6.1.167-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 6.1.167-rc1 review
This is the start of the stable review cycle for the 6.1.167 release. There are 481 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Mar 2026 13:44:33 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.167-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.167-rc1
Nathan Gao <[email protected]>
Revert "selftests: net: amt: wait longer for connection before sending packets"
Jaskaran Singh <[email protected]>
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
Jaskaran Singh <[email protected]>
Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()"
Johan Hovold <[email protected]>
i2c: cp2615: fix serial string NULL-deref at probe
Justin Stitt <[email protected]>
i2c: cp2615: replace deprecated strncpy with strscpy
Chunyan Zhang <[email protected]>
riscv: stacktrace: Disable KASAN checks for non-current tasks
Duoming Zhou <[email protected]>
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing objects with no memcg accounting
Alexander Aring <[email protected]>
dlm: fix possible lkb_resource null dereference
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: always set ID as avail when rm endp
Russell King (Oracle) <[email protected]>
net: stmmac: fix TSO DMA API usage causing oops
Chao Yu <[email protected]>
f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
Keith Busch <[email protected]>
nvme: fix admin request_queue lifetime
Pedro Demarchi Gomes <[email protected]>
ntfs: set dummy blocksize to read boot_block when mounting
Zqiang <[email protected]>
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
Jibin Zhang <[email protected]>
net: fix segmentation of forwarding fraglist GRO
Felix Fietkau <[email protected]>
net: gso: fix tcp fraglist segmentation after pull from frag_list
Felix Fietkau <[email protected]>
net: add support for segmenting TCP fraglist GSO packets
Timur Kristóf <[email protected]>
drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
Timur Kristóf <[email protected]>
drm/amd/display: Add pixel_clock to amd_pp_display_configuration
Alex Deucher <[email protected]>
drm/amdgpu: clarify DC checks
Alex Deucher <[email protected]>
drm/amdgpu: use proper DC check in amdgpu_display_supported_domains()
Jakub Kicinski <[email protected]>
net: clear the dst when changing skb protocol
Heiko Carstens <[email protected]>
s390/xor: Fix xor_xc_2() inline assembly constraints
Guodong Xu <[email protected]>
dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
Florian Westphal <[email protected]>
netfilter: nf_tables: de-constify set commit ops function argument
Josh Law <[email protected]>
tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
Josh Law <[email protected]>
lib/bootconfig: check xbc_init_node() return in override path
Rahul Bukte <[email protected]>
drm/i915/gt: Check set_default_submission() before deferencing
Hyunwoo Kim <[email protected]>
ksmbd: fix use-after-free of share_conf in compound request
Kamal Dasu <[email protected]>
mtd: rawnand: brcmnand: skip DMA during panic write
Kamal Dasu <[email protected]>
mtd: rawnand: serialize lock/unlock against other NAND operations
Christophe JAILLET <[email protected]>
i2c: fsi: Fix a potential leak in fsi_i2c_probe()
Ji-Ze Hong (Peter Hong) <[email protected]>
USB: serial: f81232: fix incomplete serial port generation
Vincent Guittot <[email protected]>
sched/fair: Fix pelt clock sync when entering idle
Joonwon Kang <[email protected]>
mailbox: Prevent out-of-bounds access in of_mbox_index_xlate()
Kuniyuki Iwashima <[email protected]>
Bluetooth: hci_core: Fix use-after-free in vhci_flush()
Maarten Lankhorst <[email protected]>
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Sanman Pradhan <[email protected]>
hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
Weiming Shi <[email protected]>
icmp: fix NULL pointer dereference in icmp_tag_validation()
Anas Iqbal <[email protected]>
net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
Muhammad Hammad Ijaz <[email protected]>
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
Weiming Shi <[email protected]>
nfnetlink_osf: validate individual option lengths in fingerprints
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release flowtable after rcu grace period on error
Xiang Mei <[email protected]>
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
Xiang Mei <[email protected]>
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
Fedor Pchelkin <[email protected]>
net: macb: fix uninitialized rx_fs_lock
Rafael J. Wysocki <[email protected]>
ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
Guenter Roeck <[email protected]>
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
Xiang Mei <[email protected]>
wifi: mac80211: fix NULL deref in mesh_matches_local()
Petr Oros <[email protected]>
iavf: fix VLAN filter lost on add/delete race
Kohei Enju <[email protected]>
igc: fix missing update of skb->tail in igc_xmit_frame()
Nikola Z. Ivanov <[email protected]>
net: usb: aqc111: Do not perform PM inside suspend callback
Jamal Hadi Salim <[email protected]>
net/sched: teql: Fix double-free in teql_master_xmit
Jiayuan Chen <[email protected]>
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Bart Van Assche <[email protected]>
PM: runtime: Fix a race condition related to device removal
Rafael J. Wysocki <[email protected]>
sched: idle: Consolidate the handling of two special cases
Dipayaan Roy <[email protected]>
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
Justin Chen <[email protected]>
net: bcmgenet: increase WoL poll timeout
Jenny Guanni Qu <[email protected]>
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
Jenny Guanni Qu <[email protected]>
netfilter: xt_time: use unsigned int for monthday bit shift
Pablo Neira Ayuso <[email protected]>
netfilter: xt_CT: drop pending enqueued packets on template removal
Pablo Neira Ayuso <[email protected]>
netfilter: nft_ct: drop pending enqueued packets on removal
Andrii Melnychenko <[email protected]>
netfilter: nft_ct: add seqadj extension for natted connections
Jenny Guanni Qu <[email protected]>
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
Lukas Johannes Möller <[email protected]>
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
Hyunwoo Kim <[email protected]>
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
Florian Westphal <[email protected]>
netfilter: ctnetlink: remove refcounting in expectation dumpers
Jiayuan Chen <[email protected]>
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
Dmitry Baryshkov <[email protected]>
Bluetooth: qca: fix ROM version reading on WCN3998 chips
Luiz Augusto von Dentz <[email protected]>
Bluetooth: HIDP: Fix possible UAF
Michael Grzeschik <[email protected]>
Bluetooth: hci_sync: Fix hci_le_create_conn_sync
Christian Eggers <[email protected]>
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Christian Eggers <[email protected]>
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Christian Eggers <[email protected]>
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
Felix Gu <[email protected]>
firmware: arm_scpi: Fix device_node reference leak in probe path
Peddolla Harshavardhan Reddy <[email protected]>
wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
Kuniyuki Iwashima <[email protected]>
wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
Richard Genoud <[email protected]>
soc: fsl: qbman: fix race condition in qman_destroy_fq
ZhengYuan Huang <[email protected]>
btrfs: tree-checker: fix misleading root drop_level error message
Zilin Guan <[email protected]>
binfmt_misc: restore write access before closing files opened by open_exec()
Håkon Bugge <[email protected]>
PCI/ACPI: Restrict program_hpx_type2() to AER bits
Russell King (Oracle) <[email protected]>
net: stmmac: remove support for lpi_intr_o
Guchun Chen <[email protected]>
drm/amdgpu: drop redundant sched job cleanup when cs is aborted
Khairul Anuar Romli <[email protected]>
spi: cadence-quadspi: Implement refcount to handle unbind during busy
Jakub Kicinski <[email protected]>
eth: bnxt: always recalculate features after XDP clearing, fix null-deref
Qu Wenruo <[email protected]>
btrfs: do not strictly require dirty metadata threshold for metadata writepages
Qu Wenruo <[email protected]>
btrfs: send: check for inline extents in range_is_hole_in_parent()
Oleg Nesterov <[email protected]>
x86/uprobes: Fix XOL allocation failure for 32-bit tasks
Jeongjun Park <[email protected]>
drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
Jeongjun Park <[email protected]>
drm/exynos: vidi: fix to avoid directly dereferencing user pointer
Jeongjun Park <[email protected]>
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
Ankit Garg <[email protected]>
gve: defer interrupt enabling until NAPI registration
Frederic Weisbecker <[email protected]>
net: Handle napi_schedule() calls from non-interrupt
Huacai Chen <[email protected]>
net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz
Bart Van Assche <[email protected]>
scsi: ufs: core: Fix handling of lrbp->cmd
Eric Dumazet <[email protected]>
net/sched: cls_u32: use skb_header_pointer_careful()
Eric Dumazet <[email protected]>
net: add skb_header_pointer_careful() helper
Mikulas Patocka <[email protected]>
dm-verity: disable recursive forward error correction
Wei Fang <[email protected]>
net: enetc: allocate vf_state during PF probes
Vladimir Oltean <[email protected]>
net: enetc: reimplement RFS/RSS memory clearing as PCI quirk
Daniel Golle <[email protected]>
mtd: spinand: macronix: use scratch buffer for DMA operation
Eric Biggers <[email protected]>
net/tcp-md5: Fix MAC comparison to be constant-time
Eric Biggers <[email protected]>
ksmbd: Compare MACs in constant time
Eric Biggers <[email protected]>
smb: client: Compare MACs in constant time
Andreas Gruenbacher <[email protected]>
gfs2: No more self recovery
Kevin Groeneveld <[email protected]>
net: fec: handle page_pool_dev_alloc_pages error
Vladimir Oltean <[email protected]>
net: dsa: improve shutdown sequence
Lang Yu <[email protected]>
drm/amdgpu: unmap and remove csa_va properly
Takashi Iwai <[email protected]>
ALSA: usb-audio: Kill timer properly at removal
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix odr switch when turning buffer off
Jakub Staniszewski <[email protected]>
ice: reintroduce retry mechanism for indirect AQ
Michal Schmidt <[email protected]>
ice: sleep, don't busy-wait, in the SQ send retry loop
Michal Schmidt <[email protected]>
ice: remove unused buffer copy code in ice_sq_send_cmd_retry()
Maíra Canal <[email protected]>
pmdomain: bcm: bcm2835-power: Increase ASB control timeout
Kevin Hao <[email protected]>
net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
Kevin Hao <[email protected]>
net: macb: Introduce gem_init_rx_ring()
Vineeth Karumanchi <[email protected]>
net: macb: queue tie-off or disable during WOL suspend
Jeff Layton <[email protected]>
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
Chuck Lever <[email protected]>
NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
Tom Rix <[email protected]>
nfsd: define exports_proc_ops with CONFIG_PROC_FS
Yang Yang <[email protected]>
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
Antoniu Miclaus <[email protected]>
iio: light: bh1780: fix PM runtime leak on error path
Filipe Manana <[email protected]>
btrfs: fix transaction abort on set received ioctl due to item overflow
Filipe Manana <[email protected]>
btrfs: fix transaction abort when snapshotting received subvolumes
Nuno Sá <[email protected]>
iio: buffer: Fix wait_queue not being removed
Nuno Sá <[email protected]>
iio: buffer: fix coding style warnings
Masami Hiramatsu (Google) <[email protected]>
kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
Masami Hiramatsu (Google) <[email protected]>
kprobes: Remove unneeded goto
Shyam Prasad N <[email protected]>
cifs: open files should not hold ref on superblock
Thorsten Blum <[email protected]>
crypto: atmel-sha204a - Fix OOM ->tfm_count leak
Long Li <[email protected]>
xfs: ensure dquot item is deleted from AIL only after log shutdown
Long Li <[email protected]>
xfs: fix integer overflow in bmap intent sort comparator
Harald Freudenberger <[email protected]>
s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
Kevin Hao <[email protected]>
net: macb: Shuffle the tx ring before enabling tx
Luca Ceresoli <[email protected]>
drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
Thomas Fourier <[email protected]>
drm/msm: Fix dma_free_attrs() buffer size
Thorsten Blum <[email protected]>
ksmbd: Don't log keys in SMB3 signing and encryption key generation
Catalin Marinas <[email protected]>
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
Joey Gouly <[email protected]>
arm64: reorganise PAGE_/PROT_ macros
Maíra Canal <[email protected]>
pmdomain: bcm: bcm2835-power: Fix broken reset status read
Huiwen He <[email protected]>
tracing: Fix syscall events activation by ensuring refcount hits zero
Darrick J. Wong <[email protected]>
iomap: reject delalloc mappings during writeback
Alexander Potapenko <[email protected]>
mm/kfence: disable KFENCE upon KASAN HW tags enablement
Alexander Potapenko <[email protected]>
mm/kfence: fix KASAN hardware tag faults during late enablement
Ravi Hothi <[email protected]>
ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
Xu Yang <[email protected]>
usb: roles: get usb role switch from parent only for usb-b-connector
Jiasheng Jiang <[email protected]>
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
Sean Christopherson <[email protected]>
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_can_open(): always configure bitrates before starting device
Mehul Rao <[email protected]>
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
Oswald Buddenhagen <[email protected]>
ALSA: pcm: fix wait_time calculations
Paul Moses <[email protected]>
net/sched: act_gate: snapshot parameters with RCU on replace
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check RM_ADDR not sent over same subflow
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: always mark signal+subflow endp as used
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: avoid sending RM_ADDR over same subflow
Natalie Vock <[email protected]>
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
Andrew Lunn <[email protected]>
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
Kim Phillips <[email protected]>
x86/sev: Allow IBPB-on-Entry feature for SNP guests
Daniil Dulov <[email protected]>
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
Johannes Berg <[email protected]>
wifi: cfg80211: move scan done work to wiphy work
Daniel Hodges <[email protected]>
wifi: libertas: fix use-after-free in lbs_free_adapter()
Jan Kara <[email protected]>
ext4: always allocate blocks only from groups inode can use
Brian Foster <[email protected]>
ext4: fix dirtyclusters double decrement on fs shutdown
Fedor Pchelkin <[email protected]>
ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
David Hildenbrand (Red Hat) <[email protected]>
mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather
David Hildenbrand (Red Hat) <[email protected]>
mm/hugetlb: fix two comments related to huge_pmd_unshare()
David Hildenbrand (Red Hat) <[email protected]>
mm/hugetlb: fix hugetlb_pmd_shared()
Jane Chu <[email protected]>
mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
Alex Deucher <[email protected]>
drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
Alex Deucher <[email protected]>
drm/radeon: apply state adjust rules to some additional HAINAN vairants
Alex Deucher <[email protected]>
drm/amdgpu/mmhub3.0: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub3.0.2: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub3.0.1: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub2.3: add bounds checking for cid
Alex Deucher <[email protected]>
drm/amdgpu/mmhub2.0: add bounds checking for cid
Maciej Andrzejewski ICEYE <[email protected]>
serial: uartlite: fix PM runtime usage count underflow on probe
Ilpo Järvinen <[email protected]>
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
Raul E Rangel <[email protected]>
serial: 8250: Fix TX deadlock when using DMA
Martin Roukala (né Peres) <[email protected]>
serial: 8250_pci: add support for the AX99100
Guanghui Feng <[email protected]>
iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
Finn Thain <[email protected]>
mtd: Avoid boot crash in RedBoot partition table parser
Chen Ni <[email protected]>
mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
Olivier Sobrie <[email protected]>
mtd: rawnand: pl353: make sure optimal timings are applied
Johan Hovold <[email protected]>
spi: fix statistics allocation
Johan Hovold <[email protected]>
spi: fix use-after-free on controller registration failure
Luke Wang <[email protected]>
mmc: sdhci: fix timing selection for 1-bit bus width
Matthew Schwartz <[email protected]>
mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
Namjae Jeon <[email protected]>
ksmbd: unset conn->binding on failed binding request
Paulo Alcantara <[email protected]>
smb: client: fix krb5 mount with username option
Lukas Johannes Möller <[email protected]>
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
Lukas Johannes Möller <[email protected]>
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
Fedor Pchelkin <[email protected]>
net: macb: fix use-after-free access to PTP clock
Ian Ray <[email protected]>
NFC: nxp-nci: allow GPIOs to sleep
Tiezhu Yang <[email protected]>
LoongArch: Give more information if kmem access failed
Ira Weiny <[email protected]>
nvdimm/bus: Fix potential use after free in asynchronous initialization
Jeff Layton <[email protected]>
sunrpc: fix cache_request leak in cache_release
Jens Axboe <[email protected]>
io_uring/kbuf: check if target buffer list is still legacy on recycle
Jens Axboe <[email protected]>
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
Eric Dumazet <[email protected]>
l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
Paul Chaignon <[email protected]>
bpf: Forget ranges when refining tnum after JSET
Eric Dumazet <[email protected]>
ipv6: use RCU in ip6_xmit()
John Ripple <[email protected]>
drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix odr switch to the same value
Antoniu Miclaus <[email protected]>
iio: gyro: mpu3050-i2c: fix pm_runtime error handling
Antoniu Miclaus <[email protected]>
iio: gyro: mpu3050-core: fix pm_runtime error handling
Chris Spencer <[email protected]>
iio: chemical: bme680: Fix measurement wait duration calculation
Lukas Schmid <[email protected]>
iio: potentiometer: mcp4131: fix double application of wiper shift
Antoniu Miclaus <[email protected]>
iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
Antoniu Miclaus <[email protected]>
iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
Oleksij Rempel <[email protected]>
iio: dac: ds4424: reject -128 RAW value
Filipe Manana <[email protected]>
btrfs: abort transaction on failure to update root in the received subvol ioctl
Filipe Manana <[email protected]>
btrfs: fix transaction abort on file creation due to name hash collision
Henrique Carvalho <[email protected]>
smb: client: fix iface port assignment in parse_server_interfaces
Paulo Alcantara <[email protected]>
smb: client: fix atomic open with O_DIRECT & O_SYNC
Josh Law <[email protected]>
lib/bootconfig: check bounds before writing in __xbc_open_brace()
Josh Law <[email protected]>
lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
Shashank Balaji <[email protected]>
x86/apic: Disable x2apic on resume if the kernel expects so
Junxiao Bi <[email protected]>
scsi: core: Fix error handling for scsi_alloc_sdev()
Josh Law <[email protected]>
lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
Stefan Haberland <[email protected]>
s390/dasd: Copy detected format information to secondary device
Stefan Haberland <[email protected]>
s390/dasd: Move quiesce state with pprc swap
Darrick J. Wong <[email protected]>
xfs: fix undersized l_iclog_roundoff values
Calvin Owens <[email protected]>
tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
Luca Ceresoli <[email protected]>
drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
Mario Limonciello <[email protected]>
drm/amd: Set num IP blocks to 0 if discovery fails
Alysa Liu <[email protected]>
drm/amdgpu: Fix use-after-free race in VM acquire
Fan Wu <[email protected]>
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Jian Zhang <[email protected]>
net: ncsi: fix skb leak in error paths
Marios Makassikis <[email protected]>
smb: server: fix use-after-free in smb2_open()
Helge Deller <[email protected]>
parisc: Check kernel mapping earlier at bootup
Helge Deller <[email protected]>
parisc: Fix initial page table creation for boot
Sanman Pradhan <[email protected]>
hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
Dave Airlie <[email protected]>
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
Helge Deller <[email protected]>
parisc: Increase initial mapping to 64 MB with KALLSYMS
Sven Eckelmann <[email protected]>
batman-adv: Avoid double-rtnl_lock ELP metric worker
Jakub Staniszewski <[email protected]>
ice: fix retry for AQ command 0x06EE
Long Li <[email protected]>
net: mana: Ring doorbell at 4 CQ wraparounds
Ariel Silver <[email protected]>
media: dvb-net: fix OOB access in ULE extension header tables
Luka Gejak <[email protected]>
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
Greg Kroah-Hartman <[email protected]>
staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
Jedrzej Jagielski <[email protected]>
ixgbevf: fix link setup issue
Marc Zyngier <[email protected]>
irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
Andy Shevchenko <[email protected]>
device property: Allow secondary lookup in fwnode_get_next_child_node()
Franz Schnyder <[email protected]>
drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
Steven Rostedt <[email protected]>
time/jiffies: Mark jiffies_64_to_clock_t() notrace
Randy Dunlap <[email protected]>
time: add kernel-doc in time.c
Max Kellermann <[email protected]>
ceph: fix i_nlink underrun during async unlink
Ilya Dryomov <[email protected]>
libceph: admit message frames only in CEPH_CON_S_OPEN state
Raphael Zimmer <[email protected]>
libceph: Use u32 for non-negative values in ceph_monmap_decode()
Ilya Dryomov <[email protected]>
libceph: prevent potential out-of-bounds reads in process_message_header()
Ilya Dryomov <[email protected]>
libceph: reject preamble if control segment is empty
Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
Mehul Rao <[email protected]>
tipc: fix divide-by-zero in tipc_sk_filter_connect()
Penghe Geng <[email protected]>
mmc: core: Avoid bitfield RMW for claim/retune flags
Felix Gu <[email protected]>
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
Kalesh Singh <[email protected]>
mm/tracing: rss_stat: ensure curr is false from kthread context
Ziyi Guo <[email protected]>
usb: image: mdc800: kill download URB on timeout
Oliver Neukum <[email protected]>
usb: mdc800: handle signal and read racing
Fan Wu <[email protected]>
usb: renesas_usbhs: fix use-after-free in ISR during device removal
Oliver Neukum <[email protected]>
usb: class: cdc-wdm: fix reordering issue in read code path
Alan Stern <[email protected]>
USB: core: Limit the length of unkillable synchronous timeouts
Alan Stern <[email protected]>
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
Alan Stern <[email protected]>
USB: usbcore: Introduce usb_bulk_msg_killable()
Marc Zyngier <[email protected]>
usb: cdc-acm: Restore CAP_BRK functionnality to CH343
Gabor Juhos <[email protected]>
usb: core: don't power off roothub PHYs if phy_set_mode() fails
Greg Kroah-Hartman <[email protected]>
usb: misc: uss720: properly clean up reference in uss720_probe()
Oliver Neukum <[email protected]>
usb: yurex: fix race in probe
Zilin Guan <[email protected]>
usb: xhci: Fix memory leak in xhci_disable_slot()
Vyacheslav Vahnenko <[email protected]>
USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
Christoffer Sandberg <[email protected]>
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
A1RM4X <[email protected]>
USB: add QUIRK_NO_BOS for video capture several devices
Sean Christopherson <[email protected]>
KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
Oleksij Rempel <[email protected]>
net: usb: lan78xx: skip LTM configuration for LAN7850
Oleksij Rempel <[email protected]>
net: usb: lan78xx: fix TX byte statistics for small packets
Oleksij Rempel <[email protected]>
net: usb: lan78xx: fix silent drop of packets with checksum errors
Takashi Iwai <[email protected]>
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
Qingye Zhao <[email protected]>
cgroup: fix race between task migration and iteration
Sasha Levin <[email protected]>
Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
Seungjin Bae <[email protected]>
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
Alok Tiwari <[email protected]>
octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
Przemek Kitszel <[email protected]>
octeontx2-af: devlink health: use retained error fmsg API
Alok Tiwari <[email protected]>
octeontx2-af: devlink: fix NIX RAS reporter recovery condition
Ricardo B. Marlière <[email protected]>
net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
Casey Connolly <[email protected]>
ASoC: detect empty DMI strings
Chen Ni <[email protected]>
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
Ben Dooks <[email protected]>
ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
Matt Vollrath <[email protected]>
e1000/e1000e: Fix leak in DMA error cleanup
Alok Tiwari <[email protected]>
i40e: fix src IP mask checks and memcpy argument names in cloud filter
Sungwoo Kim <[email protected]>
nvme-pci: Fix race bug in nvme_poll_irqdisable()
Sungwoo Kim <[email protected]>
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
Rafael J. Wysocki <[email protected]>
sched: idle: Make skipping governor callbacks more consistent
Peng Fan <[email protected]>
regulator: pca9450: Correct interrupt type
Frieder Schrempf <[email protected]>
regulator: pca9450: Make IRQ optional
Yuan Tan <[email protected]>
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
Hyunwoo Kim <[email protected]>
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
Hyunwoo Kim <[email protected]>
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
David Dull <[email protected]>
netfilter: x_tables: guard option walkers against 1-byte tail reads
Jenny Guanni Qu <[email protected]>
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
Chengfeng Ye <[email protected]>
mctp: route: hold key->lock in mctp_flow_prepare_output()
Wenyuan Li <[email protected]>
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
Haiyue Wang <[email protected]>
mctp: i2c: fix skb memory leak in receive path
Shuangpeng Bai <[email protected]>
serial: caif: hold tty->link reference in ldisc_open and ser_release
matteo.cotifava <[email protected]>
ASoC: soc-core: flush delayed work before removing DAIs and widgets
Amadeusz Sławiński <[email protected]>
ASoC: core: Do not call link_exit() on uninitialized rtd objects
Cezary Rojewski <[email protected]>
ASoC: core: Exit all links before removing their components
matteo.cotifava <[email protected]>
ASoC: soc-core: drop delayed_work_pending() check before flush
Weiming Shi <[email protected]>
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
Gal Pressman <[email protected]>
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
Cosmin Ratiu <[email protected]>
net/mlx5: Fix deadlock between devlink lock and esw->wq
Daniel Jurgens <[email protected]>
net/mlx5: Query to see if host PF is disabled
Daniel Jurgens <[email protected]>
net/mlx5: IFC updates for disabled host PF
Hangbin Liu <[email protected]>
bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
Eric Badger <[email protected]>
xprtrdma: Decrement re_receiving on the early exit paths
J. Neuschäfer <[email protected]>
powerpc: 83xx: km83xx: Fix keymile vendor prefix
Tzung-Bi Shih <[email protected]>
remoteproc: mediatek: Unprepare SCP clock during system suspend
Bjorn Andersson <[email protected]>
remoteproc: sysmon: Correct subsys_name_len type in QMI request
Christophe Leroy (CS GROUP) <[email protected]>
powerpc/uaccess: Fix inline assembly for clang build on PPC32
Takashi Iwai <[email protected]>
ALSA: usb-audio: Check max frame size for implicit feedback mode, too
Takashi Iwai <[email protected]>
ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
Azamat Almazbek uulu <[email protected]>
ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
Tomas Henzl <[email protected]>
scsi: ses: Fix devices attaching to different hosts
Sofia Schneider <[email protected]>
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
Ramanathan Choodamani <[email protected]>
wifi: mac80211: set default WMM parameters on all links
Al Viro <[email protected]>
unshare: fix unshare_fs() handling
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Add NULL checks when resetting request and reply queues
Piotr Mazek <[email protected]>
ACPI: PM: Save NVS memory on Lenovo G70-35
Jan Kiszka <[email protected]>
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
Menglong Dong <[email protected]>
net: tcp: accept old ack during closing
Victor Nogueira <[email protected]>
net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
Guenter Roeck <[email protected]>
tracing: Add NULL pointer check to trigger_data_free()
Larysa Zaremba <[email protected]>
xdp: produce a warning when calculated tailroom is negative
Larysa Zaremba <[email protected]>
xdp: use modulo operation to calculate XDP frag tailroom
Jamal Hadi Salim <[email protected]>
net/sched: act_ife: Fix metalist update behavior
Jiayuan Chen <[email protected]>
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
Fernando Fernandez Mancera <[email protected]>
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
Fernando Fernandez Mancera <[email protected]>
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
Lorenzo Bianconi <[email protected]>
net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()
Ovidiu Panait <[email protected]>
net: stmmac: Fix error handling in VLAN add and delete paths
Jakub Kicinski <[email protected]>
nfc: rawsock: cancel tx_work before socket teardown
Jakub Kicinski <[email protected]>
nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
Jakub Kicinski <[email protected]>
nfc: nci: free skb on nci_transceive early error paths
Ian Ray <[email protected]>
net: nfc: nci: Fix zero-length proprietary notifications
Koichiro Den <[email protected]>
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
Raju Rangoju <[email protected]>
amd-xgbe: fix sleep while atomic on suspend/resume
Jakub Kicinski <[email protected]>
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
Lang Xu <[email protected]>
bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
Kui-Feng Lee <[email protected]>
bpf: export bpf_link_inc_not_zero.
David Thomson <[email protected]>
xen/acpi-processor: fix _CST detection using undersized evaluation buffer
Eric Dumazet <[email protected]>
indirect_call_wrapper: do not reevaluate function pointer
Lorenzo Bianconi <[email protected]>
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
Bart Van Assche <[email protected]>
wifi: wlcore: Fix a locking bug
Bart Van Assche <[email protected]>
wifi: cw1200: Fix locking in error paths
Vimlesh Kumar <[email protected]>
octeon_ep: avoid compiler and IQ/OQ reordering
Vimlesh Kumar <[email protected]>
octeon_ep: Relocate counter updates before NAPI
Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value
Shuvam Pandey <[email protected]>
kunit: tool: copy caller args in run_kernel to prevent mutation
Rae Moar <[email protected]>
kunit: tool: Add command line interface to filter and report attributes
Daniel Latypov <[email protected]>
kunit: tool: fix pre-existing mypy --strict errors and update run_checks.py
Daniel Latypov <[email protected]>
kunit: tool: remove unused imports and variables
Alexander Pantyukhin <[email protected]>
kunit: kunit.py extract handlers
Daniel Latypov <[email protected]>
kunit: tool: make parser preserve whitespace when printing test log
Daniel Latypov <[email protected]>
kunit: tool: don't include KTAP headers and the like in the test log
Rae Moar <[email protected]>
kunit: tool: parse KTAP compliant test output
Daniel Latypov <[email protected]>
kunit: tool: make --json do nothing if --raw_ouput is set
Daniel Latypov <[email protected]>
kunit: tool: print summary of failed tests if a few failed out of a lot
Alban Bedel <[email protected]>
can: mcp251x: fix deadlock in error path of mcp251x_open
Oliver Hartkopp <[email protected]>
can: bcm: fix locking for bcm_op runtime updates
Jiayuan Chen <[email protected]>
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
Guenter Roeck <[email protected]>
dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
Ioana Ciornei <[email protected]>
dpaa2-switch: do not clear any interrupts automatically
Vladimir Oltean <[email protected]>
net: dpaa2-switch: serialize changes to priv->mac with a mutex
Vladimir Oltean <[email protected]>
net: dpaa2-switch replace direct MAC access with dpaa2_switch_port_has_mac()
Vladimir Oltean <[email protected]>
net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call
Vladimir Oltean <[email protected]>
net: dpaa2: replace dpaa2_mac_is_type_fixed() with dpaa2_mac_is_type_phy()
Chintan Vankar <[email protected]>
net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table
Jonathan Teh <[email protected]>
platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
Thomas Weißschuh <[email protected]>
ARM: clean up the memset64() C wrapper
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check removing signal+subflow endp
Paolo Abeni <[email protected]>
selftests: mptcp: more stable simult_flows tests
Junxiao Bi <[email protected]>
scsi: core: Fix refcount leak for tagset_refcnt
Thorsten Blum <[email protected]>
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
Paulo Alcantara <[email protected]>
smb: client: fix broken multichannel with krb5+signing
Lars Ellenberg <[email protected]>
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Phillip Lougher <[email protected]>
Squashfs: check metadata block offset is within range
Prithvi Tambewagh <[email protected]>
scsi: target: Fix recursive locking in __configfs_open_file()
Davide Caratti <[email protected]>
net/sched: ets: fix divide by zero in the offload path
Jason Gunthorpe <[email protected]>
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
Jason Gunthorpe <[email protected]>
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
Vahagn Vardanian <[email protected]>
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
Johannes Berg <[email protected]>
wifi: radiotap: reject radiotap with unknown bits
Jun Seo <[email protected]>
ALSA: usb-audio: Use correct version for UAC3 header validation
Kurt Borja <[email protected]>
platform/x86: dell-wmi: Add audio/mic mute key codes
Thorsten Blum <[email protected]>
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
Mike Rapoport (Microsoft) <[email protected]>
x86/efi: defer freeing of boot services memory
Greg Kroah-Hartman <[email protected]>
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
Greg Kroah-Hartman <[email protected]>
can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
Greg Kroah-Hartman <[email protected]>
can: ucan: Fix infinite loop from zero-length messages
Greg Kroah-Hartman <[email protected]>
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
Greg Kroah-Hartman <[email protected]>
net: usb: pegasus: validate USB endpoints
Greg Kroah-Hartman <[email protected]>
net: usb: kalmia: validate USB endpoints
Greg Kroah-Hartman <[email protected]>
net: usb: kaweth: validate USB endpoints
Greg Kroah-Hartman <[email protected]>
nfc: pn533: properly drop the usb interface reference on disconnect
Jens Axboe <[email protected]>
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
Jann Horn <[email protected]>
eventpoll: Fix integer overflow in ep_loop_check_proc()
Alex Deucher <[email protected]>
drm/amdgpu: keep vga memory on MacBooks with switchable graphics
Mario Limonciello <[email protected]>
drm/amd: Drop special case for yellow carp without discovery
Ethan Nelson-Moore <[email protected]>
net: arcnet: com20020-pci: fix support for 2.5Mbit cards
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
Gui-Dong Han <[email protected]>
hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
Thomas Richard (TI) <[email protected]>
usb: cdns3: fix role switching during resume
Théo Lebrun <[email protected]>
usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
Hongyu Xie <[email protected]>
usb: cdns3: remove redundant if branch
Johan Hovold <[email protected]>
clk: tegra: tegra124-emc: fix device leak on set_rate()
Shawn Lin <[email protected]>
arm64: dts: rockchip: Fix rk356x PCIe range mappings
Johan Hovold <[email protected]>
mfd: omap-usb-host: Fix OF populate on driver rebind
Uwe Kleine-König <[email protected]>
mfd: omap-usb-host: Convert to platform remove callback returning void
Johan Hovold <[email protected]>
mfd: qcom-pm8xxx: Fix OF populate on driver rebind
Uwe Kleine-König <[email protected]>
mfd: qcom-pm8xxx: Convert to platform remove callback returning void
Yongjian Sun <[email protected]>
ext4: fix e4b bitmap inconsistency reports
Matthew Wilcox (Oracle) <[email protected]>
ext4: convert bd_buddy_page to bd_buddy_folio
Matthew Wilcox (Oracle) <[email protected]>
ext4: convert bd_bitmap_page to bd_bitmap_folio
Gou Hao <[email protected]>
ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock()
Theodore Ts'o <[email protected]>
ext4: convert some BUG_ON's in mballoc to use WARN_RATELIMITED instead
Kemeng Shi <[email protected]>
ext4: remove unnecessary e4b->bd_buddy_page check in ext4_mb_load_buddy_gfp
Zhang Yi <[email protected]>
ext4: drop extent cache when splitting extent fails
Zhang Yi <[email protected]>
ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
Zhang Yi <[email protected]>
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
Zhang Yi <[email protected]>
ext4: subdivide EXT4_EXT_DATA_VALID1
Baokun Li <[email protected]>
ext4: get rid of ppath in ext4_split_extent_at()
Baokun Li <[email protected]>
ext4: get rid of ppath in ext4_ext_insert_extent()
Baokun Li <[email protected]>
ext4: get rid of ppath in ext4_ext_create_new_leaf()
Baokun Li <[email protected]>
ext4: get rid of ppath in ext4_find_extent()
Baokun Li <[email protected]>
ext4: make ext4_es_remove_extent() return void
Johan Hovold <[email protected]>
bus: omap-ocp2scp: fix OF populate on driver rebind
Uwe Kleine-König <[email protected]>
bus: omap-ocp2scp: Convert to platform remove callback returning void
Johan Hovold <[email protected]>
drm/tegra: dsi: fix device leak on probe
Sean Christopherson <[email protected]>
KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
Sean Christopherson <[email protected]>
KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject
Alper Ak <[email protected]>
media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
Milen Mitkov <[email protected]>
media: camss: vfe-480: Multiple outputs support for SM8250
Zilin Guan <[email protected]>
media: tegra-video: Fix memory leak in __tegra_channel_try_format()
Laurent Pinchart <[email protected]>
media: tegra-video: Use accessors for pad config 'try_*' fields
Sean Christopherson <[email protected]>
KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR
Sean Christopherson <[email protected]>
KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED
Mathias Krause <[email protected]>
KVM: x86: Fix KVM_GET_MSRS stack info leak
Sean Christopherson <[email protected]>
KVM: x86/pmu: Provide "error" semantics for unsupported-but-known PMU MSRs
Ilpo Järvinen <[email protected]>
PCI: Use resource_set_range() that correctly sets ->end
Ilpo Järvinen <[email protected]>
resource: Add resource set range and size helpers
Puranjay Mohan <[email protected]>
PCI: Use resource names in PCI log messages
Puranjay Mohan <[email protected]>
PCI: Update BAR # and window messages
Bjorn Helgaas <[email protected]>
PCI: Fix printk field formatting
Mika Westerberg <[email protected]>
PCI: Introduce pci_dev_for_each_resource()
Johan Hovold <[email protected]>
memory: mtk-smi: fix device leak on larb probe
Johan Hovold <[email protected]>
memory: mtk-smi: fix device leaks on common probe
Uwe Kleine-König <[email protected]>
memory: mtk-smi: Convert to platform remove callback returning void
Kohei Enju <[email protected]>
bpf: Fix stack-out-of-bounds write in devmap
Mark Harmstone <[email protected]>
btrfs: fix compat mask in error messages in btrfs_check_features()
Mark Harmstone <[email protected]>
btrfs: fix incorrect key offset in error message in check_dev_extent_item()
Josef Bacik <[email protected]>
btrfs: move btrfs_crc32c_final into free-space-cache.c
Peter Zijlstra <[email protected]>
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
Takashi Iwai <[email protected]>
ALSA: usb-audio: Use inclusive terms
Takashi Iwai <[email protected]>
ALSA: usb-audio: Cap the packet size pre-calculations
Peter Wang <[email protected]>
scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
Bart Van Assche <[email protected]>
scsi: ufs: core: Always initialize the UIC done completion
Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
Salomon Dushimirimana <[email protected]>
scsi: pm8001: Fix use-after-free in pm8001_queue_command()
Mathias Krause <[email protected]>
scsi: lpfc: Properly set WC for DPP mapping
Nam Cao <[email protected]>
irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
Felix Gu <[email protected]>
drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
Ian Forbes <[email protected]>
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
Brad Spengler <[email protected]>
drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
-------------
Diffstat:
.clang-format | 1 + .../ethernet/freescale/dpaa2/mac-phy-support.rst | 9 +- Makefile | 4 +- arch/alpha/kernel/pci.c | 5 +- arch/arm/include/asm/string.h | 14 +- arch/arm/kernel/bios32.c | 16 +- arch/arm/mach-dove/pcie.c | 10 +- arch/arm/mach-mv78xx0/pcie.c | 10 +- arch/arm/mach-orion5x/pci.c | 10 +- .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 1 - arch/arm64/boot/dts/rockchip/rk3568.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- arch/arm64/include/asm/pgtable-prot.h | 76 ++-- arch/loongarch/include/asm/uaccess.h | 14 +- arch/mips/pci/ops-bcm63xx.c | 8 +- arch/mips/pci/pci-legacy.c | 3 +- arch/parisc/include/asm/pgtable.h | 2 +- arch/parisc/kernel/head.S | 7 +- arch/parisc/kernel/setup.c | 20 +- arch/powerpc/include/asm/uaccess.h | 2 +- arch/powerpc/kernel/pci-common.c | 21 +- arch/powerpc/platforms/4xx/pci.c | 8 +- arch/powerpc/platforms/52xx/mpc52xx_pci.c | 5 +- arch/powerpc/platforms/83xx/km83xx.c | 4 +- arch/powerpc/platforms/pseries/pci.c | 16 +- arch/riscv/kernel/stacktrace.c | 21 +- arch/s390/lib/xor.c | 4 +- arch/sh/drivers/pci/pcie-sh7786.c | 10 +- arch/sparc/kernel/leon_pci.c | 5 +- arch/sparc/kernel/pci.c | 10 +- arch/sparc/kernel/pcic.c | 5 +- arch/x86/boot/compressed/sev.c | 1 + arch/x86/include/asm/efi.h | 2 +- arch/x86/include/asm/msr-index.h | 5 +- arch/x86/kernel/apic/apic.c | 6 + arch/x86/kernel/uprobes.c | 24 ++ arch/x86/kvm/svm/avic.c | 8 +- arch/x86/kvm/svm/svm.c | 11 +- arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/kvm/x86.c | 120 +++--- arch/x86/kvm/x86.h | 15 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 ++- drivers/acpi/acpi_processor.c | 15 +- drivers/acpi/osi.c | 13 + drivers/acpi/osl.c | 2 +- drivers/acpi/sleep.c | 8 + drivers/base/power/runtime.c | 1 + drivers/base/property.c | 27 +- drivers/block/drbd/drbd_actlog.c | 53 +-- drivers/block/drbd/drbd_interval.h | 5 +- drivers/bluetooth/btqca.c | 2 + drivers/bus/omap-ocp2scp.c | 19 +- drivers/clk/tegra/clk-tegra124-emc.c | 2 +- drivers/cpuidle/cpuidle.c | 10 - drivers/crypto/atmel-sha204a.c | 5 +- drivers/dma/mmp_pdma.c | 6 + drivers/firmware/arm_scpi.c | 5 +- drivers/firmware/efi/mokvar-table.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 36 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 12 +- drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 +- drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c | 3 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 3 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 1 + .../amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +- drivers/gpu/drm/amd/display/dc/dm_services_types.h | 2 +- drivers/gpu/drm/amd/include/dm_pp_interface.h | 1 + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 67 +++ drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h | 2 + drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +- drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | 6 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 69 ++- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 13 +- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 13 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 118 +++++- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 72 +++- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 +- drivers/gpu/drm/logicvc/logicvc_drm.c | 4 +- drivers/gpu/drm/msm/msm_gpummu.c | 2 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/gpu/drm/radeon/si_dpm.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 9 +- drivers/hid/hid-cmedia.c | 2 +- drivers/hid/hid-creative-sb0540.c | 2 +- drivers/hid/hid-zydacron.c | 2 +- drivers/hwmon/max16065.c | 26 +- drivers/hwmon/pmbus/isl68137.c | 7 +- drivers/hwmon/pmbus/q54sj108a2.c | 19 +- drivers/i2c/busses/i2c-cp2615.c | 5 +- drivers/i2c/busses/i2c-fsi.c | 1 + drivers/i3c/master/mipi-i3c-hci/cmd.h | 1 + drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 2 +- drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 2 +- drivers/i3c/master/mipi-i3c-hci/core.c | 6 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 4 +- drivers/iio/chemical/bme680_core.c | 2 +- drivers/iio/chemical/sps30_i2c.c | 2 +- drivers/iio/chemical/sps30_serial.c | 2 +- drivers/iio/dac/ds4424.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 18 +- drivers/iio/gyro/mpu3050-i2c.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 + drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 + drivers/iio/industrialio-buffer.c | 102 ++--- drivers/iio/light/bh1780.c | 4 +- drivers/iio/potentiometer/mcp4131.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 2 +- drivers/infiniband/hw/mthca/mthca_provider.c | 5 +- drivers/iommu/intel/dmar.c | 3 +- drivers/irqchip/irq-gic-v3-its.c | 4 + drivers/irqchip/irq-sifive-plic.c | 7 +- drivers/mailbox/mailbox.c | 6 +- drivers/md/dm-verity-fec.c | 4 +- drivers/md/dm-verity-fec.h | 3 - drivers/media/dvb-core/dmxdev.c | 4 +- drivers/media/dvb-core/dvb_net.c | 3 + drivers/media/platform/qcom/camss/camss-vfe-480.c | 59 ++- drivers/memory/mtk-smi.c | 13 +- drivers/mfd/omap-usb-host.c | 11 +- drivers/mfd/qcom-pm8xxx.c | 14 +- drivers/mmc/host/mmci_qcom_dml.c | 1 + drivers/mmc/host/sdhci-pci-gli.c | 9 + drivers/mmc/host/sdhci.c | 9 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 +- drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +- drivers/mtd/nand/raw/nand_base.c | 14 +- drivers/mtd/nand/raw/pl35x-nand-controller.c | 3 + drivers/mtd/nand/spi/macronix.c | 3 +- drivers/mtd/parsers/redboot.c | 6 +- drivers/net/arcnet/com20020-pci.c | 16 +- drivers/net/bonding/bond_debugfs.c | 16 +- drivers/net/bonding/bond_main.c | 10 +- drivers/net/caif/caif_serial.c | 3 + drivers/net/can/spi/hi311x.c | 5 +- drivers/net/can/spi/mcp251x.c | 15 +- drivers/net/can/usb/ems_usb.c | 7 +- drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +- drivers/net/can/usb/gs_usb.c | 22 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/dsa/bcm_sf2.c | 8 +- drivers/net/dsa/realtek/rtl8365mb.c | 5 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 10 - drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe.h | 3 - drivers/net/ethernet/arc/emac_main.c | 11 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 7 - drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 2 +- drivers/net/ethernet/cadence/macb.h | 7 + drivers/net/ethernet/cadence/macb_main.c | 184 +++++++- drivers/net/ethernet/cadence/macb_ptp.c | 4 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 7 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.h | 10 +- .../freescale/dpaa2/dpaa2-switch-ethtool.c | 34 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 57 ++- .../net/ethernet/freescale/dpaa2/dpaa2-switch.h | 9 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 131 ++++-- drivers/net/ethernet/freescale/fec_main.c | 19 +- drivers/net/ethernet/google/gve/gve.h | 1 + drivers/net/ethernet/google/gve/gve_main.c | 5 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 - drivers/net/ethernet/intel/e1000e/netdev.c | 2 - drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 9 +- drivers/net/ethernet/intel/ice/ice_common.c | 8 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 35 +- drivers/net/ethernet/intel/igc/igc_main.c | 7 +- drivers/net/ethernet/intel/ixgbevf/vf.c | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 48 ++- drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 27 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 468 ++++++--------------- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 15 +- .../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 30 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 18 +- drivers/net/ethernet/microsoft/mana/hw_channel.c | 6 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 23 +- drivers/net/ethernet/stmicro/stmmac/common.h | 1 - drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 - .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 9 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 - drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 61 +-- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 - drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- drivers/net/ethernet/ti/cpsw_ale.c | 9 +- drivers/net/mctp/mctp-i2c.c | 1 + drivers/net/phy/phy_device.c | 13 +- drivers/net/usb/aqc111.c | 12 +- drivers/net/usb/kalmia.c | 7 + drivers/net/usb/kaweth.c | 13 + drivers/net/usb/lan78xx.c | 10 +- drivers/net/usb/lan78xx.h | 3 + drivers/net/usb/pegasus.c | 13 +- drivers/net/vxlan/vxlan_core.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- drivers/net/wireless/marvell/libertas/main.c | 4 +- .../net/wireless/mediatek/mt76/mt76_connac_mac.c | 1 + drivers/net/wireless/st/cw1200/pm.c | 2 + drivers/net/wireless/ti/wlcore/main.c | 4 +- drivers/net/wireless/ti/wlcore/tx.c | 2 +- drivers/nfc/nxp-nci/i2c.c | 4 +- drivers/nfc/pn533/usb.c | 1 + drivers/nvdimm/bus.c | 5 +- drivers/nvme/host/core.c | 2 + drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 8 +- drivers/pci/iov.c | 7 +- drivers/pci/pci-acpi.c | 59 ++- drivers/pci/pci.c | 85 +++- drivers/pci/pci.h | 5 + drivers/pci/pcie/aer.c | 3 - drivers/pci/probe.c | 32 +- drivers/pci/quirks.c | 15 +- drivers/pci/remove.c | 5 +- drivers/pci/setup-bus.c | 57 +-- drivers/pci/setup-res.c | 74 ++-- drivers/pci/vgaarb.c | 17 +- drivers/pci/xen-pcifront.c | 4 +- drivers/platform/x86/dell/dell-wmi-base.c | 6 + .../dell/dell-wmi-sysman/passwordattr-interface.c | 1 - drivers/platform/x86/thinkpad_acpi.c | 6 +- drivers/pnp/quirks.c | 29 +- drivers/regulator/pca9450-regulator.c | 41 +- drivers/remoteproc/mtk_scp.c | 39 ++ drivers/remoteproc/qcom_sysmon.c | 2 +- drivers/s390/block/dasd_eckd.c | 16 + drivers/s390/crypto/zcrypt_ccamisc.c | 12 +- drivers/s390/crypto/zcrypt_cex4.c | 3 +- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 36 +- drivers/scsi/lpfc/lpfc_sli4.h | 3 + drivers/scsi/mpi3mr/mpi3mr_fw.c | 32 +- drivers/scsi/pm8001/pm8001_sas.c | 5 +- drivers/scsi/scsi_scan.c | 7 +- drivers/scsi/ses.c | 5 +- drivers/scsi/storvsc_drv.c | 5 +- drivers/soc/bcm/bcm2835-power.c | 18 +- drivers/soc/fsl/qbman/qman.c | 24 +- drivers/spi/spi-cadence-quadspi.c | 34 ++ drivers/spi/spi.c | 25 +- drivers/staging/media/tegra-video/vi.c | 27 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 +- drivers/target/target_core_configfs.c | 15 +- drivers/tty/serial/8250/8250_dma.c | 15 + drivers/tty/serial/8250/8250_pci.c | 17 + drivers/tty/serial/8250/8250_port.c | 6 + drivers/tty/serial/uartlite.c | 1 + drivers/ufs/core/ufshcd.c | 35 +- drivers/usb/cdns3/core.c | 11 +- drivers/usb/class/cdc-acm.c | 5 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/cdc-wdm.c | 4 +- drivers/usb/class/usbtmc.c | 6 +- drivers/usb/core/message.c | 100 ++++- drivers/usb/core/phy.c | 8 +- drivers/usb/core/quirks.c | 16 + drivers/usb/gadget/function/f_mass_storage.c | 12 +- drivers/usb/gadget/function/f_tcm.c | 14 + drivers/usb/host/xhci.c | 4 +- drivers/usb/image/mdc800.c | 6 +- drivers/usb/misc/uss720.c | 2 +- drivers/usb/misc/yurex.c | 2 +- drivers/usb/renesas_usbhs/common.c | 9 + drivers/usb/roles/class.c | 7 +- drivers/usb/serial/f81232.c | 77 ++-- drivers/xen/xen-acpi-processor.c | 7 +- fs/binfmt_misc.c | 4 +- fs/btrfs/ctree.h | 7 +- fs/btrfs/disk-io.c | 28 +- fs/btrfs/extent_io.c | 3 +- fs/btrfs/extent_io.h | 3 +- fs/btrfs/free-space-cache.c | 5 + fs/btrfs/inode.c | 19 + fs/btrfs/ioctl.c | 24 +- fs/btrfs/send.c | 4 + fs/btrfs/transaction.c | 16 + fs/btrfs/tree-checker.c | 4 +- fs/btrfs/uuid-tree.c | 46 ++ fs/ceph/dir.c | 15 +- fs/dlm/lock.c | 10 +- fs/eventpoll.c | 5 +- fs/ext4/ext4.h | 9 +- fs/ext4/extents.c | 312 ++++++++------ fs/ext4/extents_status.c | 12 +- fs/ext4/extents_status.h | 4 +- fs/ext4/fast_commit.c | 8 +- fs/ext4/inline.c | 12 +- fs/ext4/inode.c | 8 +- fs/ext4/mballoc.c | 258 ++++++------ fs/ext4/mballoc.h | 4 +- fs/ext4/migrate.c | 5 +- fs/ext4/move_extent.c | 7 +- fs/f2fs/data.c | 5 +- fs/gfs2/util.c | 31 +- fs/iomap/buffered-io.c | 7 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 31 +- fs/nfsd/state.h | 17 +- fs/ntfs3/super.c | 5 + fs/smb/client/cifsencrypt.c | 3 +- fs/smb/client/cifsfs.c | 9 +- fs/smb/client/cifsglob.h | 11 + fs/smb/client/cifsproto.h | 1 + fs/smb/client/connect.c | 5 +- fs/smb/client/dir.c | 1 + fs/smb/client/file.c | 29 +- fs/smb/client/misc.c | 41 ++ fs/smb/client/smb2ops.c | 14 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/client/smb2transport.c | 4 +- fs/smb/server/auth.c | 26 +- fs/smb/server/smb2pdu.c | 17 +- fs/squashfs/cache.c | 3 + fs/xfs/xfs_bmap_item.c | 3 +- fs/xfs/xfs_dquot.c | 8 +- fs/xfs/xfs_log.c | 2 + include/asm-generic/tlb.h | 77 +++- include/linux/bpf.h | 6 + include/linux/hugetlb.h | 17 +- include/linux/indirect_call_wrapper.h | 18 +- include/linux/ioport.h | 32 ++ include/linux/irqchip/arm-gic-v3.h | 1 + include/linux/mlx5/mlx5_ifc.h | 4 +- include/linux/mm_types.h | 1 + include/linux/mmc/host.h | 9 +- include/linux/pci.h | 14 + include/linux/skbuff.h | 12 + include/linux/stmmac.h | 1 - include/linux/uprobes.h | 1 + include/linux/usb.h | 8 +- include/net/act_api.h | 1 + include/net/bluetooth/hci_core.h | 3 + include/net/netfilter/nf_tables.h | 7 +- include/net/sch_generic.h | 38 ++ include/net/tc_act/tc_gate.h | 33 +- include/net/tc_act/tc_ife.h | 4 +- include/net/udp_tunnel.h | 2 +- include/sound/soc.h | 2 + include/trace/events/kmem.h | 8 +- io_uring/io-wq.c | 2 +- io_uring/kbuf.c | 8 +- kernel/bpf/devmap.c | 22 +- kernel/bpf/syscall.c | 3 +- kernel/bpf/trampoline.c | 4 +- kernel/bpf/verifier.c | 4 + kernel/cgroup/cgroup.c | 1 + kernel/events/core.c | 42 +- kernel/events/uprobes.c | 10 +- kernel/fork.c | 2 +- kernel/kprobes.c | 47 +-- kernel/rcu/tree_nocb.h | 5 +- kernel/sched/fair.c | 6 - kernel/sched/idle.c | 45 +- kernel/time/time.c | 171 +++++++- kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 51 ++- kernel/trace/trace_events_trigger.c | 3 + lib/bootconfig.c | 9 +- mm/hugetlb.c | 143 ++++--- mm/kfence/core.c | 22 +- mm/mmu_gather.c | 33 ++ mm/rmap.c | 25 +- net/atm/lec.c | 26 +- net/batman-adv/bat_iv_ogm.c | 3 + net/batman-adv/bat_v_elp.c | 10 +- net/batman-adv/hard-interface.c | 8 +- net/batman-adv/hard-interface.h | 1 + net/bluetooth/hci_core.c | 34 +- net/bluetooth/hci_sync.c | 2 +- net/bluetooth/hidp/core.c | 16 +- net/bluetooth/l2cap_core.c | 31 +- net/bluetooth/smp.c | 2 +- net/bridge/br_device.c | 2 +- net/bridge/br_input.c | 2 +- net/can/bcm.c | 1 + net/ceph/auth.c | 6 +- net/ceph/messenger_v2.c | 31 +- net/ceph/mon_client.c | 6 +- net/core/dev.c | 2 +- net/core/filter.c | 23 +- net/dsa/dsa2.c | 7 + net/ipv4/icmp.c | 4 +- net/ipv4/tcp.c | 3 +- net/ipv4/tcp_input.c | 18 +- net/ipv4/tcp_ipv4.c | 3 +- net/ipv4/tcp_offload.c | 74 ++++ net/ipv4/udp_offload.c | 3 +- net/ipv6/ip6_output.c | 35 +- net/ipv6/route.c | 11 +- net/ipv6/tcp_ipv6.c | 3 +- net/ipv6/tcpv6_offload.c | 65 +++ net/l2tp/l2tp_ppp.c | 25 +- net/mac80211/debugfs.c | 14 +- net/mac80211/link.c | 2 + net/mac80211/mesh.c | 6 + net/mctp/route.c | 13 +- net/mptcp/pm.c | 2 +- net/mptcp/pm_netlink.c | 72 +++- net/mptcp/protocol.h | 2 + net/ncsi/ncsi-aen.c | 3 +- net/ncsi/ncsi-rsp.c | 16 +- net/netfilter/nf_conntrack_h323_asn1.c | 4 + net/netfilter/nf_conntrack_netlink.c | 67 +-- net/netfilter/nf_conntrack_sip.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nfnetlink_cthelper.c | 8 +- net/netfilter/nfnetlink_osf.c | 13 + net/netfilter/nfnetlink_queue.c | 4 +- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_ct.c | 9 + net/netfilter/nft_log.c | 2 +- net/netfilter/nft_meta.c | 2 +- net/netfilter/nft_numgen.c | 2 +- net/netfilter/nft_set_pipapo.c | 123 ++++-- net/netfilter/nft_set_pipapo.h | 2 + net/netfilter/nft_tunnel.c | 5 +- net/netfilter/xt_CT.c | 4 + net/netfilter/xt_IDLETIMER.c | 6 + net/netfilter/xt_dccp.c | 4 +- net/netfilter/xt_tcpudp.c | 6 +- net/netfilter/xt_time.c | 4 +- net/nfc/nci/core.c | 21 +- net/nfc/nci/data.c | 12 +- net/nfc/rawsock.c | 11 + net/rose/af_rose.c | 5 + net/sched/act_ct.c | 6 + net/sched/act_gate.c | 264 ++++++++---- net/sched/act_ife.c | 93 ++-- net/sched/cls_api.c | 7 + net/sched/cls_u32.c | 13 +- net/sched/sch_ets.c | 12 +- net/sched/sch_generic.c | 27 -- net/sched/sch_teql.c | 8 +- net/smc/af_smc.c | 23 +- net/smc/smc.h | 5 + net/smc/smc_close.c | 2 +- net/sunrpc/cache.c | 26 +- net/sunrpc/xprtrdma/verbs.c | 7 +- net/tipc/socket.c | 2 + net/wireless/core.c | 4 +- net/wireless/core.h | 4 +- net/wireless/pmsr.c | 1 + net/wireless/radiotap.c | 4 +- net/wireless/scan.c | 14 +- sound/core/pcm_lib.c | 11 +- sound/core/pcm_native.c | 25 +- sound/pci/hda/patch_conexant.c | 11 + sound/soc/amd/acp3x-rt5682-max9836.c | 9 +- sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 1 + sound/soc/qcom/qdsp6/q6apm.c | 1 + sound/soc/soc-core.c | 35 +- sound/usb/endpoint.c | 10 +- sound/usb/midi.c | 3 +- sound/usb/mixer_scarlett2.c | 2 + sound/usb/quirks.c | 4 +- sound/usb/validate.c | 2 +- tools/bootconfig/main.c | 7 +- tools/testing/kunit/kunit.py | 279 +++++++----- tools/testing/kunit/kunit_config.py | 4 +- tools/testing/kunit/kunit_kernel.py | 42 +- tools/testing/kunit/kunit_parser.py | 171 +++++--- tools/testing/kunit/kunit_tool_test.py | 120 +++++- tools/testing/kunit/run_checks.py | 4 +- .../kunit/test_data/test_parse_ktap_output.log | 8 + .../kunit/test_data/test_parse_subtest_header.log | 7 + tools/testing/selftests/net/amt.sh | 7 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 49 +++ tools/testing/selftests/net/mptcp/simult_flows.sh | 11 +- 495 files changed, 5835 insertions(+), 3013 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/481 drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brad Spengler <[email protected]>
[ Upstream commit 211ecfaaef186ee5230a77d054cdec7fbfc6724a ]
The kref_put() call uses (void *)kvfree as the release callback, which is incorrect. kref_put() expects a function with signature void (*release)(struct kref *), but kvfree has signature void (*)(const void *). Calling through an incompatible function pointer is undefined behavior.
The code only worked by accident because ref_count is the first member of vmw_bo_dirty, making the kref pointer equal to the struct pointer.
Fix this by adding a proper release callback that uses container_of() to retrieve the containing structure before freeing.
--- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +8 -1
@@ -274,6 +274,13 @@ int vmw_bo_dirty_add(struct vmw_buffer_object *vbo)return ret; } +static void vmw_bo_dirty_free (struct kref *kref) +{ + struct vmw_bo_dirty *dirty = container_of(kref, struct vmw_bo_dirty, ref_count); + +kvfree (dirty); +} +/** * vmw_bo_dirty_release - Release a dirty-tracking user from a buffer object * @vbo: The buffer object
@@ -288,7 +295,7 @@ void vmw_bo_dirty_release(struct vmw_buffer_object *vbo) {struct vmw_bo_dirty *dirty = vbo->dirty; -if (dirty &&kref_put (&dirty->ref_count, (void *)kvfree)) +if (dirty &&kref_put (&dirty->ref_count, vmw_bo_dirty_free)) vbo->dirty =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/481 drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 5023ca80f9589295cb60735016e39fc5cc714243 ]
Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter.
The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +2 -2
@@ -1156,7 +1156,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv, ret =vmw_user_bo_lookup (sw_context->filp, handle, &vmw_bo);if (ret !=0 ) {drm_dbg (&dev_priv->drm,"Could not find or use MOB buffer.\n" ); -return PTR_ERR (vmw_bo); +return ret; } ret =vmw_validation_add_bo (sw_context->ctx, vmw_bo, true, false); tmp_bo = vmw_bo;
@@ -1211,7 +1211,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv, ret =vmw_user_bo_lookup (sw_context->filp, handle, &vmw_bo);if (ret !=0 ) {drm_dbg (&dev_priv->drm,"Could not find or use GMR region.\n" ); -return PTR_ERR (vmw_bo); +return ret; } ret =vmw_validation_add_bo (sw_context->ctx, vmw_bo, false, false); tmp_bo = vmw_bo;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/481 drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit fef0e649f8b42bdffe4a916dd46e1b1e9ad2f207 ]
The logicvc_drm_config_parse() function calls of_get_child_by_name() to find the "layers" node but fails to release the reference, leading to a device node reference leak.
Fix this by using the __free(device_node) cleanup attribute to automatic release the reference when the variable goes out of scope.
--- drivers/gpu/drm/logicvc/logicvc_drm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/logicvc/logicvc_drm.c +2 -2
@@ -90,7 +90,6 @@ static int logicvc_drm_config_parse(struct logicvc_drm *logicvc)struct device *dev = drm_dev->dev;struct device_node *of_node = dev->of_node;struct logicvc_drm_config *config = &logicvc->config; -struct device_node *layers_node;int ret; logicvc_of_property_parse_bool(of_node, LOGICVC_OF_PROPERTY_DITHERING,
@@ -126,7 +125,8 @@ static int logicvc_drm_config_parse(struct logicvc_drm *logicvc)if (ret)return ret; - layers_node =of_get_child_by_name (of_node,"layers" ); + struct device_node *layers_node __free(device_node) = +of_get_child_by_name (of_node,"layers" );if (!layers_node) {drm_err (drm_dev,"Missing non-optional layers node\n" );return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/481 irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
[ Upstream commit 1072020685f4b81f6efad3b412cdae0bd62bb043 ]
PLIC ignores interrupt completion message for disabled interrupt, explained by the specification:
The PLIC signals it has completed executing an interrupt handler by writing the interrupt ID it received from the claim to the claim/complete register. The PLIC does not check whether the completion ID is the same as the last claim ID for that target. If the completion ID does not match an interrupt source that is currently enabled for the target, the completion is silently ignored.
This caused problems in the past, because an interrupt can be disabled while still being handled and plic_irq_eoi() had no effect. That was fixed by checking if the interrupt is disabled, and if so enable it, before sending the completion message. That check is done with irqd_irq_disabled().
However, that is not sufficient because the enable bit for the handling hart can be zero despite irqd_irq_disabled(d) being false. This can happen when affinity setting is changed while a hart is still handling the interrupt.
This problem is easily reproducible by dumping a large file to uart (which generates lots of interrupts) and at the same time keep changing the uart interrupt's affinity setting. The uart port becomes frozen almost instantaneously.
Fix this by checking PLIC's enable bit instead of irqd_irq_disabled().
--- drivers/irqchip/irq-sifive-plic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/irqchip/irq-sifive-plic.c +6 -1
@@ -144,8 +144,13 @@ static void plic_irq_disable(struct irq_data *d)static void plic_irq_eoi (struct irq_data *d) {struct plic_handler *handler =this_cpu_ptr (&plic_handlers); +u32 __iomem *reg; +bool enabled; -if (unlikely (irqd_irq_disabled (d))) { + reg = handler->enable_base + (d->hwirq /32 ) *sizeof (u32); + enabled =readl (reg) &BIT (d->hwirq %32 ); + +if (unlikely (!enabled)) {plic_toggle (handler, d->hwirq,1 );writel (d->hwirq, handler->hart_base +CONTEXT_CLAIM );plic_toggle (handler, d->hwirq,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/481 scsi: lpfc: Properly set WC for DPP mapping
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit bffda93a51b40afd67c11bf558dc5aae83ca0943 ]
Using set_memory_wc() to enable write-combining for the DPP portion of the MMIO mapping is wrong as set_memory_*() is meant to operate on RAM only, not MMIO mappings. In fact, as used currently triggers a BUG_ON() with enabled CONFIG_DEBUG_VIRTUAL.
Simply map the DPP region separately and in addition to the already existing mappings, avoiding any possible negative side effects for these.
--- drivers/scsi/lpfc/lpfc_init.c | 2 ++ drivers/scsi/lpfc/lpfc_sli.c | 36 +++++++++++++++++++++++++++++------ drivers/scsi/lpfc/lpfc_sli4.h | 3 +++ 3 files changed, 35 insertions(+), 6 deletions(-)
drivers/scsi/lpfc/lpfc_init.c +2 -0
@@ -12059,6 +12059,8 @@ lpfc_sli4_pci_mem_unset(struct lpfc_hba *phba)iounmap (phba->sli4_hba.conf_regs_memmap_p);if (phba->sli4_hba.dpp_regs_memmap_p)iounmap (phba->sli4_hba.dpp_regs_memmap_p); +if (phba->sli4_hba.dpp_regs_memmap_wc_p) +iounmap (phba->sli4_hba.dpp_regs_memmap_wc_p);break ;case LPFC_SLI_INTF_IF_TYPE_1 :default :
drivers/scsi/lpfc/lpfc_sli.c +30 -6
@@ -15910,6 +15910,32 @@ lpfc_dual_chute_pci_bar_map(struct lpfc_hba *phba, uint16_t pci_barset)return NULL ; } +static __maybe_unused void __iomem * +lpfc_dpp_wc_map (struct lpfc_hba *phba,uint8_t dpp_barset) +{ + +/* DPP region is supposed to cover 64-bit BAR2 */ +if (dpp_barset !=WQ_PCI_BAR_4_AND_5 ) { +lpfc_log_msg (phba,KERN_WARNING ,LOG_INIT , +"3273 dpp_barset x%x != WQ_PCI_BAR_4_AND_5\n" , + dpp_barset); +return NULL ; + } + +if (!phba->sli4_hba.dpp_regs_memmap_wc_p) { +void __iomem *dpp_map; + + dpp_map =ioremap_wc (phba->pci_bar2_map, +pci_resource_len (phba->pcidev, +PCI_64BIT_BAR4 )); + +if (dpp_map) + phba->sli4_hba.dpp_regs_memmap_wc_p = dpp_map; + } + +return phba->sli4_hba.dpp_regs_memmap_wc_p; +} +/** * lpfc_modify_hba_eq_delay - Modify Delay Multiplier on EQs * @phba: HBA structure that EQs are on.
@@ -16819,9 +16845,6 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,uint8_t dpp_barset;uint32_t dpp_offset;uint8_t wq_create_version; -#ifdef CONFIG_X86 -unsigned long pg_addr; -#endif /* sanity check on queue memory */ if (!wq || !cq)
@@ -17007,14 +17030,15 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,#ifdef CONFIG_X86 /* Enable combined writes for DPP aperture */ - pg_addr = (unsigned long )(wq->dpp_regaddr) &PAGE_MASK ; - rc =set_memory_wc (pg_addr,1 ); -if (rc) { + bar_memmap_p =lpfc_dpp_wc_map (phba, dpp_barset); +if (!bar_memmap_p) {lpfc_printf_log (phba,KERN_ERR ,LOG_INIT ,"3272 Cannot setup Combined " "Write on WQ[%d] - disable DPP\n" , wq->queue_id); phba->cfg_enable_dpp =0 ; + }else { + wq->dpp_regaddr = bar_memmap_p + dpp_offset; }#else phba->cfg_enable_dpp =0 ;
drivers/scsi/lpfc/lpfc_sli4.h +3 -0
@@ -783,6 +783,9 @@ struct lpfc_sli4_hba {void __iomem *dpp_regs_memmap_p;/* Kernel memory mapped address for * dpp registers */ +void __iomem *dpp_regs_memmap_wc_p;/* Kernel memory mapped address for +* dpp registers with write combining +*/ union { struct { /* IF Type 0, BAR 0 PCI cfg space reg mem map */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/481 scsi: pm8001: Fix use-after-free in pm8001_queue_command()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salomon Dushimirimana <[email protected]>
[ Upstream commit 38353c26db28efd984f51d426eac2396d299cca7 ]
Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state.
In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free.
Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.
--- drivers/scsi/pm8001/pm8001_sas.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/pm8001/pm8001_sas.c +3 -2
@@ -467,8 +467,9 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags) }else { task->task_done (task); } - rc = -ENODEV ; - goto err_out; +spin_unlock_irqrestore (&pm8001_ha->lock, flags); +pm8001_dbg (pm8001_ha,IO ,"pm8001_task_exec device gone\n" ); +return 0 ; } ccb =pm8001_ccb_alloc (pm8001_ha, pm8001_dev, task);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/481 ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <[email protected]>
[ Upstream commit a8cc55bf81a45772cad44c83ea7bb0e98431094a ]
Remove QUIRK_FLAG_VALIDATE_RATES for Focusrite. With the previous commit, focusrite_valid_sample_rate() produces correct rate tables without USB probing.
QUIRK_FLAG_VALIDATE_RATES sends SET_CUR requests for each rate (~25ms each) and leaves the device at 192kHz. This is a problem because that
rate: 1) disables the internal mixer, so outputs are silent until an application opens the PCM and sets a lower rate, and 2) the Air and Safe modes get disabled.
--- sound/usb/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/quirks.c +1 -1
@@ -2298,7 +2298,7 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {VENDOR_FLG (0x07fd ,/* MOTU */ QUIRK_FLAG_VALIDATE_RATES ),VENDOR_FLG (0x1235 ,/* Focusrite Novation */ -QUIRK_FLAG_VALIDATE_RATES ), +0 ),VENDOR_FLG (0x1511 ,/* AURALiC */ QUIRK_FLAG_DSD_RAW ), VENDOR_FLG(0x152a, /* Thesycon devices */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/481 scsi: ufs: core: Always initialize the UIC done completion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit b1e8c53749adb795bfb0bf4e2f7836e26684bb90 ]
Simplify __ufshcd_send_uic_cmd() by always initializing the uic_cmd::done completion. This is fine since the time required to initialize a completion is small compared to the time required to process an UIC command.
Stable-dep-of: 62c015373e1c ("scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume")
--- drivers/ufs/core/ufshcd.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/ufs/core/ufshcd.c +4 -7
@@ -2340,13 +2340,11 @@ ufshcd_wait_for_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)* __ufshcd_send_uic_cmd - Send UIC commands and retrieve the result * @hba: per adapter instance * @uic_cmd: UIC command -* @completion: initialize the completion only if this is set to true * * Returns 0 only if success. */ static int -__ufshcd_send_uic_cmd (struct ufs_hba *hba,struct uic_command *uic_cmd, -bool completion) +__ufshcd_send_uic_cmd (struct ufs_hba *hba,struct uic_command *uic_cmd) {lockdep_assert_held (&hba->uic_cmd_mutex);
@@ -2356,8 +2354,7 @@ __ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd,return -EIO ; } -if (completion) -init_completion (&uic_cmd->done); +init_completion (&uic_cmd->done); uic_cmd->cmd_active =1 ;ufshcd_dispatch_uic_cmd (hba, uic_cmd);
@@ -2383,7 +2380,7 @@ int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)mutex_lock (&hba->uic_cmd_mutex);ufshcd_add_delay_before_dme_cmd (hba); - ret =__ufshcd_send_uic_cmd (hba, uic_cmd, true); + ret =__ufshcd_send_uic_cmd (hba, uic_cmd);if (!ret) ret =ufshcd_wait_for_uic_cmd (hba, uic_cmd);
@@ -4081,7 +4078,7 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd) reenable_intr = true; }spin_unlock_irqrestore (hba->host->host_lock, flags); - ret =__ufshcd_send_uic_cmd (hba, cmd, false); + ret =__ufshcd_send_uic_cmd (hba, cmd);if (ret) { dev_err(hba->dev, "pwr ctrl cmd 0x%x with mode 0x%x uic error %d\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/481 scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 62c015373e1cdb1cdca824bd2dbce2dac0819467 ]
Move the link recovery trigger from ufshcd_uic_pwr_ctrl() to __ufshcd_wl_resume(). Ensure link recovery is only attempted when hibern8 exit fails during resume, not during hibern8 enter in suspend. Improve error handling and prevent unnecessary link recovery attempts.
--- drivers/ufs/core/ufshcd.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/ufs/core/ufshcd.c +9 -9
@@ -4130,14 +4130,6 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd)spin_unlock_irqrestore (hba->host->host_lock, flags);mutex_unlock (&hba->uic_cmd_mutex); -/* -* If the h8 exit fails during the runtime resume process, it becomes -* stuck and cannot be recovered through the error handler. To fix -* this, use link recovery instead of the error handler. -*/ -if (ret && hba->pm_op_in_progress) - ret =ufshcd_link_recovery (hba); -return ret; }
@@ -9250,7 +9242,15 @@ static int __ufshcd_wl_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) }else {dev_err (hba->dev,"%s: hibern8 exit failed %d\n" , __func__, ret); - goto vendor_suspend; +/* +* If the h8 exit fails during the runtime resume +* process, it becomes stuck and cannot be recovered +* through the error handler. To fix this, use link +* recovery instead of the error handler. +*/ + ret =ufshcd_link_recovery (hba); +if (ret) + goto vendor_suspend; } }else if (ufshcd_is_link_off (hba)) {/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/481 ALSA: usb-audio: Cap the packet size pre-calculations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7fe8dec3f628e9779f1631576f8e693370050348 ]
We calculate the possible packet sizes beforehand for adaptive and synchronous endpoints, but we didn't take care of the max frame size for those pre-calculated values. When a device or a bus limits the packet size, a high sample rate or a high number of channels may lead to the packet sizes that are larger than the given limit, which results in an error from the USB core at submitting URBs.
As a simple workaround, just add the sanity checks of pre-calculated packet sizes to have the upper boundary of ep->maxframesize.
--- sound/usb/endpoint.c | 3 +++ 1 file changed, 3 insertions(+)
sound/usb/endpoint.c +3 -0
@@ -1392,6 +1392,9 @@ int snd_usb_endpoint_set_params(struct snd_usb_audio *chip, goto unlock; } + ep->packsize[0 ] =min (ep->packsize[0 ], ep->maxframesize); + ep->packsize[1 ] =min (ep->packsize[1 ], ep->maxframesize); +/* calculate the frequency in 16.16 format */ ep->freqm = ep->freqn; ep->freqshift =INT_MIN ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/481 ALSA: usb-audio: Use inclusive terms
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4e9113c533acee2ba1f72fd68ee6ecd36b64484e ]
Replace the remaining with inclusive terms; it's only this function name we overlooked at the previous conversion.
--- sound/usb/endpoint.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/usb/endpoint.c +3 -3
@@ -160,8 +160,8 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep)* This won't be used for implicit feedback which takes the packet size * returned from the sync source */ -static int slave_next_packet_size (struct snd_usb_endpoint *ep, -unsigned int avail) +static int synced_next_packet_size (struct snd_usb_endpoint *ep, +unsigned int avail) {unsigned long flags;unsigned int phase;
@@ -230,7 +230,7 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep, }if (ep->sync_source) -return slave_next_packet_size (ep, avail); +return synced_next_packet_size (ep, avail);else return next_packet_size (ep, avail); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/481 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae ]
Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption disabled.
This opens up a race vs perf_event_exit_event() and friends that will go and free various things the overflow path expects to be present, like the BPF program.
--- kernel/events/core.c | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-)
kernel/events/core.c +41 -1
@@ -9507,6 +9507,13 @@ int perf_event_overflow(struct perf_event *event,struct perf_sample_data *data, struct pt_regs *regs) { +/* +* Entry point from hardware PMI, interrupts should be disabled here. +* This serializes us against perf_event_remove_from_context() in +* things like perf_event_release_kernel(). +*/ +lockdep_assert_irqs_disabled (); +return __perf_event_overflow (event,1 , data, regs); }
@@ -9587,6 +9594,19 @@ static void perf_swevent_event(struct perf_event *event, u64 nr, {struct hw_perf_event *hwc = &event->hw; +/* +* This is: +* - software preempt +* - tracepoint preempt +* - tp_target_task irq (ctx->lock) +* - uprobes preempt/irq +* - kprobes preempt/irq +* - hw_breakpoint irq +* +* Any of these are sufficient to hold off RCU and thus ensure @event +* exists. +*/ +lockdep_assert_preemption_disabled ();local64_add (nr, &event->count);if (!regs)
@@ -9595,6 +9615,16 @@ static void perf_swevent_event(struct perf_event *event, u64 nr,if (!is_sampling_event (event))return ; +/* +* Serialize against event_function_call() IPIs like normal overflow +* event handling. Specifically, must not allow +* perf_event_release_kernel() -> perf_remove_from_context() to make +* progress and 'release' the event from under us. +*/ +guard (irqsave)(); +if (event->state !=PERF_EVENT_STATE_ACTIVE ) +return ; +if ((event->attr.sample_type &PERF_SAMPLE_PERIOD ) && !event->attr.freq) { data->period = nr;return perf_swevent_overflow (event,1 , data, regs);
@@ -10011,6 +10041,11 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size,struct perf_sample_data data;struct perf_event *event; +/* +* Per being a tracepoint, this runs with preemption disabled. +*/ +lockdep_assert_preemption_disabled (); +struct perf_raw_record raw = { .frag = { .size = entry_size,
@@ -10472,6 +10507,11 @@ void perf_bp_event(struct perf_event *bp, void *data)struct perf_sample_data sample;struct pt_regs *regs = data; +/* +* Exception context, will have interrupts disabled. +*/ +lockdep_assert_irqs_disabled (); +perf_sample_data_init (&sample, bp->attr.bp_addr,0 );if (!bp->hw.state && !perf_exclude_event (bp, regs))
@@ -10924,7 +10964,7 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)if (regs && !perf_exclude_event (event, regs)) {if (!(event->attr.exclude_idle &&is_idle_task (current))) -if (__perf_event_overflow (event,1 , &data, regs)) +if (perf_event_overflow (event, &data, regs)) ret =HRTIMER_NORESTART ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/481 btrfs: move btrfs_crc32c_final into free-space-cache.c
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 102f2640a346e84cb5c2d19805a9dd38a776013c ]
This is the only place this helper is used, take it out of ctree.h and move it into free-space-cache.c.
Stable-dep-of: 511dc8912ae3 ("btrfs: fix incorrect key offset in error message in check_dev_extent_item()")
--- fs/btrfs/ctree.h | 5 ----- fs/btrfs/free-space-cache.c | 5 +++++ 2 files changed, 5 insertions(+), 5 deletions(-)
fs/btrfs/ctree.h +0 -5
@@ -2827,11 +2827,6 @@ static inline u32 btrfs_crc32c(u32 crc, const void *address, unsigned length)return crc32c (crc, address, length); } -static inline void btrfs_crc32c_final (u32 crc,u8 *result) -{ -put_unaligned_le32 (~crc, result); -} -static inline u64 btrfs_name_hash (const char *name,int len) {return crc32c ((u32 )~1 , name, len);
fs/btrfs/free-space-cache.c +5 -0
@@ -48,6 +48,11 @@ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl, struct btrfs_free_space *info, u64 offset, u64 bytes, bool update_stats); +static void btrfs_crc32c_final (u32 crc,u8 *result) +{ +put_unaligned_le32 (~crc, result); +} +static void __btrfs_remove_free_space_cache (struct btrfs_free_space_ctl *ctl) {struct btrfs_free_space *info;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/481 btrfs: fix incorrect key offset in error message in check_dev_extent_item()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit 511dc8912ae3e929c1a182f5e6b2326516fd42a0 ]
Fix the error message in check_dev_extent_item(), when an overlapping stripe is encountered. For dev extents, objectid is the disk number and offset the physical address, so prev_key->objectid should actually be prev_key->offset.
(I can't take any credit for this one - this was discovered by Chris and his friend Claude.)
--- fs/btrfs/tree-checker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/tree-checker.c +1 -1
@@ -1697,7 +1697,7 @@ static int check_dev_extent_item(const struct extent_buffer *leaf,if (unlikely (prev_key->offset + prev_len > key->offset)) {generic_err (leaf, slot,"dev extent overlap, prev offset %llu len %llu current offset %llu" , - prev_key->objectid, prev_len, key->offset); + prev_key->offset, prev_len, key->offset);return -EUCLEAN ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/481 btrfs: fix compat mask in error messages in btrfs_check_features()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit 587bb33b10bda645a1028c1737ad3992b3d7cf61 ]
Commit d7f67ac9a928 ("btrfs: relax block-group-tree feature dependency checks") introduced a regression when it comes to handling unsupported incompat or compat_ro flags. Beforehand we only printed the flags that we didn't recognize, afterwards we printed them all, which is less useful. Fix the error handling so it behaves like it used to.
--- fs/btrfs/disk-io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/disk-io.c +3 -3
@@ -3356,7 +3356,7 @@ int btrfs_check_features(struct btrfs_fs_info *fs_info, bool is_rw_mount)if (incompat & ~BTRFS_FEATURE_INCOMPAT_SUPP ) {btrfs_err (fs_info,"cannot mount because of unknown incompat features (0x%llx)" , - incompat); + incompat & ~BTRFS_FEATURE_INCOMPAT_SUPP );return -EINVAL ; }
@@ -3388,7 +3388,7 @@ int btrfs_check_features(struct btrfs_fs_info *fs_info, bool is_rw_mount)if (compat_ro_unsupp && is_rw_mount) {btrfs_err (fs_info,"cannot mount read-write because of unknown compat_ro features (0x%llx)" , - compat_ro); + compat_ro_unsupp);return -EINVAL ; }
@@ -3401,7 +3401,7 @@ int btrfs_check_features(struct btrfs_fs_info *fs_info, bool is_rw_mount) !btrfs_test_opt(fs_info, NOLOGREPLAY)) {btrfs_err (fs_info,"cannot replay dirty log with unsupported compat_ro features (0x%llx), try rescue=nologreplay" , - compat_ro); + compat_ro_unsupp);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/481 bpf: Fix stack-out-of-bounds write in devmap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 ]
get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds.
Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write.
Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect.
To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path.
--- kernel/bpf/devmap.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
kernel/bpf/devmap.c +17 -5
@@ -571,18 +571,22 @@ static inline bool is_ifindex_excluded(int *excluded, int num_excluded, int ifin }/* Get ifindex of each upper device. 'indexes' must be able to hold at -* least MAX_NEST_DEV elements. -* Returns the number of ifindexes added. +* least 'max' elements. +* Returns the number of ifindexes added, or -EOVERFLOW if there are too +* many upper devices. */ -static int get_upper_ifindexes (struct net_device *dev,int *indexes) +static int get_upper_ifindexes (struct net_device *dev,int *indexes,int max) {struct net_device *upper;struct list_head *iter;int n =0 ;netdev_for_each_upper_dev_rcu (dev, upper, iter) { +if (n >= max) +return -EOVERFLOW ; indexes[n++] = upper->ifindex; } +return n; }
@@ -598,7 +602,11 @@ int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx,int err;if (exclude_ingress) { - num_excluded =get_upper_ifindexes (dev_rx, excluded_devices); + num_excluded =get_upper_ifindexes (dev_rx, excluded_devices, +ARRAY_SIZE (excluded_devices) -1 ); +if (num_excluded <0 ) +return num_excluded; + excluded_devices[num_excluded++] = dev_rx->ifindex; }
@@ -716,7 +724,11 @@ int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb,int err;if (exclude_ingress) { - num_excluded =get_upper_ifindexes (dev, excluded_devices); + num_excluded =get_upper_ifindexes (dev, excluded_devices, +ARRAY_SIZE (excluded_devices) -1 ); +if (num_excluded <0 ) +return num_excluded; + excluded_devices[num_excluded++] = dev->ifindex; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/481 memory: mtk-smi: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 08c1aeaa45ce0fd18912e92c6705586c8aa5240f ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 6cfa038bddd7 ("memory: mtk-smi: fix device leaks on common probe")
--- drivers/memory/mtk-smi.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/memory/mtk-smi.c +4 -6
@@ -566,14 +566,13 @@ static int mtk_smi_larb_probe(struct platform_device *pdev)return ret; } -static int mtk_smi_larb_remove (struct platform_device *pdev) +static void mtk_smi_larb_remove (struct platform_device *pdev) {struct mtk_smi_larb *larb =platform_get_drvdata (pdev);device_link_remove (&pdev->dev, larb->smi_common_dev);pm_runtime_disable (&pdev->dev);component_del (&pdev->dev, &mtk_smi_larb_component_ops); -return 0 ; }static int __maybe_unused mtk_smi_larb_resume (struct device *dev)
@@ -616,7 +615,7 @@ static const struct dev_pm_ops smi_larb_pm_ops = {static struct platform_driver mtk_smi_larb_driver = { .probe = mtk_smi_larb_probe, - .remove = mtk_smi_larb_remove, + .remove_new = mtk_smi_larb_remove, .driver = { .name ="mtk-smi-larb" , .of_match_table = mtk_smi_larb_of_ids,
@@ -789,14 +788,13 @@ static int mtk_smi_common_probe(struct platform_device *pdev)return 0 ; } -static int mtk_smi_common_remove (struct platform_device *pdev) +static void mtk_smi_common_remove (struct platform_device *pdev) {struct mtk_smi *common =dev_get_drvdata (&pdev->dev);if (common->plat->type ==MTK_SMI_GEN2_SUB_COMM )device_link_remove (&pdev->dev, common->smi_common_dev);pm_runtime_disable (&pdev->dev); -return 0 ; }static int __maybe_unused mtk_smi_common_resume (struct device *dev)
@@ -836,7 +834,7 @@ static const struct dev_pm_ops smi_common_pm_ops = {static struct platform_driver mtk_smi_common_driver = { .probe = mtk_smi_common_probe, - .remove = mtk_smi_common_remove, + .remove_new = mtk_smi_common_remove, .driver = { .name ="mtk-smi-common" , .of_match_table = mtk_smi_common_of_ids,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/481 memory: mtk-smi: fix device leaks on common probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 6cfa038bddd710f544076ea2ef7792fc82fbedd6 ]
Make sure to drop the reference taken when looking up the SMI device during common probe on late probe failure (e.g. probe deferral) and on driver unbind.
--- drivers/memory/mtk-smi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/memory/mtk-smi.c +2 -0
@@ -563,6 +563,7 @@ static int mtk_smi_larb_probe(struct platform_device *pdev) err_pm_disable:pm_runtime_disable (dev);device_link_remove (dev, larb->smi_common_dev); +put_device (larb->smi_common_dev);return ret; }
@@ -795,6 +796,7 @@ static void mtk_smi_common_remove(struct platform_device *pdev)if (common->plat->type ==MTK_SMI_GEN2_SUB_COMM )device_link_remove (&pdev->dev, common->smi_common_dev);pm_runtime_disable (&pdev->dev); +put_device (common->smi_common_dev); }static int __maybe_unused mtk_smi_common_resume (struct device *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/481 memory: mtk-smi: fix device leak on larb probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6 ]
Make sure to drop the reference taken when looking up the SMI device during larb probe on late probe failure (e.g. probe deferral) and on driver unbind.
--- drivers/memory/mtk-smi.c | 1 + 1 file changed, 1 insertion(+)
drivers/memory/mtk-smi.c +1 -0
@@ -574,6 +574,7 @@ static void mtk_smi_larb_remove(struct platform_device *pdev)device_link_remove (&pdev->dev, larb->smi_common_dev);pm_runtime_disable (&pdev->dev);component_del (&pdev->dev, &mtk_smi_larb_component_ops); +put_device (larb->smi_common_dev); }static int __maybe_unused mtk_smi_larb_resume (struct device *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/481 PCI: Introduce pci_dev_for_each_resource()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 09cc900632400079619e9154604fd299c2cc9a5a ]
Instead of open-coding it everywhere introduce a tiny helper that can be used to iterate over each resource of a PCI device, and convert the most obvious users into it.
While at it drop doubled empty line before pdev_sort_resources().
No functional changes intended.
Stable-dep-of: 11721c45a826 ("PCI: Use resource_set_range() that correctly sets ->end")
--- .clang-format | 1 + arch/alpha/kernel/pci.c | 5 ++-- arch/arm/kernel/bios32.c | 16 ++++++------- arch/arm/mach-dove/pcie.c | 10 ++++---- arch/arm/mach-mv78xx0/pcie.c | 10 ++++---- arch/arm/mach-orion5x/pci.c | 10 ++++---- arch/mips/pci/ops-bcm63xx.c | 8 +++---- arch/mips/pci/pci-legacy.c | 3 +-- arch/powerpc/kernel/pci-common.c | 21 ++++++++-------- arch/powerpc/platforms/4xx/pci.c | 8 +++---- arch/powerpc/platforms/52xx/mpc52xx_pci.c | 5 ++-- arch/powerpc/platforms/pseries/pci.c | 16 ++++++------- arch/sh/drivers/pci/pcie-sh7786.c | 10 ++++---- arch/sparc/kernel/leon_pci.c | 5 ++-- arch/sparc/kernel/pci.c | 10 ++++---- arch/sparc/kernel/pcic.c | 5 ++-- drivers/pci/remove.c | 5 ++-- drivers/pci/setup-bus.c | 27 ++++++++------------- drivers/pci/setup-res.c | 4 +--- drivers/pci/vgaarb.c | 17 ++++--------- drivers/pci/xen-pcifront.c | 4 +--- drivers/pnp/quirks.c | 29 ++++++++--------------- include/linux/pci.h | 14 +++++++++++ 23 files changed, 111 insertions(+), 132 deletions(-)
.clang-format +1 -0
@@ -516,6 +516,7 @@ ForEachMacros: - 'of_property_for_each_string' - 'of_property_for_each_u32' - 'pci_bus_for_each_resource' + - 'pci_dev_for_each_resource' - 'pci_doe_for_each_off' - 'pcl_for_each_chunk' - 'pcl_for_each_segment'
arch/alpha/kernel/pci.c +2 -3
@@ -288,11 +288,10 @@ pcibios_claim_one_bus(struct pci_bus *b)struct pci_bus *child_bus;list_for_each_entry (dev, &b->devices, bus_list) { +struct resource *r;int i; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *r = &dev->resource[i]; - +pci_dev_for_each_resource (dev, r, i) {if (r->parent || !r->start || !r->flags)continue ; if (pci_has_flag(PCI_PROBE_ONLY) ||
arch/arm/kernel/bios32.c +7 -9
@@ -142,15 +142,15 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_WINBOND2, PCI_DEVICE_ID_WINBOND2_89C940F,*/ static void pci_fixup_dec21285 (struct pci_dev *dev) { -int i; -if (dev->devfn ==0 ) { +struct resource *r; + dev->class &=0xff ; dev->class |=PCI_CLASS_BRIDGE_HOST <<8 ; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { - dev->resource[i].start =0 ; - dev->resource[i].end =0 ; - dev->resource[i].flags =0 ; +pci_dev_for_each_resource (dev, r) { + r->start =0 ; + r->end =0 ; + r->flags =0 ; } } }
@@ -162,13 +162,11 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_DEC, PCI_DEVICE_ID_DEC_21285, pci_fixup_dstatic void pci_fixup_ide_bases (struct pci_dev *dev) {struct resource *r; -int i;if ((dev->class >>8 ) !=PCI_CLASS_STORAGE_IDE )return ; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { - r = dev->resource + i; +pci_dev_for_each_resource (dev, r) {if ((r->start & ~0x80 ) ==0x374 ) { r->start |=2 ; r->end = r->start;
arch/arm/mach-dove/pcie.c +5 -5
@@ -142,14 +142,14 @@ static struct pci_ops pcie_ops = {static void rc_pci_fixup (struct pci_dev *dev) {if (dev->bus->parent ==NULL && dev->devfn ==0 ) { -int i; +struct resource *r; dev->class &=0xff ; dev->class |=PCI_CLASS_BRIDGE_HOST <<8 ; -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { - dev->resource[i].start =0 ; - dev->resource[i].end =0 ; - dev->resource[i].flags =0 ; +pci_dev_for_each_resource (dev, r) { + r->start =0 ; + r->end =0 ; + r->flags =0 ; } } }
arch/arm/mach-mv78xx0/pcie.c +5 -5
@@ -186,14 +186,14 @@ static struct pci_ops pcie_ops = {static void rc_pci_fixup (struct pci_dev *dev) {if (dev->bus->parent ==NULL && dev->devfn ==0 ) { -int i; +struct resource *r; dev->class &=0xff ; dev->class |=PCI_CLASS_BRIDGE_HOST <<8 ; -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { - dev->resource[i].start =0 ; - dev->resource[i].end =0 ; - dev->resource[i].flags =0 ; +pci_dev_for_each_resource (dev, r) { + r->start =0 ; + r->end =0 ; + r->flags =0 ; } } }
arch/arm/mach-orion5x/pci.c +5 -5
@@ -522,14 +522,14 @@ static int __init pci_setup(struct pci_sys_data *sys)static void rc_pci_fixup (struct pci_dev *dev) {if (dev->bus->parent ==NULL && dev->devfn ==0 ) { -int i; +struct resource *r; dev->class &=0xff ; dev->class |=PCI_CLASS_BRIDGE_HOST <<8 ; -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { - dev->resource[i].start =0 ; - dev->resource[i].end =0 ; - dev->resource[i].flags =0 ; +pci_dev_for_each_resource (dev, r) { + r->start =0 ; + r->end =0 ; + r->flags =0 ; } } }
arch/mips/pci/ops-bcm63xx.c +4 -4
@@ -413,18 +413,18 @@ struct pci_ops bcm63xx_cb_ops = {static void bcm63xx_fixup (struct pci_dev *dev) {static int io_window =-1 ; -int i, found, new_io_window; +int found, new_io_window; +struct resource *r;u32 val;/* look for any io resource */ found =0 ; -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { -if (pci_resource_flags (dev, i) &IORESOURCE_IO ) { +pci_dev_for_each_resource (dev, r) { +if (resource_type (r) ==IORESOURCE_IO ) { found =1 ;break ; } } -if (!found)return ;
arch/mips/pci/pci-legacy.c +1 -2
@@ -249,12 +249,11 @@ static int pcibios_enable_resources(struct pci_dev *dev, int mask)pci_read_config_word (dev,PCI_COMMAND , &cmd); old_cmd = cmd; -for (idx =0 ; idx <PCI_NUM_RESOURCES ; idx++) { +pci_dev_for_each_resource (dev, r, idx) {/* Only set up the requested stuff */ if (!(mask & (1 <<idx)))continue ; - r = &dev->resource[idx];if (!(r->flags & (IORESOURCE_IO |IORESOURCE_MEM )))continue ; if ((idx == PCI_ROM_RESOURCE) &&
arch/powerpc/kernel/pci-common.c +11 -10
@@ -880,6 +880,7 @@ int pcibios_root_bridge_prepare(struct pci_host_bridge *bridge)static void pcibios_fixup_resources (struct pci_dev *dev) {struct pci_controller *hose =pci_bus_to_host (dev->bus); +struct resource *res;int i;if (!hose) {
@@ -891,9 +892,9 @@ static void pcibios_fixup_resources(struct pci_dev *dev)if (dev->is_virtfn)return ; -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { -struct resource *res = dev->resource + i; +pci_dev_for_each_resource (dev, res, i) {struct pci_bus_region reg; +if (!res->flags)continue ;
@@ -1452,11 +1453,10 @@ void pcibios_claim_one_bus(struct pci_bus *bus)struct pci_bus *child_bus;list_for_each_entry (dev, &bus->devices, bus_list) { +struct resource *r;int i; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *r = &dev->resource[i]; - +pci_dev_for_each_resource (dev, r, i) {if (r->parent || !r->start || !r->flags)continue ;
@@ -1705,19 +1705,20 @@ EXPORT_SYMBOL_GPL(pcibios_scan_phb);static void fixup_hide_host_resource_fsl (struct pci_dev *dev) { -int i, class = dev->class >>8 ; +int class = dev->class >>8 ;/* When configured as agent, programming interface = 1 */ int prog_if = dev->class &0xf ; +struct resource *r;if ((class ==PCI_CLASS_PROCESSOR_POWERPC || class ==PCI_CLASS_BRIDGE_OTHER ) && (dev->hdr_type ==PCI_HEADER_TYPE_NORMAL ) && (prog_if ==0 ) && (dev->bus->parent ==NULL )) { -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { - dev->resource[i].start =0 ; - dev->resource[i].end =0 ; - dev->resource[i].flags =0 ; +pci_dev_for_each_resource (dev, r) { + r->start =0 ; + r->end =0 ; + r->flags =0 ; } } }
arch/powerpc/platforms/4xx/pci.c +4 -4
@@ -57,7 +57,7 @@ static inline int ppc440spe_revA(void)static void fixup_ppc4xx_pci_bridge (struct pci_dev *dev) {struct pci_controller *hose; -int i; +struct resource *r;if (dev->devfn !=0 || dev->bus->self !=NULL )return ;
@@ -79,9 +79,9 @@ static void fixup_ppc4xx_pci_bridge(struct pci_dev *dev)/* Hide the PCI host BARs from the kernel as their content doesn't * fit well in the resource management */ -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { - dev->resource[i].start = dev->resource[i].end =0 ; - dev->resource[i].flags =0 ; +pci_dev_for_each_resource (dev, r) { + r->start = r->end =0 ; + r->flags =0 ; } printk(KERN_INFO "PCI: Hiding 4xx host bridge resources %s\n",
arch/powerpc/platforms/52xx/mpc52xx_pci.c +2 -3
@@ -327,14 +327,13 @@ mpc52xx_pci_setup(struct pci_controller *hose,static void mpc52xx_pci_fixup_resources (struct pci_dev *dev) { -int i; +struct resource *res;pr_debug ("%s() %.4x:%.4x\n" , __func__, dev->vendor, dev->device);/* We don't rely on boot loader for PCI and resets all devices */ -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { -struct resource *res = &dev->resource[i]; +pci_dev_for_each_resource (dev, res) {if (res->end > res->start) {/* Only valid resources */ res->end -= res->start; res->start =0 ;
arch/powerpc/platforms/pseries/pci.c +8 -8
@@ -240,7 +240,7 @@ void __init pSeries_final_fixup(void)*/ static void fixup_winbond_82c105 (struct pci_dev * dev) { -int i; +struct resource *r;unsigned int reg;if (!machine_is (pseries))
@@ -251,14 +251,14 @@ static void fixup_winbond_82c105(struct pci_dev* dev)/* Enable LEGIRQ to use INTC instead of ISA interrupts */ pci_write_config_dword (dev,0x40 , reg | (1 <<11 )); -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; ++i) { +pci_dev_for_each_resource (dev, r) {/* zap the 2nd function of the winbond chip */ -if (dev->resource[i].flags &IORESOURCE_IO - && dev->bus->number ==0 && dev->devfn ==0x81 ) - dev->resource[i].flags &= ~IORESOURCE_IO ; -if (dev->resource[i].start ==0 && dev->resource[i].end) { - dev->resource[i].flags =0 ; - dev->resource[i].end =0 ; +if (dev->bus->number ==0 && dev->devfn ==0x81 && + r->flags &IORESOURCE_IO ) + r->flags &= ~IORESOURCE_IO ; +if (r->start ==0 && r->end) { + r->flags =0 ; + r->end =0 ; } } }
arch/sh/drivers/pci/pcie-sh7786.c +5 -5
@@ -140,12 +140,12 @@ static void sh7786_pci_fixup(struct pci_dev *dev)* Prevent enumeration of root complex resources. */ if (pci_is_root_bus (dev->bus) && dev->devfn ==0 ) { -int i; +struct resource *r; -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { - dev->resource[i].start =0 ; - dev->resource[i].end =0 ; - dev->resource[i].flags =0 ; +pci_dev_for_each_resource (dev, r) { + r->start =0 ; + r->end =0 ; + r->flags =0 ; } } }
arch/sparc/kernel/leon_pci.c +2 -3
@@ -63,15 +63,14 @@ void leon_pci_init(struct platform_device *ofdev, struct leon_pci_info *info)int pcibios_enable_device (struct pci_dev *dev,int mask) { +struct resource *res;u16 cmd, oldcmd;int i;pci_read_config_word (dev,PCI_COMMAND , &cmd); oldcmd = cmd; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *res = &dev->resource[i]; - +pci_dev_for_each_resource (dev, res, i) {/* Only set up the requested stuff */ if (!(mask & (1 <<i)))continue ;
arch/sparc/kernel/pci.c +4 -6
@@ -664,11 +664,10 @@ static void pci_claim_bus_resources(struct pci_bus *bus)struct pci_dev *dev;list_for_each_entry (dev, &bus->devices, bus_list) { +struct resource *r;int i; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *r = &dev->resource[i]; - +pci_dev_for_each_resource (dev, r, i) {if (r->parent || !r->start || !r->flags)continue ;
@@ -725,15 +724,14 @@ struct pci_bus *pci_scan_one_pbm(struct pci_pbm_info *pbm,int pcibios_enable_device (struct pci_dev *dev,int mask) { +struct resource *res;u16 cmd, oldcmd;int i;pci_read_config_word (dev,PCI_COMMAND , &cmd); oldcmd = cmd; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *res = &dev->resource[i]; - +pci_dev_for_each_resource (dev, res, i) {/* Only set up the requested stuff */ if (!(mask & (1 <<i)))continue ;
arch/sparc/kernel/pcic.c +2 -3
@@ -643,15 +643,14 @@ void pcibios_fixup_bus(struct pci_bus *bus)int pcibios_enable_device (struct pci_dev *dev,int mask) { +struct resource *res;u16 cmd, oldcmd;int i;pci_read_config_word (dev,PCI_COMMAND , &cmd); oldcmd = cmd; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *res = &dev->resource[i]; - +pci_dev_for_each_resource (dev, res, i) {/* Only set up the requested stuff */ if (!(mask & (1 <<i)))continue ;
drivers/pci/remove.c +2 -3
@@ -5,10 +5,9 @@static void pci_free_resources (struct pci_dev *dev) { -int i; +struct resource *res; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *res = dev->resource + i; +pci_dev_for_each_resource (dev, res) {if (res->parent)release_resource (res); }
drivers/pci/setup-bus.c +10 -17
@@ -124,20 +124,17 @@ static resource_size_t get_res_add_align(struct list_head *head,return dev_res ? dev_res->min_align :0 ; } -/* Sort resources by alignment */ static void pdev_sort_resources (struct pci_dev *dev,struct list_head *head) { +struct resource *r;int i; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *r; +pci_dev_for_each_resource (dev, r, i) {struct pci_dev_resource *dev_res, *tmp;resource_size_t r_align;struct list_head *n; - r = &dev->resource[i]; -if (r->flags &IORESOURCE_PCI_FIXED )continue ;
@@ -891,10 +888,9 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size, min_align =window_alignment (bus,IORESOURCE_IO );list_for_each_entry (dev, &bus->devices, bus_list) { -int i; +struct resource *r; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *r = &dev->resource[i]; +pci_dev_for_each_resource (dev, r) {unsigned long r_size;if (r->parent || !(r->flags &IORESOURCE_IO ))
@@ -1010,10 +1006,10 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, size =0 ;list_for_each_entry (dev, &bus->devices, bus_list) { +struct resource *r;int i; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *r = &dev->resource[i]; +pci_dev_for_each_resource (dev, r, i) {resource_size_t r_size; if (r->parent || (r->flags & IORESOURCE_PCI_FIXED) ||
@@ -1354,11 +1350,10 @@ static void assign_fixed_resource_on_bus(struct pci_bus *b, struct resource *r)*/ static void pdev_assign_fixed_resources (struct pci_dev *dev) { -int i; +struct resource *r; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { +pci_dev_for_each_resource (dev, r) {struct pci_bus *b; -struct resource *r = &dev->resource[i];if (r->parent || !(r->flags &IORESOURCE_PCI_FIXED ) || !(r->flags & (IORESOURCE_IO |IORESOURCE_MEM )))
@@ -1791,11 +1786,9 @@ static void remove_dev_resources(struct pci_dev *dev, struct resource *io,struct resource *mmio, struct resource *mmio_pref) { - int i; - -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { -struct resource *res = &dev->resource[i]; + struct resource *res; +pci_dev_for_each_resource (dev, res) {if (resource_type (res) ==IORESOURCE_IO ) {remove_dev_resource (io, dev, res); }else if (resource_type (res) ==IORESOURCE_MEM ) {
drivers/pci/setup-res.c +1 -3
@@ -484,12 +484,10 @@ int pci_enable_resources(struct pci_dev *dev, int mask)pci_read_config_word (dev,PCI_COMMAND , &cmd); old_cmd = cmd; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { +pci_dev_for_each_resource (dev, r, i) {if (!(mask & (1 << i)))continue ; - r = &dev->resource[i]; -if (!(r->flags & (IORESOURCE_IO |IORESOURCE_MEM )))continue ; if ((i == PCI_ROM_RESOURCE) &&
drivers/pci/vgaarb.c +5 -12
@@ -548,10 +548,8 @@ static bool vga_is_firmware_default(struct pci_dev *pdev)#if defined(CONFIG_X86 ) || defined(CONFIG_IA64 )u64 base = screen_info.lfb_base;u64 size = screen_info.lfb_size; +struct resource *r;u64 limit; -resource_size_t start, end; -unsigned long flags; -int i;/* Select the device owning the boot framebuffer if there is one */
@@ -561,19 +559,14 @@ static bool vga_is_firmware_default(struct pci_dev *pdev) limit = base + size;/* Does firmware framebuffer belong to us? */ -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { - flags =pci_resource_flags (pdev, i); - -if ((flags &IORESOURCE_MEM ) ==0 ) +pci_dev_for_each_resource (pdev, r) { +if (resource_type (r) !=IORESOURCE_MEM )continue ; - start =pci_resource_start (pdev, i); - end =pci_resource_end (pdev, i); - -if (!start || !end) +if (!r->start || !r->end)continue ; -if (base < start || limit >= end) +if (base < r->start || limit >= r->end)continue ;return true;
drivers/pci/xen-pcifront.c +1 -3
@@ -390,9 +390,7 @@ static int pcifront_claim_resource(struct pci_dev *dev, void *data)int i;struct resource *r; -for (i =0 ; i <PCI_NUM_RESOURCES ; i++) { - r = &dev->resource[i]; - +pci_dev_for_each_resource (dev, r, i) {if (!r->parent && r->start && r->flags) {dev_info (&pdev->xdev->dev,"claiming resource %s/%d\n" ,pci_name (dev), i);
drivers/pnp/quirks.c +10 -19
@@ -229,8 +229,7 @@ static void quirk_ad1815_mpu_resources(struct pnp_dev *dev)static void quirk_system_pci_resources (struct pnp_dev *dev) {struct pci_dev *pdev =NULL ; -struct resource *res; -resource_size_t pnp_start, pnp_end, pci_start, pci_end; +struct resource *res, *r;int i, j;/*
@@ -243,32 +242,26 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)* so they won't be claimed by the PNP system driver. */ for_each_pci_dev (pdev) { -for (i =0 ; i <DEVICE_COUNT_RESOURCE ; i++) { -unsigned long flags, type; +pci_dev_for_each_resource (pdev, r, i) { +unsigned long type =resource_type (r); - flags =pci_resource_flags (pdev, i); - type = flags & (IORESOURCE_IO |IORESOURCE_MEM ); -if (!type ||pci_resource_len (pdev, i) ==0 ) +if (!(type ==IORESOURCE_IO || type ==IORESOURCE_MEM ) || +resource_size (r) ==0 )continue ; -if (flags &IORESOURCE_UNSET ) +if (r->flags &IORESOURCE_UNSET )continue ; - pci_start =pci_resource_start (pdev, i); - pci_end =pci_resource_end (pdev, i);for (j =0 ; (res =pnp_get_resource (dev, type, j)); j++) {if (res->start ==0 && res->end ==0 )continue ; - pnp_start = res->start; - pnp_end = res->end; -/* * If the PNP region doesn't overlap the PCI * region at all, there's no problem. */ -if (pnp_end < pci_start || pnp_start > pci_end) +if (!resource_overlaps (res, r))continue ;/*
@@ -278,8 +271,7 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)* PNP device describes a bridge with PCI * behind it. */ -if (pnp_start <= pci_start && - pnp_end >= pci_end) +if (res->start <= r->start && res->end >= r->end)continue ;/*
@@ -288,9 +280,8 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)* driver from requesting its resources. */ dev_warn (&dev->dev, -"disabling %pR because it overlaps " -"%s BAR %d %pR\n" , res, -pci_name (pdev), i, &pdev->resource[i]); +"disabling %pR because it overlaps %s BAR %d %pR\n" , + res,pci_name (pdev), i, r); res->flags |=IORESOURCE_DISABLED ; } }
include/linux/pci.h +14 -0
@@ -2029,6 +2029,20 @@ int pci_iobar_pfn(struct pci_dev *pdev, int bar, struct vm_area_struct *vma); (pci_resource_end ((dev), (bar)) ? \ resource_size(pci_resource_n((dev), (bar))) : 0) +#define __pci_dev_for_each_res0 (dev, res, ...) \ + for (unsigned int __b = 0; \ + res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ + __b++) + +#define __pci_dev_for_each_res1 (dev, res, __b) \ + for (__b = 0; \ + res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ + __b++) + +#define pci_dev_for_each_resource (dev, res, ...) \ + CONCATENATE(__pci_dev_for_each_res, COUNT_ARGS(__VA_ARGS__)) \ + (dev, res, __VA_ARGS__) +/* * Similar to the helpers above, these manipulate per-pci_dev * driver-specific data. They are really just a wrapper around
Signature · 1 line
2.51.0
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.1.167-rc1-00482-g67c872a868ac #1 SMP PREEMPT_DYNAMIC Mon Mar 23 14:57:39 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Greg Kroah-Hartman
maintainerPATCH 21/481 PCI: Fix printk field formatting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 62008578b73f16e274070a232b939ba5933bb8ba ]
Previously we used "%#08x" to print a 32-bit value. This fills an 8-character field with "0x...", but of course many 32-bit values require a 10-character field "0x12345678" for this format. Fix the formats to avoid confusion.
Stable-dep-of: 11721c45a826 ("PCI: Use resource_set_range() that correctly sets ->end")
--- drivers/pci/setup-res.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/setup-res.c +2 -2
@@ -104,7 +104,7 @@ static void pci_std_update_resource(struct pci_dev *dev, int resno)pci_read_config_dword (dev, reg, &check);if ((new ^ check) & mask) { -pci_err (dev,"BAR %d: error updating (%#08x != %#08x)\n" , +pci_err (dev,"BAR %d: error updating (%#010x != %#010x)\n" , resno, new, check); }
@@ -113,7 +113,7 @@ static void pci_std_update_resource(struct pci_dev *dev, int resno)pci_write_config_dword (dev, reg +4 , new);pci_read_config_dword (dev, reg +4 , &check);if (check != new) { -pci_err (dev,"BAR %d: error updating (high %#08x != %#08x)\n" , +pci_err (dev,"BAR %d: error updating (high %#010x != %#010x)\n" , resno, new, check); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/481 PCI: Update BAR # and window messages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit 65f8e0beac5a495b8f3b387add1f9f4470678cb5 ]
The PCI log messages print the register offsets at some places and BAR numbers at other places. There is no uniformity in this logging mechanism. It would be better to print names than register offsets.
Add a helper function that aids in printing more meaningful information about the BAR numbers like "VF BAR", "ROM", "bridge window", etc. This function can be called while printing PCI log messages.
[bhelgaas: fold in Lukas' static array suggestion from
https: //lore.kernel.org/all/[email protected]/]
Stable-dep-of: 11721c45a826 ("PCI: Use resource_set_range() that correctly sets ->end")
--- drivers/pci/pci.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++ drivers/pci/pci.h | 2 ++ 2 files changed, 62 insertions(+)
drivers/pci/pci.c +60 -0
@@ -844,6 +844,66 @@ struct resource *pci_find_resource(struct pci_dev *dev, struct resource *res) }EXPORT_SYMBOL (pci_find_resource); +/** +* pci_resource_name - Return the name of the PCI resource +* @dev: PCI device to query +* @i: index of the resource +* +* Return the standard PCI resource (BAR) name according to their index. +*/ +const char *pci_resource_name (struct pci_dev *dev,unsigned int i) +{ +static const char *const bar_name[] = { +"BAR 0" , +"BAR 1" , +"BAR 2" , +"BAR 3" , +"BAR 4" , +"BAR 5" , +"ROM" , +#ifdef CONFIG_PCI_IOV +"VF BAR 0" , +"VF BAR 1" , +"VF BAR 2" , +"VF BAR 3" , +"VF BAR 4" , +"VF BAR 5" , +#endif +"bridge window" ,/* "io" included in %pR */ +"bridge window" ,/* "mem" included in %pR */ +"bridge window" ,/* "mem pref" included in %pR */ + }; +static const char *const cardbus_name[] = { +"BAR 1" , +"unknown" , +"unknown" , +"unknown" , +"unknown" , +"unknown" , +#ifdef CONFIG_PCI_IOV +"unknown" , +"unknown" , +"unknown" , +"unknown" , +"unknown" , +"unknown" , +#endif +"CardBus bridge window 0" ,/* I/O */ +"CardBus bridge window 1" ,/* I/O */ +"CardBus bridge window 0" ,/* mem */ +"CardBus bridge window 1" ,/* mem */ + }; + +if (dev->hdr_type ==PCI_HEADER_TYPE_CARDBUS && + i <ARRAY_SIZE (cardbus_name)) +return cardbus_name[i]; + +if (i <ARRAY_SIZE (bar_name)) +return bar_name[i]; + +return "unknown" ; +} +/** * pci_wait_for_pending - wait for @mask bit(s) to clear in status word @pos * @dev: the PCI device to operate on
drivers/pci/pci.h +2 -0
@@ -251,6 +251,8 @@ void __pci_bus_assign_resources(const struct pci_bus *bus, struct list_head *fail_head);bool pci_bus_clip_resource (struct pci_dev *dev,int idx); +const char *pci_resource_name (struct pci_dev *dev,unsigned int i); +void pci_reassigndev_resource_alignment (struct pci_dev *dev);void pci_disable_bridge_window (struct pci_dev *dev);struct pci_bus *pci_bus_get (struct pci_bus *bus);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/481 PCI: Use resource names in PCI log messages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit dc4e6f21c3f844ebc1c52b6920b8ec5dfc73f4e8 ]
Use the pci_resource_name() to get the name of the resource and use it while printing log messages.
[bhelgaas: rename to match struct resource * names, also use names in other BAR messages]
Stable-dep-of: 11721c45a826 ("PCI: Use resource_set_range() that correctly sets ->end")
--- drivers/pci/iov.c | 7 ++-- drivers/pci/pci.c | 25 +++++++------- drivers/pci/probe.c | 26 +++++++-------- drivers/pci/quirks.c | 15 ++++++--- drivers/pci/setup-bus.c | 30 +++++++++++------ drivers/pci/setup-res.c | 72 +++++++++++++++++++++++------------------ 6 files changed, 103 insertions(+), 72 deletions(-)
drivers/pci/iov.c +5 -2
@@ -750,6 +750,7 @@ static int sriov_init(struct pci_dev *dev, int pos)u16 ctrl, total;struct pci_sriov *iov;struct resource *res; +const char *res_name;struct pci_dev *pdev;pci_read_config_word (dev, pos +PCI_SRIOV_CTRL , &ctrl);
@@ -790,6 +791,8 @@ static int sriov_init(struct pci_dev *dev, int pos) nres =0 ;for (i =0 ; i <PCI_SRIOV_NUM_BARS ; i++) { res = &dev->resource[i +PCI_IOV_RESOURCES ]; + res_name =pci_resource_name (dev, i +PCI_IOV_RESOURCES ); +/* * If it is already FIXED, don't change it, something * (perhaps EA or header fixups) wants it this way.
@@ -807,8 +810,8 @@ static int sriov_init(struct pci_dev *dev, int pos) } iov->barsz[i] =resource_size (res); res->end = res->start +resource_size (res) * total -1 ; -pci_info (dev,"VF(n) BAR%d space: %pR (contains BAR%d for %d VFs)\n" , - i, res, i, total); +pci_info (dev,"%s %pR: contains BAR %d for %d VFs\n" , + res_name, res, i, total); i += bar64; nres++; }
drivers/pci/pci.c +14 -11
@@ -3373,6 +3373,7 @@ static struct resource *pci_ea_get_resource(struct pci_dev *dev, u8 bei,static int pci_ea_read (struct pci_dev *dev,int offset) {struct resource *res; +const char *res_name;int ent_size, ent_offset = offset;resource_size_t start, end;unsigned long flags;
@@ -3402,6 +3403,7 @@ static int pci_ea_read(struct pci_dev *dev, int offset) goto out; res =pci_ea_get_resource (dev, bei, prop); + res_name =pci_resource_name (dev, bei);if (!res) {pci_err (dev,"Unsupported EA entry BEI: %u\n" , bei); goto out;
@@ -3475,16 +3477,16 @@ static int pci_ea_read(struct pci_dev *dev, int offset) res->flags = flags;if (bei <=PCI_EA_BEI_BAR5 ) -pci_info (dev,"BAR %d: %pR (from Enhanced Allocation, properties %#02x)\n" , - bei, res, prop); +pci_info (dev,"%s %pR: from Enhanced Allocation, properties %#02x\n" , + res_name, res, prop);else if (bei ==PCI_EA_BEI_ROM ) -pci_info (dev,"ROM: %pR (from Enhanced Allocation, properties %#02x)\n" , - res, prop); +pci_info (dev,"%s %pR: from Enhanced Allocation, properties %#02x\n" , + res_name, res, prop);else if (bei >=PCI_EA_BEI_VF_BAR0 && bei <=PCI_EA_BEI_VF_BAR5 ) -pci_info (dev,"VF BAR %d: %pR (from Enhanced Allocation, properties %#02x)\n" , - bei -PCI_EA_BEI_VF_BAR0 , res, prop); +pci_info (dev,"%s %pR: from Enhanced Allocation, properties %#02x\n" , + res_name, res, prop);else -pci_info (dev,"BEI %d res: %pR (from Enhanced Allocation, properties %#02x)\n" , +pci_info (dev,"BEI %d %pR: from Enhanced Allocation, properties %#02x\n" , bei, res, prop); out:
@@ -6704,14 +6706,15 @@ static void pci_request_resource_alignment(struct pci_dev *dev, int bar, resource_size_t align, bool resize) {struct resource *r = &dev->resource[bar]; +const char *r_name =pci_resource_name (dev, bar);resource_size_t size;if (!(r->flags &IORESOURCE_MEM ))return ;if (r->flags &IORESOURCE_PCI_FIXED ) { -pci_info (dev,"BAR%d %pR: ignoring requested alignment %#llx\n" , - bar, r, (unsigned long long )align); +pci_info (dev,"%s %pR: ignoring requested alignment %#llx\n" , + r_name, r, (unsigned long long )align);return ; }
@@ -6747,8 +6750,8 @@ static void pci_request_resource_alignment(struct pci_dev *dev, int bar,* devices and we use the second. */ -pci_info (dev,"BAR%d %pR: requesting alignment to %#llx\n" , - bar, r, (unsigned long long )align); +pci_info (dev,"%s %pR: requesting alignment to %#llx\n" , + r_name, r, (unsigned long long )align);if (resize) { r->start =0 ;
drivers/pci/probe.c +13 -13
@@ -181,6 +181,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,u64 l64, sz64, mask64;u16 orig_cmd;struct pci_bus_region region, inverted_region; +const char *res_name =pci_resource_name (dev, res - dev->resource); mask = type ?PCI_ROM_ADDRESS_MASK : ~0 ;
@@ -255,8 +256,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, sz64 =pci_size (l64, sz64, mask64);if (!sz64) { -pci_info (dev,FW_BUG "reg 0x%x: invalid BAR (can't size)\n" , - pos); +pci_info (dev,FW_BUG "%s: invalid; can't size\n" , res_name); goto fail; }
@@ -266,8 +266,8 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, res->flags |=IORESOURCE_UNSET |IORESOURCE_DISABLED ; res->start =0 ; res->end =0 ; -pci_err (dev,"reg 0x%x: can't handle BAR larger than 4GB (size %#010llx)\n" , - pos, (unsigned long long )sz64); +pci_err (dev,"%s: can't handle BAR larger than 4GB (size %#010llx)\n" , + res_name, (unsigned long long )sz64); goto out; }
@@ -276,8 +276,8 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, res->flags |=IORESOURCE_UNSET ; res->start =0 ; res->end = sz64 -1 ; -pci_info (dev,"reg 0x%x: can't handle BAR above 4GB (bus address %#010llx)\n" , - pos, (unsigned long long )l64); +pci_info (dev,"%s: can't handle BAR above 4GB (bus address %#010llx)\n" , + res_name, (unsigned long long )l64); goto out; } }
@@ -303,8 +303,8 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, res->flags |=IORESOURCE_UNSET ; res->start =0 ; res->end = region.end - region.start; -pci_info (dev,"reg 0x%x: initial BAR value %#010llx invalid\n" , - pos, (unsigned long long )region.start); +pci_info (dev,"%s: initial BAR value %#010llx invalid\n" , + res_name, (unsigned long long )region.start); } goto out;
@@ -314,7 +314,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, res->flags =0 ; out:if (res->flags) -pci_info (dev,"reg 0x%x: %pR\n" , pos, res); +pci_info (dev,"%s %pR\n" , res_name, res);return (res->flags &IORESOURCE_MEM_64 ) ?1 :0 ; }
@@ -1948,14 +1948,14 @@ int pci_setup_device(struct pci_dev *dev) res = &dev->resource[0 ]; res->flags =LEGACY_IO_RESOURCE ;pcibios_bus_to_resource (dev->bus, res, ®ion); -pci_info (dev,"legacy IDE quirk: reg 0x10: %pR\n" , +pci_info (dev,"BAR 0 %pR: legacy IDE quirk\n" , res); region.start =0x3F6 ; region.end =0x3F6 ; res = &dev->resource[1 ]; res->flags =LEGACY_IO_RESOURCE ;pcibios_bus_to_resource (dev->bus, res, ®ion); -pci_info (dev,"legacy IDE quirk: reg 0x14: %pR\n" , +pci_info (dev,"BAR 1 %pR: legacy IDE quirk\n" , res); }if ((progif &4 ) ==0 ) {
@@ -1964,14 +1964,14 @@ int pci_setup_device(struct pci_dev *dev) res = &dev->resource[2 ]; res->flags =LEGACY_IO_RESOURCE ;pcibios_bus_to_resource (dev->bus, res, ®ion); -pci_info (dev,"legacy IDE quirk: reg 0x18: %pR\n" , +pci_info (dev,"BAR 2 %pR: legacy IDE quirk\n" , res); region.start =0x376 ; region.end =0x376 ; res = &dev->resource[3 ]; res->flags =LEGACY_IO_RESOURCE ;pcibios_bus_to_resource (dev->bus, res, ®ion); -pci_info (dev,"legacy IDE quirk: reg 0x1c: %pR\n" , +pci_info (dev,"BAR 3 %pR: legacy IDE quirk\n" , res); } }
drivers/pci/quirks.c +11 -4
@@ -475,13 +475,14 @@ static void quirk_extend_bar_to_page(struct pci_dev *dev)for (i =0 ; i <PCI_STD_NUM_BARS ; i++) {struct resource *r = &dev->resource[i]; +const char *r_name =pci_resource_name (dev, i);if (r->flags &IORESOURCE_MEM &&resource_size (r) <PAGE_SIZE ) { r->end =PAGE_SIZE -1 ; r->start =0 ; r->flags |=IORESOURCE_UNSET ; -pci_info (dev,"expanded BAR %d to page size: %pR\n" , - i, r); +pci_info (dev,"%s %pR: expanded to page size\n" , + r_name, r); } } }
@@ -510,6 +511,7 @@ static void quirk_io(struct pci_dev *dev, int pos, unsigned int size,u32 region;struct pci_bus_region bus_region;struct resource *res = dev->resource + pos; +const char *res_name =pci_resource_name (dev, pos);pci_read_config_dword (dev,PCI_BASE_ADDRESS_0 + (pos <<2 ), ®ion);
@@ -527,8 +529,7 @@ static void quirk_io(struct pci_dev *dev, int pos, unsigned int size, bus_region.end = region + size -1 ;pcibios_bus_to_resource (dev->bus, res, &bus_region); -pci_info (dev,FW_BUG "%s quirk: reg 0x%x: %pR\n" , - name,PCI_BASE_ADDRESS_0 + (pos <<2 ), res); +pci_info (dev,FW_BUG "%s %pR: %s quirk\n" , res_name, res, name); }/*
@@ -575,6 +576,12 @@ static void quirk_io_region(struct pci_dev *dev, int port, bus_region.end = region + size -1 ;pcibios_bus_to_resource (dev->bus, res, &bus_region); +/* +* "res" is typically a bridge window resource that's not being +* used for a bridge window, so it's just a place to stash this +* non-standard resource. Printing "nr" or pci_resource_name() of +* it doesn't really make sense. +*/ if (!pci_claim_resource (dev, nr))pci_info (dev,"quirk: %pR claimed by %s\n" , res, name); }
drivers/pci/setup-bus.c +20 -10
@@ -213,6 +213,7 @@ static void reassign_resources_sorted(struct list_head *realloc_head, struct list_head *head) {struct resource *res; +const char *res_name;struct pci_dev_resource *add_res, *tmp;struct pci_dev_resource *dev_res;resource_size_t add_size, align;
@@ -222,6 +223,7 @@ static void reassign_resources_sorted(struct list_head *realloc_head,bool found_match = false; res = add_res->res; +/* Skip resource that has been reset */ if (!res->flags) goto out;
@@ -237,6 +239,7 @@ static void reassign_resources_sorted(struct list_head *realloc_head,continue ; idx = res - &add_res->dev->resource[0 ]; + res_name =pci_resource_name (add_res->dev, idx); add_size = add_res->add_size; align = add_res->min_align;if (!resource_size (res)) {
@@ -249,9 +252,9 @@ static void reassign_resources_sorted(struct list_head *realloc_head, (IORESOURCE_STARTALIGN |IORESOURCE_SIZEALIGN );if (pci_reassign_resource (add_res->dev, idx, add_size, align)) -pci_info (add_res->dev,"failed to add %llx res[%d]=%pR\n" , - (unsigned long long ) add_size, idx, - res); +pci_info (add_res->dev,"%s %pR: failed to add %llx\n" , + res_name, res, + (unsigned long long ) add_size); } out:list_del (&add_res->list);
@@ -571,6 +574,7 @@ EXPORT_SYMBOL(pci_setup_cardbus);static void pci_setup_bridge_io (struct pci_dev *bridge) {struct resource *res; +const char *res_name;struct pci_bus_region region;unsigned long io_mask;u8 io_base_lo, io_limit_lo;
@@ -583,6 +587,7 @@ static void pci_setup_bridge_io(struct pci_dev *bridge)/* Set up the top and bottom of the PCI I/O segment for this bus */ res = &bridge->resource[PCI_BRIDGE_IO_WINDOW ]; + res_name =pci_resource_name (bridge,PCI_BRIDGE_IO_WINDOW );pcibios_resource_to_bus (bridge->bus, ®ion, res);if (res->flags &IORESOURCE_IO ) {pci_read_config_word (bridge,PCI_IO_BASE , &l);
@@ -591,7 +596,7 @@ static void pci_setup_bridge_io(struct pci_dev *bridge) l = ((u16 ) io_limit_lo <<8 ) | io_base_lo;/* Set up upper 16 bits of I/O base/limit */ io_upper16 = (region.end &0xffff0000 ) | (region.start >>16 ); -pci_info (bridge," bridge window %pR\n" , res); +pci_info (bridge," %s %pR\n" , res_name, res); }else {/* Clear upper 16 bits of I/O base/limit */ io_upper16 =0 ;
@@ -608,16 +613,18 @@ static void pci_setup_bridge_io(struct pci_dev *bridge)static void pci_setup_bridge_mmio (struct pci_dev *bridge) {struct resource *res; +const char *res_name;struct pci_bus_region region;u32 l;/* Set up the top and bottom of the PCI Memory segment for this bus */ res = &bridge->resource[PCI_BRIDGE_MEM_WINDOW ]; + res_name =pci_resource_name (bridge,PCI_BRIDGE_MEM_WINDOW );pcibios_resource_to_bus (bridge->bus, ®ion, res);if (res->flags &IORESOURCE_MEM ) { l = (region.start >>16 ) &0xfff0 ; l |= region.end &0xfff00000 ; -pci_info (bridge," bridge window %pR\n" , res); +pci_info (bridge," %s %pR\n" , res_name, res); }else { l =0x0000fff0 ; }
@@ -627,6 +634,7 @@ static void pci_setup_bridge_mmio(struct pci_dev *bridge)static void pci_setup_bridge_mmio_pref (struct pci_dev *bridge) {struct resource *res; +const char *res_name;struct pci_bus_region region;u32 l, bu, lu;
@@ -640,6 +648,7 @@ static void pci_setup_bridge_mmio_pref(struct pci_dev *bridge)/* Set up PREF base/limit */ bu = lu =0 ; res = &bridge->resource[PCI_BRIDGE_PREF_MEM_WINDOW ]; + res_name =pci_resource_name (bridge,PCI_BRIDGE_PREF_MEM_WINDOW );pcibios_resource_to_bus (bridge->bus, ®ion, res);if (res->flags &IORESOURCE_PREFETCH ) { l = (region.start >>16 ) &0xfff0 ;
@@ -648,7 +657,7 @@ static void pci_setup_bridge_mmio_pref(struct pci_dev *bridge) bu =upper_32_bits (region.start); lu =upper_32_bits (region.end); } -pci_info (bridge," bridge window %pR\n" , res); +pci_info (bridge," %s %pR\n" , res_name, res); }else { l =0x0000fff0 ; }
@@ -1010,6 +1019,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,int i;pci_dev_for_each_resource (dev, r, i) { +const char *r_name =pci_resource_name (dev, i);resource_size_t r_size; if (r->parent || (r->flags & IORESOURCE_PCI_FIXED) ||
@@ -1040,8 +1050,8 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,if (order <0 ) order =0 ;if (order >=ARRAY_SIZE (aligns)) { -pci_warn (dev,"disabling BAR %d: %pR (bad alignment %#llx)\n" , - i, r, (unsigned long long ) align); +pci_warn (dev,"%s %pR: disabling; bad alignment %#llx\n" , + r_name, r, (unsigned long long ) align); r->flags =0 ;continue ; }
@@ -2232,6 +2242,7 @@ int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type)for (i =PCI_BRIDGE_RESOURCES ; i <PCI_BRIDGE_RESOURCE_END ; i++) {struct resource *res = &bridge->resource[i]; +const char *res_name =pci_resource_name (bridge, i);if ((res->flags ^ type) &PCI_RES_TYPE_MASK )continue ;
@@ -2244,8 +2255,7 @@ int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type)if (ret) goto cleanup; -pci_info (bridge,"BAR %d: releasing %pR\n" , - i, res); +pci_info (bridge,"%s %pR: releasing\n" , res_name, res);if (res->parent)release_resource (res);
drivers/pci/setup-res.c +40 -32
206 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/481 resource: Add resource set range and size helpers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 9fb6fef0fb49124291837af1da5028f79d53f98e ]
Setting the end address for a resource with a given size lacks a helper and is therefore coded manually unlike the getter side which has a helper for resource size calculation. Also, almost all callsites that calculate the end address for a resource also set the start address right before it like this:
res->start = start_addr; res->end = res->start + size - 1;
Add resource_set_range(res, start_addr, size) that sets the start address and calculates the end address to simplify this often repeated fragment.
Also add resource_set_size() for the cases where setting the start address of the resource is not necessary but mention in its kerneldoc that resource_set_range() is preferred when setting both addresses.
Stable-dep-of: 11721c45a826 ("PCI: Use resource_set_range() that correctly sets ->end")
--- include/linux/ioport.h | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
include/linux/ioport.h +32 -0
@@ -216,6 +216,38 @@ struct resource *lookup_resource(struct resource *root, resource_size_t start);int adjust_resource (struct resource *res,resource_size_t start,resource_size_t size);resource_size_t resource_alignment (struct resource *res); + +/** +* resource_set_size - Calculate resource end address from size and start +* @res: Resource descriptor +* @size: Size of the resource +* +* Calculate the end address for @res based on @size. +* +* Note: The start address of @res must be set when calling this function. +* Prefer resource_set_range() if setting both the start address and @size. +*/ +static inline void resource_set_size (struct resource *res,resource_size_t size) +{ + res->end = res->start + size -1 ; +} + +/** +* resource_set_range - Set resource start and end addresses +* @res: Resource descriptor +* @start: Start address for the resource +* @size: Size of the resource +* +* Set @res start address and calculate the end address based on @size. +*/ +static inline void resource_set_range (struct resource *res, +resource_size_t start, +resource_size_t size) +{ + res->start = start; +resource_set_size (res, size); +} +static inline resource_size_t resource_size (const struct resource *res) {return res->end - res->start +1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/481 PCI: Use resource_set_range() that correctly sets ->end
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 11721c45a8266a9d0c9684153d20e37159465f96 ]
__pci_read_base() sets resource start and end addresses when resource is larger than 4G but pci_bus_addr_t or resource_size_t are not capable of representing 64-bit PCI addresses. This creates a problematic resource that has non-zero flags but the start and end addresses do not yield to resource size of 0 but 1.
Replace custom resource addresses setup with resource_set_range() that correctly sets end address as -1 which results in resource_size() returning 0.
For consistency, also use resource_set_range() in the other branch that does size based resource setup.
--- drivers/pci/probe.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pci/probe.c +2 -4
@@ -264,8 +264,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,if ((sizeof (pci_bus_addr_t) <8 ||sizeof (resource_size_t) <8 ) && sz64 >0x100000000ULL ) { res->flags |=IORESOURCE_UNSET |IORESOURCE_DISABLED ; - res->start =0 ; - res->end =0 ; +resource_set_range (res,0 ,0 );pci_err (dev,"%s: can't handle BAR larger than 4GB (size %#010llx)\n" , res_name, (unsigned long long )sz64); goto out;
@@ -274,8 +273,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,if ((sizeof (pci_bus_addr_t) <8 ) && l) {/* Above 32-bit boundary; try to reallocate */ res->flags |=IORESOURCE_UNSET ; - res->start =0 ; - res->end = sz64 -1 ; +resource_set_range (res,0 , sz64);pci_info (dev,"%s: can't handle BAR above 4GB (bus address %#010llx)\n" , res_name, (unsigned long long )l64); goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/481 KVM: x86/pmu: Provide "error" semantics for unsupported-but-known PMU MSRs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 2de154f541fc5b9f2aed3fe06e218130718ce320 ]
Provide "error" semantics (read zeros, drop writes) for userspace accesses to MSRs that are ultimately unsupported for whatever reason, but for which KVM told userspace to save and restore the MSR, i.e. for MSRs that KVM included in KVM_GET_MSR_INDEX_LIST.
Previously, KVM special cased a few PMU MSRs that were problematic at one point or another. Extend the treatment to all PMU MSRs, e.g. to avoid spurious unsupported accesses.
Note, the logic can also be used for non-PMU MSRs, but as of today only PMU MSRs can end up being unsupported after KVM told userspace to save and restore them.
Stable-dep-of: 5bb9ac186512 ("KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR")
--- arch/x86/kvm/x86.c | 51 ++++++++++++++++++++++++++-------------------- 1 file changed, 29 insertions(+), 22 deletions(-)
arch/x86/kvm/x86.c +29 -22
@@ -3576,6 +3576,18 @@ static void record_steal_time(struct kvm_vcpu *vcpu)mark_page_dirty_in_slot (vcpu->kvm, ghc->memslot,gpa_to_gfn (ghc->gpa)); } +static bool kvm_is_msr_to_save (u32 msr_index) +{ +unsigned int i; + +for (i =0 ; i < num_msrs_to_save; i++) { +if (msrs_to_save[i] == msr_index) +return true; + } + +return false; +} +int kvm_set_msr_common (struct kvm_vcpu *vcpu,struct msr_data *msr_info) {u32 msr = msr_info->index;
@@ -3896,20 +3908,18 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) vcpu->arch.guest_fpu.xfd_err = data;break ;#endif -case MSR_IA32_PEBS_ENABLE : -case MSR_IA32_DS_AREA : -case MSR_PEBS_DATA_CFG : - case MSR_F15H_PERF_CTL0 ... MSR_F15H_PERF_CTR5: +default :if (kvm_pmu_is_valid_msr (vcpu, msr))return kvm_pmu_set_msr (vcpu, msr_info); +/* * Userspace is allowed to write '0' to MSRs that KVM reports * as to-be-saved, even if an MSRs isn't fully supported. */ -return !msr_info->host_initiated || data; -default : -if (kvm_pmu_is_valid_msr (vcpu, msr)) -return kvm_pmu_set_msr (vcpu, msr_info); +if (msr_info->host_initiated && !data && +kvm_is_msr_to_save (msr)) +break ; +return KVM_MSR_RET_INVALID ; }return 0 ;
@@ -4000,20 +4010,6 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)case MSR_DRAM_ENERGY_STATUS :/* DRAM controller */ msr_info->data =0 ;break ; -case MSR_IA32_PEBS_ENABLE : -case MSR_IA32_DS_AREA : -case MSR_PEBS_DATA_CFG : - case MSR_F15H_PERF_CTL0 ... MSR_F15H_PERF_CTR5: -if (kvm_pmu_is_valid_msr (vcpu, msr_info->index)) -return kvm_pmu_get_msr (vcpu, msr_info); -/* -* Userspace is allowed to read MSRs that KVM reports as -* to-be-saved, even if an MSR isn't fully supported. -*/ -if (!msr_info->host_initiated) -return 1 ; - msr_info->data =0 ; -break ; case MSR_K7_EVNTSEL0 ... MSR_K7_EVNTSEL3: case MSR_K7_PERFCTR0 ... MSR_K7_PERFCTR3: case MSR_P6_PERFCTR0 ... MSR_P6_PERFCTR1:
@@ -4268,6 +4264,17 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)default :if (kvm_pmu_is_valid_msr (vcpu, msr_info->index))return kvm_pmu_get_msr (vcpu, msr_info); + +/* +* Userspace is allowed to read MSRs that KVM reports as +* to-be-saved, even if an MSR isn't fully supported. +*/ +if (msr_info->host_initiated && +kvm_is_msr_to_save (msr_info->index)) { + msr_info->data =0 ; +break ; + } +return KVM_MSR_RET_INVALID ; }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/481 KVM: x86: Fix KVM_GET_MSRS stack info leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
[ Upstream commit 3376ca3f1a2075eaa23c5576c47d04d7e8a4adda ]
Commit 6abe9c1386e5 ("KVM: X86: Move ignore_msrs handling upper the stack") changed the 'ignore_msrs' handling, including sanitizing return values to the caller. This was fine until commit 12bc2132b15e ("KVM:
X86: Do the same ignore_msrs check for feature msrs") which allowed non-existing feature MSRs to be ignored, i.e. to not generate an error on the ioctl() level. It even tried to preserve the sanitization of the return value. However, the logic is flawed, as '*data' will be overwritten again with the uninitialized stack value of msr.data.
Fix this by simplifying the logic and always initializing msr.data, vanishing the need for an additional error exit path.
Stable-dep-of: 5bb9ac186512 ("KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR")
--- arch/x86/kvm/x86.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
arch/x86/kvm/x86.c +5 -10
@@ -1713,22 +1713,17 @@ static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data)struct kvm_msr_entry msr;int r; +/* Unconditionally clear the output for simplicity */ + msr.data =0 ; msr.index = index; r =kvm_get_msr_feature (&msr); -if (r ==KVM_MSR_RET_INVALID ) { -/* Unconditionally clear the output for simplicity */ - *data =0 ; -if (kvm_msr_ignored_check (index,0 , false)) - r =0 ; - } - -if (r) -return r; +if (r ==KVM_MSR_RET_INVALID &&kvm_msr_ignored_check (index,0 , false)) + r =0 ; *data = msr.data; -return 0 ; +return r; }static bool __kvm_valid_efer (struct kvm_vcpu *vcpu,u64 efer)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/481 KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit aaecae7b6a2b19a874a7df0d474f44f3a5b5a74e ]
Rename the "INVALID" internal MSR error return code to "UNSUPPORTED" to try and make it more clear that access was denied because the MSR itself is unsupported/unknown. "INVALID" is too ambiguous, as it could just as easily mean the value for WRMSR as invalid.
Avoid UNKNOWN and UNIMPLEMENTED, as the error code is used for MSRs that _are_ actually implemented by KVM, e.g. if the MSR is unsupported because an associated feature flag is not present in guest CPUID.
Opportunistically beef up the comments for the internal MSR error codes.
Stable-dep-of: 5bb9ac186512 ("KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR")
--- arch/x86/kvm/svm/svm.c | 2 +- arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/kvm/x86.c | 12 ++++++------ arch/x86/kvm/x86.h | 15 +++++++++++---- 4 files changed, 19 insertions(+), 12 deletions(-)
arch/x86/kvm/svm/svm.c +1 -1
@@ -2735,7 +2735,7 @@ static int svm_get_msr_feature(struct kvm_msr_entry *msr) msr->data = kvm_caps.supported_perf_cap;return 0 ;default : -return KVM_MSR_RET_INVALID ; +return KVM_MSR_RET_UNSUPPORTED ; }return 0 ;
arch/x86/kvm/vmx/vmx.c +1 -1
@@ -1889,7 +1889,7 @@ static int vmx_get_msr_feature(struct kvm_msr_entry *msr) msr->data = kvm_caps.supported_perf_cap;return 0 ;default : -return KVM_MSR_RET_INVALID ; +return KVM_MSR_RET_UNSUPPORTED ; } }
arch/x86/kvm/x86.c +6 -6
@@ -1718,7 +1718,7 @@ static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data) msr.index = index; r =kvm_get_msr_feature (&msr); -if (r ==KVM_MSR_RET_INVALID &&kvm_msr_ignored_check (index,0 , false)) +if (r ==KVM_MSR_RET_UNSUPPORTED &&kvm_msr_ignored_check (index,0 , false)) r =0 ; *data = msr.data;
@@ -1908,7 +1908,7 @@ static int kvm_set_msr_ignored_check(struct kvm_vcpu *vcpu, {int ret =__kvm_set_msr (vcpu, index, data, host_initiated); -if (ret ==KVM_MSR_RET_INVALID ) +if (ret ==KVM_MSR_RET_UNSUPPORTED )if (kvm_msr_ignored_check (index, data, true)) ret =0 ;
@@ -1953,7 +1953,7 @@ static int kvm_get_msr_ignored_check(struct kvm_vcpu *vcpu, {int ret =__kvm_get_msr (vcpu, index, data, host_initiated); -if (ret ==KVM_MSR_RET_INVALID ) { +if (ret ==KVM_MSR_RET_UNSUPPORTED ) {/* Unconditionally clear *data for simplicity */ *data =0 ;if (kvm_msr_ignored_check (index,0 , false))
@@ -2022,7 +2022,7 @@ static int complete_fast_rdmsr(struct kvm_vcpu *vcpu)static u64 kvm_msr_reason (int r) {switch (r) { -case KVM_MSR_RET_INVALID : +case KVM_MSR_RET_UNSUPPORTED :return KVM_MSR_EXIT_REASON_UNKNOWN ;case KVM_MSR_RET_FILTERED :return KVM_MSR_EXIT_REASON_FILTER ;
@@ -3915,7 +3915,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) kvm_is_msr_to_save(msr))break ; -return KVM_MSR_RET_INVALID ; +return KVM_MSR_RET_UNSUPPORTED ; }return 0 ; }
@@ -4270,7 +4270,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)break ; } -return KVM_MSR_RET_INVALID ; +return KVM_MSR_RET_UNSUPPORTED ; }return 0 ; }
arch/x86/kvm/x86.h +11 -4
@@ -459,11 +459,18 @@ bool kvm_msr_allowed(struct kvm_vcpu *vcpu, u32 index, u32 type);/* * Internal error codes that are used to indicate that MSR emulation encountered -* an error that should result in #GP in the guest, unless userspace -* handles it. +* an error that should result in #GP in the guest, unless userspace handles it. +* Note, '1', '0', and negative numbers are off limits, as they are used by KVM +* as part of KVM's lightly documented internal KVM_RUN return codes. +* +* UNSUPPORTED - The MSR isn't supported, either because it is completely +* unknown to KVM, or because the MSR should not exist according +* to the vCPU model. +* +* FILTERED - Access to the MSR is denied by a userspace MSR filter. */ -#define KVM_MSR_RET_INVALID 2/* in-kernel MSR emulation #GP condition */ -#define KVM_MSR_RET_FILTERED 3/* #GP due to userspace MSR filter */ +#define KVM_MSR_RET_UNSUPPORTED 2 +#define KVM_MSR_RET_FILTERED 3#define __cr4_reserved_bits (__cpu_has, __c) \ ({ \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/481 KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 5bb9ac1865123356337a389af935d3913ee917ed ]
Return KVM_MSR_RET_UNSUPPORTED instead of '1' (which for all intents and purposes means "invalid") when rejecting accesses to KVM PV MSRs to adhere to KVM's ABI of allowing host reads and writes of '0' to MSRs that are advertised to userspace via KVM_GET_MSR_INDEX_LIST, even if the vCPU model doesn't support the MSR.
E.g. running a QEMU VM with
-cpu host,-kvmclock,kvm-pv-enforce-cpuid
yields:
qemu: error: failed to set MSR 0x12 to 0x0
qemu: target/i386/kvm/kvm.c:3301: kvm_buf_set_msrs:
Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.
--- arch/x86/kvm/x86.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-)
arch/x86/kvm/x86.c +20 -20
@@ -3731,47 +3731,47 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)break ;case MSR_KVM_WALL_CLOCK_NEW :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE2 )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; vcpu->kvm->arch.wall_clock = data;kvm_write_wall_clock (vcpu->kvm, data,0 );break ;case MSR_KVM_WALL_CLOCK :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; vcpu->kvm->arch.wall_clock = data;kvm_write_wall_clock (vcpu->kvm, data,0 );break ;case MSR_KVM_SYSTEM_TIME_NEW :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE2 )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;kvm_write_system_time (vcpu, data, false, msr_info->host_initiated);break ;case MSR_KVM_SYSTEM_TIME :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;kvm_write_system_time (vcpu, data, true, msr_info->host_initiated);break ;case MSR_KVM_ASYNC_PF_EN :if (!guest_pv_has (vcpu,KVM_FEATURE_ASYNC_PF )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;if (kvm_pv_enable_async_pf (vcpu, data))return 1 ;break ;case MSR_KVM_ASYNC_PF_INT :if (!guest_pv_has (vcpu,KVM_FEATURE_ASYNC_PF_INT )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;if (kvm_pv_enable_async_pf_int (vcpu, data))return 1 ;break ;case MSR_KVM_ASYNC_PF_ACK :if (!guest_pv_has (vcpu,KVM_FEATURE_ASYNC_PF_INT )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;if (data &0x1 ) { vcpu->arch.apf.pageready_pending = false;kvm_check_async_pf_completion (vcpu);
@@ -3779,7 +3779,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)break ;case MSR_KVM_STEAL_TIME :if (!guest_pv_has (vcpu,KVM_FEATURE_STEAL_TIME )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;if (unlikely (!sched_info_on ()))return 1 ;
@@ -3797,7 +3797,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)break ;case MSR_KVM_PV_EOI_EN :if (!guest_pv_has (vcpu,KVM_FEATURE_PV_EOI )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;if (kvm_lapic_set_pv_eoi (vcpu, data,sizeof (u8)))return 1 ;
@@ -3805,7 +3805,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)case MSR_KVM_POLL_CONTROL :if (!guest_pv_has (vcpu,KVM_FEATURE_POLL_CONTROL )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ;/* only enable bit supported */ if (data & (-1ULL <<1 ))
@@ -4108,61 +4108,61 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)break ;case MSR_KVM_WALL_CLOCK :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->kvm->arch.wall_clock;break ;case MSR_KVM_WALL_CLOCK_NEW :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE2 )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->kvm->arch.wall_clock;break ;case MSR_KVM_SYSTEM_TIME :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->arch.time;break ;case MSR_KVM_SYSTEM_TIME_NEW :if (!guest_pv_has (vcpu,KVM_FEATURE_CLOCKSOURCE2 )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->arch.time;break ;case MSR_KVM_ASYNC_PF_EN :if (!guest_pv_has (vcpu,KVM_FEATURE_ASYNC_PF )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->arch.apf.msr_en_val;break ;case MSR_KVM_ASYNC_PF_INT :if (!guest_pv_has (vcpu,KVM_FEATURE_ASYNC_PF_INT )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->arch.apf.msr_int_val;break ;case MSR_KVM_ASYNC_PF_ACK :if (!guest_pv_has (vcpu,KVM_FEATURE_ASYNC_PF_INT )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data =0 ;break ;case MSR_KVM_STEAL_TIME :if (!guest_pv_has (vcpu,KVM_FEATURE_STEAL_TIME )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->arch.st.msr_val;break ;case MSR_KVM_PV_EOI_EN :if (!guest_pv_has (vcpu,KVM_FEATURE_PV_EOI )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->arch.pv_eoi.msr_val;break ;case MSR_KVM_POLL_CONTROL :if (!guest_pv_has (vcpu,KVM_FEATURE_POLL_CONTROL )) -return 1 ; +return KVM_MSR_RET_UNSUPPORTED ; msr_info->data = vcpu->arch.msr_kvm_poll_control;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/481 media: tegra-video: Use accessors for pad config try_* fields
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit 0623979d8352efe18f83c4fad95a2e61df17b3e7 ]
The 'try_*' fields of the v4l2_subdev_pad_config structure are meant to be accessed through helper functions. Replace direct access with usage of the v4l2_subdev_get_pad_format(), v4l2_subdev_get_pad_crop() and v4l2_subdev_get_pad_compose() helpers.
Stable-dep-of: 43e5302d2233 ("media: tegra-video: Fix memory leak in __tegra_channel_try_format()")
--- drivers/staging/media/tegra-video/vi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/staging/media/tegra-video/vi.c +8 -6
@@ -502,6 +502,7 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan, .which = V4L2_SUBDEV_FORMAT_ACTIVE, .target = V4L2_SEL_TGT_CROP_BOUNDS, }; +struct v4l2_rect *try_crop;int ret; subdev =tegra_channel_get_remote_source_subdev (chan);
@@ -537,24 +538,25 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan,* Attempt to obtain the format size from subdev. * If not available, try to get crop boundary from subdev. */ + try_crop =v4l2_subdev_get_pad_crop (subdev, sd_state,0 ); fse.code = fmtinfo->code; ret =v4l2_subdev_call (subdev, pad, enum_frame_size, sd_state, &fse);if (ret) {if (!v4l2_subdev_has_op (subdev, pad, get_selection)) { - sd_state->pads->try_crop.width =0 ; - sd_state->pads->try_crop.height =0 ; + try_crop->width =0 ; + try_crop->height =0 ; }else { ret =v4l2_subdev_call (subdev, pad, get_selection,NULL , &sdsel);if (ret)return -EINVAL ; - sd_state->pads->try_crop.width = sdsel.r.width; - sd_state->pads->try_crop.height = sdsel.r.height; + try_crop->width = sdsel.r.width; + try_crop->height = sdsel.r.height; } }else { - sd_state->pads->try_crop.width = fse.max_width; - sd_state->pads->try_crop.height = fse.max_height; + try_crop->width = fse.max_width; + try_crop->height = fse.max_height; } ret =v4l2_subdev_call (subdev, pad, set_fmt, sd_state, &fmt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/481 media: tegra-video: Fix memory leak in __tegra_channel_try_format()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 43e5302d22334f1183dec3e0d5d8007eefe2817c ]
The state object allocated by __v4l2_subdev_state_alloc() must be freed with __v4l2_subdev_state_free() when it is no longer needed.
In __tegra_channel_try_format(), two error paths return directly after v4l2_subdev_call() fails, without freeing the allocated 'sd_state' object. This violates the requirement and causes a memory leak.
Fix this by introducing a cleanup label and using goto statements in the error paths to ensure that __v4l2_subdev_state_free() is always called before the function returns.
--- drivers/staging/media/tegra-video/vi.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/staging/media/tegra-video/vi.c +8 -5
@@ -503,7 +503,7 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan, .target = V4L2_SEL_TGT_CROP_BOUNDS, };struct v4l2_rect *try_crop; -int ret; +int ret =0 ; subdev =tegra_channel_get_remote_source_subdev (chan);if (!subdev)
@@ -548,8 +548,10 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan, }else { ret =v4l2_subdev_call (subdev, pad, get_selection,NULL , &sdsel); -if (ret) -return -EINVAL ; +if (ret) { + ret = -EINVAL ; + goto out_free; + } try_crop->width = sdsel.r.width; try_crop->height = sdsel.r.height;
@@ -561,14 +563,15 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan, ret =v4l2_subdev_call (subdev, pad, set_fmt, sd_state, &fmt);if (ret <0 ) -return ret; + goto out_free;v4l2_fill_pix_format (pix, &fmt.format);tegra_channel_fmt_align (chan, pix, fmtinfo->bpp); +out_free:__v4l2_subdev_state_free (sd_state); -return 0 ; +return ret; } static int tegra_channel_try_format(struct file *file, void *fh,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/481 media: camss: vfe-480: Multiple outputs support for SM8250
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milen Mitkov <[email protected]>
[ Upstream commit 1c4abf0246d2ad5fabc830f1d9cc3944d5a4ae95 ]
On SM8250 each VFE supports at least 3 RDI channels, or 4 in case of VFE-Lite, so add appropriate IRQ setup and handling.
Stable-dep-of: d965919af524 ("media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()")
--- .../media/platform/qcom/camss/camss-vfe-480.c | 57 ++++++++++++------- 1 file changed, 38 insertions(+), 19 deletions(-)
drivers/media/platform/qcom/camss/camss-vfe-480.c +38 -19
@@ -93,6 +93,8 @@ static inline int bus_irq_mask_0_comp_done(struct vfe_device *vfe, int n)#define RDI_WM (n) ((IS_LITE ? 0 : 23) + (n))#define RDI_COMP_GROUP (n) ((IS_LITE ? 0 : 11) + (n)) +#define MAX_VFE_OUTPUT_LINES 4 +static u32 vfe_hw_version (struct vfe_device *vfe) {u32 hw_version =readl_relaxed (vfe->base +VFE_HW_VERSION );
@@ -170,12 +172,26 @@ static inline void vfe_reg_update_clear(struct vfe_device *vfe,static void vfe_enable_irq_common (struct vfe_device *vfe) { -/* enable only the IRQs used: rup and comp_done irqs for RDI0 */ +/* enable reset ack IRQ and top BUS status IRQ */ writel_relaxed (IRQ_MASK_0_RESET_ACK |IRQ_MASK_0_BUS_TOP_IRQ , vfe->base +VFE_IRQ_MASK (0 )); -writel_relaxed (BUS_IRQ_MASK_0_RDI_RUP (vfe,0 ) | -BUS_IRQ_MASK_0_COMP_DONE (vfe,RDI_COMP_GROUP (0 )), - vfe->base +VFE_BUS_IRQ_MASK (0 )); +} + +static void vfe_enable_lines_irq (struct vfe_device *vfe) +{ +int i; +u32 bus_irq_mask =0 ; + +for (i =0 ; i <MAX_VFE_OUTPUT_LINES ; i++) { +/* Enable IRQ for newly added lines, but also keep already running lines's IRQ */ +if (vfe->line[i].output.state ==VFE_OUTPUT_RESERVED || + vfe->line[i].output.state ==VFE_OUTPUT_ON ) { + bus_irq_mask |=BUS_IRQ_MASK_0_RDI_RUP (vfe, i) + |BUS_IRQ_MASK_0_COMP_DONE (vfe,RDI_COMP_GROUP (i)); + } + } + +writel_relaxed (bus_irq_mask, vfe->base +VFE_BUS_IRQ_MASK (0 )); }static void vfe_isr_reg_update (struct vfe_device *vfe,enum vfe_line_id line_id);
@@ -192,6 +208,7 @@ static irqreturn_t vfe_isr(int irq, void *dev) {struct vfe_device *vfe = dev;u32 status; +int i; status =readl_relaxed (vfe->base +VFE_IRQ_STATUS (0 ));writel_relaxed (status, vfe->base +VFE_IRQ_CLEAR (0 ));
@@ -206,11 +223,14 @@ static irqreturn_t vfe_isr(int irq, void *dev)writel_relaxed (status, vfe->base +VFE_BUS_IRQ_CLEAR (0 ));writel_relaxed (1 , vfe->base +VFE_BUS_IRQ_CLEAR_GLOBAL ); -if (status &BUS_IRQ_MASK_0_RDI_RUP (vfe,0 )) -vfe_isr_reg_update (vfe,0 ); +/* Loop through all WMs IRQs */ +for (i =0 ; i <MSM_VFE_IMAGE_MASTERS_NUM ; i++) { +if (status &BUS_IRQ_MASK_0_RDI_RUP (vfe, i)) +vfe_isr_reg_update (vfe, i); -if (status &BUS_IRQ_MASK_0_COMP_DONE (vfe,RDI_COMP_GROUP (0 ))) -vfe_isr_wm_done (vfe,0 ); +if (status &BUS_IRQ_MASK_0_COMP_DONE (vfe,RDI_COMP_GROUP (i))) +vfe_isr_wm_done (vfe, i); + } }return IRQ_HANDLED ;
@@ -233,7 +253,6 @@ static int vfe_get_output(struct vfe_line *line)struct vfe_device *vfe =to_vfe (line);struct vfe_output *output;unsigned long flags; -int wm_idx;spin_lock_irqsave (&vfe->output_lock, flags);
@@ -245,12 +264,12 @@ static int vfe_get_output(struct vfe_line *line) output->wm_num =1 ; - wm_idx =vfe_reserve_wm (vfe, line->id); -if (wm_idx <0 ) { -dev_err (vfe->camss->dev,"Can not reserve wm\n" ); - goto error_get_wm; - } - output->wm_idx[0 ] = wm_idx; +/* Correspondence between VFE line number and WM number. +* line 0 -> RDI 0, line 1 -> RDI1, line 2 -> RDI2, line 3 -> PIX/RDI3 +* Note this 1:1 mapping will not work for PIX streams. +*/ + output->wm_idx[0 ] = line->id; + vfe->wm_output_map[line->id] = line->id; output->drop_update_idx =0 ;
@@ -258,11 +277,9 @@ static int vfe_get_output(struct vfe_line *line)return 0 ; -error_get_wm: -vfe_release_wm (vfe, output->wm_idx[0 ]); - output->state =VFE_OUTPUT_OFF ; error:spin_unlock_irqrestore (&vfe->output_lock, flags); + output->state =VFE_OUTPUT_OFF ;return -EINVAL ; }
@@ -344,6 +361,8 @@ static int vfe_enable(struct vfe_line *line) vfe->stream_count++; +vfe_enable_lines_irq (vfe); +mutex_unlock (&vfe->stream_lock); ret =vfe_get_output (line);
@@ -550,7 +569,7 @@ static const struct camss_video_ops vfe_video_ops_480 = {static void vfe_subdev_init (struct device *dev,struct vfe_device *vfe) { vfe->video_ops = vfe_video_ops_480; - vfe->line_num =1 ; + vfe->line_num =MAX_VFE_OUTPUT_LINES ; }const struct vfe_hw_ops vfe_ops_480 = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/481 media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alper Ak <[email protected]>
[ Upstream commit d965919af524e68cb2ab1a685872050ad2ee933d ]
vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop bound and passes the index to vfe_isr_reg_update(). However, vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):
struct vfe_line line[VFE_LINE_NUM_MAX];
When index is 4, 5, 6, the access to vfe->line[line_id] exceeds the array bounds and resulting in out-of-bounds memory access.
Fix this by using separate loops for output lines and write masters.
--- drivers/media/platform/qcom/camss/camss-vfe-480.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/qcom/camss/camss-vfe-480.c +4 -2
@@ -223,11 +223,13 @@ static irqreturn_t vfe_isr(int irq, void *dev)writel_relaxed (status, vfe->base +VFE_BUS_IRQ_CLEAR (0 ));writel_relaxed (1 , vfe->base +VFE_BUS_IRQ_CLEAR_GLOBAL ); -/* Loop through all WMs IRQs */ -for (i =0 ; i <MSM_VFE_IMAGE_MASTERS_NUM ; i++) { +for (i =0 ; i <MAX_VFE_OUTPUT_LINES ; i++) {if (status &BUS_IRQ_MASK_0_RDI_RUP (vfe, i))vfe_isr_reg_update (vfe, i); + } +/* Loop through all WMs IRQs */ +for (i =0 ; i <MSM_VFE_IMAGE_MASTERS_NUM ; i++) {if (status &BUS_IRQ_MASK_0_COMP_DONE (vfe,RDI_COMP_GROUP (i)))vfe_isr_wm_done (vfe, i); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/481 KVM: x86: WARN if a vCPU gets a valid wakeup that KVM cant yet inject
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 45405155d876c326da89162b8173b8cc9ab7ed75 ]
WARN if a blocking vCPU is awakened by a valid wake event that KVM can't inject, e.g. because KVM needs to complete a nested VM-enter, or needs to re-inject an exception. For the nested VM-Enter case, KVM is supposed to clear "nested_run_pending" if L1 puts L2 into HLT, i.e. entering HLT "completes" the nested VM-Enter. And for already-injected exceptions, it should be impossible for the vCPU to be in a blocking state if a VM-Exit occurred while an exception was being vectored.
Stable-dep-of: ead63640d4e7 ("KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()")
--- arch/x86/kvm/x86.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/kvm/x86.c +4 -1
@@ -11064,7 +11064,10 @@ static inline int vcpu_block(struct kvm_vcpu *vcpu)* causes a spurious wakeup from HLT). */ if (is_guest_mode (vcpu)) { -if (kvm_check_nested_events (vcpu) <0 ) +int r =kvm_check_nested_events (vcpu); + +WARN_ON_ONCE (r == -EBUSY ); +if (r <0 )return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/481 KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit ead63640d4e72e6f6d464f4e31f7fecb79af8869 ]
Ignore -EBUSY when checking nested events after exiting a blocking state while L2 is active, as exiting to userspace will generate a spurious userspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's demise. Continuing with the wakeup isn't perfect either, as *something* has gone sideways if a vCPU is awakened in L2 with an injected event (or worse, a nested run pending), but continuing on gives the VM a decent chance of surviving without any major side effects.
As explained in the Fixes commits, it _should_ be impossible for a vCPU to be put into a blocking state with an already-injected event (exception, IRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected events, and thus put the vCPU into what should be an impossible state.
Don't bother trying to preserve the WARN, e.g. with an anti-syzkaller Kconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be violating x86 architecture, e.g. by WARNing if KVM attempts to inject an exception or interrupt while the vCPU isn't running.
--- arch/x86/kvm/x86.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/kvm/x86.c +1 -2
@@ -11066,8 +11066,7 @@ static inline int vcpu_block(struct kvm_vcpu *vcpu)if (is_guest_mode (vcpu)) {int r =kvm_check_nested_events (vcpu); -WARN_ON_ONCE (r == -EBUSY ); -if (r <0 ) +if (r <0 && r != -EBUSY )return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/481 drm/tegra: dsi: fix device leak on probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit bfef062695570842cf96358f2f46f4c6642c6689 ]
Make sure to drop the reference taken when looking up the companion (ganged) device and its driver data during probe().
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/gpu/drm/tegra/dsi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/tegra/dsi.c +2 -4
@@ -1539,11 +1539,9 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)return -EPROBE_DEFER ; dsi->slave =platform_get_drvdata (gangster); - -if (!dsi->slave) { -put_device (&gangster->dev); +put_device (&gangster->dev); +if (!dsi->slave)return -EPROBE_DEFER ; - } dsi->slave->master = dsi; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/481 bus: omap-ocp2scp: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 854f89a5b56354ba4135e0e1f0e57ab2caee59ee ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 5eb63e9bb65d ("bus: omap-ocp2scp: fix OF populate on driver rebind")
--- drivers/bus/omap-ocp2scp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/bus/omap-ocp2scp.c +2 -4
@@ -84,12 +84,10 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)return ret; } -static int omap_ocp2scp_remove (struct platform_device *pdev) +static void omap_ocp2scp_remove (struct platform_device *pdev) {pm_runtime_disable (&pdev->dev);device_for_each_child (&pdev->dev,NULL , ocp2scp_remove_devices); - -return 0 ; }#ifdef CONFIG_OF
@@ -103,7 +101,7 @@ MODULE_DEVICE_TABLE(of, omap_ocp2scp_id_table);static struct platform_driver omap_ocp2scp_driver = { .probe = omap_ocp2scp_probe, - .remove = omap_ocp2scp_remove, + .remove_new = omap_ocp2scp_remove, .driver = { .name ="omap-ocp2scp" , .of_match_table =of_match_ptr (omap_ocp2scp_id_table),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/481 bus: omap-ocp2scp: fix OF populate on driver rebind
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 5eb63e9bb65d88abde647ced50fe6ad40c11de1a ]
Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound.
--- drivers/bus/omap-ocp2scp.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/bus/omap-ocp2scp.c +2 -11
@@ -17,15 +17,6 @@#define OCP2SCP_TIMING 0x18#define SYNC2_MASK 0xf -static int ocp2scp_remove_devices (struct device *dev,void *c) -{ -struct platform_device *pdev =to_platform_device (dev); - -platform_device_unregister (pdev); - -return 0 ; -} -static int omap_ocp2scp_probe (struct platform_device *pdev) {int ret;
@@ -79,7 +70,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)pm_runtime_disable (&pdev->dev); err0: -device_for_each_child (&pdev->dev,NULL , ocp2scp_remove_devices); +of_platform_depopulate (&pdev->dev);return ret; }
@@ -87,7 +78,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)static void omap_ocp2scp_remove (struct platform_device *pdev) {pm_runtime_disable (&pdev->dev); -device_for_each_child (&pdev->dev,NULL , ocp2scp_remove_devices); +of_platform_depopulate (&pdev->dev); }#ifdef CONFIG_OF
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/481 ext4: make ext4_es_remove_extent() return void
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit ed5d285b3f2a9a37ff778c5e440daf49351fcc4d ]
Now ext4_es_remove_extent() never fails, so make it return void.
Stable-dep-of: 22784ca541c0 ("ext4: subdivide EXT4_EXT_DATA_VALID1")
--- fs/ext4/extents.c | 34 ++++++---------------------------- fs/ext4/extents_status.c | 12 ++++++------ fs/ext4/extents_status.h | 4 ++-- fs/ext4/inline.c | 12 ++---------- fs/ext4/inode.c | 8 ++------ 5 files changed, 18 insertions(+), 52 deletions(-)
fs/ext4/extents.c +6 -28
@@ -4463,15 +4463,8 @@ int ext4_ext_truncate(handle_t *handle, struct inode *inode) last_block = (inode->i_size + sb->s_blocksize -1 ) >>EXT4_BLOCK_SIZE_BITS (sb); -retry: - err =ext4_es_remove_extent (inode, last_block, -EXT_MAX_BLOCKS - last_block); -if (err == -ENOMEM ) { -memalloc_retry_wait (GFP_ATOMIC ); - goto retry; - } -if (err) -return err; +ext4_es_remove_extent (inode, last_block,EXT_MAX_BLOCKS - last_block); + retry_remove_space: err =ext4_ext_remove_space (inode, last_block,EXT_MAX_BLOCKS -1 );if (err == -ENOMEM ) {
@@ -5419,13 +5412,7 @@ static int ext4_collapse_range(struct file *file, loff_t offset, loff_t len)down_write (&EXT4_I (inode)->i_data_sem);ext4_discard_preallocations (inode,0 ); - - ret =ext4_es_remove_extent (inode, punch_start, -EXT_MAX_BLOCKS - punch_start); -if (ret) { -up_write (&EXT4_I (inode)->i_data_sem); - goto out_stop; - } +ext4_es_remove_extent (inode, punch_start,EXT_MAX_BLOCKS - punch_start); ret =ext4_ext_remove_space (inode, punch_start, punch_stop -1 );if (ret) {
@@ -5611,12 +5598,7 @@ static int ext4_insert_range(struct file *file, loff_t offset, loff_t len)ext4_free_ext_path (path); } - ret =ext4_es_remove_extent (inode, offset_lblk, -EXT_MAX_BLOCKS - offset_lblk); -if (ret) { -up_write (&EXT4_I (inode)->i_data_sem); - goto out_stop; - } +ext4_es_remove_extent (inode, offset_lblk,EXT_MAX_BLOCKS - offset_lblk);/* * if offset_lblk lies in a hole which is at start of file, use
@@ -5675,12 +5657,8 @@ ext4_swap_extents(handle_t *handle, struct inode *inode1,BUG_ON (!inode_is_locked (inode1));BUG_ON (!inode_is_locked (inode2)); - *erp =ext4_es_remove_extent (inode1, lblk1, count); -if (unlikely (*erp)) -return 0 ; - *erp =ext4_es_remove_extent (inode2, lblk2, count); -if (unlikely (*erp)) -return 0 ; +ext4_es_remove_extent (inode1, lblk1, count); +ext4_es_remove_extent (inode2, lblk2, count);while (count) {struct ext4_extent *ex1, *ex2, tmp_ex;
fs/ext4/extents_status.c +6 -6
@@ -1494,10 +1494,10 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,* @len - number of blocks to remove * * Reduces block/cluster reservation count and for bigalloc cancels pending -* reservations as needed. Returns 0 on success, error code on failure. +* reservations as needed. */ -int ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, -ext4_lblk_t len) +void ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, +ext4_lblk_t len) {ext4_lblk_t end;int err =0 ;
@@ -1505,14 +1505,14 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,struct extent_status *es =NULL ;if (EXT4_SB (inode->i_sb)->s_mount_state &EXT4_FC_REPLAY ) -return 0 ; +return ;trace_ext4_es_remove_extent (inode, lblk, len);es_debug ("remove [%u/%u) from extent status tree of inode %lu\n" , lblk, len, inode->i_ino);if (!len) -return err; +return ; end = lblk + len -1 ;BUG_ON (end < lblk);
@@ -1539,7 +1539,7 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,ext4_es_print_tree (inode);ext4_da_release_space (inode, reserved); -return 0 ; +return ; } static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
fs/ext4/extents_status.h +2 -2
@@ -133,8 +133,8 @@ extern void ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,extern void ext4_es_cache_extent (struct inode *inode,ext4_lblk_t lblk,ext4_lblk_t len,ext4_fsblk_t pblk,unsigned int status); -extern int ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, -ext4_lblk_t len); +extern void ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, +ext4_lblk_t len); extern void ext4_es_find_extent_range(struct inode *inode, int (*match_fn)(struct extent_status *es), ext4_lblk_t lblk, ext4_lblk_t end,
fs/ext4/inline.c +2 -10
@@ -2004,16 +2004,8 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline)* the extent status cache must be cleared to avoid leaving * behind stale delayed allocated extent entries */ -if (!ext4_test_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA )) { -retry: - err =ext4_es_remove_extent (inode,0 ,EXT_MAX_BLOCKS ); -if (err == -ENOMEM ) { -memalloc_retry_wait (GFP_ATOMIC ); - goto retry; - } -if (err) - goto out_error; - } +if (!ext4_test_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA )) +ext4_es_remove_extent (inode,0 ,EXT_MAX_BLOCKS );/* Clear the content in the xattr space. */ if (inline_size >EXT4_MIN_INLINE_DATA_SIZE ) {
fs/ext4/inode.c +2 -6
@@ -4134,12 +4134,8 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)down_write (&EXT4_I (inode)->i_data_sem);ext4_discard_preallocations (inode,0 ); - ret =ext4_es_remove_extent (inode, first_block, - stop_block - first_block); -if (ret) { -up_write (&EXT4_I (inode)->i_data_sem); - goto out_stop; - } +ext4_es_remove_extent (inode, first_block, + stop_block - first_block);if (ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS )) ret = ext4_ext_remove_space(inode, first_block,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/481 ext4: get rid of ppath in ext4_find_extent()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 0be4c0c2f17bd10ae16c852f02d51a6a7b318aca ]
The use of path and ppath is now very confusing, so to make the code more readable, pass path between functions uniformly, and get rid of ppath.
Getting rid of ppath in ext4_find_extent() requires its caller to update ppath. These ppaths will also be dropped later. No functional changes.
Stable-dep-of: 22784ca541c0 ("ext4: subdivide EXT4_EXT_DATA_VALID1")
--- fs/ext4/ext4.h | 2 +- fs/ext4/extents.c | 55 +++++++++++++++++++++++-------------------- fs/ext4/move_extent.c | 7 +++--- 3 files changed, 34 insertions(+), 30 deletions(-)
fs/ext4/ext4.h +1 -1
@@ -3723,7 +3723,7 @@ extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path **, struct ext4_extent *, int);extern struct ext4_ext_path *ext4_find_extent (struct inode *,ext4_lblk_t , -struct ext4_ext_path **, +struct ext4_ext_path *,int flags);extern void ext4_free_ext_path (struct ext4_ext_path *);extern int ext4_ext_check_inode (struct inode *inode);
fs/ext4/extents.c +29 -26
164 lines not on this page · raw message
fs/ext4/move_extent.c +4 -3
@@ -26,16 +26,17 @@ static inline int get_ext_path(struct inode *inode, ext4_lblk_t lblock, struct ext4_ext_path **ppath) { - struct ext4_ext_path *path; + struct ext4_ext_path *path = *ppath; - path =ext4_find_extent (inode, lblock, ppath,EXT4_EX_NOCACHE ); + *ppath =NULL ; + path =ext4_find_extent (inode, lblock, path,EXT4_EX_NOCACHE );if (IS_ERR (path))return PTR_ERR (path);if (path[ext_depth (inode)].p_ext ==NULL ) {ext4_free_ext_path (path); - *ppath =NULL ;return -ENODATA ; } + *ppath = path;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/481 ext4: get rid of ppath in ext4_ext_create_new_leaf()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit a000bc8678cc2bb10a5b80b4e991e77c7b4612fd ]
The use of path and ppath is now very confusing, so to make the code more readable, pass path between functions uniformly, and get rid of ppath.
To get rid of the ppath in ext4_ext_create_new_leaf(), the following is done here:
* Free the extents path when an error is encountered.
* Its caller needs to update ppath if it uses ppath.
No functional changes.
Stable-dep-of: 22784ca541c0 ("ext4: subdivide EXT4_EXT_DATA_VALID1")
--- fs/ext4/extents.c | 43 ++++++++++++++++++++++--------------------- 1 file changed, 22 insertions(+), 21 deletions(-)
fs/ext4/extents.c +22 -21
@@ -1392,13 +1392,12 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,* finds empty index and adds new leaf. * if no free index is found, then it requests in-depth growing. */ -static int ext4_ext_create_new_leaf (handle_t *handle,struct inode *inode, -unsigned int mb_flags, -unsigned int gb_flags, -struct ext4_ext_path **ppath, -struct ext4_extent *newext) +static struct ext4_ext_path * +ext4_ext_create_new_leaf (handle_t *handle,struct inode *inode, +unsigned int mb_flags,unsigned int gb_flags, +struct ext4_ext_path *path, +struct ext4_extent *newext) { -struct ext4_ext_path *path = *ppath;struct ext4_ext_path *curp;int depth, i, err =0 ;
@@ -1419,28 +1418,25 @@ static int ext4_ext_create_new_leaf(handle_t *handle, struct inode *inode,* entry: create all needed subtree and add new leaf */ err =ext4_ext_split (handle, inode, mb_flags, path, newext, i);if (err) - goto out; + goto errout;/* refill path */ path =ext4_find_extent (inode, (ext4_lblk_t )le32_to_cpu (newext->ee_block), path, gb_flags); -if (IS_ERR (path)) - err =PTR_ERR (path); +return path; }else {/* tree is full, time to grow in depth */ err =ext4_ext_grow_indepth (handle, inode, mb_flags);if (err) - goto out; + goto errout;/* refill path */ path =ext4_find_extent (inode, (ext4_lblk_t )le32_to_cpu (newext->ee_block), path, gb_flags); -if (IS_ERR (path)) { - err =PTR_ERR (path); - goto out; - } +if (IS_ERR (path)) +return path;/* * only first (depth 0 -> 1) produces free space;
@@ -1452,9 +1448,11 @@ static int ext4_ext_create_new_leaf(handle_t *handle, struct inode *inode, goto repeat; } } -out: - *ppath =IS_ERR (path) ?NULL : path; -return err; +return path; + +errout: +ext4_free_ext_path (path); +return ERR_PTR (err); }/*
@@ -2097,11 +2095,14 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,*/ if (gb_flags &EXT4_GET_BLOCKS_METADATA_NOFAIL ) mb_flags |=EXT4_MB_USE_RESERVED ; - err =ext4_ext_create_new_leaf (handle, inode, mb_flags, gb_flags, - ppath, newext); -if (err) + path =ext4_ext_create_new_leaf (handle, inode, mb_flags, gb_flags, + path, newext); +if (IS_ERR (path)) { + *ppath =NULL ; + err =PTR_ERR (path); goto cleanup; - path = *ppath; + } + *ppath = path; depth =ext_depth (inode); eh = path[depth].p_hdr;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/481 ext4: get rid of ppath in ext4_ext_insert_extent()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit f7d1331f16a869c76a5102caebb58e840e1d509c ]
The use of path and ppath is now very confusing, so to make the code more readable, pass path between functions uniformly, and get rid of ppath.
To get rid of the ppath in ext4_ext_insert_extent(), the following is done here:
* Free the extents path when an error is encountered.
* Its caller needs to update ppath if it uses ppath.
* Free path when npath is used, free npath when it is not used.
* The got_allocated_blocks label in ext4_ext_map_blocks() does not update err now, so err is updated to 0 if the err returned by ext4_ext_search_right() is greater than 0 and is about to enter got_allocated_blocks.
No functional changes.
Stable-dep-of: 22784ca541c0 ("ext4: subdivide EXT4_EXT_DATA_VALID1")
--- fs/ext4/ext4.h | 7 ++-- fs/ext4/extents.c | 88 ++++++++++++++++++++++++------------------- fs/ext4/fast_commit.c | 8 ++-- fs/ext4/migrate.c | 5 ++- 4 files changed, 61 insertions(+), 47 deletions(-)
fs/ext4/ext4.h +4 -3
@@ -3719,9 +3719,10 @@ extern int ext4_map_blocks(handle_t *handle, struct inode *inode,extern int ext4_ext_calc_credits_for_single_extent (struct inode *inode,int num,struct ext4_ext_path *path); -extern int ext4_ext_insert_extent (handle_t *,struct inode *, -struct ext4_ext_path **, -struct ext4_extent *,int ); +extern struct ext4_ext_path *ext4_ext_insert_extent ( +handle_t *handle,struct inode *inode, +struct ext4_ext_path *path, +struct ext4_extent *newext,int gb_flags);extern struct ext4_ext_path *ext4_find_extent (struct inode *,ext4_lblk_t ,struct ext4_ext_path *,int flags);
fs/ext4/extents.c +50 -38
196 lines not on this page · raw message
fs/ext4/fast_commit.c +4 -4
@@ -1828,12 +1828,12 @@ static int ext4_fc_replay_add_range(struct super_block *sb,if (ext4_ext_is_unwritten (ex))ext4_ext_mark_unwritten (&newex);down_write (&EXT4_I (inode)->i_data_sem); - ret =ext4_ext_insert_extent ( -NULL , inode, &path, &newex,0 ); + path =ext4_ext_insert_extent (NULL , inode, + path, &newex,0 );up_write ((&EXT4_I (inode)->i_data_sem)); -ext4_free_ext_path (path); -if (ret) +if (IS_ERR (path)) goto out; +ext4_free_ext_path (path); goto next; }
fs/ext4/migrate.c +3 -2
@@ -37,7 +37,6 @@ static int finish_range(handle_t *handle, struct inode *inode, path =ext4_find_extent (inode, lb->first_block,NULL ,0 );if (IS_ERR (path)) { retval =PTR_ERR (path); - path =NULL ; goto err_out; }
@@ -53,7 +52,9 @@ static int finish_range(handle_t *handle, struct inode *inode, retval =ext4_datasem_ensure_credits (handle, inode, needed, needed,0 );if (retval <0 ) goto err_out; - retval =ext4_ext_insert_extent (handle, inode, &path, &newext,0 ); + path =ext4_ext_insert_extent (handle, inode, path, &newext,0 ); +if (IS_ERR (path)) + retval =PTR_ERR (path); err_out:up_write ((&EXT4_I (inode)->i_data_sem));ext4_free_ext_path (path);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/481 ext4: get rid of ppath in ext4_split_extent_at()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 1de82b1b60d4613753254bf3cbf622a4c02c945c ]
The use of path and ppath is now very confusing, so to make the code more readable, pass path between functions uniformly, and get rid of ppath.
To get rid of the ppath in ext4_split_extent_at(), the following is done here:
* Free the extents path when an error is encountered.
* Its caller needs to update ppath if it uses ppath.
* Teach ext4_ext_show_leaf() to skip error pointer.
No functional changes.
Stable-dep-of: 22784ca541c0 ("ext4: subdivide EXT4_EXT_DATA_VALID1")
--- fs/ext4/extents.c | 85 ++++++++++++++++++++++++++--------------------- 1 file changed, 47 insertions(+), 38 deletions(-)
fs/ext4/extents.c +47 -38
@@ -84,12 +84,11 @@ static void ext4_extent_block_csum_set(struct inode *inode, et->et_checksum =ext4_extent_block_csum (inode, eh); } -static int ext4_split_extent_at (handle_t *handle, -struct inode *inode, -struct ext4_ext_path **ppath, -ext4_lblk_t split, -int split_flag, -int flags); +static struct ext4_ext_path *ext4_split_extent_at (handle_t *handle, +struct inode *inode, +struct ext4_ext_path *path, +ext4_lblk_t split, +int split_flag,int flags);static int ext4_ext_trunc_restart_fn (struct inode *inode,int *dropped) {
@@ -335,9 +334,15 @@ ext4_force_split_extent_at(handle_t *handle, struct inode *inode,if (nofail) flags |=EXT4_GET_BLOCKS_METADATA_NOFAIL |EXT4_EX_NOFAIL ; -return ext4_split_extent_at (handle, inode, ppath, lblk, unwritten ? + path =ext4_split_extent_at (handle, inode, path, lblk, unwritten ?EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 :0 , flags); +if (IS_ERR (path)) { + *ppath =NULL ; +return PTR_ERR (path); + } + *ppath = path; +return 0 ; } static int
@@ -689,7 +694,7 @@ static void ext4_ext_show_leaf(struct inode *inode, struct ext4_ext_path *path)struct ext4_extent *ex;int i; -if (!path) +if (IS_ERR_OR_NULL (path))return ; eh = path[depth].p_hdr;
@@ -3155,16 +3160,14 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)* a> the extent are splitted into two extent. * b> split is not needed, and just mark the extent. * -* return 0 on success. +* Return an extent path pointer on success, or an error pointer on failure. */ -static int ext4_split_extent_at (handle_t *handle, -struct inode *inode, -struct ext4_ext_path **ppath, -ext4_lblk_t split, -int split_flag, -int flags) +static struct ext4_ext_path *ext4_split_extent_at (handle_t *handle, +struct inode *inode, +struct ext4_ext_path *path, +ext4_lblk_t split, +int split_flag,int flags) { -struct ext4_ext_path *path = *ppath;ext4_fsblk_t newblock;ext4_lblk_t ee_block;struct ext4_extent *ex, newex, orig_ex, zero_ex;
@@ -3238,14 +3241,12 @@ static int ext4_split_extent_at(handle_t *handle,ext4_ext_mark_unwritten (ex2); path =ext4_ext_insert_extent (handle, inode, path, &newex, flags); -if (!IS_ERR (path)) { - *ppath = path; +if (!IS_ERR (path)) goto out; - } - *ppath =NULL ; + err =PTR_ERR (path);if (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM ) -return err; +return path;/* * Get a new path to try to zeroout or fix the extent length.
@@ -3255,16 +3256,14 @@ static int ext4_split_extent_at(handle_t *handle,* in ext4_da_update_reserve_space() due to an incorrect * ee_len causing the i_reserved_data_blocks exception. */ - path =ext4_find_extent (inode, ee_block,NULL , - flags |EXT4_EX_NOFAIL ); + path =ext4_find_extent (inode, ee_block,NULL , flags |EXT4_EX_NOFAIL );if (IS_ERR (path)) {EXT4_ERROR_INODE (inode,"Failed split extent on %u, err %ld" , split,PTR_ERR (path)); -return PTR_ERR (path); +return path; } depth =ext_depth (inode); ex = path[depth].p_ext; - *ppath = path;if (EXT4_EXT_MAY_ZEROOUT & split_flag) {if (split_flag & (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )) {
@@ -3316,10 +3315,13 @@ static int ext4_split_extent_at(handle_t *handle,* and err is a non-zero error code. */ ext4_ext_dirty (handle, inode, path + path->p_depth); -return err; out: +if (err) { +ext4_free_ext_path (path); + path =ERR_PTR (err); + }ext4_ext_show_leaf (inode, path); -return err; +return path; }/*
@@ -3366,10 +3368,14 @@ static int ext4_split_extent(handle_t *handle,EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) split_flag1 |=EXT4_EXT_DATA_VALID1 ; - err =ext4_split_extent_at (handle, inode, ppath, + path =ext4_split_extent_at (handle, inode, path, map->m_lblk + map->m_len, split_flag1, flags1); -if (err) +if (IS_ERR (path)) { + err =PTR_ERR (path); + *ppath =NULL ; goto out; + } + *ppath = path; }else { allocated = ee_len - (map->m_lblk - ee_block); }
@@ -3377,7 +3383,7 @@ static int ext4_split_extent(handle_t *handle,* Update path is required because previous ext4_split_extent_at() may * result in split of original leaf or extent zeroout. */ - path =ext4_find_extent (inode, map->m_lblk, *ppath, flags); + path =ext4_find_extent (inode, map->m_lblk, path, flags);if (IS_ERR (path)) { *ppath =NULL ;return PTR_ERR (path);
@@ -3399,13 +3405,17 @@ static int ext4_split_extent(handle_t *handle, split_flag1 |= split_flag & (EXT4_EXT_MAY_ZEROOUT |EXT4_EXT_MARK_UNWRIT2 ); } - err =ext4_split_extent_at (handle, inode, ppath, + path =ext4_split_extent_at (handle, inode, path, map->m_lblk, split_flag1, flags); -if (err) +if (IS_ERR (path)) { + err =PTR_ERR (path); + *ppath =NULL ; goto out; + } + *ppath = path; } -ext4_ext_show_leaf (inode, *ppath); +ext4_ext_show_leaf (inode, path); out:return err ? err : allocated; }
@@ -5601,22 +5611,21 @@ static int ext4_insert_range(struct file *file, loff_t offset, loff_t len)if (ext4_ext_is_unwritten (extent)) split_flag =EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ; - ret =ext4_split_extent_at (handle, inode, &path, + path =ext4_split_extent_at (handle, inode, path, offset_lblk, split_flag,EXT4_EX_NOCACHE |EXT4_GET_BLOCKS_PRE_IO |EXT4_GET_BLOCKS_METADATA_NOFAIL ); } -ext4_free_ext_path (path); -if (ret <0 ) { +if (IS_ERR (path)) {up_write (&EXT4_I (inode)->i_data_sem); + ret =PTR_ERR (path); goto out_stop; } - }else { -ext4_free_ext_path (path); } +ext4_free_ext_path (path);ext4_es_remove_extent (inode, offset_lblk,EXT_MAX_BLOCKS - offset_lblk);/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/481 ext4: subdivide EXT4_EXT_DATA_VALID1
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 22784ca541c0f01c5ebad14e8228298dc0a390ed ]
When splitting an extent, if the EXT4_GET_BLOCKS_CONVERT flag is set and it is necessary to split the target extent in the middle, ext4_split_extent() first handles splitting the latter half of the extent and passes the EXT4_EXT_DATA_VALID1 flag. This flag implies that all blocks before the split point contain valid data; however, this assumption is incorrect.
Therefore, subdivid EXT4_EXT_DATA_VALID1 into EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_DATA_PARTIAL_VALID1, which indicate that the first half of the extent is either entirely valid or only partially valid, respectively. These two flags cannot be set simultaneously.
This patch does not use EXT4_EXT_DATA_PARTIAL_VALID1, it only replaces EXT4_EXT_DATA_VALID1 with EXT4_EXT_DATA_ENTIRE_VALID1 at the location where it is set, no logical changes.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
fs/ext4/extents.c +12 -6
@@ -43,8 +43,13 @@#define EXT4_EXT_MARK_UNWRIT1 0x2/* mark first half unwritten */ #define EXT4_EXT_MARK_UNWRIT2 0x4/* mark second half unwritten */ -#define EXT4_EXT_DATA_VALID1 0x8/* first half contains valid data */ -#define EXT4_EXT_DATA_VALID2 0x10/* second half contains valid data */ +/* first half contains valid data */ +#define EXT4_EXT_DATA_ENTIRE_VALID1 0x8/* has entirely valid data */ +#define EXT4_EXT_DATA_PARTIAL_VALID1 0x10/* has partially valid data */ +#define EXT4_EXT_DATA_VALID1 (EXT4_EXT_DATA_ENTIRE_VALID1 | \ + EXT4_EXT_DATA_PARTIAL_VALID1) + +#define EXT4_EXT_DATA_VALID2 0x20/* second half contains valid data */ static __le32 ext4_extent_block_csum (struct inode *inode,struct ext4_extent_header *eh)
@@ -3175,8 +3180,9 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,unsigned int ee_len, depth;int err =0 ; -BUG_ON ((split_flag & (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )) == - (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )); +BUG_ON ((split_flag &EXT4_EXT_DATA_VALID1 ) ==EXT4_EXT_DATA_VALID1 ); +BUG_ON ((split_flag &EXT4_EXT_DATA_VALID1 ) && + (split_flag &EXT4_EXT_DATA_VALID2 ));/* Do not cache extents that are in the process of being modified. */ flags |=EXT4_EX_NOCACHE ;
@@ -3367,7 +3373,7 @@ static int ext4_split_extent(handle_t *handle, split_flag1 |=EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) - split_flag1 |=EXT4_EXT_DATA_VALID1 ; + split_flag1 |=EXT4_EXT_DATA_ENTIRE_VALID1 ; path =ext4_split_extent_at (handle, inode, path, map->m_lblk + map->m_len, split_flag1, flags1);if (IS_ERR (path)) {
@@ -3731,7 +3737,7 @@ static int ext4_split_convert_extents(handle_t *handle,/* Convert to unwritten */ if (flags &EXT4_GET_BLOCKS_CONVERT_UNWRITTEN ) { - split_flag |=EXT4_EXT_DATA_VALID1 ; + split_flag |=EXT4_EXT_DATA_ENTIRE_VALID1 ;/* Convert to initialized */ }else if (flags &EXT4_GET_BLOCKS_CONVERT ) { split_flag |= ee_block + ee_len <= eof_block ?
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/481 ext4: dont zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 1bf6974822d1dba86cf11b5f05498581cf3488a2 ]
When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and converting it to initialized, there is currently a potential issue of stale data if the extent needs to be split in the middle.
0 A B N
[UUUUUUUUUUUU] U: unwritten extent
[--DDDDDDDD--] D: valid data
|<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and mark the entire extent from 0 to N as written.
0 A B N
[WWWWWWWWWWWW] W: written extent
[SSDDDDDDDDZZ] Z: zeroed, S: stale data
ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left a stale written extent from 0 to A.
0 A B N
[WW|WWWWWWWWWW]
[SS|DDDDDDDDZZ]Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at() when splitting at B, don't convert the entire extent to written and left it as unwritten after zeroing out B to N. The remaining work is just like the standard two-part split. ext4_split_extent() will pass the EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the second time, allowing it to properly handle the split. If the split is successful, it will keep extent from 0 to A as unwritten.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
fs/ext4/extents.c +12 -1
@@ -3298,6 +3298,15 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle, }if (!err) { +/* +* The first half contains partially valid data, the +* splitting of this extent has not been completed, fix +* extent length and ext4_split_extent() split will the +* first half again. +*/ +if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) + goto fix_extent_len; +/* update the extent length and mark as initialized */ ex->ee_len =cpu_to_le16 (ee_len);ext4_ext_try_to_merge (handle, inode, path, ex);
@@ -3373,7 +3382,9 @@ static int ext4_split_extent(handle_t *handle, split_flag1 |=EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) - split_flag1 |=EXT4_EXT_DATA_ENTIRE_VALID1 ; + split_flag1 |= map->m_lblk > ee_block ? +EXT4_EXT_DATA_PARTIAL_VALID1 : +EXT4_EXT_DATA_ENTIRE_VALID1 ; path =ext4_split_extent_at (handle, inode, path, map->m_lblk + map->m_len, split_flag1, flags1);if (IS_ERR (path)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/481 ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 6d882ea3b0931b43530d44149b79fcd4ffc13030 ]
When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent.
Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent.
0 A B N
[UUUUUUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUUUUUUU] extent status tree
[--DDDDDDDD--] D: valid data
|<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten.
0 A B N
[UUUUUUUUUUUU] on-disk extent
[UUUUUUUUUUUU] extent status tree
[--DDDDDDDDZZ] Z: zeroed data
ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N.
0 A B N
[UUWWWWWWWWWW] on-disk extent W: written extent
[UUUUUUUUUUUU] extent status tree
[--DDDDDDDDZZ]
Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree.
0 A B N
[UUWWWWWWWWWW] on-disk extent W: written extent
[UUWWWWWWWWUU] extent status tree
[--DDDDDDDDZZ]
Fix this issue by always cached extent status entry after zeroing out the second part.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/ext4/extents.c +9 -1
@@ -3304,8 +3304,16 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,* extent length and ext4_split_extent() split will the * first half again. */ -if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) +if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) { +/* +* Drop extent cache to prevent stale unwritten +* extents remaining after zeroing out. +*/ +ext4_es_remove_extent (inode, +le32_to_cpu (zero_ex.ee_block), +ext4_ext_get_actual_len (&zero_ex)); goto fix_extent_len; + }/* update the extent length and mark as initialized */ ex->ee_len =cpu_to_le16 (ee_len);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/481 ext4: drop extent cache when splitting extent fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 79b592e8f1b435796cbc2722190368e3e8ffd7a1 ]
When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale extent entries remaining in the extent status tree. So drop all of the remaining potentially stale extents if the splitting fails.
Message-ID: <[email protected]>
--- fs/ext4/extents.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ext4/extents.c +6 -2
@@ -3252,7 +3252,7 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle, err =PTR_ERR (path);if (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM ) -return path; + goto out_path;/* * Get a new path to try to zeroout or fix the extent length.
@@ -3266,7 +3266,7 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,if (IS_ERR (path)) {EXT4_ERROR_INODE (inode,"Failed split extent on %u, err %ld" , split,PTR_ERR (path)); -return path; + goto out_path; } depth =ext_depth (inode); ex = path[depth].p_ext;
@@ -3343,6 +3343,10 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,ext4_free_ext_path (path); path =ERR_PTR (err); } +out_path: +if (IS_ERR (path)) +/* Remove all remaining potentially stale extents. */ +ext4_es_remove_extent (inode, ee_block, ee_len);ext4_ext_show_leaf (inode, path);return path; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/481 ext4: remove unnecessary e4b->bd_buddy_page check in ext4_mb_load_buddy_gfp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 285164b80175157c18a06425cf25591c9f942b1a ]
e4b->bd_buddy_page is only set if we initialize ext4_buddy successfully. So e4b->bd_buddy_page is always NULL in error handle branch. Just remove the dead check.
Stable-dep-of: bdc56a9c46b2 ("ext4: fix e4b bitmap inconsistency reports")
--- fs/ext4/mballoc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/ext4/mballoc.c +1 -2
@@ -1599,8 +1599,7 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,put_page (page);if (e4b->bd_bitmap_page)put_page (e4b->bd_bitmap_page); -if (e4b->bd_buddy_page) -put_page (e4b->bd_buddy_page); + e4b->bd_buddy =NULL ; e4b->bd_bitmap =NULL ;return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/481 ext4: convert some BUG_ONs in mballoc to use WARN_RATELIMITED instead
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
[ Upstream commit 19b8b035a776939ceb3de0f45aded4751d7849ef ]
In cases where we have an obvious way of continuing, let's use WARN_RATELIMITED() instead of BUG_ON().
Stable-dep-of: bdc56a9c46b2 ("ext4: fix e4b bitmap inconsistency reports")
--- fs/ext4/mballoc.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
fs/ext4/mballoc.c +19 -6
@@ -1531,7 +1531,13 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,put_page (page); page =find_or_create_page (inode->i_mapping, pnum, gfp);if (page) { -BUG_ON (page->mapping != inode->i_mapping); +if (WARN_RATELIMIT (page->mapping != inode->i_mapping, +"ext4: bitmap's paging->mapping != inode->i_mapping\n" )) { +/* should never happen */ +unlock_page (page); + ret = -EINVAL ; + goto err; + }if (!PageUptodate (page)) { ret =ext4_mb_init_cache (page,NULL , gfp);if (ret) {
@@ -1567,7 +1573,13 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,put_page (page); page =find_or_create_page (inode->i_mapping, pnum, gfp);if (page) { -BUG_ON (page->mapping != inode->i_mapping); +if (WARN_RATELIMIT (page->mapping != inode->i_mapping, +"ext4: buddy bitmap's page->mapping != inode->i_mapping\n" )) { +/* should never happen */ +unlock_page (page); + ret = -EINVAL ; + goto err; + }if (!PageUptodate (page)) { ret =ext4_mb_init_cache (page, e4b->bd_bitmap, gfp);
@@ -2286,7 +2298,9 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,continue ; buddy =mb_find_buddy (e4b, i, &max); -BUG_ON (buddy ==NULL ); +if (WARN_RATELIMIT (buddy ==NULL , +"ext4: mb_simple_scan_group: mb_find_buddy failed, (%d)\n" , i)) +continue ; k =mb_find_next_zero_bit (buddy, max,0 );if (k >= max) {
@@ -4312,15 +4326,14 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)if (ac->ac_f_ex.fe_len ==0 )return ; err =ext4_mb_load_buddy (ac->ac_sb, ac->ac_f_ex.fe_group, &e4b); -if (err) { +if (WARN_RATELIMIT (err, +"ext4: mb_load_buddy failed (%d)" , err))/* * This should never happen since we pin the * pages in the ext4_allocation_context so * ext4_mb_load_buddy() should never fail. */ -WARN (1 ,"mb_load_buddy failed (%d)" , err);return ; - }ext4_lock_group (ac->ac_sb, ac->ac_f_ex.fe_group);mb_free_blocks (ac->ac_inode, &e4b, ac->ac_f_ex.fe_start, ac->ac_f_ex.fe_len);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/481 ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gou Hao <[email protected]>
[ Upstream commit f2fec3e99a32d7c14dbf63c824f8286ebc94b18d ]
'blocks_per_page' is always 1 after 'if (blocks_per_page >= 2)', 'pnum' and 'block' are equal in this case.
Stable-dep-of: bdc56a9c46b2 ("ext4: fix e4b bitmap inconsistency reports")
--- fs/ext4/mballoc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/ext4/mballoc.c +2 -3
@@ -1370,9 +1370,8 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,return 0 ; } - block++; - pnum = block / blocks_per_page; - page =find_or_create_page (inode->i_mapping, pnum, gfp); +/* blocks_per_page == 1, hence we need another page for the buddy */ + page =find_or_create_page (inode->i_mapping, block +1 , gfp);if (!page)return -ENOMEM ;BUG_ON (page->mapping != inode->i_mapping);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/481 ext4: convert bd_bitmap_page to bd_bitmap_folio
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 99b150d84e4939735cfce245e32e3d29312c68ec ]
There is no need to make this a multi-page folio, so leave all the infrastructure around it in pages. But since we're locking it, playing with its refcount and checking whether it's uptodate, it needs to move to the folio API.
Stable-dep-of: bdc56a9c46b2 ("ext4: fix e4b bitmap inconsistency reports")
--- fs/ext4/mballoc.c | 98 ++++++++++++++++++++++++----------------------- fs/ext4/mballoc.h | 2 +- 2 files changed, 52 insertions(+), 48 deletions(-)
fs/ext4/mballoc.c +51 -47
@@ -1345,9 +1345,10 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,int block, pnum, poff;int blocks_per_page;struct page *page; +struct folio *folio; e4b->bd_buddy_page =NULL ; - e4b->bd_bitmap_page =NULL ; + e4b->bd_bitmap_folio =NULL ; blocks_per_page =PAGE_SIZE / sb->s_blocksize;/*
@@ -1358,12 +1359,13 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb, block = group *2 ; pnum = block / blocks_per_page; poff = block % blocks_per_page; - page =find_or_create_page (inode->i_mapping, pnum, gfp); -if (!page) -return -ENOMEM ; -BUG_ON (page->mapping != inode->i_mapping); - e4b->bd_bitmap_page = page; - e4b->bd_bitmap =page_address (page) + (poff * sb->s_blocksize); + folio =__filemap_get_folio (inode->i_mapping, pnum, +FGP_LOCK |FGP_ACCESSED |FGP_CREAT , gfp); +if (IS_ERR (folio)) +return PTR_ERR (folio); +BUG_ON (folio->mapping != inode->i_mapping); + e4b->bd_bitmap_folio = folio; + e4b->bd_bitmap =folio_address (folio) + (poff * sb->s_blocksize);if (blocks_per_page >=2 ) {/* buddy and bitmap are on the same page */
@@ -1381,9 +1383,9 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,static void ext4_mb_put_buddy_page_lock (struct ext4_buddy *e4b) { -if (e4b->bd_bitmap_page) { -unlock_page (e4b->bd_bitmap_page); -put_page (e4b->bd_bitmap_page); +if (e4b->bd_bitmap_folio) { +folio_unlock (e4b->bd_bitmap_folio); +folio_put (e4b->bd_bitmap_folio); }if (e4b->bd_buddy_page) {unlock_page (e4b->bd_buddy_page);
@@ -1403,6 +1405,7 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group, gfp_t gfp)struct ext4_group_info *this_grp;struct ext4_buddy e4b;struct page *page; +struct folio *folio;int ret =0 ;might_sleep ();
@@ -1429,11 +1432,11 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group, gfp_t gfp) goto err; } - page = e4b.bd_bitmap_page; - ret =ext4_mb_init_cache (page,NULL , gfp); + folio = e4b.bd_bitmap_folio; + ret =ext4_mb_init_cache (&folio->page,NULL , gfp);if (ret) goto err; -if (!PageUptodate (page)) { +if (!folio_test_uptodate (folio)) { ret = -EIO ; goto err; }
@@ -1475,6 +1478,7 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,int pnum;int poff;struct page *page; +struct folio *folio;int ret;struct ext4_group_info *grp;struct ext4_sb_info *sbi =EXT4_SB (sb);
@@ -1493,7 +1497,7 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group, e4b->bd_sb = sb; e4b->bd_group = group; e4b->bd_buddy_page =NULL ; - e4b->bd_bitmap_page =NULL ; + e4b->bd_bitmap_folio =NULL ;if (unlikely (EXT4_MB_GRP_NEED_INIT (grp))) {/*
@@ -1514,53 +1518,53 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group, pnum = block / blocks_per_page; poff = block % blocks_per_page; -/* we could use find_or_create_page(), but it locks page -* what we'd like to avoid in fast path ... */ - page =find_get_page_flags (inode->i_mapping, pnum,FGP_ACCESSED ); -if (page ==NULL || !PageUptodate (page)) { -if (page) +/* Avoid locking the folio in the fast path ... */ + folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_ACCESSED ,0 ); +if (IS_ERR (folio) || !folio_test_uptodate (folio)) { +if (!IS_ERR (folio))/* -* drop the page reference and try -* to get the page with lock. If we +* drop the folio reference and try +* to get the folio with lock. If we * are not uptodate that implies -* somebody just created the page but -* is yet to initialize the same. So +* somebody just created the folio but +* is yet to initialize it. So * wait for it to initialize. */ -put_page (page); - page =find_or_create_page (inode->i_mapping, pnum, gfp); -if (page) { -if (WARN_RATELIMIT (page->mapping != inode->i_mapping, -"ext4: bitmap's paging->mapping != inode->i_mapping\n" )) { +folio_put (folio); + folio =__filemap_get_folio (inode->i_mapping, pnum, +FGP_LOCK |FGP_ACCESSED |FGP_CREAT , gfp); +if (!IS_ERR (folio)) { +if (WARN_RATELIMIT (folio->mapping != inode->i_mapping, +"ext4: bitmap's mapping != inode->i_mapping\n" )) {/* should never happen */ -unlock_page (page); +folio_unlock (folio); ret = -EINVAL ; goto err; } -if (!PageUptodate (page)) { - ret =ext4_mb_init_cache (page,NULL , gfp); +if (!folio_test_uptodate (folio)) { + ret =ext4_mb_init_cache (&folio->page,NULL , gfp);if (ret) { -unlock_page (page); +folio_unlock (folio); goto err; } -mb_cmp_bitmaps (e4b,page_address (page) + +mb_cmp_bitmaps (e4b,folio_address (folio) + (poff * sb->s_blocksize)); } -unlock_page (page); +folio_unlock (folio); } } -if (page ==NULL ) { - ret = -ENOMEM ; +if (IS_ERR (folio)) { + ret =PTR_ERR (folio); goto err; } -if (!PageUptodate (page)) { +if (!folio_test_uptodate (folio)) { ret = -EIO ; goto err; }/* Pages marked accessed already */ - e4b->bd_bitmap_page = page; - e4b->bd_bitmap =page_address (page) + (poff * sb->s_blocksize); + e4b->bd_bitmap_folio = folio; + e4b->bd_bitmap =folio_address (folio) + (poff * sb->s_blocksize); block++; pnum = block / blocks_per_page;
@@ -1608,8 +1612,8 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group, err:if (page)put_page (page); -if (e4b->bd_bitmap_page) -put_page (e4b->bd_bitmap_page); +if (e4b->bd_bitmap_folio) +folio_put (e4b->bd_bitmap_folio); e4b->bd_buddy =NULL ; e4b->bd_bitmap =NULL ;
@@ -1624,8 +1628,8 @@ static int ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,static void ext4_mb_unload_buddy (struct ext4_buddy *e4b) { -if (e4b->bd_bitmap_page) -put_page (e4b->bd_bitmap_page); +if (e4b->bd_bitmap_folio) +folio_put (e4b->bd_bitmap_folio);if (e4b->bd_buddy_page)put_page (e4b->bd_buddy_page); }
@@ -2050,7 +2054,7 @@ static void ext4_mb_use_best_found(struct ext4_allocation_context *ac,* double allocate blocks. The reference is dropped * in ext4_mb_release_context */ - ac->ac_bitmap_page = e4b->bd_bitmap_page; + ac->ac_bitmap_page = &e4b->bd_bitmap_folio->page;get_page (ac->ac_bitmap_page); ac->ac_buddy_page = e4b->bd_buddy_page;get_page (ac->ac_buddy_page);
@@ -3715,7 +3719,7 @@ static void ext4_free_data_in_buddy(struct super_block *sb,* balance refcounts from ext4_mb_free_metadata() */ put_page (e4b.bd_buddy_page); -put_page (e4b.bd_bitmap_page); +folio_put (e4b.bd_bitmap_folio); }ext4_unlock_group (sb, entry->efd_group);ext4_mb_unload_buddy (&e4b);
@@ -5888,7 +5892,7 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,struct rb_node *parent =NULL , *new_node;BUG_ON (!ext4_handle_valid (handle)); -BUG_ON (e4b->bd_bitmap_page ==NULL ); +BUG_ON (e4b->bd_bitmap_folio ==NULL );BUG_ON (e4b->bd_buddy_page ==NULL ); new_node = &new_entry->efd_node;
@@ -5901,7 +5905,7 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,* on-disk bitmap and lose not-yet-available * blocks */ get_page (e4b->bd_buddy_page); -get_page (e4b->bd_bitmap_page); +folio_get (e4b->bd_bitmap_folio); }while (*n) { parent = *n;
fs/ext4/mballoc.h +1 -1
@@ -203,7 +203,7 @@ struct ext4_allocation_context {struct ext4_buddy {struct page *bd_buddy_page;void *bd_buddy; -struct page *bd_bitmap_page; +struct folio *bd_bitmap_folio;void *bd_bitmap;struct ext4_group_info *bd_info;struct super_block *bd_sb;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/481 ext4: convert bd_buddy_page to bd_buddy_folio
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 5eea586b47f05b5f5518cf8f9dd9283a01a8066d ]
There is no need to make this a multi-page folio, so leave all the infrastructure around it in pages. But since we're locking it, playing with its refcount and checking whether it's uptodate, it needs to move to the folio API.
Stable-dep-of: bdc56a9c46b2 ("ext4: fix e4b bitmap inconsistency reports")
--- fs/ext4/mballoc.c | 91 +++++++++++++++++++++++------------------------ fs/ext4/mballoc.h | 2 +- 2 files changed, 46 insertions(+), 47 deletions(-)
fs/ext4/mballoc.c +45 -46
@@ -1336,7 +1336,7 @@ static int ext4_mb_init_cache(struct page *page, char *incore, gfp_t gfp)* Lock the buddy and bitmap pages. This make sure other parallel init_group * on the same buddy page doesn't happen whild holding the buddy page lock. * Return locked buddy and bitmap pages on e4b struct. If buddy and bitmap -* are on the same page e4b->bd_buddy_page is NULL and return value is 0. +* are on the same page e4b->bd_buddy_folio is NULL and return value is 0. */ static int ext4_mb_get_buddy_page_lock (struct super_block *sb,ext4_group_t group,struct ext4_buddy *e4b,gfp_t gfp)
@@ -1344,10 +1344,9 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,struct inode *inode =EXT4_SB (sb)->s_buddy_cache;int block, pnum, poff;int blocks_per_page; -struct page *page;struct folio *folio; - e4b->bd_buddy_page =NULL ; + e4b->bd_buddy_folio =NULL ; e4b->bd_bitmap_folio =NULL ; blocks_per_page =PAGE_SIZE / sb->s_blocksize;
@@ -1373,11 +1372,12 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb, }/* blocks_per_page == 1, hence we need another page for the buddy */ - page =find_or_create_page (inode->i_mapping, block +1 , gfp); -if (!page) -return -ENOMEM ; -BUG_ON (page->mapping != inode->i_mapping); - e4b->bd_buddy_page = page; + folio =__filemap_get_folio (inode->i_mapping, block +1 , +FGP_LOCK |FGP_ACCESSED |FGP_CREAT , gfp); +if (IS_ERR (folio)) +return PTR_ERR (folio); +BUG_ON (folio->mapping != inode->i_mapping); + e4b->bd_buddy_folio = folio;return 0 ; }
@@ -1387,9 +1387,9 @@ static void ext4_mb_put_buddy_page_lock(struct ext4_buddy *e4b)folio_unlock (e4b->bd_bitmap_folio);folio_put (e4b->bd_bitmap_folio); } -if (e4b->bd_buddy_page) { -unlock_page (e4b->bd_buddy_page); -put_page (e4b->bd_buddy_page); +if (e4b->bd_buddy_folio) { +folio_unlock (e4b->bd_buddy_folio); +folio_put (e4b->bd_buddy_folio); } }
@@ -1404,7 +1404,6 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group, gfp_t gfp)struct ext4_group_info *this_grp;struct ext4_buddy e4b; -struct page *page;struct folio *folio;int ret =0 ;
@@ -1441,7 +1440,7 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group, gfp_t gfp) goto err; } -if (e4b.bd_buddy_page ==NULL ) { +if (e4b.bd_buddy_folio ==NULL ) {/* * If both the bitmap and buddy are in * the same page we don't need to force
@@ -1451,11 +1450,11 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group, gfp_t gfp) goto err; }/* init buddy cache */ - page = e4b.bd_buddy_page; - ret =ext4_mb_init_cache (page, e4b.bd_bitmap, gfp); + folio = e4b.bd_buddy_folio; + ret =ext4_mb_init_cache (&folio->page, e4b.bd_bitmap, gfp);if (ret) goto err; -if (!PageUptodate (page)) { +if (!folio_test_uptodate (folio)) { ret = -EIO ; goto err; }
@@ -1477,7 +1476,6 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,int block;int pnum;int poff; -struct page *page;struct folio *folio;int ret;struct ext4_group_info *grp;
@@ -1496,7 +1494,7 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group, e4b->bd_info = grp; e4b->bd_sb = sb; e4b->bd_group = group; - e4b->bd_buddy_page =NULL ; + e4b->bd_buddy_folio =NULL ; e4b->bd_bitmap_folio =NULL ;if (unlikely (EXT4_MB_GRP_NEED_INIT (grp))) {
@@ -1562,7 +1560,7 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group, goto err; } -/* Pages marked accessed already */ +/* Folios marked accessed already */ e4b->bd_bitmap_folio = folio; e4b->bd_bitmap =folio_address (folio) + (poff * sb->s_blocksize);
@@ -1570,48 +1568,49 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group, pnum = block / blocks_per_page; poff = block % blocks_per_page; - page =find_get_page_flags (inode->i_mapping, pnum,FGP_ACCESSED ); -if (page ==NULL || !PageUptodate (page)) { -if (page) -put_page (page); - page =find_or_create_page (inode->i_mapping, pnum, gfp); -if (page) { -if (WARN_RATELIMIT (page->mapping != inode->i_mapping, -"ext4: buddy bitmap's page->mapping != inode->i_mapping\n" )) { + folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_ACCESSED ,0 ); +if (IS_ERR (folio) || !folio_test_uptodate (folio)) { +if (!IS_ERR (folio)) +folio_put (folio); + folio =__filemap_get_folio (inode->i_mapping, pnum, +FGP_LOCK |FGP_ACCESSED |FGP_CREAT , gfp); +if (!IS_ERR (folio)) { +if (WARN_RATELIMIT (folio->mapping != inode->i_mapping, +"ext4: buddy bitmap's mapping != inode->i_mapping\n" )) {/* should never happen */ -unlock_page (page); +folio_unlock (folio); ret = -EINVAL ; goto err; } -if (!PageUptodate (page)) { - ret =ext4_mb_init_cache (page, e4b->bd_bitmap, +if (!folio_test_uptodate (folio)) { + ret =ext4_mb_init_cache (&folio->page, e4b->bd_bitmap, gfp);if (ret) { -unlock_page (page); +folio_unlock (folio); goto err; } } -unlock_page (page); +folio_unlock (folio); } } -if (page ==NULL ) { - ret = -ENOMEM ; +if (IS_ERR (folio)) { + ret =PTR_ERR (folio); goto err; } -if (!PageUptodate (page)) { +if (!folio_test_uptodate (folio)) { ret = -EIO ; goto err; } -/* Pages marked accessed already */ - e4b->bd_buddy_page = page; - e4b->bd_buddy =page_address (page) + (poff * sb->s_blocksize); +/* Folios marked accessed already */ + e4b->bd_buddy_folio = folio; + e4b->bd_buddy =folio_address (folio) + (poff * sb->s_blocksize);return 0 ; err: -if (page) -put_page (page); +if (folio) +folio_put (folio);if (e4b->bd_bitmap_folio)folio_put (e4b->bd_bitmap_folio);
@@ -1630,8 +1629,8 @@ static void ext4_mb_unload_buddy(struct ext4_buddy *e4b) {if (e4b->bd_bitmap_folio)folio_put (e4b->bd_bitmap_folio); -if (e4b->bd_buddy_page) -put_page (e4b->bd_buddy_page); +if (e4b->bd_buddy_folio) +folio_put (e4b->bd_buddy_folio); }
@@ -2056,7 +2055,7 @@ static void ext4_mb_use_best_found(struct ext4_allocation_context *ac,*/ ac->ac_bitmap_page = &e4b->bd_bitmap_folio->page;get_page (ac->ac_bitmap_page); - ac->ac_buddy_page = e4b->bd_buddy_page; + ac->ac_buddy_page = &e4b->bd_buddy_folio->page;get_page (ac->ac_buddy_page);/* store last allocated for subsequent stream allocation */ if (ac->ac_flags &EXT4_MB_STREAM_ALLOC ) {
@@ -3718,7 +3717,7 @@ static void ext4_free_data_in_buddy(struct super_block *sb,/* No more items in the per group rb tree * balance refcounts from ext4_mb_free_metadata() */ -put_page (e4b.bd_buddy_page); +folio_put (e4b.bd_buddy_folio);folio_put (e4b.bd_bitmap_folio); }ext4_unlock_group (sb, entry->efd_group);
@@ -5893,7 +5892,7 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,BUG_ON (!ext4_handle_valid (handle));BUG_ON (e4b->bd_bitmap_folio ==NULL ); -BUG_ON (e4b->bd_buddy_page ==NULL ); +BUG_ON (e4b->bd_buddy_folio ==NULL ); new_node = &new_entry->efd_node; cluster = new_entry->efd_start_cluster;
@@ -5904,7 +5903,7 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,* otherwise we'll refresh it from * on-disk bitmap and lose not-yet-available * blocks */ -get_page (e4b->bd_buddy_page); +folio_get (e4b->bd_buddy_folio);folio_get (e4b->bd_bitmap_folio); }while (*n) {
fs/ext4/mballoc.h +1 -1
@@ -201,7 +201,7 @@ struct ext4_allocation_context {#define AC_STATUS_BREAK 3struct ext4_buddy { -struct page *bd_buddy_page; +struct folio *bd_buddy_folio;void *bd_buddy;struct folio *bd_bitmap_folio;void *bd_bitmap;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/481 ext4: fix e4b bitmap inconsistency reports
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Sun <[email protected]>
[ Upstream commit bdc56a9c46b2a99c12313122b9352b619a2e719e ]
A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bitmap check failures like:
ext4_mb_complex_scan_group:2508: group 350, 8179 free clusters as per group info. But got 8192 blocks
Analysis and experimentation confirmed that the issue is caused by a race condition between page migration and bitmap modification. Although this timing window is extremely narrow, it is still hit in practice:
folio_lock ext4_mb_load_buddy__migrate_folio
check ref count
folio_mc_copy __filemap_get_folio
folio_try_get(folio)
......
mb_mark_used
ext4_mb_unload_buddy __folio_migrate_mapping
folio_ref_freezefolio_unlock
The root cause of this issue is that the fast path of load_buddy only increments the folio's reference count, which is insufficient to prevent concurrent folio migration. We observed that the folio migration process acquires the folio lock. Therefore, we can determine whether to take the fast path in load_buddy by checking the lock status. If the folio is locked, we opt for the slow path (which acquires the lock) to close this concurrency window.
Additionally, this change addresses the following issues:
When the DOUBLE_CHECK macro is enabled to inspect bitmap-related issues, the following error may be triggered:
corruption in group 324 at byte 784(6272): f in copy != ff on disk/prealloc
Analysis reveals that this is a false positive. There is a specific race window where the bitmap and the group descriptor become momentarily inconsistent, leading to this error report:
ext4_mb_load_buddy ext4_mb_load_buddy
__filemap_get_folio(create|lock)
folio_lock
ext4_mb_init_cache
folio_mark_uptodate
__filemap_get_folio(no lock)
......
mb_mark_used
mb_mark_used_double
mb_cmp_bitmaps
mb_set_bits(e4b->bd_bitmap) folio_unlock
The original logic assumed that since mb_cmp_bitmaps is called when the bitmap is newly loaded from disk, the folio lock would be sufficient to prevent concurrent access. However, this overlooks a specific race
condition: if another process attempts to load buddy and finds the folio is already in an uptodate state, it will immediately begin using it without holding folio lock.
--- fs/ext4/mballoc.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
fs/ext4/mballoc.c +11 -10
@@ -1518,16 +1518,17 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,/* Avoid locking the folio in the fast path ... */ folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_ACCESSED ,0 ); -if (IS_ERR (folio) || !folio_test_uptodate (folio)) { +if (IS_ERR (folio) || !folio_test_uptodate (folio) ||folio_test_locked (folio)) { +/* +* folio_test_locked is employed to detect ongoing folio +* migrations, since concurrent migrations can lead to +* bitmap inconsistency. And if we are not uptodate that +* implies somebody just created the folio but is yet to +* initialize it. We can drop the folio reference and +* try to get the folio with lock in both cases to avoid +* concurrency. +*/ if (!IS_ERR (folio)) -/* -* drop the folio reference and try -* to get the folio with lock. If we -* are not uptodate that implies -* somebody just created the folio but -* is yet to initialize it. So -* wait for it to initialize. -*/ folio_put (folio); folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_LOCK |FGP_ACCESSED |FGP_CREAT , gfp);
@@ -1569,7 +1570,7 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group, poff = block % blocks_per_page; folio =__filemap_get_folio (inode->i_mapping, pnum,FGP_ACCESSED ,0 ); -if (IS_ERR (folio) || !folio_test_uptodate (folio)) { +if (IS_ERR (folio) || !folio_test_uptodate (folio) ||folio_test_locked (folio)) {if (!IS_ERR (folio))folio_put (folio); folio = __filemap_get_folio(inode->i_mapping, pnum,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/481 mfd: qcom-pm8xxx: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 19ea1d3953017518d85db35b69b5aea9bc64d630 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 27a8acea47a9 ("mfd: qcom-pm8xxx: Fix OF populate on driver rebind")
--- drivers/mfd/qcom-pm8xxx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mfd/qcom-pm8xxx.c +2 -4
@@ -587,19 +587,17 @@ static int pm8xxx_remove_child(struct device *dev, void *unused)return 0 ; } -static int pm8xxx_remove (struct platform_device *pdev) +static void pm8xxx_remove (struct platform_device *pdev) {struct pm_irq_chip *chip =platform_get_drvdata (pdev);device_for_each_child (&pdev->dev,NULL , pm8xxx_remove_child);irq_domain_remove (chip->irqdomain); - -return 0 ; }static struct platform_driver pm8xxx_driver = { .probe = pm8xxx_probe, - .remove = pm8xxx_remove, + .remove_new = pm8xxx_remove, .driver = { .name ="pm8xxx-core" , .of_match_table = pm8xxx_id_table,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/481 mfd: qcom-pm8xxx: Fix OF populate on driver rebind
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 27a8acea47a93fea6ad0e2df4c20a9b51490e4d9 ]
Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound.
--- drivers/mfd/qcom-pm8xxx.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/mfd/qcom-pm8xxx.c +1 -7
@@ -581,17 +581,11 @@ static int pm8xxx_probe(struct platform_device *pdev)return rc; } -static int pm8xxx_remove_child (struct device *dev,void *unused) -{ -platform_device_unregister (to_platform_device (dev)); -return 0 ; -} -static void pm8xxx_remove (struct platform_device *pdev) {struct pm_irq_chip *chip =platform_get_drvdata (pdev); -device_for_each_child (&pdev->dev,NULL , pm8xxx_remove_child); +of_platform_depopulate (&pdev->dev);irq_domain_remove (chip->irqdomain); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/481 mfd: omap-usb-host: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 418d1e74f8597e0b2d5d0d6e1be8f1f47e68f0a4 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 24804ba508a3 ("mfd: omap-usb-host: Fix OF populate on driver rebind")
--- drivers/mfd/omap-usb-host.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/mfd/omap-usb-host.c +2 -3
@@ -818,13 +818,12 @@ static int usbhs_omap_remove_child(struct device *dev, void *data)* * Reverses the effect of usbhs_omap_probe(). */ -static int usbhs_omap_remove (struct platform_device *pdev) +static void usbhs_omap_remove (struct platform_device *pdev) {pm_runtime_disable (&pdev->dev);/* remove children */ device_for_each_child (&pdev->dev,NULL , usbhs_omap_remove_child); -return 0 ; }static const struct dev_pm_ops usbhsomap_dev_pm_ops = {
@@ -847,7 +846,7 @@ static struct platform_driver usbhs_omap_driver = { .of_match_table = usbhs_omap_dt_ids, }, .probe = usbhs_omap_probe, - .remove = usbhs_omap_remove, + .remove_new = usbhs_omap_remove, };MODULE_AUTHOR ("Keshava Munegowda <[email protected]>" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/481 mfd: omap-usb-host: Fix OF populate on driver rebind
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 24804ba508a3e240501c521685a1c4eb9f574f8e ]
Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound.
--- drivers/mfd/omap-usb-host.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/mfd/omap-usb-host.c +4 -2
@@ -822,8 +822,10 @@ static void usbhs_omap_remove(struct platform_device *pdev) {pm_runtime_disable (&pdev->dev); -/* remove children */ -device_for_each_child (&pdev->dev,NULL , usbhs_omap_remove_child); +if (pdev->dev.of_node) +of_platform_depopulate (&pdev->dev); +else +device_for_each_child (&pdev->dev,NULL , usbhs_omap_remove_child); }static const struct dev_pm_ops usbhsomap_dev_pm_ops = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/481 arm64: dts: rockchip: Fix rk356x PCIe range mappings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
[ Upstream commit f63ea193a404481f080ca2958f73e9f364682db9 ]
The pcie bus address should be mapped 1:1 to the cpu side MMIO address, so that there is no same address allocated from normal system memory. Otherwise it's broken if the same address assigned to the EP for DMA purpose.Fix it to sync with the vendor BSP.
--- arch/arm64/boot/dts/rockchip/rk3568.dtsi | 4 ++-- arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/rockchip/rk3568.dtsi +2 -2
@@ -97,7 +97,7 @@ pcie3x1: pcie@fe270000 { <0x0 0xf2000000 0x0 0x00100000>; ranges = <0x01000000 0x0 0xf2100000 0x0 0xf2100000 0x0 0x00100000>, <0x02000000 0x0 0xf2200000 0x0 0xf2200000 0x0 0x01e00000>, - <0x03000000 0x0 0x40000000 0x3 0x40000000 0x0 0x40000000>; + <0x03000000 0x3 0x40000000 0x3 0x40000000 0x0 0x40000000>; reg-names = "dbi", "apb", "config"; resets = <&cru SRST_PCIE30X1_POWERUP>; reset-names = "pipe";
@@ -150,7 +150,7 @@ pcie3x2: pcie@fe280000 { <0x0 0xf0000000 0x0 0x00100000>; ranges = <0x01000000 0x0 0xf0100000 0x0 0xf0100000 0x0 0x00100000>, <0x02000000 0x0 0xf0200000 0x0 0xf0200000 0x0 0x01e00000>, - <0x03000000 0x0 0x40000000 0x3 0x80000000 0x0 0x40000000>; + <0x03000000 0x3 0x80000000 0x3 0x80000000 0x0 0x40000000>; reg-names = "dbi", "apb", "config"; resets = <&cru SRST_PCIE30X2_POWERUP>; reset-names = "pipe";
arch/arm64/boot/dts/rockchip/rk356x.dtsi +1 -1
@@ -985,7 +985,7 @@ pcie2x1: pcie@fe260000 { power-domains = <&power RK3568_PD_PIPE>; ranges = <0x01000000 0x0 0xf4100000 0x0 0xf4100000 0x0 0x00100000>, <0x02000000 0x0 0xf4200000 0x0 0xf4200000 0x0 0x01e00000>, - <0x03000000 0x0 0x40000000 0x3 0x00000000 0x0 0x40000000>; + <0x03000000 0x3 0x00000000 0x3 0x00000000 0x0 0x40000000>; resets = <&cru SRST_PCIE20_POWERUP>; reset-names = "pipe"; #address-cells = <3>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/481 clk: tegra: tegra124-emc: fix device leak on set_rate()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit da61439c63d34ae6503d080a847f144d587e3a48 ]
Make sure to drop the reference taken when looking up the EMC device and its driver data on first set_rate().
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/clk/tegra/clk-tegra124-emc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/tegra/clk-tegra124-emc.c +1 -1
@@ -197,8 +197,8 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra) tegra->emc_node =NULL ; tegra->emc =platform_get_drvdata (pdev); +put_device (&pdev->dev);if (!tegra->emc) { -put_device (&pdev->dev);pr_err ("%s: cannot find EMC driver\n" , __func__);return NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/481 usb: cdns3: remove redundant if branch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyu Xie <[email protected]>
[ Upstream commit dedab674428f8a99468a4864c067128ba9ea83a6 ]
cdns->role_sw->dev->driver_data gets set in routines showing below, cdns_init
sw_desc.driver_data = cdns;
cdns->role_sw = usb_role_switch_register(dev, &sw_desc);
dev_set_drvdata(&sw->dev, desc->driver_data);In cdns_resume,cdns->role = cdns_role_get(cdns->role_sw); //line redundant
struct cdns *cdns = usb_role_switch_get_drvdata(sw);
dev_get_drvdata(&sw->dev)
return dev->driver_datareturn cdns->role;
"line redundant" equals to,
cdns->role = cdns->role;
So fix this if branch.
Stable-dep-of: 87e4b043b98a ("usb: cdns3: fix role switching during resume")
--- drivers/usb/cdns3/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/usb/cdns3/core.c +1 -3
@@ -528,9 +528,7 @@ int cdns_resume(struct cdns *cdns)int ret =0 ;if (cdns_power_is_lost (cdns)) { -if (cdns->role_sw) { - cdns->role =cdns_role_get (cdns->role_sw); - }else { +if (!cdns->role_sw) { real_role =cdns_hw_role_state_machine (cdns);if (real_role != cdns->role) { ret =cdns_hw_role_switch (cdns);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/481 usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <[email protected]>
[ Upstream commit 17c6526b333cfd89a4c888a6f7c876c8c326e5ae ]
cdns_power_is_lost() does a register read.
Call it only once rather than twice.
Stable-dep-of: 87e4b043b98a ("usb: cdns3: fix role switching during resume")
--- drivers/usb/cdns3/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/cdns3/core.c +3 -2
@@ -523,11 +523,12 @@ EXPORT_SYMBOL_GPL(cdns_suspend);int cdns_resume (struct cdns *cdns) { +bool power_lost =cdns_power_is_lost (cdns);enum usb_role real_role;bool role_changed = false;int ret =0 ; -if (cdns_power_is_lost (cdns)) { +if (power_lost) {if (!cdns->role_sw) { real_role =cdns_hw_role_state_machine (cdns);if (real_role != cdns->role) {
@@ -550,7 +551,7 @@ int cdns_resume(struct cdns *cdns) }if (cdns->roles[cdns->role]->resume) - cdns->roles[cdns->role]->resume (cdns,cdns_power_is_lost (cdns)); + cdns->roles[cdns->role]->resume (cdns, power_lost);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/481 usb: cdns3: fix role switching during resume
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richard (TI) <[email protected]>
[ Upstream commit 87e4b043b98a1d269be0b812f383881abee0ca45 ]
If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference.
The host role's start() operation registers a xhci-hcd device, but its probe is deferred while we are in the resume path. The host role's resume() operation assumes the xhci-hcd device is already probed, which is not the case, leading to the dereference. Since the start() operation of the new role is already called, the resume operation can be skipped.
So skip the resume operation for the new role if a role switch occurs during resume. Once the resume sequence is complete, the xhci-hcd device can be probed in case of host mode.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208
Mem abort info:
...
Data abort info:
...
[0000000000000208] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted 6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT Hardware name: Texas Instruments J7200 EVM (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_hcd_is_primary_hcd+0x0/0x1c lr : cdns_host_resume+0x24/0x5c ... Call trace: usb_hcd_is_primary_hcd+0x0/0x1c (P) cdns_resume+0x6c/0xbc cdns3_controller_resume.isra.0+0xe8/0x17c cdns3_plat_resume+0x18/0x24 platform_pm_resume+0x2c/0x68 dpm_run_callback+0x90/0x248 device_resume+0x100/0x24c dpm_resume+0x190/0x2ec dpm_resume_end+0x18/0x34 suspend_devices_and_enter+0x2b0/0xa44 pm_suspend+0x16c/0x5fc state_store+0x80/0xec kobj_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x130/0x1dc vfs_write+0x240/0x370 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0x108 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401) ---[ end trace 0000000000000000 ]---
--- drivers/usb/cdns3/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/cdns3/core.c +1 -1
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns) } } -if (cdns->roles[cdns->role]->resume) +if (!role_changed && cdns->roles[cdns->role]->resume) cdns->roles[cdns->role]->resume (cdns, power_lost);return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/481 ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1585cf83e98db32463e5d54161b06a5f01fe9976 ]
It was reported that we need the same quirk for HP ZBook Studio G4 (SSID 103c:826b) as other HP models to make the mute-LED working.
--- sound/pci/hda/patch_conexant.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_conexant.c +1 -0
@@ -1099,6 +1099,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {SND_PCI_QUIRK (0x103c ,0x8174 ,"HP Spectre x360" ,CXT_FIXUP_HP_SPECTRE ),SND_PCI_QUIRK (0x103c ,0x822e ,"HP ProBook 440 G4" ,CXT_FIXUP_MUTE_LED_GPIO ),SND_PCI_QUIRK (0x103c ,0x8231 ,"HP ProBook 450 G4" ,CXT_FIXUP_MUTE_LED_GPIO ), +SND_PCI_QUIRK (0x103c ,0x826b ,"HP ZBook Studio G4" ,CXT_FIXUP_MUTE_LED_GPIO ),SND_PCI_QUIRK (0x103c ,0x828c ,"HP EliteBook 840 G4" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x8299 ,"HP 800 G3 SFF" ,CXT_FIXUP_HP_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/481 hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
[ Upstream commit 007be4327e443d79c9dd9e56dc16c36f6395d208 ]
Simply copying shared data to a local variable cannot prevent data races. The compiler is allowed to optimize away the local copy and re-read the shared memory, causing a Time-of-Check Time-of-Use (TOCTOU) issue if the data changes between the check and the usage.
To enforce the use of the local variable, use READ_ONCE() when reading the shared data and WRITE_ONCE() when updating it. Apply these macros to the three identified locations (curr_sense, adc, and fault) where local variables are used for error validation, ensuring the value remains consistent.
--- drivers/hwmon/max16065.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/hwmon/max16065.c +13 -13
@@ -151,27 +151,27 @@ static struct max16065_data *max16065_update_device(struct device *dev)int i;for (i =0 ; i < data->num_adc; i++) - data->adc[i] - =max16065_read_adc (client,MAX16065_ADC (i)); +WRITE_ONCE (data->adc[i], +max16065_read_adc (client,MAX16065_ADC (i)));if (data->have_current) { - data->adc[MAX16065_NUM_ADC ] - =max16065_read_adc (client,MAX16065_CSP_ADC ); - data->curr_sense - =i2c_smbus_read_byte_data (client, -MAX16065_CURR_SENSE ); +WRITE_ONCE (data->adc[MAX16065_NUM_ADC ], +max16065_read_adc (client,MAX16065_CSP_ADC )); +WRITE_ONCE (data->curr_sense, +i2c_smbus_read_byte_data (client,MAX16065_CURR_SENSE )); }for (i =0 ; i <2 ; i++) - data->fault[i] - =i2c_smbus_read_byte_data (client,MAX16065_FAULT (i)); +WRITE_ONCE (data->fault[i], +i2c_smbus_read_byte_data (client,MAX16065_FAULT (i)));/* * MAX16067 and MAX16068 have separate undervoltage and * overvoltage alarm bits. Squash them together. */ if (data->chip == max16067 || data->chip == max16068) - data->fault[0 ] |= data->fault[1 ]; +WRITE_ONCE (data->fault[0 ], + data->fault[0 ] | data->fault[1 ]); data->last_updated = jiffies; data->valid = true;
@@ -185,7 +185,7 @@ static ssize_t max16065_alarm_show(struct device *dev, {struct sensor_device_attribute_2 *attr2 =to_sensor_dev_attr_2 (da);struct max16065_data *data =max16065_update_device (dev); -int val = data->fault[attr2->nr]; +int val =READ_ONCE (data->fault[attr2->nr]);if (val <0 )return val;
@@ -203,7 +203,7 @@ static ssize_t max16065_input_show(struct device *dev, {struct sensor_device_attribute *attr =to_sensor_dev_attr (da);struct max16065_data *data =max16065_update_device (dev); -int adc = data->adc[attr->index]; +int adc =READ_ONCE (data->adc[attr->index]);if (unlikely (adc <0 ))return adc;
@@ -216,7 +216,7 @@ static ssize_t max16065_current_show(struct device *dev, struct device_attribute *da, char *buf) { struct max16065_data *data = max16065_update_device(dev); -int curr_sense = data->curr_sense; +int curr_sense =READ_ONCE (data->curr_sense);if (unlikely (curr_sense <0 ))return curr_sense;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/481 ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7bc0df86c2384bc1e2012a2c946f82305054da64 ]
Acer Swift SF314 (SSID 1025:136d) needs a bit of tweaks of the pin configurations for NID 0x16 and 0x19 to make the headphone / headset jack working. NID 0x17 can remain as is for the working speaker, and the built-in mic is supported via SOF.
--- sound/pci/hda/patch_conexant.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/pci/hda/patch_conexant.c +10 -0
@@ -312,6 +312,7 @@ enum {CXT_PINCFG_SWS_JS201D ,CXT_PINCFG_TOP_SPEAKER ,CXT_FIXUP_HP_A_U , + CXT_FIXUP_ACER_SWIFT_HP, };/* for hda_fixup_thinkpad_acpi() */
@@ -1042,6 +1043,14 @@ static const struct hda_fixup cxt_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = cxt_fixup_hp_a_u, }, + [CXT_FIXUP_ACER_SWIFT_HP] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x16 ,0x0321403f },/* Headphone */ + {0x19 ,0x40f001f0 },/* Mic */ + { } + }, + }, };static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -1091,6 +1100,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {SND_PCI_QUIRK (0x1025 ,0x0543 ,"Acer Aspire One 522" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054f ,"Acer Aspire 4830T" ,CXT_FIXUP_ASPIRE_DMIC ), +SND_PCI_QUIRK (0x1025 ,0x136d ,"Acer Swift SF314" ,CXT_FIXUP_ACER_SWIFT_HP ),SND_PCI_QUIRK (0x103c ,0x8079 ,"HP EliteBook 840 G3" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x807C ,"HP EliteBook 820 G3" ,CXT_FIXUP_HP_DOCK ), SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/481 net: arcnet: com20020-pci: fix support for 2.5Mbit cards
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
[ Upstream commit c7d9be66b71af490446127c6ffcb66d6bb71b8b9 ]
Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") converted the com20020-pci driver to use a card info structure instead of a single flag mask in driver_data. However, it failed to take into account that in the original code, driver_data of 0 indicates a card with no special flags, not a card that should not have any card info structure. This introduced a null pointer dereference when cards with no flags were probed.
Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") then papered over this issue by rejecting cards with no driver_data instead of resolving the problem at its source.
Fix the original issue by introducing a new card info structure for 2.5Mbit cards that does not set any flags and using it if no driver_data is present.
--- drivers/net/arcnet/com20020-pci.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/net/arcnet/com20020-pci.c +15 -1
@@ -114,6 +114,8 @@ static const struct attribute_group com20020_state_group = { .attrs = com20020_state_attrs, }; +static struct com20020_pci_card_info card_info_2p5mbit; +static void com20020pci_remove (struct pci_dev *pdev); static int com20020pci_probe(struct pci_dev *pdev,
@@ -139,7 +141,7 @@ static int com20020pci_probe(struct pci_dev *pdev, ci = (struct com20020_pci_card_info *)id->driver_data;if (!ci) -return -EINVAL ; + ci = &card_info_2p5mbit; priv->ci = ci; mm = &ci->misc_map;
@@ -346,6 +348,18 @@ static struct com20020_pci_card_info card_info_5mbit = { .flags = ARC_IS_5MBIT, }; +static struct com20020_pci_card_info card_info_2p5mbit = { + .name ="ARC-PCI" , + .devcount =1 , + .chan_map_tbl = { + { + .bar =2 , + .offset =0x00 , + .size =0x08 , + }, + }, +}; +static struct com20020_pci_card_info card_info_sohard = { .name ="SOHARD SH ARC-PCI" , .devcount =1 ,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/481 drm/amd: Drop special case for yellow carp without discovery
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 3ef07651a5756e7de65615e18eacbf8822c23016 ]
amdgpu_gmc_get_vbios_allocations has a special case for how to bring up yellow carp when amdgpu discovery is turned off. As this ASIC ships with discovery turned on, it's generally dead code and worse it causes adev->mman.keep_stolen_vga_memory to not be initialized for yellow carp.
Remove it.
Stable-dep-of: 096bb75e13cc ("drm/amdgpu: keep vga memory on MacBooks with switchable graphics")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +0 -6
@@ -652,12 +652,6 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev)case CHIP_RENOIR : adev->mman.keep_stolen_vga_memory = true;break ; -case CHIP_YELLOW_CARP : -if (amdgpu_discovery ==0 ) { - adev->mman.stolen_reserved_offset =0x1ffb0000 ; - adev->mman.stolen_reserved_size =64 *PAGE_SIZE ; - } -break ;default : adev->mman.keep_stolen_vga_memory = false;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/481 drm/amdgpu: keep vga memory on MacBooks with switchable graphics
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 096bb75e13cc508d3915b7604e356bcb12b17766 ]
On Intel MacBookPros with switchable graphics, when the iGPU is enabled, the address of VRAM gets put at 0 in the dGPU's virtual address space. This is non-standard and seems to cause issues with the cursor if it ends up at 0. We have the framework to reserve memory at 0 in the address space, so enable it here if the vram start address is 0.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +10 -0
@@ -652,6 +652,16 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev)case CHIP_RENOIR : adev->mman.keep_stolen_vga_memory = true;break ; +case CHIP_POLARIS10 : +case CHIP_POLARIS11 : +case CHIP_POLARIS12 : +/* MacBookPros with switchable graphics put VRAM at 0 when +* the iGPU is enabled which results in cursor issues if +* the cursor ends up at 0. Reserve vram at 0 in that case. +*/ +if (adev->gmc.vram_start ==0 ) + adev->mman.keep_stolen_vga_memory = true; +break ;default : adev->mman.keep_stolen_vga_memory = false;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/481 eventpoll: Fix integer overflow in ep_loop_check_proc()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit fdcfce93073d990ed4b71752e31ad1c1d6e9d58b upstream.
If a recursive call to ep_loop_check_proc() hits the result = INT_MAX, an integer overflow will occur in the calling ep_loop_check_proc() at result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1), breaking the recursion depth check.
Fix it by using a different placeholder value that can't lead to an overflow.
--- fs/eventpoll.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/eventpoll.c +3 -2
@@ -1872,7 +1872,8 @@ static int ep_poll(struct eventpoll *ep,* @ep: the &struct eventpoll to be currently checked. * @depth: Current depth of the path being checked. * -* Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. +* Return: depth of the subtree, or a value bigger than EP_MAX_NESTS if we found +* a loop or went too deep. */ static int ep_loop_check_proc (struct eventpoll *ep,int depth) {
@@ -1891,7 +1892,7 @@ static int ep_loop_check_proc(struct evestruct eventpoll *ep_tovisit; ep_tovisit = epi->ffd.file->private_data;if (ep_tovisit == inserting_into || depth >EP_MAX_NESTS ) - result =INT_MAX ; + result =EP_MAX_NESTS +1 ;else result =max (result,ep_loop_check_proc (ep_tovisit, depth +1 ) +1 );if (result >EP_MAX_NESTS )
Greg Kroah-Hartman
maintainerPATCH 70/481 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 upstream.
dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty.
Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}.
The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions.
Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock.
--- drivers/media/dvb-core/dmxdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/dvb-core/dmxdev.c +3 -1
@@ -168,7 +168,9 @@ static int dvb_dvr_open(struct inode *inmutex_unlock (&dmxdev->mutex);return -ENOMEM ; } -dvb_ringbuffer_init (&dmxdev->dvr_buffer, mem,DVR_BUFFER_SIZE ); + dmxdev->dvr_buffer.data = mem; + dmxdev->dvr_buffer.size =DVR_BUFFER_SIZE ; +dvb_ringbuffer_reset (&dmxdev->dvr_buffer);if (dmxdev->may_do_mmap)dvb_vb2_init (&dmxdev->dvr_vb2_ctx,"dvr" , file->f_flags &O_NONBLOCK );
Greg Kroah-Hartman
maintainerPATCH 71/481 nfc: pn533: properly drop the usb interface reference on disconnect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 12133a483dfa832241fbbf09321109a0ea8a520e upstream.
When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up by properly dropping the reference after we are done with it.
--- drivers/nfc/pn533/usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/nfc/pn533/usb.c +1 -0
@@ -629,6 +629,7 @@ static void pn533_usb_disconnect(structusb_free_urb (phy->out_urb);usb_free_urb (phy->ack_urb);kfree (phy->ack_buffer); +usb_put_dev (phy->udev);nfc_info (&interface->dev,"NXP PN533 NFC device disconnected\n" ); }
Greg Kroah-Hartman
maintainerPATCH 72/481 net: usb: kaweth: validate USB endpoints
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 4b063c002ca759d1b299988ee23f564c9609c875 upstream.
The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.
--- drivers/net/usb/kaweth.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/net/usb/kaweth.c +13 -0
@@ -883,6 +883,13 @@ static int kaweth_probe(const eth_addr_t bcast_addr = {0xFF ,0xFF ,0xFF ,0xFF ,0xFF ,0xFF };int result =0 ;int rv = -EIO ; +static const u8 bulk_ep_addr[] = { +1 |USB_DIR_IN , +2 |USB_DIR_OUT , +0 }; +static const u8 int_ep_addr[] = { +3 |USB_DIR_IN , +0 }; dev_dbg(dev, "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -896,6 +903,12 @@ static int kaweth_probe( (int )udev->descriptor.bLength, (int)udev->descriptor.bDescriptorType); +if (!usb_check_bulk_endpoints (intf, bulk_ep_addr) || + !usb_check_int_endpoints (intf, int_ep_addr)) { +dev_err (dev,"couldn't find required endpoints\n" ); +return -ENODEV ; + } + netdev =alloc_etherdev (sizeof (*kaweth));if (!netdev)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 73/481 net: usb: kalmia: validate USB endpoints
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit c58b6c29a4c9b8125e8ad3bca0637e00b71e2693 upstream.
The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.
--- drivers/net/usb/kalmia.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/usb/kalmia.c +7 -0
@@ -132,11 +132,18 @@ kalmia_bind(struct usbnet *dev, struct u {int status;u8 ethernet_addr[ETH_ALEN ]; +static const u8 ep_addr[] = { +1 |USB_DIR_IN , +2 |USB_DIR_OUT , +0 };/* Don't bind to AT command interface */ if (intf->cur_altsetting->desc.bInterfaceClass !=USB_CLASS_VENDOR_SPEC )return -EINVAL ; +if (!usb_check_bulk_endpoints (intf, ep_addr)) +return -ENODEV ; + dev->in =usb_rcvbulkpipe (dev->udev,0x81 &USB_ENDPOINT_NUMBER_MASK ); dev->out =usb_sndbulkpipe (dev->udev,0x02 &USB_ENDPOINT_NUMBER_MASK ); dev->status =NULL ;
Greg Kroah-Hartman
maintainerPATCH 74/481 net: usb: pegasus: validate USB endpoints
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 upstream.
The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.
--- drivers/net/usb/pegasus.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/net/usb/pegasus.c +12 -1
@@ -815,8 +815,19 @@ static void unlink_all_urbs(pegasus_t *pstatic int alloc_urbs (pegasus_t *pegasus) { +static const u8 bulk_ep_addr[] = { +1 |USB_DIR_IN , +2 |USB_DIR_OUT , +0 }; +static const u8 int_ep_addr[] = { +3 |USB_DIR_IN , +0 };int res = -ENOMEM ; +if (!usb_check_bulk_endpoints (pegasus->intf, bulk_ep_addr) || + !usb_check_int_endpoints (pegasus->intf, int_ep_addr)) +return -ENODEV ; + pegasus->rx_urb =usb_alloc_urb (0 ,GFP_KERNEL );if (!pegasus->rx_urb) {return res;
@@ -1171,6 +1182,7 @@ static int pegasus_probe(struct usb_inte pegasus =netdev_priv (net); pegasus->dev_index = dev_index; + pegasus->intf = intf; res =alloc_urbs (pegasus);if (res <0 ) {
@@ -1182,7 +1194,6 @@ static int pegasus_probe(struct usb_inteINIT_DELAYED_WORK (&pegasus->carrier_check, check_carrier); - pegasus->intf = intf; pegasus->usb = dev; pegasus->net = net;
Greg Kroah-Hartman
maintainerPATCH 75/481 can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 38a01c9700b0dcafe97dfa9dc7531bf4a245deff upstream.
When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer.
When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message.
--- drivers/net/can/usb/ems_usb.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/can/usb/ems_usb.c +6 -1
@@ -445,6 +445,11 @@ static void ems_usb_read_bulk_callback(s start =CPC_HEADER_SIZE ;while (msg_count) { +if (start +CPC_MSG_HEADER_LEN > urb->actual_length) { +netdev_err (netdev,"format error\n" ); +break ; + } + msg = (struct ems_cpc_msg *)&ibuf[start];switch (msg->type) {
@@ -474,7 +479,7 @@ static void ems_usb_read_bulk_callback(s start +=CPC_MSG_HEADER_LEN + msg->length; msg_count--; -if (start > urb->transfer_buffer_length) { +if (start > urb->actual_length) {netdev_err (netdev,"format error\n" );break ; }
Greg Kroah-Hartman
maintainerPATCH 76/481 can: ucan: Fix infinite loop from zero-length messages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7 upstream.
If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just skip the message and go on to the next one.
This has been fixed in the kvaser_usb driver in the past in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"), so there must be some broken devices out there like this somewhere.
--- drivers/net/can/usb/ucan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/usb/ucan.c +1 -1
@@ -747,7 +747,7 @@ static void ucan_read_bulk_callback(stru len =le16_to_cpu (m->len);/* check sanity (length of content) */ -if (urb->actual_length - pos < len) { +if ((len ==0 ) || (urb->actual_length - pos < len)) {netdev_warn (up->netdev,"invalid message (short; no data; l:%d)\n" , urb->actual_length);
Greg Kroah-Hartman
maintainerPATCH 77/481 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream.
When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also.
--- drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/usb/etas_es58x/es58x_core.c +7 -1
@@ -1460,12 +1460,18 @@ static void es58x_read_bulk_callback(str } resubmit_urb: +usb_anchor_urb (urb, &es58x_dev->rx_urbs); ret =usb_submit_urb (urb,GFP_ATOMIC ); +if (!ret) +return ; + +usb_unanchor_urb (urb); +if (ret == -ENODEV ) {for (i =0 ; i < es58x_dev->num_can_ch; i++)if (es58x_dev->netdev[i])netif_device_detach (es58x_dev->netdev[i]); - }else if (ret) + }else dev_err_ratelimited (dev,"Failed resubmitting read bulk urb: %pe\n" ,ERR_PTR (ret));
Greg Kroah-Hartman
maintainerPATCH 78/481 HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit ecfa6f34492c493a9a1dc2900f3edeb01c79946b upstream.
In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at raw event handle"), we handle the fact that raw event callbacks can happen even for a HID device that has not been "claimed" causing a crash if a broken device were attempted to be connected to the system.
Fix up the remaining in-tree HID drivers that forgot to add this same check to resolve the same issue.
--- drivers/hid/hid-cmedia.c | 2 +- drivers/hid/hid-creative-sb0540.c | 2 +- drivers/hid/hid-zydacron.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/hid/hid-cmedia.c +1 -1
@@ -99,7 +99,7 @@ static int cmhid_raw_event(struct hid_de {struct cmhid *cm =hid_get_drvdata (hid); -if (len !=CM6533_JD_RAWEV_LEN ) +if (len !=CM6533_JD_RAWEV_LEN || !(hid->claimed &HID_CLAIMED_INPUT )) goto out;if (memcmp (data+CM6533_JD_SFX_OFFSET , ji_sfx,sizeof (ji_sfx))) goto out;
drivers/hid/hid-creative-sb0540.c +1 -1
@@ -153,7 +153,7 @@ static int creative_sb0540_raw_event(stru64 code, main_code;int key; -if (len !=6 ) +if (len !=6 || !(hid->claimed &HID_CLAIMED_INPUT ))return 0 ;/* From daemons/hw_hiddev.c sb0540_rec() in lirc */
drivers/hid/hid-zydacron.c +1 -1
@@ -114,7 +114,7 @@ static int zc_raw_event(struct hid_devicunsigned key;unsigned short index; -if (report->id == data[0 ]) { +if (report->id == data[0 ] && (hdev->claimed &HID_CLAIMED_INPUT )) {/* break keys */ for (index =0 ; index <4 ; index++) {
Greg Kroah-Hartman
maintainerPATCH 79/481 x86/efi: defer freeing of boot services memory
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
commit a4b0bf6a40f3c107c67a24fbc614510ef5719980 upstream.
efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late().
There are two issue with that: memblock_free_late() should be used for memory allocated with memblock_alloc() while the memory reserved with memblock_reserve() should be freed with free_reserved_area().
More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y efi_free_boot_services() is called before deferred initialization of the memory map is complete.
Benjamin Herrenschmidt reports that this causes a leak of ~140MB of RAM on EC2 t3a.nano instances which only have 512MB or RAM.
If the freed memory resides in the areas that memory map for them is still uninitialized, they won't be actually freed because memblock_free_late() calls memblock_free_pages() and the latter skips uninitialized pages.
Using free_reserved_area() at this point is also problematic because __free_page() accesses the buddy of the freed page and that again might end up in uninitialized part of the memory map.
Delaying the entire efi_free_boot_services() could be problematic because in addition to freeing boot services memory it updates efi.memmap without any synchronization and that's undesirable late in boot when there is concurrency.
More robust approach is to only defer freeing of the EFI boot services memory.
Split efi_free_boot_services() in two. First efi_unmap_boot_services() collects ranges that should be freed into an array then efi_free_boot_services() later frees them after deferred init is complete.
--- arch/x86/include/asm/efi.h | 2 - arch/x86/platform/efi/efi.c | 2 - arch/x86/platform/efi/quirks.c | 55 ++++++++++++++++++++++++++++++++++-- drivers/firmware/efi/mokvar-table.c | 2 - 4 files changed, 55 insertions(+), 6 deletions(-)
arch/x86/include/asm/efi.h +1 -1
@@ -162,7 +162,7 @@ extern void __init efi_apply_memmap_quirextern int __init efi_reuse_config (u64 tables,int nr_tables);extern void efi_delete_dummy_variable (void );extern void efi_crash_gracefully_on_page_fault (unsigned long phys_addr); -extern void efi_free_boot_services (void ); +extern void efi_unmap_boot_services (void );void efi_enter_mm (void );void efi_leave_mm (void );
arch/x86/platform/efi/efi.c +1 -1
@@ -811,7 +811,7 @@ static void __init __efi_enter_virtual_m }efi_check_for_embedded_firmwares (); -efi_free_boot_services (); +efi_unmap_boot_services ();if (!efi_is_mixed ())efi_native_runtime_setup ();
arch/x86/platform/efi/quirks.c +52 -3
89 lines not on this page · raw message
drivers/firmware/efi/mokvar-table.c +1 -1
@@ -85,7 +85,7 @@ static struct kobject *mokvar_kobj;* as an alternative to ordinary EFI variables, due to platform-dependent * limitations. The memory occupied by this table is marked as reserved. * -* This routine must be called before efi_free_boot_services() in order +* This routine must be called before efi_unmap_boot_services() in order * to guarantee that it can mark the table as reserved. * * Implicit inputs:
Greg Kroah-Hartman
maintainerPATCH 80/481 platform/x86: dell-wmi-sysman: Dont hex dump plaintext password data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit d1a196e0a6dcddd03748468a0e9e3100790fc85c upstream.
set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.
--- drivers/platform/x86/dell/dell-wmi-sysman/passwordattr-interface.c | 1 - 1 file changed, 1 deletion(-)
drivers/platform/x86/dell/dell-wmi-sysman/passwordattr-interface.c +0 -1
@@ -93,7 +93,6 @@ int set_new_password(const char *passworif (ret <0 ) goto out; -print_hex_dump_bytes ("set new password data: " ,DUMP_PREFIX_NONE , buffer, buffer_size); ret =call_password_interface (wmi_priv.password_attr_wdev, buffer, buffer_size);/* on success copy the new password to current password */ if (!ret)
Greg Kroah-Hartman
maintainerPATCH 81/481 platform/x86: dell-wmi: Add audio/mic mute key codes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
commit 26a7601471f62b95d56a81c3a8ccb551b5a6630f upstream.
Add audio/mic mute key codes found in Alienware m18 r1 AMD.
--- drivers/platform/x86/dell/dell-wmi-base.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/dell/dell-wmi-base.c +6 -0
@@ -80,6 +80,12 @@ static const struct dmi_system_id dell_wstatic const struct key_entry dell_wmi_keymap_type_0000[] = { {KE_IGNORE ,0x003a , {KEY_CAPSLOCK } }, +/* Audio mute toggle */ + {KE_KEY ,0x0109 , {KEY_MUTE } }, + +/* Mic mute toggle */ + {KE_KEY ,0x0150 , {KEY_MICMUTE } }, +/* Meta key lock */ {KE_IGNORE ,0xe000 , {KEY_RIGHTMETA } },
Greg Kroah-Hartman
maintainerPATCH 82/481 ALSA: usb-audio: Use correct version for UAC3 header validation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Seo <[email protected]>
commit 54f9d645a5453d0bfece0c465d34aaf072ea99fa upstream.
The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields.
The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.
--- sound/usb/validate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/validate.c +1 -1
@@ -281,7 +281,7 @@ static const struct usb_desc_validator a/* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */ /* UAC3 */ - FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor), + FIXED(UAC_VERSION_3, UAC_HEADER, struct uac3_ac_header_descriptor),FIXED (UAC_VERSION_3 ,UAC_INPUT_TERMINAL , struct uac3_input_terminal_descriptor), FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
Greg Kroah-Hartman
maintainerPATCH 83/481 wifi: radiotap: reject radiotap with unknown bits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 upstream.
The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value.
Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present.
--- net/wireless/radiotap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/radiotap.c +2 -2
@@ -239,14 +239,14 @@ int ieee80211_radiotap_iterator_next(default :if (!iterator->current_namespace || iterator->_arg_index >= iterator->current_namespace->n_bits) { -if (iterator->current_namespace == &radiotap_ns) -return -ENOENT ; align =0 ; }else { align = iterator->current_namespace->align_size[iterator->_arg_index].align; size = iterator->current_namespace->align_size[iterator->_arg_index].size; }if (!align) { +if (iterator->current_namespace == &radiotap_ns) +return -ENOENT ;/* skip all subsequent data */ iterator->_arg = iterator->_next_ns_data;/* give up on this namespace */
Greg Kroah-Hartman
maintainerPATCH 84/481 wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vahagn Vardanian <[email protected]>
commit 017c1792525064a723971f0216e6ef86a8c7af11 upstream.
In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check:
ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
...
pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);The mesh_matches_local() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee802_11_parse_elems() leaves elems->mesh_chansw_params_ie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference.
A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required.
Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:
BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000
Fix by adding a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded throughout the mesh code.
The bug has been present since v3.13 (released 2014-01-19).
--- net/mac80211/mesh.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/mesh.c +3 -0
@@ -1474,6 +1474,9 @@ static void mesh_rx_csa_frame(struct ieeif (!mesh_matches_local (sdata, elems)) goto free; +if (!elems->mesh_chansw_params_ie) + goto free; + ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;if (!--ifmsh->chsw_ttl) fwd_csa = false;
Greg Kroah-Hartman
maintainerPATCH 85/481 IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 117942ca43e2e3c3d121faae530989931b7f67e1 upstream.
Fix a user triggerable leak on the system call failure path.
--- drivers/infiniband/hw/mthca/mthca_provider.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mthca/mthca_provider.c +3 -2
@@ -428,6 +428,8 @@ static int mthca_create_srq(struct ib_srif (context &&ib_copy_to_udata (udata, &srq->srqn,sizeof (__u32))) {mthca_free_srq (to_mdev (ibsrq->device), srq); +mthca_unmap_user_db (to_mdev (ibsrq->device), &context->uar, + context->db_tab, ucmd.db_index);return -EFAULT ; }
@@ -436,6 +438,7 @@ static int mthca_create_srq(struct ib_srstatic int mthca_destroy_srq (struct ib_srq *srq,struct ib_udata *udata) { +mthca_free_srq (to_mdev (srq->device),to_msrq (srq));if (udata) {struct mthca_ucontext *context = rdma_udata_to_drv_context(
@@ -446,8 +449,6 @@ static int mthca_destroy_srq(struct ib_smthca_unmap_user_db (to_mdev (srq->device), &context->uar, context->db_tab,to_msrq (srq)->db_index); } - -mthca_free_srq (to_mdev (srq->device),to_msrq (srq));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 86/481 RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 74586c6da9ea222a61c98394f2fc0a604748438c upstream.
struct irdma_create_ah_resp { // 8 bytes, no padding
__u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx)
__u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK};
rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().
The reserved members of the structure were not zeroed.
--- drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +1 -1
@@ -4338,7 +4338,7 @@ static int irdma_create_user_ah(struct i#define IRDMA_CREATE_AH_MIN_RESP_LEN offsetofend(struct irdma_create_ah_resp, rsvd) struct irdma_ah *ah = container_of(ibah, struct irdma_ah, ibah);struct irdma_device *iwdev =to_iwdev (ibah->pd->device); -struct irdma_create_ah_resp uresp; +struct irdma_create_ah_resp uresp = {};struct irdma_ah *parent_ah;int err;
Greg Kroah-Hartman
maintainerPATCH 87/481 net/sched: ets: fix divide by zero in the offload path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <[email protected]>
commit e35626f610f3d2b7953ccddf6a77453da22b3a9e upstream.
Offloading ETS requires computing each class' WRR weight: this is done by averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned int, the same integer size as the individual DRR quanta, can overflow and even cause division by zero, like it happened in the following splat:
Oops: divide error: 0000 [#1] SMP PTI CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G E 6.19.0-virtme #45 PREEMPT(full) Tainted: [E]=UNSIGNED_MODULE Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets] Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44 RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246 RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660 RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000 FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0 Call Trace: <TASK> ets_qdisc_change+0x870/0xf40 [sch_ets] qdisc_create+0x12b/0x540 tc_modify_qdisc+0x6d7/0xbd0 rtnetlink_rcv_msg+0x168/0x6b0 netlink_rcv_skb+0x5c/0x110 netlink_unicast+0x1d6/0x2b0 netlink_sendmsg+0x22e/0x470 ____sys_sendmsg+0x38a/0x3c0 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x111/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f440b81c77e Code: 4d 89 d8 e8 d4 bc 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa RSP: 002b:00007fff951e4c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000481820 RCX: 00007f440b81c77e RDX: 0000000000000000 RSI: 00007fff951e4cd0 RDI: 0000000000000003 RBP: 00007fff951e4c20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff951f4fa8 R13: 00000000699ddede R14: 00007f440bb01000 R15: 0000000000486980 </TASK> Modules linked in: sch_ets(E) netdevsim(E) ---[ end trace 0000000000000000 ]--- RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets] Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44 RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246 RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660 RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000 FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]---
Fix this using 64-bit integers for 'q_sum' and 'q_psum'.
--- net/sched/sch_ets.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/sched/sch_ets.c +8 -4
@@ -115,12 +115,12 @@ static void ets_offload_change(struct Qdstruct ets_sched *q =qdisc_priv (sch);struct tc_ets_qopt_offload qopt;unsigned int w_psum_prev =0 ; -unsigned int q_psum =0 ; -unsigned int q_sum =0 ;unsigned int quantum;unsigned int w_psum;unsigned int weight;unsigned int i; +u64 q_psum =0 ; +u64 q_sum =0 ;if (!tc_can_offload (dev) || !dev->netdev_ops->ndo_setup_tc)return ;
@@ -138,8 +138,12 @@ static void ets_offload_change(struct Qdfor (i =0 ; i < q->nbands; i++) { quantum = q->classes[i].quantum; - q_psum += quantum; - w_psum = quantum ? q_psum *100 / q_sum :0 ; +if (quantum) { + q_psum += quantum; + w_psum =div64_u64 (q_psum *100 , q_sum); + }else { + w_psum =0 ; + } weight = w_psum - w_psum_prev; w_psum_prev = w_psum;
Greg Kroah-Hartman
maintainerPATCH 88/481 scsi: target: Fix recursive locking in __configfs_open_file()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prithvi Tambewagh <[email protected]>
commit 14d4ac19d1895397532eec407433c5d74d9da53b upstream.
In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), according to the call trace:
down_read
__configfs_open_file
do_dentry_open
vfs_open
do_open
path_openat
do_filp_open
file_open_name
filp_open
target_core_item_dbroot_store
flush_write_buffer
configfs_write_iter
target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows:
db_root: not a directory: /sys/kernel/config/target/dbroot
indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking.
Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible.
--- drivers/target/target_core_configfs.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/target/target_core_configfs.c +6 -9
@@ -107,8 +107,8 @@ static ssize_t target_core_item_dbroot_s const char *page, size_t count) { ssize_t read_bytes; -struct file *fp;ssize_t r = -EINVAL ; +struct path path = {};mutex_lock (&target_devices_lock);if (target_devices) {
@@ -130,17 +130,14 @@ static ssize_t target_core_item_dbroot_s db_root_stage[read_bytes -1 ] ='\0' ;/* validate new db root before accepting it */ - fp =filp_open (db_root_stage,O_RDONLY ,0 ); -if (IS_ERR (fp)) { + r =kern_path (db_root_stage,LOOKUP_FOLLOW |LOOKUP_DIRECTORY , &path); +if (r) {pr_err ("db_root: cannot open: %s\n" , db_root_stage); +if (r == -ENOTDIR ) +pr_err ("db_root: not a directory: %s\n" , db_root_stage); goto unlock; } -if (!S_ISDIR (file_inode (fp)->i_mode)) { -filp_close (fp,NULL ); -pr_err ("db_root: not a directory: %s\n" , db_root_stage); - goto unlock; - } -filp_close (fp,NULL ); +path_put (&path);strncpy (db_root, db_root_stage, read_bytes);pr_debug ("Target_Core_ConfigFS: db_root set to %s\n" , db_root);
Greg Kroah-Hartman
maintainerPATCH 89/481 Squashfs: check metadata block offset is within range
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
commit fdb24a820a5832ec4532273282cbd4f22c291a0d upstream.
Syzkaller reports a "general protection fault in squashfs_copy_data"
This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offset.
This is subsequently passed to squashfs_copy_data (via squashfs_read_metadata) where the negative offset causes an out of bounds access.
The fix is to check that the offset is within range in squashfs_read_metadata. This will trap this and other cases.
--- fs/squashfs/cache.c | 3 +++ 1 file changed, 3 insertions(+)
fs/squashfs/cache.c +3 -0
@@ -340,6 +340,9 @@ int squashfs_read_metadata(struct super_if (unlikely (length <0 ))return -EIO ; +if (unlikely (*offset <0 || *offset >=SQUASHFS_METADATA_SIZE )) +return -EIO ; +while (length) { entry =squashfs_cache_get (sb, msblk->block_cache, *block,0 );if (entry->error) {
Greg Kroah-Hartman
maintainerPATCH 90/481 drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars Ellenberg <[email protected]>
commit ab140365fb62c0bdab22b2f516aff563b2559e3b upstream.
Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad timing.
If that happened, we logged "LOGIC BUG for enr=...", but still did not return an error.
The rest of the code now assumed that this request has references for the relevant activity log extents.
The implcations are that during an active resync, mutual exclusivity of resync versus application IO is not guaranteed. And a potential crash at this point may not realizs that these extents could have been target of in-flight IO and would need to be resynced just in case.
Also, once the request completes, it will give up activity log references it does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put().
Fix:
Do not crash the kernel for a condition that is harmless during normal
operation: also catch "e->refcnt == 0", not only "e == NULL" when being noisy about "al_complete_io() called on inactive extent %u\n".
And do not try to be smart and "guess" whether something will work, then be surprised when it does not.
Deal with the fact that it may or may not work. If it does not, remember a possible "partially in activity log" state (only possible for requests that cross extent boundaries), and return an error code from drbd_al_begin_io_nonblock().
A latter call for the same request will then resume from where we left off.
--- drivers/block/drbd/drbd_actlog.c | 53 ++++++++++++++++--------------------- drivers/block/drbd/drbd_interval.h | 5 ++- 2 files changed, 27 insertions(+), 31 deletions(-)
drivers/block/drbd/drbd_actlog.c +23 -30
@@ -483,38 +483,20 @@ void drbd_al_begin_io(struct drbd_deviceint drbd_al_begin_io_nonblock (struct drbd_device *device,struct drbd_interval *i) { -struct lru_cache *al = device->act_log;/* for bios crossing activity log extent boundaries, * we may need to activate two extents in one go */ unsigned first = i->sector >> (AL_EXTENT_SHIFT -9 );unsigned last = i->size ==0 ? first : (i->sector + (i->size >>9 ) -1 ) >> (AL_EXTENT_SHIFT -9 ); -unsigned nr_al_extents; -unsigned available_update_slots;unsigned enr; -D_ASSERT (device, first <= last); - - nr_al_extents =1 + last - first;/* worst case: all touched extends are cold. */ - available_update_slots =min (al->nr_elements - al->used, - al->max_pending_changes - al->pending_changes); - -/* We want all necessary updates for a given request within the same transaction -* We could first check how many updates are *actually* needed, -* and use that instead of the worst-case nr_al_extents */ -if (available_update_slots < nr_al_extents) { -/* Too many activity log extents are currently "hot". -* -* If we have accumulated pending changes already, -* we made progress. -* -* If we cannot get even a single pending change through, -* stop the fast path until we made some progress, -* or requests to "cold" extents could be starved. */ -if (!al->pending_changes) -__set_bit (__LC_STARVING, &device->act_log->flags); -return -ENOBUFS ; +if (i->partially_in_al_next_enr) { +D_ASSERT (device, first < i->partially_in_al_next_enr); +D_ASSERT (device, last >= i->partially_in_al_next_enr); + first = i->partially_in_al_next_enr; } +D_ASSERT (device, first <= last); +/* Is resync active in this area? */ for (enr = first; enr <= last; enr++) {struct lc_element *tmp;
@@ -529,14 +511,21 @@ int drbd_al_begin_io_nonblock(struct drb } } -/* Checkout the refcounts. -* Given that we checked for available elements and update slots above, -* this has to be successful. */ +/* Try to checkout the refcounts. */ for (enr = first; enr <= last; enr++) {struct lc_element *al_ext; al_ext =lc_get_cumulative (device->act_log, enr); -if (!al_ext) -drbd_info (device,"LOGIC BUG for enr=%u\n" , enr); + +if (!al_ext) { +/* Did not work. We may have exhausted the possible +* changes per transaction. Or raced with someone +* "locking" it against changes. +* Remember where to continue from. +*/ +if (enr > first) + i->partially_in_al_next_enr = enr; +return -ENOBUFS ; + } }return 0 ; }
@@ -556,7 +545,11 @@ void drbd_al_complete_io(struct drbd_devfor (enr = first; enr <= last; enr++) { extent =lc_find (device->act_log, enr); -if (!extent) { +/* Yes, this masks a bug elsewhere. However, during normal +* operation this is harmless, so no need to crash the kernel +* by the BUG_ON(refcount == 0) in lc_put(). +*/ +if (!extent || extent->refcnt ==0 ) {drbd_err (device,"al_complete_io() called on inactive extent %u\n" , enr);continue ; }
drivers/block/drbd/drbd_interval.h +4 -1
@@ -8,12 +8,15 @@struct drbd_interval {struct rb_node rb;sector_t sector;/* start sector of the interval */ -unsigned int size;/* size in bytes */ sector_t end;/* highest interval end in subtree */ +unsigned int size;/* size in bytes */ unsigned int local:1 /* local or remote request? */ ;unsigned int waiting:1 ;/* someone is waiting for completion */ unsigned int completed:1 ;/* this has been completed already; * ignore for conflict detection */ + +/* to resume a partially successful drbd_al_begin_io_nonblock(); */ +unsigned int partially_in_al_next_enr; };static inline void drbd_clear_interval (struct drbd_interval *i)
Greg Kroah-Hartman
maintainerPATCH 91/481 smb: client: fix broken multichannel with krb5+signing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
commit d9d1e319b39ea685ede59319002d567c159d23c3 upstream.
When mounting a share with 'multichannel,max_channels=n,sec=krb5i', the client was duplicating signing key for all secondary channels, thus making the server fail all commands sent from secondary channels due to bad signatures.
Every channel has its own signing key, so when establishing a new channel with krb5 auth, make sure to use the new session key as the derived key to generate channel's signing key in SMB2_auth_kerberos().
Repro:
$ mount.cifs //srv/share /mnt -o multichannel,max_channels=4,sec=krb5i $ sleep 5 $ umount /mnt $ dmesg ... CIFS: VFS: sign fail cmd 0x5 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 CIFS: VFS: sign fail cmd 0x5 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 CIFS: VFS: sign fail cmd 0x4 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13
--- fs/smb/client/smb2pdu.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
fs/smb/client/smb2pdu.c +10 -12
@@ -1484,19 +1484,17 @@ SMB2_auth_kerberos(struct SMB2_sess_data is_binding = (ses->ses_status ==SES_GOOD );spin_unlock (&ses->ses_lock); -/* keep session key if binding */ -if (!is_binding) { -kfree_sensitive (ses->auth_key.response); - ses->auth_key.response =kmemdup (msg->data, msg->sesskey_len, -GFP_KERNEL ); -if (!ses->auth_key.response) { -cifs_dbg (VFS ,"Kerberos can't allocate (%u bytes) memory\n" , - msg->sesskey_len); - rc = -ENOMEM ; - goto out_put_spnego_key; - } - ses->auth_key.len = msg->sesskey_len; +kfree_sensitive (ses->auth_key.response); + ses->auth_key.response =kmemdup (msg->data, + msg->sesskey_len, +GFP_KERNEL ); +if (!ses->auth_key.response) { +cifs_dbg (VFS ,"%s: can't allocate (%u bytes) memory\n" , + __func__, msg->sesskey_len); + rc = -ENOMEM ; + goto out_put_spnego_key; } + ses->auth_key.len = msg->sesskey_len; sess_data->iov[1 ].iov_base = msg->data + msg->sesskey_len; sess_data->iov[1 ].iov_len = msg->secblob_len;
Greg Kroah-Hartman
maintainerPATCH 92/481 smb: client: Dont log plaintext credentials in cifs_set_cifscreds
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d upstream.
When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.
--- fs/smb/client/connect.c | 1 - 1 file changed, 1 deletion(-)
fs/smb/client/connect.c +0 -1
@@ -2178,7 +2178,6 @@ cifs_set_cifscreds(struct smb3_fs_contex/* find first : in payload */ payload = upayload->data; delim =strnchr (payload, upayload->datalen,':' ); -cifs_dbg (FYI ,"payload=%s\n" , payload);if (!delim) {cifs_dbg (FYI ,"Unable to find ':' in payload (datalen=%d)\n" , upayload->datalen);
Greg Kroah-Hartman
maintainerPATCH 93/481 scsi: core: Fix refcount leak for tagset_refcnt
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <[email protected]>
commit 1ac22c8eae81366101597d48360718dff9b9d980 upstream.
This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace:
[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured
PID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: "iscsid"
#0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4
#1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f
#2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0
#3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f
#4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b
#5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp] #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi] #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi] #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6
#9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef
--- drivers/scsi/scsi_scan.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/scsi_scan.c +1 -0
@@ -355,6 +355,7 @@ static struct scsi_device *scsi_alloc_sd* since we use this queue depth most of times. */ if (scsi_realloc_sdev_budget_map (sdev, depth)) { +kref_put (&sdev->host->tagset_refcnt, scsi_mq_free_tags);put_device (&starget->dev);kfree (sdev); goto out;
Greg Kroah-Hartman
maintainerPATCH 94/481 selftests: mptcp: more stable simult_flows tests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 8c09412e584d9bcc0e71d758ec1008d1c8d1a326 upstream.
By default, the netem qdisc can keep up to 1000 packets under its belly to deal with the configured rate and delay. The simult flows test-case simulates very low speed links, to avoid problems due to slow CPUs and the TCP stack tend to transmit at a slightly higher rate than the (virtual) link constraints.
All the above causes a relatively large amount of packets being enqueued in the netem qdiscs - the longer the transfer, the longer the queue - producing increasingly high TCP RTT samples and consequently increasingly larger receive buffer size due to DRS.
When the receive buffer size becomes considerably larger than the needed size, the tests results can flake, i.e. because minimal inaccuracy in the pacing rate can lead to a single subflow usage towards the end of the connection for a considerable amount of data.
Address the issue explicitly setting netem limits suitable for the configured link speeds and unflake all the affected tests.
--- tools/testing/selftests/net/mptcp/simult_flows.sh | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
tools/testing/selftests/net/mptcp/simult_flows.sh +7 -4
@@ -246,10 +246,13 @@ run_test() for dev in ns2eth1 ns2eth2; do tc -n $ns2 qdisc del dev $dev root >/dev/null 2>&1 done - tc -n $ns1 qdisc add dev ns1eth1 root netem rate ${rate1}mbit $delay1 - tc -n $ns1 qdisc add dev ns1eth2 root netem rate ${rate2}mbit $delay2 - tc -n $ns2 qdisc add dev ns2eth1 root netem rate ${rate1}mbit $delay1 - tc -n $ns2 qdisc add dev ns2eth2 root netem rate ${rate2}mbit $delay2 + + # keep the queued pkts number low, or the RTT estimator will see + # increasing latency over time. + tc -n $ns1 qdisc add dev ns1eth1 root netem rate ${rate1}mbit $delay1 limit 50 + tc -n $ns1 qdisc add dev ns1eth2 root netem rate ${rate2}mbit $delay2 limit 50 + tc -n $ns2 qdisc add dev ns2eth1 root netem rate ${rate1}mbit $delay1 limit 50 + tc -n $ns2 qdisc add dev ns2eth2 root netem rate ${rate2}mbit $delay2 limit 50 # time is measured in ms, account for transfer size, aggregated link speed # and header overhead (10%)
Greg Kroah-Hartman
maintainerPATCH 95/481 selftests: mptcp: join: check removing signal+subflow endp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 1777f349ff41b62dfe27454b69c27b0bc99ffca5 upstream.
This validates the previous commit: endpoints with both the signal and subflow flags should always be marked as used even if it was not possible to create new subflows due to the MPTCP PM limits.
For this test, an extra endpoint is created with both the signal and the subflow flags, and limits are set not to create extra subflows. In this case, an ADD_ADDR is sent, but no subflows are created. Still, the local endpoint is marked as used, and no warning is fired when removing the endpoint, after having sent a RM_ADDR.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +13 -0
@@ -2389,6 +2389,19 @@ remove_tests() chk_rst_nr 0 0 fi + # signal+subflow with limits, remove + if reset "remove signal+subflow with limits"; then + pm_nl_set_limits $ns1 0 0 + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,subflow + pm_nl_set_limits $ns2 0 0 + addr_nr_ns1=-1 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 0 0 0 + chk_add_nr 1 1 + chk_rm_nr 1 0 invert + chk_rst_nr 0 0 + fi + # addresses remove if reset "remove addresses"; then pm_nl_set_limits $ns1 3 3
Re: [PATCH 6.1 095/481] selftests: mptcp: join: check removing signal+subflow endp
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
6.1-stable review patch. If anyone has any objections, please let me know.
I do!
Quoted 35 lines
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit
1777f349ff41b62dfe27454b69c27b0bc99ffca5upstream.This validates the previous commit: endpoints with both the signal and subflow flags should always be marked as used even if it was not possible to create new subflows due to the MPTCP PM limits.
For this test, an extra endpoint is created with both the signal and the subflow flags, and limits are set not to create extra subflows. In this case, an
ADD_ADDRis sent, but no subflows are created. Still, the local endpoint is marked as used, and no warning is fired when removing the endpoint, after having sent aRM_ADDR.The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.Fixes 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set")Reviewed-by Mat Martineau <[email protected]>Signed-off-by Matthieu Baerts (NGI0) <[email protected]>Link https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-5-4b5462b6f016@kernel.org open hereSigned-off-by Jakub Kicinski <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh remove_tests() · line 2398
Quoted 10 lines
tools/testing/selftests/net/mptcp/mptcp_join.sh +7
-0@@ -2389,6 +2389,19 @@ remove_tests() chk_rst_nr 0 0 fi + # signal+subflow with limits, remove + if reset "remove signal+subflow with limits"; then + pm_nl_set_limits $ns1 0 0 + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,subflow + pm_nl_set_limits $ns2 0 0 + addr_nr_ns1=-1 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1
In this kernel version, these two lines should be replaced by:
run_tests $ns1 $ns2 10.0.1.1 0 -1 0 slow
If that's easier, you can drop this patch and I can resend it with the fix.
Cheers,
Matt
Signature · 1 line
Sponsored by the NGI0 Core fund.
Greg Kroah-Hartman
maintainerRe: [PATCH 6.1 095/481] selftests: mptcp: join: check removing signal+subflow endp
Quoted 55 lines · Matthieu Baerts
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
6.1-stable review patch. If anyone has any objections, please let me know.
I do!
Quoted 35 lines
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit
1777f349ff41b62dfe27454b69c27b0bc99ffca5upstream.This validates the previous commit: endpoints with both the signal and subflow flags should always be marked as used even if it was not possible to create new subflows due to the MPTCP PM limits.
For this test, an extra endpoint is created with both the signal and the subflow flags, and limits are set not to create extra subflows. In this case, an
ADD_ADDRis sent, but no subflows are created. Still, the local endpoint is marked as used, and no warning is fired when removing the endpoint, after having sent aRM_ADDR.The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.Fixes 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set")Reviewed-by Mat Martineau <[email protected]>Signed-off-by Matthieu Baerts (NGI0) <[email protected]>Link https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-5-4b5462b6f016@kernel.org open hereSigned-off-by Jakub Kicinski <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+)tools/testing/selftests/net/mptcp/mptcp_join.sh remove_tests() · line 2398
Quoted 10 lines
tools/testing/selftests/net/mptcp/mptcp_join.sh +7
-0@@ -2389,6 +2389,19 @@ remove_tests() chk_rst_nr 0 0 fi + # signal+subflow with limits, remove + if reset "remove signal+subflow with limits"; then + pm_nl_set_limits $ns1 0 0 + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,subflow + pm_nl_set_limits $ns2 0 0 + addr_nr_ns1=-1 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1In this kernel version, these two lines should be replaced by:
Quoted 3 lines
run_tests$ns1 $ns2 10.0.1.1 0 -1 0 slowIf that's easier, you can drop this patch and I can resend it with the fix.
I'll drop and wait for a new version from you, thanks!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 96/481 ARM: clean up the memset64() C wrapper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit b52343d1cb47bb27ca32a3f4952cc2fd3cd165bf upstream.
The current logic to split the 64-bit argument into its 32-bit halves is byte-order specific and a bit clunky. Use a union instead which is easier to read and works in all cases.
GCC still generates the same machine code.
While at it, rename the arguments of the __memset64() prototype to actually reflect their semantics.
--- arch/arm/include/asm/string.h | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
arch/arm/include/asm/string.h +9 -5
@@ -39,13 +39,17 @@ static inline void *memset32(uint32_t *p }#define __HAVE_ARCH_MEMSET64 -extern void *__memset64 (uint64_t *,uint32_t low,__kernel_size_t ,uint32_t hi); +extern void *__memset64 (uint64_t *,uint32_t first,__kernel_size_t ,uint32_t second);static inline void *memset64 (uint64_t *p,uint64_t v,__kernel_size_t n) { -if (IS_ENABLED (CONFIG_CPU_LITTLE_ENDIAN )) -return __memset64 (p, v, n *8 , v >>32 ); -else -return __memset64 (p, v >>32 , n *8 , v); +union { +uint64_t val; +struct { +uint32_t first, second; + }; + } word = { .val = v }; + +return __memset64 (p, word.first, n *8 , word.second); }/*
Greg Kroah-Hartman
maintainerPATCH 97/481 platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Teh <[email protected]>
[ Upstream commit 53e977b1d50c46f2c4ec3865cd13a822f58ad3cd ]
Check whether the battery supports the relevant charge threshold before reading the value to silence these errors:
thinkpad_acpi: acpi_evalf(BCTG, dd, ...) failed: AE_NOT_FOUND
ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCTG: evaluate failedthinkpad_acpi: acpi_evalf(BCSG, dd, ...) failed: AE_NOT_FOUND
ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCSG: evaluate failed
when reading the charge thresholds via sysfs on platforms that do not support them such as the ThinkPad T400.
--- drivers/platform/x86/thinkpad_acpi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +4 -2
@@ -9643,14 +9643,16 @@ static int tpacpi_battery_get(int what, int battery, int *ret) {switch (what) {case THRESHOLD_START : - if ACPI_FAILURE(tpacpi_battery_acpi_eval(GET_START, ret, battery)) +if (!battery_info.batteries[battery].start_support || +ACPI_FAILURE (tpacpi_battery_acpi_eval (GET_START , ret, battery)))return -ENODEV ;/* The value is in the low 8 bits of the response */ *ret = *ret &0xFF ;return 0 ;case THRESHOLD_STOP : - if ACPI_FAILURE(tpacpi_battery_acpi_eval(GET_STOP, ret, battery)) +if (!battery_info.batteries[battery].stop_support || +ACPI_FAILURE (tpacpi_battery_acpi_eval (GET_STOP , ret, battery)))return -ENODEV ;/* Value is in lower 8 bits */ *ret = *ret &0xFF ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/481 net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chintan Vankar <[email protected]>
[ Upstream commit be11a537224d72b906db6b98510619770298c8a4 ]
In the current implementation, flushing multicast entries in MAC mode incorrectly deletes entries for all ports instead of only the target port, disrupting multicast traffic on other ports. The cause is adding multicast entries by setting only host port bit, and not setting the MAC port bits.
Fix this by setting the MAC port's bit in the port mask while adding the multicast entry. Also fix the flush logic to preserve the host port bit during removal of MAC port and free ALE entries when mask contains only host port.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- drivers/net/ethernet/ti/cpsw_ale.c | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +1 -1
@@ -257,7 +257,7 @@ static void am65_cpsw_nuss_ndo_slave_set_rx_mode(struct net_device *ndev)cpsw_ale_set_allmulti (common->ale, ndev->flags &IFF_ALLMULTI , port->port_id); - port_mask =ALE_PORT_HOST ; + port_mask =BIT (port->port_id) |ALE_PORT_HOST ;/* Clear all mcast from ALE */ cpsw_ale_flush_multicast (common->ale, port_mask,-1 );
drivers/net/ethernet/ti/cpsw_ale.c +4 -5
@@ -422,14 +422,13 @@ static void cpsw_ale_flush_mcast(struct cpsw_ale *ale, u32 *ale_entry, ale->port_mask_bits);if ((mask & port_mask) ==0 )return ;/* ports dont intersect, not interested */ - mask &= ~port_mask; + mask &= (~port_mask |ALE_PORT_HOST ); -/* free if only remaining port is host port */ -if (mask) +if (mask ==0x0 || mask ==ALE_PORT_HOST ) +cpsw_ale_set_entry_type (ale_entry,ALE_TYPE_FREE ); +else cpsw_ale_set_port_mask (ale_entry, mask, ale->port_mask_bits); -else -cpsw_ale_set_entry_type (ale_entry,ALE_TYPE_FREE ); }int cpsw_ale_flush_multicast (struct cpsw_ale *ale,int port_mask,int vid)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/481 net: dpaa2: replace dpaa2_mac_is_type_fixed() with dpaa2_mac_is_type_phy()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 320fefa9e2edc67011e235ea1d50f0d00ddfe004 ]
dpaa2_mac_is_type_fixed() is a header with no implementation and no callers, which is referenced from the documentation though. It can be deleted.
On the other hand, it would be useful to reuse the code between dpaa2_eth_is_type_phy() and dpaa2_switch_port_is_type_phy(). That common code should be called dpaa2_mac_is_type_phy(), so let's create that.
The removal and the addition are merged into the same patch because, in fact, is_type_phy() is the logical opposite of is_type_fixed().
Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
--- .../ethernet/freescale/dpaa2/mac-phy-support.rst | 9 ++++++--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 7 +------ drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.h | 10 ++++++++-- drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h | 7 +------ 4 files changed, 16 insertions(+), 17 deletions(-)
Documentation/networking/device_drivers/ethernet/freescale/dpaa2/mac-phy-support.rst +6 -3
@@ -181,10 +181,13 @@ when necessary using the below listed API:: - int dpaa2_mac_connect(struct dpaa2_mac *mac); - void dpaa2_mac_disconnect(struct dpaa2_mac *mac); -A phylink integration is necessary only when the partner DPMAC is not of TYPE_FIXED. -One can check for this condition using the below API:: +A phylink integration is necessary only when the partner DPMAC is not of +``TYPE_FIXED``. This means it is either of ``TYPE_PHY``, or of +``TYPE_BACKPLANE`` (the difference being the two that in the ``TYPE_BACKPLANE`` +mode, the MC firmware does not access the PCS registers). One can check for +this condition using the following helper:: - - bool dpaa2_mac_is_type_fixed(struct fsl_mc_device *dpmac_dev,struct fsl_mc_io *mc_io); + - static inline bool dpaa2_mac_is_type_phy(struct dpaa2_mac *mac); Before connection to a MAC, the caller must allocate and populate the dpaa2_mac structure with the associated net_device, a pointer to the MC portal
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h +1 -6
@@ -733,12 +733,7 @@ static inline unsigned int dpaa2_eth_rx_head_room(struct dpaa2_eth_priv *priv)static inline bool dpaa2_eth_is_type_phy (struct dpaa2_eth_priv *priv) { -if (priv->mac && - (priv->mac->attr.link_type ==DPMAC_LINK_TYPE_PHY || - priv->mac->attr.link_type ==DPMAC_LINK_TYPE_BACKPLANE )) -return true; - -return false; +return dpaa2_mac_is_type_phy (priv->mac); }static inline bool dpaa2_eth_has_mac (struct dpaa2_eth_priv *priv)
drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.h +8 -2
@@ -30,8 +30,14 @@ struct dpaa2_mac {struct phy *serdes_phy; }; -bool dpaa2_mac_is_type_fixed (struct fsl_mc_device *dpmac_dev, -struct fsl_mc_io *mc_io); +static inline bool dpaa2_mac_is_type_phy (struct dpaa2_mac *mac) +{ +if (!mac) +return false; + +return mac->attr.link_type ==DPMAC_LINK_TYPE_PHY || + mac->attr.link_type ==DPMAC_LINK_TYPE_BACKPLANE ; +}int dpaa2_mac_open (struct dpaa2_mac *mac);
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h +1 -6
@@ -230,12 +230,7 @@ static inline bool dpaa2_switch_supports_cpu_traffic(struct ethsw_core *ethsw)static inline bool dpaa2_switch_port_is_type_phy (struct ethsw_port_priv *port_priv) { -if (port_priv->mac && - (port_priv->mac->attr.link_type ==DPMAC_LINK_TYPE_PHY || - port_priv->mac->attr.link_type ==DPMAC_LINK_TYPE_BACKPLANE )) -return true; - -return false; +return dpaa2_mac_is_type_phy (port_priv->mac); }static inline bool dpaa2_switch_port_has_mac (struct ethsw_port_priv *port_priv)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/481 net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 88d64367cea019fa6197d0d97a85ac90279919b7 ]
The dpaa2-switch has the exact same locking requirements when connected to a DPMAC, so it needs port_priv->mac to always point either to NULL, or to a DPMAC with a fully initialized phylink instance.
Make the same preparatory change in the dpaa2-switch driver as in the dpaa2-eth one.
Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
--- .../ethernet/freescale/dpaa2/dpaa2-switch.c | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +12 -9
@@ -1460,9 +1460,8 @@ static int dpaa2_switch_port_connect_mac(struct ethsw_port_priv *port_priv) err =dpaa2_mac_open (mac);if (err) goto err_free_mac; - port_priv->mac = mac; -if (dpaa2_switch_port_is_type_phy (port_priv)) { +if (dpaa2_mac_is_type_phy (mac)) { err =dpaa2_mac_connect (mac);if (err) { netdev_err(port_priv->netdev,
@@ -1472,11 +1471,12 @@ static int dpaa2_switch_port_connect_mac(struct ethsw_port_priv *port_priv) } } + port_priv->mac = mac; +return 0 ; err_close_mac:dpaa2_mac_close (mac); - port_priv->mac =NULL ; err_free_mac:kfree (mac); out_put_device:
@@ -1486,15 +1486,18 @@ static int dpaa2_switch_port_connect_mac(struct ethsw_port_priv *port_priv)static void dpaa2_switch_port_disconnect_mac (struct ethsw_port_priv *port_priv) { -if (dpaa2_switch_port_is_type_phy (port_priv)) -dpaa2_mac_disconnect (port_priv->mac); +struct dpaa2_mac *mac = port_priv->mac; -if (!dpaa2_switch_port_has_mac (port_priv)) + port_priv->mac =NULL ; + +if (!mac)return ; -dpaa2_mac_close (port_priv->mac); -kfree (port_priv->mac); - port_priv->mac =NULL ; +if (dpaa2_mac_is_type_phy (mac)) +dpaa2_mac_disconnect (mac); + +dpaa2_mac_close (mac); +kfree (mac); }static irqreturn_t dpaa2_switch_irq0_handler_thread (int irq_num,void *arg)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/481 net: dpaa2-switch replace direct MAC access with dpaa2_switch_port_has_mac()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit bc230671bfb25c2d3c225f674fe6c03cea88d22e ]
The helper function will gain a lockdep annotation in a future patch. Make sure to benefit from it.
Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c +1 -1
@@ -196,7 +196,7 @@ static void dpaa2_switch_ethtool_get_stats(struct net_device *netdev, dpaa2_switch_ethtool_counters[i].name, err); } -if (port_priv->mac) +if (dpaa2_switch_port_has_mac (port_priv))dpaa2_mac_get_ethtool_stats (port_priv->mac, data + i); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/481 net: dpaa2-switch: serialize changes to priv->mac with a mutex
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 3c7f44fa9c4c8a9154935ca49e4cf45c14240335 ]
The dpaa2-switch driver uses a DPMAC in the same way as the dpaa2-eth driver, so we need to duplicate the locking solution established by the previous change to the switch driver as well.
Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
--- .../freescale/dpaa2/dpaa2-switch-ethtool.c | 32 +++++++++++++++---- .../ethernet/freescale/dpaa2/dpaa2-switch.c | 31 ++++++++++++++++-- .../ethernet/freescale/dpaa2/dpaa2-switch.h | 2 ++ 3 files changed, 55 insertions(+), 10 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-ethtool.c +25 -7
@@ -60,11 +60,18 @@ dpaa2_switch_get_link_ksettings(struct net_device *netdev, {struct ethsw_port_priv *port_priv =netdev_priv (netdev);struct dpsw_link_state state = {0 }; -int err =0 ; +int err; + +mutex_lock (&port_priv->mac_lock); -if (dpaa2_switch_port_is_type_phy (port_priv)) -return phylink_ethtool_ksettings_get (port_priv->mac->phylink, - link_ksettings); +if (dpaa2_switch_port_is_type_phy (port_priv)) { + err =phylink_ethtool_ksettings_get (port_priv->mac->phylink, + link_ksettings); +mutex_unlock (&port_priv->mac_lock); +return err; + } + +mutex_unlock (&port_priv->mac_lock); err = dpsw_if_get_link_state(port_priv->ethsw_data->mc_io, 0, port_priv->ethsw_data->dpsw_handle,
@@ -99,9 +106,16 @@ dpaa2_switch_set_link_ksettings(struct net_device *netdev,bool if_running;int err =0 , ret; -if (dpaa2_switch_port_is_type_phy (port_priv)) -return phylink_ethtool_ksettings_set (port_priv->mac->phylink, - link_ksettings); +mutex_lock (&port_priv->mac_lock); + +if (dpaa2_switch_port_is_type_phy (port_priv)) { + err =phylink_ethtool_ksettings_set (port_priv->mac->phylink, + link_ksettings); +mutex_unlock (&port_priv->mac_lock); +return err; + } + +mutex_unlock (&port_priv->mac_lock);/* Interface needs to be down to change link settings */ if_running =netif_running (netdev);
@@ -196,8 +210,12 @@ static void dpaa2_switch_ethtool_get_stats(struct net_device *netdev, dpaa2_switch_ethtool_counters[i].name, err); } +mutex_lock (&port_priv->mac_lock); +if (dpaa2_switch_port_has_mac (port_priv))dpaa2_mac_get_ethtool_stats (port_priv->mac, data + i); + +mutex_unlock (&port_priv->mac_lock); }const struct ethtool_ops dpaa2_switch_port_ethtool_ops = {
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +28 -3
@@ -603,8 +603,11 @@ static int dpaa2_switch_port_link_state_update(struct net_device *netdev)/* When we manage the MAC/PHY using phylink there is no need * to manually update the netif_carrier. +* We can avoid locking because we are called from the "link changed" +* IRQ handler, which is the same as the "endpoint changed" IRQ handler +* (the writer to port_priv->mac), so we cannot race with it. */ -if (dpaa2_switch_port_is_type_phy (port_priv)) +if (dpaa2_mac_is_type_phy (port_priv->mac))return 0 ;/* Interrupts are received even though no one issued an 'ifconfig up'
@@ -684,6 +687,8 @@ static int dpaa2_switch_port_open(struct net_device *netdev)struct ethsw_core *ethsw = port_priv->ethsw_data;int err; +mutex_lock (&port_priv->mac_lock); +if (!dpaa2_switch_port_is_type_phy (port_priv)) {/* Explicitly set carrier off, otherwise * netif_carrier_ok() will return true and cause 'ip link show'
@@ -697,6 +702,7 @@ static int dpaa2_switch_port_open(struct net_device *netdev) port_priv->ethsw_data->dpsw_handle, port_priv->idx);if (err) { +mutex_unlock (&port_priv->mac_lock);netdev_err (netdev,"dpsw_if_enable err %d\n" , err);return err; }
@@ -708,6 +714,8 @@ static int dpaa2_switch_port_open(struct net_device *netdev)phylink_start (port_priv->mac->phylink); } +mutex_unlock (&port_priv->mac_lock); +return 0 ; }
@@ -717,6 +725,8 @@ static int dpaa2_switch_port_stop(struct net_device *netdev)struct ethsw_core *ethsw = port_priv->ethsw_data;int err; +mutex_lock (&port_priv->mac_lock); +if (dpaa2_switch_port_is_type_phy (port_priv)) {phylink_stop (port_priv->mac->phylink);dpaa2_mac_stop (port_priv->mac);
@@ -725,6 +735,8 @@ static int dpaa2_switch_port_stop(struct net_device *netdev)netif_carrier_off (netdev); } +mutex_unlock (&port_priv->mac_lock); + err =dpsw_if_disable (port_priv->ethsw_data->mc_io,0 , port_priv->ethsw_data->dpsw_handle, port_priv->idx);
@@ -1471,7 +1483,9 @@ static int dpaa2_switch_port_connect_mac(struct ethsw_port_priv *port_priv) } } +mutex_lock (&port_priv->mac_lock); port_priv->mac = mac; +mutex_unlock (&port_priv->mac_lock);return 0 ;
@@ -1486,9 +1500,12 @@ static int dpaa2_switch_port_connect_mac(struct ethsw_port_priv *port_priv)static void dpaa2_switch_port_disconnect_mac (struct ethsw_port_priv *port_priv) { -struct dpaa2_mac *mac = port_priv->mac; +struct dpaa2_mac *mac; +mutex_lock (&port_priv->mac_lock); + mac = port_priv->mac; port_priv->mac =NULL ; +mutex_unlock (&port_priv->mac_lock);if (!mac)return ;
@@ -1507,6 +1524,7 @@ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg)struct ethsw_port_priv *port_priv;u32 status = ~0 ;int err, if_id; +bool had_mac; err =dpsw_get_irq_status (ethsw->mc_io,0 , ethsw->dpsw_handle,DPSW_IRQ_INDEX_IF , &status);
@@ -1529,7 +1547,12 @@ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg)if (status &DPSW_IRQ_EVENT_ENDPOINT_CHANGED ) {rtnl_lock (); -if (dpaa2_switch_port_has_mac (port_priv)) +/* We can avoid locking because the "endpoint changed" IRQ +* handler is the only one who changes priv->mac at runtime, +* so we are not racing with anyone. +*/ + had_mac = !!port_priv->mac; +if (had_mac)dpaa2_switch_port_disconnect_mac (port_priv);else dpaa2_switch_port_connect_mac (port_priv);
@@ -3279,6 +3302,8 @@ static int dpaa2_switch_probe_port(struct ethsw_core *ethsw, port_priv->netdev = port_netdev; port_priv->ethsw_data = ethsw; +mutex_init (&port_priv->mac_lock); + port_priv->idx = port_idx; port_priv->stp_state =BR_STATE_FORWARDING ;
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.h +2 -0
@@ -161,6 +161,8 @@ struct ethsw_port_priv {struct dpaa2_switch_filter_block *filter_block;struct dpaa2_mac *mac; +/* Protects against changes to port_priv->mac */ +struct mutex mac_lock; };/* Switch data */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/481 dpaa2-switch: do not clear any interrupts automatically
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <[email protected]>
[ Upstream commit f6da276479c63ca29774bc331a537b92f0550c45 ]
The DPSW object has multiple event sources multiplexed over the same IRQ. The driver has the capability to configure only some of these events to trigger the IRQ.
The dpsw_get_irq_status() can clear events automatically based on the value stored in the 'status' variable passed to it. We don't want that to happen because we could get into a situation when we are clearing more events than we actually handled.
Just resort to manually clearing the events that we handled. Also, since status is not used on the out path we remove its initialization to zero.
This change does not have a user-visible effect because the dpaa2-switch driver enables and handles all the DPSW events which exist at the moment.
Stable-dep-of: 74badb9c20b1 ("dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler")
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +2 -2
@@ -1522,9 +1522,9 @@ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg)struct device *dev = (struct device *)arg;struct ethsw_core *ethsw =dev_get_drvdata (dev);struct ethsw_port_priv *port_priv; -u32 status = ~0 ;int err, if_id;bool had_mac; +u32 status; err =dpsw_get_irq_status (ethsw->mc_io,0 , ethsw->dpsw_handle,DPSW_IRQ_INDEX_IF , &status);
@@ -1559,12 +1559,12 @@ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg)rtnl_unlock (); } -out: err =dpsw_clear_irq_status (ethsw->mc_io,0 , ethsw->dpsw_handle,DPSW_IRQ_INDEX_IF , status);if (err)dev_err (dev,"Can't clear irq status (err %d)\n" , err); +out:return IRQ_HANDLED ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/481 dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 74badb9c20b1a9c02a95c735c6d3cd6121679c93 ]
Commit 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ handler") introduces a range check for if_id to avoid an out-of-bounds access. If an out-of-bounds if_id is detected, the interrupt status is not cleared. This may result in an interrupt storm.
Clear the interrupt status after detecting an out-of-bounds if_id to avoid the problem.
Found by an experimental AI code review agent at Google.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +2 -1
@@ -1536,7 +1536,7 @@ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg) if_id = (status &0xFFFF0000 ) >>16 ;if (if_id >= ethsw->sw_attr.num_ifs) {dev_err (dev,"Invalid if_id %d in IRQ status\n" , if_id); - goto out; + goto out_clear; } port_priv = ethsw->ports[if_id];
@@ -1559,6 +1559,7 @@ static irqreturn_t dpaa2_switch_irq0_handler_thread(int irq_num, void *arg)rtnl_unlock (); } +out_clear: err =dpsw_clear_irq_status (ethsw->mc_io,0 , ethsw->dpsw_handle,DPSW_IRQ_INDEX_IF , status);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/481 atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb ]
syzkaller reported a null-ptr-deref in lec_arp_clear_vccs(). This issue can be easily reproduced using the syzkaller reproducer.
In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc). When the underlying VCC is closed, lec_vcc_close() iterates over all ARP entries and calls lec_arp_clear_vccs() for each matched entry.
For example, when lec_vcc_close() iterates through the hlists in priv->lec_arp_empty_ones or other ARP tables:
1. In the first iteration, for the first matched ARP entry sharing the VCC, lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back) and sets vcc->user_back to NULL.
2. In the second iteration, for the next matched ARP entry sharing the same VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it via vcc->pop = vpriv->old_pop, leading to a null-ptr-deref crash.
Fix this by adding a null check for vpriv before dereferencing it. If vpriv is already NULL, it means the VCC has been cleared by a previous call, so we can safely skip the cleanup and just clear the entry's vcc/recv_vcc pointers.
The entire cleanup block (including vcc_release_async()) is placed inside the vpriv guard because a NULL vpriv indicates the VCC has already been fully released by a prior iteration — repeating the teardown would redundantly set flags and trigger callbacks on an already-closing socket.
The Fixes tag points to the initial commit because the entry->vcc path has been vulnerable since the original code. The entry->recv_vcc path was later added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back") with the same pattern, and both paths are fixed here.
--- net/atm/lec.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
net/atm/lec.c +15 -11
@@ -1260,24 +1260,28 @@ static void lec_arp_clear_vccs(struct lec_arp_table *entry)struct lec_vcc_priv *vpriv =LEC_VCC_PRIV (vcc);struct net_device *dev = (struct net_device *)vcc->proto_data; - vcc->pop = vpriv->old_pop; -if (vpriv->xoff) -netif_wake_queue (dev); -kfree (vpriv); - vcc->user_back =NULL ; - vcc->push = entry->old_push; -vcc_release_async (vcc, -EPIPE ); +if (vpriv) { + vcc->pop = vpriv->old_pop; +if (vpriv->xoff) +netif_wake_queue (dev); +kfree (vpriv); + vcc->user_back =NULL ; + vcc->push = entry->old_push; +vcc_release_async (vcc, -EPIPE ); + } entry->vcc =NULL ; }if (entry->recv_vcc) {struct atm_vcc *vcc = entry->recv_vcc;struct lec_vcc_priv *vpriv =LEC_VCC_PRIV (vcc); -kfree (vpriv); - vcc->user_back =NULL ; +if (vpriv) { +kfree (vpriv); + vcc->user_back =NULL ; - entry->recv_vcc->push = entry->old_recv_push; -vcc_release_async (entry->recv_vcc, -EPIPE ); + entry->recv_vcc->push = entry->old_recv_push; +vcc_release_async (entry->recv_vcc, -EPIPE ); + } entry->recv_vcc =NULL ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/481 can: bcm: fix locking for bcm_op runtime updates
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
[ Upstream commit c35636e91e392e1540949bbc67932167cb48bc3a ]
Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") added a locking for some variables that can be modified at runtime when updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().
Usually the RX_SETUP only handles and filters incoming traffic with one
exception: When the RX_RTR_FRAME flag is set a predefined CAN frame is sent when a specific RTR frame is received. Therefore the rx bcm_op uses bcm_can_tx() which uses the bcm_tx_lock that was only initialized in bcm_tx_setup(). Add the missing spin_lock_init() when allocating the bcm_op in bcm_rx_setup() to handle the RTR case properly.
--- net/can/bcm.c | 1 + 1 file changed, 1 insertion(+)
net/can/bcm.c +1 -0
@@ -1128,6 +1128,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (!op)return -ENOMEM ; +spin_lock_init (&op->bcm_tx_lock); op->can_id = msg_head->can_id; op->nframes = msg_head->nframes; op->cfsiz =CFSIZ (msg_head->flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/481 can: mcp251x: fix deadlock in error path of mcp251x_open
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Bedel <[email protected]>
[ Upstream commit ab3f894de216f4a62adc3b57e9191888cbf26885 ]
The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish.
This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can:
mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path.
To solve this issue move the call to free_irq() after the lock is released. Setting priv->force_quit = 1 beforehand ensure that the IRQ handler will exit right away once it acquired the lock.
--- drivers/net/can/spi/mcp251x.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/net/can/spi/mcp251x.c +14 -1
@@ -1202,6 +1202,7 @@ static int mcp251x_open(struct net_device *net) {struct mcp251x_priv *priv =netdev_priv (net);struct spi_device *spi = priv->spi; +bool release_irq = false;unsigned long flags =0 ;int ret;
@@ -1245,12 +1246,24 @@ static int mcp251x_open(struct net_device *net)return 0 ; out_free_irq: -free_irq (spi->irq, priv); +/* The IRQ handler might be running, and if so it will be waiting +* for the lock. But free_irq() must wait for the handler to finish +* so calling it here would deadlock. +* +* Setting priv->force_quit will let the handler exit right away +* without any access to the hardware. This make it safe to call +* free_irq() after the lock is released. +*/ + priv->force_quit =1 ; + release_irq = true; +mcp251x_hw_sleep (spi); out_close:mcp251x_power_enable (priv->transceiver,0 );close_candev (net);mutex_unlock (&priv->mcp_lock); +if (release_irq) +free_irq (spi->irq, priv);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/481 kunit: tool: print summary of failed tests if a few failed out of a lot
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Latypov <[email protected]>
[ Upstream commit f19dd011d8de6f0c1d20abea5158aa4f5d9cea44 ]
E.g. all the hw_breakpoint tests are failing right now. So if I run kunit.py run --altests --arch=x86_64, then I see
Quoted 1 line
Testing complete. Ran 408 tests: passed: 392, failed: 9, skipped: 7
Seeing which 9 tests failed out of the hundreds is annoying. If my terminal doesn't have scrollback support, I have to resort to looking at .kunit/test.log for the not ok lines.
Teach kunit.py to print a summarized list of failures if the # of tests reachs an arbitrary threshold (>=100 tests).
To try and keep the output from being too long/noisy, this new logic
a) just reports "parent_test failed" if every child test failed
b) won't print anything if there are >10 failures (also arbitrary).
With this patch, we get an extra line of output showing:
Quoted 2 lines
Testing complete. Ran 408 tests: passed: 392, failed: 9, skipped: 7
Failures:hw_breakpoint
This also works with parameterized tests, e.g. if I add a fake failure
Quoted 1 line
Failures: kcsan.test_atomic_builtins_missing_barrier.threads=6
Note: we didn't have enough tests for this to be a problem before. But with commit 980ac3ad0512 ("kunit: tool: rename all_test_uml.config, use it for --alltests"), --alltests works and thus running >100 tests will probably become more common.
Stable-dep-of: 40804c4974b8 ("kunit: tool: copy caller args in run_kernel to prevent mutation")
--- tools/testing/kunit/kunit_parser.py | 47 ++++++++++++++++++++++++++ tools/testing/kunit/kunit_tool_test.py | 22 ++++++++++++ 2 files changed, 69 insertions(+)
tools/testing/kunit/kunit_parser.py +47 -0
@@ -58,6 +58,10 @@ class Test: self.counts.errors += 1 stdout.print_with_timestamp(stdout.red('[ERROR]') + f' Test: {self.name}: {error_message}') + def ok_status(self) -> bool: + """Returns true if the status was ok, i.e. passed or skipped.""" + return self.status in (TestStatus.SUCCESS, TestStatus.SKIPPED) + class TestStatus(Enum): """An enumeration class to represent the status of a test.""" SUCCESS = auto()
@@ -565,6 +569,40 @@ def print_test_footer(test: Test) -> None: stdout.print_with_timestamp(format_test_divider(message, len(message) - stdout.color_len())) + + +def _summarize_failed_tests(test: Test) -> str: + """Tries to summarize all the failing subtests in `test`.""" + + def failed_names(test: Test, parent_name: str) -> List[str]: + # Note: we use 'main' internally for the top-level test. + if not parent_name or parent_name == 'main': + full_name = test.name + else: + full_name = parent_name + '.' + test.name + + if not test.subtests: # this is a leaf node + return [full_name] + + # If all the children failed, just say this subtest failed. + # Don't summarize it down "the top-level test failed", though. + failed_subtests = [sub for sub in test.subtests if not sub.ok_status()] + if parent_name and len(failed_subtests) == len(test.subtests): + return [full_name] + + all_failures = [] # type: List[str] + for t in failed_subtests: + all_failures.extend(failed_names(t, full_name)) + return all_failures + + failures = failed_names(test, '') + # If there are too many failures, printing them out will just be noisy. + if len(failures) > 10: # this is an arbitrary limit + return '' + + return 'Failures: ' + ', '.join(failures) + + def print_summary_line(test: Test) -> None: """ Prints summary line of test object. Color of line is dependent on
@@ -587,6 +625,15 @@ def print_summary_line(test: Test) -> None: color = stdout.red stdout.print_with_timestamp(color(f'Testing complete. {test.counts}')) + # Summarize failures that might have gone off-screen since we had a lot + # of tests (arbitrarily defined as >=100 for now). + if test.ok_status() or test.counts.total() < 100: + return + summarized = _summarize_failed_tests(test) + if not summarized: + return + stdout.print_with_timestamp(color(summarized)) + # Other methods: def bubble_up_test_results(test: Test) -> None:
tools/testing/kunit/kunit_tool_test.py +22 -0
@@ -309,6 +309,28 @@ class KUnitParserTest(unittest.TestCase): result.status) self.assertEqual('kunit-resource-test', result.subtests[0].name) + def test_summarize_failures(self): + output = """ + KTAP version 1 + 1..2 + # Subtest: all_failed_suite + 1..2 + not ok 1 - test1 + not ok 2 - test2 + not ok 1 - all_failed_suite + # Subtest: some_failed_suite + 1..2 + ok 1 - test1 + not ok 2 - test2 + not ok 1 - some_failed_suite + """ + result = kunit_parser.parse_run_tests(output.splitlines()) + self.assertEqual(kunit_parser.TestStatus.FAILURE, result.status) + + self.assertEqual(kunit_parser._summarize_failed_tests(result), + 'Failures: all_failed_suite, some_failed_suite.test2') + + def line_stream_from_strs(strs: Iterable[str]) -> kunit_parser.LineStream: return kunit_parser.LineStream(enumerate(strs, start=1))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/481 kunit: tool: make --json do nothing if --raw_ouput is set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Latypov <[email protected]>
[ Upstream commit 309e22effb741a8c65131a2694a49839fd685a27 ]
When --raw_output is set (to any value), we don't actually parse the test results. So asking to print the test results as json doesn't make sense.
We internally create a fake test with one passing subtest, so --json would actually print out something misleading.
This patch:
* Rewords the flag descriptions so hopefully this is more obvious.
* Also updates --raw_output's description to note the default behavior is to print out only "KUnit" results (actually any KTAP results)
* also renames and refactors some related logic for clarity (e.g. test_result => test, it's a kunit_parser.Test object).
Notably, this patch does not make it an error to specify --json and --raw_output together. This is an edge case, but I know of at least one wrapper around kunit.py that always sets --json. You'd never be able to use --raw_output with that wrapper.
Stable-dep-of: 40804c4974b8 ("kunit: tool: copy caller args in run_kernel to prevent mutation")
--- tools/testing/kunit/kunit.py | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-)
tools/testing/kunit/kunit.py +18 -16
@@ -192,12 +192,11 @@ def _map_to_overall_status(test_status: kunit_parser.TestStatus) -> KunitStatus: def parse_tests(request: KunitParseRequest, metadata: kunit_json.Metadata, input_data: Iterable[str]) -> Tuple[KunitResult, kunit_parser.Test]: parse_start = time.time() - test_result = kunit_parser.Test() - if request.raw_output: # Treat unparsed results as one passing test. - test_result.status = kunit_parser.TestStatus.SUCCESS - test_result.counts.passed = 1 + fake_test = kunit_parser.Test() + fake_test.status = kunit_parser.TestStatus.SUCCESS + fake_test.counts.passed = 1 output: Iterable[str] = input_data if request.raw_output == 'all':
@@ -206,14 +205,17 @@ def parse_tests(request: KunitParseRequest, metadata: kunit_json.Metadata, input output = kunit_parser.extract_tap_lines(output, lstrip=False) for line in output: print(line.rstrip()) + parse_time = time.time() - parse_start + return KunitResult(KunitStatus.SUCCESS, parse_time), fake_test - else: - test_result = kunit_parser.parse_run_tests(input_data) - parse_end = time.time() + + # Actually parse the test results. + test = kunit_parser.parse_run_tests(input_data) + parse_time = time.time() - parse_start if request.json: json_str = kunit_json.get_json_result( - test=test_result, + test=test, metadata=metadata) if request.json == 'stdout': print(json_str)
@@ -223,10 +225,10 @@ def parse_tests(request: KunitParseRequest, metadata: kunit_json.Metadata, input stdout.print_with_timestamp("Test results stored in %s" % os.path.abspath(request.json)) - if test_result.status != kunit_parser.TestStatus.SUCCESS: - return KunitResult(KunitStatus.TEST_FAILURE, parse_end - parse_start), test_result + if test.status != kunit_parser.TestStatus.SUCCESS: + return KunitResult(KunitStatus.TEST_FAILURE, parse_time), test - return KunitResult(KunitStatus.SUCCESS, parse_end - parse_start), test_result + return KunitResult(KunitStatus.SUCCESS, parse_time), test def run_tests(linux: kunit_kernel.LinuxSourceTree, request: KunitRequest) -> KunitResult:
@@ -359,14 +361,14 @@ def add_exec_opts(parser) -> None: choices=['suite', 'test']) def add_parse_opts(parser) -> None: - parser.add_argument('--raw_output', help='If set don\'t format output from kernel. ' - 'If set to --raw_output=kunit, filters to just KUnit output.', + parser.add_argument('--raw_output', help='If set don\'t parse output from kernel. ' + 'By default, filters to just KUnit output. Use ' + '--raw_output=all to show everything', type=str, nargs='?', const='all', default=None, choices=['all', 'kunit']) parser.add_argument('--json', nargs='?', - help='Stores test results in a JSON, and either ' - 'prints to stdout or saves to file if a ' - 'filename is specified', + help='Prints parsed test results as JSON to stdout or a file if ' + 'a filename is specified. Does nothing if --raw_output is set.', type=str, const='stdout', default=None, metavar='FILE')
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/481 kunit: tool: parse KTAP compliant test output
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rae Moar <[email protected]>
[ Upstream commit 434498a6bee3db729dbdb7f131f3506f4dca85e8 ]
Change the KUnit parser to be able to parse test output that complies with the KTAP version 1 specification format found here:
https://kernel.org/doc/html/latest/dev-tools/ktap.html. Ensure the parser is able to parse tests with the original KUnit test output format as well.
KUnit parser now accepts any of the following test output formats:
Original KUnit test output format:
TAP version 14
1..1
# Subtest: kunit-test-suite
1..3
ok 1 - kunit_test_1
ok 2 - kunit_test_2
ok 3 - kunit_test_3
# kunit-test-suite: pass:3 fail:0 skip:0 total:3
# Totals: pass:3 fail:0 skip:0 total:3
ok 1 - kunit-test-suite
KTAP version 1 test output format:
KTAP version 1
1..1
KTAP version 1
1..3
ok 1 kunit_test_1
ok 2 kunit_test_2
ok 3 kunit_test_3
ok 1 kunit-test-suite
New KUnit test output format (changes made in the next patch of this series):
KTAP version 1
1..1
KTAP version 1
# Subtest: kunit-test-suite
1..3
ok 1 kunit_test_1
ok 2 kunit_test_2
ok 3 kunit_test_3
# kunit-test-suite: pass:3 fail:0 skip:0 total:3
# Totals: pass:3 fail:0 skip:0 total:3
ok 1 kunit-test-suite
Stable-dep-of: 40804c4974b8 ("kunit: tool: copy caller args in run_kernel to prevent mutation")
--- tools/testing/kunit/kunit_parser.py | 79 ++++++++++++------- tools/testing/kunit/kunit_tool_test.py | 14 ++++ .../test_data/test_parse_ktap_output.log | 8 ++ .../test_data/test_parse_subtest_header.log | 7 ++ 4 files changed, 80 insertions(+), 28 deletions(-) create mode 100644 tools/testing/kunit/test_data/test_parse_ktap_output.log create mode 100644 tools/testing/kunit/test_data/test_parse_subtest_header.log
tools/testing/kunit/kunit_parser.py +51 -28
@@ -450,6 +450,7 @@ def parse_diagnostic(lines: LineStream) -> List[str]: - '# Subtest: [test name]' - '[ok|not ok] [test number] [-] [test name] [optional skip directive]' + - 'KTAP version [version number]' Parameters: lines - LineStream of KTAP output to parse
@@ -458,8 +459,9 @@ def parse_diagnostic(lines: LineStream) -> List[str]: Log of diagnostic lines """ log = [] # type: List[str] - while lines and not TEST_RESULT.match(lines.peek()) and not \ - TEST_HEADER.match(lines.peek()): + non_diagnostic_lines = [TEST_RESULT, TEST_HEADER, KTAP_START] + while lines and not any(re.match(lines.peek()) + for re in non_diagnostic_lines): log.append(lines.pop()) return log
@@ -505,11 +507,15 @@ def print_test_header(test: Test) -> None: test - Test object representing current test being printed """ message = test.name + if message != "": + # Add a leading space before the subtest counts only if a test name + # is provided using a "# Subtest" header line. + message += " " if test.expected_count: if test.expected_count == 1: - message += ' (1 subtest)' + message += '(1 subtest)' else: - message += f' ({test.expected_count} subtests)' + message += f'({test.expected_count} subtests)' stdout.print_with_timestamp(format_test_divider(message, len(message))) def print_log(log: Iterable[str]) -> None:
@@ -656,7 +662,7 @@ def bubble_up_test_results(test: Test) -> None: elif test.counts.get_status() == TestStatus.TEST_CRASHED: test.status = TestStatus.TEST_CRASHED -def parse_test(lines: LineStream, expected_num: int, log: List[str]) -> Test: +def parse_test(lines: LineStream, expected_num: int, log: List[str], is_subtest: bool) -> Test: """ Finds next test to parse in LineStream, creates new Test object, parses any subtests of the test, populates Test object with all
@@ -674,15 +680,32 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str]) -> Test: 1..4 [subtests] - - Subtest header line + - Subtest header (must include either the KTAP version line or + "# Subtest" header line) - Example: + Example (preferred format with both KTAP version line and + "# Subtest" line): + + KTAP version 1 + # Subtest: name + 1..3 + [subtests] + ok 1 name + + Example (only "# Subtest" line): # Subtest: name 1..3 [subtests] ok 1 name + Example (only KTAP version line, compliant with KTAP v1 spec): + + KTAP version 1 + 1..3 + [subtests] + ok 1 name + - Test result line Example:
@@ -694,28 +717,29 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str]) -> Test: expected_num - expected test number for test to be parsed log - list of strings containing any preceding diagnostic lines corresponding to the current test + is_subtest - boolean indicating whether test is a subtest Return: Test object populated with characteristics and any subtests """ test = Test() test.log.extend(log) - parent_test = False - main = parse_ktap_header(lines, test) - if main: - # If KTAP/TAP header is found, attempt to parse + if not is_subtest: + # If parsing the main/top-level test, parse KTAP version line and # test plan test.name = "main" + ktap_line = parse_ktap_header(lines, test) parse_test_plan(lines, test) parent_test = True else: - # If KTAP/TAP header is not found, test must be subtest - # header or test result line so parse attempt to parser - # subtest header - parent_test = parse_test_header(lines, test) + # If not the main test, attempt to parse a test header containing + # the KTAP version line and/or subtest header line + ktap_line = parse_ktap_header(lines, test) + subtest_line = parse_test_header(lines, test) + parent_test = (ktap_line or subtest_line) if parent_test: - # If subtest header is found, attempt to parse - # test plan and print header + # If KTAP version line and/or subtest header is found, attempt + # to parse test plan and print test header parse_test_plan(lines, test) print_test_header(test) expected_count = test.expected_count
@@ -730,7 +754,7 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str]) -> Test: sub_log = parse_diagnostic(lines) sub_test = Test() if not lines or (peek_test_name_match(lines, test) and - not main): + is_subtest): if expected_count and test_num <= expected_count: # If parser reaches end of test before # parsing expected number of subtests, print
@@ -744,20 +768,19 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str]) -> Test: test.log.extend(sub_log) break else: - sub_test = parse_test(lines, test_num, sub_log) + sub_test = parse_test(lines, test_num, sub_log, True) subtests.append(sub_test) test_num += 1 test.subtests = subtests - if not main: + if is_subtest: # If not main test, look for test result line test.log.extend(parse_diagnostic(lines)) - if (parent_test and peek_test_name_match(lines, test)) or \ - not parent_test: - parse_test_result(lines, test, expected_num) - else: + if test.name != "" and not peek_test_name_match(lines, test): test.add_error('missing subtest result line!') + else: + parse_test_result(lines, test, expected_num) - # Check for there being no tests + # Check for there being no subtests within parent test if parent_test and len(subtests) == 0: # Don't override a bad status if this test had one reported. # Assumption: no subtests means CRASHED is from Test.__init__()
@@ -767,11 +790,11 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str]) -> Test: # Add statuses to TestCounts attribute in Test object bubble_up_test_results(test) - if parent_test and not main: + if parent_test and is_subtest: # If test has subtests and is not the main test object, print # footer. print_test_footer(test) - elif not main: + elif is_subtest: print_test_result(test) return test
@@ -794,7 +817,7 @@ def parse_run_tests(kernel_output: Iterable[str]) -> Test: test.add_error('could not find any KTAP output!') test.status = TestStatus.FAILURE_TO_PARSE_TESTS else: - test = parse_test(lines, 0, []) + test = parse_test(lines, 0, [], False) if test.status != TestStatus.NO_TESTS: test.status = test.counts.get_status() stdout.print_with_timestamp(DIVIDER)
tools/testing/kunit/kunit_tool_test.py +14 -0
@@ -330,6 +330,20 @@ class KUnitParserTest(unittest.TestCase): self.assertEqual(kunit_parser._summarize_failed_tests(result), 'Failures: all_failed_suite, some_failed_suite.test2') + def test_ktap_format(self): + ktap_log = test_data_path('test_parse_ktap_output.log') + with open(ktap_log) as file: + result = kunit_parser.parse_run_tests(file.readlines()) + self.assertEqual(result.counts, kunit_parser.TestCounts(passed=3)) + self.assertEqual('suite', result.subtests[0].name) + self.assertEqual('case_1', result.subtests[0].subtests[0].name) + self.assertEqual('case_2', result.subtests[0].subtests[1].name) + + def test_parse_subtest_header(self): + ktap_log = test_data_path('test_parse_subtest_header.log') + with open(ktap_log) as file: + result = kunit_parser.parse_run_tests(file.readlines()) + self.print_mock.assert_any_call(StrContains('suite (1 subtest)')) def line_stream_from_strs(strs: Iterable[str]) -> kunit_parser.LineStream: return kunit_parser.LineStream(enumerate(strs, start=1))
tools/testing/kunit/test_data/test_parse_ktap_output.log new file +8 -0
@@ -0,0 +1,8 @@ +KTAP version 1 +1..1 + KTAP version 1 + 1..3 + ok 1 case_1 + ok 2 case_2 + ok 3 case_3 +ok 1 suite
tools/testing/kunit/test_data/test_parse_subtest_header.log new file +7 -0
@@ -0,0 +1,7 @@ +KTAP version 1 +1..1 + KTAP version 1 + # Subtest: suite + 1..1 + ok 1 test +ok 1 suite
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/481 kunit: tool: dont include KTAP headers and the like in the test log
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Latypov <[email protected]>
[ Upstream commit 5937e0c04afc7d4b7b737fda93316ba4b74183c0 ]
We print the "test log" on failure.
This is meant to be all the kernel output that happened during the test.
But we also include the special KTAP lines in it, which are often redundant.
E.g. we include the "not ok" line in the log, right before we print that the test case failed...
[13:51:48] Expected 2 + 1 == 2, but
[13:51:48] 2 + 1 == 3 (0x3)
[13:51:48] not ok 1 example_simple_test
[13:51:48] [FAILED] example_simple_test
More full example after this patch:
[13:51:48] =================== example (4 subtests) =================== [13:51:48] # example_simple_test: initializing
[13:51:48] # example_simple_test: EXPECTATION FAILED at lib/kunit/kunit-example-test.c:29 [13:51:48] Expected 2 + 1 == 2, but
[13:51:48] 2 + 1 == 3 (0x3)
[13:51:48] [FAILED] example_simple_test
Stable-dep-of: 40804c4974b8 ("kunit: tool: copy caller args in run_kernel to prevent mutation")
--- tools/testing/kunit/kunit_parser.py | 8 ++++---- tools/testing/kunit/kunit_tool_test.py | 17 +++++++++++++++++ 2 files changed, 21 insertions(+), 4 deletions(-)
tools/testing/kunit/kunit_parser.py +4 -4
@@ -304,7 +304,7 @@ def parse_ktap_header(lines: LineStream, test: Test) -> bool: check_version(version_num, TAP_VERSIONS, 'TAP', test) else: return False - test.log.append(lines.pop()) + lines.pop() return True TEST_HEADER = re.compile(r'^# Subtest: (.*)$')
@@ -327,8 +327,8 @@ def parse_test_header(lines: LineStream, test: Test) -> bool: match = TEST_HEADER.match(lines.peek()) if not match: return False - test.log.append(lines.pop()) test.name = match.group(1) + lines.pop() return True TEST_PLAN = re.compile(r'1\.\.([0-9]+)')
@@ -354,9 +354,9 @@ def parse_test_plan(lines: LineStream, test: Test) -> bool: if not match: test.expected_count = None return False - test.log.append(lines.pop()) expected_count = int(match.group(1)) test.expected_count = expected_count + lines.pop() return True TEST_RESULT = re.compile(r'^(ok|not ok) ([0-9]+) (- )?([^#]*)( # .*)?$')
@@ -418,7 +418,7 @@ def parse_test_result(lines: LineStream, test: Test, # Check if line matches test result line format if not match: return False - test.log.append(lines.pop()) + lines.pop() # Set name of test object if skip_match:
tools/testing/kunit/kunit_tool_test.py +17 -0
@@ -81,6 +81,10 @@ class KconfigTest(unittest.TestCase): class KUnitParserTest(unittest.TestCase): + def noPrintCallContains(self, substr: str): + for call in self.print_mock.mock_calls: + self.assertNotIn(substr, call.args[0]) + def assertContains(self, needle: str, haystack: kunit_parser.LineStream): # Clone the iterator so we can print the contents on failure. copy, backup = itertools.tee(haystack)
@@ -345,6 +349,19 @@ class KUnitParserTest(unittest.TestCase): result = kunit_parser.parse_run_tests(file.readlines()) self.print_mock.assert_any_call(StrContains('suite (1 subtest)')) + def test_show_test_output_on_failure(self): + output = """ + KTAP version 1 + 1..1 + Test output. + not ok 1 test1 + """ + result = kunit_parser.parse_run_tests(output.splitlines()) + self.assertEqual(kunit_parser.TestStatus.FAILURE, result.status) + + self.print_mock.assert_any_call(StrContains('Test output.')) + self.noPrintCallContains('not ok 1 test1') + def line_stream_from_strs(strs: Iterable[str]) -> kunit_parser.LineStream: return kunit_parser.LineStream(enumerate(strs, start=1))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/481 kunit: tool: make parser preserve whitespace when printing test log
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Latypov <[email protected]>
[ Upstream commit c2bb92bc4ea13842fdd27819c0d5b48df2b86ea5 ]
Currently, kunit_parser.py is stripping all leading whitespace to make parsing easier. But this means we can't accurately show kernel output for failing tests or when the kernel crashes.
Embarassingly, this affects even KUnit's own output, e.g. [13:40:46] Expected 2 + 1 == 2, but
[13:40:46] 2 + 1 == 3 (0x3)
[13:40:46] not ok 1 example_simple_test [13:40:46] [FAILED] example_simple_test
After this change, here's what the output in context would look like [13:40:46] =================== example (4 subtests) =================== [13:40:46] # example_simple_test: initializing
[13:40:46] # example_simple_test: EXPECTATION FAILED at lib/kunit/kunit-example-test.c:29 [13:40:46] Expected 2 + 1 == 2, but
[13:40:46] 2 + 1 == 3 (0x3)
[13:40:46] [FAILED] example_simple_test
[13:40:46] [SKIPPED] example_skip_test
[13:40:46] [SKIPPED] example_mark_skipped_test
[13:40:46] [PASSED] example_all_expect_macros_test
[13:40:46] # example: initializing suite
[13:40:46] # example: pass:1 fail:1 skip:2 total:4
[13:40:46] # Totals: pass:1 fail:1 skip:2 total:4
[13:40:46] ===================== [FAILED] example =====================
This example shows one minor cosmetic defect this approach has. The test counts lines prevent us from dedenting the suite-level output. But at the same time, any form of non-KUnit output would do the same unless it happened to be indented as well.
Stable-dep-of: 40804c4974b8 ("kunit: tool: copy caller args in run_kernel to prevent mutation")
--- tools/testing/kunit/kunit.py | 2 +- tools/testing/kunit/kunit_parser.py | 27 +++++++++++++------------- tools/testing/kunit/kunit_tool_test.py | 2 ++ 3 files changed, 16 insertions(+), 15 deletions(-)
tools/testing/kunit/kunit.py +1 -1
@@ -202,7 +202,7 @@ def parse_tests(request: KunitParseRequest, metadata: kunit_json.Metadata, input if request.raw_output == 'all': pass elif request.raw_output == 'kunit': - output = kunit_parser.extract_tap_lines(output, lstrip=False) + output = kunit_parser.extract_tap_lines(output) for line in output: print(line.rstrip()) parse_time = time.time() - parse_start
tools/testing/kunit/kunit_parser.py +13 -14
@@ -12,6 +12,7 @@ from __future__ import annotations import re import sys +import textwrap from enum import Enum, auto from typing import Iterable, Iterator, List, Optional, Tuple
@@ -217,12 +218,12 @@ class LineStream: # Parsing helper methods: -KTAP_START = re.compile(r'KTAP version ([0-9]+)$') -TAP_START = re.compile(r'TAP version ([0-9]+)$') -KTAP_END = re.compile('(List of all partitions:|' +KTAP_START = re.compile(r'\s*KTAP version ([0-9]+)$') +TAP_START = re.compile(r'\s*TAP version ([0-9]+)$') +KTAP_END = re.compile(r'\s*(List of all partitions:|' 'Kernel panic - not syncing: VFS:|reboot: System halted)') -def extract_tap_lines(kernel_output: Iterable[str], lstrip=True) -> LineStream: +def extract_tap_lines(kernel_output: Iterable[str]) -> LineStream: """Extracts KTAP lines from the kernel output.""" def isolate_ktap_output(kernel_output: Iterable[str]) \ -> Iterator[Tuple[int, str]]:
@@ -248,11 +249,8 @@ def extract_tap_lines(kernel_output: Iterable[str], lstrip=True) -> LineStream: # stop extracting KTAP lines break elif started: - # remove the prefix and optionally any leading - # whitespace. Our parsing logic relies on this. + # remove the prefix, if any. line = line[prefix_len:] - if lstrip: - line = line.lstrip() yield line_num, line return LineStream(lines=isolate_ktap_output(kernel_output))
@@ -307,7 +305,7 @@ def parse_ktap_header(lines: LineStream, test: Test) -> bool: lines.pop() return True -TEST_HEADER = re.compile(r'^# Subtest: (.*)$') +TEST_HEADER = re.compile(r'^\s*# Subtest: (.*)$') def parse_test_header(lines: LineStream, test: Test) -> bool: """
@@ -331,7 +329,7 @@ def parse_test_header(lines: LineStream, test: Test) -> bool: lines.pop() return True -TEST_PLAN = re.compile(r'1\.\.([0-9]+)') +TEST_PLAN = re.compile(r'^\s*1\.\.([0-9]+)') def parse_test_plan(lines: LineStream, test: Test) -> bool: """
@@ -359,9 +357,9 @@ def parse_test_plan(lines: LineStream, test: Test) -> bool: lines.pop() return True -TEST_RESULT = re.compile(r'^(ok|not ok) ([0-9]+) (- )?([^#]*)( # .*)?$') +TEST_RESULT = re.compile(r'^\s*(ok|not ok) ([0-9]+) (- )?([^#]*)( # .*)?$') -TEST_RESULT_SKIP = re.compile(r'^(ok|not ok) ([0-9]+) (- )?(.*) # SKIP(.*)$') +TEST_RESULT_SKIP = re.compile(r'^\s*(ok|not ok) ([0-9]+) (- )?(.*) # SKIP(.*)$') def peek_test_name_match(lines: LineStream, test: Test) -> bool: """
@@ -520,8 +518,9 @@ def print_test_header(test: Test) -> None: def print_log(log: Iterable[str]) -> None: """Prints all strings in saved log for test in yellow.""" - for m in log: - stdout.print_with_timestamp(stdout.yellow(m)) + formatted = textwrap.dedent('\n'.join(log)) + for line in formatted.splitlines(): + stdout.print_with_timestamp(stdout.yellow(line)) def format_test_result(test: Test) -> str: """
tools/testing/kunit/kunit_tool_test.py +2 -0
@@ -354,12 +354,14 @@ class KUnitParserTest(unittest.TestCase): KTAP version 1 1..1 Test output. + Indented more. not ok 1 test1 """ result = kunit_parser.parse_run_tests(output.splitlines()) self.assertEqual(kunit_parser.TestStatus.FAILURE, result.status) self.print_mock.assert_any_call(StrContains('Test output.')) + self.print_mock.assert_any_call(StrContains(' Indented more.')) self.noPrintCallContains('not ok 1 test1') def line_stream_from_strs(strs: Iterable[str]) -> kunit_parser.LineStream:
Signature · 1 line
2.51.0