6.12.78-rc1 review
Greg Kroah-Hartman
maintainercover 6.12.78-rc1 review
This is the start of the stable review cycle for the 6.12.78 release. There are 460 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Mar 2026 13:44:33 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.78-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.78-rc1
Dapeng Mi <[email protected]>
perf/x86/intel: Add missing branch counters constraint apply
Guenter Roeck <[email protected]>
hwmon: (max6639) Fix pulses-per-revolution implementation
Josh Law <[email protected]>
tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
Josh Law <[email protected]>
lib/bootconfig: check xbc_init_node() return in override path
Kees Cook <[email protected]>
fs/tests: exec: Remove bad test vector
Rahul Bukte <[email protected]>
drm/i915/gt: Check set_default_submission() before deferencing
Hyunwoo Kim <[email protected]>
ksmbd: fix use-after-free in durable v2 replay of active file handles
Hyunwoo Kim <[email protected]>
ksmbd: fix use-after-free of share_conf in compound request
Andy Nguyen <[email protected]>
drm/amd: fix dcn 2.01 check
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr()
Kamal Dasu <[email protected]>
mtd: rawnand: brcmnand: skip DMA during panic write
Kamal Dasu <[email protected]>
mtd: rawnand: serialize lock/unlock against other NAND operations
Kairui Song <[email protected]>
mm/shmem, swap: avoid redundant Xarray lookup during swapin
Kairui Song <[email protected]>
mm/shmem, swap: improve cached mTHP handling and fix potential hang
Kemeng Shi <[email protected]>
mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
Baolin Wang <[email protected]>
mm: shmem: fix potential data corruption during shmem swapin
Pratyush Yadav <[email protected]>
mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
Pratyush Yadav <[email protected]>
mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
Kyle Meyer <[email protected]>
x86/platform/uv: Handle deconfigured sockets
Masami Hiramatsu (Google) <[email protected]>
ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
Gabor Juhos <[email protected]>
i2c: pxa: defer reset on Armada 3700 when recovery is used
Christophe JAILLET <[email protected]>
i2c: fsi: Fix a potential leak in fsi_i2c_probe()
Johan Hovold <[email protected]>
i2c: cp2615: fix serial string NULL-deref at probe
Ji-Ze Hong (Peter Hong) <[email protected]>
USB: serial: f81232: fix incomplete serial port generation
Jouni Högander <[email protected]>
drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
Sanman Pradhan <[email protected]>
hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
Sanman Pradhan <[email protected]>
hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
Weiming Shi <[email protected]>
icmp: fix NULL pointer dereference in icmp_tag_validation()
Anas Iqbal <[email protected]>
net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
Muhammad Hammad Ijaz <[email protected]>
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
Weiming Shi <[email protected]>
nfnetlink_osf: validate individual option lengths in fingerprints
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release flowtable after rcu grace period on error
Florian Westphal <[email protected]>
netfilter: bpf: defer hook memory release until rcu readers are done
Xiang Mei <[email protected]>
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
Xiang Mei <[email protected]>
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
Jianbo Liu <[email protected]>
net/mlx5e: Fix race condition during IPSec ESN update
Jianbo Liu <[email protected]>
net/mlx5e: Prevent concurrent access to IPSec ASO context
Cosmin Ratiu <[email protected]>
net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
Fedor Pchelkin <[email protected]>
net: macb: fix uninitialized rx_fs_lock
Rafael J. Wysocki <[email protected]>
ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
Guenter Roeck <[email protected]>
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
Xiang Mei <[email protected]>
wifi: mac80211: fix NULL deref in mesh_matches_local()
Petr Oros <[email protected]>
iavf: fix VLAN filter lost on add/delete race
Zdenek Bouska <[email protected]>
igc: fix page fault in XDP TX timestamps handling
Kohei Enju <[email protected]>
igc: fix missing update of skb->tail in igc_xmit_frame()
Nikola Z. Ivanov <[email protected]>
net: usb: aqc111: Do not perform PM inside suspend callback
Daniel Borkmann <[email protected]>
clsact: Fix use-after-free in init/destroy rollback asymmetry
Tobi Gaertner <[email protected]>
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
Tobi Gaertner <[email protected]>
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
Lorenzo Bianconi <[email protected]>
net: airoha: Remove airoha_dev_stop() in airoha_remove()
Lorenzo Bianconi <[email protected]>
net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
Lorenzo Bianconi <[email protected]>
net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
Lorenzo Bianconi <[email protected]>
net: airoha: read default PSE reserved pages value before updating
Jamal Hadi Salim <[email protected]>
net/sched: teql: Fix double-free in teql_master_xmit
Jiayuan Chen <[email protected]>
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Eric Dumazet <[email protected]>
bonding: prevent potential infinite loop in bond_header_parse()
Bart Van Assche <[email protected]>
PM: runtime: Fix a race condition related to device removal
Rafael J. Wysocki <[email protected]>
sched: idle: Consolidate the handling of two special cases
Dipayaan Roy <[email protected]>
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
Justin Chen <[email protected]>
net: bcmgenet: increase WoL poll timeout
Jenny Guanni Qu <[email protected]>
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
Jenny Guanni Qu <[email protected]>
netfilter: xt_time: use unsigned int for monthday bit shift
Pablo Neira Ayuso <[email protected]>
netfilter: xt_CT: drop pending enqueued packets on template removal
Pablo Neira Ayuso <[email protected]>
netfilter: nft_ct: drop pending enqueued packets on removal
Pablo Neira Ayuso <[email protected]>
nf_tables: nft_dynset: fix possible stateful expression memleak in error path
Jenny Guanni Qu <[email protected]>
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
Lukas Johannes Möller <[email protected]>
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
Hyunwoo Kim <[email protected]>
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
Florian Westphal <[email protected]>
netfilter: ctnetlink: remove refcounting in expectation dumpers
Sabrina Dubroca <[email protected]>
mpls: add missing unregister_netdevice_notifier to mpls_init
Jiayuan Chen <[email protected]>
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
Hyunwoo Kim <[email protected]>
bridge: cfm: Fix race condition in peer_mep deletion
Dmitry Baryshkov <[email protected]>
Bluetooth: qca: fix ROM version reading on WCN3998 chips
Shaurya Rane <[email protected]>
Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
Luiz Augusto von Dentz <[email protected]>
Bluetooth: HIDP: Fix possible UAF
Wang Tao <[email protected]>
Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
Michael Grzeschik <[email protected]>
Bluetooth: hci_sync: Fix hci_le_create_conn_sync
Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix defer tests being unstable
Christian Eggers <[email protected]>
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Christian Eggers <[email protected]>
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Christian Eggers <[email protected]>
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
Felix Gu <[email protected]>
firmware: arm_scpi: Fix device_node reference leak in probe path
Yeoreum Yun <[email protected]>
firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap()
Fabrizio Castro <[email protected]>
arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodesOvidiu Panait <[email protected]>
arm64: dts: renesas: r9a09g057: Add RTC node
Peddolla Harshavardhan Reddy <[email protected]>
wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
Kuniyuki Iwashima <[email protected]>
wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
Chen Ni <[email protected]>
soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources()
Richard Genoud <[email protected]>
soc: fsl: qbman: fix race condition in qman_destroy_fq
Shawn Lin <[email protected]>
soc: rockchip: grf: Add missing of_node_put() when returning
Felix Gu <[email protected]>
cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
Felix Gu <[email protected]>
cache: starfive: fix device node leak in starlink_cache_init()
Zilin Guan <[email protected]>
soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()
ZhengYuan Huang <[email protected]>
btrfs: tree-checker: fix misleading root drop_level error message
Filipe Manana <[email protected]>
btrfs: log new dentries when logging parent dir of a conflicting inode
Damien Le Moal <[email protected]>
ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()
Damien Le Moal <[email protected]>
ata: libata-scsi: Return residual for emulated SCSI commands
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Matthew Brost <[email protected]>
drm/xe: Open-code GGTT MMIO access protection
Ashutosh Dixit <[email protected]>
drm/xe/oa: Allow reading after disabling OA stream
Alex Deucher <[email protected]>
drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
Alex Deucher <[email protected]>
drm/radeon: apply state adjust rules to some additional HAINAN vairants
Alessio Belle <[email protected]>
drm/imagination: Fix deadlock in soft reset sequence
Alex Deucher <[email protected]>
drm/amdgpu/mmhub4.1.0: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub3.0: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub3.0.2: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub3.0.1: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub2.3: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub2.0: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/gmc9.0: add bounds checking for cid
Xi Ruoyao <[email protected]>
drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END}Maarten Lankhorst <[email protected]>
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
Jens Axboe <[email protected]>
io_uring/kbuf: propagate BUF_MORE through early buffer commit path
Maciej Andrzejewski ICEYE <[email protected]>
serial: uartlite: fix PM runtime usage count underflow on probe
Ilpo Järvinen <[email protected]>
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
Raul E Rangel <[email protected]>
serial: 8250: Fix TX deadlock when using DMA
Martin Roukala (né Peres) <[email protected]>
serial: 8250_pci: add support for the AX99100
Guanghui Feng <[email protected]>
iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
Finn Thain <[email protected]>
mtd: Avoid boot crash in RedBoot partition table parser
Chen Ni <[email protected]>
mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
Olivier Sobrie <[email protected]>
mtd: rawnand: pl353: make sure optimal timings are applied
Johan Hovold <[email protected]>
spi: fix statistics allocation
Johan Hovold <[email protected]>
spi: fix use-after-free on controller registration failure
Maíra Canal <[email protected]>
pmdomain: bcm: bcm2835-power: Increase ASB control timeout
Luke Wang <[email protected]>
mmc: sdhci: fix timing selection for 1-bit bus width
Matthew Schwartz <[email protected]>
mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
Damien Le Moal <[email protected]>
ata: libata-core: disable LPM on ADATA SU680 SSD
Kevin Hao <[email protected]>
net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
Kevin Hao <[email protected]>
net: macb: Introduce gem_init_rx_ring()
Yang Yang <[email protected]>
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
Filipe Manana <[email protected]>
btrfs: fix transaction abort when snapshotting received subvolumes
Masami Hiramatsu (Google) <[email protected]>
kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
Masami Hiramatsu (Google) <[email protected]>
kprobes: Remove unneeded goto
Hari Bathini <[email protected]>
powerpc64/bpf: fix kfunc call support
Naveen N Rao <[email protected]>
powerpc64/bpf: Fold bpf_jit_emit_func_call_hlp() into bpf_jit_emit_func_call_rel()
Harald Freudenberger <[email protected]>
s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
Jouni Högander <[email protected]>
drm/i915/psr: Write DSC parameters on Selective Update in ET mode
Jouni Högander <[email protected]>
drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters
Jouni Högander <[email protected]>
drm/i915/dsc: Add Selective Update register definitions
Namjae Jeon <[email protected]>
ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
Namjae Jeon <[email protected]>
ksmbd: unset conn->binding on failed binding request
Paulo Alcantara <[email protected]>
smb: client: fix krb5 mount with username option
Lukas Johannes Möller <[email protected]>
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
Lukas Johannes Möller <[email protected]>
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
Felix Fietkau <[email protected]>
mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
Helge Deller <[email protected]>
parisc: Flush correct cache in cacheflush() syscall
Fedor Pchelkin <[email protected]>
net: macb: fix use-after-free access to PTP clock
Ian Ray <[email protected]>
NFC: nxp-nci: allow GPIOs to sleep
Tiezhu Yang <[email protected]>
LoongArch: Give more information if kmem access failed
Ira Weiny <[email protected]>
nvdimm/bus: Fix potential use after free in asynchronous initialization
Jeff Layton <[email protected]>
sunrpc: fix cache_request leak in cache_release
Benjamin Tissoires <[email protected]>
HID: bpf: prevent buffer overflow in hid_hw_request
Benjamin Tissoires <[email protected]>
selftests/hid: fix compilation when bpf_wq and hid_device are not exported
Jeff Layton <[email protected]>
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
Chuck Lever <[email protected]>
NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
Lijo Lazar <[email protected]>
drm/amdgpu: Add basic validation for RAS header
Timur Kristóf <[email protected]>
drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
Timur Kristóf <[email protected]>
drm/amd/display: Add pixel_clock to amd_pp_display_configuration
Jouni Högander <[email protected]>
drm/i915/psr: Repeat Selective Update area alignment
Jouni Högander <[email protected]>
drm/i915/alpm: ALPM disable fixes
Heiko Carstens <[email protected]>
s390/xor: Fix xor_xc_2() inline assembly constraints
Heiko Carstens <[email protected]>
s390/stackleak: Fix __stackleak_poison() inline assembly constraint
Peter Zijlstra <[email protected]>
sched/fair: Fix zero_vruntime tracking
Jens Axboe <[email protected]>
io_uring/kbuf: check if target buffer list is still legacy on recycle
Cheng-Yang Chou <[email protected]>
sched_ext: Remove redundant css_put() in scx_cgroup_init()
Deepanshu Kartikey <[email protected]>
mm: thp: deny THP for files on anonymous inodes
Gao Xiang <[email protected]>
erofs: fix inline data read failure for ztailpacking pclusters
Darrick J. Wong <[email protected]>
xfs: get rid of the xchk_xfile_*_descr calls
Zilin Guan <[email protected]>
binfmt_misc: restore write access before closing files opened by open_exec()
Vladimir Oltean <[email protected]>
net: dsa: properly keep track of conduit reference
Guodong Xu <[email protected]>
dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
Han Guangjiang <[email protected]>
blk-throttle: fix access race during throttle policy activation
Chao Yu <[email protected]>
f2fs: fix to avoid migrating empty section
Zhiguo Niu <[email protected]>
f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
Zhiguo Niu <[email protected]>
f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi
Russell King (Oracle) <[email protected]>
net: stmmac: remove support for lpi_intr_o
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: always set ID as avail when rm endp
Antheas Kapenekakis <[email protected]>
platform/x86/amd/pmc: Add support for Van Gogh SoC
Oleg Nesterov <[email protected]>
x86/uprobes: Fix XOL allocation failure for 32-bit tasks
Asbjørn Sloth Tønnesen <[email protected]>
io_uring/uring_cmd: fix too strict requirement on ioctl
Hariprasad Kelam <[email protected]>
Octeontx2-af: Add proper checks for fwdata
Steven Rostedt <[email protected]>
tracing: Add recursion protection in kernel stack trace recording
Paul Greenwalt <[email protected]>
ice: fix devlink reload call trace
Qu Wenruo <[email protected]>
btrfs: do not strictly require dirty metadata threshold for metadata writepages
David Howells <[email protected]>
rxrpc: Fix recvmsg() unconditional requeue
Mikulas Patocka <[email protected]>
dm-verity: disable recursive forward error correction
Eric Dumazet <[email protected]>
ipv6: use RCU in ip6_xmit()
Shuicheng Lin <[email protected]>
drm/xe/sync: Cleanup partially initialized sync on parse failure
Long Li <[email protected]>
xfs: fix integer overflow in bmap intent sort comparator
Thorsten Blum <[email protected]>
crypto: atmel-sha204a - Fix OOM ->tfm_count leak
Shyam Prasad N <[email protected]>
cifs: open files should not hold ref on superblock
Kevin Hao <[email protected]>
net: macb: Shuffle the tx ring before enabling tx
Luca Ceresoli <[email protected]>
drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
Thorsten Blum <[email protected]>
ksmbd: Don't log keys in SMB3 signing and encryption key generation
Jim Mattson <[email protected]>
KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
Chao Gao <[email protected]>
KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
Yan Zhao <[email protected]>
KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT
Yan Zhao <[email protected]>
KVM: x86: Introduce supported_quirks to block disabling quirks
Paolo Bonzini <[email protected]>
KVM: x86: Allow vendor code to disable quirks
Paolo Bonzini <[email protected]>
KVM: x86: do not allow re-enabling quirks
Sean Christopherson <[email protected]>
KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration
Sean Christopherson <[email protected]>
KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create()
Shengming Hu <[email protected]>
fgraph: Fix thresh_return clear per-task notrace
Darrick J. Wong <[email protected]>
iomap: reject delalloc mappings during writeback
Tejun Heo <[email protected]>
sched_ext: Fix starvation of scx_enable() under fair-class saturation
Tejun Heo <[email protected]>
sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
Christian Brauner <[email protected]>
nsfs: tighten permission checks for ns iteration ioctls
Alexander Potapenko <[email protected]>
mm/kfence: fix KASAN hardware tag faults during late enablement
David Hildenbrand <[email protected]>
mm/page_alloc: forward the gfp flags from alloc_contig_range() to post_alloc_hook()
David Hildenbrand <[email protected]>
mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
Matthew Wilcox (Oracle) <[email protected]>
mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
Shawn Lin <[email protected]>
mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support
Shawn Lin <[email protected]>
mmc: dw_mmc-rockchip: Add memory clock auto-gating support
Jisheng Zhang <[email protected]>
mmc: dw_mmc-rockchip: use modern PM macros
Sean Christopherson <[email protected]>
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
Naveen N Rao <[email protected]>
KVM: SVM: Add a helper to look up the max physical ID for AVIC
Naveen N Rao <[email protected]>
KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids
Jiasheng Jiang <[email protected]>
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
Kuen-Han Tsai <[email protected]>
usb: gadget: f_ncm: Fix net_device lifecycle with device_move
Thomas Gleixner <[email protected]>
cleanup: Provide retain_and_null_ptr()
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_can_open(): always configure bitrates before starting device
Ethan Tidmore <[email protected]>
xfs: Fix error pointer dereference
Paul Moses <[email protected]>
net/sched: act_gate: snapshot parameters with RCU on replace
Nathan Chancellor <[email protected]>
kbuild: Leave objtool binary around with 'make clean'
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check RM_ADDR not sent over same subflow
Gang Yan <[email protected]>
selftests: mptcp: add a check for 'add_addr_accepted'
Natalie Vock <[email protected]>
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: avoid sending RM_ADDR over same subflow
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: always mark signal+subflow endp as used
Zide Chen <[email protected]>
perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
Kan Liang <[email protected]>
perf/x86/intel/uncore: Support more units on Granite Rapids
Daniel Hodges <[email protected]>
wifi: libertas: fix use-after-free in lbs_free_adapter()
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Support allocations of larger data
Kim Phillips <[email protected]>
x86/sev: Allow IBPB-on-Entry feature for SNP guests
Andrew Lunn <[email protected]>
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
Ankit Garg <[email protected]>
gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
Khairul Anuar Romli <[email protected]>
spi: cadence-quadspi: Implement refcount to handle unbind during busy
Fedor Pchelkin <[email protected]>
ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
Eric Dumazet <[email protected]>
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
Eric Biggers <[email protected]>
smb: client: Compare MACs in constant time
Eric Biggers <[email protected]>
ksmbd: Compare MACs in constant time
Eric Biggers <[email protected]>
net/tcp-md5: Fix MAC comparison to be constant-time
John Ripple <[email protected]>
drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
Yasin Lee <[email protected]>
iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix odr switch when turning buffer off
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix odr switch to the same value
Antoniu Miclaus <[email protected]>
iio: gyro: mpu3050-i2c: fix pm_runtime error handling
Antoniu Miclaus <[email protected]>
iio: gyro: mpu3050-core: fix pm_runtime error handling
Nuno Sá <[email protected]>
iio: buffer: Fix wait_queue not being removed
Chris Spencer <[email protected]>
iio: chemical: bme680: Fix measurement wait duration calculation
Lukas Schmid <[email protected]>
iio: potentiometer: mcp4131: fix double application of wiper shift
Antoniu Miclaus <[email protected]>
iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
Antoniu Miclaus <[email protected]>
iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
SeungJu Cheon <[email protected]>
iio: frequency: adf4377: Fix duplicated soft reset mask
Oleksij Rempel <[email protected]>
iio: dac: ds4424: reject -128 RAW value
Filipe Manana <[email protected]>
btrfs: abort transaction on failure to update root in the received subvol ioctl
Filipe Manana <[email protected]>
btrfs: fix transaction abort on set received ioctl due to item overflow
Filipe Manana <[email protected]>
btrfs: fix transaction abort on file creation due to name hash collision
Henrique Carvalho <[email protected]>
smb: client: fix iface port assignment in parse_server_interfaces
Bharath SM <[email protected]>
smb: client: fix in-place encryption corruption in SMB2_write()
Paulo Alcantara <[email protected]>
smb: client: fix atomic open with O_DIRECT & O_SYNC
Josh Law <[email protected]>
lib/bootconfig: check bounds before writing in __xbc_open_brace()
Josh Law <[email protected]>
lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
Shashank Balaji <[email protected]>
x86/apic: Disable x2apic on resume if the kernel expects so
Junxiao Bi <[email protected]>
scsi: core: Fix error handling for scsi_alloc_sdev()
Josh Law <[email protected]>
lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
Stefan Haberland <[email protected]>
s390/dasd: Copy detected format information to secondary device
Stefan Haberland <[email protected]>
s390/dasd: Move quiesce state with pprc swap
Long Li <[email protected]>
xfs: ensure dquot item is deleted from AIL only after log shutdown
Darrick J. Wong <[email protected]>
xfs: fix undersized l_iclog_roundoff values
Carlos Maiolino <[email protected]>
xfs: fix returned valued from xfs_defer_can_append
Shyam Prasad N <[email protected]>
cifs: make default value of retrans as zero
Laurent Vivier <[email protected]>
qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
Calvin Owens <[email protected]>
tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
Andrei-Alexandru Tachici <[email protected]>
tracing: Fix enabling multiple events on the kernel command line and bootconfig
Thomas Fourier <[email protected]>
drm/msm: Fix dma_free_attrs() buffer size
Janusz Krzysztofik <[email protected]>
drm/i915: Fix potential overflow of shmem scatterlist length
Luca Ceresoli <[email protected]>
drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
Mario Limonciello <[email protected]>
drm/amd: Set num IP blocks to 0 if discovery fails
Alysa Liu <[email protected]>
drm/amdgpu: Fix use-after-free race in VM acquire
Yang Wang <[email protected]>
drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
Bastien Curutchet (Schneider Electric) <[email protected]>
net: dsa: microchip: Fix error path in PTP IRQ setup
Fan Wu <[email protected]>
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Jian Zhang <[email protected]>
net: ncsi: fix skb leak in error paths
Mehul Rao <[email protected]>
net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free by using call_rcu() for oplock_info
Marios Makassikis <[email protected]>
smb: server: fix use-after-free in smb2_open()
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
Dillon Varone <[email protected]>
drm/amd/display: Fallback to boot snapshot for dispclk
Maximilian Pezzullo <[email protected]>
ata: libata-core: Disable LPM on ST1000DM010-2EP102
Maíra Canal <[email protected]>
pmdomain: bcm: bcm2835-power: Fix broken reset status read
Helge Deller <[email protected]>
parisc: Check kernel mapping earlier at bootup
Piotr Jaroszynski <[email protected]>
arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults
Helge Deller <[email protected]>
parisc: Fix initial page table creation for boot
Sanman Pradhan <[email protected]>
hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
Catalin Marinas <[email protected]>
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
Dave Airlie <[email protected]>
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
Helge Deller <[email protected]>
parisc: Increase initial mapping to 64 MB with KALLSYMS
Sven Eckelmann <[email protected]>
batman-adv: Avoid double-rtnl_lock ELP metric worker
Eric Biggers <[email protected]>
net/tcp-ao: Fix MAC comparison to be constant-time
Huiwen He <[email protected]>
tracing: Fix syscall events activation by ensuring refcount hits zero
Jakub Staniszewski <[email protected]>
ice: fix retry for AQ command 0x06EE
Long Li <[email protected]>
net: mana: Ring doorbell at 4 CQ wraparounds
Ariel Silver <[email protected]>
media: dvb-net: fix OOB access in ULE extension header tables
Luka Gejak <[email protected]>
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
Greg Kroah-Hartman <[email protected]>
staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
Jedrzej Jagielski <[email protected]>
ixgbevf: fix link setup issue
Jakub Staniszewski <[email protected]>
ice: reintroduce retry mechanism for indirect AQ
Mark Harmstone <[email protected]>
btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()
Marc Zyngier <[email protected]>
irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
Andy Shevchenko <[email protected]>
device property: Allow secondary lookup in fwnode_get_next_child_node()
Kuniyuki Iwashima <[email protected]>
nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
Alexander Gordeev <[email protected]>
s390/pfault: Fix virtual vs physical address confusion
Franz Schnyder <[email protected]>
drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
Osama Abdelkader <[email protected]>
drm/bridge: samsung-dsim: Fix memory leak in error path
Mario Limonciello <[email protected]>
drm/amd: Disable MES LR compute W/A
Xu Yang <[email protected]>
Revert "tcpm: allow looking for role_sw device in the main node"
Linus Torvalds <[email protected]>
Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
Thomas Gleixner <[email protected]>
kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
Xingui Yang <[email protected]>
scsi: hisi_sas: Fix NULL pointer exception during user_scan()
Yihang Li <[email protected]>
scsi: hisi_sas: Use macro instead of magic number
Xingui Yang <[email protected]>
scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec
Wang Shuaiwei <[email protected]>
scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
Adrian Ng Ho Yin <[email protected]>
i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
Steven Rostedt <[email protected]>
time/jiffies: Mark jiffies_64_to_clock_t() notrace
Max Kellermann <[email protected]>
ceph: fix memory leaks in ceph_mdsc_build_path()
Max Kellermann <[email protected]>
ceph: fix i_nlink underrun during async unlink
Ilya Dryomov <[email protected]>
libceph: admit message frames only in CEPH_CON_S_OPEN state
Raphael Zimmer <[email protected]>
libceph: Use u32 for non-negative values in ceph_monmap_decode()
Ilya Dryomov <[email protected]>
libceph: prevent potential out-of-bounds reads in process_message_header()
Ilya Dryomov <[email protected]>
libceph: reject preamble if control segment is empty
Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
Max Kellermann <[email protected]>
ceph: add a bunch of missing ceph_path_info initializers
Masami Hiramatsu (Google) <[email protected]>
kprobes: avoid crash when rmmod/insmod after ftrace killed
Mehul Rao <[email protected]>
tipc: fix divide-by-zero in tipc_sk_filter_connect()
Ravi Hothi <[email protected]>
ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
Penghe Geng <[email protected]>
mmc: core: Avoid bitfield RMW for claim/retune flags
Alexander Potapenko <[email protected]>
mm/kfence: disable KFENCE upon KASAN HW tags enablement
Felix Gu <[email protected]>
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
Kalesh Singh <[email protected]>
mm/tracing: rss_stat: ensure curr is false from kthread context
Miguel Ojeda <[email protected]>
rust: kbuild: allow unused_features
Ziyi Guo <[email protected]>
usb: image: mdc800: kill download URB on timeout
Oliver Neukum <[email protected]>
usb: mdc800: handle signal and read racing
Fan Wu <[email protected]>
usb: renesas_usbhs: fix use-after-free in ISR during device removal
Oliver Neukum <[email protected]>
usb: class: cdc-wdm: fix reordering issue in read code path
Alan Stern <[email protected]>
USB: core: Limit the length of unkillable synchronous timeouts
Alan Stern <[email protected]>
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
Alan Stern <[email protected]>
USB: usbcore: Introduce usb_bulk_msg_killable()
RD Babiera <[email protected]>
usb: typec: altmode/displayport: set displayport signaling rate in configure message
Xu Yang <[email protected]>
usb: roles: get usb role switch from parent only for usb-b-connector
Marc Zyngier <[email protected]>
usb: cdc-acm: Restore CAP_BRK functionnality to CH343
Gabor Juhos <[email protected]>
usb: core: don't power off roothub PHYs if phy_set_mode() fails
Greg Kroah-Hartman <[email protected]>
usb: misc: uss720: properly clean up reference in uss720_probe()
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Nova Lake -H
Oliver Neukum <[email protected]>
usb: yurex: fix race in probe
Dayu Jiang <[email protected]>
usb: xhci: Prevent interrupt storm on host controller error (HCE)
Zilin Guan <[email protected]>
usb: xhci: Fix memory leak in xhci_disable_slot()
Vyacheslav Vahnenko <[email protected]>
USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
Christoffer Sandberg <[email protected]>
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
A1RM4X <[email protected]>
USB: add QUIRK_NO_BOS for video capture several devices
Sean Christopherson <[email protected]>
KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
Pedro Falcato <[email protected]>
ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
Oleksij Rempel <[email protected]>
net: usb: lan78xx: skip LTM configuration for LAN7850
Oleksij Rempel <[email protected]>
net: usb: lan78xx: fix TX byte statistics for small packets
Oleksij Rempel <[email protected]>
net: usb: lan78xx: fix silent drop of packets with checksum errors
Takashi Iwai <[email protected]>
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
Mehul Rao <[email protected]>
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
Qingye Zhao <[email protected]>
cgroup: fix race between task migration and iteration
Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
Seungjin Bae <[email protected]>
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
Andreas Kemnade <[email protected]>
iio: imu: inv-mpu9150: fix irq ack preventing irq storms
Eric Dumazet <[email protected]>
net: prevent NULL deref in ip[6]tunnel_xmit()
Alok Tiwari <[email protected]>
octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
Alok Tiwari <[email protected]>
octeontx2-af: devlink: fix NIX RAS reporter recovery condition
Marek Behún <[email protected]>
net: dsa: realtek: Fix LED group port bit for non-zero LED group
Ricardo B. Marlière <[email protected]>
net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
Philip Yang <[email protected]>
drm/amdkfd: Unreserve bo if queue update failed
Casey Connolly <[email protected]>
ASoC: detect empty DMI strings
Chen Ni <[email protected]>
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
Ben Dooks <[email protected]>
ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
Nicolai Buchwitz <[email protected]>
net: bcmgenet: fix broken EEE by converting to phylib-managed state
Matt Vollrath <[email protected]>
e1000/e1000e: Fix leak in DMA error cleanup
Alok Tiwari <[email protected]>
i40e: fix src IP mask checks and memcpy argument names in cloud filter
Sungwoo Kim <[email protected]>
nvme-pci: Fix race bug in nvme_poll_irqdisable()
Sungwoo Kim <[email protected]>
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
Rafael J. Wysocki <[email protected]>
sched: idle: Make skipping governor callbacks more consistent
Chen Ni <[email protected]>
perf ftrace: Fix hashmap__new() error checking
Peng Fan <[email protected]>
regulator: pca9450: Correct interrupt type
Chen Ni <[email protected]>
perf annotate: Fix hashmap__new() error checking
Yuan Tan <[email protected]>
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
Hyunwoo Kim <[email protected]>
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
Hyunwoo Kim <[email protected]>
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
David Dull <[email protected]>
netfilter: x_tables: guard option walkers against 1-byte tail reads
Jenny Guanni Qu <[email protected]>
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
Florian Westphal <[email protected]>
netfilter: nf_tables: always walk all pending catchall elements
Weiming Shi <[email protected]>
net: add xmit recursion limit to tunnel xmit functions
Toke Høiland-Jørgensen <[email protected]>
xdp: register system page pool as an XDP memory model
Alexander Lobakin <[email protected]>
xdp: allow attaching already registered memory model to xdp_rxq_info
Raju Rangoju <[email protected]>
amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
Raju Rangoju <[email protected]>
amd-xgbe: fix link status handling in xgbe_rx_adaptation
Chengfeng Ye <[email protected]>
mctp: route: hold key->lock in mctp_flow_prepare_output()
Jiayuan Chen <[email protected]>
bonding: fix type confusion in bond_setup_by_slave()
Hangbin Liu <[email protected]>
bonding: use common function to compute the features
Hangbin Liu <[email protected]>
net: add a common function to compute features for upper devices
Cosmin Ratiu <[email protected]>
bonding: Correctly support GSO ESP offload
Jianbo Liu <[email protected]>
bonding: add ESP offload features when slaves support
Wenyuan Li <[email protected]>
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
Haiyue Wang <[email protected]>
mctp: i2c: fix skb memory leak in receive path
Pavan Chebbi <[email protected]>
bnxt_en: Fix RSS table size check when changing ethtool channels
Shuangpeng Bai <[email protected]>
serial: caif: hold tty->link reference in ldisc_open and ser_release
Álvaro Fernández Rojas <[email protected]>
net: sfp: improve Huawei MA5671a fixup
Sen Wang <[email protected]>
ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
Kuninori Morimoto <[email protected]>
ASoC: simple-card-utils: use __free(device_node) for device node
matteo.cotifava <[email protected]>
ASoC: soc-core: flush delayed work before removing DAIs and widgets
matteo.cotifava <[email protected]>
ASoC: soc-core: drop delayed_work_pending() check before flush
David Lechner <[email protected]>
drm/sitronix/st7586: fix bad pixel data due to byte swap
Weiming Shi <[email protected]>
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
Gal Pressman <[email protected]>
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
Patrisious Haddad <[email protected]>
net/mlx5: Fix crash when moving to switchdev mode
Cosmin Ratiu <[email protected]>
net/mlx5: Fix deadlock between devlink lock and esw->wq
Daniel Jurgens <[email protected]>
net/mlx5: Query to see if host PF is disabled
Daniel Jurgens <[email protected]>
net/mlx5: IFC updates for disabled host PF
Hangbin Liu <[email protected]>
bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
Yang Wang <[email protected]>
drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
Pengyu Luo <[email protected]>
drm/msm/dsi: fix pclk rate calculation for bonded dsi
Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
Peter Collingbourne <[email protected]>
perf disasm: Fix off-by-one bug in outside check
Breno Leitao <[email protected]>
workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
Sun YangKai <[email protected]>
btrfs: hold space_info->lock when clearing periodic reclaim ready
Eric Badger <[email protected]>
xprtrdma: Decrement re_receiving on the early exit paths
Pengyu Luo <[email protected]>
drm/msm/dsi: fix hdisplay calculation when programming dsi registers
Roberto Bergantinos Corpas <[email protected]>
nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
Guenter Roeck <[email protected]>
smb/server: Fix another refcount leak in smb2_open()
J. Neuschäfer <[email protected]>
powerpc: 83xx: km83xx: Fix keymile vendor prefix
Tzung-Bi Shih <[email protected]>
remoteproc: mediatek: Unprepare SCP clock during system suspend
Bjorn Andersson <[email protected]>
remoteproc: sysmon: Correct subsys_name_len type in QMI request
Sourabh Jain <[email protected]>
powerpc/crash: adjust the elfcorehdr size
Sourabh Jain <[email protected]>
powerpc/kexec/core: use big-endian types for crash variables
Ben Collins <[email protected]>
kexec: Include kernel-end even without crashkernel
Eliav Farber <[email protected]>
kexec: Consolidate machine_kexec_mask_interrupts() implementation
Christophe Leroy (CS GROUP) <[email protected]>
powerpc/uaccess: Fix inline assembly for clang build on PPC32
Takashi Iwai <[email protected]>
ALSA: usb-audio: Check max frame size for implicit feedback mode, too
sguttula <[email protected]>
drm/amdgpu/vcn5: Add SMU dpm interface type
Takashi Iwai <[email protected]>
ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
wangshuaiwei <[email protected]>
scsi: ufs: core: Fix shift out of bounds when MAXQ=32
Peter Wang <[email protected]>
scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
Charles Keepax <[email protected]>
ASoC: cs42l43: Report insert for exotic peripherals
Azamat Almazbek uulu <[email protected]>
ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
Tomas Henzl <[email protected]>
scsi: ses: Fix devices attaching to different hosts
Sofia Schneider <[email protected]>
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
Ramanathan Choodamani <[email protected]>
wifi: mac80211: set default WMM parameters on all links
Al Viro <[email protected]>
unshare: fix unshare_fs() handling
Sean Rhodes <[email protected]>
ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Add NULL checks when resetting request and reply queues
Piotr Mazek <[email protected]>
ACPI: PM: Save NVS memory on Lenovo G70-35
Jan Kiszka <[email protected]>
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
-------------
Diffstat:
Documentation/virt/kvm/api.rst | 52 ++++ Makefile | 13 +- arch/arm/kernel/machine_kexec.c | 23 -- arch/arm64/Kconfig | 1 + .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 1 - arch/arm64/boot/dts/renesas/r9a09g057.dtsi | 37 +-- arch/arm64/include/asm/pgtable-prot.h | 10 +- arch/arm64/kernel/machine_kexec.c | 31 --- arch/arm64/mm/contpte.c | 53 ++++- arch/loongarch/include/asm/uaccess.h | 14 +- arch/parisc/include/asm/pgtable.h | 2 +- arch/parisc/kernel/cache.c | 4 +- arch/parisc/kernel/head.S | 7 +- arch/parisc/kernel/setup.c | 20 +- arch/powerpc/include/asm/kexec.h | 1 - arch/powerpc/include/asm/uaccess.h | 2 +- arch/powerpc/kexec/core.c | 60 ++--- arch/powerpc/kexec/core_32.c | 1 + arch/powerpc/kexec/file_load_64.c | 14 +- arch/powerpc/net/bpf_jit_comp.c | 2 +- arch/powerpc/net/bpf_jit_comp64.c | 140 +++++++---- arch/powerpc/platforms/83xx/km83xx.c | 4 +- arch/riscv/kernel/machine_kexec.c | 23 -- arch/s390/include/asm/processor.h | 2 +- arch/s390/lib/xor.c | 4 +- arch/s390/mm/pfault.c | 4 +- arch/x86/boot/compressed/sev.c | 1 + arch/x86/coco/sev/core.c | 1 + arch/x86/events/intel/core.c | 25 +- arch/x86/events/intel/uncore_snbep.c | 78 ++++-- arch/x86/include/asm/kvm_host.h | 9 +- arch/x86/include/asm/msr-index.h | 5 +- arch/x86/include/uapi/asm/kvm.h | 3 + arch/x86/kernel/apic/apic.c | 6 + arch/x86/kernel/apic/x2apic_uv_x.c | 18 +- arch/x86/kernel/uprobes.c | 24 ++ arch/x86/kvm/mmu.h | 2 +- arch/x86/kvm/mmu/mmu.c | 10 +- arch/x86/kvm/svm/avic.c | 30 ++- arch/x86/kvm/svm/svm.c | 14 +- arch/x86/kvm/vmx/nested.c | 26 +- arch/x86/kvm/vmx/vmx.c | 50 +++- arch/x86/kvm/x86.c | 23 +- arch/x86/kvm/x86.h | 3 + block/blk-cgroup.c | 6 - block/blk-cgroup.h | 6 + block/blk-throttle.c | 6 +- block/blk-throttle.h | 18 +- drivers/acpi/acpi_processor.c | 15 +- drivers/acpi/osi.c | 13 + drivers/acpi/osl.c | 2 +- drivers/acpi/sleep.c | 8 + drivers/ata/libata-core.c | 5 + drivers/ata/libata-scsi.c | 83 ++++--- drivers/base/power/runtime.c | 1 + drivers/base/property.c | 27 +-- drivers/bluetooth/btqca.c | 2 + drivers/cache/ax45mp_cache.c | 4 +- drivers/cache/starfive_starlink_cache.c | 4 +- drivers/cpuidle/cpuidle.c | 10 - drivers/crypto/atmel-sha204a.c | 5 +- drivers/dma/mmp_pdma.c | 6 + drivers/firewire/net.c | 5 +- drivers/firmware/arm_ffa/driver.c | 8 +- drivers/firmware/arm_scpi.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 20 +- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 21 +- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 5 - drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 5 - drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 +- drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c | 3 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 3 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c | 3 +- drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 4 + .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 1 + drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 8 +- .../amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +- drivers/gpu/drm/amd/display/dc/dm_services_types.h | 2 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +- .../amd/display/dc/resource/dcn32/dcn32_resource.c | 3 + drivers/gpu/drm/amd/include/dm_pp_interface.h | 1 + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 67 ++++++ drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h | 2 + drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +- drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | 6 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 69 ++---- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 11 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 8 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 3 +- drivers/gpu/drm/bridge/samsung-dsim.c | 25 +- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 13 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 118 ++++++++- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_psr.c | 71 ++++-- drivers/gpu/drm/i915/display/intel_vdsc.c | 23 ++ drivers/gpu/drm/i915/display/intel_vdsc.h | 3 + drivers/gpu/drm/i915/display/intel_vdsc_regs.h | 12 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 12 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 +- drivers/gpu/drm/imagination/pvr_power.c | 11 +- drivers/gpu/drm/msm/adreno/a2xx_gpummu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 43 +++- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/gpu/drm/radeon/si_dpm.c | 4 +- drivers/gpu/drm/tiny/st7586.c | 15 +- drivers/gpu/drm/xe/xe_ggtt.c | 10 +- drivers/gpu/drm/xe/xe_ggtt_types.h | 5 +- drivers/gpu/drm/xe/xe_oa.c | 7 +- drivers/gpu/drm/xe/xe_sync.c | 24 +- drivers/hid/bpf/hid_bpf_dispatch.c | 2 + drivers/hwmon/max6639.c | 10 +- drivers/hwmon/pmbus/isl68137.c | 7 +- drivers/hwmon/pmbus/mp2975.c | 2 + drivers/hwmon/pmbus/q54sj108a2.c | 19 +- drivers/i2c/busses/i2c-cp2615.c | 3 + drivers/i2c/busses/i2c-fsi.c | 1 + drivers/i2c/busses/i2c-pxa.c | 17 +- drivers/i3c/master/dw-i3c-master.c | 4 +- drivers/i3c/master/mipi-i3c-hci/cmd.h | 1 + drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 2 +- drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 2 +- drivers/i3c/master/mipi-i3c-hci/core.c | 6 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 4 +- drivers/iio/chemical/bme680_core.c | 2 +- drivers/iio/chemical/sps30_i2c.c | 2 +- drivers/iio/chemical/sps30_serial.c | 2 +- drivers/iio/dac/ds4424.c | 2 +- drivers/iio/frequency/adf4377.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 18 +- drivers/iio/gyro/mpu3050-i2c.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 + drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 4 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 + drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 8 + drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 2 + drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +- drivers/iio/industrialio-buffer.c | 6 +- drivers/iio/potentiometer/mcp4131.c | 2 +- drivers/iio/proximity/hx9023s.c | 3 + drivers/iommu/intel/dmar.c | 3 +- drivers/irqchip/irq-gic-v3-its.c | 4 + drivers/md/dm-verity-fec.c | 4 +- drivers/md/dm-verity-fec.h | 3 - drivers/media/dvb-core/dvb_net.c | 3 + drivers/mmc/host/dw_mmc-rockchip.c | 51 +++- drivers/mmc/host/mmci_qcom_dml.c | 1 + drivers/mmc/host/sdhci-pci-gli.c | 9 + drivers/mmc/host/sdhci.c | 9 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 +- drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +- drivers/mtd/nand/raw/nand_base.c | 14 +- drivers/mtd/nand/raw/pl35x-nand-controller.c | 3 + drivers/mtd/parsers/redboot.c | 6 +- drivers/mtd/spi-nor/core.c | 145 ++++++++++- drivers/net/bonding/bond_debugfs.c | 16 +- drivers/net/bonding/bond_main.c | 138 +++++------ drivers/net/caif/caif_serial.c | 3 + drivers/net/can/spi/hi311x.c | 5 +- drivers/net/can/usb/gs_usb.c | 22 +- drivers/net/dsa/bcm_sf2.c | 8 +- drivers/net/dsa/microchip/ksz_ptp.c | 11 +- drivers/net/dsa/realtek/rtl8365mb.c | 3 +- drivers/net/dsa/realtek/rtl8366rb-leds.c | 6 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 82 ++++++- drivers/net/ethernet/amd/xgbe/xgbe.h | 4 + drivers/net/ethernet/arc/emac_main.c | 11 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 31 +-- drivers/net/ethernet/broadcom/genet/bcmgenet.h | 5 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 2 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 10 +- drivers/net/ethernet/cadence/macb_main.c | 124 +++++++++- drivers/net/ethernet/cadence/macb_ptp.c | 4 +- drivers/net/ethernet/google/gve/gve_tx_dqo.c | 52 ++-- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 - drivers/net/ethernet/intel/e1000e/netdev.c | 2 - drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 9 +- drivers/net/ethernet/intel/ice/ice_common.c | 13 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 35 ++- drivers/net/ethernet/intel/ice/ice_main.c | 3 +- drivers/net/ethernet/intel/igc/igc.h | 2 + drivers/net/ethernet/intel/igc/igc_main.c | 14 +- drivers/net/ethernet/intel/igc/igc_ptp.c | 33 +++ drivers/net/ethernet/intel/ixgbevf/vf.c | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 3 + .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 6 +- .../net/ethernet/marvell/octeontx2/af/rvu_sdp.c | 2 +- drivers/net/ethernet/mediatek/airoha_eth.c | 52 ++-- .../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 - .../ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 1 + .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- .../mellanox/mlx5/core/en_accel/ipsec_offload.c | 52 ++-- drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c | 23 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 30 ++- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 18 +- drivers/net/ethernet/microsoft/mana/hw_channel.c | 6 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 23 +- drivers/net/ethernet/stmicro/stmmac/common.h | 1 - drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 - .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 7 - drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 - drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 36 --- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 - drivers/net/mctp/mctp-i2c.c | 1 + drivers/net/phy/phy_device.c | 25 +- drivers/net/phy/sfp.c | 8 +- drivers/net/usb/aqc111.c | 12 +- drivers/net/usb/cdc_ncm.c | 10 +- drivers/net/usb/lan78xx.c | 10 +- drivers/net/usb/lan78xx.h | 3 + drivers/net/usb/qmi_wwan.c | 4 +- drivers/net/usb/usbnet.c | 7 +- drivers/net/wireless/marvell/libertas/main.c | 4 +- drivers/net/wireless/ti/wlcore/tx.c | 2 +- drivers/nfc/nxp-nci/i2c.c | 4 +- drivers/nvdimm/bus.c | 5 +- drivers/nvme/host/pci.c | 8 +- drivers/platform/x86/amd/pmc/pmc.c | 3 + drivers/platform/x86/amd/pmc/pmc.h | 1 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 9 +- drivers/pmdomain/bcm/bcm2835-power.c | 18 +- drivers/regulator/pca9450-regulator.c | 2 +- drivers/remoteproc/mtk_scp.c | 39 +++ drivers/remoteproc/qcom_sysmon.c | 2 +- drivers/s390/block/dasd_eckd.c | 16 ++ drivers/s390/crypto/zcrypt_ccamisc.c | 12 +- drivers/s390/crypto/zcrypt_cex4.c | 3 +- drivers/scsi/hisi_sas/hisi_sas.h | 43 +++- drivers/scsi/hisi_sas/hisi_sas_main.c | 42 +++- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 246 ++++++++++++------- drivers/scsi/mpi3mr/mpi3mr_fw.c | 32 +-- drivers/scsi/scsi_scan.c | 8 +- drivers/scsi/ses.c | 5 +- drivers/scsi/storvsc_drv.c | 5 +- drivers/soc/fsl/qbman/qman.c | 24 +- drivers/soc/fsl/qe/qmc.c | 4 +- drivers/soc/microchip/mpfs-sys-controller.c | 13 +- drivers/soc/rockchip/grf.c | 1 + drivers/spi/spi-cadence-quadspi.c | 33 +++ drivers/spi/spi.c | 25 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 +- drivers/tty/serial/8250/8250_dma.c | 15 ++ drivers/tty/serial/8250/8250_pci.c | 17 ++ drivers/tty/serial/8250/8250_port.c | 6 + drivers/tty/serial/uartlite.c | 1 + drivers/ufs/core/ufshcd.c | 8 +- drivers/usb/class/cdc-acm.c | 5 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/cdc-wdm.c | 4 +- drivers/usb/class/usbtmc.c | 6 +- drivers/usb/core/message.c | 100 ++++++-- drivers/usb/core/phy.c | 8 +- drivers/usb/core/quirks.c | 16 ++ drivers/usb/dwc3/dwc3-pci.c | 2 + drivers/usb/gadget/function/f_mass_storage.c | 12 +- drivers/usb/gadget/function/f_ncm.c | 36 ++- drivers/usb/gadget/function/f_tcm.c | 14 ++ drivers/usb/gadget/function/u_ether.c | 22 ++ drivers/usb/gadget/function/u_ether.h | 26 ++ drivers/usb/gadget/function/u_ncm.h | 2 +- drivers/usb/host/xhci-ring.c | 1 + drivers/usb/host/xhci.c | 4 +- drivers/usb/image/mdc800.c | 6 +- drivers/usb/misc/uss720.c | 2 +- drivers/usb/misc/yurex.c | 2 +- drivers/usb/renesas_usbhs/common.c | 9 + drivers/usb/roles/class.c | 7 +- drivers/usb/serial/f81232.c | 77 +++--- drivers/usb/typec/altmodes/displayport.c | 7 +- drivers/usb/typec/tcpm/tcpm.c | 2 +- fs/binfmt_misc.c | 4 +- fs/btrfs/disk-io.c | 22 -- fs/btrfs/extent_io.c | 3 +- fs/btrfs/extent_io.h | 3 +- fs/btrfs/inode.c | 19 ++ fs/btrfs/ioctl.c | 24 +- fs/btrfs/space-info.c | 5 +- fs/btrfs/transaction.c | 16 ++ fs/btrfs/tree-checker.c | 2 +- fs/btrfs/tree-log.c | 6 + fs/btrfs/uuid-tree.c | 38 +++ fs/btrfs/uuid-tree.h | 2 + fs/btrfs/volumes.c | 6 +- fs/ceph/debugfs.c | 4 +- fs/ceph/dir.c | 17 +- fs/ceph/file.c | 4 +- fs/ceph/inode.c | 2 +- fs/ceph/mds_client.c | 3 + fs/erofs/zdata.c | 21 +- fs/f2fs/compress.c | 74 +++--- fs/f2fs/f2fs.h | 2 + fs/f2fs/gc.c | 16 +- fs/iomap/buffered-io.c | 15 +- fs/nfs/nfs3proc.c | 7 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 16 +- fs/nfsd/state.h | 17 +- fs/nsfs.c | 21 ++ fs/smb/client/cifsencrypt.c | 3 +- fs/smb/client/cifsfs.c | 7 +- fs/smb/client/cifsglob.h | 11 + fs/smb/client/cifsproto.h | 1 + fs/smb/client/connect.c | 4 + fs/smb/client/dir.c | 1 + fs/smb/client/file.c | 29 +-- fs/smb/client/fs_context.c | 2 +- fs/smb/client/misc.c | 42 ++++ fs/smb/client/smb2ops.c | 14 +- fs/smb/client/smb2pdu.c | 5 +- fs/smb/client/smb2transport.c | 4 +- fs/smb/client/trace.h | 2 + fs/smb/server/Kconfig | 1 + fs/smb/server/auth.c | 26 +- fs/smb/server/oplock.c | 35 ++- fs/smb/server/oplock.h | 5 +- fs/smb/server/smb2pdu.c | 34 ++- fs/tests/exec_kunit.c | 3 - fs/xfs/libxfs/xfs_defer.c | 2 +- fs/xfs/scrub/agheader_repair.c | 13 +- fs/xfs/scrub/alloc_repair.c | 5 +- fs/xfs/scrub/attr_repair.c | 20 +- fs/xfs/scrub/bmap_repair.c | 6 +- fs/xfs/scrub/common.h | 18 -- fs/xfs/scrub/dir.c | 13 +- fs/xfs/scrub/dir_repair.c | 11 +- fs/xfs/scrub/dirtree.c | 11 +- fs/xfs/scrub/ialloc_repair.c | 5 +- fs/xfs/scrub/nlinks.c | 6 +- fs/xfs/scrub/orphanage.c | 7 +- fs/xfs/scrub/parent.c | 11 +- fs/xfs/scrub/parent_repair.c | 23 +- fs/xfs/scrub/quotacheck.c | 13 +- fs/xfs/scrub/refcount_repair.c | 13 +- fs/xfs/scrub/rmap_repair.c | 5 +- fs/xfs/scrub/rtsummary.c | 7 +- fs/xfs/xfs_bmap_item.c | 3 +- fs/xfs/xfs_dquot.c | 8 +- fs/xfs/xfs_log.c | 2 + include/linux/cleanup.h | 19 ++ include/linux/etherdevice.h | 3 +- include/linux/huge_mm.h | 4 + include/linux/if_ether.h | 3 +- include/linux/io_uring_types.h | 3 + include/linux/irq.h | 3 + include/linux/irqchip/arm-gic-v3.h | 1 + include/linux/mlx5/mlx5_ifc.h | 4 +- include/linux/mmc/host.h | 9 +- include/linux/netdev_features.h | 18 ++ include/linux/netdevice.h | 40 +++- include/linux/stmmac.h | 1 - include/linux/trace_recursion.h | 9 + include/linux/uprobes.h | 1 + include/linux/usb.h | 8 +- include/linux/usb/usbnet.h | 1 + include/net/dsa.h | 1 + include/net/ip6_tunnel.h | 14 ++ include/net/ip_tunnels.h | 7 + include/net/netfilter/nf_tables.h | 2 + include/net/sch_generic.h | 33 +++ include/net/tc_act/tc_gate.h | 33 ++- include/net/udp_tunnel.h | 2 +- include/net/xdp.h | 32 +++ include/trace/events/kmem.h | 8 +- include/trace/events/rxrpc.h | 4 + init/Kconfig | 3 + io_uring/kbuf.c | 18 +- io_uring/kbuf.h | 4 +- io_uring/uring_cmd.c | 9 +- kernel/cgroup/cgroup.c | 1 + kernel/events/uprobes.c | 10 +- kernel/fork.c | 2 +- kernel/irq/Kconfig | 6 + kernel/irq/Makefile | 2 +- kernel/irq/kexec.c | 40 ++++ kernel/kprobes.c | 51 ++-- kernel/sched/ext.c | 89 +++++-- kernel/sched/fair.c | 84 ++++--- kernel/sched/idle.c | 39 ++- kernel/time/time.c | 2 +- kernel/trace/ring_buffer.c | 2 +- kernel/trace/trace.c | 12 +- kernel/trace/trace_events.c | 58 +++-- kernel/trace/trace_functions_graph.c | 6 +- kernel/workqueue.c | 2 +- lib/bootconfig.c | 9 +- mm/compaction.c | 2 + mm/internal.h | 3 +- mm/kfence/core.c | 29 ++- mm/page_alloc.c | 59 ++++- mm/shmem.c | 97 ++++++-- net/batman-adv/bat_iv_ogm.c | 3 + net/batman-adv/bat_v_elp.c | 10 +- net/batman-adv/hard-interface.c | 8 +- net/batman-adv/hard-interface.h | 1 + net/bluetooth/hci_conn.c | 4 +- net/bluetooth/hci_sync.c | 2 +- net/bluetooth/hidp/core.c | 16 +- net/bluetooth/l2cap_core.c | 51 ++-- net/bluetooth/mgmt.c | 7 +- net/bluetooth/smp.c | 2 +- net/bridge/br_cfm.c | 4 +- net/ceph/auth.c | 6 +- net/ceph/messenger_v2.c | 31 ++- net/ceph/mon_client.c | 6 +- net/core/dev.c | 98 +++++++- net/core/dev.h | 35 --- net/core/dst.c | 1 + net/core/xdp.c | 56 +++++ net/dsa/dsa.c | 59 +++-- net/ethernet/eth.c | 9 +- net/ipv4/Kconfig | 1 + net/ipv4/icmp.c | 4 +- net/ipv4/ip_gre.c | 3 +- net/ipv4/ip_tunnel_core.c | 15 ++ net/ipv4/nexthop.c | 14 +- net/ipv4/route.c | 4 +- net/ipv4/tcp.c | 3 +- net/ipv4/tcp_ao.c | 3 +- net/ipv4/tcp_ipv4.c | 3 +- net/ipv6/ip6_output.c | 35 +-- net/ipv6/route.c | 4 +- net/ipv6/tcp_ipv6.c | 3 +- net/mac80211/chan.c | 6 +- net/mac80211/debugfs.c | 14 +- net/mac80211/link.c | 2 + net/mac80211/mesh.c | 3 + net/mac802154/iface.c | 4 +- net/mctp/route.c | 13 +- net/mpls/af_mpls.c | 1 + net/mptcp/pm.c | 2 +- net/mptcp/pm_netlink.c | 72 ++++-- net/mptcp/protocol.h | 2 + net/ncsi/ncsi-aen.c | 3 +- net/ncsi/ncsi-rsp.c | 16 +- net/netfilter/nf_bpf_link.c | 2 +- net/netfilter/nf_conntrack_h323_asn1.c | 4 + net/netfilter/nf_conntrack_netlink.c | 67 ++++-- net/netfilter/nf_conntrack_sip.c | 6 +- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_cthelper.c | 8 +- net/netfilter/nfnetlink_osf.c | 13 + net/netfilter/nfnetlink_queue.c | 4 +- net/netfilter/nft_ct.c | 4 + net/netfilter/nft_dynset.c | 10 +- net/netfilter/nft_set_pipapo.c | 3 +- net/netfilter/xt_CT.c | 4 + net/netfilter/xt_IDLETIMER.c | 6 + net/netfilter/xt_dccp.c | 4 +- net/netfilter/xt_tcpudp.c | 6 +- net/netfilter/xt_time.c | 4 +- net/phonet/af_phonet.c | 5 +- net/rose/af_rose.c | 5 + net/rxrpc/recvmsg.c | 19 +- net/sched/act_gate.c | 264 +++++++++++++++------ net/sched/sch_generic.c | 27 --- net/sched/sch_ingress.c | 14 +- net/sched/sch_teql.c | 8 +- net/smc/af_smc.c | 23 +- net/smc/smc.h | 5 + net/smc/smc_close.c | 2 +- net/sunrpc/cache.c | 26 +- net/sunrpc/xprtrdma/verbs.c | 7 +- net/tipc/socket.c | 2 + net/wireless/pmsr.c | 1 + sound/core/pcm_native.c | 19 +- sound/pci/hda/patch_realtek.c | 25 ++ sound/soc/amd/acp3x-rt5682-max9836.c | 9 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/cs42l43-jack.c | 1 + sound/soc/generic/simple-card-utils.c | 48 ++-- sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 1 + sound/soc/qcom/qdsp6/q6apm.c | 1 + sound/soc/soc-core.c | 11 +- sound/usb/endpoint.c | 1 + sound/usb/mixer_scarlett2.c | 2 + sound/usb/quirks.c | 2 + tools/bootconfig/main.c | 7 +- tools/objtool/Makefile | 8 +- tools/perf/builtin-ftrace.c | 9 +- tools/perf/util/annotate.c | 5 +- tools/perf/util/disasm.c | 2 +- .../testing/selftests/hid/progs/hid_bpf_helpers.h | 12 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 43 ++++ 500 files changed, 5178 insertions(+), 2252 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/460 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
[ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ]
This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V:
[ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002
[ 415.140822] INFO: lockdep is turned off.
[ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common
[ 415.140846] Preemption disabled at:
[ 415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
[ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)}
[ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024
[ 415.140857] Call Trace:
[ 415.140861] <TASK>
[ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
[ 415.140863] dump_stack_lvl+0x91/0xb0
[ 415.140870] __schedule_bug+0x9c/0xc0
[ 415.140875] __schedule+0xdf6/0x1300
[ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980
[ 415.140879] ? rcu_is_watching+0x12/0x60
[ 415.140883] schedule_rtlock+0x21/0x40
[ 415.140885] rtlock_slowlock_locked+0x502/0x1980
[ 415.140891] rt_spin_lock+0x89/0x1e0
[ 415.140893] hv_ringbuffer_write+0x87/0x2a0
[ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0
[ 415.140900] ? rcu_is_watching+0x12/0x60
[ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc]
[ 415.140904] ? HARDIRQ_verbose+0x10/0x10
[ 415.140908] ? __rq_qos_issue+0x28/0x40
[ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod]
[ 415.140926] __blk_mq_issue_directly+0x4a/0xc0
[ 415.140928] blk_mq_issue_direct+0x87/0x2b0
[ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440
[ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0
[ 415.140935] __blk_flush_plug+0xf4/0x150
[ 415.140940] __submit_bio+0x2b2/0x5c0
[ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360
[ 415.140946] submit_bio_noacct_nocheck+0x272/0x360
[ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4]
[ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4]
[ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4]
[ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4]
[ 415.141060] generic_perform_write+0x14e/0x2c0
[ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4]
[ 415.141083] vfs_write+0x2ca/0x570
[ 415.141087] ksys_write+0x76/0xf0
[ 415.141089] do_syscall_64+0x99/0x1490
[ 415.141093] ? rcu_is_watching+0x12/0x60
[ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0
[ 415.141097] ? rcu_is_watching+0x12/0x60
[ 415.141098] ? lock_release+0x1f0/0x2a0
[ 415.141100] ? rcu_is_watching+0x12/0x60
[ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0
[ 415.141103] ? rcu_is_watching+0x12/0x60
[ 415.141104] ? __schedule+0xb34/0x1300
[ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170
[ 415.141109] ? do_nanosleep+0x8b/0x160
[ 415.141111] ? hrtimer_nanosleep+0x89/0x100
[ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 415.141116] ? xfd_validate_state+0x26/0x90
[ 415.141118] ? rcu_is_watching+0x12/0x60
[ 415.141120] ? do_syscall_64+0x1e0/0x1490
[ 415.141121] ? do_syscall_64+0x1e0/0x1490
[ 415.141123] ? rcu_is_watching+0x12/0x60
[ 415.141124] ? do_syscall_64+0x1e0/0x1490
[ 415.141125] ? do_syscall_64+0x1e0/0x1490
[ 415.141127] ? irqentry_exit+0x140/0x7e0
[ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7eget_cpu() disables preemption while the spinlock hv_ringbuffer_write is using is converted to an rt-mutex under PREEMPT_RT.
--- drivers/scsi/storvsc_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/storvsc_drv.c +3 -2
@@ -1861,8 +1861,9 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) cmd_request->payload_sz = payload_sz;/* Invokes the vsc to start an IO */ - ret =storvsc_do_io (dev, cmd_request,get_cpu ()); -put_cpu (); +migrate_disable (); + ret =storvsc_do_io (dev, cmd_request,smp_processor_id ()); +migrate_enable ();if (ret)scsi_dma_unmap (scmnd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/460 ACPI: PM: Save NVS memory on Lenovo G70-35
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Mazek <[email protected]>
[ Upstream commit 023cd6d90f8aa2ef7b72d84be84a18e61ecebd64 ]
[821d6f0359b0614792ab8e2fb93b503e25a65079] prevented machines produced later than 2012 from saving NVS region to accelerate S3.
Despite being made after 2012, Lenovo G70-35 still needs NVS memory saving during S3. A quirk is introduced for this platform.
--- drivers/acpi/sleep.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/sleep.c +8 -0
@@ -386,6 +386,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { DMI_MATCH(DMI_PRODUCT_NAME, "80E1"), }, }, + { + .callback = init_nvs_save_s3, + .ident = "Lenovo G70-35", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "80Q5"), + }, + },/* * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using * the Low Power S0 Idle firmware interface (see
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/460 scsi: mpi3mr: Add NULL checks when resetting request and reply queues
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
[ Upstream commit fa96392ebebc8fade2b878acb14cce0f71016503 ]
The driver encountered a crash during resource cleanup when the reply and request queues were NULL due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first, but attempted to mem set the content of the freed memory, leading to a system crash.
Add NULL pointer checks for reply and request queues before accessing the reply/request memory during cleanup
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 34 ++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +19 -15
@@ -4677,21 +4677,25 @@ void mpi3mr_memset_buffers(struct mpi3mr_ioc *mrioc) }for (i =0 ; i < mrioc->num_queues; i++) { - mrioc->op_reply_qinfo[i].qid =0 ; - mrioc->op_reply_qinfo[i].ci =0 ; - mrioc->op_reply_qinfo[i].num_replies =0 ; - mrioc->op_reply_qinfo[i].ephase =0 ; -atomic_set (&mrioc->op_reply_qinfo[i].pend_ios,0 ); -atomic_set (&mrioc->op_reply_qinfo[i].in_use,0 ); -mpi3mr_memset_op_reply_q_buffers (mrioc, i); - - mrioc->req_qinfo[i].ci =0 ; - mrioc->req_qinfo[i].pi =0 ; - mrioc->req_qinfo[i].num_requests =0 ; - mrioc->req_qinfo[i].qid =0 ; - mrioc->req_qinfo[i].reply_qid =0 ; -spin_lock_init (&mrioc->req_qinfo[i].q_lock); -mpi3mr_memset_op_req_q_buffers (mrioc, i); +if (mrioc->op_reply_qinfo) { + mrioc->op_reply_qinfo[i].qid =0 ; + mrioc->op_reply_qinfo[i].ci =0 ; + mrioc->op_reply_qinfo[i].num_replies =0 ; + mrioc->op_reply_qinfo[i].ephase =0 ; +atomic_set (&mrioc->op_reply_qinfo[i].pend_ios,0 ); +atomic_set (&mrioc->op_reply_qinfo[i].in_use,0 ); +mpi3mr_memset_op_reply_q_buffers (mrioc, i); + } + +if (mrioc->req_qinfo) { + mrioc->req_qinfo[i].ci =0 ; + mrioc->req_qinfo[i].pi =0 ; + mrioc->req_qinfo[i].num_requests =0 ; + mrioc->req_qinfo[i].qid =0 ; + mrioc->req_qinfo[i].reply_qid =0 ; +spin_lock_init (&mrioc->req_qinfo[i].q_lock); +mpi3mr_memset_op_req_q_buffers (mrioc, i); + } }atomic_set (&mrioc->pend_large_data_sz,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/460 ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Rhodes <[email protected]>
[ Upstream commit 1cb3c20688fc8380c9b365d03aea7e84faf6a9fd ]
On Star Labs StarFighter (Realtek ALC233/235), the internal speakers can emit an audible pop when entering or leaving runtime suspend.
Mute the speaker output paths via snd_hda_gen_shutup_speakers() in the Realtek shutup callback before the codec is powered down.
This is enough to avoid the pop without special EAPD handling.
Test results:
- runtime PM pop fixed
- still reaches D3 (PCI 0000:00:1f.3 power_state=D3hot)
- does not address pops on cold boot (G3 exit) or around display manager start/shutdown
journalctl -k (boot):
- snd_hda_codec_alc269 hdaudioC0D0: ALC233: picked fixup for PCI SSID 7017:2014
- snd_hda_codec_alc269 hdaudioC0D0: autoconfig for ALC233: line_outs=1 (0x1b/0x0/0x0/0x0/0x0) type:speaker
--- sound/pci/hda/patch_realtek.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
sound/pci/hda/patch_realtek.c +25 -0
@@ -4164,6 +4164,24 @@ static int alc269_resume(struct hda_codec *codec)return 0 ; } +#define STARLABS_STARFIGHTER_SHUTUP_DELAY_MS 30 + +static void starlabs_starfighter_shutup (struct hda_codec *codec) +{ +if (snd_hda_gen_shutup_speakers (codec)) +msleep (STARLABS_STARFIGHTER_SHUTUP_DELAY_MS ); +} + +static void alc233_fixup_starlabs_starfighter (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +struct alc_spec *spec = codec->spec; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) + spec->shutup = starlabs_starfighter_shutup; +} +static void alc269_fixup_pincfg_no_hp_to_lineout (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -8203,6 +8221,7 @@ enum {ALC245_FIXUP_CLEVO_NOISY_MIC ,ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE ,ALC233_FIXUP_MEDION_MTL_SPK , +ALC233_FIXUP_STARLABS_STARFIGHTER ,ALC294_FIXUP_BASS_SPEAKER_15 ,ALC283_FIXUP_DELL_HP_RESUME , ALC294_FIXUP_ASUS_CS35L41_SPI_2,
@@ -10591,6 +10610,10 @@ static const struct hda_fixup alc269_fixups[] = { { } }, }, + [ALC233_FIXUP_STARLABS_STARFIGHTER] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc233_fixup_starlabs_starfighter, + }, [ALC294_FIXUP_BASS_SPEAKER_15] = { .type = HDA_FIXUP_FUNC, .v.func = alc294_fixup_bass_speaker_15,
@@ -11606,6 +11629,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x2782 ,0x1705 ,"MEDION E15433" ,ALC269VC_FIXUP_INFINIX_Y4_MAX ),SND_PCI_QUIRK (0x2782 ,0x1707 ,"Vaio VJFE-ADL" ,ALC298_FIXUP_SPK_VOLUME ),SND_PCI_QUIRK (0x2782 ,0x4900 ,"MEDION E15443" ,ALC233_FIXUP_MEDION_MTL_SPK ), +SND_PCI_QUIRK (0x7017 ,0x2014 ,"Star Labs StarFighter" ,ALC233_FIXUP_STARLABS_STARFIGHTER ),SND_PCI_QUIRK (0x8086 ,0x2074 ,"Intel NUC 8" ,ALC233_FIXUP_INTEL_NUC8_DMIC ),SND_PCI_QUIRK (0x8086 ,0x2080 ,"Intel NUC 8 Rugged" ,ALC256_FIXUP_INTEL_NUC8_RUGGED ), SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
@@ -11702,6 +11726,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC298_FIXUP_TPT470_DOCK_FIX, .name = "tpt470-dock-fix"}, {.id = ALC298_FIXUP_TPT470_DOCK, .name = "tpt470-dock"}, {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"}, + {.id = ALC233_FIXUP_STARLABS_STARFIGHTER, .name = "starlabs-starfighter"}, {.id = ALC700_FIXUP_INTEL_REFERENCE, .name = "alc700-ref"}, {.id = ALC269_FIXUP_SONY_VAIO, .name = "vaio"}, {.id = ALC269_FIXUP_DELL_M101Z, .name = "dell-m101z"},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/460 unshare: fix unshare_fs() handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 6c4b2243cb6c0755159bd567130d5e12e7b10d9f ]
There's an unpleasant corner case in unshare(2), when we have a CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that case copy_mnt_ns() gets passed current->fs instead of a private copy, which causes interesting warts in proof of correctness]
Quoted 1 line
I guess if private means
fs->users== 1, the condition could still be true.
Unfortunately, it's worse than just a convoluted proof of correctness. Consider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS (and current->fs->users == 1).
We pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and flips current->fs->{pwd,root} to corresponding locations in the new namespace. Now we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM). We call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's destroyed and its mount tree is dissolved, but... current->fs->root and current->fs->pwd are both left pointing to now detached mounts.
They are pinning those, so it's not a UAF, but it leaves the calling process with unshare(2) failing with -ENOMEM _and_ leaving it with pwd and root on detached isolated mounts. The last part is clearly a bug.
There is other fun related to that mess (races with pivot_root(), including the one between pivot_root() and fork(), of all things), but this one is easy to isolate and fix - treat CLONE_NEWNS as "allocate a new fs_struct even if it hadn't been shared in the first place". Sure, we could go for something like "if both CLONE_NEWNS *and* one of the things that might end up failing after copy_mnt_ns() call in create_new_namespaces() are set, force allocation of new fs_struct", but let's keep it simple - the cost of copy_fs_struct() is trivial.
Another benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets a freshly allocated fs_struct, yet to be attached to anything. That seriously simplifies the analysis...
FWIW, that bug had been there since the introduction of unshare(2) ;-/
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -3248,7 +3248,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)return 0 ;/* don't need lock here; in the worst case we'll do useless copy */ -if (fs->users ==1 ) +if (!(unshare_flags &CLONE_NEWNS ) && fs->users ==1 )return 0 ; *new_fsp =copy_fs_struct (fs);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/460 wifi: mac80211: set default WMM parameters on all links
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramanathan Choodamani <[email protected]>
[ Upstream commit 2259d14499d16b115ef8d5d2ddc867e2be7cb5b5 ]
Currently, mac80211 only initializes default WMM parameters on the deflink during do_open(). For MLO cases, this leaves the additional links without proper WMM defaults if hostapd does not supply per-link WMM parameters, leading to inconsistent QoS behavior across links.
Set default WMM parameters for each link during ieee80211_vif_update_links(), because this ensures all individual links in an MLD have valid WMM settings during bring-up and behave consistently across different BSS.
--- net/mac80211/link.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/link.c +2 -0
@@ -283,6 +283,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS ];struct ieee80211_link_data *old_data[IEEE80211_MLD_MAX_NUM_LINKS ];bool use_deflink = old_links ==0 ;/* set for error case */ +bool non_sta = sdata->vif.type !=NL80211_IFTYPE_STATION ;lockdep_assert_wiphy (sdata->local->hw.wiphy);
@@ -339,6 +340,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata, link = links[link_id];ieee80211_link_init (sdata, link_id, &link->data, &link->conf);ieee80211_link_setup (&link->data); +ieee80211_set_wmm_default (&link->data, true, non_sta); }if (new_links ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/460 ACPI: OSI: Add DMI quirk for Acer Aspire One D255
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sofia Schneider <[email protected]>
[ Upstream commit 5ede90206273ff156a778254f0f972a55e973c89 ]
The screen backlight turns off during boot (specifically during udev device initialization) when returning true for _OSI("Windows 2009").
Analyzing the device's DSDT reveals that the firmware takes a different code path when Windows 7 is reported, which leads to the backlight shutoff. Add a DMI quirk to invoke dmi_disable_osi_win7 for this model.
--- drivers/acpi/osi.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/acpi/osi.c +13 -0
@@ -389,6 +389,19 @@ static const struct dmi_system_id acpi_osi_dmi_table[] __initconst = { }, }, +/* +* The screen backlight turns off during udev device creation +* when returning true for _OSI("Windows 2009") +*/ + { + .callback = dmi_disable_osi_win7, + .ident = "Acer Aspire One D255", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "AOD255"), + }, + }, + /* * The wireless hotkey does not work on those machines when * returning true for _OSI("Windows 2012")
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/460 scsi: ses: Fix devices attaching to different hosts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Henzl <[email protected]>
[ Upstream commit 70ca8caa96ce473647054f5c7b9dab5423902402 ]
On a multipath SAS system some devices don't end up with correct symlinks from the SCSI device to its enclosure. Some devices even have enclosure links pointing to enclosures attached to different SCSI hosts.
ses_match_to_enclosure() calls enclosure_for_each_device() which iterates over all enclosures on the system, not just enclosures attached to the current SCSI host.
Replace the iteration with a direct call to ses_enclosure_find_by_addr().
--- drivers/scsi/ses.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/scsi/ses.c +2 -3
@@ -529,9 +529,8 @@ struct efd { };static int ses_enclosure_find_by_addr (struct enclosure_device *edev, -void *data) +struct efd *efd) { -struct efd *efd = data;int i;struct ses_component *scomp;
@@ -684,7 +683,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,if (efd.addr) { efd.dev = &sdev->sdev_gendev; -enclosure_for_each_device (ses_enclosure_find_by_addr, &efd); +ses_enclosure_find_by_addr (edev, &efd); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/460 ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azamat Almazbek uulu <[email protected]>
[ Upstream commit 32fc4168fa56f6301d858c778a3d712774e9657e ]
The ASUS ExpertBook BM1503CDA (Ryzen 5 7535U, Barcelo-R) has an internal DMIC connected through the AMD ACP (Audio CoProcessor) but is missing from the DMI quirk table, so the acp6x machine driver probe returns -ENODEV and no DMIC capture device is created.
Add the DMI entry so the internal microphone works out of the box.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -696,6 +696,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Vivobook_ASUSLaptop M6501RR_M6501RR"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK BM1503CDA"), + } + }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/460 ASoC: cs42l43: Report insert for exotic peripherals
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 6510e1324bcdc8caf21f6d17efe27604c48f0d64 ]
For some exotic peripherals the type detect can return a reserved value of 0x4. This will currently return an error and not report anything to user-space, update this to report the insert normally.
--- sound/soc/codecs/cs42l43-jack.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/cs42l43-jack.c +1 -0
@@ -711,6 +711,7 @@ static int cs42l43_run_type_detect(struct cs42l43_codec *priv)switch (type &CS42L43_HSDET_TYPE_STS_MASK ) {case 0x0 :// CTIA case 0x1 :// OMTP +case 0x4 :return cs42l43_run_load_detect (priv, true);case 0x2 :// 3-pole return cs42l43_run_load_detect (priv, false);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/460 scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 30df81f2228d65bddf492db3929d9fcaffd38fc5 ]
The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq->id. This can happen if ufshcd_mcq_req_to_hwq() returns NULL.
This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash.
Kernel log excerpt:
[<ffffffd5d192dc4c>] notify_die+0x4c/0x8c [<ffffffd5d1814e58>] __die+0x60/0xb0 [<ffffffd5d1814d64>] die+0x4c/0xe0 [<ffffffd5d181575c>] die_kernel_fault+0x74/0x88 [<ffffffd5d1864db4>] __do_kernel_fault+0x314/0x318 [<ffffffd5d2a3cdf8>] do_page_fault+0xa4/0x5f8 [<ffffffd5d2a3cd34>] do_translation_fault+0x34/0x54 [<ffffffd5d1864524>] do_mem_abort+0x50/0xa8 [<ffffffd5d2a297dc>] el1_abort+0x3c/0x64 [<ffffffd5d2a29718>] el1h_64_sync_handler+0x44/0xcc [<ffffffd5d181133c>] el1h_64_sync+0x80/0x88 [<ffffffd5d255c1dc>] ufshcd_add_command_trace+0x23c/0x320 [<ffffffd5d255bad8>] ufshcd_compl_one_cqe+0xa4/0x404 [<ffffffd5d2572968>] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [<ffffffd5d11c7460>] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [<ffffffd5d19ab92c>] __handle_irq_event_percpu+0xc8/0x348 [<ffffffd5d19abca8>] handle_irq_event+0x3c/0xa8 [<ffffffd5d19b1f0c>] handle_fasteoi_irq+0xf8/0x294 [<ffffffd5d19aa778>] generic_handle_domain_irq+0x54/0x80 [<ffffffd5d18102bc>] gic_handle_irq+0x1d4/0x330 [<ffffffd5d1838210>] call_on_irq_stack+0x44/0x68 [<ffffffd5d183af30>] do_interrupt_handler+0x78/0xd8 [<ffffffd5d2a29c00>] el1_interrupt+0x48/0xa8 [<ffffffd5d2a29ba8>] el1h_64_irq_handler+0x14/0x24 [<ffffffd5d18113c4>] el1h_64_irq+0x80/0x88 [<ffffffd5d2527fb4>] arch_local_irq_enable+0x4/0x1c [<ffffffd5d25282e4>] cpuidle_enter+0x34/0x54 [<ffffffd5d195a678>] do_idle+0x1dc/0x2f8 [<ffffffd5d195a7c4>] cpu_startup_entry+0x30/0x3c [<ffffffd5d18155c4>] secondary_start_kernel+0x134/0x1ac [<ffffffd5d18640bc>] __secondary_switched+0xc4/0xcc
--- drivers/ufs/core/ufshcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ufs/core/ufshcd.c +2 -2
@@ -483,8 +483,8 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,if (hba->mcq_enabled) {struct ufs_hw_queue *hwq =ufshcd_mcq_req_to_hwq (hba, rq); - - hwq_id = hwq->id; +if (hwq) + hwq_id = hwq->id; }else { doorbell =ufshcd_readl (hba,REG_UTP_TRANSFER_REQ_DOOR_BELL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/460 scsi: ufs: core: Fix shift out of bounds when MAXQ=32
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangshuaiwei <[email protected]>
[ Upstream commit 2f38fd99c0004676d835ae96ac4f3b54edc02c82 ]
According to JESD223F, the maximum number of queues (MAXQ) is 32. When MCQ is enabled and ESI is disabled, nr_hw_queues=32 causes a shift overflow problem.
Fix this by using 64-bit intermediate values to handle the nr_hw_queues=32 case safely.
--- drivers/ufs/core/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +1 -1
@@ -6974,7 +6974,7 @@ static irqreturn_t ufshcd_handle_mcq_cq_events(struct ufs_hba *hba) ret =ufshcd_vops_get_outstanding_cqs (hba, &outstanding_cqs);if (ret) - outstanding_cqs = (1U << hba->nr_hw_queues) -1 ; + outstanding_cqs = (1ULL << hba->nr_hw_queues) -1 ;/* Exclude the poll queues */ nr_queues = hba->nr_hw_queues - hba->nr_queues[HCTX_TYPE_POLL ];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/460 ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c5bf24c8aba1ff711226ee0f039ff01a5754692b ]
Although DIYINHK USB Audio 2.0 (ID 20b1:2009) shows the implicit feedback source for the capture stream, this would cause several problems for the playback. Namely, the device can get wMaxPackSize 1024 for 24/32 bit format with 6 channels, and when a high sample rate like 352.8kHz or 384kHz is played, the packet size overflows the max limit. Also, the device has another two playback altsets, and those aren't properly handled with the implicit feedback.
Since the device has been working well even before introducing the implicit feedback, we can assume that it works fine in the async mode. This patch adds the explicit skip of the implicit fb detection to make the playback running in the async mode.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2351,6 +2351,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),DEVICE_FLG (0x2040 ,0x7281 ,/* Hauppauge HVR-950Q-MXL */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ), +DEVICE_FLG (0x20b1 ,0x2009 ,/* XMOS Ltd DIYINHK USB Audio 2.0 */ +QUIRK_FLAG_SKIP_IMPLICIT_FB |QUIRK_FLAG_DSD_RAW ),DEVICE_FLG (0x2040 ,0x8200 ,/* Hauppauge Woodbury */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ), DEVICE_FLG(0x21b4, 0x0081, /* AudioQuest DragonFly */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/460 drm/amdgpu/vcn5: Add SMU dpm interface type
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: sguttula <[email protected]>
[ Upstream commit a5fe1a54513196e4bc8f9170006057dc31e7155e ]
This will set AMDGPU_VCN_SMU_DPM_INTERFACE_* smu_type based on soc type and fixing ring timeout issue seen for DPM enabled case.
--- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c +4 -0
@@ -166,6 +166,10 @@ static int vcn_v5_0_0_sw_init(void *handle) fw_shared->present_flag_0 =cpu_to_le32 (AMDGPU_FW_SHARED_FLAG_0_UNIFIED_QUEUE ); fw_shared->sq.is_enabled =1 ; + fw_shared->present_flag_0 |=cpu_to_le32 (AMDGPU_VCN_SMU_DPM_INTERFACE_FLAG ); + fw_shared->smu_dpm_interface.smu_interface_type = (adev->flags &AMD_IS_APU ) ? +AMDGPU_VCN_SMU_DPM_INTERFACE_APU :AMDGPU_VCN_SMU_DPM_INTERFACE_DGPU ; +if (amdgpu_vcnfw_log)amdgpu_vcn_fwlog_init (&adev->vcn.inst[i]); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/460 ALSA: usb-audio: Check max frame size for implicit feedback mode, too
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7cb2a5422f5bbdf1cf32eae0eda41000485b9346 ]
When the packet sizes are taken from the capture stream in the implicit feedback mode, the sizes might be larger than the upper boundary defined by the descriptor. As already done for other transfer modes, we have to cap the sizes accordingly at sending, otherwise this would lead to an error in USB core at submission of URBs.
--- sound/usb/endpoint.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/endpoint.c +1 -0
@@ -224,6 +224,7 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep, packet = ctx->packet_size[idx];if (packet) { + packet =min (packet, ep->maxframesize);if (avail && packet >= avail)return -EAGAIN ;return packet;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/460 powerpc/uaccess: Fix inline assembly for clang build on PPC32
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy (CS GROUP) <[email protected]>
[ Upstream commit 0ee95a1d458630272d0415d0ffa9424fcb606c90 ]
Test robot reports the following error with clang-16.0.6:
In file included from kernel/rseq.c:75:
include/linux/rseq_entry.h:141:3: error: invalid operand for instruction
unsafe_get_user(offset, &ucs->post_commit_offset, efault);
^
include/linux/uaccess.h:608:2: note: expanded from macro 'unsafe_get_user'
arch_unsafe_get_user(x, ptr, local_label); \
^
arch/powerpc/include/asm/uaccess.h:518:2: note: expanded from macro 'arch_unsafe_get_user'
__get_user_size_goto(__gu_val, __gu_addr, sizeof(*(p)), e); \
^
arch/powerpc/include/asm/uaccess.h:284:2: note: expanded from macro '__get_user_size_goto'
__get_user_size_allowed(x, ptr, size, __gus_retval); \
^
arch/powerpc/include/asm/uaccess.h:275:10: note: expanded from macro '__get_user_size_allowed'
case 8: __get_user_asm2(x, (u64 __user *)ptr, retval); break; \
^
arch/powerpc/include/asm/uaccess.h:258:4: note: expanded from macro '__get_user_asm2'
" li %1+1,0\n" \
^
<inline asm>:7:5: note: instantiated into assembly here
li 31+1,0
^
1 error generated.On PPC32, for 64 bits vars a pair of registers is used. Usually the lower register in the pair is the high part and the higher register is the low part. GCC uses r3/r4 ... r11/r12 ... r14/r15 ... r30/r31
In older kernel code inline assembly was using %1 and %1+1 to represent 64 bits values. However here it looks like clang uses r31 as high part, allthough r32 doesn't exist hence the error.
Allthoug %1+1 should work, most places now use %L1 instead of %1+1, so let's do the same here.
With that change, the build doesn't fail anymore and a disassembly shows clang uses r17/r18 and r31/r14 pair when GCC would have used r16/r17 and r30/r31:
Disassembly of section .fixup: 00000000 <.fixup>: 0: 38 a0 ff f2 li r5,-14 4: 3a 20 00 00 li r17,0 8: 3a 40 00 00 li r18,0 c: 48 00 00 00 b c <.fixup+0xc> c: R_PPC_REL24 .text+0xbc 10: 38 a0 ff f2 li r5,-14 14: 3b e0 00 00 li r31,0 18: 39 c0 00 00 li r14,0 1c: 48 00 00 00 b 1c <.fixup+0x1c> 1c: R_PPC_REL24 .text+0x144
--- arch/powerpc/include/asm/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/uaccess.h +1 -1
@@ -253,7 +253,7 @@ __gus_failed: \".section .fixup,\"ax\"\n" \"4: li %0,%3\n" \" li %1,0\n" \ -" li %1+1,0\n" \ +" li %L1,0\n" \" b 3b\n" \".previous\n" \EX_TABLE (1b ,4b ) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/460 kexec: Consolidate machine_kexec_mask_interrupts() implementation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliav Farber <[email protected]>
[ Upstream commit bad6722e478f5b17a5ceb039dfb4c680cf2c0b48 ]
Consolidate the machine_kexec_mask_interrupts implementation into a common function located in a new file: kernel/irq/kexec.c. This removes duplicate implementations from architecture-specific files in arch/arm, arch/arm64, arch/powerpc, and arch/riscv, reducing code duplication and improving maintainability.
The new implementation retains architecture-specific behavior for CONFIG_GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD, which was previously implemented for ARM64. When enabled (currently for ARM64), it clears the active state of interrupts forwarded to virtual machines (VMs) before handling other interrupt masking operations.
Stable-dep-of: 20197b967a6a ("powerpc/kexec/core: use big-endian types for crash variables")
--- arch/arm/kernel/machine_kexec.c | 23 ------------------ arch/arm64/Kconfig | 1 + arch/arm64/kernel/machine_kexec.c | 31 ------------------------ arch/powerpc/include/asm/kexec.h | 1 - arch/powerpc/kexec/core.c | 22 ----------------- arch/powerpc/kexec/core_32.c | 1 + arch/riscv/kernel/machine_kexec.c | 23 ------------------ include/linux/irq.h | 3 +++ kernel/irq/Kconfig | 6 +++++ kernel/irq/Makefile | 2 +- kernel/irq/kexec.c | 40 +++++++++++++++++++++++++++++++ 11 files changed, 52 insertions(+), 101 deletions(-) create mode 100644 kernel/irq/kexec.c
arch/arm/kernel/machine_kexec.c +0 -23
@@ -127,29 +127,6 @@ void crash_smp_send_stop(void) cpus_stopped =1 ; } -static void machine_kexec_mask_interrupts (void ) -{ -unsigned int i; -struct irq_desc *desc; - -for_each_irq_desc (i, desc) { -struct irq_chip *chip; - - chip =irq_desc_get_chip (desc); -if (!chip) -continue ; - -if (chip->irq_eoi &&irqd_irq_inprogress (&desc->irq_data)) - chip->irq_eoi (&desc->irq_data); - -if (chip->irq_mask) - chip->irq_mask (&desc->irq_data); - -if (chip->irq_disable && !irqd_irq_disabled (&desc->irq_data)) - chip->irq_disable (&desc->irq_data); - } -} -void machine_crash_shutdown (struct pt_regs *regs) {local_irq_disable ();
arch/arm64/Kconfig +1 -0
@@ -146,6 +146,7 @@ config ARM64 select GENERIC_IDLE_POLL_SETUP select GENERIC_IOREMAP select GENERIC_IRQ_IPI + select GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD select GENERIC_IRQ_PROBE select GENERIC_IRQ_SHOW select GENERIC_IRQ_SHOW_LEVEL
arch/arm64/kernel/machine_kexec.c +0 -31
@@ -207,37 +207,6 @@ void machine_kexec(struct kimage *kimage)BUG ();/* Should never get here. */ } -static void machine_kexec_mask_interrupts (void ) -{ -unsigned int i; -struct irq_desc *desc; - -for_each_irq_desc (i, desc) { -struct irq_chip *chip; -int ret; - - chip =irq_desc_get_chip (desc); -if (!chip) -continue ; - -/* -* First try to remove the active state. If this -* fails, try to EOI the interrupt. -*/ - ret =irq_set_irqchip_state (i,IRQCHIP_STATE_ACTIVE , false); - -if (ret &&irqd_irq_inprogress (&desc->irq_data) && - chip->irq_eoi) - chip->irq_eoi (&desc->irq_data); - -if (chip->irq_mask) - chip->irq_mask (&desc->irq_data); - -if (chip->irq_disable && !irqd_irq_disabled (&desc->irq_data)) - chip->irq_disable (&desc->irq_data); - } -} -/** * machine_crash_shutdown - shutdown non-crashing cpus and save registers */
arch/powerpc/include/asm/kexec.h +0 -1
@@ -61,7 +61,6 @@ struct pt_regs;extern void kexec_smp_wait (void );/* get and clear naca physid, wait for master to copy new code to 0 */ extern void default_machine_kexec (struct kimage *image); -extern void machine_kexec_mask_interrupts (void );void relocate_new_kernel (unsigned long indirection_page,unsigned long reboot_code_buffer,unsigned long start_address)__noreturn ;
arch/powerpc/kexec/core.c +0 -22
@@ -22,28 +22,6 @@#include <asm/setup.h> #include <asm/firmware.h> -void machine_kexec_mask_interrupts (void ) { -unsigned int i; -struct irq_desc *desc; - -for_each_irq_desc (i, desc) { -struct irq_chip *chip; - - chip =irq_desc_get_chip (desc); -if (!chip) -continue ; - -if (chip->irq_eoi &&irqd_irq_inprogress (&desc->irq_data)) - chip->irq_eoi (&desc->irq_data); - -if (chip->irq_mask) - chip->irq_mask (&desc->irq_data); - -if (chip->irq_disable && !irqd_irq_disabled (&desc->irq_data)) - chip->irq_disable (&desc->irq_data); - } -} -#ifdef CONFIG_CRASH_DUMP void machine_crash_shutdown (struct pt_regs *regs) {
arch/powerpc/kexec/core_32.c +1 -0
@@ -7,6 +7,7 @@* Copyright (C) 2005 IBM Corporation. */ +#include <linux/irq.h> #include <linux/kexec.h> #include <linux/mm.h> #include <linux/string.h>
arch/riscv/kernel/machine_kexec.c +0 -23
@@ -114,29 +114,6 @@ void machine_shutdown(void)#endif } -static void machine_kexec_mask_interrupts (void ) -{ -unsigned int i; -struct irq_desc *desc; - -for_each_irq_desc (i, desc) { -struct irq_chip *chip; - - chip =irq_desc_get_chip (desc); -if (!chip) -continue ; - -if (chip->irq_eoi &&irqd_irq_inprogress (&desc->irq_data)) - chip->irq_eoi (&desc->irq_data); - -if (chip->irq_mask) - chip->irq_mask (&desc->irq_data); - -if (chip->irq_disable && !irqd_irq_disabled (&desc->irq_data)) - chip->irq_disable (&desc->irq_data); - } -} -/* * machine_crash_shutdown - Prepare to kexec after a kernel crash *
include/linux/irq.h +3 -0
@@ -694,6 +694,9 @@ extern int irq_chip_request_resources_parent(struct irq_data *data);extern void irq_chip_release_resources_parent (struct irq_data *data);#endif +/* Disable or mask interrupts during a kernel kexec */ +extern void machine_kexec_mask_interrupts (void ); +/* Handling of unhandled and spurious interrupts: */ extern void note_interrupt (struct irq_desc *desc,irqreturn_t action_ret);
kernel/irq/Kconfig +6 -0
@@ -141,6 +141,12 @@ config GENERIC_IRQ_DEBUGFS If you don't know what to do here, say N. +# Clear forwarded VM interrupts during kexec. +# This option ensures the kernel clears active states for interrupts +# forwarded to virtual machines (VMs) during a machine kexec. +config GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD + bool + endmenu config GENERIC_IRQ_MULTI_HANDLER
kernel/irq/Makefile +1 -1
@@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 -obj-y := irqdesc.o handle.o manage.o spurious.o resend.o chip.o dummychip.o devres.o +obj-y := irqdesc.o handle.o manage.o spurious.o resend.o chip.o dummychip.o devres.o kexec.o obj-$(CONFIG_IRQ_TIMINGS) += timings.o ifeq ($(CONFIG_TEST_IRQ_TIMINGS),y) CFLAGS_timings.o += -DDEBUG
kernel/irq/kexec.c new file +40 -0
@@ -0,0 +1,40 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/interrupt.h> +#include <linux/irq.h> +#include <linux/irqdesc.h> +#include <linux/irqnr.h> + +#include "internals.h" + +void machine_kexec_mask_interrupts (void ) +{ +struct irq_desc *desc; +unsigned int i; + +for_each_irq_desc (i, desc) { +struct irq_chip *chip; +int check_eoi =1 ; + + chip =irq_desc_get_chip (desc); +if (!chip) +continue ; + +if (IS_ENABLED (CONFIG_GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD )) { +/* +* First try to remove the active state from an interrupt which is forwarded +* to a VM. If the interrupt is not forwarded, try to EOI the interrupt. +*/ + check_eoi =irq_set_irqchip_state (i,IRQCHIP_STATE_ACTIVE , false); + } + +if (check_eoi && chip->irq_eoi &&irqd_irq_inprogress (&desc->irq_data)) + chip->irq_eoi (&desc->irq_data); + +if (chip->irq_mask) + chip->irq_mask (&desc->irq_data); + +if (chip->irq_disable && !irqd_irq_disabled (&desc->irq_data)) + chip->irq_disable (&desc->irq_data); + } +}
Signature · 1 line
2.51.0
Re: [PATCH 6.12 017/460] kexec: Consolidate machine_kexec_mask_interrupts() implementation
Quoted 21 lines · On Mon, 23 Mar 2026 14:40:13 +0100 Greg Kroah-Hartman…
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliav Farber <[email protected]>
[ Upstream commit
bad6722e478f5b17a5ceb039dfb4c680cf2c0b48]Consolidate the
machine_kexec_mask_interruptsimplementation into a common function located in a new file:kernel/irq/kexec.c. This removes duplicate implementations from architecture-specific files inarch/arm,arch/arm64,arch/powerpc, andarch/riscv, reducing code duplication and improving maintainability.The new implementation retains architecture-specific behavior for
CONFIG_GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD, which was previously implemented for ARM64. When enabled (currently for ARM64), it clears the active state of interrupts forwarded to virtual machines (VMs) before handling other interrupt masking operations.
Quoted 5 lines
Signed-off-by Eliav Farber <[email protected]>Signed-off-by Thomas Gleixner <[email protected]>Stable-dep-of:
20197b967a6a("powerpc/kexec/core: use big-endian types for crash variables")Signed-off-by Sasha Levin <[email protected]>
Please see my note at:
https://lore.kernel.org/stable/[email protected]/
I hope that helps!
Cheers,
Miguel
Greg Kroah-Hartman
maintainerPATCH 18/460 kexec: Include kernel-end even without crashkernel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Collins <[email protected]>
[ Upstream commit 38c64dfe0af12778953846df5f259e913275cfe5 ]
Certain versions of kexec don't even work without kernel-end being added to the device-tree. Add it even if crash-kernel is disabled.
Stable-dep-of: 20197b967a6a ("powerpc/kexec/core: use big-endian types for crash variables")
--- arch/powerpc/kexec/core.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
arch/powerpc/kexec/core.c +15 -12
@@ -22,6 +22,8 @@#include <asm/setup.h> #include <asm/firmware.h> +#define cpu_to_be_ulong __PASTE(cpu_to_be, BITS_PER_LONG) +#ifdef CONFIG_CRASH_DUMP void machine_crash_shutdown (struct pt_regs *regs) {
@@ -156,17 +158,10 @@ int __init overlaps_crashkernel(unsigned long start, unsigned long size) }/* Values we need to export to the second kernel via the device tree. */ -static phys_addr_t kernel_end;static phys_addr_t crashk_base;static phys_addr_t crashk_size;static unsigned long long mem_limit; -static struct property kernel_end_prop = { - .name ="linux,kernel-end" , - .length =sizeof (phys_addr_t), - .value = &kernel_end, -}; -static struct property crashk_base_prop = { .name ="linux,crashkernel-base" , .length =sizeof (phys_addr_t),
@@ -185,8 +180,6 @@ static struct property memory_limit_prop = { .value = &mem_limit, }; -#define cpu_to_be_ulong __PASTE(cpu_to_be, BITS_PER_LONG) -static void __init export_crashk_values (struct device_node *node) {/* There might be existing crash kernel properties, but we can't
@@ -210,6 +203,15 @@ static void __init export_crashk_values(struct device_node *node) mem_limit =cpu_to_be_ulong (memory_limit); of_update_property(node, &memory_limit_prop); } +#endif /* CONFIG_CRASH_RESERVE */ + +static phys_addr_t kernel_end; + +static struct property kernel_end_prop = { + .name ="linux,kernel-end" , + .length =sizeof (phys_addr_t), + .value = &kernel_end, +};static int __init kexec_setup (void ) {
@@ -220,16 +222,17 @@ static int __init kexec_setup(void)return -ENOENT ;/* remove any stale properties so ours can be found */ -of_remove_property (node,of_find_property (node, kernel_end_prop.name,NULL )); +of_remove_property (node,of_find_property (node, kernel_end_prop.name, +NULL ));/* information needed by userspace when using default_machine_kexec */ kernel_end =cpu_to_be_ulong (__pa (_end));of_add_property (node, &kernel_end_prop); +#ifdef CONFIG_CRASH_RESERVE export_crashk_values (node); - +#endif of_node_put (node);return 0 ; }late_initcall (kexec_setup); -#endif /* CONFIG_CRASH_RESERVE */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/460 powerpc/kexec/core: use big-endian types for crash variables
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
[ Upstream commit 20197b967a6a29dab81495f25a988515bda84cfe ]
Use explicit word-sized big-endian types for kexec and crash related variables. This makes the endianness unambiguous and avoids type mismatches that trigger sparse warnings.
The change addresses sparse warnings like below (seen on both 32-bit and 64-bit builds):
CHECK ../arch/powerpc/kexec/core.c
sparse: expected unsigned int static [addressable] [toplevel] [usertype] crashk_base sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned int static [addressable] [toplevel] [usertype] crashk_size sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned long long static [addressable] [toplevel] mem_limit sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned int static [addressable] [toplevel] [usertype] kernel_end sparse: got restricted __be32 [usertype]
No functional change intended.
--- arch/powerpc/kexec/core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
arch/powerpc/kexec/core.c +9 -8
@@ -23,6 +23,7 @@#include <asm/firmware.h> #define cpu_to_be_ulong __PASTE(cpu_to_be, BITS_PER_LONG) +#define __be_word __PASTE(__be, BITS_PER_LONG)#ifdef CONFIG_CRASH_DUMP void machine_crash_shutdown (struct pt_regs *regs)
@@ -158,25 +159,25 @@ int __init overlaps_crashkernel(unsigned long start, unsigned long size) }/* Values we need to export to the second kernel via the device tree. */ -static phys_addr_t crashk_base; -static phys_addr_t crashk_size; -static unsigned long long mem_limit; +static __be_word crashk_base; +static __be_word crashk_size; +static __be_word mem_limit;static struct property crashk_base_prop = { .name ="linux,crashkernel-base" , - .length =sizeof (phys_addr_t), + .length =sizeof (__be_word), .value = &crashk_base };static struct property crashk_size_prop = { .name ="linux,crashkernel-size" , - .length =sizeof (phys_addr_t), + .length =sizeof (__be_word), .value = &crashk_size, };static struct property memory_limit_prop = { .name ="linux,memory-limit" , - .length =sizeof (unsigned long long ), + .length =sizeof (__be_word), .value = &mem_limit, };
@@ -205,11 +206,11 @@ static void __init export_crashk_values(struct device_node *node) }#endif /* CONFIG_CRASH_RESERVE */ -static phys_addr_t kernel_end; +static __be_word kernel_end;static struct property kernel_end_prop = { .name ="linux,kernel-end" , - .length =sizeof (phys_addr_t), + .length =sizeof (__be_word), .value = &kernel_end, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/460 powerpc/crash: adjust the elfcorehdr size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
[ Upstream commit 04e707cb77c272cb0bb2e2e3c5c7f844d804a089 ]
With crash hotplug support enabled, additional memory is allocated to the elfcorehdr kexec segment to accommodate resources added during memory hotplug events. However, the kdump FDT is not updated with the same size, which can result in elfcorehdr corruption in the kdump kernel.
Update elf_headers_sz (the kimage member representing the size of the elfcorehdr kexec segment) to reflect the total memory allocated for the elfcorehdr segment instead of the elfcorehdr buffer size at the time of kdump load. This allows of_kexec_alloc_and_setup_fdt() to reserve the full elfcorehdr memory in the kdump FDT and prevents elfcorehdr corruption.
--- arch/powerpc/kexec/file_load_64.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/powerpc/kexec/file_load_64.c +13 -1
@@ -633,6 +633,11 @@ static int load_elfcorehdr_segment(struct kimage *image, struct kexec_buf *kbuf) kbuf->buffer = headers; kbuf->mem =KEXEC_BUF_MEM_UNKNOWN ; kbuf->bufsz = headers_sz; + +/* +* Account for extra space required to accommodate additional memory +* ranges in elfcorehdr due to memory hotplug events. +*/ kbuf->memsz = headers_sz +kdump_extra_elfcorehdr_size (cmem); kbuf->top_down = false;
@@ -643,7 +648,14 @@ static int load_elfcorehdr_segment(struct kimage *image, struct kexec_buf *kbuf) } image->elf_load_addr = kbuf->mem; - image->elf_headers_sz = headers_sz; + +/* +* If CONFIG_CRASH_HOTPLUG is enabled, the elfcorehdr kexec segment +* memsz can be larger than bufsz. Always initialize elf_headers_sz +* with memsz. This ensures the correct size is reserved for elfcorehdr +* memory in the FDT prepared for kdump. +*/ + image->elf_headers_sz = kbuf->memsz; image->elf_headers = headers; out:kfree (cmem);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/460 remoteproc: sysmon: Correct subsys_name_len type in QMI request
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
[ Upstream commit da994db94e60f9a9411108ddf4d1836147ad4c9c ]
The QMI message encoder has up until recently read a single byte (as elem_size == 1), but with the introduction of big endian support it's become apparent that this field is expected to be a full u32 - regardless of the size of the length in the encoded message (which is what elem_size specifies).
The result is that the encoder now reads past the length byte and rejects the unreasonably large length formed when including the following 3 bytes from the subsys_name array.
Fix this by changing to the expected type.
--- drivers/remoteproc/qcom_sysmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/qcom_sysmon.c +1 -1
@@ -203,7 +203,7 @@ static const struct qmi_elem_info ssctl_shutdown_resp_ei[] = { };struct ssctl_subsys_event_req { -u8 subsys_name_len; +u32 subsys_name_len;char subsys_name[SSCTL_SUBSYS_NAME_LENGTH ];u32 event;u8 evt_driven_valid;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/460 remoteproc: mediatek: Unprepare SCP clock during system suspend
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit 35c3f72a2d55dbf52f28f4ecae51c76be1acf545 ]
Prior to commit d935187cfb27 ("remoteproc: mediatek: Break lock dependency to prepare_lock"), scp->clk was prepared and enabled only when it needs to communicate with the SCP. The commit d935187cfb27 moved the prepare operation to remoteproc's prepare(), keeping the clock prepared as long as the SCP is running.
The power consumption due to the prolonged clock preparation can be negligible when the system is running, as SCP is designed to be a very power efficient processor.
However, the clock remains prepared even when the system enters system suspend. This prevents the underlying clock controller (and potentially the parent PLLs) from shutting down, which increases power consumption and may block the system from entering deep sleep states.
Add suspend and resume callbacks. Unprepare the clock in suspend() if it was active and re-prepare it in resume() to ensure the clock is properly disabled during system suspend, while maintaining the "always prepared" semantics while the system is active. The driver doesn't implement .attach() callback, hence it only checks for RPROC_RUNNING.
--- drivers/remoteproc/mtk_scp.c | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
drivers/remoteproc/mtk_scp.c +39 -0
@@ -1544,12 +1544,51 @@ static const struct of_device_id mtk_scp_of_match[] = { };MODULE_DEVICE_TABLE (of, mtk_scp_of_match); +static int __maybe_unused scp_suspend (struct device *dev) +{ +struct mtk_scp *scp =dev_get_drvdata (dev); +struct rproc *rproc = scp->rproc; + +/* +* Only unprepare if the SCP is running and holding the clock. +* +* Note: `scp_ops` doesn't implement .attach() callback, hence +* `rproc->state` can never be RPROC_ATTACHED. Otherwise, it +* should also be checked here. +*/ +if (rproc->state ==RPROC_RUNNING ) +clk_unprepare (scp->clk); +return 0 ; +} + +static int __maybe_unused scp_resume (struct device *dev) +{ +struct mtk_scp *scp =dev_get_drvdata (dev); +struct rproc *rproc = scp->rproc; + +/* +* Only prepare if the SCP was running and holding the clock. +* +* Note: `scp_ops` doesn't implement .attach() callback, hence +* `rproc->state` can never be RPROC_ATTACHED. Otherwise, it +* should also be checked here. +*/ +if (rproc->state ==RPROC_RUNNING ) +return clk_prepare (scp->clk); +return 0 ; +} + +static const struct dev_pm_ops scp_pm_ops = { +SET_SYSTEM_SLEEP_PM_OPS (scp_suspend, scp_resume) +}; +static struct platform_driver mtk_scp_driver = { .probe = scp_probe, .remove_new = scp_remove, .driver = { .name ="mtk-scp" , .of_match_table = mtk_scp_of_match, + .pm = &scp_pm_ops, }, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/460 powerpc: 83xx: km83xx: Fix keymile vendor prefix
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Neuschäfer <[email protected]>
[ Upstream commit 691417ffe7821721e0a28bd25ad8c0dc0d4ae4ad ]
When kmeter.c was refactored into km83xx.c in 2011, the "keymile" vendor prefix was changed to upper-case "Keymile". The devicetree at arch/powerpc/boot/dts/kmeter1.dts never underwent the same change, suggesting that this was simply a mistake.
--- arch/powerpc/platforms/83xx/km83xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/platforms/83xx/km83xx.c +2 -2
@@ -155,8 +155,8 @@ machine_device_initcall(mpc83xx_km, mpc83xx_declare_of_platform_devices);/* list of the supported boards */ static char *board[]__initdata = { -"Keymile,KMETER1" , -"Keymile,kmpbec8321" , +"keymile,KMETER1" , +"keymile,kmpbec8321" ,NULL };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/460 smb/server: Fix another refcount leak in smb2_open()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit c15e7c62feb3751cbdd458555819df1d70374890 ]
If ksmbd_override_fsids() fails, we jump to err_out2. At that point, fp is NULL because it hasn't been assigned dh_info.fp yet, so ksmbd_fd_put(work, fp) will not be called. However, dh_info.fp was already inserted into the session file table by ksmbd_reopen_durable_fd(), so it will leak in the session file table until the session is closed.
Move fp = dh_info.fp; ahead of the ksmbd_override_fsids() check to fix the problem.
Found by an experimental AI code review agent at Google.
--- fs/smb/server/smb2pdu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +2 -1
@@ -3012,13 +3012,14 @@ int smb2_open(struct ksmbd_work *work) goto err_out2; } + fp = dh_info.fp; +if (ksmbd_override_fsids (work)) { rc = -ENOMEM ;ksmbd_put_durable_fd (dh_info.fp); goto err_out2; } - fp = dh_info.fp; file_info =FILE_OPENED ; rc =ksmbd_vfs_getattr (&fp->filp->f_path, &stat);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/460 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Bergantinos Corpas <[email protected]>
[ Upstream commit 410666a298c34ebd57256fde6b24c96bd23059a2 ]
If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative.
This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open.
This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection).
While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops.
--- fs/nfs/nfs3proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/nfs3proc.c +6 -1
@@ -393,8 +393,13 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,if (status !=0 ) goto out_release_acls; -if (d_alias) +if (d_alias) { +if (d_is_dir (d_alias)) { + status = -EISDIR ; + goto out_dput; + } dentry = d_alias; + }/* When we created the file with exclusive semantics, make * sure we set the attributes afterwards. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/460 drm/msm/dsi: fix hdisplay calculation when programming dsi registers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengyu Luo <[email protected]>
[ Upstream commit ac47870fd795549f03d57e0879fc730c79119f4b ]
Recently, the hdisplay calculation is working for 3:1 compressed ratio only. If we have a video panel with DSC BPP = 8, and BPC = 10, we still use the default bits_per_pclk = 24, then we get the wrong hdisplay. We can draw the conclusion by cross-comparing the calculation with the calculation in dsi_adjust_pclk_for_compression().
Since CMD mode does not use this, we can remove !(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO) safely.
Patchwork: https://patchwork.freedesktop.org/patch/704822/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +8 -6
@@ -944,7 +944,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)if (msm_host->dsc) {struct drm_dsc_config *dsc = msm_host->dsc; -u32 bytes_per_pclk; +u32 bits_per_pclk;/* update dsc params with timing params */ if (!dsc || !mode->hdisplay || !mode->vdisplay) {
@@ -966,7 +966,9 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)/* * DPU sends 3 bytes per pclk cycle to DSI. If widebus is -* enabled, bus width is extended to 6 bytes. +* enabled, MDP always sends out 48-bit compressed data per +* pclk and on average, DSI consumes an amount of compressed +* data equivalent to the uncompressed pixel depth per pclk. * * Calculate the number of pclks needed to transmit one line of * the compressed data.
@@ -978,12 +980,12 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)* unused anyway. */ h_total -= hdisplay; -if (wide_bus_enabled && !(msm_host->mode_flags &MIPI_DSI_MODE_VIDEO )) - bytes_per_pclk =6 ; +if (wide_bus_enabled) + bits_per_pclk =mipi_dsi_pixel_format_to_bpp (msm_host->format);else - bytes_per_pclk =3 ; + bits_per_pclk =24 ; - hdisplay =DIV_ROUND_UP (msm_dsc_get_bytes_per_line (msm_host->dsc), bytes_per_pclk); + hdisplay =DIV_ROUND_UP (msm_dsc_get_bytes_per_line (msm_host->dsc) *8 , bits_per_pclk); h_total += hdisplay; ha_end = ha_start + hdisplay;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/460 xprtrdma: Decrement re_receiving on the early exit paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Badger <[email protected]>
[ Upstream commit 7b6275c80a0c81c5f8943272292dfe67730ce849 ]
In the event that rpcrdma_post_recvs() fails to create a work request (due to memory allocation failure, say) or otherwise exits early, we should decrement ep->re_receiving before returning. Otherwise we will hang in rpcrdma_xprt_drain() as re_receiving will never reach zero and the completion will never be triggered.
On a system with high memory pressure, this can appear as the following hung task:
INFO: task kworker/u385:17:8393 blocked for more than 122 seconds.
Tainted: G S E 6.19.0 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u385:17 state:D stack:0 pid:8393 tgid:8393 ppid:2 task_flags:0x4248060 flags:0x00080000
Workqueue: xprtiod xprt_autoclose [sunrpc]
Call Trace:
<TASK>
__schedule+0x48b/0x18b0
? ib_post_send_mad+0x247/0xae0 [ib_core]
schedule+0x27/0xf0
schedule_timeout+0x104/0x110
__wait_for_common+0x98/0x180
? __pfx_schedule_timeout+0x10/0x10
wait_for_completion+0x24/0x40
rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma]
xprt_rdma_close+0x12/0x40 [rpcrdma]
xprt_autoclose+0x5f/0x120 [sunrpc]
process_one_work+0x191/0x3e0
worker_thread+0x2e3/0x420
? __pfx_worker_thread+0x10/0x10
kthread+0x10d/0x230
? __pfx_kthread+0x10/0x10
ret_from_fork+0x273/0x2b0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30--- net/sunrpc/xprtrdma/verbs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/sunrpc/xprtrdma/verbs.c +4 -3
@@ -1362,7 +1362,7 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed) needed +=RPCRDMA_MAX_RECV_BATCH ;if (atomic_inc_return (&ep->re_receiving) >1 ) - goto out; + goto out_dec;/* fast path: all needed reps can be found on the free list */ wr =NULL ;
@@ -1385,7 +1385,7 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed) ++count; }if (!wr) - goto out; + goto out_dec; rc =ib_post_recv (ep->re_id->qp, wr, (const struct ib_recv_wr **)&bad_wr);
@@ -1400,9 +1400,10 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed) --count; } } + +out_dec:if (atomic_dec_return (&ep->re_receiving) >0 )complete (&ep->re_done); - out:trace_xprtrdma_post_recvs (r_xprt, count); ep->re_receive_count += count;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/460 btrfs: hold space_info->lock when clearing periodic reclaim ready
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun YangKai <[email protected]>
[ Upstream commit b8883b61f2fc50dcf22938cbed40fec05020552f ]
btrfs_set_periodic_reclaim_ready() requires space_info->lock to be held, as enforced by lockdep_assert_held(). However, btrfs_reclaim_sweep() was calling it after do_reclaim_sweep() returns, at which point space_info->lock is no longer held.
Fix this by explicitly acquiring space_info->lock before clearing the periodic reclaim ready flag in btrfs_reclaim_sweep().
--- fs/btrfs/space-info.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/btrfs/space-info.c +4 -1
@@ -2128,8 +2128,11 @@ void btrfs_reclaim_sweep(const struct btrfs_fs_info *fs_info)if (!btrfs_should_periodic_reclaim (space_info))continue ;for (raid =0 ; raid <BTRFS_NR_RAID_TYPES ; raid++) { -if (do_reclaim_sweep (space_info, raid)) +if (do_reclaim_sweep (space_info, raid)) { +spin_lock (&space_info->lock);btrfs_set_periodic_reclaim_ready (space_info, false); +spin_unlock (&space_info->lock); + } } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/460 workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit f42f9091be9e5ff57567a3945cfcdd498f475348 ]
pr_cont_worker_id() checks pool->flags against WQ_BH, which is a workqueue-level flag (defined in workqueue.h). Pool flags use a separate namespace with POOL_* constants (defined in workqueue.c). The correct constant is POOL_BH. Both WQ_BH and POOL_BH are defined as (1 << 0) so this has no behavioral impact, but it is semantically wrong and inconsistent with every other pool-level BH check in the file.
--- kernel/workqueue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/workqueue.c +1 -1
@@ -6209,7 +6209,7 @@ static void pr_cont_worker_id(struct worker *worker) {struct worker_pool *pool = worker->pool; -if (pool->flags &WQ_BH ) +if (pool->flags &POOL_BH )pr_cont ("bh%s" , pool->attrs->nice ==HIGHPRI_NICE_LEVEL ?"-hi" :"" );else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/460 perf disasm: Fix off-by-one bug in outside check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Collingbourne <[email protected]>
[ Upstream commit b3ce769203a99d6f3c6d6269ec09232a8c5da422 ]
If a branch target points to one past the end of a function, the branch should be treated as a branch to another function.
This can happen e.g. with a tail call to a function that is laid out immediately after the caller.
--- tools/perf/util/disasm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/disasm.c +1 -1
@@ -408,7 +408,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s start =map__unmap_ip (map, sym->start); end =map__unmap_ip (map, sym->end); - ops->target.outside = target.addr < start || target.addr > end; + ops->target.outside = target.addr < start || target.addr >= end;/* * FIXME: things like this in _cpp_lex_token (gcc's cc1 program):
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/460 net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mieczyslaw Nalewaj <[email protected]>
[ Upstream commit f76a93241d71fbba8425e3967097b498c29264ed ]
rx_packets should report the number of frames successfully received:
unicast + multicast + broadcast. Subtracting ifOutDiscards (a TX counter) is incorrect and can undercount RX packets. RX drops are already reported via rx_dropped (e.g. etherStatsDropEvents), so there is no need to adjust rx_packets.
This patch removes the subtraction of ifOutDiscards from rx_packets in rtl8365mb_stats_update().
--- drivers/net/dsa/realtek/rtl8365mb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/dsa/realtek/rtl8365mb.c +1 -2
@@ -1480,8 +1480,7 @@ static void rtl8365mb_stats_update(struct realtek_priv *priv, int port) stats->rx_packets = cnt[RTL8365MB_MIB_ifInUcastPkts] + cnt[RTL8365MB_MIB_ifInMulticastPkts] + - cnt[RTL8365MB_MIB_ifInBroadcastPkts] - - cnt[RTL8365MB_MIB_ifOutDiscards]; + cnt[RTL8365MB_MIB_ifInBroadcastPkts]; stats->tx_packets = cnt[RTL8365MB_MIB_ifOutUcastPkts] + cnt[RTL8365MB_MIB_ifOutMulticastPkts] +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/460 drm/msm/dsi: fix pclk rate calculation for bonded dsi
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengyu Luo <[email protected]>
[ Upstream commit e4eb11b34d6c84f398d8f08d7cb4d6c38e739dd2 ]
Recently, we round up new_hdisplay once at most, for bonded dsi, we may need twice, since they are independent links, we should round up each half separately. This also aligns with the hdisplay we program later in dsi_timing_setup()
Example:
full_hdisplay = 1904, dsc_bpp = 8, bpc = 8 new_full_hdisplay = DIV_ROUND_UP(1904 * 8, 8 * 3) = 635
if we use half display
new_half_hdisplay = DIV_ROUND_UP(952 * 8, 8 * 3) = 318 new_full_display = 636
Patchwork: https://patchwork.freedesktop.org/patch/709716/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +23 -6
@@ -534,13 +534,30 @@ void dsi_link_clk_disable_v2(struct msm_dsi_host *msm_host)* FIXME: Reconsider this if/when CMD mode handling is rewritten to use * transfer time and data overhead as a starting point of the calculations. */ -static unsigned long dsi_adjust_pclk_for_compression (const struct drm_display_mode *mode, -const struct drm_dsc_config *dsc) +static unsigned long +dsi_adjust_pclk_for_compression (const struct drm_display_mode *mode, +const struct drm_dsc_config *dsc, +bool is_bonded_dsi) { -int new_hdisplay =DIV_ROUND_UP (mode->hdisplay *drm_dsc_get_bpp_int (dsc), - dsc->bits_per_component *3 ); +int hdisplay, new_hdisplay, new_htotal; -int new_htotal = mode->htotal - mode->hdisplay + new_hdisplay; +/* +* For bonded DSI, split hdisplay across two links and round up each +* half separately, passing the full hdisplay would only round up once. +* This also aligns with the hdisplay we program later in +* dsi_timing_setup() +*/ + hdisplay = mode->hdisplay; +if (is_bonded_dsi) + hdisplay /=2 ; + + new_hdisplay =DIV_ROUND_UP (hdisplay *drm_dsc_get_bpp_int (dsc), + dsc->bits_per_component *3 ); + +if (is_bonded_dsi) + new_hdisplay *=2 ; + + new_htotal = mode->htotal - mode->hdisplay + new_hdisplay;return mult_frac (mode->clock *1000u , new_htotal, mode->htotal); }
@@ -553,7 +570,7 @@ static unsigned long dsi_get_pclk_rate(const struct drm_display_mode *mode, pclk_rate = mode->clock *1000u ;if (dsc) - pclk_rate =dsi_adjust_pclk_for_compression (mode, dsc); + pclk_rate =dsi_adjust_pclk_for_compression (mode, dsc, is_bonded_dsi);/* * For bonded DSI mode, the current DRM mode has the complete width of the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/460 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 9d4837a26149355ffe3a1f80de80531eafdd3353 ]
add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14.0.2/14.0.3
--- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +2 -1
@@ -2394,7 +2394,8 @@ static int smu_v14_0_2_restore_user_od_settings(struct smu_context *smu) user_od_table->OverDriveTable.FeatureCtrlMask =BIT (PP_OD_FEATURE_GFXCLK_BIT ) |BIT (PP_OD_FEATURE_UCLK_BIT ) |BIT (PP_OD_FEATURE_GFX_VF_CURVE_BIT ) | -BIT (PP_OD_FEATURE_FAN_CURVE_BIT ); +BIT (PP_OD_FEATURE_FAN_CURVE_BIT ) | +BIT (PP_OD_FEATURE_ZERO_FAN_BIT ); res =smu_v14_0_2_upload_overdrive_table (smu, user_od_table); user_od_table->OverDriveTable.FeatureCtrlMask =0 ;if (res ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/460 bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 3348be7978f450ede0c308a4e8416ac716cf1015 ]
Before the fixed commit, we check slave->new_link during commit state, which values are only BOND_LINK_{NOCHANGE, UP, DOWN}. After the commit, we start using slave->link_new_state, which state also could be BOND_LINK_{FAIL, BACK}.
For example, when we set updelay/downdelay, after a failover, the slave->link_new_state could be set to BOND_LINK_{FAIL, BACK} in bond_miimon_inspect(). And later in bond_miimon_commit(), it will treat it as invalid and print an error, which would cause confusion for users.
[ 106.440254] bond0: (slave veth2): link status down for interface, disabling it in 200 ms [ 106.440265] bond0: (slave veth2): invalid new link 1 on slave [ 106.648276] bond0: (slave veth2): link status definitely down, disabling slave [ 107.480271] bond0: (slave veth2): link status up, enabling it in 200 ms [ 107.480288] bond0: (slave veth2): invalid new link 3 on slave [ 107.688302] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex
Let's handle BOND_LINK_{FAIL, BACK} as valid link states.
--- drivers/net/bonding/bond_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +7 -1
@@ -2936,8 +2936,14 @@ static void bond_miimon_commit(struct bonding *bond)continue ; +case BOND_LINK_FAIL : +case BOND_LINK_BACK : +slave_dbg (bond->dev, slave->dev,"link_new_state %d on slave\n" , + slave->link_new_state); +continue ; +default : -slave_err (bond->dev, slave->dev,"invalid new link %d on slave\n" , +slave_err (bond->dev, slave->dev,"invalid link_new_state %d on slave\n" , slave->link_new_state);bond_propose_link_state (slave,BOND_LINK_NOCHANGE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/460 net/mlx5: IFC updates for disabled host PF
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Jurgens <[email protected]>
[ Upstream commit cd1746cb6555a2238c4aae9f9d60b637a61bf177 ]
The port 2 host PF can be disabled, this bit reflects that setting.
Stable-dep-of: aed763abf0e9 ("net/mlx5: Fix deadlock between devlink lock and esw->wq")
--- include/linux/mlx5/mlx5_ifc.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/linux/mlx5/mlx5_ifc.h +3 -1
@@ -12282,7 +12282,9 @@ struct mlx5_ifc_mtrc_ctrl_bits {struct mlx5_ifc_host_params_context_bits {u8 host_number[0x8 ]; -u8 reserved_at_8[0x7 ]; +u8 reserved_at_8[0x5 ]; +u8 host_pf_not_exist[0x1 ]; +u8 reserved_at_14[0x1 ];u8 host_pf_disabled[0x1 ];u8 host_num_of_vfs[0x10 ];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/460 net/mlx5: Query to see if host PF is disabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Jurgens <[email protected]>
[ Upstream commit 9e84de72aef9bcf0e751a0bff3ac91b0cf52366f ]
The host PF can be disabled, query firmware to check if the host PF of this function exists.
Stable-dep-of: aed763abf0e9 ("net/mlx5: Fix deadlock between devlink lock and esw->wq")
--- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 23 +++++++++++++++++++ .../net/ethernet/mellanox/mlx5/core/eswitch.h | 1 + 2 files changed, 24 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +23 -0
@@ -1038,6 +1038,25 @@ const u32 *mlx5_esw_query_functions(struct mlx5_core_dev *dev)return ERR_PTR (err); } +static int mlx5_esw_host_functions_enabled_query (struct mlx5_eswitch *esw) +{ +const u32 *query_host_out; + +if (!mlx5_core_is_ecpf_esw_manager (esw->dev)) +return 0 ; + + query_host_out =mlx5_esw_query_functions (esw->dev); +if (IS_ERR (query_host_out)) +return PTR_ERR (query_host_out); + + esw->esw_funcs.host_funcs_disabled = +MLX5_GET (query_esw_functions_out, query_host_out, + host_params_context.host_pf_not_exist); + +kvfree (query_host_out); +return 0 ; +} +static void mlx5_eswitch_event_handler_register (struct mlx5_eswitch *esw) {if (esw->mode ==MLX5_ESWITCH_OFFLOADS &&mlx5_eswitch_is_funcs_handler (esw->dev)) {
@@ -1871,6 +1890,10 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) goto abort; } + err =mlx5_esw_host_functions_enabled_query (esw); +if (err) + goto abort; + err =mlx5_esw_vports_init (esw);if (err) goto abort;
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +1 -0
@@ -316,6 +316,7 @@ struct mlx5_host_work {struct mlx5_esw_functions {struct mlx5_nb nb; +bool host_funcs_disabled;u16 num_vfs;u16 num_ec_vfs; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/460 net/mlx5: Fix deadlock between devlink lock and esw->wq
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit aed763abf0e905b4b8d747d1ba9e172961572f57 ]
esw->work_queue executes esw_functions_changed_event_handler -> esw_vfs_changed_event_handler and acquires the devlink lock.
.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) -> mlx5_devlink_eswitch_mode_set -> mlx5_eswitch_disable_locked -> mlx5_eswitch_event_handler_unregister -> flush_workqueue deadlocks when esw_vfs_changed_event_handler executes.
Fix that by no longer flushing the work to avoid the deadlock, and using a generation counter to keep track of work relevance. This avoids an old handler manipulating an esw that has undergone one or more mode changes:
- the counter is incremented in mlx5_eswitch_event_handler_unregister.
- the counter is read and passed to the ephemeral mlx5_host_work struct.
- the work handler takes the devlink lock and bails out if the current generation is different than the one it was scheduled to operate on.
- mlx5_eswitch_cleanup does the final draining before destroying the wq.
No longer flushing the workqueue has the side effect of maybe no longer cancelling pending vport_change_handler work items, but that's ok since those are disabled elsewhere:
- mlx5_eswitch_disable_locked disables the vport eq notifier.
- mlx5_esw_vport_disable disarms the HW EQ notification and marks vport->enabled under state_lock to false to prevent pending vport handler from doing anything.
- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events are disabled/finished.
--- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 7 ++++--- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 2 ++ .../mellanox/mlx5/core/eswitch_offloads.c | 18 +++++++++++++----- 3 files changed, 19 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +4 -3
@@ -1068,10 +1068,11 @@ static void mlx5_eswitch_event_handler_register(struct mlx5_eswitch *esw)static void mlx5_eswitch_event_handler_unregister (struct mlx5_eswitch *esw) { -if (esw->mode ==MLX5_ESWITCH_OFFLOADS &&mlx5_eswitch_is_funcs_handler (esw->dev)) +if (esw->mode ==MLX5_ESWITCH_OFFLOADS && +mlx5_eswitch_is_funcs_handler (esw->dev)) {mlx5_eq_notifier_unregister (esw->dev, &esw->esw_funcs.nb); - -flush_workqueue (esw->work_queue); +atomic_inc (&esw->esw_funcs.generation); + } }static void mlx5_eswitch_clear_vf_vports_info (struct mlx5_eswitch *esw)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +2 -0
@@ -312,10 +312,12 @@ struct esw_mc_addr { /* SRIOV only */struct mlx5_host_work {struct work_struct work;struct mlx5_eswitch *esw; +int work_gen; };struct mlx5_esw_functions {struct mlx5_nb nb; +atomic_t generation;bool host_funcs_disabled;u16 num_vfs;u16 num_ec_vfs;
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +13 -5
@@ -3402,22 +3402,28 @@ static void esw_offloads_steering_cleanup(struct mlx5_eswitch *esw) }static void -esw_vfs_changed_event_handler (struct mlx5_eswitch *esw,const u32 *out) +esw_vfs_changed_event_handler (struct mlx5_eswitch *esw,int work_gen, +const u32 *out) {struct devlink *devlink;bool host_pf_disabled;u16 new_num_vfs; + devlink =priv_to_devlink (esw->dev); +devl_lock (devlink); + +/* Stale work from one or more mode changes ago. Bail out. */ +if (work_gen !=atomic_read (&esw->esw_funcs.generation)) + goto unlock; + new_num_vfs =MLX5_GET (query_esw_functions_out, out, host_params_context.host_num_of_vfs); host_pf_disabled =MLX5_GET (query_esw_functions_out, out, host_params_context.host_pf_disabled);if (new_num_vfs == esw->esw_funcs.num_vfs || host_pf_disabled) -return ; + goto unlock; - devlink =priv_to_devlink (esw->dev); -devl_lock (devlink);/* Number of VFs can only change from "0 to x" or "x to 0". */ if (esw->esw_funcs.num_vfs >0 ) {mlx5_eswitch_unload_vf_vports (esw, esw->esw_funcs.num_vfs);
@@ -3432,6 +3438,7 @@ esw_vfs_changed_event_handler(struct mlx5_eswitch *esw, const u32 *out) } } esw->esw_funcs.num_vfs = new_num_vfs; +unlock:devl_unlock (devlink); }
@@ -3448,7 +3455,7 @@ static void esw_functions_changed_event_handler(struct work_struct *work)if (IS_ERR (out)) goto out; -esw_vfs_changed_event_handler (esw, out); +esw_vfs_changed_event_handler (esw, host_work->work_gen, out);kvfree (out); out:kfree (host_work);
@@ -3468,6 +3475,7 @@ int mlx5_esw_funcs_changed_handler(struct notifier_block *nb, unsigned long type esw = container_of(esw_funcs, struct mlx5_eswitch, esw_funcs); host_work->esw = esw; + host_work->work_gen =atomic_read (&esw_funcs->generation);INIT_WORK (&host_work->work, esw_functions_changed_event_handler);queue_work (esw->work_queue, &host_work->work);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/460 net/mlx5: Fix crash when moving to switchdev mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 24b2795f9683e092dc22a68f487e7aaaf2ddafea ]
When moving to switchdev mode when the device doesn't support IPsec, we try to clean up the IPsec resources anyway which causes the crash below, fix that by correctly checking for IPsec support before trying to clean up its resources.
[27642.515799] WARNING: arch/x86/mm/fault.c:1276 at do_user_addr_fault+0x18a/0x680, CPU#4: devlink/6490 [27642.517159] Modules linked in: xt_conntrack xt_MASQUERADE
ip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat xt_addrtype rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl nfnetlink zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core ib_core
[27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted
6.19.0-rc5_for_upstream_min_debug_2026_01_14_16_47 #1 NONE
[27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[27642.524528] RIP: 0010:do_user_addr_fault+0x18a/0x680
[27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22
00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb
ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d
41
[27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046
[27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX:
ffff88810b980f00
[27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI:
ffff88810770f728
[27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09:
0000000000000000
[27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff888103f3c4c0
[27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15:
0000000000000000
[27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000)
knlGS:0000000000000000
[27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4:
0000000000172eb0
[27642.537982] Call Trace:
[27642.538466] <TASK>
[27642.538907] exc_page_fault+0x76/0x140
[27642.539583] asm_exc_page_fault+0x22/0x30
[27642.540282] RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30
[27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8
01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00
00 <f0> 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8
5b
[27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046
[27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX:
ffff888113ad96d8
[27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI:
00000000000000a0
[27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09:
ffff88810b980f00
[27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12:
00000000000000a8
[27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15:
ffff8881130d8a40
[27642.550379] complete_all+0x20/0x90
[27642.551010] mlx5e_ipsec_disable_events+0xb6/0xf0 [mlx5_core]
[27642.552022] mlx5e_nic_disable+0x12d/0x220 [mlx5_core]
[27642.552929] mlx5e_detach_netdev+0x66/0xf0 [mlx5_core]
[27642.553822] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]
[27642.554821] mlx5e_vport_rep_load+0x419/0x590 [mlx5_core]
[27642.555757] ? xa_load+0x53/0x90
[27642.556361] __esw_offloads_load_rep+0x54/0x70 [mlx5_core]
[27642.557328] mlx5_esw_offloads_rep_load+0x45/0xd0 [mlx5_core]
[27642.558320] esw_offloads_enable+0xb4b/0xc90 [mlx5_core]
[27642.559247] mlx5_eswitch_enable_locked+0x34e/0x4f0 [mlx5_core]
[27642.560257] ? mlx5_rescan_drivers_locked+0x222/0x2d0 [mlx5_core]
[27642.561284] mlx5_devlink_eswitch_mode_set+0x5ac/0x9c0 [mlx5_core]
[27642.562334] ? devlink_rate_set_ops_supported+0x21/0x3a0
[27642.563220] devlink_nl_eswitch_set_doit+0x67/0xe0
[27642.564026] genl_family_rcv_msg_doit+0xe0/0x130
[27642.564816] genl_rcv_msg+0x183/0x290
[27642.565466] ? __devlink_nl_pre_doit.isra.0+0x160/0x160
[27642.566329] ? devlink_nl_eswitch_get_doit+0x290/0x290
[27642.567181] ? devlink_nl_pre_doit_parent_dev_optional+0x20/0x20
[27642.568147] ? genl_family_rcv_msg_dumpit+0xf0/0xf0
[27642.568966] netlink_rcv_skb+0x4b/0xf0
[27642.569629] genl_rcv+0x24/0x40
[27642.570215] netlink_unicast+0x255/0x380
[27642.570901] ? __alloc_skb+0xfa/0x1e0
[27642.571560] netlink_sendmsg+0x1f3/0x420
[27642.572249] __sock_sendmsg+0x38/0x60
[27642.572911] __sys_sendto+0x119/0x180
[27642.573561] ? __sys_recvmsg+0x5c/0xb0
[27642.574227] __x64_sys_sendto+0x20/0x30
[27642.574904] do_syscall_64+0x55/0xc10
[27642.575554] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[27642.576391] RIP: 0033:0x7f197c85e807
[27642.577050] Code: c7 c0 ff ff ff ff eb be 66 2e 0f 1f 84 00 00 00 00
00 90 f3 0f 1e fa 80 3d 45 08 0d 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f
05 <48> 3d 00 f0 ff ff 77 69 c3 55 48 89 e5 53 48 83 ec 38 44 89 4d
d0
[27642.579846] RSP: 002b:00007ffebd4e2248 EFLAGS: 00000202 ORIG_RAX:
000000000000002c
[27642.581082] RAX: ffffffffffffffda RBX: 000055cfcd9cd2a0 RCX:
00007f197c85e807
[27642.582200] RDX: 0000000000000038 RSI: 000055cfcd9cd490 RDI:
0000000000000003
[27642.583320] RBP: 00007ffebd4e2290 R08: 00007f197c942200 R09:
000000000000000c
[27642.584437] R10: 0000000000000000 R11: 0000000000000202 R12:
0000000000000000
[27642.585555] R13: 000055cfcd9cd490 R14: 00007ffebd4e45d1 R15:
000055cfcd9cd2a0
[27642.586671] </TASK>
[27642.587121] ---[ end trace 0000000000000000 ]---
[27642.587910] BUG: kernel NULL pointer dereference, address:00000000000000a0
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +1 -1
@@ -2449,7 +2449,7 @@ void mlx5e_ipsec_disable_events(struct mlx5e_priv *priv) goto out; peer_priv =mlx5_devcom_get_next_peer_data (priv->devcom, &tmp); -if (peer_priv) +if (peer_priv && peer_priv->ipsec)complete_all (&peer_priv->ipsec->comp);mlx5_devcom_for_each_peer_end (priv->devcom);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/460 net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 1633111d69053512d099658d4a05fc736fab36b0 ]
In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desyncing the DMA FIFO producer and consumer.
After recovery, the producer pushes new DMA entries at the old dma_fifo_pc, while the consumer reads from position 0. This causes us to unmap stale DMA addresses from before the recovery.
The DMA FIFO is a purely software construct with no HW counterpart. At the point of reset, all WQEs have been flushed so dma_fifo_cc is already equal to dma_fifo_pc. There is no need to reset either counter, similar to how skb_fifo pc/cc are untouched.
Remove the 'dma_fifo_cc = 0' reset.
This fixes the following WARNING:
WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90
Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:iommu_dma_unmap_page+0x79/0x90
Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00
Call Trace:
<IRQ>
? __warn+0x7d/0x110
? iommu_dma_unmap_page+0x79/0x90
? report_bug+0x16d/0x180
? handle_bug+0x4f/0x90
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x16/0x20
? iommu_dma_unmap_page+0x79/0x90
? iommu_dma_unmap_page+0x2e/0x90
dma_unmap_page_attrs+0x10d/0x1b0
mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]
mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]
mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]
__napi_poll+0x24/0x190
net_rx_action+0x32a/0x3b0
? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]
? notifier_call_chain+0x35/0xa0
handle_softirqs+0xc9/0x270
irq_exit_rcu+0x71/0xd0
common_interrupt+0x7f/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x22/0x40--- drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c +0 -1
@@ -45,7 +45,6 @@ static void mlx5e_reset_txqsq_cc_pc(struct mlx5e_txqsq *sq)"SQ 0x%x: cc (0x%x) != pc (0x%x)\n" , sq->sqn, sq->cc, sq->pc); sq->cc =0 ; - sq->dma_fifo_cc =0 ; sq->pc =0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/460 net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 ]
teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update skb->dev to the slave device beforehand.
When a gretap tunnel is a TEQL slave, the transmit path reaches iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0 master) and later calls iptunnel_xmit_stats(dev, pkt_len). This function does:
get_cpu_ptr(dev->tstats)
Since teql_master_setup() does not set dev->pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes NULL + __per_cpu_offset[cpu], resulting in a page fault.
BUG: unable to handle page fault for address: ffff8880e6659018 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 68bc067 P4D 68bc067 PUD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89) Call Trace: <TASK> ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) __gre_xmit (net/ipv4/ip_gre.c:478) gre_tap_xmit (net/ipv4/ip_gre.c:779) teql_master_xmit (net/sched/sch_teql.c:319) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) neigh_direct_output (net/core/neighbour.c:1660) ip_finish_output2 (net/ipv4/ip_output.c:237) __ip_finish_output.part.0 (net/ipv4/ip_output.c:315) ip_mc_output (net/ipv4/ip_output.c:369) ip_send_skb (net/ipv4/ip_output.c:1508) udp_send_skb (net/ipv4/udp.c:1195) udp_sendmsg (net/ipv4/udp.c:1485) inet_sendmsg (net/ipv4/af_inet.c:859) __sys_sendto (net/socket.c:2206)
Fix this by setting skb->dev = slave before calling netdev_start_xmit(), so that tunnel xmit functions see the correct slave device with properly allocated tstats.
--- net/sched/sch_teql.c | 1 + 1 file changed, 1 insertion(+)
net/sched/sch_teql.c +1 -0
@@ -315,6 +315,7 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)if (__netif_tx_trylock (slave_txq)) {unsigned int length =qdisc_pkt_len (skb); + skb->dev = slave;if (!netif_xmit_frozen_or_stopped (slave_txq) &&netdev_start_xmit (skb, slave, slave_txq, false) ==NETDEV_TX_OK ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/460 drm/sitronix/st7586: fix bad pixel data due to byte swap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 46d8a07b4ae262e2fec6ce2aa454e06243661265 ]
Correctly set dbi->write_memory_bpw for the ST7586 driver. This driver is for a monochrome display that has an unusual data format, so the default value set in mipi_dbi_spi_init() is not correct simply because this controller is non-standard.
Previously, we were using dbi->swap_bytes to make the same sort of workaround, but it was removed in the same commit that added dbi->write_memory_bpw, so we need to use the latter now to have the correct behavior.
This fixes every 3 columns of pixels being swapped on the display. There are 3 pixels per byte, so the byte swap caused this effect.
--- drivers/gpu/drm/tiny/st7586.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/gpu/drm/tiny/st7586.c +6 -9
@@ -345,6 +345,12 @@ static int st7586_probe(struct spi_device *spi)if (ret)return ret; +/* +* Override value set by mipi_dbi_spi_init(). This driver is a bit +* non-standard, so best to set it explicitly here. +*/ + dbi->write_memory_bpw =8 ; +/* Cannot read from this controller via SPI */ dbi->read_commands =NULL ;
@@ -354,15 +360,6 @@ static int st7586_probe(struct spi_device *spi)if (ret)return ret; -/* -* we are using 8-bit data, so we are not actually swapping anything, -* but setting mipi->swap_bytes makes mipi_dbi_typec3_command() do the -* right thing and not use 16-bit transfers (which results in swapped -* bytes on little-endian systems and causes out of order data to be -* sent to the display). -*/ - dbi->swap_bytes = true; -drm_mode_config_reset (drm); ret =drm_dev_register (drm,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/460 ASoC: soc-core: drop delayed_work_pending() check before flush
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: matteo.cotifava <[email protected]>
[ Upstream commit 3c99c9f0ed60582c1c9852b685d78d5d3a50de63 ]
The delayed_work_pending() check before flush_delayed_work() in soc_free_pcm_runtime() is unnecessary and racy. flush_delayed_work() is safe to call unconditionally - it is a no-op when no work is pending. Remove the check.
The original check was added by commit 9c9b65203492 ("ASoC: core:
only flush inited work during free") but delayed_work_pending() followed by flush_delayed_work() has a time-of-check/time-of-use window where work can become pending between the two calls.
--- sound/soc/soc-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/soc-core.c +1 -2
@@ -456,8 +456,7 @@ static void soc_free_pcm_runtime(struct snd_soc_pcm_runtime *rtd)list_del (&rtd->list); -if (delayed_work_pending (&rtd->delayed_work)) -flush_delayed_work (&rtd->delayed_work); +flush_delayed_work (&rtd->delayed_work);snd_soc_pcm_component_free (rtd);/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/460 ASoC: soc-core: flush delayed work before removing DAIs and widgets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: matteo.cotifava <[email protected]>
[ Upstream commit 95bc5c225513fc3c4ce169563fb5e3929fbb938b ]
When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler.
During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free.
The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets.
Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses).
--- sound/soc/soc-core.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/soc-core.c +3 -0
@@ -2114,6 +2114,9 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)for_each_card_rtds (card, rtd)if (rtd->initialized)snd_soc_link_exit (rtd); +/* flush delayed work before removing DAIs and DAPM widgets */ +snd_soc_flush_all_delayed_work (card); +/* remove and free each DAI */ soc_remove_link_dais (card);soc_remove_link_components (card);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/460 ASoC: simple-card-utils: use __free(device_node) for device node
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit 419d1918105e5d9926ab02f1f834bb416dc76f65 ]
simple-card-utils handles many type of device_node, thus need to use of_node_put() in many place. Let's use __free(device_node) and avoid it.
Stable-dep-of: 4185b95f8a42 ("ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays")
--- sound/soc/generic/simple-card-utils.c | 44 +++++++++------------------ 1 file changed, 14 insertions(+), 30 deletions(-)
sound/soc/generic/simple-card-utils.c +14 -30
@@ -999,35 +999,27 @@ EXPORT_SYMBOL_GPL(graph_util_card_probe);int graph_util_is_ports0 (struct device_node *np) { -struct device_node *port, *ports, *ports0, *top; -int ret; + struct device_node *parent __free(device_node) = of_get_parent(np); +struct device_node *port;/* np is "endpoint" or "port" */ -if (of_node_name_eq (np,"endpoint" )) { - port =of_get_parent (np); - }else { +if (of_node_name_eq (np,"endpoint" )) + port = parent; +else port = np; -of_node_get (port); - } - - ports =of_get_parent (port); - top =of_get_parent (ports); - ports0 =of_get_child_by_name (top,"ports" ); - - ret = ports0 == ports; -of_node_put (port); -of_node_put (ports); -of_node_put (ports0); -of_node_put (top); + struct device_node *ports __free(device_node) = of_get_parent(port); + struct device_node *top __free(device_node) = of_get_parent(ports); + struct device_node *ports0 __free(device_node) = of_get_child_by_name(top, "ports"); -return ret; +return ports0 == ports; }EXPORT_SYMBOL_GPL (graph_util_is_ports0);static int graph_get_dai_id (struct device_node *ep) { -struct device_node *node; + struct device_node *node __free(device_node) = of_graph_get_port_parent(ep); + struct device_node *port __free(device_node) = of_get_parent(ep);struct device_node *endpoint;struct of_endpoint info;int i, id;
@@ -1050,13 +1042,10 @@ static int graph_get_dai_id(struct device_node *ep)if (of_property_present (ep,"reg" ))return info.id; - node =of_get_parent (ep); - ret =of_property_present (node,"reg" ); -of_node_put (node); + ret =of_property_present (port,"reg" );if (ret)return info.port; } - node =of_graph_get_port_parent (ep);/* * Non HDMI sound case, counting port/endpoint on its DT
@@ -1070,8 +1059,6 @@ static int graph_get_dai_id(struct device_node *ep) i++; } -of_node_put (node); -if (id <0 )return -ENODEV ;
@@ -1081,7 +1068,6 @@ static int graph_get_dai_id(struct device_node *ep)int graph_util_parse_dai (struct device *dev,struct device_node *ep,struct snd_soc_dai_link_component *dlc,int *is_single_link) { -struct device_node *node;struct of_phandle_args args = {};struct snd_soc_dai *dai;int ret;
@@ -1089,7 +1075,7 @@ int graph_util_parse_dai(struct device *dev, struct device_node *ep,if (!ep)return 0 ; - node =of_graph_get_port_parent (ep); + struct device_node *node __free(device_node) = of_graph_get_port_parent(ep);/* * Try to find from DAI node
@@ -1131,10 +1117,8 @@ int graph_util_parse_dai(struct device *dev, struct device_node *ep,* if he unbinded CPU or Codec. */ ret =snd_soc_get_dlc (&args, dlc); -if (ret <0 ) { -of_node_put (node); +if (ret <0 )return ret; - } parse_dai_end:if (is_single_link)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/460 ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sen Wang <[email protected]>
[ Upstream commit 4185b95f8a42d92d68c49289b4644546b51e252b ]
graph_util_is_ports0() identifies DPCM front-end (ports@0) vs back-end (ports@1) by calling of_get_child_by_name() to find the first "ports" child and comparing pointers. This relies on child iteration order matching DTS source order.
When the DPCM topology comes from a DT overlay, __of_attach_node() inserts new children at the head of the sibling list, reversing the order. of_get_child_by_name() then returns ports@1 instead of ports@0, causing all front-end links to be classified as back-ends. The card registers with no PCM devices.
Fix this by matching the unit address directly from the node name instead of relying on sibling order.
--- sound/soc/generic/simple-card-utils.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
sound/soc/generic/simple-card-utils.c +8 -4
@@ -1008,11 +1008,15 @@ int graph_util_is_ports0(struct device_node *np)else port = np; - struct device_node *ports __free(device_node) = of_get_parent(port); - struct device_node *top __free(device_node) = of_get_parent(ports); - struct device_node *ports0 __free(device_node) = of_get_child_by_name(top, "ports"); + struct device_node *ports __free(device_node) = of_get_parent(port); +const char *at =strchr (kbasename (ports->full_name),'@' ); -return ports0 == ports; +/* +* Since child iteration order may differ +* between a base DT and DT overlays, +* string match "ports" or "ports@0" in the node name instead. +*/ +return !at || !strcmp (at,"@0" ); }EXPORT_SYMBOL_GPL (graph_util_is_ports0);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/460 net: sfp: improve Huawei MA5671a fixup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 87d126852158467ab87d5cbc36ccfd3f15464a6c ]
With the current sfp_fixup_ignore_tx_fault() fixup we ignore the TX_FAULT signal, but we also need to apply sfp_fixup_ignore_los() in order to be able to communicate with the module even if the fiber isn't connected for configuration purposes.
This is needed for all the MA5671a firmwares, excluding the FS modded firmware.
--- drivers/net/phy/sfp.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/phy/sfp.c +7 -1
@@ -360,6 +360,12 @@ static void sfp_fixup_ignore_tx_fault(struct sfp *sfp) sfp->state_ignore_mask |=SFP_F_TX_FAULT ; } +static void sfp_fixup_ignore_tx_fault_and_los (struct sfp *sfp) +{ +sfp_fixup_ignore_tx_fault (sfp); +sfp_fixup_ignore_los (sfp); +} +static void sfp_fixup_ignore_hw (struct sfp *sfp,unsigned int mask) { sfp->state_hw_mask &= ~mask;
@@ -523,7 +529,7 @@ static const struct sfp_quirk sfp_quirks[] = {// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd NRZ in // their EEPROM SFP_QUIRK ("HUAWEI" ,"MA5671A" , sfp_quirk_2500basex, - sfp_fixup_ignore_tx_fault), + sfp_fixup_ignore_tx_fault_and_los),// Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but // incorrectly report 2500MBd NRZ in their EEPROM.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/460 serial: caif: hold tty->link reference in ldisc_open and ser_release
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <[email protected]>
[ Upstream commit 288598d80a068a0e9281de35bcb4ce495f189e2a ]
A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.
Hold an extra kref on tty->link for the lifetime of the caif_serial line
discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.
With this change applied, the reproducer no longer triggers the UAF in my testing.
--- drivers/net/caif/caif_serial.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/caif/caif_serial.c +3 -0
@@ -311,6 +311,7 @@ static void ser_release(struct work_struct *work)dev_close (ser->dev);unregister_netdevice (ser->dev);debugfs_deinit (ser); +tty_kref_put (tty->link);tty_kref_put (tty); }rtnl_unlock ();
@@ -345,6 +346,7 @@ static int ldisc_open(struct tty_struct *tty) ser =netdev_priv (dev); ser->tty =tty_kref_get (tty); +tty_kref_get (tty->link); ser->dev = dev;debugfs_init (ser, tty); tty->receive_room =N_TTY_BUF_SIZE ;
@@ -353,6 +355,7 @@ static int ldisc_open(struct tty_struct *tty)rtnl_lock (); result =register_netdevice (dev);if (result) { +tty_kref_put (tty->link);tty_kref_put (tty);rtnl_unlock ();free_netdev (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/460 bnxt_en: Fix RSS table size check when changing ethtool channels
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Chebbi <[email protected]>
[ Upstream commit 0d9a60a0618d255530ca56072c5f39eb58e1ed4a ]
When changing channels, the current check in bnxt_set_channels() is not checking for non-default RSS contexts when the RSS table size changes. The current check for IFF_RXFH_CONFIGURED is only sufficient for the default RSS context. Expand the check to include the presence of any non-default RSS contexts.
Allowing such change will result in incorrect configuration of the context's RSS table when the table size changes.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +2 -2
@@ -958,8 +958,8 @@ static int bnxt_set_channels(struct net_device *dev,if (bnxt_get_nr_rss_ctxs (bp, req_rx_rings) !=bnxt_get_nr_rss_ctxs (bp, bp->rx_nr_rings) && -netif_is_rxfh_configured (dev)) { -netdev_warn (dev,"RSS table size change required, RSS table entries must be default to proceed\n" ); + (netif_is_rxfh_configured (dev) || bp->num_rss_ctx)) { +netdev_warn (dev,"RSS table size change required, RSS table entries must be default (with no additional RSS contexts present) to proceed\n" );return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/460 mctp: i2c: fix skb memory leak in receive path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haiyue Wang <[email protected]>
[ Upstream commit e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69 ]
When 'midev->allow_rx' is false, the newly allocated skb isn't consumed by netif_rx(), it needs to free the skb directly.
--- drivers/net/mctp/mctp-i2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/mctp/mctp-i2c.c +1 -0
@@ -344,6 +344,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev) }else { status =NET_RX_DROP ;spin_unlock_irqrestore (&midev->lock, flags); +kfree_skb (skb); }if (status ==NET_RX_SUCCESS ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/460 can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenyuan Li <[email protected]>
[ Upstream commit 47bba09b14fa21712398febf36cb14fd4fc3bded ]
In hi3110_open(), the return value of hi3110_power_enable() is not checked. If power enable fails, the device may not function correctly, while the driver still returns success.
Add a check for the return value and propagate the error accordingly.
--- drivers/net/can/spi/hi311x.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/can/spi/hi311x.c +4 -1
@@ -756,7 +756,9 @@ static int hi3110_open(struct net_device *net)return ret;mutex_lock (&priv->hi3110_lock); -hi3110_power_enable (priv->transceiver,1 ); + ret =hi3110_power_enable (priv->transceiver,1 ); +if (ret) + goto out_close_candev; priv->force_quit =0 ; priv->tx_skb =NULL ;
@@ -791,6 +793,7 @@ static int hi3110_open(struct net_device *net)hi3110_hw_sleep (spi); out_close:hi3110_power_enable (priv->transceiver,0 ); + out_close_candev:close_candev (net);mutex_unlock (&priv->hi3110_lock);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/460 bonding: add ESP offload features when slaves support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 4861333b42178fa3d8fd1bb4e2cfb2fedc968dba ]
Add NETIF_F_GSO_ESP bit to bond's gso_partial_features if all slaves support it, such that ESP segmentation is handled by hardware if possible.
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
--- drivers/net/bonding/bond_main.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/bonding/bond_main.c +9 -0
@@ -1558,6 +1558,7 @@ static void bond_compute_features(struct bonding *bond) {unsigned int dst_release_flag =IFF_XMIT_DST_RELEASE |IFF_XMIT_DST_RELEASE_PERM ; +netdev_features_t gso_partial_features =NETIF_F_GSO_ESP ;netdev_features_t vlan_features =BOND_VLAN_FEATURES ;netdev_features_t enc_features =BOND_ENC_FEATURES ;#ifdef CONFIG_XFRM_OFFLOAD
@@ -1591,6 +1592,9 @@ static void bond_compute_features(struct bonding *bond) BOND_XFRM_FEATURES);#endif /* CONFIG_XFRM_OFFLOAD */ +if (slave->dev->hw_enc_features &NETIF_F_GSO_PARTIAL ) + gso_partial_features &= slave->dev->gso_partial_features; + mpls_features =netdev_increment_features (mpls_features, slave->dev->mpls_features,BOND_MPLS_FEATURES );
@@ -1604,6 +1608,11 @@ static void bond_compute_features(struct bonding *bond) } bond_dev->hard_header_len = max_hard_header_len; +if (gso_partial_features &NETIF_F_GSO_ESP ) + bond_dev->gso_partial_features |=NETIF_F_GSO_ESP ; +else + bond_dev->gso_partial_features &= ~NETIF_F_GSO_ESP ; + done: bond_dev->vlan_features = vlan_features; bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/460 bonding: Correctly support GSO ESP offload
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 9e6c4e6b605c1fa3e24f74ee0b641e95f090188a ]
The referenced fix is incomplete. It correctly computes bond_dev->gso_partial_features across slaves, but unfortunately netdev_fix_features discards gso_partial_features from the feature set if NETIF_F_GSO_PARTIAL isn't set in bond_dev->features.
This is visible with ethtool -k bond0 | grep esp:
tx-esp-segmentation: off [requested on]
esp-hw-offload: on
esp-tx-csum-hw-offload: on
This patch reworks the bonding GSO offload support by:
- making aggregating gso_partial_features across slaves similar to the other feature sets (this part is a no-op).
- advertising the default partial gso features on empty bond devs, same as with other feature sets (also a no-op).
- adding NETIF_F_GSO_PARTIAL to hw_enc_features filtered across slaves.
- adding NETIF_F_GSO_PARTIAL to features in bond_setup()
With all of these, 'ethtool -k bond0 | grep esp' now reports:
tx-esp-segmentation: on
esp-hw-offload: on
esp-tx-csum-hw-offload: on
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
--- drivers/net/bonding/bond_main.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/net/bonding/bond_main.c +10 -9
@@ -1548,17 +1548,20 @@ static netdev_features_t bond_fix_features(struct net_device *dev, NETIF_F_HIGHDMA | NETIF_F_LRO)#define BOND_ENC_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ - NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE) + NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE | \ + NETIF_F_GSO_PARTIAL)#define BOND_MPLS_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ NETIF_F_GSO_SOFTWARE) +#define BOND_GSO_PARTIAL_FEATURES (NETIF_F_GSO_ESP) +static void bond_compute_features (struct bonding *bond) { +netdev_features_t gso_partial_features =BOND_GSO_PARTIAL_FEATURES ;unsigned int dst_release_flag =IFF_XMIT_DST_RELEASE |IFF_XMIT_DST_RELEASE_PERM ; -netdev_features_t gso_partial_features =NETIF_F_GSO_ESP ;netdev_features_t vlan_features =BOND_VLAN_FEATURES ;netdev_features_t enc_features =BOND_ENC_FEATURES ;#ifdef CONFIG_XFRM_OFFLOAD
@@ -1592,8 +1595,9 @@ static void bond_compute_features(struct bonding *bond) BOND_XFRM_FEATURES);#endif /* CONFIG_XFRM_OFFLOAD */ -if (slave->dev->hw_enc_features &NETIF_F_GSO_PARTIAL ) - gso_partial_features &= slave->dev->gso_partial_features; + gso_partial_features =netdev_increment_features (gso_partial_features, + slave->dev->gso_partial_features, +BOND_GSO_PARTIAL_FEATURES ); mpls_features = netdev_increment_features(mpls_features, slave->dev->mpls_features,
@@ -1608,12 +1612,8 @@ static void bond_compute_features(struct bonding *bond) } bond_dev->hard_header_len = max_hard_header_len; -if (gso_partial_features &NETIF_F_GSO_ESP ) - bond_dev->gso_partial_features |=NETIF_F_GSO_ESP ; -else - bond_dev->gso_partial_features &= ~NETIF_F_GSO_ESP ; - done: + bond_dev->gso_partial_features = gso_partial_features; bond_dev->vlan_features = vlan_features; bond_dev->hw_enc_features = enc_features |NETIF_F_GSO_ENCAP_ALL | NETIF_F_HW_VLAN_CTAG_TX |
@@ -6082,6 +6082,7 @@ void bond_setup(struct net_device *bond_dev) bond_dev->hw_features |=NETIF_F_GSO_ENCAP_ALL ; bond_dev->features |= bond_dev->hw_features; bond_dev->features |=NETIF_F_HW_VLAN_CTAG_TX |NETIF_F_HW_VLAN_STAG_TX ; + bond_dev->features |=NETIF_F_GSO_PARTIAL ;#ifdef CONFIG_XFRM_OFFLOAD bond_dev->hw_features |=BOND_XFRM_FEATURES ;/* Only enable XFRM features if this is an active-backup config */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/460 net: add a common function to compute features for upper devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 28098defc79fe7d29e6bfe4eb6312991f6bdc3d3 ]
Some high level software drivers need to compute features from lower devices. But each has their own implementations and may lost some feature compute. Let's use one common function to compute features for kinds of these devices.
The new helper uses the current bond implementation as the reference one, as the latter already handles all the relevant aspects: netdev features, TSO limits and dst retention.
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
--- include/linux/netdev_features.h | 18 +++++++ include/linux/netdevice.h | 1 + net/core/dev.c | 88 +++++++++++++++++++++++++++++++++ 3 files changed, 107 insertions(+)
include/linux/netdev_features.h +18 -0
@@ -253,6 +253,24 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start) NETIF_F_GSO_UDP_TUNNEL | \ NETIF_F_GSO_UDP_TUNNEL_CSUM) +/* virtual device features */ +#define MASTER_UPPER_DEV_VLAN_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ + NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | \ + NETIF_F_GSO_ENCAP_ALL | \ + NETIF_F_HIGHDMA | NETIF_F_LRO) + +#define MASTER_UPPER_DEV_ENC_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ + NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE | \ + NETIF_F_GSO_PARTIAL) + +#define MASTER_UPPER_DEV_MPLS_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ + NETIF_F_GSO_SOFTWARE) + +#define MASTER_UPPER_DEV_XFRM_FEATURES (NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM | \ + NETIF_F_GSO_ESP) + +#define MASTER_UPPER_DEV_GSO_PARTIAL_FEATURES (NETIF_F_GSO_ESP) +static inline netdev_features_t netdev_base_features (netdev_features_t features) { features &= ~NETIF_F_ONE_FOR_ALL ;
include/linux/netdevice.h +1 -0
@@ -4993,6 +4993,7 @@ static inline netdev_features_t netdev_add_tso_features(netdev_features_t featurint __netdev_update_features (struct net_device *dev);void netdev_update_features (struct net_device *dev);void netdev_change_features (struct net_device *dev); +void netdev_compute_master_upper_features (struct net_device *dev,bool update_header);void netif_stacked_transfer_operstate (const struct net_device *rootdev,struct net_device *dev);
net/core/dev.c +88 -0
94 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/460 bonding: use common function to compute the features
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit d4fde269a970666a30dd3abd0413273a06dd972d ]
Use the new functon netdev_compute_master_upper_features() to compute the bonding features.
Note that bond_compute_features() currently uses bond_for_each_slave() to traverse the lower devices list, and that is just a macro wrapper of netdev_for_each_lower_private(). We use similar helper netdev_for_each_lower_dev() in netdev_compute_master_upper_features() to iterate the slave device, as there is not need to get the private data.
No functional change intended.
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
--- drivers/net/bonding/bond_main.c | 99 ++------------------------------- 1 file changed, 4 insertions(+), 95 deletions(-)
drivers/net/bonding/bond_main.c +4 -95
@@ -1542,97 +1542,6 @@ static netdev_features_t bond_fix_features(struct net_device *dev,return features; } -#define BOND_VLAN_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ - NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | \ - NETIF_F_GSO_ENCAP_ALL | \ - NETIF_F_HIGHDMA | NETIF_F_LRO) - -#define BOND_ENC_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ - NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE | \ - NETIF_F_GSO_PARTIAL) - -#define BOND_MPLS_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ - NETIF_F_GSO_SOFTWARE) - -#define BOND_GSO_PARTIAL_FEATURES (NETIF_F_GSO_ESP) - - -static void bond_compute_features (struct bonding *bond) -{ -netdev_features_t gso_partial_features =BOND_GSO_PARTIAL_FEATURES ; -unsigned int dst_release_flag =IFF_XMIT_DST_RELEASE | -IFF_XMIT_DST_RELEASE_PERM ; -netdev_features_t vlan_features =BOND_VLAN_FEATURES ; -netdev_features_t enc_features =BOND_ENC_FEATURES ; -#ifdef CONFIG_XFRM_OFFLOAD -netdev_features_t xfrm_features =BOND_XFRM_FEATURES ; -#endif /* CONFIG_XFRM_OFFLOAD */ -netdev_features_t mpls_features =BOND_MPLS_FEATURES ; -struct net_device *bond_dev = bond->dev; -struct list_head *iter; -struct slave *slave; -unsigned short max_hard_header_len =ETH_HLEN ; -unsigned int tso_max_size =TSO_MAX_SIZE ; -u16 tso_max_segs =TSO_MAX_SEGS ; - -if (!bond_has_slaves (bond)) - goto done; - - vlan_features =netdev_base_features (vlan_features); - mpls_features =netdev_base_features (mpls_features); - -bond_for_each_slave (bond, slave, iter) { - vlan_features =netdev_increment_features (vlan_features, - slave->dev->vlan_features,BOND_VLAN_FEATURES ); - - enc_features =netdev_increment_features (enc_features, - slave->dev->hw_enc_features, -BOND_ENC_FEATURES ); - -#ifdef CONFIG_XFRM_OFFLOAD - xfrm_features =netdev_increment_features (xfrm_features, - slave->dev->hw_enc_features, -BOND_XFRM_FEATURES ); -#endif /* CONFIG_XFRM_OFFLOAD */ - - gso_partial_features =netdev_increment_features (gso_partial_features, - slave->dev->gso_partial_features, -BOND_GSO_PARTIAL_FEATURES ); - - mpls_features =netdev_increment_features (mpls_features, - slave->dev->mpls_features, -BOND_MPLS_FEATURES ); - - dst_release_flag &= slave->dev->priv_flags; -if (slave->dev->hard_header_len > max_hard_header_len) - max_hard_header_len = slave->dev->hard_header_len; - - tso_max_size =min (tso_max_size, slave->dev->tso_max_size); - tso_max_segs =min (tso_max_segs, slave->dev->tso_max_segs); - } - bond_dev->hard_header_len = max_hard_header_len; - -done: - bond_dev->gso_partial_features = gso_partial_features; - bond_dev->vlan_features = vlan_features; - bond_dev->hw_enc_features = enc_features |NETIF_F_GSO_ENCAP_ALL | -NETIF_F_HW_VLAN_CTAG_TX | -NETIF_F_HW_VLAN_STAG_TX ; -#ifdef CONFIG_XFRM_OFFLOAD - bond_dev->hw_enc_features |= xfrm_features; -#endif /* CONFIG_XFRM_OFFLOAD */ - bond_dev->mpls_features = mpls_features; -netif_set_tso_max_segs (bond_dev, tso_max_segs); -netif_set_tso_max_size (bond_dev, tso_max_size); - - bond_dev->priv_flags &= ~IFF_XMIT_DST_RELEASE ; -if ((bond_dev->priv_flags &IFF_XMIT_DST_RELEASE_PERM ) && - dst_release_flag == (IFF_XMIT_DST_RELEASE |IFF_XMIT_DST_RELEASE_PERM )) - bond_dev->priv_flags |=IFF_XMIT_DST_RELEASE ; - -netdev_change_features (bond_dev); -} -static void bond_setup_by_slave (struct net_device *bond_dev,struct net_device *slave_dev) {
@@ -2379,7 +2288,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, } bond->slave_cnt++; -bond_compute_features (bond); +netdev_compute_master_upper_features (bond->dev, true);bond_set_carrier (bond);/* Needs to be called before bond_select_active_slave(), which will
@@ -2631,7 +2540,7 @@ static int __bond_release_one(struct net_device *bond_dev,call_netdevice_notifiers (NETDEV_RELEASE , bond->dev); } -bond_compute_features (bond); +netdev_compute_master_upper_features (bond->dev, true);if (!(bond_dev->features &NETIF_F_VLAN_CHALLENGED ) && (old_features &NETIF_F_VLAN_CHALLENGED ))slave_info (bond_dev, slave_dev,"last VLAN challenged slave left bond - VLAN blocking is removed\n" );
@@ -4135,7 +4044,7 @@ static int bond_slave_netdev_event(unsigned long event,case NETDEV_FEAT_CHANGE :if (!bond->notifier_ctx) { bond->notifier_ctx = true; -bond_compute_features (bond); +netdev_compute_master_upper_features (bond->dev, true); bond->notifier_ctx = false; }break ;
@@ -6073,7 +5982,7 @@ void bond_setup(struct net_device *bond_dev)* capable */ - bond_dev->hw_features =BOND_VLAN_FEATURES | + bond_dev->hw_features =MASTER_UPPER_DEV_VLAN_FEATURES |NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_RX |
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/460 bonding: fix type confusion in bond_setup_by_slave()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 950803f7254721c1c15858fbbfae3deaaeeecb11 ]
kernel BUG at net/core/skbuff.c:2306!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: <TASK> ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646 __sys_sendmsg+0x170/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe1a0e6c1a9
When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond, bond_setup_by_slave() directly copies the slave's header_ops to the bond device:
bond_dev->header_ops = slave_dev->header_ops;
This causes a type confusion when dev_hard_header() is later called on the bond device. Functions like ipgre_header(), ip6gre_header(),all use netdev_priv(dev) to access their device-specific private data. When called with the bond device, netdev_priv() returns the bond's private data (struct bonding) instead of the expected type (e.g. struct ip_tunnel), leading to garbage values being read and kernel crashes.
Fix this by introducing bond_header_ops with wrapper functions that delegate to the active slave's header_ops using the slave's own device. This ensures netdev_priv() in the slave's header functions always receives the correct device.
The fix is placed in the bonding driver rather than individual device drivers, as the root cause is bond blindly inheriting header_ops from the slave without considering that these callbacks expect a specific netdev_priv() layout.
The type confusion can be observed by adding a printk in ipgre_header() and running the following commands:
ip link add dummy0 type dummy
ip addr add 10.0.0.1/24 dev dummy0
ip link set dummy0 up
ip link add gre1 type gre local 10.0.0.1 ip link add bond1 type bond mode active-backup ip link set gre1 master bond1
ip link set gre1 up
ip link set bond1 up
ip addr add fe80::1/64 dev bond1
--- drivers/net/bonding/bond_main.c | 47 ++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +46 -1
@@ -1542,6 +1542,50 @@ static netdev_features_t bond_fix_features(struct net_device *dev,return features; } +static int bond_header_create (struct sk_buff *skb,struct net_device *bond_dev, +unsigned short type,const void *daddr, +const void *saddr,unsigned int len) +{ +struct bonding *bond =netdev_priv (bond_dev); +const struct header_ops *slave_ops; +struct slave *slave; +int ret =0 ; + +rcu_read_lock (); + slave =rcu_dereference (bond->curr_active_slave); +if (slave) { + slave_ops =READ_ONCE (slave->dev->header_ops); +if (slave_ops && slave_ops->create) + ret = slave_ops->create (skb, slave->dev, + type, daddr, saddr, len); + } +rcu_read_unlock (); +return ret; +} + +static int bond_header_parse (const struct sk_buff *skb,unsigned char *haddr) +{ +struct bonding *bond =netdev_priv (skb->dev); +const struct header_ops *slave_ops; +struct slave *slave; +int ret =0 ; + +rcu_read_lock (); + slave =rcu_dereference (bond->curr_active_slave); +if (slave) { + slave_ops =READ_ONCE (slave->dev->header_ops); +if (slave_ops && slave_ops->parse) + ret = slave_ops->parse (skb, haddr); + } +rcu_read_unlock (); +return ret; +} + +static const struct header_ops bond_header_ops = { + .create = bond_header_create, + .parse = bond_header_parse, +}; +static void bond_setup_by_slave (struct net_device *bond_dev,struct net_device *slave_dev) {
@@ -1549,7 +1593,8 @@ static void bond_setup_by_slave(struct net_device *bond_dev,dev_close (bond_dev); - bond_dev->header_ops = slave_dev->header_ops; + bond_dev->header_ops = slave_dev->header_ops ? + &bond_header_ops :NULL ; bond_dev->type = slave_dev->type; bond_dev->hard_header_len = slave_dev->hard_header_len;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/460 mctp: route: hold key->lock in mctp_flow_prepare_output()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
[ Upstream commit 7d86aa41c073c4e7eb75fd2e674f1fd8f289728a ]
mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key(), but it does not hold key->lock while doing so.
mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output() without holding key->lock, so the check-and-set sequence is racy.
Example interleaving:
CPU0 CPU1
---- ----
mctp_flow_prepare_output(key, devA)
if (!key->dev) // sees NULL
mctp_flow_prepare_output(
key, devB)
if (!key->dev) // still NULL
mctp_dev_set_key(devB, key)
mctp_dev_hold(devB)
key->dev = devB
mctp_dev_set_key(devA, key)
mctp_dev_hold(devA)
key->dev = devA // overwrites devBNow both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev.
Fix by taking key->lock around the key->dev check and mctp_dev_set_key() call.
--- net/mctp/route.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/mctp/route.c +7 -4
@@ -306,6 +306,7 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) {struct mctp_sk_key *key;struct mctp_flow *flow; +unsigned long flags; flow =skb_ext_find (skb,SKB_EXT_MCTP );if (!flow)
@@ -313,12 +314,14 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) key = flow->key; -if (key->dev) { +spin_lock_irqsave (&key->lock, flags); + +if (!key->dev) +mctp_dev_set_key (dev, key); +else WARN_ON (key->dev != dev); -return ; - } - mctp_dev_set_key(dev, key); + spin_unlock_irqrestore(&key->lock, flags); }#else static void mctp_skb_set_flow (struct sk_buff *skb,struct mctp_sk_key *key) {}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/460 amd-xgbe: fix link status handling in xgbe_rx_adaptation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit 6485cb96be5cd0f4bf39554737ba11322cc9b053 ]
The link status bit is latched low to allow detection of momentary link drops. If the status indicates that the link is already down, read it again to obtain the current state.
--- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +14 -5
@@ -2050,7 +2050,7 @@ static void xgbe_set_rx_adap_mode(struct xgbe_prv_data *pdata,static void xgbe_rx_adaptation (struct xgbe_prv_data *pdata) {struct xgbe_phy_data *phy_data = pdata->phy_data; -unsigned int reg; +int reg;/* step 2: force PCS to send RX_ADAPT Req to PHY */ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_EQ_CTRL4,
@@ -2072,11 +2072,20 @@ static void xgbe_rx_adaptation(struct xgbe_prv_data *pdata)/* Step 4: Check for Block lock */ -/* Link status is latched low, so read once to clear -* and then read again to get current state -*/ - reg =XMDIO_READ (pdata,MDIO_MMD_PCS ,MDIO_STAT1 ); reg =XMDIO_READ (pdata,MDIO_MMD_PCS ,MDIO_STAT1 ); +if (reg <0 ) + goto set_mode; + +/* Link status is latched low so that momentary link drops +* can be detected. If link was already down read again +* to get the latest state. +*/ +if (!pdata->phy.link && !(reg &MDIO_STAT1_LSTATUS )) { + reg =XMDIO_READ (pdata,MDIO_MMD_PCS ,MDIO_STAT1 ); +if (reg <0 ) + goto set_mode; + } +if (reg &MDIO_STAT1_LSTATUS ) {/* If the block lock is found, update the helpers * and declare the link up
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/460 amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit 27a4dd0c702b3b2b9cf2c045d100cc2fe8720b81 ]
When operating in 10GBASE-KR mode with auto-negotiation disabled and RX adaptation enabled, CRC errors can occur during the RX adaptation process. This happens because the driver continues transmitting and receiving packets while adaptation is in progress.
Fix this by stopping TX/RX immediately when the link goes down and RX adaptation needs to be re-triggered, and only re-enabling TX/RX after adaptation completes and the link is confirmed up. Introduce a flag to track whether TX/RX was disabled for adaptation so it can be restored correctly.
This prevents packets from being transmitted or received during the RX adaptation window and avoids CRC errors from corrupted frames.
The flag tracking the data path state is synchronized with hardware state in xgbe_start() to prevent stale state after device restarts. This ensures that after a restart cycle (where xgbe_stop disables TX/RX and xgbe_start re-enables them), the flag correctly reflects that the data path is active.
--- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 63 ++++++++++++++++++++- drivers/net/ethernet/amd/xgbe/xgbe.h | 4 ++ 3 files changed, 69 insertions(+), 2 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-drv.c +4 -0
@@ -1338,6 +1338,10 @@ static int xgbe_start(struct xgbe_prv_data *pdata) hw_if->enable_tx (pdata); hw_if->enable_rx (pdata); +/* Synchronize flag with hardware state after enabling TX/RX. +* This prevents stale state after device restart cycles. +*/ + pdata->data_path_stopped = false;udp_tunnel_nic_reset_ntf (netdev);
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +61 -2
88 lines not on this page · raw message
drivers/net/ethernet/amd/xgbe/xgbe.h +4 -0
@@ -1321,6 +1321,10 @@ struct xgbe_prv_data {bool en_rx_adap;int rx_adapt_retries;bool rx_adapt_done; +/* Flag to track if data path (TX/RX) was stopped for RX adaptation. +* This prevents packet corruption during the adaptation window. +*/ +bool data_path_stopped;bool mode_set; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/460 xdp: allow attaching already registered memory model to xdp_rxq_info
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Lobakin <[email protected]>
[ Upstream commit f65966fe0178c06065d354c22fb456fc4370b527 ]
One may need to register memory model separately from xdp_rxq_info. One simple example may be XDP test run code, but in general, it might be useful when memory model registering is managed by one layer and then XDP RxQ info by a different one.
Allow such scenarios by adding a simple helper which "attaches" already registered memory model to the desired xdp_rxq_info. As this is mostly needed for Page Pool, add a special function to do that for a &page_pool pointer.
Stable-dep-of: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions")
--- include/net/xdp.h | 32 +++++++++++++++++++++++++++ net/core/xdp.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+)
include/net/xdp.h +32 -0
@@ -356,6 +356,38 @@ void xdp_rxq_info_unreg_mem_model(struct xdp_rxq_info *xdp_rxq);int xdp_reg_mem_model (struct xdp_mem_info *mem,enum xdp_mem_type type,void *allocator);void xdp_unreg_mem_model (struct xdp_mem_info *mem); +int xdp_reg_page_pool (struct page_pool *pool); +void xdp_unreg_page_pool (const struct page_pool *pool); +void xdp_rxq_info_attach_page_pool (struct xdp_rxq_info *xdp_rxq, +const struct page_pool *pool); + +/** +* xdp_rxq_info_attach_mem_model - attach registered mem info to RxQ info +* @xdp_rxq: XDP RxQ info to attach the memory info to +* @mem: already registered memory info +* +* If the driver registers its memory providers manually, it must use this +* function instead of xdp_rxq_info_reg_mem_model(). +*/ +static inline void +xdp_rxq_info_attach_mem_model (struct xdp_rxq_info *xdp_rxq, +const struct xdp_mem_info *mem) +{ + xdp_rxq->mem = *mem; +} + +/** +* xdp_rxq_info_detach_mem_model - detach registered mem info from RxQ info +* @xdp_rxq: XDP RxQ info to detach the memory info from +* +* If the driver registers its memory providers manually and then attaches it +* via xdp_rxq_info_attach_mem_model(), it must call this function before +* xdp_rxq_info_unreg(). +*/ +static inline void xdp_rxq_info_detach_mem_model (struct xdp_rxq_info *xdp_rxq) +{ + xdp_rxq->mem = (struct xdp_mem_info ){ }; +}/* Drivers not supporting XDP metadata can use this helper, which * rejects any room expansion for metadata as a result.
net/core/xdp.c +56 -0
62 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/460 xdp: register system page pool as an XDP memory model
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit e77d9aee951341119be16a991fcfc76d1154d22a ]
To make the system page pool usable as a source for allocating XDP frames, we need to register it with xdp_reg_mem_model(), so that page return works correctly. This is done in preparation for using the system page_pool to convert XDP_PASS XSk frames to skbs; for the same reason, make the per-cpu variable non-static so we can access it from other source files as well (but w/o exporting).
Stable-dep-of: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions")
--- include/linux/netdevice.h | 1 + net/core/dev.c | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-)
include/linux/netdevice.h +1 -0
@@ -3256,6 +3256,7 @@ struct softnet_data { }; DECLARE_PER_CPU_ALIGNED(struct softnet_data, softnet_data); +DECLARE_PER_CPU(struct page_pool *, system_page_pool);#ifndef CONFIG_PREEMPT_RT static inline int dev_recursion_level (void )
net/core/dev.c +9 -1
@@ -460,7 +460,7 @@ EXPORT_PER_CPU_SYMBOL(softnet_data);* PP consumers must pay attention to run APIs in the appropriate context * (e.g. NAPI context). */ -static DEFINE_PER_CPU(struct page_pool *, system_page_pool); +DEFINE_PER_CPU(struct page_pool *, system_page_pool);#ifdef CONFIG_LOCKDEP /*
@@ -12225,11 +12225,18 @@ static int net_page_pool_create(int cpuid) .nid = cpu_to_mem(cpuid), };struct page_pool *pp_ptr; +int err; pp_ptr =page_pool_create_percpu (&page_pool_params, cpuid);if (IS_ERR (pp_ptr))return -ENOMEM ; + err =xdp_reg_page_pool (pp_ptr); +if (err) { +page_pool_destroy (pp_ptr); +return err; + } +per_cpu (system_page_pool, cpuid) = pp_ptr;#endif return 0 ;
@@ -12363,6 +12370,7 @@ static int __init net_dev_init(void)if (!pp_ptr)continue ; +xdp_unreg_page_pool (pp_ptr);page_pool_destroy (pp_ptr);per_cpu (system_page_pool, i) =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/460 net: add xmit recursion limit to tunnel xmit functions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 6f1a9140ecda3baba3d945b9a6155af4268aafc4 ]
Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow.
The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not sufficient because tunnel recursion involves route lookups and full IP output, consuming much more stack per level. Use a lower limit of 4 (IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.
Add recursion detection using dev_xmit_recursion helpers directly in iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).
Move dev_xmit_recursion helpers from net/core/dev.h to public header include/linux/netdevice.h so they can be used by tunnel code.
BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160 Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11 Workqueue: mld mld_ifc_work Call Trace: <TASK> __build_flow_key.constprop.0 (net/ipv4/route.c:515) ip_rt_update_pmtu (net/ipv4/route.c:1073) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) mld_sendpack mld_ifc_work process_one_work worker_thread </TASK>
--- include/linux/netdevice.h | 32 ++++++++++++++++++++++++++++++++ include/net/ip6_tunnel.h | 12 ++++++++++++ include/net/ip_tunnels.h | 7 +++++++ net/core/dev.h | 35 ----------------------------------- net/ipv4/ip_tunnel_core.c | 13 +++++++++++++ 5 files changed, 64 insertions(+), 35 deletions(-)
include/linux/netdevice.h +32 -0
@@ -3258,17 +3258,49 @@ struct softnet_data { DECLARE_PER_CPU_ALIGNED(struct softnet_data, softnet_data); DECLARE_PER_CPU(struct page_pool *, system_page_pool); +#define XMIT_RECURSION_LIMIT 8 +#ifndef CONFIG_PREEMPT_RT static inline int dev_recursion_level (void ) {return this_cpu_read (softnet_data.xmit.recursion); } + +static inline bool dev_xmit_recursion (void ) +{ +return unlikely (__this_cpu_read (softnet_data.xmit.recursion) > +XMIT_RECURSION_LIMIT ); +} + +static inline void dev_xmit_recursion_inc (void ) +{ +__this_cpu_inc (softnet_data.xmit.recursion); +} + +static inline void dev_xmit_recursion_dec (void ) +{ +__this_cpu_dec (softnet_data.xmit.recursion); +}#else static inline int dev_recursion_level (void ) {return current->net_xmit.recursion; } +static inline bool dev_xmit_recursion (void ) +{ +return unlikely (current->net_xmit.recursion >XMIT_RECURSION_LIMIT ); +} + +static inline void dev_xmit_recursion_inc (void ) +{ + current->net_xmit.recursion++; +} + +static inline void dev_xmit_recursion_dec (void ) +{ + current->net_xmit.recursion--; +}#endif void __netif_schedule (struct Qdisc *q);
include/net/ip6_tunnel.h +12 -0
@@ -156,6 +156,16 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb, {int pkt_len, err; +if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); +kfree_skb (skb); +return ; + } + +dev_xmit_recursion_inc (); +memset (skb->cb,0 ,sizeof (struct inet6_skb_parm )); pkt_len = skb->len -skb_inner_network_offset (skb); err =ip6_local_out (dev_net (skb_dst (skb)->dev), sk, skb);
@@ -165,6 +175,8 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb, pkt_len =-1 ;iptunnel_xmit_stats (dev, pkt_len); } + +dev_xmit_recursion_dec (); }#endif #endif
include/net/ip_tunnels.h +7 -0
@@ -24,6 +24,13 @@#include <net/ip6_route.h> #endif +/* Recursion limit for tunnel xmit to detect routing loops. +* Unlike XMIT_RECURSION_LIMIT (8) used in the no-qdisc path, tunnel +* recursion involves route lookups and full IP output, consuming much +* more stack per level, so a lower limit is needed. +*/ +#define IP_TUNNEL_RECURSION_LIMIT 4 +/* Keep error state on tunnel for 30 sec */ #define IPTUNNEL_ERR_TIMEO (30*HZ)
net/core/dev.h +0 -35
@@ -162,41 +162,6 @@ static inline void napi_assert_will_not_race(const struct napi_struct *napi)void kick_defer_list_purge (struct softnet_data *sd,unsigned int cpu); -#define XMIT_RECURSION_LIMIT 8 - -#ifndef CONFIG_PREEMPT_RT -static inline bool dev_xmit_recursion (void ) -{ -return unlikely (__this_cpu_read (softnet_data.xmit.recursion) > -XMIT_RECURSION_LIMIT ); -} - -static inline void dev_xmit_recursion_inc (void ) -{ -__this_cpu_inc (softnet_data.xmit.recursion); -} - -static inline void dev_xmit_recursion_dec (void ) -{ -__this_cpu_dec (softnet_data.xmit.recursion); -} -#else -static inline bool dev_xmit_recursion (void ) -{ -return unlikely (current->net_xmit.recursion >XMIT_RECURSION_LIMIT ); -} - -static inline void dev_xmit_recursion_inc (void ) -{ - current->net_xmit.recursion++; -} - -static inline void dev_xmit_recursion_dec (void ) -{ - current->net_xmit.recursion--; -} -#endif -int dev_set_hwtstamp_phylib (struct net_device *dev,struct kernel_hwtstamp_config *cfg,struct netlink_ext_ack *extack);
net/ipv4/ip_tunnel_core.c +13 -0
@@ -57,6 +57,17 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,struct iphdr *iph;int err; +if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); +ip_rt_put (rt); +kfree_skb (skb); +return ; + } + +dev_xmit_recursion_inc (); +skb_scrub_packet (skb, xnet);skb_clear_hash_if_not_l4 (skb);
@@ -86,6 +97,8 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb, pkt_len =0 ;iptunnel_xmit_stats (dev, pkt_len); } + +dev_xmit_recursion_dec (); }EXPORT_SYMBOL_GPL (iptunnel_xmit);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/460 netfilter: nf_tables: always walk all pending catchall elements
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9 ]
During transaction processing we might have more than one catchall element:
1 live catchall element and 1 pending element that is coming as part of the new batch.
If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate.
Otherwise, we get:
WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]
--- net/netfilter/nf_tables_api.c | 2 -- 1 file changed, 2 deletions(-)
net/netfilter/nf_tables_api.c +0 -2
@@ -700,7 +700,6 @@ static void nft_map_catchall_deactivate(const struct nft_ctx *ctx,nft_set_elem_change_active (ctx->net, set, ext);nft_setelem_data_deactivate (ctx->net, set, catchall->elem); -break ; } }
@@ -5706,7 +5705,6 @@ static void nft_map_catchall_activate(const struct nft_ctx *ctx,nft_clear (ctx->net, ext);nft_setelem_data_activate (ctx->net, set, catchall->elem); -break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/460 netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <[email protected]>
[ Upstream commit d6d8cd2db236a9dd13dbc2d05843b3445cc964b5 ]
pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the to_offset argument on every iteration, including the last one where i == m->field_count - 1. This reads one element past the end of the stack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS] with NFT_PIPAPO_MAX_FIELDS == 16).
Although pipapo_unmap() returns early when is_last is true without using the to_offset value, the argument is evaluated at the call site before the function body executes, making this a genuine out-of-bounds stack read confirmed by KASAN:
BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables] Read of size 4 at addr ffff8000810e71a4
This frame has 1 object:
[32, 160) 'rulemap'
The buggy address is at offset 164 -- exactly 4 bytes past the end of the rulemap array.
Pass 0 instead of rulemap[i + 1].n on the last iteration to avoid the out-of-bounds read.
--- net/netfilter/nft_set_pipapo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nft_set_pipapo.c +2 -1
@@ -1627,6 +1627,7 @@ static void pipapo_drop(struct nft_pipapo_match *m,int i;nft_pipapo_for_each_field (f, i, m) { +bool last = i == m->field_count -1 ;int g;for (g =0 ; g < f->groups; g++) {
@@ -1646,7 +1647,7 @@ static void pipapo_drop(struct nft_pipapo_match *m, }pipapo_unmap (f->mt, f->rules, rulemap[i].to, rulemap[i].n, - rulemap[i +1 ].n, i == m->field_count -1 ); + last ?0 : rulemap[i +1 ].n, last);if (pipapo_resize (f, f->rules, f->rules - rulemap[i].n)) {/* We can ignore this, a failure to shrink tables down * doesn't make tables invalid.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/460 netfilter: x_tables: guard option walkers against 1-byte tail reads
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Dull <[email protected]>
[ Upstream commit cfe770220ac2dbd3e104c6b45094037455da81d4 ]
When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers.
--- net/netfilter/xt_dccp.c | 4 ++-- net/netfilter/xt_tcpudp.c | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-)
net/netfilter/xt_dccp.c +2 -2
@@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option,return true; } -if (op[i] <2 ) +if (op[i] <2 || i == optlen -1 ) i++;else - i += op[i+1 ]?:1 ; + i += op[i +1 ] ? :1 ; }spin_unlock_bh (&dccp_buflock);
net/netfilter/xt_tcpudp.c +4 -2
@@ -59,8 +59,10 @@ tcp_find_option(u_int8_t option,for (i =0 ; i < optlen; ) {if (op[i] == option)return !invert; -if (op[i] <2 ) i++; -else i += op[i+1 ]?:1 ; +if (op[i] <2 || i == optlen -1 ) + i++; +else + i += op[i +1 ] ? :1 ; }return invert;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/460 netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit f1ba83755d81c6fc66ac7acd723d238f974091e9 ]
nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff.
This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory.
Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.
--- net/netfilter/nfnetlink_queue.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nfnetlink_queue.c +3 -1
@@ -1547,8 +1547,10 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,if (entry->state.pf ==PF_BRIDGE ) { err =nfqa_parse_bridge (entry, nfqa); -if (err <0 ) +if (err <0 ) { +nfqnl_reinject (entry,NF_DROP );return err; + } }if (nfqa[NFQA_PAYLOAD ]) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/460 netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 ]
nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].
The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds.
BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0
--- net/netfilter/nfnetlink_cthelper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/nfnetlink_cthelper.c +4 -4
@@ -603,10 +603,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) goto out; } } - } -if (cb->args[1 ]) { - cb->args[1 ] =0 ; - goto restart; +if (cb->args[1 ]) { + cb->args[1 ] =0 ; + goto restart; + } } out:rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/460 netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Tan <[email protected]>
[ Upstream commit 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf ]
IDLETIMER revision 0 rules reuse existing timers by label and always call mod_timer() on timer->timer.
If the label was created first by revision 1 with XT_IDLETIMER_ALARM, the object uses alarm timer semantics and timer->timer is never initialized. Reusing that object from revision 0 causes mod_timer() on an uninitialized timer_list, triggering debugobjects warnings and possible panic when panic_on_warn=1.
Fix this by rejecting revision 0 rule insertion when an existing timer with the same label is of ALARM type.
--- net/netfilter/xt_IDLETIMER.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/xt_IDLETIMER.c +6 -0
@@ -320,6 +320,12 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par) info->timer =__idletimer_tg_find_by_label (info->label);if (info->timer) { +if (info->timer->timer_type &XT_IDLETIMER_ALARM ) { +pr_debug ("Adding/Replacing rule with same label and different timer type is not allowed\n" ); +mutex_unlock (&list_mutex); +return -EINVAL ; + } + info->timer->refcnt++;mod_timer (&info->timer->timer,msecs_to_jiffies (info->timeout *1000 ) + jiffies);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/460 perf annotate: Fix hashmap__new() error checking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit bf29cb3641b80bac759c3332b02e0b270e16bf94 ]
The hashmap__new() function never returns NULL, it returns error pointers. Fix the error checking to match.
Additionally, set src->samples to NULL to prevent any later code from accidentally using the error pointer.
--- tools/perf/util/annotate.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/annotate.c +4 -1
@@ -44,6 +44,7 @@#include "strbuf.h" #include <regex.h> #include <linux/bitops.h> +#include <linux/err.h> #include <linux/kernel.h> #include <linux/string.h> #include <linux/zalloc.h>
@@ -135,8 +136,10 @@ static int annotated_source__alloc_histograms(struct annotated_source *src,return -1 ; src->samples =hashmap__new (sym_hist_hash, sym_hist_equal,NULL ); -if (src->samples ==NULL ) +if (IS_ERR (src->samples)) {zfree (&src->histograms); + src->samples =NULL ; + }return src->histograms ?0 :-1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/460 regulator: pca9450: Correct interrupt type
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 5d0efaf47ee90ac60efae790acee3a3ed99ebf80 ]
Kernel warning on i.MX8MP-EVK when doing module test:
irq: type mismatch, failed to map hwirq-3 for gpio@30200000!
Per PCA945[X] specification: The IRQ_B pin is pulled low when any unmasked interrupt bit status is changed and it is released high once application processor read INT1 register.
So the interrupt should be configured as IRQF_TRIGGER_LOW, not IRQF_TRIGGER_FALLING.
--- drivers/regulator/pca9450-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/pca9450-regulator.c +1 -1
@@ -965,7 +965,7 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)if (pca9450->irq) { ret =devm_request_threaded_irq (pca9450->dev, pca9450->irq,NULL , pca9450_irq_handler, - (IRQF_TRIGGER_FALLING |IRQF_ONESHOT ), + (IRQF_TRIGGER_LOW |IRQF_ONESHOT ),"pca9450-irq" , pca9450);if (ret !=0 ) { dev_err(pca9450->dev, "Failed to request IRQ: %d\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/460 perf ftrace: Fix hashmap__new() error checking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit be34705aa527872e5ce83927b7bc9307ba8095ca ]
The hashmap__new() function never returns NULL, it returns error pointers. Fix the error checking to match.
Additionally, set ftrace->profile_hash to NULL on error, and return the exact error code from hashmap__new().
--- tools/perf/builtin-ftrace.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
tools/perf/builtin-ftrace.c +7 -2
@@ -18,6 +18,7 @@#include <poll.h> #include <ctype.h> #include <linux/capability.h> +#include <linux/err.h> #include <linux/string.h> #include "debug.h"
@@ -998,8 +999,12 @@ static int prepare_func_profile(struct perf_ftrace *ftrace) ftrace->graph_tail =1 ; ftrace->profile_hash =hashmap__new (profile_hash, profile_equal,NULL ); -if (ftrace->profile_hash ==NULL ) -return -ENOMEM ; +if (IS_ERR (ftrace->profile_hash)) { +int err =PTR_ERR (ftrace->profile_hash); + + ftrace->profile_hash =NULL ; +return err; + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/460 sched: idle: Make skipping governor callbacks more consistent
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit d557640e4ce589a24dca5ca7ce3b9680f471325f ]
If the cpuidle governor .select() callback is skipped because there is only one idle state in the cpuidle driver, the .reflect() callback should be skipped as well, at least for consistency (if not for correctness), so do it.
--- drivers/cpuidle/cpuidle.c | 10 ---------- kernel/sched/idle.c | 11 ++++++++++- 2 files changed, 10 insertions(+), 11 deletions(-)
drivers/cpuidle/cpuidle.c +0 -10
@@ -353,16 +353,6 @@ noinstr int cpuidle_enter_state(struct cpuidle_device *dev,int cpuidle_select (struct cpuidle_driver *drv,struct cpuidle_device *dev,bool *stop_tick) { -/* -* If there is only a single idle state (or none), there is nothing -* meaningful for the governor to choose. Skip the governor and -* always use state 0 with the tick running. -*/ -if (drv->state_count <=1 ) { - *stop_tick = false; -return 0 ; - } -return cpuidle_curr_governor->select (drv, dev, stop_tick); }
kernel/sched/idle.c +10 -1
@@ -214,7 +214,7 @@ static void cpuidle_idle_call(void) next_state =cpuidle_find_deepest_state (drv, dev, max_latency_ns);call_cpuidle (drv, dev, next_state); - }else { + }else if (drv->state_count >1 ) {bool stop_tick = true;/*
@@ -232,6 +232,15 @@ static void cpuidle_idle_call(void)* Give the governor an opportunity to reflect on the outcome */ cpuidle_reflect (dev, entered_state); + }else { +tick_nohz_idle_retain_tick (); + +/* +* If there is only a single idle state (or none), there is +* nothing meaningful for the governor to choose. Skip the +* governor and always use state 0. +*/ +call_cpuidle (drv, dev,0 ); } exit_idle:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/460 nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungwoo Kim <[email protected]>
[ Upstream commit b4e78f1427c7d6859229ae9616df54e1fc05a516 ]
dev->online_queues is a count incremented in nvme_init_queue. Thus, valid indices are 0 through dev->online_queues − 1.
This patch fixes the loop condition to ensure the index stays within the valid range. Index 0 is excluded because it is the admin queue.
KASAN splat:
==================================================================
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline] BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404 Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74 CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: nvme-reset-wq nvme_reset_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x5d0 mm/kasan/report.c:482 kasan_report+0xdc/0x110 mm/kasan/report.c:595 __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379 nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline] nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404 nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> Allocated by task 34 on cpu 1 at 4.241550s: kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57 kasan_save_track+0x1c/0x70 mm/kasan/common.c:78 kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663 kmalloc_array_node_noprof include/linux/slab.h:1075 [inline] nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline] nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534 local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324 pci_call_probe drivers/pci/pci-driver.c:392 [inline] __pci_device_probe drivers/pci/pci-driver.c:417 [inline] pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x29b/0xb70 drivers/base/dd.c:661 __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803 driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833 __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159 async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the object at ffff88800592a000 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 244 bytes to the right of
allocated 1152-byte region [ffff88800592a000, ffff88800592a480)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff) page_type: f5(slab) raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000003 ffffea0000164a01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800592a400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88800592a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800592a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88800592a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800592a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================--- drivers/nvme/host/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/pci.c +1 -1
@@ -343,7 +343,7 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)/* Free memory and continue on */ nvme_dbbuf_dma_free (dev); -for (i =1 ; i <= dev->online_queues; i++) +for (i =1 ; i < dev->online_queues; i++)nvme_dbbuf_free (&dev->queues[i]); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/460 nvme-pci: Fix race bug in nvme_poll_irqdisable()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungwoo Kim <[email protected]>
[ Upstream commit fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e ]
In the following scenario, pdev can be disabled between (1) and (3) by (2). This sets pdev->msix_enabled = 0. Then, pci_irq_vector() will return MSI-X IRQ(>15) for (1) whereas return INTx IRQ(<=15) for (2). This causes IRQ warning because it tries to enable INTx IRQ that has never been disabled before.
To fix this, save IRQ number into a local variable and ensure disable_irq() and enable_irq() operate on the same IRQ number. Even if pci_free_irq_vectors() frees the IRQ concurrently, disable_irq() and enable_irq() on a stale IRQ number is still valid and safe, and the depth accounting reamins balanced.
task 1:nvme_poll_irqdisable()
disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(1) enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(3)
task 2:nvme_reset_work()
nvme_dev_disable()
pdev->msix_enable = 0; ...(2)
crash log:
------------[ cut here ]------------ Unbalanced enable for IRQ 10 WARNING: kernel/irq/manage.c:753 at __enable_irq+0x102/0x190 kernel/irq/manage.c:753, CPU#1: kworker/1:0H/26 Modules linked in: CPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted 6.19.0-dirty #9 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_timeout_work RIP: 0010:__enable_irq+0x107/0x190 kernel/irq/manage.c:753 Code: ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 79 48 8d 3d 2e 7a 3f 05 41 8b 74 24 2c <67> 48 0f b9 3a e8 ef b9 21 00 5b 41 5c 5d e9 46 54 66 03 e8 e1 b9 RSP: 0018:ffffc900001bf550 EFLAGS: 00010046 RAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffffb20c0e90 RDX: 0000000000000000 RSI: 000000000000000a RDI: ffffffffb74b88f0 RBP: ffffc900001bf560 R08: ffff88800197cf00 R09: 0000000000000001 R10: 0000000000000003 R11: 0000000000000003 R12: ffff8880012a6000 R13: 1ffff92000037eae R14: 000000000000000a R15: 0000000000000293 FS: 0000000000000000(0000) GS:ffff8880b49f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555da4a25fa8 CR3: 00000000208e8000 CR4: 00000000000006f0 Call Trace: <TASK> enable_irq+0x121/0x1e0 kernel/irq/manage.c:797 nvme_poll_irqdisable+0x162/0x1c0 drivers/nvme/host/pci.c:1494 nvme_timeout+0x965/0x14b0 drivers/nvme/host/pci.c:1744 blk_mq_rq_timed_out block/blk-mq.c:1653 [inline] blk_mq_handle_expired+0x227/0x2d0 block/blk-mq.c:1721 bt_iter+0x2fc/0x3a0 block/blk-mq-tag.c:292 __sbitmap_for_each_set include/linux/sbitmap.h:269 [inline] sbitmap_for_each_set include/linux/sbitmap.h:290 [inline] bt_for_each block/blk-mq-tag.c:324 [inline] blk_mq_queue_tag_busy_iter+0x969/0x1e80 block/blk-mq-tag.c:536 blk_mq_timeout_work+0x627/0x870 block/blk-mq.c:1763 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> irq event stamp: 74478 hardirqs last enabled at (74477): [<ffffffffb5720a9c>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (74477): [<ffffffffb5720a9c>] _raw_spin_unlock_irq+0x2c/0x60 kernel/locking/spinlock.c:202 hardirqs last disabled at (74478): [<ffffffffb57207b5>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (74478): [<ffffffffb57207b5>] _raw_spin_lock_irqsave+0x85/0xa0 kernel/locking/spinlock.c:162 softirqs last enabled at (74304): [<ffffffffb1e9466c>] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (74304): [<ffffffffb1e9466c>] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (74304): [<ffffffffb1e9466c>] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723 softirqs last disabled at (74287): [<ffffffffb1e9466c>] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (74287): [<ffffffffb1e9466c>] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (74287): [<ffffffffb1e9466c>] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723 ---[ end trace 0000000000000000 ]---
--- drivers/nvme/host/pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/nvme/host/pci.c +4 -2
@@ -1201,14 +1201,16 @@ static irqreturn_t nvme_irq_check(int irq, void *data)static void nvme_poll_irqdisable (struct nvme_queue *nvmeq) {struct pci_dev *pdev =to_pci_dev (nvmeq->dev->dev); +int irq;WARN_ON_ONCE (test_bit (NVMEQ_POLLED , &nvmeq->flags)); -disable_irq (pci_irq_vector (pdev, nvmeq->cq_vector)); + irq =pci_irq_vector (pdev, nvmeq->cq_vector); +disable_irq (irq);spin_lock (&nvmeq->cq_poll_lock);nvme_poll_cq (nvmeq,NULL );spin_unlock (&nvmeq->cq_poll_lock); -enable_irq (pci_irq_vector (pdev, nvmeq->cq_vector)); +enable_irq (irq); }static int nvme_poll (struct blk_mq_hw_ctx *hctx,struct io_comp_batch *iob)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/460 i40e: fix src IP mask checks and memcpy argument names in cloud filter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit e809085f492842ce7a519c9ef72d40f4bca89c13 ]
Fix following issues in the IPv4 and IPv6 cloud filter handling logic in both the add and delete paths:
- The source-IP mask check incorrectly compares mask.src_ip[0] against tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely goes unnoticed because the check is in an "else if" path that only executes when dst_ip is not set, most cloud filter use cases focus on destination-IP matching, and the buggy condition can accidentally evaluate true in some cases.
- memcpy() for the IPv4 source address incorrectly uses ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although both arrays are the same size.
- The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE (tcf.src_ip), Update these to use sizeof(cfilter->ip.v4.dst_ip) and sizeof(cfilter->ip.v4.src_ip) to ensure correct and explicit copy size.
- In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent explicit, even though both fields are struct in6_addr.
--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +7 -7
@@ -3821,10 +3821,10 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg) cfilter.n_proto =ETH_P_IP ;if (mask.dst_ip[0 ] & tcf.dst_ip[0 ])memcpy (&cfilter.ip.v4.dst_ip, tcf.dst_ip, -ARRAY_SIZE (tcf.dst_ip)); -else if (mask.src_ip[0 ] & tcf.dst_ip[0 ]) +sizeof (cfilter.ip.v4.dst_ip)); +else if (mask.src_ip[0 ] & tcf.src_ip[0 ])memcpy (&cfilter.ip.v4.src_ip, tcf.src_ip, -ARRAY_SIZE (tcf.dst_ip)); +sizeof (cfilter.ip.v4.src_ip));break ;case VIRTCHNL_TCP_V6_FLOW : cfilter.n_proto =ETH_P_IPV6 ;
@@ -3879,7 +3879,7 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg)/* for ipv6, mask is set for all sixteen bytes (4 words) */ if (cfilter.n_proto ==ETH_P_IPV6 && mask.dst_ip[3 ])if (memcmp (&cfilter.ip.v6.dst_ip6, &cf->ip.v6.dst_ip6, -sizeof (cfilter.ip.v6.src_ip6))) +sizeof (cfilter.ip.v6.dst_ip6)))continue ;if (mask.vlan_id)if (cfilter.vlan_id != cf->vlan_id)
@@ -3967,10 +3967,10 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) cfilter->n_proto =ETH_P_IP ;if (mask.dst_ip[0 ] & tcf.dst_ip[0 ])memcpy (&cfilter->ip.v4.dst_ip, tcf.dst_ip, -ARRAY_SIZE (tcf.dst_ip)); -else if (mask.src_ip[0 ] & tcf.dst_ip[0 ]) +sizeof (cfilter->ip.v4.dst_ip)); +else if (mask.src_ip[0 ] & tcf.src_ip[0 ])memcpy (&cfilter->ip.v4.src_ip, tcf.src_ip, -ARRAY_SIZE (tcf.dst_ip)); +sizeof (cfilter->ip.v4.src_ip));break ;case VIRTCHNL_TCP_V6_FLOW : cfilter->n_proto =ETH_P_IPV6 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/460 e1000/e1000e: Fix leak in DMA error cleanup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Vollrath <[email protected]>
[ Upstream commit e94eaef11142b01f77bf8ba4d0b59720b7858109 ]
If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb.
Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak.
In these commits, a faulty while condition caused an infinite loop in dma_error:
Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver")
Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver")
Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error.
This issue may still exist in the igbvf driver, but I did not address it in this patch.
--- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 -- drivers/net/ethernet/intel/e1000e/netdev.c | 2 -- 2 files changed, 4 deletions(-)
drivers/net/ethernet/intel/e1000/e1000_main.c +0 -2
@@ -2948,8 +2948,6 @@ static int e1000_tx_map(struct e1000_adapter *adapter, dma_error:dev_err (&pdev->dev,"TX DMA map failed\n" ); buffer_info->dma =0 ; -if (count) - count--;while (count--) {if (i ==0 )
drivers/net/ethernet/intel/e1000e/netdev.c +0 -2
@@ -5633,8 +5633,6 @@ static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb, dma_error:dev_err (&pdev->dev,"Tx DMA map failed\n" ); buffer_info->dma =0 ; -if (count) - count--;while (count--) {if (i ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/460 net: bcmgenet: fix broken EEE by converting to phylib-managed state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Buchwitz <[email protected]>
[ Upstream commit 908c344d5cfac4160f49715da9efacdf5b6a28bd ]
The bcmgenet EEE implementation is broken in several ways. phy_support_eee() is never called, so the PHY never advertises EEE and phylib never sets phydev->enable_tx_lpi. bcmgenet_mac_config() checks priv->eee.eee_enabled to decide whether to enable the MAC LPI logic, but that field is never initialised to true, so the MAC never enters Low Power Idle even when EEE is negotiated - wasting the power savings EEE is designed to provide. The only way to get EEE working at all is a manual 'ethtool --set-eee eth0 eee on' after every link-up, and even then bcmgenet_get_eee() immediately clobbers the reported state because phy_ethtool_get_eee() overwrites eee_enabled and tx_lpi_enabled with the uninitialised PHY eee_cfg values. Finally, bcmgenet_mac_config() is only called on link-up, so EEE is never disabled in hardware on link-down.
Fix all of this by removing the MAC-side EEE state tracking (priv->eee) and aligning with the pattern used by other non-phylink MAC drivers such as FEC.
Call phy_support_eee() in bcmgenet_mii_probe() so the PHY advertises EEE link modes and phylib tracks negotiation state. Move the EEE hardware control to bcmgenet_mii_setup(), which is called on every link event, and drive it directly from phydev->enable_tx_lpi - the flag phylib sets when EEE is negotiated and the user has not disabled it. This enables EEE automatically once the link partner agrees and disables it cleanly on link-down.
Make bcmgenet_get_eee() and bcmgenet_set_eee() pure passthroughs to phy_ethtool_get_eee() and phy_ethtool_set_eee(), with the MAC hardware register read/written for tx_lpi_timer. Drop struct ethtool_keee eee from struct bcmgenet_priv.
--- .../net/ethernet/broadcom/genet/bcmgenet.c | 31 +++++++------------ .../net/ethernet/broadcom/genet/bcmgenet.h | 5 +-- drivers/net/ethernet/broadcom/genet/bcmmii.c | 10 +++--- 3 files changed, 18 insertions(+), 28 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +12 -19
@@ -1272,8 +1272,7 @@ static void bcmgenet_get_ethtool_stats(struct net_device *dev, } } -void bcmgenet_eee_enable_set (struct net_device *dev,bool enable, -bool tx_lpi_enabled) +void bcmgenet_eee_enable_set (struct net_device *dev,bool enable) {struct bcmgenet_priv *priv =netdev_priv (dev);u32 off = priv->hw_params->tbuf_offset +TBUF_ENERGY_CTRL ;
@@ -1293,7 +1292,7 @@ void bcmgenet_eee_enable_set(struct net_device *dev, bool enable,/* Enable EEE and switch to a 27Mhz clock automatically */ reg =bcmgenet_readl (priv->base + off); -if (tx_lpi_enabled) +if (enable) reg |=TBUF_EEE_EN |TBUF_PM_EN ;else reg &= ~(TBUF_EEE_EN |TBUF_PM_EN );
@@ -1312,14 +1311,12 @@ void bcmgenet_eee_enable_set(struct net_device *dev, bool enable, priv->clk_eee_enabled = false; } - priv->eee.eee_enabled = enable; - priv->eee.tx_lpi_enabled = tx_lpi_enabled; }static int bcmgenet_get_eee (struct net_device *dev,struct ethtool_keee *e) {struct bcmgenet_priv *priv =netdev_priv (dev); -struct ethtool_keee *p = &priv->eee; +int ret;if (GENET_IS_V1 (priv))return -EOPNOTSUPP ;
@@ -1327,17 +1324,21 @@ static int bcmgenet_get_eee(struct net_device *dev, struct ethtool_keee *e)if (!dev->phydev)return -ENODEV ; - e->tx_lpi_enabled = p->tx_lpi_enabled; + ret =phy_ethtool_get_eee (dev->phydev, e); +if (ret) +return ret; + +/* tx_lpi_timer is maintained by the MAC hardware register; the +* PHY-level eee_cfg timer is not set for GENET. +*/ e->tx_lpi_timer =bcmgenet_umac_readl (priv,UMAC_EEE_LPI_TIMER ); -return phy_ethtool_get_eee (dev->phydev, e); +return 0 ; }static int bcmgenet_set_eee (struct net_device *dev,struct ethtool_keee *e) {struct bcmgenet_priv *priv =netdev_priv (dev); -struct ethtool_keee *p = &priv->eee; -bool active;if (GENET_IS_V1 (priv))return -EOPNOTSUPP ;
@@ -1345,15 +1346,7 @@ static int bcmgenet_set_eee(struct net_device *dev, struct ethtool_keee *e)if (!dev->phydev)return -ENODEV ; - p->eee_enabled = e->eee_enabled; - -if (!p->eee_enabled) { -bcmgenet_eee_enable_set (dev, false, false); - }else { - active =phy_init_eee (dev->phydev, false) >=0 ; -bcmgenet_umac_writel (priv, e->tx_lpi_timer,UMAC_EEE_LPI_TIMER ); -bcmgenet_eee_enable_set (dev, active, e->tx_lpi_enabled); - } +bcmgenet_umac_writel (priv, e->tx_lpi_timer,UMAC_EEE_LPI_TIMER );return phy_ethtool_set_eee (dev->phydev, e); }
drivers/net/ethernet/broadcom/genet/bcmgenet.h +1 -4
@@ -646,8 +646,6 @@ struct bcmgenet_priv {bool wol_active;struct bcmgenet_mib_counters mib; - -struct ethtool_keee eee; };#define GENET_IO_MACRO (name, offset) \
@@ -705,7 +703,6 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv,void bcmgenet_wol_power_up_cfg (struct bcmgenet_priv *priv,enum bcmgenet_power_mode mode); -void bcmgenet_eee_enable_set (struct net_device *dev,bool enable, -bool tx_lpi_enabled); +void bcmgenet_eee_enable_set (struct net_device *dev,bool enable);#endif /* __BCMGENET_H__ */
drivers/net/ethernet/broadcom/genet/bcmmii.c +5 -5
@@ -30,7 +30,6 @@ static void bcmgenet_mac_config(struct net_device *dev)struct bcmgenet_priv *priv =netdev_priv (dev);struct phy_device *phydev = dev->phydev;u32 reg, cmd_bits =0 ; -bool active;/* speed */ if (phydev->speed ==SPEED_1000 )
@@ -91,10 +90,6 @@ static void bcmgenet_mac_config(struct net_device *dev)bcmgenet_umac_writel (priv, reg,UMAC_CMD );spin_unlock_bh (&priv->reg_lock); - active =phy_init_eee (phydev,0 ) >=0 ; -bcmgenet_eee_enable_set (dev, - priv->eee.eee_enabled && active, - priv->eee.tx_lpi_enabled); }/* setup netdev link state when PHY link status change and
@@ -114,6 +109,8 @@ void bcmgenet_mii_setup(struct net_device *dev)bcmgenet_ext_writel (priv, reg,EXT_RGMII_OOB_CTRL ); } +bcmgenet_eee_enable_set (dev, phydev->enable_tx_lpi); +phy_print_status (phydev); }
@@ -408,6 +405,9 @@ int bcmgenet_mii_probe(struct net_device *dev)/* Indicate that the MAC is responsible for PHY PM */ dev->phydev->mac_managed_pm = true; +if (!GENET_IS_V1 (priv)) +phy_support_eee (dev->phydev); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/460 ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <[email protected]>
[ Upstream commit 393815f57651101f1590632092986d1d5a3a41bd ]
The pointer returned from acpi_os_map_generic_address() is tagged with __iomem, so make the rv it is returned to also of void __iomem * type.
Fixes the following sparse warning:
drivers/acpi/osl.c:1686:20: warning: incorrect type in assignment (different address spaces)drivers/acpi/osl.c:1686:20: expected void *rvdrivers/acpi/osl.c:1686:20: got void [noderef] __iomem *
--- drivers/acpi/osl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/osl.c +1 -1
@@ -1649,7 +1649,7 @@ acpi_status __init acpi_os_initialize(void)* Use acpi_os_map_generic_address to pre-map the reset * register if it's in system memory. */ -void *rv; +void __iomem *rv; rv =acpi_os_map_generic_address (&acpi_gbl_FADT.reset_register); pr_debug("%s: Reset register mapping %s\n", __func__,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/460 ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 53f3a900e9a383d47af7253076e19f510c5708d0 ]
The acp3x_5682_init() function did not check the return value of clk_get(), which could lead to dereferencing error pointers in rt5682_clk_enable().
Fix this by:
1. Changing clk_get() to the device-managed devm_clk_get().
2. Adding proper IS_ERR() checks for both clock acquisitions.
--- sound/soc/amd/acp3x-rt5682-max9836.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/soc/amd/acp3x-rt5682-max9836.c +7 -2
@@ -94,8 +94,13 @@ static int acp3x_5682_init(struct snd_soc_pcm_runtime *rtd)return ret; } - rt5682_dai_wclk =clk_get (component->dev,"rt5682-dai-wclk" ); - rt5682_dai_bclk =clk_get (component->dev,"rt5682-dai-bclk" ); + rt5682_dai_wclk =devm_clk_get (component->dev,"rt5682-dai-wclk" ); +if (IS_ERR (rt5682_dai_wclk)) +return PTR_ERR (rt5682_dai_wclk); + + rt5682_dai_bclk =devm_clk_get (component->dev,"rt5682-dai-bclk" ); +if (IS_ERR (rt5682_dai_bclk)) +return PTR_ERR (rt5682_dai_bclk); ret = snd_soc_card_jack_new_pins(card, "Headset Jack", SND_JACK_HEADSET |
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/460 ASoC: detect empty DMI strings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Connolly <[email protected]>
[ Upstream commit a9683730e8b1d632674f81844ed03ddfbe4821c0 ]
Some bootloaders like recent versions of U-Boot may install some DMI properties with empty values rather than not populate them. This manages to make its way through the validator and cleanup resulting in a rogue hyphen being appended to the card longname.
--- sound/soc/soc-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/soc-core.c +4 -1
@@ -1837,12 +1837,15 @@ static void cleanup_dmi_name(char *name)/* * Check if a DMI field is valid, i.e. not containing any string -* in the black list. +* in the black list and not the empty string. */ static int is_dmi_valid (const char *field) {int i =0 ; +if (!field[0 ]) +return 0 ; +while (dmi_blacklist[i]) {if (strstr (field, dmi_blacklist[i]))return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/460 drm/amdkfd: Unreserve bo if queue update failed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit 2ce75a0b7e1bfddbcb9bc8aeb2e5e7fa99971acf ]
Error handling path should unreserve bo then return failed.
--- drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +1 -0
@@ -600,6 +600,7 @@ int pqm_update_queue_properties(struct process_queue_manager *pqm, p->queue_size)) {pr_debug ("ring buf 0x%llx size 0x%llx not mapped on GPU\n" , p->queue_address, p->queue_size); +amdgpu_bo_unreserve (vm->root.bo);return -EFAULT ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/460 net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 30021e969d48e5819d5ae56936c2f34c0f7ce997 ]
When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags().
BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: <IRQ> ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().
--- drivers/net/bonding/bond_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +1 -1
@@ -3487,7 +3487,7 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond, }else if (is_arp) {return bond_arp_rcv (skb, bond, slave);#if IS_ENABLED (CONFIG_IPV6 ) - } else if (is_ipv6) { + } else if (is_ipv6 && likely(ipv6_mod_enabled())) {return bond_na_rcv (skb, bond, slave);#endif }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/460 net: dsa: realtek: Fix LED group port bit for non-zero LED group
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit e8f0dc024ce55451ebd54bad975134ba802e4fcc ]
The rtl8366rb_led_group_port_mask() function always returns LED port bit in LED group 0; the switch statement returns the same thing in all non-default cases.
This means that the driver does not currently support configuring LEDs in non-zero LED groups.
Fix this.
--- drivers/net/dsa/realtek/rtl8366rb-leds.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/dsa/realtek/rtl8366rb-leds.c +3 -3
@@ -12,11 +12,11 @@ static inline u32 rtl8366rb_led_group_port_mask(u8 led_group, u8 port)case 0 :return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port));case 1 : -return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port)); +return FIELD_PREP (RTL8366RB_LED_X_1_CTRL_MASK ,BIT (port));case 2 : -return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port)); +return FIELD_PREP (RTL8366RB_LED_2_X_CTRL_MASK ,BIT (port));case 3 : -return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port)); +return FIELD_PREP (RTL8366RB_LED_X_3_CTRL_MASK ,BIT (port));default :return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/460 octeontx2-af: devlink: fix NIX RAS reporter recovery condition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit dc26ca99b835e21e76a58b1463b84adb0ca34f58 ]
The NIX RAS health reporter recovery routine checks nix_af_rvu_int to decide whether to re-enable NIX_AF_RAS interrupts. This is the RVU interrupt status field and is unrelated to RAS events, so the recovery flow may incorrectly skip re-enabling NIX_AF_RAS interrupts.
Check nix_af_rvu_ras instead before writing NIX_AF_RAS_ENA_W1S.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +1 -1
@@ -475,7 +475,7 @@ static int rvu_hw_nix_ras_recover(struct devlink_health_reporter *reporter,if (blkaddr <0 )return blkaddr; -if (nix_event_ctx->nix_af_rvu_int) +if (nix_event_ctx->nix_af_rvu_ras)rvu_write64 (rvu, blkaddr,NIX_AF_RAS_ENA_W1S , ~0ULL );return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/460 octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 87f7dff3ec75b91def0024ebaaf732457f47a63b ]
The NIX RAS health report path uses nix_af_rvu_err when handling the NIX_AF_RVU_RAS case, so the report prints the ERR interrupt status rather than the RAS interrupt status.
Use nix_af_rvu_ras for the NIX_AF_RVU_RAS report.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +2 -2
@@ -327,10 +327,10 @@ static int rvu_nix_report_show(struct devlink_fmsg *fmsg, void *ctx,rvu_report_pair_end (fmsg);break ;case NIX_AF_RVU_RAS : - intr_val = nix_event_context->nix_af_rvu_err; + intr_val = nix_event_context->nix_af_rvu_ras;rvu_report_pair_start (fmsg,"NIX_AF_RAS" );devlink_fmsg_u64_pair_put (fmsg,"\tNIX RAS Interrupt Reg " , - nix_event_context->nix_af_rvu_err); + nix_event_context->nix_af_rvu_ras);devlink_fmsg_string_put (fmsg,"\n\tPoison Data on:" );if (intr_val &BIT_ULL (34 ))devlink_fmsg_string_put (fmsg,"\n\tNIX_AQ_INST_S" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/460 net: prevent NULL deref in ip[6]tunnel_xmit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c38b8f5f791ecce13ab77e2257f8fd2444ba80f6 ]
Blamed commit missed that both functions can be called with dev == NULL.
Also add unlikely() hints for these conditions that only fuzzers can hit.
--- include/net/ip6_tunnel.h | 10 ++++++---- net/ipv4/ip_tunnel_core.c | 10 ++++++---- 2 files changed, 12 insertions(+), 8 deletions(-)
include/net/ip6_tunnel.h +6 -4
@@ -156,10 +156,12 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb, {int pkt_len, err; -if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { -net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , - dev->name); -DEV_STATS_INC (dev, tx_errors); +if (unlikely (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT )) { +if (dev) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); + }kfree_skb (skb);return ; }
net/ipv4/ip_tunnel_core.c +6 -4
@@ -57,10 +57,12 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,struct iphdr *iph;int err; -if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { -net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , - dev->name); -DEV_STATS_INC (dev, tx_errors); +if (unlikely (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT )) { +if (dev) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); + }ip_rt_put (rt);kfree_skb (skb);return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/460 iio: imu: inv-mpu9150: fix irq ack preventing irq storms
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
[ Upstream commit d23d763e00ace4e9c59f8d33e0713d401133ba88 ]
IRQ needs to be acked. for some odd reasons, reading from irq status does not reliable help, enable acking from any register to be on the safe side and read the irq status register. Comments in the code indicate a known unreliability with that register.
The blamed commit was tested with mpu6050 in lg,p895 and lg,p880 according to Tested-bys. But with the MPU9150 in the Epson Moverio BT-200 this leads to irq storms without properly acking the irq.
--- drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 8 ++++++++ drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 2 ++ drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 ++++- 3 files changed, 14 insertions(+), 1 deletion(-)
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +8 -0
@@ -1922,6 +1922,14 @@ int inv_mpu_core_probe(struct regmap *regmap, int irq, const char *name, irq_type);return -EINVAL ; } + +/* +* Acking interrupts by status register does not work reliably +* but seem to work when this bit is set. +*/ +if (st->chip_type ==INV_MPU9150 ) + st->irq_mask |=INV_MPU6050_INT_RD_CLEAR ; +device_set_wakeup_capable (dev, true); st->vdd_supply =devm_regulator_get (dev,"vdd" );
drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h +2 -0
@@ -387,6 +387,8 @@ struct inv_mpu6050_state {/* enable level triggering */ #define INV_MPU6050_LATCH_INT_EN 0x20#define INV_MPU6050_BIT_BYPASS_EN 0x2 +/* allow acking interrupts by any register read */ +#define INV_MPU6050_INT_RD_CLEAR 0x10/* Allowed timestamp period jitter in percent */ #define INV_MPU6050_TS_PERIOD_JITTER 4
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +4 -1
@@ -249,7 +249,6 @@ static irqreturn_t inv_mpu6050_interrupt_handle(int irq, void *p)switch (st->chip_type) {case INV_MPU6000 :case INV_MPU6050 : -case INV_MPU9150 :/* * WoM is not supported and interrupt status read seems to be broken for * some chips. Since data ready is the only interrupt, bypass interrupt
@@ -258,6 +257,10 @@ static irqreturn_t inv_mpu6050_interrupt_handle(int irq, void *p) wom_bits =0 ; int_status =INV_MPU6050_BIT_RAW_DATA_RDY_INT ; goto data_ready_interrupt; +case INV_MPU9150 : +/* IRQ needs to be acked */ + wom_bits =0 ; +break ;case INV_MPU6500 :case INV_MPU6515 :case INV_MPU6880 :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/460 usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 8479891d1f04a8ce55366fe4ca361ccdb96f02e1 ]
The check_command_size_in_blocks() function calculates the data size in bytes by left shifting common->data_size_from_cmnd by the block size (common->curlun->blkbits). However, it does not validate whether this shift operation will cause an integer overflow.
Initially, the block size is set up in fsg_lun_open() , and the common->data_size_from_cmnd is set up in do_scsi_command(). During initialization, there is no integer overflow check for the interaction between two variables.
So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (common->data_size_from_cmnd), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses.
Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows.
--- drivers/usb/gadget/function/f_mass_storage.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_mass_storage.c +10 -2
@@ -180,6 +180,7 @@#include <linux/kthread.h> #include <linux/sched/signal.h> #include <linux/limits.h> +#include <linux/overflow.h> #include <linux/pagemap.h> #include <linux/rwsem.h> #include <linux/slab.h>
@@ -1853,8 +1854,15 @@ static int check_command_size_in_blocks(struct fsg_common *common, int cmnd_size, enum data_direction data_dir, unsigned int mask, int needs_medium, const char *name) { - if (common->curlun) - common->data_size_from_cmnd <<= common->curlun->blkbits; + if (common->curlun) { + if (check_shl_overflow(common->data_size_from_cmnd, + common->curlun->blkbits, + &common->data_size_from_cmnd)) { + common->phase_error = 1; +return -EINVAL ; + } + } +return check_command (common, cmnd_size, data_dir, mask, needs_medium, name); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/460 Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit a7037c3eb0130a6167138e69178895b22758d7f3.
The backport applied regulator-boot-on to vreg_l12a_1p8 (ldo12) instead of vreg_l14a_1p88 (ldo14) due to identical surrounding context lines.
--- arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi +0 -1
@@ -246,7 +246,6 @@ vreg_l12a_1p8: ldo12 { regulator-min-microvolt = <1800000>; regulator-max-microvolt = <1800000>; regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>; - regulator-boot-on; }; vreg_l14a_1p88: ldo14 {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/460 cgroup: fix race between task migration and iteration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingye Zhao <[email protected]>
commit 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 upstream.
When a task is migrated out of a css_set, cgroup_migrate_add_task() first moves it from cset->tasks to cset->mg_tasks via:
list_move_tail(&task->cg_list, &cset->mg_tasks);
If a css_task_iter currently has it->task_pos pointing to this task, css_set_move_task() calls css_task_iter_skip() to keep the iterator valid. However, since the task has already been moved to ->mg_tasks, the iterator is advanced relative to the mg_tasks list instead of the original tasks list. As a result, remaining tasks on cset->tasks, as well as tasks queued on cset->mg_tasks, can be skipped by iteration.
Fix this by calling css_set_skip_task_iters() before unlinking task->cg_list from cset->tasks. This advances all active iterators to the next task on cset->tasks, so iteration continues correctly even when a task is concurrently being migrated.
This race is hard to hit in practice without instrumentation, but it can be reproduced by artificially slowing down cgroup_procs_show(). For example, on an Android device a temporary /sys/kernel/cgroup/cgroup_test knob can be added to inject a delay into cgroup_procs_show(), and then:
1) Spawn three long-running tasks (PIDs 101, 102, 103).
2) Create a test cgroup and move the tasks into it.
3) Enable a large delay via /sys/kernel/cgroup/cgroup_test.
4) In one shell, read cgroup.procs from the test cgroup.
5) Within the delay window, in another shell migrate PID 102 by writing it to a different cgroup.procs file.
Under this setup, cgroup.procs can intermittently show only PID 101 while skipping PID 103. Once the migration completes, reading the file again shows all tasks as expected.
Note that this change does not allow removing the existing css_set_skip_task_iters() call in css_set_move_task(). The new call in cgroup_migrate_add_task() only handles iterators that are racing with migration while the task is still on cset->tasks. Iterators may also start after the task has been moved to cset->mg_tasks. If we dropped css_set_skip_task_iters() from css_set_move_task(), such iterators could keep task_pos pointing to a migrating task, causing css_task_iter_advance() to malfunction on the destination css_set, up to and including crashes or infinite loops.
The race window between migration and iteration is very small, and css_task_iter is not on a hot path. In the worst case, when an iterator is positioned on the first thread of the migrating process, cgroup_migrate_add_task() may have to skip multiple tasks via css_set_skip_task_iters(). However, this only happens when migration and iteration actually race, so the performance impact is negligible compared to the correctness fix provided here.
--- kernel/cgroup/cgroup.c | 1 + 1 file changed, 1 insertion(+)
kernel/cgroup/cgroup.c +1 -0
@@ -2530,6 +2530,7 @@ static void cgroup_migrate_add_task(stru mgctx->tset.nr_tasks++; +css_set_skip_task_iters (cset, task);list_move_tail (&task->cg_list, &cset->mg_tasks);if (list_empty (&cset->mg_node)) list_add_tail(&cset->mg_node,
Greg Kroah-Hartman
maintainerPATCH 90/460 ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehul Rao <[email protected]>
commit 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 upstream.
In the drain loop, the local variable 'runtime' is reassigned to a linked stream's runtime (runtime = s->runtime at line 2157). After releasing the stream lock at line 2169, the code accesses runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size (lines 2170-2178) — all referencing the linked stream's runtime without any lock or refcount protecting its lifetime.
A concurrent close() on the linked stream's fd triggers snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private() → snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime). No synchronization prevents kfree(runtime) from completing while the drain path dereferences the stale pointer.
Fix by caching the needed runtime fields (no_period_wakeup, rate, buffer_size) into local variables while still holding the stream lock, and using the cached values after the lock is released.
--- sound/core/pcm_native.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
sound/core/pcm_native.c +16 -3
@@ -2144,6 +2144,10 @@ static int snd_pcm_drain(struct snd_pcm_for (;;) {long tout;struct snd_pcm_runtime *to_check; +unsigned int drain_rate; +snd_pcm_uframes_t drain_bufsz; +bool drain_no_period_wakeup; +if (signal_pending (current)) { result = -ERESTARTSYS ;break ;
@@ -2163,16 +2167,25 @@ static int snd_pcm_drain(struct snd_pcm_snd_pcm_group_unref (group, substream);if (!to_check)break ;/* all drained */ +/* +* Cache the runtime fields needed after unlock. +* A concurrent close() on the linked stream may free +* its runtime via snd_pcm_detach_substream() once we +* release the stream lock below. +*/ + drain_no_period_wakeup = to_check->no_period_wakeup; + drain_rate = to_check->rate; + drain_bufsz = to_check->buffer_size;init_waitqueue_entry (&wait, current);set_current_state (TASK_INTERRUPTIBLE );add_wait_queue (&to_check->sleep, &wait);snd_pcm_stream_unlock_irq (substream); -if (runtime->no_period_wakeup) +if (drain_no_period_wakeup) tout =MAX_SCHEDULE_TIMEOUT ;else { tout =100 ; -if (runtime->rate) { -long t = runtime->buffer_size *1100 / runtime->rate; +if (drain_rate) { +long t = drain_bufsz *1100 / drain_rate; tout =max (t, tout); } tout =msecs_to_jiffies (tout);
Greg Kroah-Hartman
maintainerPATCH 91/460 ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit df1d8abf36ca3681c21a6809eaa9a1e01ef897a6 upstream.
The Scarlett2 mixer quirk in USB-audio driver may hit a NULL dereference when a malformed USB descriptor is passed, since it assumes the presence of an endpoint in the parsed interface in scarlett2_find_fc_interface(), as reported by fuzzer.
For avoiding the NULL dereference, just add the sanity check of bNumEndpoints and skip the invalid interface.
--- sound/usb/mixer_scarlett2.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/mixer_scarlett2.c +2 -0
@@ -8579,6 +8579,8 @@ static int scarlett2_find_fc_interface(sif (desc->bInterfaceClass !=255 )continue ; +if (desc->bNumEndpoints <1 ) +continue ; epd =get_endpoint (intf->altsetting,0 ); private->bInterfaceNumber = desc->bInterfaceNumber;
Greg Kroah-Hartman
maintainerPATCH 92/460 net: usb: lan78xx: fix silent drop of packets with checksum errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit e4f774a0cc955ce762aec91c66915a6e15087ab7 upstream.
Do not drop packets with checksum errors at the USB driver level; pass them to the network stack.
Previously, the driver dropped all packets where the 'Receive Error Detected' (RED) bit was set, regardless of the specific error type. This caused packets with only IP or TCP/UDP checksum errors to be dropped before reaching the kernel, preventing the network stack from accounting for them or performing software fallback.
Add a mask for hard hardware errors to safely drop genuinely corrupt frames, while allowing checksum-errored frames to pass with their ip_summed field explicitly set to CHECKSUM_NONE.
--- drivers/net/usb/lan78xx.c | 4 +++- drivers/net/usb/lan78xx.h | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/lan78xx.c +3 -1
@@ -3537,6 +3537,7 @@ static void lan78xx_rx_csum_offload(stru*/ if (!(dev->net->features &NETIF_F_RXCSUM ) ||unlikely (rx_cmd_a &RX_CMD_A_ICSM_ ) || +unlikely (rx_cmd_a &RX_CMD_A_CSE_MASK_ ) || ((rx_cmd_a &RX_CMD_A_FVTG_ ) && !(dev->net->features &NETIF_F_HW_VLAN_CTAG_RX ))) { skb->ip_summed =CHECKSUM_NONE ;
@@ -3609,7 +3610,8 @@ static int lan78xx_rx(struct lan78xx_netreturn 0 ; } -if (unlikely (rx_cmd_a &RX_CMD_A_RED_ )) { +if (unlikely (rx_cmd_a &RX_CMD_A_RED_ ) && + (rx_cmd_a &RX_CMD_A_RX_HARD_ERRS_MASK_ )) {netif_dbg (dev, rx_err, dev->net,"Error rx_cmd_a=0x%08x" , rx_cmd_a); }else {
drivers/net/usb/lan78xx.h +3 -0
@@ -74,6 +74,9 @@#define RX_CMD_A_ICSM_ (0x00004000)#define RX_CMD_A_LEN_MASK_ (0x00003FFF) +#define RX_CMD_A_RX_HARD_ERRS_MASK_ \ + (RX_CMD_A_RX_ERRS_MASK_ & ~RX_CMD_A_CSE_MASK_) +/* Rx Command B */ #define RX_CMD_B_CSUM_SHIFT_ (16)#define RX_CMD_B_CSUM_MASK_ (0xFFFF0000)
Greg Kroah-Hartman
maintainerPATCH 93/460 net: usb: lan78xx: fix TX byte statistics for small packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 50988747c30df47b73b787f234f746027cb7ec6c upstream.
Account for hardware auto-padding in TX byte counters to reflect actual wire traffic.
The LAN7850 hardware automatically pads undersized frames to the minimum Ethernet frame length (ETH_ZLEN, 60 bytes). However, the driver tracks the network statistics based on the unpadded socket buffer length. This results in the tx_bytes counter under-reporting the actual physical bytes placed on the Ethernet wire for small packets (like short ARP or ICMP requests).
Use max_t() to ensure the transmission statistics accurately account for the hardware-generated padding.
--- drivers/net/usb/lan78xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/lan78xx.c +1 -1
@@ -3886,7 +3886,7 @@ static struct skb_data *lan78xx_tx_buf_f } tx_data += len; - entry->length += len; + entry->length += max_t(unsigned int, len, ETH_ZLEN); entry->num_of_packet +=skb_shinfo (skb)->gso_segs ?:1 ;dev_kfree_skb_any (skb);
Greg Kroah-Hartman
maintainerPATCH 94/460 net: usb: lan78xx: skip LTM configuration for LAN7850
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 upstream.
Do not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware.
The LAN7850 is a High-Speed (USB 2.0) only device and does not support SuperSpeed features like LTM. Currently, the driver unconditionally attempts to configure LTM registers during initialization. On the LAN7850, these registers do not exist, resulting in writes to invalid or undocumented memory space.
This issue was identified during a port to the regmap API with strict register validation enabled. While no functional issues or crashes have been observed from these invalid writes, bypassing LTM initialization on the LAN7850 ensures the driver strictly adheres to the hardware's valid register map.
--- drivers/net/usb/lan78xx.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/lan78xx.c +4 -0
@@ -2667,6 +2667,10 @@ static void lan78xx_init_ltm(struct lan7u32 buf;u32 regs[6 ] = {0 }; +/* LAN7850 is USB 2.0 and does not support LTM */ +if (dev->chipid ==ID_REV_CHIP_ID_7850_ ) +return ; + ret =lan78xx_read_reg (dev,USB_CFG1 , &buf);if (buf &USB_CFG1_LTM_ENABLE_ ) {u8 temp[2 ];
Greg Kroah-Hartman
maintainerPATCH 95/460 ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Falcato <[email protected]>
commit b92b0075ee1870f78f59ab1f7da7dbfdd718ad7a upstream.
Currently, whenever you boot with a QEMU drive over an AHCI interface, you get:
[ 1.632121] ata1.00: applying bridge limits
This happens due to the kernel not believing the given drive is SATA, since word 93 of IDENTIFY (ATA_ID_HW_CONFIG) is non-zero. The result is a pretty severe limit in max_hw_sectors_kb, which limits our IO sizes.
QEMU has set word 93 erroneously for SATA drives but does not, in any way, emulate any of these real hardware details. There is no PATA drive and no SATA cable.
As such, add a BRIDGE_OK quirk for QEMU HARDDISK. Special care is taken to limit this quirk to "2.5+", to allow for fixed future versions.
This results in the max_hw_sectors being limited solely by the controller interface's limits. Which, for AHCI controllers, takes it from 128KB to 32767KB.
--- drivers/ata/libata-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-core.c +1 -0
@@ -4144,6 +4144,7 @@ static const struct ata_dev_quirks_entry/* Devices that do not need bridging limits applied */ { "MTRON MSP-SATA*", NULL, ATA_QUIRK_BRIDGE_OK }, { "BUFFALO HD-QSU2/R5", NULL, ATA_QUIRK_BRIDGE_OK }, + { "QEMU HARDDISK", "2.5+", ATA_QUIRK_BRIDGE_OK },/* Devices which aren't very happy with higher link speeds */ { "WD My Book", NULL, ATA_QUIRK_1_5_GBPS },
Greg Kroah-Hartman
maintainerPATCH 96/460 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
commit 325291b20f8a6f14b9c82edbf5d12e4e71f6adaa upstream.
Add a DMI quirk for the ASUS EXPERTBOOK PM1503CDA fixing the issue where the internal microphone was not detected.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -703,6 +703,13 @@ static const struct dmi_system_id yc_acp DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK BM1503CDA"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_BOARD_NAME, "PM1503CDA"), + } + }, {} };
Greg Kroah-Hartman
maintainerPATCH 97/460 KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 3989a6d036c8ec82c0de3614bed23a1dacd45de5 upstream.
Initialize all per-vCPU AVIC control fields in the VMCB if AVIC is enabled in KVM and the VM has an in-kernel local APIC, i.e. if it's _possible_ the vCPU could activate AVIC at any point in its lifecycle. Configuring the VMCB if and only if AVIC is active "works" purely because of optimizations in kvm_create_lapic() to speculatively set apicv_active if AVIC is enabled *and* to defer updates until the first KVM_RUN. In quotes because KVM likely won't do the right thing if kvm_apicv_activated() is false, i.e. if a vCPU is created while APICv is inhibited at the VM level for whatever reason. E.g. if the inhibit is *removed* before KVM_REQ_APICV_UPDATE is handled in KVM_RUN, then __kvm_vcpu_update_apicv() will elide calls to vendor code due to seeing "apicv_active == activate".
Cleaning up the initialization code will also allow fixing a bug where KVM incorrectly leaves CR8 interception enabled when AVIC is activated without creating a mess with respect to whether AVIC is activated or not.
--- arch/x86/kvm/svm/avic.c | 2 +- arch/x86/kvm/svm/svm.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/x86/kvm/svm/avic.c +1 -1
@@ -253,7 +253,7 @@ void avic_init_vmcb(struct vcpu_svm *svm vmcb->control.avic_physical_id = ppa &AVIC_HPA_MASK ; vmcb->control.avic_vapic_bar =APIC_DEFAULT_PHYS_BASE &VMCB_AVIC_APIC_BAR_MASK ; -if (kvm_apicv_activated (svm->vcpu.kvm)) +if (kvm_vcpu_apicv_active (&svm->vcpu))avic_activate_vmcb (svm);else avic_deactivate_vmcb (svm);
arch/x86/kvm/svm/svm.c +1 -1
@@ -1360,7 +1360,7 @@ static void init_vmcb(struct kvm_vcpu *vif (boot_cpu_has (X86_FEATURE_V_SPEC_CTRL ))set_msr_interception (vcpu, svm->msrpm,MSR_IA32_SPEC_CTRL ,1 ,1 ); -if (kvm_vcpu_apicv_active (vcpu)) +if (enable_apicv &&irqchip_in_kernel (vcpu->kvm))avic_init_vmcb (svm, vmcb);if (vnmi)
Greg Kroah-Hartman
maintainerPATCH 98/460 USB: add QUIRK_NO_BOS for video capture several devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: A1RM4X <[email protected]>
commit 93cd0d664661f58f7e7bed7373714ab2ace41734 upstream.
Several USB capture devices also need the USB_QUIRK_NO_BOS set for them to work properly, odds are they are all the same chip inside, just different vendor/product ids.
This fixes up:
- ASUS TUF 4K PRO
- Avermedia Live Gamer Ultra 2.1 (GC553G2)
- UGREEN 35871
to now run at full speed (10 Gbps/4K 60 fps mode.)
--- drivers/usb/core/quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/core/quirks.c +9 -0
@@ -377,6 +377,9 @@ static const struct usb_device_id usb_qu/* SanDisk Extreme 55AE */ { USB_DEVICE(0x0781, 0x55ae), .driver_info = USB_QUIRK_NO_LPM }, + /* Avermedia Live Gamer Ultra 2.1 (GC553G2) - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x07ca, 0x2553), .driver_info = USB_QUIRK_NO_BOS }, + /* Realforce 87U Keyboard */ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
@@ -434,6 +437,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0b05, 0x17e0), .driver_info = USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* ASUS TUF 4K PRO - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x0b05, 0x1ab9), .driver_info = USB_QUIRK_NO_BOS }, + /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ { USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
@@ -562,6 +568,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM }, + /* UGREEN 35871 - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x2b89, 0x5871), .driver_info = USB_QUIRK_NO_BOS }, + /* APTIV AUTOMOTIVE HUB */ { USB_DEVICE(0x2c48, 0x0132), .driver_info = USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT },
Greg Kroah-Hartman
maintainerPATCH 99/460 usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <[email protected]>
commit 0326ff28d56b4fa202de36ffc8462a354f383a64 upstream.
Similar to other Huawei LTE modules using this quirk, this version with another vid/pid suffers from spurious wakeups.
Setting the quirk fixes the issue for this device as well.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -208,6 +208,10 @@ static const struct usb_device_id usb_qu/* HP v222w 16GB Mini USB Drive */ { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT }, + /* Huawei 4G LTE module ME906S */ + { USB_DEVICE(0x03f0, 0xa31d), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, + /* Creative SB Audigy 2 NX */ { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 100/460 USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vyacheslav Vahnenko <[email protected]>
commit d0d9b1f4f5391e6a00cee81d73ed2e8f98446d5f upstream.
Add USB_QUIRK_NO_BOS for ezcap401 capture card, without it dmesg will show "unable to get BOS descriptor or descriptor too short" and "unable to read config index 0 descriptor/start: -71" errors and device will not able to work at full speed at 10gbs
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -585,6 +585,9 @@ static const struct usb_device_id usb_qu/* Alcor Link AK9563 SC Reader used in 2022 Lenovo ThinkPads */ { USB_DEVICE(0x2ce3, 0x9563), .driver_info = USB_QUIRK_NO_LPM }, + /* ezcap401 - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x32ed, 0x0401), .driver_info = USB_QUIRK_NO_BOS }, + /* DELL USB GEN2 */ { USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 101/460 usb: xhci: Fix memory leak in xhci_disable_slot()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
commit c1c8550e70401159184130a1afc6261db01fc0ce upstream.
xhci_alloc_command() allocates a command structure and, when the second argument is true, also allocates a completion structure. Currently, the error handling path in xhci_disable_slot() only frees the command structure using kfree(), causing the completion structure to leak.
Use xhci_free_command() instead of kfree(). xhci_free_command() correctly frees both the command structure and the associated completion structure. Since the command structure is allocated with zero-initialization, command->in_ctx is NULL and will not be erroneously freed by xhci_free_command().
This bug was found using an experimental static analysis tool we are developing. The tool is based on the LLVM framework and is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available, but we plan to open-source it after our research is published.
The bug was originally detected on v6.13-rc1 using our static analysis tool, and we have verified that the issue persists in the latest mainline kernel.
We performed build testing on x86_64 with allyesconfig using GCC=11.4.0. Since triggering these error paths in xhci_disable_slot() requires specific hardware conditions or abnormal state, we were unable to construct a test case to reliably trigger these specific error paths at runtime.
--- drivers/usb/host/xhci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +2 -2
@@ -3939,7 +3939,7 @@ int xhci_disable_slot(struct xhci_hcd *xif (state ==0xffffffff || (xhci->xhc_state &XHCI_STATE_DYING ) || (xhci->xhc_state &XHCI_STATE_HALTED )) {spin_unlock_irqrestore (&xhci->lock, flags); -kfree (command); +xhci_free_command (xhci, command);return -ENODEV ; }
@@ -3947,7 +3947,7 @@ int xhci_disable_slot(struct xhci_hcd *x slot_id);if (ret) {spin_unlock_irqrestore (&xhci->lock, flags); -kfree (command); +xhci_free_command (xhci, command);return ret; }xhci_ring_cmd_db (xhci);
Greg Kroah-Hartman
maintainerPATCH 102/460 usb: xhci: Prevent interrupt storm on host controller error (HCE)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dayu Jiang <[email protected]>
commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream.
The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults.
When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt().
Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors.
This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC.
--- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-ring.c +1 -0
@@ -3200,6 +3200,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcdif (status &STS_HCE ) {xhci_warn (xhci,"WARNING: Host Controller Error\n" ); +xhci_halt (xhci); goto out; }
Greg Kroah-Hartman
maintainerPATCH 103/460 usb: yurex: fix race in probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 7a875c09899ba0404844abfd8f0d54cdc481c151 upstream.
The bbu member of the descriptor must be set to the value standing for uninitialized values before the URB whose completion handler sets bbu is submitted. Otherwise there is a window during which probing can overwrite already retrieved data.
--- drivers/usb/misc/yurex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/yurex.c +1 -1
@@ -272,6 +272,7 @@ static int yurex_probe(struct usb_interf dev->int_buffer,YUREX_BUF_SIZE , yurex_interrupt, dev, 1); dev->urb->transfer_flags |=URB_NO_TRANSFER_DMA_MAP ; + dev->bbu =-1 ;if (usb_submit_urb (dev->urb,GFP_KERNEL )) { retval = -EIO ;dev_err (&interface->dev,"Could not submitting URB\n" );
@@ -280,7 +281,6 @@ static int yurex_probe(struct usb_interf/* save our data pointer in this interface device */ usb_set_intfdata (interface, dev); - dev->bbu =-1 ;/* we can register the device now, as it is ready */ retval =usb_register_dev (interface, &yurex_class);
Greg Kroah-Hartman
maintainerPATCH 104/460 usb: dwc3: pci: add support for the Intel Nova Lake -H
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
commit 17ab4d4078e22be7fd8fd6fc710c15c085a4cb1b upstream.
This patch adds the necessary PCI ID for Intel Nova Lake -H devices.
--- drivers/usb/dwc3/dwc3-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc3/dwc3-pci.c +2 -0
@@ -56,6 +56,7 @@#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0#define PCI_DEVICE_ID_INTEL_RPL 0xa70e +#define PCI_DEVICE_ID_INTEL_NVLH 0xd37f#define PCI_DEVICE_ID_INTEL_PTLH 0xe332#define PCI_DEVICE_ID_INTEL_PTLH_PCH 0xe37e#define PCI_DEVICE_ID_INTEL_PTLU 0xe432
@@ -448,6 +449,7 @@ static const struct pci_device_id dwc3_p { PCI_DEVICE_DATA(INTEL, CNPH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, CNPV, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, RPL, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, NVLH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, PTLH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, PTLH_PCH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, PTLU, &dwc3_pci_intel_swnode) },
Greg Kroah-Hartman
maintainerPATCH 105/460 usb: misc: uss720: properly clean up reference in uss720_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 45dba8011efac11a2f360383221b541f5ea53ce5 upstream.
If get_1284_register() fails, the usb device reference count is incorrect and needs to be properly dropped before returning. That will happen when the kref is dropped in the call to destroy_priv(), so jump to that error path instead of returning directly.
--- drivers/usb/misc/uss720.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/uss720.c +1 -1
@@ -736,7 +736,7 @@ static int uss720_probe(struct usb_inter ret =get_1284_register (pp,0 , ®,GFP_KERNEL );dev_dbg (&intf->dev,"reg: %7ph\n" , priv->reg);if (ret <0 ) -return ret; + goto probe_abort; ret =usb_find_last_int_in_endpoint (interface, &epd);if (!ret) {
Greg Kroah-Hartman
maintainerPATCH 106/460 usb: core: dont power off roothub PHYs if phy_set_mode() fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit e293015ba76eb96ce4ebed7e3b2cb1a7d319f3e9 upstream.
Remove the error path from the usb_phy_roothub_set_mode() function. The code is clearly wrong, because phy_set_mode() calls can't be balanced with phy_power_off() calls.
Additionally, the usb_phy_roothub_set_mode() function is called only from usb_add_hcd() before it powers on the PHYs, so powering off those makes no sense anyway.
Presumably, the code is copy-pasted from the phy_power_on() function without adjusting the error handling.
--- drivers/usb/core/phy.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/usb/core/phy.c +1 -7
@@ -200,16 +200,10 @@ int usb_phy_roothub_set_mode(struct usb_list_for_each_entry (roothub_entry, head, list) { err =phy_set_mode (roothub_entry->phy, mode);if (err) - goto err_out; +return err; }return 0 ; - -err_out: -list_for_each_entry_continue_reverse (roothub_entry, head, list) -phy_power_off (roothub_entry->phy); - -return err; }EXPORT_SYMBOL_GPL (usb_phy_roothub_set_mode);
Greg Kroah-Hartman
maintainerPATCH 107/460 usb: cdc-acm: Restore CAP_BRK functionnality to CH343
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 14ae24cba291bddfdc296bbcbfd00cd09d0498ef upstream.
The CH343 USB/serial adapter is as buggy as it is popular (very). One of its quirks is that despite being capable of signalling a BREAK condition, it doesn't advertise it.
This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm:
return correct error code on unsupported break") applied some reasonable restrictions, preventing breaks from being emitted on devices that do not advertise CAP_BRK.
Add a quirk for this particular device, so that breaks can still be produced on some of my machines attached to my console server.
--- drivers/usb/class/cdc-acm.c | 5 +++++ drivers/usb/class/cdc-acm.h | 1 + 2 files changed, 6 insertions(+)
drivers/usb/class/cdc-acm.c +5 -0
@@ -1379,6 +1379,8 @@ made_compressed_probe: acm->ctrl_caps = h.usb_cdc_acm_descriptor->bmCapabilities;if (quirks &NO_CAP_LINE ) acm->ctrl_caps &= ~USB_CDC_CAP_LINE ; +if (quirks &MISSING_CAP_BRK ) + acm->ctrl_caps |=USB_CDC_CAP_BRK ; acm->ctrlsize = ctrlsize; acm->readsize = readsize; acm->rx_buflimit = num_rx_buf;
@@ -2002,6 +2004,9 @@ static const struct usb_device_id acm_id .driver_info = IGNORE_DEVICE, }, +/* CH343 supports CAP_BRK, but doesn't advertise it */ + { USB_DEVICE(0x1a86, 0x55d3), .driver_info = MISSING_CAP_BRK, }, + /* control interfaces without any protocol set */ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, USB_CDC_PROTO_NONE) },
drivers/usb/class/cdc-acm.h +1 -0
@@ -113,3 +113,4 @@ struct acm {#define CLEAR_HALT_CONDITIONS BIT(5)#define SEND_ZERO_PACKET BIT(6)#define DISABLE_ECHO BIT(7) +#define MISSING_CAP_BRK BIT(8)
Greg Kroah-Hartman
maintainerPATCH 108/460 usb: roles: get usb role switch from parent only for usb-b-connector
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 8345b1539faa49fcf9c9439c3cbd97dac6eca171 upstream.
usb_role_switch_is_parent() was walking up to the parent node and checking for the "usb-role-switch" property regardless of the type of the passed fwnode. This could cause unrelated device nodes to be probed as potential role switch parent, leading to spurious matches and "-EPROBE_DEFER" being returned infinitely.
Till now only Type-B connector node will have a parent node which may present "usb-role-switch" property and register the role switch device. For Type-C connector node, its parent node will always be a Type-C chip device which will never register the role switch device. However, it may still present a non-boolean "usb-role-switch = <&usb_controller>" property for historical compatibility.
So restrict the helper to only operate on Type-B connector when attempting to get the role switch from parent node.
--- drivers/usb/roles/class.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/roles/class.c +6 -1
@@ -139,9 +139,14 @@ static void *usb_role_switch_match(conststatic struct usb_role_switch *usb_role_switch_is_parent (struct fwnode_handle *fwnode) { -struct fwnode_handle *parent =fwnode_get_parent (fwnode); +struct fwnode_handle *parent;struct device *dev; +if (!fwnode_device_is_compatible (fwnode,"usb-b-connector" )) +return NULL ; + + parent =fwnode_get_parent (fwnode); +if (!fwnode_property_present (parent,"usb-role-switch" )) {fwnode_handle_put (parent);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 109/460 usb: typec: altmode/displayport: set displayport signaling rate in configure message
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: RD Babiera <[email protected]>
commit e8557acfa079a54b59a21f447c82a31aec7717df upstream.
dp_altmode_configure sets the signaling rate to the current configuration's rate and then shifts the value to the Select Configuration bitfield. On the initial configuration, dp->data.conf is 0 to begin with, so the signaling rate field is never set, which leads to some DisplayPort Alt Mode partners sending NAK to the Configure message.
Set the signaling rate to the capabilities supported by both the port and the port partner. If the cable supports DisplayPort Alt Mode, then include its capabilities as well.
--- drivers/usb/typec/altmodes/displayport.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/typec/altmodes/displayport.c +6 -1
@@ -93,9 +93,14 @@ static int dp_altmode_configure(struct d {u8 pin_assign =0 ;u32 conf; +u32 signal;/* DP Signalling */ - conf = (dp->data.conf &DP_CONF_SIGNALLING_MASK ) >>DP_CONF_SIGNALLING_SHIFT ; + signal =DP_CAP_DP_SIGNALLING (dp->port->vdo) &DP_CAP_DP_SIGNALLING (dp->alt->vdo); +if (dp->plug_prime) + signal &=DP_CAP_DP_SIGNALLING (dp->plug_prime->vdo); + + conf = signal <<DP_CONF_SIGNALLING_SHIFT ;switch (con) {case DP_STATUS_CON_DISABLED :
Greg Kroah-Hartman
maintainerPATCH 110/460 USB: usbcore: Introduce usb_bulk_msg_killable()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 416909962e7cdf29fd01ac523c953f37708df93d upstream.
The synchronous message API in usbcore (usb_control_msg(), usb_bulk_msg(), and so on) uses uninterruptible waits. However, drivers may call these routines in the context of a user thread, which means it ought to be possible to at least kill them.
For this reason, introduce a new usb_bulk_msg_killable() function which behaves the same as usb_bulk_msg() except for using wait_for_completion_killable_timeout() instead of wait_for_completion_timeout(). The same can be done later for usb_control_msg() later on, if it turns out to be needed.
--- drivers/usb/core/message.c | 79 +++++++++++++++++++++++++++++++++++++++------ include/linux/usb.h | 5 +- 2 files changed, 72 insertions(+), 12 deletions(-)
drivers/usb/core/message.c +69 -10
@@ -42,16 +42,17 @@ static void usb_api_blocking_completion(/* -* Starts urb and waits for completion or timeout. Note that this call -* is NOT interruptible. Many device driver i/o requests should be -* interruptible and therefore these drivers should implement their -* own interruptible routines. +* Starts urb and waits for completion or timeout. +* Whether or not the wait is killable depends on the flag passed in. +* For example, compare usb_bulk_msg() and usb_bulk_msg_killable(). */ -static int usb_start_wait_urb (struct urb *urb,int timeout,int *actual_length) +static int usb_start_wait_urb (struct urb *urb,int timeout,int *actual_length, +bool killable) {struct api_context ctx;unsigned long expire;int retval; +long rc;init_completion (&ctx.done); urb->context = &ctx;
@@ -61,12 +62,21 @@ static int usb_start_wait_urb(struct urb goto out; expire = timeout ?msecs_to_jiffies (timeout) :MAX_SCHEDULE_TIMEOUT ; -if (!wait_for_completion_timeout (&ctx.done, expire)) { +if (killable) + rc =wait_for_completion_killable_timeout (&ctx.done, expire); +else + rc =wait_for_completion_timeout (&ctx.done, expire); +if (rc <=0 ) {usb_kill_urb (urb); - retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); +if (ctx.status != -ENOENT ) + retval = ctx.status; +else if (rc ==0 ) + retval = -ETIMEDOUT ; +else + retval = rc; dev_dbg(&urb->dev->dev, - "%s timed out on ep%d%s len=%u/%u\n", + "%s timed out or killed on ep%d%s len=%u/%u\n", current->comm, usb_endpoint_num(&urb->ep->desc), usb_urb_dir_in(urb) ? "in" : "out",
@@ -100,7 +110,7 @@ static int usb_internal_control_msg(struusb_fill_control_urb (urb, usb_dev, pipe, (unsigned char *)cmd, data, len, usb_api_blocking_completion,NULL ); - retv =usb_start_wait_urb (urb, timeout, &length); + retv =usb_start_wait_urb (urb, timeout, &length, false);if (retv <0 )return retv;else
@@ -385,10 +395,59 @@ int usb_bulk_msg(struct usb_device *usb_usb_fill_bulk_urb (urb, usb_dev, pipe, data, len, usb_api_blocking_completion,NULL ); -return usb_start_wait_urb (urb, timeout, actual_length); +return usb_start_wait_urb (urb, timeout, actual_length, false); }EXPORT_SYMBOL_GPL (usb_bulk_msg); +/** +* usb_bulk_msg_killable - Builds a bulk urb, sends it off and waits for completion in a killable state +* @usb_dev: pointer to the usb device to send the message to +* @pipe: endpoint "pipe" to send the message to +* @data: pointer to the data to send +* @len: length in bytes of the data to send +* @actual_length: pointer to a location to put the actual length transferred +* in bytes +* @timeout: time in msecs to wait for the message to complete before +* timing out (if 0 the wait is forever) +* +* Context: task context, might sleep. +* +* This function is just like usb_blk_msg() except that it waits in a +* killable state. +* +* Return: +* If successful, 0. Otherwise a negative error number. The number of actual +* bytes transferred will be stored in the @actual_length parameter. +* +*/ +int usb_bulk_msg_killable (struct usb_device *usb_dev,unsigned int pipe, +void *data,int len,int *actual_length,int timeout) +{ +struct urb *urb; +struct usb_host_endpoint *ep; + + ep =usb_pipe_endpoint (usb_dev, pipe); +if (!ep || len <0 ) +return -EINVAL ; + + urb =usb_alloc_urb (0 ,GFP_KERNEL ); +if (!urb) +return -ENOMEM ; + +if ((ep->desc.bmAttributes &USB_ENDPOINT_XFERTYPE_MASK ) == +USB_ENDPOINT_XFER_INT ) { + pipe = (pipe & ~(3 <<30 )) | (PIPE_INTERRUPT <<30 ); +usb_fill_int_urb (urb, usb_dev, pipe, data, len, + usb_api_blocking_completion,NULL , + ep->desc.bInterval); + }else +usb_fill_bulk_urb (urb, usb_dev, pipe, data, len, + usb_api_blocking_completion,NULL ); + +return usb_start_wait_urb (urb, timeout, actual_length, true); +} +EXPORT_SYMBOL_GPL (usb_bulk_msg_killable); +/*-------------------------------------------------------------------*/ static void sg_clean (struct usb_sg_request *io)
include/linux/usb.h +3 -2
@@ -1836,8 +1836,9 @@ extern int usb_control_msg(struct usb_deextern int usb_interrupt_msg (struct usb_device *usb_dev,unsigned int pipe,void *data,int len,int *actual_length,int timeout);extern int usb_bulk_msg (struct usb_device *usb_dev,unsigned int pipe, -void *data,int len,int *actual_length, -int timeout); +void *data,int len,int *actual_length,int timeout); +extern int usb_bulk_msg_killable (struct usb_device *usb_dev,unsigned int pipe, +void *data,int len,int *actual_length,int timeout);/* wrappers around usb_control_msg() for the most common standard requests */ int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request,
Greg Kroah-Hartman
maintainerPATCH 111/460 USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 7784caa413a89487dd14dd5c41db8753483b2acb upstream.
The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usb_bulk_msg() calls. Since the user can specify arbitrarily long timeouts and usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable() instead to avoid the possibility of the user hanging a kernel thread indefinitely.
--- drivers/usb/class/usbtmc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/class/usbtmc.c +3 -3
@@ -727,7 +727,7 @@ static int usbtmc488_ioctl_trigger(struc buffer[1 ] = data->bTag; buffer[2 ] = ~data->bTag; - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_sndbulkpipe(data->usb_dev, data->bulk_out), buffer, USBTMC_HEADER_SIZE,
@@ -1347,7 +1347,7 @@ static int send_request_dev_dep_msg_in(s buffer[11 ] =0 ;/* Reserved */ /* Send bulk URB */ - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_sndbulkpipe(data->usb_dev, data->bulk_out), buffer, USBTMC_HEADER_SIZE,
@@ -1419,7 +1419,7 @@ static ssize_t usbtmc_read(struct file * actual =0 ;/* Send bulk URB */ - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_rcvbulkpipe(data->usb_dev, data->bulk_in), buffer, bufsize, &actual,
Greg Kroah-Hartman
maintainerPATCH 112/460 USB: core: Limit the length of unkillable synchronous timeouts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 upstream.
The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device.
To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector.
In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout.
--- drivers/usb/core/message.c | 27 +++++++++++++-------------- include/linux/usb.h | 3 +++ 2 files changed, 16 insertions(+), 14 deletions(-)
drivers/usb/core/message.c +13 -14
@@ -45,6 +45,8 @@ static void usb_api_blocking_completion(* Starts urb and waits for completion or timeout. * Whether or not the wait is killable depends on the flag passed in. * For example, compare usb_bulk_msg() and usb_bulk_msg_killable(). +* +* For non-killable waits, we enforce a maximum limit on the timeout value. */ static int usb_start_wait_urb (struct urb *urb,int timeout,int *actual_length,bool killable)
@@ -61,7 +63,9 @@ static int usb_start_wait_urb(struct urbif (unlikely (retval)) goto out; - expire = timeout ?msecs_to_jiffies (timeout) :MAX_SCHEDULE_TIMEOUT ; +if (!killable && (timeout <=0 || timeout >USB_MAX_SYNCHRONOUS_TIMEOUT )) + timeout =USB_MAX_SYNCHRONOUS_TIMEOUT ; + expire = (timeout >0 ) ?msecs_to_jiffies (timeout) :MAX_SCHEDULE_TIMEOUT ;if (killable) rc =wait_for_completion_killable_timeout (&ctx.done, expire);else
@@ -127,8 +131,7 @@ static int usb_internal_control_msg(stru* @index: USB message index value * @data: pointer to the data to send * @size: length in bytes of the data to send -* @timeout: time in msecs to wait for the message to complete before timing -* out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. *
@@ -183,8 +186,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg);* @index: USB message index value * @driver_data: pointer to the data to send * @size: length in bytes of the data to send -* @timeout: time in msecs to wait for the message to complete before timing -* out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt ()
@@ -242,8 +244,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_send);* @index: USB message index value * @driver_data: pointer to the data to be filled in by the message * @size: length in bytes of the data to be received -* @timeout: time in msecs to wait for the message to complete before timing -* out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt ()
@@ -314,8 +315,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_recv);* @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes -* @timeout: time in msecs to wait for the message to complete before -* timing out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. *
@@ -347,8 +347,7 @@ EXPORT_SYMBOL_GPL(usb_interrupt_msg);* @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes -* @timeout: time in msecs to wait for the message to complete before -* timing out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. *
@@ -408,12 +407,12 @@ EXPORT_SYMBOL_GPL(usb_bulk_msg);* @actual_length: pointer to a location to put the actual length transferred * in bytes * @timeout: time in msecs to wait for the message to complete before -* timing out (if 0 the wait is forever) +* timing out (if <= 0, the wait is as long as possible) * * Context: task context, might sleep. * -* This function is just like usb_blk_msg() except that it waits in a -* killable state. +* This function is just like usb_blk_msg(), except that it waits in a +* killable state and there is no limit on the timeout length. * * Return: * If successful, 0. Otherwise a negative error number. The number of actual
include/linux/usb.h +3 -0
@@ -1830,6 +1830,9 @@ void usb_free_coherent(struct usb_device* SYNCHRONOUS CALL SUPPORT * *-------------------------------------------------------------------*/ +/* Maximum value allowed for timeout in synchronous routines below */ +#define USB_MAX_SYNCHRONOUS_TIMEOUT 60000/* ms */ +extern int usb_control_msg (struct usb_device *dev,unsigned int pipe,__u8 request,__u8 requesttype,__u16 value,__u16 index,void *data,__u16 size,int timeout);
Greg Kroah-Hartman
maintainerPATCH 113/460 usb: class: cdc-wdm: fix reordering issue in read code path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 8df672bfe3ec2268c2636584202755898e547173 upstream.
Quoting the bug report:
Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove. If this happens, wdm_read() can see the new length and call copy_to_user() on uninitialized memory. This also violates LKMM data race rules [1].
Fix it by using WRITE_ONCE and memory barriers.
--- drivers/usb/class/cdc-wdm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/class/cdc-wdm.c +3 -1
@@ -225,7 +225,8 @@ static void wdm_in_callback(struct urb */* we may already be in overflow */ if (!test_bit (WDM_OVERFLOW , &desc->flags)) {memmove (desc->ubuf + desc->length, desc->inbuf, length); - desc->length += length; +smp_wmb ();/* against wdm_read() */ +WRITE_ONCE (desc->length, desc->length + length); } } skip_error:
@@ -533,6 +534,7 @@ static ssize_t wdm_readreturn -ERESTARTSYS ; cntr =READ_ONCE (desc->length); +smp_rmb ();/* against wdm_in_callback() */ if (cntr ==0 ) { desc->read =0 ; retry:
Greg Kroah-Hartman
maintainerPATCH 114/460 usb: renesas_usbhs: fix use-after-free in ISR during device removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 3cbc242b88c607f55da3d0d0d336b49bf1e20412 upstream.
In usbhs_remove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhs_interrupt) is still registered. If an interrupt fires after usbhs_pipe_remove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free.
Fix this by calling devm_free_irq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhs_pipe_remove() is called.
--- drivers/usb/renesas_usbhs/common.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/renesas_usbhs/common.c +9 -0
@@ -811,6 +811,15 @@ static void usbhs_remove(struct platformusbhs_platform_call (priv, hardware_exit, pdev);reset_control_assert (priv->rsts); + +/* +* Explicitly free the IRQ to ensure the interrupt handler is +* disabled and synchronized before freeing resources. +* devm_free_irq() calls free_irq() which waits for any running +* ISR to complete, preventing UAF. +*/ +devm_free_irq (&pdev->dev, priv->irq, priv); +usbhs_mod_remove (priv);usbhs_fifo_remove (priv);usbhs_pipe_remove (priv);
Greg Kroah-Hartman
maintainerPATCH 115/460 usb: mdc800: handle signal and read racing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 2d6d260e9a3576256fe9ef6d1f7930c9ec348723 upstream.
If a signal arrives after a read has partially completed, we need to return the number of bytes read. -EINTR is correct only if that number is zero.
--- drivers/usb/image/mdc800.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/image/mdc800.c +1 -1
@@ -707,7 +707,7 @@ static ssize_t mdc800_device_read (strucif (signal_pending (current)) {mutex_unlock (&mdc800->io_lock); -return -EINTR ; +return len == left ? -EINTR : len-left; } sts=left > (mdc800->out_count-mdc800->out_ptr)?mdc800->out_count-mdc800->out_ptr:left;
Greg Kroah-Hartman
maintainerPATCH 116/460 usb: image: mdc800: kill download URB on timeout
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
commit 1be3b77de4eb89af8ae2fd6610546be778e25589 upstream.
mdc800_device_read() submits download_urb and waits for completion. If the timeout fires and the device has not responded, the function returns without killing the URB, leaving it active.
A subsequent read() resubmits the same URB while it is still in-flight, triggering the WARN in usb_submit_urb():
"URB submitted while active"
Check the return value of wait_event_timeout() and kill the URB if it indicates timeout, ensuring the URB is complete before its status is inspected or the URB is resubmitted.
Similar to
- commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
--- drivers/usb/image/mdc800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/image/mdc800.c +3 -1
@@ -730,9 +730,11 @@ static ssize_t mdc800_device_read (strucmutex_unlock (&mdc800->io_lock);return len-left; } -wait_event_timeout (mdc800->download_wait, + retval =wait_event_timeout (mdc800->download_wait, mdc800->downloaded,msecs_to_jiffies (TO_DOWNLOAD_GET_READY )); +if (!retval) +usb_kill_urb (mdc800->download_urb); mdc800->downloaded =0 ;if (mdc800->download_urb->status !=0 ) {
Greg Kroah-Hartman
maintainerPATCH 117/460 rust: kbuild: allow `unused_features`
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 592c61f3bfceaa29f8275696bd67c3dfad7ef72e upstream.
Starting with the upcoming Rust 1.96.0 (to be released 2026-05-28), rustc introduces the new lint unused_features [1], which warns [2]:
warning: feature used_with_arg is declared but not used
--> <crate attribute>:1:93
|
1 | #![feature(asm_const,asm_goto,arbitrary_self_types,lint_reasons,offset_of_nested,raw_ref_op,used_with_arg)]
| ^^^^^^^^^^^^^
|
= note: #[warn(unused_features)] (part of #[warn(unused)]) on by default
The original goal of using -Zcrate-attr automatically was that there is a consistent set of features enabled and managed globally for all Rust kernel code (modulo exceptions like the rust/ crated).
While we could require crates to enable features manually (even if we still keep the -Zallow-features= list, i.e. removing the -Zcrate-attr list), it is not really worth making all developers worry about it just for a new lint.
The features are expected to eventually become stable anyway (most already did), and thus having to remove features in every file that may use them is not worth it either.
Thus just allow the new lint globally.
The lint actually existed for a long time, which is why rustc does not complain about an unknown lint in the stable versions we support, but it was "disabled" years ago [3], and now it was made to work again.
For extra context, the new implementation of the lint has already been improved to avoid linting about features that became stable thanks to Benno's report and the ensuing discussion [4] [5], but while that helps, it is still the case that we may have features enabled that are not used for one reason or another in a particular crate.
--- Makefile | 1 + 1 file changed, 1 insertion(+)
Makefile +1 -0
@@ -446,6 +446,7 @@ KBUILD_USERLDFLAGS := $(USERLDFLAGS) export rust_common_flags := --edition=2021 \ -Zbinary_dep_depinfo=y \ -Astable_features \ + -Aunused_features \ -Dnon_ascii_idents \ -Dunsafe_op_in_unsafe_fn \ -Wmissing_docs \
Greg Kroah-Hartman
maintainerPATCH 118/460 mm/tracing: rss_stat: ensure curr is false from kthread context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh Singh <[email protected]>
commit 079c24d5690262e83ee476e2a548e416f3237511 upstream.
The rss_stat trace event allows userspace tools, like Perfetto [1], to inspect per-process RSS metric changes over time.
The curr field was introduced to rss_stat in commit e4dcad204d3a ("rss_stat: add support to detect RSS updates of external mm"). Its intent is to indicate whether the RSS update is for the mm_struct of the current execution context; and is set to false when operating on a remote mm_struct (e.g., via kswapd or a direct reclaimer).
However, an issue arises when a kernel thread temporarily adopts a user process's mm_struct. Kernel threads do not have their own mm_struct and normally have current->mm set to NULL. To operate on user memory, they can "borrow" a memory context using kthread_use_mm(), which sets current->mm to the user process's mm.
This can be observed, for example, in the USB Function Filesystem (FFS) driver. The ffs_user_copy_worker() handles AIO completions and uses kthread_use_mm() to copy data to a user-space buffer. If a page fault occurs during this copy, the fault handler executes in the kthread's context.
At this point, current is the kthread, but current->mm points to the user process's mm. Since the rss_stat event (from the page fault) is for that same mm, the condition current->mm == mm becomes true, causing curr to be incorrectly set to true when the trace event is emitted.
This is misleading because it suggests the mm belongs to the kthread, confusing userspace tools that track per-process RSS changes and corrupting their mm_id-to-process association.
Fix this by ensuring curr is always false when the trace event is emitted from a kthread context by checking for the PF_KTHREAD flag.
--- include/trace/events/kmem.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
include/trace/events/kmem.h +7 -1
@@ -397,7 +397,13 @@ TRACE_EVENT(rss_stat,TP_fast_assign ( __entry->mm_id = mm_ptr_to_hash(mm); - __entry->curr = !!(current->mm == mm); +/* +* curr is true if the mm matches the current task's mm_struct. +* Since kthreads (PF_KTHREAD) have no mm_struct of their own +* but can borrow one via kthread_use_mm(), we must filter them +* out to avoid incorrectly attributing the RSS update to them. +*/ + __entry->curr = current->mm == mm && !(current->flags &PF_KTHREAD ); __entry->member = member; __entry->size = (percpu_counter_sum_positive (&mm->rss_stat[member]) <<PAGE_SHIFT );
Greg Kroah-Hartman
maintainerPATCH 119/460 mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
commit af12e64ae0661546e8b4f5d30d55c5f53a11efe7 upstream.
When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In of_get_dml_pipe_index(), it does not release the reference.
--- drivers/mmc/host/mmci_qcom_dml.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/mmci_qcom_dml.c +1 -0
@@ -109,6 +109,7 @@ static int of_get_dml_pipe_index(struct &dma_spec))return -ENODEV ; +of_node_put (dma_spec.np);if (dma_spec.args_count)return dma_spec.args[0 ];
Greg Kroah-Hartman
maintainerPATCH 120/460 mm/kfence: disable KFENCE upon KASAN HW tags enablement
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <[email protected]>
commit 09833d99db36d74456a4d13eb29c32d56ff8f2b6 upstream.
KFENCE does not currently support KASAN hardware tags. As a result, the two features are incompatible when enabled simultaneously.
Given that MTE provides deterministic protection and KFENCE is a sampling-based debugging tool, prioritize the stronger hardware protections. Disable KFENCE initialization and free the pre-allocated pool if KASAN hardware tags are detected to ensure the system maintains the security guarantees provided by MTE.
--- mm/kfence/core.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
mm/kfence/core.c +15 -0
@@ -13,6 +13,7 @@#include <linux/hash.h> #include <linux/irq_work.h> #include <linux/jhash.h> +#include <linux/kasan-enabled.h> #include <linux/kcsan-checks.h> #include <linux/kfence.h> #include <linux/kmemleak.h>
@@ -881,6 +882,20 @@ void __init kfence_alloc_pool_and_metadareturn ;/* +* If KASAN hardware tags are enabled, disable KFENCE, because it +* does not support MTE yet. +*/ +if (kasan_hw_tags_enabled ()) { +pr_info ("disabled as KASAN HW tags are enabled\n" ); +if (__kfence_pool) { +memblock_free (__kfence_pool,KFENCE_POOL_SIZE ); + __kfence_pool =NULL ; + } + kfence_sample_interval =0 ; +return ; + } + +/* * If the pool has already been initialized by arch, there is no need to * re-allocate the memory pool. */
Greg Kroah-Hartman
maintainerPATCH 121/460 mmc: core: Avoid bitfield RMW for claim/retune flags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Penghe Geng <[email protected]>
commit 901084c51a0a8fb42a3f37d2e9c62083c495f824 upstream.
Move claimed and retune control flags out of the bitfield word to avoid unrelated RMW side effects in asynchronous contexts.
The host->claimed bit shared a word with retune flags. Writes to claimed in __mmc_claim_host() or retune_now in mmc_mq_queue_rq() can overwrite other bits when concurrent updates happen in other contexts, triggering spurious WARN_ON(!host->claimed). Convert claimed, can_retune, retune_now and retune_paused to bool to remove shared-word coupling.
--- include/linux/mmc/host.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
include/linux/mmc/host.h +5 -4
@@ -423,14 +423,12 @@ struct mmc_host {struct mmc_ios ios;/* current io bus settings */ +bool claimed;/* host exclusively claimed */ +/* group bitfields together to minimize padding */ unsigned int use_spi_crc:1; - unsigned int claimed:1; /* host exclusively claimed */ unsigned int doing_init_tune:1; /* initial tuning in progress */ - unsigned int can_retune:1; /* re-tuning can be used */ unsigned int doing_retune:1; /* re-tuning in progress */ - unsigned int retune_now:1; /* do re-tuning at next req */ - unsigned int retune_paused:1; /* re-tuning is temporarily disabled */ unsigned int retune_crc_disable:1; /* don't trigger retune upon crc */ unsigned int can_dma_map_merge:1; /* merging can be used */ unsigned int vqmmc_enabled:1; /* vqmmc regulator is enabled */
@@ -438,6 +436,9 @@ struct mmc_host {int rescan_disable;/* disable card detection */ int rescan_entered;/* used with nonremovable devices */ +bool can_retune;/* re-tuning can be used */ +bool retune_now;/* do re-tuning at next req */ +bool retune_paused;/* re-tuning is temporarily disabled */ int need_retune;/* re-tuning is needed */ int hold_retune;/* hold off re-tuning */ unsigned int retune_period;/* re-tuning period in secs */
Greg Kroah-Hartman
maintainerPATCH 122/460 ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Hothi <[email protected]>
commit d6db827b430bdcca3976cebca7bd69cca03cde2c upstream.
During ADSP stop and start, the kernel crashes due to the order in which ASoC components are removed.
On ADSP stop, the q6apm-audio .remove callback unloads topology and removes PCM runtimes during ASoC teardown. This deletes the RTDs that contain the q6apm DAI components before their removal pass runs, leaving those components still linked to the card and causing crashes on the next rebind.
Fix this by ensuring that all dependent (child) components are removed first, and the q6apm component is removed last.
[ 48.105720] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 [ 48.114763] Mem abort info: [ 48.117650] ESR = 0x0000000096000004 [ 48.121526] EC = 0x25: DABT (current EL), IL = 32 bits [ 48.127010] SET = 0, FnV = 0 [ 48.130172] EA = 0, S1PTW = 0 [ 48.133415] FSC = 0x04: level 0 translation fault [ 48.138446] Data abort info: [ 48.141422] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 48.147079] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 48.152354] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 48.157859] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173cf000 [ 48.164517] [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000 [ 48.171530] Internal error: Oops: 0000000096000004 [#1] SMP [ 48.177348] Modules linked in: q6prm_clocks q6apm_lpass_dais q6apm_dai snd_q6dsp_common q6prm snd_q6apm 8021q garp mrp stp llc snd_soc_hdmi_codec apr pdr_interface phy_qcom_edp fastrpc qcom_pd_mapper rpmsg_ctrl qrtr_smd rpmsg_char qcom_pdr_msg qcom_iris v4l2_mem2mem videobuf2_dma_contig ath11k_pci msm ubwc_config at24 ath11k videobuf2_memops mac80211 ocmem videobuf2_v4l2 libarc4 drm_gpuvm mhi qrtr videodev drm_exec snd_soc_sc8280xp gpu_sched videobuf2_common nvmem_qcom_spmi_sdam snd_soc_qcom_sdw drm_dp_aux_bus qcom_q6v5_pas qcom_spmi_temp_alarm snd_soc_qcom_common rtc_pm8xxx qcom_pon drm_display_helper cec qcom_pil_info qcom_stats soundwire_bus drm_client_lib mc dispcc0_sa8775p videocc_sa8775p qcom_q6v5 camcc_sa8775p snd_soc_dmic phy_qcom_sgmii_eth snd_soc_max98357a i2c_qcom_geni snd_soc_core dwmac_qcom_ethqos llcc_qcom icc_bwmon qcom_sysmon snd_compress qcom_refgen_regulator coresight_stm stmmac_platform snd_pcm_dmaengine qcom_common coresight_tmc stmmac coresight_replicator qcom_glink_smem coresight_cti stm_core [ 48.177444] coresight_funnel snd_pcm ufs_qcom phy_qcom_qmp_usb gpi phy_qcom_snps_femto_v2 coresight phy_qcom_qmp_ufs qcom_wdt gpucc_sa8775p pcs_xpcs mdt_loader qcom_ice icc_osm_l3 qmi_helpers snd_timer snd soundcore display_connector qcom_rng nvmem_reboot_mode drm_kms_helper phy_qcom_qmp_pcie sha256 cfg80211 rfkill socinfo fuse drm backlight ipv6 [ 48.301059] CPU: 2 UID: 0 PID: 293 Comm: kworker/u32:2 Not tainted 6.19.0-rc6-dirty #10 PREEMPT [ 48.310081] Hardware name: Qualcomm Technologies, Inc. Lemans EVK (DT) [ 48.316782] Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface] [ 48.323672] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 48.330825] pc : mutex_lock+0xc/0x54 [ 48.334514] lr : soc_dapm_shutdown_dapm+0x44/0x174 [snd_soc_core] [ 48.340794] sp : ffff800084ddb7b0 [ 48.344207] x29: ffff800084ddb7b0 x28: ffff00009cd9cf30 x27: ffff00009cd9cc00 [ 48.351544] x26: ffff000099610190 x25: ffffa31d2f19c810 x24: ffffa31d2f185098 [ 48.358869] x23: ffff800084ddb7f8 x22: 0000000000000000 x21: 00000000000000d0 [ 48.366198] x20: ffff00009ba6c338 x19: ffff00009ba6c338 x18: 00000000ffffffff [ 48.373528] x17: 000000040044ffff x16: ffffa31d4ae6dca8 x15: 072007740775076f [ 48.380853] x14: 0765076d07690774 x13: 00313a323a656369 x12: 767265733a637673 [ 48.388182] x11: 00000000000003f9 x10: ffffa31d4c7dea98 x9 : 0000000000000001 [ 48.395519] x8 : ffff00009a2aadc0 x7 : 0000000000000003 x6 : 0000000000000000 [ 48.402854] x5 : 0000000000000000 x4 : 0000000000000028 x3 : ffff000ef397a698 [ 48.410180] x2 : ffff00009a2aadc0 x1 : 0000000000000000 x0 : 00000000000000d0 [ 48.417506] Call trace: [ 48.420025] mutex_lock+0xc/0x54 (P) [ 48.423712] snd_soc_dapm_shutdown+0x44/0xbc [snd_soc_core] [ 48.429447] soc_cleanup_card_resources+0x30/0x2c0 [snd_soc_core] [ 48.435719] snd_soc_bind_card+0x4dc/0xcc0 [snd_soc_core] [ 48.441278] snd_soc_add_component+0x27c/0x2c8 [snd_soc_core] [ 48.447192] snd_soc_register_component+0x9c/0xf4 [snd_soc_core] [ 48.453371] devm_snd_soc_register_component+0x64/0xc4 [snd_soc_core] [ 48.459994] apm_probe+0xb4/0x110 [snd_q6apm] [ 48.464479] apr_device_probe+0x24/0x40 [apr] [ 48.468964] really_probe+0xbc/0x298 [ 48.472651] __driver_probe_device+0x78/0x12c [ 48.477132] driver_probe_device+0x40/0x160 [ 48.481435] __device_attach_driver+0xb8/0x134 [ 48.486011] bus_for_each_drv+0x80/0xdc [ 48.489964] __device_attach+0xa8/0x1b0 [ 48.493916] device_initial_probe+0x50/0x54 [ 48.498219] bus_probe_device+0x38/0xa0 [ 48.502170] device_add+0x590/0x760 [ 48.505761] device_register+0x20/0x30 [ 48.509623] of_register_apr_devices+0x1d8/0x318 [apr] [ 48.514905] apr_pd_status+0x2c/0x54 [apr] [ 48.519114] pdr_notifier_work+0x8c/0xe0 [pdr_interface] [ 48.524570] process_one_work+0x150/0x294 [ 48.528692] worker_thread+0x2d8/0x3d8 [ 48.532551] kthread+0x130/0x204 [ 48.535874] ret_from_fork+0x10/0x20 [ 48.539559] Code: d65f03c0 d5384102 d503201f d2800001 (c8e17c02) [ 48.545823] ---[ end trace 0000000000000000 ]---
--- sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 1 + sound/soc/qcom/qdsp6/q6apm.c | 1 + 3 files changed, 3 insertions(+)
sound/soc/qcom/qdsp6/q6apm-dai.c +1 -0
@@ -844,6 +844,7 @@ static const struct snd_soc_component_dr .ack = q6apm_dai_ack, .compress_ops = &q6apm_dai_compress_ops, .use_dai_pcm_id = true, + .remove_order = SND_SOC_COMP_ORDER_EARLY, };static int q6apm_dai_probe (struct platform_device *pdev)
sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +1 -0
@@ -278,6 +278,7 @@ static const struct snd_soc_component_dr .of_xlate_dai_name = q6dsp_audio_ports_of_xlate_dai_name, .be_pcm_base = AUDIOREACH_BE_PCM_BASE, .use_dai_pcm_id = true, + .remove_order = SND_SOC_COMP_ORDER_FIRST, };static int q6apm_lpass_dai_dev_probe (struct platform_device *pdev)
sound/soc/qcom/qdsp6/q6apm.c +1 -0
@@ -732,6 +732,7 @@ static const struct snd_soc_component_dr .name = APM_AUDIO_DRV_NAME, .probe = q6apm_audio_probe, .remove = q6apm_audio_remove, + .remove_order = SND_SOC_COMP_ORDER_LAST, };static int apm_probe (gpr_device_t *gdev)
Greg Kroah-Hartman
maintainerPATCH 123/460 tipc: fix divide-by-zero in tipc_sk_filter_connect()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehul Rao <[email protected]>
commit 6c5a9baa15de240e747263aba435a0951da8d8d2 upstream.
A user can set conn_timeout to any value via setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in tipc_sk_filter_connect() executes:
delay %= (tsk->conn_timeout / 4);
If conn_timeout is in the range [0, 3], the integer division yields 0, and the modulo operation triggers a divide-by-zero exception, causing a kernel oops/panic.
Fix this by clamping conn_timeout to a minimum of 4 at the point of use in tipc_sk_filter_connect().
Oops: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+ RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362) Call Trace: tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406) __release_sock (include/net/sock.h:1185 net/core/sock.c:3213) release_sock (net/core/sock.c:3797) tipc_connect (net/tipc/socket.c:2570) __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)
--- net/tipc/socket.c | 2 ++ 1 file changed, 2 insertions(+)
net/tipc/socket.c +2 -0
@@ -2233,6 +2233,8 @@ static bool tipc_sk_filter_connect(strucif (skb_queue_empty (&sk->sk_write_queue))break ;get_random_bytes (&delay,2 ); +if (tsk->conn_timeout <4 ) + tsk->conn_timeout =4 ; delay %= (tsk->conn_timeout /4 ); delay =msecs_to_jiffies (delay +100 );sk_reset_timer (sk, &sk->sk_timer, jiffies + delay);
Greg Kroah-Hartman
maintainerPATCH 124/460 kprobes: avoid crash when rmmod/insmod after ftrace killed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit e113f0b46d19626ec15388bcb91432c9a4fd6261 upstream.
After we hit ftrace is killed by some errors, the kernel crash if we remove modules in which kprobe probes.
BUG: unable to handle page fault for address: fffffbfff805000d PGD 817fcc067 P4D 817fcc067 PUD 817fc8067 PMD 101555067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 4 UID: 0 PID: 2012 Comm: rmmod Tainted: G W OE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE RIP: 0010:kprobes_module_callback+0x89/0x790 RSP: 0018:ffff88812e157d30 EFLAGS: 00010a02 RAX: 1ffffffff805000d RBX: dffffc0000000000 RCX: ffffffff86a8de90 RDX: ffffed1025c2af9b RSI: 0000000000000008 RDI: ffffffffc0280068 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1025c2af9a R10: ffff88812e157cd7 R11: 205d323130325420 R12: 0000000000000002 R13: ffffffffc0290488 R14: 0000000000000002 R15: ffffffffc0280040 FS: 00007fbc450dd740(0000) GS:ffff888420331000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff805000d CR3: 000000010f624000 CR4: 00000000000006f0 Call Trace: <TASK> notifier_call_chain+0xc6/0x280 blocking_notifier_call_chain+0x60/0x90 __do_sys_delete_module.constprop.0+0x32a/0x4e0 do_syscall_64+0x5d/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
This is because the kprobe on ftrace does not correctly handles the kprobe_ftrace_disabled flag set by ftrace_kill().
To prevent this error, check kprobe_ftrace_disabled in __disarm_kprobe_ftrace() and skip all ftrace related operations.
--- kernel/kprobes.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/kprobes.c +4 -0
@@ -1113,6 +1113,10 @@ static int __disarm_kprobe_ftrace(structint ret;lockdep_assert_held (&kprobe_mutex); +if (unlikely (kprobe_ftrace_disabled)) { +/* Now ftrace is disabled forever, disarm is already done. */ +return 0 ; + }if (*cnt ==1 ) { ret =unregister_ftrace_function (ops);
Greg Kroah-Hartman
maintainerPATCH 125/460 ceph: add a bunch of missing ceph_path_info initializers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit 43323a5934b660afae687e8e4e95ac328615a5c4 upstream.
ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter, or else the following ceph_mdsc_free_path_info() may crash.
Example crash (on Linux 6.18.12):
virt_to_cache: Object is not a Slab page!
WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400 [...] Call Trace: [...] ceph_open+0x13d/0x3e0 do_dentry_open+0x134/0x480 vfs_open+0x2a/0xe0 path_openat+0x9a3/0x1160 [...] cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400 [...] kernel BUG at mm/slub.c:634! Oops: invalid opcode: 0000 [#1] SMP NOPTI RIP: 0010:__slab_free+0x1a4/0x350
Some of the ceph_mdsc_build_path() callers had initializers, but others had not, even though they were all added by commit 15f519e9f883 ("ceph: fix race condition validating r_parent before applying state"). The ones without initializer are suspectible to random crashes. (I can imagine it could even be possible to exploit this bug to elevate privileges.)
Unfortunately, these Ceph functions are undocumented and its semantics can only be derived from the code. I see that ceph_mdsc_build_path() initializes the structure only on success, but not on error.
Calling ceph_mdsc_free_path_info() after a failed ceph_mdsc_build_path() call does not even make sense, but that's what all callers do, and for it to be safe, the structure must be zero-initialized. The least intrusive approach to fix this is therefore to add initializers everywhere.
--- fs/ceph/debugfs.c | 4 ++-- fs/ceph/dir.c | 2 +- fs/ceph/file.c | 4 ++-- fs/ceph/inode.c | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-)
fs/ceph/debugfs.c +2 -2
@@ -79,7 +79,7 @@ static int mdsc_show(struct seq_file *s,if (req->r_inode) {seq_printf (s," #%llx" ,ceph_ino (req->r_inode)); }else if (req->r_dentry) { -struct ceph_path_info path_info; +struct ceph_path_info path_info = {0 }; path =ceph_mdsc_build_path (mdsc, req->r_dentry, &path_info,0 );if (IS_ERR (path)) path =NULL ;
@@ -98,7 +98,7 @@ static int mdsc_show(struct seq_file *s, }if (req->r_old_dentry) { -struct ceph_path_info path_info; +struct ceph_path_info path_info = {0 }; path =ceph_mdsc_build_path (mdsc, req->r_old_dentry, &path_info,0 );if (IS_ERR (path)) path =NULL ;
fs/ceph/dir.c +1 -1
@@ -1354,7 +1354,7 @@ static int ceph_unlink(struct inode *dirif (!dn) { try_async = false; }else { -struct ceph_path_info path_info; +struct ceph_path_info path_info = {0 }; path =ceph_mdsc_build_path (mdsc, dn, &path_info,0 );if (IS_ERR (path)) { try_async = false;
fs/ceph/file.c +2 -2
@@ -397,7 +397,7 @@ int ceph_open(struct inode *inode, strucif (!dentry) { do_sync = true; }else { -struct ceph_path_info path_info; +struct ceph_path_info path_info = {0 }; path =ceph_mdsc_build_path (mdsc, dentry, &path_info,0 );if (IS_ERR (path)) { do_sync = true;
@@ -807,7 +807,7 @@ int ceph_atomic_open(struct inode *dir,if (!dn) { try_async = false; }else { -struct ceph_path_info path_info; +struct ceph_path_info path_info = {0 }; path =ceph_mdsc_build_path (mdsc, dn, &path_info,0 );if (IS_ERR (path)) { try_async = false;
fs/ceph/inode.c +1 -1
@@ -2546,7 +2546,7 @@ int __ceph_setattr(struct mnt_idmap *idmif (!dentry) { do_sync = true; }else { -struct ceph_path_info path_info; +struct ceph_path_info path_info = {0 }; path =ceph_mdsc_build_path (mdsc, dentry, &path_info,0 );if (IS_ERR (path)) { do_sync = true;
Greg Kroah-Hartman
maintainerPATCH 126/460 libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Zimmer <[email protected]>
commit b282c43ed156ae15ea76748fc15cd5c39dc9ab72 upstream.
This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a message is stored in a variable of type int. A value greater than INT_MAX leads to an integer overflow and is interpreted as a negative value. This leads to decrementing the pointer address by this value and subsequently accessing it because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation.
This patch fixes the issue by changing the data type of payload_len to u32. Additionally, the data type of result_msg_len is changed to u32, as it is also a variable holding a non-negative length.
Also, an additional layer of sanity checks is introduced, ensuring that directly after reading it from the message, payload_len and result_msg_len are not greater than the overall segment length.
BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph] Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262 CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: ceph-msgr ceph_con_workfn [libceph] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x620 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x72/0x210 kasan_report+0xe7/0x130 ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] __asan_report_load_n_noabort+0xf/0x20 ceph_handle_auth_reply+0x642/0x7a0 [libceph] mon_dispatch+0x973/0x23d0 [libceph] ? apparmor_socket_recvmsg+0x6b/0xa0 ? __pfx_mon_dispatch+0x10/0x10 [libceph] ? __kasan_check_write+0x14/0x30i ? mutex_unlock+0x7f/0xd0 ? __pfx_mutex_unlock+0x10/0x10 ? __pfx_do_recvmsg+0x10/0x10 [libceph] ceph_con_process_message+0x1f1/0x650 [libceph] process_message+0x1e/0x450 [libceph] ceph_con_v2_try_read+0x2e48/0x6c80 [libceph] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph] ? save_fpregs_to_fpstate+0xb0/0x230 ? raw_spin_rq_unlock+0x17/0xa0 ? finish_task_switch.isra.0+0x13b/0x760 ? __switch_to+0x385/0xda0 ? __kasan_check_write+0x14/0x30 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 ceph_con_workfn+0x248/0x10c0 [libceph] process_one_work+0x629/0xf80 ? __kasan_check_write+0x14/0x30 worker_thread+0x87f/0x1570 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_try_to_wake_up+0x10/0x10 ? kasan_print_address_stack_frame+0x1f7/0x280 ? __pfx_worker_thread+0x10/0x10 kthread+0x396/0x830 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? __pfx_kthread+0x10/0x10 ? __kasan_check_write+0x14/0x30 ? recalc_sigpending+0x180/0x210 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3f7/0x610 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x385/0xda0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
[ idryomov: replace if statements with ceph_decode_need() for
payload_len and result_msg_len ]
--- net/ceph/auth.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ceph/auth.c +4 -2
@@ -205,9 +205,9 @@ int ceph_handle_auth_reply(struct ceph_as32 result;u64 global_id;void *payload, *payload_end; -int payload_len; +u32 payload_len;char *result_msg; -int result_msg_len; +u32 result_msg_len;int ret = -EINVAL ;mutex_lock (&ac->mutex);
@@ -217,10 +217,12 @@ int ceph_handle_auth_reply(struct ceph_a result =ceph_decode_32 (&p); global_id =ceph_decode_64 (&p); payload_len =ceph_decode_32 (&p); +ceph_decode_need (&p, end, payload_len, bad); payload = p; p += payload_len;ceph_decode_need (&p, end,sizeof (u32), bad); result_msg_len =ceph_decode_32 (&p); +ceph_decode_need (&p, end, result_msg_len, bad); result_msg = p; p += result_msg_len;if (p != end)
Greg Kroah-Hartman
maintainerPATCH 127/460 libceph: reject preamble if control segment is empty
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit c4c22b846eceff05b1129b8844a80310e55a7f87 upstream.
While head_onwire_len() has a branch to handle ctrl_len == 0 case, prepare_read_control() always sets up a kvec for the CRC meaning that a non-empty control segment is effectively assumed. All frames that clients deal with meet that assumption, so let's make it official and treat the preamble with an empty control segment as malformed.
--- net/ceph/messenger_v2.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
net/ceph/messenger_v2.c +8 -9
@@ -392,7 +392,7 @@ static int head_onwire_len(int ctrl_len,int head_len;int rem_len; -BUG_ON (ctrl_len <0 || ctrl_len >CEPH_MSG_MAX_CONTROL_LEN ); +BUG_ON (ctrl_len <1 || ctrl_len >CEPH_MSG_MAX_CONTROL_LEN );if (secure) { head_len =CEPH_PREAMBLE_SECURE_LEN ;
@@ -401,9 +401,7 @@ static int head_onwire_len(int ctrl_len, head_len +=padded_len (rem_len) +CEPH_GCM_TAG_LEN ; } }else { - head_len =CEPH_PREAMBLE_PLAIN_LEN ; -if (ctrl_len) - head_len += ctrl_len +CEPH_CRC_LEN ; + head_len =CEPH_PREAMBLE_PLAIN_LEN + ctrl_len +CEPH_CRC_LEN ; }return head_len; }
@@ -528,11 +526,16 @@ static int decode_preamble(void *p, stru desc->fd_aligns[i] =ceph_decode_16 (&p); } -if (desc->fd_lens[0 ] <0 || +/* +* This would fire for FRAME_TAG_WAIT (it has one empty +* segment), but we should never get it as client. +*/ +if (desc->fd_lens[0 ] <1 || desc->fd_lens[0 ] >CEPH_MSG_MAX_CONTROL_LEN ) {pr_err ("bad control segment length %d\n" , desc->fd_lens[0 ]);return -EINVAL ; } +if (desc->fd_lens[1 ] <0 || desc->fd_lens[1 ] >CEPH_MSG_MAX_FRONT_LEN ) {pr_err ("bad front segment length %d\n" , desc->fd_lens[1 ]);
@@ -549,10 +552,6 @@ static int decode_preamble(void *p, strureturn -EINVAL ; } -/* -* This would fire for FRAME_TAG_WAIT (it has one empty -* segment), but we should never get it as client. -*/ if (!desc->fd_lens[desc->fd_seg_cnt -1 ]) {pr_err ("last segment empty, segment count %d\n" , desc->fd_seg_cnt);
Greg Kroah-Hartman
maintainerPATCH 128/460 libceph: prevent potential out-of-bounds reads in process_message_header()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 69fb5d91bba44ecf7eb80530b85fa4fb028921d5 upstream.
If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less than the size of the message header or a different frame is made to look like a message frame, out-of-bounds reads may ensue in process_message_header().
Perform an explicit bounds check before decoding the message header.
--- net/ceph/messenger_v2.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/ceph/messenger_v2.c +8 -1
@@ -2864,12 +2864,15 @@ static int process_message_header(struct void *p, void *end) { struct ceph_frame_desc *desc = &con->v2.in_desc; -struct ceph_msg_header2 *hdr2 = p; +struct ceph_msg_header2 *hdr2;struct ceph_msg_header hdr;int skip;int ret;u64 seq; +ceph_decode_need (&p, end,sizeof (*hdr2), bad); + hdr2 = p; +/* verify seq# */ seq =le64_to_cpu (hdr2->seq);if ((s64 )seq - (s64 )con->in_seq <1 ) {
@@ -2900,6 +2903,10 @@ static int process_message_header(structWARN_ON (!con->in_msg);WARN_ON (con->in_msg->con != con);return 1 ; + +bad: +pr_err ("failed to decode message header\n" ); +return -EINVAL ; }static int process_message (struct ceph_connection *con)
Greg Kroah-Hartman
maintainerPATCH 129/460 libceph: Use u32 for non-negative values in ceph_monmap_decode()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Zimmer <[email protected]>
commit 770444611f047dbfd4517ec0bc1b179d40c2f346 upstream.
This patch fixes unnecessary implicit conversions that change signedness of blob_len and num_mon in ceph_monmap_decode().
Currently blob_len and num_mon are (signed) int variables. They are used to hold values that are always non-negative and get assigned in ceph_decode_32_safe(), which is meant to assign u32 values. Both variables are subsequently used as unsigned values, and the value of num_mon is further assigned to monmap->num_mon, which is of type u32. Therefore, both variables should be of type u32. This is especially relevant for num_mon. If the value read from the incoming message is very large, it is interpreted as a negative value, and the check for num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to allocate a very large chunk of memory for monmap, which will most likely fail. In this case, an unnecessary attempt to allocate memory is performed, and -ENOMEM is returned instead of -EINVAL.
--- net/ceph/mon_client.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ceph/mon_client.c +3 -3
@@ -72,8 +72,8 @@ static struct ceph_monmap *ceph_monmap_dstruct ceph_monmap *monmap =NULL ;struct ceph_fsid fsid;u32 struct_len; -int blob_len; -int num_mon; +u32 blob_len; +u32 num_mon;u8 struct_v;u32 epoch;int ret;
@@ -112,7 +112,7 @@ static struct ceph_monmap *ceph_monmap_d }ceph_decode_32_safe (p, end, num_mon, e_inval); -dout ("%s fsid %pU epoch %u num_mon %d\n" , __func__, &fsid, epoch, +dout ("%s fsid %pU epoch %u num_mon %u\n" , __func__, &fsid, epoch, num_mon);if (num_mon >CEPH_MAX_MON ) goto e_inval;
Greg Kroah-Hartman
maintainerPATCH 130/460 libceph: admit message frames only in CEPH_CON_S_OPEN state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit a5a373705081d7cc6363e16990e2361b0b362314 upstream.
Similar checks are performed for all control frames, but an early check for message frames was missing. process_message() is already set up to terminate the loop in case the state changes while con->ops->dispatch() handler is being executed.
--- net/ceph/messenger_v2.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ceph/messenger_v2.c +5 -0
@@ -2936,6 +2936,11 @@ static int __handle_control(struct ceph_if (con->v2.in_desc.fd_tag !=FRAME_TAG_MESSAGE )return process_control (con, p, end); +if (con->state !=CEPH_CON_S_OPEN ) { + con->error_msg ="protocol error, unexpected message" ; +return -EINVAL ; + } + ret =process_message_header (con, p, end);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 131/460 ceph: fix i_nlink underrun during async unlink
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit ce0123cbb4a40a2f1bbb815f292b26e96088639f upstream.
During async unlink, we drop the i_nlink counter before we receive the completion (that will eventually update the i_nlink) because "we assume that the unlink will succeed". That is not a bad idea, but it races against deletions by other clients (or against the completion of our own unlink) and can lead to an underrun which emits a WARNING like this one:
WARNING: CPU: 85 PID: 25093 at fs/inode.c:407 drop_nlink+0x50/0x68 Modules linked in: CPU: 85 UID: 3221252029 PID: 25093 Comm: php-cgi8.1 Not tainted 6.14.11-cm4all1-ampere #655 Hardware name: Supermicro ARS-110M-NR/R12SPD-A, BIOS 1.1b 10/17/2023 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drop_nlink+0x50/0x68 lr : ceph_unlink+0x6c4/0x720 sp : ffff80012173bc90 x29: ffff80012173bc90 x28: ffff086d0a45aaf8 x27: ffff0871d0eb5680 x26: ffff087f2a64a718 x25: 0000020000000180 x24: 0000000061c88647 x23: 0000000000000002 x22: ffff07ff9236d800 x21: 0000000000001203 x20: ffff07ff9237b000 x19: ffff088b8296afc0 x18: 00000000f3c93365 x17: 0000000000070000 x16: ffff08faffcbdfe8 x15: ffff08faffcbdfec x14: 0000000000000000 x13: 45445f65645f3037 x12: 34385f6369706f74 x11: 0000a2653104bb20 x10: ffffd85f26d73290 x9 : ffffd85f25664f94 x8 : 00000000000000c0 x7 : 0000000000000000 x6 : 0000000000000002 x5 : 0000000000000081 x4 : 0000000000000481 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff08727d3f91e8 Call trace: drop_nlink+0x50/0x68 (P) vfs_unlink+0xb0/0x2e8 do_unlinkat+0x204/0x288 __arm64_sys_unlinkat+0x3c/0x80 invoke_syscall.constprop.0+0x54/0xe8 do_el0_svc+0xa4/0xc8 el0_svc+0x18/0x58 el0t_64_sync_handler+0x104/0x130 el0t_64_sync+0x154/0x158
In ceph_unlink(), a call to ceph_mdsc_submit_request() submits the CEPH_MDS_OP_UNLINK to the MDS, but does not wait for completion.
Meanwhile, between this call and the following drop_nlink() call, a worker thread may process a CEPH_CAP_OP_IMPORT, CEPH_CAP_OP_GRANT or just a CEPH_MSG_CLIENT_REPLY (the latter of which could be our own completion). These will lead to a set_nlink() call, updating the i_nlink counter to the value received from the MDS. If that new i_nlink value happens to be zero, it is illegal to decrement it further. But that is exactly what ceph_unlink() will do then.
The WARNING can be reproduced this way:
1. Force async unlink; only the async code path is affected. Having no real clue about Ceph internals, I was unable to find out why the MDS wouldn't give me the "Fxr" capabilities, so I patched get_caps_for_async_unlink() to always succeed.
(Note that the WARNING dump above was found on an unpatched kernel, without this kludge - this is not a theoretical bug.)
2. Add a sleep call after ceph_mdsc_submit_request() so the unlink completion gets handled by a worker thread before drop_nlink() is called. This guarantees that the i_nlink is already zero before drop_nlink() runs.
The solution is to skip the counter decrement when it is already zero, but doing so without a lock is still racy (TOCTOU). Since ceph_fill_inode() and handle_cap_grant() both hold the ceph_inode_info.i_ceph_lock spinlock while set_nlink() runs, this seems like the proper lock to protect the i_nlink updates.
I found prior art in NFS and SMB (using inode.i_lock) and AFS (using afs_vnode.cb_lock). All three have the zero check as well.
--- fs/ceph/dir.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/ceph/dir.c +14 -1
@@ -1330,6 +1330,7 @@ static int ceph_unlink(struct inode *dirstruct ceph_client *cl = fsc->client;struct ceph_mds_client *mdsc = fsc->mdsc;struct inode *inode =d_inode (dentry); +struct ceph_inode_info *ci =ceph_inode (inode);struct ceph_mds_request *req;bool try_async =ceph_test_mount_opt (fsc,ASYNC_DIROPS );struct dentry *dn;
@@ -1415,7 +1416,19 @@ retry:* We have enough caps, so we assume that the unlink * will succeed. Fix up the target inode and dcache. */ -drop_nlink (inode); + +/* +* Protect the i_nlink update with i_ceph_lock +* to precent racing against ceph_fill_inode() +* handling our completion on a worker thread +* and don't decrement if i_nlink has already +* been updated to zero by this completion. +*/ +spin_lock (&ci->i_ceph_lock); +if (inode->i_nlink >0 ) +drop_nlink (inode); +spin_unlock (&ci->i_ceph_lock); +d_delete (dentry); }else {spin_lock (&fsc->async_unlink_conflict_lock);
Greg Kroah-Hartman
maintainerPATCH 132/460 ceph: fix memory leaks in ceph_mdsc_build_path()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit 040d159a45ded7f33201421a81df0aa2a86e5a0b upstream.
Add __putname() calls to error code paths that did not free the "path" pointer obtained by __getname(). If ownership of this pointer is not passed to the caller via path_info.path, the function must free it before returning.
--- fs/ceph/mds_client.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ceph/mds_client.c +3 -0
@@ -2766,6 +2766,7 @@ retry:if (ret <0 ) {dput (parent);dput (cur); +__putname (path);return ERR_PTR (ret); }
@@ -2775,6 +2776,7 @@ retry:if (len <0 ) {dput (parent);dput (cur); +__putname (path);return ERR_PTR (len); } }
@@ -2811,6 +2813,7 @@ retry:* cannot ever succeed. Creating paths that long is * possible with Ceph, but Linux cannot use them. */ +__putname (path);return ERR_PTR (-ENAMETOOLONG ); }
Greg Kroah-Hartman
maintainerPATCH 133/460 time/jiffies: Mark jiffies_64_to_clock_t() notrace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 755a648e78f12574482d4698d877375793867fa1 ]
The trace_clock_jiffies() function that handles the "uptime" clock for tracing calls jiffies_64_to_clock_t(). This causes the function tracer to constantly recurse when the tracing clock is set to "uptime". Mark it notrace to prevent unnecessary recursion when using the "uptime" clock.
--- kernel/time/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/time.c +1 -1
@@ -702,7 +702,7 @@ EXPORT_SYMBOL(clock_t_to_jiffies);* * Return: jiffies_64 value converted to 64-bit "clock_t" (CLOCKS_PER_SEC) */ -u64 jiffies_64_to_clock_t (u64 x) +notrace u64 jiffies_64_to_clock_t(u64 x) {#if (TICK_NSEC % (NSEC_PER_SEC /USER_HZ )) ==0 # if HZ <USER_HZ
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/460 i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ng Ho Yin <[email protected]>
[ Upstream commit f311a05784634febd299f03476b80f3f18489767 ]
The DesignWare I3C master controller ACKs IBIs as soon as a valid Device Address Table (DAT) entry is present. This can create a race between device attachment (after DAA) and the point where the client driver enables IBIs via i3c_device_enable_ibi().
Set DEV_ADDR_TABLE_SIR_REJECT in the DAT entry during attach_i3c_dev() and reattach_i3c_dev() so that IBIs are rejected by default. The bit is managed thereafter by the existing dw_i3c_master_set_sir_enabled() function, which clears it in enable_ibi() after ENEC is issued, and restores it in disable_ibi() after DISEC.
--- drivers/i3c/master/dw-i3c-master.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i3c/master/dw-i3c-master.c +2 -2
@@ -1013,7 +1013,7 @@ static int dw_i3c_master_reattach_i3c_dev(struct i3c_dev_desc *dev, master->free_pos &= ~BIT (pos); } -writel (DEV_ADDR_TABLE_DYNAMIC_ADDR (dev->info.dyn_addr), +writel (DEV_ADDR_TABLE_DYNAMIC_ADDR (dev->info.dyn_addr) |DEV_ADDR_TABLE_SIR_REJECT , master->regs +DEV_ADDR_TABLE_LOC (master->datstartaddr, data->index));
@@ -1042,7 +1042,7 @@ static int dw_i3c_master_attach_i3c_dev(struct i3c_dev_desc *dev) master->free_pos &= ~BIT (pos);i3c_dev_set_master_data (dev, data); -writel (DEV_ADDR_TABLE_DYNAMIC_ADDR (master->devs[pos].addr), +writel (DEV_ADDR_TABLE_DYNAMIC_ADDR (master->devs[pos].addr) |DEV_ADDR_TABLE_SIR_REJECT , master->regs +DEV_ADDR_TABLE_LOC (master->datstartaddr, data->index));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/460 scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Shuaiwei <[email protected]>
[ Upstream commit b0bd84c39289ef6a6c3827dd52c875659291970a ]
In __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel the UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op, POST_CHANGE). This creates a race condition where ufshcd_rtc_work() can still be running while ufshcd_vops_suspend() is executing. When UFSHCD_CAP_CLK_GATING is not supported, the condition !hba->clk_gating.active_reqs is always true, causing ufshcd_update_rtc() to be executed. Since ufshcd_vops_suspend() typically performs clock gating operations, executing ufshcd_update_rtc() at that moment triggers an SError. The kernel panic trace is as follows:
Kernel panic - not syncing: Asynchronous SError Interrupt Call trace: dump_backtrace+0xec/0x128 show_stack+0x18/0x28 dump_stack_lvl+0x40/0xa0 dump_stack+0x18/0x24 panic+0x148/0x374 nmi_panic+0x3c/0x8c arm64_serror_panic+0x64/0x8c do_serror+0xc4/0xc8 el1h_64_error_handler+0x34/0x4c el1h_64_error+0x68/0x6c el1_interrupt+0x20/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c ktime_get+0xc4/0x12c ufshcd_mcq_sq_stop+0x4c/0xec ufshcd_mcq_sq_cleanup+0x64/0x1dc ufshcd_clear_cmd+0x38/0x134 ufshcd_issue_dev_cmd+0x298/0x4d0 ufshcd_exec_dev_cmd+0x1a4/0x1c4 ufshcd_query_attr+0xbc/0x19c ufshcd_rtc_work+0x10c/0x1c8 process_scheduled_works+0x1c4/0x45c worker_thread+0x32c/0x3e8 kthread+0x120/0x1d8 ret_from_fork+0x10/0x20
Fix this by moving cancel_delayed_work_sync() before the call to ufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is fully completed or cancelled at that point.
--- drivers/ufs/core/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +1 -1
@@ -9813,6 +9813,7 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op) }flush_work (&hba->eeh_work); +cancel_delayed_work_sync (&hba->ufs_rtc_update_work); ret =ufshcd_vops_suspend (hba, pm_op,PRE_CHANGE );if (ret)
@@ -9867,7 +9868,6 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)if (ret) goto set_link_active; -cancel_delayed_work_sync (&hba->ufs_rtc_update_work); goto out; set_link_active:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/460 scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <[email protected]>
[ Upstream commit 3c62791322e42d1afd65acfdb5b3a371bde21ede ]
Spec says at least 5us between two H2D FIS when do soft reset, but be generous and sleep for about 1ms.
Stable-dep-of: 8ddc0c269165 ("scsi: hisi_sas: Fix NULL pointer exception during user_scan()")
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/hisi_sas/hisi_sas_main.c +1 -0
@@ -1341,6 +1341,7 @@ static int hisi_sas_softreset_ata_disk(struct domain_device *device) }if (rc ==TMF_RESP_FUNC_COMPLETE ) { +usleep_range (900 ,1000 );ata_for_each_link (link, ap,EDGE ) {int pmp =sata_srst_pmp (link);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/460 scsi: hisi_sas: Use macro instead of magic number
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit 4ca7fe99fc8485fcd04b367f37dc7a48f1355419 ]
The hisi_sas driver has a large number of magic numbers which makes for unfriendly code reading. Use macro definitions instead.
Stable-dep-of: 8ddc0c269165 ("scsi: hisi_sas: Fix NULL pointer exception during user_scan()")
--- drivers/scsi/hisi_sas/hisi_sas.h | 43 +++-- drivers/scsi/hisi_sas/hisi_sas_main.c | 41 +++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 244 ++++++++++++++++--------- 3 files changed, 213 insertions(+), 115 deletions(-)
drivers/scsi/hisi_sas/hisi_sas.h +32 -11
@@ -46,6 +46,13 @@#define HISI_SAS_IOST_ITCT_CACHE_DW_SZ 10#define HISI_SAS_FIFO_DATA_DW_SIZE 32 +#define HISI_SAS_REG_MEM_SIZE 4 +#define HISI_SAS_MAX_CDB_LEN 16 +#define HISI_SAS_BLK_QUEUE_DEPTH 64 + +#define BYTE_TO_DW 4 +#define BYTE_TO_DDW 8 +#define HISI_SAS_STATUS_BUF_SZ (sizeof(struct hisi_sas_status_buffer))#define HISI_SAS_COMMAND_TABLE_SZ (sizeof(union hisi_sas_command_table))
@@ -92,6 +99,8 @@#define HISI_SAS_WAIT_PHYUP_TIMEOUT (30 * HZ)#define HISI_SAS_CLEAR_ITCT_TIMEOUT (20 * HZ) +#define HISI_SAS_DELAY_FOR_PHY_DISABLE 100 +#define NAME_BUF_SIZE 256struct hisi_hba ;
@@ -167,6 +176,8 @@ struct hisi_sas_debugfs_fifo {u32 rd_data[HISI_SAS_FIFO_DATA_DW_SIZE ]; }; +#define FRAME_RCVD_BUF 32 +#define SAS_PHY_RESV_SIZE 2struct hisi_sas_phy {struct work_struct works[HISI_PHYES_NUM ];struct hisi_hba *hisi_hba;
@@ -178,10 +189,10 @@ struct hisi_sas_phy {spinlock_t lock;u64 port_id;/* from hw */ u64 frame_rcvd_size; -u8 frame_rcvd[32 ]; +u8 frame_rcvd[FRAME_RCVD_BUF ];u8 phy_attached;u8 in_reset; -u8 reserved[2 ]; +u8 reserved[SAS_PHY_RESV_SIZE ];u32 phy_type;u32 code_violation_err_count;enum sas_linkrate minimum_linkrate;
@@ -348,6 +359,7 @@ struct hisi_sas_hw { };#define HISI_SAS_MAX_DEBUGFS_DUMP (50) +#define HISI_SAS_DEFAULT_DEBUGFS_DUMP 1struct hisi_sas_debugfs_cq {struct hisi_sas_cq *cq;
@@ -527,12 +539,13 @@ struct hisi_sas_cmd_hdr {__le64 dif_prd_table_addr; }; +#define ITCT_RESV_DDW 12struct hisi_sas_itct {__le64 qw0;__le64 sas_addr;__le64 qw2;__le64 qw3; -__le64 qw4_15[12 ]; +__le64 qw4_15[ITCT_RESV_DDW ]; };struct hisi_sas_iost {
@@ -542,22 +555,26 @@ struct hisi_sas_iost {__le64 qw3; }; +#define ERROR_RECORD_BUF_DW 4struct hisi_sas_err_record { -u32 data[4 ]; +u32 data[ERROR_RECORD_BUF_DW ]; }; +#define FIS_RESV_DW 3struct hisi_sas_initial_fis {struct hisi_sas_err_record err_record;struct dev_to_host_fis fis; -u32 rsvd[3 ]; +u32 rsvd[FIS_RESV_DW ]; }; +#define BREAKPOINT_DATA_SIZE 128struct hisi_sas_breakpoint { -u8 data[128 ]; +u8 data[BREAKPOINT_DATA_SIZE ]; }; +#define BREAKPOINT_TAG_NUM 32struct hisi_sas_sata_breakpoint { -struct hisi_sas_breakpoint tag[32 ]; +struct hisi_sas_breakpoint tag[BREAKPOINT_TAG_NUM ]; };struct hisi_sas_sge {
@@ -568,13 +585,15 @@ struct hisi_sas_sge {__le32 data_off; }; +#define SMP_CMD_TABLE_SIZE 44struct hisi_sas_command_table_smp { -u8 bytes[44 ]; +u8 bytes[SMP_CMD_TABLE_SIZE ]; }; +#define DUMMY_BUF_SIZE 12struct hisi_sas_command_table_stp {struct host_to_dev_fis command_fis; -u8 dummy[12 ]; +u8 dummy[DUMMY_BUF_SIZE ];u8 atapi_cdb[ATAPI_CDB_LEN ]; };
@@ -588,12 +607,13 @@ struct hisi_sas_sge_dif_page {struct hisi_sas_sge sge[HISI_SAS_SGE_DIF_PAGE_CNT ]; }__aligned(16) ; +#define PROT_BUF_SIZE 7struct hisi_sas_command_table_ssp {struct ssp_frame_hdr hdr;union {struct {struct ssp_command_iu task; -u32 prot[7 ]; +u32 prot[PROT_BUF_SIZE ]; };struct ssp_tmf_iu ssp_task;struct xfer_rdy_iu xfer_rdy;
@@ -607,9 +627,10 @@ union hisi_sas_command_table {struct hisi_sas_command_table_stp stp; }__aligned(16) ; +#define IU_BUF_SIZE 1024struct hisi_sas_status_buffer {struct hisi_sas_err_record err; -u8 iu[1024 ]; +u8 iu[IU_BUF_SIZE ]; }__aligned(16) ;struct hisi_sas_slot_buf_table {
drivers/scsi/hisi_sas/hisi_sas_main.c +28 -13
123 lines not on this page · raw message
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +153 -91
668 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/460 scsi: hisi_sas: Fix NULL pointer exception during user_scan()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <[email protected]>
[ Upstream commit 8ddc0c26916574395447ebf4cff684314f6873a9 ]
user_scan() invokes updated sas_user_scan() for channel 0, and if successful, iteratively scans remaining channels (1 to shost->max_channel) via scsi_scan_host_selected() in commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"). However, hisi_sas supports only one channel, and the current value of max_channel is
1. sas_user_scan() for channel 1 will trigger the following NULL pointer exception:
[ 441.554662] Unable to handle kernel NULL pointer dereference at virtual address 00000000000008b0 [ 441.554699] Mem abort info: [ 441.554710] ESR = 0x0000000096000004 [ 441.554718] EC = 0x25: DABT (current EL), IL = 32 bits [ 441.554723] SET = 0, FnV = 0 [ 441.554726] EA = 0, S1PTW = 0 [ 441.554730] FSC = 0x04: level 0 translation fault [ 441.554735] Data abort info: [ 441.554737] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 441.554742] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 441.554747] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 441.554752] user pgtable: 4k pages, 48-bit VAs, pgdp=00000828377a6000 [ 441.554757] [00000000000008b0] pgd=0000000000000000, p4d=0000000000000000 [ 441.554769] Internal error: Oops: 0000000096000004 [#1] SMP [ 441.629589] Modules linked in: arm_spe_pmu arm_smmuv3_pmu tpm_tis_spi hisi_uncore_sllc_pmu hisi_uncore_pa_pmu hisi_uncore_l3c_pmu hisi_uncore_hha_pmu hisi_uncore_ddrc_pmu hisi_uncore_cpa_pmu hns3_pmu hisi_ptt hisi_pcie_pmu tpm_tis_core spidev spi_hisi_sfc_v3xx hisi_uncore_pmu spi_dw_mmio fuse hclge hclge_common hisi_sec2 hisi_hpre hisi_zip hisi_qm hns3 hisi_sas_v3_hw sm3_ce sbsa_gwdt hnae3 hisi_sas_main uacce hisi_dma i2c_hisi dm_mirror dm_region_hash dm_log dm_mod [ 441.670819] CPU: 46 UID: 0 PID: 6994 Comm: bash Kdump: loaded Not tainted 7.0.0-rc2+ #84 PREEMPT [ 441.691327] pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 441.698277] pc : sas_find_dev_by_rphy+0x44/0x118 [ 441.702896] lr : sas_find_dev_by_rphy+0x3c/0x118 [ 441.707502] sp : ffff80009abbba40 [ 441.710805] x29: ffff80009abbba40 x28: ffff082819a40008 x27: ffff082810c37c08 [ 441.717930] x26: ffff082810c37c28 x25: ffff082819a40290 x24: ffff082810c37c00 [ 441.725054] x23: 0000000000000000 x22: 0000000000000001 x21: ffff082819a40000 [ 441.732179] x20: ffff082819a40290 x19: 0000000000000000 x18: 0000000000000020 [ 441.739304] x17: 0000000000000000 x16: ffffb5dad6bda690 x15: 00000000ffffffff [ 441.746428] x14: ffff082814c3b26c x13: 00000000ffffffff x12: ffff082814c3b26a [ 441.753553] x11: 00000000000000c0 x10: 000000000000003a x9 : ffffb5dad5ea94f4 [ 441.760678] x8 : 000000000000003a x7 : ffff80009abbbab0 x6 : 0000000000000030 [ 441.767802] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 441.774926] x2 : ffff08280f35a300 x1 : ffffb5dad7127180 x0 : 0000000000000000 [ 441.782053] Call trace: [ 441.784488] sas_find_dev_by_rphy+0x44/0x118 (P) [ 441.789095] sas_target_alloc+0x24/0xb0 [ 441.792920] scsi_alloc_target+0x290/0x330 [ 441.797010] __scsi_scan_target+0x88/0x258 [ 441.801096] scsi_scan_channel+0x74/0xb8 [ 441.805008] scsi_scan_host_selected+0x170/0x188 [ 441.809615] sas_user_scan+0xfc/0x148 [ 441.813267] store_scan+0x10c/0x180 [ 441.816743] dev_attr_store+0x20/0x40 [ 441.820398] sysfs_kf_write+0x84/0xa8 [ 441.824054] kernfs_fop_write_iter+0x130/0x1c8 [ 441.828487] vfs_write+0x2c0/0x370 [ 441.831880] ksys_write+0x74/0x118 [ 441.835271] __arm64_sys_write+0x24/0x38 [ 441.839182] invoke_syscall+0x50/0x120 [ 441.842919] el0_svc_common.constprop.0+0xc8/0xf0 [ 441.847611] do_el0_svc+0x24/0x38 [ 441.850913] el0_svc+0x38/0x158 [ 441.854043] el0t_64_sync_handler+0xa0/0xe8 [ 441.858214] el0t_64_sync+0x1ac/0x1b0 [ 441.861865] Code: aa1303e0 97ff70a8 34ffff80 d10a4273 (f9445a75) [ 441.867946] ---[ end trace 0000000000000000 ]---
Therefore, set max_channel to 0.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +1 -1
@@ -2544,7 +2544,7 @@ int hisi_sas_probe(struct platform_device *pdev, shost->transportt = hisi_sas_stt; shost->max_id =HISI_SAS_MAX_DEVICES ; shost->max_lun = ~0 ; - shost->max_channel =1 ; + shost->max_channel =0 ; shost->max_cmd_len =HISI_SAS_MAX_CDB_LEN ;if (hisi_hba->hw->slot_index_alloc) { shost->can_queue =HISI_SAS_MAX_COMMANDS ;
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -1
@@ -4959,7 +4959,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) shost->transportt = hisi_sas_stt; shost->max_id =HISI_SAS_MAX_DEVICES ; shost->max_lun = ~0 ; - shost->max_channel =1 ; + shost->max_channel =0 ; shost->max_cmd_len =HISI_SAS_MAX_CDB_LEN ; shost->can_queue =HISI_SAS_UNRESERVED_IPTT ; shost->cmd_per_lun =HISI_SAS_UNRESERVED_IPTT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/460 kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit e2ffa15b9baa447e444d654ffd47123ba6443ae4 ]
clang < 17 fails to use scope local labels with CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y:
{
__label__ local_lbl;
...
unsafe_get_user(uval, uaddr, local_lbl);
...
return 0;
local_lbl:
return -EFAULT;
}when two such scopes exist in the same function:
error: cannot jump from this asm goto statement to one of its possible targets
There are other failure scenarios. Shuffling code around slightly makes it worse and fail even with one instance.
That issue prevents using local labels for a cleanup based user access mechanism.
After failed attempts to provide a simple enough test case for the 'depends on' test in Kconfig, the initial cure was to mark ASM goto broken on clang versions < 17 to get this road block out of the way.
But Nathan pointed out that this is a known clang issue and indeed affects clang < version 17 in combination with cleanup(). It's not even required to use local labels for that.
The clang issue tracker has a small enough test case, which can be used as a test in the 'depends on' section of CC_HAS_ASM_GOTO_OUTPUT:
void bar(void **);
void* baz(void);
int foo (void) {
{
asm goto("jmp %l0"::::l0);
return 0;
l0:
return 1;
}
void *x __attribute__((cleanup(bar))) = baz();
{
asm goto("jmp %l0"::::l1);
return 42;
l1:
return 0xff;
}
}Add another dependency to config CC_HAS_ASM_GOTO_OUTPUT for it and use the clang issue tracker test case for detection by condensing it to obfuscated C-code contest format. This reliably catches the problem on clang < 17 and did not show any issues on the non broken GCC versions.
That test might be sufficient to catch all issues and therefore could replace the existing test, but keeping that around does no harm either.
Thanks to Nathan for pointing to the relevant clang issue!
--- init/Kconfig | 3 +++ 1 file changed, 3 insertions(+)
init/Kconfig +3 -0
@@ -104,7 +104,10 @@ config GCC_ASM_GOTO_OUTPUT_BROKEN config CC_HAS_ASM_GOTO_OUTPUT def_bool y depends on !GCC_ASM_GOTO_OUTPUT_BROKEN + # Detect basic support depends on $(success,echo 'int foo(int x) { asm goto ("": "=r"(x) ::: bar); return x; bar: return 0; }' | $(CC) -x c - -c -o /dev/null) + # Detect clang (< v17) scoped label issues + depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto("jmp %l0"::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto("jmp %l0"::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null) config CC_HAS_ASM_GOTO_TIED_OUTPUT depends on CC_HAS_ASM_GOTO_OUTPUT
Signature · 1 line
2.51.0