progress. However, it also changed the return value of rds_sendmsg to that of rds_send_xmit instead of the payload_len. This means the user may incorrectly receive errno values when it should have simply received a payload of 0 while the peer attempts a reconnections. So this patch corrects the teardown handling code to only use the out error path in that case, thus restoring the original payload_len return value.
--- net/rds/send.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/rds/send.c +4 -2
@@ -1382,9 +1382,11 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)else queue_delayed_work (rds_wq, &cpath->cp_send_w,1 );rcu_read_unlock (); + +if (ret) + goto out; } -if (ret) - goto out; +rds_message_put (rm);for (ind =0 ; ind < vct.indx; ind++)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 538/641 net: bridge: mcast: always update mdb_n_entries for vlan contexts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 8b769e311a86bb9d15c5658ad283b86fc8f080a2 ]
syzbot triggered a warning[1] about the number of mdb entries in a context. It turned out that there are multiple ways to trigger that warning today (some got added during the years), the root cause of the problem is that the increase is done conditionally, and over the years these different conditions increased so there were new ways to trigger the warning, that is to do a decrease which wasn't paired with a previous increase.
For example one way to trigger it is with flush:
$ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1
$ ip l add dumdum up master br0 type dummy
$ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1
$ ip link set dev br0 down
$ ip link set dev br0 type bridge mcast_vlan_snooping 1
^^^^ this will enable snooping, but will not update mdb_n_entries
because in __br_multicast_enable_port_ctx() we check !netif_running
$ bridge mdb flush dev br0
^^^ this will trigger the warning because it will delete the pg which
we added above, which will try to decrease mdb_n_entriesFix the problem by removing the conditional increase and always keep the count up-to-date while the vlan exists. In order to do that we have to first initialize it on port-vlan context creation, and then always increase or decrease the value regardless of mcast options. To keep the current behaviour we have to enforce the mdb limit only if the context is port's or if the port-vlan's mcast snooping is enabled.
[1]
------------[ cut here ]------------ n == 0 WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline], CPU#0: syz.4.4607/22043 WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline], CPU#0: syz.4.4607/22043 WARNING: net/bridge/br_multicast.c:718 at br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825, CPU#0: syz.4.4607/22043 Modules linked in: CPU: 0 UID: 0 PID: 22043 Comm: syz.4.4607 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline] RIP: 0010:br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline] RIP: 0010:br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825 Code: 41 5f 5d e9 04 7a 48 f7 e8 3f 73 5c f7 90 0f 0b 90 e9 cf fd ff ff e8 31 73 5c f7 90 0f 0b 90 e9 16 fd ff ff e8 23 73 5c f7 90 <0f> 0b 90 e9 60 fd ff ff e8 15 73 5c f7 eb 05 e8 0e 73 5c f7 48 8b RSP: 0018:ffffc9000c207220 EFLAGS: 00010293 RAX: ffffffff8a68042d RBX: ffff88807c6f1800 RCX: ffff888066e90000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888066e90000 R09: 000000000000000c R10: 000000000000000c R11: 0000000000000000 R12: ffff8880303ef800 R13: dffffc0000000000 R14: ffff888050eb11c4 R15: 1ffff1100a1d6238 FS: 00007fa45921b6c0(0000) GS:ffff8881256f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa4591f9ff8 CR3: 0000000081df2000 CR4: 00000000003526f0 Call Trace: <TASK> br_mdb_flush_pgs net/bridge/br_mdb.c:1525 [inline] br_mdb_flush net/bridge/br_mdb.c:1544 [inline] br_mdb_del_bulk+0x5e2/0xb20 net/bridge/br_mdb.c:1561 rtnl_mdb_del+0x48a/0x640 net/core/rtnetlink.c:-1 rtnetlink_rcv_msg+0x77e/0xbe0 net/core/rtnetlink.c:6967 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa45839aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa45921b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fa458615fa0 RCX: 00007fa45839aeb9 RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 RBP: 00007fa458408c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa458616038 R14: 00007fa458615fa0 R15: 00007fff0b59fae8 </TASK>
--- net/bridge/br_multicast.c | 45 ++++++++++++++++----------------------- 1 file changed, 18 insertions(+), 27 deletions(-)
net/bridge/br_multicast.c +18 -27
@@ -244,14 +244,11 @@ br_multicast_port_vid_to_port_ctx(struct net_bridge_port *port, u16 vid)lockdep_assert_held_once (&port->br->multicast_lock); -if (!br_opt_get (port->br,BROPT_MCAST_VLAN_SNOOPING_ENABLED )) -return NULL ; -/* Take RCU to access the vlan. */ rcu_read_lock (); vlan =br_vlan_find (nbp_vlan_group_rcu (port), vid); -if (vlan && !br_multicast_port_ctx_vlan_disabled (&vlan->port_mcast_ctx)) +if (vlan) pmctx = &vlan->port_mcast_ctx;rcu_read_unlock ();
@@ -701,7 +698,10 @@ br_multicast_port_ngroups_inc_one(struct net_bridge_mcast_port *pmctx,u32 max =READ_ONCE (pmctx->mdb_max_entries);u32 n =READ_ONCE (pmctx->mdb_n_entries); -if (max && n >= max) { +/* enforce the max limit when it's a port pmctx or a port-vlan pmctx +* with snooping enabled +*/ +if (!br_multicast_port_ctx_vlan_disabled (pmctx) && max && n >= max) {NL_SET_ERR_MSG_FMT_MOD (extack,"%s is already in %u groups, and mcast_max_groups=%u" , what, n, max);return -E2BIG ;
@@ -736,9 +736,7 @@ static int br_multicast_port_ngroups_inc(struct net_bridge_port *port,return err; } -/* Only count on the VLAN context if VID is given, and if snooping on -* that VLAN is enabled. -*/ +/* Only count on the VLAN context if VID is given */ if (!group->vid)return 0 ;
@@ -2011,6 +2009,18 @@ void br_multicast_port_ctx_init(struct net_bridge_port *port,timer_setup (&pmctx->ip6_own_query.timer, br_ip6_multicast_port_query_expired,0 );#endif +/* initialize mdb_n_entries if a new port vlan is being created */ +if (vlan) { +struct net_bridge_port_group *pg; +u32 n =0 ; + +spin_lock_bh (&port->br->multicast_lock); +hlist_for_each_entry (pg, &port->mglist, mglist) +if (pg->key.addr.vid == vlan->vid) + n++; +WRITE_ONCE (pmctx->mdb_n_entries, n); +spin_unlock_bh (&port->br->multicast_lock); + } }void br_multicast_port_ctx_deinit (struct net_bridge_mcast_port *pmctx)
@@ -2094,25 +2104,6 @@ static void __br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx)br_ip4_multicast_add_router (brmctx, pmctx);br_ip6_multicast_add_router (brmctx, pmctx); } - -if (br_multicast_port_ctx_is_vlan (pmctx)) { -struct net_bridge_port_group *pg; -u32 n =0 ; - -/* The mcast_n_groups counter might be wrong. First, -* BR_VLFLAG_MCAST_ENABLED is toggled before temporary entries -* are flushed, thus mcast_n_groups after the toggle does not -* reflect the true values. And second, permanent entries added -* while BR_VLFLAG_MCAST_ENABLED was disabled, are not reflected -* either. Thus we have to refresh the counter. -*/ - -hlist_for_each_entry (pg, &pmctx->port->mglist, mglist) { -if (pg->key.addr.vid == pmctx->vlan->vid) - n++; - } -WRITE_ONCE (pmctx->mdb_n_entries, n); - } }static void br_multicast_enable_port_ctx (struct net_bridge_mcast_port *pmctx)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 539/641 selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Oladko <[email protected]>
[ Upstream commit 02cb2e6bacbb08ebf6acb61be816efd11e1f4a21 ]
The test generates VXLAN traffic using mausezahn, where the encapsulated inner IPv4 packet contains a zero IP header checksum. After VXLAN decapsulation, such packets do not pass sanity checks in br_netfilter and are dropped, which causes the test to fail.
Fix this by calculating and setting a valid IPv4 header checksum for the encapsulated packet generated by mausezahn, so that the packet is accepted by br_netfilter. Fixed by using the payload_template_calc_checksum() / payload_template_expand_checksum() helpers that are only available in v6.3 and newer kernels.
--- .../net/forwarding/vxlan_bridge_1d.sh | 26 ++++++++++++------- 1 file changed, 16 insertions(+), 10 deletions(-)
tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +16 -10
@@ -567,6 +567,21 @@ vxlan_encapped_ping_do() local inner_tos=$1; shift local outer_tos=$1; shift + local ipv4hdr=$(: + )"45:"$( : IP version + IHL + )"$inner_tos:"$( : IP TOS + )"00:54:"$( : IP total length + )"99:83:"$( : IP identification + )"40:00:"$( : IP flags + frag off + )"40:"$( : IP TTL + )"01:"$( : IP proto + )"CHECKSUM:"$( : IP header csum + )"c0:00:02:03:"$( : IP saddr: 192.0.2.3 + )"c0:00:02:01"$( : IP daddr: 192.0.2.1 + ) + local checksum=$(payload_template_calc_checksum "$ipv4hdr") + ipv4hdr=$(payload_template_expand_checksum "$ipv4hdr" $checksum) + $MZ $dev -c $count -d 100msec -q \ -b $next_hop_mac -B $dest_ip \ -t udp tos=$outer_tos,sp=23456,dp=$VXPORT,p=$(:
@@ -577,16 +592,7 @@ vxlan_encapped_ping_do() )"$dest_mac:"$( : ETH daddr )"$(mac_get w2):"$( : ETH saddr )"08:00:"$( : ETH type - )"45:"$( : IP version + IHL - )"$inner_tos:"$( : IP TOS - )"00:54:"$( : IP total length - )"99:83:"$( : IP identification - )"40:00:"$( : IP flags + frag off - )"40:"$( : IP TTL - )"01:"$( : IP proto - )"00:00:"$( : IP header csum - )"c0:00:02:03:"$( : IP saddr: 192.0.2.3 - )"c0:00:02:01:"$( : IP daddr: 192.0.2.1 + )"$ipv4hdr:"$( : IPv4 header )"08:"$( : ICMP type )"00:"$( : ICMP code )"8b:f2:"$( : ICMP csum
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 540/641 selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Oladko <[email protected]>
[ Upstream commit ce9f6aec0fb780dafc1dfc5f47c688422aff464a ]
The test generates VXLAN traffic using mausezahn, where the encapsulated inner IPv6 packet has an incorrect payload length set in the IPv6 header. After VXLAN decapsulation, such packets do not pass sanity checks in br_netfilter and are dropped, which causes the test to fail.
Fix this by setting the correct IPv6 payload length for the encapsulated packet generated by mausezahn, so that the packet is accepted by br_netfilter.
tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh lines 698-706
)"00:03:"$( : Payload length
)"3a:"$( : Next header
)"04:"$( : Hop limit
)"$saddr:"$( : IP saddr
)"$daddr:"$( : IP daddr
)"80:"$( : ICMPv6.type
)"00:"$( : ICMPv6.code
)"00:"$( : ICMPv6.checksum
)Data after IPv6 header:
• 80: — 1 byte (ICMPv6 type)
• 00: — 1 byte (ICMPv6 code)
• 00: — 1 byte (ICMPv6 checksum, truncated)
Total: 3 bytes → 00:03 is correct. The old value 00:08 did not match the actual payload size.
--- tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh +1 -1
@@ -695,7 +695,7 @@ vxlan_encapped_ping_do() )"6"$( : IP version )"$inner_tos"$( : Traffic class )"0:00:00:"$( : Flow label - )"00:08:"$( : Payload length + )"00:03:"$( : Payload length )"3a:"$( : Next header )"04:"$( : Hop limit )"$saddr:"$( : IP saddr
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 541/641 netfilter: nf_conntrack_h323: dont pass uninitialised l3num value
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a6d28eb8efe96b3e35c92efdf1bfacb0cccf541f ]
Mihail Milev reports: Error: UNINIT (CWE-457):
net/netfilter/nf_conntrack_h323_main.c:1189:2: var_decl:
Declaring variable "tuple" without initializer.
net/netfilter/nf_conntrack_h323_main.c:1197:2:
uninit_use_in_call: Using uninitialized value "tuple.src.l3num" when calling "__nf_ct_expect_find".
net/netfilter/nf_conntrack_expect.c:142:2:
read_value: Reading value "tuple->src.l3num" when calling "nf_ct_expect_dst_hash".
1195| tuple.dst.protonum = IPPROTO_TCP; 1196| 1197|-> exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple); 1198| if (exp && exp->master == ct) 1199| return exp;
Switch this to a C99 initialiser and set the l3num value.
--- net/netfilter/nf_conntrack_h323_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/netfilter/nf_conntrack_h323_main.c +5 -5
@@ -1186,13 +1186,13 @@ static struct nf_conntrack_expect *find_expect(struct nf_conn *ct, {struct net *net =nf_ct_net (ct);struct nf_conntrack_expect *exp; -struct nf_conntrack_tuple tuple; +struct nf_conntrack_tuple tuple = { + .src.l3num =nf_ct_l3num (ct), + .dst.protonum =IPPROTO_TCP , + .dst.u.tcp.port = port, + }; -memset (&tuple.src.u3,0 ,sizeof (tuple.src.u3)); - tuple.src.u.tcp.port =0 ;memcpy (&tuple.dst.u3, addr,sizeof (tuple.dst.u3)); - tuple.dst.u.tcp.port = port; - tuple.dst.protonum =IPPROTO_TCP ; exp =__nf_ct_expect_find (net,nf_ct_zone (ct), &tuple);if (exp && exp->master == ct)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 542/641 ipvs: do not keep dest_dst if dev is going down
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 8fde939b0206afc1d5846217a01a16b9bc8c7896 ]
There is race between the netdev notifier ip_vs_dst_event() and the code that caches dst with dev that is going down. As the FIB can be notified for the closed device after our handler finishes, it is possible valid route to be returned and cached resuling in a leaked dev reference until the dest is not removed.
To prevent new dest_dst to be attached to dest just after the handler dropped the old one, add a netif_running() check to make sure the notifier handler is not currently running for device that is closing.
--- net/netfilter/ipvs/ip_vs_xmit.c | 46 ++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 10 deletions(-)
net/netfilter/ipvs/ip_vs_xmit.c +36 -10
@@ -295,6 +295,12 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,return true; } +/* rt has device that is down */ +static bool rt_dev_is_down (const struct net_device *dev) +{ +return dev && !netif_running (dev); +} +/* Get route to destination or remote server */ static int __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,
@@ -310,9 +316,11 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,if (dest) { dest_dst =__ip_vs_dst_check (dest); -if (likely (dest_dst)) +if (likely (dest_dst)) { rt =dst_rtable (dest_dst->dst_cache); -else { +if (ret_saddr) + *ret_saddr = dest_dst->dst_saddr.ip; + }else { dest_dst =ip_vs_dest_dst_alloc ();spin_lock_bh (&dest->dst_lock);if (!dest_dst) {
@@ -328,14 +336,22 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,ip_vs_dest_dst_free (dest_dst); goto err_unreach; } -__ip_vs_dst_set (dest, dest_dst, &rt->dst,0 ); +/* It is forbidden to attach dest->dest_dst if +* device is going down. +*/ +if (!rt_dev_is_down (dst_dev_rcu (&rt->dst))) +__ip_vs_dst_set (dest, dest_dst, &rt->dst,0 ); +else + noref =0 ;spin_unlock_bh (&dest->dst_lock);IP_VS_DBG (10 ,"new dst %pI4, src %pI4, refcnt=%d\n" , &dest->addr.ip, &dest_dst->dst_saddr.ip,rcuref_read (&rt->dst.__rcuref)); +if (ret_saddr) + *ret_saddr = dest_dst->dst_saddr.ip; +if (!noref) +ip_vs_dest_dst_free (dest_dst); } -if (ret_saddr) - *ret_saddr = dest_dst->dst_saddr.ip; }else { noref =0 ;
@@ -472,9 +488,11 @@ __ip_vs_get_out_rt_v6(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,if (dest) { dest_dst =__ip_vs_dst_check (dest); -if (likely (dest_dst)) +if (likely (dest_dst)) { rt =dst_rt6_info (dest_dst->dst_cache); -else { +if (ret_saddr) + *ret_saddr = dest_dst->dst_saddr.in6; + }else {u32 cookie; dest_dst =ip_vs_dest_dst_alloc ();
@@ -495,14 +513,22 @@ __ip_vs_get_out_rt_v6(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb, } rt =dst_rt6_info (dst); cookie =rt6_get_cookie (rt); -__ip_vs_dst_set (dest, dest_dst, &rt->dst, cookie); +/* It is forbidden to attach dest->dest_dst if +* device is going down. +*/ +if (!rt_dev_is_down (dst_dev_rcu (&rt->dst))) +__ip_vs_dst_set (dest, dest_dst, &rt->dst, cookie); +else + noref =0 ;spin_unlock_bh (&dest->dst_lock);IP_VS_DBG (10 ,"new dst %pI6, src %pI6, refcnt=%d\n" , &dest->addr.in6, &dest_dst->dst_saddr.in6,rcuref_read (&rt->dst.__rcuref)); +if (ret_saddr) + *ret_saddr = dest_dst->dst_saddr.in6; +if (!noref) +ip_vs_dest_dst_free (dest_dst); } -if (ret_saddr) - *ret_saddr = dest_dst->dst_saddr.in6; }else { noref =0 ; dst = __ip_vs_route_output_v6(net, daddr, ret_saddr, do_xfrm,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 543/641 net: remove WARN_ON_ONCE when accessing forward path array
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 008e7a7c293b30bc43e4368dac6ea3808b75a572 ]
Although unlikely, recent support for IPIP tunnels increases chances of reaching this WARN_ON_ONCE if userspace manages to build a sufficiently long forward path.
Remove it.
--- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/dev.c +1 -1
@@ -738,7 +738,7 @@ static struct net_device_path *dev_fwd_path(struct net_device_path_stack *stack) {int k = stack->num_paths++; -if (WARN_ON_ONCE (k >=NET_DEVICE_PATH_STACK_MAX )) +if (k >=NET_DEVICE_PATH_STACK_MAX )return NULL ;return &stack->path[k];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 544/641 netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inseo An <[email protected]>
[ Upstream commit 71e99ee20fc3f662555118cf1159443250647533 ]
nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between.
This creates two use-after-free conditions:
1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it.
2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain.
Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -2822,6 +2822,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 policy, err_register_hook:nft_chain_del (chain); +synchronize_rcu (); err_chain_add:nft_trans_destroy (trans); err_trans:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 545/641 ipv6: fix a race in ip6_sock_set_v6only()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 452a3eee22c57a5786ae6db5c97f3b0ec13bb3b7 ]
It is unlikely that this function will be ever called with isk->inet_num being not zero.
Perform the check on isk->inet_num inside the locked section for complete safety.
--- include/net/ipv6.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
include/net/ipv6.h +7 -4
@@ -1280,12 +1280,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex,static inline int ip6_sock_set_v6only (struct sock *sk) { -if (inet_sk (sk)->inet_num) -return -EINVAL ; +int ret =0 ; +lock_sock (sk); - sk->sk_ipv6only = true; +if (inet_sk (sk)->inet_num) + ret = -EINVAL ; +else + sk->sk_ipv6only = true;release_sock (sk); -return 0 ; +return ret; }static inline void ip6_sock_set_recverr (struct sock *sk)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 546/641 bpftool: Fix truncated netlink dumps
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 3b39d73cc3379360a33eb583b17f21fe55e1288e ]
Netlink requires that the recv buffer used during dumps is at least min(PAGE_SIZE, 8k) (see the man page). Otherwise the messages will get truncated. Make sure bpftool follows this requirement, avoid missing information on systems with large pages.
--- tools/bpf/bpftool/net.c | 5 ++++- tools/lib/bpf/netlink.c | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-)
tools/bpf/bpftool/net.c +4 -1
@@ -156,7 +156,7 @@ static int netlink_recv(int sock, __u32 nl_pid, __u32 seq,bool multipart = true;struct nlmsgerr *err;struct nlmsghdr *nh; -char buf[4096 ]; +char buf[8192 ];int len, ret;while (multipart) {
@@ -201,6 +201,9 @@ static int netlink_recv(int sock, __u32 nl_pid, __u32 seq,return ret; } } + +if (len) +p_err ("Invalid message or trailing data in Netlink response: %d bytes left" , len); } ret =0 ; done:
tools/lib/bpf/netlink.c +3 -1
@@ -143,7 +143,7 @@ static int libbpf_netlink_recv(int sock, __u32 nl_pid, int seq,struct nlmsghdr *nh;int len, ret; - ret =alloc_iov (&iov,4096 ); + ret =alloc_iov (&iov,8192 );if (ret) goto done;
@@ -212,6 +212,8 @@ static int libbpf_netlink_recv(int sock, __u32 nl_pid, int seq, } } } +if (len) +pr_warn ("Invalid message or trailing data in Netlink response: %d bytes left\n" , len); } ret =0 ; done:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 547/641 net: psp: select CONFIG_SKB_EXTENSIONS
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 6e980df452169f82674f2e650079c1fe0aee343d ]
psp now uses skb extensions, failing to build when that is disabled:
In file included from include/net/psp.h:7,
from net/psp/psp_sock.c:9:
include/net/psp/functions.h: In function '__psp_skb_coalesce_diff':
include/net/psp/functions.h:60:13: error: implicit declaration of function 'skb_ext_find'; did you mean 'skb_ext_copy'? [-Wimplicit-function-declaration]
60 | a = skb_ext_find(one, SKB_EXT_PSP);
| ^~~~~~~~~~~~
| skb_ext_copy
include/net/psp/functions.h:60:31: error: 'SKB_EXT_PSP' undeclared (first use in this function)
60 | a = skb_ext_find(one, SKB_EXT_PSP);
| ^~~~~~~~~~~include/net/psp/functions.h:60:31: note: each undeclared identifier is reported only once for each function it appears in include/net/psp/functions.h: In function '__psp_sk_rx_policy_check':include/net/psp/functions.h:94:53: error: 'SKB_EXT_PSP' undeclared (first use in this function)
94 | struct psp_skb_ext *pse = skb_ext_find(skb, SKB_EXT_PSP);
| ^~~~~~~~~~~net/psp/psp_sock.c: In function 'psp_sock_recv_queue_check':net/psp/psp_sock.c:164:41: error: 'SKB_EXT_PSP' undeclared (first use in this function)
164 | pse = skb_ext_find(skb, SKB_EXT_PSP);
| ^~~~~~~~~~~
Select the Kconfig symbol as we do from its other users.
--- net/psp/Kconfig | 1 + 1 file changed, 1 insertion(+)
net/psp/Kconfig +1 -0
@@ -6,6 +6,7 @@ config INET_PSP bool "PSP Security Protocol support" depends on INET select SKB_DECRYPTED + select SKB_EXTENSIONS select SOCK_VALIDATE_XMIT help Enable kernel support for the PSP Security Protocol (PSP).
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 548/641 ping: annotate data-races in ping_lookup()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ad5dfde2a5733aaf652ea3e40c8c5e071e935901 ]
isk->inet_num, isk->inet_rcv_saddr and sk->sk_bound_dev_if are read locklessly in ping_lookup().
Add READ_ONCE()/WRITE_ONCE() annotations.
The race on isk->inet_rcv_saddr is probably coming from IPv6 support, but does not deserve a specific backport.
--- net/ipv4/ping.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-)
net/ipv4/ping.c +19 -12
@@ -148,7 +148,7 @@ void ping_unhash(struct sock *sk)pr_debug ("ping_unhash(isk=%p,isk->num=%u)\n" , isk, isk->inet_num);spin_lock (&ping_table.lock);if (sk_del_node_init_rcu (sk)) { - isk->inet_num =0 ; +WRITE_ONCE (isk->inet_num,0 ); isk->inet_sport =0 ;sock_prot_inuse_add (sock_net (sk), sk->sk_prot,-1 ); }
@@ -181,31 +181,35 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) } sk_for_each_rcu(sk, hslot) { + int bound_dev_if; + if (!net_eq(sock_net(sk), net)) continue; isk = inet_sk(sk); pr_debug("iterate\n"); - if (isk->inet_num != ident) + if (READ_ONCE(isk->inet_num) != ident) continue; + bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); if (skb->protocol == htons(ETH_P_IP) && sk->sk_family == AF_INET) { + __be32 rcv_saddr = READ_ONCE(isk->inet_rcv_saddr); + pr_debug("found: %p: num=%d, daddr=%pI4, dif=%d\n", sk, - (int) isk->inet_num, &isk->inet_rcv_saddr, - sk->sk_bound_dev_if); + ident, &rcv_saddr, + bound_dev_if); - if (isk->inet_rcv_saddr && - isk->inet_rcv_saddr != ip_hdr(skb)->daddr) + if (rcv_saddr && rcv_saddr != ip_hdr(skb)->daddr) continue; #if IS_ENABLED(CONFIG_IPV6) } else if (skb->protocol == htons(ETH_P_IPV6) && sk->sk_family == AF_INET6) { pr_debug("found: %p: num=%d, daddr=%pI6c, dif=%d\n", sk, - (int) isk->inet_num, + ident, &sk->sk_v6_rcv_saddr, - sk->sk_bound_dev_if); + bound_dev_if); if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr) && !ipv6_addr_equal(&sk->sk_v6_rcv_saddr,
@@ -216,8 +220,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)continue ; } -if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif && - sk->sk_bound_dev_if != sdif) +if (bound_dev_if && bound_dev_if != dif && + bound_dev_if != sdif)continue ; goto exit;
@@ -392,7 +396,9 @@ static void ping_set_saddr(struct sock *sk, struct sockaddr *saddr)if (saddr->sa_family ==AF_INET ) {struct inet_sock *isk =inet_sk (sk);struct sockaddr_in *addr = (struct sockaddr_in *) saddr; - isk->inet_rcv_saddr = isk->inet_saddr = addr->sin_addr.s_addr; + + isk->inet_saddr = addr->sin_addr.s_addr; +WRITE_ONCE (isk->inet_rcv_saddr, addr->sin_addr.s_addr);#if IS_ENABLED (CONFIG_IPV6 ) } else if (saddr->sa_family == AF_INET6) {struct sockaddr_in6 *addr = (struct sockaddr_in6 *) saddr;
@@ -849,7 +855,8 @@ int ping_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,struct sk_buff *skb;int copied, err; -pr_debug ("ping_recvmsg(sk=%p,sk->num=%u)\n" , isk, isk->inet_num); +pr_debug ("ping_recvmsg(sk=%p,sk->num=%u)\n" , isk, +READ_ONCE (isk->inet_num)); err = -EOPNOTSUPP ;if (flags &MSG_OOB )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 549/641 selftests: tc_actions: dont dump 2MB of \0 to stdout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 32b70e62034aa72f8414ad4e9122cce7ad418c48 ]
Since we started running selftests in NIPA we have been seeing tc_actions.sh generate a soft lockup warning on ~20% of the runs. On the pre-netdev foundation setup it was actually a missed irq splat from the console. Now it's either that or a lockup.
I initially suspected a socket locking issue since the test is exercising local loopback with act_mirred.
After hours of staring at this I noticed in strace that ncat when -o $file is specified _both_ saves the output to the file and still prints it to stdout. Because the file being sent is constructed with:
dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$mirred
^^^^^^^^^
the data printed is all \0. Most terminals don't display nul characters (and neither does vng output capture save them). But QEMU's serial console still has to poke them thru which is very slow and causes the lockup (if the file is >600kB).
Replace the '-o $file' with '> $file'. This speeds the test up from 2m20s to 18s on debug kernels, and prevents the warnings.
--- tools/testing/selftests/net/forwarding/tc_actions.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/tc_actions.sh +1 -1
@@ -223,7 +223,7 @@ mirred_egress_to_ingress_tcp_test() ip_proto icmp \ action drop - ip vrf exec v$h1 ncat --recv-only -w10 -l -p 12345 -o $mirred_e2i_tf2 & + ip vrf exec v$h1 ncat --recv-only -w10 -l -p 12345 > $mirred_e2i_tf2 & local rpid=$! ip vrf exec v$h1 ncat -w1 --send-only 192.0.2.2 12345 <$mirred_e2i_tf1 wait -n $rpid
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 550/641 macvlan: observe an RCU grace period in macvlan_common_newlink() error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e3f000f0dee1bfab52e2e61ca6a3835d9e187e35 ]
valis reported that a race condition still happens after my prior patch.
macvlan_common_newlink() might have made @dev visible before detecting an error, and its caller will directly call free_netdev(dev).
We must respect an RCU period, either in macvlan or the core networking stack.
After adding a temporary mdelay(1000) in macvlan_forward_source_one() to open the race window, valis repro was:
ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1
ip link set up dev p1
ip link set up dev p2
ip link add mv0 link p2 type macvlan mode source
(ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20 &) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4 PING 1.2.3.4 (1.2.3.4): 56 data bytes
RTNETLINK answers: Invalid argument
BUG: KASAN: slab-use-after-free in macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) Read of size 8 at addr ffff888016bb89c0 by task e/175 CPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) ? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) kasan_report (mm/kasan/report.c:597) ? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
? tasklet_init (kernel/softirq.c:983)macvlan_handle_frame (drivers/net/macvlan.c:501)
Allocated by task 169:
kasan_save_stack (mm/kasan/common.c:58)kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70 mm/kasan/common.c:79)__kasan_kmalloc (mm/kasan/common.c:419)__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657 mm/slub.c:7140)alloc_netdev_mqs (net/core/dev.c:12012)rtnl_create_link (net/core/rtnetlink.c:3648)rtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957 net/core/rtnetlink.c:4072)rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)netlink_rcv_skb (net/netlink/af_netlink.c:2550)netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894)__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209)do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
Freed by task 169:
kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70 mm/kasan/common.c:79) kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287)
kfree (mm/slub.c:6674 mm/slub.c:6882) rtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957
net/core/rtnetlink.c:4072)rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)netlink_rcv_skb (net/netlink/af_netlink.c:2550)netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894)__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209)do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
--- drivers/net/macvlan.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/macvlan.c +5 -0
@@ -1572,6 +1572,11 @@ int macvlan_common_newlink(struct net_device *dev,if (create)macvlan_port_destroy (port->dev); } +/* @dev might have been made visible before an error was detected. +* Make sure to observe an RCU grace period before our caller +* (rtnl_newlink()) frees it. +*/ +synchronize_net ();return err; }EXPORT_SYMBOL_GPL (macvlan_common_newlink);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 551/641 eth: fbnic: Add validation for MTU changes
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dimitri Daskalakis <[email protected]>
[ Upstream commit ccd8e87748ad083047d6c8544c5809b7f96cc8df ]
Increasing the MTU beyond the HDS threshold causes the hardware to fragment packets across multiple buffers. If a single-buffer XDP program is attached, the driver will drop all multi-frag frames. While we can't prevent a remote sender from sending non-TCP packets larger than the MTU, this will prevent users from inadvertently breaking new TCP streams.
Traditionally, drivers supported XDP with MTU less than 4Kb (packet per page). Fbnic currently prevents attaching XDP when MTU is too high. But it does not prevent increasing MTU after XDP is attached.
--- drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c +18 -0
@@ -262,6 +262,23 @@ static int fbnic_set_mac(struct net_device *netdev, void *p)return 0 ; } +static int fbnic_change_mtu (struct net_device *dev,int new_mtu) +{ +struct fbnic_net *fbn =netdev_priv (dev); + +if (fbnic_check_split_frames (fbn->xdp_prog, new_mtu, fbn->hds_thresh)) { +dev_err (&dev->dev, +"MTU %d is larger than HDS threshold %d in XDP mode\n" , + new_mtu, fbn->hds_thresh); + +return -EINVAL ; + } + +WRITE_ONCE (dev->mtu, new_mtu); + +return 0 ; +} +void fbnic_clear_rx_mode (struct fbnic_dev *fbd) {struct net_device *netdev = fbd->netdev;
@@ -533,6 +550,7 @@ static const struct net_device_ops fbnic_netdev_ops = { .ndo_start_xmit = fbnic_xmit_frame, .ndo_features_check = fbnic_features_check, .ndo_set_mac_address = fbnic_set_mac, + .ndo_change_mtu = fbnic_change_mtu, .ndo_set_rx_mode = fbnic_set_rx_mode, .ndo_get_stats64 = fbnic_get_stats64, .ndo_bpf = fbnic_bpf,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 552/641 icmp: prevent possible overflow in icmp_global_allow()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 034bbd806298e9ba4197dd1587b0348ee30996ea ]
Following expression can overflow
if sysctl_icmp_msgs_per_sec is big enough.
sysctl_icmp_msgs_per_sec * delta / HZ;
--- net/ipv4/icmp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/icmp.c +2 -1
@@ -248,7 +248,8 @@ bool icmp_global_allow(struct net *net)if (delta <HZ /50 )return false; - incr =READ_ONCE (net->ipv4.sysctl_icmp_msgs_per_sec) * delta /HZ ; + incr =READ_ONCE (net->ipv4.sysctl_icmp_msgs_per_sec); + incr =div_u64 ((u64 )incr * delta,HZ );if (!incr)return false;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 553/641 inet: move icmp_global_{credit,stamp} to a separate cache line
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 87b08913a9ae82082e276d237ece08fc8ee24380 ]
icmp_global_credit was meant to be changed ~1000 times per second, but if an admin sets net.ipv4.icmp_msgs_per_sec to a very high value, icmp_global_credit changes can inflict false sharing to surrounding fields that are read mostly.
Move icmp_global_credit and icmp_global_stamp to a separate cacheline aligned group.
--- include/net/netns/ipv4.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
include/net/netns/ipv4.h +7 -2
@@ -87,6 +87,12 @@ struct netns_ipv4 {int sysctl_tcp_rmem[3 ];__cacheline_group_end (netns_ipv4_read_rx); +/* ICMP rate limiter hot cache line. */ +__cacheline_group_begin_aligned (icmp); +atomic_t icmp_global_credit; +u32 icmp_global_stamp; +__cacheline_group_end_aligned (icmp); +struct inet_timewait_death_row tcp_death_row;struct udp_table *udp_table;
@@ -139,8 +145,7 @@ struct netns_ipv4 {int sysctl_icmp_ratemask;int sysctl_icmp_msgs_per_sec;int sysctl_icmp_msgs_burst; -atomic_t icmp_global_credit; -u32 icmp_global_stamp; +u32 ip_rt_min_pmtu;int ip_rt_mtu_expires;int ip_rt_min_advmss;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 554/641 ipv6: icmp: remove obsolete code in icmpv6_xrlim_allow()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0201eedb69b24a6be9b7c1716287a89c4dde2320 ]
Following part was needed before the blamed commit, because inet_getpeer_v6() second argument was the prefix.
/* Give more bandwidth to wider prefixes. */ if (rt->rt6i_dst.plen < 128) tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
Now inet_getpeer_v6() retrieves hosts, we need to remove @tmo adjustement or wider prefixes likes /24 allow 8x more ICMP to be sent for a given ratelimit.
As we had this issue for a while, this patch changes net.ipv6.icmp.ratelimit default value from 1000ms to 100ms to avoid potential regressions.
Also add a READ_ONCE() when reading net->ipv6.sysctl.icmpv6_time.
--- Documentation/networking/ip-sysctl.rst | 7 ++++--- net/ipv6/af_inet6.c | 2 +- net/ipv6/icmp.c | 7 +------ 3 files changed, 6 insertions(+), 10 deletions(-)
Documentation/networking/ip-sysctl.rst +4 -3
@@ -3195,12 +3195,13 @@ enhanced_dad - BOOLEAN =========== ratelimit - INTEGER - Limit the maximal rates for sending ICMPv6 messages. + Limit the maximal rates for sending ICMPv6 messages to a particular + peer. 0 to disable any limiting, - otherwise the minimal space between responses in milliseconds. + otherwise the space between responses in milliseconds. - Default: 1000 + Default: 100 ratemask - list of comma separated ranges For ICMPv6 message types matching the ranges in the ratemask, limit
net/ipv6/af_inet6.c +1 -1
@@ -955,7 +955,7 @@ static int __net_init inet6_net_init(struct net *net)int err =0 ; net->ipv6.sysctl.bindv6only =0 ; - net->ipv6.sysctl.icmpv6_time =1 *HZ ; + net->ipv6.sysctl.icmpv6_time =HZ /10 ; net->ipv6.sysctl.icmpv6_echo_ignore_all =0 ; net->ipv6.sysctl.icmpv6_echo_ignore_multicast =0 ; net->ipv6.sysctl.icmpv6_echo_ignore_anycast =0 ;
net/ipv6/icmp.c +1 -6
@@ -217,14 +217,9 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, }else if (dev && (dev->flags &IFF_LOOPBACK )) { res = true; }else { -struct rt6_info *rt =dst_rt6_info (dst); -int tmo = net->ipv6.sysctl.icmpv6_time; +int tmo =READ_ONCE (net->ipv6.sysctl.icmpv6_time);struct inet_peer *peer; -/* Give more bandwidth to wider prefixes. */ -if (rt->rt6i_dst.plen <128 ) - tmo >>= ((128 - rt->rt6i_dst.plen)>>5 ); - peer =inet_getpeer_v6 (net->ipv6.peers, &fl6->daddr); res =inet_peer_xrlim_allow (peer, tmo); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 556/641 eth: fbnic: Advertise supported XDP features.
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dimitri Daskalakis <[email protected]>
[ Upstream commit e977fcb3a318b53b47f23b44ac237fceb1b731fe ]
Drivers are supposed to advertise the XDP features they support. This was missed while adding XDP support.
Before:
$ ynl --family netdev --dump dev-get
...
{'ifindex': 3,
'xdp-features': set(),
'xdp-rx-metadata-features': set(),
'xsk-features': set()},
...After:
$ ynl --family netdev --dump dev-get
...
{'ifindex': 3,
'xdp-features': {'basic', 'rx-sg'},
'xdp-rx-metadata-features': set(),
'xsk-features': set()},
...--- drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c +2 -0
@@ -808,6 +808,8 @@ struct net_device *fbnic_netdev_alloc(struct fbnic_dev *fbd) netdev->hw_enc_features |= netdev->features; netdev->features |=NETIF_F_NTUPLE ; + netdev->xdp_features =NETDEV_XDP_ACT_BASIC |NETDEV_XDP_ACT_RX_SG ; + netdev->min_mtu =IPV6_MIN_MTU ; netdev->max_mtu =FBNIC_MAX_JUMBO_FRAME_SIZE -ETH_HLEN ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 557/641 bnge: fix reserving resources from FW
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vikas Gupta <[email protected]>
[ Upstream commit 604530085b2ef484843c723a105b6fd3218b4710 ]
HWRM_FUNC_CFG is used to reserve resources, whereas HWRM_FUNC_QCFG is intended for querying resource information from the firmware. Since __bnge_hwrm_reserve_pf_rings() reserves resources for a specific PF, the command type should be HWRM_FUNC_CFG.
--- drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c +1 -1
@@ -442,7 +442,7 @@ __bnge_hwrm_reserve_pf_rings(struct bnge_dev *bd, struct bnge_hw_rings *hwr)struct hwrm_func_cfg_input *req;u32 enables =0 ; -if (bnge_hwrm_req_init (bd, req,HWRM_FUNC_QCFG )) +if (bnge_hwrm_req_init (bd, req,HWRM_FUNC_CFG ))return NULL ; req->fid =cpu_to_le16 (0xffff );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 558/641 bonding: alb: fix UAF in rlb_arp_recv during bond up/down
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit e6834a4c474697df23ab9948fd3577b26bf48656 ]
The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected by KASAN.
However, the root cause is that rlb_arp_recv() can still be accessed after setting recv_probe to NULL, which is actually a use-after-free (UAF) issue. That is the reason for using the referenced commit in the Fixes tag.
[ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI [ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] [ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary) [ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022 [ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding] [ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00 [ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206 [ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e [ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8 [ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8 [ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119 [ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810 [ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000 [ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0 [ 214.310347] Call Trace: [ 214.313070] <IRQ> [ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding] [ 214.320975] bond_handle_frame+0x166/0xb60 [bonding] [ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] [ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710 [ 214.339199] ? __pfx_arp_process+0x10/0x10 [ 214.343775] ? sched_balance_find_src_group+0x98/0x630 [ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 214.356513] ? arp_rcv+0x307/0x690 [ 214.360311] ? __pfx_arp_rcv+0x10/0x10 [ 214.364499] ? __lock_acquire+0x58c/0xbd0 [ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0 [ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 214.380743] ? lock_acquire+0x10b/0x140 [ 214.385026] process_backlog+0x3f1/0x13a0 [ 214.389502] ? process_backlog+0x3aa/0x13a0 [ 214.394174] __napi_poll.constprop.0+0x9f/0x370 [ 214.399233] net_rx_action+0x8c1/0xe60 [ 214.403423] ? __pfx_net_rx_action+0x10/0x10 [ 214.408193] ? lock_acquire.part.0+0xbd/0x260 [ 214.413058] ? sched_clock_cpu+0x6c/0x540 [ 214.417540] ? mark_held_locks+0x40/0x70 [ 214.421920] handle_softirqs+0x1fd/0x860 [ 214.426302] ? __pfx_handle_softirqs+0x10/0x10 [ 214.431264] ? __neigh_event_send+0x2d6/0xf50 [ 214.436131] do_softirq+0xb1/0xf0 [ 214.439830] </IRQ>
The issue is reproducible by repeatedly running
ip link set bond0 up/down while receiving ARP messages, where rlb_arp_recv() can race with rlb_deinitialize() and dereference a freed rx_hashtbl entry.
Fix this by setting recv_probe to NULL and then calling synchronize_net() to wait for any concurrent RX processing to finish. This ensures that no RX handler can access rx_hashtbl after it is freed in bond_alb_deinitialize().
--- drivers/net/bonding/bond_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +5 -1
@@ -4405,9 +4405,13 @@ static int bond_close(struct net_device *bond_dev)bond_work_cancel_all (bond); bond->send_peer_notif =0 ; +WRITE_ONCE (bond->recv_probe,NULL ); + +/* Wait for any in-flight RX handlers */ +synchronize_net (); +if (bond_is_lb (bond))bond_alb_deinitialize (bond); - bond->recv_probe =NULL ;if (BOND_MODE (bond) ==BOND_MODE_8023AD && bond->params.broadcast_neighbor)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 559/641 net/mlx5: Fix multiport device check over light SFs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 47bf2e813817159f4d195be83a9b5a640ee6baec ]
Driver is using num_vhca_ports capability to distinguish between multiport master device and multiport slave device. num_vhca_ports is a capability the driver sets according to the MAX num_vhca_ports capability reported by FW. On the other hand, light SFs doesn't set the above capbility.
This leads to wrong results whenever light SFs is checking whether he is a multiport master or slave.
Therefore, use the MAX capability to distinguish between master and slave devices.
--- include/linux/mlx5/driver.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/mlx5/driver.h +2 -2
@@ -1274,12 +1274,12 @@ static inline bool mlx5_rl_is_supported(struct mlx5_core_dev *dev)static inline int mlx5_core_is_mp_slave (struct mlx5_core_dev *dev) {return MLX5_CAP_GEN (dev, affiliate_nic_vport_criteria) && -MLX5_CAP_GEN (dev, num_vhca_ports) <=1 ; +MLX5_CAP_GEN_MAX (dev, num_vhca_ports) <=1 ; }static inline int mlx5_core_is_mp_master (struct mlx5_core_dev *dev) { -return MLX5_CAP_GEN (dev, num_vhca_ports) >1 ; +return MLX5_CAP_GEN_MAX (dev, num_vhca_ports) >1 ; }static inline int mlx5_core_mp_enabled (struct mlx5_core_dev *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 560/641 net/mlx5: Fix misidentification of write combining CQE during poll loop
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit d451994ebc7d4392610bd4b2ab339b255deb4143 ]
The write combining completion poll loop uses usleep_range() which can sleep much longer than requested due to scheduler latency. Under load, we witnessed a 20ms+ delay until the process was rescheduled, causing the jiffies based timeout to expire while the thread is sleeping.
The original do-while loop structure (poll, sleep, check timeout) would exit without a final poll when waking after timeout, missing a CQE that arrived during sleep.
Instead of the open-coded while loop, use the kernel's poll_timeout_us() which always performs an additional check after the sleep expiration, and is less error-prone.
Note: poll_timeout_us() doesn't accept a sleep range, by passing 10 sleep_us the sleep range effectively changes from 2-10 to 3-10 usecs.
--- drivers/net/ethernet/mellanox/mlx5/core/wc.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/wc.c +5 -9
@@ -2,6 +2,7 @@// Copyright (c) 2024, NVIDIA CORPORATION & AFFILIATES. All rights reserved. #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/mlx5/transobj.h> #include "lib/clock.h" #include "mlx5_core.h"
@@ -14,7 +15,7 @@#define TEST_WC_NUM_WQES 255#define TEST_WC_LOG_CQ_SZ (order_base_2(TEST_WC_NUM_WQES))#define TEST_WC_SQ_LOG_WQ_SZ TEST_WC_LOG_CQ_SZ -#define TEST_WC_POLLING_MAX_TIME_JIFFIES msecs_to_jiffies(100) +#define TEST_WC_POLLING_MAX_TIME_USEC (100 * USEC_PER_MSEC)struct mlx5_wc_cq {/* data path - accessed per cqe */
@@ -358,7 +359,6 @@ static int mlx5_wc_poll_cq(struct mlx5_wc_sq *sq)static void mlx5_core_test_wc (struct mlx5_core_dev *mdev) {unsigned int offset =0 ; -unsigned long expires;struct mlx5_wc_sq *sq;int i, err;
@@ -388,13 +388,9 @@ static void mlx5_core_test_wc(struct mlx5_core_dev *mdev)mlx5_wc_post_nop (sq, &offset, true); - expires = jiffies +TEST_WC_POLLING_MAX_TIME_JIFFIES ; -do { - err =mlx5_wc_poll_cq (sq); -if (err) -usleep_range (2 ,10 ); - }while (mdev->wc_state ==MLX5_WC_STATE_UNINITIALIZED && -time_is_after_jiffies (expires)); +poll_timeout_us (mlx5_wc_poll_cq (sq), + mdev->wc_state !=MLX5_WC_STATE_UNINITIALIZED ,10 , +TEST_WC_POLLING_MAX_TIME_USEC , false);mlx5_wc_destroy_sq (sq);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 561/641 net/mlx5e: Fix deadlocks between devlink and netdev instance locks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 83ac0304a2d77519dae1e54c9713cbe1aedf19c9 ]
In the mentioned "Fixes" commit, various work tasks triggering devlink health reporter recovery were switched to use netdev_trylock to protect against concurrent tear down of the channels being recovered. But this had the side effect of introducing potential deadlocks because of incorrect lock ordering.
The correct lock order is described by the init flow:probe_one -> mlx5_init_one (acquires devlink lock)
-> mlx5_init_one_devl_locked -> mlx5_register_device -> mlx5_rescan_drivers_locked -...-> mlx5e_probe -> _mlx5e_probe -> register_netdev (acquires rtnl lock)
-> register_netdevice (acquires netdev lock)
=> devlink lock -> rtnl lock -> netdev lock.
But in the current recovery flow, the order is wrong:mlx5e_tx_err_cqe_work (acquires netdev lock)
-> mlx5e_reporter_tx_err_cqe -> mlx5e_health_report
-> devlink_health_report (acquires devlink lock => boom!) -> devlink_health_reporter_recover
-> mlx5e_tx_reporter_recover -> mlx5e_tx_reporter_recover_from_ctx -> mlx5e_tx_reporter_err_cqe_recover
The same pattern exists in:mlx5e_reporter_rx_timeoutmlx5e_reporter_tx_ptpsq_unhealthymlx5e_reporter_tx_timeout
Fix these by moving the netdev_trylock calls from the work handlers lower in the call stack, in the respective recovery functions, where they are actually necessary.
--- .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 14 ----- .../mellanox/mlx5/core/en/reporter_rx.c | 13 +++++ .../mellanox/mlx5/core/en/reporter_tx.c | 52 +++++++++++++++++-- .../net/ethernet/mellanox/mlx5/core/en_main.c | 40 -------------- 4 files changed, 61 insertions(+), 58 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +0 -14
@@ -448,22 +448,8 @@ static void mlx5e_ptpsq_unhealthy_work(struct work_struct *work) {struct mlx5e_ptpsq *ptpsq = container_of(work, struct mlx5e_ptpsq, report_unhealthy_work); -struct mlx5e_txqsq *sq = &ptpsq->txqsq; - -/* Recovering the PTP SQ means re-enabling NAPI, which requires the -* netdev instance lock. However, SQ closing has to wait for this work -* task to finish while also holding the same lock. So either get the -* lock or find that the SQ is no longer enabled and thus this work is -* not relevant anymore. -*/ -while (!netdev_trylock (sq->netdev)) { -if (!test_bit (MLX5E_SQ_STATE_ENABLED , &sq->state)) -return ; -msleep (20 ); - }mlx5e_reporter_tx_ptpsq_unhealthy (ptpsq); -netdev_unlock (sq->netdev); } static int mlx5e_ptp_open_txqsq(struct mlx5e_ptp *c, u32 tisn,
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c +13 -0
@@ -1,6 +1,8 @@// SPDX-License-Identifier: GPL-2.0 // Copyright (c) 2019 Mellanox Technologies. +#include <net/netdev_lock.h> +#include "health.h" #include "params.h" #include "txrx.h"
@@ -177,6 +179,16 @@ static int mlx5e_rx_reporter_timeout_recover(void *ctx) rq = ctx; priv = rq->priv; +/* Acquire netdev instance lock to synchronize with channel close and +* reopen flows. Either successfully obtain the lock, or detect that +* channels are closing for another reason, making this work no longer +* necessary. +*/ +while (!netdev_trylock (rq->netdev)) { +if (!test_bit (MLX5E_STATE_CHANNELS_ACTIVE , &rq->priv->state)) +return 0 ; +msleep (20 ); + }mutex_lock (&priv->state_lock); eq = rq->cq.mcq.eq;
@@ -186,6 +198,7 @@ static int mlx5e_rx_reporter_timeout_recover(void *ctx)clear_bit (MLX5E_SQ_STATE_ENABLED , &rq->icosq->state);mutex_unlock (&priv->state_lock); +netdev_unlock (rq->netdev);return err; }
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c +48 -4
109 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +0 -40
@@ -688,19 +688,7 @@ static void mlx5e_rq_timeout_work(struct work_struct *timeout_work) struct mlx5e_rq, rx_timeout_work); -/* Acquire netdev instance lock to synchronize with channel close and -* reopen flows. Either successfully obtain the lock, or detect that -* channels are closing for another reason, making this work no longer -* necessary. -*/ -while (!netdev_trylock (rq->netdev)) { -if (!test_bit (MLX5E_STATE_CHANNELS_ACTIVE , &rq->priv->state)) -return ; -msleep (20 ); - } -mlx5e_reporter_rx_timeout (rq); -netdev_unlock (rq->netdev); }static int mlx5e_alloc_mpwqe_rq_drop_page (struct mlx5e_rq *rq)
@@ -1997,20 +1985,7 @@ void mlx5e_tx_err_cqe_work(struct work_struct *recover_work) struct mlx5e_txqsq *sq = container_of(recover_work, struct mlx5e_txqsq, recover_work); -/* Recovering queues means re-enabling NAPI, which requires the netdev -* instance lock. However, SQ closing flows have to wait for work tasks -* to finish while also holding the netdev instance lock. So either get -* the lock or find that the SQ is no longer enabled and thus this work -* is not relevant anymore. -*/ -while (!netdev_trylock (sq->netdev)) { -if (!test_bit (MLX5E_SQ_STATE_ENABLED , &sq->state)) -return ; -msleep (20 ); - } -mlx5e_reporter_tx_err_cqe (sq); -netdev_unlock (sq->netdev); }static struct dim_cq_moder mlx5e_get_def_tx_moderation (u8 cq_period_mode)
@@ -5102,19 +5077,6 @@ static void mlx5e_tx_timeout_work(struct work_struct *work)struct net_device *netdev = priv->netdev;int i; -/* Recovering the TX queues implies re-enabling NAPI, which requires -* the netdev instance lock. -* However, channel closing flows have to wait for this work to finish -* while holding the same lock. So either get the lock or find that -* channels are being closed for other reason and this work is not -* relevant anymore. -*/ -while (!netdev_trylock (netdev)) { -if (!test_bit (MLX5E_STATE_CHANNELS_ACTIVE , &priv->state)) -return ; -msleep (20 ); - } -for (i =0 ; i < netdev->real_num_tx_queues; i++) {struct netdev_queue *dev_queue =netdev_get_tx_queue (netdev, i);
@@ -5127,8 +5089,6 @@ static void mlx5e_tx_timeout_work(struct work_struct *work)/* break if tried to reopened channels */ break ; } - -netdev_unlock (netdev); }static void mlx5e_tx_timeout (struct net_device *dev,unsigned int txqueue)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 562/641 net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 57a94d4b22b0c6cc5d601e6b6238d78fb923d991 ]
The max number of channels is always an unsigned int, use the correct type to fix compilation errors done with strict type checking, e.g.:
error: call to ‘__compiletime_assert_1110’ declared with attribute
error: min(mlx5e_get_devlink_param_num_doorbells(mdev), mlx5e_get_max_num_channels(mdev)) signedness error
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +2 -1
@@ -179,7 +179,8 @@ static inline u16 mlx5_min_rx_wqes(int wq_type, u32 wq_size) }/* Use this function to get max num channels (rxqs/txqs) only to create netdev */ -static inline int mlx5e_get_max_num_channels (struct mlx5_core_dev *mdev) +static inline unsigned int +mlx5e_get_max_num_channels (struct mlx5_core_dev *mdev) {return is_kdump_kernel () ? MLX5E_MIN_NUM_CHANNELS :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 563/641 apparmor: fix NULL pointer dereference in __unix_needs_revalidation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: System Administrator <root@localhost>
[ Upstream commit e2938ad00b21340c0362562dfedd7cfec0554d67 ]
When receiving file descriptors via SCM_RIGHTS, both the socket pointer and the socket's sk pointer can be NULL during socket setup or teardown, causing NULL pointer dereferences in __unix_needs_revalidation().
This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new __unix_needs_revalidation() function was added without proper NULL checks.
The crash manifests as:
BUG: kernel NULL pointer dereference, address: 0x0000000000000018 RIP: aa_file_perm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0) Call Trace: apparmor_file_receive+0x42/0x80 security_file_receive+0x2e/0x50 receive_fd+0x1d/0xf0 scm_detach_fds+0xad/0x1c0
The function dereferences sock->sk->sk_family without checking if either sock or sock->sk is NULL first.
Add NULL checks for both sock and sock->sk before accessing sk_family.
--- security/apparmor/file.c | 3 +++ 1 file changed, 3 insertions(+)
security/apparmor/file.c +3 -0
@@ -578,6 +578,9 @@ static bool __unix_needs_revalidation(struct file *file, struct aa_label *label,return false;if (request &NET_PEER_MASK )return false; +/* sock and sock->sk can be NULL for sockets being set up or torn down */ +if (!sock || !sock->sk) +return false;if (sock->sk->sk_family ==PF_UNIX ) {struct aa_sk_ctx *ctx =aa_sock (sock->sk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 564/641 apparmor: fix NULL sock in aa_sock_file_perm
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit 00b67657535dfea56e84d11492f5c0f61d0af297 ]
Deal with the potential that sock and sock-sk can be NULL during socket setup or teardown. This could lead to an oops. The fix for NULL pointer dereference in __unix_needs_revalidation shows this is at least possible for af_unix sockets. While the fix for af_unix sockets applies for newer mediation this is still the fall back path for older af_unix mediation and other sockets, so ensure it is covered.
--- security/apparmor/net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
security/apparmor/net.c +4 -2
@@ -326,8 +326,10 @@ int aa_sock_file_perm(const struct cred *subj_cred, struct aa_label *label,struct socket *sock = (struct socket *) file->private_data;AA_BUG (!label); -AA_BUG (!sock); -AA_BUG (!sock->sk); + +/* sock && sock->sk can be NULL for sockets being set up or torn down */ +if (!sock || !sock->sk) +return 0 ;if (sock->sk->sk_family ==PF_UNIX )return aa_unix_file_perm (subj_cred, label, op, request, file);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 565/641 AppArmor: Allow apparmor to handle unaligned dfa tables
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit 64802f731214a51dfe3c6c27636b3ddafd003eb0 ]
The dfa tables can originate from kernel or userspace and 8-byte alignment isn't always guaranteed and as such may trigger unaligned memory accesses on various architectures. Resulting in the following
[ 73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720
[ 74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom sd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common
[ 74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE
[ 74.536543] Call Trace:
[ 74.568561] [<0000000000434c24>] dump_stack+0x8/0x18
[ 74.633757] [<0000000000476438>] __warn+0xd8/0x100
[ 74.696664] [<00000000004296d4>] warn_slowpath_fmt+0x34/0x74
[ 74.771006] [<00000000008db28c>] aa_dfa_unpack+0x6cc/0x720
[ 74.843062] [<00000000008e643c>] unpack_pdb+0xbc/0x7e0
[ 74.910545] [<00000000008e7740>] unpack_profile+0xbe0/0x1300
[ 74.984888] [<00000000008e82e0>] aa_unpack+0xe0/0x6a0
[ 75.051226] [<00000000008e3ec4>] aa_replace_profiles+0x64/0x1160
[ 75.130144] [<00000000008d4d90>] policy_update+0xf0/0x280
[ 75.201057] [<00000000008d4fc8>] profile_replace+0xa8/0x100
[ 75.274258] [<0000000000766bd0>] vfs_write+0x90/0x420
[ 75.340594] [<00000000007670cc>] ksys_write+0x4c/0xe0
[ 75.406932] [<0000000000767174>] sys_write+0x14/0x40
[ 75.472126] [<0000000000406174>] linux_sparc_syscall+0x34/0x44
[ 75.548802] ---[ end trace 0000000000000000 ]---
[ 75.609503] dfa blob stream 0xfff0000008926b96 not aligned.
[ 75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720
Work around it by using the get_unaligned_xx() helpers.
--- security/apparmor/match.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
security/apparmor/match.c +8 -7
@@ -15,6 +15,7 @@#include <linux/vmalloc.h> #include <linux/err.h> #include <linux/kref.h> +#include <linux/unaligned.h> #include "include/lib.h" #include "include/match.h"
@@ -42,11 +43,11 @@ static struct table_header *unpack_table(char *blob, size_t bsize)/* loaded td_id's start at 1, subtract 1 now to avoid doing * it every time we use td_id as an index */ - th.td_id =be16_to_cpu (*(__be16 *) (blob)) -1 ; + th.td_id =get_unaligned_be16 (blob) -1 ;if (th.td_id >YYTD_ID_MAX ) goto out; - th.td_flags =be16_to_cpu (*(__be16 *) (blob +2 )); - th.td_lolen =be32_to_cpu (*(__be32 *) (blob +8 )); + th.td_flags =get_unaligned_be16 (blob +2 ); + th.td_lolen =get_unaligned_be32 (blob +8 ); blob +=sizeof (struct table_header ); if (!(th.td_flags == YYTD_DATA16 || th.td_flags == YYTD_DATA32 ||
@@ -313,14 +314,14 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)if (size <sizeof (struct table_set_header )) goto fail; -if (ntohl (*(__be32 *) data) !=YYTH_MAGIC ) +if (get_unaligned_be32 (data) !=YYTH_MAGIC ) goto fail; - hsize =ntohl (*(__be32 *) (data +4 )); + hsize =get_unaligned_be32 (data +4 );if (size < hsize) goto fail; - dfa->flags =ntohs (*(__be16 *) (data +12 )); + dfa->flags =get_unaligned_be16 (data +12 );if (dfa->flags & ~(YYTH_FLAGS )) goto fail;
@@ -329,7 +330,7 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)* if (dfa->flags & YYTH_FLAGS_OOB_TRANS) { * if (hsize < 16 + 4) * goto fail; -* dfa->max_oob = ntol(*(__be32 *) (data + 16)); +* dfa->max_oob = get_unaligned_be32(data + 16); * if (dfa->max <= MAX_OOB_SUPPORTED) { * pr_err("AppArmor DFA OOB greater than supported\n"); * goto fail;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 566/641 apparmor: Fix & Optimize table creation from possibly unaligned memory
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit 6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a ]
Source blob may come from userspace and might be unaligned. Try to optize the copying process by avoiding unaligned memory accesses.
- Added Fixes tag
- Added "Fix &" to description as this doesn't just optimize but fixes a potential unaligned memory access
--- security/apparmor/include/match.h | 12 +++++++----- security/apparmor/match.c | 7 +++---- 2 files changed, 10 insertions(+), 9 deletions(-)
security/apparmor/include/match.h +7 -5
@@ -104,16 +104,18 @@ struct aa_dfa {struct table_header *tables[YYTD_ID_TSIZE ]; }; -#define byte_to_byte (X ) (X) -#define UNPACK_ARRAY (TABLE ,BLOB ,LEN ,TTYPE ,BTYPE ,NTOHX ) \ do { \ typeof(LEN) __i; \ TTYPE *__t = (TTYPE *) TABLE; \ BTYPE *__b = (BTYPE *) BLOB; \ - for (__i = 0; __i < LEN; __i++) { \ - __t[__i] = NTOHX(__b[__i]); \ - } \ + BUILD_BUG_ON(sizeof(TTYPE) != sizeof(BTYPE)); \ + if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) \ + memcpy(__t, __b, (LEN) * sizeof(BTYPE)); \ + else/* copy & convert from big-endian */ \ +for (__i =0 ; __i <LEN ; __i++) { \ + __t[__i] =NTOHX (&__b[__i]); \ + } \ }while (0 ) static inline size_t table_size(size_t len, size_t el_size)
security/apparmor/match.c +3 -4
@@ -67,14 +67,13 @@ static struct table_header *unpack_table(char *blob, size_t bsize) table->td_flags = th.td_flags; table->td_lolen = th.td_lolen;if (th.td_flags ==YYTD_DATA8 ) -UNPACK_ARRAY (table->td_data, blob, th.td_lolen, - u8, u8, byte_to_byte); +memcpy (table->td_data, blob, th.td_lolen);else if (th.td_flags ==YYTD_DATA16 )UNPACK_ARRAY (table->td_data, blob, th.td_lolen, - u16, __be16, be16_to_cpu); + u16, __be16, get_unaligned_be16);else if (th.td_flags ==YYTD_DATA32 )UNPACK_ARRAY (table->td_data, blob, th.td_lolen, - u32, __be32, be32_to_cpu); + u32, __be32, get_unaligned_be32);else goto fail;/* if table was vmalloced make sure the page tables are synced
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 567/641 apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Lee <[email protected]>
[ Upstream commit 74b7105e53e80a4072bd3e1a50be7aa15e3f0a01 ]
In policy_unpack.c:unpack_perms_table, the perms struct is allocated via kcalloc, with the position being reset if the allocation fails. However, the error path results in -EPROTO being retured instead of -ENOMEM. Fix this to return the correct error code.
--- security/apparmor/policy_unpack.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
security/apparmor/policy_unpack.c +4 -2
@@ -687,8 +687,10 @@ static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)if (!aa_unpack_array (e,NULL , &size)) goto fail_reset; *perms =kcalloc (size,sizeof (struct aa_perms ),GFP_KERNEL ); -if (!*perms) - goto fail_reset; +if (!*perms) { + e->pos = pos; +return -ENOMEM ; + }for (i =0 ; i < size; i++) {if (!unpack_perm (e, version, &(*perms)[i])) goto fail;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 568/641 apparmor: fix boolean argument in apparmor_mmap_file
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Lee <[email protected]>
[ Upstream commit 48d5268e911abcf7674ec33c9b0b3e952be1175e ]
The previous value of GFP_ATOMIC is an int and not a bool, potentially resulting in UB when being assigned to a bool. In addition, the mmap hook is called outside of locks (i.e. in a non-atomic context), so we can pass a fixed constant value of false instead to common_mmap.
Stable-dep-of: 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases")
--- security/apparmor/lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/apparmor/lsm.c +1 -1
@@ -583,7 +583,7 @@ static int common_mmap(const char *op, struct file *file, unsigned long prot,static int apparmor_mmap_file (struct file *file,unsigned long reqprot,unsigned long prot,unsigned long flags) { -return common_mmap (OP_FMMAP , file, prot, flags,GFP_ATOMIC ); +return common_mmap (OP_FMMAP , file, prot, flags, false); } static int apparmor_file_mprotect(struct vm_area_struct *vma,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 569/641 apparmor: drop in_atomic flag in common_mmap, and common_file_perm
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit c3f27ccdb2dce3f0f2814574d06017f46c11fa29 ]
with the previous changes to mmap the in_atomic flag is now always false, so drop it.
Stable-dep-of: 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases")
--- security/apparmor/lsm.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
security/apparmor/lsm.c +9 -12
@@ -519,8 +519,7 @@ static void apparmor_file_free_security(struct file *file)aa_put_label (rcu_access_pointer (ctx->label)); } -static int common_file_perm (const char *op,struct file *file,u32 mask, -bool in_atomic) +static int common_file_perm (const char *op,struct file *file,u32 mask) {struct aa_label *label;int error =0 ;
@@ -531,7 +530,7 @@ static int common_file_perm(const char *op, struct file *file, u32 mask,return -EACCES ; label =__begin_current_label_crit_section (&needput); - error =aa_file_perm (op,current_cred (), label, file, mask, in_atomic); + error =aa_file_perm (op,current_cred (), label, file, mask, false);__end_current_label_crit_section (label, needput);return error;
@@ -539,13 +538,12 @@ static int common_file_perm(const char *op, struct file *file, u32 mask,static int apparmor_file_receive (struct file *file) { -return common_file_perm (OP_FRECEIVE , file,aa_map_file_to_perms (file), - false); +return common_file_perm (OP_FRECEIVE , file,aa_map_file_to_perms (file)); }static int apparmor_file_permission (struct file *file,int mask) { -return common_file_perm (OP_FPERM , file, mask, false); +return common_file_perm (OP_FPERM , file, mask); }static int apparmor_file_lock (struct file *file,unsigned int cmd)
@@ -555,11 +553,11 @@ static int apparmor_file_lock(struct file *file, unsigned int cmd)if (cmd ==F_WRLCK ) mask |=MAY_WRITE ; -return common_file_perm (OP_FLOCK , file, mask, false); +return common_file_perm (OP_FLOCK , file, mask); }static int common_mmap (const char *op,struct file *file,unsigned long prot, -unsigned long flags,bool in_atomic) +unsigned long flags) {int mask =0 ;
@@ -577,21 +575,20 @@ static int common_mmap(const char *op, struct file *file, unsigned long prot,if (prot &PROT_EXEC ) mask |=AA_EXEC_MMAP ; -return common_file_perm (op, file, mask, in_atomic); +return common_file_perm (op, file, mask); }static int apparmor_mmap_file (struct file *file,unsigned long reqprot,unsigned long prot,unsigned long flags) { -return common_mmap (OP_FMMAP , file, prot, flags, false); +return common_mmap (OP_FMMAP , file, prot, flags); }static int apparmor_file_mprotect (struct vm_area_struct *vma,unsigned long reqprot,unsigned long prot) {return common_mmap (OP_FMPROT , vma->vm_file, prot, - !(vma->vm_flags &VM_SHARED ) ?MAP_PRIVATE :0 , - false); + !(vma->vm_flags &VM_SHARED ) ?MAP_PRIVATE :0 ); }#ifdef CONFIG_IO_URING
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 570/641 apparmor: account for in_atomic removal in common_file_perm
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Lee <[email protected]>
[ Upstream commit 9b829c0aa96e9385b1e9a308d3eb054b95fbeda2 ]
If we are not in an atomic context in common_file_perm, then we don't have to use the atomic versions, resulting in improved performance outside of atomic contexts.
Stable-dep-of: 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases")
--- security/apparmor/lsm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
security/apparmor/lsm.c +2 -3
@@ -523,15 +523,14 @@ static int common_file_perm(const char *op, struct file *file, u32 mask) {struct aa_label *label;int error =0 ; -bool needput;/* don't reaudit files closed during inheritance */ if (unlikely (file->f_path.dentry == aa_null.dentry))return -EACCES ; - label =__begin_current_label_crit_section (&needput); + label =begin_current_label_crit_section (); error =aa_file_perm (op,current_cred (), label, file, mask, false); -__end_current_label_crit_section (label, needput); +end_current_label_crit_section (label);return error; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 571/641 apparmor: move check for aa_null file to cover all cases
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit 4a134723f9f1ad2f3621566259db673350d19cb1 ]
files with a dentry pointing aa_null.dentry where already rejected as part of file_inheritance. Unfortunately the check in common_file_perm() is insufficient to cover all cases causing unnecessary audit messages without the original files context.
Eg.
[ 442.886474] audit: type=1400 audit(1704822661.616:329): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//lxd-juju-98527a-0_<var-snap-lxd-common-lxd>" profile="snap.lxd.activate" name="/apparmor/.null" pid=9525 comm="snap-exec"
Further examples of this are in the logs of
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2120439
https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1952084
https://bugs.launchpad.net/snapd/+bug/2049099
These messages have no value and should not be sent to the logs. AppArmor was already filtering the out in some cases but the original patch did not catch all cases. Fix this by push the existing check down into two functions that should cover all cases.
--- security/apparmor/file.c | 12 ++++++++++-- security/apparmor/lsm.c | 4 ---- 2 files changed, 10 insertions(+), 6 deletions(-)
security/apparmor/file.c +10 -2
@@ -154,8 +154,12 @@ static int path_name(const char *op, const struct cred *subj_cred,const char *info =NULL ;int error; - error =aa_path_name (path, flags, buffer, name, &info, -labels_profile (label)->disconnected); +/* don't reaudit files closed during inheritance */ +if (unlikely (path->dentry == aa_null.dentry)) + error = -EACCES ; +else + error =aa_path_name (path, flags, buffer, name, &info, +labels_profile (label)->disconnected);if (error) { fn_for_each_confined(label, profile, aa_audit_file(subj_cred,
@@ -616,6 +620,10 @@ int aa_file_perm(const char *op, const struct cred *subj_cred,AA_BUG (!label);AA_BUG (!file); +/* don't reaudit files closed during inheritance */ +if (unlikely (file->f_path.dentry == aa_null.dentry)) +return -EACCES ; + fctx =file_ctx (file);rcu_read_lock ();
security/apparmor/lsm.c +0 -4
@@ -524,10 +524,6 @@ static int common_file_perm(const char *op, struct file *file, u32 mask)struct aa_label *label;int error =0 ; -/* don't reaudit files closed during inheritance */ -if (unlikely (file->f_path.dentry == aa_null.dentry)) -return -EACCES ; - label =begin_current_label_crit_section (); error =aa_file_perm (op,current_cred (), label, file, mask, false);end_current_label_crit_section (label);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 572/641 apparmor: fix rlimit for posix cpu timers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit 6ca56813f4a589f536adceb42882855d91fb1125 ]
Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and conditionally update the posix cpu timers when appropriate.
--- security/apparmor/resource.c | 5 +++++ 1 file changed, 5 insertions(+)
security/apparmor/resource.c +5 -0
@@ -196,6 +196,11 @@ void __aa_transition_rlimits(struct aa_label *old_l, struct aa_label *new_l) rules->rlimits.limits[j].rlim_max);/* soft limit should not exceed hard limit */ rlim->rlim_cur =min (rlim->rlim_cur, rlim->rlim_max); +if (j ==RLIMIT_CPU && + rlim->rlim_cur !=RLIM_INFINITY && +IS_ENABLED (CONFIG_POSIX_TIMERS )) + (void )update_rlimit_cpu (current->group_leader, + rlim->rlim_cur); } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 573/641 apparmor: remove apply_modes_to_perms from label_match
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit b2e27be2948f2f8c38421cd554b5fc9383215648 ]
The modes shouldn't be applied at the point of label match, it just results in them being applied multiple times. Instead they should be applied after which is already being done by all callers so it can just be dropped from label_match.
Stable-dep-of: a4c9efa4dbad ("apparmor: make label_match return a consistent value")
--- security/apparmor/label.c | 3 --- 1 file changed, 3 deletions(-)
security/apparmor/label.c +0 -3
@@ -1317,7 +1317,6 @@ static int label_compound_match(struct aa_profile *profile, goto fail; } *perms = *aa_lookup_perms (rules->policy, state); -aa_apply_modes_to_perms (profile, perms);if ((perms->allow & request) != request)return -EACCES ;
@@ -1370,7 +1369,6 @@ static int label_components_match(struct aa_profile *profile, next: tmp = *aa_lookup_perms (rules->policy, state); -aa_apply_modes_to_perms (profile, &tmp);aa_perms_accum (perms, &tmp);label_for_each_cont (i, label, tp) {if (!aa_ns_visible (profile->ns, tp->ns, subns))
@@ -1379,7 +1377,6 @@ static int label_components_match(struct aa_profile *profile,if (!state) goto fail; tmp = *aa_lookup_perms (rules->policy, state); -aa_apply_modes_to_perms (profile, &tmp);aa_perms_accum (perms, &tmp); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 574/641 apparmor: make label_match return a consistent value
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit a4c9efa4dbad6dacad6e8b274e30e814c8353097 ]
compound match is inconsistent in returning a state or an integer error this is problemati if the error is ever used as a state in the state machine
--- security/apparmor/label.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
security/apparmor/label.c +9 -11
@@ -1278,7 +1278,7 @@ static inline aa_state_t match_component(struct aa_profile *profile,* @request: permissions to request * @perms: perms struct to set * -* Returns: 0 on success else ERROR +* Returns: state match stopped at or DFA_NOMATCH if aborted early * * For the label A//&B//&C this does the perm match for A//&B//&C * @perms should be preinitialized with allperms OR a previous permission
@@ -1305,7 +1305,7 @@ static int label_compound_match(struct aa_profile *profile,/* no component visible */ *perms = allperms; -return 0 ; +return state; next:label_for_each_cont (i, label, tp) {
@@ -1317,14 +1317,11 @@ static int label_compound_match(struct aa_profile *profile, goto fail; } *perms = *aa_lookup_perms (rules->policy, state); -if ((perms->allow & request) != request) -return -EACCES ; - -return 0 ; +return state; fail: *perms = nullperms; -return state; +return DFA_NOMATCH ; }/**
@@ -1406,11 +1403,12 @@ int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules, struct aa_label *label, aa_state_t state, bool subns, u32 request, struct aa_perms *perms) { - int error = label_compound_match(profile, rules, label, state, subns, - request, perms); -if (!error) -return error; + aa_state_t tmp = label_compound_match(profile, rules, label, state, subns, + request, perms); +if ((perms->allow & request) == request) +return 0 ; +/* failed compound_match try component matches */ *perms = allperms;return label_components_match (profile, rules, label, state, subns, request, perms);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 575/641 apparmor: avoid per-cpu hold underflow in aa_get_buffer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengmian Hu <[email protected]>
[ Upstream commit 640cf2f09575c9dc344b3f7be2498d31e3923ead ]
When aa_get_buffer() pulls from the per-cpu list it unconditionally decrements cache->hold. If hold reaches 0 while count is still non-zero, the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a very long time, so aa_put_buffer() never returns buffers to the global list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max) allocations.
Guard the decrement so hold never underflows.
--- security/apparmor/lsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
security/apparmor/lsm.c +2 -1
@@ -2136,7 +2136,8 @@ char *aa_get_buffer(bool in_atomic)if (!list_empty (&cache->head)) { aa_buf = list_first_entry(&cache->head, union aa_buffer, list);list_del (&aa_buf->list); - cache->hold--; +if (cache->hold) + cache->hold--; cache->count--;put_cpu_ptr (&aa_local_buffers);return &aa_buf->buffer[0 ];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 576/641 apparmor: fix invalid deref of rawdata when export_binary is unset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgia Garcia <[email protected]>
[ Upstream commit df9ac55abd18628bd8cff687ea043660532a3654 ]
If the export_binary parameter is disabled on runtime, profiles that were loaded before that will still have their rawdata stored in apparmorfs, with a symbolic link to the rawdata on the policy directory. When one of those profiles are replaced, the rawdata is set to NULL, but when trying to resolve the symbolic links to rawdata for that profile, it will try to dereference profile->rawdata->name when profile->rawdata is now NULL causing an oops. Fix it by checking if rawdata is set.
[ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088 [ 168.657420] #PF: supervisor read access in kernel mode [ 168.660619] #PF: error_code(0x0000) - not-present page [ 168.663613] PGD 0 P4D 0 [ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI [ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary) [ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330 [ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 <48> 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8 [ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282 [ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158 [ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80 [ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000 [ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80 [ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0 [ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000 [ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0 [ 168.701696] Call Trace: [ 168.702325] <TASK> [ 168.702995] rawdata_get_link_data+0x1c/0x30 [ 168.704145] vfs_readlink+0xd4/0x160 [ 168.705152] do_readlinkat+0x114/0x180 [ 168.706214] __x64_sys_readlink+0x1e/0x30 [ 168.708653] x64_sys_call+0x1d77/0x26b0 [ 168.709525] do_syscall_64+0x81/0x500 [ 168.710348] ? do_statx+0x72/0xb0 [ 168.711109] ? putname+0x3e/0x80 [ 168.711845] ? __x64_sys_statx+0xb7/0x100 [ 168.712711] ? x64_sys_call+0x10fc/0x26b0 [ 168.713577] ? do_syscall_64+0xbf/0x500 [ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0 [ 168.715404] ? irqentry_exit+0xb2/0x740 [ 168.716359] ? exc_page_fault+0x90/0x1b0 [ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- security/apparmor/apparmorfs.c | 9 +++++++++ 1 file changed, 9 insertions(+)
security/apparmor/apparmorfs.c +9 -0
@@ -1639,6 +1639,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label =aa_get_label_rcu (&proxy->label); profile =labels_profile (label); + +/* rawdata can be null when aa_g_export_binary is unset during +* runtime and a profile is replaced +*/ +if (!profile->rawdata) { +aa_put_label (label); +return ERR_PTR (-ENOENT ); + } + depth =profile_depth (profile); target =gen_symlink_name (depth, profile->rawdata->name, name);aa_put_label (label);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 577/641 apparmor: fix aa_label to return state from compount and component match
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit 9058798652c8bc0584ed1fb0766a1015046c06e8 ]
aa-label_match is not correctly returning the state in all cases. The only reason this didn't cause a error is that all callers currently ignore the return value.
--- security/apparmor/label.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
security/apparmor/label.c +6 -6
@@ -1334,7 +1334,7 @@ static int label_compound_match(struct aa_profile *profile,* @request: permissions to request * @perms: an initialized perms struct to add accumulation to * -* Returns: 0 on success else ERROR +* Returns: the state the match finished in, may be the none matching state * * For the label A//&B//&C this does the perm match for each of A and B and C * @perms should be preinitialized with allperms OR a previous permission
@@ -1362,7 +1362,7 @@ static int label_components_match(struct aa_profile *profile, }/* no subcomponents visible - no change in perms */ -return 0 ; +return state; next: tmp = *aa_lookup_perms (rules->policy, state);
@@ -1378,13 +1378,13 @@ static int label_components_match(struct aa_profile *profile, }if ((perms->allow & request) != request) -return -EACCES ; +return DFA_NOMATCH ; -return 0 ; +return state; fail: *perms = nullperms; -return -EACCES ; +return DFA_NOMATCH ; }/**
@@ -1406,7 +1406,7 @@ int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,aa_state_t tmp =label_compound_match (profile, rules, label, state, subns, request, perms);if ((perms->allow & request) == request) -return 0 ; +return tmp;/* failed compound_match try component matches */ *perms = allperms;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 578/641 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit c9be63d565789b56ca7b0197e2cb78a3671f95a8 ]
In amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM, the function returns directly without releasing the allocated xcc_info, resulting in a memory leak.
Fix this by ensuring that xcc_info is properly freed in the error paths.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +3 -1
@@ -1136,8 +1136,10 @@ static int amdgpu_acpi_enumerate_xcc(void)if (!dev_info) ret =amdgpu_acpi_dev_init (&dev_info, xcc_info, sbdf); -if (ret == -ENOMEM ) +if (ret == -ENOMEM ) { +kfree (xcc_info);return ret; + }if (!dev_info) {kfree (xcc_info);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 579/641 drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 0c44d61945c4a80775292d96460aa2f22e62f86c ]
amdgpu_discovery_get_nps_info() internally allocates memory for ranges using kvcalloc(), which may use vmalloc() for large allocation. Using kfree() to release vmalloc memory will lead to a memory corruption.
Use kvfree() to safely handle both kmalloc and vmalloc allocations.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +1 -1
@@ -1381,7 +1381,7 @@ int amdgpu_gmc_get_nps_memranges(struct amdgpu_device *adev,if (!*exp_ranges) *exp_ranges = range_cnt; err: -kfree (ranges); +kvfree (ranges);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 580/641 drm/amdgpu: Fix memory leak in amdgpu_ras_init()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit ee41e5b63c8210525c936ee637a2c8d185ce873c ]
When amdgpu_nbio_ras_sw_init() fails in amdgpu_ras_init(), the function returns directly without freeing the allocated con structure, leading to a memory leak.
Fix this by jumping to the release_con label to properly clean up the allocated memory before returning the error code.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +1 -1
@@ -4137,7 +4137,7 @@ int amdgpu_ras_init(struct amdgpu_device *adev)* to handle fatal error */ r =amdgpu_nbio_ras_sw_init (adev);if (r) -return r; + goto release_con;if (adev->nbio.ras && adev->nbio.ras->init_ras_controller_interrupt) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 581/641 drm/amdgpu: move reset debug disable handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit ad0a48e531a3137cec16bb5f8f60c8cc8de06b01 ]
Move everything to the supported resets masks rather than having an explicit misc checks for this.
Stable-dep-of: 46a2cb7d24f2 ("drm/amdgpu/sdma5: enable queue resets unconditionally")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 8 +++----- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 --- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 6 ++++-- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 6 ++++-- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 8 ++++++-- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 6 ++++-- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 3 ++- 12 files changed, 32 insertions(+), 22 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +3 -5
@@ -130,11 +130,9 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job) }/* attempt a per ring reset */ -if (unlikely (adev->debug_disable_gpu_ring_reset)) { -dev_err (adev->dev,"Ring reset disabled by debug mask\n" ); - }else if (amdgpu_gpu_recovery && -amdgpu_ring_is_reset_type_supported (ring,AMDGPU_RESET_TYPE_PER_QUEUE ) && - ring->funcs->reset) { +if (amdgpu_gpu_recovery && +amdgpu_ring_is_reset_type_supported (ring,AMDGPU_RESET_TYPE_PER_QUEUE ) && + ring->funcs->reset) {dev_err (adev->dev,"Starting %s ring reset\n" , s_job->sched->name); r =amdgpu_ring_reset (ring, job->vmid, &job->hw_fence);
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +0 -3
@@ -460,9 +460,6 @@ bool amdgpu_ring_soft_recovery(struct amdgpu_ring *ring, unsigned int vmid,ktime_t deadline;bool ret; -if (unlikely (ring->adev->debug_disable_soft_recovery)) -return false; - deadline =ktime_add_us (ktime_get (),10000 );if (amdgpu_sriov_vf (ring->adev) || !ring->funcs->soft_recovery || !fence)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +2 -1
@@ -4956,7 +4956,8 @@ static int gfx_v10_0_sw_init(struct amdgpu_ip_block *ip_block)amdgpu_get_soft_full_reset_mask (&adev->gfx.gfx_ring[0 ]); adev->gfx.compute_supported_reset =amdgpu_get_soft_full_reset_mask (&adev->gfx.compute_ring[0 ]); -if (!amdgpu_sriov_vf (adev)) { +if (!amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) { adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; adev->gfx.gfx_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; }
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +4 -2
@@ -1821,13 +1821,15 @@ static int gfx_v11_0_sw_init(struct amdgpu_ip_block *ip_block)case IP_VERSION (11 ,0 ,3 ):if ((adev->gfx.me_fw_version >=2280 ) && (adev->gfx.mec_fw_version >=2410 ) && - !amdgpu_sriov_vf (adev)) { + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) { adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; adev->gfx.gfx_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; }break ;default : -if (!amdgpu_sriov_vf (adev)) { +if (!amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) { adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; adev->gfx.gfx_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; }
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +2 -1
@@ -1547,7 +1547,8 @@ static int gfx_v12_0_sw_init(struct amdgpu_ip_block *ip_block)case IP_VERSION (12 ,0 ,1 ):if ((adev->gfx.me_fw_version >=2660 ) && (adev->gfx.mec_fw_version >=2920 ) && - !amdgpu_sriov_vf (adev)) { + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) { adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; adev->gfx.gfx_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; }
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +1 -1
@@ -2409,7 +2409,7 @@ static int gfx_v9_0_sw_init(struct amdgpu_ip_block *ip_block)amdgpu_get_soft_full_reset_mask (&adev->gfx.gfx_ring[0 ]); adev->gfx.compute_supported_reset =amdgpu_get_soft_full_reset_mask (&adev->gfx.compute_ring[0 ]); -if (!amdgpu_sriov_vf (adev)) +if (!amdgpu_sriov_vf (adev) && !adev->debug_disable_gpu_ring_reset) adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; r =amdgpu_gfx_kiq_init (adev,GFX9_MEC_HPD_SIZE ,0 );
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +4 -2
@@ -1149,14 +1149,16 @@ static int gfx_v9_4_3_sw_init(struct amdgpu_ip_block *ip_block)case IP_VERSION (9 ,4 ,3 ):case IP_VERSION (9 ,4 ,4 ):if ((adev->gfx.mec_fw_version >=155 ) && - !amdgpu_sriov_vf (adev)) { + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) { adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_PIPE ; }break ;case IP_VERSION (9 ,5 ,0 ):if ((adev->gfx.mec_fw_version >=21 ) && - !amdgpu_sriov_vf (adev)) { + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) { adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; adev->gfx.compute_supported_reset |=AMDGPU_RESET_TYPE_PER_PIPE ; }
drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c +6 -2
@@ -2361,11 +2361,15 @@ static void sdma_v4_4_2_update_reset_mask(struct amdgpu_device *adev)switch (amdgpu_ip_version (adev,GC_HWIP ,0 )) {case IP_VERSION (9 ,4 ,3 ):case IP_VERSION (9 ,4 ,4 ): -if ((adev->gfx.mec_fw_version >=0xb0 ) &&amdgpu_dpm_reset_sdma_is_supported (adev)) +if ((adev->gfx.mec_fw_version >=0xb0 ) && +amdgpu_dpm_reset_sdma_is_supported (adev) && + !adev->debug_disable_gpu_ring_reset) adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;break ;case IP_VERSION (9 ,5 ,0 ): -if ((adev->gfx.mec_fw_version >=0xf ) &&amdgpu_dpm_reset_sdma_is_supported (adev)) +if ((adev->gfx.mec_fw_version >=0xf ) && +amdgpu_dpm_reset_sdma_is_supported (adev) && + !adev->debug_disable_gpu_ring_reset) adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;break ;default :
drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +2 -1
@@ -1429,7 +1429,8 @@ static int sdma_v5_0_sw_init(struct amdgpu_ip_block *ip_block)case IP_VERSION (5 ,0 ,2 ):case IP_VERSION (5 ,0 ,5 ):if ((adev->sdma.instance[0 ].fw_version >=35 ) && - !amdgpu_sriov_vf (adev)) + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;break ;default :
drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +4 -2
@@ -1348,12 +1348,14 @@ static int sdma_v5_2_sw_init(struct amdgpu_ip_block *ip_block)case IP_VERSION (5 ,2 ,3 ):case IP_VERSION (5 ,2 ,4 ):if ((adev->sdma.instance[0 ].fw_version >=76 ) && - !amdgpu_sriov_vf (adev)) + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;break ;case IP_VERSION (5 ,2 ,5 ):if ((adev->sdma.instance[0 ].fw_version >=34 ) && - !amdgpu_sriov_vf (adev)) + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;break ;default :
drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c +2 -1
@@ -1356,7 +1356,8 @@ static int sdma_v6_0_sw_init(struct amdgpu_ip_block *ip_block)case IP_VERSION (6 ,0 ,2 ):case IP_VERSION (6 ,0 ,3 ):if ((adev->sdma.instance[0 ].fw_version >=21 ) && - !amdgpu_sriov_vf (adev)) + !amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;break ;default :
drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c +2 -1
@@ -1337,7 +1337,8 @@ static int sdma_v7_0_sw_init(struct amdgpu_ip_block *ip_block) adev->sdma.supported_reset =amdgpu_get_soft_full_reset_mask (&adev->sdma.instance[0 ].ring); -if (!amdgpu_sriov_vf (adev)) +if (!amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; r =amdgpu_sdma_sysfs_reset_mask_init (adev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 582/641 drm/amdgpu/sdma5: enable queue resets unconditionally
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 46a2cb7d24f21132e970cab52359210c3f5ea3c6 ]
There is no firmware version dependency.
--- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +3 -12
@@ -1424,18 +1424,9 @@ static int sdma_v5_0_sw_init(struct amdgpu_ip_block *ip_block) adev->sdma.supported_reset =amdgpu_get_soft_full_reset_mask (&adev->sdma.instance[0 ].ring); -switch (amdgpu_ip_version (adev,SDMA0_HWIP ,0 )) { -case IP_VERSION (5 ,0 ,0 ): -case IP_VERSION (5 ,0 ,2 ): -case IP_VERSION (5 ,0 ,5 ): -if ((adev->sdma.instance[0 ].fw_version >=35 ) && - !amdgpu_sriov_vf (adev) && - !adev->debug_disable_gpu_ring_reset) - adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; -break ; -default : -break ; - } +if (!amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) + adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;/* Allocate memory for SDMA IP Dump buffer */ ptr =kcalloc (adev->sdma.num_instances * reg_count,sizeof (uint32_t ),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 583/641 drm/amdgpu/sdma5.2: enable queue resets unconditionally
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 314d30ad50622fc0d70da71509f9dff21545be14 ]
There is no firmware version dependency. This also enables sdma queue resets on all SDMA 5.2.x based chips.
--- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 22 +++------------------- 1 file changed, 3 insertions(+), 19 deletions(-)
drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +3 -19
@@ -1342,25 +1342,9 @@ static int sdma_v5_2_sw_init(struct amdgpu_ip_block *ip_block) adev->sdma.supported_reset =amdgpu_get_soft_full_reset_mask (&adev->sdma.instance[0 ].ring); -switch (amdgpu_ip_version (adev,SDMA0_HWIP ,0 )) { -case IP_VERSION (5 ,2 ,0 ): -case IP_VERSION (5 ,2 ,2 ): -case IP_VERSION (5 ,2 ,3 ): -case IP_VERSION (5 ,2 ,4 ): -if ((adev->sdma.instance[0 ].fw_version >=76 ) && - !amdgpu_sriov_vf (adev) && - !adev->debug_disable_gpu_ring_reset) - adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; -break ; -case IP_VERSION (5 ,2 ,5 ): -if ((adev->sdma.instance[0 ].fw_version >=34 ) && - !amdgpu_sriov_vf (adev) && - !adev->debug_disable_gpu_ring_reset) - adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; -break ; -default : -break ; - } +if (!amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) + adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;/* Allocate memory for SDMA IP Dump buffer */ ptr =kcalloc (adev->sdma.num_instances * reg_count,sizeof (uint32_t ),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 584/641 drm/amdgpu/sdma6: enable queue resets unconditionally
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 56423871e9eef1dd069bddef895207fa5ce275fe ]
There is no firmware version dependency. This also enables sdma queue resets on all SDMA 6.x based chips.
--- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c +3 -12
@@ -1351,18 +1351,9 @@ static int sdma_v6_0_sw_init(struct amdgpu_ip_block *ip_block) adev->sdma.supported_reset =amdgpu_get_soft_full_reset_mask (&adev->sdma.instance[0 ].ring); -switch (amdgpu_ip_version (adev,SDMA0_HWIP ,0 )) { -case IP_VERSION (6 ,0 ,0 ): -case IP_VERSION (6 ,0 ,2 ): -case IP_VERSION (6 ,0 ,3 ): -if ((adev->sdma.instance[0 ].fw_version >=21 ) && - !amdgpu_sriov_vf (adev) && - !adev->debug_disable_gpu_ring_reset) - adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ; -break ; -default : -break ; - } +if (!amdgpu_sriov_vf (adev) && + !adev->debug_disable_gpu_ring_reset) + adev->sdma.supported_reset |=AMDGPU_RESET_TYPE_PER_QUEUE ;if (amdgpu_sdma_ras_sw_init (adev)) {dev_err (adev->dev,"Failed to initialize sdma ras block!\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 585/641 mshv: fix SRCU protection in irqfd resampler ack handler
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 2e7577cd5ddc1f86d1b6c48caf3cfa87dbb14e34 ]
Replace hlist_for_each_entry_rcu() with hlist_for_each_entry_srcu() in mshv_irqfd_resampler_ack() to correctly handle SRCU-protected linked list traversal.
The function uses SRCU (sleepable RCU) synchronization via partition->pt_irq_srcu, but was incorrectly using the RCU variant for list iteration. This could lead to race conditions when the list is modified concurrently.
Also add srcu_read_lock_held() assertion as required by hlist_for_each_entry_srcu() to ensure we're in the proper read-side critical section.
--- drivers/hv/mshv_eventfd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hv/mshv_eventfd.c +3 -2
@@ -87,8 +87,9 @@ static void mshv_irqfd_resampler_ack(struct mshv_irq_ack_notifier *mian) idx =srcu_read_lock (&partition->pt_irq_srcu); -hlist_for_each_entry_rcu (irqfd, &resampler->rsmplr_irqfd_list, - irqfd_resampler_hnode) { +hlist_for_each_entry_srcu (irqfd, &resampler->rsmplr_irqfd_list, + irqfd_resampler_hnode, +srcu_read_lock_held (&partition->pt_irq_srcu)) {if (hv_should_clear_interrupt (irqfd->irqfd_lapic_irq.lapic_control.interrupt_type))hv_call_clear_virtual_interrupt (partition->pt_id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 586/641 ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
[ Upstream commit 9f16d96e1222391a6b996a1b676bec14fb91e3b2 ]
This reverts commit f51424872760 ("ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()").
The original patch attempted to acquire the card->controls_rwsem lock in fsl_xcvr_mode_put(). However, this function is called from the upper ALSA core function snd_ctl_elem_write(), which already holds the write lock on controls_rwsem for the whole put operation. So there is no need to simply hold the lock for fsl_xcvr_activate_ctl() again.
Acquiring the read lock while holding the write lock in the same thread results in a deadlock and a hung task, as reported by Alexander Stein.
--- sound/soc/fsl/fsl_xcvr.c | 3 --- 1 file changed, 3 deletions(-)
sound/soc/fsl/fsl_xcvr.c +0 -3
@@ -223,13 +223,10 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, xcvr->mode =snd_soc_enum_item_to_val (e, item[0 ]); -down_read (&card->snd_card->controls_rwsem);fsl_xcvr_activate_ctl (dai, fsl_xcvr_arc_mode_kctl.name, (xcvr->mode ==FSL_XCVR_MODE_ARC ));fsl_xcvr_activate_ctl (dai, fsl_xcvr_earc_capds_kctl.name, (xcvr->mode ==FSL_XCVR_MODE_EARC )); -up_read (&card->snd_card->controls_rwsem); -/* Allow playback for SPDIF only */ rtd =snd_soc_get_pcm_runtime (card, card->dai_link); rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count =
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 587/641 drm/i915/acpi: free _DSM package when no connectors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 57b85fd53fccfdf14ce7b36d919c31aa752255f8 ]
acpi_evaluate_dsm_typed() returns an ACPI package in pkg. When pkg->package.count == 0, we returned without freeing pkg, leaking memory. Free pkg before returning on the empty case.
--- drivers/gpu/drm/i915/display/intel_acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/display/intel_acpi.c +1 -0
@@ -96,6 +96,7 @@ static void intel_dsm_platform_mux_info(acpi_handle dhandle)if (!pkg->package.count) {DRM_DEBUG_DRIVER ("no connection in _DSM\n" ); +ACPI_FREE (pkg);return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 588/641 ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ferrieux <[email protected]>
[ Upstream commit b82fa9b0c26eeb2fde6017f7de2c3c544484efef ]
The aw88261_dev_reg_update() function sets the Awinic registers in a rather nonuniform way:
- most registers get directly overwritten from the firmware blob
- but a handful of them need more delicate logic to preserve some bits from their current value, according to a register- specific mask
For the latter, the logic is basically
NEW = (OLD & MASK) | (VAL & ~MASK)
However, the ~MASK value is hand-computed, and in the specific case of the SYSCTRL register, in a buggy way.
This patch restores the proper ~MASK value.
--- sound/soc/codecs/aw88261.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/codecs/aw88261.c +2 -1
@@ -423,9 +423,10 @@ static int aw88261_dev_reg_update(struct aw88261 *aw88261,if (ret)break ; +/* keep all three bits from current hw status */ read_val &= (~AW88261_AMPPD_MASK ) | (~AW88261_PWDN_MASK ) | (~AW88261_HMUTE_MASK ); - reg_val &= (AW88261_AMPPD_MASK |AW88261_PWDN_MASK |AW88261_HMUTE_MASK ); + reg_val &= (AW88261_AMPPD_MASK &AW88261_PWDN_MASK &AW88261_HMUTE_MASK ); reg_val |= read_val;/* enable uls hmute */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 589/641 PCI: Validate window resource type in pbus_select_window_for_type()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit e5f72cb9cea599dc9f5a9b80a33560a1d06f01cc ]
After ebe091ad81e1 ("PCI: Use pbus_select_window_for_type() during IO window sizing") and ae88d0b9c57f ("PCI: Use pbus_select_window_for_type() during mem window sizing"), many bridge windows can't get resources assigned:
pci 0006:05:00.0: bridge window [??? 0x00001000-0x00001fff flags 0x20080000]: can't assign; no space pci 0006:05:00.0: bridge window [??? 0x00001000-0x00001fff flags 0x20080000]: failed to assign
Those commits replace find_bus_resource_of_type() with pbus_select_window_for_type(), and the latter lacks resource type validation.
Add the resource type validation back to pbus_select_window_for_type() to match the original behavior.
--- drivers/pci/setup-bus.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/pci/setup-bus.c +10 -3
@@ -221,14 +221,21 @@ static struct resource *pbus_select_window_for_type(struct pci_bus *bus,switch (iores_type) {case IORESOURCE_IO : -return pci_bus_resource_n (bus,PCI_BUS_BRIDGE_IO_WINDOW ); + win =pci_bus_resource_n (bus,PCI_BUS_BRIDGE_IO_WINDOW ); +if (win && (win->flags &IORESOURCE_IO )) +return win; +return NULL ;case IORESOURCE_MEM : mmio =pci_bus_resource_n (bus,PCI_BUS_BRIDGE_MEM_WINDOW ); mmio_pref =pci_bus_resource_n (bus,PCI_BUS_BRIDGE_PREF_MEM_WINDOW ); -if (!(type &IORESOURCE_PREFETCH ) || - !(mmio_pref->flags &IORESOURCE_MEM )) +if (mmio && !(mmio->flags &IORESOURCE_MEM )) + mmio =NULL ; +if (mmio_pref && !(mmio_pref->flags &IORESOURCE_MEM )) + mmio_pref =NULL ; + +if (!(type &IORESOURCE_PREFETCH ) || !mmio_pref)return mmio; if ((type & IORESOURCE_MEM_64) ||
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 590/641 drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 5a19302cab5cec7ae7f1a60c619951e6c17d8742 ]
The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id.
If a very large watch_id is passed from userspace, it can be converted to a negative value. This can cause invalid shifts and may access memory outside the watch_points array.
drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before using it. Also use BIT(watch_id) to test and clear bits safely.
This keeps the behavior unchanged for valid watch IDs and avoids undefined behavior for invalid ones.
Fixes the below:drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c
433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,
434 uint32_t watch_id)
435 {
436 int r;
437
438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if watch_id is larger than INT_MAX it leads to a buffer overflow. (Negative shifts are undefined).
439 return -EINVAL;
440
441 if (!pdd->dev->kfd->shared_resources.enable_mes) {
442 r = debug_lock_and_unmap(pdd->dev->dqm);
443 if (r)
444 return r;
445 }
446
447 amdgpu_gfx_off_ctrl(pdd->dev->adev, false);
--> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch(
449 pdd->dev->adev,
450 watch_id);v2: (as per, Jonathan Kim)
- Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to match the clear path.
- Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().
--- drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_debug.c +12 -8
@@ -401,27 +401,25 @@ static int kfd_dbg_get_dev_watch_id(struct kfd_process_device *pdd, int *watch_ireturn -ENOMEM ; } -static void kfd_dbg_clear_dev_watch_id (struct kfd_process_device *pdd,int watch_id) +static void kfd_dbg_clear_dev_watch_id (struct kfd_process_device *pdd,u32 watch_id) {spin_lock (&pdd->dev->watch_points_lock);/* process owns device watch point so safe to clear */ -if ((pdd->alloc_watch_ids >> watch_id) &0x1 ) { - pdd->alloc_watch_ids &= ~(0x1 << watch_id); - pdd->dev->alloc_watch_ids &= ~(0x1 << watch_id); +if (pdd->alloc_watch_ids &BIT (watch_id)) { + pdd->alloc_watch_ids &= ~BIT (watch_id); + pdd->dev->alloc_watch_ids &= ~BIT (watch_id); }spin_unlock (&pdd->dev->watch_points_lock); } -static bool kfd_dbg_owns_dev_watch_id (struct kfd_process_device *pdd,int watch_id) +static bool kfd_dbg_owns_dev_watch_id (struct kfd_process_device *pdd,u32 watch_id) {bool owns_watch_id = false;spin_lock (&pdd->dev->watch_points_lock); - owns_watch_id = watch_id <MAX_WATCH_ADDRESSES && - ((pdd->alloc_watch_ids >> watch_id) &0x1 ); - + owns_watch_id = pdd->alloc_watch_ids &BIT (watch_id);spin_unlock (&pdd->dev->watch_points_lock);return owns_watch_id;
@@ -432,6 +430,9 @@ int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, {int r; +if (watch_id >=MAX_WATCH_ADDRESSES ) +return -EINVAL ; +if (!kfd_dbg_owns_dev_watch_id (pdd, watch_id))return -EINVAL ;
@@ -469,6 +470,9 @@ int kfd_dbg_trap_set_dev_address_watch(struct kfd_process_device *pdd,if (r)return r; +if (*watch_id >=MAX_WATCH_ADDRESSES ) +return -EINVAL ; +if (!pdd->dev->kfd->shared_resources.enable_mes) { r =debug_lock_and_unmap (pdd->dev->dqm);if (r) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 591/641 drm/amd/display: Reject cursor plane on DCE when scaled differently than primary
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 41af6215cdbcecd12920f211239479027904abf3 ]
Currently DCE doesn't support the overlay cursor, so the dm_crtc_get_cursor_mode() function returns DM_CURSOR_NATIVE_MODE unconditionally. The outcome is that it doesn't check for the conditions that would necessitate the overlay cursor, meaning that it doesn't reject cases where the native cursor mode isn't supported on DCE.
Remove the early return from dm_crtc_get_cursor_mode() for DCE and instead let it perform the necessary checks and return DM_CURSOR_OVERLAY_MODE. Add a later check that rejects when DM_CURSOR_OVERLAY_MODE would be used with DCE.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +8 -3
@@ -12027,10 +12027,9 @@ static int dm_crtc_get_cursor_mode(struct amdgpu_device *adev,/* Overlay cursor not supported on HW before DCN * DCN401 does not have the cursor-on-scaled-plane or cursor-on-yuv-plane restrictions -* as previous DCN generations, so enable native mode on DCN401 in addition to DCE +* as previous DCN generations, so enable native mode on DCN401 */ -if (amdgpu_ip_version (adev,DCE_HWIP ,0 ) ==0 || -amdgpu_ip_version (adev,DCE_HWIP ,0 ) ==IP_VERSION (4 ,0 ,1 )) { +if (amdgpu_ip_version (adev,DCE_HWIP ,0 ) ==IP_VERSION (4 ,0 ,1 )) { *cursor_mode =DM_CURSOR_NATIVE_MODE ;return 0 ; }
@@ -12350,6 +12349,12 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,* need to be added for DC to not disable a plane by mistake */ if (dm_new_crtc_state->cursor_mode ==DM_CURSOR_OVERLAY_MODE ) { +if (amdgpu_ip_version (adev,DCE_HWIP ,0 ) ==0 ) { +drm_dbg (dev,"Overlay cursor not supported on DCE\n" ); + ret = -EINVAL ; + goto fail; + } + ret =drm_atomic_add_affected_planes (state, crtc);if (ret) goto fail;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 592/641 drm/amd/display: Fix out-of-bounds stream encoder index v3
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit abde491143e4e12eecc41337910aace4e8d59603 ]
eng_id can be negative and that stream_enc_regs[]
can be indexed out of bounds.
eng_id is used directly as an index into stream_enc_regs[], which has only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can access memory past the end of the array.
Add a bounds check using ARRAY_SIZE() before using eng_id as an index. The unsigned cast also rejects negative values.
This avoids out-of-bounds access.
Fixes the below smatch error:
dcn*_resource.c: stream_encoder_create() may index stream_enc_regs[eng_id] out of bounds (size 5).
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c
1246 static struct stream_encoder *dcn35_stream_encoder_create(
1247 enum engine_id eng_id,
1248 struct dc_context *ctx)
1249 {
...
1255
1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */
1257 if (eng_id <= ENGINE_ID_DIGF) {ENGINE_ID_DIGF is 5. should <= be <?
Unrelated but, ugh, why is Smatch saying that "eng_id" can be negative?end_id is type signed long, but there are checks in the caller which prevent it from being negative.
1258 vpg_inst = eng_id;
1259 afmt_inst = eng_id;
1260 } else
1261 return NULL;
1262
...
1281
1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
1283 eng_id, vpg, afmt,
--> 1284 &stream_enc_regs[eng_id],
^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.
...
1287 return &enc1->base;
1288 }v2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast
v3: The compiler already knows how to compare the two values, so the
cast (int) is not needed. (Roman)
--- .../drm/amd/display/dc/resource/dcn315/dcn315_resource.c | 8 ++++---- .../drm/amd/display/dc/resource/dcn316/dcn316_resource.c | 8 ++++---- .../drm/amd/display/dc/resource/dcn32/dcn32_resource.c | 8 ++++---- .../drm/amd/display/dc/resource/dcn321/dcn321_resource.c | 8 ++++---- .../drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 8 ++++---- .../drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 8 ++++---- 6 files changed, 24 insertions(+), 24 deletions(-)
drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c +4 -4
@@ -1226,12 +1226,12 @@ static struct stream_encoder *dcn315_stream_encoder_create(/*PHYB is wired off in HW, allow front end to remapping, otherwise needs more changes*/ /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ -if (eng_id <=ENGINE_ID_DIGF ) { - vpg_inst = eng_id; - afmt_inst = eng_id; - }else +if (eng_id <0 || eng_id >=ARRAY_SIZE (stream_enc_regs))return NULL ; + vpg_inst = eng_id; + afmt_inst = eng_id; + enc1 =kzalloc (sizeof (struct dcn10_stream_encoder ),GFP_KERNEL ); vpg =dcn31_vpg_create (ctx, vpg_inst); afmt =dcn31_afmt_create (ctx, afmt_inst);
drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c +4 -4
@@ -1220,12 +1220,12 @@ static struct stream_encoder *dcn316_stream_encoder_create(int afmt_inst;/* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ -if (eng_id <=ENGINE_ID_DIGF ) { - vpg_inst = eng_id; - afmt_inst = eng_id; - }else +if (eng_id <0 || eng_id >=ARRAY_SIZE (stream_enc_regs))return NULL ; + vpg_inst = eng_id; + afmt_inst = eng_id; + enc1 =kzalloc (sizeof (struct dcn10_stream_encoder ),GFP_KERNEL ); vpg =dcn31_vpg_create (ctx, vpg_inst); afmt =dcn31_afmt_create (ctx, afmt_inst);
drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c +4 -4
@@ -1208,12 +1208,12 @@ static struct stream_encoder *dcn32_stream_encoder_create(int afmt_inst;/* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ -if (eng_id <=ENGINE_ID_DIGF ) { - vpg_inst = eng_id; - afmt_inst = eng_id; - }else +if (eng_id <0 || eng_id >=ARRAY_SIZE (stream_enc_regs))return NULL ; + vpg_inst = eng_id; + afmt_inst = eng_id; + enc1 =kzalloc (sizeof (struct dcn10_stream_encoder ),GFP_KERNEL ); vpg =dcn32_vpg_create (ctx, vpg_inst); afmt =dcn32_afmt_create (ctx, afmt_inst);
drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c +4 -4
@@ -1189,12 +1189,12 @@ static struct stream_encoder *dcn321_stream_encoder_create(int afmt_inst;/* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ -if (eng_id <=ENGINE_ID_DIGF ) { - vpg_inst = eng_id; - afmt_inst = eng_id; - }else +if (eng_id <0 || eng_id >=ARRAY_SIZE (stream_enc_regs))return NULL ; + vpg_inst = eng_id; + afmt_inst = eng_id; + enc1 =kzalloc (sizeof (struct dcn10_stream_encoder ),GFP_KERNEL ); vpg =dcn321_vpg_create (ctx, vpg_inst); afmt =dcn321_afmt_create (ctx, afmt_inst);
drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +4 -4
@@ -1271,12 +1271,12 @@ static struct stream_encoder *dcn35_stream_encoder_create(int afmt_inst;/* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ -if (eng_id <=ENGINE_ID_DIGF ) { - vpg_inst = eng_id; - afmt_inst = eng_id; - }else +if (eng_id <0 || eng_id >=ARRAY_SIZE (stream_enc_regs))return NULL ; + vpg_inst = eng_id; + afmt_inst = eng_id; + enc1 =kzalloc (sizeof (struct dcn10_stream_encoder ),GFP_KERNEL ); vpg =dcn31_vpg_create (ctx, vpg_inst); afmt =dcn31_afmt_create (ctx, afmt_inst);
drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c +4 -4
@@ -1251,12 +1251,12 @@ static struct stream_encoder *dcn35_stream_encoder_create(int afmt_inst;/* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ -if (eng_id <=ENGINE_ID_DIGF ) { - vpg_inst = eng_id; - afmt_inst = eng_id; - }else +if (eng_id <0 || eng_id >=ARRAY_SIZE (stream_enc_regs))return NULL ; + vpg_inst = eng_id; + afmt_inst = eng_id; + enc1 =kzalloc (sizeof (struct dcn10_stream_encoder ),GFP_KERNEL ); vpg =dcn31_vpg_create (ctx, vpg_inst); afmt =dcn31_afmt_create (ctx, afmt_inst);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 593/641 spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 888a0a802c467bbe34a42167bdf9d7331333440a ]
platform_get_resource_byname() can return NULL, which would cause a crash when passed the pointer to resource_size().
Move the fiu->memory_size assignment after the error check for devm_ioremap_resource() to prevent the potential NULL pointer dereference.
--- drivers/spi/spi-wpcm-fiu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-wpcm-fiu.c +1 -1
@@ -459,11 +459,11 @@ static int wpcm_fiu_probe(struct platform_device *pdev) res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"memory" ); fiu->memory =devm_ioremap_resource (dev, res); - fiu->memory_size =min_t (size_t,resource_size (res),MAX_MEMORY_SIZE_TOTAL );if (IS_ERR (fiu->memory))return dev_err_probe (dev,PTR_ERR (fiu->memory),"Failed to map flash memory window\n" ); + fiu->memory_size =min_t (size_t,resource_size (res),MAX_MEMORY_SIZE_TOTAL ); fiu->shm_regmap =syscon_regmap_lookup_by_phandle_optional (dev->of_node,"nuvoton,shm" );wpcm_fiu_hw_init (fiu);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 594/641 s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Egorenkov <[email protected]>
[ Upstream commit dd3411959b57df6e05a3ccbac67b0a836871c0c4 ]
The commit c8424e776b09 ("MODSIGN: Export module signature definitions") replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with the dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG in s390 kernels built with MODULES=n if nothing else selects MODULE_SIG_FORMAT.
Furthermore, the signature verification in s390 kexec does not require MODULE_SIG_FORMAT because it requires only the struct module_signature and, therefore, does not depend on code in kernel/module_signature.c.
But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION is also incorrect because it makes KEXEC_SIG available on s390 only if some other arbitrary option (for instance a file system or device driver) selects it directly or indirectly.
To properly make KEXEC_SIG available for s390 kernels built with MODULES=y as well as MODULES=n _and_ also not depend on arbitrary options selecting SYSTEM_DATA_VERIFICATION, set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and select SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y.
--- arch/s390/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/s390/Kconfig +2 -1
@@ -270,6 +270,7 @@ config S390 select SPARSE_IRQ select SWIOTLB select SYSCTL_EXCEPTION_TRACE + select SYSTEM_DATA_VERIFICATION if KEXEC_SIG select THREAD_INFO_IN_TASK select TRACE_IRQFLAGS_SUPPORT select TTY
@@ -296,7 +297,7 @@ config ARCH_SUPPORTS_KEXEC_FILE def_bool y config ARCH_SUPPORTS_KEXEC_SIG - def_bool MODULE_SIG_FORMAT + def_bool y config ARCH_SUPPORTS_KEXEC_PURGATORY def_bool y
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 595/641 drm/xe/configfs: Fix parameter name omitted errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Wajdeczko <[email protected]>
[ Upstream commit 2a673fb4d787ce6672862cb693112378bff86abb ]
On some configs and old compilers we can get following build errors:
../drivers/gpu/drm/xe/xe_configfs.h: In function 'xe_configfs_get_ctx_restore_mid_bb':
../drivers/gpu/drm/xe/xe_configfs.h:40:76: error: parameter name omitted
static inline u32 xe_configfs_get_ctx_restore_mid_bb(struct pci_dev *pdev, enum xe_engine_class,
^~~~~~~~~~~~~~~~~~~~
../drivers/gpu/drm/xe/xe_configfs.h: In function 'xe_configfs_get_ctx_restore_post_bb':
../drivers/gpu/drm/xe/xe_configfs.h:42:77: error: parameter name omitted
static inline u32 xe_configfs_get_ctx_restore_post_bb(struct pci_dev *pdev, enum xe_engine_class,
^~~~~~~~~~~~~~~~~~~~when trying to define our configfs stub functions. Fix that.
--- drivers/gpu/drm/xe/xe_configfs.h | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/gpu/drm/xe/xe_configfs.h +8 -4
@@ -19,9 +19,11 @@ void xe_configfs_check_device(struct pci_dev *pdev);bool xe_configfs_get_survivability_mode (struct pci_dev *pdev);u64 xe_configfs_get_engines_allowed (struct pci_dev *pdev);bool xe_configfs_get_psmi_enabled (struct pci_dev *pdev); -u32 xe_configfs_get_ctx_restore_mid_bb (struct pci_dev *pdev,enum xe_engine_class , +u32 xe_configfs_get_ctx_restore_mid_bb (struct pci_dev *pdev, +enum xe_engine_class class,const u32 **cs); -u32 xe_configfs_get_ctx_restore_post_bb (struct pci_dev *pdev,enum xe_engine_class , +u32 xe_configfs_get_ctx_restore_post_bb (struct pci_dev *pdev, +enum xe_engine_class class,const u32 **cs);#else static inline int xe_configfs_init (void ) {return 0 ; }
@@ -30,9 +32,11 @@ static inline void xe_configfs_check_device(struct pci_dev *pdev) { }static inline bool xe_configfs_get_survivability_mode (struct pci_dev *pdev) {return false; }static inline u64 xe_configfs_get_engines_allowed (struct pci_dev *pdev) {return U64_MAX ; }static inline bool xe_configfs_get_psmi_enabled (struct pci_dev *pdev) {return false; } -static inline u32 xe_configfs_get_ctx_restore_mid_bb (struct pci_dev *pdev,enum xe_engine_class , +static inline u32 xe_configfs_get_ctx_restore_mid_bb (struct pci_dev *pdev, +enum xe_engine_class class,const u32 **cs) {return 0 ; } -static inline u32 xe_configfs_get_ctx_restore_post_bb (struct pci_dev *pdev,enum xe_engine_class , +static inline u32 xe_configfs_get_ctx_restore_post_bb (struct pci_dev *pdev, +enum xe_engine_class class,const u32 **cs) {return 0 ; }#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 596/641 drm/xe/mmio: Avoid double-adjust in 64-bit reads
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit 4a9b4e1fa52a6aaa1adbb7f759048df14afed54c ]
xe_mmio_read64_2x32() was adjusting register addresses and then calling xe_mmio_read32(), which applies the adjustment again. This may shift accesses twice if adj_offset < adj_limit. There is no issue currently, as for media gt, adj_offset > adj_limit, so the 2nd adjust will be a no-op. But it may not work in future.
To fix it, replace the adjusted-address comparison with a direct sanity check that ensures the MMIO address adjustment cutoff never falls within the 8-byte range of a 64-bit register. And let xe_mmio_read32() handle address translation.
v2: rewrite the sanity check in a more natural way. (Matt)
v3: Add Fixes tag. (Jani)
--- drivers/gpu/drm/xe/xe_mmio.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/xe/xe_mmio.c +5 -5
@@ -260,11 +260,11 @@ u64 xe_mmio_read64_2x32(struct xe_mmio *mmio, struct xe_reg reg)struct xe_reg reg_udw = { .addr = reg.addr +0x4 };u32 ldw, udw, oldudw, retries; - reg.addr =xe_mmio_adjusted_addr (mmio, reg.addr); - reg_udw.addr =xe_mmio_adjusted_addr (mmio, reg_udw.addr); - -/* we shouldn't adjust just one register address */ -xe_tile_assert (mmio->tile, reg_udw.addr == reg.addr +0x4 ); +/* +* The two dwords of a 64-bit register can never straddle the offset +* adjustment cutoff. +*/ +xe_tile_assert (mmio->tile, !in_range (mmio->adj_limit, reg.addr +1 ,7 )); oldudw =xe_mmio_read32 (mmio, reg_udw);for (retries =5 ; retries; --retries) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 597/641 drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit bc6387a2e0c1562faa56ce2a98cef50cab809e08 ]
The PSS_CHICKEN register has been part of the RCS engine's LRC since it was first introduced in Xe_LP. That means that any workarounds that adjust its value (such as Wa_14019988906 and Wa_14019877138) need to be implemented in the lrc_was[] table so that they become part of the default LRC from which all subsequent LRCs are copied. Although these workarounds were implemented correctly on most platforms, they were incorrectly placed on the engine_was[] table for Xe2_HPG.
Move the workarounds to the proper lrc_was[] table and switch the 'xe_rtp_match_first_render_or_compute' rule to specifically match the RCS since that's the engine whose LRC manages the register.
Bspec: 65182
--- drivers/gpu/drm/xe/xe_wa.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
drivers/gpu/drm/xe/xe_wa.c +8 -10
@@ -567,16 +567,6 @@ static const struct xe_rtp_entry_sr engine_was[] = { FUNC(xe_rtp_match_first_render_or_compute)),XE_RTP_ACTIONS (SET (ROW_CHICKEN ,EARLY_EOT_DIS )) }, - { XE_RTP_NAME("14019988906"), -XE_RTP_RULES (GRAPHICS_VERSION_RANGE (2001 ,2002 ), -FUNC (xe_rtp_match_first_render_or_compute)), -XE_RTP_ACTIONS (SET (XEHP_PSS_CHICKEN ,FLSH_IGNORES_PSD )) - }, - { XE_RTP_NAME("14019877138"), -XE_RTP_RULES (GRAPHICS_VERSION_RANGE (2001 ,2002 ), -FUNC (xe_rtp_match_first_render_or_compute)), -XE_RTP_ACTIONS (SET (XEHP_PSS_CHICKEN ,FD_END_COLLECT )) - }, { XE_RTP_NAME("14020338487"),XE_RTP_RULES (GRAPHICS_VERSION_RANGE (2001 ,2002 ), FUNC(xe_rtp_match_first_render_or_compute)),
@@ -873,6 +863,14 @@ static const struct xe_rtp_entry_sr lrc_was[] = {XE_RTP_RULES (GRAPHICS_VERSION (2001 ),ENGINE_CLASS (RENDER )),XE_RTP_ACTIONS (SET (WM_CHICKEN3 ,HIZ_PLANE_COMPRESSION_DIS )) }, + { XE_RTP_NAME("14019988906"), +XE_RTP_RULES (GRAPHICS_VERSION_RANGE (2001 ,2002 ),ENGINE_CLASS (RENDER )), +XE_RTP_ACTIONS (SET (XEHP_PSS_CHICKEN ,FLSH_IGNORES_PSD )) + }, + { XE_RTP_NAME("14019877138"), +XE_RTP_RULES (GRAPHICS_VERSION_RANGE (2001 ,2002 ),ENGINE_CLASS (RENDER )), +XE_RTP_ACTIONS (SET (XEHP_PSS_CHICKEN ,FD_END_COLLECT )) + }, { XE_RTP_NAME("14021490052"),XE_RTP_RULES (GRAPHICS_VERSION (2001 ),ENGINE_CLASS (RENDER )), XE_RTP_ACTIONS(SET(FF_MODE,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 598/641 drm/xe: Make xe_modparam.force_vram_bar_size signed
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit 1acec6ef0511b92e7974cc5a8768bfd3a659feaf ]
vram_bar_size is registered as an int module parameter and is documented to accept negative values to disable BAR resizing.
Store it as an int in xe_modparam as well, so negative values work as intended and the module_param type matches.
--- drivers/gpu/drm/xe/xe_module.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_module.h +1 -1
@@ -12,7 +12,7 @@struct xe_modparam {bool force_execlist;bool probe_display; -u32 force_vram_bar_size; +int force_vram_bar_size;int guc_log_level;char *guc_firmware_path;char *huc_firmware_path;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 599/641 drm/xe/bo: Redirect faults to dummy page for wedged device
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raag Jadav <[email protected]>
[ Upstream commit 4e83a8d58e1c721a89b3ffe15f549007080272e2 ]
As per uapi documentation[1], the prerequisite for wedged device is to redirected page faults to a dummy page. Follow it.
[1] Documentation/gpu/drm-uapi.rst
v2: Add uapi reference and fixes tag (Matthew Brost)
--- drivers/gpu/drm/xe/xe_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_bo.c +1 -1
@@ -1895,7 +1895,7 @@ static vm_fault_t xe_bo_cpu_fault(struct vm_fault *vmf)int err =0 ;int idx; -if (!drm_dev_enter (&xe->drm, &idx)) +if (xe_device_wedged (xe) || !drm_dev_enter (&xe->drm, &idx))return ttm_bo_vm_dummy_page (vmf, vmf->vma->vm_page_prot); ret =xe_bo_cpu_fault_fastpath (vmf, xe, bo, needs_rpm);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 600/641 gpio: amd-fch: ionly return allowed values from amd_fch_gpio_get()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit fbd03587ba732c612b8a569d1cf5bed72bd3a27c ]
As of 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") gpiolib requires drivers implementing GPIOs to only return 0, 1 or negative error for the get() callbacks. Ensure that amd-fch complies with this requirement.
--- drivers/gpio/gpio-amd-fch.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpio/gpio-amd-fch.c +4 -3
@@ -8,6 +8,7 @@* */ +#include <linux/bitfield.h> #include <linux/err.h> #include <linux/io.h> #include <linux/kernel.h>
@@ -120,15 +121,15 @@ static int amd_fch_gpio_get(struct gpio_chip *gc, unsigned int offset) {unsigned long flags; -int ret; +u32 val;struct amd_fch_gpio_priv *priv =gpiochip_get_data (gc);void __iomem *ptr =amd_fch_gpio_addr (priv, offset);spin_lock_irqsave (&priv->lock, flags); - ret = (readl_relaxed (ptr) &AMD_FCH_GPIO_FLAG_READ ); + val =readl_relaxed (ptr);spin_unlock_irqrestore (&priv->lock, flags); -return ret; +return FIELD_GET (AMD_FCH_GPIO_FLAG_READ , val); } static int amd_fch_gpio_request(struct gpio_chip *chip,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 602/641 btrfs: remove fs_info argument from btrfs_try_granting_tickets()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit e3df6408b13a75cf73e543e53453f28261874c6f ]
We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument.
Stable-dep-of: 5870ec7c8fe5 ("btrfs: reset block group size class when it becomes empty")
--- fs/btrfs/block-group.c | 4 ++-- fs/btrfs/block-rsv.c | 2 +- fs/btrfs/space-info.c | 14 +++++++------- fs/btrfs/space-info.h | 5 ++--- 4 files changed, 12 insertions(+), 13 deletions(-)
fs/btrfs/block-group.c +2 -2
@@ -3836,7 +3836,7 @@ int btrfs_add_reserved_bytes(struct btrfs_block_group *cache,* that happens. */ if (num_bytes < ram_bytes) -btrfs_try_granting_tickets (cache->fs_info, space_info); +btrfs_try_granting_tickets (space_info); out:spin_unlock (&cache->lock);spin_unlock (&space_info->lock);
@@ -3874,7 +3874,7 @@ void btrfs_free_reserved_bytes(struct btrfs_block_group *cache, u64 num_bytes, cache->delalloc_bytes -= num_bytes;spin_unlock (&cache->lock); -btrfs_try_granting_tickets (cache->fs_info, space_info); +btrfs_try_granting_tickets (space_info);spin_unlock (&space_info->lock); }
fs/btrfs/block-rsv.c +1 -1
@@ -387,7 +387,7 @@ void btrfs_update_global_block_rsv(struct btrfs_fs_info *fs_info) num_bytes = block_rsv->reserved - block_rsv->size;btrfs_space_info_update_bytes_may_use (sinfo, -num_bytes); block_rsv->reserved = block_rsv->size; -btrfs_try_granting_tickets (fs_info, sinfo); +btrfs_try_granting_tickets (sinfo); } block_rsv->full = (block_rsv->reserved == block_rsv->size);
fs/btrfs/space-info.c +7 -7
@@ -378,7 +378,7 @@ void btrfs_add_bg_to_space_info(struct btrfs_fs_info *info,btrfs_space_info_update_bytes_zone_unusable (space_info, block_group->zone_unusable);if (block_group->length >0 ) space_info->full = false; -btrfs_try_granting_tickets (info, space_info); +btrfs_try_granting_tickets (space_info);spin_unlock (&space_info->lock); block_group->space_info = space_info;
@@ -528,9 +528,9 @@ static void remove_ticket(struct btrfs_space_info *space_info,* This is for space we already have accounted in space_info->bytes_may_use, so * basically when we're returning space from block_rsv's. */ -void btrfs_try_granting_tickets (struct btrfs_fs_info *fs_info, -struct btrfs_space_info *space_info) +void btrfs_try_granting_tickets (struct btrfs_space_info *space_info) { +struct btrfs_fs_info *fs_info = space_info->fs_info;struct list_head *head;enum btrfs_reserve_flush_enum flush =BTRFS_RESERVE_NO_FLUSH ;
@@ -1129,7 +1129,7 @@ static bool maybe_fail_all_tickets(struct btrfs_fs_info *fs_info,* the list. */ if (!aborted) -btrfs_try_granting_tickets (fs_info, space_info); +btrfs_try_granting_tickets (space_info); }return (tickets_id != space_info->tickets_id); }
@@ -1549,7 +1549,7 @@ static void priority_reclaim_metadata_space(struct btrfs_fs_info *fs_info,* ticket in front of a smaller ticket that can now be satisfied with * the available space. */ -btrfs_try_granting_tickets (fs_info, space_info); +btrfs_try_granting_tickets (space_info);spin_unlock (&space_info->lock); }
@@ -1577,7 +1577,7 @@ static void priority_reclaim_data_space(struct btrfs_fs_info *fs_info, ticket->error = -ENOSPC ;remove_ticket (space_info, ticket); -btrfs_try_granting_tickets (fs_info, space_info); +btrfs_try_granting_tickets (space_info);spin_unlock (&space_info->lock); }
@@ -2200,5 +2200,5 @@ void btrfs_return_free_space(struct btrfs_space_info *space_info, u64 len) grant:/* Add to any tickets we may have. */ if (len) -btrfs_try_granting_tickets (fs_info, space_info); +btrfs_try_granting_tickets (space_info); }
fs/btrfs/space-info.h +2 -3
@@ -283,8 +283,7 @@ int btrfs_reserve_metadata_bytes(struct btrfs_fs_info *fs_info,struct btrfs_space_info *space_info, u64 orig_bytes, enum btrfs_reserve_flush_enum flush); -void btrfs_try_granting_tickets (struct btrfs_fs_info *fs_info, -struct btrfs_space_info *space_info); +void btrfs_try_granting_tickets (struct btrfs_space_info *space_info);int btrfs_can_overcommit (struct btrfs_fs_info *fs_info,const struct btrfs_space_info *space_info,u64 bytes,enum btrfs_reserve_flush_enum flush);
@@ -295,7 +294,7 @@ static inline void btrfs_space_info_free_bytes_may_use( {spin_lock (&space_info->lock);btrfs_space_info_update_bytes_may_use (space_info, -num_bytes); -btrfs_try_granting_tickets (space_info->fs_info, space_info); +btrfs_try_granting_tickets (space_info);spin_unlock (&space_info->lock); } int btrfs_reserve_data_bytes(struct btrfs_space_info *space_info, u64 bytes,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 603/641 btrfs: reduce block group critical section in btrfs_free_reserved_bytes()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 8b6fa164ab59f9e3f24e627fe09a0234783e7a8b ]
There's no need to update the space_info fields (bytes_reserved, max_extent_size, bytes_readonly, bytes_zone_unusable) while holding the block group's spinlock. So move those updates to happen after we unlock the block group (and while holding the space_info locked of course), so that all we do under the block group's critical section is to update the block group itself.
Stable-dep-of: 5870ec7c8fe5 ("btrfs: reset block group size class when it becomes empty")
--- fs/btrfs/block-group.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
fs/btrfs/block-group.c +9 -6
@@ -3859,21 +3859,24 @@ void btrfs_free_reserved_bytes(struct btrfs_block_group *cache, u64 num_bytes, bool is_delalloc) {struct btrfs_space_info *space_info = cache->space_info; +bool bg_ro;spin_lock (&space_info->lock);spin_lock (&cache->lock); -if (cache->ro) + bg_ro = cache->ro; + cache->reserved -= num_bytes; +if (is_delalloc) + cache->delalloc_bytes -= num_bytes; +spin_unlock (&cache->lock); + +if (bg_ro) space_info->bytes_readonly += num_bytes;else if (btrfs_is_zoned (cache->fs_info)) space_info->bytes_zone_unusable += num_bytes; - cache->reserved -= num_bytes; + space_info->bytes_reserved -= num_bytes; space_info->max_extent_size =0 ; -if (is_delalloc) - cache->delalloc_bytes -= num_bytes; -spin_unlock (&cache->lock); -btrfs_try_granting_tickets (space_info);spin_unlock (&space_info->lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 604/641 btrfs: reset block group size class when it becomes empty
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit 5870ec7c8fe57a8b2c65005e5da5efc054faa3e6 ]
Block group size classes are managed consistently everywhere. Currently, btrfs_use_block_group_size_class() sets a block group's size class to specialize it for a specific allocation size. However, this size class remains "stale" even if the block group becomes completely empty (both used and reserved bytes reach zero).
This happens in two scenarios:
1. When space reservations are freed (e.g., due to errors or transaction aborts) via btrfs_free_reserved_bytes().
2. When the last extent in a block group is freed via btrfs_update_block_group().
While size classes are advisory, a stale size class can cause find_free_extent to unnecessarily skip candidate block groups during initial search loops. This undermines the purpose of size classes to reduce fragmentation by keeping block groups restricted to a specific size class when they could be reused for any size.
Fix this by resetting the size class to BTRFS_BG_SZ_NONE whenever a block group's used and reserved counts both reach zero. This ensures that empty block groups are fully available for any allocation size in the next cycle.
--- fs/btrfs/block-group.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/btrfs/block-group.c +10 -0
@@ -3681,6 +3681,14 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans)return ret; } +static void btrfs_maybe_reset_size_class (struct btrfs_block_group *bg) +{ +lockdep_assert_held (&bg->lock); +if (btrfs_block_group_should_use_size_class (bg) && + bg->used ==0 && bg->reserved ==0 ) + bg->size_class =BTRFS_BG_SZ_NONE ; +} +int btrfs_update_block_group (struct btrfs_trans_handle *trans,u64 bytenr,u64 num_bytes,bool alloc) {
@@ -3745,6 +3753,7 @@ int btrfs_update_block_group(struct btrfs_trans_handle *trans, old_val -= num_bytes; cache->used = old_val; cache->pinned += num_bytes; +btrfs_maybe_reset_size_class (cache);btrfs_space_info_update_bytes_pinned (space_info, num_bytes); space_info->bytes_used -= num_bytes; space_info->disk_used -= num_bytes * factor;
@@ -3865,6 +3874,7 @@ void btrfs_free_reserved_bytes(struct btrfs_block_group *cache, u64 num_bytes,spin_lock (&cache->lock); bg_ro = cache->ro; cache->reserved -= num_bytes; +btrfs_maybe_reset_size_class (cache);if (is_delalloc) cache->delalloc_bytes -= num_bytes;spin_unlock (&cache->lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 605/641 btrfs: use the correct type to initialize block reserve for delayed refs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 2155d0c0a761a56ce7ede83a26eb23ea0f935260 ]
When initializing the delayed refs block reserve for a transaction handle we are passing a type of BTRFS_BLOCK_RSV_DELOPS, which is meant for delayed items and not for delayed refs. The correct type for delayed refs is BTRFS_BLOCK_RSV_DELREFS.
On release of any excess space reserved in a local delayed refs reserve, we also should transfer that excess space to the global block reserve (it it's full, we return to the space info for general availability).
By initializing a transaction's local delayed refs block reserve with a type of BTRFS_BLOCK_RSV_DELOPS, we were also causing any excess space released from the delayed block reserve (fs_info->delayed_block_rsv, used for delayed inodes and items) to be transferred to the global block reserve instead of the global delayed refs block reserve. This was an unintentional change in commit 28270e25c69a ("btrfs: always reserve space for delayed refs when starting transaction"), but it's not particularly serious as things tend to cancel out each other most of the time and it's relatively rare to be anywhere near exhaustion of the global reserve.
Fix this by initializing a transaction's local delayed refs reserve with a type of BTRFS_BLOCK_RSV_DELREFS and making btrfs_block_rsv_release() attempt to transfer unused space from such a reserve into the global block reserve, just as we did before that commit for when the block reserve is a delayed refs rsv.
--- fs/btrfs/block-rsv.c | 7 ++++--- fs/btrfs/transaction.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-)
fs/btrfs/block-rsv.c +4 -3
@@ -278,10 +278,11 @@ u64 btrfs_block_rsv_release(struct btrfs_fs_info *fs_info,struct btrfs_block_rsv *target =NULL ;/* -* If we are a delayed block reserve then push to the global rsv, -* otherwise dump into the global delayed reserve if it is not full. +* If we are a delayed refs block reserve then push to the global +* reserve, otherwise dump into the global delayed refs reserve if it is +* not full. */ -if (block_rsv->type ==BTRFS_BLOCK_RSV_DELOPS ) +if (block_rsv->type ==BTRFS_BLOCK_RSV_DELREFS ) target = global_rsv;else if (block_rsv != global_rsv && !btrfs_block_rsv_full (delayed_rsv)) target = delayed_rsv;
fs/btrfs/transaction.c +1 -1
@@ -726,7 +726,7 @@ start_transaction(struct btrfs_root *root, unsigned int num_items, h->type = type;INIT_LIST_HEAD (&h->new_bgs); -btrfs_init_metadata_block_rsv (fs_info, &h->delayed_rsv,BTRFS_BLOCK_RSV_DELOPS ); +btrfs_init_metadata_block_rsv (fs_info, &h->delayed_rsv,BTRFS_BLOCK_RSV_DELREFS );smp_mb (); if (cur_trans->state >= TRANS_STATE_COMMIT_START &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 606/641 btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit ecb7c2484cfc83a93658907580035a8adf1e0a92 ]
If btrfs_search_slot_for_read() returns 1, it means we did not find any key greater than or equals to the key we asked for, meaning we have reached the end of the tree and therefore the path is not valid. If this happens we need to break out of the loop and stop, instead of continuing and accessing an invalid path.
--- fs/btrfs/qgroup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/btrfs/qgroup.c +7 -4
@@ -1157,11 +1157,14 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info, }if (ret >0 ) {/* -* Shouldn't happen, but in case it does we -* don't need to do the btrfs_next_item, just -* continue. +* Shouldn't happen because the key should still +* be there (return 0), but in case it does it +* means we have reached the end of the tree - +* there are no more leaves with items that have +* a key greater than or equals to @found_key, +* so just stop the search loop. */ -continue ; +break ; } } ret =btrfs_next_item (tree_root, path);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 607/641 x86/hyperv: Fix error pointer dereference
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
[ Upstream commit 705d01c8d78121ee1634bfc602ac4b0ad1438fab ]
The function idle_thread_get() can return an error pointer and is not checked for it. Add check for error pointer.
Detected by Smatch:arch/x86/hyperv/hv_vtl.c:126 hv_vtl_bringup_vcpu() error:
'idle' dereferencing possible ERR_PTR()
--- arch/x86/hyperv/hv_vtl.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/x86/hyperv/hv_vtl.c +5 -3
@@ -105,7 +105,7 @@ static void hv_vtl_ap_entry(void)static int hv_vtl_bringup_vcpu (u32 target_vp_index,int cpu,u64 eip_ignored) { -u64 status; +u64 status, rsp, rip;int ret =0 ;struct hv_enable_vp_vtl *input;unsigned long irq_flags;
@@ -118,9 +118,11 @@ static int hv_vtl_bringup_vcpu(u32 target_vp_index, int cpu, u64 eip_ignored)struct desc_struct *gdt;struct task_struct *idle =idle_thread_get (cpu); -u64 rsp = (unsigned long )idle->thread.sp; +if (IS_ERR (idle)) +return PTR_ERR (idle); -u64 rip = (u64)&hv_vtl_ap_entry; + rsp = (unsigned long )idle->thread.sp; + rip = (u64)&hv_vtl_ap_entry;native_store_gdt (&gdt_ptr);store_idt (&idt_ptr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 608/641 ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Detlev Casanova <[email protected]>
[ Upstream commit 0783052534f547f8f201dd4554b1df9f1f8615b5 ]
Drivers will not always call set_sysclk() for all clocks, especially when default mclk-fs can be used.
When that is the case, use the clock rate set in the params multiplied by the default mclk-fs.
--- sound/soc/rockchip/rockchip_i2s_tdm.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/soc/rockchip/rockchip_i2s_tdm.c +10 -0
@@ -22,6 +22,7 @@#define DRV_NAME "rockchip-i2s-tdm" +#define DEFAULT_MCLK_FS 256#define CH_GRP_MAX 4/* The max channel 8 / 2 */ #define MULTIPLEX_CH_MAX 10
@@ -665,6 +666,15 @@ static int rockchip_i2s_tdm_hw_params(struct snd_pcm_substream *substream, mclk_rate = i2s_tdm->mclk_rx_freq; } +/* +* When the dai/component driver doesn't need to set mclk-fs for a specific +* clock, it can skip the call to set_sysclk() for that clock. +* In that case, simply use the clock rate from the params and multiply it by +* the default mclk-fs value. +*/ +if (!mclk_rate) + mclk_rate =DEFAULT_MCLK_FS *params_rate (params); + err =clk_set_rate (mclk, mclk_rate);if (err)return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 609/641 drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
[ Upstream commit f0157ce46cf0e5e2257e19d590c9b16036ce26d4 ]
The plane scaling hw seems to have the same min/max plane scaling limits for all 16 bpc / 64 bpp interleaved pixel color formats.
Therefore add cases to amdgpu_dm_plane_get_min_max_dc_plane_scaling() for all the 16 bpc fixed-point / unorm formats to use the same .fp16 up/downscaling factor limits as used by the fp16 floating point formats.
So far, 16 bpc unorm formats were not handled, and the default: path returned max/min factors for 32 bpp argb8888 formats, which were wrong and bigger than what many DCE / DCN hw generations could handle.
The result sometimes was misscaling of framebuffers with DRM_FORMAT_XRGB16161616, DRM_FORMAT_ARGB16161616, DRM_FORMAT_XBGR16161616, DRM_FORMAT_ABGR16161616, leading to very wrong looking display, as tested on Polaris11 / DCE-11.2.
So far this went unnoticed, because only few userspace clients used such 16 bpc unorm framebuffers, and those didn't use hw plane scaling, so they did not experience this issue.
With upcoming Mesa 26 exposing 16 bpc unorm formats under both OpenGL and Vulkan under Wayland, and the upcoming GNOME 50 Mutter Wayland compositor allowing for direct scanout of these formats, the scaling hw will be used on these formats if possible for HiDPI display scaling, so it is important to use the correct hw scaling limits to avoid wrong display.
Tested on AMD Polaris 11 / DCE 11.2 with upcoming Mesa 26 and GNOME 50 on HiDPI displays with scaling enabled. The mutter Wayland compositor now correctly falls back to scaling via desktop compositing instead of direct scanout, thereby avoiding wrong image display. For unscaled mode, it correctly uses direct scanout.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +5 -0
@@ -1059,10 +1059,15 @@ static void amdgpu_dm_plane_get_min_max_dc_plane_scaling(struct drm_device *dev, *min_downscale = plane_cap->max_downscale_factor.nv12;break ; +/* All 64 bpp formats have the same fp16 scaling limits */ case DRM_FORMAT_XRGB16161616F :case DRM_FORMAT_ARGB16161616F :case DRM_FORMAT_XBGR16161616F :case DRM_FORMAT_ABGR16161616F : +case DRM_FORMAT_XRGB16161616 : +case DRM_FORMAT_ARGB16161616 : +case DRM_FORMAT_XBGR16161616 : +case DRM_FORMAT_ABGR16161616 : *max_upscale = plane_cap->max_upscale_factor.fp16; *min_downscale = plane_cap->max_downscale_factor.fp16;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 610/641 usb: cdns3: fix role switching during resume
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richard (TI) <[email protected]>
commit 87e4b043b98a1d269be0b812f383881abee0ca45 upstream.
If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference.
The host role's start() operation registers a xhci-hcd device, but its probe is deferred while we are in the resume path. The host role's resume() operation assumes the xhci-hcd device is already probed, which is not the case, leading to the dereference. Since the start() operation of the new role is already called, the resume operation can be skipped.
So skip the resume operation for the new role if a role switch occurs during resume. Once the resume sequence is complete, the xhci-hcd device can be probed in case of host mode.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208
Mem abort info:
...
Data abort info:
...
[0000000000000208] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted 6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT Hardware name: Texas Instruments J7200 EVM (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_hcd_is_primary_hcd+0x0/0x1c lr : cdns_host_resume+0x24/0x5c ... Call trace: usb_hcd_is_primary_hcd+0x0/0x1c (P) cdns_resume+0x6c/0xbc cdns3_controller_resume.isra.0+0xe8/0x17c cdns3_plat_resume+0x18/0x24 platform_pm_resume+0x2c/0x68 dpm_run_callback+0x90/0x248 device_resume+0x100/0x24c dpm_resume+0x190/0x2ec dpm_resume_end+0x18/0x34 suspend_devices_and_enter+0x2b0/0xa44 pm_suspend+0x16c/0x5fc state_store+0x80/0xec kobj_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x130/0x1dc vfs_write+0x240/0x370 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0x108 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401) ---[ end trace 0000000000000000 ]---
--- drivers/usb/cdns3/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/cdns3/core.c +1 -1
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns) } } -if (cdns->roles[cdns->role]->resume) +if (!role_changed && cdns->roles[cdns->role]->resume) cdns->roles[cdns->role]->resume (cdns, power_lost);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 611/641 MIPS: Work around LLVM bug when gp is used as global register variable
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Zi <[email protected]>
commit 30bfc2d6a1132a89a5f1c3b96c59cf3e4d076ea3 upstream.
On MIPS, __current_thread_info is defined as global register variable locating in $gp, and is simply assigned with new address during kernel relocation.
This however is broken with LLVM, which always restores $gp if it finds $gp is clobbered in any form, including when intentionally through a global register variable. This is against GCC's documentation[1], which requires a callee-saved register used as global register variable not to be restored if it's clobbered.
As a result, $gp will continue to point to the unrelocated kernel after the epilog of relocate_kernel(), leading to an early crash in init_idle,
[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000000000, epc == ffffffff81afada8, ra == ffffffff81afad90 [ 0.000000] Oops[#1]: [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G W 6.19.0-rc5-00262-gd3eeb99bbc99-dirty #188 VOLUNTARY [ 0.000000] Tainted: [W]=WARN [ 0.000000] Hardware name: loongson,loongson64v-4core-virtio [ 0.000000] $ 0 : 0000000000000000 0000000000000000 0000000000000001 0000000000000000 [ 0.000000] $ 4 : ffffffff80b80ec0 ffffffff80b53d48 0000000000000000 00000000000f4240 [ 0.000000] $ 8 : 0000000000000100 ffffffff81d82f80 ffffffff81d82f80 0000000000000001 [ 0.000000] $12 : 0000000000000000 ffffffff81776f58 00000000000005da 0000000000000002 [ 0.000000] $16 : ffffffff80b80e40 0000000000000000 ffffffff80b81614 9800000005dfbe80 [ 0.000000] $20 : 00000000540000e0 ffffffff81980000 0000000000000000 ffffffff80f81c80 [ 0.000000] $24 : 0000000000000a26 ffffffff8114fb90 [ 0.000000] $28 : ffffffff80b50000 ffffffff80b53d40 0000000000000000 ffffffff81afad90 [ 0.000000] Hi : 0000000000000000 [ 0.000000] Lo : 0000000000000000 [ 0.000000] epc : ffffffff81afada8 init_idle+0x130/0x270 [ 0.000000] ra : ffffffff81afad90 init_idle+0x118/0x270 [ 0.000000] Status: 540000e2 KX SX UX KERNEL EXL [ 0.000000] Cause : 00000008 (ExcCode 02) [ 0.000000] BadVA : 0000000000000000 [ 0.000000] PrId : 00006305 (ICT Loongson-3) [ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000) [ 0.000000] Stack : 9800000005dfbf00 ffffffff8178e950 0000000000000000 0000000000000000 [ 0.000000] 0000000000000000 ffffffff81970000 000000000000003f ffffffff810a6528 [ 0.000000] 0000000000000001 9800000005dfbe80 9800000005dfbf00 ffffffff81980000 [ 0.000000] ffffffff810a6450 ffffffff81afb6c0 0000000000000000 ffffffff810a2258 [ 0.000000] ffffffff81d82ec8 ffffffff8198d010 ffffffff81b67e80 ffffffff8197dd98 [ 0.000000] ffffffff81d81c80 ffffffff81930000 0000000000000040 0000000000000000 [ 0.000000] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 0.000000] 0000000000000000 000000000000009e ffffffff9fc01000 0000000000000000 [ 0.000000] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 0.000000] 0000000000000000 ffffffff81ae86dc ffffffff81b3c741 0000000000000002 [ 0.000000] ... [ 0.000000] Call Trace: [ 0.000000] [<ffffffff81afada8>] init_idle+0x130/0x270 [ 0.000000] [<ffffffff81afb6c0>] sched_init+0x5c8/0x6c0 [ 0.000000] [<ffffffff81ae86dc>] start_kernel+0x27c/0x7a8
This bug has been reported to LLVM[2] and affects version from (at least) 18 to 21. Let's work around this by using inline assembly to assign $gp before a fix is widely available.
--- arch/mips/kernel/relocate.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/mips/kernel/relocate.c +13 -0
@@ -420,7 +420,20 @@ void *__init relocate_kernel(void) goto out;/* The current thread is now within the relocated image */ +#ifndef CONFIG_CC_IS_CLANG __current_thread_info =RELOCATED (&init_thread_union); +#else +/* +* LLVM may wrongly restore $gp ($28) in epilog even if it's +* intentionally modified. Work around this by using inline +* assembly to assign $gp. $gp couldn't be listed as output or +* clobber, or LLVM will still restore its original value. +* See also LLVM upstream issue +* https://github.com/llvm/llvm-project/issues/176546 +*/ + asmvolatile ("move $28, %0" : : +"r" (RELOCATED (&init_thread_union))); +#endif /* Return the new kernel's entry point */ kernel_entry =RELOCATED (start_kernel);
Greg Kroah-Hartman
maintainerPATCH 612/641 ext4: subdivide EXT4_EXT_DATA_VALID1
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 22784ca541c0f01c5ebad14e8228298dc0a390ed upstream.
When splitting an extent, if the EXT4_GET_BLOCKS_CONVERT flag is set and it is necessary to split the target extent in the middle, ext4_split_extent() first handles splitting the latter half of the extent and passes the EXT4_EXT_DATA_VALID1 flag. This flag implies that all blocks before the split point contain valid data; however, this assumption is incorrect.
Therefore, subdivid EXT4_EXT_DATA_VALID1 into EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_DATA_PARTIAL_VALID1, which indicate that the first half of the extent is either entirely valid or only partially valid, respectively. These two flags cannot be set simultaneously.
This patch does not use EXT4_EXT_DATA_PARTIAL_VALID1, it only replaces EXT4_EXT_DATA_VALID1 with EXT4_EXT_DATA_ENTIRE_VALID1 at the location where it is set, no logical changes.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
fs/ext4/extents.c +12 -6
@@ -43,8 +43,13 @@#define EXT4_EXT_MARK_UNWRIT1 0x2/* mark first half unwritten */ #define EXT4_EXT_MARK_UNWRIT2 0x4/* mark second half unwritten */ -#define EXT4_EXT_DATA_VALID1 0x8/* first half contains valid data */ -#define EXT4_EXT_DATA_VALID2 0x10/* second half contains valid data */ +/* first half contains valid data */ +#define EXT4_EXT_DATA_ENTIRE_VALID1 0x8/* has entirely valid data */ +#define EXT4_EXT_DATA_PARTIAL_VALID1 0x10/* has partially valid data */ +#define EXT4_EXT_DATA_VALID1 (EXT4_EXT_DATA_ENTIRE_VALID1 | \ + EXT4_EXT_DATA_PARTIAL_VALID1) + +#define EXT4_EXT_DATA_VALID2 0x20/* second half contains valid data */ static __le32 ext4_extent_block_csum (struct inode *inode,struct ext4_extent_header *eh)
@@ -3190,8 +3195,9 @@ static struct ext4_ext_path *ext4_split_unsigned int ee_len, depth;int err =0 ; -BUG_ON ((split_flag & (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )) == - (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )); +BUG_ON ((split_flag &EXT4_EXT_DATA_VALID1 ) ==EXT4_EXT_DATA_VALID1 ); +BUG_ON ((split_flag &EXT4_EXT_DATA_VALID1 ) && + (split_flag &EXT4_EXT_DATA_VALID2 ));ext_debug (inode,"logical block %llu\n" , (unsigned long long )split);
@@ -3373,7 +3379,7 @@ static struct ext4_ext_path *ext4_split_ split_flag1 |=EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) - split_flag1 |=EXT4_EXT_DATA_VALID1 ; + split_flag1 |=EXT4_EXT_DATA_ENTIRE_VALID1 ; path =ext4_split_extent_at (handle, inode, path, map->m_lblk + map->m_len, split_flag1, flags1);if (IS_ERR (path))
@@ -3732,7 +3738,7 @@ static struct ext4_ext_path *ext4_split_/* Convert to unwritten */ if (flags &EXT4_GET_BLOCKS_CONVERT_UNWRITTEN ) { - split_flag |=EXT4_EXT_DATA_VALID1 ; + split_flag |=EXT4_EXT_DATA_ENTIRE_VALID1 ;/* Convert to initialized */ }else if (flags &EXT4_GET_BLOCKS_CONVERT ) { split_flag |= ee_block + ee_len <= eof_block ?
Greg Kroah-Hartman
maintainerPATCH 613/641 ext4: dont zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 1bf6974822d1dba86cf11b5f05498581cf3488a2 upstream.
When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and converting it to initialized, there is currently a potential issue of stale data if the extent needs to be split in the middle.
0 A B N
[UUUUUUUUUUUU] U: unwritten extent
[--DDDDDDDD--] D: valid data
|<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and mark the entire extent from 0 to N as written.
0 A B N
[WWWWWWWWWWWW] W: written extent
[SSDDDDDDDDZZ] Z: zeroed, S: stale data
ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left a stale written extent from 0 to A.
0 A B N
[WW|WWWWWWWWWW]
[SS|DDDDDDDDZZ]Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at() when splitting at B, don't convert the entire extent to written and left it as unwritten after zeroing out B to N. The remaining work is just like the standard two-part split. ext4_split_extent() will pass the EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the second time, allowing it to properly handle the split. If the split is successful, it will keep extent from 0 to A as unwritten.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
fs/ext4/extents.c +12 -1
@@ -3310,6 +3310,15 @@ static struct ext4_ext_path *ext4_split_ }if (!err) { +/* +* The first half contains partially valid data, the +* splitting of this extent has not been completed, fix +* extent length and ext4_split_extent() split will the +* first half again. +*/ +if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) + goto fix_extent_len; +/* update the extent length and mark as initialized */ ex->ee_len =cpu_to_le16 (ee_len);ext4_ext_try_to_merge (handle, inode, path, ex);
@@ -3379,7 +3388,9 @@ static struct ext4_ext_path *ext4_split_ split_flag1 |=EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) - split_flag1 |=EXT4_EXT_DATA_ENTIRE_VALID1 ; + split_flag1 |= map->m_lblk > ee_block ? +EXT4_EXT_DATA_PARTIAL_VALID1 : +EXT4_EXT_DATA_ENTIRE_VALID1 ; path =ext4_split_extent_at (handle, inode, path, map->m_lblk + map->m_len, split_flag1, flags1);if (IS_ERR (path))
Greg Kroah-Hartman
maintainerPATCH 614/641 ext4: dont cache extent during splitting extent
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 8b4b19a2f96348d70bfa306ef7d4a13b0bcbea79 upstream.
Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases, the corresponding extent block entries are likely already cached before the split happens, making caching here not particularly useful.
Assume we have an unwritten extent, and then DIO writes the first half.
[UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUUUUUUUUUUU] extent status tree
|<- ->| ----> dio write this range
First, when ext4_split_extent_at() splits this extent, it truncates the existing extent and then inserts a new one. During this process, this extent status entry may be shrunk, and calls to ext4_find_extent() and ext4_cache_extents() may occur, which could potentially insert the truncated range as a hole into the extent status tree. After the split is completed, this hole is not replaced with the correct status.
[UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent [UUUUUUU|HHHHHHHH] extent status tree H: hole
Then, the outer calling functions will not correct this remaining hole extent either. Finally, if we perform a delayed buffer write on this latter part, it will re-insert the delayed extent and cause an error in space accounting.
In adition, if the unwritten extent cache is not shrunk during the splitting, ext4_cache_extents() also conflicts with existing extents when caching extents. In the future, we will add checks when caching extents, which will trigger a warning. Therefore, Do not cache extents that are being split.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/extents.c +6 -0
@@ -3199,6 +3199,9 @@ static struct ext4_ext_path *ext4_split_BUG_ON ((split_flag &EXT4_EXT_DATA_VALID1 ) && (split_flag &EXT4_EXT_DATA_VALID2 )); +/* Do not cache extents that are in the process of being modified. */ + flags |=EXT4_EX_NOCACHE ; +ext_debug (inode,"logical block %llu\n" , (unsigned long long )split);ext4_ext_show_leaf (inode, path);
@@ -3381,6 +3384,9 @@ static struct ext4_ext_path *ext4_split_ ee_len =ext4_ext_get_actual_len (ex); unwritten =ext4_ext_is_unwritten (ex); +/* Do not cache extents that are in the process of being modified. */ + flags |=EXT4_EX_NOCACHE ; +if (map->m_lblk + map->m_len < ee_block + ee_len) { split_flag1 = split_flag &EXT4_EXT_MAY_ZEROOUT ; flags1 = flags |EXT4_GET_BLOCKS_PRE_IO ;
Greg Kroah-Hartman
maintainerPATCH 615/641 ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 6d882ea3b0931b43530d44149b79fcd4ffc13030 upstream.
When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent.
Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent.
0 A B N
[UUUUUUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUUUUUUU] extent status tree
[--DDDDDDDD--] D: valid data
|<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten.
0 A B N
[UUUUUUUUUUUU] on-disk extent
[UUUUUUUUUUUU] extent status tree
[--DDDDDDDDZZ] Z: zeroed data
ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N.
0 A B N
[UUWWWWWWWWWW] on-disk extent W: written extent
[UUUUUUUUUUUU] extent status tree
[--DDDDDDDDZZ]
Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree.
0 A B N
[UUWWWWWWWWWW] on-disk extent W: written extent
[UUWWWWWWWWUU] extent status tree
[--DDDDDDDDZZ]
Fix this issue by always cached extent status entry after zeroing out the second part.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/ext4/extents.c +9 -1
@@ -3319,8 +3319,16 @@ static struct ext4_ext_path *ext4_split_* extent length and ext4_split_extent() split will the * first half again. */ -if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) +if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) { +/* +* Drop extent cache to prevent stale unwritten +* extents remaining after zeroing out. +*/ +ext4_es_remove_extent (inode, +le32_to_cpu (zero_ex.ee_block), +ext4_ext_get_actual_len (&zero_ex)); goto fix_extent_len; + }/* update the extent length and mark as initialized */ ex->ee_len =cpu_to_le16 (ee_len);
Greg Kroah-Hartman
maintainerPATCH 616/641 ext4: drop extent cache when splitting extent fails
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 79b592e8f1b435796cbc2722190368e3e8ffd7a1 upstream.
When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale extent entries remaining in the extent status tree. So drop all of the remaining potentially stale extents if the splitting fails.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ext4/extents.c +6 -2
@@ -3267,7 +3267,7 @@ static struct ext4_ext_path *ext4_split_ err =PTR_ERR (path);if (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM ) -return path; + goto out_path;/* * Get a new path to try to zeroout or fix the extent length.
@@ -3281,7 +3281,7 @@ static struct ext4_ext_path *ext4_split_if (IS_ERR (path)) {EXT4_ERROR_INODE (inode,"Failed split extent on %u, err %ld" , split,PTR_ERR (path)); -return path; + goto out_path; } depth =ext_depth (inode); ex = path[depth].p_ext;
@@ -3358,6 +3358,10 @@ out:ext4_free_ext_path (path); path =ERR_PTR (err); } +out_path: +if (IS_ERR (path)) +/* Remove all remaining potentially stale extents. */ +ext4_es_remove_extent (inode, ee_block, ee_len);ext4_ext_show_leaf (inode, path);return path; }
Greg Kroah-Hartman
maintainerPATCH 617/641 ext4: fix memory leak in ext4_ext_shift_extents()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
commit ca81109d4a8f192dc1cbad4a1ee25246363c2833 upstream.
In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the function returns immediately without releasing the path obtained via ext4_find_extent(), leading to a memory leak.
Fix this by jumping to the out label to ensure the path is properly released.
--- fs/ext4/extents.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/extents.c +2 -1
@@ -5410,7 +5410,8 @@ again:if (!extent) {EXT4_ERROR_INODE (inode,"unexpected hole at %lu" , (unsigned long ) *iterator); -return -EFSCORRUPTED ; + ret = -EFSCORRUPTED ; + goto out; }if (SHIFT ==SHIFT_LEFT && *iterator >le32_to_cpu (extent->ee_block)) {
Greg Kroah-Hartman
maintainerPATCH 618/641 ext4: fix e4b bitmap inconsistency reports
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Sun <[email protected]>
commit bdc56a9c46b2a99c12313122b9352b619a2e719e upstream.
A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bitmap check failures like:
ext4_mb_complex_scan_group:2508: group 350, 8179 free clusters as per group info. But got 8192 blocks
Analysis and experimentation confirmed that the issue is caused by a race condition between page migration and bitmap modification. Although this timing window is extremely narrow, it is still hit in practice:
folio_lock ext4_mb_load_buddy__migrate_folio
check ref count
folio_mc_copy __filemap_get_folio
folio_try_get(folio)
......
mb_mark_used
ext4_mb_unload_buddy __folio_migrate_mapping
folio_ref_freezefolio_unlock
The root cause of this issue is that the fast path of load_buddy only increments the folio's reference count, which is insufficient to prevent concurrent folio migration. We observed that the folio migration process acquires the folio lock. Therefore, we can determine whether to take the fast path in load_buddy by checking the lock status. If the folio is locked, we opt for the slow path (which acquires the lock) to close this concurrency window.
Additionally, this change addresses the following issues:
When the DOUBLE_CHECK macro is enabled to inspect bitmap-related issues, the following error may be triggered:
corruption in group 324 at byte 784(6272): f in copy != ff on disk/prealloc
Analysis reveals that this is a false positive. There is a specific race window where the bitmap and the group descriptor become momentarily inconsistent, leading to this error report:
ext4_mb_load_buddy ext4_mb_load_buddy
__filemap_get_folio(create|lock)
folio_lock
ext4_mb_init_cache
folio_mark_uptodate
__filemap_get_folio(no lock)
......
mb_mark_used
mb_mark_used_double
mb_cmp_bitmaps
mb_set_bits(e4b->bd_bitmap) folio_unlock
The original logic assumed that since mb_cmp_bitmaps is called when the bitmap is newly loaded from disk, the folio lock would be sufficient to prevent concurrent access. However, this overlooks a specific race
condition: if another process attempts to load buddy and finds the folio is already in an uptodate state, it will immediately begin using it without holding folio lock.
--- fs/ext4/mballoc.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
fs/ext4/mballoc.c +11 -10
@@ -1712,16 +1712,17 @@ ext4_mb_load_buddy_gfp(struct super_bloc/* Avoid locking the folio in the fast path ... */ folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_ACCESSED ,0 ); -if (IS_ERR (folio) || !folio_test_uptodate (folio)) { +if (IS_ERR (folio) || !folio_test_uptodate (folio) ||folio_test_locked (folio)) { +/* +* folio_test_locked is employed to detect ongoing folio +* migrations, since concurrent migrations can lead to +* bitmap inconsistency. And if we are not uptodate that +* implies somebody just created the folio but is yet to +* initialize it. We can drop the folio reference and +* try to get the folio with lock in both cases to avoid +* concurrency. +*/ if (!IS_ERR (folio)) -/* -* drop the folio reference and try -* to get the folio with lock. If we -* are not uptodate that implies -* somebody just created the folio but -* is yet to initialize it. So -* wait for it to initialize. -*/ folio_put (folio); folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_LOCK |FGP_ACCESSED |FGP_CREAT , gfp);
@@ -1763,7 +1764,7 @@ ext4_mb_load_buddy_gfp(struct super_bloc poff = block % blocks_per_page; folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_ACCESSED ,0 ); -if (IS_ERR (folio) || !folio_test_uptodate (folio)) { +if (IS_ERR (folio) || !folio_test_uptodate (folio) ||folio_test_locked (folio)) {if (!IS_ERR (folio))folio_put (folio); folio = __filemap_get_folio(inode->i_mapping, pnum,
Greg Kroah-Hartman
maintainerPATCH 619/641 ext4: fix dirtyclusters double decrement on fs shutdown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <[email protected]>
commit 94a8cea54cd935c54fa2fba70354757c0fc245e3 upstream.
fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count:
WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]
Tracing the failure shows that the warning fires due to an s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the caller ext4_mb_new_blocks().
First, note that generic/388 is a shutdown vs. fsstress test and so produces a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters counter a second time, creating the inconsistency.
To avoid this problem and simplify ownership of the cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends up consumed or returned due to failure.
--- fs/ext4/mballoc-test.c | 2 +- fs/ext4/mballoc.c | 21 +++++---------------- 2 files changed, 6 insertions(+), 17 deletions(-)
fs/ext4/mballoc-test.c +1 -1
@@ -567,7 +567,7 @@ test_mark_diskspace_used_range(struct ku bitmap =mbt_ctx_bitmap (sb,TEST_GOAL_GROUP );memset (bitmap,0 , sb->s_blocksize); - ret =ext4_mb_mark_diskspace_used (ac,NULL ,0 ); + ret =ext4_mb_mark_diskspace_used (ac,NULL );KUNIT_ASSERT_EQ (test, ret,0 ); max =EXT4_CLUSTERS_PER_GROUP (sb);
fs/ext4/mballoc.c +5 -16
@@ -4181,8 +4181,7 @@ out_err:* Returns 0 if success or error code */ static noinline_for_stack int -ext4_mb_mark_diskspace_used (struct ext4_allocation_context *ac, -handle_t *handle,unsigned int reserv_clstrs) +ext4_mb_mark_diskspace_used (struct ext4_allocation_context *ac,handle_t *handle) {struct ext4_group_desc *gdp;struct ext4_sb_info *sbi;
@@ -4237,13 +4236,6 @@ ext4_mb_mark_diskspace_used(struct ext4_BUG_ON (changed != ac->ac_b_ex.fe_len);#endif percpu_counter_sub (&sbi->s_freeclusters_counter, ac->ac_b_ex.fe_len); -/* -* Now reduce the dirty block count also. Should not go negative -*/ -if (!(ac->ac_flags &EXT4_MB_DELALLOC_RESERVED )) -/* release all the reserved blocks if non delalloc */ -percpu_counter_sub (&sbi->s_dirtyclusters_counter, - reserv_clstrs);return err; }
@@ -6328,7 +6320,7 @@ repeat:ext4_mb_pa_put_free (ac); }if (likely (ac->ac_status ==AC_STATUS_FOUND )) { - *errp =ext4_mb_mark_diskspace_used (ac, handle, reserv_clstrs); + *errp =ext4_mb_mark_diskspace_used (ac, handle);if (*errp) {ext4_discard_allocated_blocks (ac); goto errout;
@@ -6359,12 +6351,9 @@ errout: out:if (inquota && ar->len < inquota)dquot_free_block (ar->inode,EXT4_C2B (sbi, inquota - ar->len)); -if (!ar->len) { -if ((ar->flags &EXT4_MB_DELALLOC_RESERVED ) ==0 ) -/* release all the reserved blocks if non delalloc */ -percpu_counter_sub (&sbi->s_dirtyclusters_counter, - reserv_clstrs); - } +/* release any reserved blocks */ +if (reserv_clstrs) +percpu_counter_sub (&sbi->s_dirtyclusters_counter, reserv_clstrs);trace_ext4_allocate_blocks (ar, (unsigned long long )block);
Greg Kroah-Hartman
maintainerPATCH 620/641 ext4: always allocate blocks only from groups inode can use
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 4865c768b563deff1b6a6384e74a62f143427b42 upstream.
For filesystems with more than 2^32 blocks inodes using indirect block based format cannot use blocks beyond the 32-bit limit. ext4_mb_scan_groups_linear() takes care to not select these unsupported groups for such inodes however other functions selecting groups for allocation don't. So far this is harmless because the other selection functions are used only with mb_optimize_scan and this is currently disabled for inodes with indirect blocks however in the following patch we want to enable mb_optimize_scan regardless of inode format.
--- fs/ext4/mballoc.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-)
fs/ext4/mballoc.c +20 -9
@@ -892,6 +892,21 @@ mb_update_avg_fragment_size(struct super } } +static ext4_group_t ext4_get_allocation_groups_count ( +struct ext4_allocation_context *ac) +{ +ext4_group_t ngroups =ext4_get_groups_count (ac->ac_sb); + +/* non-extent files are limited to low blocks/groups */ +if (!(ext4_test_inode_flag (ac->ac_inode,EXT4_INODE_EXTENTS ))) + ngroups =EXT4_SB (ac->ac_sb)->s_blockfile_groups; + +/* Pairs with smp_wmb() in ext4_update_super() */ +smp_rmb (); + +return ngroups; +} +static int ext4_mb_scan_groups_xa_range (struct ext4_allocation_context *ac,struct xarray *xa,ext4_group_t start,ext4_group_t end)
@@ -899,7 +914,7 @@ static int ext4_mb_scan_groups_xa_range(struct super_block *sb = ac->ac_sb;struct ext4_sb_info *sbi =EXT4_SB (sb);enum criteria cr = ac->ac_criteria; -ext4_group_t ngroups =ext4_get_groups_count (sb); +ext4_group_t ngroups =ext4_get_allocation_groups_count (ac);unsigned long group = start;struct ext4_group_info *grp;
@@ -951,7 +966,7 @@ static int ext4_mb_scan_groups_p2_aligneext4_group_t start, end; start = group; - end =ext4_get_groups_count (ac->ac_sb); + end =ext4_get_allocation_groups_count (ac); wrap_around:for (i = ac->ac_2order; i <MB_NUM_ORDERS (ac->ac_sb); i++) { ret = ext4_mb_scan_groups_largest_free_order_range(ac, i,
@@ -1001,7 +1016,7 @@ static int ext4_mb_scan_groups_goal_fastext4_group_t start, end; start = group; - end =ext4_get_groups_count (ac->ac_sb); + end =ext4_get_allocation_groups_count (ac); wrap_around: i =mb_avg_fragment_size_order (ac->ac_sb, ac->ac_g_ex.fe_len);for (; i <MB_NUM_ORDERS (ac->ac_sb); i++) {
@@ -1083,7 +1098,7 @@ static int ext4_mb_scan_groups_best_avai min_order =fls (ac->ac_o_ex.fe_len); start = group; - end =ext4_get_groups_count (ac->ac_sb); + end =ext4_get_allocation_groups_count (ac); wrap_around:for (i = order; i >= min_order; i--) {int frag_order;
@@ -1182,11 +1197,7 @@ static int ext4_mb_scan_groups(struct exint ret =0 ;ext4_group_t start;struct ext4_sb_info *sbi =EXT4_SB (ac->ac_sb); -ext4_group_t ngroups =ext4_get_groups_count (ac->ac_sb); - -/* non-extent files are limited to low blocks/groups */ -if (!(ext4_test_inode_flag (ac->ac_inode,EXT4_INODE_EXTENTS ))) - ngroups = sbi->s_blockfile_groups; +ext4_group_t ngroups =ext4_get_allocation_groups_count (ac);/* searching for the right group start from the goal value specified */ start = ac->ac_g_ex.fe_group;
Greg Kroah-Hartman
maintainerPATCH 621/641 ext4: use optimized mballoc scanning regardless of inode format
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 3574c322b1d0eb32dbd76b469cb08f9a67641599 upstream.
Currently we don't used mballoc optimized scanning (using max free extent order and avg free extent order group lists) for inodes with indirect block based format. This is confusing for users and I don't see a good reason for that. Even with indirect block based inode format we can spend big amount of time searching for free blocks for large filesystems with fragmented free space. To add to the confusion before commit 077d0c2c78df ("ext4: make mb_optimize_scan performance mount option work with extents") optimized scanning was applied *only* to indirect block based inodes so that commit appears as a performance regression to some users. Just use optimized scanning whenever it is enabled by mount options.
--- fs/ext4/mballoc.c | 2 -- 1 file changed, 2 deletions(-)
fs/ext4/mballoc.c +0 -2
@@ -1148,8 +1148,6 @@ static inline int should_optimize_scan(sreturn 0 ;if (ac->ac_criteria >=CR_GOAL_LEN_SLOW )return 0 ; -if (!ext4_test_inode_flag (ac->ac_inode,EXT4_INODE_EXTENTS )) -return 0 ;return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 622/641 ata: pata_ftide010: Fix some DMA timings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit ff4a46c278ac6a4b3f39be1492a4568b6dcc6105 upstream.
The FTIDE010 has been missing some timing settings since its inception, since the upstream OpenWrt patch was missing these.
The community has since come up with the appropriate timings.
--- drivers/ata/pata_ftide010.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/ata/pata_ftide010.c +3 -3
@@ -122,10 +122,10 @@ static const u8 mwdma_50_active_time[3]static const u8 mwdma_50_recovery_time[3 ] = {6 ,2 ,1 };static const u8 mwdma_66_active_time[3 ] = {8 ,3 ,3 };static const u8 mwdma_66_recovery_time[3 ] = {8 ,2 ,1 }; -static const u8 udma_50_setup_time[6 ] = {3 ,3 ,2 ,2 ,1 ,1 }; +static const u8 udma_50_setup_time[6 ] = {3 ,3 ,2 ,2 ,1 ,9 };static const u8 udma_50_hold_time[6 ] = {3 ,1 ,1 ,1 ,1 ,1 }; -static const u8 udma_66_setup_time[7 ] = {4 ,4 ,3 ,2 , }; -static const u8 udma_66_hold_time[7 ] = {}; +static const u8 udma_66_setup_time[7 ] = {4 ,4 ,3 ,2 ,1 ,9 ,9 }; +static const u8 udma_66_hold_time[7 ] = {4 ,2 ,1 ,1 ,1 ,1 ,1 };/* * We set 66 MHz for all MWDMA modes
Greg Kroah-Hartman
maintainerPATCH 623/641 ata: libata-scsi: refactor ata_scsi_translate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit bb3a8154b1a1dc2c86d037482c0a2cf9186829ed upstream.
Factor out of ata_scsi_translate() the code handling queued command deferral using the port qc_defer callback and issuing the queued command with ata_qc_issue() into the new function ata_scsi_qc_issue(), and simplify the goto used in ata_scsi_translate().
While at it, also add a lockdep annotation to check that the port lock is held when ata_scsi_translate() is called.
No functional changes.
--- drivers/ata/libata-scsi.c | 81 ++++++++++++++++++++++++++++------------------ 1 file changed, 50 insertions(+), 31 deletions(-)
drivers/ata/libata-scsi.c +50 -31
@@ -1690,6 +1690,42 @@ static void ata_scsi_qc_complete(structata_qc_done (qc); } +static int ata_scsi_qc_issue (struct ata_port *ap,struct ata_queued_cmd *qc) +{ +int ret; + +if (!ap->ops->qc_defer) + goto issue; + +/* Check if the command needs to be deferred. */ + ret = ap->ops->qc_defer (qc); +switch (ret) { +case 0 : +break ; +case ATA_DEFER_LINK : + ret =SCSI_MLQUEUE_DEVICE_BUSY ; +break ; +case ATA_DEFER_PORT : + ret =SCSI_MLQUEUE_HOST_BUSY ; +break ; +default : +WARN_ON_ONCE (1 ); + ret =SCSI_MLQUEUE_HOST_BUSY ; +break ; + } + +if (ret) { +/* Force a requeue of the command to defer its execution. */ +ata_qc_free (qc); +return ret; + } + +issue: +ata_qc_issue (qc); + +return 0 ; +} +/** * ata_scsi_translate - Translate then issue SCSI command to ATA device * @dev: ATA device to which the command is addressed
@@ -1713,66 +1749,49 @@ static void ata_scsi_qc_complete(struct* spin_lock_irqsave(host lock) * * RETURNS: -* 0 on success, SCSI_ML_QUEUE_DEVICE_BUSY if the command -* needs to be deferred. +* 0 on success, SCSI_ML_QUEUE_DEVICE_BUSY or SCSI_MLQUEUE_HOST_BUSY if the +* command needs to be deferred. */ static int ata_scsi_translate (struct ata_device *dev,struct scsi_cmnd *cmd,ata_xlat_func_t xlat_func) {struct ata_port *ap = dev->link->ap;struct ata_queued_cmd *qc; -int rc; +lockdep_assert_held (ap->lock); + +/* +* ata_scsi_qc_new() calls scsi_done(cmd) in case of failure. So we +* have nothing further to do when allocating a qc fails. +*/ qc =ata_scsi_qc_new (dev, cmd);if (!qc) - goto err_mem; +return 0 ;/* data is present; dma-map it */ if (cmd->sc_data_direction ==DMA_FROM_DEVICE || cmd->sc_data_direction ==DMA_TO_DEVICE ) {if (unlikely (scsi_bufflen (cmd) <1 )) {ata_dev_warn (dev,"WARNING: zero len r/w req\n" ); - goto err_did; + cmd->result = (DID_ERROR <<16 ); + goto done; }ata_sg_init (qc,scsi_sglist (cmd),scsi_sg_count (cmd)); - qc->dma_dir = cmd->sc_data_direction; } qc->complete_fn = ata_scsi_qc_complete;if (xlat_func (qc)) - goto early_finish; - -if (ap->ops->qc_defer) { -if ((rc = ap->ops->qc_defer (qc))) - goto defer; - } - -/* select device, send command to hardware */ -ata_qc_issue (qc); - -return 0 ; + goto done; -early_finish: -ata_qc_free (qc); -scsi_done (cmd); -return 0 ; +return ata_scsi_qc_issue (ap, qc); -err_did: +done:ata_qc_free (qc); - cmd->result = (DID_ERROR <<16 );scsi_done (cmd); -err_mem:return 0 ; - -defer: -ata_qc_free (qc); -if (rc ==ATA_DEFER_LINK ) -return SCSI_MLQUEUE_DEVICE_BUSY ; -else -return SCSI_MLQUEUE_HOST_BUSY ; }/**
Greg Kroah-Hartman
maintainerPATCH 624/641 ata: libata-scsi: avoid Non-NCQ command starvation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 0ea84089dbf62a92dc7889c79e6b18fc89260808 upstream.
When a non-NCQ command is issued while NCQ commands are being executed, ata_scsi_qc_issue() indicates to the SCSI layer that the command issuing should be deferred by returning SCSI_MLQUEUE_XXX_BUSY. This command deferring is correct and as mandated by the ACS specifications since NCQ and non-NCQ commands cannot be mixed.
However, in the case of a host adapter using multiple submission queues, when the target device is under a constant load of NCQ commands, there are no guarantees that requeueing the non-NCQ command will be executed later and it may be deferred again repeatedly as other submission queues can constantly issue NCQ commands from different CPUs ahead of the non-NCQ command. This can lead to very long delays for the execution of non-NCQ commands, and even complete starvation for these commands in the worst case scenario.
Since the block layer and the SCSI layer do not distinguish between queueable (NCQ) and non queueable (non-NCQ) commands, libata-scsi SAT implementation must ensure forward progress for non-NCQ commands in the presence of NCQ command traffic. This is similar to what SAS HBAs with a hardware/firmware based SAT implementation do.
Implement such forward progress guarantee by limiting requeueing of non-NCQ commands from ata_scsi_qc_issue(): when a non-NCQ command is received and NCQ commands are in-flight, do not force a requeue of the non-NCQ command by returning SCSI_MLQUEUE_XXX_BUSY and instead return 0 to indicate that the command was accepted but hold on to the qc using the new deferred_qc field of struct ata_port.
This deferred qc will be issued using the work item deferred_qc_work running the function ata_scsi_deferred_qc_work() once all in-flight commands complete, which is checked with the port qc_defer() callback return value indicating that no further delay is necessary. This check is done using the helper function ata_scsi_schedule_deferred_qc() which is called from ata_scsi_qc_complete(). This thus excludes this mechanism from all internal non-NCQ commands issued by ATA EH.
When a port deferred_qc is non NULL, that is, the port has a command waiting for the device queue to drain, the issuing of all incoming commands (both NCQ and non-NCQ) is deferred using the regular busy mechanism. This simplifies the code and also avoids potential denial of service problems if a user issues too many non-NCQ commands.
Finally, whenever ata EH is scheduled, regardless of the reason, a deferred qc is always requeued so that it can be retried once EH completes. This is done by calling the function ata_scsi_requeue_deferred_qc() from ata_eh_set_pending(). This avoids the need for any special processing for the deferred qc in case of NCQ error, link or device reset, or device timeout.
--- drivers/ata/libata-core.c | 5 ++ drivers/ata/libata-eh.c | 6 ++ drivers/ata/libata-scsi.c | 93 ++++++++++++++++++++++++++++++++++++++++++++++ drivers/ata/libata.h | 2 include/linux/libata.h | 3 + 5 files changed, 109 insertions(+)
drivers/ata/libata-core.c +5 -0
@@ -5552,6 +5552,7 @@ struct ata_port *ata_port_alloc(struct amutex_init (&ap->scsi_scan_mutex);INIT_DELAYED_WORK (&ap->hotplug_task, ata_scsi_hotplug);INIT_DELAYED_WORK (&ap->scsi_rescan_task, ata_scsi_dev_rescan); +INIT_WORK (&ap->deferred_qc_work, ata_scsi_deferred_qc_work);INIT_LIST_HEAD (&ap->eh_done_q);init_waitqueue_head (&ap->eh_wait_q);init_completion (&ap->park_req_pending);
@@ -6162,6 +6163,10 @@ static void ata_port_detach(struct ata_p } } +/* Make sure the deferred qc work finished. */ +cancel_work_sync (&ap->deferred_qc_work); +WARN_ON (ap->deferred_qc); +/* Tell EH to disable all devices */ ap->pflags |=ATA_PFLAG_UNLOADING ;ata_port_schedule_eh (ap);
drivers/ata/libata-eh.c +6 -0
@@ -917,6 +917,12 @@ static void ata_eh_set_pending(struct at ap->pflags |=ATA_PFLAG_EH_PENDING ; +/* +* If we have a deferred qc, requeue it so that it is retried once EH +* completes. +*/ +ata_scsi_requeue_deferred_qc (ap); +if (!fastdrain)return ;
drivers/ata/libata-scsi.c +93 -0
119 lines not on this page · raw message
drivers/ata/libata.h +2 -0
@@ -161,6 +161,8 @@ void ata_scsi_sdev_config(struct scsi_deint ata_scsi_dev_config (struct scsi_device *sdev,struct queue_limits *lim,struct ata_device *dev);int __ata_scsi_queuecmd (struct scsi_cmnd *scmd,struct ata_device *dev); +void ata_scsi_deferred_qc_work (struct work_struct *work); +void ata_scsi_requeue_deferred_qc (struct ata_port *ap);/* libata-eh.c */ extern unsigned int ata_internal_cmd_timeout (struct ata_device *dev,u8 cmd);
include/linux/libata.h +3 -0
@@ -899,6 +899,9 @@ struct ata_port {u64 qc_active;int nr_active_links;/* #links with active qcs */ +struct work_struct deferred_qc_work; +struct ata_queued_cmd *deferred_qc; +struct ata_link link;/* host default link */ struct ata_link *slave_link;/* see ata_slave_link_init() */
Greg Kroah-Hartman
maintainerPATCH 625/641 SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit 3e6397b056335cc56ef0e9da36c95946a19f5118 upstream.
The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer(), which calls kmemdup(). When a subsequent decode operation fails, these functions return immediately without freeing previously allocated buffers, causing memory leaks.
The leak in gssx_dec_ctx() is particularly relevant because the caller (gssp_accept_sec_context_upcall) initializes several buffer length fields to non-zero values, resulting in memory allocation:
struct gssx_ctx rctxh = {
.exported_context_token.len = GSSX_max_output_handle_sz, .mech.len = GSS_OID_MAX_LEN, .src_name.display_name.len = GSSX_max_princ_sz, .targ_name.display_name.len = GSSX_max_princ_sz
};
If, for example, gssx_dec_name() succeeds for src_name but fails for targ_name, the memory allocated for exported_context_token, mech, and src_name.display_name remains unreferenced and cannot be reclaimed.
Add error handling with goto-based cleanup to free any previously allocated buffers before returning an error.
--- net/sunrpc/auth_gss/gss_rpc_xdr.c | 82 +++++++++++++++++++++++++++++--------- 1 file changed, 64 insertions(+), 18 deletions(-)
net/sunrpc/auth_gss/gss_rpc_xdr.c +64 -18
@@ -320,29 +320,47 @@ static int gssx_dec_status(struct xdr_st/* status->minor_status */ p =xdr_inline_decode (xdr,8 ); -if (unlikely (p ==NULL )) -return -ENOSPC ; +if (unlikely (p ==NULL )) { + err = -ENOSPC ; + goto out_free_mech; + } p =xdr_decode_hyper (p, &status->minor_status);/* status->major_status_string */ err =gssx_dec_buffer (xdr, &status->major_status_string);if (err) -return err; + goto out_free_mech;/* status->minor_status_string */ err =gssx_dec_buffer (xdr, &status->minor_status_string);if (err) -return err; + goto out_free_major_status_string;/* status->server_ctx */ err =gssx_dec_buffer (xdr, &status->server_ctx);if (err) -return err; + goto out_free_minor_status_string;/* we assume we have no options for now, so simply consume them */ /* status->options */ err =dummy_dec_opt_array (xdr, &status->options); +if (err) + goto out_free_server_ctx; +return 0 ; + +out_free_server_ctx: +kfree (status->server_ctx.data); + status->server_ctx.data =NULL ; +out_free_minor_status_string: +kfree (status->minor_status_string.data); + status->minor_status_string.data =NULL ; +out_free_major_status_string: +kfree (status->major_status_string.data); + status->major_status_string.data =NULL ; +out_free_mech: +kfree (status->mech.data); + status->mech.data =NULL ;return err; }
@@ -505,28 +523,35 @@ static int gssx_dec_name(struct xdr_stre/* name->name_type */ err =gssx_dec_buffer (xdr, &dummy_netobj);if (err) -return err; + goto out_free_display_name;/* name->exported_name */ err =gssx_dec_buffer (xdr, &dummy_netobj);if (err) -return err; + goto out_free_display_name;/* name->exported_composite_name */ err =gssx_dec_buffer (xdr, &dummy_netobj);if (err) -return err; + goto out_free_display_name;/* we assume we have no attributes for now, so simply consume them */ /* name->name_attributes */ err =dummy_dec_nameattr_array (xdr, &dummy_name_attr_array);if (err) -return err; + goto out_free_display_name;/* we assume we have no options for now, so simply consume them */ /* name->extensions */ err =dummy_dec_opt_array (xdr, &dummy_option_array); +if (err) + goto out_free_display_name; +return 0 ; + +out_free_display_name: +kfree (name->display_name.data); + name->display_name.data =NULL ;return err; }
@@ -649,32 +674,34 @@ static int gssx_dec_ctx(struct xdr_strea/* ctx->state */ err =gssx_dec_buffer (xdr, &ctx->state);if (err) -return err; + goto out_free_exported_context_token;/* ctx->need_release */ err =gssx_dec_bool (xdr, &ctx->need_release);if (err) -return err; + goto out_free_state;/* ctx->mech */ err =gssx_dec_buffer (xdr, &ctx->mech);if (err) -return err; + goto out_free_state;/* ctx->src_name */ err =gssx_dec_name (xdr, &ctx->src_name);if (err) -return err; + goto out_free_mech;/* ctx->targ_name */ err =gssx_dec_name (xdr, &ctx->targ_name);if (err) -return err; + goto out_free_src_name;/* ctx->lifetime */ p =xdr_inline_decode (xdr,8 +8 ); -if (unlikely (p ==NULL )) -return -ENOSPC ; +if (unlikely (p ==NULL )) { + err = -ENOSPC ; + goto out_free_targ_name; + } p =xdr_decode_hyper (p, &ctx->lifetime);/* ctx->ctx_flags */
@@ -683,17 +710,36 @@ static int gssx_dec_ctx(struct xdr_strea/* ctx->locally_initiated */ err =gssx_dec_bool (xdr, &ctx->locally_initiated);if (err) -return err; + goto out_free_targ_name;/* ctx->open */ err =gssx_dec_bool (xdr, &ctx->open);if (err) -return err; + goto out_free_targ_name;/* we assume we have no options for now, so simply consume them */ /* ctx->options */ err =dummy_dec_opt_array (xdr, &ctx->options); +if (err) + goto out_free_targ_name; + +return 0 ; +out_free_targ_name: +kfree (ctx->targ_name.display_name.data); + ctx->targ_name.display_name.data =NULL ; +out_free_src_name: +kfree (ctx->src_name.display_name.data); + ctx->src_name.display_name.data =NULL ; +out_free_mech: +kfree (ctx->mech.data); + ctx->mech.data =NULL ; +out_free_state: +kfree (ctx->state.data); + ctx->state.data =NULL ; +out_free_exported_context_token: +kfree (ctx->exported_context_token.data); + ctx->exported_context_token.data =NULL ;return err; }
Greg Kroah-Hartman
maintainerPATCH 626/641 SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Hodges <[email protected]>
commit dd2fdc3504592d85e549c523b054898a036a6afe upstream.
Commit 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c") added a kref_get(&gss_auth->kref) call to balance the gss_put_auth() done in gss_release_msg(), but forgot to add a corresponding kref_put() on the error path when kstrdup_const() fails.
If service_name is non-NULL and kstrdup_const() fails, the function jumps to err_put_pipe_version which calls put_pipe_version() and kfree(gss_msg), but never releases the gss_auth reference. This leads to a kref leak where the gss_auth structure is never freed.
Add a forward declaration for gss_free_callback() and call kref_put() in the err_put_pipe_version error path to properly release the reference taken earlier.
--- net/sunrpc/auth_gss/auth_gss.c | 3 +++ 1 file changed, 3 insertions(+)
net/sunrpc/auth_gss/auth_gss.c +3 -0
@@ -39,6 +39,8 @@ static const struct rpc_authops authgss_static const struct rpc_credops gss_credops;static const struct rpc_credops gss_nullops; +static void gss_free_callback (struct kref *kref); +#define GSS_RETRY_EXPIRED 5static unsigned int gss_expired_cred_retry_delay =GSS_RETRY_EXPIRED ;
@@ -551,6 +553,7 @@ gss_alloc_msg(struct gss_auth *gss_auth, }return gss_msg; err_put_pipe_version: +kref_put (&gss_auth->kref, gss_free_callback);put_pipe_version (gss_auth->net); err_free_msg:kfree (gss_msg);
Greg Kroah-Hartman
maintainerPATCH 627/641 dt-bindings: phy: qcom-edp: Add missing clock for X Elite
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
commit 6b99eeacf6abb1ff2d6463c84e490343f39cf11a upstream.
On X Elite platform, the eDP PHY uses one more clock called ref.
The current X Elite devices supported upstream work fine without this clock, because the boot firmware leaves this clock enabled. But we should not rely on that. Also, even though this change breaks the ABI, it is needed in order to make the driver disables this clock along with the other ones, for a proper bring-down of the entire PHY.
So attach the this ref clock to the PHY.
--- Documentation/devicetree/bindings/phy/qcom,edp-phy.yaml | 28 +++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/phy/qcom,edp-phy.yaml +27 -1
@@ -37,12 +37,15 @@ properties: - description: PLL register block clocks: - maxItems: 2 + minItems: 2 + maxItems: 3 clock-names: + minItems: 2 items: - const: aux - const: cfg_ahb + - const: ref "#clock-cells": const: 1
@@ -64,6 +67,29 @@ required: - "#clock-cells" - "#phy-cells" +allOf: + - if: + properties: + compatible: + enum: + - qcom,x1e80100-dp-phy + then: + properties: + clocks: + minItems: 3 + maxItems: 3 + clock-names: + minItems: 3 + maxItems: 3 + else: + properties: + clocks: + minItems: 2 + maxItems: 2 + clock-names: + minItems: 2 + maxItems: 2 + additionalProperties: false examples:
Greg Kroah-Hartman
maintainerPATCH 628/641 dt-bindings: media: qcom,qcs8300-camss: Add missing power supplies
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vikram Sharma <[email protected]>
commit 555e882051a3a7ecc2bcee2b2047822249dcd074 upstream.
Add missing vdda-phy-supply and vdda-pll-supply in the (monaco)qcs8300 camss binding. While enabling imx412 sensor for qcs8300 we see a need to add these supplies which were missing in initial submission.
--- Documentation/devicetree/bindings/media/qcom,qcs8300-camss.yaml | 13 ++++++++++ 1 file changed, 13 insertions(+)
Documentation/devicetree/bindings/media/qcom,qcs8300-camss.yaml +13 -0
@@ -120,6 +120,14 @@ properties: items: - const: top + vdda-phy-supply: + description: + Phandle to a 0.88V regulator supply to CSI PHYs. + + vdda-pll-supply: + description: + Phandle to 1.2V regulator supply to CSI PHYs pll block. + ports: $ref: /schemas/graph.yaml#/properties/ports
@@ -160,6 +168,8 @@ required: - power-domains - power-domain-names - ports + - vdda-phy-supply + - vdda-pll-supply additionalProperties: false
@@ -328,6 +338,9 @@ examples: power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>; power-domain-names = "top"; + vdda-phy-supply = <&vreg_l4a_0p88>; + vdda-pll-supply = <&vreg_l1c_1p2>; + ports { #address-cells = <1>; #size-cells = <0>;
Greg Kroah-Hartman
maintainerPATCH 629/641 ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
commit 50a634f1d795721ce68583c78ba493f1d7aa8bc2 upstream.
When including the dai-common.yaml, and allow '#sound-dai-cells' and "sound-name-prefix' to be used, should use unevaluatedProperties:false according to writing-bindings.rst.
--- Documentation/devicetree/bindings/sound/asahi-kasei,ak4458.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/sound/asahi-kasei,ak4458.yaml +1 -1
@@ -60,7 +60,7 @@ allOf: properties: dsd-path: false -additionalProperties: false +unevaluatedProperties: false examples: - |
Greg Kroah-Hartman
maintainerPATCH 630/641 ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
commit e570a5ca307f6d7a6acd080fc219db2ce3c0737b upstream.
In the original txt format binding document ak4458.txt, the supply names are 'AVDD-supply', 'DVDD-supply', and they are also used in driver. But in the commit converting to yaml format, they are changed to 'avdd-supply', 'dvdd-supply'. After search all the dts file, these names 'AVDD-supply', 'DVDD-supply', 'avdd-supply', 'dvdd-supply' are not used in any dts file. So it is safe to fix this yaml binding document.
--- Documentation/devicetree/bindings/sound/asahi-kasei,ak4458.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/sound/asahi-kasei,ak4458.yaml +2 -2
@@ -21,10 +21,10 @@ properties: reg: maxItems: 1 - avdd-supply: + AVDD-supply: description: Analog power supply - dvdd-supply: + DVDD-supply: description: Digital power supply reset-gpios:
Greg Kroah-Hartman
maintainerPATCH 631/641 ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
commit 80ca113671a005430207d351cb403c1637106212 upstream.
In the original txt format binding document ak4458.txt, the supply names are 'AVDD-supply', 'DVDD-supply', and they are also used in driver. But in the commit converting to yaml format, they are changed to 'avdd-supply', 'dvdd-supply'. After search all the dts file, these names 'AVDD-supply', 'DVDD-supply', 'avdd-supply', 'dvdd-supply' are not used in any dts file. So it is safe to fix the yaml binding document.
--- Documentation/devicetree/bindings/sound/asahi-kasei,ak5558.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/sound/asahi-kasei,ak5558.yaml +2 -2
@@ -19,10 +19,10 @@ properties: reg: maxItems: 1 - avdd-supply: + AVDD-supply: description: A 1.8V supply that powers up the AVDD pin. - dvdd-supply: + DVDD-supply: description: A 1.2V supply that powers up the DVDD pin. reset-gpios:
Greg Kroah-Hartman
maintainerPATCH 632/641 ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Naim <[email protected]>
commit 405d59fdd2038a65790eaad8c1013d37a2af6561 upstream.
Fixes microphone detection when a headset is connected to the audio jack using the ALC256.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6952,6 +6952,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x144d ,0xc886 ,"Samsung Galaxy Book3 Pro (NP964XFG)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS ),SND_PCI_QUIRK (0x144d ,0xc1ca ,"Samsung Galaxy Book3 Pro 360 (NP960QFG)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS ),SND_PCI_QUIRK (0x144d ,0xc1cc ,"Samsung Galaxy Book3 Ultra (NT960XFH)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS ), +SND_PCI_QUIRK (0x1458 ,0x900e ,"Gigabyte G5 KF5 (2023)" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1458 ,0xfa53 ,"Gigabyte BXBT-2807" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1462 ,0xb120 ,"MSI Cubi MS-B120" ,ALC283_FIXUP_HEADSET_MIC ), SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 633/641 ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7bc0df86c2384bc1e2012a2c946f82305054da64 upstream.
Acer Swift SF314 (SSID 1025:136d) needs a bit of tweaks of the pin configurations for NID 0x16 and 0x19 to make the headphone / headset jack working. NID 0x17 can remain as is for the working speaker, and the built-in mic is supported via SOF.
--- sound/hda/codecs/conexant.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/hda/codecs/conexant.c +10 -0
@@ -299,6 +299,7 @@ enum {CXT_PINCFG_SWS_JS201D ,CXT_PINCFG_TOP_SPEAKER ,CXT_FIXUP_HP_A_U , + CXT_FIXUP_ACER_SWIFT_HP, };/* for hda_fixup_thinkpad_acpi() */
@@ -1024,6 +1025,14 @@ static const struct hda_fixup cxt_fixups .type = HDA_FIXUP_FUNC, .v.func = cxt_fixup_hp_a_u, }, + [CXT_FIXUP_ACER_SWIFT_HP] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x16 ,0x0321403f },/* Headphone */ + {0x19 ,0x40f001f0 },/* Mic */ + { } + }, + }, };static const struct hda_quirk cxt5045_fixups[] = {
@@ -1073,6 +1082,7 @@ static const struct hda_quirk cxt5066_fiSND_PCI_QUIRK (0x1025 ,0x0543 ,"Acer Aspire One 522" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054f ,"Acer Aspire 4830T" ,CXT_FIXUP_ASPIRE_DMIC ), +SND_PCI_QUIRK (0x1025 ,0x136d ,"Acer Swift SF314" ,CXT_FIXUP_ACER_SWIFT_HP ),SND_PCI_QUIRK (0x103c ,0x8079 ,"HP EliteBook 840 G3" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x807C ,"HP EliteBook 820 G3" ,CXT_FIXUP_HP_DOCK ), SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
Greg Kroah-Hartman
maintainerPATCH 634/641 ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lewis Mason <[email protected]>
commit 3a6b7dc431aab90744e973254604855e654294ae upstream.
The Samsung Galaxy Book3 Pro 360 NP965QFG (subsystem ID 0x144d:0xc1cb) uses the same Realtek ALC298 codec and amplifier configuration as the NP960QFG (0x144d:0xc1ca). Apply the same ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS fixup to enable the internal speakers.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6951,6 +6951,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x144d ,0xc872 ,"Samsung Galaxy Book2 Pro (NP950XEE)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS ),SND_PCI_QUIRK (0x144d ,0xc886 ,"Samsung Galaxy Book3 Pro (NP964XFG)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS ),SND_PCI_QUIRK (0x144d ,0xc1ca ,"Samsung Galaxy Book3 Pro 360 (NP960QFG)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS ), +SND_PCI_QUIRK (0x144d ,0xc1cb ,"Samsung Galaxy Book3 Pro 360 (NP965QFG)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS ),SND_PCI_QUIRK (0x144d ,0xc1cc ,"Samsung Galaxy Book3 Ultra (NT960XFH)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS ),SND_PCI_QUIRK (0x1458 ,0x900e ,"Gigabyte G5 KF5 (2023)" ,ALC2XX_FIXUP_HEADSET_MIC ), SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 635/641 drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit d3968a0d85b211e197f2f4f06268a7031079e0d0 upstream.
vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct vidi_context pointer. However, drm_dev->dev is the exynos-drm master device, and the driver_data contained therein is not the vidi component device, but a completely different device.
This can lead to various bugs, ranging from null pointer dereferences and garbage value accesses to, in unlucky cases, out-of-bounds errors, use-after-free errors, and more.
To resolve this issue, we need to store/delete the vidi device pointer in exynos_drm_private->vidi_dev during bind/unbind, and then read this exynos_drm_private->vidi_dev within ioctl() to obtain the correct struct vidi_context pointer.
--- drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 14 +++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-)
drivers/gpu/drm/exynos/exynos_drm_drv.h +1 -0
@@ -199,6 +199,7 @@ struct drm_exynos_file_private {struct exynos_drm_private {struct device *g2d_dev;struct device *dma_dev; +struct device *vidi_dev;void *mapping;/* for atomic commit */
drivers/gpu/drm/exynos/exynos_drm_vidi.c +13 -1
@@ -231,9 +231,14 @@ ATTRIBUTE_GROUPS(vidi);int vidi_connection_ioctl (struct drm_device *drm_dev,void *data,struct drm_file *file_priv) { -struct vidi_context *ctx =dev_get_drvdata (drm_dev->dev); +struct exynos_drm_private *priv = drm_dev->dev_private; +struct device *dev = priv ? priv->vidi_dev :NULL ; +struct vidi_context *ctx = dev ?dev_get_drvdata (dev) :NULL ;struct drm_exynos_vidi_connection *vidi = data; +if (!ctx) +return -ENODEV ; +if (!vidi) {DRM_DEV_DEBUG_KMS (ctx->dev,"user data for vidi is null.\n" );
@@ -393,6 +398,7 @@ static int vidi_bind(struct device *dev, {struct vidi_context *ctx =dev_get_drvdata (dev);struct drm_device *drm_dev = data; +struct exynos_drm_private *priv = drm_dev->dev_private;struct drm_encoder *encoder = &ctx->encoder;struct exynos_drm_plane *exynos_plane;struct exynos_drm_plane_config plane_config = {0 };
@@ -400,6 +406,8 @@ static int vidi_bind(struct device *dev,int ret; ctx->drm_dev = drm_dev; +if (priv) + priv->vidi_dev = dev; plane_config.pixel_formats = formats; plane_config.num_pixel_formats =ARRAY_SIZE (formats);
@@ -445,8 +453,12 @@ static int vidi_bind(struct device *dev,static void vidi_unbind (struct device *dev,struct device *master,void *data) {struct vidi_context *ctx =dev_get_drvdata (dev); +struct drm_device *drm_dev = data; +struct exynos_drm_private *priv = drm_dev->dev_private;timer_delete_sync (&ctx->timer); +if (priv) + priv->vidi_dev =NULL ; }static const struct component_ops vidi_component_ops = {
Greg Kroah-Hartman
maintainerPATCH 636/641 drm/exynos: vidi: fix to avoid directly dereferencing user pointer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit d4c98c077c7fb2dfdece7d605e694b5ea2665085 upstream.
In vidi_connection_ioctl(), vidi->edid(user pointer) is directly dereferenced in the kernel.
This allows arbitrary kernel memory access from the user space, so instead of directly accessing the user pointer in the kernel, we should modify it to copy edid to kernel memory using copy_from_user() and use it.
--- drivers/gpu/drm/exynos/exynos_drm_vidi.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/gpu/drm/exynos/exynos_drm_vidi.c +18 -4
@@ -262,13 +262,27 @@ int vidi_connection_ioctl(struct drm_devif (vidi->connection) {const struct drm_edid *drm_edid; -const struct edid *raw_edid; +const void __user *edid_userptr =u64_to_user_ptr (vidi->edid); +void *edid_buf; +struct edid hdr;size_t size; - raw_edid = (const struct edid *)(unsigned long )vidi->edid; - size = (raw_edid->extensions +1 ) *EDID_LENGTH ; +if (copy_from_user (&hdr, edid_userptr,sizeof (hdr))) +return -EFAULT ; - drm_edid =drm_edid_alloc (raw_edid, size); + size = (hdr.extensions +1 ) *EDID_LENGTH ; + + edid_buf =kmalloc (size,GFP_KERNEL ); +if (!edid_buf) +return -ENOMEM ; + +if (copy_from_user (edid_buf, edid_userptr, size)) { +kfree (edid_buf); +return -EFAULT ; + } + + drm_edid =drm_edid_alloc (edid_buf, size); +kfree (edid_buf);if (!drm_edid)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 637/641 Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit f8e6343b7a89c7c649db5a9e309ba7aa20401813 upstream.
Resolves the following lockdep report when booting PREEMPT_RT on Hyper-V with related guest support enabled:
[ 1.127941] hv_vmbus: registering driver hyperv_drm
[ 1.132518] =============================
[ 1.132519] [ BUG: Invalid wait context ]
[ 1.132521] 6.19.0-rc8+ #9 Not tainted
[ 1.132524] -----------------------------
[ 1.132525] swapper/0/0 is trying to lock:
[ 1.132526] ffff8b9381bb3c90 (&channel->sched_lock){....}-{3:3}, at: vmbus_chan_sched+0xc4/0x2b0
[ 1.132543] other info that might help us debug this:
[ 1.132544] context-{2:2}
[ 1.132545] 1 lock held by swapper/0/0:
[ 1.132547] #0: ffffffffa010c4c0 (rcu_read_lock){....}-{1:3}, at: vmbus_chan_sched+0x31/0x2b0
[ 1.132557] stack backtrace:
[ 1.132560] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-rc8+ #9 PREEMPT_{RT,(lazy)}
[ 1.132565] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/25/2025
[ 1.132567] Call Trace:
[ 1.132570] <IRQ>
[ 1.132573] dump_stack_lvl+0x6e/0xa0
[ 1.132581] __lock_acquire+0xee0/0x21b0
[ 1.132592] lock_acquire+0xd5/0x2d0
[ 1.132598] ? vmbus_chan_sched+0xc4/0x2b0
[ 1.132606] ? lock_acquire+0xd5/0x2d0
[ 1.132613] ? vmbus_chan_sched+0x31/0x2b0
[ 1.132619] rt_spin_lock+0x3f/0x1f0
[ 1.132623] ? vmbus_chan_sched+0xc4/0x2b0
[ 1.132629] ? vmbus_chan_sched+0x31/0x2b0
[ 1.132634] vmbus_chan_sched+0xc4/0x2b0
[ 1.132641] vmbus_isr+0x2c/0x150
[ 1.132648] __sysvec_hyperv_callback+0x5f/0xa0
[ 1.132654] sysvec_hyperv_callback+0x88/0xb0
[ 1.132658] </IRQ>
[ 1.132659] <TASK>
[ 1.132660] asm_sysvec_hyperv_callback+0x1a/0x20As code paths that handle vmbus IRQs use sleepy locks under PREEMPT_RT, the vmbus_isr execution needs to be moved into thread context. Open- coding this allows to skip the IPI that irq_work would additionally bring and which we do not need, being an IRQ, never an NMI.
This affects both x86 and arm64, therefore hook into the common driver logic.
--- drivers/hv/vmbus_drv.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 65 insertions(+), 1 deletion(-)
drivers/hv/vmbus_drv.c +65 -1
@@ -25,6 +25,7 @@#include <linux/cpu.h> #include <linux/sched/isolation.h> #include <linux/sched/task_stack.h> +#include <linux/smpboot.h> #include <linux/delay.h> #include <linux/panic_notifier.h>
@@ -1306,7 +1307,7 @@ sched_unlock_rcu: } } -static void vmbus_isr (void ) +static void __vmbus_isr (void ) {struct hv_per_cpu_context *hv_cpu =this_cpu_ptr (hv_context.cpu_context);
@@ -1330,6 +1331,53 @@ static void vmbus_isr(void)add_interrupt_randomness (vmbus_interrupt); } +static DEFINE_PER_CPU(bool, vmbus_irq_pending); +static DEFINE_PER_CPU(struct task_struct *, vmbus_irqd); + +static void vmbus_irqd_wake (void ) +{ +struct task_struct *tsk =__this_cpu_read (vmbus_irqd); + +__this_cpu_write (vmbus_irq_pending, true); +wake_up_process (tsk); +} + +static void vmbus_irqd_setup (unsigned int cpu) +{ +sched_set_fifo (current); +} + +static int vmbus_irqd_should_run (unsigned int cpu) +{ +return __this_cpu_read (vmbus_irq_pending); +} + +static void run_vmbus_irqd (unsigned int cpu) +{ +__this_cpu_write (vmbus_irq_pending, false); +__vmbus_isr (); +} + +static bool vmbus_irq_initialized; + +static struct smp_hotplug_thread vmbus_irq_threads = { + .store = &vmbus_irqd, + .setup = vmbus_irqd_setup, + .thread_should_run = vmbus_irqd_should_run, + .thread_fn = run_vmbus_irqd, + .thread_comm ="vmbus_irq/%u" , +}; + +static void vmbus_isr (void ) +{ +if (IS_ENABLED (CONFIG_PREEMPT_RT )) { +vmbus_irqd_wake (); + }else { +lockdep_hardirq_threaded (); +__vmbus_isr (); + } +} +static irqreturn_t vmbus_percpu_isr (int irq,void *dev_id) {vmbus_isr ();
@@ -1375,6 +1423,13 @@ static int vmbus_bus_init(void)* the VMbus interrupt handler. */ +if (IS_ENABLED (CONFIG_PREEMPT_RT ) && !vmbus_irq_initialized) { + ret =smpboot_register_percpu_thread (&vmbus_irq_threads); +if (ret) + goto err_kthread; + vmbus_irq_initialized = true; + } +if (vmbus_irq ==-1 ) {hv_setup_vmbus_handler (vmbus_isr); }else {
@@ -1449,6 +1504,11 @@ err_alloc:free_percpu (vmbus_evt); } err_setup: +if (IS_ENABLED (CONFIG_PREEMPT_RT ) && vmbus_irq_initialized) { +smpboot_unregister_percpu_thread (&vmbus_irq_threads); + vmbus_irq_initialized = false; + } +err_kthread:bus_unregister (&hv_bus);return ret; }
@@ -2914,6 +2974,10 @@ static void __exit vmbus_exit(void)free_percpu_irq (vmbus_irq, vmbus_evt);free_percpu (vmbus_evt); } +if (IS_ENABLED (CONFIG_PREEMPT_RT ) && vmbus_irq_initialized) { +smpboot_unregister_percpu_thread (&vmbus_irq_threads); + vmbus_irq_initialized = false; + }for_each_online_cpu (cpu) {struct hv_per_cpu_context *hv_cpu =per_cpu_ptr (hv_context.cpu_context, cpu);
Greg Kroah-Hartman
maintainerPATCH 638/641 io_uring/rsrc: clean up buffer cloning arg validation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <[email protected]>
commit b8201b50e403815f941d1c6581a27fdbfe7d0fd4 upstream.
Get rid of some redundant checks and move the src arg validation to before the buffer table allocation, which simplifies error handling.
--- io_uring/rsrc.c | 27 ++++++--------------------- 1 file changed, 6 insertions(+), 21 deletions(-)
io_uring/rsrc.c +6 -21
@@ -1185,12 +1185,16 @@ static int io_clone_buffers(struct io_rireturn -EBUSY ; nbufs = src_ctx->buf_table.nr; +if (!nbufs) +return -ENXIO ;if (!arg->nr) arg->nr = nbufs;else if (arg->nr > nbufs)return -EINVAL ;else if (arg->nr >IORING_MAX_REG_BUFFERS )return -EINVAL ; +if (check_add_overflow (arg->nr, arg->src_off, &off) || off > nbufs) +return -EOVERFLOW ;if (check_add_overflow (arg->nr, arg->dst_off, &nbufs))return -EOVERFLOW ;if (nbufs >IORING_MAX_REG_BUFFERS )
@@ -1210,21 +1214,6 @@ static int io_clone_buffers(struct io_ri } } - ret = -ENXIO ; - nbufs = src_ctx->buf_table.nr; -if (!nbufs) - goto out_free; - ret = -EINVAL ; -if (!arg->nr) - arg->nr = nbufs; -else if (arg->nr > nbufs) - goto out_free; - ret = -EOVERFLOW ; -if (check_add_overflow (arg->nr, arg->src_off, &off)) - goto out_free; -if (off > nbufs) - goto out_free; - off = arg->dst_off; i = arg->src_off; nr = arg->nr;
@@ -1237,8 +1226,8 @@ static int io_clone_buffers(struct io_ri }else { dst_node =io_rsrc_node_alloc (ctx,IORING_RSRC_BUFFER );if (!dst_node) { - ret = -ENOMEM ; - goto out_free; +io_rsrc_data_free (ctx, &data); +return -ENOMEM ; }refcount_inc (&src_node->buf->refs);
@@ -1274,10 +1263,6 @@ static int io_clone_buffers(struct io_riWARN_ON_ONCE (ctx->buf_table.nr); ctx->buf_table = data;return 0 ; - -out_free: -io_rsrc_data_free (ctx, &data); -return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 640/641 drm/amd/display: Clear HDMI HPD pending work only if it is enabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Lipski <[email protected]>
commit 17b2c526fd8026d8e0f4c0e7f94fc517e3901589 upstream.
[Why&How]
On amdgpu_dm_connector_destroy(), the driver attempts to cancel pending HDMI HPD work without checking if the HDMI HPD is enabled.
Added a check that it is enabled before clearing it.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -4
@@ -7548,10 +7548,12 @@ static void amdgpu_dm_connector_destroy(drm_dp_mst_topology_mgr_destroy (&aconnector->mst_mgr);/* Cancel and flush any pending HDMI HPD debounce work */ -cancel_delayed_work_sync (&aconnector->hdmi_hpd_debounce_work); -if (aconnector->hdmi_prev_sink) { -dc_sink_release (aconnector->hdmi_prev_sink); - aconnector->hdmi_prev_sink =NULL ; +if (aconnector->hdmi_hpd_debounce_delay_ms) { +cancel_delayed_work_sync (&aconnector->hdmi_hpd_debounce_work); +if (aconnector->hdmi_prev_sink) { +dc_sink_release (aconnector->hdmi_prev_sink); + aconnector->hdmi_prev_sink =NULL ; + } }if (aconnector->bl_idx !=-1 ) {
Greg Kroah-Hartman
maintainerPATCH 641/641 net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit e1aa5ef892fb4fa9014a25e87b64b97347919d37 upstream.
Current clk_csr_i setting of Loongson STMMAC (including LS7A1000/2000 and LS2K1000/2000/3000) are copy & paste from other drivers. In fact, Loongson STMMAC use 125MHz clocks and need 62 freq division to within 2.5MHz, meeting most PHY MDC requirement. So fix by setting clk_csr_i to 100-150MHz, otherwise some PHYs may link fail.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +2 -2
@@ -90,8 +90,8 @@ static void loongson_default_data(struct/* Get bus_id, this can be overwritten later */ plat->bus_id =pci_dev_id (pdev); -/* clk_csr_i = 20-35MHz & MDC = clk_csr_i/16 */ - plat->clk_csr =STMMAC_CSR_20_35M ; +/* clk_csr_i = 100-150MHz & MDC = clk_csr_i/62 */ + plat->clk_csr =STMMAC_CSR_100_150M ; plat->core_type =DWMAC_CORE_GMAC ; plat->force_sf_dma_mode =1 ;
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.14 release. There are 641 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 27 Feb 2026 01:22:34 +0000. Anything received after that time might be too late.
test_progs, test_progs-no_alu32, test_progs-cpuv4, test_maps, test_verifier in BPF selftests all passes[1] on x86_64.
1: https://github.com/shunghsiyu/libbpf/actions/runs/22381308704/job/64792250146
[...]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.14 release. There are 641 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 27 Feb 2026 01:22:34 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.14-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.14 release. There are 641 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 27 Feb 2026 01:22:34 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.14-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.18:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
133 tests: 133 pass, 0 failLinux version: 6.18.14-rc1-g24498817f13b
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.14 release. There are 641 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Kevin Brodsky <[email protected]>
selftests/mm: fix faulting-in code inpagemap_ioctltest
This breaks the build of the mm selftests:
CC pagemap_ioctlpagemap_ioctl.c: In function ‘sanity_tests’:
pagemap_ioctl.c:1169:9: error: implicit declaration of function ‘force_read_pages’ [-Wimplicit-function-declaration]
1169 | force_read_pages(fmem, nr_pages, page_size);
| ^~~~~~~~~~~~~~~~IIRC there was a patch adding that function.
Greg Kroah-Hartman
maintainerQuoted 11 lines · Mark Brown
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.14 release. There are 641 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Kevin Brodsky <[email protected]>
selftests/mm: fix faulting-in code inpagemap_ioctltestThis breaks the build of the mm selftests:
Quoted 7 lines
CC
pagemap_ioctlpagemap_ioctl.c: In function ‘sanity_tests’:
pagemap_ioctl.c:1169:9: error: implicit declaration of function ‘force_read_pages’ [-Wimplicit-function-declaration]1169 | force_read_pages(fmem, nr_pages, page_size); | ^~~~~~~~~~~~~~~~IIRC there was a patch adding that function.
thanks, I've dropped this from all queues now, and will push out a -rc2 in a bit.
greg k-h
hello,
Compiled and booted 6.18.14-rc1+
dmesg related error
----------------------err-------------------------- $sudo dmesg -l err
[ 22.068694] kobject: kobject_add_internal failed for lp.0 (error:
-2 parent: parport0)
$ -----------------------err-------------------------
.
--
software engineer
rajagiri school of engineering and technology-